chore(deps): update dependency stacklok/toolhive to v0.26.0 (#2150)

* chore(deps): update dependency stacklok/toolhive to v0.26.0

* chore: regenerate artifacts after dependency update

---------

Co-authored-by: renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>
Co-authored-by: github-actions[bot] <github-actions[bot]@users.noreply.github.com>

Author: renovate[bot]

common/api/generated/types.gen.ts

@@ -233,6 +233,12 @@ export type GithubComStacklokToolhivePkgAuthAwsstsConfig = {
    * SessionNameClaim is the JWT claim to use for role session name (default: "sub").
    */
   session_name_claim?: string
+  /**
+   * SubjectProviderName identifies which upstream provider's access token to use
+   * for STS AssumeRoleWithWebIdentity. Used by vMCP only. When empty, the bearer
+   * token from the incoming HTTP request is used.
+   */
+  subject_provider_name?: string
 }
 
 export type GithubComStacklokToolhivePkgAuthAwsstsRoleMapping = {
@@ -658,7 +664,11 @@ export type GithubComStacklokToolhivePkgAuthserverUserInfoFieldMappingRunConfig
   }
 
 /**
- * UserInfo contains configuration for fetching user information (required for OAuth2).
+ * UserInfo contains configuration for fetching user information.
+ * Optional: when nil, the upstream OAuth2 provider derives a deterministic
+ * subject by SHA-256-hashing the access token (with a "tk-" prefix) instead
+ * of calling a userinfo endpoint. OIDC providers always derive Subject from
+ * the ID token and are unaffected.
  */
 export type GithubComStacklokToolhivePkgAuthserverUserInfoRunConfig = {
   /**
@@ -815,7 +825,6 @@ export type GithubComStacklokToolhivePkgClientClientApp =
   | 'codex'
   | 'kimi-cli'
   | 'factory'
-  | 'xcode'
 
 export type GithubComStacklokToolhivePkgClientClientAppStatus = {
   client_type?: GithubComStacklokToolhivePkgClientClientApp

common/api/openapi.json

@@ -226,6 +226,10 @@
           "session_name_claim": {
             "description": "SessionNameClaim is the JWT claim to use for role session name (default: \"sub\").",
             "type": "string"
+          },
+          "subject_provider_name": {
+            "description": "SubjectProviderName identifies which upstream provider's access token to use\nfor STS AssumeRoleWithWebIdentity. Used by vMCP only. When empty, the bearer\ntoken from the incoming HTTP request is used.",
+            "type": "string"
           }
         },
         "type": "object"
@@ -674,7 +678,7 @@
         "type": "object"
       },
       "github_com_stacklok_toolhive_pkg_authserver.UserInfoRunConfig": {
-        "description": "UserInfo contains configuration for fetching user information (required for OAuth2).",
+        "description": "UserInfo contains configuration for fetching user information.\nOptional: when nil, the upstream OAuth2 provider derives a deterministic\nsubject by SHA-256-hashing the access token (with a \"tk-\" prefix) instead\nof calling a userinfo endpoint. OIDC providers always derive Subject from\nthe ID token and are unaffected.",
         "properties": {
           "additional_headers": {
             "additionalProperties": {
@@ -841,8 +845,7 @@
           "mistral-vibe",
           "codex",
           "kimi-cli",
-          "factory",
-          "xcode"
+          "factory"
         ],
         "type": "string",
         "x-enum-varnames": [
@@ -872,8 +875,7 @@
           "MistralVibe",
           "Codex",
           "KimiCli",
-          "Factory",
-          "Xcode"
+          "Factory"
         ]
       },
       "github_com_stacklok_toolhive_pkg_client.ClientAppStatus": {

utils/constants.ts

@@ -3,4 +3,4 @@
  * This is managed by Renovate and updated automatically when new versions are released.
  * renovate: datasource=github-releases depName=stacklok/toolhive versioning=semver
  */
-export const TOOLHIVE_VERSION = process.env.THV_VERSION ?? 'v0.25.0'
+export const TOOLHIVE_VERSION = process.env.THV_VERSION ?? 'v0.26.0'