@mccaskie-labs/workbench-config 0.1.29 → 0.1.31

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @mccaskie-labs/workbench-config
 
+## 0.1.31
+
+### Patch Changes
+
+- The `gateway` manifest lists the `X-Workbench-Keep` request header (kept calls, `docs/spec.md` §2.9), and says what `X-Workbench-Subject` should hold for an app with signed-in users.
+
+## 0.1.30
+
+### Patch Changes
+
+- The Gateway manifest's `budget_exceeded` now names which cap was reached: a tool's, the environment's or the global ceiling.
+
 ## 0.1.29
 
 ### Patch Changes

package/capabilities/gateway.json

@@ -37,7 +37,8 @@
       { "name": "Authorization", "required": true, "description": "Bearer <key>. On /anthropic/* the key goes in x-api-key instead, so the official SDK works unchanged" },
       { "name": "X-Workbench-Job", "required": true, "pattern": "^[a-z0-9._-]{1,64}$", "description": "What the call is for, e.g. article.write. Recorded with usage" },
       { "name": "X-Workbench-Prompt-Version", "required": false, "description": "The app's prompt version, recorded with usage (audit F17)" },
-      { "name": "X-Workbench-Subject", "required": false, "pattern": "^[a-z0-9_-]+:[^\\s]{1,128}$", "description": "type:id of the thing the call is about" },
+      { "name": "X-Workbench-Subject", "required": false, "pattern": "^[a-z0-9_-]+:[^\\s]{1,128}$", "description": "type:id of the thing the call is about. An app with signed-in users sends user:<its own user id>, never a name, email address or phone number, so a person's kept calls can be found and deleted (spec §2.9)" },
+      { "name": "X-Workbench-Keep", "required": false, "pattern": "^(yes|no)$", "description": "no: keep this AI call's facts but not its text (spec §2.9). A refused call is kept whatever it says. Left out, the project's own setting decides (on by default)" },
       { "name": "Idempotency-Key", "required": false, "description": "Email only: a repeat within 24 hours returns the stored result" },
       { "name": "X-Workbench-Env", "required": false, "pattern": "^(development|staging|production)$", "description": "The caller's WORKBENCH_ENV. The packages send it; a key from another environment is then refused with unauthorised" }
     ],
@@ -54,7 +55,7 @@
     { "code": "unauthorised", "http": 401, "retryable": false, "meaning": "No key, a malformed or unknown key, a revoked key, or a key from the wrong environment" },
     { "code": "forbidden_scope", "http": 403, "retryable": false, "meaning": "The key doesn't carry the scope this endpoint needs" },
     { "code": "invalid_request", "http": 400, "retryable": false, "meaning": "The body or a required header is missing or malformed" },
-    { "code": "budget_exceeded", "http": 402, "retryable": false, "meaning": "The environment's enforced monthly budget, or the global ceiling, is reached" },
+    { "code": "budget_exceeded", "http": 402, "retryable": false, "meaning": "An enforced monthly cap is reached: the tool's cap (AI text, AI images, image search or email), the environment's budget or the global ceiling, whichever comes first. The error names it in budget (tool, environment or global) and, for a tool, tool" },
     { "code": "content_refused", "http": 422, "retryable": false, "meaning": "The Workbench content rules refuse what was sent (stage input) or what the vendor made (stage output). The error names the rule, the stage and the rules version, never the content. A vendor's own safety block is reported the same way, with rule vendor" },
     { "code": "content_check_unavailable", "http": 503, "retryable": true, "meaning": "The content check couldn't be run, so nothing was returned. Nothing passes unchecked" },
     { "code": "rate_limited", "http": 429, "retryable": true, "meaning": "Per-key rate limit; it stops runaway loops, budgets limit spend" },

package/dist/capabilities.gen.d.ts

@@ -1,4 +1,4 @@
-export declare const MANIFEST_VERSION: "4538a59cfe87";
+export declare const MANIFEST_VERSION: "0f2fa24af1ca";
 export declare const capabilities: {
     readonly ai: {
         readonly $schema: "./schema.json";
@@ -1203,7 +1203,12 @@ export declare const capabilities: {
                 readonly name: "X-Workbench-Subject";
                 readonly required: false;
                 readonly pattern: "^[a-z0-9_-]+:[^\\s]{1,128}$";
-                readonly description: "type:id of the thing the call is about";
+                readonly description: "type:id of the thing the call is about. An app with signed-in users sends user:<its own user id>, never a name, email address or phone number, so a person's kept calls can be found and deleted (spec §2.9)";
+            }, {
+                readonly name: "X-Workbench-Keep";
+                readonly required: false;
+                readonly pattern: "^(yes|no)$";
+                readonly description: "no: keep this AI call's facts but not its text (spec §2.9). A refused call is kept whatever it says. Left out, the project's own setting decides (on by default)";
             }, {
                 readonly name: "Idempotency-Key";
                 readonly required: false;
@@ -1263,7 +1268,7 @@ export declare const capabilities: {
             readonly code: "budget_exceeded";
             readonly http: 402;
             readonly retryable: false;
-            readonly meaning: "The environment's enforced monthly budget, or the global ceiling, is reached";
+            readonly meaning: "An enforced monthly cap is reached: the tool's cap (AI text, AI images, image search or email), the environment's budget or the global ceiling, whichever comes first. The error names it in budget (tool, environment or global) and, for a tool, tool";
         }, {
             readonly code: "content_refused";
             readonly http: 422;

package/dist/capabilities.gen.js

@@ -1,6 +1,6 @@
 // Generated by `npm run capabilities:build` from capabilities/*.json. Do not edit.
 // check:capabilities fails in Checks when this file is stale.
-export const MANIFEST_VERSION = "4538a59cfe87";
+export const MANIFEST_VERSION = "0f2fa24af1ca";
 export const capabilities = {
     "ai": {
         "$schema": "./schema.json",
@@ -1653,7 +1653,13 @@ export const capabilities = {
                     "name": "X-Workbench-Subject",
                     "required": false,
                     "pattern": "^[a-z0-9_-]+:[^\\s]{1,128}$",
-                    "description": "type:id of the thing the call is about"
+                    "description": "type:id of the thing the call is about. An app with signed-in users sends user:<its own user id>, never a name, email address or phone number, so a person's kept calls can be found and deleted (spec §2.9)"
+                },
+                {
+                    "name": "X-Workbench-Keep",
+                    "required": false,
+                    "pattern": "^(yes|no)$",
+                    "description": "no: keep this AI call's facts but not its text (spec §2.9). A refused call is kept whatever it says. Left out, the project's own setting decides (on by default)"
                 },
                 {
                     "name": "Idempotency-Key",
@@ -1733,7 +1739,7 @@ export const capabilities = {
                 "code": "budget_exceeded",
                 "http": 402,
                 "retryable": false,
-                "meaning": "The environment's enforced monthly budget, or the global ceiling, is reached"
+                "meaning": "An enforced monthly cap is reached: the tool's cap (AI text, AI images, image search or email), the environment's budget or the global ceiling, whichever comes first. The error names it in budget (tool, environment or global) and, for a tool, tool"
             },
             {
                 "code": "content_refused",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mccaskie-labs/workbench-config",
-  "version": "0.1.29",
+  "version": "0.1.31",
   "description": "Workbench app configuration: WORKBENCH_ENV, typed variables that fail by name, secrets that are never printed, and the capabilities manifest.",
   "license": "UNLICENSED",
   "type": "module",