@vertesia/common 1.5.0-dev.20260722.120446Z → 1.5.0-dev.20260804.124748Z

package/src/secrets.ts

@@ -1,129 +1,50 @@
+import type { z } from 'zod';
 import type {
-    WebsiteCredentialMetadata,
-    WebsiteCredentialRecord,
-    WebsiteCredentialSecretInput,
-} from './browser-credentials.js';
-import type { EventCategory } from './platform-event.js';
+    CreateSecretRequestSchema,
+    EventIngestSigningSecretRequestSchema,
+    EventIngestSigningSecretResponseSchema,
+    EventWebhookSigningSecretRequestSchema,
+    EventWebhookSigningSecretResponseSchema,
+    GithubInstallationTokenRequestSchema,
+    GithubInstallationTokenResponseSchema,
+    ListSecretsQuerySchema,
+    ListSecretsResponseSchema,
+    SecretKindSchema,
+    SecretLookupQuerySchema,
+    SecretProjectQuerySchema,
+    SecretRecordSchema,
+    SignEventWebhookRequestSchema,
+    SignEventWebhookResponseSchema,
+    UpdateSecretRequestSchema,
+    VerifyEventIngestSignatureRequestSchema,
+    VerifyEventIngestSignatureResponseSchema,
+} from './api-schemas/secrets.js';
 
 // First supported top-level secret kind. OAuth connector grants continue to use
 // the OAuth/MCP token flows and can be materialized later by tools that need them.
-export type SecretKind = 'website_credential';
+export type SecretKind = z.infer<typeof SecretKindSchema>;
 
-export interface SecretProjectQuery {
-    /**
-     * Project scope for top-level secret APIs. Must match the authenticated project context.
-     */
-    project_id?: string;
-}
+export type SecretProjectQuery = z.infer<typeof SecretProjectQuerySchema>;
 
-export interface ListSecretsQuery extends SecretProjectQuery {
-    kind?: SecretKind;
-    host?: string;
-    enabled?: boolean;
-}
+export type ListSecretsQuery = z.infer<typeof ListSecretsQuerySchema>;
 
-export interface SecretLookupQuery extends SecretProjectQuery {
-    kind?: SecretKind;
-}
+export type SecretLookupQuery = z.infer<typeof SecretLookupQuerySchema>;
 
-export interface SecretRecord {
-    id: string;
-    secret_ref: string;
-    kind: SecretKind;
-    project: string;
-    name: string;
-    enabled?: boolean;
-    tags?: string[];
-    properties?: Record<string, unknown>;
-    created_at?: string;
-    updated_at?: string;
-    details?: WebsiteCredentialRecord;
-}
+export type SecretRecord = z.infer<typeof SecretRecordSchema>;
 
-export interface ListSecretsResponse {
-    secrets: SecretRecord[];
-}
+export type ListSecretsResponse = z.infer<typeof ListSecretsResponseSchema>;
 
-export interface CreateSecretRequest {
-    kind: SecretKind;
-    metadata: WebsiteCredentialMetadata;
-    secret?: WebsiteCredentialSecretInput;
-}
+export type CreateSecretRequest = z.infer<typeof CreateSecretRequestSchema>;
 
-export interface UpdateSecretRequest {
-    kind?: SecretKind;
-    metadata?: Partial<WebsiteCredentialMetadata>;
-    secret?: WebsiteCredentialSecretInput;
-    clear_username_secret?: boolean;
-    clear_password?: boolean;
-    clear_totp?: boolean;
-    clear_oauth?: boolean;
-}
+export type UpdateSecretRequest = z.infer<typeof UpdateSecretRequestSchema>;
 
