@celigo/api-specs 0.2.170 → 0.2.171

package/dist/guardrail.yml

@@ -594,9 +594,9 @@ components:
         LLM configuration for an `ai_agent` guardrail — which provider and model evaluate each
         record, with instructions, parameter tuning, and output format. Guardrails never invoke
         tools, so unlike an AI agent import no block here accepts a `tools` array. MCP `prompts`
-        and `resources` are accepted on save, but an unreachable MCP server doesn't fail the
-        run (verified on OpenAI), so put the policy the guardrail must apply in its
-        instructions. Providers come in two families with two configuration formats:
+        and `resources` are accepted on save but never used at run time, so put the policy the
+        guardrail must apply in its instructions. Providers come in two families with two
+        configuration formats:
 
         - **Built-in providers** — each has its own configuration block.
           - **openai**: OpenAI models (GPT-4.1, GPT-5, etc.). Configure via the `openai` object.
@@ -761,7 +761,7 @@ components:
           type: array
           description: |-
             MCP prompt entries saved with a catalog-provider guardrail (generic flat format).
-            Each entry references one MCP connection and the prompt names allowed from it.
+            Each entry references one MCP connection and prompt names; a guardrail's run never fetches them.
           items:
             type: object
             properties:
@@ -782,7 +782,7 @@ components:
                     description: Connection to the MCP server that exposes the prompts.
                   allowedPrompts:
                     type: array
-                    description: Prompt names the model may fetch from the server.
+                    description: Prompt names saved with the entry; a guardrail's run never fetches them.
                     items:
                       type: string
           x-celigo-ai-guidance:
@@ -1039,7 +1039,7 @@ components:
               type: array
               description: |-
                 MCP prompt entries saved with the guardrail. Each item references one
-                MCP connection and the prompt names allowed from it.
+                MCP connection and prompt names; a guardrail's run never fetches them.
               items:
                 type: object
                 properties:
@@ -1061,7 +1061,7 @@ components:
                         description: Connection to the MCP server.
                       allowedPrompts:
                         type: array
-                        description: Prompt names to allow from the MCP server.
+                        description: Prompt names saved with the entry; a guardrail's run never fetches them.
                         items:
                           type: string
             resources:
@@ -1228,7 +1228,7 @@ components:
                       type: array
                       description: |-
                         MCP prompt entries saved with a Gemini guardrail. Each item references one
-                        MCP connection and the prompt names allowed from it.
+                        MCP connection and prompt names; a guardrail's run never fetches them.
                       items:
                         type: object
                         properties:
@@ -1250,7 +1250,7 @@ components:
                                 description: Connection to the MCP server.
                               allowedPrompts:
                                 type: array
-                                description: Prompt names to allow from the MCP server.
+                                description: Prompt names saved with the entry; a guardrail's run never fetches them.
                                 items:
                                   type: string
                     resources:
@@ -1450,7 +1450,7 @@ components:
                       type: array
                       description: |-
                         MCP prompt entries saved with a Claude guardrail. Each item references one
-                        MCP connection and the prompt names allowed from it.
+                        MCP connection and prompt names; a guardrail's run never fetches them.
                       items:
                         type: object
                         properties:
@@ -1472,7 +1472,7 @@ components:
                                 description: Connection to the MCP server.
                               allowedPrompts:
                                 type: array
-                                description: Prompt names to allow from the MCP server.
+                                description: Prompt names saved with the entry; a guardrail's run never fetches them.
                                 items:
                                   type: string
                     resources:
@@ -1544,10 +1544,9 @@ components:
           (`aiAgent.tools`, `aiAgent.openai.tools`, `aiAgent.litellm._overrides.gemini.tools`,
           `aiAgent.litellm._overrides.anthropic.tools`) fails the save with 422
           `guardrail_tools_not_allowed`. MCP `prompts` and `resources` are still accepted on
-          save, but don't rely on them for the check: with their MCP server unreachable, a
-          guardrail runs on its instructions and input alone, with no error, where an AI agent's
-          run fails (verified on OpenAI). Put the policy the guardrail must apply in its
-          instructions.
+          save, but a guardrail's run never uses them: it gives the model only its instructions
+          and input, whether the MCP server can be reached or not. Put the policy the guardrail
+          must apply in its instructions.
       properties:
         type:
           type: string
@@ -2177,7 +2176,8 @@ components:
             mapping:
               type: object
               description: |-
-                Mapper 1.0 input mapping that selects the field evaluated as `text`.
+                Mapper 1.0 input mapping that selects what is evaluated: a field mapped
+                to `text`, or an object mapped to `record` (evaluated as its JSON).
                 Served only when populated — a guardrail created without one has no
                 `mapping` in responses, and evaluates the whole record (or the
                 record's own top-level `text` field, when it has one).
@@ -2353,7 +2353,8 @@ components:
             record field to the `text` input (e.g.
             `{"fields": [{"extract": "employeeSummary", "generate": "text"}]}`);
             only that field is evaluated, and fields outside it are neither
-            scanned nor masked. Optional — when omitted the whole record is
+            scanned nor masked. A mapping can also generate `record`, an object
+            evaluated as its JSON. Optional — when omitted the whole record is
             evaluated, serialized as JSON, unless the record has its own
             top-level `text` field, which is then evaluated alone. The server
             serves this field only when populated.
@@ -2362,10 +2363,13 @@ components:
               Send the input selection here as `mapping`, not as Mapper 2.0
               `mappings` rows. Map the field explicitly when records carry their
               own `text` field.
+            - |-
+              A guardrail keeps no conversation history, so a mapped
+              `conversationHistoryId` changes nothing.
           properties:
             fields:
               type: array
-              description: Field-level mapping entries; `generate` targets the guardrail input (typically `text`).
+              description: Field-level mapping entries; `generate` targets the guardrail input (`text`, or `record` for an object).
               items:
                 $ref: '#/components/schemas/MappingField'
             lists:

