@m6d/cortex-cli 1.5.0 → 1.7.0

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@m6d/cortex-cli",
-    "version": "1.5.0",
+    "version": "1.7.0",
     "description": "Scaffold and operate Cortex servers",
     "license": "MIT",
     "type": "module",
@@ -28,7 +28,7 @@
     },
     "devDependencies": {
         "@cortex/contracts": "workspace:*",
-        "@types/bun": "latest",
+        "@types/bun": "1.3.14",
         "typescript": "~5.9.3"
     },
     "publishConfig": {

package/src/contracts/runtime/index.ts

@@ -130,9 +130,32 @@ export const serviceCardSchema = z.object({
 
 export const runtimeAgentConfigSchema = z.object({
     agentId: agentSlugSchema,
+    /**
+     * End-user JWT verification for this agent, managed by the agent's owner.
+     * Tokens must be asymmetrically signed (the JWKS URI serves the public
+     * keys) with a matching `iss` claim. Absent = the server's own auth
+     * default applies.
+     */
+    auth: z
+        .object({
+            jwksUri: z.url(),
+            issuer: z.string().trim().min(1).max(2048),
+            // Optional: when set, the token's `aud` must contain it. Guards
+            // against a token minted for another audience under the same
+            // issuer being replayed here.
+            audience: z.string().trim().min(1).max(2048).optional(),
+        })
+        .optional(),
     systemPrompt: z.string(),
     promptVariables: z.array(z.enum(PROMPT_VARIABLES)),
     defaultLocale: localeSchema,
+    /**
+     * Whether end users may upload files to this agent. Operational config
+     * like `auth`: read from the agent row, so toggling applies without
+     * republishing. The runtime rejects new uploads when false; existing
+     * attachments stay downloadable and deletable.
+     */
+    attachmentsEnabled: z.boolean(),
     metaTools: z.object({
         searchKnowledge: z.boolean(),
         searchTools: z.boolean(),

package/src/contracts/wire/index.ts

@@ -81,6 +81,14 @@ export type ClientToolBinding = {
     embedOrigin: string;
 };
 
+/**
+ * What the server offers this agent's clients, fetched once at widget startup.
+ * The widget hides UI for anything absent; enforcement stays server-side.
+ */
+export type AgentCapabilities = {
+    attachments: boolean;
+};
+
 export type MessageMetadata = {
     modelId?: string;
     providerMetadata?: unknown;