@vertesia/common 1.5.0-dev.20260807.073259Z → 1.5.0-dev.20260901.005903Z

package/src/api-schemas/registry.ts

@@ -29,10 +29,8 @@ import {
     TextResultSchema,
     ToolDefinitionSchema,
     ToolUseSchema,
+    VideoResultSchema,
 } from '@llumiverse/common/schemas';
-import type { ValidateFunction } from 'ajv/dist/2020.js';
-import { Ajv2020 } from 'ajv/dist/2020.js';
-import ajvFormats from 'ajv-formats';
 import { z } from 'zod';
 import type {
     CreateEventSubscriptionPayload,
@@ -80,7 +78,8 @@ import {
     SystemRoleDefinitionArraySchema,
 } from './access-control.js';
 import { AccountSchema, StripeBillingStatusResponseSchema, UpdateAccountPayloadSchema } from './account.js';
-import { findUnprunablePaths, isPlainObject, type JsonObject, pruneToSchema, toOpenApiComponents } from './adapter.js';
+import { type JsonObject, toOpenApiComponents } from './adapter.js';
+import * as AgentCommunicationSchemas from './agent-communication.js';
 import * as AgentRunSchemas from './agent-runs.js';
 import {
     AnalyticsAxisSchema,
@@ -126,6 +125,7 @@ import {
     AppInstallationProjectsQuerySchema,
     AppInstallationProviderBindingSchema,
     AppInstallationsQuerySchema,
+    AppListScopeSchema,
     AppOAuthCollectionParamsSchema,
     AppOAuthProviderParamsSchema,
     AppPackageScopeSchema,
@@ -140,6 +140,7 @@ import {
     AppScaffoldModuleSchema,
     AppScaffoldProgressSchema,
     AppScaffoldProgressStatusSchema,
+    AppsQuerySchema,
     AppToolCollectionArraySchema,
     AppToolCollectionSchema,
     AppVersionGitRefTypeSchema,
@@ -164,6 +165,7 @@ import {
     RunTypeSchema,
     StartAppBuildRequestSchema,
     StartAppBuildResponseSchema,
+    StartAppDevelopmentTaskRequestSchema,
     StartAppScaffoldRequestSchema,
     StartAppScaffoldResponseSchema,
     StoredTypeRefSchema,
@@ -231,6 +233,7 @@ import {
     RunMigrationResponseSchema,
 } from './commands.js';
 import * as ContentSchemas from './content.js';
+import * as ContentQuerySchemas from './content-query.js';
 import {
     CostAnalyticsQuerySchema,
     CostAnalyticsResponseSchema,
@@ -391,6 +394,8 @@ import {
 } from './environment.js';
 import * as EventSchemas from './events.js';
 import {
+    BucketCreateAccessQuerySchema,
+    BucketCreateAccessStatusResponseSchema,
     BucketReadAccessQuerySchema,
     BucketReadAccessStatusResponseSchema,
     BulkUploadUrlsPayloadSchema,
@@ -398,6 +403,8 @@ import {
     CopyFilePayloadSchema,
     CopyFileResponseSchema,
     DeleteFileResultSchema,
+    EnsureBucketCreateAccessPayloadSchema,
+    EnsureBucketCreateAccessResponseSchema,
     EnsureBucketReadAccessPayloadSchema,
     EnsureBucketReadAccessResponseSchema,
     FileBucketResponseSchema,
@@ -415,6 +422,7 @@ import {
 } from './files.js';
 import {
     CreateUserGroupPayloadSchema,
+    ListUserGroupsQuerySchema,
     UpdateUserGroupPayloadSchema,
     UserGroupArraySchema,
     UserGroupRefSchema,
@@ -451,6 +459,7 @@ import {
     ComputedFacetResponseSchema,
     ComputeInteractionFacetPayloadSchema,
     ComputeRunFacetPayloadSchema,
+    ComputeRunFacetsResponseSchema,
     ConversationStateSchema,
     ConversationStripOptionsSchema,
     ConversationVisibilitySchema,
@@ -469,6 +478,8 @@ import {
     ExternalizedToolInputRefSchema,
     ExternalizedToolInputRefsSchema,
     FacetSpecSchema,
+    FindRunResultArraySchema,
+    FindRunResultSchema,
     GeneratedInteractionDefinitionArraySchema,
     GeneratedInteractionDefinitionSchema,
     GeneratedInteractionPromptSegmentSchema,
@@ -479,6 +490,7 @@ import {
     GenerateTestDataPayloadSchema,
     ImprovePromptPayloadConfigSchema,
     ImprovePromptPayloadSchema,
+    InCodeInteractionSchema,
     InCodePromptSchema,
     InitialToolCallSchema,
     InteractionArraySchema,
@@ -492,6 +504,8 @@ import {
     InteractionForkPayloadSchema,
     InteractionNameArraySchema,
     InteractionNameSchema,
+    InteractionPromptSegmentInputSchema,
+    InteractionPromptTemplateInputSchema,
     InteractionPublishPayloadSchema,
     InteractionRefArraySchema,
     InteractionRefSchema,
@@ -530,6 +544,7 @@ import {
     PromptTemplateUpdatePayloadSchema,
     RateLimitRequestPayloadSchema,
     RateLimitRequestResponseSchema,
+    ResolvedCatalogInteractionSchema,
     ResolvedEnvironmentInfoSchema,
     ResolvedInteractionExecutionInfoSchema,
     ResolvedRuntimeConfigSchema,
@@ -585,15 +600,27 @@ import {
     UpdateOAuthProviderPayloadSchema,
 } from './oauth.js';
 import {
+    ApproveOAuthAuthorizationRequestPayloadSchema,
     BulkRevokeOAuthGrantsPayloadSchema,
+    CreateOAuthAuthorizationRequestPayloadSchema,
     CreateOAuthClientPayloadSchema,
     ListOAuthGrantsQuerySchema,
+    OAuthAuthorizationDecisionResponseSchema,
+    OAuthAuthorizationRequestSchema,
+    OAuthAuthorizationRequestStatusSchema,
+    OAuthAuthorizationServerMetadataSchema,
+    OAuthAuthorizeQuerySchema,
     OAuthClientArraySchema,
     OAuthClientCreateResponseSchema,
+    OAuthClientDisplayMetadataSchema,
+    OAuthClientRegistrationModeSchema,
     OAuthClientSchema,
     OAuthClientScopeMetadataSchema,
     OAuthClientStatusSchema,
     OAuthClientTypeSchema,
+    OAuthDeviceAuthorizationRequestSchema,
+    OAuthDeviceAuthorizationResponseSchema,
+    OAuthGrantableScopesResponseSchema,
     OAuthGrantListResponseSchema,
     OAuthGrantRevokeResponseSchema,
     OAuthGrantSchema,
@@ -605,15 +632,10 @@ import {
     OAuthRegistrationSourceSchema,
     OAuthResponseTypeSchema,
     OAuthTokenEndpointAuthMethodSchema,
+    OAuthTokenResponseSchema,
     RevokeOAuthGrantQuerySchema,
     UpdateOAuthClientPayloadSchema,
 } from './oauth-server.js';
-import {
-    type ApiParameterLocation,
-    type NormalizedApiParameters,
-    normalizeParameters,
-    type RawApiParameters,
-} from './parameters.js';
 import * as ProcessSchemas from './process.js';
 import {
     CountResultSchema,
@@ -667,6 +689,7 @@ import {
     ContentTypeIntakePolicySchema,
     CreateContentObjectTypePayloadSchema,
     InCodeTypeDefinitionSchema,
+    InteractionExecutionConfigurationSchema,
     UpdateContentObjectTypePayloadSchema,
 } from './store.js';
 import * as StsSchemas from './sts.js';
@@ -685,7 +708,12 @@ import {
 import {
     AggregatedToolArraySchema,
     AggregatedToolSchema,
+    InspectProjectToolQuerySchema,
     ListProjectToolsQuerySchema,
+    ProcessToolCompatibilityReasonSchema,
+    ProcessToolCompatibilitySchema,
+    ToolInspectionSchema,
+    ToolRuntimeContextSchema,
     ToolSourceSchema,
     ToolValidationResultSchema,
     ValidateToolNamesPayloadSchema,
@@ -703,15 +731,23 @@ import {
 } from './user.js';
 import * as ViewExecutionSchemas from './view-execution.js';
 import {
+    AgenticViewRerankConfigurationSchema,
     AgenticViewSearchConfigurationSchema,
     CreateViewExperienceRequestSchema,
     UpdateViewExperienceRequestSchema,
+    ViewActionConfigurationSchema,
+    ViewActionPlacementSchema,
+    ViewActionSelectionRequirementSchema,
+    ViewActionsConfigurationSchema,
+    ViewAgenticExecutionConfigurationSchema,
+    ViewAgenticSearchModeSchema,
     ViewBoardCardConfigurationSchema,
     ViewBoardColumnSchema,
     ViewBoardDisplaySchema,
     ViewCardsDisplaySchema,
     ViewCollectionNavigationSchema,
     ViewDisplayConfigurationSchema,
+    ViewDropConfigurationSchema,
     ViewElasticsearchQuerySchema,
     ViewExperienceArraySchema,
     ViewExperienceLayoutSchema,
@@ -735,19 +771,17 @@ import {
     ViewSearchConfigurationSchema,
     ViewSearchFieldDefinitionSchema,
     ViewSearchFieldTypeSchema,
+    ViewSelectionConfigurationSchema,
+    ViewSelectionModeSchema,
     ViewSortClauseSchema,
     ViewSortOptionSchema,
     ViewTableColumnSchema,
     ViewTableDisplaySchema,
     ViewTermsNavigationSchema,
+    ViewUploadDropParametersSchema,
 } from './views.js';
 import * as WorkflowRunSchemas from './workflow-runs.js';
 
-// ajv-formats is CommonJS with an ESM-style declaration file. Node's interop makes the default
-// import the whole `module.exports` (itself callable), while TypeScript sees the namespace — and
-// `.default` is the plugin function in both shapes.
