@marinoscar/platform-contract 0.1.0-next.3 → 0.1.0-next.4

package/dist/cjs/ai/schemas.d.ts

@@ -0,0 +1,642 @@
+import { z } from 'zod';
+import { type AiKeyPolicyEnum, type AiOpenAiApiStyleEnum, type AiSecretFieldNames } from './constants.js';
+/**
+ * Per-user AI preferences (`ai`) — issue #423, epic #419, umbrella #418.
+ *
+ * `defaultModel` is the ONLY field this issue adds: which (provider, model)
+ * a caller's AI surface should pre-select, so a user who has settled on one
+ * model does not re-pick it every time. Nullable, and the namespace itself
+ * optional — see below for why both.
+ *
+ * NON-SECRET ONLY, and this is the whole namespace, not a policy exception:
+ * a user's own provider key is `UserAiKey.secret`, ciphertext in its own
+ * table (`apps/api/prisma/schema.prisma`), never in `user_settings.value`,
+ * which — like `system_settings.value` — is returned wholesale by
+ * `GET /api/user-settings` and copied verbatim into whatever audit trail
+ * later issues add. `provider`/`modelId` here are the same kind of
+ * IDENTIFIER `systemStorageSchema.accessKeyId` is: they name a selection,
+ * they authorise nothing.
+ *
+ * `provider`/`modelId` are plain strings, not `z.enum(AI_PROVIDER_IDS)` /
+ * a foreign key into `AiModel`: this schema has no access to the database to
+ * validate a model still exists, and — matching `Job.type`'s and
+ * `AiModel.provider`'s own "a row must outlive the registry that produced it"
+ * reasoning throughout this codebase — a user's saved preference for a model
+ * later disabled or removed by an admin must remain a value this schema can
+ * represent, even though nothing routes to it any more.
+ *
+ * @stability experimental
+ */
+export declare const userAiSettingsSchema: z.ZodObject<{
+    defaultModel: z.ZodNullable<z.ZodObject<{
+        provider: z.ZodString;
+        modelId: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+/**
+ * The per-user `ai` settings namespace (`userAiSettingsSchema`'s output).
+ *
+ * @stability experimental
+ */
+export type UserAiSettingsValue = z.infer<typeof userAiSettingsSchema>;
+/**
+ * `ai`, PATCH counterpart. `defaultModel` stays required-but-nullable inside
+ * the object (an explicit `{ "ai": { "defaultModel": null } }` clears the
+ * selection back to "none chosen"; the whole `ai` object itself is optional
+ * to send at all, matching `dataTables`/`navigation` above).
+ *
+ * @stability experimental
+ */
+export declare const userAiSettingsPatchSchema: z.ZodObject<{
+    defaultModel: z.ZodNullable<z.ZodObject<{
+        provider: z.ZodString;
+        modelId: z.ZodString;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+/**
+ * A `PATCH` of the per-user `ai` namespace.
+ *
+ * @stability experimental
+ */
+export type UserAiSettingsPatchValue = z.infer<typeof userAiSettingsPatchSchema>;
+/**
+ * One limit value: a positive integer up to `AI_LIMIT_VALUE_MAX`.
+ *
+ * @stability experimental
+ */
+export declare const aiLimitValueSchema: z.ZodNumber;
+/**
+ * `ai.limits` (#450) — per-user and per-model rate limits and output caps.
+ * EVERY FIELD IS OPTIONAL, AND ABSENT MEANS UNLIMITED: `{}` (the default) is
+ * a deployment with no limits at all, which is exactly Phase 1's behaviour.
+ *
+ *  - `perUser.requestsPerMinute` / `.requestsPerDay` — every inference call a
+ *    user makes, whoever's key pays.
+ *  - `orgKey.requestsPerDayPerUser` / `.tokensPerDayPerUser` — only calls the
+ *    ORG key pays for (`keySource: 'org'`); a user on their own key is never
+ *    counted against these.
+ *  - `perModel['<provider>:<modelId>']` — `maxOutputTokens` clamps the call
+ *    (together with `defaults.maxOutputTokensCap`, the smaller wins), and
+ *    `requestsPerMinutePerUser` limits each user's calls to that one model.
+ *
+ * Enforced by `AiLimitsService` (`ai/runtime/ai-limits.service.ts`); see
+ * `docs/specs/ai-platform.md` §2.22.
