@vertesia/common 1.5.0-dev.20260826.064249Z → 1.5.0-dev.20260901.033115Z

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vertesia/common",
-  "version": "1.5.0-dev.20260826.064249Z",
+  "version": "1.5.0-dev.20260901.033115Z",
   "license": "Apache-2.0",
   "type": "module",
   "main": "./lib/index.js",
@@ -36,7 +36,7 @@
     "ajv": "^8.20.0",
     "ajv-formats": "^3.0.1",
     "zod": "^4.4.3",
-    "@llumiverse/common": "1.5.0-dev.20260826.063042Z"
+    "@llumiverse/common": "1.5.0-dev.20260831.235912Z"
   },
   "repository": {
     "type": "git",
@@ -51,7 +51,7 @@
     "ai",
     "typescript"
   ],
-  "gitHead": "c0d6426380b6f66657db83017c90de208ee4956a",
+  "gitHead": "96b1587659282d517fe75878467b5fd82bbc1ac5",
   "scripts": {
     "lint": "biome lint src",
     "test": "vitest run",

package/src/api-contract/components.generated.json

@@ -3454,6 +3454,11 @@
         "type": "string",
         "minLength": 1,
         "description": "Provider-defined processing tier. Unknown non-empty values are preserved for forward compatibility."
+      },
+      "extra_body": {
+        "type": "object",
+        "additionalProperties": true,
+        "description": "Additional provider-specific fields merged into the OpenAI-compatible request body."
       }
     },
     "required": [
@@ -3522,6 +3527,11 @@
         "type": "string",
         "minLength": 1,
         "description": "Provider-defined processing tier. Unknown non-empty values are preserved for forward compatibility."
+      },
+      "extra_body": {
+        "type": "object",
+        "additionalProperties": true,
+        "description": "Additional provider-specific fields merged into the OpenAI-compatible request body."
       }
     },
     "required": [
@@ -19084,6 +19094,17 @@
       "webhook_secret_hint": {
         "type": "string"
       },
+      "webhook_secret": {
+        "anyOf": [
+          {
+            "type": "string",
+            "description": "Decrypted credential returned only to authenticated agent principals for runtime use. Human and service-account callers receive null; presence and hint fields report configuration status."
+          },
+          {
+            "type": "null"
+          }
+        ]
+      },
       "events": {
         "type": "array",
         "items": {
@@ -19102,7 +19123,8 @@
     },
     "required": [
       "integration",
-      "enabled"
+      "enabled",
+      "webhook_secret"
     ],
     "additionalProperties": false,
     "description": "Configuration for ask_user webhook notifications. Sends webhooks when agents call ask_user and when users respond."
@@ -19122,6 +19144,17 @@
       "api_key_hint": {
         "type": "string"
       },
+      "api_key": {
+        "anyOf": [
+          {
+            "type": "string",
+            "description": "Decrypted credential returned only to authenticated agent principals for runtime use. Human and service-account callers receive null; presence and hint fields report configuration status."
+          },
+          {
+            "type": "null"
+          }
+        ]
+      },
       "email_domain": {
         "type": "string",
         "description": "Domain for email (both sending and receiving). Must be verified in Resend."
@@ -19136,6 +19169,17 @@
       "webhook_secret_hint": {
         "type": "string"
       },
+      "webhook_secret": {
+        "anyOf": [
+          {
+            "type": "string",
+            "description": "Decrypted credential returned only to authenticated agent principals for runtime use. Human and service-account callers receive null; presence and hint fields report configuration status."
+          },
+          {
+            "type": "null"
+          }
+        ]
+      },
       "allowed_sender_domains": {
         "type": "array",
         "items": {
@@ -19155,7 +19199,9 @@
     "required": [
       "integration",
       "enabled",
-      "email_domain"
+      "api_key",
+      "email_domain",
+      "webhook_secret"
     ],
     "additionalProperties": false
   },
@@ -19173,11 +19219,23 @@
       },
       "api_key_hint": {
         "type": "string"
+      },
+      "api_key": {
+        "anyOf": [
+          {
+            "type": "string",
+            "description": "Decrypted credential returned only to authenticated agent principals for runtime use. Human and service-account callers receive null; presence and hint fields report configuration status."
+          },
+          {
+            "type": "null"
+          }
+        ]
       }
     },
     "required": [
       "integration",
-      "enabled"
+      "enabled",
+      "api_key"
     ],
     "additionalProperties": false
   },
@@ -19195,11 +19253,23 @@
       },
       "api_key_hint": {
         "type": "string"
+      },
+      "api_key": {
+        "anyOf": [
+          {
+            "type": "string",
+            "description": "Decrypted credential returned only to authenticated agent principals for runtime use. Human and service-account callers receive null; presence and hint fields report configuration status."
+          },
+          {
+            "type": "null"
+          }
+        ]
       }
     },
     "required": [
       "integration",
-      "enabled"
+      "enabled",
+      "api_key"
     ],
     "additionalProperties": false
   },
@@ -19218,13 +19288,25 @@
       "api_key_hint": {
         "type": "string"
       },
+      "api_key": {
+        "anyOf": [
+          {
+            "type": "string",
+            "description": "Decrypted credential returned only to authenticated agent principals for runtime use. Human and service-account callers receive null; presence and hint fields report configuration status."
+          },
+          {
+            "type": "null"
+          }
+        ]
+      },
       "url": {
         "type": "string"
       }
     },
     "required": [
       "integration",
-      "enabled"
+      "enabled",
+      "api_key"
     ],
     "additionalProperties": false
   },
@@ -19274,13 +19356,25 @@
       "api_key_hint": {
         "type": "string"
       },
+      "api_key": {
+        "anyOf": [
+          {
+            "type": "string",
+            "description": "Decrypted credential returned only to authenticated agent principals for runtime use. Human and service-account callers receive null; presence and hint fields report configuration status."
+          },
+          {
+            "type": "null"
+          }
+        ]
+      },
       "url": {
         "type": "string"
       }
     },
     "required": [
       "integration",
-      "enabled"
+      "enabled",
+      "api_key"
     ],
     "additionalProperties": false
   },
@@ -24618,11 +24712,19 @@
       "type": {
         "type": "string",
         "const": "workflow",
-        "description": "The type fo the step. If not set defaults to \"activity\""
+        "description": "Identifies this step as a child workflow"
       },
       "name": {
         "type": "string"
       },
+      "title": {
+        "type": "string",
+        "description": "Title of the child workflow to be displayed in the UI workflow builder"
+      },
+      "description": {
+        "type": "string",
+        "description": "Description of the child workflow displayed in the UI workflow builder"
+      },
       "vars": {
         "type": "object",
         "additionalProperties": true,

