@usabledev/usable-chat 1.174.3 → 1.175.0

package/cli.js

@@ -91696,6 +91696,12 @@ var init_env2 = __esm({
         // (/api/oauth/register). Pre-configured in Keycloak (memory-mesh) with PKCE +
         // whitelisted redirect URIs — clients never hit Keycloak's DCR endpoint.
         MCP_OAUTH_CLIENT_ID: external_exports.string().min(1).default("mcp_oauth_client"),
+        // Optional azp (authorized party) allowlist for Bearer JWT auth on API routes.
+        // Comma-separated Keycloak client IDs. UNSET = no azp enforcement (issuer +
+        // signature + expiry only — pre-existing behaviour, keeps embed integrations
+        // working). SET = bearer tokens whose azp is not in the list are rejected
+        // with 401 JWT_AZP_REJECTED. See docs/chat-v2-contract.md#authentication.
+        CHAT_TRUSTED_CLIENT_IDS: external_exports.string().optional(),
         // Usable MCP
         USABLE_MCP_URL: external_exports.string().url().default("https://usable.dev/api/mcp"),
         USABLE_WORKSPACE_ID: external_exports.string().uuid(),
@@ -91803,6 +91809,7 @@ var init_env2 = __esm({
         USABLE_CLIENT_ID: process.env.USABLE_CLIENT_ID,
         USABLE_CLIENT_SECRET: process.env.USABLE_CLIENT_SECRET,
         MCP_OAUTH_CLIENT_ID: process.env.MCP_OAUTH_CLIENT_ID,
+        CHAT_TRUSTED_CLIENT_IDS: process.env.CHAT_TRUSTED_CLIENT_IDS,
         // Usable MCP
         USABLE_MCP_URL: process.env.USABLE_MCP_URL,
         USABLE_WORKSPACE_ID: process.env.USABLE_WORKSPACE_ID,
@@ -91911,7 +91918,12 @@ var init_config = __esm({
         clientId: env.USABLE_CLIENT_ID,
         clientSecret: env.USABLE_CLIENT_SECRET,
         /** Static public client_id returned by the MCP OAuth registration endpoint. */
-        mcpOAuthClientId: env.MCP_OAUTH_CLIENT_ID || DEFAULT_MCP_OAUTH_CLIENT_ID2
+        mcpOAuthClientId: env.MCP_OAUTH_CLIENT_ID || DEFAULT_MCP_OAUTH_CLIENT_ID2,
+        /**
+         * Optional azp allowlist for Bearer JWT auth (comma-separated client IDs).
+         * Empty/unset disables enforcement. See docs/chat-v2-contract.md.
+         */
+        trustedClientIdsRaw: env.CHAT_TRUSTED_CLIENT_IDS
       },
       mcp: {
         url: env.USABLE_MCP_URL,
@@ -214522,6 +214534,19 @@ Use this to discover the current state of background work \u2014 running, comple
   }
 });
 
+// src/core/billing/credit-authorization.ts
+async function authorizeCreditBeforeProvider(port, input) {
+  if (!port) return void 0;
+  const authorization = await port.authorize(input);
+  port.current = authorization;
+  return authorization;
+}
+var init_credit_authorization = __esm({
+  "src/core/billing/credit-authorization.ts"() {
+    "use strict";
+  }
+});
+
 // src/core/orchestrator/discoverable-skills-prompt.ts
 function buildDiscoverableSkillsPromptSection(skills) {
   if (skills.length === 0) {
@@ -289652,6 +289677,12 @@ Re-read them (working_memory on web, bash on the CLI \u2014 grep/sed projection,
         while (true) {
           let overflowMessage;
           try {
+            if (!config3.__scriptedLlm) {
+              await authorizeCreditBeforeProvider(context.creditAuthorization, {
+                inputTokens,
+                maxOutputTokens: maxTokens
+              });
+            }
             result = await callLLM({
               isClaude,
               selectedModelId,
@@ -290314,7 +290345,8 @@ Re-read them (working_memory on web, bash on the CLI \u2014 grep/sed projection,
           });
         }
       }
-      const errorCode = error41?.code === "CONTEXT_TOO_LARGE" ? "CONTEXT_TOO_LARGE" : "ORCHESTRATION_ERROR";
+      const rawErrorCode = error41?.code;
+      const errorCode = rawErrorCode === "CONTEXT_TOO_LARGE" || rawErrorCode === "MEMBER_CAP_EXCEEDED" || rawErrorCode === "CREDIT_LIMIT_REACHED" || rawErrorCode === "CREDIT_OVERAGE_CAP_REACHED" || rawErrorCode === "CREDIT_PREFLIGHT_UNAVAILABLE" ? rawErrorCode : "ORCHESTRATION_ERROR";
       const errorEvent = emitter.emit("error", {
         message: errorMessage,
         code: errorCode,
@@ -290357,6 +290389,7 @@ function createOrchestratorRequest(messages4, context, config3, persona, apiKey,
       abortSignal: context.abortSignal,
       sessionPathway: context.sessionPathway,
       // REQUIRED - validated above
+      creditAuthorization: context.creditAuthorization,
       chatStore: context.chatStore,
       // Persistence port (Drizzle for Next.js, SQLite for CLI)
       metadata: context.metadata,
@@ -290456,6 +290489,7 @@ var init_orchestrator = __esm({
     init_redis();
     init_executor();
     init_tool_categories();
+    init_credit_authorization();
     init_discoverable_skills_prompt();
     init_mcp_server_tools_prompt();
     init_spill_payload();
@@ -309138,7 +309172,7 @@ init_tui_select();
 init_model_registry();
 
 // package.json
-var version2 = "1.174.3";
+var version2 = "1.175.0";
 
 // src/adapters/cli/model-catalog.ts
 init_codex_auth();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@usabledev/usable-chat",
-  "version": "1.174.3",
+  "version": "1.175.0",
   "description": "usable-chat — terminal harness for usable-chat (headless + TUI)",
   "type": "module",
   "bin": {