@vertesia/common 1.6.0-dev.20261014.015055Z → 1.6.0-dev.20261022.120426Z

package/src/api-schemas/interaction.ts

@@ -28,7 +28,7 @@ import { InferenceProfileIdSchema, InferenceProfileSnapshotSchema } from './infe
 import { AccountRefSchema } from './invites.js';
 import { ProcessAgentExecutionPolicySchema } from './process-agent-policy.js';
 import { AgentBudgetConfigurationSchema, AgentCheckpointConfigurationSchema } from './project-configuration.js';
-import { EditRevisionSchema, ExpectedEditRevisionSchema } from './schema-primitives.js';
+import { EditRevisionSchema, ExpectedEditRevisionSchema, PageCountSchema } from './schema-primitives.js';
 import { InteractionExecutionConfigurationSchema, RunDataStorageLevelSchema } from './store.js';
 
 /**
@@ -498,8 +498,8 @@ export const InteractionForkPayloadSchema = z
 
 export const InteractionEndpointQuerySchema = z
     .strictObject({
-        limit: z.number().optional(),
-        offset: z.number().optional(),
+        limit: PageCountSchema.optional(),
+        offset: PageCountSchema.optional(),
         status: InteractionStatusSchema.optional(),
         visibility: InteractionVisibilitySchema.optional(),
         version: z.number().optional(),
@@ -701,8 +701,10 @@ export const RunSearchQuerySchema = z
  */
 export const RunListQuerySchema = z
     .strictObject({
-        limit: z.number().int().meta({ description: 'Maximum number of runs to return.' }).optional(),
-        offset: z.number().int().meta({ description: 'Number of runs to skip.' }).optional(),
+        // Already published as `integer`, so these keep that type and only gain the lower bound a find
+        // `skip` needs; a negative count failed there as a 500.
+        limit: z.number().int().min(0).meta({ description: 'Maximum number of runs to return.' }).optional(),
+        offset: z.number().int().min(0).meta({ description: 'Number of runs to skip.' }).optional(),
         interaction: z
             .array(z.string())
             .meta({ description: 'Interaction ids, or in-code interaction names, to filter by.' })
@@ -1144,8 +1146,8 @@ export const RunSearchPayloadSchema = z
             })
             .optional(),
         query: RunSearchQuerySchema.optional(),
-        limit: z.number().optional(),
-        offset: z.number().optional(),
+        limit: PageCountSchema.optional(),
+        offset: PageCountSchema.optional(),
         select: z.string().optional(),
         all_revisions: z.boolean().optional(),
         from_root: z.string().optional(),
@@ -2131,6 +2133,20 @@ export const AgentEvaluateRequestSchema = z.boolean().optional().meta({
         'Request LLM evaluation when the project evaluation policy is opt_in. Defaults to false. Cannot override disabled or opt out of always_on.',
 });
 
+export const AgentRunIdempotencyKeySchema = z
+    .string()
+    .min(1)
+    .max(256)
+    .meta({
+        description:
+            'Client-chosen key, unique per intended run, that makes this request safe to retry. A repeat of ' +
+            'the request with the same key and the same body returns the agent run the first request started ' +
+            'instead of starting another. Reusing a key with a different body is rejected with 409, and a ' +
+            'repeat that arrives while the first request is still starting the run may be answered with 503 ' +
+            'and `Retry-After`. Keys are scoped to the project and stay bound to their run for as long as it ' +
+            'exists; once the run is deleted, the same key starts a new one.',
+    });
+
 export const ConversationEnrichmentFields = {
     title: z.string().min(1).meta({ description: 'Caller-provided conversation title.' }).optional(),
     topic: z
@@ -2206,6 +2222,7 @@ export const AsyncConversationExecutionPayloadSchema = z
             .array(z.string())
             .meta({ description: 'An array of endpoint URLs to be notified upon execution' })
             .optional(),
+        idempotency_key: AgentRunIdempotencyKeySchema.optional(),
         task_queue: z.string().optional(),
         tool_approval_mode: AgentToolApprovalModeSchema.meta({
             description: 'Effective tool approval mode for interactive agent conversations.',
@@ -2444,9 +2461,33 @@ export const StoredCatalogInteractionsQuerySchema = z
     })
     .meta({ id: 'StoredCatalogInteractionsQuery' });
 
