@vertesia/common 1.6.0-dev.20260923.085325Z → 1.6.0-dev.20261004.085740Z

package/src/api-schemas/registry.ts

@@ -69,6 +69,7 @@ import type {
     UpdateProcessDefinitionPayload,
 } from '../store/process.js';
 import type { ViewNavigationNode } from '../views.js';
+import type { ApiComponentTypes } from '../wire-types.generated.js';
 import {
     ACECreatePayloadSchema,
     ACEUpdatePayloadSchema,
@@ -467,6 +468,23 @@ import {
     ReindexAgentRunsResponseSchema,
     StartProjectReindexPayloadSchema,
 } from './indexing.js';
+import {
+    CreateInferenceProfilePayloadSchema,
+    InferenceProfileIdSchema,
+    InferenceProfileNameSchema,
+    InferenceProfileRecordArraySchema,
+    InferenceProfileRecordSchema,
+    InferenceProfileSchema,
+    InferenceProfileSnapshotSchema,
+    InferenceProfileUsageEntrySchema,
+    InferenceProfileUsageQuerySchema,
+    InferenceProfileUsageSchema,
+    InteractionConfigurationRecordSchema,
+    InteractionConfigurationResultSchema,
+    ProjectInferenceProfilesSchema,
+    UpdateInferenceProfilePayloadSchema,
+    UpdateInteractionConfigurationPayloadSchema,
+} from './inference-profile.js';
 import * as IntegrationSchemas from './integrations.js';
 import {
     AgentResourceActionSchema,
@@ -708,6 +726,7 @@ import {
     RenderPromptResponseSchema,
 } from './prompt.js';
 import { QuotaStandingResponseSchema, QuotaTierResponseSchema } from './quota.js';
+import * as RunBudgetSchemas from './run-budget.js';
 import * as SecretSchemas from './secrets.js';
 import {
     ColumnLayoutSchema,
@@ -1115,6 +1134,21 @@ const LLM_COMPLETION_SCHEMAS = {
 } as const satisfies Record<string, z.ZodType>;
 
