@vertesia/common 1.5.0-dev.20260807.073259Z → 1.5.0-dev.20260901.005903Z

package/src/oauth-server.ts

@@ -1,14 +1,26 @@
 import type { z } from 'zod';
 import type {
+    ApproveOAuthAuthorizationRequestPayloadSchema,
     BulkRevokeOAuthGrantsPayloadSchema,
+    CreateOAuthAuthorizationRequestPayloadSchema,
     CreateOAuthClientPayloadSchema,
     ListOAuthGrantsQuerySchema,
+    OAuthAuthorizationDecisionResponseSchema,
+    OAuthAuthorizationRequestSchema,
+    OAuthAuthorizationRequestStatusSchema,
+    OAuthAuthorizationServerMetadataSchema,
+    OAuthAuthorizeQuerySchema,
     OAuthClientCreateResponseSchema,
     OAuthClientDataSchema,
+    OAuthClientDisplayMetadataSchema,
+    OAuthClientRegistrationModeSchema,
     OAuthClientSchema,
     OAuthClientScopeMetadataSchema,
     OAuthClientStatusSchema,
     OAuthClientTypeSchema,
+    OAuthDeviceAuthorizationRequestSchema,
+    OAuthDeviceAuthorizationResponseSchema,
+    OAuthGrantableScopesResponseSchema,
     OAuthGrantListResponseSchema,
     OAuthGrantRevokeResponseSchema,
     OAuthGrantSchema,
@@ -20,17 +32,14 @@ import type {
     OAuthRegistrationSourceSchema,
     OAuthResponseTypeSchema,
     OAuthTokenEndpointAuthMethodSchema,
+    OAuthTokenResponseSchema,
     RevokeOAuthGrantQuerySchema,
     UpdateOAuthClientPayloadSchema,
 } from './api-schemas/oauth-server.js';
-import type { AuthTokenPayload, PrincipalType } from './apikey.js';
-import type { ProjectRef } from './project.js';
 
 /**
- * The types the three studio OAuth resources publish are inferred from
- * `./api-schemas/oauth-server.js` — the same objects the OpenAPI document and the request validator
- * are built from. The rest of this module is the token server's own OAuth surface, still declared
- * here and still TypeScript-derived; it converts with that service's own slots.
+ * These public OAuth wire types are inferred from `./api-schemas/oauth-server.js` — the same
+ * contracts used for runtime parsing and OpenAPI components.
  */
 export type OAuthClientType = z.infer<typeof OAuthClientTypeSchema>;
 export type OAuthClientStatus = z.infer<typeof OAuthClientStatusSchema>;
@@ -39,14 +48,8 @@ export type OAuthProjectBindingMode = z.infer<typeof OAuthProjectBindingModeSche
 export type OAuthTokenEndpointAuthMethod = z.infer<typeof OAuthTokenEndpointAuthMethodSchema>;
 export type OAuthGrantType = z.infer<typeof OAuthGrantTypeSchema>;
 export type OAuthResponseType = z.infer<typeof OAuthResponseTypeSchema>;
-export type OAuthAuthorizationRequestStatus = 'pending' | 'denied' | 'consumed';
-export type OAuthClientRegistrationMode = 'registered' | 'client_id_metadata_document';
-/**
- * How Vertesia identified itself to a *remote* authorization server when connecting
- * out as an OAuth client. Distinct from {@link OAuthClientRegistrationMode}, which
- * describes how inbound clients identified themselves to Vertesia's own AS.
- */
-export type RemoteOAuthRegistrationMode = 'dynamic_client_registration' | 'client_id_metadata_document';
+export type OAuthAuthorizationRequestStatus = z.infer<typeof OAuthAuthorizationRequestStatusSchema>;
+export type OAuthClientRegistrationMode = z.infer<typeof OAuthClientRegistrationModeSchema>;
 export type OAuthGrantStatus = z.infer<typeof OAuthGrantStatusSchema>;
 export type OAuthGrantSortField = z.infer<typeof OAuthGrantSortFieldSchema>;
 export type OAuthGrantSortOrder = z.infer<typeof OAuthGrantSortOrderSchema>;
@@ -78,204 +81,14 @@ export type CreateOAuthClientPayload = z.infer<typeof CreateOAuthClientPayloadSc
 
 export type UpdateOAuthClientPayload = z.infer<typeof UpdateOAuthClientPayloadSchema>;
 
