@vertesia/common 1.5.0-dev.20260807.073259Z → 1.5.0-dev.20260901.005903Z

package/src/api-schemas/oauth.contract.test.ts

@@ -1,5 +1,10 @@
 import { describe, expect, it } from 'vitest';
-import { OAuthGrantStatusSchema } from './oauth-server.js';
+import {
+    OAuthAuthorizationServerMetadataSchema,
+    OAuthDeviceAuthorizationResponseSchema,
+    OAuthGrantStatusSchema,
+    OAuthTokenResponseSchema,
+} from './oauth-server.js';
 import { ApiSchemaComponents, validateApiRequest, validateApiResponse } from './registry.js';
 
 /**
@@ -101,6 +106,64 @@ describe('UpdateOAuthProviderPayload', () => {
     });
 });
 
+describe('OAuth protocol response parsing', () => {
+    it('parses complete authorization-server metadata and ignores registered extensions', () => {
+        const result = OAuthAuthorizationServerMetadataSchema.safeParse({
+            issuer: 'https://sts.example.com',
+            authorization_endpoint: 'https://cloud.example.com/oauth/authorize',
+            token_endpoint: 'https://sts.example.com/oauth/token',
+            jwks_uri: 'https://sts.example.com/.well-known/jwks.json',
+            response_types_supported: ['code'],
+            grant_types_supported: ['authorization_code'],
+            code_challenge_methods_supported: ['S256'],
+            token_endpoint_auth_methods_supported: ['none'],
+            scopes_supported: ['openid'],
+            extension_parameter: 'ignored',
+        });
+
+        expect(result.success).toBe(true);
+        if (result.success) {
+            expect(result.data).not.toHaveProperty('extension_parameter');
+        }
+    });
+
+    it('rejects incomplete device and token responses', () => {
+        expect(OAuthDeviceAuthorizationResponseSchema.safeParse({ device_code: 'device' }).success).toBe(false);
+        expect(
+            OAuthTokenResponseSchema.safeParse({
+                access_token: 'token',
+                token_type: 'Basic',
+                expires_in: 3600,
+            }).success,
+        ).toBe(false);
+    });
+
+    it('accepts RFC 6749 token responses with an omitted scope and case-insensitive bearer type', () => {
+        expect(
+            OAuthTokenResponseSchema.safeParse({
+                access_token: 'token',
+                token_type: 'bearer',
+                expires_in: 3600,
+            }).success,
+        ).toBe(true);
+    });
+
+    it('accepts OAuth token response extensions without widening the inferred contract', () => {
+        const result = OAuthTokenResponseSchema.safeParse({
+            access_token: 'token',
+            token_type: 'Bearer',
+            expires_in: 3600,
+            scope: 'openid',
+            extension_parameter: true,
+        });
+
+        expect(result.success).toBe(true);
+        if (result.success) {
+            expect(result.data).not.toHaveProperty('extension_parameter');
+        }
+    });
+});
+
 /**
  * A component's `status` enum, as the registry emits it.
  *

package/src/api-schemas/process.ts

@@ -1,10 +1,12 @@
 // Runtime schemas for the process API domain.
 
-import { JSONSchemaSchema } from '@llumiverse/common/schemas';
+import { JSONObjectSchema, JSONSchemaSchema } from '@llumiverse/common/schemas';
 import type { StringValue } from 'ms';
 import { z } from 'zod';
+import { PermissionSchema } from './access-control.js';
 import { StringValueMapSchema } from './files.js';
 import { ConversationVisibilitySchema, RunSourceSchema } from './interaction.js';
+import { EditRevisionSchema, ExpectedEditRevisionSchema } from './schema-primitives.js';
 import { TaskFieldSchema } from './task.js';
 
 export const DurationValueSchema = z
@@ -227,6 +229,7 @@ export const ProcessHistoryResponseSchema = z
     .strictObject({
         run_id: z.string(),
         current_node: z.string(),
+        node_history: z.array(NodeHistoryEntrySchema),
         node_history_ref: z
             .strictObject({
                 path: z.string(),
@@ -241,6 +244,7 @@ export const ProcessContextResponseSchema = z
     .strictObject({
         run_id: z.string(),
         current_node: z.string(),
+        context: JSONObjectSchema,
     })
     .meta({ id: 'ProcessContextResponse' });
 