-const addFormats = ajvFormats.default;
-
 /**
  * Endpoint-level API schemas, keyed by the OpenAPI component name they publish under.
  *
@@ -793,6 +827,7 @@ const IAM_AND_ACCOUNT_SCHEMAS = {
     UserGroupArray: UserGroupArraySchema,
     UserGroupRef: UserGroupRefSchema,
     CreateUserGroupPayload: CreateUserGroupPayloadSchema,
+    ListUserGroupsQuery: ListUserGroupsQuerySchema,
     UpdateUserGroupPayload: UpdateUserGroupPayloadSchema,
     AccessControlEntry: AccessControlEntrySchema,
     AccessControlEntryArray: AccessControlEntryArraySchema,
@@ -841,7 +876,7 @@ const PROJECT_AND_APP_SCHEMAS = {
     BrowserUseProjectConfiguration: BrowserUseProjectConfigurationSchema,
     ProjectIntakeSniffConfiguration: ProjectIntakeSniffConfigurationSchema,
     // Leaves of the Project closure. `ModelOptions` hoists its
-    // twenty-three driver option sets and four enums; `JSONSchema` hoists `JSONSchemaProperties`.
+    // twenty-five driver option sets and four enums; `JSONSchema` hoists `JSONSchemaProperties`.
     JSONSchema: JSONSchemaSchema,
     ModelOptions: ModelOptionsSchema,
     HttpTimeoutOptions: HttpTimeoutOptionsSchema,
@@ -899,9 +934,23 @@ const OAUTH_SCHEMAS = {
     OAuthTokenEndpointAuthMethod: OAuthTokenEndpointAuthMethodSchema,
     OAuthGrantType: OAuthGrantTypeSchema,
     OAuthResponseType: OAuthResponseTypeSchema,
+    OAuthAuthorizationRequestStatus: OAuthAuthorizationRequestStatusSchema,
+    OAuthClientRegistrationMode: OAuthClientRegistrationModeSchema,
     OAuthGrantStatus: OAuthGrantStatusSchema,
     OAuthGrantSortField: OAuthGrantSortFieldSchema,
     OAuthGrantSortOrder: OAuthGrantSortOrderSchema,
+    // OAuth authorization-server discovery, consent, device-code, and token contracts.
+    OAuthAuthorizationServerMetadata: OAuthAuthorizationServerMetadataSchema,
+    OAuthClientDisplayMetadata: OAuthClientDisplayMetadataSchema,
+    OAuthAuthorizeQuery: OAuthAuthorizeQuerySchema,
+    CreateOAuthAuthorizationRequestPayload: CreateOAuthAuthorizationRequestPayloadSchema,
+    OAuthAuthorizationRequest: OAuthAuthorizationRequestSchema,
+    ApproveOAuthAuthorizationRequestPayload: ApproveOAuthAuthorizationRequestPayloadSchema,
+    OAuthGrantableScopesResponse: OAuthGrantableScopesResponseSchema,
+    OAuthAuthorizationDecisionResponse: OAuthAuthorizationDecisionResponseSchema,
+    OAuthDeviceAuthorizationRequest: OAuthDeviceAuthorizationRequestSchema,
+    OAuthDeviceAuthorizationResponse: OAuthDeviceAuthorizationResponseSchema,
+    OAuthTokenResponse: OAuthTokenResponseSchema,
     // Clients registered against Vertesia's own OAuth server. `OAuthClientData` is composed into
     // `OAuthClient` rather than hoisted, so it has no component of its own — as today.
     OAuthClient: OAuthClientSchema,
@@ -1012,6 +1061,7 @@ const LLM_COMPLETION_SCHEMAS = {
     TextResult: TextResultSchema,
     JsonResult: JsonResultSchema,
     ImageResult: ImageResultSchema,
+    VideoResult: VideoResultSchema,
     CompletionResult: CompletionResultSchema,
     ExecutionTokenUsage: ExecutionTokenUsageSchema,
     // The options a caller may send. `PromptFormatter` is deliberately gone: see the note on
@@ -1030,10 +1080,12 @@ const INTERACTION_SCHEMAS = {
     SchemaRef: SchemaRefSchema,
     CachePolicy: CachePolicySchema,
     PromptTemplate: PromptTemplateSchema,
+    InteractionPromptTemplateInput: InteractionPromptTemplateInputSchema,
     PromptTemplateCreatePayload: PromptTemplateCreatePayloadSchema,
     PromptTemplateUpdatePayload: PromptTemplateUpdatePayloadSchema,
     PromptTemplateRef: PromptTemplateRefSchema,
     PromptSegmentDef: PromptSegmentDefSchema,
+    InteractionPromptSegmentInput: InteractionPromptSegmentInputSchema,
     PromptSegmentRef_PromptTemplateRef: PromptSegmentRef_PromptTemplateRefSchema,
     InCodePrompt: InCodePromptSchema,
     Interaction: InteractionSchema,
@@ -1064,6 +1116,8 @@ const INTERACTION_SCHEMAS = {
     // The catalog — in-code interactions an app or the system provides, alongside stored ones.
     CatalogInteractionRef: CatalogInteractionRefSchema,
     CatalogInteractionRefArray: CatalogInteractionRefArraySchema,
+    InCodeInteraction: InCodeInteractionSchema,
+    ResolvedCatalogInteraction: ResolvedCatalogInteractionSchema,
     CatalogTagQuery: CatalogTagQuerySchema,
     StoredCatalogInteractionsQuery: StoredCatalogInteractionsQuerySchema,
     // What `GET /interactions/resolve/:nameOrId` answers with.
@@ -1155,11 +1209,17 @@ const EXECUTION_RUN_SCHEMAS = {
     InteractionExecutionPayload: InteractionExecutionPayloadSchema,
     NamedInteractionExecutionPayload: NamedInteractionExecutionPayloadSchema,
     InteractionExecutionResult: InteractionExecutionResultSchema,
+    FindRunResult: FindRunResultSchema,
+    FindRunResultArray: FindRunResultArraySchema,
     // The retrieve variant, and the two pre-versioning result shapes. See the schema module for why
     // the populated interaction cannot share a component with the create path.
     PopulatedExecutionRunResult: PopulatedExecutionRunResultSchema,
     LegacyExecutionRunResult: LegacyExecutionRunResultSchema,
     LegacyPopulatedExecutionRunResult: LegacyPopulatedExecutionRunResultSchema,
+    // Registered explicitly although the adapter would hoist it anyway from the schemas that
+    // reference it. Hoisted-only components exist in `ApiSchemaComponents` but not in the
+    // `ApiComponentName` union, so a server could not name this one to validate against it.
