Merge remote-tracking branch 'origin/staging' into feat/sim-cli

# Conflicts:
#	apps/docs/openapi-v2-resources.json
#	apps/sim/app/api/auth/oauth2/authorize/route.test.ts
#	apps/sim/app/api/auth/oauth2/authorize/route.ts
#	apps/sim/app/api/credentials/route.test.ts
#	apps/sim/app/api/v2/credentials/providers/route.test.ts
#	apps/sim/app/oauth/credential-connected/page.tsx
#	apps/sim/lib/api/contracts/v2/credentials.ts
#	apps/sim/lib/api/contracts/v2/openapi/resources.ts
#	apps/sim/lib/credentials/application/authorization.ts
#	apps/sim/lib/credentials/application/list-credential-providers.test.ts
#	apps/sim/lib/credentials/application/list-credential-providers.ts
#	apps/sim/lib/credentials/application/operations.ts
#	apps/sim/lib/credentials/application/presentation.ts
#	apps/sim/lib/credentials/application/save-credential-draft.test.ts
#	apps/sim/lib/credentials/application/save-credential-draft.ts
#	apps/sim/lib/credentials/members.ts
#	apps/sim/lib/credentials/orchestration/credential-create.ts
#	apps/sim/lib/credentials/orchestration/index.ts
#	apps/sim/lib/credentials/queries.ts
#	scripts/check-api-validation-contracts.ts
#	scripts/check-tool-registry-boundary.baseline.json

Author: TheodoreSpeaks

apps/docs/content/docs/en/integrations/table.mdx

@@ -54,7 +54,7 @@ Tables are created from the **Tables** section in the sidebar. Each table requir
 
 ## Usage Instructions
 
-Create and manage custom data tables. Store, query, and manipulate structured data within workflows.
+Create and manage custom data tables. Store, query, and manipulate structured data within workflows. Query Rows returns every matching row when Limit is omitted and fails if the result exceeds 5MB.
 
 
 
@@ -213,7 +213,7 @@ Query rows from a table with filtering, sorting, and pagination
 | `tableId` | string | Yes | Table ID |
 | `filter` | object | No | Filter conditions \(MongoDB-style operators: $eq, $ne, $gt, $gte, $lt, $lte, $in, $nin, $contains, $ncontains, $startsWith, $endsWith, $empty\) |
 | `sort` | object | No | Sort order as \{field: "asc"\|"desc"\} |
-| `limit` | number | No | Maximum rows to return \(default: $\{TABLE_LIMITS.DEFAULT_QUERY_LIMIT\}, max: $\{TABLE_LIMITS.MAX_QUERY_LIMIT\}\) |
+| `limit` | number | No | Maximum rows to return. Omit to return every matching row; the query fails if the result exceeds the 5MB response budget. |
 | `offset` | number | No | Number of rows to skip \(default: 0\) |
 
 #### Output

apps/docs/openapi-v2-resources.json

@@ -1810,7 +1810,7 @@
       "get": {
         "operationId": "listCredentialProviders",
         "summary": "List Credential Providers",
-        "description": "List catalogued OAuth and service-account connection methods and whether each is available to the caller in this workspace and deployment. OAuth authorization options contain the exact provider IDs accepted by the browser connection endpoint; service-account methods list the exact create-body fields and mark secret fields write-only. The bounded set is returned in one page; `nextCursor` is always null.",
+        "description": "List catalogued OAuth and service-account connection methods and whether each is available to the caller in this workspace and deployment. Optionally search provider names with a case-insensitive substring match. OAuth authorization options contain the exact provider IDs accepted by the browser connection endpoint; service-account methods list the exact create-body fields and mark secret fields write-only. The bounded set is returned in one page; `nextCursor` is always null.",
         "tags": ["Credentials"],
         "parameters": [
           {
@@ -1824,6 +1824,18 @@
               "maxLength": 128,
               "description": "Workspace used to evaluate credential-provider availability and integration policy."
             }
+          },
+          {
+            "name": "search",
+            "in": "query",
+            "required": false,
+            "description": "Case-insensitive substring match against the credential provider name.",
+            "schema": {
+              "description": "Case-insensitive substring match against the credential provider name.",
+              "type": "string",
+              "minLength": 1,
+              "maxLength": 200
+            }
           }
         ],
         "responses": {