@@ -567,8 +571,16 @@ export const CreateProcessDefinitionPayloadSchema: z.ZodType = z
 
 export const DSLChildWorkflowStepSchema: z.ZodType = z
     .strictObject({
-        type: z.literal('workflow').meta({ description: 'The type fo the step. If not set defaults to "activity"' }),
+        type: z.literal('workflow').meta({ description: 'Identifies this step as a child workflow' }),
         name: z.string(),
+        title: z
+            .string()
+            .meta({ description: 'Title of the child workflow to be displayed in the UI workflow builder' })
+            .optional(),
+        description: z
+            .string()
+            .meta({ description: 'Description of the child workflow displayed in the UI workflow builder' })
+            .optional(),
         vars: z
             .looseObject({})
             .meta({
@@ -627,6 +639,7 @@ export const DSLWorkflowDefinitionSchema: z.ZodType = z
         result: z.string().optional(),
         debug_mode: z.boolean().optional(),
         id: z.string().meta({ description: 'Unique identifier for the object' }),
+        edit_revision: EditRevisionSchema,
         updated_by: z.string().meta({ description: 'Identifier of the user who last modified the object' }),
         created_by: z.string().meta({ description: 'Identifier of the user who created the object' }),
         created_at: z.string().meta({ description: 'ISO timestamp of when the object was created' }),
@@ -647,6 +660,7 @@ export const DSLWorkflowDefinitionResponseSchema: z.ZodType = z
         result: z.string().optional(),
         debug_mode: z.boolean().optional(),
         id: z.string().meta({ description: 'Unique identifier for the object' }),
+        edit_revision: EditRevisionSchema,
         updated_by: z.string().meta({ description: 'Identifier of the user who last modified the object' }),
         created_by: z.string().meta({ description: 'Identifier of the user who created the object' }),
         created_at: z.string().meta({ description: 'ISO timestamp of when the object was created' }),
@@ -755,6 +769,33 @@ export const WorkflowDefinitionPayloadSchema: z.ZodType = z
     ])
     .meta({ id: 'WorkflowDefinitionPayload' });
 
+export const UpdateWorkflowDefinitionPayloadWithActivitiesSchema: z.ZodType = z
+    .strictObject({
+        ...dslWorkflowSpecBaseFields,
+        expected_edit_revision: ExpectedEditRevisionSchema,
+        steps: z.array(z.lazy(() => DSLWorkflowStepSchema)).optional(),
+        activities: z.array(DSLActivitySpecSchema).meta(deprecatedActivitiesMeta),
+        spec_format: z.literal('activities'),
+    })
+    .meta({ id: 'UpdateWorkflowDefinitionPayloadWithActivities' });
+
+export const UpdateWorkflowDefinitionPayloadWithStepsSchema: z.ZodType = z
+    .strictObject({
+        ...dslWorkflowSpecBaseFields,
+        expected_edit_revision: ExpectedEditRevisionSchema,
+        steps: z.array(z.lazy(() => DSLWorkflowStepSchema)),
+        activities: z.array(DSLActivitySpecSchema).meta(deprecatedActivitiesMeta).optional(),
+        spec_format: z.literal('steps'),
+    })
+    .meta({ id: 'UpdateWorkflowDefinitionPayloadWithSteps' });
+
+export const UpdateWorkflowDefinitionPayloadSchema: z.ZodType = z
+    .discriminatedUnion('spec_format', [
+        UpdateWorkflowDefinitionPayloadWithStepsSchema as unknown as z.ZodObject,
+        UpdateWorkflowDefinitionPayloadWithActivitiesSchema as unknown as z.ZodObject,
+    ])
+    .meta({ id: 'UpdateWorkflowDefinitionPayload' });
+
 export const DSLWorkflowStepSchema: z.ZodType = z
     .discriminatedUnion('type', [
         DSLActivityStepSchema,
@@ -840,6 +881,7 @@ export const NodeDefinitionMapSchema: z.ZodType = z
 export const ProcessDefinitionSchema: z.ZodType = z
     .strictObject({
         id: z.string(),
+        edit_revision: EditRevisionSchema,
         account: z.string(),
         project: z.string(),
         name: z.string(),
@@ -876,6 +918,7 @@ export const ProcessDefinitionBodySchema: z.ZodType = z
 