+    InteractionExecutionConfiguration: InteractionExecutionConfigurationSchema,
     InteractionExecutionError: InteractionExecutionErrorSchema,
     ResultStorageOptions: ResultStorageOptionsSchema,
     ExecuteInteractionByEndpointQuery: ExecuteInteractionByEndpointQuerySchema,
@@ -1174,6 +1234,7 @@ const EXECUTION_RUN_SCHEMAS = {
     RateLimitRequestPayload: RateLimitRequestPayloadSchema,
     RateLimitRequestResponse: RateLimitRequestResponseSchema,
     ComputeRunFacetPayload: ComputeRunFacetPayloadSchema,
+    ComputeRunFacetsResponse: ComputeRunFacetsResponseSchema,
     RunSearchMetaResponse: RunSearchMetaResponseSchema,
     ToolResultsPayload: ToolResultsPayloadSchema,
     UserMessagePayload: UserMessagePayloadSchema,
@@ -1203,6 +1264,10 @@ const FILE_STORAGE_SCHEMAS = {
     BucketReadAccessStatusResponse: BucketReadAccessStatusResponseSchema,
     EnsureBucketReadAccessPayload: EnsureBucketReadAccessPayloadSchema,
     EnsureBucketReadAccessResponse: EnsureBucketReadAccessResponseSchema,
+    BucketCreateAccessQuery: BucketCreateAccessQuerySchema,
+    BucketCreateAccessStatusResponse: BucketCreateAccessStatusResponseSchema,
+    EnsureBucketCreateAccessPayload: EnsureBucketCreateAccessPayloadSchema,
+    EnsureBucketCreateAccessResponse: EnsureBucketCreateAccessResponseSchema,
 } as const satisfies Record<string, z.ZodType>;
 
 const DURABLE_TASK_SCHEMAS = {
@@ -1427,6 +1492,9 @@ const PROCESS_DSL_SCHEMAS = {
     WorkflowDefinitionPayload: ProcessSchemas.WorkflowDefinitionPayloadSchema,
     WorkflowDefinitionPayloadWithActivities: ProcessSchemas.WorkflowDefinitionPayloadWithActivitiesSchema,
     WorkflowDefinitionPayloadWithSteps: ProcessSchemas.WorkflowDefinitionPayloadWithStepsSchema,
+    UpdateWorkflowDefinitionPayload: ProcessSchemas.UpdateWorkflowDefinitionPayloadSchema,
+    UpdateWorkflowDefinitionPayloadWithActivities: ProcessSchemas.UpdateWorkflowDefinitionPayloadWithActivitiesSchema,
+    UpdateWorkflowDefinitionPayloadWithSteps: ProcessSchemas.UpdateWorkflowDefinitionPayloadWithStepsSchema,
 } as const satisfies Record<string, z.ZodType>;
 
 const AGENT_MESSAGE_SCHEMAS = {
@@ -1493,6 +1561,8 @@ const CONTENT_OBJECT_SCHEMAS = {
     UpdateContentObjectPayload: ContentSchemas.UpdateContentObjectPayloadSchema,
     ContentObjectApiTypeRef: ContentSchemas.ContentObjectApiTypeRefSchema,
     ContentObjectApiResponse: ContentSchemas.ContentObjectApiResponseSchema,
+    ProjectedContentObjectApiResponse: ContentSchemas.ProjectedContentObjectApiResponseSchema,
+    ProjectedContentObjectApiResponseArray: ContentSchemas.ProjectedContentObjectApiResponseArraySchema,
     ContentObjectItemApiResponse: ContentSchemas.ContentObjectItemApiResponseSchema,
     ContentObjectItemApiResponseArray: ContentSchemas.ContentObjectItemApiResponseArraySchema,
     ContentObjectProcessingPriority: ContentSchemas.ContentObjectProcessingPrioritySchema,
@@ -1575,6 +1645,37 @@ const PROCESS_RUNTIME_SCHEMAS = {
     ProcessState: ProcessSchemas.ProcessStateSchema,
     WorkflowExecutionStartResultArray: ProcessSchemas.WorkflowExecutionStartResultArraySchema,
     RecordProcessRunPayload: ProcessSchemas.RecordProcessRunPayloadSchema,
+    ProcessTestRunStatus: ProcessSchemas.ProcessTestRunStatusSchema,
+    ProcessTestVirtualActor: ProcessSchemas.ProcessTestVirtualActorSchema,
+    ProcessTestFixtureResult: ProcessSchemas.ProcessTestFixtureResultSchema,
+    ProcessTestFixtureError: ProcessSchemas.ProcessTestFixtureErrorSchema,
+    ProcessTestFixtureResponse: ProcessSchemas.ProcessTestFixtureResponseSchema,
+    ProcessTestNodeFixture: ProcessSchemas.ProcessTestNodeFixtureSchema,
+    ProcessTestHumanAction: ProcessSchemas.ProcessTestHumanActionSchema,
+    ProcessTestAssertions: ProcessSchemas.ProcessTestAssertionsSchema,
+    ProcessTestScenario: ProcessSchemas.ProcessTestScenarioSchema,
+    ProcessTestSuite: ProcessSchemas.ProcessTestSuiteSchema,
+    ProcessTestSuiteArray: ProcessSchemas.ProcessTestSuiteArraySchema,
+    CreateProcessTestSuitePayload: ProcessSchemas.CreateProcessTestSuitePayloadSchema,
+    UpdateProcessTestSuitePayload: ProcessSchemas.UpdateProcessTestSuitePayloadSchema,
+    StartProcessTestRunPayload: ProcessSchemas.StartProcessTestRunPayloadSchema,
+    ProcessTestStoredSubject: ProcessSchemas.ProcessTestStoredSubjectSchema,
+    ProcessTestResolvedSubject: ProcessSchemas.ProcessTestResolvedSubjectSchema,
+    ProcessTestInlineSubject: ProcessSchemas.ProcessTestInlineSubjectSchema,
+    ProcessTestSubject: ProcessSchemas.ProcessTestSubjectSchema,
+    ProcessTestTargetById: ProcessSchemas.ProcessTestTargetByIdSchema,
+    ProcessTestTargetWithDefinition: ProcessSchemas.ProcessTestTargetWithDefinitionSchema,
+    ProcessTestTarget: ProcessSchemas.ProcessTestTargetSchema,
+    SubmitProcessTestRunPayload: ProcessSchemas.SubmitProcessTestRunPayloadSchema,
+    ProcessTestAssertionResult: ProcessSchemas.ProcessTestAssertionResultSchema,
+    ProcessTestActorDecision: ProcessSchemas.ProcessTestActorDecisionSchema,
+    ProcessTestCoverage: ProcessSchemas.ProcessTestCoverageSchema,
+    ProcessTestChildTrace: ProcessSchemas.ProcessTestChildTraceSchema,
+    ProcessTestScenarioResult: ProcessSchemas.ProcessTestScenarioResultSchema,
+    ProcessTestRun: ProcessSchemas.ProcessTestRunSchema,
+    ProcessTestRunArray: ProcessSchemas.ProcessTestRunArraySchema,
+    ListProcessTestRunsQuery: ProcessSchemas.ListProcessTestRunsQuerySchema,
+    UpdateProcessTestScenarioPayload: ProcessSchemas.UpdateProcessTestScenarioPayloadSchema,
 } as const satisfies Record<string, z.ZodType>;
 
 const EVENT_DELIVERY_SCHEMAS = {
@@ -1744,6 +1845,8 @@ const VIEW_EXECUTION_SCHEMAS = {
     ExecuteViewRequest: ViewExecutionSchemas.ExecuteViewRequestSchema,
     ViewNavigationResult: ViewExecutionSchemas.ViewNavigationResultSchema,
     ViewExecutionQueryPlan: ViewExecutionSchemas.ViewExecutionQueryPlanSchema,
+    ViewRerankFailureCode: ViewExecutionSchemas.ViewRerankFailureCodeSchema,
+    ViewExecutionRerankResult: ViewExecutionSchemas.ViewExecutionRerankResultSchema,
     ViewExecutionSearchConfiguration: ViewExecutionSchemas.ViewExecutionSearchConfigurationSchema,
     ViewNavigationResultMap: ViewExecutionSchemas.ViewNavigationResultMapSchema,
     ViewExecutionSearchResult: ViewExecutionSchemas.ViewExecutionSearchResultSchema,
@@ -1794,12 +1897,17 @@ const PROJECT_TOOL_SCHEMAS = {
     // The unified project-scoped tool registry: what `GET /tools` aggregates across
     // builtins, installed apps and interactions, and what `POST /tools/validate` resolves.