+/** `include_prompt`: whether a response carries the rendered prompt sent to the model. */
+function includePromptQuery(description: string) {
+    return z.boolean().meta({ description }).optional();
+}
+
+export const GetRunQuerySchema = z
+    .strictObject({
+        include_prompt: includePromptQuery(
+            'Whether the run includes the rendered `prompt` sent to the model. Defaults to true. Pass false when the caller does not read the prompt: it can be large (for example when media is inlined), and it is then not loaded from storage.',
+        ),
+    })
+    .meta({ id: 'GetRunQuery' });
+
+const ExecutionIncludePromptQuerySchema = includePromptQuery(
+    'Whether the synchronous execution result includes the rendered `prompt` sent to the model. Defaults to true. Pass false when the caller does not read the prompt: it can be large (for example when media is inlined). It is still stored with the run unless run data storage is restricted.',
+);
+
+export const ExecuteNamedInteractionQuerySchema = z
+    .strictObject({
+        include_prompt: ExecutionIncludePromptQuerySchema,
+    })
+    .meta({ id: 'ExecuteNamedInteractionQuery' });
+
 export const ExecuteInteractionByEndpointQuerySchema = z
     .strictObject({
         tag: z.string().optional(),
+        include_prompt: ExecutionIncludePromptQuerySchema,
     })
     .meta({ id: 'ExecuteInteractionByEndpointQuery' });
 

package/src/api-schemas/oauth-server.ts

@@ -20,11 +20,16 @@ export const OAuthRegistrationSourceSchema = z.enum(['admin', 'dynamic']).meta({
 export const OAuthProjectBindingModeSchema = z.enum(['user_select', 'fixed']).meta({ id: 'OAuthProjectBindingMode' });
 
 export const OAuthTokenEndpointAuthMethodSchema = z
-    .enum(['none', 'client_secret_post', 'client_secret_basic'])
+    .enum(['none', 'client_secret_post', 'client_secret_basic', 'private_key_jwt'])
     .meta({ id: 'OAuthTokenEndpointAuthMethod' });
 
 export const OAuthGrantTypeSchema = z
-    .enum(['authorization_code', 'refresh_token', 'urn:ietf:params:oauth:grant-type:device_code'])
+    .enum([
+        'authorization_code',
+        'refresh_token',
+        'urn:ietf:params:oauth:grant-type:device_code',
+        'urn:ietf:params:oauth:grant-type:token-exchange',
+    ])
     .meta({ id: 'OAuthGrantType' });
 