+ *
+ * @stability experimental
+ */
+export declare const systemAiLimitsSchema: z.ZodObject<{
+    perUser: z.ZodOptional<z.ZodObject<{
+        requestsPerMinute: z.ZodOptional<z.ZodNumber>;
+        requestsPerDay: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>>;
+    orgKey: z.ZodOptional<z.ZodObject<{
+        requestsPerDayPerUser: z.ZodOptional<z.ZodNumber>;
+        tokensPerDayPerUser: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>>;
+    perOrg: z.ZodOptional<z.ZodObject<{
+        requestsPerDay: z.ZodOptional<z.ZodNumber>;
+        outputTokensPerDay: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>>;
+    perModel: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        maxOutputTokens: z.ZodOptional<z.ZodNumber>;
+        requestsPerMinutePerUser: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+/**
+ * `ai.limits`, as stored.
+ *
+ * @stability experimental
+ */
+export type SystemAiLimitsValue = z.infer<typeof systemAiLimitsSchema>;
+/**
+ * Deployment-wide AI platform policy (`ai`).
+ *
+ * `enabled` is the master switch: OFF by default, matching every other
+ * feature namespace in this file that ships ahead of its own UI
+ * (`databaseBackup.enabled`, `nodes.jobSecretBrokerEnabled`) — a capability
+ * this deployment did not ask for must not turn itself on by existing in the
+ * schema.
+ *
+ * `providers.openai.baseUrl` IS AN ENDPOINT OVERRIDE, NOT A CREDENTIAL — the
+ * exact counterpart of `systemStorageSchema.endpoint`. It exists for
+ * OpenAI-compatible proxies and self-hosted gateways, and is optional because
+ * absent means "use the provider's own default host". `providers` is a RECORD
+ * keyed by provider id (PP-14.6, #924), open to a provider an app or package
+ * registers: this schema checks the id and `enabled`, and the provider's own
+ * `settingsSchema` (the API's provider registry) validates the rest, which a
+ * schema in this package cannot, since it does not know which providers a
+ * deployment registered. The stored shape of the five built-in providers is
+ * unchanged.
+ *
+ * `defaults.maxOutputTokensCap` bounds every call regardless of what the
+ * caller (or the model's own `maxOutputTokens`) requests, and is optional:
+ * absent means "no deployment-wide cap", not zero.
+ * `defaults.allowBackgroundRuns` decides whether a call may be queued as an `AiRun`
+ * job at all rather than only served synchronously; ON by default, since the
+ * job queue is this application's normal way of doing anything that takes a
+ * while (see the "Every Long-Running Activity Is a Queue Job" rules) and a
+ * deployment that has not thought about AI at all should not have quietly
+ * disabled the queue path the moment this namespace materialises.
+ *
+ * `defaults.allowRealtime` (#449) decides whether a user may mint a realtime
+ * voice session (`POST /api/ai/realtime/sessions`) — an ephemeral provider
+ * secret handed to the BROWSER, after which the server can neither see nor
+ * meter the conversation. OFF by default: that loss of per-call control is
+ * an administrator's decision (docs/specs/ai-platform.md §2.15). A row
+ * written before the field existed reads it as `false` without disturbing
+ * the rest of `defaults` (`SystemSettingsService.withAiSlots`).
+ *
+ * `logPromptContent` is OFF by default and is a deliberate, named privacy
+ * decision: whether this deployment's own logs/telemetry may capture prompt
+ * text at all, independent of `enabled`. A deployment can turn AI on while
+ * still refusing to let prompts (which may carry a user's own sensitive
+ * input) land in a log line nobody scoped for that.
+ *
+ * ⚠ THERE IS NO API KEY FIELD ANYWHERE IN THIS NAMESPACE, AND THERE MUST
+ * NEVER BE ONE — see the compile-time proof at the bottom of this file. A
+ * user's own key is `UserAiKey.secret`, ciphertext in its own table, never
+ * in this JSONB blob; an org-wide fallback key (
+ * `AI_KEY_POLICIES.byok_with_org_fallback`) is credential material for the same reason
+ * `systemStorageSchema`'s own header gives for the storage secret access
+ * key: this object is returned WHOLESALE by `GET /api/system-settings` and
+ * copied verbatim into every settings audit row, so a secret here is one
+ * admin GET away from being on the wire.