package/src/api-schemas/integrations.ts

@@ -5,6 +5,11 @@ import { SupportedIntegrations } from '../integrations.js';
 import { StringValueMapSchema } from './files.js';
 import { DSLActivityOptionsSchema } from './process.js';
 
+const agentOnlyDecryptedSecretSchema = z.string().meta({
+    description:
+        'Decrypted credential returned only to authenticated agent principals for runtime use. Human and service-account callers receive null; presence and hint fields report configuration status.',
+});
+
 export const SupportedIntegrations_ask_user_webhookSchema = z
     .literal(SupportedIntegrations.ask_user_webhook)
     .meta({ id: 'SupportedIntegrations_ask_user_webhook' });
@@ -54,6 +59,7 @@ export const AskUserWebhookConfigurationSchema = z
         webhook_url: z.string().meta({ description: 'Webhook URL to receive ask_user events' }).optional(),
         has_webhook_secret: z.boolean().optional(),
         webhook_secret_hint: z.string().optional(),
+        webhook_secret: agentOnlyDecryptedSecretSchema.nullable(),
         events: z
             .array(z.enum(['requested', 'resolved']))
             .meta({ description: "Which events to send: ['requested', 'resolved'] or subset (default: both)" })
@@ -74,6 +80,7 @@ export const ResendConfigurationSchema = z
         enabled: z.boolean(),
         has_api_key: z.boolean().optional(),
         api_key_hint: z.string().optional(),
+        api_key: agentOnlyDecryptedSecretSchema.nullable(),
         email_domain: z
             .string()
             .meta({ description: 'Domain for email (both sending and receiving). Must be verified in Resend.' }),
@@ -83,6 +90,7 @@ export const ResendConfigurationSchema = z
             .optional(),
         has_webhook_secret: z.boolean().optional(),
         webhook_secret_hint: z.string().optional(),
+        webhook_secret: agentOnlyDecryptedSecretSchema.nullable(),
         allowed_sender_domains: z
             .array(z.string())
             .meta({ description: 'Domains allowed to send emails TO start agents (for inbound validation)' })
@@ -104,6 +112,7 @@ export const LinkupConfigurationSchema = z
         enabled: z.boolean(),
         has_api_key: z.boolean().optional(),
         api_key_hint: z.string().optional(),
+        api_key: agentOnlyDecryptedSecretSchema.nullable(),
     })
     .meta({ id: 'LinkupConfiguration' });
 
