@vertesia/common 1.6.0-dev.20261014.015055Z → 1.6.0-dev.20261019.172735Z

package/src/api-schemas/oauth-server.ts

@@ -20,11 +20,16 @@ export const OAuthRegistrationSourceSchema = z.enum(['admin', 'dynamic']).meta({
 export const OAuthProjectBindingModeSchema = z.enum(['user_select', 'fixed']).meta({ id: 'OAuthProjectBindingMode' });
 
 export const OAuthTokenEndpointAuthMethodSchema = z
-    .enum(['none', 'client_secret_post', 'client_secret_basic'])
+    .enum(['none', 'client_secret_post', 'client_secret_basic', 'private_key_jwt'])
     .meta({ id: 'OAuthTokenEndpointAuthMethod' });
 
 export const OAuthGrantTypeSchema = z
-    .enum(['authorization_code', 'refresh_token', 'urn:ietf:params:oauth:grant-type:device_code'])
+    .enum([
+        'authorization_code',
+        'refresh_token',
+        'urn:ietf:params:oauth:grant-type:device_code',
+        'urn:ietf:params:oauth:grant-type:token-exchange',
+    ])
     .meta({ id: 'OAuthGrantType' });
 
 export const OAuthResponseTypeSchema = z.literal('code').meta({ id: 'OAuthResponseType' });
@@ -58,6 +63,7 @@ export const OAuthAuthorizationServerMetadataSchema = z
         grant_types_supported: z.array(z.string()),
         code_challenge_methods_supported: z.array(z.string()),
         token_endpoint_auth_methods_supported: z.array(z.string()),
+        token_endpoint_auth_signing_alg_values_supported: z.array(z.string()).optional(),
         scopes_supported: z.array(z.string()),
         client_id_metadata_document_supported: z.boolean().optional(),
         authorization_response_iss_parameter_supported: z.boolean().optional(),
@@ -110,6 +116,7 @@ export const OAuthAuthorizationRequestSchema = z
         }),
         client_id: z.string(),
         client_name: z.string(),
+        app_id: z.string().optional(),
         client_metadata: OAuthClientDisplayMetadataSchema.optional(),
         client_registration_mode: OAuthClientRegistrationModeSchema.optional(),
         redirect_uri: z.string(),
@@ -212,12 +219,17 @@ export const OAuthTokenResponseSchema = z
  * publishes these properties inline under `OAuthClient`, with `client_id` last.
  */
 export const OAuthClientDataSchema = z.strictObject({
+    app_id: z.string().optional().meta({
+        description:
+            'App associated with this client. Authorization requires an installation explicitly enabling this client and current user app access.',
+    }),
     client_name: z.string(),
     client_type: OAuthClientTypeSchema,
     redirect_uris: z.array(z.string()),
     grant_types: z.array(OAuthGrantTypeSchema),
     response_types: z.array(OAuthResponseTypeSchema),
     token_endpoint_auth_method: OAuthTokenEndpointAuthMethodSchema,
+    jwks_uri: z.string().url().optional(),
     allowed_scopes: z.array(z.string()),
     default_scopes: z.array(z.string()).optional(),
     registration_source: OAuthRegistrationSourceSchema,
@@ -269,6 +281,7 @@ export const CreateOAuthClientPayloadSchema = z
         grant_types: z.array(OAuthGrantTypeSchema).optional(),
         response_types: z.array(OAuthResponseTypeSchema).optional(),
         token_endpoint_auth_method: OAuthTokenEndpointAuthMethodSchema.optional(),
+        jwks_uri: z.string().url().optional(),
         allowed_scopes: z.array(z.string()).optional(),
         default_scopes: z.array(z.string()).optional(),
         project_binding_mode: OAuthProjectBindingModeSchema.optional(),
@@ -292,9 +305,13 @@ export const UpdateOAuthClientPayloadSchema = z
         grant_types: z.array(OAuthGrantTypeSchema).optional(),
         response_types: z.array(OAuthResponseTypeSchema).optional(),
         token_endpoint_auth_method: OAuthTokenEndpointAuthMethodSchema.optional(),
+        jwks_uri: z.string().url().optional(),
         allowed_scopes: z.array(z.string()).optional(),
         default_scopes: z.array(z.string()).optional(),
         status: OAuthClientStatusSchema.optional(),
+        revoke_previous_client_secret: z.boolean().optional().meta({
+            description: 'Immediately revoke the previous rotation secret while retaining the current secret.',
+        }),
         project_binding_mode: OAuthProjectBindingModeSchema.optional(),
         fixed_project_id: z.string().optional(),
         restrict_to_owner_account: z.boolean().optional(),
@@ -406,3 +423,87 @@ export const OAuthLoginUserNotFoundResponseSchema = z
         ensure_user_url: z.string(),
     })
     .meta({ id: 'OAuthLoginUserNotFoundResponse' });
+
+const federationId = z.string().regex(/^[a-fA-F0-9]{24}$/);