package/dist/import.yml

@@ -9674,7 +9674,7 @@ components:
                       x-enumDescriptions:
                         text: Free-form text response from the model.
                         json_schema: Structured JSON output conforming to a defined schema.
-                        blob: Binary data output for non-text content.
+                        blob: Image generation — the run calls the image generation tool and returns the stored image's `blobKey`, not `_text` or `_json`.
                       default: text
                       description: Output format type.
                     schemaMode:
@@ -9896,11 +9896,6 @@ components:
                               an object without a non-empty name fails with a
                               missing-required-field error. String entries are the
                               legacy form and stay valid.
-                      allowedPrompts:
-                        type: array
-                        description: Specific prompts to allow from the MCP server (used for MCP prompt entries; all if omitted).
-                        items:
-                          type: string
                   tool:
                     type: object
                     description: |
@@ -10043,7 +10038,7 @@ components:
                   x-enumDescriptions:
                     text: Free-form text response from the model.
                     json_schema: Structured JSON output conforming to a defined schema.
-                    blob: Binary data output for non-text content.
+                    blob: Image generation — the run returns the stored image's `blobKey`, not `_text` or `_json`.
                   default: text
                 schemaMode:
                   type: string
@@ -10212,11 +10207,6 @@ components:
                                       description: Display description shown for the tool.
                                   required:
                                     - name
-                              allowedPrompts:
-                                type: array
-                                description: Specific prompts to allow from the MCP server (used for MCP prompt entries; all if omitted).
-                                items:
-                                  type: string
                           tool:
                             type: object
                             description: Reference to a Celigo Tool resource, used when type is "tool".
@@ -10729,9 +10719,9 @@ components:
         LLM configuration for an `ai_agent` guardrail — which provider and model evaluate each
         record, with instructions, parameter tuning, and output format. Guardrails never invoke
         tools, so unlike an AI agent import no block here accepts a `tools` array. MCP `prompts`
-        and `resources` are accepted on save, but an unreachable MCP server doesn't fail the
-        run (verified on OpenAI), so put the policy the guardrail must apply in its
-        instructions. Providers come in two families with two configuration formats:
+        and `resources` are accepted on save but never used at run time, so put the policy the
+        guardrail must apply in its instructions. Providers come in two families with two
+        configuration formats:
 