-export interface OAuthAuthorizationServerMetadata {
-    issuer: string;
-    authorization_endpoint: string;
-    token_endpoint: string;
-    jwks_uri: string;
-    registration_endpoint?: string;
-    revocation_endpoint?: string;
-    response_types_supported: string[];
-    grant_types_supported: string[];
-    code_challenge_methods_supported: string[];
-    token_endpoint_auth_methods_supported: string[];
-    scopes_supported: string[];
-    client_id_metadata_document_supported?: boolean;
-    device_authorization_endpoint?: string;
-}
-
-export interface OAuthClientMetadataDocument {
-    client_id: string;
-    client_name: string;
-    redirect_uris: string[];
-    grant_types?: OAuthGrantType[];
-    response_types?: OAuthResponseType[];
-    token_endpoint_auth_method?: OAuthTokenEndpointAuthMethod;
-    scope?: string;
-    client_uri?: string;
-    logo_uri?: string;
-    tos_uri?: string;
-    policy_uri?: string;
-}
-
-export interface OAuthClientDisplayMetadata {
-    client_uri?: string;
-    logo_uri?: string;
-    tos_uri?: string;
-    policy_uri?: string;
-}
-
-export interface OAuthAuthorizeQuery {
-    response_type: 'code';
-    client_id: string;
-    redirect_uri: string;
-    resource?: string;
-    scope?: string;
-    state?: string;
-    code_challenge: string;
-    code_challenge_method: 'S256';
-    project_id?: string;
-}
-
-export interface CreateOAuthAuthorizationRequestPayload extends OAuthAuthorizeQuery {}
-
-export interface OAuthAuthorizationRequest {
-    request_id: string;
-    client_id: string;
-    client_name: string;
-    client_metadata?: OAuthClientDisplayMetadata;
-    client_registration_mode?: OAuthClientRegistrationMode;
-    redirect_uri: string;
-    redirect_origin: string;
-    resource?: string;
-    requested_scopes: string[];
-    optional_scopes?: string[];
-    requested_project_id?: string;
-    project_binding_mode: OAuthProjectBindingMode;
-    fixed_project_id?: string;
-    /**
-     * When true, the consent UI must constrain project selection to {@link owner_account_id}: the
-     * client may only be authorized for projects in its owning account. False (default) lets the user
-     * authorize any project they can access. Mirrors the server-side authorization enforcement.
-     */
-    restrict_to_owner_account?: boolean;
-    /** The owning account the client is restricted to, when {@link restrict_to_owner_account} is true. */
-    owner_account_id?: string;
-    status: OAuthAuthorizationRequestStatus;
-    created_at: string;
-    expires_at: string;
-}
-
-export interface ApproveOAuthAuthorizationRequestPayload {
-    project_id?: string;
-    granted_scopes: string[];
-}
-
-export interface OAuthGrantableScopesResponse {
-    project_id: string;
-    requested_permission_scopes: string[];
-    grantable_permission_scopes: string[];
-    unavailable_permission_scopes: string[];
-}
-
-export interface OAuthAuthorizationDecisionResponse {
-    redirect_url: string;
-}
-
-export interface OAuthDeviceAuthorizationRequest {
-    client_id: string;
-    resource?: string;
-    scope?: string;
-    project_id?: string;
-}
-
-export interface OAuthDeviceAuthorizationResponse {
-    device_code: string;
-    user_code: string;
-    verification_uri: string;
-    verification_uri_complete: string;
-    expires_in: number;
-    interval: number;