 export const OAuthResponseTypeSchema = z.literal('code').meta({ id: 'OAuthResponseType' });
@@ -58,6 +63,7 @@ export const OAuthAuthorizationServerMetadataSchema = z
         grant_types_supported: z.array(z.string()),
         code_challenge_methods_supported: z.array(z.string()),
         token_endpoint_auth_methods_supported: z.array(z.string()),
+        token_endpoint_auth_signing_alg_values_supported: z.array(z.string()).optional(),
         scopes_supported: z.array(z.string()),
         client_id_metadata_document_supported: z.boolean().optional(),
         authorization_response_iss_parameter_supported: z.boolean().optional(),
@@ -110,6 +116,7 @@ export const OAuthAuthorizationRequestSchema = z
         }),
         client_id: z.string(),
         client_name: z.string(),
+        app_id: z.string().optional(),
         client_metadata: OAuthClientDisplayMetadataSchema.optional(),
         client_registration_mode: OAuthClientRegistrationModeSchema.optional(),
         redirect_uri: z.string(),
@@ -212,12 +219,17 @@ export const OAuthTokenResponseSchema = z
  * publishes these properties inline under `OAuthClient`, with `client_id` last.
  */
 export const OAuthClientDataSchema = z.strictObject({
+    app_id: z.string().optional().meta({
+        description:
+            'App associated with this client. Authorization requires an installation explicitly enabling this client and current user app access.',
+    }),
     client_name: z.string(),
     client_type: OAuthClientTypeSchema,
     redirect_uris: z.array(z.string()),
     grant_types: z.array(OAuthGrantTypeSchema),
     response_types: z.array(OAuthResponseTypeSchema),
     token_endpoint_auth_method: OAuthTokenEndpointAuthMethodSchema,
+    jwks_uri: z.string().url().optional(),
     allowed_scopes: z.array(z.string()),
     default_scopes: z.array(z.string()).optional(),
     registration_source: OAuthRegistrationSourceSchema,
@@ -269,6 +281,7 @@ export const CreateOAuthClientPayloadSchema = z
         grant_types: z.array(OAuthGrantTypeSchema).optional(),
         response_types: z.array(OAuthResponseTypeSchema).optional(),
         token_endpoint_auth_method: OAuthTokenEndpointAuthMethodSchema.optional(),
+        jwks_uri: z.string().url().optional(),
         allowed_scopes: z.array(z.string()).optional(),
         default_scopes: z.array(z.string()).optional(),
         project_binding_mode: OAuthProjectBindingModeSchema.optional(),
@@ -292,9 +305,13 @@ export const UpdateOAuthClientPayloadSchema = z
         grant_types: z.array(OAuthGrantTypeSchema).optional(),
         response_types: z.array(OAuthResponseTypeSchema).optional(),
         token_endpoint_auth_method: OAuthTokenEndpointAuthMethodSchema.optional(),
+        jwks_uri: z.string().url().optional(),
         allowed_scopes: z.array(z.string()).optional(),
         default_scopes: z.array(z.string()).optional(),
         status: OAuthClientStatusSchema.optional(),
+        revoke_previous_client_secret: z.boolean().optional().meta({
+            description: 'Immediately revoke the previous rotation secret while retaining the current secret.',
+        }),
         project_binding_mode: OAuthProjectBindingModeSchema.optional(),
         fixed_project_id: z.string().optional(),
         restrict_to_owner_account: z.boolean().optional(),
@@ -406,3 +423,87 @@ export const OAuthLoginUserNotFoundResponseSchema = z
         ensure_user_url: z.string(),
     })
     .meta({ id: 'OAuthLoginUserNotFoundResponse' });
+
+const federationId = z.string().regex(/^[a-fA-F0-9]{24}$/);
+export const OidcFederationConnectionPayloadSchema = z
+    .strictObject({
+        name: z.string().min(1).max(200),
+        issuer: z.string().url(),
+        jwks_uri: z.string().url().optional(),
+        external_id_claim: z.string().min(1).max(256).regex(/\S/).meta({
+            description:
+                'Exact top-level verified token claim matched to SCIM externalId within the owning provisioning account.',
+        }),
+        allowed_audiences: z.array(z.string().min(1)).min(1).max(20),
+        allowed_algorithms: z
+            .array(z.enum(['RS256', 'ES256']))
+            .min(1)
+            .max(2),
+        subject_token_type: z.enum([
+            'urn:ietf:params:oauth:token-type:jwt',
+            'urn:ietf:params:oauth:token-type:id_token',
+            'urn:ietf:params:oauth:token-type:access_token',
+        ]),
+        required_claims: z.record(z.string(), z.string()).optional().meta({
+            description: 'Exact string matches against verified top-level IdP claims, such as tenant or azp.',
+        }),
+        all_projects: z.boolean().optional().meta({
+            description:
+                'Explicitly allow all current and future projects in the owning organization, subject to the user’s current access. Defaults to false for existing allowlists. When true, allowed_project_ids must be empty.',
+        }),
+        allowed_project_ids: z.array(federationId).max(100).meta({
+            description: 'Explicit project allowlist. Must contain 1–100 projects unless all_projects is true.',
+        }),
+        allowed_client_ids: z.array(z.string().min(1).max(256)).min(1).max(20).optional().meta({
+            description:
+                'When set, require authentication by one of these account-owned confidential OAuth clients. Omit to allow exchanges without separate client authentication.',
+        }),
+        allowed_scopes: z.array(z.string().min(1)).min(1).max(100).optional().meta({
+            description:
+                'Optional restriction on delegable Vertesia permissions, excluding account:admin. Omit to use the user’s current permissions. An explicit list further restricts the grant.',
+        }),
+        max_token_ttl_seconds: z.number().int().min(30).max(300),
+        max_subject_token_age_seconds: z.number().int().min(30).max(86400).optional().meta({
+            description:
+                'Maximum age since the signed iat claim. Defaults to 3600 seconds; 60 seconds of clock tolerance applies.',
+        }),
+        enabled: z.boolean(),
+    })
+    .meta({ id: 'OidcFederationConnectionPayload' });
+export const OidcFederationConnectionSchema = OidcFederationConnectionPayloadSchema.extend({
+    id: federationId,
+    account_id: federationId,
+    max_subject_token_age_seconds: z.number().int().min(30).max(86400),
+}).meta({ id: 'OidcFederationConnection' });
+export const OidcFederationConnectionArraySchema = z
+    .array(OidcFederationConnectionSchema)
+    .meta({ id: 'OidcFederationConnectionArray' });
+export const OAuthTokenExchangeRequestSchema = z
+    .strictObject({
+        grant_type: z.literal('urn:ietf:params:oauth:grant-type:token-exchange'),
+        subject_token: z.string().min(1).max(65536),
+        subject_token_type: OidcFederationConnectionPayloadSchema.shape.subject_token_type,
+        requested_token_type: z.literal('urn:ietf:params:oauth:token-type:access_token').optional(),
+        federation_connection_id: federationId,
+        client_id: z.string().min(1).max(256).optional(),
+        client_secret: z.string().min(1).max(4096).optional(),
+        client_assertion: z.string().min(1).max(16384).optional(),
+        client_assertion_type: z.literal('urn:ietf:params:oauth:client-assertion-type:jwt-bearer').optional(),
+        project_id: federationId,
+        resource: z.string().min(1),
+        scope: z.string().min(1).max(4096).optional().meta({
+            description:
+                'Optional space-separated permission subset. Omit to use current user permissions within the connection policy.',
+        }),
+    })
+    .meta({ id: 'OAuthTokenExchangeRequest' });
+export const OAuthTokenExchangeResponseSchema = OAuthTokenResponseSchema.omit({
+    refresh_token: true,
+    refresh_token_expires_in: true,
+    id_token: true,
+})
+    .extend({
+        token_type: z.literal('Bearer'),
+        issued_token_type: z.literal('urn:ietf:params:oauth:token-type:access_token'),
+    })
+    .meta({ id: 'OAuthTokenExchangeResponse' });

