@vertesia/common 1.6.0-dev.20260918.115658Z → 1.6.0-dev.20261004.085740Z

package/src/api-schemas/run-budget.ts

@@ -0,0 +1,60 @@
+import { z } from 'zod';
+
+export const RunBudgetOwnerSchema = z
+    .strictObject({
+        workflow_id: z.string().min(1),
+        first_run_id: z.string().min(1),
+    })
+    .meta({ id: 'RunBudgetOwner' });
+
+/** Cumulative counters are read from existing execution runs, never from an audit cursor. */
+export const RunBudgetUsageSchema = z
+    .strictObject({
+        input: z.number().nonnegative(),
+        cached_input: z.number().nonnegative(),
+        output: z.number().nonnegative(),
+    })
+    .meta({ id: 'RunBudgetUsage' });
+
+export const RunBudgetTotalsSchema = z
+    .strictObject({
+        measured: RunBudgetUsageSchema,
+        unpriced: RunBudgetUsageSchema,
+        reported_nano_usd: z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER),
+        estimated_nano_usd: z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER),
+        unmeasured_calls: z.number().int().nonnegative(),
+        missing_usage_calls: z.number().int().nonnegative(),
+    })
+    .meta({ id: 'RunBudgetTotals' });
+
+export const ReadRunBudgetUsagePayloadSchema = z
+    .strictObject({
+        account_id: z.string().min(1),
+        project_id: z.string().min(1),
+        agent_run_id: z.string().min(1),
+        owner: RunBudgetOwnerSchema,
+        require_estimates: z.boolean().optional(),
+    })
+    .meta({ id: 'ReadRunBudgetUsagePayload' });
+
+export const RunBudgetCapabilitySchema = z
+    .strictObject({
+        supported: z.boolean(),
+        source: z.enum(['provider', 'estimate', 'unavailable']),
+        reason: z.string().optional(),
+    })
+    .meta({ id: 'RunBudgetCapability' });
+
+export const RunBudgetCapabilityQuerySchema = z
+    .strictObject({
+        check_model: z
+            .boolean()
+            .optional()
+            .meta({ description: 'False checks only whether estimates are enabled, without consulting model prices.' }),
+        model: z.string().min(1),
+        service_tier: z.string().optional(),
+    })
+    .meta({
+        id: 'RunBudgetCapabilityQuery',
+        description: 'Selected model and requested serving tier for run budget admission.',
+    });

package/src/api-schemas/store.ts

@@ -2,6 +2,7 @@ import { HttpTimeoutOptionsSchema, ModelOptionsSchema, PromptCacheModeSchema } f
 import { z } from 'zod';
 // From the values module, for the reason `./apikey.js` gives.
 import { ConfigModes, RunDataStorageLevel } from '../interaction-values.js';
+import { InferenceProfileIdSchema } from './inference-profile.js';
 import { EditRevisionSchema, ExpectedEditRevisionSchema } from './schema-primitives.js';
 
 /**
@@ -78,6 +79,17 @@ export const ConfigModesSchema = z.enum(ConfigModes).meta({ id: 'ConfigModes' })
 export const InteractionExecutionConfigurationSchema = z
     .strictObject({
         id: z.string().optional(),
+        inference_profile: InferenceProfileIdSchema.nullable()
+            .optional()
+            .meta({ description: 'Select a project inference profile. Null bypasses profile defaults.' }),
+        inherit_model_config: z
+            .boolean()
+            .optional()
+            .meta({
+                description:
+                    "Treat the supplied environment, model and inference_profile as the caller's settings, inherited as " +
+                    "a fallback: the interaction's bound or attached profile, or its own model, replaces them.",
+            }),
         environment: z.string().optional(),
         model: z.string().optional(),
         do_validate: z.boolean().optional(),

package/src/api-schemas/sts.ts

@@ -124,3 +124,19 @@ export const IssueTokenForbiddenResponseSchema = z
 export const IssueTokenUnavailableResponseSchema = z
     .strictObject({ error: z.string(), message: z.string() })
     .meta({ id: 'IssueTokenUnavailableResponse' });
+
+export const AppSessionTokenRequestSchema = z
+    .strictObject({
+        app_name: z.string().min(1),
+        scopes: z.array(z.string()).optional(),
+        ttl_seconds: z.number().int().min(1).max(900).optional(),
+    })
+    .meta({ id: 'AppSessionTokenRequest' });
+
+export const AppSessionTokenResponseSchema = z
+    .strictObject({
+        token: z.string(),
+        token_type: z.literal('Bearer'),
+        expires_in: z.number().int(),
+    })
+    .meta({ id: 'AppSessionTokenResponse' });

package/src/api-schemas/user.ts

@@ -1,4 +1,5 @@
 import { z } from 'zod';
+import type * as Wire from '../wire-types.generated.js';
 