+export const OidcFederationConnectionPayloadSchema = z
+    .strictObject({
+        name: z.string().min(1).max(200),
+        issuer: z.string().url(),
+        jwks_uri: z.string().url().optional(),
+        external_id_claim: z.string().min(1).max(256).regex(/\S/).meta({
+            description:
+                'Exact top-level verified token claim matched to SCIM externalId within the owning provisioning account.',
+        }),
+        allowed_audiences: z.array(z.string().min(1)).min(1).max(20),
+        allowed_algorithms: z
+            .array(z.enum(['RS256', 'ES256']))
+            .min(1)
+            .max(2),
+        subject_token_type: z.enum([
+            'urn:ietf:params:oauth:token-type:jwt',
+            'urn:ietf:params:oauth:token-type:id_token',
+            'urn:ietf:params:oauth:token-type:access_token',
+        ]),
+        required_claims: z.record(z.string(), z.string()).optional().meta({
+            description: 'Exact string matches against verified top-level IdP claims, such as tenant or azp.',
+        }),
+        all_projects: z.boolean().optional().meta({
+            description:
+                'Explicitly allow all current and future projects in the owning organization, subject to the user’s current access. Defaults to false for existing allowlists. When true, allowed_project_ids must be empty.',
+        }),
+        allowed_project_ids: z.array(federationId).max(100).meta({
+            description: 'Explicit project allowlist. Must contain 1–100 projects unless all_projects is true.',
+        }),
+        allowed_client_ids: z.array(z.string().min(1).max(256)).min(1).max(20).optional().meta({
+            description:
+                'When set, require authentication by one of these account-owned confidential OAuth clients. Omit to allow exchanges without separate client authentication.',
+        }),
+        allowed_scopes: z.array(z.string().min(1)).min(1).max(100).optional().meta({
+            description:
+                'Optional restriction on delegable Vertesia permissions, excluding account:admin. Omit to use the user’s current permissions. An explicit list further restricts the grant.',
+        }),
+        max_token_ttl_seconds: z.number().int().min(30).max(300),
+        max_subject_token_age_seconds: z.number().int().min(30).max(86400).optional().meta({
+            description:
+                'Maximum age since the signed iat claim. Defaults to 3600 seconds; 60 seconds of clock tolerance applies.',
+        }),
+        enabled: z.boolean(),
+    })
+    .meta({ id: 'OidcFederationConnectionPayload' });
+export const OidcFederationConnectionSchema = OidcFederationConnectionPayloadSchema.extend({
+    id: federationId,
+    account_id: federationId,
+    max_subject_token_age_seconds: z.number().int().min(30).max(86400),
+}).meta({ id: 'OidcFederationConnection' });
+export const OidcFederationConnectionArraySchema = z
+    .array(OidcFederationConnectionSchema)
+    .meta({ id: 'OidcFederationConnectionArray' });
+export const OAuthTokenExchangeRequestSchema = z
+    .strictObject({
+        grant_type: z.literal('urn:ietf:params:oauth:grant-type:token-exchange'),
+        subject_token: z.string().min(1).max(65536),
+        subject_token_type: OidcFederationConnectionPayloadSchema.shape.subject_token_type,
+        requested_token_type: z.literal('urn:ietf:params:oauth:token-type:access_token').optional(),
+        federation_connection_id: federationId,
+        client_id: z.string().min(1).max(256).optional(),
+        client_secret: z.string().min(1).max(4096).optional(),
+        client_assertion: z.string().min(1).max(16384).optional(),
+        client_assertion_type: z.literal('urn:ietf:params:oauth:client-assertion-type:jwt-bearer').optional(),
+        project_id: federationId,
+        resource: z.string().min(1),
+        scope: z.string().min(1).max(4096).optional().meta({
+            description:
+                'Optional space-separated permission subset. Omit to use current user permissions within the connection policy.',
+        }),
+    })
+    .meta({ id: 'OAuthTokenExchangeRequest' });
+export const OAuthTokenExchangeResponseSchema = OAuthTokenResponseSchema.omit({
+    refresh_token: true,
+    refresh_token_expires_in: true,
+    id_token: true,
+})
+    .extend({
+        token_type: z.literal('Bearer'),
+        issued_token_type: z.literal('urn:ietf:params:oauth:token-type:access_token'),
+    })
+    .meta({ id: 'OAuthTokenExchangeResponse' });

