@vertesia/common 1.6.0-dev.20260918.115658Z → 1.6.0-dev.20260923.085325Z

package/src/api-schemas/account.ts

@@ -2,6 +2,7 @@ import { z } from 'zod';
 // From the values module, never from `user.ts`: `user.ts` derives its public types from the schemas
 // below, so importing it here would invert the dependency and make the source of truth circular.
 import { ACCOUNT_APP_ACCESS_MESSAGE_MAX_LENGTH, AccountType, BillingMethod, QuotaTier } from '../account-values.js';
+import { ApiVersions } from '../versions.js';
 
 /**
  * Runtime API schemas for the Accounts endpoints.
@@ -144,3 +145,10 @@ export type AccountBillingFromSchema = z.infer<typeof AccountBillingSchema>;
 export type AccountFromSchema = z.infer<typeof AccountSchema>;
 export type UpdateAccountPayloadFromSchema = z.infer<typeof UpdateAccountPayloadSchema>;
 export type StripeBillingStatusResponseFromSchema = z.infer<typeof StripeBillingStatusResponseSchema>;
+
+/** Account-wide defaults for request API version negotiation. */
+export const AccountApiVersionPolicySchema = z
+    .strictObject({
+        default_api_version: z.enum(ApiVersions).optional(),
+    })
+    .meta({ id: 'AccountApiVersionPolicy' });

package/src/api-schemas/app-lifecycle.ts

@@ -40,6 +40,13 @@ export const UpdateAppInstallationToolAllowlistPayloadSchema = z
     })
     .meta({ id: 'UpdateAppInstallationToolAllowlistPayload' });
 
+export const UpdateAppInstallationOAuthApprovalPayloadSchema = z
+    .strictObject({ approved_scopes: z.array(z.string().min(1)).max(200) })
+    .meta({
+        id: 'UpdateAppInstallationOAuthApprovalPayload',
+        description: 'Approve OAuth scopes for this project installation. An empty list revokes project approval.',
+    });
+
 export const ValidateUrlResponseSchema = z
     .strictObject({
         valid: z.boolean(),
@@ -405,6 +412,10 @@ export const StartAppScaffoldRequestSchema = z
         title: z.string().optional(),
         description: z.string().optional(),
         modules: z.array(AppScaffoldModuleSchema).optional(),
+        oauth_scopes: z
+            .array(z.string())
+            .optional()
+            .meta({ description: 'App permissions declared in generated source. Defaults to sign-in only.' }),
         appgen_package_spec: z
             .string()
             .regex(APPGEN_PACKAGE_SPEC_PATTERN)

package/src/api-schemas/app-runtime.ts

@@ -256,11 +256,18 @@ export const InCodeProcessDefinitionSchema: z.ZodType<InCodeProcessDefinition> =
     })
     .meta({ id: 'InCodeProcessDefinition' });
 
+const appOAuthApprovalSchema = z.strictObject({
+    scopes: z.array(z.string()),
+    approved_by: z.string(),
+    approved_at: z.string(),
+});
+
 export const AppInstallationSchema = z
     .strictObject({
         id: z.string(),
         project: z.string(),
         manifest: z.string(),
+        oauth_approval: appOAuthApprovalSchema.optional(),
         settings: z.looseObject({}).optional(),
         tool_allowlist: z
             .array(z.string())
@@ -331,6 +338,7 @@ export const AppDashboardDefinitionSchema = z
 
 export const AppManifestDataSchema = z
     .strictObject({
+        oauth_scopes: z.array(z.string()).optional(),
         name: z.string().meta({
             description: 'The name of the app, used as the id in the system. Must be in kebab case (e.g. my-app).',
         }),
@@ -511,6 +519,7 @@ export const CompositeAppMessageOverridesSchema = z
 
 export const AppManifestSchema = z
     .strictObject({
+        oauth_scopes: z.array(z.string()).optional(),
         edit_revision: EditRevisionSchema,
         name: z.string().meta({
             description: 'The name of the app, used as the id in the system. Must be in kebab case (e.g. my-app).',
@@ -630,6 +639,7 @@ export const AppInstallationWithManifestSchema = z
     .strictObject({
         id: z.string(),
         project: z.string(),
+        oauth_approval: appOAuthApprovalSchema.optional(),
         settings: z.looseObject({}).optional(),
         tool_allowlist: z
             .array(z.string())
@@ -675,6 +685,7 @@ export const AppInstallationListEntrySchema = z
     .strictObject({
         id: z.string(),
         project: z.string(),
+        oauth_approval: appOAuthApprovalSchema.optional(),
         settings: z.looseObject({}).optional(),
         tool_allowlist: z
             .array(z.string())
@@ -911,6 +922,10 @@ export const AppEventSubscriptionDefinitionSchema = z
 
