vpndetection 4.2.0 → 5.1.0

package/dist/generated/types.gen.d.ts

@@ -84,6 +84,50 @@ export type LookupResponse = {
      */
     mobproxy?: ProxyDetail;
 };
+export type BatchLookupRequest = {
+    /**
+     * The addresses to classify, 1 to 1000 per call, counted before
+     * duplicates collapse. Each distinct string is one lookup.
+     *
+     */
+    ips: Array<string>;
+};
+export type BatchLookupResponse = {
+    /**
+     * One answer per input string that was classified, keyed by the string
+     * as you sent it; the `ip` inside is the normalized form. Each value is
+     * exactly what `GET /{ip}` answers for your plan.
+     *
+     */
+    results: {
+        [key: string]: LookupResponse;
+    };
+    /**
+     * One entry per input string that could not be classified, keyed the
+     * same way. Empty when every entry was answered.
+     *
+     */
+    errors: {
+        [key: string]: BatchLookupError;
+    };
+};
+/**
+ * Why one entry of a batch was not answered, as the single lookup would have reported it.
+ */
+export type BatchLookupError = {
+    /**
+     * The HTTP status `GET /{ip}` would have answered for this entry: `400`
+     * for a string that is not an address, `429` for a spent allowance,
+     * `500` when the VPN dataset could not be consulted. A `429` here is
+     * never a throttle; the whole call is refused instead.
+     *
+     */
+    status: number;
+    /**
+     * The same message the single lookup carries for that status.
+     */
+    error: string;
+};
 /**
  * What is known about the VPN attribution. Every key is present when the
  * object is populated, empty values included; the object is `{}` when
@@ -199,7 +243,11 @@ export type DatabaseFormat = 'csvgz' | 'mmdb';
 export type DatabaseFormatSize = {
     format: DatabaseFormat;
     /**
-     * Size of the published file, or null when it has not been published yet
+     * Size of the published file, or null when it has not been published
+     * yet. int64 because it is not hypothetical: resproxy_ip_14d's MMDB is
+     * 4.58 GB, so a 32-bit field cannot carry the catalogue and `list`
+     * throws for every caller rather than for that one entry.
+     *
      */
     bytes: number | null;
 };
@@ -277,6 +325,8 @@ export type Download = {
     /**
      * Object size at redirect time, NOT bytes delivered: the transfer is a
      * presigned redirect straight to object storage, so we never observe it.
+     * int64 for the same reason as DatabaseFormatSize.bytes - it is the
+     * size of the same object.
      *
      */
     bytes: number | null;
@@ -347,21 +397,21 @@ export type DatabaseMetadata = {
      */
     sample_entries?: number;
 };
-export type AccountMe = {
+export type Entitlement = {
     /**
      * The organization the key belongs to.
      */
     org_id: string;
-    apikey: AccountApikey;
-    plan: AccountPlan;
-    usage: AccountUsage;
+    apikey: EntitlementApikey;
+    plan: EntitlementPlan;
+    usage: EntitlementUsage;
 };
 /**
  * The credential itself. The key is never echoed - only its id, which is
  * what the console shows and what you can act on.
  *
  */
-export type AccountApikey = {
+export type EntitlementApikey = {
     id: string;
     /**
      * Null for a key with no end date, which is the normal case.
@@ -374,7 +424,7 @@ export type AccountApikey = {
      */
     allowed_cidrs: Array<string>;
 };
-export type AccountPlan = {
+export type EntitlementPlan = {
     /**
      * The plan the organization is on.
      */
@@ -387,7 +437,7 @@ export type AccountPlan = {
      */
     tier: 'free' | 'starter' | 'scale' | 'max';
 };
-export type AccountUsage = {
+export type EntitlementUsage = {
     /**
      * Requests counted in the current window. The same number the lookup
      * API gates on, and it can lag by a few seconds.
@@ -414,9 +464,175 @@ export type AccountUsage = {
      */
     window_end: string;
 };
-export type AccountError = {
+export type EntitlementError = {
     error: string;
 };
+export type AccountRc = {
+    /**
+     * The outcome. `SUCCESS` on success; otherwise the reason.
+     */
+    rc: string;
+};
+export type Identity = {
+    rc: string;
+    user: AccountUser;
+    org: AccountOrgRef;
+    /**
+     * What this credential may do right now.