 /**
  * Runtime API schemas for the IAM user endpoints.
@@ -9,15 +10,22 @@ import { z } from 'zod';
  */
 
 /**
- * Not hoisted: no `id` in `.meta()`, so the adapter inlines it into `PrincipalIdentity` instead of
- * emitting a `PrincipalContext` component and a `$ref` the document has never published.
+ * The full principal context resolved at token-issue time — every field a rule can reference through
+ * `$principal.*`: the principal `kind`, its `id`, and the merged BLP attributes. This is the single
+ * source of truth the token server mirrors into the JWT, the shared `buildPrincipalContext`
+ * produces, and the UI condition editor offers. `kind` and `id` are first-class members here, not
+ * identity-only metadata: they are resolvable in ResourceSet/PrincipalSet conditions, so hiding them
+ * (as an earlier split of this schema did) under-declared what the server actually matches against.
  *
- * It still exists as a schema rather than being spelled out inside `PrincipalIdentitySchema`,
- * because `PrincipalContext` is a public type in its own right — consumed by PrincipalSet condition
- * evaluation and client-side ABAC tooling. Composing the two is what keeps the five inherited fields
- * from becoming a hand-written twin of the schema that publishes them.
+ * Not hoisted: no `id` in `.meta()`, so the adapter inlines it into `PrincipalIdentity` instead of
+ * emitting an `AbacPrincipalContext` component and a `$ref` the document has never published. It
+ * still exists as a schema in its own right because it is a public type composed into
+ * `PrincipalIdentitySchema` — composing is what keeps the shared fields from becoming a hand-written
+ * twin of the schema that publishes them.
  */
-export const PrincipalContextSchema = z.object({
+export const AbacPrincipalContextSchema = z.object({
+    kind: z.enum(['user', 'apikey']),
+    id: z.string(),
     clearance: z.number(),
     compartments: z.array(z.string()),
     email: z.string().optional(),
@@ -26,19 +34,18 @@ export const PrincipalContextSchema = z.object({
 });
 
 /**
- * `.extend()` rather than a fresh object literal: it appends `id` after the inherited five, which is
- * both what `interface PrincipalIdentity extends PrincipalContext` produced and the property order
- * the document already publishes.
+ * Response shape of the `/iam/users/identity` endpoint. Extends {@link AbacPrincipalContextSchema}
+ * adding nothing today: the two are kept as distinct names so identity-only fields — ones that must
+ * NOT become resolvable as `$principal.*` — can be added here later without widening the ABAC
+ * surface. Invariant: the ABAC principal context is always a subset of the identity. At this
+ * endpoint `kind` is always `user`.
  */
-export const PrincipalIdentitySchema = PrincipalContextSchema.extend({
-    id: z.string(),
-}).meta({
+export const PrincipalIdentitySchema = AbacPrincipalContextSchema.extend({}).meta({
     id: 'PrincipalIdentity',
     description:
-        "Response shape of the `/iam/users/identity` endpoint: the current principal's  {@link  " +
-        'PrincipalContext }  plus its id. Distinct from `PrincipalContext` itself because the id is ' +
-        'identity metadata, not a merged BLP field — adding it to `PrincipalContext` would ' +
-        'unintentionally expose `$principal.id` to PrincipalSet rule evaluation.',
+        "Response shape of the `/iam/users/identity` endpoint: the current principal's full ABAC " +
+        'context — its `kind` (always `user` here), `id`, and the merged BLP attributes a rule can ' +
+        'reference through `$principal.*`.',
 });
 