package/src/api-schemas/process.ts

@@ -155,6 +155,19 @@ export const PublishProcessDefinitionPayloadSchema = z
             .optional(),
         label: z.string().meta({ description: 'Optional human-readable revision label.' }).optional(),
         comment: z.string().meta({ description: 'Optional publish note.' }).optional(),
+        idempotency_key: z
+            .string()
+            .min(1)
+            .max(256)
+            .meta({
+                description:
+                    'Client-chosen key that makes this request safe to retry. Publishing is otherwise not ' +
+                    'idempotent: a repeat of a publish that already succeeded is rejected because the revision ' +
+                    'is no longer a draft. When the revision was published by a request with the same key and ' +
+                    'the same body, the repeat returns that revision instead. Reusing the key with a different ' +
+                    'body is rejected with 409. The key is bound to the revision it published.',
+            })
+            .optional(),
     })
     .meta({ id: 'PublishProcessDefinitionPayload' });
 

package/src/api-schemas/prompt.ts

@@ -1,5 +1,6 @@
 import { z } from 'zod';
 import { FacetSpecSchema, PromptTemplateRefSchema } from './interaction.js';
+import { PageCountSchema } from './schema-primitives.js';
 
 // The prompt-authoring contracts: what a fork, a render and a prompt search publish, and how a
 // prompt's interaction usages are reported. `PromptTemplate` itself and its two write payloads live
@@ -50,8 +51,10 @@ export const PromptSearchQuerySchema = z
                     'Accepted and ignored. `GET /prompts` and `POST /prompts/facets` list drafts only, and always have.',
             })
             .optional(),
-        limit: z.number().meta({ description: 'Maximum number of prompts to return. Defaults to 100.' }).optional(),
-        offset: z.number().meta({ description: 'Number of prompts to skip.' }).optional(),
+        limit: PageCountSchema.meta({
+            description: 'Maximum number of prompts to return. Defaults to 100.',
+        }).optional(),
+        offset: PageCountSchema.meta({ description: 'Number of prompts to skip.' }).optional(),
         role: z.string().meta({ description: 'Exact match on the prompt role.' }).optional(),
         tags: z.array(z.string()).meta({ description: 'Match prompts carrying any of these tags.' }).optional(),
         matchInteractions: z

