@vertesia/common 1.6.0-dev.20261009.095813Z → 1.6.0-dev.20261019.172735Z

package/src/api-schemas/oauth-server.ts

@@ -20,11 +20,16 @@ export const OAuthRegistrationSourceSchema = z.enum(['admin', 'dynamic']).meta({
 export const OAuthProjectBindingModeSchema = z.enum(['user_select', 'fixed']).meta({ id: 'OAuthProjectBindingMode' });
 
 export const OAuthTokenEndpointAuthMethodSchema = z
-    .enum(['none', 'client_secret_post', 'client_secret_basic'])
+    .enum(['none', 'client_secret_post', 'client_secret_basic', 'private_key_jwt'])
     .meta({ id: 'OAuthTokenEndpointAuthMethod' });
 
 export const OAuthGrantTypeSchema = z
-    .enum(['authorization_code', 'refresh_token', 'urn:ietf:params:oauth:grant-type:device_code'])
+    .enum([
+        'authorization_code',
+        'refresh_token',
+        'urn:ietf:params:oauth:grant-type:device_code',
+        'urn:ietf:params:oauth:grant-type:token-exchange',
+    ])
     .meta({ id: 'OAuthGrantType' });
 
 export const OAuthResponseTypeSchema = z.literal('code').meta({ id: 'OAuthResponseType' });
@@ -58,6 +63,7 @@ export const OAuthAuthorizationServerMetadataSchema = z
         grant_types_supported: z.array(z.string()),
         code_challenge_methods_supported: z.array(z.string()),
         token_endpoint_auth_methods_supported: z.array(z.string()),
+        token_endpoint_auth_signing_alg_values_supported: z.array(z.string()).optional(),
         scopes_supported: z.array(z.string()),
         client_id_metadata_document_supported: z.boolean().optional(),
         authorization_response_iss_parameter_supported: z.boolean().optional(),
@@ -110,6 +116,7 @@ export const OAuthAuthorizationRequestSchema = z
         }),
         client_id: z.string(),
         client_name: z.string(),
+        app_id: z.string().optional(),
         client_metadata: OAuthClientDisplayMetadataSchema.optional(),
         client_registration_mode: OAuthClientRegistrationModeSchema.optional(),
         redirect_uri: z.string(),
@@ -212,12 +219,17 @@ export const OAuthTokenResponseSchema = z
  * publishes these properties inline under `OAuthClient`, with `client_id` last.
  */
 export const OAuthClientDataSchema = z.strictObject({
+    app_id: z.string().optional().meta({
+        description:
+            'App associated with this client. Authorization requires an installation explicitly enabling this client and current user app access.',
+    }),
     client_name: z.string(),
     client_type: OAuthClientTypeSchema,
     redirect_uris: z.array(z.string()),
     grant_types: z.array(OAuthGrantTypeSchema),
     response_types: z.array(OAuthResponseTypeSchema),
     token_endpoint_auth_method: OAuthTokenEndpointAuthMethodSchema,
+    jwks_uri: z.string().url().optional(),
     allowed_scopes: z.array(z.string()),
     default_scopes: z.array(z.string()).optional(),
     registration_source: OAuthRegistrationSourceSchema,
@@ -269,6 +281,7 @@ export const CreateOAuthClientPayloadSchema = z
         grant_types: z.array(OAuthGrantTypeSchema).optional(),
         response_types: z.array(OAuthResponseTypeSchema).optional(),
         token_endpoint_auth_method: OAuthTokenEndpointAuthMethodSchema.optional(),
+        jwks_uri: z.string().url().optional(),
         allowed_scopes: z.array(z.string()).optional(),
         default_scopes: z.array(z.string()).optional(),
         project_binding_mode: OAuthProjectBindingModeSchema.optional(),
@@ -292,9 +305,13 @@ export const UpdateOAuthClientPayloadSchema = z
         grant_types: z.array(OAuthGrantTypeSchema).optional(),
         response_types: z.array(OAuthResponseTypeSchema).optional(),
         token_endpoint_auth_method: OAuthTokenEndpointAuthMethodSchema.optional(),
+        jwks_uri: z.string().url().optional(),
         allowed_scopes: z.array(z.string()).optional(),
         default_scopes: z.array(z.string()).optional(),
         status: OAuthClientStatusSchema.optional(),
+        revoke_previous_client_secret: z.boolean().optional().meta({
+            description: 'Immediately revoke the previous rotation secret while retaining the current secret.',
+        }),
         project_binding_mode: OAuthProjectBindingModeSchema.optional(),
         fixed_project_id: z.string().optional(),
         restrict_to_owner_account: z.boolean().optional(),
@@ -406,3 +423,87 @@ export const OAuthLoginUserNotFoundResponseSchema = z
         ensure_user_url: z.string(),
     })
     .meta({ id: 'OAuthLoginUserNotFoundResponse' });
+
+const federationId = z.string().regex(/^[a-fA-F0-9]{24}$/);
