This PR was opened by the [Changesets
release](https://github.com/changesets/action) GitHub action. When
you're ready to do a release, you can merge this and the packages will
be published to npm automatically. If you're not ready to do a release
yet, that's fine, whenever you add more changesets to next, this PR will
be updated.


# Releases
## @composio/core@0.20.0

### Minor Changes

- a4a40a1: Fix project API key resolution so the SDK never sends a
Composio user API key (`uak_...`, as stored by `composio login`) as the
`x-api-key` project credential. When that stored key is the only
candidate, the constructor now throws a redacted
`ComposioAPIKeyKindError` that explains the mismatch instead of making
requests that fail with 401. `apiKey: null` now disables project-key
authentication entirely, including the `COMPOSIO_API_KEY` and
`~/.composio/user_data.json` fallbacks, and is accepted when the
instance holds another credential: `userApiKey` or `orgApiKey` (explicit
or from their environment variables), or an `x-user-api-key` entry in
`defaultHeaders`. Requests then carry only that credential. Malformed or
unexpectedly shaped user config files produce a diagnostic that names
the file without echoing its contents, and cloned instances keep the
credential they were resolved with instead of re-reading the
environment. Code that resolves the key with `apiKey:
process.env.COMPOSIO_API_KEY ?? null` (or any expression that yields
`null` when the variable is unset) is affected: it used to fall back to
the environment and the CLI config file and now throws unless another
credential is configured; omit `apiKey` (or pass `undefined`) to keep
the fallbacks. With `apiKey: null`, an `x-api-key` entry in
`defaultHeaders` is rejected as well, including on `createSession()`
clones: pass the project key as `apiKey` instead of a raw header.
- 6c56b73: Add `userApiKey` and `orgApiKey` to `ComposioConfig`. Both
are forwarded to the underlying API client, which sends each one only on
operations whose security scheme requires it (organization, consumer,
and user-scoped endpoints reached through `getClient()`), never
alongside the project key. They fall back to `COMPOSIO_USER_API_KEY` and
`COMPOSIO_ORG_API_KEY`. A project `apiKey` is still required unless it
is set to `null`, which opts into user-only authentication.
- 6c56b73: Expose the rest of the owned client surface on the `Composio`
class:

- `composio.webhooks.subscriptions` (`list`, `get`, `set`, `update`,
`delete`, `rotateSecret`, `listEventTypes`) and
`composio.webhooks.endpoints` (`list`, `get`, `create`, `replace`,
`update`). `composio.triggers.setWebhookSubscription()` now delegates to
the same upsert as `webhooks.subscriptions.set()`. Its behaviour for
well-formed API responses is unchanged; malformed responses are now
rejected with a `ValidationError` instead of being read leniently.
- `composio.logs.search()` and `composio.logs.get()` for tool-execution
logs.
- `composio.connectedAccounts.revoke()`, which surfaces the API's
400/409 as `ComposioConnectedAccountRevocationNotSupportedError` /
`ComposioConnectedAccountNotRevokableError`.
`connectedAccounts.refresh()` is marked `@deprecated` (the endpoint is
deprecated upstream).
- `composio.toolkits.getMany(slugs)` and
`composio.toolkits.changelog()`.
  - `session.listConfigHistory()` on sessions.
- `composio.experimental.usage.summary()` and
`composio.experimental.usage.breakdown()` (experimental, shape may
change).
- `composio.toolkits.recommendScopes(toolkitSlug, { tools, ... })` and
`composio.toolkits.listGrantContexts(toolkitSlug)` for OAuth scope
recommendations (the API marks both beta).
- `composio.connectedAccounts.completeAuth({ userId, sessionUri })`,
which completes a deferred OAuth connection after your OAuth callback
verifier has confirmed the user's identity.
- `composio.keyring.listTransferKeys()`, which returns the public JWKs
of the organization's customer-managed keyring.
- `composio.experimental.customToolkits` (`upsert`, `sync`, `delete`)
for project-owned custom toolkits (in pilot, shape may change).
  - `CIMD_OAUTH` joins `AuthSchemeTypes`.
- `triggers.listActive()` returns `{}` for `state` and `triggerConfig`
when the API sends `null`.
- `ToolkitAuthField` gains `userVisible` (from `user_visible`) and
`ToolkitAuthConfigDetails` gains `requiredScopes` (from
`required_scopes`), both omitted when the API does not send them.
- `@composio/client` moves from the old autogenerated client to the new
handrolled client. The API removed `validate_credentials` from the
connected-account refresh, so `connectedAccounts.refresh()` now ignores
`validateCredentials` and logs a warning when it is set.
- `logger` and `logLevel` options on `new Composio({...})`. `logger`
accepts any `{ error, warn, info, debug }` sink (`console`, pino,
winston, ...) and receives the SDK's formatted, credential-redacted
output; `logLevel` (`'silent' | 'error' | 'warn' | 'info' | 'debug'`)
overrides `COMPOSIO_LOG_LEVEL`. The owned client's runtime deprecation
warnings (response `Deprecation`/`Sunset` headers and deprecated request
inputs) are now routed through that SDK logger instead of `console`. The
client's per-request lifecycle logs are emitted only at `'debug'`.
`tools.get`/`getRawComposioTools` send the API's `query` parameter in
place of the deprecated `search` wire parameter; the SDK's public
`search` option is unchanged.