+     */
+    scopes: Array<string>;
+};
+export type AccountUser = {
+    id: string;
+    fullname?: string;
+    email?: string;
+};
+export type AccountOrgRef = {
+    id: string;
+};
+export type AccountOrgWrap = {
+    rc: string;
+    org: AccountOrg;
+};
+export type AccountOrg = {
+    id: string;
+    name?: string;
+    created?: string | null;
+};
+export type ApikeyList = {
+    rc: string;
+    keys: Array<ApikeyDetail>;
+};
+/**
+ * Key METADATA. Never the key itself.
+ */
+export type ApikeyDetail = {
+    id: string;
+    name: string;
+    /**
+     * The leading, non-secret part, so a key is recognisable without storing it.
+     */
+    key_prefix: string;
+    created: string;
+    expires?: string | null;
+    last_used_at?: string | null;
+    revoked_at?: string | null;
+    /**
+     * Source-IP allowlist. EMPTY MEANS UNRESTRICTED, not deny-all.
+     */
+    allowed_cidrs?: Array<string>;
+    allowed_scopes?: Array<string>;
+    /**
+     * Whether this key's secret can still be read back. False permanently for a key issued before secrets were stored recoverably.
+     */
+    retrievable?: boolean;
+};
+export type AccountCreateApikeyRequest = {
+    /**
+     * A label you will recognise later. Shown wherever the key is listed.
+     */
+    name: string;
+    /**
+     * What the new key may do. Omit for a key that carries no named scope, which is the safe default.
+     */
+    allowed_scopes?: Array<string>;
+};
+export type AccountCreatedApikey = {
+    rc: string;
+    id: string;
+    name?: string;
+    /**
+     * The secret. Returned once, here, and never again.
+     */
+    key: string;
+    key_prefix?: string;
+    allowed_cidrs?: Array<string>;
+    allowed_scopes?: Array<string>;
+};
+export type AccountRevealedApikey = {
+    rc: string;
+    /**
+     * The secret.
+     */
+    key: string;
+};
+export type OauthMetadata = {
+    issuer: string;
+    authorization_endpoint: string;
+    token_endpoint: string;
+    device_authorization_endpoint?: string;
+    revocation_endpoint?: string;
+    scopes_supported?: Array<string>;
+    response_types_supported?: Array<string>;
+    grant_types_supported?: Array<string>;
+    code_challenge_methods_supported?: Array<string>;
+    /**
+     * A client_id may be an https URL serving your client metadata.
+     */
+    client_id_metadata_document_supported?: boolean;
+};
+export type DeviceAuthorizationRequest = {
+    client_id: string;
+    /**
+     * Space-delimited. Anything your client is not registered for is dropped rather than refused.
+     */
+    scope?: string;
+    /**
+     * RFC 8707: what the token is for.
+     */
+    resource?: string;
+};
+export type DeviceAuthorization = {
+    /**
+     * Yours. Poll with it; never show it to anyone.
+     */
+    device_code: string;
+    /**
+     * Short and typable. This is what the person confirms.
+     */
+    user_code: string;
+    verification_uri: string;
+    /**
+     * The same page with the code already filled in.
+     */
+    verification_uri_complete?: string;
+    expires_in: number;
+    /**
+     * Seconds between polls.
+     */
+    interval: number;
+};
+export type TokenRequest = {
+    grant_type: string;
+    client_id: string;
+    device_code?: string;
+    code?: string;
+    code_verifier?: string;
+    redirect_uri?: string;
+    refresh_token?: string;
+};
+export type TokenResponse = {
+    access_token: string;
+    token_type: string;
+    expires_in: number;
+    refresh_token?: string;
+    /**
+     * What was actually granted, which may be narrower than what was asked for.
+     */
+    scope?: string;
+};
+export type RevokeRequest = {
+    token: string;
+    client_id?: string;
+};
+export type OauthError = {
+    error: string;
+    error_description?: string;
+};
+/**
+ * The key's id, as returned by the list endpoint. Never the key itself.
+ */
+export type ApikeyIdParam = string;
 export type LookupIpData = {
     body?: never;
     path: {
@@ -503,6 +719,50 @@ export type LookupMyIpResponses = {
     200: LookupResponse;
 };
 export type LookupMyIpResponse = LookupMyIpResponses[keyof LookupMyIpResponses];
+export type LookupBatchData = {
+    body: BatchLookupRequest;
+    path?: never;
+    query?: never;
+    url: '/batch';
+};
+export type LookupBatchErrors = {
+    /**
+     * The body is not a batch, or names too few or too many addresses.
