@naturali/cli 0.133.3 → 0.135.0

package/dist/index.mjs

@@ -17,7 +17,7 @@ var __exportAll = (all, no_symbols) => {
 };
 //#endregion
 //#region package.json
-var version = "0.133.3";
+var version = "0.135.0";
 //#endregion
 //#region ../sdk/src/generated/core/bodySerializer.gen.ts
 const serializeFormDataPair = (data, key, value) => {
@@ -1492,7 +1492,7 @@ var ApiKeys = class {
 	* Create an API key
 	*
 	* Creates an API key. When `project_id` is set the key is scoped to that project (the default and recommended stance); omit it for an account-scoped key. `capabilities` narrows what the key may do; when omitted the key inherits the creator's capabilities. The raw `key` (nat_sk_…) is returned only in this response.
-	* A project-scoped key requires the `admin` role in that project: the key is a standing credential for everything the project can do, so handing one out is an administrative act rather than something a read-only `member` can do for themselves. An account-scoped key requires a credential that is not itself confined to one project.
+	* A project-scoped key requires membership of that project. The key carries no role of its own — every request it makes resolves its holder's membership again — so it can never reach past what its minter already had. An account-scoped key requires a credential that is not itself confined to one project.
 	* A connected app cannot create keys at all: a grant is revocable and a key is not, so a key minted under a grant would still work after the app was disconnected. Reading and revoking keys stay available.
 	*
 	*/
@@ -3745,8 +3745,9 @@ var Projects = class {
 	/**
 	* Update a project
 	*
-	* Rename or archive a project, and/or change its content-retention settings (`trace_content_retention_days`, `trace_content_mode`). Archiving is reversible; resources are retained.
-	* Requires the `admin` role in the project (an `owner` has it too).
+	* Rename or archive a project, and/or change its content-retention settings (`trace_content_retention_days`, `trace_content_mode`), its execution ceilings (`max_concurrent_runs`, `max_chain_generations`, `max_orchestration_run_depth`) and its priced-model gate (`require_priced_model`). Archiving is reversible; resources are retained.
+	* Requires the `admin` role in the project (an `owner` has it too). These are the terms every member works under, which is why setting them sits above the role that works under them.
+	* The ceilings and the priced-model gate are uncapped by plan: each one only ever narrows what the project may spend, so setting one takes on a restriction rather than claiming an entitlement. On the three ceilings `null` clears the project's own bound and omission leaves it alone — they are different instructions.
 	* The two retention controls answer different questions. The window bounds how long content *stays* — a daily sweep purges anything past it, leaving auditable skeletons behind. `trace_content_mode: none` means content is never *written*, which is the stronger guarantee: it cannot be missed by a sweep or survive in a backup.
 	*
 	* Your plan sets the longest window you may keep content for. A wider one — `null` included, which keeps content indefinitely — responds `403` with `plan_limit_reached`, whose `details` carry the `plan` and the `limit` in days. Anything shorter is always allowed. Moving to a plan with a shorter window takes effect at the end of the billing cycle, and content already stored is then purged by age like everything else.
@@ -3765,7 +3766,7 @@ var Projects = class {
 	/**
 	* List project members
 	*
-	* Lists who may act in the project, and with what role. Readable by every member, including a read-only `member`: who else is in the project is not a privileged fact, and hiding it makes "why can that person see my agents?" unanswerable.
+	* Lists who may act in the project, and with what role. Readable by every member, whatever their role: who else is in the project is not a privileged fact, and hiding it makes "why can that person see my agents?" unanswerable.
 	* Somebody invited who has never signed in is listed too, with status `pending` — the invitation is already a grant, so hiding it until they arrive would hide access that exists.
 	*
 	*/
@@ -3802,7 +3803,7 @@ var Projects = class {
 	*
 	* Removes a member, or leaves the project yourself.
 	*
-	* **Anyone may remove themselves**, whatever their role: a colleague who no longer wants access should not have to ask for it, and leaving takes nothing from anybody else. Removing *somebody else* needs authority — an `owner` may remove anyone, an `admin` may remove a read-only `member` and not another `admin`.
