@naturali/cli 0.209.2 → 0.209.3

package/dist/index.mjs

@@ -17,7 +17,7 @@ var __exportAll = (all, no_symbols) => {
 };
 //#endregion
 //#region package.json
-var version = "0.209.2";
+var version = "0.209.3";
 //#endregion
 //#region ../sdk/src/generated/core/bodySerializer.gen.ts
 const serializeFormDataPair = (data, key, value) => {
@@ -2645,10 +2645,7 @@ var Embeddings = class {
 	* Provide `input` for a single text or `inputs` for a batch. At least one is required.
 	* Returns `embedding` when `input` is used, and `embeddings` when `inputs` is used.
 	*
-	* `project_id` names the project the call's token usage is metered against, so
-	* embedding spend reaches the usage rollup and the project's `cost_usd` / `tokens`
-	* quotas. A project-scoped credential supplies its own project; a call that names
-	* none and is bound to none is `400 VALIDATION_FAILED`.
+	* The call's token usage is metered against the project in the path, so embedding spend reaches the usage rollup and the project's `cost_usd` / `tokens` quotas. A body `project_id` is ignored.
 	*
 	*/
 	static createEmbeddings(options) {
@@ -3699,7 +3696,7 @@ var Listings = class {
 	* Update a listing
 	*
 	* Change the title or description, or pause and resume the listing.
-	* `state: suspended` stops the listing for every installing project at once; their installs are kept. `state: listed` resumes a listing you suspended, provided naturali had listed it; nobody reinstalls. A listing naturali suspended cannot be resumed here, and an invalid move answers `409 invalid_listing_state`.
+	* `state: suspended` stops a `listed` listing for every installing project at once; their installs are kept. `state: listed` resumes a listing you suspended, provided naturali had listed it; nobody reinstalls. A listing naturali suspended cannot be resumed here, and an invalid move answers `409 invalid_listing_state`.
 	*
 	*/
 	static updateListing(options) {
@@ -8595,7 +8592,7 @@ const routes = {
 			},
 			{
 				"name": "version_label",
-				"description": "Optional tag for the config version this write archives (e.g. `initial`). Annotates the version only — it is not stored on the agent and is not part of the config, so labelling a change is never itself a change.",
+				"description": "Optional tag for the config version this write creates (e.g. `initial`). Annotates the version only — it is not stored on the agent and is not part of the config, so labelling a change is never itself a change.",
 				"required": false,
 				"type": "string",
 				"in": "body"
@@ -8821,7 +8818,7 @@ const routes = {
 			},
 			{
 				"name": "version_label",
-				"description": "Optional tag for the config version this write archives (e.g. `pre-tone-change`). Annotates the version only — it is not stored on the agent and is not part of the config, so labelling a change is never itself a change. Ignored when the write changes nothing, since no version is created.",
+				"description": "Optional tag for the config version this write creates (e.g. `tone-change`). Annotates the version only — it is not stored on the agent and is not part of the config, so labelling a change is never itself a change. Ignored when the write changes nothing, since no version is created.",
 				"required": false,
 				"type": "string",
 				"in": "body"
@@ -9030,7 +9027,7 @@ const routes = {
 			},
 			{
 				"name": "version_label",
-				"description": "Optional tag for the config version this write archives (e.g. `pre-tone-change`). Annotates the version only — it is not stored on the agent and is not part of the config, so labelling a change is never itself a change. Ignored when the write changes nothing, since no version is created.",
+				"description": "Optional tag for the config version this write creates (e.g. `tone-change`). Annotates the version only — it is not stored on the agent and is not part of the config, so labelling a change is never itself a change. Ignored when the write changes nothing, since no version is created.",
 				"required": false,
 				"type": "string",
 				"in": "body"
@@ -10127,7 +10124,7 @@ const routes = {
 			},
 			{
 				"name": "arguments",
-				"description": "Edited arguments to execute instead of the proposed ones. Editing composes a new call, so it additionally requires permission to make that call: `tools:CallTool` on the tool, and for a `builtin` proposal the action's own IAM action.",