 export const AppPackageSchema = z
     .strictObject({
+        oauth_scopes: z
+            .array(z.string())
+            .meta({ description: 'OAuth scopes requested by the app. Users must consent to project permissions.' })
+            .optional(),
         ui: AppUIConfigSchema.meta({ description: 'The UI configuration of the app' }).optional(),
         tools: z
             .array(AgentToolDefinitionSchema)

package/src/api-schemas/interaction.ts

@@ -488,6 +488,7 @@ export const InteractionPublishPayloadSchema = z
 
 export const InteractionForkPayloadSchema = z
     .strictObject({
+        newName: z.string().optional(),
         keepTags: z.boolean().optional(),
         forkPrompts: z.boolean().optional(),
         targetProject: z.string().optional(),

package/src/api-schemas/llumiverse.contract.test.ts

@@ -1,4 +1,5 @@
 import type { JSONSchema, ModelOptions } from '@llumiverse/common';
+import { ModelOptionsSchema } from '@llumiverse/common/schemas';
 import { Ajv2020 } from 'ajv/dist/2020.js';
 import { describe, expect, it } from 'vitest';
 import type { JsonObject } from './adapter.js';
@@ -19,36 +20,12 @@ function compile(name: string) {
     return ajv.compile({ $ref: `vertesia://openapi${apiComponentRef(name as never)}` });
 }
 
-const UNION_MEMBERS = [
-    'TextFallbackOptions',
-    'AzureFoundryChatOptions',
-    'ImagenOptions',
-    'VertexAIClaudeOptions',
-    'VertexAIGeminiOptions',
-    'VertexAIGeminiOmniVideoOptions',
-    'VertexAIGrokOptions',
-    'NovaCanvasOptions',
-    'BedrockConverseOptions',
-    'BedrockNovaOptions',
-    'BedrockMistralOptions',
-    'BedrockAI21Options',
-    'BedrockCohereCommandOptions',
-    'BedrockClaudeOptions',
-    'BedrockPalmyraOptions',
-    'BedrockGptOssOptions',
-    'TwelvelabsPegasusOptions',
-    'BedrockMantleResponsesOptions',
-    'BedrockMantleChatCompletionsOptions',
-    'BedrockMantleClaudeOptions',
-    'OpenAiThinkingOptions',
-    'OpenAiTextOptions',
-    'OpenRouterTextOptions',
-    'OpenAiDalleOptions',
-    'OpenAiGptImageOptions',
-    'XAIGrokImageOptions',
-    'GroqOptions',
-    'MistralTextOptions',
-];
+// Follow the canonical union; do not maintain a second provider membership list here.
+const UNION_MEMBERS = ModelOptionsSchema.options.map((schema) => {
+    const id = schema.meta()?.id;
+    if (!id) throw new Error('Model option schemas must declare a component id');
+    return id;
+});
 
 describe('the ModelOptions closure is published whole and enforced closed', () => {
     it('hoists every union member and enum into its own component', () => {
@@ -60,18 +37,29 @@ describe('the ModelOptions closure is published whole and enforced closed', () =
         }
     });
 
