@naturali/sdk 0.133.3 → 0.135.0

package/dist/index.cjs

@@ -1472,7 +1472,7 @@ var ApiKeys = class {
 	* Create an API key
 	*
 	* Creates an API key. When `project_id` is set the key is scoped to that project (the default and recommended stance); omit it for an account-scoped key. `capabilities` narrows what the key may do; when omitted the key inherits the creator's capabilities. The raw `key` (nat_sk_…) is returned only in this response.
-	* A project-scoped key requires the `admin` role in that project: the key is a standing credential for everything the project can do, so handing one out is an administrative act rather than something a read-only `member` can do for themselves. An account-scoped key requires a credential that is not itself confined to one project.
+	* A project-scoped key requires membership of that project. The key carries no role of its own — every request it makes resolves its holder's membership again — so it can never reach past what its minter already had. An account-scoped key requires a credential that is not itself confined to one project.
 	* A connected app cannot create keys at all: a grant is revocable and a key is not, so a key minted under a grant would still work after the app was disconnected. Reading and revoking keys stay available.
 	*
 	*/
@@ -3725,8 +3725,9 @@ var Projects = class {
 	/**
 	* Update a project
 	*
-	* Rename or archive a project, and/or change its content-retention settings (`trace_content_retention_days`, `trace_content_mode`). Archiving is reversible; resources are retained.
-	* Requires the `admin` role in the project (an `owner` has it too).
+	* Rename or archive a project, and/or change its content-retention settings (`trace_content_retention_days`, `trace_content_mode`), its execution ceilings (`max_concurrent_runs`, `max_chain_generations`, `max_orchestration_run_depth`) and its priced-model gate (`require_priced_model`). Archiving is reversible; resources are retained.
+	* Requires the `admin` role in the project (an `owner` has it too). These are the terms every member works under, which is why setting them sits above the role that works under them.
+	* The ceilings and the priced-model gate are uncapped by plan: each one only ever narrows what the project may spend, so setting one takes on a restriction rather than claiming an entitlement. On the three ceilings `null` clears the project's own bound and omission leaves it alone — they are different instructions.
 	* The two retention controls answer different questions. The window bounds how long content *stays* — a daily sweep purges anything past it, leaving auditable skeletons behind. `trace_content_mode: none` means content is never *written*, which is the stronger guarantee: it cannot be missed by a sweep or survive in a backup.
 	*
 	* Your plan sets the longest window you may keep content for. A wider one — `null` included, which keeps content indefinitely — responds `403` with `plan_limit_reached`, whose `details` carry the `plan` and the `limit` in days. Anything shorter is always allowed. Moving to a plan with a shorter window takes effect at the end of the billing cycle, and content already stored is then purged by age like everything else.
@@ -3745,7 +3746,7 @@ var Projects = class {
 	/**
 	* List project members
 	*
-	* Lists who may act in the project, and with what role. Readable by every member, including a read-only `member`: who else is in the project is not a privileged fact, and hiding it makes "why can that person see my agents?" unanswerable.
+	* Lists who may act in the project, and with what role. Readable by every member, whatever their role: who else is in the project is not a privileged fact, and hiding it makes "why can that person see my agents?" unanswerable.
 	* Somebody invited who has never signed in is listed too, with status `pending` — the invitation is already a grant, so hiding it until they arrive would hide access that exists.
 	*
 	*/
@@ -3782,7 +3783,7 @@ var Projects = class {
 	*
 	* Removes a member, or leaves the project yourself.
 	*
-	* **Anyone may remove themselves**, whatever their role: a colleague who no longer wants access should not have to ask for it, and leaving takes nothing from anybody else. Removing *somebody else* needs authority — an `owner` may remove anyone, an `admin` may remove a read-only `member` and not another `admin`.
+	* **Anyone may remove themselves**, whatever their role: a colleague who no longer wants access should not have to ask for it, and leaving takes nothing from anybody else. Removing *somebody else* needs authority — an `owner` may remove anyone, an `admin` may remove a `member` and not another `admin`.