+export const OidcFederationConnectionPayloadSchema = z
+    .strictObject({
+        name: z.string().min(1).max(200),
+        issuer: z.string().url(),
+        jwks_uri: z.string().url().optional(),
+        external_id_claim: z.string().min(1).max(256).regex(/\S/).meta({
+            description:
+                'Exact top-level verified token claim matched to SCIM externalId within the owning provisioning account.',
+        }),
+        allowed_audiences: z.array(z.string().min(1)).min(1).max(20),
+        allowed_algorithms: z
+            .array(z.enum(['RS256', 'ES256']))
+            .min(1)
+            .max(2),
+        subject_token_type: z.enum([
+            'urn:ietf:params:oauth:token-type:jwt',
+            'urn:ietf:params:oauth:token-type:id_token',
+            'urn:ietf:params:oauth:token-type:access_token',
+        ]),
+        required_claims: z.record(z.string(), z.string()).optional().meta({
+            description: 'Exact string matches against verified top-level IdP claims, such as tenant or azp.',
+        }),
+        all_projects: z.boolean().optional().meta({
+            description:
+                'Explicitly allow all current and future projects in the owning organization, subject to the user’s current access. Defaults to false for existing allowlists. When true, allowed_project_ids must be empty.',
+        }),
+        allowed_project_ids: z.array(federationId).max(100).meta({
+            description: 'Explicit project allowlist. Must contain 1–100 projects unless all_projects is true.',
+        }),
+        allowed_client_ids: z.array(z.string().min(1).max(256)).min(1).max(20).optional().meta({
+            description:
+                'When set, require authentication by one of these account-owned confidential OAuth clients. Omit to allow exchanges without separate client authentication.',
+        }),
+        allowed_scopes: z.array(z.string().min(1)).min(1).max(100).optional().meta({
+            description:
+                'Optional restriction on delegable Vertesia permissions, excluding account:admin. Omit to use the user’s current permissions. An explicit list further restricts the grant.',
+        }),
+        max_token_ttl_seconds: z.number().int().min(30).max(300),
+        max_subject_token_age_seconds: z.number().int().min(30).max(86400).optional().meta({
+            description:
+                'Maximum age since the signed iat claim. Defaults to 3600 seconds; 60 seconds of clock tolerance applies.',
+        }),
+        enabled: z.boolean(),
+    })
+    .meta({ id: 'OidcFederationConnectionPayload' });
+export const OidcFederationConnectionSchema = OidcFederationConnectionPayloadSchema.extend({
+    id: federationId,
+    account_id: federationId,
+    max_subject_token_age_seconds: z.number().int().min(30).max(86400),
+}).meta({ id: 'OidcFederationConnection' });
+export const OidcFederationConnectionArraySchema = z
+    .array(OidcFederationConnectionSchema)
+    .meta({ id: 'OidcFederationConnectionArray' });
+export const OAuthTokenExchangeRequestSchema = z
+    .strictObject({
+        grant_type: z.literal('urn:ietf:params:oauth:grant-type:token-exchange'),
+        subject_token: z.string().min(1).max(65536),
+        subject_token_type: OidcFederationConnectionPayloadSchema.shape.subject_token_type,
+        requested_token_type: z.literal('urn:ietf:params:oauth:token-type:access_token').optional(),
+        federation_connection_id: federationId,
+        client_id: z.string().min(1).max(256).optional(),
+        client_secret: z.string().min(1).max(4096).optional(),
+        client_assertion: z.string().min(1).max(16384).optional(),
+        client_assertion_type: z.literal('urn:ietf:params:oauth:client-assertion-type:jwt-bearer').optional(),
+        project_id: federationId,
+        resource: z.string().min(1),
+        scope: z.string().min(1).max(4096).optional().meta({
+            description:
+                'Optional space-separated permission subset. Omit to use current user permissions within the connection policy.',
+        }),
+    })
+    .meta({ id: 'OAuthTokenExchangeRequest' });
+export const OAuthTokenExchangeResponseSchema = OAuthTokenResponseSchema.omit({
+    refresh_token: true,
+    refresh_token_expires_in: true,
+    id_token: true,
+})
+    .extend({
+        token_type: z.literal('Bearer'),
+        issued_token_type: z.literal('urn:ietf:params:oauth:token-type:access_token'),
+    })
+    .meta({ id: 'OAuthTokenExchangeResponse' });