+ *
+ * `usageRetentionDays` (#443) is how long `ai_usage_events` rows are kept
+ * before the daily `ai.usage.purge` job deletes them — 180 days by default,
+ * comfortably past the 90-day window the usage report can show. It is a data
+ * retention decision, so it applies whether or not AI is currently enabled.
+ *
+ * `hostedTools` (#442) switches each provider-hosted tool type on for the
+ * deployment — web search, file search, code interpreter, image generation
+ * and remote MCP. ALL OFF BY DEFAULT: each one reaches outside this
+ * deployment (the open web, a third-party MCP server) and bills per use, so
+ * it is an administrator's decision, never a side effect of upgrading.
+ * `mcpAllowedHosts` optionally narrows which hosts an MCP `serverUrl` may
+ * name (`*.example.com` for subdomains); empty means any `https` host. It is
+ * a list of HOSTNAMES — MCP credentials travel per request, in the tool's
+ * `headers`, and are never stored here or anywhere else.
+ *
+ * `limits` (#450) holds the per-user and per-model rate limits and output
+ * caps — see `systemAiLimitsSchema`. Every field inside it is optional and
+ * absent means unlimited; the default is `{}`.
+ *
+ * NO `.default()` ON ANY FIELD, matching every namespace above it in this
+ * file. The defaults live in `DEFAULT_SYSTEM_SETTINGS` (settings.types.ts)
+ * and nowhere else.
+ */
+/**
+ * One provider's slot in `ai.providers`: its switch and optional endpoint
+ * override. Every provider id has at least this shape; the two #448 slots
+ * below extend it.
+ *
+ * @stability experimental
+ */
+export declare const systemAiProviderSchema: z.ZodObject<{
+    enabled: z.ZodBoolean;
+    baseUrl: z.ZodOptional<z.ZodString>;
+}, z.core.$strip>;
+/**
+ * A `baseUrl` for an admin-chosen OpenAI-family endpoint, restricted to `schemes`.
+ *
+ * @stability experimental
+ */
+export declare function aiEndpointUrlSchema(schemes: readonly string[]): z.ZodString;
+/**
+ * Azure OpenAI's model id to deployment name map.
+ *
+ * @stability experimental
+ */
+export declare const aiAzureDeploymentsSchema: z.ZodRecord<z.ZodString, z.ZodString>;
+/**
+ * `providers['azure-openai']` (#448).
+ *
+ *  - `baseUrl` — the resource endpoint, `https://<resource>.openai.azure.com`
+ *    (the SDK appends `/openai`). Named `baseUrl`, like every other slot, so
+ *    every generic consumer (the admin test's override, the catalog sync, the
+ *    per-call context) handles it with no Azure special case. Required before
+ *    the provider can be enabled — see `AiConfigAdminService`.
+ *  - `apiVersion` — the `api-version` query value; absent means
+ *    `AZURE_OPENAI_DEFAULT_API_VERSION` (`ai/providers/azure-openai`).
+ *  - `apiStyle` — `responses` (the default: current api-versions serve the
+ *    Responses API) or `chat_completions` for an older api-version or a
+ *    deployment the Responses API does not cover.
+ *  - `deployments` — model id → deployment name. Azure routes by DEPLOYMENT,
+ *    and a deployment may be named anything; when this map is set its keys
+ *    ARE the model list the catalog discovers, and a model id missing from it
+ *    is sent as its own deployment name.
+ *
+ * @stability experimental
+ */
+export declare const systemAiAzureProviderSchema: z.ZodObject<{
+    enabled: z.ZodBoolean;
+    baseUrl: z.ZodOptional<z.ZodString>;
+    apiVersion: z.ZodOptional<z.ZodString>;
+    apiStyle: z.ZodOptional<z.ZodEnum<AiOpenAiApiStyleEnum>>;
+    deployments: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+}, z.core.$strip>;
+/**
+ * `providers['openai-compatible']` (#448) — Ollama, vLLM, LM Studio or any
+ * other server speaking the OpenAI wire protocol.
+ *
+ *  - `baseUrl` — the server's API root, INCLUDING its version segment
+ *    (`http://ollama.internal:11434/v1`); required before enabling.
+ *  - `apiStyle` — `chat_completions` (the default: what every compatible
+ *    server serves) or `responses` for one that also serves the Responses API.