-    it('publishes a discriminator whose mapping covers every member', () => {
-        const union = ApiSchemaComponents.ModelOptions as JsonObject & {
-            oneOf: { $ref: string }[];
-            discriminator: { propertyName: string; mapping: Record<string, string> };
-        };
-        expect(union.discriminator.propertyName).toBe('_option_id');
-        expect(union.oneOf.map((member) => member.$ref)).toEqual(
+    it('publishes every optional-ID family as anyOf, without a required discriminator', () => {
+        const union = ApiSchemaComponents.ModelOptions as JsonObject & { anyOf: { $ref: string }[] };
+        expect(union.discriminator).toBeUndefined();
+        expect(union.oneOf).toBeUndefined();
+        expect(union.required ?? []).not.toContain('_option_id');
+        expect(union.anyOf.map((member) => member.$ref)).toEqual(
             UNION_MEMBERS.map((name) => `#/components/schemas/${name}`),
         );
-        // A mapping short of the `oneOf` is the failure that matters: a generated Java or Go client
-        // reads the mapping to pick the concrete subtype and falls back to a loose map without it.
-        expect(new Set(Object.values(union.discriminator.mapping))).toEqual(new Set(union.oneOf.map((m) => m.$ref)));
+        for (const name of UNION_MEMBERS) {
+            expect((ApiSchemaComponents[name] as JsonObject).required ?? [], name).not.toContain('_option_id');
+        }
+    });
+
+    it.each([
+        {},
+        { temperature: 0.2, max_tokens: 1024 },
+        { cache_enabled: true, cache_ttl: '1h', thinking_budget_tokens: 1024 },
+        { extra_body: { provider_extension: true } },
+    ] satisfies ModelOptions[])('accepts untagged options through the run request contract: %j', (model_options) => {
+        const payload = { interaction: 'Chat', config: { model: 'claude-sonnet-4-6', model_options } };
+        expect(validateApiRequest('RunCreatePayload', payload).valid).toBe(true);
+        expect(payload.config.model_options).not.toHaveProperty('_option_id');
+        expect(compile('ModelOptions')(model_options)).toBe(true);
     });
 
     it('enforces the closure it documents — an undeclared option is rejected, not ignored', () => {
@@ -106,6 +94,48 @@ describe('the ModelOptions closure is published whole and enforced closed', () =
         expect(validate({ _option_id: 'openai-text', extra_body: ['not-an-object'] })).toBe(false);
     });
 
+    it('accepts Anthropic options through the run request contract', () => {
+        const payload = {
+            interaction: 'Chat',
+            config: {
+                model: 'claude-sonnet-4-6',
+                model_options: {
+                    _option_id: 'anthropic-claude',
+                    effort: 'high',
+                    cache_enabled: true,
+                    cache_ttl: '1h',
+                },
+            },
+        };
+        expect(validateApiRequest('RunCreatePayload', payload).valid).toBe(true);
+        expect(
+            validateApiRequest('RunCreatePayload', {
+                ...payload,
+                config: { ...payload.config, model_options: { ...payload.config.model_options, cache_ttl: '2h' } },
+            }).valid,
+        ).toBe(false);
+    });
+
+    it.each([
+        { _option_id: 'bedrock-nova', top_k: 12 },
+        { _option_id: 'bedrock-mistral', top_k: 12 },
+        { _option_id: 'bedrock-ai21', presence_penalty: 0.4, frequency_penalty: 0.2 },
+        { _option_id: 'bedrock-cohere-command', top_k: 12, presence_penalty: 0.4, frequency_penalty: 0.2 },
+        { _option_id: 'bedrock-mantle-responses', effort: 'max', reasoning_effort: 'max' },
+        { _option_id: 'vertexai-imagen', person_generation: 'allow_adult', mask_class: [0, 42] },
+        { _option_id: 'vertexai-imagen', person_generation: 'allow_adults' },
+        { _option_id: 'bedrock-nova-canvas', taskType: 'OUTPAINTING', outPaintingMode: 'DEFAULT' },
+    ] satisfies ModelOptions[])('accepts restored provider options: %j', (model_options) => {
+        const payload = { interaction: 'Chat', config: { model: 'model', model_options } };
+        expect(validateApiRequest('RunCreatePayload', payload).valid).toBe(true);
+        expect(
+            validateApiRequest('RunCreatePayload', {
+                ...payload,
+                config: { ...payload.config, model_options: { ...model_options, unknown_option: true } },
+            }).valid,
+        ).toBe(false);
+    });
+
     it('accepts Gemini Omni task and resolution options through the run request contract', () => {
         const result = validateApiRequest('RunCreatePayload', {
             interaction: 'GenerateVideo',

package/src/api-schemas/oauth-server.ts

@@ -83,6 +83,7 @@ const oauthAuthorizeQueryFields = {
     state: z.string().optional(),
     code_challenge: z.string(),
     code_challenge_method: z.literal('S256'),
+    account_id: z.string().optional(),
     project_id: z.string().optional(),
 };
 
@@ -92,9 +93,21 @@ export const CreateOAuthAuthorizationRequestPayloadSchema = z
     .strictObject(oauthAuthorizeQueryFields)
     .meta({ id: 'CreateOAuthAuthorizationRequestPayload' });
 