@@ -113,6 +122,7 @@ export const ExaConfigurationSchema = z
         enabled: z.boolean(),
         has_api_key: z.boolean().optional(),
         api_key_hint: z.string().optional(),
+        api_key: agentOnlyDecryptedSecretSchema.nullable(),
     })
     .meta({ id: 'ExaConfiguration' });
 
@@ -122,6 +132,7 @@ export const SerperConfigurationSchema = z
         enabled: z.boolean(),
         has_api_key: z.boolean().optional(),
         api_key_hint: z.string().optional(),
+        api_key: agentOnlyDecryptedSecretSchema.nullable(),
         url: z.string().optional(),
     })
     .meta({ id: 'SerperConfiguration' });
@@ -151,6 +162,7 @@ export const GladiaConfigurationSchema = z
         enabled: z.boolean(),
         has_api_key: z.boolean().optional(),
         api_key_hint: z.string().optional(),
+        api_key: agentOnlyDecryptedSecretSchema.nullable(),
         url: z.string().optional(),
     })
     .meta({ id: 'GladiaConfiguration' });

package/src/api-schemas/llumiverse.contract.test.ts

@@ -96,6 +96,21 @@ describe('the ModelOptions closure is published whole and enforced closed', () =
         ).toBe(true);
         expect(validate({ _option_id: 'not-a-driver' })).toBe(false);
     });
+
+    it('allows provider-specific objects only inside OpenAI-compatible extra_body', () => {
+        const validate = compile('ModelOptions');
+        expect(
+            validate({
+                _option_id: 'openai-text',
+                extra_body: {
+                    provider: { sort: 'throughput', allow_fallbacks: false },
+                    baseten: { performance: 'max' },
+                },
+            }),
+            JSON.stringify(validate.errors),
+        ).toBe(true);
+        expect(validate({ _option_id: 'openai-text', extra_body: ['invalid'] })).toBe(false);
+    });
 });
 
 describe('the JSONSchema closure is published open, because a JSON Schema is open', () => {

package/src/api-schemas/process.ts

@@ -571,8 +571,16 @@ export const CreateProcessDefinitionPayloadSchema: z.ZodType = z
 
 export const DSLChildWorkflowStepSchema: z.ZodType = z
     .strictObject({
-        type: z.literal('workflow').meta({ description: 'The type fo the step. If not set defaults to "activity"' }),
+        type: z.literal('workflow').meta({ description: 'Identifies this step as a child workflow' }),
         name: z.string(),
+        title: z
+            .string()
+            .meta({ description: 'Title of the child workflow to be displayed in the UI workflow builder' })
+            .optional(),
+        description: z
+            .string()
+            .meta({ description: 'Description of the child workflow displayed in the UI workflow builder' })
+            .optional(),
         vars: z
             .looseObject({})
             .meta({

package/src/api-schemas/project.contract.test.ts

@@ -98,6 +98,7 @@ describe('gate 1 — the schema is the single source of truth for the converted
             validateApiResponse('ProjectIntegrationConfigResponse', {
                 integration: SupportedIntegrations.ask_user_webhook,
                 enabled: false,
+                webhook_secret: null,
             }).valid,
         ).toBe(true);
         expect(
@@ -105,6 +106,7 @@ describe('gate 1 — the schema is the single source of truth for the converted
                 integration: SupportedIntegrations.ask_user_webhook,
                 enabled: true,
                 webhook_url: 'https://example.test/hooks/ask-user',
+                webhook_secret: null,
             }).valid,
         ).toBe(true);
     });
@@ -393,6 +395,23 @@ describe('gate 4 — AJV validates the same canonical objects that are published
 });
 