apps/sim/.env.example

@@ -197,6 +197,7 @@ CRON_SECRET=your_cron_secret # Use `openssl rand -hex 32` to generate. Authentic
 # DATA_RETENTION_ENABLED= / NEXT_PUBLIC_DATA_RETENTION_ENABLED=   # Runs retention deletion — off by default
 # DATA_DRAINS_ENABLED= / NEXT_PUBLIC_DATA_DRAINS_ENABLED=         # Export streams
 # FORKING_ENABLED=                                                # Workspace forks
+# CREDENTIAL_GROUPS=                                              # Enterprise managed OAuth collections
 # ORGANIZATIONS_ENABLED= / NEXT_PUBLIC_ORGANIZATIONS_ENABLED=     # Organizations only
 
 # Instance organization (Optional). Most enterprise features read their settings from the

apps/sim/app/api/auth/oauth/credentials/route.test.ts

@@ -4,7 +4,13 @@
  * @vitest-environment node
  */
 
-import { hybridAuthMockFns, permissionsMock, workflowsUtilsMock } from '@sim/testing'
+import {
+  dbChainMockFns,
+  hybridAuthMockFns,
+  permissionsMock,
+  resetDbChainMock,
+  workflowsUtilsMock,
+} from '@sim/testing'
 import { NextRequest } from 'next/server'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
@@ -26,6 +32,7 @@ describe('OAuth Credentials API Route', () => {
 
   beforeEach(() => {
     vi.clearAllMocks()
+    resetDbChainMock()
   })
 
   it('should handle unauthenticated user', async () => {
@@ -90,4 +97,33 @@ describe('OAuth Credentials API Route', () => {
     expect(response.status).toBe(200)
     expect(data.credentials).toHaveLength(0)
   })
+
+  it('does not expose a managed credential requested by exact ID', async () => {
+    hybridAuthMockFns.mockCheckSessionOrInternalAuth.mockResolvedValueOnce({
+      success: true,
+      userId: 'user-123',
+      authType: 'session',
+    })
+    dbChainMockFns.limit.mockResolvedValueOnce([
+      {
+        id: 'managed-credential-1',
+        workspaceId: 'workspace-1',
+        type: 'managed_oauth',
+        displayName: 'Managed Gmail',
+        providerId: 'google-email',
+        accountId: null,
+        updatedAt: new Date('2026-01-01T00:00:00Z'),
+        accountProviderId: null,
+        accountScope: null,
+        accountUpdatedAt: null,
+      },
+    ])
+
+    const response = await GET(
+      createMockRequestWithQuery('GET', '?credentialId=managed-credential-1')
+    )
+
+    expect(response.status).toBe(200)
+    await expect(response.json()).resolves.toEqual({ credentials: [] })
+  })
 })

apps/sim/app/api/auth/oauth/token/route.test.ts

@@ -12,8 +12,17 @@ import {
 import { NextRequest } from 'next/server'
 import { beforeEach, describe, expect, it, vi } from 'vitest'
 
-const { mockAuthorizeCredentialUse, mockResolveServiceAccountToken } = vi.hoisted(() => ({
+const {
+  mockAuthenticateManagedOAuthDelegation,
+  mockAuthorizeCredentialUse,
+  mockGetToolMetadata,
+  mockResolveManagedOAuthCredentialToken,
+  mockResolveServiceAccountToken,
+} = vi.hoisted(() => ({
+  mockAuthenticateManagedOAuthDelegation: vi.fn(),
   mockAuthorizeCredentialUse: vi.fn(),
+  mockGetToolMetadata: vi.fn(),
+  mockResolveManagedOAuthCredentialToken: vi.fn(),
   mockResolveServiceAccountToken: vi.fn(),
 }))
 
