@vertesia/common 1.6.0-dev.20260923.085325Z → 1.6.0-dev.20261004.085740Z

package/src/workflow-analytics.ts

@@ -23,8 +23,8 @@ export enum AgentEventType {
     TurnEvaluation = 'turn_evaluation',
     /** A user rating on an agent run, emitted by the server when it is recorded */
     Feedback = 'feedback',
-    /** Verdict of the LLM judge on one turn, emitted by the judge workflow */
-    TurnJudgement = 'turn_judgement',
+    /** LLM evaluation verdict for one turn, emitted by the evaluation workflow */
+    TurnLlmEvaluation = 'turn_llm_evaluation',
     /** The stall circuit breaker acted: a corrective was injected, or the loop was stopped */
     StallBreaker = 'stall_breaker',
 }
@@ -244,6 +244,8 @@ interface BaseLlmCallEvent extends BaseAgentEvent {
     attemptNumber?: number;
     /** Error type if failed */
     errorType?: string;
+    /** The interaction run that recorded the call, and its billing event (its `request_id`) */
+    executionRunId?: string;
 }
 
 export interface LlmCallEvent extends BaseLlmCallEvent {}
@@ -442,38 +444,38 @@ export interface FeedbackEvent extends BaseAgentEvent {
     replaced: boolean;
 }
 
-/** Why the judge looked at a run. */
-export type JudgeGateReason = 'signal' | 'sample';
+/** Why a run was selected for LLM evaluation. */
+export type EvaluationGateReason = 'signal' | 'sample' | 'opt_in' | 'always_on';
 
-/** What the judge run produced. */
-export type JudgeOutcome = 'judged' | 'skipped_unarchived' | 'failed';
+/** Outcome of an LLM evaluation run. */
+export type EvaluationOutcome = 'evaluated' | 'skipped_unarchived' | 'failed';
 
-/** The judge's reading of a turn. */
-export type JudgeVerdict = 'success' | 'partial' | 'failure';
+/** LLM evaluation verdict for a turn. */
+export type EvaluationVerdict = 'success' | 'partial' | 'failure';
 
 /**
- * Emitted by the judge workflow for each turn it evaluated (or once with a non-judged outcome).
+ * Emitted by the evaluator workflow for each turn it evaluated (or once with a non-evaluated outcome).
  */
-export interface TurnJudgementEvent extends BaseAgentEvent {
-    eventType: AgentEventType.TurnJudgement;
-    /** Evaluation revision the judge run was started for */
+export interface TurnLlmEvaluationEvent extends BaseAgentEvent {
+    eventType: AgentEventType.TurnLlmEvaluation;
+    /** Evaluation revision the evaluator run was started for */
     evaluationRev: number;
     workstreamId: string;
-    /** Turn judged; 0 when the outcome is not `judged` */
+    /** Turn evaluated; 0 when the outcome is not `evaluated` */
     turnSeq: number;
-    gate: JudgeGateReason;
+    gate: EvaluationGateReason;
     /** Sampling rate in force when the gate was evaluated */
     sampleRate: number;
     /** Probability that this run was selected, for weighted calibration */
     selectedProbability: number;
-    outcome: JudgeOutcome;
-    verdict?: JudgeVerdict;
+    outcome: EvaluationOutcome;
+    verdict?: EvaluationVerdict;
     /** 0..1 */
     score?: number;
     reasons?: string[];
-    /** Version of the judge prompt */
+    /** Version of the evaluator prompt */
     promptVersion: string;
-    /** Detector version of the evaluation the judge was compared against */
+    /** Detector version of the evaluation the evaluator was compared against */
     detectorVersion?: number;
 }
 
@@ -509,7 +511,7 @@ export type AgentEvent =
     | ToolCallEvent
     | TurnEvaluationEvent
     | FeedbackEvent
-    | TurnJudgementEvent
+    | TurnLlmEvaluationEvent
     | StallBreakerEvent;
 
