@vertesia/common 1.6.0-dev.20260912.110338Z → 1.6.0-dev.20260918.061604Z

package/src/api-schemas/agent-runs.ts

@@ -64,6 +64,7 @@ export const TurnEvaluationFlagSchema = z
         'overhead',
         'followup_after_answer',
         'approval_denied',
+        'circuit_breaker',
     ])
     .meta({ id: 'TurnEvaluationFlag', description: 'Reason behind an evaluation severity.' });
 
@@ -169,7 +170,12 @@ export const AgentRunFeedbackCountsSchema = z
         last_rating: AgentRunFeedbackRatingSchema.optional(),
         last_reason_code: AgentRunFeedbackReasonCodeSchema.optional(),
     })
-    .meta({ id: 'AgentRunFeedbackCounts', description: 'Ratings over the retained feedback entries.' });
+    .meta({
+        id: 'AgentRunFeedbackCounts',
+        description:
+            'Ratings over the retained feedback entries, one vote per rater: a user who rated the run and ' +
+            'one of its answers counts once, by their latest rating.',
+    });
 
 export const AgentRunFeedbackResponseSchema = z
     .strictObject({
@@ -213,6 +219,8 @@ const AgentRunEvaluationTotalsSchema = z.strictObject({
     approvals_requested: z.number().int(),
     approvals_denied: z.number().int(),
     stop_requests: z.number().int(),
+    /** Absent on rollups written before the stall counters existed; read as 0. */
+    stall_trips: z.number().int().optional(),
 });
 
 /**
@@ -421,6 +429,9 @@ const TurnEvaluationEventSchema = z.strictObject({
     approvalsRequested: z.number().int(),
     approvalsDenied: z.number().int(),
     stopRequests: z.number().int(),
+    /** Absent on events from producers that predate the stall counters; read as 0. */
+    stallCorrectives: z.number().int().optional(),
+    stallTrips: z.number().int().optional(),
     followupAfterAnswer: z.boolean(),
     severity: EvaluationSeveritySchema,
     flags: z.array(TurnEvaluationFlagSchema),
@@ -458,6 +469,19 @@ const TurnJudgementEventSchema = z.strictObject({
     detectorVersion: z.number().int().optional(),
 });
 
+const StallBreakerEventSchema = z.strictObject({
+    ...agentEventBase,
+    eventType: z.literal(AgentEventType.StallBreaker),
+    action: z.enum(['corrective', 'trip']),
+    toolNames: z.array(z.string()),
+    repeatCount: z.number().int(),
+    stallMeasure: z.number().int(),
+    allErrored: z.boolean(),
+    iteration: z.number().int(),
+    interactive: z.boolean(),
+    workstreamId: z.string(),
+});
+
 export const AgentEventSchema: z.ZodType<AgentEvent> = z
     .discriminatedUnion('eventType', [
         AgentRunStartedEventSchema,
@@ -467,6 +491,7 @@ export const AgentEventSchema: z.ZodType<AgentEvent> = z
         TurnEvaluationEventSchema,
         FeedbackEventSchema,
         TurnJudgementEventSchema,
+        StallBreakerEventSchema,
     ])
     .meta({ id: 'AgentEvent' });
 

package/src/api-schemas/apikey.ts

@@ -84,6 +84,14 @@ export const ApiKeySchema = z
         account: z.string(),
         project: ProjectRefSchema,
         enabled: z.boolean(),
+        scim_provisioning: z
+            .boolean()
+            .optional()
+            .meta({
+                description:
+                    'Organization-wide SCIM provisioning credential. Only account administrators may create ' +
+                    'or manage these keys. May be enabled by account administrators on existing keys; disable or delete to revoke access.',
+            }),
         created_by: z.string(),
         updated_by: z.string(),
         created_at: z.string().meta({ format: 'date-time' }),
@@ -147,6 +155,7 @@ export const CreateApiKeyPayloadSchema = ApiKeySchema.pick({
     role: true,
     type: true,
     expires_at: true,
+    scim_provisioning: true,
     properties: true,
     clearance: true,
     compartments: true,
@@ -155,7 +164,7 @@ export const CreateApiKeyPayloadSchema = ApiKeySchema.pick({
     .meta({ id: 'CreateApiKeyPayload' });
 