 export const UpdateProcessDefinitionPayloadSchema: z.ZodType = z
     .strictObject({
+        expected_edit_revision: ExpectedEditRevisionSchema,
         name: z.string().optional(),
         description: z.string().optional(),
         status: ProcessDefinitionStatusSchema.meta({
@@ -927,3 +970,310 @@ export const RecordProcessRunPayloadSchema = z
         started_by: z.string().optional(),
     })
     .meta({ id: 'RecordProcessRunPayload' });
+
+export const ProcessTestRunStatusSchema = z
+    .enum(['pending', 'running', 'passed', 'failed', 'cancelled'])
+    .meta({ id: 'ProcessTestRunStatus' });
+
+export const ProcessTestVirtualActorSchema = z
+    .strictObject({
+        id: z.string(),
+        label: z.string().optional(),
+        refs: z.array(z.string()),
+        permissions: z.array(PermissionSchema),
+    })
+    .meta({ id: 'ProcessTestVirtualActor' });
+
+export const ProcessTestFixtureResultSchema = z
+    .strictObject({
+        kind: z.literal('result'),
+        output: z.unknown().optional(),
+        context_update: JSONObjectSchema.optional(),
+        transition_to: z.string().optional(),
+        skip_node: z.boolean().optional(),
+    })
+    .meta({ id: 'ProcessTestFixtureResult' });
+
+export const ProcessTestFixtureErrorSchema = z
+    .strictObject({
+        kind: z.literal('error'),
+        message: z.string(),
+        retry: z.boolean(),
+    })
+    .meta({ id: 'ProcessTestFixtureError' });
+
+export const ProcessTestFixtureResponseSchema = z
+    .discriminatedUnion('kind', [ProcessTestFixtureResultSchema, ProcessTestFixtureErrorSchema])
+    .meta({ id: 'ProcessTestFixtureResponse' });
+
+export const ProcessTestNodeFixtureSchema = z
+    .strictObject({
+        node: z.string(),
+        workflow_path: z.array(z.string()).optional(),
+        responses: z.array(ProcessTestFixtureResponseSchema),
+        guard_facts: JSONObjectSchema.optional(),
+    })
+    .meta({ id: 'ProcessTestNodeFixture' });
+
+export const ProcessTestHumanActionSchema = z
+    .strictObject({
+        node: z.string(),
+        workflow_path: z.array(z.string()).optional(),
+        actor: z.string(),
+        result: JSONObjectSchema,
+        expect: z.enum(['accepted', 'forbidden']),
+    })
+    .meta({ id: 'ProcessTestHumanAction' });
+
+export const ProcessTestAssertionsSchema = z
+    .strictObject({
+        status: z.enum(['completed', 'failed', 'cancelled']).optional(),
+        path: z.array(z.string()).optional(),
+        required_nodes: z.array(z.string()).optional(),
+        forbidden_nodes: z.array(z.string()).optional(),
+        context: JSONObjectSchema.optional(),
+        fixture_calls: z.record(z.string(), z.number()).optional(),
+        context_at_nodes: z.record(z.string(), JSONObjectSchema).optional(),
+    })
+    .meta({ id: 'ProcessTestAssertions' });
+
+export const ProcessTestScenarioSchema = z
+    .strictObject({
+        id: z.string(),
+        name: z.string(),
+        description: z.string().optional(),
+        initial_context: JSONObjectSchema,
+        actors: z.array(ProcessTestVirtualActorSchema),
+        fixtures: z.array(ProcessTestNodeFixtureSchema),
+        human_actions: z.array(ProcessTestHumanActionSchema),
+        assertions: ProcessTestAssertionsSchema,
+        timeout_seconds: z.number().int().min(1).max(300).default(30),
+    })
+    .meta({ id: 'ProcessTestScenario' });
+
+export const ProcessTestSuiteSchema = z
+    .strictObject({
+        id: z.string(),
+        account: z.string(),
+        project: z.string(),
+        process_root_id: z.string(),
+        name: z.string(),
+        description: z.string().optional(),
+        scenarios: z.array(ProcessTestScenarioSchema),
+        created_by: z.string(),
+        updated_by: z.string(),
+        created_at: z.string().meta({ format: 'date-time' }),
+        updated_at: z.string().meta({ format: 'date-time' }),
+    })
+    .meta({ id: 'ProcessTestSuite' });
+
+export const ProcessTestSuiteArraySchema = z.array(ProcessTestSuiteSchema).meta({ id: 'ProcessTestSuiteArray' });
+
+export const CreateProcessTestSuitePayloadSchema = z
+    .strictObject({