package/src/api-schemas/registry.ts

@@ -88,6 +88,16 @@ import {
     AppDevelopmentTaskDetailsSchema,
     AppDevelopmentTaskListSchema,
     AppDevelopmentTaskSchema,
+    AppGithubAccountSchema,
+    AppGithubBranchStateSchema,
+    AppGithubConfigurationSchema,
+    AppGithubInstallationSchema,
+    AppGithubRepositoriesQuerySchema,
+    AppGithubRepositoryCreationSchema,
+    AppGithubRepositoryListSchema,
+    AppGithubRepositorySchema,
+    AppGithubRepositorySetupQuerySchema,
+    AppGithubRepositorySetupSchema,
     AppInspectionCapabilityReportSchema,
     AppInspectionIssueSchema,
     AppInspectionResultSchema,
@@ -97,6 +107,7 @@ import {
     AppInstallationProjectsQuerySchema,
     AppInstallationProviderBindingSchema,
     AppInstallationsQuerySchema,
+    AppInstanceAvailabilitySchema,
     AppListScopeSchema,
     AppOAuthCollectionParamsSchema,
     AppOAuthProviderParamsSchema,
@@ -112,6 +123,7 @@ import {
     AppScaffoldModuleSchema,
     AppScaffoldProgressSchema,
     AppScaffoldProgressStatusSchema,
+    AppScaffoldSourceModeSchema,
     AppsQuerySchema,
     AppToolCollectionArraySchema,
     AppToolCollectionSchema,
@@ -128,6 +140,8 @@ import {
     ConversationActivityStateSchema,
     DeleteAppVersionResponseSchema,
     EventRefSchema,
+    ExchangeAppGithubAuthorizationRequestSchema,
+    ExchangeAppGithubAuthorizationResponseSchema,
     Extract_AppVersionGitRefType_branch_tag_commitSchema,
     InCodeTypeRefSchema,
     McpApiKeyCredentialSchema,
@@ -138,6 +152,7 @@ import {
     StartAppBuildRequestSchema,
     StartAppBuildResponseSchema,
     StartAppDevelopmentTaskRequestSchema,
+    StartAppGithubAuthorizationResponseSchema,
     StartAppScaffoldRequestSchema,
     StartAppScaffoldResponseSchema,
     StoredTypeRefSchema,
@@ -152,6 +167,7 @@ import * as AppRuntimeSchemas from './app-runtime.js';
 import {
     AppAccessControlSchema,
     AppCapabilitiesSchema,
+    AppGitSourceProviderSchema,
     AppManifestSourceSchema,
     AppSourceConfigSchema,
     AppUIConfigSchema,
@@ -657,7 +673,12 @@ import {
     OAuthRegistrationSourceSchema,
     OAuthResponseTypeSchema,
     OAuthTokenEndpointAuthMethodSchema,
+    OAuthTokenExchangeRequestSchema,
+    OAuthTokenExchangeResponseSchema,
     OAuthTokenResponseSchema,
+    OidcFederationConnectionArraySchema,
+    OidcFederationConnectionPayloadSchema,
+    OidcFederationConnectionSchema,
     RevokeOAuthGrantQuerySchema,
     UpdateOAuthClientPayloadSchema,
 } from './oauth-server.js';
@@ -934,6 +955,7 @@ const PROJECT_AND_APP_SCHEMAS = {
     AppCapabilities: AppCapabilitiesSchema,
     AppAccessControl: AppAccessControlSchema,
     AppSourceConfig: AppSourceConfigSchema,
+    AppGitSourceProvider: AppGitSourceProviderSchema,
     AppManifestSource: AppManifestSourceSchema,
 } as const satisfies Record<string, z.ZodType>;
 
