@ingram-cloud/sdk 1.0.0

package/dist/responses.js

@@ -0,0 +1,12 @@
+/**
+ * TypeScript types for the `/v1` JSON response bodies — the consumer-facing
+ * companion to the wire schemas, imported by API consumers (e.g. the console) to
+ * type the JSON they read back.
+ *
+ * The `IC*` types are `z.infer`red from the hand-authored Zod in
+ * `./zod/<resource>` (the wire's source of truth) and re-exported here as
+ * **types** — so this module stays Zod-free for `import type` consumers. Only the
+ * list-envelope generics ({@link ICList}/{@link ICPaginatedResponse}) are
+ * declared inline, since they're generic over any resource.
+ */
+export {};

package/dist/schemas.js

@@ -0,0 +1,4 @@
+/** The wire's Zod schema map — the hand-authored schemas in ./zod, keyed by
+ *  export name. Source of truth; consumed by the api test suite to validate
+ *  wire shapes. (Replaces the former openapi-zod-client-generated file.) */
+export * as schemas from "./zod/index.js";

package/dist/zod/_page.js

@@ -0,0 +1,17 @@
+/**
+ * The shared cursor-paginated list envelope. One definition so every paginated
+ * `/v1` list reads back the same shape: `data` + the opaque `next_cursor` (null
+ * on the last page) + `has_more`. The cursor is an opaque, short-lived token —
+ * pass it straight back as `?cursor=`, never parse it.
+ */
+import { z } from "zod";
+/** Wrap an item schema as a cursor-paginated list out, named `id` in the spec. */
+export function pageOut(item, id) {
+    return z
+        .object({
+        data: z.array(item),
+        next_cursor: z.string().nullish(),
+        has_more: z.boolean(),
+    })
+        .meta({ id });
+}