 const INTERACTION_SCHEMAS = {
+    UpdateInteractionConfigurationPayload: UpdateInteractionConfigurationPayloadSchema,
+    InteractionConfigurationRecord: InteractionConfigurationRecordSchema,
+    InteractionConfigurationResult: InteractionConfigurationResultSchema,
+    CreateInferenceProfilePayload: CreateInferenceProfilePayloadSchema,
+    UpdateInferenceProfilePayload: UpdateInferenceProfilePayloadSchema,
+    InferenceProfileRecord: InferenceProfileRecordSchema,
+    InferenceProfileUsage: InferenceProfileUsageSchema,
+    InferenceProfileUsageEntry: InferenceProfileUsageEntrySchema,
+    InferenceProfileUsageQuery: InferenceProfileUsageQuerySchema,
+    InferenceProfileRecordArray: InferenceProfileRecordArraySchema,
+    InferenceProfileId: InferenceProfileIdSchema,
+    InferenceProfileName: InferenceProfileNameSchema,
+    InferenceProfile: InferenceProfileSchema,
+    InferenceProfileSnapshot: InferenceProfileSnapshotSchema,
+    ProjectInferenceProfiles: ProjectInferenceProfilesSchema,
     // The interaction definition and the prompt tree under it.
     InteractionStatus: InteractionStatusSchema,
     InteractionVisibility: InteractionVisibilitySchema,
@@ -1249,6 +1283,30 @@ type ExecutionRunSchemaMap = {
     RunSearchQuery: typeof RunSearchQuerySchema;
     RunListQuery: typeof RunListQuerySchema;
     RunSearchPayload: typeof RunSearchPayloadSchema;
+};
+
+const EXECUTION_RUN_SCHEMAS: ExecutionRunSchemaMap = {
+    // A run: what was executed, by whom, and how it ended.
+    ExecutionRunStatus: ExecutionRunStatusSchema,
+    RunSourceTypes: RunSourceTypesSchema,
+    RunSource: RunSourceSchema,
+    ExecutionRunDocRef: ExecutionRunDocRefSchema,
+    ExecutionRunWorkflow: ExecutionRunWorkflowSchema,
+    ExecutionRunInteraction: ExecutionRunInteractionSchema,
+    ExecutionRun: ExecutionRunSchema,
+    ExecutionRunRef: ExecutionRunRefSchema,
+    ExecutionRunRefArray: ExecutionRunRefArraySchema,
+    UpdateExecutionRunPayload: UpdateExecutionRunPayloadSchema,
+    RunCreatePayload: RunCreatePayloadSchema,
+    // Listing and searching runs.
+    SortOrder: SortOrderSchema,
+    SortOption: SortOptionSchema,
+    RunSearchQuery: RunSearchQuerySchema,
+    RunListQuery: RunListQuerySchema,
+    RunSearchPayload: RunSearchPayloadSchema,
+} as const satisfies Record<string, z.ZodType>;
+
+const EXECUTION_REQUEST_SCHEMAS: {
     InteractionExecutionPayload: typeof InteractionExecutionPayloadSchema;
     NamedInteractionExecutionPayload: typeof NamedInteractionExecutionPayloadSchema;
     InteractionExecutionResult: typeof InteractionExecutionResultSchema;
@@ -1277,27 +1335,7 @@ type ExecutionRunSchemaMap = {
     UserMessagePayload: typeof UserMessagePayloadSchema;
     ExecutionResponse: typeof ExecutionResponseSchema;
     RunClonePayload: typeof RunClonePayloadSchema;
-};
-
-const EXECUTION_RUN_SCHEMAS: ExecutionRunSchemaMap = {
-    // A run: what was executed, by whom, and how it ended.
-    ExecutionRunStatus: ExecutionRunStatusSchema,
-    RunSourceTypes: RunSourceTypesSchema,
-    RunSource: RunSourceSchema,
-    ExecutionRunDocRef: ExecutionRunDocRefSchema,
-    ExecutionRunWorkflow: ExecutionRunWorkflowSchema,
-    ExecutionRunInteraction: ExecutionRunInteractionSchema,
-    ExecutionRun: ExecutionRunSchema,
-    ExecutionRunRef: ExecutionRunRefSchema,
-    ExecutionRunRefArray: ExecutionRunRefArraySchema,
-    UpdateExecutionRunPayload: UpdateExecutionRunPayloadSchema,
-    RunCreatePayload: RunCreatePayloadSchema,
-    // Listing and searching runs.
-    SortOrder: SortOrderSchema,
-    SortOption: SortOptionSchema,
-    RunSearchQuery: RunSearchQuerySchema,
-    RunListQuery: RunListQuerySchema,
-    RunSearchPayload: RunSearchPayloadSchema,
+} = {
     // Executing an interaction, synchronously or as a workflow.
     InteractionExecutionPayload: InteractionExecutionPayloadSchema,
     NamedInteractionExecutionPayload: NamedInteractionExecutionPayloadSchema,
@@ -1376,7 +1414,22 @@ const DURABLE_TASK_SCHEMAS = {
     ListTasksQuery: ListTasksQuerySchema,
 } as const satisfies Record<string, z.ZodType>;
 