+				"description": "Edited arguments to execute instead of the proposed ones. Editing composes a new call, so it additionally requires permission to make that call: `tools:CallTool` on the tool, and for a `builtin` proposal the action's own IAM action. Refused on an item with no `proposed_action`.",
 				"required": false,
 				"type": "object",
 				"in": "body"
@@ -12333,7 +12330,7 @@ const routes = {
 			},
 			{
 				"name": "version_label",
-				"description": "Optional tag for the version this write archives. Ignored when the write changes no question, since no version is archived.",
+				"description": "Optional tag for the version this write creates. Ignored when the write changes no question, since no version is archived.",
 				"required": false,
 				"type": "string",
 				"in": "body"
@@ -12793,7 +12790,7 @@ const routes = {
 			},
 			{
 				"name": "filename",
-				"description": "",
+				"description": "Download name. Defaults to the leaf of `path`.",
 				"required": false,
 				"type": "string",
 				"in": "body"
@@ -13251,7 +13248,7 @@ const routes = {
 			},
 			{
 				"name": "version_label",
-				"description": "Optional tag for the tombstone version this write archives.",
+				"description": "Optional tag for the tombstone version this write creates.",
 				"required": false,
 				"type": "string",
 				"in": "body"
@@ -13553,7 +13550,7 @@ const routes = {
 	"create-embeddings": {
 		serviceClass: "Embeddings",
 		operationId: "createEmbeddings",
-		description: "Generates embedding vectors for one or more text inputs using the server's configured embedding model. Provide `input` for a single text or `inputs` for a batch. At least one is required. Returns `embedding` when `input` is used, and `embeddings` when `inputs` is used. `project_id` names the project the call's token usage is metered against, so embedding spend reaches the usage rollup and the project's `cost_usd` / `tokens` quotas. A project-scoped credential supplies its own project; a call that names none and is bound to none is `400 VALIDATION_FAILED`.",
+		description: "Generates embedding vectors for one or more text inputs using the server's configured embedding model. Provide `input` for a single text or `inputs` for a batch. At least one is required. Returns `embedding` when `input` is used, and `embeddings` when `inputs` is used. The call's token usage is metered against the project in the path, so embedding spend reaches the usage rollup and the project's `cost_usd` / `tokens` quotas. A body `project_id` is ignored.",
 		moduleDocsUrl: "https://naturali.ai/docs/modules/embeddings",
 		httpMethod: "post",
 		pathParams: ["project_id"],
@@ -13570,7 +13567,7 @@ const routes = {
 			},
 			{
 				"name": "input",
-				"description": "Single text to embed.",
+				"description": "Single text to embed. An empty string is `400 VALIDATION_FAILED`.",
 				"required": false,
 				"type": "string",
 				"in": "body"
@@ -15638,7 +15635,7 @@ const routes = {
 			},
 			{
 				"name": "version_label",
-				"description": "Optional tag for the config version this write archives (e.g. `initial`). Annotates the version only — it is not stored on the guardrail and is not part of the config, so labelling a change is never itself a change.",
+				"description": "Optional tag for the config version this write creates (e.g. `initial`). Annotates the version only — it is not stored on the guardrail and is not part of the config, so labelling a change is never itself a change.",
 				"required": false,
 				"type": "string",
 				"in": "body"
@@ -15738,7 +15735,7 @@ const routes = {
 			},
 			{
 				"name": "version_label",
-				"description": "Optional tag for the config version this write archives (e.g. `pre-tightening`). Annotates the version only — it is not stored on the guardrail and is not part of the config, so labelling a change is never itself a change. Ignored when the write changes no policy, since no version is created.",
+				"description": "Optional tag for the config version this write creates (e.g. `tightened`). Annotates the version only — it is not stored on the guardrail and is not part of the config, so labelling a change is never itself a change. Ignored when the write changes no policy, since no version is created.",
 				"required": false,
 				"type": "string",
 				"in": "body"
@@ -16609,7 +16606,7 @@ const routes = {
 	"update-listing": {
 		serviceClass: "Listings",
 		operationId: "updateListing",