 /**

package/src/agent-resources.test.ts

@@ -1,89 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import { type AgentResourceReference, normalizeAgentResources } from './interaction.js';
-import { AgentMessageType, getResourcesFromMessage } from './store/workflow.js';
-
-const validRef: AgentResourceReference = {
-    type: 'document',
-    id: 'doc-1',
-    label: 'My Document',
-    action: 'created',
-};
-
-describe('normalizeAgentResources', () => {
-    it('returns an empty array for non-array input', () => {
-        expect(normalizeAgentResources(undefined)).toEqual([]);
-        expect(normalizeAgentResources(null)).toEqual([]);
-        expect(normalizeAgentResources('nope')).toEqual([]);
-        expect(normalizeAgentResources({})).toEqual([]);
-    });
-
-    it('keeps a well-formed reference', () => {
-        expect(normalizeAgentResources([validRef])).toEqual([validRef]);
-    });
-
-    it('preserves revision_id when present and non-empty', () => {
-        const ref = { ...validRef, revision_id: 'rev-9' };
-        expect(normalizeAgentResources([ref])).toEqual([ref]);
-    });
-
-    it('drops an empty revision_id rather than keeping it', () => {
-        const result = normalizeAgentResources([{ ...validRef, revision_id: '' }]);
-        expect(result[0]).not.toHaveProperty('revision_id');
-    });
-
-    it('falls back to the id when the label is missing or empty', () => {
-        const result = normalizeAgentResources([{ type: 'collection', id: 'col-1', action: 'updated' }]);
-        expect(result).toEqual([{ type: 'collection', id: 'col-1', label: 'col-1', action: 'updated' }]);
-    });
-
-    it('drops entries with an unknown type or action', () => {
-        const result = normalizeAgentResources([
-            { type: 'artifact', id: 'a', label: 'a', action: 'created' },
-            { type: 'document', id: 'd', label: 'd', action: 'viewed' },
-            { type: 'document', id: '', label: 'd', action: 'created' },
-            validRef,
-        ]);
-        expect(result).toEqual([validRef]);
-    });
-
-    it('accepts every supported resource type', () => {
-        const types = [
-            'document',
-            'collection',
-            'content_type',
-            'interaction',
-            'prompt',
-            'agent',
-            'workflow',
-            'process',
-            'process_run',
-            'interaction_run',
-            'view',
-        ] as const;
-        const input = types.map((type, i) => ({ type, id: `id-${i}`, label: `L${i}`, action: 'created' }));
-        expect(normalizeAgentResources(input)).toHaveLength(types.length);
-    });
-});
-
-describe('getResourcesFromMessage', () => {
-    it('reads resources from message details', () => {
-        const msg = {
-            timestamp: 0,
-            workflow_run_id: 'run-1',
-            type: AgentMessageType.THOUGHT,
-            message: '',
-            details: { event_class: 'activity', resources: [validRef] },
-        };
-        expect(getResourcesFromMessage(msg)).toEqual([validRef]);
-    });
-
-    it('returns an empty array when details or resources are absent', () => {
-        const msg = {
-            timestamp: 0,
-            workflow_run_id: 'run-1',
-            type: AgentMessageType.COMPLETE,
-            message: '',
-        };
-        expect(getResourcesFromMessage(msg)).toEqual([]);
-    });
-});