package/src/api-schemas/process.ts

@@ -155,6 +155,19 @@ export const PublishProcessDefinitionPayloadSchema = z
             .optional(),
         label: z.string().meta({ description: 'Optional human-readable revision label.' }).optional(),
         comment: z.string().meta({ description: 'Optional publish note.' }).optional(),
+        idempotency_key: z
+            .string()
+            .min(1)
+            .max(256)
+            .meta({
+                description:
+                    'Client-chosen key that makes this request safe to retry. Publishing is otherwise not ' +
+                    'idempotent: a repeat of a publish that already succeeded is rejected because the revision ' +
+                    'is no longer a draft. When the revision was published by a request with the same key and ' +
+                    'the same body, the repeat returns that revision instead. Reusing the key with a different ' +
+                    'body is rejected with 409. The key is bound to the revision it published.',
+            })
+            .optional(),
     })
     .meta({ id: 'PublishProcessDefinitionPayload' });
 

package/src/api-schemas/prompt.ts

@@ -1,5 +1,6 @@
 import { z } from 'zod';
 import { FacetSpecSchema, PromptTemplateRefSchema } from './interaction.js';
+import { PageCountSchema } from './schema-primitives.js';
 
 // The prompt-authoring contracts: what a fork, a render and a prompt search publish, and how a
 // prompt's interaction usages are reported. `PromptTemplate` itself and its two write payloads live
@@ -50,8 +51,10 @@ export const PromptSearchQuerySchema = z
                     'Accepted and ignored. `GET /prompts` and `POST /prompts/facets` list drafts only, and always have.',
             })
             .optional(),
-        limit: z.number().meta({ description: 'Maximum number of prompts to return. Defaults to 100.' }).optional(),
-        offset: z.number().meta({ description: 'Number of prompts to skip.' }).optional(),
+        limit: PageCountSchema.meta({
+            description: 'Maximum number of prompts to return. Defaults to 100.',
+        }).optional(),
+        offset: PageCountSchema.meta({ description: 'Number of prompts to skip.' }).optional(),
         role: z.string().meta({ description: 'Exact match on the prompt role.' }).optional(),
         tags: z.array(z.string()).meta({ description: 'Match prompts carrying any of these tags.' }).optional(),
         matchInteractions: z