+ *  - `requiresKey` — absent or `true`: a key is resolved like any provider's
+ *    (BYOK, or the org fallback). `false` is the ADMINISTRATOR'S OPT-IN to a
+ *    keyless server: calls carry no credential, no user needs a key, and
+ *    usage is recorded with `keySource: 'none'` (docs/specs/ai-platform.md
+ *    §2.24).
+ *
+ * @stability experimental
+ */
+export declare const systemAiCompatibleProviderSchema: z.ZodObject<{
+    enabled: z.ZodBoolean;
+    baseUrl: z.ZodOptional<z.ZodString>;
+    apiStyle: z.ZodOptional<z.ZodEnum<AiOpenAiApiStyleEnum>>;
+    requiresKey: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+/**
+ * A provider id: a lower-case letter, then lower-case letters, digits and
+ * hyphens (2 to 48 characters). The pattern of the pluggable-kind registry
+ * and the provider part of an `ai.limits.perModel` key.
+ *
+ * @extensionPoint schema
+ * @stability experimental
+ */
+export declare const aiProviderIdSchema: z.ZodString;
+/**
+ * One provider's slot in the stored `ai.providers` record: the switch every
+ * provider has, plus the provider's own non-secret settings (`baseUrl`,
+ * `region`, ...), which pass through. Carries no key.
+ *
+ * @extensionPoint schema
+ * @stability experimental
+ */
+export declare const aiProviderSlotSchema: z.ZodObject<{
+    enabled: z.ZodBoolean;
+}, z.core.$loose>;
+/**
+ * One provider's slot in a PATCH: every field optional, and a provider's own
+ * optional setting takes `null` to remove it (back to its default).
+ *
+ * @stability experimental
+ */
+export declare const aiProviderSlotPatchSchema: z.ZodObject<{
+    enabled: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$loose>;
+/**
+ * `ai.providers` as stored and as a PUT carries it: slots by provider id.
+ *
+ * @stability experimental
+ */
+export declare const systemAiProvidersSchema: z.ZodRecord<z.ZodString, z.ZodObject<{
+    enabled: z.ZodBoolean;
+}, z.core.$loose>>;
+/**
+ * `ai.providers` in a PATCH: the slots to change, by provider id; a provider
+ * left out keeps its stored settings.
+ *
+ * @stability experimental
+ */
+export declare const systemAiProvidersPatchSchema: z.ZodRecord<z.ZodString, z.ZodObject<{
+    enabled: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$loose>>;
+/**
+ * `ai.providers` as `GET /api/system-settings` answers it. `hasKey` is
+ * reported by consumers that know whether a deployment key is stored.
+ *
+ * @stability experimental
+ */
+export declare const aiProvidersResponseSchema: z.ZodRecord<z.ZodString, z.ZodObject<{
+    enabled: z.ZodBoolean;
+    hasKey: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$loose>>;
+/**
+ * `ai.providers` in an organization's overrides: it may only switch a
+ * provider off for its members.
+ *
+ * @stability experimental
+ */
+export declare const orgAiProvidersSchema: z.ZodRecord<z.ZodString, z.ZodObject<{
+    enabled: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>>;
+/**
+ * The stored `ai` system settings namespace: the deployment's AI policy.
+ * It carries no key (see `AI_SETTINGS_CARRIES_NO_SECRET`).