-const CONTENT_TYPE_CATALOG_SCHEMAS = {
+// Keep declaration emit from expanding the nested content-type schemas.
+const CONTENT_TYPE_CATALOG_SCHEMAS: {
+    readonly ColumnLayout: typeof ColumnLayoutSchema;
+    readonly ContentTypeEditingPolicy: typeof ContentTypeEditingPolicySchema;
+    readonly ContentObjectTypeStatus: typeof ContentObjectTypeStatusSchema;
+    readonly ContentObjectTypeItem: typeof ContentObjectTypeItemSchema;
+    readonly ContentObjectTypeItemArray: typeof ContentObjectTypeItemArraySchema;
+    readonly ContentObjectTypeCatalogEntry: typeof ContentObjectTypeCatalogEntrySchema;
+    readonly ContentObjectTypeCatalogEntryArray: typeof ContentObjectTypeCatalogEntryArraySchema;
+    readonly InCodeTypeDefinition: typeof InCodeTypeDefinitionSchema;
+    readonly CreateContentObjectTypePayload: typeof CreateContentObjectTypePayloadSchema;
+    readonly UpdateContentObjectTypePayload: typeof UpdateContentObjectTypePayloadSchema;
+    readonly ContentObjectType: typeof ContentObjectTypeSchema;
+    readonly ContentObjectTypeCatalogQuery: typeof ContentObjectTypeCatalogQuerySchema;
+    readonly ContentObjectTypeListQuery: typeof ContentObjectTypeListQuerySchema;
+} = {
     ColumnLayout: ColumnLayoutSchema,
     ContentTypeEditingPolicy: ContentTypeEditingPolicySchema,
     ContentObjectTypeStatus: ContentObjectTypeStatusSchema,
@@ -1753,6 +1806,9 @@ const PROCESS_RUNTIME_SCHEMAS = {
     AnswerProcessTaskPayload: ProcessSchemas.AnswerProcessTaskPayloadSchema,
     AdvanceProcessPayload: ProcessSchemas.AdvanceProcessPayloadSchema,
     ProcessState: ProcessSchemas.ProcessStateSchema,
+    ProcessTerminalReason: ProcessSchemas.ProcessTerminalReasonSchema,
+    ProcessBudgetState: ProcessSchemas.ProcessBudgetStateSchema,
+    ProcessBudgetSummary: ProcessSchemas.ProcessBudgetSummarySchema,
     WorkflowExecutionStartResultArray: ProcessSchemas.WorkflowExecutionStartResultArraySchema,
     RecordProcessRunPayload: ProcessSchemas.RecordProcessRunPayloadSchema,
     ProcessTestRunStatus: ProcessSchemas.ProcessTestRunStatusSchema,
@@ -1874,6 +1930,7 @@ const AGENT_RUN_SCHEMAS = {
     AgentRunArchiveState: AgentRunSchemas.AgentRunArchiveStateSchema,
     ResourceRef: AgentRunSchemas.ResourceRefSchema,
     SignalAgentResponse: AgentRunSchemas.SignalAgentResponseSchema,
+    AllocateAgentRunBudgetPayload: AgentRunSchemas.AllocateAgentRunBudgetPayloadSchema,
     AutonomousRunResponse: AgentRunSchemas.AutonomousRunResponseSchema,
     AgentRun: AgentRunSchemas.AgentRunSchema,
     CreateAgentRunPayload: AgentRunSchemas.CreateAgentRunPayloadSchema,
@@ -1904,16 +1961,16 @@ const AGENT_RUN_SCHEMAS = {
     AgentRunFeedbackResponse: AgentRunSchemas.AgentRunFeedbackResponseSchema,
     AgentRunFeedbackEntry: AgentRunSchemas.AgentRunFeedbackEntrySchema,
     AgentRunEvaluationRollup: AgentRunSchemas.AgentRunEvaluationRollupSchema,
-    AgentRunJudgeResult: AgentRunSchemas.AgentRunJudgeResultSchema,
+    AgentRunLlmEvaluationResult: AgentRunSchemas.AgentRunLlmEvaluationResultSchema,
     AgentRunContradictionReason: AgentRunSchemas.AgentRunContradictionReasonSchema,
     AgentRunEvaluation: AgentRunSchemas.AgentRunEvaluationSchema,
     TurnTerminalType: AgentRunSchemas.TurnTerminalTypeSchema,
     EvaluationSeverity: AgentRunSchemas.EvaluationSeveritySchema,
     TurnEvaluationFlag: AgentRunSchemas.TurnEvaluationFlagSchema,
     ToolErrorClass: AgentRunSchemas.ToolErrorClassSchema,
