@assemblyline-agents/core 4.0.2 → 5.0.1

package/dist/plugin-contract.d.ts

@@ -35,7 +35,11 @@ export interface ConnectionPluginMetadata extends AdapterProviderMetadata {
     tokenEnv?: string;
     tokenRequired?: boolean;
     tokenHeader?: string;
-    credentialEnv?: string;
+    relayCredential?: string;
+    requiredConfig: string[];
+    optionalConfig: string[];
+    requiredCredentials: string[];
+    optionalCredentials: string[];
     scopes?: string[];
     subject?: NonNullable<ConnectionDefinition["subject"]>;
     tools?: ToolFilterDefinition;
@@ -46,7 +50,8 @@ export interface ConnectionPluginMetadata extends AdapterProviderMetadata {
     defaultEvents?: string[];
     eventMode?: ConnectionEventMode;
     eventScope?: ConnectionEventScope;
-    eventRequiredEnv?: string[];
+    eventRequiredConfig?: string[];
+    eventRequiredCredentials?: string[];
 }
 export interface PluginModule {
     connections?: ConnectionPluginMetadata[];
@@ -71,8 +76,10 @@ export interface ToolPackPluginMetadata {
     tools: ToolPackToolMetadata[];
     config?: ToolPackConfigMetadata;
     skills?: string[];
-    requiredEnv?: string[];
-    optionalEnv?: string[];
+    requiredConfig?: string[];
+    optionalConfig?: string[];
+    requiredCredentials?: string[];
+    optionalCredentials?: string[];
     setup?: Array<{
         kind: string;
         name: string;
@@ -87,6 +94,10 @@ interface CommonPluginConnectionOptions {
     required?: boolean;
     subject?: ConnectionDefinition["subject"];
     events?: ConnectionEventSelection;
+    /** Trusted host-side source; never becomes a model-visible operation. */
+    credentialSource?: import("./connection-types.js").ConnectionCredentialSourceFactory;
+    /** Trusted host-side sink used by direct source-to-sink transfer. */
+    credentialSink?: import("./connection-types.js").ConnectionCredentialSinkFactory;
 }
 export interface McpPluginConnectionOptions extends CommonPluginConnectionOptions {
     url?: string;
@@ -103,7 +114,6 @@ export interface StdioMcpPluginConnectionOptions extends CommonPluginConnectionO
 }
 export interface RelayMcpPluginConnectionOptions extends CommonPluginConnectionOptions {
     url?: string;
-    credentialEnv?: string;
     timeoutMs?: number;
     metadata?: McpClientConnectionDefinition["metadata"];
 }
@@ -125,8 +135,8 @@ export interface HttpApiPluginConnectionOptions extends Omit<CommonPluginConnect
 }
 export interface SdkApiPluginConnectionOptions extends CommonPluginConnectionOptions {
     operations: SdkApiOperationDefinition[];
-    execute: SdkApiConnectionDefinition["execute"];
-    close?: SdkApiConnectionDefinition["close"];
+    execute(operationName: string, input: Record<string, unknown>, context: import("./connection-types.js").ConnectionFactoryContext): import("./index.js").MaybePromise<unknown>;
+    close?(context: import("./connection-types.js").ConnectionFactoryContext): import("./index.js").MaybePromise<void>;
     metadata?: SdkApiConnectionDefinition["metadata"];
 }
 export interface SandboxCliPluginConnectionOptions extends Omit<CommonPluginConnectionOptions, "tools"> {
@@ -153,7 +163,8 @@ export interface ResolvedConnectionPluginEvents {
     resources: JsonObject[];
     mode: ConnectionEventMode;
     scope: ConnectionEventScope;
-    requiredEnv: string[];
+    requiredConfig: string[];
+    requiredCredentials: string[];
 }
 /** Validate and normalize the common event selection used by provider packages. */
 export declare function resolveConnectionPluginEvents(plugin: ConnectionPluginMetadata, selection: ConnectionEventSelection | undefined): ResolvedConnectionPluginEvents | undefined;

package/dist/plugin-contract.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"plugin-contract.d.ts","sourceRoot":"","sources":["../src/plugin-contract.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACtE,OAAO,KAAK,EACV,uBAAuB,EACvB,4BAA4B,EAC5B,wBAAwB,EACxB,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,wBAAwB,EACxB,iBAAiB,EACjB,2BAA2B,EAC3B,0BAA0B,EAC1B,6BAA6B,EAC7B,2BAA2B,EAC3B,iBAAiB,EACjB,8BAA8B,EAC9B,wBAAwB,EACxB,0BAA0B,EAC1B,yBAAyB,EACzB,oBAAoB,EACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AAEtE,MAAM,MAAM,4BAA4B,GAAG,mBAAmB,GAAG,WAAW,GAAG,YAAY,CAAC;AAE5F,MAAM,WAAW,gCAAgC;IAC/C,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,4BAA4B,CAAC;CACtE;AAED,4EAA4E;AAC5E,MAAM,WAAW,qCAAqC;IACpD,IAAI,EAAE,IAAI,CAAC;IACX,KAAK,EAAE,KAAK,GAAG;QACb,QAAQ,EAAE,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,4BAA4B,CAAC;QACrE,yEAAyE;QACzE,iBAAiB,CAAC,EAAE,gCAAgC,EAAE,CAAC;KACxD,CAAC;CACH;AAED,kFAAkF;AAClF,MAAM,MAAM,+BAA+B,GAAG,4BAA4B,GAAG,qCAAqC,CAAC;AAEnH,4EAA4E;AAC5E,MAAM,WAAW,wBAAyB,SAAQ,uBAAuB;IACvE,IAAI,EAAE,YAAY,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,YAAY,GAAG,KAAK,GAAG,KAAK,GAAG,SAAS,GAAG,MAAM,GAAG,KAAK,GAAG,KAAK,CAAC;IAC5E,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,GAAG,SAAS,CAAC;IACnD,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,CAAC,EAAE,WAAW,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC,CAAC;IACvD,KAAK,CAAC,EAAE,oBAAoB,CAAC;IAC7B,gBAAgB,CAAC,EAAE,0BAA0B,CAAC;IAC9C,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,SAAS,CAAC,EAAE,mBAAmB,CAAC;IAChC,UAAU,CAAC,EAAE,oBAAoB,CAAC;IAClC,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,YAAY;IAC3B,WAAW,CAAC,EAAE,wBAAwB,EAAE,CAAC;IACzC,SAAS,CAAC,EAAE,sBAAsB,EAAE,CAAC;CACtC;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,UAAU,CAAC;CACtB;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,OAAO,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,oBAAoB,EAAE,CAAC;IAC9B,MAAM,CAAC,EAAE,sBAAsB,CAAC;IAChC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,WAAW,CAAC,EAAE,MAAM,EAAE,CAAC;IACvB,KAAK,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACnF;AAED,UAAU,6BAA6B;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,oBAAoB,CAAC;IAC7B,MAAM,CAAC,EAAE,+BAA+B,CAAC;IACzC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,OAAO,CAAC,EAAE,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,CAAC,EAAE,wBAAwB,CAAC;CACnC;AAED,MAAM,WAAW,0BAA2B,SAAQ,6BAA6B;IAC/E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,wBAAwB,GAAG,KAAK,CAAC;IACxC,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B,QAAQ,CAAC,EAAE,6BAA6B,CAAC,UAAU,CAAC,CAAC;CACtD;AAED,MAAM,WAAW,+BAAgC,SAAQ,6BAA6B;IACpF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,QAAQ,CAAC,EAAE,6BAA6B,CAAC,UAAU,CAAC,CAAC;CACtD;AAED,MAAM,WAAW,+BAAgC,SAAQ,6BAA6B;IACpF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,6BAA6B,CAAC,UAAU,CAAC,CAAC;CACtD;AAED,MAAM,WAAW,8BAA+B,SAAQ,IAAI,CAAC,6BAA6B,EAAE,OAAO,CAAC;IAClG,IAAI,CAAC,EAAE,iBAAiB,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,wBAAwB,GAAG,KAAK,CAAC;IACxC,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B,UAAU,CAAC,EAAE,oBAAoB,CAAC;IAClC,QAAQ,CAAC,EAAE,2BAA2B,CAAC,UAAU,CAAC,CAAC;CACpD;AAED,MAAM,WAAW,8BAA+B,SAAQ,IAAI,CAAC,6BAA6B,EAAE,OAAO,CAAC;IAClG,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,wBAAwB,GAAG,KAAK,CAAC;IACxC,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B,UAAU,EAAE,0BAA0B,EAAE,CAAC;IACzC,eAAe,CAAC,EAAE,oBAAoB,CAAC;IACvC,QAAQ,CAAC,EAAE,2BAA2B,CAAC,UAAU,CAAC,CAAC;CACpD;AAED,MAAM,WAAW,6BAA8B,SAAQ,6BAA6B;IAClF,UAAU,EAAE,yBAAyB,EAAE,CAAC;IACxC,OAAO,EAAE,0BAA0B,CAAC,SAAS,CAAC,CAAC;IAC/C,KAAK,CAAC,EAAE,0BAA0B,CAAC,OAAO,CAAC,CAAC;IAC5C,QAAQ,CAAC,EAAE,0BAA0B,CAAC,UAAU,CAAC,CAAC;CACnD;AAED,MAAM,WAAW,iCAAkC,SAAQ,IAAI,CAAC,6BAA6B,EAAE,OAAO,CAAC;IACrG,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,wBAAwB,EAAE,CAAC;IAClC,IAAI,CAAC,EAAE,wBAAwB,CAAC;IAChC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,8BAA8B,CAAC,UAAU,CAAC,CAAC;CACvD;AAED,MAAM,WAAW,0BAA2B,SAAQ,IAAI,CAAC,6BAA6B,EAAE,OAAO,CAAC;IAC9F,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,wBAAwB,GAAG,KAAK,CAAC;IACxC,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B,MAAM,CAAC,EAAE,oBAAoB,CAAC;IAC9B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,QAAQ,CAAC,EAAE,uBAAuB,CAAC,UAAU,CAAC,CAAC;CAChD;AAED,MAAM,WAAW,8BAA8B;IAC7C,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,SAAS,EAAE,UAAU,EAAE,CAAC;IACxB,IAAI,EAAE,mBAAmB,CAAC;IAC1B,KAAK,EAAE,oBAAoB,CAAC;IAC5B,WAAW,EAAE,MAAM,EAAE,CAAC;CACvB;AAED,mFAAmF;AACnF,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,wBAAwB,EAChC,SAAS,EAAE,wBAAwB,GAAG,SAAS,GAC9C,8BAA8B,GAAG,SAAS,CAuC5C"}
+{"version":3,"file":"plugin-contract.d.ts","sourceRoot":"","sources":["../src/plugin-contract.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,uBAAuB,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AACtE,OAAO,KAAK,EACV,uBAAuB,EACvB,4BAA4B,EAC5B,wBAAwB,EACxB,oBAAoB,EACpB,mBAAmB,EACnB,oBAAoB,EACpB,wBAAwB,EACxB,iBAAiB,EACjB,2BAA2B,EAC3B,0BAA0B,EAC1B,6BAA6B,EAC7B,2BAA2B,EAC3B,iBAAiB,EACjB,8BAA8B,EAC9B,wBAAwB,EACxB,0BAA0B,EAC1B,yBAAyB,EACzB,oBAAoB,EACrB,MAAM,uBAAuB,CAAC;AAC/B,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AAEtE,MAAM,MAAM,4BAA4B,GAAG,mBAAmB,GAAG,WAAW,GAAG,YAAY,CAAC;AAE5F,MAAM,WAAW,gCAAgC;IAC/C,KAAK,EAAE,MAAM,EAAE,CAAC;IAChB,QAAQ,EAAE,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,4BAA4B,CAAC;CACtE;AAED,4EAA4E;AAC5E,MAAM,WAAW,qCAAqC;IACpD,IAAI,EAAE,IAAI,CAAC;IACX,KAAK,EAAE,KAAK,GAAG;QACb,QAAQ,EAAE,QAAQ,GAAG,MAAM,GAAG,OAAO,GAAG,4BAA4B,CAAC;QACrE,yEAAyE;QACzE,iBAAiB,CAAC,EAAE,gCAAgC,EAAE,CAAC;KACxD,CAAC;CACH;AAED,kFAAkF;AAClF,MAAM,MAAM,+BAA+B,GAAG,4BAA4B,GAAG,qCAAqC,CAAC;AAEnH,4EAA4E;AAC5E,MAAM,WAAW,wBAAyB,SAAQ,uBAAuB;IACvE,IAAI,EAAE,YAAY,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,YAAY,GAAG,KAAK,GAAG,KAAK,GAAG,SAAS,GAAG,MAAM,GAAG,KAAK,GAAG,KAAK,CAAC;IAC5E,SAAS,CAAC,EAAE,MAAM,GAAG,OAAO,GAAG,OAAO,GAAG,SAAS,CAAC;IACnD,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,aAAa,CAAC,EAAE,OAAO,CAAC;IACxB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,OAAO,CAAC,EAAE,WAAW,CAAC,oBAAoB,CAAC,SAAS,CAAC,CAAC,CAAC;IACvD,KAAK,CAAC,EAAE,oBAAoB,CAAC;IAC7B,gBAAgB,CAAC,EAAE,0BAA0B,CAAC;IAC9C,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,iBAAiB,EAAE,MAAM,EAAE,CAAC;IAC5B,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,aAAa,CAAC,EAAE,MAAM,EAAE,CAAC;IACzB,SAAS,CAAC,EAAE,mBAAmB,CAAC;IAChC,UAAU,CAAC,EAAE,oBAAoB,CAAC;IAClC,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,wBAAwB,CAAC,EAAE,MAAM,EAAE,CAAC;CACrC;AAED,MAAM,WAAW,YAAY;IAC3B,WAAW,CAAC,EAAE,wBAAwB,EAAE,CAAC;IACzC,SAAS,CAAC,EAAE,sBAAsB,EAAE,CAAC;CACtC;AAED,MAAM,WAAW,oBAAoB;IACnC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,aAAa,CAAC,EAAE,OAAO,CAAC;CACzB;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,CAAC,EAAE,UAAU,CAAC;CACtB;AAED,MAAM,WAAW,sBAAsB;IACrC,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,OAAO,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,CAAC;IACpB,KAAK,EAAE,oBAAoB,EAAE,CAAC;IAC9B,MAAM,CAAC,EAAE,sBAAsB,CAAC;IAChC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,mBAAmB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC/B,KAAK,CAAC,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,OAAO,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACnF;AAED,UAAU,6BAA6B;IACrC,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,KAAK,CAAC,EAAE,oBAAoB,CAAC;IAC7B,MAAM,CAAC,EAAE,+BAA+B,CAAC;IACzC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,OAAO,CAAC,EAAE,oBAAoB,CAAC,SAAS,CAAC,CAAC;IAC1C,MAAM,CAAC,EAAE,wBAAwB,CAAC;IAClC,yEAAyE;IACzE,gBAAgB,CAAC,EAAE,OAAO,uBAAuB,EAAE,iCAAiC,CAAC;IACrF,qEAAqE;IACrE,cAAc,CAAC,EAAE,OAAO,uBAAuB,EAAE,+BAA+B,CAAC;CAClF;AAED,MAAM,WAAW,0BAA2B,SAAQ,6