+export const OAuthAuthorizationRequestGeneratedAppSchema = z
+    .strictObject({
+        tenant_id: z.string(),
+        app_name: z.string(),
+        version_id: z.string().optional(),
+    })
+    .meta({ id: 'OAuthAuthorizationRequestGeneratedApp' });
+
 export const OAuthAuthorizationRequestSchema = z
     .strictObject({
         request_id: z.string(),
+        user_code: z.string().optional().meta({
+            description:
+                'User-visible device code to compare with the terminal before approving. Never the secret device_code.',
+        }),
         client_id: z.string(),
         client_name: z.string(),
         client_metadata: OAuthClientDisplayMetadataSchema.optional(),
@@ -104,7 +117,9 @@ export const OAuthAuthorizationRequestSchema = z
         resource: z.string().optional(),
         requested_scopes: z.array(z.string()),
         optional_scopes: z.array(z.string()).optional(),
+        requested_account_id: z.string().optional(),
         requested_project_id: z.string().optional(),
+        generated_app: OAuthAuthorizationRequestGeneratedAppSchema.optional(),
         project_binding_mode: OAuthProjectBindingModeSchema,
         fixed_project_id: z.string().optional(),
         restrict_to_owner_account: z.boolean().optional().meta({
@@ -370,3 +385,24 @@ export const OAuthGrantRevokeResponseSchema = z
         revoked_consents: z.number(),
     })
     .meta({ id: 'OAuthGrantRevokeResponse' });
+
+export const OAuthLoginPayloadSchema = z
+    .strictObject({
+        id_token: z.string().min(1),
+        account_id: z.string().optional(),
+        project_id: z.string().optional(),
+    })
+    .meta({ id: 'OAuthLoginPayload' });
+export const OAuthLoginDecisionResponseSchema = z
+    .strictObject({
+        redirect_url: z.string().optional(),
+        consent_url: z.string().optional(),
+    })
+    .meta({ id: 'OAuthLoginDecisionResponse' });
+
+export const OAuthLoginUserNotFoundResponseSchema = z
+    .strictObject({
+        error: z.literal('user_not_found'),
+        ensure_user_url: z.string(),
+    })
+    .meta({ id: 'OAuthLoginUserNotFoundResponse' });

package/src/api-schemas/project-configuration.ts

@@ -460,6 +460,12 @@ export const ProjectConfigurationSchema = z
                     "'de'). Determines which Elasticsearch analyzer is used for the text field. Defaults to 'en' " +
                     '(English/standard analyzer).\n\nChanging this value requires a full reindex to take effect.',
             }),
+        oauth_clients: z
+            .strictObject({
+                external_clients: z.enum(['allow_all', 'allowlist']).optional(),
+                allowed_origins: z.array(z.string()).optional(),
+            })
+            .optional(),
         browser_use: BrowserUseProjectConfigurationSchema.optional().meta({
             description: 'Project defaults and caps for browser_use agent workstreams.',
         }),

package/src/api-schemas/project.contract.test.ts

@@ -242,6 +242,21 @@ describe('gate 2 — the closure is closed, bottom-up', () => {
         expect(SYSTEM_INTERACTION_CATEGORIES.ContentSearchReranker).toBe(SystemInteractionCategory.analysis);
     });
 
+    it('uses the agent model default for every app development agent', () => {
+        // Each is launched in-code without an environment or model of its own, so an uncategorised
+        // one silently resolves to the project BASE default instead of the agent default.
+        for (const endpoint of [
+            'AppDevelopmentOrchestrator',
+            'AppSolutionArchitect',
+            'AppDesigner',
+            'AppDeveloper',
+            'AppReviewer',
+            'AppTester',
+        ]) {
+            expect(SYSTEM_INTERACTION_CATEGORIES[endpoint]).toBe(SystemInteractionCategory.agent);
+        }
+    });
+
     it('publishes the property-mapping map without the propertyNames z.record adds', () => {
         // `Record<string, ProjectSearchPropertyMapping>` is inline in the interface and has no
         // TypeScript name, so it never becomes a canonical alias — it stays canonical AND derived,

package/src/api-schemas/prompt.ts

@@ -34,6 +34,7 @@ export const PromptTemplateInteractionVersionSchema = z
 
 export const PromptTemplateForkPayloadSchema = z
     .strictObject({
+        newName: z.string().optional(),
         keepTags: z.boolean().optional(),
         targetProject: z.string().optional(),
     })

package/src/api-schemas/registry-groups.test.ts

@@ -1,5 +1,6 @@
-import { describe, expect, it } from 'vitest';
+import { describe, expect, expectTypeOf, it } from 'vitest';
 import { z } from 'zod';
+import type { NamedInteractionExecutionPayloadSchema } from './interaction.js';
 import { type ApiComponentName, type ApiComponentType, ApiSchemaComponents, mergeComponentGroups } from './registry.js';
 