package/dist/zod/agents.js

@@ -0,0 +1,176 @@
+/**
+ * Hand-authored Zod schemas for the `agents` resource — the wire's source of
+ * truth, replacing the loose generated `schemas.ts` shapes for this resource.
+ *
+ * One source, three outputs: the API imports these into its `createRoute`
+ * definitions (validation + emitted OpenAPI), and the consumer-facing `IC*`
+ * types are `z.infer`red from them here and re-exported by `../responses`. No
+ * Zod is pulled into a type-only consumer — `responses.ts` re-exports these as
+ * `export type`.
+ *
+ * `.meta({ id })` names the component so the emitted OpenAPI references it as
+ * `#/components/schemas/<id>` rather than inlining it.
+ */
+import { z } from "zod";
+import { pageOut } from "./_page.js";
+/** A per-smith variable an agent declares; bound at run time. */
+export const AgentVariable = z
+    .object({
+    name: z.string(),
+    default: z.string().nullish(),
+    description: z.string().nullish(),
+    required: z.boolean().optional(),
+})
+    .meta({ id: "AgentVariable" });
+/** A predeclared UI-backed capability (Rung 2) bound to a UI template — the MCP
+ *  host's model calls it as a typed tool and the template renders the result. */
+export const UiResourceTool = z
+    .object({
+    description: z.string(),
+    /** JSON Schema for the tool's arguments (host-supplied). */
+    input_schema: z.record(z.string(), z.unknown()).optional(),
+    /** Scoped instruction the smith runs with when this tool is called. */
+    instruction: z.string().nullish(),
+    /** Writes gate through approval; reads flow freely (OpenUI Query/Mutation). */
+    mutating: z.boolean().optional(),
+})
+    .meta({ id: "UiResourceTool" });
+/** CSP domain allowlists for the sandboxed iframe — the MCP Apps `_meta.ui.csp`
+ *  shape (each key a list of allowed origins), passed through to the host verbatim. */
+export const UiCsp = z
+    .object({
+    connectDomains: z.array(z.string()).optional(),
+    resourceDomains: z.array(z.string()).optional(),
+    frameDomains: z.array(z.string()).optional(),
+    baseUriDomains: z.array(z.string()).optional(),
+})
+    .meta({ id: "UiCsp" });
+/** A tenant-authored interactive UI template (MCP Apps, SEP-1865) attached to an
+ *  agent. The HTML bundle lives in blob storage; this is its wire metadata (the
+ *  internal blob ref is never exposed). `csp`/`permissions` mirror the standard
+ *  `_meta.ui` shape and are echoed to the host on `resources/read`. */
+export const UiResource = z
+    .object({
+    name: z.string(),
+    content_hash: z.string(),
+    csp: UiCsp.optional(),
+    /** Host permissions the template requests, a Permissions-Policy-style map
+     *  (e.g. `{ "camera": {}, "microphone": {} }`). */
+    permissions: z.record(z.string(), z.unknown()).optional(),
+    tool: UiResourceTool.nullish(),
+})
+    .meta({ id: "UiResource" });
+/** The mutable draft head — what the next publish snapshots. */
+export const AgentDraft = z
+    .object({
+    instructions: z.string().nullable(),
+    model: z.string().nullable(),
+    enabled_hosted_tools: z.array(z.string()),
+    vector_store_ids: z.array(z.string()),
+    auto_memory: z.boolean().nullable(),
+    memory_consolidation: z.boolean().nullable(),
+    variables: z.array(AgentVariable),
+    ui_resources: z.array(UiResource),
+})
+    .meta({ id: "AgentDraft" });
+export const AgentOut = z
+    .object({
+    id: z.string(),
+    /** Immutable, project-unique IaC reconcile key. Null for the default agent. */
+    slug: z.string().nullable(),
+    /** Free, mutable display label (not unique). */
+    name: z.string(),
+    /** True for the lazily-created default agent (can't be deleted). */
+    is_default: z.boolean(),
+    draft: AgentDraft,
+    active_version: z.number().int().nullable(),
+    rollout_version: z.number().int().nullable(),
+    rollout_percent: z.number().int(),
+    smith_count: z.number().int().optional(),
+    created_at: z.string().nullable(),
+    updated_at: z.string().nullable(),
+})
+    .meta({ id: "AgentOut" });
+export const AgentListOut = pageOut(AgentOut, "AgentListOut");
+/** A published, immutable version snapshot of an agent. */
+export const AgentVersionOut = z
+    .object({
+    version: z.number().int(),
+    snapshot: z.object({
+        instructions: z.string().nullish(),
+        model: z.string().nullish(),
+        enabled_hosted_tools: z.array(z.string()).optional(),
+        vector_store_ids: z.array(z.string()).optional(),
+        auto_memory: z.boolean().nullish(),
+        memory_consolidation: z.boolean().nullish(),
+        variables: z.array(AgentVariable).optional(),
+        ui_resources: z.array(UiResource).optional(),
+    }),
+    created_by: z.string().nullable(),
+    note: z.string().nullable(),
+    created_at: z.string().nullable(),
+})
+    .meta({ id: "AgentVersionOut" });
+export const AgentVersionListOut = z
+    .object({ data: z.array(AgentVersionOut) })
+    .meta({ id: "AgentVersionListOut" });
+// ── Request bodies ──────────────────────────────────────────────────────────
+export const AgentIn = z
+    .object({
+    name: z.string(),
+    slug: z.string().nullish(),
+    instructions: z.string().nullish(),
+    model: z.string().nullish(),
+    enabled_hosted_tools: z.array(z.string()).nullish(),
+    vector_store_ids: z.array(z.string()).nullish(),
+    auto_memory: z.boolean().nullish(),
+    memory_consolidation: z.boolean().nullish(),
+    variables: z.array(AgentVariable).nullish(),
+})
+    .meta({ id: "AgentIn" });
+export const AgentPatch = z
+    .object({
+    name: z.string().nullish(),
+    instructions: z.string().nullish(),
+    model: z.string().nullish(),
+    enabled_hosted_tools: z.array(z.string()).nullish(),
+    vector_store_ids: z.array(z.string()).nullish(),
+    auto_memory: z.boolean().nullish(),
+    memory_consolidation: z.boolean().nullish(),
+    variables: z.array(AgentVariable).nullish(),
+})
+    .meta({ id: "AgentPatch" });
+export const RolloutIn = z
+    .object({
+    version: z.number().int(),
+    percent: z.number().int().min(0).max(100).default(100),
+})
+    .meta({ id: "RolloutIn" });
+export const PublishIn = z
+    .object({ note: z.string().nullish() })
+    .meta({ id: "PublishIn" });
+export const ImportIn = z
+    .object({ from_smith: z.string(), name: z.string() })
+    .meta({ id: "ImportIn" });
+export const AttachIn = z
+    .object({
+    all: z.boolean().default(false),
+    smith_ids: z.array(z.string()).nullish(),
+})
+    .meta({ id: "AttachIn" });
+/** The JSON `metadata` part of a UI-template multipart upload (the HTML bundle
+ *  rides the `file` part). */
+export const UiResourceIn = z
+    .object({
+    name: z
+        .string()
+        .regex(/^[a-z0-9][a-z0-9_-]*$/, "lowercase letters, digits, - and _")
+        .max(63),
+    csp: UiCsp.nullish(),
+    permissions: z.record(z.string(), z.unknown()).nullish(),
+    tool: UiResourceTool.nullish(),
+})
+    .meta({ id: "UiResourceIn" });
+export const UiResourceListOut = z
+    .object({ data: z.array(UiResource) })
+    .meta({ id: "UiResourceListOut" });