-    JudgeGateReason: AgentRunSchemas.JudgeGateReasonSchema,
-    JudgeOutcome: AgentRunSchemas.JudgeOutcomeSchema,
-    JudgeVerdict: AgentRunSchemas.JudgeVerdictSchema,
+    EvaluationGateReason: AgentRunSchemas.EvaluationGateReasonSchema,
+    EvaluationOutcome: AgentRunSchemas.EvaluationOutcomeSchema,
+    EvaluationVerdict: AgentRunSchemas.EvaluationVerdictSchema,
     ListAgentRunsEvaluationSeverity: AgentRunSchemas.ListAgentRunsEvaluationSeveritySchema,
     AgentEvent: AgentRunSchemas.AgentEventSchema,
     IngestAgentEventsPayload: AgentRunSchemas.IngestAgentEventsPayloadSchema,
@@ -2383,7 +2440,16 @@ const DELEGATION_SCHEMAS = {
     DelegationGrant: DelegationGrantSchema,
     DelegationGrantArray: DelegationGrantArraySchema,
 };
+const RUN_BUDGET_SCHEMAS = {
+    RunBudgetOwner: RunBudgetSchemas.RunBudgetOwnerSchema,
+    RunBudgetUsage: RunBudgetSchemas.RunBudgetUsageSchema,
+    ReadRunBudgetUsagePayload: RunBudgetSchemas.ReadRunBudgetUsagePayloadSchema,
+    RunBudgetTotals: RunBudgetSchemas.RunBudgetTotalsSchema,
+    RunBudgetCapability: RunBudgetSchemas.RunBudgetCapabilitySchema,
+    RunBudgetCapabilityQuery: RunBudgetSchemas.RunBudgetCapabilityQuerySchema,
+};
 const API_SCHEMA_GROUPS = [
+    RUN_BUDGET_SCHEMAS,
     DELEGATION_SCHEMAS,
     IAM_AND_ACCOUNT_SCHEMAS,
     PROJECT_AND_APP_SCHEMAS,
@@ -2394,6 +2460,7 @@ const API_SCHEMA_GROUPS = [
     INTERACTION_AUTHORING_SCHEMAS,
     AGENT_CONVERSATION_SCHEMAS,
     EXECUTION_RUN_SCHEMAS,
+    EXECUTION_REQUEST_SCHEMAS,
     PROMPT_AUTHORING_SCHEMAS,
     PROJECT_TOOL_SCHEMAS,
     REMOTE_MCP_SCHEMAS,
@@ -2447,7 +2514,8 @@ const API_SCHEMA_GROUPS = [
  * have inferred to. `mergeComponentGroups` rejects a name declared by two groups, so no key is ever
  * intersected with a second schema.
  */
-type ApiSchemaMap = typeof DELEGATION_SCHEMAS &
+type ApiSchemaMap = typeof RUN_BUDGET_SCHEMAS &
+    typeof DELEGATION_SCHEMAS &
     typeof IAM_AND_ACCOUNT_SCHEMAS &
     typeof PROJECT_AND_APP_SCHEMAS &
     typeof OAUTH_SCHEMAS &
@@ -2457,6 +2525,7 @@ type ApiSchemaMap = typeof DELEGATION_SCHEMAS &
     typeof INTERACTION_AUTHORING_SCHEMAS &
     typeof AGENT_CONVERSATION_SCHEMAS &
     typeof EXECUTION_RUN_SCHEMAS &
+    typeof EXECUTION_REQUEST_SCHEMAS &
     typeof PROMPT_AUTHORING_SCHEMAS &
     typeof PROJECT_TOOL_SCHEMAS &
     typeof REMOTE_MCP_SCHEMAS &
@@ -2519,6 +2588,15 @@ const API_SCHEMAS: Readonly<Record<ApiComponentName, z.ZodType>> = mergeComponen
  * objects, so a body carrying an undeclared property is rejected rather than quietly accepted.
  */
 const STRICT_COMPONENTS: ReadonlySet<string> = new Set<string>([
+    'UpdateInteractionConfigurationPayload',
+    'InteractionConfigurationRecord',
+    'InteractionConfigurationResult',
+    'CreateInferenceProfilePayload',
+    'UpdateInferenceProfilePayload',
+    'InferenceProfileRecord',
+    'InferenceProfile',
+    'InferenceProfileSnapshot',
+    'ProjectInferenceProfiles',
     'AccountApiKey',
     'AccountApiKeyWithValue',
     'CreateAccountApiKeyPayload',
@@ -2679,6 +2757,8 @@ const STRICT_COMPONENTS: ReadonlySet<string> = new Set<string>([
     // The agent configuration block under `ProjectConfiguration`, published closed on both sides.
     'AgentProjectConfiguration',
     'AgentCheckpointConfiguration',
+    'AgentBudgetConfiguration',
+    ...Object.keys(RUN_BUDGET_SCHEMAS),
     // Declared in @llumiverse/common beside the type, like the ModelOptions members above.