package/src/api-contract/components.contract.test.ts

@@ -1,99 +0,0 @@
-import { execFileSync } from 'node:child_process';
-import { readFileSync } from 'node:fs';
-import { describe, expect, it } from 'vitest';
-import { buildApiSchemaComponents } from '../api-schemas/registry.js';
-import { ApiSchemaComponents } from './index.js';
-
-/**
- * Guards the two properties that make `components.generated.json` safe to serve from.
- *
- * 1. It is COMPILED OUTPUT, not a second source of truth. The Zod registry remains the authority;
- *    the artifact is its emission. If they diverge, servers enforce a contract the spec no longer
- *    describes — silently, since nothing else compares them.
- * 2. Nothing reachable from the subpath imports zod. That is the entire reason the artifact exists:
- *    building the Zod graph costs ~85 MB of heap in every process that enforces contracts, which is
- *    enough to push a small API process past its memory limit.
- */
-describe('api-contract components artifact', () => {
-    it('matches the Zod registry exactly', { timeout: 30_000 }, () => {
-        // Fails when an API schema was edited without re-running the generator, and equally when the
-        // artifact was regenerated but not committed — a CI checkout then has new Zod against old JSON.
-        // Rebuilding the full registry is CPU-heavy and can exceed Vitest's default timeout under parallel CI.
-        expect(
-            ApiSchemaComponents,
-            'components.generated.json is stale — run `pnpm run gen:schemas` in packages/common',
-        ).toEqual(buildApiSchemaComponents());
-    });
-
-    it('round-trips through JSON without loss', () => {
-        // The artifact is only equivalent to the in-memory emission if every value survives
-        // serialization. An `undefined` property would vanish on write and change the contract.
-        expect(JSON.parse(JSON.stringify(ApiSchemaComponents))).toEqual(ApiSchemaComponents);
-    });
-});
-
-const BUILT_ENTRY = new URL('../../lib/api-contract/index.js', import.meta.url).pathname;
-
-/**
- * Every module Node actually resolves while importing the built subpath.
- *
- * Inspecting the entry file alone is not enough: it imports `adapter.js` and `parameters.js`, and if
- * either ever grows a zod import — directly or through a package of its own — the entry's own text
- * still mentions nothing and a text check passes while the servers load zod again. A `resolve` hook
- * records the real graph, transitively, including everything under `node_modules`.
- *
- * Run in a child process because the hook has to be installed before the first import, and this test
- * file has already imported the registry (and therefore zod) into its own process.
- */
-function resolveRuntimeGraph(entry: string): string[] {
-    const probe = `
-        import { registerHooks } from 'node:module';
-        const resolved = [];
-        registerHooks({
-            resolve(specifier, context, nextResolve) {
-                const result = nextResolve(specifier, context);
-                resolved.push(result.url);
-                return result;
-            },
-        });
-        await import(${JSON.stringify(entry)});
-        console.log(JSON.stringify(resolved));
-    `;
-    const out = execFileSync(process.execPath, ['--input-type=module', '-e', probe], { encoding: 'utf8' });
-    return JSON.parse(out.trim().split('\n').pop() as string) as string[];
-}
-
-const packageOf = (url: string): string | undefined =>
-    url.match(/node_modules\/(?:\.pnpm\/[^/]+\/node_modules\/)?((?:@[^/]+\/)?[^/]+)/)?.[1];
-
-describe('api-contract zod isolation', () => {
-    it('does not reference zod or the Zod registry from the entry file', () => {
-        // `index.ts` imports `ApiComponentName`/`ApiComponentType` from the registry with
-        // `import type`, which tsc elides. Dropping the `type` keyword would compile fine and quietly
-        // pull the whole graph back into every server, so assert on the emitted JavaScript.
-        const emitted = readFileSync(BUILT_ENTRY, 'utf8');
-        for (const marker of ['zod', '_zod', 'ZodObject', 'registry.js']) {
-            expect(emitted, `built api-contract entry must not reference '${marker}'`).not.toContain(marker);
-        }
-    });
-
-    it('loads no zod module anywhere in its transitive runtime graph', () => {
-        const graph = resolveRuntimeGraph(BUILT_ENTRY);
-        // Guards against a vacuous pass: an entry that failed to import, or a hook that recorded
-        // nothing, would otherwise satisfy every assertion below.
-        expect(graph.length, 'resolve hook recorded no modules — the probe did not run').toBeGreaterThan(10);
-
-        const packages = [...new Set(graph.map(packageOf).filter(Boolean))].sort();
-        const offenders = graph.filter((url) => /node_modules\/(?:\.pnpm\/)?zod[@/]/.test(url));
-        expect(
-            offenders,
-            `zod reached the api-contract runtime graph — the ~85 MB object graph is back in every ` +
-                `server that enforces contracts. Packages resolved: ${packages.join(', ')}`,
-        ).toEqual([]);
-
-        expect(
-            graph.filter((url) => /api-schemas\/registry\.js$/.test(url)),
-            'the Zod registry is in the runtime graph — an `import type` lost its `type` keyword',
-        ).toEqual([]);
-    });
-});