+     */
+    400: LookupError;
+    /**
+     * The presented API key is unknown, revoked, or expired.
+     */
+    401: LookupError;
+    /**
+     * The key restricts which source addresses may use it, and this
+     * request did not come from one of them.
+     *
+     */
+    403: LookupError;
+    /**
+     * The body is larger than any batch of 1000 addresses can be.
+     */
+    413: LookupError;
+    /**
+     * The rate limit refused the whole call. Always transient and always
+     * with `Retry-After`; a spent allowance is reported per entry in a
+     * `200` instead.
+     *
+     */
+    429: LookupError;
+};
+export type LookupBatchError = LookupBatchErrors[keyof LookupBatchErrors];
+export type LookupBatchResponses = {
+    /**
+     * One entry per distinct input string, in `results` or in `errors`.
+     * Present fields within a result are those your plan includes; see the
+     * tier table in the API description.
+     *
+     */
+    200: BatchLookupResponse;
+};
+export type LookupBatchResponse = LookupBatchResponses[keyof LookupBatchResponses];
 export type ListDatabasesData = {
     body?: never;
     path?: never;
@@ -667,36 +927,379 @@ export type ListDownloadsResponses = {
     };
 };
 export type ListDownloadsResponse = ListDownloadsResponses[keyof ListDownloadsResponses];
-export type AccountMeData = {
+export type MyEntitlementData = {
     body?: never;
     path?: never;
     query?: never;
-    url: '/api/v1/account/me';
+    url: '/api/v1/entitlement';
 };
-export type AccountMeErrors = {
+export type MyEntitlementErrors = {
     /**
      * No key was presented, or it is unknown, revoked or expired.
      */
-    401: AccountError;
+    401: EntitlementError;
     /**
      * The key restricts which source addresses may use it, and this
      * request did not come from one of them.
      *
      */
-    403: AccountError;
+    403: EntitlementError;
     /**
      * The usage counters could not be read. Reported rather than guessed
      * at: the whole answer is the number, and a confident zero would read
      * as "you have used nothing".
      *
      */
-    503: AccountError;
+    503: EntitlementError;
 };
-export type AccountMeError = AccountMeErrors[keyof AccountMeErrors];
-export type AccountMeResponses = {
+export type MyEntitlementError = MyEntitlementErrors[keyof MyEntitlementErrors];
+export type MyEntitlementResponses = {
     /**
      * The key's entitlements and consumption.
      */
-    200: AccountMe;
+    200: Entitlement;
+};
+export type MyEntitlementResponse = MyEntitlementResponses[keyof MyEntitlementResponses];
+export type AccountIdentityData = {
+    body?: never;
+    path?: never;
+    query?: never;
+    url: '/api/v1/iam/identity';
+};
+export type AccountIdentityErrors = {
+    /**
+     * No credential was presented, or it is not valid.
+     */
+    401: AccountRc;
+    /**
+     * The credential does not hold the scope this endpoint requires. The
+     * missing scope is deliberately not named.
+     *
+     */
+    403: AccountRc;
+};
+export type AccountIdentityError = AccountIdentityErrors[keyof AccountIdentityErrors];
+export type AccountIdentityResponses = {
+    /**
+     * The caller.
+     */
+    200: Identity;
+};
+export type AccountIdentityResponse = AccountIdentityResponses[keyof AccountIdentityResponses];
+export type AccountOrgData = {
+    body?: never;
+    path?: never;
+    query?: never;
+    url: '/api/v1/iam/org';
+};
+export type AccountOrgErrors = {
+    /**
+     * No credential was presented, or it is not valid.
+     */
+    401: AccountRc;
+    /**
+     * The credential does not hold the scope this endpoint requires. The
+     * missing scope is deliberately not named.
+     *
+     */
+    403: AccountRc;
+};
+export type AccountOrgError = AccountOrgErrors[keyof AccountOrgErrors];
+export type AccountOrgResponses = {
+    /**
+     * The organization.
+     */
+    200: AccountOrgWrap;
+};
+export type AccountOrgResponse = AccountOrgResponses[keyof AccountOrgResponses];
+export type AccountOrgMembersData = {
+    body?: never;
+    path?: never;
+    query?: never;
+    url: '/api/v1/iam/org/members';
+};
+export type AccountOrgMembersErrors = {
+    /**
+     * No credential was presented, or it is not valid.
