feat(credentials): add v2 credential lifecycle APIs (#6664)

* feat(credentials): add v2 OAuth connection APIs

* fix(credentials): preserve active OAuth connection links

* fix(credentials): bind OAuth links to connection intent

* feat(credentials): complete v2 credential lifecycle

* fix(credentials): make disconnect idempotent

* fix(credentials): stabilize oauth draft retries

* fix(credentials): bind oauth callbacks to drafts

* fix(credentials): fail closed on oauth completion

* fix(credentials): bind shopify completion to oauth state

* fix(credentials): align custom oauth reconnects

* fix(credentials): centralize application authorization

* fix(credentials): keep OAuth draft intent immutable

* fix(credentials): allow renamed reconnect targets

* fix(credentials): close OAuth draft edge cases

* fix(credentials): fail closed without breaking auth

* fix(credentials): preserve migrated route behavior

* feat(credentials): add provider search

* fix(credentials): prevent stale secrets and drafts

Author: TheodoreSpeaks

.agents/skills/migrate-application-operation/SKILL.md

@@ -78,6 +78,43 @@ Classify each as `migrate`, `defer`, or `non-goal`. Do not migrate adjacent oper
 
 Preserve behavior unless the task explicitly changes it. Stop and report a decision when surfaces currently disagree on security or compatibility behavior; do not silently choose one.
 
+## Freeze observable behavior before editing
+
+Treat the legacy route or tool as an ordered program, not merely a bag of business logic. Before moving code, write a compact baseline for every in-scope entry point and add focused characterization tests for behavior not already pinned down.
+
+Capture all of these when they apply:
+
+- Accepted inputs, including trimming, blank omission, duplicate query keys, aliases, defaults, and bounds.
+- Authentication and authorization order, minimum roles, resource membership, concealment, and exact error/status mapping.
+- Exact success bodies, optional fields, status codes, redirects, cookies, headers, and binary or stream behavior.
+- Mutation ordering, transaction boundaries, idempotency, no-ops, and observable state after each possible partial failure.
+- Audit, notification, analytics, and billing timing plus exact semantic dimensions and attribution.
+- Browser or protocol state ownership, concurrency isolation, expiry, callback ordering, and cleanup behavior.
+- Every value newly crossing into HTML, JavaScript, SQL, URLs, logs, provider payloads, or another encoding context.
+
+Compare the old statement order with the proposed application lifecycle explicitly:
+
+```text
+legacy parse/normalize
+  -> legacy authorization checks
+  -> branch-specific canonical lookup
+  -> mutation(s)
+  -> per-step side effects
+  -> response or redirect catch
+```
+
+Moving those steps under a wrapper may change behavior even when each individual call is reused. In particular:
+
+- `projectAudit` and `afterSuccess` run only after `execute` returns. They cannot describe earlier committed mutations when a later step throws. Make the compound mutation atomic or define explicit partial-result/failure projection semantics before migrating it.
+- Operation metadata is executable policy. Adding a resource role to a workspace-only legacy read is an authorization change, not an architectural cleanup.
+- A shared error policy does not automatically preserve route-local concealment, subclass ordering, browser redirects, or branch-specific messages.
+- A shared contract does not automatically preserve manual `URLSearchParams` normalization or exact legacy response unions.
+- A shared use case may own domain behavior while separate surface presenters still preserve different wire shapes.
+- Per-flow identity is insufficient when another part of the flow remains in browser-global state such as one cookie.
+- Passing a newly supported parameter through old rendering code creates a new security boundary even when the renderer itself is unchanged.
+
+Fail fast if the baseline cannot be established from code, tests, or an explicit product decision. Do not infer that behavior is unimportant because it was previously implicit.
+
 ## Keep the layers distinct
 
 Use these responsibilities:
@@ -270,6 +307,10 @@ Add focused tests for every migrated surface and principal kind allowed by the o
 - Public API: personal and workspace keys, rate and rollout behavior, concealment, exact external envelope, and rate headers.
 - Copilot or tools: trusted context, exact registered operation membership, rejected forged scope, aliases and resume paths, permission re-check, safe errors, and unchanged tool result shapes.
 - Side effects: audit derives from authoritative results; shared notifications follow audit; neither occurs for rejection or no-op.
+- Compatibility characterization: legacy normalization, exact response/redirect/cookie behavior, concealment, error subclass precedence, and branch-specific output.
+- Failure sequencing: inject a failure after each independently committing step and assert persisted state plus audit, analytics, and notification effects.
+- Concurrency: overlap stateful browser or provider flows and prove each callback consumes only its own state and return destination.
+- Rendering boundaries: exercise hostile values for every newly connected input that reaches HTML, inline JavaScript, URLs, logs, or provider requests.
 