@@ -987,6 +1009,12 @@ const OAUTH_SCHEMAS = {
     OAuthDeviceAuthorizationRequest: OAuthDeviceAuthorizationRequestSchema,
     OAuthDeviceAuthorizationResponse: OAuthDeviceAuthorizationResponseSchema,
     OAuthTokenResponse: OAuthTokenResponseSchema,
+    OidcFederationConnectionPayload: OidcFederationConnectionPayloadSchema,
+    OidcFederationConnection: OidcFederationConnectionSchema,
+    OidcFederationConnectionArray: OidcFederationConnectionArraySchema,
+    OAuthTokenExchangeRequest: OAuthTokenExchangeRequestSchema,
+    OAuthTokenExchangeResponse: OAuthTokenExchangeResponseSchema,
+
     // Clients registered against Vertesia's own OAuth server. `OAuthClientData` is composed into
     // `OAuthClient` rather than hoisted, so it has no component of its own — as today.
     OAuthClient: OAuthClientSchema,
@@ -2224,6 +2252,20 @@ const APP_LIFECYCLE_SCHEMAS = {
     AppRepoBranch: AppRepoBranchSchema,
     AppRepoDocumentCommit: AppRepoDocumentCommitSchema,
     AppVersionGitSource: AppVersionGitSourceSchema,
+    AppGithubConfiguration: AppGithubConfigurationSchema,
+    StartAppGithubAuthorizationResponse: StartAppGithubAuthorizationResponseSchema,
+    ExchangeAppGithubAuthorizationRequest: ExchangeAppGithubAuthorizationRequestSchema,
+    AppGithubRepositoriesQuery: AppGithubRepositoriesQuerySchema,
+    ExchangeAppGithubAuthorizationResponse: ExchangeAppGithubAuthorizationResponseSchema,
+    AppGithubInstallation: AppGithubInstallationSchema,
+    AppGithubAccount: AppGithubAccountSchema,
+    AppGithubRepository: AppGithubRepositorySchema,
+    AppGithubRepositoryCreation: AppGithubRepositoryCreationSchema,
+    AppGithubRepositoryList: AppGithubRepositoryListSchema,
+    AppGithubRepositorySetupQuery: AppGithubRepositorySetupQuerySchema,
+    AppGithubBranchState: AppGithubBranchStateSchema,
+    AppGithubRepositorySetup: AppGithubRepositorySetupSchema,
+    AppScaffoldSourceMode: AppScaffoldSourceModeSchema,
     StartAppScaffoldRequest: StartAppScaffoldRequestSchema,
     StartAppDevelopmentTaskRequest: StartAppDevelopmentTaskRequestSchema,
     StartAppBuildRequest: StartAppBuildRequestSchema,
@@ -2248,6 +2290,7 @@ const APP_LIFECYCLE_SCHEMAS = {
     AgentRunSearchHit: AgentRunSearchHitSchema,
     UpsertAppVersionRequest: UpsertAppVersionRequestSchema,
     AppInstallationPayload: AppInstallationPayloadSchema,
+    AppInstanceAvailability: AppInstanceAvailabilitySchema,
     AppDevelopmentTaskDetails: AppDevelopmentTaskDetailsSchema,
     AppVersionRecordArray: AppVersionRecordArraySchema,
     AppToolCollectionArray: AppToolCollectionArraySchema,
@@ -2338,6 +2381,7 @@ const APP_MANIFEST_SCHEMAS = {
     MCPOAuthConfigMap: AppRuntimeSchemas.MCPOAuthConfigMapSchema,
     AppWidgetInfo: AppRuntimeSchemas.AppWidgetInfoSchema,
     AppDashboardDefinition: AppRuntimeSchemas.AppDashboardDefinitionSchema,
+    AppOAuthClientConfig: AppRuntimeSchemas.AppOAuthClientConfigSchema,
     AppManifestData: AppRuntimeSchemas.AppManifestDataSchema,
     UpdateAppPayload: AppRuntimeSchemas.UpdateAppPayloadSchema,
     AppManifest: AppRuntimeSchemas.AppManifestSchema,
@@ -2557,6 +2601,10 @@ const API_SCHEMAS: Readonly<Record<ApiComponentName, z.ZodType>> = mergeComponen
  * objects, so a body carrying an undeclared property is rejected rather than quietly accepted.
  */
 const STRICT_COMPONENTS: ReadonlySet<string> = new Set<string>([
+    'OidcFederationConnectionPayload',
+    'OidcFederationConnection',
+    'OAuthTokenExchangeRequest',
+    'OAuthTokenExchangeResponse',
     'UpdateInteractionConfigurationPayload',
     'InteractionConfigurationRecord',
     'InteractionConfigurationResult',
@@ -2774,6 +2822,8 @@ const STRICT_COMPONENTS: ReadonlySet<string> = new Set<string>([
     'MCPOAuthConfig',
     'MCPApiKeyConfig',
     'MCPToolCollectionObject',
+    'McpPublicParameter',
+    'McpSecretParameter',
     'VertesiaSDKToolCollectionObject',
     // File, task, content-type and command components. Every one is published closed
     // today; `StringValueMap`, `MigrationListResponse`, `TaskArray`, the two content-type array
@@ -3474,6 +3524,8 @@ const STRICT_COMPONENTS: ReadonlySet<string> = new Set<string>([
     'AgentRunSearchHit',
     'UpsertAppVersionRequest',
     'AppInstallationPayload',
+    'AppInstanceAvailability',
+    'AppOAuthClientConfig',
     'AppDevelopmentTaskDetails',
     'AppInstallationsQuery',
     'AppsQuery',

package/src/api-schemas/schema-primitives.ts

@@ -11,6 +11,15 @@ export const nullableNumberSchema = z
     .nullable()
     .meta({ anyOf: undefined, type: ['number', 'null'] });
 
+/**
+ * A `limit` or `offset` query count: a whole number, zero or more. A fraction or a negative count used to
+ * reach the database and fail there as a 500.
+ *
+ * Published as `type: number` with `multipleOf: 1` rather than `type: integer`, so the generated Java and Go
+ * clients keep the parameter types they already expose while the contract enforcer answers 400.
+ */
+export const PageCountSchema = z.number().multipleOf(1).min(0);
+
 /** Monotonic token for optimistic concurrency on mutable, user-authored resources. */
 export const EditRevisionSchema = z
     .number()

package/src/api-schemas/store.ts

@@ -3,7 +3,7 @@ import { z } from 'zod';
 // From the values module, for the reason `./apikey.js` gives.
 import { ConfigModes, RunDataStorageLevel } from '../interaction-values.js';
 import { InferenceProfileIdSchema } from './inference-profile.js';
-import { EditRevisionSchema, ExpectedEditRevisionSchema } from './schema-primitives.js';
+import { EditRevisionSchema, ExpectedEditRevisionSchema, PageCountSchema } from './schema-primitives.js';
 