     ToolSource: ToolSourceSchema,
+    ToolRuntimeContext: ToolRuntimeContextSchema,
+    ProcessToolCompatibilityReason: ProcessToolCompatibilityReasonSchema,
+    ProcessToolCompatibility: ProcessToolCompatibilitySchema,
     ValidateToolNamesPayload: ValidateToolNamesPayloadSchema,
     ToolValidationResult: ToolValidationResultSchema,
     AggregatedTool: AggregatedToolSchema,
     ValidateToolNamesResponse: ValidateToolNamesResponseSchema,
     AggregatedToolArray: AggregatedToolArraySchema,
     ListProjectToolsQuery: ListProjectToolsQuerySchema,
+    InspectProjectToolQuery: InspectProjectToolQuerySchema,
+    ToolInspection: ToolInspectionSchema,
 } as const satisfies Record<string, z.ZodType>;
 
 const REMOTE_MCP_SCHEMAS = {
@@ -1855,6 +1963,9 @@ const VIEW_EXPERIENCE_SCHEMAS = {
     ViewResultFieldFormat: ViewResultFieldFormatSchema,
     ViewBoardColumn: ViewBoardColumnSchema,
     ViewTableColumn: ViewTableColumnSchema,
+    ViewAgenticSearchMode: ViewAgenticSearchModeSchema,
+    AgenticViewRerankConfiguration: AgenticViewRerankConfigurationSchema,
+    ViewAgenticExecutionConfiguration: ViewAgenticExecutionConfigurationSchema,
     AgenticViewSearchConfiguration: AgenticViewSearchConfigurationSchema,
     ViewSearchFieldType: ViewSearchFieldTypeSchema,
     ViewSearchFieldDefinition: ViewSearchFieldDefinitionSchema,
@@ -1880,6 +1991,14 @@ const VIEW_EXPERIENCE_SCHEMAS = {
     ViewCardsDisplay: ViewCardsDisplaySchema,
     ViewGalleryDisplay: ViewGalleryDisplaySchema,
     ViewDisplayConfiguration: ViewDisplayConfigurationSchema,
+    ViewSelectionMode: ViewSelectionModeSchema,
+    ViewSelectionConfiguration: ViewSelectionConfigurationSchema,
+    ViewActionPlacement: ViewActionPlacementSchema,
+    ViewActionSelectionRequirement: ViewActionSelectionRequirementSchema,
+    ViewActionConfiguration: ViewActionConfigurationSchema,
+    ViewActionsConfiguration: ViewActionsConfigurationSchema,
+    ViewUploadDropParameters: ViewUploadDropParametersSchema,
+    ViewDropConfiguration: ViewDropConfigurationSchema,
     ViewResultsConfiguration: ViewResultsConfigurationSchema,
     CreateViewExperienceRequest: CreateViewExperienceRequestSchema,
     ViewExperience: ViewExperienceSchema,
@@ -1937,6 +2056,7 @@ const APP_LIFECYCLE_SCHEMAS = {
     AppRepoDocumentCommit: AppRepoDocumentCommitSchema,
     AppVersionGitSource: AppVersionGitSourceSchema,
     StartAppScaffoldRequest: StartAppScaffoldRequestSchema,
+    StartAppDevelopmentTaskRequest: StartAppDevelopmentTaskRequestSchema,
     StartAppBuildRequest: StartAppBuildRequestSchema,
     AgentToolDefinition: AgentToolDefinitionSchema,
     AppDevelopmentTaskList: AppDevelopmentTaskListSchema,
@@ -1964,6 +2084,8 @@ const APP_LIFECYCLE_SCHEMAS = {
     AppToolCollectionArray: AppToolCollectionArraySchema,
     AppInstallationKind: AppInstallationKindSchema,
     AppInstallationsQuery: AppInstallationsQuerySchema,
+    AppListScope: AppListScopeSchema,
+    AppsQuery: AppsQuerySchema,
     AppInstallationProjectsQuery: AppInstallationProjectsQuerySchema,
     SystemPackageQuery: SystemPackageQuerySchema,
 } as const satisfies Record<string, z.ZodType>;
@@ -2059,6 +2181,7 @@ const APP_MANIFEST_SCHEMAS = {
     AppWidgetInfo: AppRuntimeSchemas.AppWidgetInfoSchema,
     AppDashboardDefinition: AppRuntimeSchemas.AppDashboardDefinitionSchema,
     AppManifestData: AppRuntimeSchemas.AppManifestDataSchema,
+    UpdateAppPayload: AppRuntimeSchemas.UpdateAppPayloadSchema,
     AppManifest: AppRuntimeSchemas.AppManifestSchema,
     AppManifestArray: AppRuntimeSchemas.AppManifestArraySchema,
     AppWidgetInfoMap: AppRuntimeSchemas.AppWidgetInfoMapSchema,
@@ -2097,6 +2220,32 @@ const STS_SCHEMAS = {
     IssueTokenUnavailableResponse: StsSchemas.IssueTokenUnavailableResponseSchema,
 } as const satisfies Record<string, z.ZodType>;
 
+const AGENT_COMMUNICATION_SCHEMAS = {
+    EmailRouteData: AgentCommunicationSchemas.EmailRouteDataSchema,
+    SendEmailRequest: AgentCommunicationSchemas.SendEmailRequestSchema,
+    SendEmailResponse: AgentCommunicationSchemas.SendEmailResponseSchema,
+    ResolveEmailRouteRequest: AgentCommunicationSchemas.ResolveEmailRouteRequestSchema,
+    CreateEmailRouteRequest: AgentCommunicationSchemas.CreateEmailRouteRequestSchema,
+    CreateEmailRouteResponse: AgentCommunicationSchemas.CreateEmailRouteResponseSchema,
+    EmailRouteResponse: AgentCommunicationSchemas.EmailRouteResponseSchema,
+    UpdateEmailRouteRequest: AgentCommunicationSchemas.UpdateEmailRouteRequestSchema,
+    UpdateEmailRouteResponse: AgentCommunicationSchemas.UpdateEmailRouteResponseSchema,
+    ForwardEmailRequest: AgentCommunicationSchemas.ForwardEmailRequestSchema,
+    ForwardEmailResponse: AgentCommunicationSchemas.ForwardEmailResponseSchema,
+    PendingAskStatus: AgentCommunicationSchemas.PendingAskStatusSchema,
+    PendingAskData: AgentCommunicationSchemas.PendingAskDataSchema,
+    RegisterPendingAskRequest: AgentCommunicationSchemas.RegisterPendingAskRequestSchema,
+    RegisterPendingAskResponse: AgentCommunicationSchemas.RegisterPendingAskResponseSchema,
+    ResolvePendingAskRequest: AgentCommunicationSchemas.ResolvePendingAskRequestSchema,
+    ResolvePendingAskResponse: AgentCommunicationSchemas.ResolvePendingAskResponseSchema,
+    ListPendingAsksResponse: AgentCommunicationSchemas.ListPendingAsksResponseSchema,
+} as const satisfies Record<string, z.ZodType>;
+
+const CONTENT_QUERY_SCHEMAS = {
+    ContentQueryPayload: ContentQuerySchemas.ContentQueryPayloadSchema,
+    ContentQueryResult: ContentQuerySchemas.ContentQueryResultSchema,
+} as const satisfies Record<string, z.ZodType>;
+
 const API_SCHEMA_GROUPS = [
     IAM_AND_ACCOUNT_SCHEMAS,
     PROJECT_AND_APP_SCHEMAS,
@@ -2120,6 +2269,8 @@ const API_SCHEMA_GROUPS = [
     APP_MANIFEST_SCHEMAS,
     APP_INSTALLATION_SCHEMAS,
     STS_SCHEMAS,
+    AGENT_COMMUNICATION_SCHEMAS,
+    CONTENT_QUERY_SCHEMAS,
     FILE_STORAGE_SCHEMAS,
     DURABLE_TASK_SCHEMAS,
     CONTENT_TYPE_CATALOG_SCHEMAS,
@@ -2179,6 +2330,8 @@ type ApiSchemaMap = typeof IAM_AND_ACCOUNT_SCHEMAS &
     typeof APP_MANIFEST_SCHEMAS &
     typeof APP_INSTALLATION_SCHEMAS &
     typeof STS_SCHEMAS &
+    typeof AGENT_COMMUNICATION_SCHEMAS &
+    typeof CONTENT_QUERY_SCHEMAS &
     typeof FILE_STORAGE_SCHEMAS &
     typeof DURABLE_TASK_SCHEMAS &
     typeof CONTENT_TYPE_CATALOG_SCHEMAS &
@@ -2227,6 +2380,33 @@ const API_SCHEMAS: Readonly<Record<ApiComponentName, z.ZodType>> = mergeComponen
  * objects, so a body carrying an undeclared property is rejected rather than quietly accepted.
