@mccaskie-labs/workbench-config 0.1.9 → 0.1.11

package/CHANGELOG.md

@@ -1,5 +1,17 @@
 # @mccaskie-labs/workbench-config
 
+## 0.1.11
+
+### Patch Changes
+
+- The Gateway's error list gains `content_refused` (422) and `content_check_unavailable` (503) for the Workbench content rules (`docs/spec.md` §2.7).
+
+## 0.1.10
+
+### Patch Changes
+
+- `gateway.budget-enforced` describes the development key's US$0 enforce budget (changed 11 November 2026, `docs/phase-4-plan.md` §3 Q10), with a cost hint of US$0, since the call is refused before any spend.
+
 ## 0.1.9
 
 ### Patch Changes

package/capabilities/gateway.json

@@ -55,6 +55,8 @@
     { "code": "forbidden_scope", "http": 403, "retryable": false, "meaning": "The key doesn't carry the scope this endpoint needs" },
     { "code": "invalid_request", "http": 400, "retryable": false, "meaning": "The body or a required header is missing or malformed" },
     { "code": "budget_exceeded", "http": 402, "retryable": false, "meaning": "The environment's enforced monthly budget, or the global ceiling, is reached" },
+    { "code": "content_refused", "http": 422, "retryable": false, "meaning": "The Workbench content rules refuse what was sent (stage input) or what the vendor made (stage output). The error names the rule, the stage and the rules version, never the content. A vendor's own safety block is reported the same way, with rule vendor" },
+    { "code": "content_check_unavailable", "http": 503, "retryable": true, "meaning": "The content check couldn't be run, so nothing was returned. Nothing passes unchecked" },
     { "code": "rate_limited", "http": 429, "retryable": true, "meaning": "Per-key rate limit; it stops runaway loops, budgets limit spend" },
     { "code": "not_available", "http": 501, "retryable": false, "meaning": "Not built yet, e.g. bulk email" },
     { "code": "upstream_error", "http": 502, "retryable": true, "meaning": "The vendor failed after the Gateway's retries" },
@@ -75,7 +77,7 @@
     { "id": "gateway.wrong-scope", "half": "runtime", "expect": "refused_as_expected", "refusal": "forbidden_scope", "cost_hint_usd": 0 },
     { "id": "gateway.wrong-environment", "half": "runtime", "expect": "refused_as_expected", "refusal": "unauthorised", "cost_hint_usd": 0 },
     { "id": "gateway.revoked-key", "half": "runtime", "expect": "refused_as_expected", "refusal": "unauthorised", "cost_hint_usd": 0, "note": "Stops within 60 seconds of revocation" },
-    { "id": "gateway.budget-enforced", "half": "runtime", "expect": "refused_as_expected", "refusal": "budget_exceeded", "cost_hint_usd": 0.01, "note": "Uses the development key's US$0.01 enforce budget (docs/phase-4-plan.md §3 Q10)" },
+    { "id": "gateway.budget-enforced", "half": "runtime", "expect": "refused_as_expected", "refusal": "budget_exceeded", "cost_hint_usd": 0, "note": "Uses the development key's US$0 enforce budget, so it is refused before any spend (docs/phase-4-plan.md §3 Q10)" },
     { "id": "gateway.no-vendor-keys.scan", "half": "runtime", "expect": "pass", "cost_hint_usd": 0, "note": "Manual: grep of the repo and cf_worker_secret_list show only WORKBENCH_GATEWAY_* secrets" }
   ]
 }

package/dist/capabilities.gen.d.ts

@@ -1,4 +1,4 @@
-export declare const MANIFEST_VERSION: "ffb5a8a16ad1";
+export declare const MANIFEST_VERSION: "debb0b3db404";
 export declare const capabilities: {
     readonly ai: {
         readonly $schema: "./schema.json";
@@ -935,6 +935,16 @@ export declare const capabilities: {
             readonly http: 402;
             readonly retryable: false;
             readonly meaning: "The environment's enforced monthly budget, or the global ceiling, is reached";
+        }, {
+            readonly code: "content_refused";
+            readonly http: 422;
+            readonly retryable: false;
+            readonly meaning: "The Workbench content rules refuse what was sent (stage input) or what the vendor made (stage output). The error names the rule, the stage and the rules version, never the content. A vendor's own safety block is reported the same way, with rule vendor";
+        }, {
+            readonly code: "content_check_unavailable";
+            readonly http: 503;
+            readonly retryable: true;
+            readonly meaning: "The content check couldn't be run, so nothing was returned. Nothing passes unchecked";
         }, {
             readonly code: "rate_limited";
             readonly http: 429;
@@ -1034,8 +1044,8 @@ export declare const capabilities: {
             readonly half: "runtime";
             readonly expect: "refused_as_expected";
             readonly refusal: "budget_exceeded";
-            readonly cost_hint_usd: 0.01;
-            readonly note: "Uses the development key's US$0.01 enforce budget (docs/phase-4-plan.md §3 Q10)";
+            readonly cost_hint_usd: 0;
+            readonly note: "Uses the development key's US$0 enforce budget, so it is refused before any spend (docs/phase-4-plan.md §3 Q10)";
         }, {
             readonly id: "gateway.no-vendor-keys.scan";
             readonly half: "runtime";

package/dist/capabilities.gen.js

@@ -1,6 +1,6 @@
 // Generated by `npm run capabilities:build` from capabilities/*.json. Do not edit.
 // check:capabilities fails in Checks when this file is stale.
-export const MANIFEST_VERSION = "ffb5a8a16ad1";
+export const MANIFEST_VERSION = "debb0b3db404";
 export const capabilities = {
     "ai": {
         "$schema": "./schema.json",
@@ -1253,6 +1253,18 @@ export const capabilities = {
                 "retryable": false,
                 "meaning": "The environment's enforced monthly budget, or the global ceiling, is reached"
             },
+            {
+                "code": "content_refused",
+                "http": 422,
+                "retryable": false,
+                "meaning": "The Workbench content rules refuse what was sent (stage input) or what the vendor made (stage output). The error names the rule, the stage and the rules version, never the content. A vendor's own safety block is reported the same way, with rule vendor"
+            },
+            {
+                "code": "content_check_unavailable",
+                "http": 503,
+                "retryable": true,
+                "meaning": "The content check couldn't be run, so nothing was returned. Nothing passes unchecked"
+            },
             {
                 "code": "rate_limited",
                 "http": 429,
@@ -1370,8 +1382,8 @@ export const capabilities = {
                 "half": "runtime",
                 "expect": "refused_as_expected",
                 "refusal": "budget_exceeded",
-                "cost_hint_usd": 0.01,
-                "note": "Uses the development key's US$0.01 enforce budget (docs/phase-4-plan.md §3 Q10)"
+                "cost_hint_usd": 0,
+                "note": "Uses the development key's US$0 enforce budget, so it is refused before any spend (docs/phase-4-plan.md §3 Q10)"
             },
             {
                 "id": "gateway.no-vendor-keys.scan",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@mccaskie-labs/workbench-config",
-  "version": "0.1.9",
+  "version": "0.1.11",
   "description": "Workbench app configuration: WORKBENCH_ENV, typed variables that fail by name, secrets that are never printed, and the capabilities manifest.",
   "license": "UNLICENSED",
   "type": "module",