+        name: z.string(),
+        description: z.string().optional(),
+        scenarios: z.array(ProcessTestScenarioSchema),
+    })
+    .meta({ id: 'CreateProcessTestSuitePayload' });
+
+export const UpdateProcessTestSuitePayloadSchema = CreateProcessTestSuitePayloadSchema.partial().meta({
+    id: 'UpdateProcessTestSuitePayload',
+});
+
+export const StartProcessTestRunPayloadSchema = z
+    .strictObject({
+        suite_id: z.string(),
+        process_revision_id: z.string(),
+        scenario_ids: z.array(z.string()).optional(),
+    })
+    .meta({ id: 'StartProcessTestRunPayload' });
+
+/**
+ * Identifies what a test run was executed against. Stored subjects carry the revision identity
+ * of a persisted process definition; resolved subjects name an in-code process served by an app
+ * package or built into the server; inline subjects carry no external identity at all — the
+ * definition snapshot recorded on the run is the whole subject.
+ */
+export const ProcessTestStoredSubjectSchema = z
+    .strictObject({
+        kind: z.literal('stored'),
+        process_root_id: z.string(),
+        process_revision_id: z.string(),
+    })
+    .meta({ id: 'ProcessTestStoredSubject' });
+
+export const ProcessTestResolvedSubjectSchema = z
+    .strictObject({
+        kind: z.literal('resolved'),
+        /** The in-code process id that was resolved, such as `app:acme:invoice-review`. */
+        process_id: z.string(),
+        /** App package version pinned for the run, when the process came from an app package. */
+        app_version: z.string().optional(),
+    })
+    .meta({ id: 'ProcessTestResolvedSubject' });
+
+export const ProcessTestInlineSubjectSchema = z
+    .strictObject({
+        kind: z.literal('inline'),
+    })
+    .meta({ id: 'ProcessTestInlineSubject' });
+
+export const ProcessTestSubjectSchema = z
+    .discriminatedUnion('kind', [
+        ProcessTestStoredSubjectSchema,
+        ProcessTestResolvedSubjectSchema,
+        ProcessTestInlineSubjectSchema,
+    ])
+    .meta({ id: 'ProcessTestSubject' });
+
+/**
+ * Tests an in-code process by id — `app:<app>:<process>` or a built-in `sys:` process.
+ * `app_version` pins the app package version for the whole run so it stays reproducible, and only
+ * applies to an `app:` id.
+ */
+export const ProcessTestTargetByIdSchema = z
+    .strictObject({
+        id: z.string(),
+        app_version: z.string().optional(),
+    })
+    .meta({ id: 'ProcessTestTargetById' });
+
+/** Tests an ephemeral definition body that is not stored or served by an app. */
+export const ProcessTestTargetWithDefinitionSchema = z
+    .strictObject({
+        definition: ProcessDefinitionBodySchema,
+    })
+    .meta({ id: 'ProcessTestTargetWithDefinition' });
+
+/**
+ * What to test: exactly one of an in-code process id or an inline definition body. Modelled as a
+ * union rather than an object of optional properties so the published contract rejects an empty
+ * target, a target carrying both, and `app_version` on an inline definition.
+ */
+export const ProcessTestTargetSchema = z
+    .union([ProcessTestTargetByIdSchema, ProcessTestTargetWithDefinitionSchema])
+    .meta({ id: 'ProcessTestTarget' });
+
+export const SubmitProcessTestRunPayloadSchema = z
+    .strictObject({
+        process: ProcessTestTargetSchema,
+        scenarios: z.array(ProcessTestScenarioSchema).min(1),
+    })
+    .meta({ id: 'SubmitProcessTestRunPayload' });
+
+export const ProcessTestAssertionResultSchema = z
+    .strictObject({
+        assertion: z.string(),
+        passed: z.boolean(),
+        expected: z.unknown().optional(),
+        actual: z.unknown().optional(),
+        message: z.string().optional(),
+    })
+    .meta({ id: 'ProcessTestAssertionResult' });
+
+export const ProcessTestActorDecisionSchema = z
+    .strictObject({
+        node: z.string(),
+        actor: z.string(),
+        decision: z.enum(['accepted', 'forbidden']),
+        message: z.string().optional(),
+    })
+    .meta({ id: 'ProcessTestActorDecision' });
+
+export const ProcessTestCoverageSchema = z
+    .strictObject({
+        nodes: z.array(z.string()),
+        transitions: z.array(z.string()),