     'HttpTimeoutOptions',
     // The intake policy tree. Every object in it is published closed today, including the inline
@@ -2707,6 +2787,8 @@ const STRICT_COMPONENTS: ReadonlySet<string> = new Set<string>([
     // `JSONSchema` is deliberately absent: it is OPEN by design and by long-standing publication —
     // a JSON Schema carries keywords the type never enumerated. `JSONSchemaProperties` is a map.
     // Derive membership so new provider schemas inherit this enforcement check automatically.
+    'OpenAiImageGenerationOptions',
+    'OpenAiImageGenerationMask',
     ...ModelOptionsSchema.options.map((schema) => {
         const id = schema.meta()?.id;
         if (!id) throw new Error('Model option schemas must declare a component id');
@@ -2912,7 +2994,7 @@ const STRICT_COMPONENTS: ReadonlySet<string> = new Set<string>([
     'AgentRunFeedbackCounts',
     'AgentRunFeedbackEntry',
     'AgentRunEvaluationRollup',
-    'AgentRunJudgeResult',
+    'AgentRunLlmEvaluationResult',
     'AgentRunEvaluation',
     'StartContentObjectExportResponse',
     'ExportContentObjectsIncludeOptions',
@@ -2952,6 +3034,8 @@ const STRICT_COMPONENTS: ReadonlySet<string> = new Set<string>([
     'ContentObjectExportArtifactFile',
     'ProcessRunConfig',
     'ProcessHistoryRef',
+    'ProcessBudgetState',
+    'ProcessBudgetSummary',
     'NodeHistoryEntry',
     'ResourceRef',
     'WorkflowRun',
@@ -2986,6 +3070,7 @@ const STRICT_COMPONENTS: ReadonlySet<string> = new Set<string>([
     'WorkflowActionResponse',
     'AnswerProcessTaskPayload',
     'SignalAgentResponse',
+    'AllocateAgentRunBudgetPayload',
     'AdvanceProcessPayload',
     'BranchDefinition',
     'ParallelCollectDefinition',
@@ -3610,12 +3695,25 @@ interface ZenoRecursiveComponentTypes {
 /**
  * The wire type a component publishes.
  *
- * `ApiComponentType<'Account'>` is `z.infer<typeof AccountSchema>` — the map is indexed directly
- * rather than dispatched through the groups, which the intersection makes possible.
+ * `ApiComponentType<'Account'>` is the plain type `gen:schemas` writes for `AccountSchema` into
+ * `ApiComponentTypes`, which `wire-types.generated.test.ts` proves identical to its `z.infer`. Indexing
+ * that map rather than `z.infer<ApiSchemaMap[N]>` keeps Zod's inference out of every program that names
+ * a component. A component the generator has not seen yet resolves to `never`, which
+ * `registry-groups.test.ts` rejects.
+ *
+ * It is wrapped in `NoInfer` because `N` always comes from a component-name argument and can never be
+ * recovered from the wire type. Without it, a call whose result has a contextual type — a destructuring
+ * `const { file } = validatedQuery(ctx, 'FileMetadataQuery')`, an `await`, a typed `return` — makes the
+ * checker infer `N` from that context while `N` is still unresolved, which evaluates `z.infer` across
+ * every component in the registry: about 500k types, 1 GB and 2 s of `tsc` in each consuming program.
  */
-export type ApiComponentType<N extends ApiComponentName> = N extends keyof ZenoRecursiveComponentTypes
-    ? ZenoRecursiveComponentTypes[N]
-    : z.infer<ApiSchemaMap[N]>;
+export type ApiComponentType<N extends ApiComponentName> = NoInfer<
+    N extends keyof ZenoRecursiveComponentTypes
+        ? ZenoRecursiveComponentTypes[N]
+        : N extends keyof ApiComponentTypes
+          ? ApiComponentTypes[N]
+          : never
+>;
 