package/src/api-schemas/registry.ts

@@ -62,8 +62,6 @@ import {
     AccountApiKeyWithValueSchema,
     ApiKeyArraySchema,
     ApiKeyListQuerySchema,
-    ApiKeyReadQuerySchema,
-    ApiKeyReadResponseSchema,
     ApiKeySchema,
     ApiKeyWithValueSchema,
     AuthTokenResponseSchema,
@@ -88,6 +86,16 @@ import {
     AppDevelopmentTaskDetailsSchema,
     AppDevelopmentTaskListSchema,
     AppDevelopmentTaskSchema,
+    AppGithubAccountSchema,
+    AppGithubBranchStateSchema,
+    AppGithubConfigurationSchema,
+    AppGithubInstallationSchema,
+    AppGithubRepositoriesQuerySchema,
+    AppGithubRepositoryCreationSchema,
+    AppGithubRepositoryListSchema,
+    AppGithubRepositorySchema,
+    AppGithubRepositorySetupQuerySchema,
+    AppGithubRepositorySetupSchema,
     AppInspectionCapabilityReportSchema,
     AppInspectionIssueSchema,
     AppInspectionResultSchema,
@@ -97,6 +105,7 @@ import {
     AppInstallationProjectsQuerySchema,
     AppInstallationProviderBindingSchema,
     AppInstallationsQuerySchema,
+    AppInstanceAvailabilitySchema,
     AppListScopeSchema,
     AppOAuthCollectionParamsSchema,
     AppOAuthProviderParamsSchema,
@@ -112,6 +121,7 @@ import {
     AppScaffoldModuleSchema,
     AppScaffoldProgressSchema,
     AppScaffoldProgressStatusSchema,
+    AppScaffoldSourceModeSchema,
     AppsQuerySchema,
     AppToolCollectionArraySchema,
     AppToolCollectionSchema,
@@ -128,6 +138,8 @@ import {
     ConversationActivityStateSchema,
     DeleteAppVersionResponseSchema,
     EventRefSchema,
+    ExchangeAppGithubAuthorizationRequestSchema,
+    ExchangeAppGithubAuthorizationResponseSchema,
     Extract_AppVersionGitRefType_branch_tag_commitSchema,
     InCodeTypeRefSchema,
     McpApiKeyCredentialSchema,
@@ -138,6 +150,7 @@ import {
     StartAppBuildRequestSchema,
     StartAppBuildResponseSchema,
     StartAppDevelopmentTaskRequestSchema,
+    StartAppGithubAuthorizationResponseSchema,
     StartAppScaffoldRequestSchema,
     StartAppScaffoldResponseSchema,
     StoredTypeRefSchema,
@@ -152,6 +165,7 @@ import * as AppRuntimeSchemas from './app-runtime.js';
 import {
     AppAccessControlSchema,
     AppCapabilitiesSchema,
+    AppGitSourceProviderSchema,
     AppManifestSourceSchema,
     AppSourceConfigSchema,
     AppUIConfigSchema,
@@ -487,6 +501,7 @@ import {
     EmailChannelSchema,
     ExecuteInteractionByEndpointHeadersSchema,
     ExecuteInteractionByEndpointQuerySchema,
+    ExecuteNamedInteractionQuerySchema,
     ExecutionResponseSchema,
     ExecutionRunDocRefSchema,
     ExecutionRunInteractionSchema,
@@ -509,6 +524,7 @@ import {
     GeneratedTestDataRecordSchema,
     GenerateInteractionPayloadSchema,
     GenerateTestDataPayloadSchema,
+    GetRunQuerySchema,
     ImprovePromptPayloadConfigSchema,
     ImprovePromptPayloadSchema,
     InCodeInteractionSchema,
@@ -657,7 +673,12 @@ import {
     OAuthRegistrationSourceSchema,
     OAuthResponseTypeSchema,
     OAuthTokenEndpointAuthMethodSchema,
+    OAuthTokenExchangeRequestSchema,
+    OAuthTokenExchangeResponseSchema,
     OAuthTokenResponseSchema,
+    OidcFederationConnectionArraySchema,
+    OidcFederationConnectionPayloadSchema,
+    OidcFederationConnectionSchema,
     RevokeOAuthGrantQuerySchema,
     UpdateOAuthClientPayloadSchema,
 } from './oauth-server.js';
@@ -871,8 +892,6 @@ const IAM_AND_ACCOUNT_SCHEMAS = {
     CreateAccountApiKeyPayload: CreateAccountApiKeyPayloadSchema,
     UpdateAccountApiKeyPayload: UpdateAccountApiKeyPayloadSchema,
 
-    ApiKeyReadResponse: ApiKeyReadResponseSchema,
-    ApiKeyReadQuery: ApiKeyReadQuerySchema,
     CreateApiKeyPayload: CreateApiKeyPayloadSchema,
     UpdateApiKeyPayload: UpdateApiKeyPayloadSchema,
     AuthTokenResponse: AuthTokenResponseSchema,
@@ -934,6 +953,7 @@ const PROJECT_AND_APP_SCHEMAS = {
     AppCapabilities: AppCapabilitiesSchema,
     AppAccessControl: AppAccessControlSchema,
     AppSourceConfig: AppSourceConfigSchema,
+    AppGitSourceProvider: AppGitSourceProviderSchema,
     AppManifestSource: AppManifestSourceSchema,
 } as const satisfies Record<string, z.ZodType>;
 