+ *
+ * @stability experimental
+ */
+export declare const systemAiSchema: z.ZodObject<{
+    enabled: z.ZodBoolean;
+    keyPolicy: z.ZodEnum<AiKeyPolicyEnum>;
+    providers: z.ZodRecord<z.ZodString, z.ZodObject<{
+        enabled: z.ZodBoolean;
+    }, z.core.$loose>>;
+    defaults: z.ZodObject<{
+        maxOutputTokensCap: z.ZodOptional<z.ZodNumber>;
+        allowBackgroundRuns: z.ZodBoolean;
+        allowRealtime: z.ZodBoolean;
+    }, z.core.$strip>;
+    logPromptContent: z.ZodBoolean;
+    usageRetentionDays: z.ZodNumber;
+    hostedTools: z.ZodObject<{
+        web_search: z.ZodBoolean;
+        file_search: z.ZodBoolean;
+        code_interpreter: z.ZodBoolean;
+        image_generation: z.ZodBoolean;
+        mcp: z.ZodBoolean;
+        mcpAllowedHosts: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>;
+    limits: z.ZodObject<{
+        perUser: z.ZodOptional<z.ZodObject<{
+            requestsPerMinute: z.ZodOptional<z.ZodNumber>;
+            requestsPerDay: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strip>>;
+        orgKey: z.ZodOptional<z.ZodObject<{
+            requestsPerDayPerUser: z.ZodOptional<z.ZodNumber>;
+            tokensPerDayPerUser: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strip>>;
+        perOrg: z.ZodOptional<z.ZodObject<{
+            requestsPerDay: z.ZodOptional<z.ZodNumber>;
+            outputTokensPerDay: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strip>>;
+        perModel: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+            maxOutputTokens: z.ZodOptional<z.ZodNumber>;
+            requestsPerMinutePerUser: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strip>>>;
+    }, z.core.$strip>;
+    deploymentKeyServesOrgs: z.ZodBoolean;
+}, z.core.$strip>;
+/**
+ * The stored `ai` namespace (`systemAiSchema`'s output).
+ *
+ * @stability experimental
+ */
+export type SystemAiValue = z.infer<typeof systemAiSchema>;
+/**
+ * `ai`, one level deep — matching `systemStoragePatchSchema`'s own shape one
+ * level further in: `providers` and `defaults` are each optional as a whole
+ * AND optional field by field inside, so
+ * `{ "ai": { "providers": { "openai": { "enabled": true } } } }` is a legal body that leaves `defaults` and
+ * `logPromptContent` untouched. See `SystemSettingsService.patchSettings`
+ * for the merge this shape is built to support.
+ */
+/**
+ * A `PATCH /api/system-settings` body's `ai` member: every field optional.
+ *
+ * @stability experimental
+ */
+export declare const systemAiPatchSchema: z.ZodObject<{
+    enabled: z.ZodOptional<z.ZodBoolean>;
+    keyPolicy: z.ZodOptional<z.ZodEnum<AiKeyPolicyEnum>>;
+    providers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        enabled: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$loose>>>;
+    defaults: z.ZodOptional<z.ZodObject<{
+        maxOutputTokensCap: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        allowBackgroundRuns: z.ZodOptional<z.ZodBoolean>;
+        allowRealtime: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>>;
+    logPromptContent: z.ZodOptional<z.ZodBoolean>;
+    usageRetentionDays: z.ZodOptional<z.ZodNumber>;
+    hostedTools: z.ZodOptional<z.ZodObject<{
+        web_search: z.ZodOptional<z.ZodBoolean>;
+        file_search: z.ZodOptional<z.ZodBoolean>;
+        code_interpreter: z.ZodOptional<z.ZodBoolean>;
+        image_generation: z.ZodOptional<z.ZodBoolean>;
+        mcp: z.ZodOptional<z.ZodBoolean>;
+        mcpAllowedHosts: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>;
+    limits: z.ZodOptional<z.ZodObject<{
+        perUser: z.ZodOptional<z.ZodObject<{
+            requestsPerMinute: z.ZodOptional<z.ZodNumber>;
+            requestsPerDay: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strip>>;
+        orgKey: z.ZodOptional<z.ZodObject<{
+            requestsPerDayPerUser: z.ZodOptional<z.ZodNumber>;
+            tokensPerDayPerUser: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strip>>;
+        perOrg: z.ZodOptional<z.ZodObject<{
+            requestsPerDay: z.ZodOptional<z.ZodNumber>;
+            outputTokensPerDay: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strip>>;
+        perModel: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+            maxOutputTokens: z.ZodOptional<z.ZodNumber>;
+            requestsPerMinutePerUser: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strip>>>;
+    }, z.core.$strip>>;
+    deploymentKeyServesOrgs: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+/**
+ * The admin `PUT /api/admin/ai/config` body's `limits`.