-		description: "Change the title or description, or pause and resume the listing. `state: suspended` stops the listing for every installing project at once; their installs are kept. `state: listed` resumes a listing you suspended, provided naturali had listed it; nobody reinstalls. A listing naturali suspended cannot be resumed here, and an invalid move answers `409 invalid_listing_state`.",
+		description: "Change the title or description, or pause and resume the listing. `state: suspended` stops a `listed` listing for every installing project at once; their installs are kept. `state: listed` resumes a listing you suspended, provided naturali had listed it; nobody reinstalls. A listing naturali suspended cannot be resumed here, and an invalid move answers `409 invalid_listing_state`.",
 		moduleDocsUrl: "https://naturali.ai/docs/modules/listings",
 		httpMethod: "patch",
 		pathParams: ["project_id", "listing_id"],
@@ -18720,7 +18717,7 @@ const routes = {
 			},
 			{
 				"name": "version_label",
-				"description": "Optional tag for the version this write archives, e.g. `pre-rewire`. Ignored when the write changes no graph field, since no version is archived.",
+				"description": "Optional tag for the version this write creates, e.g. `rewired`. Ignored when the write changes no graph field, since no version is archived.",
 				"required": false,
 				"type": "string",
 				"in": "body"
@@ -19403,7 +19400,7 @@ const routes = {
 			},
 			{
 				"name": "version_label",
-				"description": "Optional tag for the version this write archives. Ignored when the write changes no definition, since no version is archived.",
+				"description": "Optional tag for the version this write creates. Ignored when the write changes no definition, since no version is archived.",
 				"required": false,
 				"type": "string",
 				"in": "body"
@@ -22915,7 +22912,7 @@ const routes = {
 			},
 			{
 				"name": "execute",
-				"description": "Execution config for http tools. Supported fields: `url` (required), `method` (default `POST`), `headers`, `body_mode` and `response_mode`. The `url` may contain `{paramName}` placeholders (e.g. `/users/{userId}`) that are replaced at call time with the corresponding tool argument value (URL-encoded). Arguments consumed as path parameters are excluded from the query string and request body. `body_mode` is `json` (default) or `multipart`. In `multipart` mode the merged tool arguments are sent as a `multipart/form-data` body: scalar fields become plain form fields and a field shaped like `{ content_type, filename, data_base64 }` is decoded from base64 and attached as a file part (the hardcoded `Content-Type: application/json` is dropped so `fetch` sets the multipart boundary itself). `response_mode` is `json` (default: the body parsed as JSON, else returned as text) or `base64`, which returns a 2xx body as `{ content_type, filename, data_base64 }` — the same file shape `multipart` accepts, so a pipeline step can relay a downloaded file. `filename` comes from `Content-Disposition` and is omitted when the target names none; a body over `TOOL_RESPONSE_MAX_BYTES` is `502 TOOL_RESPONSE_TOO_LARGE`.\n\n`auth` adds a computed request credential, for targets whose `Authorization` value cannot be expressed as a static header. Supported `auth.type` values:\n\n- `aws_sigv4` — signs the request with AWS Signature Version 4. Requires `region`, `service`, `access_key_id` and `secret_access_key`; `session_token` is optional (temporary credentials). Incompatible with `body_mode: multipart`, whose body bytes are not known at signing time.\n- `gcp_service_account` — mints a Google OAuth 2.0 access token from a signed service account assertion and sends it as a bearer token. Requires `credentials` (the service account key file JSON, as a string) and `scopes` (a non-empty array). Tokens are cached per service account and scope set until shortly before they expire.\n\nCredential fields accept `{{secret:...}}` references and should use them — a tool is readable by anyone who can `GET /tools`, and the stored reference is what is echoed back, never the resolved value.