-}
-
-export interface OAuthTokenRequestAuthorizationCode {
-    grant_type: 'authorization_code';
-    code: string;
-    redirect_uri: string;
-    client_id: string;
-    resource?: string;
-    code_verifier: string;
-    client_secret?: string;
-}
-
-export interface OAuthTokenRequestRefreshToken {
-    grant_type: 'refresh_token';
-    refresh_token: string;
-    client_id: string;
-    resource?: string;
-    project_id?: string;
-    client_secret?: string;
-}
-
-export interface OAuthTokenRequestDeviceCode {
-    grant_type: 'urn:ietf:params:oauth:grant-type:device_code';
-    device_code: string;
-    client_id: string;
-    client_secret?: string;
-}
-
-export type OAuthTokenRequest =
-    | OAuthTokenRequestAuthorizationCode
-    | OAuthTokenRequestRefreshToken
-    | OAuthTokenRequestDeviceCode;
-
-export interface OAuthTokenResponse {
-    access_token: string;
-    token_type: 'Bearer';
-    expires_in: number;
-    scope: string;
-    refresh_token?: string;
-    id_token?: string;
-}
-
-export interface OAuthAuthorizationCodeRecord {
-    code: string;
-    client_id: string;
-    user_id: string;
-    account_id: string;
-    project_id: string;
-    resource: string;
-    scope: string[];
-    redirect_uri: string;
-    code_challenge: string;
-    code_challenge_method: 'S256';
-    expires_at: string;
-}
-
-export interface OAuthConsentRecord {
-    user_id: string;
-    client_id: string;
-    account_id: string;
-    project_id: string;
-    scope: string[];
-    granted_at: string;
-    revoked_at?: string;
-}
-
-export interface OAuthAccessTokenPayload extends Omit<AuthTokenPayload, 'type' | 'project'> {
-    type: PrincipalType.OAuthAccess;
-    client_id: string;
-    scope: string;
-    user_id: string;
-    project: ProjectRef;
-    allowed_collections?: string[];
-    resource?: string;
-}
-
-export interface OAuthIdTokenPayload {
-    sub: string;
-    user_id: string;
-    name?: string;
-    email?: string;
-    picture?: string;
-    type: 'oauth_id';
-    client_id: string;
-    account?: AuthTokenPayload['account'];
-    accounts?: AuthTokenPayload['accounts'];
-    project?: ProjectRef;
-    /** User groups */
-    groups?: AuthTokenPayload['groups'];
-    iss: string;
-    aud: string;
-    exp: number;
-}
+export type OAuthAuthorizationServerMetadata = z.infer<typeof OAuthAuthorizationServerMetadataSchema>;
+export type OAuthClientDisplayMetadata = z.infer<typeof OAuthClientDisplayMetadataSchema>;
+export type OAuthAuthorizeQuery = z.infer<typeof OAuthAuthorizeQuerySchema>;
+export type CreateOAuthAuthorizationRequestPayload = z.infer<typeof CreateOAuthAuthorizationRequestPayloadSchema>;
+export type OAuthAuthorizationRequest = z.infer<typeof OAuthAuthorizationRequestSchema>;
+export type ApproveOAuthAuthorizationRequestPayload = z.infer<typeof ApproveOAuthAuthorizationRequestPayloadSchema>;
+export type OAuthGrantableScopesResponse = z.infer<typeof OAuthGrantableScopesResponseSchema>;
+export type OAuthAuthorizationDecisionResponse = z.infer<typeof OAuthAuthorizationDecisionResponseSchema>;
+export type OAuthDeviceAuthorizationRequest = z.infer<typeof OAuthDeviceAuthorizationRequestSchema>;
+export type OAuthDeviceAuthorizationResponse = z.infer<typeof OAuthDeviceAuthorizationResponseSchema>;
+export type OAuthTokenResponse = z.infer<typeof OAuthTokenResponseSchema>;