 /**
  * Runtime API schemas for the content-intake policy tree.
@@ -643,8 +643,8 @@ export const ContentObjectTypeSchema = z.strictObject(storedContentTypeShape).me
 const contentTypeListingFields = {
     layout: z.boolean().optional(),
     schema: z.boolean().optional(),
-    limit: z.number().optional(),
-    offset: z.number().optional(),
+    limit: PageCountSchema.optional(),
+    offset: PageCountSchema.optional(),
 };
 
 export const ContentObjectTypeCatalogQuerySchema = z

package/src/api-schemas/task.ts

@@ -1,4 +1,5 @@
 import { z } from 'zod';
+import { PageCountSchema } from './schema-primitives.js';
 
 export const CompleteTaskPayloadSchema = z
     .strictObject({
@@ -98,7 +99,7 @@ export const ListTasksQuerySchema = z
         assignee: z.string().optional(),
         run_id: z.string().optional(),
         source_type: TaskSourceSchema.shape.type.optional(),
-        limit: z.number().optional(),
-        offset: z.number().optional(),
+        limit: PageCountSchema.optional(),
+        offset: PageCountSchema.optional(),
     })
     .meta({ id: 'ListTasksQuery' });

package/src/apikey.ts

@@ -97,6 +97,14 @@ export interface AuthTokenPayload {
      */
     apps: string[];
 
+    /** Versioned grants for installations in the selected project. Absence means a legacy token. */
+    app_installations?: {
+        version: 1;
+        project_id: string;
+        ids: string[];
+        ui_restrictions?: string[];
+    };
+
     /**
      * Apps in `apps[]` whose UI surface is restricted for this principal — present only on
      * user tokens, and only when at least one app applies. Such apps grant functional access

package/src/apps.ts

@@ -1,8 +1,28 @@
+import type { AuthTokenPayload } from './apikey.js';
 import type * as Wire from './wire-types.generated.js';
 
 /** Allowed values for AppUINavItem.preferredSection */
 export const PREFERRED_SECTIONS = ['default', 'footer', 'settings'] as const;
 
+function trimBoundaryHyphens(value: string): string {
+    let start = 0;
+    let end = value.length;
+    while (start < end && value[start] === '-') start++;
+    while (end > start && value[end - 1] === '-') end--;
+    return value.slice(start, end);
+}
+
+/** Convert an app display/package name into the canonical persisted app id. */
+export function slugifyAppId(value: string): string {
+    const normalized = value
+        .trim()
+        .toLowerCase()
+        .replace(/[^a-z0-9._-]+/g, '-');
+    const slug = trimBoundaryHyphens(normalized).slice(0, 80);
+    if (!slug) throw new Error('App name must contain at least one letter or number');
+    return slug;
+}
+
 // The app-manifest closure is declared once, as the Zod schemas in `./api-schemas/apps.ts`, and
 // inferred below. The documentation moved with it: what a published component says about a field now
 // comes from the schema's own `.meta({ description })` rather than from a TSDoc comment a generator
@@ -41,6 +61,7 @@ export interface AppUINavItem {
 }
 
 export type AppUIConfig = Wire.AppUIConfig;
+export type AppOAuthClientConfig = Wire.AppOAuthClientConfig;
 
 export type AppInstallationProjectsQuery = Wire.AppInstallationProjectsQuery;
 