 /**
- * What `PUT /apikeys/:keyId` accepts: the six fields the handler applies, each optional.
+ * What `PUT /apikeys/:keyId` accepts: the fields the handler applies, each optional.
  *
  * Narrower than the create payload in both directions — `type` and `expires_at` are immutable after
  * creation, `enabled` is only settable here — which is precisely why one shared component could not
@@ -167,6 +176,7 @@ export const UpdateApiKeyPayloadSchema = ApiKeySchema.pick({
     name: true,
     role: true,
     enabled: true,
+    scim_provisioning: true,
     properties: true,
     clearance: true,
     compartments: true,
@@ -197,3 +207,34 @@ export type ApiKeyReadResponseFromSchema = z.infer<typeof ApiKeyReadResponseSche
 export type CreateApiKeyPayloadFromSchema = z.infer<typeof CreateApiKeyPayloadSchema>;
 export type UpdateApiKeyPayloadFromSchema = z.infer<typeof UpdateApiKeyPayloadSchema>;
 export type AuthTokenResponseFromSchema = z.infer<typeof AuthTokenResponseSchema>;
+
+/** Project-independent organization credentials, managed only by interactive administrators. */
+export const AccountApiKeySchema = ApiKeySchema.pick({
+    id: true,
+    name: true,
+    account: true,
+    enabled: true,
+    maskedValue: true,
+    created_by: true,
+    updated_by: true,
+    created_at: true,
+    updated_at: true,
+    expires_at: true,
+})
+    .extend({
+        scope: z.literal('account'),
+        profile: z.literal('account_admin_v1'),
+        last_used_at: z.string().meta({ format: 'date-time' }).optional(),
+    })
+    .meta({ id: 'AccountApiKey' });
+export const AccountApiKeyWithValueSchema = AccountApiKeySchema.extend({ value: z.string() }).meta({
+    id: 'AccountApiKeyWithValue',
+});
+export const AccountApiKeyArraySchema = z.array(AccountApiKeySchema).meta({ id: 'AccountApiKeyArray' });
+export const CreateAccountApiKeyPayloadSchema = AccountApiKeySchema.pick({ name: true, expires_at: true })
+    .extend({ name: z.string().trim().min(1).regex(/\S/) })
+    .meta({ id: 'CreateAccountApiKeyPayload' });
+export const UpdateAccountApiKeyPayloadSchema = AccountApiKeySchema.pick({ name: true, enabled: true })
+    .extend({ name: z.string().trim().min(1).regex(/\S/) })
+    .partial()
+    .meta({ id: 'UpdateAccountApiKeyPayload' });

package/src/api-schemas/bundle-isolation.test.ts

@@ -1,37 +1,16 @@
-import { existsSync, readFileSync } from 'node:fs';
+import { readFileSync } from 'node:fs';
 import { gzipSync } from 'node:zlib';
 import { describe, expect, it } from 'vitest';
 
 /**
- * Guards the packaging boundary that keeps schema-authoring runtime code out of ordinary
- * `@vertesia/common` and `@vertesia/client` consumers.
- *
- * `lib/index.js` is bundled wholesale into `lib/vertesia-common.js` by rolldown, and
- * `apps/composable-ui/build/shared-libs.ts` serves that single file to the browser mapped to the
- * bare specifier `@vertesia/common`. There is no per-consumer tree-shaking anywhere on that path,
- * so `import type` erasure in app code cannot save us: anything runtime-reachable from the root
- * barrel ships to every UI user.
- *
- * The rule this enforces: the root may re-export schema-derived TYPES (`export type`, erased by
- * tsc) but must never runtime-export `./api-schemas/*`. `@vertesia/client` is covered too — it is
- * shipped to the browser by the same mechanism, so a schema import there leaks just as badly. Its
- * default and Node.js entries are checked independently because this is also an SDK dependency
- * boundary for Node.js, serverless, CLI, and other JavaScript applications—not only a browser-size
- * concern.
- *
- * Runs against build output, so each artifact is skipped when it has not been built.
+ * Keep schema-authoring code out of the common browser bundle and public root entry.
+ * Build outputs are required; Turbo builds this package before running its tests.
+ * Client packaging is tested by the client package.
  */
 const path = (relative: string) => new URL(relative, import.meta.url).pathname;
 