\n\nA credential slot takes a reference, never a literal: a literal `secret_access_key`, `session_token` or `credentials` under `auth`, a literal credential-named `headers` value (`Authorization`, `Cookie`, or a name containing `api-key`/`token`/`secret`/`password`), or a `url` carrying a password or a literal credential-named query parameter (those names, plus `key` and `sig`/`signature`) is refused with `400 LITERAL_CREDENTIAL`, `meta.paths` naming each one. A stored literal reads back as `{\"no_echo\": true}` (a `url` holding one is masked whole), an object rather than a string so a read-edit-write round trip fails the schema check instead of writing the placeholder in as the credential. A value carrying a `{{secret:...}}` reference is the wiring, not the credential, and stays readable.\n\n`headers` values additionally accept `{{context:<key>}}` references, resolved per call from the caller's `tool_context`, so a per-user credential can be placed in the real header the target expects (`Authorization: Bearer {{context:ocaToken}}`) instead of only in an `X-Naturali-Context-<key>` header. Valid **only** inside `headers` — a context value is caller-supplied, so it may not steer the `url` — and a key missing from the `tool_context` at call time fails the tool call with `MISSING_TOOL_CONTEXT_KEY` rather than sending an empty credential. See the Tool Context reference.\n",
+				"description": "Execution config for http tools. An `http` tool without a non-empty `url` is `400 VALIDATION_FAILED`, on create and on an update that would leave it without one. Supported fields: `url` (required), `method` (default `POST`), `headers`, `body_mode` and `response_mode`. The `url` may contain `{paramName}` placeholders (e.g. `/users/{userId}`) that are replaced at call time with the corresponding tool argument value (URL-encoded). Arguments consumed as path parameters are excluded from the query string and request body. `body_mode` is `json` (default) or `multipart`. In `multipart` mode the merged tool arguments are sent as a `multipart/form-data` body: scalar fields become plain form fields and a field shaped like `{ content_type, filename, data_base64 }` is decoded from base64 and attached as a file part (the hardcoded `Content-Type: application/json` is dropped so `fetch` sets the multipart boundary itself). `response_mode` is `json` (default: the body parsed as JSON, else returned as text) or `base64`, which returns a 2xx body as `{ content_type, filename, data_base64 }` — the same file shape `multipart` accepts, so a pipeline step can relay a downloaded file. `filename` comes from `Content-Disposition` and is omitted when the target names none; a body over `TOOL_RESPONSE_MAX_BYTES` is `502 TOOL_RESPONSE_TOO_LARGE`.\n\n`auth` adds a computed request credential, for targets whose `Authorization` value cannot be expressed as a static header. Supported `auth.type` values:\n\n- `aws_sigv4` — signs the request with AWS Signature Version 4. Requires `region`, `service`, `access_key_id` and `secret_access_key`; `session_token` is optional (temporary credentials). Incompatible with `body_mode: multipart`, whose body bytes are not known at signing time.\n- `gcp_service_account` — mints a Google OAuth 2.0 access token from a signed service account assertion and sends it as a bearer token. Requires `credentials` (the service account key file JSON, as a string) and `scopes` (a non-empty array). Tokens are cached per service account and scope set until shortly before they expire.\n\nCredential fields accept `{{secret:...}}` references and should use them — a tool is readable by anyone who can `GET /tools`, and the stored reference is what is echoed back, never the resolved value.\n\nA credential slot takes a reference, never a literal: a literal `secret_access_key`, `session_token` or `credentials` under `auth`, a literal credential-named `headers` value (`Authorization`, `Cookie`, or a name containing `api-key`/`token`/`secret`/`password`), or a `url` carrying a password or a literal credential-named query parameter (those names, plus `key` and `sig`/`signature`) is refused with `400 LITERAL_CREDENTIAL`, `meta.paths` naming each one. A stored literal reads back as `{\"no_echo\": true}` (a `url` holding one is masked whole), an object rather than a string so a read-edit-write round trip fails the schema check instead of writing the placeholder in as the credential. A value carrying a `{{secret:...}}` reference is the wiring, not the credential, and stays readable.\n\n`headers` values additionally accept `{{context:<key>}}` references, resolved per call from the caller's `tool_context`, so a per-user credential can be placed in the real header the target expects (`Authorization: Bearer {{context:ocaToken}}`) instead of only in an `X-Naturali-Context-<key>` header. Valid **only** inside `headers` — a context value is caller-supplied, so it may not steer the `url` — and a key missing from the `tool_context` at call time fails the tool call with `MISSING_TOOL_CONTEXT_KEY` rather than sending an empty credential. See the Tool Context reference.\n",