package/src/payload.ts

@@ -26,7 +26,7 @@ export type SortOrder = z.infer<typeof SortOrderSchema>;
 
 export type SortOption = z.infer<typeof SortOptionSchema>;
 
-export interface SearchPayload {
+interface SearchPayload {
     facets?: FacetSpec[];
     /**
      * If the facets should be limited to the current page of results.
@@ -45,11 +45,6 @@ export interface SearchPayload {
     aggs?: Record<string, unknown>;
 }
 
-export interface ComputeFacetPayload {
-    facets: FacetSpec[];
-    query?: SimpleSearchQuery;
-}
-
 export interface InteractionSearchPayload extends SearchPayload {
     query?: InteractionSearchQuery;
 }

package/src/pending-asks.ts

@@ -3,53 +3,30 @@
  * Used to notify external systems when agents are waiting for user input.
  */
 
-import type { UserChannel } from './email.js';
-import type { TaskField } from './store/task.js';
+import type { z } from 'zod';
+import type {
+    ListPendingAsksResponseSchema,
+    PendingAskDataSchema,
+    PendingAskStatusSchema,
+    RegisterPendingAskRequestSchema,
+    RegisterPendingAskResponseSchema,
+    ResolvePendingAskRequestSchema,
+    ResolvePendingAskResponseSchema,
+} from './api-schemas/agent-communication.js';
 
 // ================= Pending Ask Data ====================
 
 /**
  * Status of a pending ask request.
  */
-export type PendingAskStatus = 'pending' | 'resolved' | 'expired';
+export type PendingAskStatus = z.infer<typeof PendingAskStatusSchema>;
 
 /**
  * Data stored in Redis for pending ask_user requests.
  * Tracks which agents are waiting for user input and enables
  * both webhook notifications and portal views.
  */
-export interface PendingAskData {
-    /** Unique identifier for this ask (10-char alphanumeric) */
-    askId: string;
-    /** Temporal workflow run ID */
-    runId: string;
-    /** Temporal workflow ID */
-    workflowId: string;
-    /** Project ID */
-    projectId: string;
-    /** Account ID */
-    accountId: string;
-    /** Name of the agent/interaction that asked */
-    agentName: string;
-    /** Questions asked by the agent */
-    questions: string[];
-    /** Timeout in hours (default 48) */
-    timeoutHours: number;
-    /** Communication channels configured for the conversation */
-    userChannels: UserChannel[];
-    /** Timestamp when the ask was created (ms since epoch) */
-    createdAt: number;
-    /** Timestamp when the ask expires (ms since epoch) */
-    expiresAt: number;
-    /** Current status of the ask */
-    status: PendingAskStatus;
-    /** Durable task created for this ask_user request. */
-    taskId?: string;
-    /** Timestamp when resolved (ms since epoch) */
-    resolvedAt?: number;
-    /** User's response (after resolution) */
-    response?: string;
-}
+export type PendingAskData = z.infer<typeof PendingAskDataSchema>;
 
 // ================= Webhook Events ====================
 
@@ -104,10 +81,8 @@ export interface AskUserWebhookEvent {
 /**
  * Response from listing pending asks.
  */
-export interface ListPendingAsksResponse {
-    asks: PendingAskData[];
-}
-
-export interface AskUserTaskMetadata {
-    taskFields?: TaskField[];
-}
+export type RegisterPendingAskRequest = z.infer<typeof RegisterPendingAskRequestSchema>;
+export type RegisterPendingAskResponse = z.infer<typeof RegisterPendingAskResponseSchema>;
+export type ResolvePendingAskRequest = z.infer<typeof ResolvePendingAskRequestSchema>;
+export type ResolvePendingAskResponse = z.infer<typeof ResolvePendingAskResponseSchema>;
+export type ListPendingAsksResponse = z.infer<typeof ListPendingAsksResponseSchema>;

package/src/platform-event.ts

@@ -51,7 +51,7 @@ import type {
 import type { AuditMeter } from './audit-trail.js';
 import type { ConversationVisibility } from './interaction.js';
 import type { SystemRoles } from './project.js';
-import type { GroundedVerificationBreakdown, ProcessDefinitionBody, ProcessRunType } from './store/index.js';
+import type { ProcessDefinitionBody, ProcessRunType } from './store/index.js';
 