 const COMMON_BUNDLE = path('../../lib/vertesia-common.js');
 const COMMON_ENTRY = path('../../lib/index.js');
-const CLIENT_BUNDLE = path('../../../client/lib/vertesia-client.js');
-/** `.` and `./node` in the client's exports map — the latter is `lib/nodejs/index.js`, not `lib/index.js`. */
-const CLIENT_ENTRIES = [
-    { label: 'client default entry (.)', file: path('../../../client/lib/index.js') },
-    { label: 'client node entry (./node)', file: path('../../../client/lib/nodejs/index.js') },
-];
-
 /** Markers that prove a runtime schema import leaked into a browser artifact. */
 const FORBIDDEN = ['zod', '_zod', 'ZodObject', 'api-schemas', 'toOpenApiComponents', 'ApiSchemaComponents'];
 
@@ -45,7 +24,7 @@ function expectNoSchemaRuntime(file: string, label: string): void {
     }
 }
 
-describe.skipIf(!existsSync(COMMON_BUNDLE))('@vertesia/common runtime schema isolation', () => {
+describe('@vertesia/common runtime schema isolation', () => {
     it('does not runtime-reference the api-schemas subpath from the root entry', () => {
         expect(readFileSync(COMMON_ENTRY, 'utf8')).not.toContain('api-schemas');
     });
@@ -63,18 +42,3 @@ describe.skipIf(!existsSync(COMMON_BUNDLE))('@vertesia/common runtime schema iso
         ).toBeLessThan(MAX_COMMON_GZIP_BYTES);
     });
 });
-
-describe.skipIf(!existsSync(CLIENT_BUNDLE))('@vertesia/client consumer runtime isolation', () => {
-    it('contains no zod import or schema registry code', () => {
-        // The client is served to the browser the same way common is, so importing
-        // `@vertesia/common/api-schemas` from an SDK method would ship zod to every UI user.
-        expectNoSchemaRuntime(CLIENT_BUNDLE, 'client browser bundle');
-    });
-
-    it.each(CLIENT_ENTRIES)('does not reference the api-schemas subpath from the $label', ({ label, file }) => {
-        // Asserted rather than skipped: a missing artifact means the entry moved or stopped being
-        // built, and silently passing would let a packaging regression through unnoticed.
-        expect(existsSync(file), `${label} not found at ${file} — has the exports map changed?`).toBe(true);
-        expect(readFileSync(file, 'utf8'), `${label} must not import api-schemas`).not.toContain('api-schemas');
-    });
-});

package/src/api-schemas/project-configuration.ts

@@ -67,11 +67,12 @@ export const ProjectSearchTierSchema = z.enum(['standard', 'performance']).meta(
 export const ElasticsearchBackendSchema = z.enum(['serverless', 'hosted']).meta({ id: 'ElasticsearchBackend' });
 
 export const ProjectSearchPropertyTypeSchema = z
-    .enum(['keyword', 'text', 'boolean', 'long', 'double', 'date', 'geo_point'])
+    .enum(['keyword', 'text', 'boolean', 'long', 'double', 'date', 'geo_point', 'nested'])
     .meta({
         id: 'ProjectSearchPropertyType',
         description:
-            'Elasticsearch field types that may be explicitly assigned to content-object properties. Paths are ' +
+            'Elasticsearch field types that may be explicitly assigned to content-object properties. ' +
+            'Declare nested object-array paths with type `nested` and their children as separate dotted paths. Paths are ' +
             "relative to the object's `properties` field.",
     });
 

package/src/api-schemas/project.contract.test.ts

@@ -253,6 +253,21 @@ describe('gate 2 — the closure is closed, bottom-up', () => {
         });
     });
 
+    it('accepts explicit nested paths through the project configuration contract', () => {
+        expect(ApiSchemaComponents.ProjectSearchPropertyType.enum).toContain('nested');
+        expect(
+            validateApiRequest('UpdateProjectConfigurationPayload', {
+                indexing: {
+                    property_mappings: {
+                        line_items: { type: 'nested' },
+                        'line_items.sku': { type: 'keyword' },
+                        'line_items.quantity': { type: 'long' },
+                    },
+                },
+            }).valid,
+        ).toBe(true);
+    });
+
     it('publishes geo_point as an explicit project property mapping type', () => {
         expect(ApiSchemaComponents.ProjectSearchPropertyType.enum).toContain('geo_point');
     });