- a4a40a1: Sessions now export their MCP config from the auth context
the session request was actually made with: the project key as
`x-api-key` when one is configured, otherwise the user API key
(`userApiKey` or the `x-user-api-key` default header) as
`x-user-api-key`, plus `x-org-id` / `x-project-id` when the instance is
scoped. No other default header and no ambient `COMPOSIO_API_KEY` is
ever copied. The headers are only attached when the MCP URL shares the
origin of the configured API base URL (whatever its scheme). Any other
destination (a different origin, an opaque origin such as a `data:` URL,
or a URL that does not parse) never receives them: with `mcp: true`,
`create()` / `use()` throw `ComposioMCPDestinationError`, which names
both origins and never includes a key; without `mcp: true` the session
is returned with `session.mcp.headers` empty and a warning naming both
origins is logged, so native tools keep working. The SDK never connects
to the MCP URL itself and does not follow redirects for it. Trigger
subscriptions (Pusher channel auth) follow the same rule instead of
falling back to the environment when the project key is disabled.

`ComposioConfig` gains `orgId` and `projectId`: the organization and
consumer project nano IDs, sent together as the `x-org-id` /
`x-project-id` headers on every request and with the session MCP config.
They may also be supplied through `defaultHeaders`; a half-configured or
disagreeing scope throws `ComposioScopeConfigError`. Without a scope, a
user API key keeps addressing the API default project.

`session.update()` now sends the session's last observed `configVersion`
as the `expected_config_version` precondition by default and never
retries that request, so a concurrent change surfaces as
`ComposioSessionConfigConflictError` (HTTP 409; re-fetch the session,
then retry) while the local session object stays unchanged. Pass
`expectedConfigVersion` to send another version or
`expectedConfigVersion: false` to opt out (last writer wins). Every
policy block (`toolkits`, `tools`, `tags`, `authConfigs`,
`connectedAccounts`, `preload`, `manageConnections`, `multiAccount`,
`search`, `execute`, `experimental`) accepts `null` to remove the stored
override, `manageConnections.callbackUrl: null` removes only the stored
callback URL, `multiAccount.maxAccountsPerToolkit: null` removes the
stored maximum, and an empty toolkit allowlist (`toolkits: []`) is sent
as-is so it denies every app toolkit.

- 6c56b73: Replace the old autogenerated `@composio/client` with the new
handrolled client.
## @composio/slim@0.20.0

No changes in this release.
## @e2e-tests/cf-workers-basic@0.0.4

### Patch Changes

- Updated dependencies [a4a40a1]
- Updated dependencies [6c56b73]
- Updated dependencies [6c56b73]
- Updated dependencies [a4a40a1]
- Updated dependencies [6c56b73]
  - @composio/core@0.20.0
## @e2e-tests/cf-workers-files@0.0.4

### Patch Changes

- Updated dependencies [a4a40a1]
- Updated dependencies [6c56b73]
- Updated dependencies [6c56b73]
- Updated dependencies [a4a40a1]
- Updated dependencies [6c56b73]
  - @composio/core@0.20.0
## @e2e-tests/cf-workers-tool-router-ai@0.0.4

### Patch Changes

- Updated dependencies [a4a40a1]
- Updated dependencies [6c56b73]
- Updated dependencies [6c56b73]
- Updated dependencies [a4a40a1]
- Updated dependencies [6c56b73]
  - @composio/core@0.20.0
  - @composio/vercel@0.12.1
## @e2e-tests/deno-tool-execution@0.0.2

### Patch Changes

- Updated dependencies [a4a40a1]
- Updated dependencies [6c56b73]
- Updated dependencies [6c56b73]
- Updated dependencies [a4a40a1]
- Updated dependencies [6c56b73]
  - @composio/core@0.20.0
## @e2e-tests/node-claude-agent-sdk@0.0.4