@@ -81,11 +102,24 @@ function deriveMCPCollectionId(input: string): string {
  * @param vars - Optional endpoint variables to substitute in URLs
  * @returns Normalized ToolCollectionObject
  */
-export function normalizeToolCollection(collection: ToolCollectionObject, vars?: Endpoints): ToolCollectionObject {
+export function normalizeToolCollection(
+    collection: ToolCollectionObject,
+    vars?: Endpoints,
+    sharedParameters?: MCPToolCollectionObject['parameters'],
+): ToolCollectionObject {
     if (!collection || typeof collection !== 'object') {
         throw new TypeError('Tool collection must be an object');
     }
-    const substitutedUrl = vars && collection.url ? substituteEndpoints(collection.url, vars) : collection.url;
+    const substitutedUrl =
+        vars && collection.url
+            ? substituteEndpoints(
+                  collection.url,
+                  vars,
+                  collection.type === 'mcp'
+                      ? [...Object.keys(sharedParameters ?? {}), ...Object.keys(collection.parameters ?? {})]
+                      : [],
+              )
+            : collection.url;
     const urlChanged = substitutedUrl !== collection.url;
     if (collection.type === 'mcp') {
         const fallbackId = deriveMCPCollectionId(collection.id || collection.name || collection.url);
@@ -191,10 +225,26 @@ export type AppBuildProgress = Wire.AppBuildProgress;
 
 export type AppScaffoldModule = Wire.AppScaffoldModule;
 
+export type AppScaffoldSourceMode = Wire.AppScaffoldSourceMode;
+
 export type StartAppScaffoldRequest = Wire.StartAppScaffoldRequest;
 
 export type StartAppScaffoldResponse = Wire.StartAppScaffoldResponse;
 
+export type AppGithubConfiguration = Wire.AppGithubConfiguration;
+export type StartAppGithubAuthorizationResponse = Wire.StartAppGithubAuthorizationResponse;
+export type ExchangeAppGithubAuthorizationRequest = Wire.ExchangeAppGithubAuthorizationRequest;
+export type AppGithubRepositoriesQuery = Wire.AppGithubRepositoriesQuery;
+export type AppGithubInstallation = Wire.AppGithubInstallation;
+export type AppGithubAccount = Wire.AppGithubAccount;
+export type ExchangeAppGithubAuthorizationResponse = Wire.ExchangeAppGithubAuthorizationResponse;
+export type AppGithubRepository = Wire.AppGithubRepository;
+export type AppGithubRepositoryCreation = Wire.AppGithubRepositoryCreation;
+export type AppGithubRepositoryList = Wire.AppGithubRepositoryList;
+export type AppGithubRepositorySetupQuery = Wire.AppGithubRepositorySetupQuery;
+export type AppGithubBranchState = Wire.AppGithubBranchState;
+export type AppGithubRepositorySetup = Wire.AppGithubRepositorySetup;
+
 export type StartAppDevelopmentTaskRequest = Wire.StartAppDevelopmentTaskRequest;
 
 export type AppScaffoldProgressStatus = Wire.AppScaffoldProgressStatus;
@@ -232,6 +282,7 @@ export type AppManifestData = Wire.AppManifestData;
 export type UpdateAppPayload = Wire.UpdateAppPayload;
 
 export type AppGitSourceConfig = Wire.AppGitSourceConfig;
+export type AppGitSourceProvider = Wire.AppGitSourceProvider;
 
 export type AppSourceConfig = Wire.AppSourceConfig;
 
@@ -262,9 +313,11 @@ export interface Endpoints {
  * with the unresolved placeholder visible, rather than silently pointing nowhere).
  * Trailing slashes on replacement values are stripped to avoid `//api/...` joins.
  */
-function substituteEndpoints(url: string, endpoints?: Endpoints): string {
+function substituteEndpoints(url: string, endpoints?: Endpoints, parameterNames: string[] = []): string {
     if (!url || !endpoints) return url;
     return url.replace(/\{\{\s*(\w+)\s*\}\}/g, (match, key: string) => {
+        // Explicit installation parameters take precedence over legacy platform endpoint placeholders.
+        if (parameterNames.includes(key)) return match;
         const value = (endpoints as Record<string, string | undefined>)[key];
         if (typeof value !== 'string' || !value) return match;
         return trimTrailingSlashes(value);
@@ -632,3 +685,63 @@ export type ValidateUrlResponse = Wire.ValidateUrlResponse;
 export type AppDeleteSummary = Wire.AppDeleteSummary;
 