package/src/api-schemas/registry.ts

@@ -90,6 +90,9 @@ import {
     TimeResolutionSchema,
 } from './analytics.js';
 import {
+    AccountApiKeyArraySchema,
+    AccountApiKeySchema,
+    AccountApiKeyWithValueSchema,
     ApiKeyArraySchema,
     ApiKeyListQuerySchema,
     ApiKeyReadQuerySchema,
@@ -97,9 +100,11 @@ import {
     ApiKeySchema,
     ApiKeyWithValueSchema,
     AuthTokenResponseSchema,
+    CreateAccountApiKeyPayloadSchema,
     CreateApiKeyPayloadSchema,
     DeleteOperationResultSchema,
     ProjectRefArraySchema,
+    UpdateAccountApiKeyPayloadSchema,
     UpdateApiKeyPayloadSchema,
 } from './apikey.js';
 import {
@@ -841,6 +846,12 @@ const IAM_AND_ACCOUNT_SCHEMAS = {
     ApiKey: ApiKeySchema,
     ApiKeyArray: ApiKeyArraySchema,
     ApiKeyWithValue: ApiKeyWithValueSchema,
+    AccountApiKey: AccountApiKeySchema,
+    AccountApiKeyWithValue: AccountApiKeyWithValueSchema,
+    AccountApiKeyArray: AccountApiKeyArraySchema,
+    CreateAccountApiKeyPayload: CreateAccountApiKeyPayloadSchema,
+    UpdateAccountApiKeyPayload: UpdateAccountApiKeyPayloadSchema,
+
     ApiKeyReadResponse: ApiKeyReadResponseSchema,
     ApiKeyReadQuery: ApiKeyReadQuerySchema,
     CreateApiKeyPayload: CreateApiKeyPayloadSchema,
@@ -2408,6 +2419,11 @@ const API_SCHEMAS: Readonly<Record<ApiComponentName, z.ZodType>> = mergeComponen
  * objects, so a body carrying an undeclared property is rejected rather than quietly accepted.
  */
 const STRICT_COMPONENTS: ReadonlySet<string> = new Set<string>([
+    'AccountApiKey',
+    'AccountApiKeyWithValue',
+    'CreateAccountApiKeyPayload',
+    'UpdateAccountApiKeyPayload',
+
     'CreateDelegationGrantPayload',
     'DelegationGrant',
     // Process Test Lab request, fixture, and result contracts.

package/src/api-schemas/store.contract.test.ts

@@ -1,5 +1,3 @@
-import { readFileSync } from 'node:fs';
-import { fileURLToPath } from 'node:url';
 import { Ajv } from 'ajv';
 import { describe, expect, it } from 'vitest';
 import { ContentTypeIntakePolicySchema as GeneratedIntakePolicySchema } from '../store/intake-policy-schema.generated.js';
@@ -14,9 +12,9 @@ function assertType<T extends true>(_ok: T): void {}
 
 /**
  * The intake policy is now stated once, in Zod, and reaches its consumers three ways: as the
- * published OpenAPI component, as the checked-in JSON artifact that zeno-server / the workflow tool /
- * the web editor compiles, and as the TypeScript type. This file is the gate that keeps all three
- * the same statement.
+ * canonical component, as the checked-in JSON artifact consumers compile, and as the TypeScript
+ * type. This file keeps those package-owned contracts aligned. Downstream consumers test their
+ * published API documents and generated-client fixtures separately.
  *
  * It also pins the behaviour changes the conversion makes, because the schema it replaced was
  * hand-written and disagreed with the contract in both directions. Each is asserted rather than
@@ -30,101 +28,13 @@ function errors(): string {
     return ajv.errorsText(validate.errors, { separator: '\n' });
 }
 