BAA6B;IAC/E,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,IAAI,CAAC,EAAE,wBAAwB,GAAG,KAAK,CAAC;IACxC,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B,QAAQ,CAAC,EAAE,6BAA6B,CAAC,UAAU,CAAC,CAAC;CACtD;AAED,MAAM,WAAW,+BAAgC,SAAQ,6BAA6B;IACpF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,GAAG,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC7B,QAAQ,CAAC,EAAE,6BAA6B,CAAC,UAAU,CAAC,CAAC;CACtD;AAED,MAAM,WAAW,+BAAgC,SAAQ,6BAA6B;IACpF,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,6BAA6B,CAAC,UAAU,CAAC,CAAC;CACtD;AAED,MAAM,WAAW,8BAA+B,SAAQ,IAAI,CAAC,6BAA6B,EAAE,OAAO,CAAC;IAClG,IAAI,CAAC,EAAE,iBAAiB,CAAC;IACzB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,wBAAwB,GAAG,KAAK,CAAC;IACxC,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B,UAAU,CAAC,EAAE,oBAAoB,CAAC;IAClC,QAAQ,CAAC,EAAE,2BAA2B,CAAC,UAAU,CAAC,CAAC;CACpD;AAED,MAAM,WAAW,8BAA+B,SAAQ,IAAI,CAAC,6BAA6B,EAAE,OAAO,CAAC;IAClG,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,wBAAwB,GAAG,KAAK,CAAC;IACxC,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B,UAAU,EAAE,0BAA0B,EAAE,CAAC;IACzC,eAAe,CAAC,EAAE,oBAAoB,CAAC;IACvC,QAAQ,CAAC,EAAE,2BAA2B,CAAC,UAAU,CAAC,CAAC;CACpD;AAED,MAAM,WAAW,6BAA8B,SAAQ,6BAA6B;IAClF,UAAU,EAAE,yBAAyB,EAAE,CAAC;IACxC,OAAO,CACL,aAAa,EAAE,MAAM,EACrB,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAC9B,OAAO,EAAE,OAAO,uBAAuB,EAAE,wBAAwB,GAChE,OAAO,YAAY,EAAE,YAAY,CAAC,OAAO,CAAC,CAAC;IAC9C,KAAK,CAAC,CAAC,OAAO,EAAE,OAAO,uBAAuB,EAAE,wBAAwB,GAAG,OAAO,YAAY,EAAE,YAAY,CAAC,IAAI,CAAC,CAAC;IACnH,QAAQ,CAAC,EAAE,0BAA0B,CAAC,UAAU,CAAC,CAAC;CACnD;AAED,MAAM,WAAW,iCAAkC,SAAQ,IAAI,CAAC,6BAA6B,EAAE,OAAO,CAAC;IACrG,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,wBAAwB,EAAE,CAAC;IAClC,IAAI,CAAC,EAAE,wBAAwB,CAAC;IAChC,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,EAAE,8BAA8B,CAAC,UAAU,CAAC,CAAC;CACvD;AAED,MAAM,WAAW,0BAA2B,SAAQ,IAAI,CAAC,6BAA6B,EAAE,OAAO,CAAC;IAC9F,YAAY,EAAE,MAAM,CAAC;IACrB,IAAI,CAAC,EAAE,wBAAwB,GAAG,KAAK,CAAC;IACxC,OAAO,CAAC,EAAE,iBAAiB,CAAC;IAC5B,MAAM,CAAC,EAAE,oBAAoB,CAAC;IAC9B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,QAAQ,CAAC,EAAE,uBAAuB,CAAC,UAAU,CAAC,CAAC;CAChD;AAED,MAAM,WAAW,8BAA8B;IAC7C,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,aAAa,EAAE,MAAM,EAAE,CAAC;IACxB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,SAAS,EAAE,UAAU,EAAE,CAAC;IACxB,IAAI,EAAE,mBAAmB,CAAC;IAC1B,KAAK,EAAE,oBAAoB,CAAC;IAC5B,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,mBAAmB,EAAE,MAAM,EAAE,CAAC;CAC/B;AAED,mFAAmF;AACnF,wBAAgB,6BAA6B,CAC3C,MAAM,EAAE,wBAAwB,EAChC,SAAS,EAAE,wBAAwB,GAAG,SAAS,GAC9C,8BAA8B,GAAG,SAAS,CAyC5C"}

package/dist/plugin-contract.js

@@ -19,7 +19,8 @@ export function resolveConnectionPluginEvents(plugin, selection) {
             resources: [],
             mode: plugin.eventMode ?? "api",
             scope: plugin.eventScope ?? "connection",
-            requiredEnv: uniqueStrings(plugin.eventRequiredEnv ?? [])
+            requiredConfig: uniqueStrings(plugin.eventRequiredConfig ?? []),
+            requiredCredentials: uniqueStrings(plugin.eventRequiredCredentials ?? [])
         };
     }
     const include = uniqueStrings(selection?.include ?? defaults);
@@ -36,7 +37,8 @@ export function resolveConnectionPluginEvents(plugin, selection) {
         resources: (selection?.resources ?? []).map((resource) => ({ ...resource })),
         mode: plugin.eventMode ?? "api",
         scope: plugin.eventScope ?? "connection",
-        requiredEnv: uniqueStrings(plugin.eventRequiredEnv ?? [])
+        requiredConfig: uniqueStrings(plugin.eventRequiredConfig ?? []),
+        requiredCredentials: uniqueStrings(plugin.eventRequiredCredentials ?? [])
     };
 }
 function uniqueStrings(values) {

package/dist/plugin-contract.js.map

@@ -1 +1 @@
-{"version":3,"file":"plugin-contract.js","sourceRoot":"","sources":["../src/plugin-contract.ts"],"names":[],"mappings":"AA+LA,mFAAmF;AACnF,MAAM,UAAU,6BAA6B,CAC3C,MAAgC,EAChC,SAA+C;IAE/C,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;QACjC,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,QAAQ,oCAAoC,CAAC,CAAC;QAC5F,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;IAC3D,iBAAiB,CAAC,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;IAC9D,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;QACxB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,OAAO;YACP,aAAa,EAAE,QAAQ;YACvB,cAAc,EAAE,EAAE;YAClB,cAAc,EAAE,EAAE;YAClB,SAAS,EAAE,EAAE;YACb,IAAI,EAAE,MAAM,CAAC,SAAS,IAAI,KAAK;YAC/B,KAAK,EAAE,MAAM,CAAC,UAAU,IAAI,YAAY;YACxC,WAAW,EAAE,aAAa,CAAC,MAAM,CAAC,gBAAgB,IAAI,EAAE,CAAC;SAC1D,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,aAAa,CAAC,SAAS,EAAE,OAAO,IAAI,QAAQ,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,aAAa,CAAC,SAAS,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;IACxD,iBAAiB,CAAC,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;IAC9D,iBAAiB,CAAC,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAClC,OAAO;QACL,OAAO,EAAE,IAAI;QACb,OAAO;QACP,aAAa,EAAE,QAAQ;QACvB,cAAc,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC/D,cAAc,EAAE,OAAO;QACvB,SAAS,EAAE,CAAC,SAAS,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC;QAC5E,IAAI,EAAE,MAAM,CAAC,SAAS,IAAI,KAAK;QAC/B,KAAK,EAAE,MAAM,CAAC,UAAU,IAAI,YAAY;QACxC,WAAW,EAAE,aAAa,CAAC,MAAM,CAAC,gBAAgB,IAAI,EAAE,CAAC;KAC1D,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,MAAyB;IAC9C,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,iBAAiB,CACxB,MAAgC,EAChC,MAAyB,EACzB,KAAa,EACb,OAA0B;IAE1B,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IAChE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,CAAC,MAAM,KAAK,KAAK,iCAAiC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpG,CAAC;AACH,CAAC"}