 describe('gate 5 — runtime enforcement uses the published components', () => {
+    it('accepts decrypted integration credentials only on the response contract', () => {
+        expect(
+            validateApiResponse('ProjectIntegrationConfigResponse', {
+                integration: SupportedIntegrations.exa,
+                enabled: true,
+                api_key: 'agent-runtime-secret',
+            }).valid,
+        ).toBe(true);
+        expect(
+            validateApiResponse('ProjectIntegrationConfigResponse', {
+                integration: SupportedIntegrations.ask_user_webhook,
+                enabled: true,
+                webhook_secret: 'agent-runtime-secret',
+            }).valid,
+        ).toBe(true);
+    });
+
     it('checks the shared count response the same way for every service that returns it', () => {
         // Four slots across three resources and two servers, so this component had to move as a unit.
         expect(validateApiResponse('CountResult', { count: 0 }).valid).toBe(true);

package/src/api-schemas/zeno-response-contracts.test.ts

@@ -186,6 +186,30 @@ describe('Zeno read-side response contracts', () => {
         ).toBe(true);
     });
 
+    it('accepts display metadata on child-workflow steps', () => {
+        expect(
+            validateApiResponse('DSLWorkflowDefinitionResponse', {
+                id: 'workflow-1',
+                name: 'Parent workflow',
+                edit_revision: 1,
+                created_by: 'user-1',
+                updated_by: 'user-1',
+                created_at: timestamp,
+                updated_at: timestamp,
+                vars: {},
+                spec_format: 'steps',
+                steps: [
+                    {
+                        type: 'workflow',
+                        name: 'childWorkflow',
+                        title: 'Review documents',
+                        description: 'Runs the review child workflow',
+                    },
+                ],
+            }).valid,
+        ).toBe(true);
+    });
+
     it('accepts explicit file, embedding, facet, and data-table wire objects', () => {
         expect(
             validateApiResponse('FileMetadataResponse', {

package/src/integrations.ts

@@ -25,7 +25,7 @@ export type GladiaConfigurationInput = z.infer<typeof GladiaConfigurationInputSc
 export type GladiaConfiguration = z.infer<typeof GladiaConfigurationSchema>;
 
 export interface GladiaConfigurationWithSecrets extends GladiaConfiguration {
-    api_key?: string;
+    api_key: string | null;
 }
 
 export type GithubConfigurationInput = z.infer<typeof GithubConfigurationInputSchema>;

package/src/store/dsl-workflow.ts

@@ -105,6 +105,10 @@ export interface DSLChildWorkflowStep extends DSLWorkflowStepBase {
     type: 'workflow';
     // the workflow endpoint to run
     name: string;
+    /** Title displayed for the child workflow in the workflow builder. */
+    title?: string;
+    /** Description displayed for the child workflow in the workflow builder. */
+    description?: string;
     /**
      * The parameters to pass to the child workflow.
      * These parameters will be merged over the parent workflow vars and passed altogether to the child workflow.

package/src/store/intake-policy-schema.generated.ts

@@ -1407,6 +1407,11 @@ export const ContentTypeIntakePolicySchema: JSONObject = {
                     description:
                         'Provider-defined processing tier. Unknown non-empty values are preserved for forward compatibility.',
                 },
+                extra_body: {
+                    type: 'object',
+                    additionalProperties: true,
+                    description: 'Additional provider-specific fields merged into the OpenAI-compatible request body.',
+                },
             },
             required: ['_option_id'],
             additionalProperties: false,
@@ -1446,6 +1451,11 @@ export const ContentTypeIntakePolicySchema: JSONObject = {
                     description:
                         'Provider-defined processing tier. Unknown non-empty values are preserved for forward compatibility.',
                 },
+                extra_body: {
+                    type: 'object',
+                    additionalProperties: true,
+                    description: 'Additional provider-specific fields merged into the OpenAI-compatible request body.',
+                },
             },
             required: ['_option_id'],
             additionalProperties: false,