 	*
 	* The owner's own row is refused: a project with no owner is unreachable, and the row names who pays.
 	*

package/dist/index.d.cts

@@ -5847,11 +5847,31 @@ type Project = {
    *
    */
   trace_content_mode: 'full' | 'none';
+  /**
+   * Orchestration runs of this project driven at once. `null` (the default) is unlimited. Enforced when a run is claimed — runs past the limit wait for a slot rather than failing.
+   *
+   */
+  max_concurrent_runs: number | null;
+  /**
+   * Generations one continuation chain in this project may hold before it stops being resumed. `null` (the default) leaves the platform-wide ceiling in force. The budget actually applied is the smallest of that ceiling, this number, and the agent's own — an agent author can be stricter than this, never looser.
+   *
+   */
+  max_chain_generations: number | null;
+  /**
+   * Nesting levels a run tree in this project may reach before the next child is refused. `null` (the default) leaves the platform-wide bound in force; the bound applied is the smaller of the two.
+   *
+   */
+  max_orchestration_run_depth: number | null;
+  /**
+   * Whether a generation whose model carries no price is refused before the provider is called. `false` by default, which runs the model and meters it at no cost. Mainly of use with your own providers — see [Requiring a priced model](/docs/modules/projects#requiring-a-priced-model).
+   *
+   */
+  require_priced_model: boolean;
   created_at: Date;
   updated_at: Date;
 };
 /**
- * What the member may do in this project. `owner` — everything, including deleting it and paying for it; exactly one per project. `admin` — every read and write inside it, including minting project API keys, but not deleting the project. `member` — reads only.
+ * What the member may do in this project. `owner` — everything, including deleting it and paying for it; exactly one per project. `admin` — everything a `member` may do, plus managing who else is in the project and how the project itself is configured. `member` — every read and write on the project's own resources, including minting project API keys.
  * When returned on a `Project`, this is *your* role, not a property of the project: it is what lets a client hide an action the request would refuse.
  *
  */
@@ -5934,6 +5954,26 @@ type ProjectUpdate = {
    *
    */
   trace_content_mode?: 'full' | 'none';
+  /**
+   * Orchestration runs driven at once. Send `null` to lift the limit. Omitting the field leaves it unchanged.
+   *
+   */
+  max_concurrent_runs?: number | null;
+  /**
+   * Generations one continuation chain may hold. Send `null` to drop back to the platform-wide ceiling. Omitting the field leaves it unchanged.
+   *
+   */
+  max_chain_generations?: number | null;
+  /**
+   * Nesting levels a run tree may reach. Send `null` to drop back to the platform-wide bound. Omitting the field leaves it unchanged.
+   *
+   */
+  max_orchestration_run_depth?: number | null;
+  /**
+   * Refuse a generation whose model carries no price, before the provider is called. Uncapped by plan — it only ever narrows what the project may spend.
+   *
+   */
+  require_priced_model?: boolean;
 };
 /**
  * Token counts (input_tokens already includes cached input).
@@ -17788,7 +17828,7 @@ type AddProjectMemberErrors = {
    */
   401: ErrorResponse;
   /**
-   * The caller is a read-only `member`, an `admin` granting `admin`, or a project-scoped credential.
+   * The caller is a `member`, an `admin` granting `admin`, or a project-scoped credential.
    *
    */
   403: ErrorResponse;
@@ -18216,7 +18256,7 @@ type CreateProjectUsageThresholdErrors = {
    */
   401: ErrorResponse;
   /**
-   * The caller is a read-only member.
+   * The caller is a `member`; an alerting rule needs `admin`.
    */
   403: ErrorResponse;
   /**
@@ -18250,7 +18290,7 @@ type DeleteProjectUsageThresholdErrors = {
    */
   401: ErrorResponse;
   /**
-   * The caller is a read-only member.
+   * The caller is a `member`; an alerting rule needs `admin`.
    */
   403: ErrorResponse;
   /**
@@ -21622,7 +21662,7 @@ export declare class ApiKeys {
    * Create an API key
    *
    * Creates an API key. When `project_id` is set the key is scoped to that project (the default and recommended stance); omit it for an account-scoped key. `capabilities` narrows what the key may do; when omitted the key inherits the creator's capabilities. The raw `key` (nat_sk_…) is returned only in this response.