package/src/api-schemas/process.ts

@@ -155,6 +155,19 @@ export const PublishProcessDefinitionPayloadSchema = z
             .optional(),
         label: z.string().meta({ description: 'Optional human-readable revision label.' }).optional(),
         comment: z.string().meta({ description: 'Optional publish note.' }).optional(),
+        idempotency_key: z
+            .string()
+            .min(1)
+            .max(256)
+            .meta({
+                description:
+                    'Client-chosen key that makes this request safe to retry. Publishing is otherwise not ' +
+                    'idempotent: a repeat of a publish that already succeeded is rejected because the revision ' +
+                    'is no longer a draft. When the revision was published by a request with the same key and ' +
+                    'the same body, the repeat returns that revision instead. Reusing the key with a different ' +
+                    'body is rejected with 409. The key is bound to the revision it published.',
+            })
+            .optional(),
     })
     .meta({ id: 'PublishProcessDefinitionPayload' });
 
@@ -1187,11 +1200,29 @@ export const UpdateProcessTestSuitePayloadSchema = CreateProcessTestSuitePayload
     id: 'UpdateProcessTestSuitePayload',
 });
 
+/**
+ * Makes starting a test run safe to retry. Starting a run is otherwise not idempotent: a request the
+ * client gave up on can still complete server-side, and resending it would start a second run.
+ */
+const ProcessTestRunIdempotencyKeySchema = z
+    .string()
+    .min(1)
+    .max(256)
+    .meta({
+        description:
+            'Client-chosen key, unique per intended run, that makes this request safe to retry. A repeat of ' +
+            'the request with the same key and the same body returns the run the first request started ' +
+            'instead of starting another. Reusing a key with a different body is rejected with 409. Keys ' +
+            'are scoped to the project and stay bound to their run for as long as it exists; once the run ' +
+            'is deleted, the same key starts a new one.',
+    });
+
 export const StartProcessTestRunPayloadSchema = z
     .strictObject({
         suite_id: z.string(),
         process_revision_id: z.string(),
         scenario_ids: z.array(z.string()).optional(),
+        idempotency_key: ProcessTestRunIdempotencyKeySchema.optional(),
     })
     .meta({ id: 'StartProcessTestRunPayload' });
 
@@ -1265,6 +1296,7 @@ export const SubmitProcessTestRunPayloadSchema = z
     .strictObject({
         process: ProcessTestTargetSchema,
         scenarios: z.array(ProcessTestScenarioSchema).min(1),
+        idempotency_key: ProcessTestRunIdempotencyKeySchema.optional(),
     })
     .meta({ id: 'SubmitProcessTestRunPayload' });
 

package/src/api-schemas/prompt.ts

@@ -1,5 +1,6 @@
 import { z } from 'zod';
 import { FacetSpecSchema, PromptTemplateRefSchema } from './interaction.js';
+import { PageCountSchema } from './schema-primitives.js';
 