package/dist/zod/approvals.js

@@ -0,0 +1,38 @@
+/**
+ * Hand-authored Zod schemas for the `approvals` resource — the wire's source of
+ * truth, replacing the loose generated `schemas.ts` shapes for this resource.
+ *
+ * One source, three outputs: the API imports these into its `createRoute`
+ * definitions (validation + emitted OpenAPI), and the consumer-facing `IC*`
+ * types are `z.infer`red from them here and re-exported by `../responses`. No
+ * Zod is pulled into a type-only consumer — `responses.ts` re-exports these as
+ * `export type`.
+ *
+ * `.meta({ id })` names the component so the emitted OpenAPI references it as
+ * `#/components/schemas/<id>` rather than inlining it.
+ *
+ * The approvals route is read-only (list + get); there is no decision/submit
+ * body here — approvals are resolved on the standard tool-call channel via the
+ * run's `/submit`, not a bespoke endpoint.
+ */
+import { z } from "zod";
+import { pageOut } from "./_page.js";
+/** A first-class human-in-the-loop decision raised by a paused run. */
+export const ApprovalOut = z
+    .object({
+    id: z.string(),
+    run_id: z.string().nullable(),
+    smith_id: z.string().nullable(),
+    tool_call_id: z.string().nullable(),
+    tool: z.string().nullable(),
+    /** The tool-call arguments awaiting a decision; `{}` when none. */
+    args: z.record(z.string(), z.unknown()),
+    /** pending | approved | rejected. */
+    status: z.string(),
+    actor: z.string().nullable(),
+    reason: z.string().nullable(),
+    created_at: z.string().nullable(),
+    resolved_at: z.string().nullable(),
+})
+    .meta({ id: "ApprovalOut" });
+export const ApprovalListOut = pageOut(ApprovalOut, "ApprovalListOut");

package/dist/zod/budgets.js

@@ -0,0 +1,62 @@
+/**
+ * Hand-authored Zod schemas for the `budgets` resource — the wire's source of
+ * truth, replacing the loose generated `schemas.ts` shapes for this resource.
+ *
+ * One source, three outputs: the API imports these into its `createRoute`
+ * definitions (validation + emitted OpenAPI), and the consumer-facing `IC*`
+ * types are `z.infer`red from them here and re-exported by `../responses`. No
+ * Zod is pulled into a type-only consumer — `responses.ts` re-exports these as
+ * `export type`.
+ *
+ * `.meta({ id })` names the component so the emitted OpenAPI references it as
+ * `#/components/schemas/<id>` rather than inlining it.
+ */
+import { z } from "zod";
+/** What a budget caps; `agent`/`smith`/`customer` budgets carry the id in
+ *  `scope_id` (an agent design, a single smith, or one of your customers). */
+export const BudgetScope = z.enum(["tenant", "agent", "smith", "customer"]);
+/** Whether crossing the cap warns or blocks new runs. */
+export const BudgetAction = z.enum(["warn", "block"]);
+/** A monthly spend cap on a scope. `limit` is in `currency` — the platform billing
+ *  currency (EUR by default), not necessarily USD; the field is currency-agnostic. */
+export const BudgetOut = z
+    .object({
+    id: z.string(),
+    scope: BudgetScope,
+    scope_id: z.string().nullish(),
+    period: z.string(),
+    limit: z.number(),
+    // ISO-4217, lower-case. The denomination of `limit` and `/status`'s `spent`.
+    currency: z.string(),
+    action: BudgetAction,
+    created_at: z.string().nullish(),
+})
+    .meta({ id: "BudgetOut" });
+/** A budget plus its month-to-date spend, computed by `/status`. */
+export const BudgetStatusOut = BudgetOut.extend({
+    period_start: z.string(),
+    period_key: z.string(),
+    spent: z.number(),
+    pct: z.number(),
+    over: z.boolean(),
+}).meta({ id: "BudgetStatusOut" });
+export const BudgetListOut = z
+    .object({ data: z.array(BudgetOut) })
+    .meta({ id: "BudgetListOut" });
+// ── Request bodies ──────────────────────────────────────────────────────────
+export const BudgetIn = z
+    .object({
+    scope: z.string(),
+    scope_id: z.string().nullish(),
+    // The cap, in the platform billing currency (EUR by default).
+    limit: z.number(),
+    action: z.string().default("warn"),
+    period: z.string().default("monthly"),
+})
+    .meta({ id: "BudgetIn" });
+export const BudgetPatch = z
+    .object({
+    limit: z.number().nullish(),
+    action: z.string().nullish(),
+})
+    .meta({ id: "BudgetPatch" });