+     */
+    401: AccountRc;
+    /**
+     * The credential does not hold the scope this endpoint requires. The
+     * missing scope is deliberately not named.
+     *
+     */
+    403: AccountRc;
+};
+export type AccountOrgMembersError = AccountOrgMembersErrors[keyof AccountOrgMembersErrors];
+export type AccountOrgMembersResponses = {
+    /**
+     * The members.
+     */
+    200: AccountRc;
+};
+export type AccountOrgMembersResponse = AccountOrgMembersResponses[keyof AccountOrgMembersResponses];
+export type AccountListApikeysData = {
+    body?: never;
+    path?: never;
+    query?: never;
+    url: '/api/v1/iam/apikeys';
+};
+export type AccountListApikeysErrors = {
+    /**
+     * No credential was presented, or it is not valid.
+     */
+    401: AccountRc;
+    /**
+     * The credential does not hold the scope this endpoint requires. The
+     * missing scope is deliberately not named.
+     *
+     */
+    403: AccountRc;
+};
+export type AccountListApikeysError = AccountListApikeysErrors[keyof AccountListApikeysErrors];
+export type AccountListApikeysResponses = {
+    /**
+     * The organization's keys, newest first.
+     */
+    200: ApikeyList;
+};
+export type AccountListApikeysResponse = AccountListApikeysResponses[keyof AccountListApikeysResponses];
+export type AccountCreateApikeyData = {
+    body: AccountCreateApikeyRequest;
+    path?: never;
+    query?: never;
+    url: '/api/v1/iam/apikeys';
+};
+export type AccountCreateApikeyErrors = {
+    /**
+     * The request body is missing a required field.
+     */
+    400: AccountRc;
+    /**
+     * No credential was presented, or it is not valid.
+     */
+    401: AccountRc;
+    /**
+     * The credential does not hold the scope this endpoint requires. The
+     * missing scope is deliberately not named.
+     *
+     */
+    403: AccountRc;
+};
+export type AccountCreateApikeyError = AccountCreateApikeyErrors[keyof AccountCreateApikeyErrors];
+export type AccountCreateApikeyResponses = {
+    /**
+     * The new key, including its secret.
+     */
+    200: AccountCreatedApikey;
+};
+export type AccountCreateApikeyResponse = AccountCreateApikeyResponses[keyof AccountCreateApikeyResponses];
+export type AccountRotateApikeyData = {
+    body?: never;
+    path: {
+        /**
+         * The key's id, as returned by the list endpoint. Never the key itself.
+         */
+        id: string;
+    };
+    query?: never;
+    url: '/api/v1/iam/apikeys/{id}/rotate';
+};
+export type AccountRotateApikeyErrors = {
+    /**
+     * No credential was presented, or it is not valid.
+     */
+    401: AccountRc;
+    /**
+     * The credential does not hold the scope this endpoint requires. The
+     * missing scope is deliberately not named.
+     *
+     */
+    403: AccountRc;
+    /**
+     * No such key in this organization.
+     */
+    404: AccountRc;
+};
+export type AccountRotateApikeyError = AccountRotateApikeyErrors[keyof AccountRotateApikeyErrors];
+export type AccountRotateApikeyResponses = {
+    /**
+     * The key, with its new secret.
+     */
+    200: AccountCreatedApikey;
+};
+export type AccountRotateApikeyResponse = AccountRotateApikeyResponses[keyof AccountRotateApikeyResponses];
+export type AccountRevokeApikeyData = {
+    body?: never;
+    path: {
+        /**
+         * The key's id, as returned by the list endpoint. Never the key itself.
+         */
+        id: string;
+    };
+    query?: never;
+    url: '/api/v1/iam/apikeys/{id}/revoke';
+};
+export type AccountRevokeApikeyErrors = {
+    /**
+     * No credential was presented, or it is not valid.
+     */
+    401: AccountRc;
+    /**
+     * The credential does not hold the scope this endpoint requires. The
+     * missing scope is deliberately not named.
+     *
+     */
+    403: AccountRc;
+    /**
+     * No such key in this organization.
+     */
+    404: AccountRc;
+};
+export type AccountRevokeApikeyError = AccountRevokeApikeyErrors[keyof AccountRevokeApikeyErrors];
+export type AccountRevokeApikeyResponses = {
+    /**
+     * Revoked.