 // The prompt-authoring contracts: what a fork, a render and a prompt search publish, and how a
 // prompt's interaction usages are reported. `PromptTemplate` itself and its two write payloads live
@@ -50,8 +51,10 @@ export const PromptSearchQuerySchema = z
                     'Accepted and ignored. `GET /prompts` and `POST /prompts/facets` list drafts only, and always have.',
             })
             .optional(),
-        limit: z.number().meta({ description: 'Maximum number of prompts to return. Defaults to 100.' }).optional(),
-        offset: z.number().meta({ description: 'Number of prompts to skip.' }).optional(),
+        limit: PageCountSchema.meta({
+            description: 'Maximum number of prompts to return. Defaults to 100.',
+        }).optional(),
+        offset: PageCountSchema.meta({ description: 'Number of prompts to skip.' }).optional(),
         role: z.string().meta({ description: 'Exact match on the prompt role.' }).optional(),
         tags: z.array(z.string()).meta({ description: 'Match prompts carrying any of these tags.' }).optional(),
         matchInteractions: z

package/src/api-schemas/registry.ts

@@ -88,6 +88,16 @@ import {
     AppDevelopmentTaskDetailsSchema,
     AppDevelopmentTaskListSchema,
     AppDevelopmentTaskSchema,
+    AppGithubAccountSchema,
+    AppGithubBranchStateSchema,
+    AppGithubConfigurationSchema,
+    AppGithubInstallationSchema,
+    AppGithubRepositoriesQuerySchema,
+    AppGithubRepositoryCreationSchema,
+    AppGithubRepositoryListSchema,
+    AppGithubRepositorySchema,
+    AppGithubRepositorySetupQuerySchema,
+    AppGithubRepositorySetupSchema,
     AppInspectionCapabilityReportSchema,
     AppInspectionIssueSchema,
     AppInspectionResultSchema,
@@ -97,6 +107,7 @@ import {
     AppInstallationProjectsQuerySchema,
     AppInstallationProviderBindingSchema,
     AppInstallationsQuerySchema,
+    AppInstanceAvailabilitySchema,
     AppListScopeSchema,
     AppOAuthCollectionParamsSchema,
     AppOAuthProviderParamsSchema,
@@ -112,6 +123,7 @@ import {
     AppScaffoldModuleSchema,
     AppScaffoldProgressSchema,
     AppScaffoldProgressStatusSchema,
+    AppScaffoldSourceModeSchema,
     AppsQuerySchema,
     AppToolCollectionArraySchema,
     AppToolCollectionSchema,
@@ -128,6 +140,8 @@ import {
     ConversationActivityStateSchema,
     DeleteAppVersionResponseSchema,
     EventRefSchema,
+    ExchangeAppGithubAuthorizationRequestSchema,
+    ExchangeAppGithubAuthorizationResponseSchema,
     Extract_AppVersionGitRefType_branch_tag_commitSchema,
     InCodeTypeRefSchema,
     McpApiKeyCredentialSchema,
@@ -138,6 +152,7 @@ import {
     StartAppBuildRequestSchema,
     StartAppBuildResponseSchema,
     StartAppDevelopmentTaskRequestSchema,
+    StartAppGithubAuthorizationResponseSchema,
     StartAppScaffoldRequestSchema,
     StartAppScaffoldResponseSchema,
     StoredTypeRefSchema,
@@ -152,6 +167,7 @@ import * as AppRuntimeSchemas from './app-runtime.js';
 import {
     AppAccessControlSchema,
     AppCapabilitiesSchema,
+    AppGitSourceProviderSchema,
     AppManifestSourceSchema,
     AppSourceConfigSchema,
     AppUIConfigSchema,
@@ -657,7 +673,12 @@ import {
     OAuthRegistrationSourceSchema,
     OAuthResponseTypeSchema,
     OAuthTokenEndpointAuthMethodSchema,
+    OAuthTokenExchangeRequestSchema,
+    OAuthTokenExchangeResponseSchema,
     OAuthTokenResponseSchema,
+    OidcFederationConnectionArraySchema,
+    OidcFederationConnectionPayloadSchema,
+    OidcFederationConnectionSchema,
     RevokeOAuthGrantQuerySchema,
     UpdateOAuthClientPayloadSchema,
 } from './oauth-server.js';
@@ -934,6 +955,7 @@ const PROJECT_AND_APP_SCHEMAS = {
     AppCapabilities: AppCapabilitiesSchema,
     AppAccessControl: AppAccessControlSchema,
     AppSourceConfig: AppSourceConfigSchema,
+    AppGitSourceProvider: AppGitSourceProviderSchema,
     AppManifestSource: AppManifestSourceSchema,
 } as const satisfies Record<string, z.ZodType>;
 