 /**
  * Names a published component from inside a handler signature:

package/src/api-schemas/run-budget.ts

@@ -0,0 +1,60 @@
+import { z } from 'zod';
+
+export const RunBudgetOwnerSchema = z
+    .strictObject({
+        workflow_id: z.string().min(1),
+        first_run_id: z.string().min(1),
+    })
+    .meta({ id: 'RunBudgetOwner' });
+
+/** Cumulative counters are read from existing execution runs, never from an audit cursor. */
+export const RunBudgetUsageSchema = z
+    .strictObject({
+        input: z.number().nonnegative(),
+        cached_input: z.number().nonnegative(),
+        output: z.number().nonnegative(),
+    })
+    .meta({ id: 'RunBudgetUsage' });
+
+export const RunBudgetTotalsSchema = z
+    .strictObject({
+        measured: RunBudgetUsageSchema,
+        unpriced: RunBudgetUsageSchema,
+        reported_nano_usd: z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER),
+        estimated_nano_usd: z.number().int().nonnegative().max(Number.MAX_SAFE_INTEGER),
+        unmeasured_calls: z.number().int().nonnegative(),
+        missing_usage_calls: z.number().int().nonnegative(),
+    })
+    .meta({ id: 'RunBudgetTotals' });
+
+export const ReadRunBudgetUsagePayloadSchema = z
+    .strictObject({
+        account_id: z.string().min(1),
+        project_id: z.string().min(1),
+        agent_run_id: z.string().min(1),
+        owner: RunBudgetOwnerSchema,
+        require_estimates: z.boolean().optional(),
+    })
+    .meta({ id: 'ReadRunBudgetUsagePayload' });
+
+export const RunBudgetCapabilitySchema = z
+    .strictObject({
+        supported: z.boolean(),
+        source: z.enum(['provider', 'estimate', 'unavailable']),
+        reason: z.string().optional(),
+    })
+    .meta({ id: 'RunBudgetCapability' });
+
+export const RunBudgetCapabilityQuerySchema = z
+    .strictObject({
+        check_model: z
+            .boolean()
+            .optional()
+            .meta({ description: 'False checks only whether estimates are enabled, without consulting model prices.' }),
+        model: z.string().min(1),
+        service_tier: z.string().optional(),
+    })
+    .meta({
+        id: 'RunBudgetCapabilityQuery',
+        description: 'Selected model and requested serving tier for run budget admission.',
+    });

package/src/api-schemas/store.ts

@@ -2,6 +2,7 @@ import { HttpTimeoutOptionsSchema, ModelOptionsSchema, PromptCacheModeSchema } f
 import { z } from 'zod';
 // From the values module, for the reason `./apikey.js` gives.
 import { ConfigModes, RunDataStorageLevel } from '../interaction-values.js';
+import { InferenceProfileIdSchema } from './inference-profile.js';
 import { EditRevisionSchema, ExpectedEditRevisionSchema } from './schema-primitives.js';
 
 /**
@@ -78,6 +79,17 @@ export const ConfigModesSchema = z.enum(ConfigModes).meta({ id: 'ConfigModes' })
 export const InteractionExecutionConfigurationSchema = z
     .strictObject({
         id: z.string().optional(),
+        inference_profile: InferenceProfileIdSchema.nullable()
+            .optional()
+            .meta({ description: 'Select a project inference profile. Null bypasses profile defaults.' }),
+        inherit_model_config: z
+            .boolean()
+            .optional()
+            .meta({
+                description:
+                    "Treat the supplied environment, model and inference_profile as the caller's settings, inherited as " +
+                    "a fallback: the interaction's bound or attached profile, or its own model, replaces them.",
+            }),
         environment: z.string().optional(),
         model: z.string().optional(),
         do_validate: z.boolean().optional(),

package/src/api-schemas/user.ts

@@ -1,4 +1,5 @@
 import { z } from 'zod';
+import type * as Wire from '../wire-types.generated.js';
 
 /**
  * Runtime API schemas for the IAM user endpoints.
@@ -200,11 +201,11 @@ export const SignupPayloadSchema = z
  * The public IAM types, inferred rather than written. `../principal-context.ts`, `../user.ts` and
  * `../common.ts` re-export these under their public names.
  */
-export type AbacPrincipalContextFromSchema = z.infer<typeof AbacPrincipalContextSchema>;
-export type PrincipalIdentityFromSchema = z.infer<typeof PrincipalIdentitySchema>;
-export type UserFromSchema = z.infer<typeof UserSchema>;
-export type UserArrayFromSchema = z.infer<typeof UserArraySchema>;
-export type UserRefFromSchema = z.infer<typeof UserRefSchema>;
-export type UserRefArrayFromSchema = z.infer<typeof UserRefArraySchema>;
-export type UpdateUserPayloadFromSchema = z.infer<typeof UpdateUserPayloadSchema>;
-export type DeleteByIdResultFromSchema = z.infer<typeof DeleteByIdResultSchema>;
+export type AbacPrincipalContextFromSchema = Wire.AbacPrincipalContextFromSchema;
+export type PrincipalIdentityFromSchema = Wire.PrincipalIdentityFromSchema;
+export type UserFromSchema = Wire.UserFromSchema;
+export type UserArrayFromSchema = Wire.UserArrayFromSchema;
+export type UserRefFromSchema = Wire.UserRefFromSchema;
+export type UserRefArrayFromSchema = Wire.UserRefArrayFromSchema;
+export type UpdateUserPayloadFromSchema = Wire.UpdateUserPayloadFromSchema;
+export type DeleteByIdResultFromSchema = Wire.DeleteByIdResultFromSchema;