package/src/api-schemas/access-control.contract.test.ts

@@ -1,209 +0,0 @@
-import { Ajv2020 } from 'ajv/dist/2020.js';
-import { describe, expect, it } from 'vitest';
-import {
-    type ACECreatePayload,
-    type ACEUpdatePayload,
-    type AccessControlEntry,
-    AccessControlPrincipalType,
-    AccessControlResourceType,
-    Permission,
-} from '../access-control.js';
-import type { RoleDefinition, SystemRoleDefinition } from '../roles/types.js';
-import type {
-    AccessControlEntryArrayFromSchema,
-    RoleDefinitionArrayFromSchema,
-    SystemRoleDefinitionArrayFromSchema,
-} from './access-control.js';
-import type { JsonObject } from './adapter.js';
-import { ApiSchemaComponents, apiComponentRef, validateApiRequest, validateApiResponse } from './registry.js';
-
-/** Exact type identity — `extends` in both directions is too weak (any/unknown slip through). */
-type Equals<A, B> = (<T>() => T extends A ? 1 : 2) extends <T>() => T extends B ? 1 : 2 ? true : false;
-function assertType<T extends true>(_ok: T): void {}
-
-function compile(name: string) {
-    const ajv = new Ajv2020({ strictSchema: false, allErrors: true });
-    ajv.addSchema({ $id: 'vertesia://openapi', components: { schemas: ApiSchemaComponents } });
-    return ajv.compile({ $ref: `vertesia://openapi${apiComponentRef(name as never)}` });
-}
-
-const VALID_ACE = {
-    id: 'ace1',
-    role: 'owner',
-    resource_type: AccessControlResourceType.account,
-    resource: '68b1779130afe5403a1589ba',
-    principal_type: AccessControlPrincipalType.user,
-    principal: '68b1779130afe5403a1589bb',
-};
-
-const VALID_ROLE = { name: 'owner', permissions: ['account:admin'], domain: 'system' };
-
-describe('gate 1 — the schema is the single source of truth for the public access-control types', () => {
-    it('publishes the exact schema-derived type, not a hand-written twin', () => {
-        assertType<Equals<AccessControlEntryArrayFromSchema, AccessControlEntry[]>>(true);
-        assertType<Equals<RoleDefinitionArrayFromSchema, RoleDefinition[]>>(true);
-        assertType<Equals<SystemRoleDefinitionArrayFromSchema, SystemRoleDefinition[]>>(true);
-        expect(true).toBe(true);
-    });
-
-    it('derives both ACE payloads from the entry rather than restating ten fields', () => {
-        // `ACECreatePayload extends Omit<AccessControlEntry, 'created_at' | 'updated_at' | 'id'>` is
-        // what the hand-written type said; `.omit()` is the literal translation, and the right
-        // operator when the derived shape is almost everything.
-        assertType<Equals<ACECreatePayload['role'], AccessControlEntry['role']>>(true);
-        assertType<Equals<ACECreatePayload['conditions'], AccessControlEntry['conditions']>>(true);
-        assertType<Equals<ACEUpdatePayload['role'], string | undefined>>(true);
-        // The three server-owned fields are what the omit leaves behind.
-        assertType<Equals<Extract<keyof ACECreatePayload, 'id' | 'created_at' | 'updated_at'>, never>>(true);
-        expect(true).toBe(true);
-    });
-
-    it('narrows permissions on the system role view without restating the shape', () => {
-        // `.extend()` overriding one property, which is what `interface SystemRoleDefinition extends
-        // RoleDefinition` did. Overriding keeps the property's position, so the published order holds.
-        assertType<Equals<SystemRoleDefinition['name'], RoleDefinition['name']>>(true);
-        assertType<Equals<SystemRoleDefinition['domain'], RoleDefinition['domain']>>(true);
-        assertType<Equals<RoleDefinition['permissions'], string[]>>(true);
-        // `SystemRoleDefinition['permissions']` is `Permission[]` — asserted by assignment in both
-        // directions rather than by `Equals`, which distinguishes an enum type from the union of its
-        // members even though tsc reports them under the same name.
-        const fromEnum: SystemRoleDefinition['permissions'] = [Permission.account_admin];