@@ -987,6 +1009,12 @@ const OAUTH_SCHEMAS = {
     OAuthDeviceAuthorizationRequest: OAuthDeviceAuthorizationRequestSchema,
     OAuthDeviceAuthorizationResponse: OAuthDeviceAuthorizationResponseSchema,
     OAuthTokenResponse: OAuthTokenResponseSchema,
+    OidcFederationConnectionPayload: OidcFederationConnectionPayloadSchema,
+    OidcFederationConnection: OidcFederationConnectionSchema,
+    OidcFederationConnectionArray: OidcFederationConnectionArraySchema,
+    OAuthTokenExchangeRequest: OAuthTokenExchangeRequestSchema,
+    OAuthTokenExchangeResponse: OAuthTokenExchangeResponseSchema,
+
     // Clients registered against Vertesia's own OAuth server. `OAuthClientData` is composed into
     // `OAuthClient` rather than hoisted, so it has no component of its own — as today.
     OAuthClient: OAuthClientSchema,
@@ -1395,12 +1423,6 @@ const CONTENT_TYPE_CATALOG_SCHEMAS: {
     readonly ContentObjectTypeItemArray: typeof ContentObjectTypeItemArraySchema;
     readonly ContentObjectTypeCatalogEntry: typeof ContentObjectTypeCatalogEntrySchema;
     readonly ContentObjectTypeCatalogEntryArray: typeof ContentObjectTypeCatalogEntryArraySchema;
-    readonly InCodeTypeDefinition: typeof InCodeTypeDefinitionSchema;
-    readonly CreateContentObjectTypePayload: typeof CreateContentObjectTypePayloadSchema;
-    readonly UpdateContentObjectTypePayload: typeof UpdateContentObjectTypePayloadSchema;
-    readonly ContentObjectType: typeof ContentObjectTypeSchema;
-    readonly ContentObjectTypeCatalogQuery: typeof ContentObjectTypeCatalogQuerySchema;
-    readonly ContentObjectTypeListQuery: typeof ContentObjectTypeListQuerySchema;
 } = {
     ColumnLayout: ColumnLayoutSchema,
     ContentTypeEditingPolicy: ContentTypeEditingPolicySchema,
@@ -1409,6 +1431,9 @@ const CONTENT_TYPE_CATALOG_SCHEMAS: {
     ContentObjectTypeItemArray: ContentObjectTypeItemArraySchema,
     ContentObjectTypeCatalogEntry: ContentObjectTypeCatalogEntrySchema,
     ContentObjectTypeCatalogEntryArray: ContentObjectTypeCatalogEntryArraySchema,
+} as const satisfies Record<string, z.ZodType>;
+
+const CONTENT_TYPE_AUTHORING_SCHEMAS = {
     InCodeTypeDefinition: InCodeTypeDefinitionSchema,
     CreateContentObjectTypePayload: CreateContentObjectTypePayloadSchema,
     UpdateContentObjectTypePayload: UpdateContentObjectTypePayloadSchema,
@@ -1690,6 +1715,7 @@ const CONTENT_OBJECT_SCHEMAS = {
     TranscriptSegment: ContentSchemas.TranscriptSegmentSchema,
     ContentObjectTypeArray: ContentSchemas.ContentObjectTypeArraySchema,
     ContentObjectTextResponse: ContentSchemas.ContentObjectTextResponseSchema,
+    SetObjectTextPayload: ContentSchemas.SetObjectTextPayloadSchema,
     DeleteContentObjectResult: ContentSchemas.DeleteContentObjectResultSchema,
     Transcript: ContentSchemas.TranscriptSchema,
     CreateContentObjectPayload: ContentSchemas.CreateContentObjectPayloadSchema,
@@ -2226,6 +2252,20 @@ const APP_LIFECYCLE_SCHEMAS = {
     AppRepoBranch: AppRepoBranchSchema,
     AppRepoDocumentCommit: AppRepoDocumentCommitSchema,
     AppVersionGitSource: AppVersionGitSourceSchema,
+    AppGithubConfiguration: AppGithubConfigurationSchema,
+    StartAppGithubAuthorizationResponse: StartAppGithubAuthorizationResponseSchema,
+    ExchangeAppGithubAuthorizationRequest: ExchangeAppGithubAuthorizationRequestSchema,
+    AppGithubRepositoriesQuery: AppGithubRepositoriesQuerySchema,
+    ExchangeAppGithubAuthorizationResponse: ExchangeAppGithubAuthorizationResponseSchema,
+    AppGithubInstallation: AppGithubInstallationSchema,
+    AppGithubAccount: AppGithubAccountSchema,
+    AppGithubRepository: AppGithubRepositorySchema,
+    AppGithubRepositoryCreation: AppGithubRepositoryCreationSchema,