+{"version":3,"file":"plugin-contract.js","sourceRoot":"","sources":["../src/plugin-contract.ts"],"names":[],"mappings":"AA8MA,mFAAmF;AACnF,MAAM,UAAU,6BAA6B,CAC3C,MAAgC,EAChC,SAA+C;IAE/C,IAAI,CAAC,MAAM,CAAC,YAAY,EAAE,MAAM,EAAE,CAAC;QACjC,IAAI,SAAS,KAAK,SAAS,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;YACnD,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,CAAC,MAAM,KAAK,MAAM,CAAC,QAAQ,oCAAoC,CAAC,CAAC;QAC5F,CAAC;QACD,OAAO,SAAS,CAAC;IACnB,CAAC;IACD,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC,YAAY,CAAC,CAAC;IACnD,MAAM,QAAQ,GAAG,aAAa,CAAC,MAAM,CAAC,aAAa,IAAI,EAAE,CAAC,CAAC;IAC3D,iBAAiB,CAAC,MAAM,EAAE,QAAQ,EAAE,eAAe,EAAE,OAAO,CAAC,CAAC;IAC9D,IAAI,SAAS,KAAK,KAAK,EAAE,CAAC;QACxB,OAAO;YACL,OAAO,EAAE,KAAK;YACd,OAAO;YACP,aAAa,EAAE,QAAQ;YACvB,cAAc,EAAE,EAAE;YAClB,cAAc,EAAE,EAAE;YAClB,SAAS,EAAE,EAAE;YACb,IAAI,EAAE,MAAM,CAAC,SAAS,IAAI,KAAK;YAC/B,KAAK,EAAE,MAAM,CAAC,UAAU,IAAI,YAAY;YACxC,cAAc,EAAE,aAAa,CAAC,MAAM,CAAC,mBAAmB,IAAI,EAAE,CAAC;YAC/D,mBAAmB,EAAE,aAAa,CAAC,MAAM,CAAC,wBAAwB,IAAI,EAAE,CAAC;SAC1E,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,aAAa,CAAC,SAAS,EAAE,OAAO,IAAI,QAAQ,CAAC,CAAC;IAC9D,MAAM,OAAO,GAAG,aAAa,CAAC,SAAS,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;IACxD,iBAAiB,CAAC,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;IAC9D,iBAAiB,CAAC,MAAM,EAAE,OAAO,EAAE,gBAAgB,EAAE,OAAO,CAAC,CAAC;IAC9D,MAAM,QAAQ,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IAClC,OAAO;QACL,OAAO,EAAE,IAAI;QACb,OAAO;QACP,aAAa,EAAE,QAAQ;QACvB,cAAc,EAAE,OAAO,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,QAAQ,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC/D,cAAc,EAAE,OAAO;QACvB,SAAS,EAAE,CAAC,SAAS,EAAE,SAAS,IAAI,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,EAAE,GAAG,QAAQ,EAAE,CAAC,CAAC;QAC5E,IAAI,EAAE,MAAM,CAAC,SAAS,IAAI,KAAK;QAC/B,KAAK,EAAE,MAAM,CAAC,UAAU,IAAI,YAAY;QACxC,cAAc,EAAE,aAAa,CAAC,MAAM,CAAC,mBAAmB,IAAI,EAAE,CAAC;QAC/D,mBAAmB,EAAE,aAAa,CAAC,MAAM,CAAC,wBAAwB,IAAI,EAAE,CAAC;KAC1E,CAAC;AACJ,CAAC;AAED,SAAS,aAAa,CAAC,MAAyB;IAC9C,OAAO,CAAC,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;AAC3E,CAAC;AAED,SAAS,iBAAiB,CACxB,MAAgC,EAChC,MAAyB,EACzB,KAAa,EACb,OAA0B;IAE1B,MAAM,SAAS,GAAG,IAAI,GAAG,CAAC,OAAO,CAAC,CAAC;IACnC,MAAM,OAAO,GAAG,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC,CAAC;IAChE,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,GAAG,MAAM,CAAC,MAAM,KAAK,KAAK,iCAAiC,OAAO,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;IACpG,CAAC;AACH,CAAC"}

package/dist/plugin.js

@@ -48,8 +48,10 @@ const TOOL_PACK_PLUGIN_CATALOG = [
             options: {}
         },
         skills: ["openui-artifacts"],
-        requiredEnv: [],
-        optionalEnv: ["R2_PUBLIC_BASE_URL", "S3_PUBLIC_BASE_URL"],
+        requiredConfig: [],
+        optionalConfig: ["R2_PUBLIC_BASE_URL", "S3_PUBLIC_BASE_URL"],
+        requiredCredentials: [],
+        optionalCredentials: [],
         setup: [{
                 kind: "tools",
                 name: "openui-public-blob-origin",
@@ -65,15 +67,19 @@ const WRITE_PATTERNS = [
     "regex:(^|[-_])(add|append|archive|assign|book|buy|cancel|checkout|close|complete|create|delete|draft|duplicate|edit|execute|insert|invite|kick|link|merge|modify|move|mutate|open|pay|post|publish|purchase|push|react|reaction|remove|rename|reply|reserve|resolve|reopen|run|schedule|send|set|share|submit|transfer|transition|unassign|unlink|update|upload|write)([-_]|$)"
 ];
 function catalogEntry(input) {
-    const requiredEnv = [
+    const requiredConfig = [
         ...(input.urlEnv && !input.defaultUrl ? [input.urlEnv] : []),
-        ...(input.tokenEnv && input.tokenRequired !== false ? [input.tokenEnv] : []),
-        ...(input.credentialEnv ? [input.credentialEnv] : [])
     ];
-    const optionalEnv = [
+    const optionalConfig = [
         ...(input.urlEnv && input.defaultUrl ? [input.urlEnv] : []),
-        ...(input.tokenEnv && input.tokenRequired === false ? [input.tokenEnv] : []),
-        ...(input.optionalEnv ?? [])
+        ...(input.optionalConfig ?? [])
+    ];
+    const requiredCredentials = [
+        ...(input.tokenEnv && input.tokenRequired !== false ? [input.tokenEnv] : []),
+        ...(input.relayCredential ? [input.relayCredential] : [])
+    ];
+    const optionalCredentials = [
+        ...(input.tokenEnv && input.tokenRequired === false ? [input.tokenEnv] : [])
     ];
     return {
         kind: input.kind,
@@ -89,9 +95,11 @@ function catalogEntry(input) {
         ...(input.tokenEnv ? { tokenEnv: input.tokenEnv } : {}),
         ...(input.tokenEnv ? { tokenRequired: input.tokenRequired !== false } : {}),
         ...(input.tokenHeader ? { tokenHeader: input.tokenHeader } : {}),
-        ...(input.credentialEnv ? { credentialEnv: input.credentialEnv } : {}),
-        requiredEnv,
-        optionalEnv,
+        ...(input.relayCredential ? { relayCredential: input.relayCredential } : {}),
+        requiredConfig,
+        optionalConfig,
+        requiredCredentials,
+        optionalCredentials,
         capabilities: ["mcp", "live-tools", input.transport === "stdio" ? "stdio" : input.transport === "relay" ? "e2ee-device-relay" : "streamable-http"],
         scopes: [...(input.scopes ?? [])],
         // Plugins with user-scoped grants declare subject: "user" explicitly; an
@@ -105,7 +113,8 @@ function catalogEntry(input) {
         ...(input.defaultEvents ? { defaultEvents: [...input.defaultEvents] } : {}),
         ...(input.eventMode ? { eventMode: input.eventMode } : {}),
         ...(input.eventScope ? { eventScope: input.eventScope } : {}),
-        ...(input.eventRequiredEnv ? { eventRequiredEnv: [...input.eventRequiredEnv] } : {}),
+        ...(input.eventRequiredConfig ? { eventRequiredConfig: [...input.eventRequiredConfig] } : {}),