-        const toEnum: Permission[] = fromEnum;
-        // And it is genuinely narrower than the base component: an ABAC role name is a valid
-        // `RoleDefinition` permission and not a valid system one.
-        const abac: RoleDefinition['permissions'] = ['content:reader'];
-        // @ts-expect-error 'content:reader' is not a Permission
-        const rejected: SystemRoleDefinition['permissions'] = abac;
-        expect([toEnum, rejected]).toEqual([['account:admin'], ['content:reader']]);
-    });
-});
-
-describe('gate 2 — the published components match the closure the types come from', () => {
-    it('keeps the enums as shared components rather than inlining them per property', () => {
-        // A named component becomes ONE reusable Java/Go enum; an inline copy becomes an anonymous
-        // type per property. These names are already in the published document, so keeping them is
-        // also what avoids a breaking rename for everyone generating from it.
-        const props = ApiSchemaComponents.AccessControlEntry.properties as Record<string, JsonObject>;
-        expect(props.resource_type).toEqual({ $ref: '#/components/schemas/AccessControlResourceType' });
-        expect(props.principal_type).toEqual({ $ref: '#/components/schemas/AccessControlPrincipalType' });
-        expect(ApiSchemaComponents.AccessControlResourceType.enum).toContain('content_set');
-        expect(ApiSchemaComponents.Permission.enum).toContain('account:admin');
-    });
-
-    it('closes AceConditions, which the display-name fields would otherwise slip through', () => {
-        // Listed in STRICT_COMPONENTS by name: it is a hoisted component, so the parent entry's
-        // strict policy does not reach it.
-        expect(ApiSchemaComponents.AceConditions.additionalProperties).toBe(false);
-        expect(Object.keys(ApiSchemaComponents.AceConditions.properties as JsonObject)).toEqual([
-            'principal_props',
-            'resource_props',
-            'scope',
-        ]);
-    });
-
-    it('publishes PropertyConditions as the map it is', () => {
-        // It used to be a `$ref` to a synthesized `PropertyConditionValueMap` — an artifact of
-        // deriving a `Record<>` alias through a second alias. The indirection is gone; the value
-        // schema is still its own component so the "deliberately unconstrained" statement has one
-        // place to live.
-        expect(ApiSchemaComponents.PropertyConditions.additionalProperties).toEqual({
-            $ref: '#/components/schemas/PropertyConditionValue',
-        });
-        expect(Object.keys(ApiSchemaComponents)).not.toContain('PropertyConditionValueMap');
-    });
-
-    it('leaves the ACE timestamps as plain strings', () => {
-        // Deliberately NOT tightened to `format: date-time` the way User and UserGroup were:
-        // `expires_at` shares the declaration and is written straight from a payload, so a stored
-        // value AJV would now reject is a real possibility rather than a hypothetical one.
-        const props = ApiSchemaComponents.AccessControlEntry.properties as Record<string, JsonObject>;
-        expect(props.created_at).toEqual({ type: 'string' });
-        expect(props.expires_at).toEqual({ type: 'string' });
-    });
-});
-
-describe('gate 3 — AJV validates the same canonical objects that are published', () => {
-    it('accepts a minimal entry and rejects a missing required field', () => {
-        const validate = compile('AccessControlEntry');
-        expect(validate(VALID_ACE)).toBe(true);
-        const { principal: _dropped, ...incomplete } = VALID_ACE;
-        expect(validate(incomplete)).toBe(false);
-    });
-
-    it('rejects the display names the sub-document holds but the contract does not declare', () => {
-        const validate = compile('AccessControlEntry');
-        expect(validate({ ...VALID_ACE, conditions: { principal_props: { team: 'eng' } } })).toBe(true);
-        expect(validate({ ...VALID_ACE, conditions: { principal_name: 'Engineering staff' } })).toBe(false);