-   * A project-scoped key requires the `admin` role in that project: the key is a standing credential for everything the project can do, so handing one out is an administrative act rather than something a read-only `member` can do for themselves. An account-scoped key requires a credential that is not itself confined to one project.
+   * A project-scoped key requires membership of that project. The key carries no role of its own — every request it makes resolves its holder's membership again — so it can never reach past what its minter already had. An account-scoped key requires a credential that is not itself confined to one project.
    * A connected app cannot create keys at all: a grant is revocable and a key is not, so a key minted under a grant would still work after the app was disconnected. Reading and revoking keys stay available.
    *
    */
@@ -22784,8 +22824,9 @@ export declare class Projects {
   /**
    * Update a project
    *
-   * Rename or archive a project, and/or change its content-retention settings (`trace_content_retention_days`, `trace_content_mode`). Archiving is reversible; resources are retained.
-   * Requires the `admin` role in the project (an `owner` has it too).
+   * Rename or archive a project, and/or change its content-retention settings (`trace_content_retention_days`, `trace_content_mode`), its execution ceilings (`max_concurrent_runs`, `max_chain_generations`, `max_orchestration_run_depth`) and its priced-model gate (`require_priced_model`). Archiving is reversible; resources are retained.
+   * Requires the `admin` role in the project (an `owner` has it too). These are the terms every member works under, which is why setting them sits above the role that works under them.
+   * The ceilings and the priced-model gate are uncapped by plan: each one only ever narrows what the project may spend, so setting one takes on a restriction rather than claiming an entitlement. On the three ceilings `null` clears the project's own bound and omission leaves it alone — they are different instructions.
    * The two retention controls answer different questions. The window bounds how long content *stays* — a daily sweep purges anything past it, leaving auditable skeletons behind. `trace_content_mode: none` means content is never *written*, which is the stronger guarantee: it cannot be missed by a sweep or survive in a backup.
    *
    * Your plan sets the longest window you may keep content for. A wider one — `null` included, which keeps content indefinitely — responds `403` with `plan_limit_reached`, whose `details` carry the `plan` and the `limit` in days. Anything shorter is always allowed. Moving to a plan with a shorter window takes effect at the end of the billing cycle, and content already stored is then purged by age like everything else.
@@ -22795,7 +22836,7 @@ export declare class Projects {
   /**
    * List project members
    *
-   * Lists who may act in the project, and with what role. Readable by every member, including a read-only `member`: who else is in the project is not a privileged fact, and hiding it makes "why can that person see my agents?" unanswerable.
+   * Lists who may act in the project, and with what role. Readable by every member, whatever their role: who else is in the project is not a privileged fact, and hiding it makes "why can that person see my agents?" unanswerable.
    * Somebody invited who has never signed in is listed too, with status `pending` — the invitation is already a grant, so hiding it until they arrive would hide access that exists.
    *
    */
@@ -22818,7 +22859,7 @@ export declare class Projects {
    *
    * Removes a member, or leaves the project yourself.
    *
-   * **Anyone may remove themselves**, whatever their role: a colleague who no longer wants access should not have to ask for it, and leaving takes nothing from anybody else. Removing *somebody else* needs authority — an `owner` may remove anyone, an `admin` may remove a read-only `member` and not another `admin`.
+   * **Anyone may remove themselves**, whatever their role: a colleague who no longer wants access should not have to ask for it, and leaving takes nothing from anybody else. Removing *somebody else* needs authority — an `owner` may remove anyone, an `admin` may remove a `member` and not another `admin`.
    *
    * The owner's own row is refused: a project with no owner is unreachable, and the row names who pays.
    *

package/dist/index.d.mts

@@ -5847,11 +5847,31 @@ type Project = {
    *
    */
   trace_content_mode: 'full' | 'none';
+  /**
+   * Orchestration runs of this project driven at once. `null` (the default) is unlimited. Enforced when a run is claimed — runs past the limit wait for a slot rather than failing.