 // Inferred from `./api-schemas/audit-trail.js`, which is where the schema sits: the audit trail is
 // the only place the category is published, and the converter grouped it with the endpoints that
@@ -93,108 +93,6 @@ export interface PlatformEvent extends EventRef {
     details?: Record<string, unknown>;
 }
 
-/**
- * Lifecycle actions published by the workflow completion interceptor. The names intentionally
- * match the legacy notify_endpoints event_name values so migrated webhook subscribers receive
- * byte-identical status/event_name fields.
- */
-export type WorkflowLifecycleAction = 'workflow_completed' | 'workflow_failed';
-
-export interface DocumentProcessingModelUsage {
-    role: 'extraction' | 'review';
-    run_id: string;
-    model?: string;
-    environment_id?: string;
-    provider?: string;
-}
-
-/** Compact, content-free operational summary emitted after grounded IDP completes. */
-export interface DocumentProcessedEventData {
-    schema_version: 1;
-    pipeline: 'grounded_extraction';
-    object_id: string;
-    page_count: number;
-    ocr_page_count: number;
-    vision_page_count: number;
-    property_count: number;
-    citation_count: number;
-    verification: GroundedVerificationBreakdown;
-    result_path: string;
-    confidence?: number;
-    coverage_min?: number;
-    hardness?: number;
-    escalated?: boolean;
-    reviewed?: boolean;
-    review_issue_count?: number;
-    verdict?: 'good_to_go' | 'needs_review';
-    verdict_reason?: string;
-    models_used?: DocumentProcessingModelUsage[];
-    review_agent_run_id?: string;
-}
-
-/**
- * Resource flavor of a workflow lifecycle event, derived from the Temporal workflow type:
- * ExecuteConversationWorkflow -> agent_run, ExecuteProcessWorkflow -> process_run,
- * document-scoped workflows may use content_object, and anything else -> workflow_run.
- */
-export type WorkflowLifecycleResourceType = 'workflow_run' | 'agent_run' | 'process_run' | 'content_object';
-
-/**
- * Body of POST /internal/events/publish (zeno-server, workload-identity gated). Sent by Temporal
- * workers to publish a workflow lifecycle event to the event bus; the server fills event ids,
- * tenant, timestamp and causality from caused_by.
- */
-export interface PublishWorkflowLifecycleEventRequest {
-    account_id: string;
-    project_id: string;
-    action: WorkflowLifecycleAction;
-    resource_type: WorkflowLifecycleResourceType;
-    /** Domain resource the workflow acted on. Defaults to workflow_id for workflow-scoped events. */
-    resource_id?: string;
-    workflow_id: string;
-    workflow_run_id: string;
-    workflow_type: string;
-    /** Rule/subscription name that started the run (payload.wf_rule_name), used for filtering. */
-    workflow_rule_name?: string;
-    initiated_by?: string;
-    /** Workflow return value for completed runs. */
-    result?: unknown;
-    /** Error message for failed runs. */
-    error?: string;
-    /** EventRef of the event that started the workflow (payload.vars.event_ref), if any. */
-    caused_by?: EventRef;
-    /** Optional IDP outcome published as a separate, subscribable content event. */
-    document_processed?: DocumentProcessedEventData;
-}
-
-/**
- * A provider-neutral external work-item thread identity. The pair `(resource_type, resource_id)`
- * derives a stable `eventThreadTag` (see `@dglabs/event-bus`), so all events of the same thread
- * correlate to one agent run.
- */
-export interface EventThreadRef {
-    resource_type: string;
-    resource_id: string;
-}
-
-/**
- * Body of the internal, workload-identity-gated run-threads endpoint. Sent by a Temporal worker so an
- * agent run can register additional external-thread identities on **itself** mid-run, so later events on
- * those threads route to the same run. The server computes the thread tags from `(account, project,
- * resource_type, resource_id)` and idempotently appends them to the run; the worker never supplies a raw
- * tag.
- */
-export interface AppendAgentRunThreadsRequest {
-    account_id: string;
-    project_id: string;
-    threads: EventThreadRef[];
-}
-
-export interface AppendAgentRunThreadsResponse {
-    /** The thread tags that are now present on the run (the full event-thread tag set). */
-    thread_tags: string[];
-}
-
 export type EventSubscriptionFilter = z.infer<typeof EventSubscriptionFilterSchema>;
 