 /**
@@ -30,6 +31,13 @@ type ResolvedName<N extends ApiComponentName> = [ApiComponentType<N>] extends [n
  * merge actually refuses, which no import of a correct registry can show.
  */
 describe('mergeComponentGroups', () => {
+    it('preserves execution payload types and rejects unregistered component names', () => {
+        expectTypeOf<ApiComponentType<'NamedInteractionExecutionPayload'>>().toEqualTypeOf<
+            z.infer<typeof NamedInteractionExecutionPayloadSchema>
+        >();
+        expectTypeOf<'UnregisteredExecutionComponent'>().not.toMatchTypeOf<ApiComponentName>();
+    });
+
     const A = z.strictObject({ a: z.string() });
     const B = z.strictObject({ b: z.number() });
 

package/src/api-schemas/registry.ts

@@ -77,7 +77,12 @@ import {
     RoleDefinitionArraySchema,
     SystemRoleDefinitionArraySchema,
 } from './access-control.js';
-import { AccountSchema, StripeBillingStatusResponseSchema, UpdateAccountPayloadSchema } from './account.js';
+import {
+    AccountApiVersionPolicySchema,
+    AccountSchema,
+    StripeBillingStatusResponseSchema,
+    UpdateAccountPayloadSchema,
+} from './account.js';
 import { type JsonObject, toOpenApiComponents } from './adapter.js';
 import * as AgentCommunicationSchemas from './agent-communication.js';
 import * as AgentRunSchemas from './agent-runs.js';
@@ -175,6 +180,7 @@ import {
     StartAppScaffoldResponseSchema,
     StoredTypeRefSchema,
     SystemPackageQuerySchema,
+    UpdateAppInstallationOAuthApprovalPayloadSchema,
     UpdateAppInstallationToolAllowlistPayloadSchema,
     UpsertAppVersionRequestSchema,
     ValidateUrlRequestSchema,
@@ -630,6 +636,7 @@ import {
     CreateOAuthClientPayloadSchema,
     ListOAuthGrantsQuerySchema,
     OAuthAuthorizationDecisionResponseSchema,
+    OAuthAuthorizationRequestGeneratedAppSchema,
     OAuthAuthorizationRequestSchema,
     OAuthAuthorizationRequestStatusSchema,
     OAuthAuthorizationServerMetadataSchema,
@@ -652,6 +659,9 @@ import {
     OAuthGrantSortOrderSchema,
     OAuthGrantStatusSchema,
     OAuthGrantTypeSchema,
+    OAuthLoginDecisionResponseSchema,
+    OAuthLoginPayloadSchema,
+    OAuthLoginUserNotFoundResponseSchema,
     OAuthProjectBindingModeSchema,
     OAuthRegistrationSourceSchema,
     OAuthResponseTypeSchema,
@@ -833,6 +843,7 @@ import * as WorkflowRunSchemas from './workflow-runs.js';
  * group approaches the proven-safe size.
  */
 const IAM_AND_ACCOUNT_SCHEMAS = {
+    AccountApiVersionPolicy: AccountApiVersionPolicySchema,
     Account: AccountSchema,
     UpdateAccountPayload: UpdateAccountPayloadSchema,
     StripeBillingStatusResponse: StripeBillingStatusResponseSchema,
@@ -975,6 +986,10 @@ const OAUTH_SCHEMAS = {
     OAuthAuthorizeQuery: OAuthAuthorizeQuerySchema,
     CreateOAuthAuthorizationRequestPayload: CreateOAuthAuthorizationRequestPayloadSchema,
     OAuthAuthorizationRequest: OAuthAuthorizationRequestSchema,
+    OAuthAuthorizationRequestGeneratedApp: OAuthAuthorizationRequestGeneratedAppSchema,
+    OAuthLoginPayload: OAuthLoginPayloadSchema,
+    OAuthLoginUserNotFoundResponse: OAuthLoginUserNotFoundResponseSchema,
+    OAuthLoginDecisionResponse: OAuthLoginDecisionResponseSchema,
     ApproveOAuthAuthorizationRequestPayload: ApproveOAuthAuthorizationRequestPayloadSchema,
     OAuthGrantableScopesResponse: OAuthGrantableScopesResponseSchema,
     OAuthAuthorizationDecisionResponse: OAuthAuthorizationDecisionResponseSchema,
@@ -1216,7 +1231,55 @@ const AGENT_CONVERSATION_SCHEMAS = {
     ConversationState: ConversationStateSchema,
 } as const satisfies Record<string, z.ZodType>;
 