-        expect(validate({ ...VALID_ACE, conditions: { resource_name: 'Confidential docs' } })).toBe(false);
-    });
-
-    it('rejects the internal fields a serialized document would have leaked', () => {
-        const validate = compile('AccessControlEntry');
-        expect(validate({ ...VALID_ACE, _id: 'deadbeef' })).toBe(false);
-        expect(validate({ ...VALID_ACE, type: 'legacy' })).toBe(false);
-    });
-
-    it('accepts any condition value, which is the point of leaving it unconstrained', () => {
-        const validate = compile('AccessControlEntry');
-        for (const value of [5, 'engineering', { $gte: 5 }, ['us-east'], '$principal.access_level', null]) {
-            expect(validate({ ...VALID_ACE, conditions: { resource_props: { key: value } } })).toBe(true);
-        }
-    });
-
-    it('requires the five identifying fields on a create payload and none on an update', () => {
-        const create = compile('ACECreatePayload');
-        const { id: _id, ...payload } = VALID_ACE;
-        expect(create(payload)).toBe(true);
-        // `id` and the timestamps are server-owned; the closed payload rejects them outright.
-        expect(create(VALID_ACE)).toBe(false);
-        expect(create({ role: 'owner' })).toBe(false);
-
-        const update = compile('ACEUpdatePayload');
-        expect(update({})).toBe(true);
-        expect(update({ role: 'reader' })).toBe(true);
-        expect(update({ rogue_field: 1 })).toBe(false);
-    });
-
-    it('constrains a system role to the Permission enum and a plain role to any string', () => {
-        expect(compile('RoleDefinition')(VALID_ROLE)).toBe(true);
-        expect(compile('RoleDefinition')({ ...VALID_ROLE, permissions: ['content:reader'] })).toBe(true);
-        expect(compile('SystemRoleDefinition')(VALID_ROLE)).toBe(true);
-        // 'content:reader' is an ABAC role name, not a Permission — which is exactly the distinction
-        // the two components exist to draw.
-        expect(compile('SystemRoleDefinition')({ ...VALID_ROLE, permissions: ['content:reader'] })).toBe(false);
-        expect(compile('RoleDefinition')({ ...VALID_ROLE, domain: 'billing' })).toBe(false);
-    });
-});
-
-describe('gate 4 — runtime enforcement uses the published components', () => {
-    it('checks every member of a listing against the same entry component', () => {
-        expect(validateApiResponse('AccessControlEntryArray', [VALID_ACE, VALID_ACE]).valid).toBe(true);
-        expect(validateApiResponse('AccessControlEntryArray', []).valid).toBe(true);
-        // One entry still carrying its display name is what the unmapped listing would have produced.
-        const leaked = { ...VALID_ACE, conditions: { principal_name: 'Everyone' } };
-        expect(validateApiResponse('AccessControlEntryArray', [VALID_ACE, leaked]).valid).toBe(false);
-    });
-
-    it('rejects an undeclared update field without removing it', () => {
-        const payload: Record<string, unknown> = { role: 'reader', rogue_field: 42 };
-        const result = validateApiRequest('ACEUpdatePayload', payload);
-        expect(result.valid).toBe(false);
-        expect(payload.rogue_field).toBe(42);
-    });
-
-    it('hands back the component type on the valid branch', () => {
-        const result = validateApiResponse('AccessControlEntry', VALID_ACE);
-        expect(result.valid).toBe(true);
-        if (result.valid) {
-            assertType<Equals<typeof result.data, AccessControlEntry>>(true);
-        }
-    });
-
-    it('checks the role listings against their own components', () => {
-        expect(validateApiResponse('RoleDefinitionArray', [VALID_ROLE]).valid).toBe(true);
-        expect(validateApiResponse('SystemRoleDefinitionArray', [VALID_ROLE]).valid).toBe(true);
-        expect(validateApiResponse('RoleDefinitionArray', [{ ...VALID_ROLE, domain: 'system', extra: 1 }]).valid).toBe(
-            false,
-        );
-    });
-});