@@ -987,6 +1007,12 @@ const OAUTH_SCHEMAS = {
     OAuthDeviceAuthorizationRequest: OAuthDeviceAuthorizationRequestSchema,
     OAuthDeviceAuthorizationResponse: OAuthDeviceAuthorizationResponseSchema,
     OAuthTokenResponse: OAuthTokenResponseSchema,
+    OidcFederationConnectionPayload: OidcFederationConnectionPayloadSchema,
+    OidcFederationConnection: OidcFederationConnectionSchema,
+    OidcFederationConnectionArray: OidcFederationConnectionArraySchema,
+    OAuthTokenExchangeRequest: OAuthTokenExchangeRequestSchema,
+    OAuthTokenExchangeResponse: OAuthTokenExchangeResponseSchema,
+
     // Clients registered against Vertesia's own OAuth server. `OAuthClientData` is composed into
     // `OAuthClient` rather than hoisted, so it has no component of its own — as today.
     OAuthClient: OAuthClientSchema,
@@ -1250,6 +1276,7 @@ type ExecutionRunSchemaMap = {
     ExecutionRunRefArray: typeof ExecutionRunRefArraySchema;
     UpdateExecutionRunPayload: typeof UpdateExecutionRunPayloadSchema;
     RunCreatePayload: typeof RunCreatePayloadSchema;
+    GetRunQuery: typeof GetRunQuerySchema;
     SortOrder: typeof SortOrderSchema;
     SortOption: typeof SortOptionSchema;
     RunSearchQuery: typeof RunSearchQuerySchema;
@@ -1270,6 +1297,7 @@ const EXECUTION_RUN_SCHEMAS: ExecutionRunSchemaMap = {
     ExecutionRunRefArray: ExecutionRunRefArraySchema,
     UpdateExecutionRunPayload: UpdateExecutionRunPayloadSchema,
     RunCreatePayload: RunCreatePayloadSchema,
+    GetRunQuery: GetRunQuerySchema,
     // Listing and searching runs.
     SortOrder: SortOrderSchema,
     SortOption: SortOptionSchema,
@@ -1290,6 +1318,7 @@ const EXECUTION_REQUEST_SCHEMAS: {
     InteractionExecutionConfiguration: typeof InteractionExecutionConfigurationSchema;
     InteractionExecutionError: typeof InteractionExecutionErrorSchema;
     ResultStorageOptions: typeof ResultStorageOptionsSchema;
+    ExecuteNamedInteractionQuery: typeof ExecuteNamedInteractionQuerySchema;
     ExecuteInteractionByEndpointQuery: typeof ExecuteInteractionByEndpointQuerySchema;
     ExecuteInteractionByEndpointHeaders: typeof ExecuteInteractionByEndpointHeadersSchema;
     AsyncCompletionMode: typeof AsyncCompletionModeSchema;
@@ -1325,6 +1354,7 @@ const EXECUTION_REQUEST_SCHEMAS: {
     InteractionExecutionConfiguration: InteractionExecutionConfigurationSchema,
     InteractionExecutionError: InteractionExecutionErrorSchema,
     ResultStorageOptions: ResultStorageOptionsSchema,
+    ExecuteNamedInteractionQuery: ExecuteNamedInteractionQuerySchema,
     ExecuteInteractionByEndpointQuery: ExecuteInteractionByEndpointQuerySchema,
     ExecuteInteractionByEndpointHeaders: ExecuteInteractionByEndpointHeadersSchema,
     AsyncCompletionMode: AsyncCompletionModeSchema,
@@ -2224,6 +2254,20 @@ const APP_LIFECYCLE_SCHEMAS = {
     AppRepoBranch: AppRepoBranchSchema,
     AppRepoDocumentCommit: AppRepoDocumentCommitSchema,
     AppVersionGitSource: AppVersionGitSourceSchema,
+    AppGithubConfiguration: AppGithubConfigurationSchema,
+    StartAppGithubAuthorizationResponse: StartAppGithubAuthorizationResponseSchema,
+    ExchangeAppGithubAuthorizationRequest: ExchangeAppGithubAuthorizationRequestSchema,
+    AppGithubRepositoriesQuery: AppGithubRepositoriesQuerySchema,
+    ExchangeAppGithubAuthorizationResponse: ExchangeAppGithubAuthorizationResponseSchema,
+    AppGithubInstallation: AppGithubInstallationSchema,
+    AppGithubAccount: AppGithubAccountSchema,
+    AppGithubRepository: AppGithubRepositorySchema,