package/src/api-schemas/workflow-runs.ts

@@ -12,6 +12,7 @@ import {
     InteractionRefSchema,
     UserChannelSchema,
 } from './interaction.js';
+import { AgentBudgetConfigurationSchema } from './project-configuration.js';
 import { nullableStringSchema } from './schema-primitives.js';
 import { InteractionExecutionConfigurationSchema } from './store.js';
 
@@ -112,6 +113,7 @@ export const WorkflowInteractionVarsSchema = z
         collection_id: z.string().optional(),
         disabled_mcp_collections: z.array(z.string()).optional(),
         checkpoint_tokens: z.number().optional(),
+        budget: AgentBudgetConfigurationSchema.optional(),
         version: z.number().optional(),
         agent_run_id: z.string().optional(),
     })

package/src/apikey.ts

@@ -1,19 +1,8 @@
-import type { z } from 'zod';
 import type { PropertyConditions } from './access-control.js';
-import type {
-    ApiKeyArraySchema,
-    ApiKeyListQuerySchema,
-    ApiKeyReadQuerySchema,
-    ApiKeyReadResponseSchema,
-    ApiKeySchema,
-    ApiKeyWithValueSchema,
-    AuthTokenResponseSchema,
-    CreateApiKeyPayloadSchema,
-    UpdateApiKeyPayloadSchema,
-} from './api-schemas/apikey.js';
 import type { UserGroupRef } from './group.js';
 import type { ProjectRef, SystemRoles } from './project.js';
 import type { AccountRef } from './user.js';
+import type * as Wire from './wire-types.generated.js';
 
 /**
  * `ApiKeyTypes` lives in `./apikey-values.js` so the API schemas can read it without importing this
@@ -22,17 +11,17 @@ import type { AccountRef } from './user.js';
 export * from './apikey-values.js';
 
 /**
- * Per-scope, per-verb property-condition arrays that narrow content visibility
- * at query time. Each value array uses $or semantics — any matching condition
- * set grants access. Presence of this object switches content access from
- * allow-all to restrict mode.
+ * Per-scope, per-verb property-condition arrays that narrow resource access.
+ * Each value array uses $or semantics — any matching condition set grants
+ * access. The consumer defines when the presence of its scope switches access
+ * from the baseline to restrict mode.
  *
  * The bare keys `read`/`write`/`delete` apply to the default `'document'`
  * scope. They also receive entries emitted by system-role ABAC ACEs (which
  * predate the scope concept).
  *
  * Non-default scopes appear as prefixed keys: `'collection:read'`,
- * `'collection:write'`, `'task:read'`, etc. — the prefix is the
+ * `'agent_run:control'`, `'task:read'`, etc. — the prefix is the
  * `AceConditions.scope` value, the suffix is the verb derived from the
  * ABAC role's permission set.
  *
@@ -42,8 +31,14 @@ export interface ContentSecurity {
     read?: PropertyConditions[];
     write?: PropertyConditions[];
     delete?: PropertyConditions[];
-    /** Scope-prefixed entries: `'collection:read'`, `'task:write'`, etc. */
-    [scopedKey: string]: PropertyConditions[] | undefined;
+    /**
+     * Either a scope-prefixed conditions entry (`'collection:read'`, `'agent_run:control'`, …) whose
+     * value is a conditions array, OR a cross-project shared-content group keyed by `'@<owner_project_id>'`
+     * whose value is a nested `ContentSecurity` — the SAME shape scoped to that owner project, minus
+     * any further `@` keys (the mint never nests `@` groups inside `@` groups). Distinguish by the
+     * `@` prefix (or `Array.isArray`): bare/scope keys → conditions array; `@`-keys → nested group.
+     */
+    [scopedKey: string]: PropertyConditions[] | ContentSecurity | undefined;
 }
 