### Patch Changes

- Updated dependencies [a4a40a1]
- Updated dependencies [6c56b73]
- Updated dependencies [6c56b73]
- Updated dependencies [a4a40a1]
- Updated dependencies [6c56b73]
  - @composio/core@0.20.0
  - @composio/claude-agent-sdk@0.12.1
## @e2e-tests/node-custom-tools@0.0.4

### Patch Changes

- Updated dependencies [a4a40a1]
- Updated dependencies [6c56b73]
- Updated dependencies [6c56b73]
- Updated dependencies [a4a40a1]
- Updated dependencies [6c56b73]
  - @composio/core@0.20.0
## @e2e-tests/node-mastra-tool-router-zod-v3@0.0.4

### Patch Changes

- Updated dependencies [a4a40a1]
- Updated dependencies [6c56b73]
- Updated dependencies [6c56b73]
- Updated dependencies [a4a40a1]
- Updated dependencies [6c56b73]
  - @composio/core@0.20.0
  - @composio/mastra@0.10.5
## @e2e-tests/node-mastra-tool-router-zod-v4@0.0.4

### Patch Changes

- Updated dependencies [a4a40a1]
- Updated dependencies [6c56b73]
- Updated dependencies [6c56b73]
- Updated dependencies [a4a40a1]
- Updated dependencies [6c56b73]
  - @composio/core@0.20.0
  - @composio/mastra@0.10.5
## @e2e-tests/node-tool-router-files@0.0.4

### Patch Changes

- Updated dependencies [a4a40a1]
- Updated dependencies [6c56b73]
- Updated dependencies [6c56b73]
- Updated dependencies [a4a40a1]
- Updated dependencies [6c56b73]
  - @composio/core@0.20.0
## @e2e-tests/node-tool-router-pagination@0.0.4

### Patch Changes

- Updated dependencies [a4a40a1]
- Updated dependencies [6c56b73]
- Updated dependencies [6c56b73]
- Updated dependencies [a4a40a1]
- Updated dependencies [6c56b73]
  - @composio/core@0.20.0
## anthropic-example@0.1.4

### Patch Changes

- Updated dependencies [a4a40a1]
- Updated dependencies [6c56b73]
- Updated dependencies [6c56b73]
- Updated dependencies [a4a40a1]
- Updated dependencies [6c56b73]
  - @composio/core@0.20.0
  - @composio/anthropic@0.11.2
  - @composio/claude-agent-sdk@0.12.1
## cloudflare-wrangler-example@0.0.3

### Patch Changes

- Updated dependencies [a4a40a1]
- Updated dependencies [6c56b73]
- Updated dependencies [6c56b73]
- Updated dependencies [a4a40a1]
- Updated dependencies [6c56b73]
  - @composio/core@0.20.0
## connected-accounts-example@0.1.13

### Patch Changes

- Updated dependencies [a4a40a1]
- Updated dependencies [6c56b73]
- Updated dependencies [6c56b73]
- Updated dependencies [a4a40a1]
- Updated dependencies [6c56b73]
  - @composio/core@0.20.0
## error-handling-example@0.1.13

### Patch Changes

- Updated dependencies [a4a40a1]
- Updated dependencies [6c56b73]
- Updated dependencies [6c56b73]
- Updated dependencies [a4a40a1]
- Updated dependencies [6c56b73]
  - @composio/core@0.20.0
## file-handling-example@0.1.4

### Patch Changes

- Updated dependencies [a4a40a1]
- Updated dependencies [6c56b73]
- Updated dependencies [6c56b73]
- Updated dependencies [a4a40a1]
- Updated dependencies [6c56b73]
  - @composio/core@0.20.0
## google-example@0.1.4

### Patch Changes

- Updated dependencies [a4a40a1]
- Updated dependencies [6c56b73]
- Updated dependencies [6c56b73]
- Updated dependencies [a4a40a1]
- Updated dependencies [6c56b73]
  - @composio/core@0.20.0
  - @composio/google@0.11.1
## json-schema-to-zod-example@0.1.4

### Patch Changes

- Updated dependencies [a4a40a1]
- Updated dependencies [6c56b73]
- Updated dependencies [6c56b73]
- Updated dependencies [a4a40a1]
- Updated dependencies [6c56b73]
  - @composio/core@0.20.0
## langchain-example@0.1.13

### Patch Changes

- Updated dependencies [a4a40a1]
- Updated dependencies [6c56b73]
- Updated dependencies [6c56b73]
- Updated dependencies [a4a40a1]
- Updated dependencies [6c56b73]
  - @composio/core@0.20.0
  - @composio/langchain@0.11.1
## llamaindex-example@0.1.4