-export interface EventWebhookSigningSecretRequest {
-    account_id?: string;
-    project_id: string;
-}
-
-export interface EventWebhookSigningSecretResponse {
-    subscription_id: string;
-    secret: string;
-    secret_label: string;
-}
-
-export interface SignEventWebhookRequest extends EventWebhookSigningSecretRequest {
-    delivery_id: string;
-    body: string;
-    event_id: string;
-    event_category: EventCategory;
-    action: string;
-    timestamp?: number;
-}
-
-export interface SignEventWebhookResponse {
-    headers: Record<string, string>;
-    timestamp: number;
-    signature: string;
-}
-
-export interface EventIngestSigningSecretRequest {
-    account_id?: string;
-    project_id: string;
-}
-
-export interface EventIngestSigningSecretResponse {
-    channel_id: string;
-    secret: string;
-    secret_label: string;
-}
-
-export interface VerifyEventIngestSignatureRequest extends EventIngestSigningSecretRequest {
-    /** Raw request body bytes (exactly as received) the sender signed. */
-    body: string;
-    /** Signature value from the request header. */
-    signature_header: string;
-    algorithm?: 'sha256' | 'sha1';
-    encoding?: 'hex' | 'base64';
-    /** Literal prefix to strip from the header value, e.g. `sha256=`. */
-    prefix?: string;
-}
-
-export interface VerifyEventIngestSignatureResponse {
-    valid: boolean;
-}
-
-export interface GithubInstallationTokenRequest {
-    account_id?: string;
-    project_id: string;
-    /** Numeric GitHub App installation id (from the trusted webhook payload, never agent-supplied). */
-    installation_id: string;
-    /** `owner/name` of the repo to scope the token to. Required — tokens are always repository-scoped. */
-    repo: string;
-}
-
-export interface GithubInstallationTokenResponse {
-    /** Short-lived, repository-scoped GitHub App installation token. */
-    token: string;
-    /** ISO-8601 expiry returned by GitHub, when available. */
-    expires_at?: string;
-}
+export type EventWebhookSigningSecretRequest = z.infer<typeof EventWebhookSigningSecretRequestSchema>;
+export type EventWebhookSigningSecretResponse = z.infer<typeof EventWebhookSigningSecretResponseSchema>;
+export type SignEventWebhookRequest = z.infer<typeof SignEventWebhookRequestSchema>;
+export type SignEventWebhookResponse = z.infer<typeof SignEventWebhookResponseSchema>;
+export type EventIngestSigningSecretRequest = z.infer<typeof EventIngestSigningSecretRequestSchema>;
+export type EventIngestSigningSecretResponse = z.infer<typeof EventIngestSigningSecretResponseSchema>;
+export type VerifyEventIngestSignatureRequest = z.infer<typeof VerifyEventIngestSignatureRequestSchema>;
+export type VerifyEventIngestSignatureResponse = z.infer<typeof VerifyEventIngestSignatureResponseSchema>;
+export type GithubInstallationTokenRequest = z.infer<typeof GithubInstallationTokenRequestSchema>;
+export type GithubInstallationTokenResponse = z.infer<typeof GithubInstallationTokenResponseSchema>;

package/src/store/agent-approval.ts

@@ -1,22 +1,17 @@
-import type { ToolResult } from '../interaction.js';
+import type { z } from 'zod';
+import type {
+    AgentToolApprovalModeSchema,
+    PendingToolApprovalResultsSchema,
+    ToolApprovalGrantSchema,
+} from '../api-schemas/interaction.js';
 
 export const AgentToolApprovalModes = ['ask', 'auto_review', 'full_control'] as const;
 
-export type AgentToolApprovalMode = (typeof AgentToolApprovalModes)[number];
+export type AgentToolApprovalMode = z.infer<typeof AgentToolApprovalModeSchema>;
 
-export interface ToolApprovalGrant {
-    key: string;
-    tool_name: string;
-    target?: string;
-    granted_at: string;
-}
+export type ToolApprovalGrant = z.infer<typeof ToolApprovalGrantSchema>;
 
-export interface PendingToolApprovalResults {
-    results: ToolResult[];
-    reason: 'denied' | 'denied_with_feedback' | 'timeout' | 'reviewer_denied';
-    message: string;
-    created_at: string;
-}
+export type PendingToolApprovalResults = z.infer<typeof PendingToolApprovalResultsSchema>;
 
 export function normalizeAgentToolApprovalMode(
     mode: AgentToolApprovalMode | undefined,