+   *
+   */
+  max_concurrent_runs: number | null;
+  /**
+   * Generations one continuation chain in this project may hold before it stops being resumed. `null` (the default) leaves the platform-wide ceiling in force. The budget actually applied is the smallest of that ceiling, this number, and the agent's own — an agent author can be stricter than this, never looser.
+   *
+   */
+  max_chain_generations: number | null;
+  /**
+   * Nesting levels a run tree in this project may reach before the next child is refused. `null` (the default) leaves the platform-wide bound in force; the bound applied is the smaller of the two.
+   *
+   */
+  max_orchestration_run_depth: number | null;
+  /**
+   * Whether a generation whose model carries no price is refused before the provider is called. `false` by default, which runs the model and meters it at no cost. Mainly of use with your own providers — see [Requiring a priced model](/docs/modules/projects#requiring-a-priced-model).
+   *
+   */
+  require_priced_model: boolean;
   created_at: Date;
   updated_at: Date;
 };
 /**
- * What the member may do in this project. `owner` — everything, including deleting it and paying for it; exactly one per project. `admin` — every read and write inside it, including minting project API keys, but not deleting the project. `member` — reads only.
+ * What the member may do in this project. `owner` — everything, including deleting it and paying for it; exactly one per project. `admin` — everything a `member` may do, plus managing who else is in the project and how the project itself is configured. `member` — every read and write on the project's own resources, including minting project API keys.
  * When returned on a `Project`, this is *your* role, not a property of the project: it is what lets a client hide an action the request would refuse.
  *
  */
@@ -5934,6 +5954,26 @@ type ProjectUpdate = {
    *
    */
   trace_content_mode?: 'full' | 'none';
+  /**
+   * Orchestration runs driven at once. Send `null` to lift the limit. Omitting the field leaves it unchanged.
+   *
+   */
+  max_concurrent_runs?: number | null;
+  /**
+   * Generations one continuation chain may hold. Send `null` to drop back to the platform-wide ceiling. Omitting the field leaves it unchanged.
+   *
+   */
+  max_chain_generations?: number | null;
+  /**
+   * Nesting levels a run tree may reach. Send `null` to drop back to the platform-wide bound. Omitting the field leaves it unchanged.
+   *
+   */
+  max_orchestration_run_depth?: number | null;
+  /**
+   * Refuse a generation whose model carries no price, before the provider is called. Uncapped by plan — it only ever narrows what the project may spend.
+   *
+   */
+  require_priced_model?: boolean;
 };
 /**
  * Token counts (input_tokens already includes cached input).
@@ -17788,7 +17828,7 @@ type AddProjectMemberErrors = {
    */
   401: ErrorResponse;
   /**
-   * The caller is a read-only `member`, an `admin` granting `admin`, or a project-scoped credential.
+   * The caller is a `member`, an `admin` granting `admin`, or a project-scoped credential.
    *
    */
   403: ErrorResponse;
@@ -18216,7 +18256,7 @@ type CreateProjectUsageThresholdErrors = {
    */
   401: ErrorResponse;
   /**
-   * The caller is a read-only member.
+   * The caller is a `member`; an alerting rule needs `admin`.
    */
   403: ErrorResponse;
   /**
@@ -18250,7 +18290,7 @@ type DeleteProjectUsageThresholdErrors = {
    */
   401: ErrorResponse;
   /**
-   * The caller is a read-only member.
+   * The caller is a `member`; an alerting rule needs `admin`.
    */
   403: ErrorResponse;
   /**
@@ -21622,7 +21662,7 @@ export declare class ApiKeys {
    * Create an API key
    *
    * Creates an API key. When `project_id` is set the key is scoped to that project (the default and recommended stance); omit it for an account-scoped key. `capabilities` narrows what the key may do; when omitted the key inherits the creator's capabilities. The raw `key` (nat_sk_…) is returned only in this response.
-   * A project-scoped key requires the `admin` role in that project: the key is a standing credential for everything the project can do, so handing one out is an administrative act rather than something a read-only `member` can do for themselves. An account-scoped key requires a credential that is not itself confined to one project.