package/dist/zod/catalog.js

@@ -0,0 +1,49 @@
+/**
+ * Hand-authored Zod schemas for the `catalog` resource — the Ingram-curated MCP
+ * integration presets exposed at `GET /v1/catalog`.
+ *
+ * One source, three outputs: the API imports these into its `createRoute`
+ * definitions (validation + emitted OpenAPI), and the consumer-facing `IC*`
+ * type is `z.infer`red from them here and re-exported by `../responses`. No Zod
+ * is pulled into a type-only consumer — `responses.ts` re-exports these as
+ * `export type`.
+ *
+ * `.meta({ id })` names the component so the emitted OpenAPI references it as
+ * `#/components/schemas/<id>` rather than inlining it.
+ */
+import { z } from "zod";
+/**
+ * The approval-rule shape a catalog entry carries as its `default_approval_policy`.
+ *
+ * Defined inline (not imported from `./mcp`) to keep this module independent of
+ * the parallel mcp authoring. It mirrors the canonical mcp `ApprovalRule`:
+ * a tool-name `match` glob and an optional `require` mode.
+ */
+const ApprovalRule = z.object({
+    match: z.string(),
+    require: z.string().optional(),
+});
+/** How a catalog integration authenticates; surfaced flattened on the wire. */
+const CatalogAuth = z.object({
+    kind: z.string(),
+    provider: z.string().nullable(),
+    client_mode: z.string(),
+});
+export const CatalogEntryOut = z
+    .object({
+    slug: z.string(),
+    display_name: z.string(),
+    description: z.string(),
+    mcp_url: z.string(),
+    auth: CatalogAuth,
+    scopes: z.array(z.string()),
+    /** null = expose all discovered tools; otherwise the default-deny set. */
+    default_allowlist: z.array(z.string()).nullable(),
+    default_approval_policy: z.array(ApprovalRule),
+    logo_url: z.string().nullable(),
+    docs_url: z.string().nullable(),
+})
+    .meta({ id: "CatalogEntryOut" });
+export const CatalogListOut = z
+    .object({ data: z.array(CatalogEntryOut) })
+    .meta({ id: "CatalogListOut" });