@@ -27,6 +36,17 @@ vi.mock('@/lib/auth/credential-access', () => ({
   authorizeCredentialUseForAuth: mockAuthorizeCredentialUse,
 }))
 
+vi.mock('@/lib/credentials/application/managed-oauth-delegation', () => ({
+  authenticateManagedOAuthDelegation: mockAuthenticateManagedOAuthDelegation,
+  InvalidManagedOAuthDelegationError: class InvalidManagedOAuthDelegationError extends Error {},
+}))
+
+vi.mock('@/lib/credentials/application/resolve-managed-oauth-token', () => ({
+  resolveManagedOAuthCredentialToken: { execute: mockResolveManagedOAuthCredentialToken },
+}))
+
+vi.mock('@/tools/metadata', () => ({ getToolMetadata: mockGetToolMetadata }))
+
 import { TokenServiceAccountValidationError } from '@/lib/credentials/token-service-accounts/errors'
 import { GET, POST } from '@/app/api/auth/oauth/token/route'
 
@@ -108,6 +128,38 @@ describe('OAuth Token API Routes', () => {
       expect(authOAuthUtilsMockFns.mockGetCredential).toHaveBeenCalled()
     })
 
+    it('does not authenticate managed delegation for an ordinary OAuth credential', async () => {
+      mockAuthorizeCredentialUse.mockResolvedValueOnce({
+        ok: true,
+        authType: 'internal_jwt',
+        requesterUserId: 'workflow-owner-id',
+        credentialOwnerUserId: 'workflow-owner-id',
+      })
+      authOAuthUtilsMockFns.mockGetCredential.mockResolvedValueOnce({
+        id: 'credential-id',
+        accessToken: 'test-token',
+        refreshToken: 'refresh-token',
+        accessTokenExpiresAt: new Date(Date.now() + 3600 * 1000),
+        providerId: 'google',
+      })
+      authOAuthUtilsMockFns.mockRefreshTokenIfNeeded.mockResolvedValueOnce({
+        accessToken: 'fresh-token',
+        refreshed: false,
+      })
+
+      const response = await POST(
+        createMockRequest(
+          'POST',
+          { credentialId: 'credential-id', workflowId: 'workflow-id' },
+          { 'x-sim-managed-oauth-delegation': 'Bearer stale-delegation' }
+        )
+      )
+
+      expect(response.status).toBe(200)
+      await expect(response.json()).resolves.toMatchObject({ accessToken: 'fresh-token' })
+      expect(mockAuthenticateManagedOAuthDelegation).not.toHaveBeenCalled()
+    })
+
     it('should handle missing credentialId', async () => {
       const req = createMockRequest('POST', {})
 
@@ -332,6 +384,140 @@ describe('OAuth Token API Routes', () => {
       )
     })
 