+   * A project-scoped key requires membership of that project. The key carries no role of its own — every request it makes resolves its holder's membership again — so it can never reach past what its minter already had. An account-scoped key requires a credential that is not itself confined to one project.
    * A connected app cannot create keys at all: a grant is revocable and a key is not, so a key minted under a grant would still work after the app was disconnected. Reading and revoking keys stay available.
    *
    */
@@ -22784,8 +22824,9 @@ export declare class Projects {
   /**
    * Update a project
    *
-   * Rename or archive a project, and/or change its content-retention settings (`trace_content_retention_days`, `trace_content_mode`). Archiving is reversible; resources are retained.
-   * Requires the `admin` role in the project (an `owner` has it too).
+   * Rename or archive a project, and/or change its content-retention settings (`trace_content_retention_days`, `trace_content_mode`), its execution ceilings (`max_concurrent_runs`, `max_chain_generations`, `max_orchestration_run_depth`) and its priced-model gate (`require_priced_model`). Archiving is reversible; resources are retained.
+   * Requires the `admin` role in the project (an `owner` has it too). These are the terms every member works under, which is why setting them sits above the role that works under them.
+   * The ceilings and the priced-model gate are uncapped by plan: each one only ever narrows what the project may spend, so setting one takes on a restriction rather than claiming an entitlement. On the three ceilings `null` clears the project's own bound and omission leaves it alone — they are different instructions.
    * The two retention controls answer different questions. The window bounds how long content *stays* — a daily sweep purges anything past it, leaving auditable skeletons behind. `trace_content_mode: none` means content is never *written*, which is the stronger guarantee: it cannot be missed by a sweep or survive in a backup.
    *
    * Your plan sets the longest window you may keep content for. A wider one — `null` included, which keeps content indefinitely — responds `403` with `plan_limit_reached`, whose `details` carry the `plan` and the `limit` in days. Anything shorter is always allowed. Moving to a plan with a shorter window takes effect at the end of the billing cycle, and content already stored is then purged by age like everything else.
@@ -22795,7 +22836,7 @@ export declare class Projects {
   /**
    * List project members
    *
-   * Lists who may act in the project, and with what role. Readable by every member, including a read-only `member`: who else is in the project is not a privileged fact, and hiding it makes "why can that person see my agents?" unanswerable.
+   * Lists who may act in the project, and with what role. Readable by every member, whatever their role: who else is in the project is not a privileged fact, and hiding it makes "why can that person see my agents?" unanswerable.
    * Somebody invited who has never signed in is listed too, with status `pending` — the invitation is already a grant, so hiding it until they arrive would hide access that exists.
    *
    */
@@ -22818,7 +22859,7 @@ export declare class Projects {
    *
    * Removes a member, or leaves the project yourself.
    *
-   * **Anyone may remove themselves**, whatever their role: a colleague who no longer wants access should not have to ask for it, and leaving takes nothing from anybody else. Removing *somebody else* needs authority — an `owner` may remove anyone, an `admin` may remove a read-only `member` and not another `admin`.
+   * **Anyone may remove themselves**, whatever their role: a colleague who no longer wants access should not have to ask for it, and leaving takes nothing from anybody else. Removing *somebody else* needs authority — an `owner` may remove anyone, an `admin` may remove a `member` and not another `admin`.
    *
    * The owner's own row is refused: a project with no owner is unreachable, and the row names who pays.
    *

package/dist/index.mjs

@@ -1471,7 +1471,7 @@ var ApiKeys = class {
 	* Create an API key
 	*
 	* Creates an API key. When `project_id` is set the key is scoped to that project (the default and recommended stance); omit it for an account-scoped key. `capabilities` narrows what the key may do; when omitted the key inherits the creator's capabilities. The raw `key` (nat_sk_…) is returned only in this response.
-	* A project-scoped key requires the `admin` role in that project: the key is a standing credential for everything the project can do, so handing one out is an administrative act rather than something a read-only `member` can do for themselves. An account-scoped key requires a credential that is not itself confined to one project.