+        ...(input.eventRequiredCredentials ? { eventRequiredCredentials: [...input.eventRequiredCredentials] } : {}),
         setup: [{
                 kind: "connection",
                 name: `${input.kind}-developer-configuration`,
@@ -124,8 +133,10 @@ const HIGGSFIELD_PLUGIN = {
     provider: "higgsfield",
     description: "Higgsfield creative media generation, analysis, and editing through the official CLI inside the agent sandbox.",
     command: "higgsfield",
-    requiredEnv: [],
-    optionalEnv: [],
+    requiredConfig: [],
+    optionalConfig: [],
+    requiredCredentials: [],
+    optionalCredentials: [],
     capabilities: ["sandbox-cli", "native-file-inputs", "media-generation", "video-analysis", "video-editing"],
     scopes: [],
     subject: "user",
@@ -148,8 +159,10 @@ const REMOTION_PLUGIN = {
     provider: "remotion",
     description: "Remotion composition discovery and rendering through the project CLI inside the active agent sandbox.",
     command: "npx",
-    requiredEnv: [],
-    optionalEnv: [],
+    requiredConfig: [],
+    optionalConfig: [],
+    requiredCredentials: [],
+    optionalCredentials: [],
     capabilities: ["sandbox-cli", "media-rendering", "workspace-artifacts"],
     scopes: [],
     subject: "environment",
@@ -173,8 +186,10 @@ const MIRROR_PLUGIN = {
     description: "User-scoped connected accounts, mirrored source records, live reads, and approval-gated actions through Mirror.",
     defaultUrl: "https://mirror.artificialillumination.co/mcp",
     urlEnv: "MIRROR_MCP_URL",
-    requiredEnv: ["MIRROR_OAUTH_CLIENT_ID"],
-    optionalEnv: ["MIRROR_MCP_URL", "MIRROR_OAUTH_ISSUER", "MIRROR_OAUTH_REDIRECT_URI"],
+    requiredConfig: ["MIRROR_OAUTH_CLIENT_ID"],
+    optionalConfig: ["MIRROR_MCP_URL", "MIRROR_OAUTH_ISSUER", "MIRROR_OAUTH_REDIRECT_URI"],
+    requiredCredentials: [],
+    optionalCredentials: [],
     capabilities: ["mcp", "oauth", "pkce", "live-tools", "streamable-http", "connected-accounts", "approval-gated-writes"],
     scopes: [],
     subject: "user",
@@ -238,8 +253,8 @@ const MARGINS_PLUGIN = {
     description: "Resource-scoped collaborative Markdown pages, folders, comments, suggestions, and conflict-safe edits through Margins.",
     defaultUrl: "https://margins.artificialillumination.co/mcp",
     urlEnv: "MARGINS_MCP_URL",
-    requiredEnv: [],
-    optionalEnv: [
+    requiredConfig: [],
+    optionalConfig: [
         "MARGINS_MCP_URL",
         "MARGINS_ISSUER",
         "MARGINS_AGENT_ID",
@@ -247,6 +262,8 @@ const MARGINS_PLUGIN = {
         "MARGINS_AGENT_RUNTIME",
         "MARGINS_AGENT_HARNESS"
     ],
+    requiredCredentials: [],
+    optionalCredentials: [],
     capabilities: [
         "mcp",
         "host-side-pairing",
@@ -306,8 +323,8 @@ const PROVENANCE_PLUGIN = {
     description: "User-scoped append-only agent evidence, session reconstruction, tool traces, handoff bundles, and artifacts through Provenance.",
     defaultUrl: "https://provenance.artificialillumination.co/mcp",
     urlEnv: "PROVENANCE_MCP_URL",
-    requiredEnv: ["PROVENANCE_OAUTH_CLIENT_ID"],
-    optionalEnv: [
+    requiredConfig: ["PROVENANCE_OAUTH_CLIENT_ID"],
+    optionalConfig: [
         "PROVENANCE_MCP_URL",
         "PROVENANCE_OAUTH_ISSUER",
         "PROVENANCE_OAUTH_REDIRECT_URI",
@@ -315,6 +332,8 @@ const PROVENANCE_PLUGIN = {
         "PROVENANCE_AGENT_NAME",
         "PROVENANCE_AGENT_RUNTIME"
     ],
+    requiredCredentials: [],
+    optionalCredentials: [],
     capabilities: ["mcp", "oauth", "pkce", "live-tools", "streamable-http", "append-only-ledger", "agent-handoffs"],
     scopes: ["provenance:ledger"],
     subject: "user",
@@ -365,22 +384,24 @@ const CONNECTION_PLUGIN_CATALOG = [
         helper: "defineOnePasswordConnection",
         protocol: "sdk",
         provider: "1password",
-        description: "1Password vault discovery, item search and retrieval, and secret resolution through the official SDK.",
-        requiredEnv: ["OP_SERVICE_ACCOUNT_TOKEN"],
-        optionalEnv: [],
-        capabilities: ["sdk", "direct-api", "live-tools", "service-account", "vaults", "items", "secrets"],
+        description: "Metadata-only 1Password vault and item browsing plus host-only credential resolution through the official SDK.",
+        requiredConfig: [],
+        optionalConfig: [],
+        requiredCredentials: ["OP_SERVICE_ACCOUNT_TOKEN"],
+        optionalCredentials: [],
+        capabilities: ["sdk", "direct-api", "live-tools", "service-account", "vaults", "item-metadata", "credential-source"],
         scopes: [],
         subject: "environment",
         tools: {
-            allow: ["list_vaults", "list_items", "search_items", "get_item", "resolve_secret"]
+            allow: ["list_vaults", "list_items", "search_items"]
         },
-        readToolPatterns: ["list_vaults", "list_items", "search_items", "get_item", "resolve_secret"],
+        readToolPatterns: ["list_vaults", "list_items", "search_items"],
         writeToolPatterns: [],
         setup: [{
                 kind: "connection",
                 name: "onepassword-service-account",
                 required: true,
-                message: "Create a 1Password service account for this agent, share only the vaults the agent should be able to use, and set its token in OP_SERVICE_ACCOUNT_TOKEN. Every readable item and concealed field in those vaults is available to the agent."
+                message: "Create a dedicated 1Password service account, share only the intended vaults, and store its token as OP_SERVICE_ACCOUNT_TOKEN. Model-facing tools expose metadata only; concealed values remain host-side."