+    AppGithubRepositoryList: AppGithubRepositoryListSchema,
+    AppGithubRepositorySetupQuery: AppGithubRepositorySetupQuerySchema,
+    AppGithubBranchState: AppGithubBranchStateSchema,
+    AppGithubRepositorySetup: AppGithubRepositorySetupSchema,
+    AppScaffoldSourceMode: AppScaffoldSourceModeSchema,
     StartAppScaffoldRequest: StartAppScaffoldRequestSchema,
     StartAppDevelopmentTaskRequest: StartAppDevelopmentTaskRequestSchema,
     StartAppBuildRequest: StartAppBuildRequestSchema,
@@ -2250,6 +2290,7 @@ const APP_LIFECYCLE_SCHEMAS = {
     AgentRunSearchHit: AgentRunSearchHitSchema,
     UpsertAppVersionRequest: UpsertAppVersionRequestSchema,
     AppInstallationPayload: AppInstallationPayloadSchema,
+    AppInstanceAvailability: AppInstanceAvailabilitySchema,
     AppDevelopmentTaskDetails: AppDevelopmentTaskDetailsSchema,
     AppVersionRecordArray: AppVersionRecordArraySchema,
     AppToolCollectionArray: AppToolCollectionArraySchema,
@@ -2340,6 +2381,7 @@ const APP_MANIFEST_SCHEMAS = {
     MCPOAuthConfigMap: AppRuntimeSchemas.MCPOAuthConfigMapSchema,
     AppWidgetInfo: AppRuntimeSchemas.AppWidgetInfoSchema,
     AppDashboardDefinition: AppRuntimeSchemas.AppDashboardDefinitionSchema,
+    AppOAuthClientConfig: AppRuntimeSchemas.AppOAuthClientConfigSchema,
     AppManifestData: AppRuntimeSchemas.AppManifestDataSchema,
     UpdateAppPayload: AppRuntimeSchemas.UpdateAppPayloadSchema,
     AppManifest: AppRuntimeSchemas.AppManifestSchema,
@@ -2448,6 +2490,7 @@ const API_SCHEMA_GROUPS = [
     FILE_STORAGE_SCHEMAS,
     DURABLE_TASK_SCHEMAS,
     CONTENT_TYPE_CATALOG_SCHEMAS,
+    CONTENT_TYPE_AUTHORING_SCHEMAS,
     MIGRATION_COMMAND_SCHEMAS,
     PROCESS_DSL_SCHEMAS,
     AGENT_MESSAGE_SCHEMAS,
@@ -2512,6 +2555,7 @@ type ApiSchemaMap = typeof RUN_BUDGET_SCHEMAS &
     typeof FILE_STORAGE_SCHEMAS &
     typeof DURABLE_TASK_SCHEMAS &
     typeof CONTENT_TYPE_CATALOG_SCHEMAS &
+    typeof CONTENT_TYPE_AUTHORING_SCHEMAS &
     typeof MIGRATION_COMMAND_SCHEMAS &
     typeof PROCESS_DSL_SCHEMAS &
     typeof AGENT_MESSAGE_SCHEMAS &
@@ -2557,6 +2601,10 @@ const API_SCHEMAS: Readonly<Record<ApiComponentName, z.ZodType>> = mergeComponen
  * objects, so a body carrying an undeclared property is rejected rather than quietly accepted.
  */
 const STRICT_COMPONENTS: ReadonlySet<string> = new Set<string>([
+    'OidcFederationConnectionPayload',
+    'OidcFederationConnection',
+    'OAuthTokenExchangeRequest',
+    'OAuthTokenExchangeResponse',
     'UpdateInteractionConfigurationPayload',
     'InteractionConfigurationRecord',
     'InteractionConfigurationResult',
@@ -2774,6 +2822,8 @@ const STRICT_COMPONENTS: ReadonlySet<string> = new Set<string>([
     'MCPOAuthConfig',
     'MCPApiKeyConfig',
     'MCPToolCollectionObject',
+    'McpPublicParameter',
+    'McpSecretParameter',
     'VertesiaSDKToolCollectionObject',
     // File, task, content-type and command components. Every one is published closed
     // today; `StringValueMap`, `MigrationListResponse`, `TaskArray`, the two content-type array
@@ -3092,6 +3142,7 @@ const STRICT_COMPONENTS: ReadonlySet<string> = new Set<string>([
     'ViewExecutionSearchConfiguration',
     'DSLRetryPolicy',
     'CreateContentObjectPayload',
+    'SetObjectTextPayload',
     'EventIngestChannelMutationResponse',
     'CreateEventIngestChannelPayload',
     'AgentRun',
@@ -3473,6 +3524,8 @@ const STRICT_COMPONENTS: ReadonlySet<string> = new Set<string>([
     'AgentRunSearchHit',
     'UpsertAppVersionRequest',
     'AppInstallationPayload',
+    'AppInstanceAvailability',
+    'AppOAuthClientConfig',
     'AppDevelopmentTaskDetails',
     'AppInstallationsQuery',
     'AppsQuery',

