@naturali/cli 0.57.0 → 0.58.1

package/dist/index.mjs

@@ -14,7 +14,7 @@ var __exportAll = (all, no_symbols) => {
 };
 //#endregion
 //#region package.json
-var version = "0.57.0";
+var version = "0.58.1";
 //#endregion
 //#region ../sdk/src/generated/core/bodySerializer.gen.ts
 const jsonBodySerializer = { bodySerializer: (body) => JSON.stringify(body, (_key, value) => typeof value === "bigint" ? value.toString() : value) };
@@ -6082,6 +6082,13 @@ const routes = {
 				"type": "object",
 				"in": "body"
 			},
+			{
+				"name": "tool_context",
+				"description": "Write-only. Per-run context forwarded to the run's tool calls: every entry is sent as an `X-Naturali-Context-<key>` request header on each `http`/`mcp` tool call the run's agent nodes make, including those of a `loop` or `sub_orchestration` child run. This is how a per-user credential reaches a tool endpoint without being written into the prompt — the endpoint reads it from a header it can trust rather than from model output.\n\nThe bag is stored on the run, so it survives an `awaiting_input` pause, a durable wait and a restart. It is never returned on a read: any principal on the project can read the project's runs.\n\nA key becomes an HTTP header name verbatim — no character is re-cased, so `ocaToken` and `oca_token` are two different keys — and must contain only letters, digits and `!#$%&'*+-.^_`|~`; two keys that differ only in case are rejected, since HTTP folds them into one. To land a value in a header the target already expects (usually `Authorization`), have the tool declare it with a `{{context:<key>}}` reference in its own `headers`, and set the tool's `context_keys` so the value reaches that tool alone.",
+				"required": false,
+				"type": "object",
+				"in": "body"
+			},
 			{
 				"name": "wait",
 				"description": "When true, block until the run reaches a terminal or `awaiting_input` state and return the settled run. When false (default), return immediately with `status: \"queued\"`.",
@@ -6628,7 +6635,7 @@ const routes = {
 			},
 			{
 				"name": "tool_context",
-				"description": "Key-value string headers injected into every tool call made during the session or generation.\n",
+				"description": "Context forwarded to every `http`/`mcp` tool call made during the session or generation: each entry is sent as an `X-Naturali-Context-<key>` request header, so a per-user credential can reach a tool endpoint without being written into the prompt.\n\nA key becomes an HTTP header name verbatim — no character is re-cased, so `ocaToken` and `oca_token` are two different keys — and must contain only letters, digits and `!#$%&'*+-.^_`|~`; two keys that differ only in case are rejected, since HTTP folds them into one. To land a value in a header the target already expects (usually `Authorization`), have the tool declare it with a `{{context:<key>}}` reference in its own `headers`, and set the tool's `context_keys` so the value reaches that tool alone.\n",
 				"required": false,
 				"type": "object",
 				"in": "body"
@@ -6785,7 +6792,7 @@ const routes = {
 			},
 			{
 				"name": "tool_context",
-				"description": "Key-value string headers injected into every tool call made during the session or generation.\n",
+				"description": "Context forwarded to every `http`/`mcp` tool call made during the session or generation: each entry is sent as an `X-Naturali-Context-<key>` request header, so a per-user credential can reach a tool endpoint without being written into the prompt.\n\nA key becomes an HTTP header name verbatim — no character is re-cased, so `ocaToken` and `oca_token` are two different keys — and must contain only letters, digits and `!#$%&'*+-.^_`|~`; two keys that differ only in case are rejected, since HTTP folds them into one. To land a value in a header the target already expects (usually `Authorization`), have the tool declare it with a `{{context:<key>}}` reference in its own `headers`, and set the tool's `context_keys` so the value reaches that tool alone.\n",
 				"required": false,
 				"type": "object",
 				"in": "body"
@@ -6842,7 +6849,7 @@ const routes = {
 			},
 			{
 				"name": "tool_context",
-				"description": "Key-value string headers injected into every tool call made during the session or generation.\n",
+				"description": "Context forwarded to every `http`/`mcp` tool call made during the session or generation: each entry is sent as an `X-Naturali-Context-<key>` request header, so a per-user credential can reach a tool endpoint without being written into the prompt.\n\nA key becomes an HTTP header name verbatim — no character is re-cased, so `ocaToken` and `oca_token` are two different keys — and must contain only letters, digits and `!#$%&'*+-.^_`|~`; two keys that differ only in case are rejected, since HTTP folds them into one. To land a value in a header the target already expects (usually `Authorization`), have the tool declare it with a `{{context:<key>}}` reference in its own `headers`, and set the tool's `context_keys` so the value reaches that tool alone.\n",
 				"required": false,
 				"type": "object",
 				"in": "body"
@@ -7230,6 +7237,13 @@ const routes = {
 				"required": false,
 				"type": "array",
 				"in": "body"
+			},
+			{
+				"name": "context_keys",
+				"description": "Allowlist of `tool_context` keys forwarded to this tool as `X-Naturali-Context-<key>` headers. Omit (or `null`) to forward every key the caller supplied; `[]` forwards none. Set it on the tools that need a given credential and the credential stops egressing to the rest of the agent's tool set — a key a tool consumes through a `{{context:<key>}}` reference in its own `headers` is substituted either way, since the tool declared that header itself.",
+				"required": false,
+				"type": "array",
+				"in": "body"
 			}
 		]
 	},
@@ -7341,6 +7355,13 @@ const routes = {
 				"type": "array",
 				"in": "body"
 			},
+			{
+				"name": "context_keys",
+				"description": "Replace the allowlist of `tool_context` keys forwarded to this tool. `null` clears it (every key is forwarded again) — unlike omitting the field, which leaves the current allowlist alone.",
+				"required": false,
+				"type": "array",
+				"in": "body"
+			},
 			{
 				"name": "status",
 				"description": "",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@naturali/cli",
-  "version": "0.57.0",
+  "version": "0.58.1",
   "description": "Command-line interface for the naturali.ai API, generated from its OpenAPI specs",
   "type": "module",
   "bin": {
@@ -30,7 +30,7 @@
     "tsx": "^4.23.1",
     "typescript": "~6.0.3",
     "vitest": "^4.1.10",
-    "@naturali/sdk": "0.57.0"
+    "@naturali/sdk": "0.58.1"
   },
   "scripts": {
     "generate": "tsx scripts/generate.ts",