  */
 const STRICT_COMPONENTS: ReadonlySet<string> = new Set<string>([
+    // Process Test Lab request, fixture, and result contracts.
+    'ProcessTestVirtualActor',
+    'ProcessTestFixtureResult',
+    'ProcessTestFixtureError',
+    'ProcessTestNodeFixture',
+    'ProcessTestHumanAction',
+    'ProcessTestAssertions',
+    'ProcessTestScenario',
+    'ProcessTestSuite',
+    'CreateProcessTestSuitePayload',
+    'UpdateProcessTestSuitePayload',
+    'StartProcessTestRunPayload',
+    'ProcessTestStoredSubject',
+    'ProcessTestResolvedSubject',
+    'ProcessTestInlineSubject',
+    'ProcessTestTargetById',
+    'ProcessTestTargetWithDefinition',
+    'ProcessTestTarget',
+    'SubmitProcessTestRunPayload',
+    'ProcessTestAssertionResult',
+    'ProcessTestActorDecision',
+    'ProcessTestCoverage',
+    'ProcessTestChildTrace',
+    'ProcessTestScenarioResult',
+    'ProcessTestRun',
+    'ListProcessTestRunsQuery',
+    'UpdateProcessTestScenarioPayload',
     'Account',
     'AccountBilling',
     'UpdateAccountPayload',
@@ -2271,6 +2451,27 @@ const STRICT_COMPONENTS: ReadonlySet<string> = new Set<string>([
     'UserGroupRef',
     'CreateUserGroupPayload',
     'UpdateUserGroupPayload',
+    'ListUserGroupsQuery',
+    // Agent communication and content query endpoints.
+    'EmailRouteData',
+    'SendEmailRequest',
+    'SendEmailResponse',
+    'ResolveEmailRouteRequest',
+    'CreateEmailRouteRequest',
+    'CreateEmailRouteResponse',
+    'EmailRouteResponse',
+    'UpdateEmailRouteRequest',
+    'UpdateEmailRouteResponse',
+    'ForwardEmailRequest',
+    'ForwardEmailResponse',
+    'PendingAskData',
+    'RegisterPendingAskRequest',
+    'RegisterPendingAskResponse',
+    'ResolvePendingAskRequest',
+    'ResolvePendingAskResponse',
+    'ListPendingAsksResponse',
+    'ContentQueryPayload',
+    'ContentQueryResult',
     // The roles / access-control closure. `AceConditions` is closed too, and has to be listed by
     // name: it is a hoisted component, so the parent's strict policy does not reach it.
     // `PropertyConditions` is deliberately absent — it is a map whose `additionalProperties` is a
@@ -2350,7 +2551,7 @@ const STRICT_COMPONENTS: ReadonlySet<string> = new Set<string>([
     'ProjectConfiguration',
     'UpdateProjectPayload',
     'UpdateProjectConfigurationPayload',
-    // Every member of the `ModelOptions` union. All twenty-three are published closed today, and
+    // Every member of the `ModelOptions` union is published closed today, and
     // their Zod schemas are `strictObject`, so the published contract, the AJV enforcement and the
     // schema's own parse all reject the same undeclared option. `ModelOptions` itself is a union
     // and takes no `additionalProperties`, and neither do the four hoisted enums.
@@ -2358,9 +2559,11 @@ const STRICT_COMPONENTS: ReadonlySet<string> = new Set<string>([
     // `JSONSchema` is deliberately absent: it is OPEN by design and by long-standing publication —
     // a JSON Schema carries keywords the type never enumerated. `JSONSchemaProperties` is a map.
     'TextFallbackOptions',
+    'AzureFoundryChatOptions',
     'ImagenOptions',
     'VertexAIClaudeOptions',
     'VertexAIGeminiOptions',
+    'VertexAIGeminiOmniVideoOptions',
     'VertexAIGrokOptions',
     'NovaCanvasOptions',
     'BedrockConverseOptions',
@@ -2379,7 +2582,9 @@ const STRICT_COMPONENTS: ReadonlySet<string> = new Set<string>([
     'OpenAiTextOptions',
     'OpenAiDalleOptions',
     'OpenAiGptImageOptions',
+    'XAIGrokImageOptions',
     'GroqOptions',
+    'MistralTextOptions',
     // The app-manifest leaves. Every object among them is published closed today, the nested `git`
     // block included, and it is spelled `strictObject` so the emission carries it directly. The five
     // enums take no `additionalProperties` at all.
@@ -2590,6 +2795,8 @@ const STRICT_COMPONENTS: ReadonlySet<string> = new Set<string>([
     'ViewResultMedia',
     'ViewBoardColumn',
     'ViewTableColumn',
+    'AgenticViewRerankConfiguration',
+    'ViewAgenticExecutionConfiguration',
     'AgenticViewSearchConfiguration',
     'ViewSearchFieldDefinition',
     'ViewRangeDefinition',
@@ -2691,6 +2898,7 @@ const STRICT_COMPONENTS: ReadonlySet<string> = new Set<string>([
     'WorkflowRunEvent',
     'ViewNavigationResult',
     'ViewExecutionQueryPlan',
+    'ViewExecutionRerankResult',
     'ViewExecutionSearchConfiguration',
     'DSLRetryPolicy',
     'CreateContentObjectPayload',
@@ -2718,6 +2926,7 @@ const STRICT_COMPONENTS: ReadonlySet<string> = new Set<string>([
     'DSLActivitySpec',
     'DSLActivityStep',
     'ContentObjectApiResponse',
+    'ProjectedContentObjectApiResponse',
     'ComputeObjectFacetPayload',
     'EventSubscriptionFilter',
     'EventDeliverySummary',
@@ -2730,6 +2939,11 @@ const STRICT_COMPONENTS: ReadonlySet<string> = new Set<string>([
     'ListEventDeliveriesResponse',
     'ObjectSearchResponse',
     'WorkflowRunWithDetails',
+    'ViewSelectionConfiguration',
+    'ViewActionConfiguration',
+    'ViewActionsConfiguration',
+    'ViewUploadDropParameters',
+    'ViewDropConfiguration',
     'ViewResultsConfiguration',
     'ViewExecutionDefinition',
     'ViewExperienceConfiguration',
@@ -2768,6 +2982,14 @@ const STRICT_COMPONENTS: ReadonlySet<string> = new Set<string>([
     'OAuthProviderAuthorizeResponse',
     'OAuthProviderAccessTokenResponse',
     'OAuthProviderExchangePayload',
+    'OAuthClientDisplayMetadata',
+    'OAuthAuthorizeQuery',
+    'CreateOAuthAuthorizationRequestPayload',
+    'OAuthAuthorizationRequest',
+    'ApproveOAuthAuthorizationRequestPayload',
+    'OAuthGrantableScopesResponse',
+    'OAuthAuthorizationDecisionResponse',
+    'OAuthDeviceAuthorizationRequest',
     'OAuthClient',
     'OAuthClientCreateResponse',
     'OAuthClientScopeMetadata',
@@ -2836,16 +3058,19 @@ const STRICT_COMPONENTS: ReadonlySet<string> = new Set<string>([
     'TextResult',
     'JsonResult',
     'ImageResult',
+    'VideoResult',
     'ExecutionTokenUsage',
     'StatelessExecutionOptions',
     'SchemaRef',
     'CachePolicy',
     'PromptModalities',
     'PromptTemplate',
+    'InteractionPromptTemplateInput',
     'PromptTemplateCreatePayload',
     'PromptTemplateUpdatePayload',
     'PromptTemplateRef',
     'PromptSegmentDef',
+    'InteractionPromptSegmentInput',
     'PromptSegmentRef_PromptTemplateRef',
     'InCodePrompt',
     'Interaction',
@@ -2934,6 +3159,11 @@ const STRICT_COMPONENTS: ReadonlySet<string> = new Set<string>([
     'ValidateToolNamesPayload',
     'ToolValidationResult',
     'AggregatedTool',
+    'ToolRuntimeContext',
+    'ProcessToolCompatibilityReason',
+    'ProcessToolCompatibility',
+    'InspectProjectToolQuery',
+    'ToolInspection',
     'ValidateToolNamesResponse',
     'RenderPromptResponse',
     'PromptTemplateInteractionVersion',
@@ -3019,6 +3249,7 @@ const STRICT_COMPONENTS: ReadonlySet<string> = new Set<string>([
     'AppRepoDocumentCommit',
     'AppVersionGitSource',
     'StartAppScaffoldRequest',
+    'StartAppDevelopmentTaskRequest',
     'StartAppBuildRequest',
     'AgentToolDefinition',
     'AppDevelopmentTaskList',
@@ -3037,6 +3268,7 @@ const STRICT_COMPONENTS: ReadonlySet<string> = new Set<string>([
     'AppInstallationPayload',
     'AppDevelopmentTaskDetails',
     'AppInstallationsQuery',
+    'AppsQuery',
     'AppInstallationProjectsQuery',
     'SystemPackageQuery',
     'WebsiteCredentialTotpMetadata',
@@ -3071,6 +3303,7 @@ const STRICT_COMPONENTS: ReadonlySet<string> = new Set<string>([
     'DeleteSecretResponse',
     'WebsiteCredentialMetadata',
     'AppManifestData',
+    'UpdateAppPayload',
     'WebsiteCredentialMetadataUpdate',
     'AskUserWebhookConfigurationInput',
     'ResendConfigurationInput',
@@ -3099,13 +3332,20 @@ const STRICT_COMPONENTS: ReadonlySet<string> = new Set<string>([
     'BucketReadAccessStatusResponse',
     'EnsureBucketReadAccessPayload',
     'EnsureBucketReadAccessResponse',
+    'BucketCreateAccessQuery',
+    'BucketCreateAccessStatusResponse',
+    'EnsureBucketCreateAccessPayload',
+    'EnsureBucketCreateAccessResponse',
     'MigrateInteractionsPayload',
     'MigrateInteractionsResult',
     'PricingSyncPayload',
     'PricingSyncDayResult',
     'PricingSyncResult',
     'ComputeRunFacetPayload',
+    'FindRunResult',
+    'FindRunResultArray',
     'RunSearchMetaResponse',
+    'ComputeRunFacetsResponse',
     'ToolResultsPayload',
     'UserMessagePayload',
     'ExecutionResponse',
@@ -3154,122 +3394,19 @@ function emitRawSchemas(): Record<string, unknown> {
 }
 
 /**
- * The canonical `components.schemas` for all documented endpoints.