+ *
+ * @stability experimental
+ */
+export declare const aiLimitsSettingsSchema: z.ZodObject<{
+    perUser: z.ZodOptional<z.ZodObject<{
+        requestsPerMinute: z.ZodOptional<z.ZodNumber>;
+        requestsPerDay: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>>;
+    orgKey: z.ZodOptional<z.ZodObject<{
+        requestsPerDayPerUser: z.ZodOptional<z.ZodNumber>;
+        tokensPerDayPerUser: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>>;
+    perOrg: z.ZodOptional<z.ZodObject<{
+        requestsPerDay: z.ZodOptional<z.ZodNumber>;
+        outputTokensPerDay: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>>;
+    perModel: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        maxOutputTokens: z.ZodOptional<z.ZodNumber>;
+        requestsPerMinutePerUser: z.ZodOptional<z.ZodNumber>;
+    }, z.core.$strip>>>;
+}, z.core.$strip>;
+/**
+ * The `ai` namespace on the wire of `PUT /api/system-settings`.
+ *
+ * @stability experimental
+ */
+export declare const aiSettingsSchema: z.ZodObject<{
+    enabled: z.ZodBoolean;
+    keyPolicy: z.ZodEnum<AiKeyPolicyEnum>;
+    providers: z.ZodRecord<z.ZodString, z.ZodObject<{
+        enabled: z.ZodBoolean;
+    }, z.core.$loose>>;
+    defaults: z.ZodObject<{
+        maxOutputTokensCap: z.ZodOptional<z.ZodNumber>;
+        allowBackgroundRuns: z.ZodBoolean;
+        allowRealtime: z.ZodBoolean;
+    }, z.core.$strip>;
+    logPromptContent: z.ZodBoolean;
+    usageRetentionDays: z.ZodNumber;
+    hostedTools: z.ZodObject<{
+        web_search: z.ZodBoolean;
+        file_search: z.ZodBoolean;
+        code_interpreter: z.ZodBoolean;
+        image_generation: z.ZodBoolean;
+        mcp: z.ZodBoolean;
+        mcpAllowedHosts: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>;
+    limits: z.ZodObject<{
+        perUser: z.ZodOptional<z.ZodObject<{
+            requestsPerMinute: z.ZodOptional<z.ZodNumber>;
+            requestsPerDay: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strip>>;
+        orgKey: z.ZodOptional<z.ZodObject<{
+            requestsPerDayPerUser: z.ZodOptional<z.ZodNumber>;
+            tokensPerDayPerUser: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strip>>;
+        perOrg: z.ZodOptional<z.ZodObject<{
+            requestsPerDay: z.ZodOptional<z.ZodNumber>;
+            outputTokensPerDay: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strip>>;
+        perModel: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+            maxOutputTokens: z.ZodOptional<z.ZodNumber>;
+            requestsPerMinutePerUser: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strip>>>;
+    }, z.core.$strip>;
+    deploymentKeyServesOrgs: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+/**
+ * The `ai` namespace on the wire of `PATCH /api/system-settings`.
+ *
+ * @stability experimental
+ */
+export declare const aiSettingsPatchSchema: z.ZodObject<{
+    enabled: z.ZodOptional<z.ZodBoolean>;
+    keyPolicy: z.ZodOptional<z.ZodEnum<AiKeyPolicyEnum>>;
+    providers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        enabled: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$loose>>>;
+    defaults: z.ZodOptional<z.ZodObject<{
+        maxOutputTokensCap: z.ZodOptional<z.ZodNullable<z.ZodNumber>>;
+        allowBackgroundRuns: z.ZodOptional<z.ZodBoolean>;
+        allowRealtime: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>>;
+    logPromptContent: z.ZodOptional<z.ZodBoolean>;
+    usageRetentionDays: z.ZodOptional<z.ZodNumber>;
+    hostedTools: z.ZodOptional<z.ZodObject<{
+        web_search: z.ZodOptional<z.ZodBoolean>;
+        file_search: z.ZodOptional<z.ZodBoolean>;
+        code_interpreter: z.ZodOptional<z.ZodBoolean>;
+        image_generation: z.ZodOptional<z.ZodBoolean>;
+        mcp: z.ZodOptional<z.ZodBoolean>;
+        mcpAllowedHosts: z.ZodOptional<z.ZodArray<z.ZodString>>;
+    }, z.core.$strip>>;
+    limits: z.ZodOptional<z.ZodObject<{
+        perUser: z.ZodOptional<z.ZodObject<{
+            requestsPerMinute: z.ZodOptional<z.ZodNumber>;
+            requestsPerDay: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strip>>;
+        orgKey: z.ZodOptional<z.ZodObject<{
+            requestsPerDayPerUser: z.ZodOptional<z.ZodNumber>;
+            tokensPerDayPerUser: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strip>>;
+        perOrg: z.ZodOptional<z.ZodObject<{
+            requestsPerDay: z.ZodOptional<z.ZodNumber>;
+            outputTokensPerDay: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strip>>;
+        perModel: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+            maxOutputTokens: z.ZodOptional<z.ZodNumber>;
+            requestsPerMinutePerUser: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strip>>>;
+    }, z.core.$strip>>;
+    deploymentKeyServesOrgs: z.ZodOptional<z.ZodBoolean>;
+}, z.core.$strip>;
+/**
+ * The `ai` namespace as `GET /api/system-settings` answers it.