 /**
@@ -194,11 +201,11 @@ export const SignupPayloadSchema = z
  * The public IAM types, inferred rather than written. `../principal-context.ts`, `../user.ts` and
  * `../common.ts` re-export these under their public names.
  */
-export type PrincipalContextFromSchema = z.infer<typeof PrincipalContextSchema>;
-export type PrincipalIdentityFromSchema = z.infer<typeof PrincipalIdentitySchema>;
-export type UserFromSchema = z.infer<typeof UserSchema>;
-export type UserArrayFromSchema = z.infer<typeof UserArraySchema>;
-export type UserRefFromSchema = z.infer<typeof UserRefSchema>;
-export type UserRefArrayFromSchema = z.infer<typeof UserRefArraySchema>;
-export type UpdateUserPayloadFromSchema = z.infer<typeof UpdateUserPayloadSchema>;
-export type DeleteByIdResultFromSchema = z.infer<typeof DeleteByIdResultSchema>;
+export type AbacPrincipalContextFromSchema = Wire.AbacPrincipalContextFromSchema;
+export type PrincipalIdentityFromSchema = Wire.PrincipalIdentityFromSchema;
+export type UserFromSchema = Wire.UserFromSchema;
+export type UserArrayFromSchema = Wire.UserArrayFromSchema;
+export type UserRefFromSchema = Wire.UserRefFromSchema;
+export type UserRefArrayFromSchema = Wire.UserRefArrayFromSchema;
+export type UpdateUserPayloadFromSchema = Wire.UpdateUserPayloadFromSchema;
+export type DeleteByIdResultFromSchema = Wire.DeleteByIdResultFromSchema;

package/src/api-schemas/workflow-runs.ts

@@ -12,6 +12,7 @@ import {
     InteractionRefSchema,
     UserChannelSchema,
 } from './interaction.js';
+import { AgentBudgetConfigurationSchema } from './project-configuration.js';
 import { nullableStringSchema } from './schema-primitives.js';
 import { InteractionExecutionConfigurationSchema } from './store.js';
 
@@ -112,6 +113,7 @@ export const WorkflowInteractionVarsSchema = z
         collection_id: z.string().optional(),
         disabled_mcp_collections: z.array(z.string()).optional(),
         checkpoint_tokens: z.number().optional(),
+        budget: AgentBudgetConfigurationSchema.optional(),
         version: z.number().optional(),
         agent_run_id: z.string().optional(),
     })

package/src/apikey.ts

@@ -1,19 +1,8 @@
-import type { z } from 'zod';
 import type { PropertyConditions } from './access-control.js';
-import type {
-    ApiKeyArraySchema,
-    ApiKeyListQuerySchema,
-    ApiKeyReadQuerySchema,
-    ApiKeyReadResponseSchema,
-    ApiKeySchema,
-    ApiKeyWithValueSchema,
-    AuthTokenResponseSchema,
-    CreateApiKeyPayloadSchema,
-    UpdateApiKeyPayloadSchema,
-} from './api-schemas/apikey.js';
 import type { UserGroupRef } from './group.js';
 import type { ProjectRef, SystemRoles } from './project.js';
 import type { AccountRef } from './user.js';
+import type * as Wire from './wire-types.generated.js';
 
 /**
  * `ApiKeyTypes` lives in `./apikey-values.js` so the API schemas can read it without importing this
@@ -22,17 +11,17 @@ import type { AccountRef } from './user.js';
 export * from './apikey-values.js';
 
 /**
- * Per-scope, per-verb property-condition arrays that narrow content visibility
- * at query time. Each value array uses $or semantics — any matching condition
- * set grants access. Presence of this object switches content access from
- * allow-all to restrict mode.
+ * Per-scope, per-verb property-condition arrays that narrow resource access.
+ * Each value array uses $or semantics — any matching condition set grants
+ * access. The consumer defines when the presence of its scope switches access
+ * from the baseline to restrict mode.
  *
  * The bare keys `read`/`write`/`delete` apply to the default `'document'`
  * scope. They also receive entries emitted by system-role ABAC ACEs (which
  * predate the scope concept).
  *
  * Non-default scopes appear as prefixed keys: `'collection:read'`,
- * `'collection:write'`, `'task:read'`, etc. — the prefix is the
+ * `'agent_run:control'`, `'task:read'`, etc. — the prefix is the
  * `AceConditions.scope` value, the suffix is the verb derived from the
  * ABAC role's permission set.
  *
@@ -42,8 +31,14 @@ export interface ContentSecurity {
     read?: PropertyConditions[];
     write?: PropertyConditions[];
     delete?: PropertyConditions[];
-    /** Scope-prefixed entries: `'collection:read'`, `'task:write'`, etc. */
-    [scopedKey: string]: PropertyConditions[] | undefined;
+    /**
+     * Either a scope-prefixed conditions entry (`'collection:read'`, `'agent_run:control'`, …) whose
+     * value is a conditions array, OR a cross-project shared-content group keyed by `'@<owner_project_id>'`
+     * whose value is a nested `ContentSecurity` — the SAME shape scoped to that owner project, minus
+     * any further `@` keys (the mint never nests `@` groups inside `@` groups). Distinguish by the
+     * `@` prefix (or `Array.isArray`): bare/scope keys → conditions array; `@`-keys → nested group.
+     */
+    [scopedKey: string]: PropertyConditions[] | ContentSecurity | undefined;
 }
 