 export type UpdateAppInstallationOAuthApprovalPayload = Wire.UpdateAppInstallationOAuthApprovalPayload;
+
+/** Check exact installation grants; legacy app-name grants authorize only the default instance. */
+export function hasAppInstallationAccess(
+    token: AuthTokenPayload,
+    installation: { id: string; project: string; instance_key?: string; manifest: { name: string } },
+    ui = false,
+): boolean {
+    if (token.project?.id !== installation.project) return false;
+    const grants = token.app_installations;
+    if (grants !== undefined) {
+        if (grants.version !== 1 || grants.project_id !== installation.project) return false;
+        if (grants.ids.includes(installation.id)) {
+            return !ui || !grants.ui_restrictions?.includes(installation.id);
+        }
+    }
+    // Default app-name grants survive reinstalling the same app with a new installation ID.
+    // Named instances never inherit these grants, including on refreshed running-agent tokens.
+    return (
+        (!installation.instance_key || installation.instance_key === 'default') &&
+        (token.apps ?? []).includes(installation.manifest.name) &&
+        (!ui || !token.ui_restrictions?.includes(installation.manifest.name))
+    );
+}
+
+/** Persist this effective collection in catalogs so discovery and execution use the same namespace. */
+export function resolveInstallationCollection(
+    collection: ToolCollectionObject,
+    installation: Pick<AppInstallation, 'instance_key' | 'namespace_overrides' | 'namespace_conflicts'>,
+): ToolCollectionObject {
+    if (collection.type === 'mcp' && installation.namespace_conflicts?.includes(collection.id)) {
+        throw new Error(`Namespace conflict for MCP collection '${collection.id}'; resolve it in project app settings`);
+    }
+    if (collection.type !== 'mcp') return collection;
+    const overrides = installation.namespace_overrides;
+    if (overrides && Object.hasOwn(overrides, collection.id)) {
+        const namespace = overrides[collection.id];
+        if (typeof namespace === 'string' && namespace.length > 0) return { ...collection, namespace };
+    } else if (!installation.instance_key || installation.instance_key === 'default') {
+        return collection;
+    }
+    throw new Error(`Namespace allocation required for MCP collection '${collection.id}'`);
+}
+
+export type AppInstanceAvailability = Wire.AppInstanceAvailability;
+export type McpPublicParameter = Wire.McpPublicParameter;
+export type McpSecretParameter = Wire.McpSecretParameter;
+export type McpConnectionParameter = Wire.McpConnectionParameter;
+
+/** Whether a manifest can safely back an additional MCP-only installation. */
+export function isMcpOnlyInstanceManifest(
+    manifest: Pick<AppManifestData, 'endpoint' | 'ui' | 'capabilities' | 'tool_collections'>,
+): boolean {
+    return (
+        !manifest.endpoint &&
+        !manifest.ui &&
+        !manifest.capabilities?.some((capability) => capability !== 'tools') &&
+        !!manifest.tool_collections?.length &&
+        manifest.tool_collections.every((collection) => normalizeToolCollection(collection).type === 'mcp')
+    );
+}

package/src/interaction.ts

@@ -2,6 +2,7 @@ import type {
     CompletionResult,
     ExecutionTokenUsage,
     JSONSchema,
+    // biome-ignore lint/suspicious/noDeprecatedImports: Legacy output_modality contracts still require this enum.
     Modalities,
     PromptCacheDiagnostic,
     StatelessExecutionOptions,

package/src/oauth-server.ts

@@ -62,3 +62,13 @@ export type OAuthLoginPayload = Wire.OAuthLoginPayload;
 export type OAuthLoginDecisionResponse = Wire.OAuthLoginDecisionResponse;
 
 export type OAuthLoginUserNotFoundResponse = Wire.OAuthLoginUserNotFoundResponse;
+
+export type OidcFederationConnectionPayload = Wire.OidcFederationConnectionPayload;
+
+export type OidcFederationConnection = Wire.OidcFederationConnection;
+
+export type OidcFederationConnectionArray = Wire.OidcFederationConnectionArray;
+
+export type OAuthTokenExchangeRequest = Wire.OAuthTokenExchangeRequest;
+
+export type OAuthTokenExchangeResponse = Wire.OAuthTokenExchangeResponse;

package/src/store/index.ts

@@ -15,4 +15,5 @@ export * from './schedule.js';
 export * from './signals.js';
 export * from './store.js';
 export * from './task.js';
+export * from './text-limits.js';
 export * from './workflow.js';

package/src/store/intake-policy-schema.generated.ts

@@ -1236,8 +1236,7 @@ export const ContentTypeIntakePolicySchema: JSONObject = {
                     },
                 },
                 effort: {
-                    type: 'string',
-                    enum: ['none', 'high'],
+                    $ref: '#/$defs/ReasoningEffort',
                 },
                 random_seed: {
                     type: 'integer',