+ *
+ * @stability experimental
+ */
+export declare const aiResponseSchema: z.ZodObject<{
+    enabled: z.ZodBoolean;
+    keyPolicy: z.ZodEnum<AiKeyPolicyEnum>;
+    providers: z.ZodRecord<z.ZodString, z.ZodObject<{
+        enabled: z.ZodBoolean;
+        hasKey: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$loose>>;
+    defaults: z.ZodObject<{
+        maxOutputTokensCap: z.ZodOptional<z.ZodNumber>;
+        allowBackgroundRuns: z.ZodBoolean;
+        allowRealtime: z.ZodBoolean;
+    }, z.core.$strip>;
+    logPromptContent: z.ZodBoolean;
+    usageRetentionDays: z.ZodNumber;
+    hostedTools: z.ZodObject<{
+        web_search: z.ZodBoolean;
+        file_search: z.ZodBoolean;
+        code_interpreter: z.ZodBoolean;
+        image_generation: z.ZodBoolean;
+        mcp: z.ZodBoolean;
+        mcpAllowedHosts: z.ZodArray<z.ZodString>;
+    }, z.core.$strip>;
+    limits: z.ZodObject<{
+        perUser: z.ZodOptional<z.ZodObject<{
+            requestsPerMinute: z.ZodOptional<z.ZodNumber>;
+            requestsPerDay: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strip>>;
+        orgKey: z.ZodOptional<z.ZodObject<{
+            requestsPerDayPerUser: z.ZodOptional<z.ZodNumber>;
+            tokensPerDayPerUser: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strip>>;
+        perOrg: z.ZodOptional<z.ZodObject<{
+            requestsPerDay: z.ZodOptional<z.ZodNumber>;
+            outputTokensPerDay: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strip>>;
+        perModel: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+            maxOutputTokens: z.ZodOptional<z.ZodNumber>;
+            requestsPerMinutePerUser: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strip>>>;
+    }, z.core.$strip>;
+    deploymentKeyServesOrgs: z.ZodBoolean;
+}, z.core.$strip>;
+/**
+ * The fields of the `ai` namespace an organization may set for itself.
+ *
+ * @stability experimental
+ */
+export declare const orgAiSettingsSchema: z.ZodObject<{
+    enabled: z.ZodOptional<z.ZodBoolean>;
+    keyPolicy: z.ZodOptional<z.ZodEnum<AiKeyPolicyEnum>>;
+    providers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{
+        enabled: z.ZodOptional<z.ZodBoolean>;
+    }, z.core.$strip>>>;
+    limits: z.ZodOptional<z.ZodObject<{
+        perOrg: z.ZodOptional<z.ZodObject<{
+            requestsPerDay: z.ZodOptional<z.ZodNumber>;
+            outputTokensPerDay: z.ZodOptional<z.ZodNumber>;
+        }, z.core.$strip>>;
+    }, z.core.$strip>>;
+}, z.core.$strip>;
+/**
+ * One organization's stored `ai` overrides.
+ *
+ * @stability experimental
+ */
+export type OrgAiSettingsValue = z.infer<typeof orgAiSettingsSchema>;
+/**
+ * The effective `ai` policy of an organization: the deployment's value with
+ * the organization's overrides applied, each of which can only tighten it.
+ *
+ * @param system - the deployment's `ai` value.
+ * @param org - the organization's stored overrides.
+ * @returns the effective value (a new object; `system` is not modified).
+ *
+ * @stability experimental
+ */
+export declare function tightenAiPolicy(system: SystemAiValue, org: Partial<OrgAiSettingsValue>): SystemAiValue;
+/**
+ * Compile-time proof that the `ai` namespace has no secret-bearing field:
+ * `true`, or `never` (and the file stops compiling) when one is added.
