Description

Adds types and deserialization for all 16 agent.* events: blueprint (3), instance and instance session (4), and registration (9). The API emits all of them, the OpenAPI spec defines them, and the Go, Python, Ruby, PHP and .NET SDKs already type them. Node had none:

• Their payloads fell through the default branch of deserializeEvent and came back as raw snake_case data.
• EventName rejected the names in listEvents at compile time.
• CreateWebhookEndpointEvents and UpdateWebhookEndpointEvents rejected them in createEndpoint and updateEndpoint.

A customer building on agent registration reported agent.registration.expired, .revoked and .deleted as missing. The blueprint and instance events have the same gap, and the agents module already exposes those APIs.

• Payload types in src/agents/interfaces/agent-event.interface.ts. They follow the vault-event pattern (*EventData / *EventResponseData). The shapes match the api-json-models-zod event schemas that the spec's EventSchema variants are generated from. Where an event payload matches an existing REST model exactly, the REST model is reused.
  • agent.blueprint.created and .updated use AgentBlueprintEventData, which is AgentBlueprint plus invocableAs: { instanceTypes }. The REST model doesn't type that field yet (see Not changed).
  • agent.blueprint.deleted is the slim { object, id, name, createdAt, updatedAt }.
  • agent.instance.created and .deleted reuse AgentInstance and deserializeAgentInstance as they are.
  • agent.instance.session.created and .revoked use AgentInstanceSessionEventData. It differs from the REST AgentInstanceSession: it carries organizationId and has no status. .created adds permissionSlugs, the grant computed at mint time, which no other payload reports.
  • agent.registration.created is the registration with a new AgentRegistrationMethod. This is the event shape, not the REST AgentRegistration. It has no claim, it adds method, and its agentIdentity carries object but no timestamps.
  • agent.registration.claim.attempt.created and .claim.completed carry the claim attempt and the claim (claimedBy: { userId, organizationId }).
  • agent.registration.credential.issued: its detail is a discriminated union on kind: { kind: 'api_key', apiKeyId } or { kind: 'access_token', jti, expiresAt }.
  • agent.registration.organization.switched is { agentRegistrationId, fromOrganizationId, toOrganizationId }.
  • agent.registration.refreshed, .expired, .revoked and .deleted are { agentRegistrationId }. All four share AgentRegistrationLifecycleEventData.
• Event types and deserialization. Sixteen Agent*Event / *EventResponse interfaces are added to the Event / EventResponse unions, so EventName picks them up, with matching cases in deserializeEvent. They sit at the top of each union and of the switch, in spec order, away from the feature-flag entries that feat(feature-flags): Handle all feature flag lifecycle events #1721 edits in the same lists.
• Webhook endpoint subscriptions. The 16 values are added to CreateWebhookEndpointEvents and UpdateWebhookEndpointEvents. Both files carry the oagen header. The values are hand-added in spec enum order under the member names the emitter produces, which PHP and Go already use, so the next regeneration produces no diff for them. This is the same approach as fix(events): Type Pipes connected account events #1686.
• Tests. Two events.spec.ts cases, one for blueprint/instance and one for registration, filter on every event and check the events query parameter. They then deserialize each payload. Both delegated and autonomous instances are covered, as are both credential detail variants and events without context.

The blueprint and instance REST endpoints are behind the agent-blueprints-public-api feature flag in the API, so only environments with that API enabled emit those seven events. The registration endpoints are no longer gated: #71300 removed the GA'd agent-auth flags.

Not changed

• AgentBlueprint lacks invocableAs. The REST AgentBlueprint returned by getAgentBlueprint and listAgentBlueprints still doesn't type invocableAs, even though the spec marks invocable_as as required. The same goes for the create/update options. That's an API-surface change to the agents module, so it's left out here. The blueprint event type adds the field on top of AgentBlueprint, so it stays correct once the REST model catches up.
• Other missing subscription values. The webhook endpoint constants still lack 8 non-agent values the spec has: radar.challenge_created, authentication.reauthentication_succeeded, api_key.updated and five pipes.account_connection.*. A full Node regeneration should bring those in, not this PR.
• Unknown events. Events the SDK doesn't know about still fall through deserializeEvent unchanged.

Documentation

Does this require changes to the WorkOS Docs? E.g. the API Reference or code snippets need updates.

[ ] Yes

This PR needs no docs change. Separately, the events reference lists six of the nine agent registration events and omits expired, revoked and deleted. That's an existing gap in the docs, not in this repo.

🤖 Generated with Claude Code