-/**
- * Reads a file from the studio repository this package is a submodule of.
- *
- * `undefined` when it is not there, which is the normal state in this repository's own CI: it clones
- * composableai alone, so nothing above the submodule root exists. Two of the gates below compare
- * against the published document and the generated-client fixture, both of which live up there — so
- * they are skipped when they cannot be read rather than failing the whole file at import time, which
- * is what used to happen and what left this suite red on every commit.
- *
- * They still run where they are the actual gate: a checkout of the parent repository, which is what
- * the migration's own verification and the studio CI use.
- */
-function readFromStudioRepo(relativePath: string): unknown {
-    try {
-        return JSON.parse(readFileSync(fileURLToPath(new URL(relativePath, import.meta.url)), 'utf8'));
-    } catch (error) {
-        if ((error as NodeJS.ErrnoException).code === 'ENOENT') return undefined;
-        throw error;
-    }
-}
-
-const publishedDocument = readFromStudioRepo('../../../../../packages/api-specs/vertesia-openapi.json') as
-    | { components: { schemas: Record<string, Record<string, unknown>> } }
-    | undefined;
-const published = publishedDocument?.components.schemas ?? {};
-
-/**
- * The published component minus the OpenAPI-only discriminator hint the bundler drops.
- *
- * Written out here rather than imported from the registry on purpose: reusing the production
- * function to check the production function would make the comparison below pass by construction.
- * The rule is small enough to state twice, and stating it twice is what makes it a gate.
- */
-function withoutDiscriminatorHints(value: unknown): unknown {
-    if (Array.isArray(value)) return value.map(withoutDiscriminatorHints);
-    if (!value || typeof value !== 'object') return value;
-    const node = value as Record<string, unknown>;
-    const restated = node.discriminator !== undefined && node.properties === undefined;
-    return Object.fromEntries(
-        Object.entries(node)
-            .filter(([key]) => key !== 'discriminator' && !(restated && (key === 'type' || key === 'required')))
-            .map(([key, item]) => [key, withoutDiscriminatorHints(item)]),
-    );
-}
-
-function $defsOf(schema: unknown): unknown {
-    return (schema as { $defs: unknown }).$defs;
-}
-
-describe.skipIf(!publishedDocument)('gate — generated artifact = canonical component = published component', () => {
+describe('generated artifact and canonical component', () => {
     it('is the exact bundle the registry emits, so the artifact is compiled output', () => {
         // Deep equality, not a spot check: the file is generated by `pnpm run gen:schemas` from this
         // same function, so any difference means someone hand-edited it or forgot to regenerate.
         expect(GeneratedIntakePolicySchema).toEqual(bundleCanonicalComponent('ContentTypeIntakePolicy'));
     });
 
-    it('describes the same shape as the component the OpenAPI document publishes', () => {
-        // The artifact re-roots `#/components/schemas/X` to `#/$defs/X` so AJV and Monaco can compile
-        // it standalone. Undoing that is what makes the two directly comparable.
-        const { $defs, ...body } = GeneratedIntakePolicySchema as { $defs: Record<string, unknown> };
-        const rerooted = JSON.parse(JSON.stringify(body).replaceAll('#/$defs/', '#/components/schemas/'));
-        expect(rerooted).toEqual(withoutDiscriminatorHints(published.ContentTypeIntakePolicy));
-
-        // ...and every definition it carries is the published component of that name, so the bundle
-        // cannot describe a private variant of a shared type.
-        for (const [name, definition] of Object.entries($defs)) {
-            const asComponent = JSON.parse(JSON.stringify(definition).replaceAll('#/$defs/', '#/components/schemas/'));
-            expect(asComponent, `$defs.${name} disagrees with the published component`).toEqual(
-                withoutDiscriminatorHints(published[name]),
-            );
-        }
-    });
-
-    it('drops the discriminator hint the published component keeps, and only that', () => {
-        // The one place the artifact and the component are allowed to differ, pinned from both sides
-        // so neither can move alone. `synthesizeDiscriminator` restates `type` and `required` on the
-        // union node for the generated Java/Go clients; the node has no `properties`, and Gemini
-        // rejects the whole tool schema over it ("requires unspecified property '_option_id'") when
-        // the artifact reaches Vertex inside `create_or_update_type`'s input schema.
-        expect(published.ModelOptions).toMatchObject({
-            discriminator: { propertyName: '_option_id' },
-            type: 'object',
-            required: ['_option_id'],
-        });
-
-        const bundled = ($defsOf(GeneratedIntakePolicySchema) as Record<string, Record<string, unknown>>).ModelOptions;
-        expect(bundled.discriminator).toBeUndefined();
-        expect(bundled.required).toBeUndefined();
-        expect(bundled.type).toBeUndefined();
-        // The branches are what carried the contract all along, so nothing was validated away.
-        expect((bundled.oneOf as unknown[]).length).toBe(
-            ((published.ModelOptions as { oneOf: unknown[] }).oneOf ?? []).length,
-        );
-    });
-
     it('registers the component the alias claims, under the id the alias name requires', () => {
         expect(Object.keys(ApiSchemaComponents)).toContain('ContentTypeIntakePolicy');
         assertType<Equals<ContentTypeIntakePolicy, (typeof ContentTypeIntakePolicySchema)['_zod']['output']>>(true);
@@ -230,38 +140,6 @@ describe('gate — the artifact accepts exactly what the Zod schema accepts', ()
     });
 });
 