+    AppGithubRepositoryCreation: AppGithubRepositoryCreationSchema,
+    AppGithubRepositoryList: AppGithubRepositoryListSchema,
+    AppGithubRepositorySetupQuery: AppGithubRepositorySetupQuerySchema,
+    AppGithubBranchState: AppGithubBranchStateSchema,
+    AppGithubRepositorySetup: AppGithubRepositorySetupSchema,
+    AppScaffoldSourceMode: AppScaffoldSourceModeSchema,
     StartAppScaffoldRequest: StartAppScaffoldRequestSchema,
     StartAppDevelopmentTaskRequest: StartAppDevelopmentTaskRequestSchema,
     StartAppBuildRequest: StartAppBuildRequestSchema,
@@ -2248,6 +2292,7 @@ const APP_LIFECYCLE_SCHEMAS = {
     AgentRunSearchHit: AgentRunSearchHitSchema,
     UpsertAppVersionRequest: UpsertAppVersionRequestSchema,
     AppInstallationPayload: AppInstallationPayloadSchema,
+    AppInstanceAvailability: AppInstanceAvailabilitySchema,
     AppDevelopmentTaskDetails: AppDevelopmentTaskDetailsSchema,
     AppVersionRecordArray: AppVersionRecordArraySchema,
     AppToolCollectionArray: AppToolCollectionArraySchema,
@@ -2338,6 +2383,7 @@ const APP_MANIFEST_SCHEMAS = {
     MCPOAuthConfigMap: AppRuntimeSchemas.MCPOAuthConfigMapSchema,
     AppWidgetInfo: AppRuntimeSchemas.AppWidgetInfoSchema,
     AppDashboardDefinition: AppRuntimeSchemas.AppDashboardDefinitionSchema,
+    AppOAuthClientConfig: AppRuntimeSchemas.AppOAuthClientConfigSchema,
     AppManifestData: AppRuntimeSchemas.AppManifestDataSchema,
     UpdateAppPayload: AppRuntimeSchemas.UpdateAppPayloadSchema,
     AppManifest: AppRuntimeSchemas.AppManifestSchema,
@@ -2557,6 +2603,10 @@ const API_SCHEMAS: Readonly<Record<ApiComponentName, z.ZodType>> = mergeComponen
  * objects, so a body carrying an undeclared property is rejected rather than quietly accepted.
  */
 const STRICT_COMPONENTS: ReadonlySet<string> = new Set<string>([
+    'OidcFederationConnectionPayload',
+    'OidcFederationConnection',
+    'OAuthTokenExchangeRequest',
+    'OAuthTokenExchangeResponse',
     'UpdateInteractionConfigurationPayload',
     'InteractionConfigurationRecord',
     'InteractionConfigurationResult',
@@ -2683,8 +2733,6 @@ const STRICT_COMPONENTS: ReadonlySet<string> = new Set<string>([
     'AccountRef',
     'ApiKey',
     'ApiKeyWithValue',
-    'ApiKeyReadResponse',
-    'ApiKeyReadQuery',
     'CreateApiKeyPayload',
     'UpdateApiKeyPayload',
     'AuthTokenResponse',
@@ -2774,6 +2822,8 @@ const STRICT_COMPONENTS: ReadonlySet<string> = new Set<string>([
     'MCPOAuthConfig',
     'MCPApiKeyConfig',
     'MCPToolCollectionObject',
+    'McpPublicParameter',
+    'McpSecretParameter',
     'VertesiaSDKToolCollectionObject',
     // File, task, content-type and command components. Every one is published closed
     // today; `StringValueMap`, `MigrationListResponse`, `TaskArray`, the two content-type array
@@ -3347,6 +3397,8 @@ const STRICT_COMPONENTS: ReadonlySet<string> = new Set<string>([
     'CatalogTagQuery',
     'StoredCatalogInteractionsQuery',
     'ResolveInteractionQuery',
+    'ExecuteNamedInteractionQuery',
+    'GetRunQuery',
     'ExecuteInteractionByEndpointQuery',
     'ExecuteInteractionByEndpointHeaders',
     // The prompt-authoring, project-tool, remote-MCP, audit-trail and view-experience closures.
@@ -3474,6 +3526,8 @@ const STRICT_COMPONENTS: ReadonlySet<string> = new Set<string>([
     'AgentRunSearchHit',
     'UpsertAppVersionRequest',
     'AppInstallationPayload',
+    'AppInstanceAvailability',
+    'AppOAuthClientConfig',
     'AppDevelopmentTaskDetails',
     'AppInstallationsQuery',
     'AppsQuery',