+ * Converts the whole Zod registry into the canonical `components.schemas`.
  *
- * This exact object is what the OpenAPI spec publishes AND what AJV compiles, so the published
- * contract and the enforced contract cannot diverge.
- */
-export const ApiSchemaComponents: Readonly<Record<string, JsonObject>> = toOpenApiComponents(emitRawSchemas(), {
-    strictComponents: STRICT_COMPONENTS,
-});
-
-/**
- * A canonical component as a SELF-CONTAINED JSON Schema, for consumers that compile it directly.
+ * This is the BUILD-TIME half of the contract. Its result is written to
+ * `../api-contract/components.generated.json` by `scripts/gen-api-components.ts`, and that artifact
+ * — not this function — is what serving processes load as `ApiSchemaComponents`. Calling this
+ * requires the ~85 MB Zod object graph, which is precisely what the artifact exists to keep out of
+ * the servers; see the comment at the top of `../api-contract/index.ts`.
  *
- * The published component `$ref`s its neighbours through `#/components/schemas/...`, which resolves
- * only inside the OpenAPI document. AJV and the Monaco editor need a document they can compile on
- * its own, so the transitive closure is inlined under `$defs` and the pointers rewritten. Nothing
- * about the shapes changes — this is a re-rooting of the same objects, plus the removal of the
- * OpenAPI-only discriminator keywords described below, which is what lets a generated artifact be
- * compared with the component it came from.
+ * Callers are the generator and `../api-contract/components.contract.test.ts`, which compares the
+ * two and fails on drift. Everything else should read `ApiSchemaComponents`.
  */
-export function bundleCanonicalComponent(name: ApiComponentName): JsonObject {
-    const seen = new Set<string>();
-    const queue: string[] = [name];
-    while (queue.length > 0) {
-        const current = queue.shift() as string;
-        if (seen.has(current)) continue;
-        seen.add(current);
-        for (const referenced of collectComponentRefs(ApiSchemaComponents[current])) {
-            if (!seen.has(referenced)) queue.push(referenced);
-        }
-    }
-    seen.delete(name);
-    const defs: JsonObject = {};
-    for (const dependency of [...seen].sort()) {
-        defs[dependency] = toPlainJsonSchema(ApiSchemaComponents[dependency]) as JsonObject;
-    }
-    const root = toPlainJsonSchema(ApiSchemaComponents[name]) as JsonObject;
-    return seen.size > 0 ? { ...root, $defs: defs } : root;
-}
-
-const COMPONENT_REF_PREFIX = '#/components/schemas/';
-
-/**
- * Re-roots the component pointers AND drops the discriminator keywords, which are OpenAPI's, not
- * JSON Schema's.
- *
- * `synthesizeDiscriminator` in the adapter gives a discriminated union a `discriminator` plus a
- * restated `type: 'object'` and `required: [propertyName]` ON THE UNION NODE, so a generated
- * Java/Go client can pick a subtype from the union rather than the branches. That restatement is a
- * codegen hint: the node carries no `properties`, so it says "an object that must have
- * `_option_id`" while declaring nothing that could be one.
- *
- * A JSON Schema validator does not mind — `required` needs no matching `properties`, and each
- * branch requires the same key anyway, so removing all three is validation-neutral. Gemini's
- * function-declaration validator does mind, and rejects the whole tool:
- *
- *     schema at properties.intake.properties.extraction.properties.config.properties.model_options
- *     requires unspecified property '_option_id'
- *
- * That was a 400 on every agent turn offering `create_or_update_type`, because the intake-policy
- * artifact reaches Vertex inside that tool's input schema. Stripping here rather than at the tool
- * keeps the next component someone bundles from reintroducing it. The OpenAPI document is untouched
- * — `ApiSchemaComponents` still carries the hint, and the generated clients still read it.
- */
-function toPlainJsonSchema(value: unknown): unknown {
-    const rerooted = rerootComponentRefs(value);
-    return stripDiscriminators(rerooted);
-}
-
-function stripDiscriminators(value: unknown): unknown {
-    if (Array.isArray(value)) return value.map(stripDiscriminators);
-    if (!value || typeof value !== 'object') return value;
-    const node = value as JsonObject;
-    // `properties` present means the node describes an object in its own right, so its `type` and
-    // `required` are the schema's own rather than the restatement — only the OpenAPI keyword goes.
-    const restated = node.discriminator !== undefined && node.properties === undefined;
-    const out: JsonObject = {};
-    for (const [key, item] of Object.entries(node)) {
-        if (key === 'discriminator') continue;
-        if (restated && (key === 'type' || key === 'required')) continue;
-        out[key] = stripDiscriminators(item) as never;
-    }
-    return out;
-}
-
-function collectComponentRefs(value: unknown, out = new Set<string>()): Set<string> {
-    if (Array.isArray(value)) {
-        for (const item of value) collectComponentRefs(item, out);
-        return out;
-    }
-    if (!value || typeof value !== 'object') return out;
-    for (const [key, item] of Object.entries(value)) {
-        if (key === '$ref' && typeof item === 'string' && item.startsWith(COMPONENT_REF_PREFIX)) {
-            out.add(item.slice(COMPONENT_REF_PREFIX.length));
-        } else {
-            collectComponentRefs(item, out);
-        }
-    }
-    return out;
-}
-
-function rerootComponentRefs(value: unknown): unknown {
-    if (Array.isArray(value)) return value.map(rerootComponentRefs);
-    if (!value || typeof value !== 'object') return value;
-    const out: JsonObject = {};
-    for (const [key, item] of Object.entries(value)) {
-        out[key] =
-            key === '$ref' && typeof item === 'string' && item.startsWith(COMPONENT_REF_PREFIX)
-                ? `#/$defs/${item.slice(COMPONENT_REF_PREFIX.length)}`
-                : (rerootComponentRefs(item) as never);
-    }
-    return out;
-}
-
-/** The `$ref` pointer for a component, in the same spelling the spec publishes. */
-export function apiComponentRef(name: ApiComponentName): string {
-    return `#/components/schemas/${name}`;
+export function buildApiSchemaComponents(): Readonly<Record<string, JsonObject>> {
+    return toOpenApiComponents(emitRawSchemas(), { strictComponents: STRICT_COMPONENTS });
 }
 
 /**
@@ -3338,332 +3475,28 @@ export type ApiComponentType<N extends ApiComponentName> = N extends keyof ZenoR
 export type ApiSchemaOf<N extends ApiComponentName> = ApiComponentType<N>;
 
 /**
- * Validators compiled against the published components, through an envelope so the pointer AJV
- * resolves is the exact pointer the spec publishes. `strictSchema: false` tolerates the
- * `components` wrapper while leaving type and tuple checks active.