             }]
     },
     {
@@ -391,8 +412,10 @@ const CONNECTION_PLUGIN_CATALOG = [
         protocol: "a2a",
         provider: "a2a",
         description: "Discover and delegate work to an independently deployed agent through the A2A v1.0 protocol.",
-        requiredEnv: [],
-        optionalEnv: [],
+        requiredConfig: [],
+        optionalConfig: [],
+        requiredCredentials: [],
+        optionalCredentials: [],
         capabilities: ["a2a", "agent-card-discovery", "remote-agent-tasks", "json-rpc"],
         scopes: [],
         subject: "environment",
@@ -419,8 +442,10 @@ const CONNECTION_PLUGIN_CATALOG = [
         provider: "arcads",
         description: "Arcads media analysis, generation, and editing through the official hosted MCP server.",
         defaultUrl: "https://mcp.arcads.ai",
-        requiredEnv: ["ARCADS_MCP_CLIENT_ID"],
-        optionalEnv: ["ARCADS_MCP_REDIRECT_URI"],
+        requiredConfig: ["ARCADS_MCP_CLIENT_ID"],
+        optionalConfig: ["ARCADS_MCP_REDIRECT_URI"],
+        requiredCredentials: [],
+        optionalCredentials: [],
         capabilities: ["mcp", "oauth", "live-tools", "streamable-http"],
         scopes: ["mcp", "offline_access"],
         subject: "user",
@@ -449,8 +474,10 @@ const CONNECTION_PLUGIN_CATALOG = [
         description: "Attio CRM records, lists, notes, tasks, comments, email and meeting intelligence, and reporting through Attio's official hosted MCP server.",
         defaultUrl: "https://mcp.attio.com/mcp",
         urlEnv: "ATTIO_MCP_URL",
-        requiredEnv: ["ATTIO_MCP_CLIENT_ID"],
-        optionalEnv: ["ATTIO_MCP_URL", "ATTIO_MCP_REDIRECT_URI"],
+        requiredConfig: ["ATTIO_MCP_CLIENT_ID"],
+        optionalConfig: ["ATTIO_MCP_URL", "ATTIO_MCP_REDIRECT_URI"],
+        requiredCredentials: [],
+        optionalCredentials: [],
         capabilities: ["mcp", "oauth", "pkce", "refresh-token", "live-tools", "streamable-http", "crm", "semantic-search", "reporting"],
         scopes: ["mcp", "offline_access", "openid"],
         subject: "user",
@@ -557,8 +584,10 @@ const CONNECTION_PLUGIN_CATALOG = [
         description: "Gmail threads, messages, attachments, drafts, and sends through the Gmail REST API.",
         defaultBaseUrl: "https://gmail.googleapis.com/gmail/v1",
         baseUrlEnv: "GMAIL_API_BASE_URL",
-        requiredEnv: ["GOOGLE_CLIENT_ID", "GOOGLE_CLIENT_SECRET"],
-        optionalEnv: ["GOOGLE_REDIRECT_URI", "GMAIL_API_BASE_URL"],
+        requiredConfig: ["GOOGLE_CLIENT_ID"],
+        optionalConfig: ["GOOGLE_REDIRECT_URI", "GMAIL_API_BASE_URL"],
+        requiredCredentials: ["GOOGLE_CLIENT_SECRET"],
+        optionalCredentials: [],
         capabilities: ["http-api", "oauth", "pkce", "refresh-token", "live-tools"],
         scopes: [
             "https://www.googleapis.com/auth/gmail.readonly",
@@ -582,7 +611,8 @@ const CONNECTION_PLUGIN_CATALOG = [
         defaultEvents: ["email.received"],
         eventMode: "watch",
         eventScope: "principal",
-        eventRequiredEnv: ["GOOGLE_CLOUD_PROJECT", "GMAIL_PUBSUB_TOPIC", "GMAIL_PUBSUB_VERIFICATION_TOKEN"],
+        eventRequiredConfig: ["GOOGLE_CLOUD_PROJECT", "GMAIL_PUBSUB_TOPIC"],
+        eventRequiredCredentials: ["GMAIL_PUBSUB_VERIFICATION_TOKEN"],
         setup: [{
                 kind: "connection",
                 name: "gmail-oauth-configuration",
@@ -600,8 +630,10 @@ const CONNECTION_PLUGIN_CATALOG = [
         description: "Google Calendar lists, events, availability, and scheduling through the Google Calendar REST API.",
         defaultBaseUrl: "https://www.googleapis.com/calendar/v3",
         baseUrlEnv: "GOOGLE_CALENDAR_API_BASE_URL",
-        requiredEnv: ["GOOGLE_CLIENT_ID", "GOOGLE_CLIENT_SECRET"],
-        optionalEnv: ["GOOGLE_REDIRECT_URI", "GOOGLE_CALENDAR_API_BASE_URL"],
+        requiredConfig: ["GOOGLE_CLIENT_ID"],
+        optionalConfig: ["GOOGLE_REDIRECT_URI", "GOOGLE_CALENDAR_API_BASE_URL"],
+        requiredCredentials: ["GOOGLE_CLIENT_SECRET"],
+        optionalCredentials: [],
         capabilities: ["http-api", "oauth", "pkce", "refresh-token", "live-tools"],
         scopes: [
             "https://www.googleapis.com/auth/calendar.readonly",
@@ -639,8 +671,10 @@ const CONNECTION_PLUGIN_CATALOG = [
         description: "Google Drive file search, downloads, uploads, organization, and sharing through the Google Drive REST API.",
         defaultBaseUrl: "https://www.googleapis.com",
         baseUrlEnv: "GOOGLE_DRIVE_API_BASE_URL",
-        requiredEnv: ["GOOGLE_CLIENT_ID", "GOOGLE_CLIENT_SECRET"],
-        optionalEnv: ["GOOGLE_REDIRECT_URI", "GOOGLE_DRIVE_API_BASE_URL"],
+        requiredConfig: ["GOOGLE_CLIENT_ID"],
+        optionalConfig: ["GOOGLE_REDIRECT_URI", "GOOGLE_DRIVE_API_BASE_URL"],
+        requiredCredentials: ["GOOGLE_CLIENT_SECRET"],
+        optionalCredentials: [],
         capabilities: ["http-api", "oauth", "pkce", "refresh-token", "binary-transfer", "live-tools"],
         scopes: [
             "https://www.googleapis.com/auth/drive.readonly",
@@ -683,19 +717,16 @@ const CONNECTION_PLUGIN_CATALOG = [
         protocol: "credential",
         provider: "github",
         description: "Host-only GitHub App installation credentials for Git and the GitHub CLI inside an agent sandbox.",
-        requiredEnv: [
-            "GITHUB_APP_ID",
-            "GITHUB_APP_PRIVATE_KEY"
-        ],
-        optionalEnv: [
+        requiredConfig: ["GITHUB_APP_ID"],
+        optionalConfig: [
             "GITHUB_APP_INSTALLATION_ID",
             "GITHUB_APP_SLUG",
             "GITHUB_APP_CLIENT_ID",
-            "GITHUB_APP_CLIENT_SECRET",
-            "GITHUB_APP_WEBHOOK_SECRET",
             "GITHUB_API_URL",
             "GITHUB_OAUTH_URL"
         ],
+        requiredCredentials: ["GITHUB_APP_PRIVATE_KEY"],
+        optionalCredentials: ["GITHUB_APP_CLIENT_SECRET", "GITHUB_APP_WEBHOOK_SECRET"],
         capabilities: ["sandbox-credentials", "github-app", "git", "github-cli"],
         scopes: [],
         subject: "user",
@@ -711,7 +742,7 @@ const CONNECTION_PLUGIN_CATALOG = [
         defaultEvents: ["issues.opened", "issue_comment.created", "pull_request.opened", "pull_request_review.submitted", "push", "workflow_run.completed"],
         eventMode: "manual",
         eventScope: "connection",
-        eventRequiredEnv: ["GITHUB_APP_WEBHOOK_SECRET"],
+        eventRequiredCredentials: ["GITHUB_APP_WEBHOOK_SECRET"],
         setup: [{
                 kind: "connection",
                 name: "github-app-developer-configuration",
@@ -726,14 +757,16 @@ const CONNECTION_PLUGIN_CATALOG = [
         description: "Strava profile and fitness activity tools through a developer-configured MCP server.", urlEnv: "STRAVA_MCP_URL", tokenEnv: "STRAVA_MCP_TOKEN",
         eventCatalog: ["activity.create", "activity.update", "activity.delete", "athlete.update"],
         defaultEvents: ["activity.create", "activity.update", "activity.delete", "athlete.update"], eventMode: "api", eventScope: "connection",
-        eventRequiredEnv: ["STRAVA_CLIENT_ID", "STRAVA_CLIENT_SECRET", "STRAVA_WEBHOOK_SIGNING_SECRET"]