package/src/api-schemas/schema-primitives.ts

@@ -11,6 +11,15 @@ export const nullableNumberSchema = z
     .nullable()
     .meta({ anyOf: undefined, type: ['number', 'null'] });
 
+/**
+ * A `limit` or `offset` query count: a whole number, zero or more. A fraction or a negative count used to
+ * reach the database and fail there as a 500.
+ *
+ * Published as `type: number` with `multipleOf: 1` rather than `type: integer`, so the generated Java and Go
+ * clients keep the parameter types they already expose while the contract enforcer answers 400.
+ */
+export const PageCountSchema = z.number().multipleOf(1).min(0);
+
 /** Monotonic token for optimistic concurrency on mutable, user-authored resources. */
 export const EditRevisionSchema = z
     .number()

package/src/api-schemas/store.ts

@@ -3,7 +3,7 @@ import { z } from 'zod';
 // From the values module, for the reason `./apikey.js` gives.
 import { ConfigModes, RunDataStorageLevel } from '../interaction-values.js';
 import { InferenceProfileIdSchema } from './inference-profile.js';
-import { EditRevisionSchema, ExpectedEditRevisionSchema } from './schema-primitives.js';
+import { EditRevisionSchema, ExpectedEditRevisionSchema, PageCountSchema } from './schema-primitives.js';
 
 /**
  * Runtime API schemas for the content-intake policy tree.
@@ -643,8 +643,8 @@ export const ContentObjectTypeSchema = z.strictObject(storedContentTypeShape).me
 const contentTypeListingFields = {
     layout: z.boolean().optional(),
     schema: z.boolean().optional(),
-    limit: z.number().optional(),
-    offset: z.number().optional(),
+    limit: PageCountSchema.optional(),
+    offset: PageCountSchema.optional(),
 };
 
 export const ContentObjectTypeCatalogQuerySchema = z

package/src/api-schemas/task.ts

@@ -1,4 +1,5 @@
 import { z } from 'zod';
+import { PageCountSchema } from './schema-primitives.js';
 
 export const CompleteTaskPayloadSchema = z
     .strictObject({
@@ -98,7 +99,7 @@ export const ListTasksQuerySchema = z
         assignee: z.string().optional(),
         run_id: z.string().optional(),
         source_type: TaskSourceSchema.shape.type.optional(),
-        limit: z.number().optional(),
-        offset: z.number().optional(),
+        limit: PageCountSchema.optional(),
+        offset: PageCountSchema.optional(),
     })
     .meta({ id: 'ListTasksQuery' });

package/src/apikey.ts

@@ -62,7 +62,6 @@ export type ApiKeyArray = Wire.ApiKeyArray;
 export type CreateApiKeyPayload = Wire.CreateApiKeyPayload;
 export type UpdateApiKeyPayload = Wire.UpdateApiKeyPayload;
 export type ApiKeyWithValue = Wire.ApiKeyWithValue;
-export type ApiKeyReadResponse = Wire.ApiKeyReadResponse;
 
 export interface CreatePublicKeyPayload {
     name?: string;
@@ -72,7 +71,6 @@ export interface CreatePublicKeyPayload {
 
 export type AuthTokenResponse = Wire.AuthTokenResponse;
 export type ApiKeyListQuery = Wire.ApiKeyListQuery;
-export type ApiKeyReadQuery = Wire.ApiKeyReadQuery;
 
 export interface AuthTokenPayload {
     credential_scope?: 'project' | 'account';
@@ -97,6 +95,14 @@ export interface AuthTokenPayload {
      */
     apps: string[];
 
+    /** Versioned grants for installations in the selected project. Absence means a legacy token. */
+    app_installations?: {
+        version: 1;
+        project_id: string;
+        ids: string[];
+        ui_restrictions?: string[];
+    };
+
     /**
      * Apps in `apps[]` whose UI surface is restricted for this principal — present only on
      * user tokens, and only when at least one app applies. Such apps grant functional access