+        node_percent: z.number(),
+        transition_percent: z.number(),
+    })
+    .meta({ id: 'ProcessTestCoverage' });
+
+export const ProcessTestChildTraceSchema = z
+    .strictObject({
+        workflow_path: z.array(z.string()),
+        status: ProcessTestRunStatusSchema,
+        error: z.string().optional(),
+        process_state: ProcessStateSchema.optional(),
+        node_history: z.array(NodeHistoryEntrySchema),
+        coverage: ProcessTestCoverageSchema,
+        fixture_calls: z.record(z.string(), z.number()),
+        actor_decisions: z.array(ProcessTestActorDecisionSchema),
+    })
+    .meta({ id: 'ProcessTestChildTrace' });
+
+export const ProcessTestScenarioResultSchema = z
+    .strictObject({
+        scenario_id: z.string(),
+        name: z.string(),
+        /** Immutable scenario input captured when the run is created. Absent on legacy run documents. */
+        initial_context: JSONObjectSchema.optional(),
+        status: ProcessTestRunStatusSchema,
+        error: z.string().optional(),
+        process_state: ProcessStateSchema.optional(),
+        node_history: z.array(NodeHistoryEntrySchema),
+        assertions: z.array(ProcessTestAssertionResultSchema),
+        fixture_calls: z.record(z.string(), z.number()),
+        actor_decisions: z.array(ProcessTestActorDecisionSchema),
+        coverage: ProcessTestCoverageSchema,
+        child_traces: z.array(ProcessTestChildTraceSchema),
+        started_at: z.string().meta({ format: 'date-time' }),
+        completed_at: z.string().meta({ format: 'date-time' }).optional(),
+    })
+    .meta({ id: 'ProcessTestScenarioResult' });
+
+export const ProcessTestRunSchema = z
+    .strictObject({
+        id: z.string(),
+        account: z.string(),
+        project: z.string(),
+        subject: ProcessTestSubjectSchema,
+        /** Present only for `stored` subjects. */
+        process_root_id: z.string().optional(),
+        /** Present only for `stored` subjects. */
+        process_revision_id: z.string().optional(),
+        /** Present only for `stored` subjects — runs submitted directly carry their scenarios inline. */
+        suite_id: z.string().optional(),
+        definition_hash: z.string(),
+        status: ProcessTestRunStatusSchema,
+        /**
+         * Whether the tested definition still matches the current head revision. Always false for
+         * non-stored subjects, which have no later revision to drift from: for those,
+         * `definition_hash` and `subject.app_version` serve reproducibility instead.
+         */
+        stale: z.boolean(),
+        process_definition_snapshot: ProcessDefinitionBodySchema,
+        scenarios: z.array(ProcessTestScenarioResultSchema),
+        created_by: z.string(),
+        created_at: z.string().meta({ format: 'date-time' }),
+        started_at: z.string().meta({ format: 'date-time' }).optional(),
+        completed_at: z.string().meta({ format: 'date-time' }).optional(),
+    })
+    .meta({ id: 'ProcessTestRun' });
+
+export const ProcessTestRunArraySchema = z.array(ProcessTestRunSchema).meta({ id: 'ProcessTestRunArray' });
+
+export const ListProcessTestRunsQuerySchema = z
+    .strictObject({
+        limit: z.number().int().min(1).max(100).optional(),
+    })
+    .meta({ id: 'ListProcessTestRunsQuery' });
+
+export const UpdateProcessTestScenarioPayloadSchema = z
+    .strictObject({
+        checkpoint_token: z.string(),
+        scenario_id: z.string(),
+        workflow_path: z.array(z.string()),
+        status: ProcessTestRunStatusSchema,
+        error: z.string().optional(),
+        process_state: ProcessStateSchema.optional(),
+        node_history: z.array(NodeHistoryEntrySchema),
+        assertions: z.array(ProcessTestAssertionResultSchema),
+        fixture_calls: z.record(z.string(), z.number()),
+        actor_decisions: z.array(ProcessTestActorDecisionSchema),
+        coverage: ProcessTestCoverageSchema,
+        started_at: z.string().meta({ format: 'date-time' }),
+        completed_at: z.string().meta({ format: 'date-time' }).optional(),
+    })
+    .meta({ id: 'UpdateProcessTestScenarioPayload' });