+	* **Anyone may remove themselves**, whatever their role: a colleague who no longer wants access should not have to ask for it, and leaving takes nothing from anybody else. Removing *somebody else* needs authority — an `owner` may remove anyone, an `admin` may remove a `member` and not another `admin`.
 	*
 	* The owner's own row is refused: a project with no owner is unreachable, and the row names who pays.
 	*
@@ -7869,7 +7870,7 @@ const routes = {
 	"create-api-key": {
 		serviceClass: "APIKeys",
 		operationId: "createApiKey",
-		description: "Creates an API key. When `project_id` is set the key is scoped to that project (the default and recommended stance); omit it for an account-scoped key. `capabilities` narrows what the key may do; when omitted the key inherits the creator's capabilities. The raw `key` (nat_sk_…) is returned only in this response. A project-scoped key requires the `admin` role in that project: the key is a standing credential for everything the project can do, so handing one out is an administrative act rather than something a read-only `member` can do for themselves. An account-scoped key requires a credential that is not itself confined to one project. A connected app cannot create keys at all: a grant is revocable and a key is not, so a key minted under a grant would still work after the app was disconnected. Reading and revoking keys stay available.",
+		description: "Creates an API key. When `project_id` is set the key is scoped to that project (the default and recommended stance); omit it for an account-scoped key. `capabilities` narrows what the key may do; when omitted the key inherits the creator's capabilities. The raw `key` (nat_sk_…) is returned only in this response. A project-scoped key requires membership of that project. The key carries no role of its own — every request it makes resolves its holder's membership again — so it can never reach past what its minter already had. An account-scoped key requires a credential that is not itself confined to one project. A connected app cannot create keys at all: a grant is revocable and a key is not, so a key minted under a grant would still work after the app was disconnected. Reading and revoking keys stay available.",
 		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/api-keys",
 		httpMethod: "post",
 		pathParams: [],
@@ -15054,7 +15055,7 @@ const routes = {
 	"update-project": {
 		serviceClass: "Projects",
 		operationId: "updateProject",
-		description: "Rename or archive a project, and/or change its content-retention settings (`trace_content_retention_days`, `trace_content_mode`). Archiving is reversible; resources are retained. Requires the `admin` role in the project (an `owner` has it too). The two retention controls answer different questions. The window bounds how long content *stays* — a daily sweep purges anything past it, leaving auditable skeletons behind. `trace_content_mode: none` means content is never *written*, which is the stronger guarantee: it cannot be missed by a sweep or survive in a backup. Your plan sets the longest window you may keep content for. A wider one — `null` included, which keeps content indefinitely — responds `403` with `plan_limit_reached`, whose `details` carry the `plan` and the `limit` in days. Anything shorter is always allowed. Moving to a plan with a shorter window takes effect at the end of the billing cycle, and content already stored is then purged by age like everything else.",
+		description: "Rename or archive a project, and/or change its content-retention settings (`trace_content_retention_days`, `trace_content_mode`), its execution ceilings (`max_concurrent_runs`, `max_chain_generations`, `max_orchestration_run_depth`) and its priced-model gate (`require_priced_model`). Archiving is reversible; resources are retained. Requires the `admin` role in the project (an `owner` has it too). These are the terms every member works under, which is why setting them sits above the role that works under them. The ceilings and the priced-model gate are uncapped by plan: each one only ever narrows what the project may spend, so setting one takes on a restriction rather than claiming an entitlement. On the three ceilings `null` clears the project's own bound and omission leaves it alone — they are different instructions. The two retention controls answer different questions. The window bounds how long content *stays* — a daily sweep purges anything past it, leaving auditable skeletons behind. `trace_content_mode: none` means content is never *written*, which is the stronger guarantee: it cannot be missed by a sweep or survive in a backup. Your plan sets the longest window you may keep content for. A wider one — `null` included, which keeps content indefinitely — responds `403` with `plan_limit_reached`, whose `details` carry the `plan` and the `limit` in days. Anything shorter is always allowed. Moving to a plan with a shorter window takes effect at the end of the billing cycle, and content already stored is then purged by age like everything else.",