 /**
@@ -54,8 +49,8 @@ export interface ContentSecurity {
  * `format: date-time` strings and JSON has no date type, so the previous `Date` declaration
  * described the Mongoose document rather than the response a client parses.
  */
-export type ApiKey = z.infer<typeof ApiKeySchema>;
-export type ApiKeyArray = z.infer<typeof ApiKeyArraySchema>;
+export type ApiKey = Wire.ApiKey;
+export type ApiKeyArray = Wire.ApiKeyArray;
 /**
  * Create and update take DIFFERENT payloads, and did not before.
  *
@@ -64,10 +59,10 @@ export type ApiKeyArray = z.infer<typeof ApiKeyArraySchema>;
  * `role` (which unset a required path). Splitting it is source-breaking for the SDK and is announced
  * as a release operation; the two names say which operation they belong to.
  */
-export type CreateApiKeyPayload = z.infer<typeof CreateApiKeyPayloadSchema>;
-export type UpdateApiKeyPayload = z.infer<typeof UpdateApiKeyPayloadSchema>;
-export type ApiKeyWithValue = z.infer<typeof ApiKeyWithValueSchema>;
-export type ApiKeyReadResponse = z.infer<typeof ApiKeyReadResponseSchema>;
+export type CreateApiKeyPayload = Wire.CreateApiKeyPayload;
+export type UpdateApiKeyPayload = Wire.UpdateApiKeyPayload;
+export type ApiKeyWithValue = Wire.ApiKeyWithValue;
+export type ApiKeyReadResponse = Wire.ApiKeyReadResponse;
 
 export interface CreatePublicKeyPayload {
     name?: string;
@@ -75,9 +70,9 @@ export interface CreatePublicKeyPayload {
     ttl?: number;
 }
 
-export type AuthTokenResponse = z.infer<typeof AuthTokenResponseSchema>;
-export type ApiKeyListQuery = z.infer<typeof ApiKeyListQuerySchema>;
-export type ApiKeyReadQuery = z.infer<typeof ApiKeyReadQuerySchema>;
+export type AuthTokenResponse = Wire.AuthTokenResponse;
+export type ApiKeyListQuery = Wire.ApiKeyListQuery;
+export type ApiKeyReadQuery = Wire.ApiKeyReadQuery;
 
 export interface AuthTokenPayload {
     credential_scope?: 'project' | 'account';
@@ -126,8 +121,8 @@ export interface AuthTokenPayload {
     /** groups */
     groups?: UserGroupRef[]; //group ids
 
-    /** Content security conditions keyed by permission (read/write/delete).
-     *  Presence triggers restrict mode: project:* is dropped from security filters.
+    /** Scoped ABAC conditions keyed by operation.
+     *  Each resource consumer defines its baseline/restrict composition.
      *
      *  Transitional: this field is being renamed to `abac` (see [[pending-migrations]]).
      *  Both fields are typed so consumers can dual-read during the transition.
@@ -197,12 +192,8 @@ export enum PrincipalType {
     Schedule = 'schedule',
 }
 
-export type AccountApiKey = z.infer<typeof import('./api-schemas/apikey.js').AccountApiKeySchema>;
-export type AccountApiKeyWithValue = z.infer<typeof import('./api-schemas/apikey.js').AccountApiKeyWithValueSchema>;
-export type AccountApiKeyArray = z.infer<typeof import('./api-schemas/apikey.js').AccountApiKeyArraySchema>;
-export type CreateAccountApiKeyPayload = z.infer<
-    typeof import('./api-schemas/apikey.js').CreateAccountApiKeyPayloadSchema
->;
-export type UpdateAccountApiKeyPayload = z.infer<
-    typeof import('./api-schemas/apikey.js').UpdateAccountApiKeyPayloadSchema
->;
+export type AccountApiKey = Wire.AccountApiKey;
+export type AccountApiKeyWithValue = Wire.AccountApiKeyWithValue;
+export type AccountApiKeyArray = Wire.AccountApiKeyArray;
+export type CreateAccountApiKeyPayload = Wire.CreateAccountApiKeyPayload;
+export type UpdateAccountApiKeyPayload = Wire.UpdateAccountApiKeyPayload;