-const EXECUTION_RUN_SCHEMAS = {
+// Reference schema types by name to keep declaration output bounded without erasing payload types.
+type ExecutionRunSchemaMap = {
+    ExecutionRunStatus: typeof ExecutionRunStatusSchema;
+    RunSourceTypes: typeof RunSourceTypesSchema;
+    RunSource: typeof RunSourceSchema;
+    ExecutionRunDocRef: typeof ExecutionRunDocRefSchema;
+    ExecutionRunWorkflow: typeof ExecutionRunWorkflowSchema;
+    ExecutionRunInteraction: typeof ExecutionRunInteractionSchema;
+    ExecutionRun: typeof ExecutionRunSchema;
+    ExecutionRunRef: typeof ExecutionRunRefSchema;
+    ExecutionRunRefArray: typeof ExecutionRunRefArraySchema;
+    UpdateExecutionRunPayload: typeof UpdateExecutionRunPayloadSchema;
+    RunCreatePayload: typeof RunCreatePayloadSchema;
+    SortOrder: typeof SortOrderSchema;
+    SortOption: typeof SortOptionSchema;
+    RunSearchQuery: typeof RunSearchQuerySchema;
+    RunListQuery: typeof RunListQuerySchema;
+    RunSearchPayload: typeof RunSearchPayloadSchema;
+    InteractionExecutionPayload: typeof InteractionExecutionPayloadSchema;
+    NamedInteractionExecutionPayload: typeof NamedInteractionExecutionPayloadSchema;
+    InteractionExecutionResult: typeof InteractionExecutionResultSchema;
+    FindRunResult: typeof FindRunResultSchema;
+    FindRunResultArray: typeof FindRunResultArraySchema;
+    PopulatedExecutionRunResult: typeof PopulatedExecutionRunResultSchema;
+    LegacyExecutionRunResult: typeof LegacyExecutionRunResultSchema;
+    LegacyPopulatedExecutionRunResult: typeof LegacyPopulatedExecutionRunResultSchema;
+    InteractionExecutionConfiguration: typeof InteractionExecutionConfigurationSchema;
+    InteractionExecutionError: typeof InteractionExecutionErrorSchema;
+    ResultStorageOptions: typeof ResultStorageOptionsSchema;
+    ExecuteInteractionByEndpointQuery: typeof ExecuteInteractionByEndpointQuerySchema;
+    ExecuteInteractionByEndpointHeaders: typeof ExecuteInteractionByEndpointHeadersSchema;
+    AsyncCompletionMode: typeof AsyncCompletionModeSchema;
+    AsyncCompletionOptions: typeof AsyncCompletionOptionsSchema;
+    AsyncExecutionPayload: typeof AsyncExecutionPayloadSchema;
+    AsyncInteractionExecutionPayload: typeof AsyncInteractionExecutionPayloadSchema;
+    AsyncConversationExecutionPayload: typeof AsyncConversationExecutionPayloadSchema;
+    AsyncExecutionResult: typeof AsyncExecutionResultSchema;
+    RateLimitRequestPayload: typeof RateLimitRequestPayloadSchema;
+    RateLimitRequestResponse: typeof RateLimitRequestResponseSchema;
+    ComputeRunFacetPayload: typeof ComputeRunFacetPayloadSchema;
+    ComputeRunFacetsResponse: typeof ComputeRunFacetsResponseSchema;
+    RunSearchMetaResponse: typeof RunSearchMetaResponseSchema;
+    ToolResultsPayload: typeof ToolResultsPayloadSchema;
+    UserMessagePayload: typeof UserMessagePayloadSchema;
+    ExecutionResponse: typeof ExecutionResponseSchema;
+    RunClonePayload: typeof RunClonePayloadSchema;
+};
+
+const EXECUTION_RUN_SCHEMAS: ExecutionRunSchemaMap = {
     // A run: what was executed, by whom, and how it ended.
     ExecutionRunStatus: ExecutionRunStatusSchema,
     RunSourceTypes: RunSourceTypesSchema,
@@ -2083,6 +2146,7 @@ const VIEW_EXPERIENCE_SCHEMAS = {
 const APP_LIFECYCLE_SCHEMAS = {
     // What an app does once it exists: versions, builds, scaffolds, git repositories,
     // development tasks, installations and inspection.
+    UpdateAppInstallationOAuthApprovalPayload: UpdateAppInstallationOAuthApprovalPayloadSchema,
     UpdateAppInstallationToolAllowlistPayload: UpdateAppInstallationToolAllowlistPayloadSchema,
     ValidateUrlResponse: ValidateUrlResponseSchema,
     ValidateUrlRequest: ValidateUrlRequestSchema,
@@ -2280,6 +2344,8 @@ const STS_SCHEMAS = {
     EnvironmentTokenRequest: StsSchemas.EnvironmentTokenRequestSchema,
     AgentTokenRequest: StsSchemas.AgentTokenRequestSchema,
     ServiceAccountTokenRequest: StsSchemas.ServiceAccountTokenRequestSchema,
+    AppSessionTokenRequest: StsSchemas.AppSessionTokenRequestSchema,
+    AppSessionTokenResponse: StsSchemas.AppSessionTokenResponseSchema,
     IssueTokenRequest: StsSchemas.IssueTokenRequestSchema,
     IssueTokenResponse: StsSchemas.IssueTokenResponseSchema,
     IssueTokenForbiddenResponse: StsSchemas.IssueTokenForbiddenResponseSchema,
@@ -2500,6 +2566,8 @@ const STRICT_COMPONENTS: ReadonlySet<string> = new Set<string>([
     'EnvironmentTokenRequest',
     'AgentTokenRequest',
     'ServiceAccountTokenRequest',