### Patch Changes

- Updated dependencies [a4a40a1]
- Updated dependencies [6c56b73]
- Updated dependencies [6c56b73]
- Updated dependencies [a4a40a1]
- Updated dependencies [6c56b73]
  - @composio/core@0.20.0
  - @composio/llamaindex@0.11.1
## mastra-example@0.1.4

### Patch Changes

- Updated dependencies [a4a40a1]
- Updated dependencies [6c56b73]
- Updated dependencies [6c56b73]
- Updated dependencies [a4a40a1]
- Updated dependencies [6c56b73]
  - @composio/core@0.20.0
  - @composio/mastra@0.10.5
## mcp-example@0.1.4

### Patch Changes

- Updated dependencies [a4a40a1]
- Updated dependencies [6c56b73]
- Updated dependencies [6c56b73]
- Updated dependencies [a4a40a1]
- Updated dependencies [6c56b73]
  - @composio/core@0.20.0
  - @composio/vercel@0.12.1
## modifiers-example@0.1.13

### Patch Changes

- Updated dependencies [a4a40a1]
- Updated dependencies [6c56b73]
- Updated dependencies [6c56b73]
- Updated dependencies [a4a40a1]
- Updated dependencies [6c56b73]
  - @composio/core@0.20.0
  - @composio/vercel@0.12.1
## openai-example@0.1.13

### Patch Changes

- Updated dependencies [a4a40a1]
- Updated dependencies [6c56b73]
- Updated dependencies [6c56b73]
- Updated dependencies [a4a40a1]
- Updated dependencies [6c56b73]
  - @composio/core@0.20.0
  - @composio/openai@0.12.3
  - @composio/openai-agents@0.11.1
## session-management-example@0.1.4

### Patch Changes

- Updated dependencies [a4a40a1]
- Updated dependencies [6c56b73]
- Updated dependencies [6c56b73]
- Updated dependencies [a4a40a1]
- Updated dependencies [6c56b73]
  - @composio/core@0.20.0
## tool-router-example@1.0.14

### Patch Changes

- Updated dependencies [a4a40a1]
- Updated dependencies [6c56b73]
- Updated dependencies [6c56b73]
- Updated dependencies [a4a40a1]
- Updated dependencies [6c56b73]
  - @composio/core@0.20.0
  - @composio/claude-agent-sdk@0.12.1
  - @composio/openai-agents@0.11.1
  - @composio/vercel@0.12.1
## toolkits-example@0.1.13

### Patch Changes

- Updated dependencies [a4a40a1]
- Updated dependencies [6c56b73]
- Updated dependencies [6c56b73]
- Updated dependencies [a4a40a1]
- Updated dependencies [6c56b73]
  - @composio/core@0.20.0
  - @composio/vercel@0.12.1
## tools-example@0.1.4

### Patch Changes

- Updated dependencies [a4a40a1]
- Updated dependencies [6c56b73]
- Updated dependencies [6c56b73]
- Updated dependencies [a4a40a1]
- Updated dependencies [6c56b73]
  - @composio/core@0.20.0
  - @composio/vercel@0.12.1
## triggers-example@0.1.4

### Patch Changes

- Updated dependencies [a4a40a1]
- Updated dependencies [6c56b73]
- Updated dependencies [6c56b73]
- Updated dependencies [a4a40a1]
- Updated dependencies [6c56b73]
  - @composio/core@0.20.0
## typesafe-example@0.0.2

### Patch Changes

- Updated dependencies [a4a40a1]
- Updated dependencies [6c56b73]
- Updated dependencies [6c56b73]
- Updated dependencies [a4a40a1]
- Updated dependencies [6c56b73]
  - @composio/core@0.20.0
  - @composio/openai@0.12.3
  - @composio/typesafe@0.1.1
## vercel-example@0.1.13

### Patch Changes

- Updated dependencies [a4a40a1]
- Updated dependencies [6c56b73]
- Updated dependencies [6c56b73]
- Updated dependencies [a4a40a1]
- Updated dependencies [6c56b73]
  - @composio/core@0.20.0
  - @composio/vercel@0.12.1
## versioning-example@0.1.4

### Patch Changes

- Updated dependencies [a4a40a1]
- Updated dependencies [6c56b73]
- Updated dependencies [6c56b73]
- Updated dependencies [a4a40a1]
- Updated dependencies [6c56b73]
  - @composio/core@0.20.0

Co-authored-by: sdkrelease[bot] <294075132+sdkrelease[bot]@users.noreply.github.com>