- *
- * Compiled lazily and cached: AJV compilation is the expensive step, and most components are
- * never validated in a given process.
- */
-const validators = new Map<string, ValidateFunction>();
-
-/**
- * One instance for the process, built on first validation.
- *
- * Per-component instances meant re-registering the whole thousand-component envelope for every
- * component ever validated, and AJV walks a schema when it is added. Sharing one instance also lets
- * it reuse the compiled form of a component that two others reference.
- */
-let ajvInstance: Ajv2020 | undefined;
-
-/**
- * The published components as AJV can consume them: the same schemas, with the two adjustments
- * AJV's discriminator support requires and the OpenAPI document must not have.
- *
- * `discriminator: true` below is what makes AJV validate a discriminated union through the branch
- * its tag names, instead of trying every branch and reporting all of their failures at once. The
- * difference is not cosmetic — a legacy MCP tool collection missing `id` used to report the real
- * error alongside two impossible ones from the branch it was never meant to match:
- *
- *     / must have required property 'id'                        <- the real one
- *     / must NOT have additional properties: oauth_app          <- vertesia_sdk branch
- *     /type must be equal to constant                           <- vertesia_sdk branch
- *     / must match exactly one schema in oneOf
- *
- * AJV rejects `mapping` outright ("discriminator: mapping is not supported"), because it derives
- * the tag-to-branch map from each branch's own `const`/`enum` instead. The OpenAPI document still
- * needs the mapping — a generated Java or Go client reads it to pick a concrete subtype — so both
- * fixups here apply to AJV's copy only, and `ApiSchemaComponents` is published exactly as built.
+ * The runtime half of the contract, re-exported so this module stays the single import for schema
+ * authors, the OpenAPI generator and the contract tests.
  *
- * AJV's remaining requirements — the tag required in every branch, carrying `const` or a
- * single-valued `enum`, with the union node typed as an object — are what `synthesizeDiscriminator`
- * in the adapter already checks before it emits a discriminator at all, and what the hand-written
- * `.meta({ discriminator })` declarations restate. `api-discriminators.test.ts` compiles every
- * registered component so a union satisfying neither fails the build rather than the request.
+ * The implementations live in `../api-contract/index.ts` because they must not depend on Zod: they
+ * validate against the prebuilt `components.generated.json`, which is what lets the servers enforce
+ * contracts without loading the ~85 MB Zod graph. Importing them from HERE pulls that graph in, so
+ * server code must import `@vertesia/common/api-contract` directly. This re-export is for the
+ * build-time and test consumers that have already paid for zod.
  */
-function toAjvComponents(): Record<string, JsonObject> {
-    const schemas = structuredClone(ApiSchemaComponents) as Record<string, JsonObject>;
-    const resolve = (value: unknown): JsonObject | undefined => {
-        if (!isPlainObject(value)) return undefined;
-        const ref = value.$ref;
-        if (typeof ref !== 'string' || !ref.startsWith(COMPONENT_REF_PREFIX)) return value;
-        return schemas[ref.slice(COMPONENT_REF_PREFIX.length)];
-    };
-
-    visitSchemaNodes(schemas, (node) => {
-        const discriminator = node.discriminator;
-        if (!isPlainObject(discriminator) || !Array.isArray(node.oneOf)) return;
-        // AJV derives the tag-to-branch map from each branch's own literal, so `mapping` is both
-        // redundant and rejected.
-        delete discriminator.mapping;
-
-        const tag = discriminator.propertyName;
-        if (typeof tag !== 'string') return;
-        for (const member of node.oneOf) {
-            const branch = resolve(member);
-            const properties = branch && isPlainObject(branch.properties) ? branch.properties : undefined;
-            const tagSchema = properties?.[tag];
-            if (!isPlainObject(tagSchema) || tagSchema.const !== undefined || tagSchema.enum !== undefined) continue;
-            // The tag is a `$ref` to a named literal component — `TaskType_ACTIVITY`,
-            // `SupportedIntegrations_gladia` — because the literal carries its own `.meta({ id })`.
-            // AJV reads `properties/<tag>` looking for `const` or `enum` and does not follow a
-            // `$ref` to find one, so it refuses to compile the union at all. Restating the resolved
-            // literal ALONGSIDE the `$ref` is validation-neutral: `$ref` has no special precedence
-            // in 2020-12, both keywords apply, and they carry the same value by construction.
-            const target = resolve(tagSchema);
-            if (!target) continue;
-            if (target.const !== undefined) tagSchema.const = target.const;
-            else if (Array.isArray(target.enum)) tagSchema.enum = target.enum;
-        }
-    });
-    return schemas;
-}
-
-/** Every object node in the component graph, parents before children. */
-function visitSchemaNodes(value: unknown, visit: (node: JsonObject) => void): void {
-    if (Array.isArray(value)) {
-        for (const item of value) visitSchemaNodes(item, visit);
-        return;
-    }
-    if (!isPlainObject(value)) return;
-    visit(value);
-    for (const item of Object.values(value)) visitSchemaNodes(item, visit);
-}
-
-function getAjv(): Ajv2020 {
-    if (ajvInstance) return ajvInstance;
-    const ajv = new Ajv2020({ strictSchema: false, allErrors: true, discriminator: true });
-    // Without this, AJV treats `format` as an annotation and ignores it, so a `date-time` property
-    // would document a constraint nothing checks — the exact spec/enforcement gap this design is
-    // meant to close.
-    addFormats(ajv);
-    ajv.addSchema({ $id: 'vertesia://openapi', components: { schemas: toAjvComponents() } });
-    ajvInstance = ajv;
-    return ajv;
-}
-
-function getValidator(name: ApiComponentName): ValidateFunction {
-    const cached = validators.get(name);
-    if (cached) return cached;
-    const validate = getAjv().compile({ $ref: `vertesia://openapi${apiComponentRef(name)}` });
-    validators.set(name, validate);
-    return validate;
-}
-
-function additionalProperty(error: { params?: unknown }): string | undefined {
-    // AJV writes "must NOT have additional properties" and puts the offending key in `params`,
-    // so the message alone says a body is wrong without saying which property made it wrong.
-    // Every other keyword names its subject already — `required` quotes the missing property,
-    // `enum` and `type` describe the value in place — and this is the one a caller most often
-    // trips, so it is the one worth spelling out rather than reformatting all of them.
-    return (error.params as { additionalProperty?: string } | undefined)?.additionalProperty;
-}
-
-/**
- * One validation failure, with the undeclared property names kept AS NAMES.
- *
- * The structure exists because the rendered line cannot be taken apart again. Property names are
- * arbitrary JSON strings: `{"customer secret token": 1}` and `{"a, b": 1}` are both valid, so
- * neither a space nor a comma is a reliable separator once the names have been joined. Any consumer
- * that needs to shorten the list — the HTTP boundary does, the log does not — has to do it here,
- * on the array, where a name can be dropped whole.
- */
-export interface ApiValidationIssue {
-    /**
-     * AJV's `instancePath` for the failing value, with `'/'` substituted for the root.
-     *
-     * Not quite a JSON Pointer: the pointer for a document root is the empty string, which reads as
-     * a missing path in a message. `'/'` is a display sentinel, so treat this as human-facing rather
-     * than as something to resolve against the payload.
-     */
-    path: string;
-    /** AJV's own message, e.g. `must NOT have additional properties`. */
-    message: string;
-    /** Undeclared property names at {@link path}, in the order AJV reported them. */
-    undeclared?: string[];
-}
-
-/**
- * The failures, with all undeclared properties at a given path gathered into ONE issue.
- *
- * AJV reports `additionalProperties` per property, so a value carrying a whole foreign object —
- * a Mongoose document that reached the response mapper unmapped, say — produces one error per own
- * key and buries every other failure in the payload. Gathering is lossless: every name is kept, in
- * the order AJV found it, on the issue for the path it belongs to.