-describe.skipIf(!publishedDocument)('the fixture the generated Java and Go clients deserialize', () => {
-    // `openapi/fixtures/content-type-intake-policy.json` is read by
-    // `openapi/java/src/test/.../ContentTypeIntakePolicyDeserializationTest.java` and by
-    // `openapi/go/tests/intake_policy_deserialization_test.go`. Asserting it HERE is what stops it
-    // going stale: a schema change that the fixture no longer satisfies fails in this package,
-    // beside the schema, rather than in a client harness that only CI runs.
-    const fixture = readFromStudioRepo('../../../../../openapi/fixtures/content-type-intake-policy.json') ?? {};
-
-    it('is a policy the canonical schema and the generated artifact both accept', () => {
-        expect(ContentTypeIntakePolicySchema.safeParse(fixture).success).toBe(true);
-        expect(validate(fixture), errors()).toBe(true);
-    });
-
-    it('exercises the shapes the number -> integer correction changed', () => {
-        // The fields whose generated Java type moved from Double to Integer and whose Go type moved
-        // from float32 to int32. A fixture that omitted them would let the clients compile and
-        // deserialize while proving nothing about the change this batch makes.
-        const policy = fixture as ContentTypeIntakePolicy;
-        expect(policy.extraction?.max_pages).toBe(6);
-        expect(policy.extraction?.page_ranges).toEqual([
-            [1, 2],
-            [-1, -1],
-        ]);
-        expect(policy.text_conversion?.render_dpi).toBe(150);
-        expect(policy.extraction?.vision?.max_image_tokens).toBe(9000);
-        expect(policy.extraction?.grounding?.window_pages).toBe(4);
-        // ...and the discriminated union, which is what a Go oneOf decoder gets wrong when the
-        // discriminator is missing from the document.
-        expect(policy.extraction?.config?.model_options?._option_id).toBe('vertexai-claude');
-    });
-});
-
 describe('the TypeScript type says what the schema says', () => {
     it('widens page ranges to number[][], which is what the component has always described', () => {
         // `[number, number][]` is what the interface used to claim. The published component is

package/src/apikey.ts

@@ -80,6 +80,8 @@ export type ApiKeyListQuery = z.infer<typeof ApiKeyListQuerySchema>;
 export type ApiKeyReadQuery = z.infer<typeof ApiKeyReadQuerySchema>;
 
 export interface AuthTokenPayload {
+    credential_scope?: 'project' | 'account';
+    credential_profile?: 'account_admin_v1';
     delegation?: import('./delegation.js').DelegationTokenClaim;
     sub: string;
     name: string;
@@ -194,3 +196,13 @@ export enum PrincipalType {
     Agent = 'agent',
     Schedule = 'schedule',
 }
+
+export type AccountApiKey = z.infer<typeof import('./api-schemas/apikey.js').AccountApiKeySchema>;
+export type AccountApiKeyWithValue = z.infer<typeof import('./api-schemas/apikey.js').AccountApiKeyWithValueSchema>;
+export type AccountApiKeyArray = z.infer<typeof import('./api-schemas/apikey.js').AccountApiKeyArraySchema>;
+export type CreateAccountApiKeyPayload = z.infer<
+    typeof import('./api-schemas/apikey.js').CreateAccountApiKeyPayloadSchema
+>;
+export type UpdateAccountApiKeyPayload = z.infer<
+    typeof import('./api-schemas/apikey.js').UpdateAccountApiKeyPayloadSchema
+>;

package/src/oauth-scopes.ts

@@ -1,4 +1,4 @@
-import { Permission } from './access-control-values.js';
+import { ACCOUNT_SCOPED_PERMISSIONS, Permission } from './access-control-values.js';
 