package/src/api-schemas/project-configuration.ts

@@ -66,12 +66,14 @@ export const ProjectSearchTierSchema = z.enum(['standard', 'performance']).meta(
 
 export const ElasticsearchBackendSchema = z.enum(['serverless', 'hosted']).meta({ id: 'ElasticsearchBackend' });
 
-export const ProjectSearchPropertyTypeSchema = z.enum(['keyword', 'text', 'boolean', 'long', 'double', 'date']).meta({
-    id: 'ProjectSearchPropertyType',
-    description:
-        'Elasticsearch field types that may be explicitly assigned to content-object properties. Paths are ' +
-        "relative to the object's `properties` field.",
-});
+export const ProjectSearchPropertyTypeSchema = z
+    .enum(['keyword', 'text', 'boolean', 'long', 'double', 'date', 'geo_point'])
+    .meta({
+        id: 'ProjectSearchPropertyType',
+        description:
+            'Elasticsearch field types that may be explicitly assigned to content-object properties. Paths are ' +
+            "relative to the object's `properties` field.",
+    });
 
 export const ProjectSearchPropertyMappingSchema = z
     .object({
@@ -90,7 +92,7 @@ export const ProjectSearchPropertyMappingSchema = z
             .meta({
                 description:
                     'Skip malformed values instead of rejecting the whole document. Valid only for long, double, ' +
-                    'and date mappings.',
+                    'date, and geo_point mappings.',
             }),
     })
     .meta({
@@ -416,6 +418,8 @@ export const ProjectIntakeConfigurationSchema = z
  */
 export const ProjectConfigurationSchema = z
     .strictObject({
+        default_environment: z.string().optional(),
+        default_model: z.string().optional(),
         human_context: z.string().optional(),
         defaults: ProjectModelDefaultsSchema.optional(),
         default_visibility: ResourceVisibilitySchema.optional(),