 Run at minimum:
 

.claude/commands/migrate-application-operation.md

@@ -77,6 +77,43 @@ Classify each as `migrate`, `defer`, or `non-goal`. Do not migrate adjacent oper
 
 Preserve behavior unless the task explicitly changes it. Stop and report a decision when surfaces currently disagree on security or compatibility behavior; do not silently choose one.
 
+## Freeze observable behavior before editing
+
+Treat the legacy route or tool as an ordered program, not merely a bag of business logic. Before moving code, write a compact baseline for every in-scope entry point and add focused characterization tests for behavior not already pinned down.
+
+Capture all of these when they apply:
+
+- Accepted inputs, including trimming, blank omission, duplicate query keys, aliases, defaults, and bounds.
+- Authentication and authorization order, minimum roles, resource membership, concealment, and exact error/status mapping.
+- Exact success bodies, optional fields, status codes, redirects, cookies, headers, and binary or stream behavior.
+- Mutation ordering, transaction boundaries, idempotency, no-ops, and observable state after each possible partial failure.
+- Audit, notification, analytics, and billing timing plus exact semantic dimensions and attribution.
+- Browser or protocol state ownership, concurrency isolation, expiry, callback ordering, and cleanup behavior.
+- Every value newly crossing into HTML, JavaScript, SQL, URLs, logs, provider payloads, or another encoding context.
+
+Compare the old statement order with the proposed application lifecycle explicitly:
+
+```text
+legacy parse/normalize
+  -> legacy authorization checks
+  -> branch-specific canonical lookup
+  -> mutation(s)
+  -> per-step side effects
+  -> response or redirect catch
+```
+
+Moving those steps under a wrapper may change behavior even when each individual call is reused. In particular:
+
+- `projectAudit` and `afterSuccess` run only after `execute` returns. They cannot describe earlier committed mutations when a later step throws. Make the compound mutation atomic or define explicit partial-result/failure projection semantics before migrating it.
+- Operation metadata is executable policy. Adding a resource role to a workspace-only legacy read is an authorization change, not an architectural cleanup.
+- A shared error policy does not automatically preserve route-local concealment, subclass ordering, browser redirects, or branch-specific messages.
+- A shared contract does not automatically preserve manual `URLSearchParams` normalization or exact legacy response unions.
+- A shared use case may own domain behavior while separate surface presenters still preserve different wire shapes.
+- Per-flow identity is insufficient when another part of the flow remains in browser-global state such as one cookie.
+- Passing a newly supported parameter through old rendering code creates a new security boundary even when the renderer itself is unchanged.
+
+Fail fast if the baseline cannot be established from code, tests, or an explicit product decision. Do not infer that behavior is unimportant because it was previously implicit.
+
 ## Keep the layers distinct
 
 Use these responsibilities:
@@ -269,6 +306,10 @@ Add focused tests for every migrated surface and principal kind allowed by the o
 - Public API: personal and workspace keys, rate and rollout behavior, concealment, exact external envelope, and rate headers.
 - Copilot or tools: trusted context, exact registered operation membership, rejected forged scope, aliases and resume paths, permission re-check, safe errors, and unchanged tool result shapes.
 - Side effects: audit derives from authoritative results; shared notifications follow audit; neither occurs for rejection or no-op.
+- Compatibility characterization: legacy normalization, exact response/redirect/cookie behavior, concealment, error subclass precedence, and branch-specific output.
+- Failure sequencing: inject a failure after each independently committing step and assert persisted state plus audit, analytics, and notification effects.
+- Concurrency: overlap stateful browser or provider flows and prove each callback consumes only its own state and return destination.
+- Rendering boundaries: exercise hostile values for every newly connected input that reaches HTML, inline JavaScript, URLs, logs, or provider requests.
 