package/src/api-schemas/schema-primitives.ts

@@ -11,6 +11,15 @@ export const nullableNumberSchema = z
     .nullable()
     .meta({ anyOf: undefined, type: ['number', 'null'] });
 
+/**
+ * A `limit` or `offset` query count: a whole number, zero or more. A fraction or a negative count used to
+ * reach the database and fail there as a 500.
+ *
+ * Published as `type: number` with `multipleOf: 1` rather than `type: integer`, so the generated Java and Go
+ * clients keep the parameter types they already expose while the contract enforcer answers 400.
+ */
+export const PageCountSchema = z.number().multipleOf(1).min(0);
+
 /** Monotonic token for optimistic concurrency on mutable, user-authored resources. */
 export const EditRevisionSchema = z
     .number()

package/src/api-schemas/store.ts

@@ -3,7 +3,7 @@ import { z } from 'zod';
 // From the values module, for the reason `./apikey.js` gives.
 import { ConfigModes, RunDataStorageLevel } from '../interaction-values.js';
 import { InferenceProfileIdSchema } from './inference-profile.js';
-import { EditRevisionSchema, ExpectedEditRevisionSchema } from './schema-primitives.js';
+import { EditRevisionSchema, ExpectedEditRevisionSchema, PageCountSchema } from './schema-primitives.js';
 
 /**
  * Runtime API schemas for the content-intake policy tree.
@@ -643,8 +643,8 @@ export const ContentObjectTypeSchema = z.strictObject(storedContentTypeShape).me
 const contentTypeListingFields = {
     layout: z.boolean().optional(),
     schema: z.boolean().optional(),
-    limit: z.number().optional(),
-    offset: z.number().optional(),
+    limit: PageCountSchema.optional(),
+    offset: PageCountSchema.optional(),
 };
 
 export const ContentObjectTypeCatalogQuerySchema = z

package/src/api-schemas/task.ts

@@ -1,4 +1,5 @@
 import { z } from 'zod';
+import { PageCountSchema } from './schema-primitives.js';
 
 export const CompleteTaskPayloadSchema = z
     .strictObject({
@@ -98,7 +99,7 @@ export const ListTasksQuerySchema = z
         assignee: z.string().optional(),
         run_id: z.string().optional(),
         source_type: TaskSourceSchema.shape.type.optional(),
-        limit: z.number().optional(),
-        offset: z.number().optional(),
+        limit: PageCountSchema.optional(),
+        offset: PageCountSchema.optional(),
     })
     .meta({ id: 'ListTasksQuery' });

package/src/apikey.ts

@@ -97,6 +97,14 @@ export interface AuthTokenPayload {
      */
     apps: string[];
 
+    /** Versioned grants for installations in the selected project. Absence means a legacy token. */
+    app_installations?: {
+        version: 1;
+        project_id: string;
+        ids: string[];
+        ui_restrictions?: string[];
+    };
+
     /**
      * Apps in `apps[]` whose UI surface is restricted for this principal — present only on
      * user tokens, and only when at least one app applies. Such apps grant functional access