 		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/projects",
 		httpMethod: "patch",
 		pathParams: ["project_id"],
@@ -15096,6 +15097,34 @@ const routes = {
 				"required": false,
 				"type": "string",
 				"in": "body"
+			},
+			{
+				"name": "max_concurrent_runs",
+				"description": "Orchestration runs driven at once. Send `null` to lift the limit. Omitting the field leaves it unchanged.\n",
+				"required": false,
+				"type": "integer",
+				"in": "body"
+			},
+			{
+				"name": "max_chain_generations",
+				"description": "Generations one continuation chain may hold. Send `null` to drop back to the platform-wide ceiling. Omitting the field leaves it unchanged.\n",
+				"required": false,
+				"type": "integer",
+				"in": "body"
+			},
+			{
+				"name": "max_orchestration_run_depth",
+				"description": "Nesting levels a run tree may reach. Send `null` to drop back to the platform-wide bound. Omitting the field leaves it unchanged.\n",
+				"required": false,
+				"type": "integer",
+				"in": "body"
+			},
+			{
+				"name": "require_priced_model",
+				"description": "Refuse a generation whose model carries no price, before the provider is called. Uncapped by plan — it only ever narrows what the project may spend.\n",
+				"required": false,
+				"type": "boolean",
+				"in": "body"
 			}
 		]
 	},
@@ -15126,7 +15155,7 @@ const routes = {
 	"list-project-members": {
 		serviceClass: "Projects",
 		operationId: "listProjectMembers",
-		description: "Lists who may act in the project, and with what role. Readable by every member, including a read-only `member`: who else is in the project is not a privileged fact, and hiding it makes \"why can that person see my agents?\" unanswerable. Somebody invited who has never signed in is listed too, with status `pending` — the invitation is already a grant, so hiding it until they arrive would hide access that exists.",
+		description: "Lists who may act in the project, and with what role. Readable by every member, whatever their role: who else is in the project is not a privileged fact, and hiding it makes \"why can that person see my agents?\" unanswerable. Somebody invited who has never signed in is listed too, with status `pending` — the invitation is already a grant, so hiding it until they arrive would hide access that exists.",
 		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/projects",
 		httpMethod: "get",
 		pathParams: ["project_id"],
@@ -15212,7 +15241,7 @@ const routes = {
 	"remove-project-member": {
 		serviceClass: "Projects",
 		operationId: "removeProjectMember",
-		description: "Removes a member, or leaves the project yourself. **Anyone may remove themselves**, whatever their role: a colleague who no longer wants access should not have to ask for it, and leaving takes nothing from anybody else. Removing *somebody else* needs authority — an `owner` may remove anyone, an `admin` may remove a read-only `member` and not another `admin`. The owner's own row is refused: a project with no owner is unreachable, and the row names who pays.",
+		description: "Removes a member, or leaves the project yourself. **Anyone may remove themselves**, whatever their role: a colleague who no longer wants access should not have to ask for it, and leaving takes nothing from anybody else. Removing *somebody else* needs authority — an `owner` may remove anyone, an `admin` may remove a `member` and not another `admin`. The owner's own row is refused: a project with no owner is unreachable, and the row names who pays.",
 		moduleDocsUrl: "https://docs.naturali.ai/docs/modules/projects",
 		httpMethod: "delete",
 		pathParams: ["project_id", "member_id"],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@naturali/cli",
-  "version": "0.133.3",
+  "version": "0.135.0",
   "description": "Command-line interface for the naturali.ai API, generated from its OpenAPI specs",
   "type": "module",
   "bin": {
@@ -25,7 +25,7 @@
     "yaml": "^2.9.1"
   },
   "devDependencies": {
-    "@naturali/sdk": "0.133.3",
+    "@naturali/sdk": "0.135.0",
     "@ttoss/openapi-codegen": "^0.3.1",
     "@types/node": "^26.5.1",
     "tsdown": "^0.23.0",