 Run at minimum:
 

.cursor/commands/migrate-application-operation.md

@@ -73,6 +73,43 @@ Classify each as `migrate`, `defer`, or `non-goal`. Do not migrate adjacent oper
 
 Preserve behavior unless the task explicitly changes it. Stop and report a decision when surfaces currently disagree on security or compatibility behavior; do not silently choose one.
 
+## Freeze observable behavior before editing
+
+Treat the legacy route or tool as an ordered program, not merely a bag of business logic. Before moving code, write a compact baseline for every in-scope entry point and add focused characterization tests for behavior not already pinned down.
+
+Capture all of these when they apply:
+
+- Accepted inputs, including trimming, blank omission, duplicate query keys, aliases, defaults, and bounds.
+- Authentication and authorization order, minimum roles, resource membership, concealment, and exact error/status mapping.
+- Exact success bodies, optional fields, status codes, redirects, cookies, headers, and binary or stream behavior.
+- Mutation ordering, transaction boundaries, idempotency, no-ops, and observable state after each possible partial failure.
+- Audit, notification, analytics, and billing timing plus exact semantic dimensions and attribution.
+- Browser or protocol state ownership, concurrency isolation, expiry, callback ordering, and cleanup behavior.
+- Every value newly crossing into HTML, JavaScript, SQL, URLs, logs, provider payloads, or another encoding context.
+
+Compare the old statement order with the proposed application lifecycle explicitly:
+
+```text
+legacy parse/normalize
+  -> legacy authorization checks
+  -> branch-specific canonical lookup
+  -> mutation(s)
+  -> per-step side effects
+  -> response or redirect catch
+```
+
+Moving those steps under a wrapper may change behavior even when each individual call is reused. In particular:
+
+- `projectAudit` and `afterSuccess` run only after `execute` returns. They cannot describe earlier committed mutations when a later step throws. Make the compound mutation atomic or define explicit partial-result/failure projection semantics before migrating it.
+- Operation metadata is executable policy. Adding a resource role to a workspace-only legacy read is an authorization change, not an architectural cleanup.
+- A shared error policy does not automatically preserve route-local concealment, subclass ordering, browser redirects, or branch-specific messages.
+- A shared contract does not automatically preserve manual `URLSearchParams` normalization or exact legacy response unions.
+- A shared use case may own domain behavior while separate surface presenters still preserve different wire shapes.
+- Per-flow identity is insufficient when another part of the flow remains in browser-global state such as one cookie.
+- Passing a newly supported parameter through old rendering code creates a new security boundary even when the renderer itself is unchanged.
+
+Fail fast if the baseline cannot be established from code, tests, or an explicit product decision. Do not infer that behavior is unimportant because it was previously implicit.
+
 ## Keep the layers distinct
 
 Use these responsibilities:
@@ -265,6 +302,10 @@ Add focused tests for every migrated surface and principal kind allowed by the o
 - Public API: personal and workspace keys, rate and rollout behavior, concealment, exact external envelope, and rate headers.
 - Copilot or tools: trusted context, exact registered operation membership, rejected forged scope, aliases and resume paths, permission re-check, safe errors, and unchanged tool result shapes.
 - Side effects: audit derives from authoritative results; shared notifications follow audit; neither occurs for rejection or no-op.
+- Compatibility characterization: legacy normalization, exact response/redirect/cookie behavior, concealment, error subclass precedence, and branch-specific output.
+- Failure sequencing: inject a failure after each independently committing step and assert persisted state plus audit, analytics, and notification effects.
+- Concurrency: overlap stateful browser or provider flows and prove each callback consumes only its own state and return destination.
+- Rendering boundaries: exercise hostile values for every newly connected input that reaches HTML, inline JavaScript, URLs, logs, or provider requests.
 