+        eventRequiredConfig: ["STRAVA_CLIENT_ID"],
+        eventRequiredCredentials: ["STRAVA_CLIENT_SECRET", "STRAVA_WEBHOOK_SIGNING_SECRET"]
     }),
     catalogEntry({
         kind: "polar", displayName: "Polar", helper: "definePolarConnection",
         description: "Polar workout and heart-rate tools through a developer-configured MCP server.", urlEnv: "POLAR_MCP_URL", tokenEnv: "POLAR_MCP_TOKEN",
         eventCatalog: ["EXERCISE", "SLEEP", "CONTINUOUS_HEART_RATE", "SLEEP_WISE_CIRCADIAN_BEDTIME", "SLEEP_WISE_ALERTNESS", "ACTIVITY_SUMMARY", "PHYSICAL_INFORMATION"],
         defaultEvents: ["EXERCISE", "SLEEP", "CONTINUOUS_HEART_RATE"], eventMode: "api", eventScope: "connection",
-        eventRequiredEnv: ["POLAR_CLIENT_ID", "POLAR_CLIENT_SECRET"]
+        eventRequiredConfig: ["POLAR_CLIENT_ID"],
+        eventRequiredCredentials: ["POLAR_CLIENT_SECRET"]
     }),
     catalogEntry({ kind: "spotify", displayName: "Spotify", helper: "defineSpotifyConnection", description: "Spotify library, playlist, and playback tools through a developer-configured MCP server.", urlEnv: "SPOTIFY_MCP_URL", tokenEnv: "SPOTIFY_MCP_TOKEN", write: true }),
     catalogEntry({ kind: "xai", displayName: "xAI", helper: "defineXaiConnection", description: "xAI and X search tools through a developer-configured MCP server.", urlEnv: "XAI_MCP_URL", tokenEnv: "XAI_MCP_TOKEN" }),
@@ -766,7 +799,8 @@ const CONNECTION_PLUGIN_CATALOG = [
         description: "Read-only Plaid financial tools through a developer-configured MCP bridge.", urlEnv: "PLAID_MCP_URL", tokenEnv: "PLAID_MCP_TOKEN",
         eventCatalog: ["transactions.changed", "item.changed", "auth.changed", "identity.changed", "assets.changed", "holdings.changed", "investments.changed", "liabilities.changed", "payment.changed", "transfer.changed", "income.changed"],
         defaultEvents: ["transactions.changed", "item.changed"], eventMode: "api", eventScope: "connection",
-        eventRequiredEnv: ["PLAID_CLIENT_ID", "PLAID_SECRET"]
+        eventRequiredConfig: ["PLAID_CLIENT_ID"],
+        eventRequiredCredentials: ["PLAID_SECRET"]
     }),
     catalogEntry({ kind: "granola", displayName: "Granola", helper: "defineGranolaConnection", description: "Granola meeting notes, transcripts, and action items through Granola MCP.", defaultUrl: "https://mcp.granola.ai/mcp", urlEnv: "GRANOLA_MCP_URL", tokenEnv: "GRANOLA_MCP_TOKEN" }),
     {
@@ -780,8 +814,10 @@ const CONNECTION_PLUGIN_CATALOG = [
         description: "Private-company, ownership, funding, transaction, filing, contact, conference, and deal intelligence through Grata's official hosted MCP server.",
         defaultUrl: "https://mcp.grata.com",
         urlEnv: "GRATA_MCP_URL",
-        requiredEnv: ["GRATA_MCP_CLIENT_ID", "GRATA_MCP_CLIENT_SECRET"],
-        optionalEnv: ["GRATA_MCP_URL", "GRATA_MCP_REDIRECT_URI"],
+        requiredConfig: ["GRATA_MCP_CLIENT_ID"],
+        optionalConfig: ["GRATA_MCP_URL", "GRATA_MCP_REDIRECT_URI"],
+        requiredCredentials: ["GRATA_MCP_CLIENT_SECRET"],
+        optionalCredentials: [],
         capabilities: ["mcp", "oauth", "pkce", "refresh-token", "live-tools", "streamable-http", "private-market-intelligence"],
         scopes: ["openid", "profile", "email", "offline_access"],
         subject: "user",
@@ -802,7 +838,7 @@ const CONNECTION_PLUGIN_CATALOG = [
         description: "Linear issues, projects, cycles, and teams through Linear MCP.", defaultUrl: "https://mcp.linear.app/mcp", urlEnv: "LINEAR_MCP_URL", tokenEnv: "LINEAR_MCP_TOKEN", write: true,
         eventCatalog: ["issue.create", "issue.update", "issue.remove", "comment.create", "comment.update", "comment.remove", "project.create", "project.update", "project.remove", "cycle.create", "cycle.update", "cycle.remove", "document.create", "document.update", "document.remove", "customer.create", "customer.update", "customer.remove", "user.create", "user.update", "user.remove", "agentSessionEvent.created", "agentSessionEvent.prompted", "linear.changed"],
         defaultEvents: ["issue.create", "issue.update", "comment.create", "comment.update", "project.update", "agentSessionEvent.created", "agentSessionEvent.prompted", "linear.changed"],
-        eventMode: "manual", eventScope: "principal", eventRequiredEnv: ["LINEAR_WEBHOOK_SECRET"]
+        eventMode: "manual", eventScope: "principal", eventRequiredCredentials: ["LINEAR_WEBHOOK_SECRET"]
     }),
     catalogEntry({
         kind: "notion", displayName: "Notion", helper: "defineNotionConnection",
@@ -821,7 +857,7 @@ const CONNECTION_PLUGIN_CATALOG = [
         description: "monday.com boards, items, workspaces, and docs through Platform MCP.", defaultUrl: "https://mcp.monday.com/mcp", urlEnv: "MONDAY_MCP_URL", tokenEnv: "MONDAY_MCP_TOKEN", write: true,
         eventCatalog: ["create_item", "change_column_value", "change_status_column_value", "change_name", "item_moved_to_any_group", "item_deleted", "item_archived", "create_update"],
         defaultEvents: ["create_item", "change_column_value", "change_status_column_value", "item_deleted", "create_update"], eventMode: "api", eventScope: "principal",
-        eventRequiredEnv: ["MONDAY_SIGNING_SECRET"]
+        eventRequiredCredentials: ["MONDAY_SIGNING_SECRET"]
     }),
     catalogEntry({
         kind: "jira", displayName: "Jira", helper: "defineJiraConnection",
@@ -834,7 +870,7 @@ const CONNECTION_PLUGIN_CATALOG = [
         description: "HubSpot CRM records and associations through HubSpot MCP.", defaultUrl: "https://mcp.hubspot.com", urlEnv: "HUBSPOT_MCP_URL", tokenEnv: "HUBSPOT_MCP_TOKEN",
         eventCatalog: ["contact.creation", "contact.deletion", "contact.propertyChange", "company.creation", "company.deletion", "company.propertyChange", "deal.creation", "deal.deletion", "deal.propertyChange", "ticket.creation", "ticket.deletion", "ticket.propertyChange"],
         defaultEvents: ["contact.creation", "contact.deletion", "company.creation", "company.deletion", "deal.creation", "deal.deletion", "ticket.creation", "ticket.deletion"],
-        eventMode: "api", eventScope: "connection", eventRequiredEnv: ["HUBSPOT_APP_ID", "HUBSPOT_DEVELOPER_API_KEY", "HUBSPOT_CLIENT_SECRET"]
+        eventMode: "api", eventScope: "connection", eventRequiredConfig: ["HUBSPOT_APP_ID"], eventRequiredCredentials: ["HUBSPOT_DEVELOPER_API_KEY", "HUBSPOT_CLIENT_SECRET"]
     }),
     catalogEntry({
         kind: "figma", displayName: "Figma", helper: "defineFigmaConnection",
@@ -853,19 +889,19 @@ const CONNECTION_PLUGIN_CATALOG = [
         kind: "supabase", displayName: "Supabase", helper: "defineSupabaseConnection",
         description: "Supabase projects, databases, docs, and Edge Functions through Supabase MCP.", defaultUrl: "https://mcp.supabase.com/mcp", urlEnv: "SUPABASE_MCP_URL", tokenEnv: "SUPABASE_MCP_TOKEN", write: true,
         eventCatalog: ["row.inserted", "row.updated", "row.deleted"], defaultEvents: ["row.inserted", "row.updated", "row.deleted"], eventMode: "api", eventScope: "principal",
-        eventRequiredEnv: ["SUPABASE_WEBHOOK_SECRET"]
+        eventRequiredCredentials: ["SUPABASE_WEBHOOK_SECRET"]