 				"required": false,
 				"type": "object",
 				"in": "body"
@@ -23057,7 +23054,7 @@ const routes = {
 			},
 			{
 				"name": "execute",
-				"description": "Execution config for http tools. Supported fields: `url` (required), `method` (default `POST`), `headers`, `body_mode` and `response_mode`. The `url` may contain `{paramName}` placeholders (e.g. `/users/{userId}`) that are replaced at call time with the corresponding tool argument value (URL-encoded). Arguments consumed as path parameters are excluded from the query string and request body. `body_mode` is `json` (default) or `multipart`. In `multipart` mode the merged tool arguments are sent as a `multipart/form-data` body: scalar fields become plain form fields and a field shaped like `{ content_type, filename, data_base64 }` is decoded from base64 and attached as a file part (the hardcoded `Content-Type: application/json` is dropped so `fetch` sets the multipart boundary itself). `response_mode` is `json` (default: the body parsed as JSON, else returned as text) or `base64`, which returns a 2xx body as `{ content_type, filename, data_base64 }` — the same file shape `multipart` accepts, so a pipeline step can relay a downloaded file. `filename` comes from `Content-Disposition` and is omitted when the target names none; a body over `TOOL_RESPONSE_MAX_BYTES` is `502 TOOL_RESPONSE_TOO_LARGE`.\n\n`auth` adds a computed request credential, for targets whose `Authorization` value cannot be expressed as a static header. Supported `auth.type` values:\n\n- `aws_sigv4` — signs the request with AWS Signature Version 4. Requires `region`, `service`, `access_key_id` and `secret_access_key`; `session_token` is optional (temporary credentials). Incompatible with `body_mode: multipart`, whose body bytes are not known at signing time.\n- `gcp_service_account` — mints a Google OAuth 2.0 access token from a signed service account assertion and sends it as a bearer token. Requires `credentials` (the service account key file JSON, as a string) and `scopes` (a non-empty array). Tokens are cached per service account and scope set until shortly before they expire.\n\nCredential fields accept `{{secret:...}}` references and should use them — a tool is readable by anyone who can `GET /tools`, and the stored reference is what is echoed back, never the resolved value.\n\nA credential slot takes a reference, never a literal: a literal `secret_access_key`, `session_token` or `credentials` under `auth`, a literal credential-named `headers` value (`Authorization`, `Cookie`, or a name containing `api-key`/`token`/`secret`/`password`), or a `url` carrying a password or a literal credential-named query parameter (those names, plus `key` and `sig`/`signature`) is refused with `400 LITERAL_CREDENTIAL`, `meta.paths` naming each one. A stored literal reads back as `{\"no_echo\": true}` (a `url` holding one is masked whole), an object rather than a string so a read-edit-write round trip fails the schema check instead of writing the placeholder in as the credential. A value carrying a `{{secret:...}}` reference is the wiring, not the credential, and stays readable.\n\n`headers` values additionally accept `{{context:<key>}}` references, resolved per call from the caller's `tool_context`, so a per-user credential can be placed in the real header the target expects (`Authorization: Bearer {{context:ocaToken}}`) instead of only in an `X-Naturali-Context-<key>` header. Valid **only** inside `headers` — a context value is caller-supplied, so it may not steer the `url` — and a key missing from the `tool_context` at call time fails the tool call with `MISSING_TOOL_CONTEXT_KEY` rather than sending an empty credential. See the Tool Context reference.\n",