+ *
+ * @stability experimental
+ */
+export type AiSettingsCarriesNoSecret = Extract<keyof SystemAiValue, AiSecretFieldNames> extends never ? true : never;
+/**
+ * The proof's witness value.
+ *
+ * @stability experimental
+ */
+export declare const AI_SETTINGS_CARRIES_NO_SECRET: AiSettingsCarriesNoSecret;
+//# sourceMappingURL=schemas.d.ts.map

package/dist/cjs/ai/schemas.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schemas.d.ts","sourceRoot":"","sources":["../../../src/ai/schemas.ts"],"names":[],"mappings":"AAcA,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAoBL,KAAK,eAAe,EACpB,KAAK,oBAAoB,EACzB,KAAK,kBAAkB,EACxB,MAAM,gBAAgB,CAAC;AAKxB;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,eAAO,MAAM,oBAAoB;;;;;iBAU/B,CAAC;AAEH;;;;GAIG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAEvE;;;;;;;GAOG;AACH,eAAO,MAAM,yBAAyB;;;;;iBAUpC,CAAC;AAEH;;;;GAIG;AACH,MAAM,MAAM,wBAAwB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,yBAAyB,CAAC,CAAC;AAmBjF;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,aAAsD,CAAC;AAEtF;;;;;;;;;;;;;;;;;;GAkBG;AACH,eAAO,MAAM,oBAAoB;;;;;;;;;;;;;;;;;iBA8C/B,CAAC;AAEH;;;;GAIG;AACH,MAAM,MAAM,mBAAmB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,oBAAoB,CAAC,CAAC;AAGvE;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4EG;AACH;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB;;;iBAKjC,CAAC;AA0BH;;;;GAIG;AACH,wBAAgB,mBAAmB,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,eAS7D;AAWD;;;;GAIG;AACH,eAAO,MAAM,wBAAwB,uCAOjC,CAAC;AAEL;;;;;;;;;;;;;;;;;;;GAmBG;AACH,eAAO,MAAM,2BAA2B;;;;;;iBAStC,CAAC;AAEH;;;;;;;;;;;;;;;GAeG;AACH,eAAO,MAAM,gCAAgC;;;;;iBAO3C,CAAC;AAaH;;;;;;;GAOG;AACH,eAAO,MAAM,kBAAkB,aAA2C,CAAC;AAE3E;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB;;iBAG/B,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB;;iBAGpC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,uBAAuB;;kBAAqD,CAAC;AAE1F;;;;;GAKG;AACH,eAAO,MAAM,4BAA4B;;kBAA0D,CAAC;AAEpG;;;;;GAKG;AACH,eAAO,MAAM,yBAAyB;;;kBAQrC,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,oBAAoB;;kBAMhC,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,cAAc;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA4CzB,CAAC;AAEH;;;;GAIG;AACH,MAAM,MAAM,aAAa,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,cAAc,CAAC,CAAC;AAE3D;;;;;;;GAOG;AAQH;;;;GAIG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAkD9B,CAAC;AAsBH;;;;GAIG;AACH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;;iBA8CjC,CAAC;AAEH;;;;GAIG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA2C3B,CAAC;AAOH;;;;GAIG;AACH,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBAiDhC,CAAC;AAWH;;;;GAIG;AACH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iBA+E3B,CAAC;AAYH;;;;GAIG;AACH,eAAO,MAAM,mBAAmB;;;;;;;;;;;;iBAqB9B,CAAC;AAEH;;;;GAIG;AACH,MAAM,MAAM,kBAAkB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,mBAAmB,CAAC,CAAC;AAQrE;;;;;;;;;GASG;AACH,wBAAgB,eAAe,CAAC,MAAM,EAAE,aAAa,EAAE,GAAG,EAAE,OAAO,CAAC,kBAAkB,CAAC,GAAG,aAAa,CA4BtG;AAqBD;;;;;GAKG;AACH,MAAM,MAAM,yBAAyB,GACnC,OAAO,CAAC,MAAM,aAAa,EAAE,kBAAkB,CAAC,SAAS,KAAK,GAAG,IAAI,GAAG,KAAK,CAAC;AAEhF;;;;GAIG;AACH,eAAO,MAAM,6BAA6B,EAAE,yBAAgC,CAAC"}