     }),
     catalogEntry({
         kind: "metabase", displayName: "Metabase", helper: "defineMetabaseConnection",
         description: "Metabase semantic-layer queries, questions, and dashboards through an instance MCP endpoint.", urlEnv: "METABASE_MCP_URL", tokenEnv: "METABASE_MCP_TOKEN", tokenRequired: false, write: true,
         eventCatalog: ["alert.triggered"], defaultEvents: ["alert.triggered"], eventMode: "manual", eventScope: "connection",
-        eventRequiredEnv: ["METABASE_WEBHOOK_SECRET"]
+        eventRequiredCredentials: ["METABASE_WEBHOOK_SECRET"]
     }),
     catalogEntry({
         kind: "cloudflare", displayName: "Cloudflare", helper: "defineCloudflareConnection",
         description: "Cloudflare API and account tools through Cloudflare MCP.", defaultUrl: "https://mcp.cloudflare.com/mcp", urlEnv: "CLOUDFLARE_MCP_URL", tokenEnv: "CLOUDFLARE_MCP_TOKEN", write: true,
         eventCatalog: ["notification.received"], defaultEvents: ["notification.received"], eventMode: "api", eventScope: "principal",
-        eventRequiredEnv: ["CLOUDFLARE_WEBHOOK_SECRET"]
+        eventRequiredCredentials: ["CLOUDFLARE_WEBHOOK_SECRET"]
     }),
     catalogEntry({
         kind: "vercel", displayName: "Vercel", helper: "defineVercelConnection",
@@ -1025,8 +1061,10 @@ const CONNECTION_PLUGIN_CATALOG = [
         description: "Connected X account identity, private bookmarks, and reviewed post or reply publishing through X API v2.",
         defaultBaseUrl: "https://api.x.com/2",
         baseUrlEnv: "X_API_BASE_URL",
-        requiredEnv: ["X_API_CLIENT_ID", "X_API_CLIENT_SECRET"],
-        optionalEnv: ["X_API_REDIRECT_URI", "X_API_BASE_URL"],
+        requiredConfig: ["X_API_CLIENT_ID"],
+        optionalConfig: ["X_API_REDIRECT_URI", "X_API_BASE_URL"],
+        requiredCredentials: ["X_API_CLIENT_SECRET"],
+        optionalCredentials: [],
         capabilities: ["http-api", "oauth", "pkce", "refresh-token", "live-tools", "bookmarks", "publishing"],
         scopes: ["bookmark.read", "tweet.read", "tweet.write", "users.read", "offline.access"],
         subject: "user",
@@ -1052,8 +1090,10 @@ const CONNECTION_PLUGIN_CATALOG = [
         description: "Dropbox account, file and folder metadata, search, temporary content links, and reviewed file operations through the Dropbox API.",
         defaultBaseUrl: "https://api.dropboxapi.com/2",
         baseUrlEnv: "DROPBOX_API_BASE_URL",
-        requiredEnv: ["DROPBOX_APP_KEY", "DROPBOX_APP_SECRET"],
-        optionalEnv: ["DROPBOX_REDIRECT_URI", "DROPBOX_API_BASE_URL"],
+        requiredConfig: ["DROPBOX_APP_KEY"],
+        optionalConfig: ["DROPBOX_REDIRECT_URI", "DROPBOX_API_BASE_URL"],
+        requiredCredentials: ["DROPBOX_APP_SECRET"],
+        optionalCredentials: [],
         capabilities: ["http-api", "oauth", "pkce", "refresh-token", "live-tools"],
         scopes: [
             "account_info.read",
@@ -1117,8 +1157,10 @@ const CONNECTION_PLUGIN_CATALOG = [
         description: "SoundCloud tracks, playlists, users, likes, follows, reposts, and comments through the official API.",
         defaultSpec: "https://developers.soundcloud.com/docs/api/explorer/api.json",
         defaultBaseUrl: "https://api.soundcloud.com",
-        requiredEnv: ["SOUNDCLOUD_CLIENT_ID", "SOUNDCLOUD_CLIENT_SECRET"],
-        optionalEnv: ["SOUNDCLOUD_REDIRECT_URI"],
+        requiredConfig: ["SOUNDCLOUD_CLIENT_ID"],
+        optionalConfig: ["SOUNDCLOUD_REDIRECT_URI"],
+        requiredCredentials: ["SOUNDCLOUD_CLIENT_SECRET"],
+        optionalCredentials: [],
         capabilities: ["openapi", "oauth", "live-tools"],
         scopes: [],
         subject: "user",
@@ -1148,7 +1190,7 @@ const CONNECTION_PLUGIN_CATALOG = [
         defaultEvents: ["agent.task.status_update"],
         eventMode: "manual",
         eventScope: "connection",
-        eventRequiredEnv: ["BROWSER_USE_WEBHOOK_SECRET"],
+        eventRequiredCredentials: ["BROWSER_USE_WEBHOOK_SECRET"],
         setupMessage: "Set BROWSER_USE_API_KEY for the Assembly Line host. Browser profiles, cost limits, and write authority remain developer-controlled."
     }),
     catalogEntry({
@@ -1178,7 +1220,8 @@ const CONNECTION_PLUGIN_CATALOG = [
                 "scroll",
                 "wait",
                 "execute_bash",
-                "execute_python"
+                "execute_python",
+                "credential_fill"
             ]
         },
         readToolPatterns: [
@@ -1201,9 +1244,10 @@ const CONNECTION_PLUGIN_CATALOG = [
             "scroll",
             "wait",
             "execute_bash",
-            "execute_python"
+            "execute_python",
+            "credential_fill"
         ],
-        optionalEnv: ["ORGO_API_BASE_URL"],
+        optionalConfig: ["ORGO_API_BASE_URL"],
         setupMessage: "Set ORGO_API_KEY on the Assembly Line runtime host. The developer owns Orgo workspaces, account limits, auto-stop policy, login state, and billing; the packaged bridge strips VNC credentials from results."
     }),
     catalogEntry({
@@ -1231,7 +1275,7 @@ const CONNECTION_PLUGIN_CATALOG = [
         transport: "relay",
         defaultUrl: "https://computer-use.artificialillumination.co/v1",
         urlEnv: "ASSEMBLY_LINE_COMPUTER_USE_RELAY_URL",
-        credentialEnv: "ASSEMBLY_LINE_COMPUTER_USE_BINDING",
+        relayCredential: "ASSEMBLY_LINE_COMPUTER_USE_BINDING",
         subject: "environment",
         tools: { allow: ["inspect_ui", "list", "permissions", "click", "type", "hotkey", "scroll", "drag", "swipe", "move", "set_value", "perform_action", "app", "window", "menu", "dock", "dialog", "space"] },
         readToolPatterns: ["inspect_ui", "list", "permissions"],
@@ -1288,8 +1332,10 @@ function cloneHostRequirements(requirements) {
 function cloneMetadata(entry) {
     return {
         ...entry,
-        requiredEnv: [...(entry.requiredEnv ?? [])],
-        optionalEnv: [...(entry.optionalEnv ?? [])],
+        requiredConfig: [...entry.requiredConfig],
+        optionalConfig: [...entry.optionalConfig],
+        requiredCredentials: [...entry.requiredCredentials],
+        optionalCredentials: [...entry.optionalCredentials],
         capabilities: [...(entry.capabilities ?? [])],
         scopes: [...(entry.scopes ?? [])],
         readToolPatterns: [...entry.readToolPatterns],
@@ -1309,8 +1355,10 @@ function cloneToolPackMetadata(entry) {
             }
         } : {}),
         ...(entry.skills ? { skills: [...entry.skills] } : {}),
-        ...(entry.requiredEnv ? { requiredEnv: [...entry.requiredEnv] } : {}),
-        ...(entry.optionalEnv ? { optionalEnv: [...entry.optionalEnv] } : {}),
+        ...(entry.requiredConfig ? { requiredConfig: [...entry.requiredConfig] } : {}),
+        ...(entry.optionalConfig ? { optionalConfig: [...entry.optionalConfig] } : {}),
+        ...(entry.requiredCredentials ? { requiredCredentials: [...entry.requiredCredentials] } : {}),
+        ...(entry.optionalCredentials ? { optionalCredentials: [...entry.optionalCredentials] } : {}),
         ...(entry.setup ? { setup: entry.setup.map((step) => ({ ...step })) } : {})
     };
 }