package/src/api-schemas/account-apikey.test.ts

@@ -1,60 +0,0 @@
-import { describe, expect, it } from 'vitest';
-import { ApiSchemaComponents } from '../api-contract/index.js';
-import {
-    AccountApiKeySchema,
-    AccountApiKeyWithValueSchema,
-    ApiKeySchema,
-    CreateAccountApiKeyPayloadSchema,
-    UpdateAccountApiKeyPayloadSchema,
-} from './apikey.js';
-import { validateApiRequest } from './registry.js';
-
-describe('separate account-key wire contract', () => {
-    const metadata = {
-        id: 'key',
-        name: 'IdP',
-        account: 'account',
-        scope: 'account',
-        profile: 'account_admin_v1',
-        enabled: true,
-        maskedValue: 'sk-…',
-        created_at: '2026-09-15T00:00:00Z',
-        updated_at: '2026-09-15T00:00:00Z',
-        created_by: 'user:admin',
-        updated_by: 'user:admin',
-    };
-    it('requires account scope/profile without weakening the project-key contract', () => {
-        expect(AccountApiKeySchema.safeParse(metadata).success).toBe(true);
-        expect(AccountApiKeySchema.safeParse({ ...metadata, profile: 'other' }).success).toBe(false);
-        expect(ApiKeySchema.safeParse(metadata).success).toBe(false);
-        expect(AccountApiKeyWithValueSchema.safeParse(metadata).success).toBe(false);
-        expect(AccountApiKeyWithValueSchema.safeParse({ ...metadata, value: 'test-secret' }).success).toBe(true);
-    });
-    it('publishes strict management payloads and metadata without a value or project property', () => {
-        const components = ApiSchemaComponents as Record<
-            string,
-            { additionalProperties?: boolean; properties?: Record<string, unknown>; required?: string[] }
-        >;
-        for (const name of ['AccountApiKey', 'CreateAccountApiKeyPayload', 'UpdateAccountApiKeyPayload']) {
-            expect(components[name].additionalProperties).toBe(false);
-            expect(components[name].properties).not.toHaveProperty('value');
-            expect(components[name].properties).not.toHaveProperty('project');
-        }
-        expect(components.ApiKey.required).toContain('project');
-    });
-});
-
-// AJV enforces emitted JSON Schema; Zod trimming alone cannot reject whitespace at the API boundary.
-describe.each([
-    ['CreateAccountApiKeyPayload', CreateAccountApiKeyPayloadSchema],
-    ['UpdateAccountApiKeyPayload', UpdateAccountApiKeyPayloadSchema],
-] as const)('%s name validation', (component, schema) => {
-    it.each(['', '   ', '\t\n ', '\u00a0'])('rejects blank name %j in Zod and AJV', (name) => {
-        expect(schema.safeParse({ name }).success).toBe(false);
-        expect(validateApiRequest(component, { name }).valid).toBe(false);
-    });
-    it.each(['IdP provisioning', '  IdP provisioning  '])('accepts nonblank name %j in both validators', (name) => {
-        expect(schema.safeParse({ name }).success).toBe(true);
-        expect(validateApiRequest(component, { name }).valid).toBe(true);
-    });
-});