 export const OAUTH_SCOPE_OPENID = 'openid';
 export const OAUTH_SCOPE_PROFILE = 'profile';
@@ -12,6 +12,7 @@ export const OAUTH_STANDARD_SCOPES = [OAUTH_SCOPE_OPENID, OAUTH_SCOPE_PROFILE, O
  * hand out secret material, or are internal to the platform's own consoles.
  */
 const NON_OAUTH_PERMISSION_SCOPES = new Set<Permission>([
+    ...ACCOUNT_SCOPED_PERMISSIONS,
     Permission.schedule_delegate,
     Permission.api_key_create,
     Permission.api_key_update,

package/src/project-values.ts

@@ -24,6 +24,7 @@ export enum ResourceVisibility {
 export enum SystemRoles {
     owner = 'owner', // all permissions
     admin = 'admin', // all permissions
+    app_admin = 'app_admin', // all permissions but studio:access — admin driving a custom admin UI
     manager = 'manager', // all permissions but manage_account, manage_billing
     developer = 'developer', // all permissions but manage_account, manage_billing, manage_roles, delete
     application = 'application', // executor + request_pk

package/src/roles.test.ts

@@ -7,6 +7,7 @@ describe('shared role vocabulary', () => {
         expect(Object.values(SystemRoles).sort()).toEqual(
             [
                 'admin',
+                'app_admin',
                 'app_member',
                 'application',
                 'auditor',

package/src/workflow-analytics.ts

@@ -25,6 +25,8 @@ export enum AgentEventType {
     Feedback = 'feedback',
     /** Verdict of the LLM judge on one turn, emitted by the judge workflow */
     TurnJudgement = 'turn_judgement',
+    /** The stall circuit breaker acted: a corrective was injected, or the loop was stopped */
+    StallBreaker = 'stall_breaker',
 }
 
 /**
@@ -81,7 +83,8 @@ export type TurnEvaluationFlag =
     | 'high_gather'
     | 'overhead'
     | 'followup_after_answer'
-    | 'approval_denied';
+    | 'approval_denied'
+    | 'circuit_breaker';
 
 /** Coarse class of a tool error, derived from the error text. */
 export type ToolErrorClass = 'schema' | 'platform' | 'config' | 'environment' | 'other';
@@ -313,6 +316,31 @@ export interface TurnToolObservation {
     durationMs: number;
 }
 
+/** What the stall circuit breaker did. */
+export type StallBreakerAction = 'corrective' | 'trip';
+
+/**
+ * Emitted the moment the stall circuit breaker acts on a repeated tool call: `corrective` when it
+ * appends its warning to the tool results, `trip` when the model repeated anyway and the loop was
+ * stopped (the run fails, or an interactive run hands control back to the user). The closing turn
+ * evaluation counts these too; this row carries the tools and the measure at the time.
+ */
+export interface StallBreakerEvent extends BaseAgentEvent {
+    eventType: AgentEventType.StallBreaker;
+    action: StallBreakerAction;
+    /** Tools of the repeated call set */
+    toolNames: string[];
+    /** Consecutive repeats of the identical call set */
+    repeatCount: number;
+    /** The measure the breaker acted on: the repeat count, or the windowed unproductive run */
+    stallMeasure: number;
+    /** Whether every result of the repeated call set was an error */
+    allErrored: boolean;
+    iteration: number;
+    interactive: boolean;
+    workstreamId: string;
+}
+
 /**
  * Emitted when an agent turn ends. One turn is the agent work between two user hand-offs.
  * Deterministic: computed inside the workflow from what the workflow observed.
@@ -378,6 +406,13 @@ export interface TurnEvaluationEvent extends BaseAgentEvent {
     approvalsRequested: number;
     approvalsDenied: number;
     stopRequests: number;
+    /**
+     * Stall correctives injected: the model was warned it kept repeating the same call.
+     * Absent on events from producers that predate the counter; read as 0.
+     */
+    stallCorrectives?: number;
+    /** Stall circuit-breaker trips: the model ignored the corrective and the loop was stopped. Same caveat. */
+    stallTrips?: number;
     /** An unprompted user message after an answer was followed by substantive tool work */
     followupAfterAnswer: boolean;
     severity: EvaluationSeverity;
@@ -474,7 +509,8 @@ export type AgentEvent =
     | ToolCallEvent
     | TurnEvaluationEvent
     | FeedbackEvent
-    | TurnJudgementEvent;
+    | TurnJudgementEvent
+    | StallBreakerEvent;
 
 /**
  * Workflow Analytics Types