package/dist/zod/connections.js

@@ -0,0 +1,75 @@
+/**
+ * Hand-authored Zod schemas for the `connections` resource — per-smith OAuth
+ * grants under `/v1/smiths/:pid/connections`. The wire's source of truth,
+ * replacing the loose generated shapes for this resource.
+ *
+ * One source, three outputs: the API imports these into its `createRoute`
+ * definitions (validation + emitted OpenAPI), and the consumer-facing `IC*`
+ * types are `z.infer`red from them here and re-exported by `../responses`. No
+ * Zod is pulled into a type-only consumer — `responses.ts` re-exports these as
+ * `export type`.
+ *
+ * SECURITY INVARIANT: `ConnectionOut` NEVER carries the secret credential
+ * material — only `id`, `provider`, `scopes`, `status`, `expires_at`,
+ * `metadata`, `created_at`. The handler's `toPublic` serializer is validated
+ * against this schema.
+ *
+ * `.meta({ id })` names the component so the emitted OpenAPI references it as
+ * `#/components/schemas/<id>` rather than inlining it.
+ */
+import { z } from "zod";
+/** OAuth token material the tenant pushes in; IC stores it encrypted and never
+ *  echoes it back. Only `kind: "oauth_tokens"` is accepted. */
+export const Credential = z
+    .object({
+    kind: z.string().optional(),
+    access_token: z.string().nullish(),
+    refresh_token: z.string().nullish(),
+    expires_at: z.string().nullish(),
+    token_uri: z.string().nullish(),
+})
+    .meta({ id: "Credential" });
+/** A connection WITHOUT the secret credential material. */
+export const ConnectionOut = z
+    .object({
+    id: z.string(),
+    provider: z.string(),
+    scopes: z.array(z.string()),
+    status: z.string(),
+    expires_at: z.string().nullable(),
+    metadata: z.record(z.string(), z.unknown()).optional(),
+    created_at: z.string().nullable(),
+})
+    .meta({ id: "ConnectionOut" });
+export const ConnectionListOut = z
+    .object({ data: z.array(ConnectionOut) })
+    .meta({ id: "ConnectionListOut" });
+// ── Request bodies ──────────────────────────────────────────────────────────
+export const ConnectionIn = z
+    .object({
+    provider: z.string(),
+    scopes: z.array(z.string()).optional(),
+    credential: Credential,
+    metadata: z.record(z.string(), z.unknown()).optional(),
+})
+    .meta({ id: "ConnectionIn" });
+export const ConnectionPatch = z
+    .object({
+    scopes: z.array(z.string()).nullish(),
+    credential: Credential.nullish(),
+    status: z.string().nullish(),
+    metadata: z.record(z.string(), z.unknown()).nullish(),
+})
+    .meta({ id: "ConnectionPatch" });
+/** The `authorize` 200 body: the minted authorize URL + echoed provider. */
+export const AuthorizeOut = z
+    .object({ authorize_url: z.string().nullable(), provider: z.string() })
+    .meta({ id: "AuthorizeOut" });
+/** Body for the OAuth consent broker: `POST …/connections/authorize`. */
+export const AuthorizeIn = z
+    .object({
+    provider: z.string(),
+    return_url: z.string().nullish(),
+    mcp_server: z.string().nullish(),
+})
+    .meta({ id: "AuthorizeIn" });