         - **Built-in providers** — each has its own configuration block.
           - **openai**: OpenAI models (GPT-4.1, GPT-5, etc.). Configure via the `openai` object.
@@ -10896,7 +10886,7 @@ components:
           type: array
           description: |-
             MCP prompt entries saved with a catalog-provider guardrail (generic flat format).
-            Each entry references one MCP connection and the prompt names allowed from it.
+            Each entry references one MCP connection and prompt names; a guardrail's run never fetches them.
           items:
             type: object
             properties:
@@ -10917,7 +10907,7 @@ components:
                     description: Connection to the MCP server that exposes the prompts.
                   allowedPrompts:
                     type: array
-                    description: Prompt names the model may fetch from the server.
+                    description: Prompt names saved with the entry; a guardrail's run never fetches them.
                     items:
                       type: string
           x-celigo-ai-guidance:
@@ -11174,7 +11164,7 @@ components:
               type: array
               description: |-
                 MCP prompt entries saved with the guardrail. Each item references one
-                MCP connection and the prompt names allowed from it.
+                MCP connection and prompt names; a guardrail's run never fetches them.
               items:
                 type: object
                 properties:
@@ -11196,7 +11186,7 @@ components:
                         description: Connection to the MCP server.
                       allowedPrompts:
                         type: array
-                        description: Prompt names to allow from the MCP server.
+                        description: Prompt names saved with the entry; a guardrail's run never fetches them.
                         items:
                           type: string
             resources:
@@ -11363,7 +11353,7 @@ components:
                       type: array
                       description: |-
                         MCP prompt entries saved with a Gemini guardrail. Each item references one
-                        MCP connection and the prompt names allowed from it.
+                        MCP connection and prompt names; a guardrail's run never fetches them.
                       items:
                         type: object
                         properties:
@@ -11385,7 +11375,7 @@ components:
                                 description: Connection to the MCP server.
                               allowedPrompts:
                                 type: array
-                                description: Prompt names to allow from the MCP server.
+                                description: Prompt names saved with the entry; a guardrail's run never fetches them.
                                 items:
                                   type: string
                     resources:
@@ -11585,7 +11575,7 @@ components:
                       type: array
                       description: |-
                         MCP prompt entries saved with a Claude guardrail. Each item references one
-                        MCP connection and the prompt names allowed from it.
+                        MCP connection and prompt names; a guardrail's run never fetches them.
                       items:
                         type: object
                         properties:
@@ -11607,7 +11597,7 @@ components:
                                 description: Connection to the MCP server.
                               allowedPrompts:
                                 type: array
-                                description: Prompt names to allow from the MCP server.
+                                description: Prompt names saved with the entry; a guardrail's run never fetches them.
                                 items:
                                   type: string
                     resources:
@@ -11709,8 +11699,8 @@ components:
           `aiAgent.openai.tools`, `aiAgent.litellm._overrides.gemini.tools`, `….anthropic.tools`) —
           any non-empty array fails the save with 422 `guardrail_tools_not_allowed` ("Tools aren't
           supported on a guardrail AI agent configuration…"), on create and on update. `prompts` and
-          `resources` are accepted on save, but an unreachable MCP server doesn't fail the run
-          (verified on OpenAI), so put the policy in the instructions. The server still echoes
+          `resources` are accepted on save but never used at run time, so put the policy in the
+          instructions. The server still echoes
           `openai.tools: []` on OpenAI guardrails.
       properties:
         type:

package/dist/networkpolicy.yml

@@ -24,6 +24,10 @@ tags:
     description: |-
       Network policies are named IP allow and deny lists that control where API tokens, MCP servers, and users may connect from. A policy takes effect only once it is assigned — through `_networkPolicyId` on an API token or MCP server, or in account settings for workspace-user and end-user sign-in — and each environment (production or sandbox) keeps its own library of policies. Network policies must be enabled for the account, and only the account owner and administrators can manage them.
 
+      Every policy that applies to a call must admit the caller. An API token's policy is checked when the token authenticates, before the request runs; an MCP server's policy is checked on every request to it, so a call to an MCP server passes both its token's policy and the server's. A personal access token has no policy of its own: it is checked against the workspace-user sign-in policy of the environment it belongs to. Sign-in policies are checked when a workspace user signs in or switches account or environment, and when an end user signs in to an MCP server.
+
+      A refused call gets HTTP 403 with `{"errors": [{"code": "access_denied", "message": "Access denied."}]}` and nothing that names the policy or the address. An MCP server endpoint speaks JSON-RPC, so its 403 carries the MCP server's access-denied error (`-32006`) in a JSON-RPC envelope instead — `{"jsonrpc": "2.0", "error": {"code": -32006, "message": "Access denied."}, "id": <request id>}`, with `id` echoed when the request had one — and the server's request log records the call as blocked.
+
       ## Network policy schema
 
       {% openapi-schemas spec="networkpolicy" schemas="NetworkPolicy" grouped="true" %}

package/dist/tool.yml

@@ -21213,7 +21213,7 @@ components:
                       x-enumDescriptions:
                         text: Free-form text response from the model.
                         json_schema: Structured JSON output conforming to a defined schema.
-                        blob: Binary data output for non-text content.
+                        blob: Image generation — the run calls the image generation tool and returns the stored image's `blobKey`, not `_text` or `_json`.
                       default: text
                       description: Output format type.
                     schemaMode:
@@ -21435,11 +21435,6 @@ components:
                               an object without a non-empty name fails with a
                               missing-required-field error. String entries are the
                               legacy form and stay valid.
-                      allowedPrompts:
-                        type: array
-                        description: Specific prompts to allow from the MCP server (used for MCP prompt entries; all if omitted).
-                        items:
-                          type: string
                   tool:
                     type: object
                     description: |
@@ -21582,7 +21577,7 @@ components:
                   x-enumDescriptions:
                     text: Free-form text response from the model.
                     json_schema: Structured JSON output conforming to a defined schema.
-                    blob: Binary data output for non-text content.
+                    blob: Image generation — the run returns the stored image's `blobKey`, not `_text` or `_json`.
                   default: text
                 schemaMode:
                   type: string
@@ -21751,11 +21746,6 @@ components:
                                       description: Display description shown for the tool.
                                   required:
                                     - name
-                              allowedPrompts:
-                                type: array
-                                description: Specific prompts to allow from the MCP server (used for MCP prompt entries; all if omitted).
-                                items:
-                                  type: string
                           tool:
                             type: object
                             description: Reference to a Celigo Tool resource, used when type is "tool".
@@ -22268,9 +22258,9 @@ components:
         LLM configuration for an `ai_agent` guardrail — which provider and model evaluate each
         record, with instructions, parameter tuning, and output format. Guardrails never invoke
         tools, so unlike an AI agent import no block here accepts a `tools` array. MCP `prompts`
-        and `resources` are accepted on save, but an unreachable MCP server doesn't fail the
-        run (verified on OpenAI), so put the policy the guardrail must apply in its
-        instructions. Providers come in two families with two configuration formats:
+        and `resources` are accepted on save but never used at run time, so put the policy the
+        guardrail must apply in its instructions. Providers come in two families with two
+        configuration formats:
 