+				"description": "Execution config for http tools. An `http` tool without a non-empty `url` is `400 VALIDATION_FAILED`, on create and on an update that would leave it without one. Supported fields: `url` (required), `method` (default `POST`), `headers`, `body_mode` and `response_mode`. The `url` may contain `{paramName}` placeholders (e.g. `/users/{userId}`) that are replaced at call time with the corresponding tool argument value (URL-encoded). Arguments consumed as path parameters are excluded from the query string and request body. `body_mode` is `json` (default) or `multipart`. In `multipart` mode the merged tool arguments are sent as a `multipart/form-data` body: scalar fields become plain form fields and a field shaped like `{ content_type, filename, data_base64 }` is decoded from base64 and attached as a file part (the hardcoded `Content-Type: application/json` is dropped so `fetch` sets the multipart boundary itself). `response_mode` is `json` (default: the body parsed as JSON, else returned as text) or `base64`, which returns a 2xx body as `{ content_type, filename, data_base64 }` — the same file shape `multipart` accepts, so a pipeline step can relay a downloaded file. `filename` comes from `Content-Disposition` and is omitted when the target names none; a body over `TOOL_RESPONSE_MAX_BYTES` is `502 TOOL_RESPONSE_TOO_LARGE`.\n\n`auth` adds a computed request credential, for targets whose `Authorization` value cannot be expressed as a static header. Supported `auth.type` values:\n\n- `aws_sigv4` — signs the request with AWS Signature Version 4. Requires `region`, `service`, `access_key_id` and `secret_access_key`; `session_token` is optional (temporary credentials). Incompatible with `body_mode: multipart`, whose body bytes are not known at signing time.\n- `gcp_service_account` — mints a Google OAuth 2.0 access token from a signed service account assertion and sends it as a bearer token. Requires `credentials` (the service account key file JSON, as a string) and `scopes` (a non-empty array). Tokens are cached per service account and scope set until shortly before they expire.\n\nCredential fields accept `{{secret:...}}` references and should use them — a tool is readable by anyone who can `GET /tools`, and the stored reference is what is echoed back, never the resolved value.\n\nA credential slot takes a reference, never a literal: a literal `secret_access_key`, `session_token` or `credentials` under `auth`, a literal credential-named `headers` value (`Authorization`, `Cookie`, or a name containing `api-key`/`token`/`secret`/`password`), or a `url` carrying a password or a literal credential-named query parameter (those names, plus `key` and `sig`/`signature`) is refused with `400 LITERAL_CREDENTIAL`, `meta.paths` naming each one. A stored literal reads back as `{\"no_echo\": true}` (a `url` holding one is masked whole), an object rather than a string so a read-edit-write round trip fails the schema check instead of writing the placeholder in as the credential. A value carrying a `{{secret:...}}` reference is the wiring, not the credential, and stays readable.\n\n`headers` values additionally accept `{{context:<key>}}` references, resolved per call from the caller's `tool_context`, so a per-user credential can be placed in the real header the target expects (`Authorization: Bearer {{context:ocaToken}}`) instead of only in an `X-Naturali-Context-<key>` header. Valid **only** inside `headers` — a context value is caller-supplied, so it may not steer the `url` — and a key missing from the `tool_context` at call time fails the tool call with `MISSING_TOOL_CONTEXT_KEY` rather than sending an empty credential. See the Tool Context reference.\n",
 				"required": false,
 				"type": "object",
 				"in": "body"
@@ -24685,7 +24682,7 @@ const routes = {
 			},
 			{
 				"name": "version_label",
-				"description": "Optional tag for the version this write archives, e.g. `pre-rewire`. Ignored when the write changes no definition field, since no version is archived.",
+				"description": "Optional tag for the version this write creates, e.g. `rewired`. Ignored when the write changes no definition field, since no version is archived.",
 				"required": false,
 				"type": "string",
 				"in": "body"

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@naturali/cli",
-  "version": "0.209.2",
+  "version": "0.209.3",
   "description": "Command-line interface for the naturali.ai API, generated from its OpenAPI specs",
   "keywords": [
     "naturali",
@@ -31,7 +31,7 @@
     "yaml": "^2.9.1"
   },
   "devDependencies": {
-    "@naturali/sdk": "0.209.2",
+    "@naturali/sdk": "0.209.3",
     "@ttoss/openapi-codegen": "^0.10.0",
     "@types/node": "^26.5.1",
     "tsdown": "^0.23.0",