+    'AppSessionTokenRequest',
+    'AppSessionTokenResponse',
     'IssueTokenResponse',
     'IssueTokenForbiddenResponse',
     'IssueTokenUnavailableResponse',
@@ -2515,7 +2583,7 @@ const STRICT_COMPONENTS: ReadonlySet<string> = new Set<string>([
     'QuotaStandingWindow',
     'QuotaStandingAdmissionClass',
     'QuotaTierResponse',
-    // The IAM closure. PrincipalContext is composed into PrincipalIdentity rather than hoisted,
+    // The IAM closure. AbacPrincipalContext is composed into PrincipalIdentity rather than hoisted,
     // so it has no component of its own to list.
     'User',
     'UpdateUserPayload',
@@ -2638,34 +2706,12 @@ const STRICT_COMPONENTS: ReadonlySet<string> = new Set<string>([
     //
     // `JSONSchema` is deliberately absent: it is OPEN by design and by long-standing publication —
     // a JSON Schema carries keywords the type never enumerated. `JSONSchemaProperties` is a map.
-    'TextFallbackOptions',
-    'AzureFoundryChatOptions',
-    'ImagenOptions',
-    'VertexAIClaudeOptions',
-    'VertexAIGeminiOptions',
-    'VertexAIGeminiOmniVideoOptions',
-    'VertexAIGrokOptions',
-    'NovaCanvasOptions',
-    'BedrockConverseOptions',
-    'BedrockNovaOptions',
-    'BedrockMistralOptions',
-    'BedrockAI21Options',
-    'BedrockCohereCommandOptions',
-    'BedrockClaudeOptions',
-    'BedrockPalmyraOptions',
-    'BedrockGptOssOptions',
-    'TwelvelabsPegasusOptions',
-    'BedrockMantleResponsesOptions',
-    'BedrockMantleChatCompletionsOptions',
-    'BedrockMantleClaudeOptions',
-    'OpenAiThinkingOptions',
-    'OpenAiTextOptions',
-    'OpenRouterTextOptions',
-    'OpenAiDalleOptions',
-    'OpenAiGptImageOptions',
-    'XAIGrokImageOptions',
-    'GroqOptions',
-    'MistralTextOptions',
+    // Derive membership so new provider schemas inherit this enforcement check automatically.
+    ...ModelOptionsSchema.options.map((schema) => {
+        const id = schema.meta()?.id;
+        if (!id) throw new Error('Model option schemas must declare a component id');
+        return id;
+    }),
     // The app-manifest leaves. Every object among them is published closed today, the nested `git`
     // block included, and it is spelled `strictObject` so the emission carries it directly. The five
     // enums take no `additionalProperties` at all.
@@ -3076,6 +3122,10 @@ const STRICT_COMPONENTS: ReadonlySet<string> = new Set<string>([
     'OAuthAuthorizeQuery',
     'CreateOAuthAuthorizationRequestPayload',
     'OAuthAuthorizationRequest',
+    'OAuthAuthorizationRequestGeneratedApp',
+    'OAuthLoginPayload',
+    'OAuthLoginUserNotFoundResponse',
+    'OAuthLoginDecisionResponse',
     'ApproveOAuthAuthorizationRequestPayload',
     'OAuthGrantableScopesResponse',
     'OAuthAuthorizationDecisionResponse',
@@ -3316,6 +3366,7 @@ const STRICT_COMPONENTS: ReadonlySet<string> = new Set<string>([
     'AuditTrailQuery',
     'ViewExperienceListQuery',
     'UpdateAppInstallationToolAllowlistPayload',
+    'UpdateAppInstallationOAuthApprovalPayload',
     'ValidateUrlResponse',
     'ValidateUrlRequest',
     'AppVersionUrls',
@@ -3474,8 +3525,25 @@ const STRICT_COMPONENTS: ReadonlySet<string> = new Set<string>([
  * divergence. Note that `.refine()` is silently DROPPED rather than rejected, so refinements must
  * not be used to express contract rules — they would be invisible to both the spec and AJV.
  */
+function emitSchema(name: string, schema: z.ZodType): unknown {
+    const emitted = emitJsonSchema(schema) as Record<string, unknown>;
+    const rootRef = emitted.$ref;
+    const defs = emitted.$defs;
+    const expectedRef = `#/$defs/${name}`;
+    if (rootRef !== expectedRef || !defs || typeof defs !== 'object' || Array.isArray(defs)) return emitted;
+
+    const root = (defs as Record<string, unknown>)[name];
+    if (!root || typeof root !== 'object' || Array.isArray(root)) return emitted;
+    const remainingDefs = Object.fromEntries(
+        Object.entries(defs as Record<string, unknown>).filter(([id]) => id !== name),
+    );
+    return Object.keys(remainingDefs).length === 0
+        ? root
+        : { ...(root as Record<string, unknown>), $defs: remainingDefs };
+}
+
 function emitRawSchemas(): Record<string, unknown> {
-    return Object.fromEntries(Object.entries(API_SCHEMAS).map(([name, schema]) => [name, emitJsonSchema(schema)]));
+    return Object.fromEntries(Object.entries(API_SCHEMAS).map(([name, schema]) => [name, emitSchema(name, schema)]));
 }
 