package/dist/zod/conversations.js

@@ -0,0 +1,91 @@
+/**
+ * Hand-authored Zod schemas for the `conversations` resource — the wire's source
+ * of truth, mapped onto the OpenAI **Conversations API** so an OpenAI client
+ * library talks to it unchanged.
+ *
+ * One source, three outputs: the API imports these into its `createRoute`
+ * definitions (validation + emitted OpenAPI), and the consumer-facing `IC*`
+ * types are `z.infer`red here and re-exported by `../responses`.
+ *
+ * Standards mapping: the object matches OpenAI's `conversation`
+ * (`id`/`object`/`created_at`/`metadata`); `title`, `smith_id`, and `updated_at`
+ * are documented IC extensions OpenAI omits (OpenAI has no title and no list
+ * endpoint, both of which a console conversation list needs). `created_at`/
+ * `updated_at` are unix-second integers like every OpenAI object, not the ISO
+ * strings the native `ic_*` resources use. Items are read-only and reconstructed
+ * from the conversation's runs — they accrue from `/v1/responses`, not a write
+ * endpoint.
+ */
+import { z } from "zod";
+import { pageOut } from "./_page.js";
+/** A conversation — the OpenAI Conversations object + IC extensions. */
+export const ConversationOut = z
+    .object({
+    id: z.string(),
+    object: z.literal("conversation"),
+    /** Unix seconds, like every OpenAI object. */
+    created_at: z.number().int(),
+    /** Unix seconds of the last run in the conversation (IC extension). */
+    updated_at: z.number().int(),
+    /** Auto-set from the first user turn of a Responses-API run that names this
+     *  conversation; null until then. Set it yourself any time. IC extension. */
+    title: z.string().nullable(),
+    /** The smith that owns this conversation. IC extension. */
+    smith_id: z.string(),
+    metadata: z.record(z.string(), z.unknown()),
+})
+    .meta({ id: "ConversationOut" });
+export const ConversationListOut = pageOut(ConversationOut, "ConversationListOut");
+/** The delete acknowledgement, in OpenAI's `*.deleted` shape. */
+export const ConversationDeleted = z
+    .object({
+    id: z.string(),
+    object: z.literal("conversation.deleted"),
+    deleted: z.literal(true),
+})
+    .meta({ id: "ConversationDeleted" });
+/** One reconstructed item in a conversation. Modelled loosely on the Responses
+ *  output items: a `message` carries `content` parts (`input_text`/`output_text`);
+ *  the tool-step items mirror their wire shapes — `function_call`
+ *  (`call_id`/`name`/`arguments`) and `function_call_output` (`call_id`/`output`) for
+ *  client-side tools, `mcp_call` (`name`/`arguments`/`output`/`server_label`) for a
+ *  tool the run loop executed server-side. */
+export const ConversationItem = z
+    .object({
+    id: z.string(),
+    type: z.string(),
+    role: z.string().optional(),
+    status: z.string().optional(),
+    content: z.array(z.record(z.string(), z.unknown())).optional(),
+    // Tool-step fields (present on function_call / function_call_output / mcp_call).
+    call_id: z.string().optional(),
+    name: z.string().optional(),
+    arguments: z.string().optional(),
+    output: z.string().optional(),
+    server_label: z.string().optional(),
+})
+    .meta({ id: "ConversationItem" });
+/** A conversation's items, in OpenAI's `list` envelope (not the IC cursor page). */
+export const ConversationItemListOut = z
+    .object({
+    object: z.literal("list"),
+    data: z.array(ConversationItem),
+    first_id: z.string().nullable(),
+    last_id: z.string().nullable(),
+    has_more: z.boolean(),
+})
+    .meta({ id: "ConversationItemListOut" });
+/** Create body — OpenAI accepts `metadata`; `title` is the IC extension. */
+export const ConversationCreate = z
+    .object({
+    title: z.string().optional(),
+    metadata: z.record(z.string(), z.unknown()).optional(),
+})
+    .meta({ id: "ConversationCreate" });
+/** Update body — set the title and/or merge metadata. */
+export const ConversationUpdate = z
+    .object({
+    title: z.string().optional(),
+    metadata: z.record(z.string(), z.unknown()).optional(),
+})
+    .meta({ id: "ConversationUpdate" });

package/dist/zod/customers.js

@@ -0,0 +1,53 @@
+/**
+ * Hand-authored Zod schemas for the `customers` resource — the wire's source of
+ * truth, replacing the loose generated shapes for this resource.
+ *
+ * One source, three outputs: the API imports these into its `createRoute`
+ * definitions (validation + emitted OpenAPI), and the consumer-facing `IC*`
+ * types are `z.infer`red from them here and re-exported by `../responses`. No
+ * Zod is pulled into a type-only consumer — `responses.ts` re-exports these as
+ * `export type`.
+ *
+ * A customer is the *tenant's* billable party for its smiths (never ours); many
+ * smiths roll up to one customer, so `smith_count` is a correlated count.
+ *
+ * `.meta({ id })` names the component so the emitted OpenAPI references it as
+ * `#/components/schemas/<id>` rather than inlining it.
+ */
+import { z } from "zod";
+export const CustomerOut = z
+    .object({
+    id: z.string(),
+    name: z.string(),
+    /** Opaque external system → id map (e.g. CRM/billing keys). */
+    external_ids: z.record(z.string(), z.string()),
+    /** Free-form tenant annotations. */
+    metadata: z.record(z.string(), z.unknown()),
+    /** Active smiths rolling up to this customer; present on single-customer reads. */
+    smith_count: z.number().int().optional(),
+    created_at: z.string().nullable(),
+})
+    .meta({ id: "CustomerOut" });
+/** Paginated list envelope: keyset cursor over `created_at, id` (desc). */
+export const CustomerListOut = z
+    .object({
+    data: z.array(CustomerOut),
+    next_cursor: z.string().nullable(),
+    has_more: z.boolean(),
+})
+    .meta({ id: "CustomerListOut" });
+// ── Request bodies ──────────────────────────────────────────────────────────
+export const CustomerCreate = z
+    .object({
+    name: z.string(),
+    external_ids: z.record(z.string(), z.string()).optional(),
+    metadata: z.record(z.string(), z.unknown()).optional(),
+})
+    .meta({ id: "CustomerCreate" });
+export const CustomerPatch = z
+    .object({
+    name: z.string().nullish(),
+    external_ids: z.record(z.string(), z.string()).nullish(),
+    metadata: z.record(z.string(), z.unknown()).nullish(),
+})
+    .meta({ id: "CustomerPatch" });