+	* A project-scoped key requires membership of that project. The key carries no role of its own — every request it makes resolves its holder's membership again — so it can never reach past what its minter already had. An account-scoped key requires a credential that is not itself confined to one project.
 	* A connected app cannot create keys at all: a grant is revocable and a key is not, so a key minted under a grant would still work after the app was disconnected. Reading and revoking keys stay available.
 	*
 	*/
@@ -3724,8 +3724,9 @@ var Projects = class {
 	/**
 	* Update a project
 	*
-	* Rename or archive a project, and/or change its content-retention settings (`trace_content_retention_days`, `trace_content_mode`). Archiving is reversible; resources are retained.
-	* Requires the `admin` role in the project (an `owner` has it too).
+	* Rename or archive a project, and/or change its content-retention settings (`trace_content_retention_days`, `trace_content_mode`), its execution ceilings (`max_concurrent_runs`, `max_chain_generations`, `max_orchestration_run_depth`) and its priced-model gate (`require_priced_model`). Archiving is reversible; resources are retained.
+	* Requires the `admin` role in the project (an `owner` has it too). These are the terms every member works under, which is why setting them sits above the role that works under them.
+	* The ceilings and the priced-model gate are uncapped by plan: each one only ever narrows what the project may spend, so setting one takes on a restriction rather than claiming an entitlement. On the three ceilings `null` clears the project's own bound and omission leaves it alone — they are different instructions.
 	* The two retention controls answer different questions. The window bounds how long content *stays* — a daily sweep purges anything past it, leaving auditable skeletons behind. `trace_content_mode: none` means content is never *written*, which is the stronger guarantee: it cannot be missed by a sweep or survive in a backup.
 	*
 	* Your plan sets the longest window you may keep content for. A wider one — `null` included, which keeps content indefinitely — responds `403` with `plan_limit_reached`, whose `details` carry the `plan` and the `limit` in days. Anything shorter is always allowed. Moving to a plan with a shorter window takes effect at the end of the billing cycle, and content already stored is then purged by age like everything else.
@@ -3744,7 +3745,7 @@ var Projects = class {
 	/**
 	* List project members
 	*
-	* Lists who may act in the project, and with what role. Readable by every member, including a read-only `member`: who else is in the project is not a privileged fact, and hiding it makes "why can that person see my agents?" unanswerable.
+	* Lists who may act in the project, and with what role. Readable by every member, whatever their role: who else is in the project is not a privileged fact, and hiding it makes "why can that person see my agents?" unanswerable.
 	* Somebody invited who has never signed in is listed too, with status `pending` — the invitation is already a grant, so hiding it until they arrive would hide access that exists.
 	*
 	*/
@@ -3781,7 +3782,7 @@ var Projects = class {
 	*
 	* Removes a member, or leaves the project yourself.
 	*
-	* **Anyone may remove themselves**, whatever their role: a colleague who no longer wants access should not have to ask for it, and leaving takes nothing from anybody else. Removing *somebody else* needs authority — an `owner` may remove anyone, an `admin` may remove a read-only `member` and not another `admin`.
+	* **Anyone may remove themselves**, whatever their role: a colleague who no longer wants access should not have to ask for it, and leaving takes nothing from anybody else. Removing *somebody else* needs authority — an `owner` may remove anyone, an `admin` may remove a `member` and not another `admin`.
 	*
 	* The owner's own row is refused: a project with no owner is unreachable, and the row names who pays.
 	*

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@naturali/sdk",
-  "version": "0.133.3",
+  "version": "0.135.0",
   "description": "TypeScript SDK for the naturali.ai API, generated from its OpenAPI specs",
   "type": "module",
   "sideEffects": false,
@@ -31,7 +31,7 @@
   },
   "devDependencies": {
     "@hey-api/openapi-ts": "^0.99.0",
-    "@naturali/api": "0.133.3",
+    "@naturali/api": "0.135.0",
     "@ttoss/openapi-codegen": "^0.3.1",
     "@types/node": "^26.5.1",
     "tsdown": "^0.23.0",