 // --- Semantic conditions ---
@@ -270,16 +168,6 @@ export type EventDeliveryTargetInput =
     | AgentEventDeliveryTarget
     | ProcessEventDeliveryTarget;
 
-export interface MatchedEventSubscriptionSnapshot {
-    subscription_id: string;
-    subscription_name: string;
-    target: EventDeliveryTarget;
-    priority: EventPriority;
-    run_as_role: SystemRoles;
-    /** Semantic condition carried from the subscription filter, evaluated at delivery time. */
-    semantic_condition?: EventSemanticCondition;
-}
-
 export interface EventSubscription {
     id: string;
     name: string;
@@ -373,13 +261,13 @@ export interface EventDeliveryStreamUpdate {
     item: EventDeliveryStreamItem;
 }
 
-export interface EventDeliveryStreamHeartbeat {
+interface EventDeliveryStreamHeartbeat {
     type: 'heartbeat';
     emitted_at: string;
     cursor?: string;
 }
 
-export interface EventDeliveryStreamError {
+interface EventDeliveryStreamError {
     type: 'error';
     emitted_at: string;
     cursor?: string;
@@ -453,24 +341,6 @@ export type CancelEventDeliveryIntentsPayload = z.infer<typeof CancelEventDelive
 
 export type CancelEventDeliveryIntentsResponse = z.infer<typeof CancelEventDeliveryIntentsResponseSchema>;
 
-export interface PublishPlatformEventPayload {
-    event: PlatformEvent;
-    priority?: EventPriority;
-}
-
-export interface PublishPlatformEventResponse {
-    event_id: string;
-    outbox_id?: string;
-    status: EventOutboxStatus;
-    matched_subscription_count: number;
-    materialized_intent_count: number;
-}
-
-export interface WorkflowEventInput<T = Record<string, unknown>> {
-    event_ref: EventRef;
-    payload: T;
-}
-
 // --- External event ingest channels ---
 // An ingest channel is a token-authenticated inbound endpoint that lets external systems publish
 // events into the platform event bus. Ingested events get event_category 'external' and
@@ -493,26 +363,3 @@ export type CreateEventIngestChannelPayload = z.infer<typeof CreateEventIngestCh
 export type UpdateEventIngestChannelPayload = z.infer<typeof UpdateEventIngestChannelPayloadSchema>;
 
 export type EventIngestChannelMutationResponse = z.infer<typeof EventIngestChannelMutationResponseSchema>;
-
-/**
- * Body accepted by the public ingest webhook
- * `POST /webhooks/events/:accountId/:projectId/:channelId`. All fields are optional: when omitted the
- * channel transform / defaults are applied. The raw body is preserved under `event.details.payload`.
- */
-export interface IngestExternalEventPayload {
-    action?: string;
-    resource_type?: string;
-    resource_id?: string;
-    /** Domain payload; defaults to the full raw body when omitted. */
-    payload?: Record<string, unknown>;
-    /** Extra fields merged into `event.details`. */
-    details?: Record<string, unknown>;
-    /** Deduplication key: the same key produces the same event id. */
-    idempotency_key?: string;
-    /** ISO 8601 event timestamp; defaults to ingest time. */
-    timestamp?: string;
-}
-
-export interface IngestExternalEventResponse {
-    event_id: string;
-}