package/src/api-schemas/project.contract.test.ts

@@ -13,12 +13,13 @@ import {
     type SerperConfigurationInput,
     SupportedIntegrations,
 } from '../integrations.js';
-import type {
-    ICreateProjectPayload,
-    ModelDefault,
-    Project,
-    ProjectPluginsUpdatePayload,
-    SystemDefaults,
+import {
+    type ICreateProjectPayload,
+    type ModelDefault,
+    type Project,
+    type ProjectPluginsUpdatePayload,
+    SYSTEM_INTERACTION_CATEGORIES,
+    type SystemDefaults,
     SystemInteractionCategory,
 } from '../project.js';
 import type { JsonObject } from './adapter.js';
@@ -70,6 +71,56 @@ describe('gate 1 — the schema is the single source of truth for the converted
         assertType<Equals<SerperConfigurationInput['integration'], SupportedIntegrations.serper>>(true);
         expect(true).toBe(true);
     });
+
+    it('accepts an AWS integration that is declared but not configured', () => {
+        // `getIntegrationConfig` reads `integrations?.[integrationId] ?? {}`, so a project that has
+        // never set up AWS answers with the discriminator and `enabled` alone. `s3_role_arn` was
+        // required, which made that answer fail its own response contract on every call.
+        expect(
+            validateApiResponse('ProjectIntegrationConfigResponse', {
+                integration: SupportedIntegrations.aws,
+                enabled: false,
+            }).valid,
+        ).toBe(true);
+        expect(
+            validateApiResponse('ProjectIntegrationConfigResponse', {
+                integration: SupportedIntegrations.aws,
+                enabled: true,
+                s3_role_arn: 'arn:aws:iam::123456789012:role/vertesia',
+            }).valid,
+        ).toBe(true);
+    });
+
+    it('accepts an ask_user_webhook integration that is declared but not configured', () => {
+        // Same defect as the AWS case above: `webhook_url` was required on the response, so an
+        // unconfigured project failed its own contract on every GET of this integration.
+        expect(
+            validateApiResponse('ProjectIntegrationConfigResponse', {
+                integration: SupportedIntegrations.ask_user_webhook,
+                enabled: false,
+                webhook_secret: null,
+            }).valid,
+        ).toBe(true);
+        expect(
+            validateApiResponse('ProjectIntegrationConfigResponse', {
+                integration: SupportedIntegrations.ask_user_webhook,
+                enabled: true,
+                webhook_url: 'https://example.test/hooks/ask-user',
+                webhook_secret: null,
+            }).valid,
+        ).toBe(true);
+    });
+
+    it('still requires webhook_url when the integration is being configured', () => {
+        // The request schema must not follow the response into optionality — you cannot set this
+        // integration up without a URL.
+        expect(
+            validateApiRequest('ProjectIntegrationConfigRequest', {
+                integration: SupportedIntegrations.ask_user_webhook,
+                enabled: true,
+            }).valid,
+        ).toBe(false);
+    });
 });
 
 /**
@@ -186,6 +237,11 @@ describe('gate 2 — the closure is closed, bottom-up', () => {
         expect(true).toBe(true);
     });
 
+    it('uses the analysis model default for both content query planning and reranking', () => {
+        expect(SYSTEM_INTERACTION_CATEGORIES.ContentSearchAgent).toBe(SystemInteractionCategory.analysis);
+        expect(SYSTEM_INTERACTION_CATEGORIES.ContentSearchReranker).toBe(SystemInteractionCategory.analysis);
+    });
+
     it('publishes the property-mapping map without the propertyNames z.record adds', () => {
         // `Record<string, ProjectSearchPropertyMapping>` is inline in the interface and has no
         // TypeScript name, so it never becomes a canonical alias — it stays canonical AND derived,
@@ -197,6 +253,10 @@ describe('gate 2 — the closure is closed, bottom-up', () => {
         });
     });
 
+    it('publishes geo_point as an explicit project property mapping type', () => {
+        expect(ApiSchemaComponents.ProjectSearchPropertyType.enum).toContain('geo_point');
+    });
+
     it('enforces the browser-use configuration the deleted AJV schema only described', () => {
         // A `JSONSchemaType<BrowserUseProjectConfiguration>` used to sit beside the interface with
         // descriptions that had already drifted from the TSDoc, and nothing compiled it. This is the
@@ -335,6 +395,23 @@ describe('gate 4 — AJV validates the same canonical objects that are published
 });
 
 describe('gate 5 — runtime enforcement uses the published components', () => {
+    it('accepts decrypted integration credentials only on the response contract', () => {
+        expect(
+            validateApiResponse('ProjectIntegrationConfigResponse', {
+                integration: SupportedIntegrations.exa,
+                enabled: true,
+                api_key: 'agent-runtime-secret',
+            }).valid,
+        ).toBe(true);
+        expect(
+            validateApiResponse('ProjectIntegrationConfigResponse', {
+                integration: SupportedIntegrations.ask_user_webhook,
+                enabled: true,
+                webhook_secret: 'agent-runtime-secret',
+            }).valid,
+        ).toBe(true);
+    });
+
     it('checks the shared count response the same way for every service that returns it', () => {
         // Four slots across three resources and two servers, so this component had to move as a unit.
         expect(validateApiResponse('CountResult', { count: 0 }).valid).toBe(true);