 Run at minimum:
 

apps/docs/content/docs/en/integrations/logrocket.mdx

@@ -188,4 +188,3 @@ Register a release version in LogRocket so uploaded source maps can decode stack
 | --------- | ---- | ----------- |
 | `version` | string | Release version that was registered |
 
-

apps/docs/openapi-v2-billing.json

@@ -479,7 +479,7 @@
                 "description": "Human-readable explanation of the error."
               },
               "details": {
-                "description": "Structured error details. On a `403` whose cause a caller can act on, this carries a `code` from a closed set:\n- `INSUFFICIENT_WORKSPACE_ROLE` — The caller has access to the workspace but its role is below the one this operation requires.\n- `PERSONAL_API_KEYS_DISABLED` — The workspace's organization does not allow personal API keys. Use a workspace API key.\n- `WORKSPACE_KEY_OPERATION_NOT_PERMITTED` — This operation is not available to a workspace-scoped API key. Use a personal API key.\n- `PRINCIPAL_KIND_NOT_PERMITTED` — This operation does not accept the caller’s kind of API key.\n- `ORGANIZATION_MEMBERSHIP_REQUIRED` — The caller is not a member of the organization it named.\n- `ORGANIZATION_ADMIN_REQUIRED` — The caller is a member of the organization but not an admin or owner.\n- `ENTERPRISE_PLAN_REQUIRED` — The organization has no active enterprise subscription.\n- `AUDIT_LOGS_DISABLED` — Audit logging is not enabled for this deployment.\n- `SKILL_EDITOR_ACCESS_REQUIRED` — The caller can write in the workspace but is not an editor of this skill.\n- `SECRET_ADMIN_ACCESS_REQUIRED` — The caller can write in the workspace but is not an admin of this secret. Ask a workspace admin, or someone holding admin on the secret, to grant access or set the value.\n- `WORKSPACE_RESOURCE_LIMIT_REACHED` — The workspace already holds the maximum number of resources of this kind. Delete one, or contact Sim to raise the limit; the message names the ceiling.\n- `PUBLIC_SHARING_NOT_ALLOWED` — The workspace's organization does not permit sharing this resource publicly. An organization admin controls the policy.\n- `MCP_SERVER_URL_NOT_ALLOWED` — The supplied MCP server URL is outside the allowed domains or resolves to an internal address."
+                "description": "Structured error details. On a `403` whose cause a caller can act on, this carries a `code` from a closed set:\n- `INSUFFICIENT_WORKSPACE_ROLE` — The caller has access to the workspace but its role is below the one this operation requires.\n- `PERSONAL_API_KEYS_DISABLED` — The workspace's organization does not allow personal API keys. Use a workspace API key.\n- `WORKSPACE_KEY_OPERATION_NOT_PERMITTED` — This operation is not available to a workspace-scoped API key. Use a personal API key.\n- `PRINCIPAL_KIND_NOT_PERMITTED` — This operation does not accept the caller’s kind of API key.\n- `ORGANIZATION_MEMBERSHIP_REQUIRED` — The caller is not a member of the organization it named.\n- `ORGANIZATION_ADMIN_REQUIRED` — The caller is a member of the organization but not an admin or owner.\n- `ENTERPRISE_PLAN_REQUIRED` — The organization has no active enterprise subscription.\n- `AUDIT_LOGS_DISABLED` — Audit logging is not enabled for this deployment.\n- `SKILL_EDITOR_ACCESS_REQUIRED` — The caller can write in the workspace but is not an editor of this skill.\n- `SECRET_ADMIN_ACCESS_REQUIRED` — The caller can write in the workspace but is not an admin of this secret. Ask a workspace admin, or someone holding admin on the secret, to grant access or set the value.\n- `WORKSPACE_RESOURCE_LIMIT_REACHED` — The workspace already holds the maximum number of resources of this kind. Delete one, or contact Sim to raise the limit; the message names the ceiling.\n- `PUBLIC_SHARING_NOT_ALLOWED` — The workspace's organization does not permit sharing this resource publicly. An organization admin controls the policy.\n- `CREDENTIAL_ADMIN_ACCESS_REQUIRED` — The caller can reach the workspace but cannot administer this credential.\n- `MCP_SERVER_URL_NOT_ALLOWED` — The supplied MCP server URL is outside the allowed domains or resolves to an internal address."
               }
             },
             "required": ["code", "message"],