package/dist/zod/deployments.js

@@ -0,0 +1,81 @@
+/**
+ * Hand-authored Zod schemas for the `deployments` resource — messaging endpoints
+ * attached to a smith (Telegram/WhatsApp/Slack/SMS/voice/email).
+ *
+ * One source, three outputs: the API imports these into its `createRoute`
+ * definitions (validation + emitted OpenAPI), and the consumer-facing `IC*`
+ * types are `z.infer`red from them here and re-exported by `../responses`. No
+ * Zod is pulled into a type-only consumer — `responses.ts` re-exports these as
+ * `export type`.
+ *
+ * `.meta({ id })` names the component so the emitted OpenAPI references it as
+ * `#/components/schemas/<id>` rather than inlining it.
+ *
+ * Two response shapes on purpose: `DeploymentOut` is the plain serializer
+ * (`api/src/runtime/deployments.ts::publicDeployment`) returned by GET/list, PATCH,
+ * and the email `provision` create. `DeploymentCreatedOut` is the richer create
+ * response — the deferred-setup gateways (telegram/whatsapp `start_token`,
+ * slack `provision`/`oauth_install`) hand back binding affordances on top of
+ * the base shape (`start_token` + `deep_link`, slack's `install_url`/`state`,
+ * …). The relic `DeploymentOut` did NOT document these create-only fields; the
+ * handler is the truth, so they live here as optionals.
+ */
+import { z } from "zod";
+import { pageOut } from "./_page.js";
+/** A deployment's target: a fixed `smith` (one running clone) or an `agent`
+ *  catch-all that mints a fresh smith per inbound sender. */
+export const DeploymentTarget = z
+    .object({ type: z.enum(["smith", "agent"]), id: z.string() })
+    .meta({ id: "DeploymentTarget" });
+export const DeploymentOut = z
+    .object({
+    id: z.string(),
+    target: DeploymentTarget,
+    kind: z.string(),
+    address: z.string().nullable(),
+    provider: z.string().nullable(),
+    provider_metadata: z.record(z.string(), z.unknown()).optional(),
+    /** Names of the encrypted secret fields that are set (values never returned). */
+    secret_keys: z.array(z.string()).optional(),
+    status: z.string(),
+    created_at: z.string().nullable(),
+})
+    .meta({ id: "DeploymentOut" });
+export const DeploymentListOut = pageOut(DeploymentOut, "DeploymentListOut");
+/**
+ * The richer create response. Beyond the base `DeploymentOut`, the setup gateways
+ * attach provider-specific binding affordances:
+ * - telegram `start_token`: `start_token`, `deep_link` (t.me link).
+ * - whatsapp `start_token`: `start_token`, `prefilled_message`, `deep_link` (wa.me link).
+ * - slack `provision`/`oauth_install`: `install_url`, `state`, optional `slack_app_id`.
+ * - email `provision`: no extras (plain `DeploymentOut`).
+ * All are optional — which appear depends on the kind + setup mode.
+ */
+export const DeploymentCreatedOut = DeploymentOut.extend({
+    start_token: z.string().optional(),
+    deep_link: z.string().optional(),
+    prefilled_message: z.string().optional(),
+    install_url: z.string().optional(),
+    state: z.string().optional(),
+    slack_app_id: z.string().optional(),
+}).meta({ id: "DeploymentCreatedOut" });
+// ── Request bodies ──────────────────────────────────────────────────────────
+export const DeploymentIn = z
+    .object({
+    /** Who the deployment binds: a `smith` (fixed) or an `agent` (mints a smith
+     *  per inbound sender). A smith token may only target its own smith. */
+    target: DeploymentTarget,
+    kind: z.string(),
+    address: z.string().nullish(),
+    provider: z.string().nullish(),
+    provider_metadata: z.record(z.string(), z.unknown()).optional(),
+    secrets: z.record(z.string(), z.unknown()).optional(),
+    setup: z.record(z.string(), z.unknown()).nullish(),
+})
+    .meta({ id: "DeploymentIn" });
+export const DeploymentPatch = z
+    .object({
+    display_name: z.string().nullish(),
+    owner_email: z.string().nullish(),
+})
+    .meta({ id: "DeploymentPatch" });