- */
-function collectIssues(validate: ValidateFunction): ApiValidationIssue[] {
-    const errors = validate.errors ?? [];
-    const undeclaredByPath = new Map<string, Set<string>>();
-    for (const error of errors) {
-        const additional = additionalProperty(error);
-        if (additional === undefined) continue;
-        const where = error.instancePath || '/';
-        const names = undeclaredByPath.get(where);
-        // A union whose branches all reject the same property reports it once per branch. The name
-        // is the same fact each time, so it is listed once.
-        if (names) names.add(additional);
-        else undeclaredByPath.set(where, new Set([additional]));
-    }
-
-    const gathered = new Set<string>();
-    const issues: ApiValidationIssue[] = [];
-    for (const error of errors) {
-        const path = error.instancePath || '/';
-        const message = error.message ?? 'is invalid';
-        if (additionalProperty(error) === undefined) {
-            issues.push({ path, message });
-            continue;
-        }
-        if (gathered.has(path)) continue;
-        gathered.add(path);
-        issues.push({ path, message, undeclared: [...(undeclaredByPath.get(path) ?? [])] });
-    }
-    return issues;
-}
-
-/**
- * The complete rendering of one issue — every name, no budget.
- *
- * This is what gets logged. A caller-facing message renders from {@link ApiValidationIssue} itself
- * with a length limit rather than shortening this string; see `reportableErrors` in the enforcer.
- */
-export function renderApiValidationIssue(issue: ApiValidationIssue): string {
-    const head = `${issue.path} ${issue.message}`;
-    return issue.undeclared?.length ? `${head}: ${issue.undeclared.join(', ')}` : head;
-}
-
-/** The failed branch of every validator here, so the two views cannot be built inconsistently. */
-function invalidResult(validate: ValidateFunction): { valid: false; errors: string[]; issues: ApiValidationIssue[] } {
-    const issues = collectIssues(validate);
-    return { valid: false, errors: issues.map(renderApiValidationIssue), issues };
-}
-
-export type ValidateApiPayloadResult<T> =
-    | { valid: true; data: T }
-    /**
-     * `errors` is the rendered form, complete and ready to log; `issues` is the same failures with
-     * the property names still separable. Shorten from `issues`, never from `errors`.
-     */
-    | { valid: false; errors: string[]; issues: ApiValidationIssue[] };
-
-/**
- * Validates an untyped request body against the component the endpoint publishes.
- *
- * Non-mutating by design. AJV's removal modes are never used here: the server would then accept a
- * body the published schema declares invalid, silently disagreeing with its own spec — and
- * `removeAdditional: 'all'` additionally empties freeform maps. An undeclared property is reported,
- * not deleted.
- *
- * The component type is handed back only on the `valid` branch, so a body missing required fields
- * cannot be typed as complete. What the caller does with a failure — reject, or log and continue —
- * is the endpoint's policy, not this function's.
- */
-export function validateApiRequest<N extends ApiComponentName>(
-    name: N,
-    value: unknown,
-): ValidateApiPayloadResult<ApiComponentType<N>> {
-    const validate = getValidator(name);
-    if (validate(value)) {
-        return { valid: true, data: value as ApiComponentType<N> };
-    }
-    return invalidResult(validate);
-}
-
-/**
- * Validates an already-mapped response against the component it is published as.
- *
- * Separate from {@link pruneAndValidateApiResponse} because a resource mapper has already produced
- * the wire shape: there is nothing to prune, and pruning would only mask a mapper bug. Use this at
- * the response boundary to detect drift between what the mapper builds and what the spec promises.
- */
-export function validateApiResponse<N extends ApiComponentName>(
-    name: N,
-    value: unknown,
-): ValidateApiPayloadResult<ApiComponentType<N>> {
-    const validate = getValidator(name);
-    if (validate(value)) {
-        return { valid: true, data: value as ApiComponentType<N> };
-    }
-    return invalidResult(validate);
-}
-
-/**
- * Best-effort normalization of a response payload towards the fields its published component
- * declares. Use this on the response path INSTEAD of an AJV removal mode, which would empty
- * freeform maps such as `Account.feature_flags`.
- *
- * NOT a secret-removal boundary. Ambiguous schema shapes pass values through untouched — see
- * {@link pruneToSchema} and check a component with {@link findUnprunablePaths} before treating its
- * output as closed. Fields that must never ship still need an explicit response mapper.
- *
- * Never throws and never rejects: an undocumented field is server-side drift, and failing the
- * response would punish the caller for it.
- *
- * Takes a value the caller has already typed as the component. Pruning only REMOVES undeclared
- * extras, so a conforming input yields a conforming output and the return type is honest. It does
- * NOT validate, which is why it cannot accept `unknown` — narrowing a payload that is missing
- * required fields would hand TypeScript a complete `Account` that does not exist at runtime. Use
- * {@link pruneAndValidateApiResponse} when the payload's shape is not already established.
- *
- * Request validation stays separate and non-mutating — pruning a request would make the server
- * silently disagree with the permissive schema it publishes.
- */
-export function pruneApiResponse<N extends ApiComponentName>(name: N, value: ApiComponentType<N>): ApiComponentType<N> {
-    return pruneToSchema(value, { $ref: apiComponentRef(name) }, ApiSchemaComponents) as ApiComponentType<N>;
-}
-
-export type PruneAndValidateResult<T> =
-    | { valid: true; data: T }
-    | { valid: false; data: unknown; errors: string[]; issues: ApiValidationIssue[] };
-
-/**
- * Prunes an untyped payload and validates the result against the published component.
- *
- * The only sound entry point for a payload of unknown shape: the component type is handed back
- * exclusively on the `valid` branch, so a document missing required fields cannot be typed as
- * complete. On failure the pruned value is still returned — the caller decides whether to ship it
- * and log, or fail — which keeps the "never turn drift into a 500" property a policy choice rather
- * than something baked in here.
- *
- */
-export function pruneAndValidateApiResponse<N extends ApiComponentName>(
-    name: N,
-    value: unknown,
-): PruneAndValidateResult<ApiComponentType<N>> {
-    const pruned = pruneToSchema(value, { $ref: apiComponentRef(name) }, ApiSchemaComponents);
-    const validate = getValidator(name);
-    if (validate(pruned)) {
-        return { valid: true, data: pruned as ApiComponentType<N> };
-    }
-    return { ...invalidResult(validate), data: pruned };
-}
-
-/**
- * Paths inside a component where pruning cannot narrow. Empty means no STRUCTURAL gaps for
- * schema-conforming input — see {@link findUnprunablePaths} for why that is weaker than "nothing
- * can escape". Anything listed needs an explicit response mapper.
- */
-export function findUnprunableApiPaths(name: ApiComponentName): string[] {
-    return findUnprunablePaths({ $ref: apiComponentRef(name) }, ApiSchemaComponents);
-}
-
-/**
- * Normalizes raw query or header text into the value a component describes.
- *
- * Binds {@link normalizeParameters} to {@link ApiSchemaComponents} — the same objects the OpenAPI
- * document publishes and {@link validateApiRequest} compiles. That is what keeps the published
- * parameter and the enforced one the same declaration: the scanner expands this component's
- * properties into `in: query` parameters, and the coercion below is decided by those same property
- * schemas, so neither can be changed without changing the other.
- *
- * Validate the result with {@link validateApiRequest}, which is non-coercing: everything type-related
- * has already happened here, so a value this could not coerce is reported against the published
- * schema rather than by a second rule.
- */
-export function normalizeApiParameters(
-    name: ApiComponentName,
-    raw: RawApiParameters,
-    location: ApiParameterLocation,
-): NormalizedApiParameters {
-    return normalizeParameters(name, raw, location, ApiSchemaComponents[name], ApiSchemaComponents);
-}
+export {
+    ApiSchemaComponents,
+    type ApiValidationIssue,
+    apiComponentRef,
+    bundleCanonicalComponent,
+    findUnprunableApiPaths,
+    normalizeApiParameters,
+    type PruneAndValidateResult,
+    pruneAndValidateApiResponse,
+    pruneApiResponse,
+    renderApiValidationIssue,
+    renderApiValidationIssueHead,
+    type ValidateApiPayloadResult,
+    validateApiRequest,
+    validateApiResponse,
+} from '../api-contract/index.js';