 /**
@@ -54,8 +49,8 @@ export interface ContentSecurity {
  * `format: date-time` strings and JSON has no date type, so the previous `Date` declaration
  * described the Mongoose document rather than the response a client parses.
  */
-export type ApiKey = z.infer<typeof ApiKeySchema>;
-export type ApiKeyArray = z.infer<typeof ApiKeyArraySchema>;
+export type ApiKey = Wire.ApiKey;
+export type ApiKeyArray = Wire.ApiKeyArray;
 /**
  * Create and update take DIFFERENT payloads, and did not before.
  *
@@ -64,10 +59,10 @@ export type ApiKeyArray = z.infer<typeof ApiKeyArraySchema>;
  * `role` (which unset a required path). Splitting it is source-breaking for the SDK and is announced
  * as a release operation; the two names say which operation they belong to.
  */
-export type CreateApiKeyPayload = z.infer<typeof CreateApiKeyPayloadSchema>;
-export type UpdateApiKeyPayload = z.infer<typeof UpdateApiKeyPayloadSchema>;
-export type ApiKeyWithValue = z.infer<typeof ApiKeyWithValueSchema>;
-export type ApiKeyReadResponse = z.infer<typeof ApiKeyReadResponseSchema>;
+export type CreateApiKeyPayload = Wire.CreateApiKeyPayload;
+export type UpdateApiKeyPayload = Wire.UpdateApiKeyPayload;
+export type ApiKeyWithValue = Wire.ApiKeyWithValue;
+export type ApiKeyReadResponse = Wire.ApiKeyReadResponse;
 
 export interface CreatePublicKeyPayload {
     name?: string;
@@ -75,9 +70,9 @@ export interface CreatePublicKeyPayload {
     ttl?: number;
 }
 
-export type AuthTokenResponse = z.infer<typeof AuthTokenResponseSchema>;
-export type ApiKeyListQuery = z.infer<typeof ApiKeyListQuerySchema>;
-export type ApiKeyReadQuery = z.infer<typeof ApiKeyReadQuerySchema>;
+export type AuthTokenResponse = Wire.AuthTokenResponse;
+export type ApiKeyListQuery = Wire.ApiKeyListQuery;
+export type ApiKeyReadQuery = Wire.ApiKeyReadQuery;
 
 export interface AuthTokenPayload {
     credential_scope?: 'project' | 'account';
@@ -126,8 +121,8 @@ export interface AuthTokenPayload {
     /** groups */
     groups?: UserGroupRef[]; //group ids
 
-    /** Content security conditions keyed by permission (read/write/delete).
-     *  Presence triggers restrict mode: project:* is dropped from security filters.
+    /** Scoped ABAC conditions keyed by operation.
+     *  Each resource consumer defines its baseline/restrict composition.
      *
      *  Transitional: this field is being renamed to `abac` (see [[pending-migrations]]).
      *  Both fields are typed so consumers can dual-read during the transition.
@@ -197,12 +192,8 @@ export enum PrincipalType {
     Schedule = 'schedule',
 }
 
-export type AccountApiKey = z.infer<typeof import('./api-schemas/apikey.js').AccountApiKeySchema>;
-export type AccountApiKeyWithValue = z.infer<typeof import('./api-schemas/apikey.js').AccountApiKeyWithValueSchema>;
-export type AccountApiKeyArray = z.infer<typeof import('./api-schemas/apikey.js').AccountApiKeyArraySchema>;
-export type CreateAccountApiKeyPayload = z.infer<
-    typeof import('./api-schemas/apikey.js').CreateAccountApiKeyPayloadSchema
->;
-export type UpdateAccountApiKeyPayload = z.infer<
-    typeof import('./api-schemas/apikey.js').UpdateAccountApiKeyPayloadSchema
->;
+export type AccountApiKey = Wire.AccountApiKey;
+export type AccountApiKeyWithValue = Wire.AccountApiKeyWithValue;
+export type AccountApiKeyArray = Wire.AccountApiKeyArray;
+export type CreateAccountApiKeyPayload = Wire.CreateAccountApiKeyPayload;
+export type UpdateAccountApiKeyPayload = Wire.UpdateAccountApiKeyPayload;