 /**

package/src/api-schemas/store.contract.test.ts

@@ -263,8 +263,8 @@ describe('runtime tightenings — recorded as operation 25 of the 1.5 runbook',
 
     it('validates model_options against the union instead of accepting any object', () => {
         // Same class: `model_options` was `{type: object, additionalProperties: true}` in the
-        // hand-written schema and `$ref: ModelOptions` in the published component. It now has to name
-        // a driver through `_option_id`, which is the discriminator generated clients already use.
+        // hand-written schema and `$ref: ModelOptions` in the published component. The family hint
+        // is optional, but known field types and supplied IDs remain validated.
         expect(ApiSchemaComponents.ContentTypeIntakePolicy).toBeDefined();
         expect(
             validate({
@@ -272,11 +272,11 @@ describe('runtime tightenings — recorded as operation 25 of the 1.5 runbook',
             }),
             errors(),
         ).toBe(true);
-        expect(validate({ extraction: { config: { model_options: { temperature: 0.5 } } } })).toBe(false);
+        expect(validate({ extraction: { config: { model_options: { temperature: 0.5 } } } })).toBe(true);
         expect(validate({ extraction: { config: { model_options: { _option_id: 'not-a-driver' } } } })).toBe(false);
-        // The empty object is rejected for the same reason, which is why nothing may PUT it on the
-        // wire — see `normalizeModelOptions`, which drops an options bag with no options in it.
-        expect(validate({ extraction: { config: { model_options: {} } } })).toBe(false);
+        expect(validate({ extraction: { config: { model_options: {} } } })).toBe(true);
+        expect(validate({ extraction: { config: { model_options: { temperature: 'hot' } } } })).toBe(false);
+        expect(validate({ extraction: { config: { model_options: { unknown_option: true } } } })).toBe(false);
     });
 
     it('constrains the two config enums that were unconstrained strings', () => {