+    describe('managed OAuth path', () => {
+      const managedCredential = {
+        accountId: '',
+        credentialId: 'managed-credential-id',
+        credentialType: 'managed_oauth',
+        providerId: 'google-email',
+        workspaceId: 'workspace-id',
+        usedCredentialTable: true,
+      }
+
+      beforeEach(() => {
+        authOAuthUtilsMockFns.mockResolveOAuthAccountId.mockResolvedValueOnce(managedCredential)
+        mockGetToolMetadata.mockReturnValue({
+          oauth: {
+            required: true,
+            provider: 'google-email',
+            requiredScopes: ['https://www.googleapis.com/auth/gmail.readonly'],
+          },
+        })
+      })
+
+      it('fails closed when workflow delegation is missing', async () => {
+        const response = await POST(
+          createMockRequest('POST', {
+            credentialId: 'managed-credential-id',
+            toolId: 'gmail_read',
+          })
+        )
+
+        expect(response.status).toBe(403)
+        await expect(response.json()).resolves.toMatchObject({
+          code: 'MANAGED_CREDENTIAL_DELEGATION_REQUIRED',
+        })
+        expect(mockResolveManagedOAuthCredentialToken).not.toHaveBeenCalled()
+      })
+
+      it('resolves a manually supplied managed credential ID with scoped delegation', async () => {
+        const principal = {
+          kind: 'delegated' as const,
+          serviceId: 'executor' as const,
+          subjectUserId: 'user-id',
+          workspaceId: 'workspace-id',
+          delegationId: 'delegation-id',
+          audience: 'sim:managed-oauth-credentials',
+          issuedAt: new Date(Date.now() - 1_000),
+          expiresAt: new Date(Date.now() + 60_000),
+          resourceScope: { credentialId: 'managed-credential-id' },
+          delegationContext: {
+            kind: 'workflow_execution' as const,
+            workflowId: 'workflow-id',
+          },
+        }
+        mockAuthenticateManagedOAuthDelegation.mockResolvedValueOnce(principal)
+        mockResolveManagedOAuthCredentialToken.mockResolvedValueOnce({
+          accessToken: 'managed-access-token',
+          refreshed: false,
+        })
+
+        const response = await POST(
+          createMockRequest(
+            'POST',
+            { credentialId: 'managed-credential-id', toolId: 'gmail_read' },
+            { 'x-sim-managed-oauth-delegation': 'Bearer delegated-token' }
+          )
+        )
+
+        expect(response.status).toBe(200)
+        await expect(response.json()).resolves.toEqual({ accessToken: 'managed-access-token' })
+        expect(mockResolveManagedOAuthCredentialToken).toHaveBeenCalledWith({
+          principal,
+          input: {
+            credentialId: 'managed-credential-id',
+            expectedProviderId: 'google-email',
+            requiredScopes: ['https://www.googleapis.com/auth/gmail.readonly'],
+            toolId: 'gmail_read',
+          },
+          request: expect.any(NextRequest),
+        })
+      })
+
+      it('uses the trusted provider scope policy when a Slack tool omits narrower scopes', async () => {
+        mockGetToolMetadata.mockReturnValueOnce({
+          oauth: {
+            required: true,
+            provider: 'slack',
+          },
+        })
+        const principal = {
+          kind: 'delegated' as const,
+          serviceId: 'executor' as const,
+          subjectUserId: 'user-id',
+          workspaceId: 'workspace-id',
+          delegationId: 'delegation-id',
+          audience: 'sim:managed-oauth-credentials',
+          issuedAt: new Date(Date.now() - 1_000),
+          expiresAt: new Date(Date.now() + 60_000),
+          resourceScope: { credentialId: 'managed-credential-id' },
+          delegationContext: {
+            kind: 'workflow_execution' as const,
+            workflowId: 'workflow-id',
+          },
+        }
+        mockAuthenticateManagedOAuthDelegation.mockResolvedValueOnce(principal)
+        mockResolveManagedOAuthCredentialToken.mockResolvedValueOnce({
+          accessToken: 'managed-slack-token',
+          refreshed: false,
+        })
+
+        const response = await POST(
+          createMockRequest(
+            'POST',
+            { credentialId: 'managed-credential-id', toolId: 'slack_message' },
+            { 'x-sim-managed-oauth-delegation': 'Bearer delegated-token' }
+          )
+        )
+
+        expect(response.status).toBe(200)
+        expect(mockResolveManagedOAuthCredentialToken).toHaveBeenCalledWith({
+          principal,
+          input: {
+            credentialId: 'managed-credential-id',
+            expectedProviderId: 'slack',
+            requiredScopes: expect.arrayContaining([
+              'channels:read',
+              'channels:history',
+              'chat:write',
+            ]),
+            toolId: 'slack_message',
+          },
+          request: expect.any(NextRequest),
+        })
+      })
+    })
+
     describe('credentialAccountUserId + providerId path', () => {
       it('should reject unauthenticated requests', async () => {
         hybridAuthMockFns.mockCheckSessionOrInternalAuth.mockResolvedValueOnce({