         - **Built-in providers** — each has its own configuration block.
           - **openai**: OpenAI models (GPT-4.1, GPT-5, etc.). Configure via the `openai` object.
@@ -22435,7 +22425,7 @@ components:
           type: array
           description: |-
             MCP prompt entries saved with a catalog-provider guardrail (generic flat format).
-            Each entry references one MCP connection and the prompt names allowed from it.
+            Each entry references one MCP connection and prompt names; a guardrail's run never fetches them.
           items:
             type: object
             properties:
@@ -22456,7 +22446,7 @@ components:
                     description: Connection to the MCP server that exposes the prompts.
                   allowedPrompts:
                     type: array
-                    description: Prompt names the model may fetch from the server.
+                    description: Prompt names saved with the entry; a guardrail's run never fetches them.
                     items:
                       type: string
           x-celigo-ai-guidance:
@@ -22713,7 +22703,7 @@ components:
               type: array
               description: |-
                 MCP prompt entries saved with the guardrail. Each item references one
-                MCP connection and the prompt names allowed from it.
+                MCP connection and prompt names; a guardrail's run never fetches them.
               items:
                 type: object
                 properties:
@@ -22735,7 +22725,7 @@ components:
                         description: Connection to the MCP server.
                       allowedPrompts:
                         type: array
-                        description: Prompt names to allow from the MCP server.
+                        description: Prompt names saved with the entry; a guardrail's run never fetches them.
                         items:
                           type: string
             resources:
@@ -22902,7 +22892,7 @@ components:
                       type: array
                       description: |-
                         MCP prompt entries saved with a Gemini guardrail. Each item references one
-                        MCP connection and the prompt names allowed from it.
+                        MCP connection and prompt names; a guardrail's run never fetches them.
                       items:
                         type: object
                         properties:
@@ -22924,7 +22914,7 @@ components:
                                 description: Connection to the MCP server.
                               allowedPrompts:
                                 type: array
-                                description: Prompt names to allow from the MCP server.
+                                description: Prompt names saved with the entry; a guardrail's run never fetches them.
                                 items:
                                   type: string
                     resources:
@@ -23124,7 +23114,7 @@ components:
                       type: array
                       description: |-
                         MCP prompt entries saved with a Claude guardrail. Each item references one
-                        MCP connection and the prompt names allowed from it.
+                        MCP connection and prompt names; a guardrail's run never fetches them.
                       items:
                         type: object
                         properties:
@@ -23146,7 +23136,7 @@ components:
                                 description: Connection to the MCP server.
                               allowedPrompts:
                                 type: array
-                                description: Prompt names to allow from the MCP server.
+                                description: Prompt names saved with the entry; a guardrail's run never fetches them.
                                 items:
                                   type: string
                     resources:
@@ -23248,8 +23238,8 @@ components:
           `aiAgent.openai.tools`, `aiAgent.litellm._overrides.gemini.tools`, `….anthropic.tools`) —
           any non-empty array fails the save with 422 `guardrail_tools_not_allowed` ("Tools aren't
           supported on a guardrail AI agent configuration…"), on create and on update. `prompts` and
-          `resources` are accepted on save, but an unreachable MCP server doesn't fail the run
-          (verified on OpenAI), so put the policy in the instructions. The server still echoes
+          `resources` are accepted on save but never used at run time, so put the policy in the
+          instructions. The server still echoes
           `openai.tools: []` on OpenAI guardrails.
       properties:
         type:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@celigo/api-specs",
-  "version": "0.2.170",
+  "version": "0.2.171",
   "private": false,
   "description": "Public OpenAPI bundles (dist/) and the celigo-cli lint schema pack (schemas.json).",
   "keywords": [