+     */
+    200: AccountRc;
+};
+export type AccountRevokeApikeyResponse = AccountRevokeApikeyResponses[keyof AccountRevokeApikeyResponses];
+export type AccountRevealApikeyData = {
+    body?: never;
+    path: {
+        /**
+         * The key's id, as returned by the list endpoint. Never the key itself.
+         */
+        id: string;
+    };
+    query?: never;
+    url: '/api/v1/iam/apikeys/{id}/reveal';
+};
+export type AccountRevealApikeyErrors = {
+    /**
+     * No credential was presented, or it is not valid.
+     */
+    401: AccountRc;
+    /**
+     * The credential does not hold the scope this endpoint requires. The
+     * missing scope is deliberately not named.
+     *
+     */
+    403: AccountRc;
+    /**
+     * No such key in this organization, or its secret was never stored
+     * recoverably (`NOT_RETRIEVABLE`).
+     *
+     */
+    404: AccountRc;
+};
+export type AccountRevealApikeyError = AccountRevealApikeyErrors[keyof AccountRevealApikeyErrors];
+export type AccountRevealApikeyResponses = {
+    /**
+     * The key's secret.
+     */
+    200: AccountRevealedApikey;
+};
+export type AccountRevealApikeyResponse = AccountRevealApikeyResponses[keyof AccountRevealApikeyResponses];
+export type OauthMetadataData = {
+    body?: never;
+    path?: never;
+    query?: never;
+    url: '/.well-known/oauth-authorization-server';
+};
+export type OauthMetadataResponses = {
+    /**
+     * The server's metadata.
+     */
+    200: OauthMetadata;
+};
+export type OauthMetadataResponse = OauthMetadataResponses[keyof OauthMetadataResponses];
+export type OauthDeviceAuthorizationData = {
+    body: DeviceAuthorizationRequest;
+    path?: never;
+    query?: never;
+    url: '/oauth/device_authorization';
+};
+export type OauthDeviceAuthorizationErrors = {
+    /**
+     * `invalid_request`, `invalid_client`, `unauthorized_client`, or
+     * `slow_down` when this address has started too many authorizations.
+     *
+     */
+    400: OauthError;
+};
+export type OauthDeviceAuthorizationError = OauthDeviceAuthorizationErrors[keyof OauthDeviceAuthorizationErrors];
+export type OauthDeviceAuthorizationResponses = {
+    /**
+     * A pending device authorization.
+     */
+    200: DeviceAuthorization;
+};
+export type OauthDeviceAuthorizationResponse = OauthDeviceAuthorizationResponses[keyof OauthDeviceAuthorizationResponses];
+export type OauthAuthorizeData = {
+    body?: never;
+    path?: never;
+    query: {
+        client_id: string;
+        redirect_uri: string;
+        response_type: 'code';
+        code_challenge: string;
+        /**
+         * S256 only. `plain` is refused rather than downgraded.
+         */
+        code_challenge_method?: 'S256';
+        scope?: string;
+        /**
+         * Returned unchanged. Use it to bind the response to your request.
+         */
+        state?: string;
+        /**
+         * RFC 8707. What the token is FOR, so it cannot be replayed elsewhere.
+         */
+        resource?: string;
+    };
+    url: '/oauth/authorize';
+};
+export type OauthAuthorizeErrors = {
+    /**
+     * Shown to the user. An unverified redirect target is never sent an error.
+     */
+    400: unknown;
+};
+export type OauthTokenData = {
+    body: TokenRequest;
+    path?: never;
+    query?: never;
+    url: '/oauth/token';
+};
+export type OauthTokenErrors = {
+    /**
+     * An RFC 6749 error. `authorization_pending` and `slow_down` are
+     * normal answers while polling a device authorization, not failures.
+     *
+     */
+    400: OauthError;
+};
+export type OauthTokenError = OauthTokenErrors[keyof OauthTokenErrors];
+export type OauthTokenResponses = {
+    /**
+     * Tokens.
+     */
+    200: TokenResponse;
+};
+export type OauthTokenResponse = OauthTokenResponses[keyof OauthTokenResponses];
+export type OauthRevokeData = {
+    body: RevokeRequest;
+    path?: never;
+    query?: never;
+    url: '/oauth/revoke';
+};
+export type OauthRevokeResponses = {
+    /**
+     * Always, whatever was presented.
+     */
+    200: {
+        [key: string]: unknown;
+    };
 };
-export type AccountMeResponse = AccountMeResponses[keyof AccountMeResponses];
+export type OauthRevokeResponse = OauthRevokeResponses[keyof OauthRevokeResponses];