@every-app/sdk 0.3.0-rc.1 → 0.3.0-rc.11

package/dist/internal/capabilities.d.ts

@@ -16,15 +16,14 @@
  *    proxy's rules: inference routes only, the model allowlist, the usage
  *    tap. Never a capability: its key would reach the account's credits
  *    and keys on the same host.
- *  - `oauth_client`: a provider's OAuth client (a social network's), held
- *    the same way. The gateway completes the token endpoint calls only,
- *    putting the client on them; the app builds the authorize URL from the
- *    public client id (`integrationStatus()`), keeps the user tokens and
- *    calls the provider's API with them itself. A client shared by apps
- *    with different needs carries a `scopePolicy`: named scope sets an app
- *    lists in its manifest entry's `scopes`, which ./oauthScopes.ts turns
- *    into what the app may ask the provider for and what a token it is
- *    handed may carry.
+ *  - `oauth_client`: an OAuth provider (Google, Microsoft, Slack built
+ *    in; GitHub and others as presets, ./oauthPresets.ts) whose client the
+ *    gateway holds and whose flow it runs. A person connects in an app,
+ *    for exactly the provider scopes the app's manifest entry lists
+ *    (`scopes`); the gateway keeps the tokens and puts the person's token
+ *    on the app's calls to the provider's `api` hosts. Each provider is a
+ *    spec (./oauthSpec.ts), its differences data; ./oauthScopes.ts holds
+ *    the one set of scope rules.
  *  - `service`: something the gateway does itself, with no upstream host
  *    an app names (sending email, listing the organization's members). An
  *    app lists it the same way and calls its routes,
@@ -102,9 +101,12 @@ export interface ProviderCost {
     usd?: number;
     note?: string;
     /**
-     * A top-level field of the provider's JSON answer that reports the
-     * call's cost in US dollars (DataForSEO's `cost`); read off the head of
-     * every answer and added to the usage counters. Absent: nothing is read.
+     * The field of the provider's JSON answer that reports the call's cost
+     * in US dollars, added to the usage counters: a top-level name the
+     * capability proxy reads off the head of every answer (DataForSEO's
+     * `cost`), or a dotted path the AI proxy reads off the tail with the
+     * token usage (OpenRouter's `usage.cost`). Absent: nothing is read, and
+     * `usd` is the flat per-call price where the provider has one.
      */
     responseField?: string;
 }
@@ -149,6 +151,8 @@ export interface ProviderDetails {
     example?: string;
     cost?: ProviderCost;
     rate?: ProviderRate;
+    /** One request that costs nothing and proves the key works, for a person's terminal. */
+    smoke?: SmokeRequest;
     verified?: ProviderVerification;
     tags?: readonly string[];
 }
@@ -192,7 +196,6 @@ export interface ApiKeyCapability extends ProviderDetails {
      * provider account would show one app another's work.
      */
     accountWidePaths: readonly (readonly string[])[];
-    smoke?: SmokeRequest;
 }
 /**
  * An AI provider (OpenAI, OpenRouter, Workers AI): the AI proxy's table as
@@ -208,6 +211,12 @@ export interface AiProviderCapability extends ProviderDetails {
     label: string;
     /** Where the key goes: bearer for the three today; Anthropic's `x-api-key` header is a `header` kind. */
     auth: ApiKeyAuth;
+    /**
+     * The auth setting is read when set and the entry works without it:
+     * Cloudflare AI Gateway's own token (`cf-aig-authorization`), which an
+     * authenticated gateway requires and an open one ignores. Never a need.
+     */
+    authOptional?: true;
     docs: string;
     setup?: string;
     /** `https://api.openai.com`. */
@@ -220,6 +229,68 @@ export interface AiProviderCapability extends ProviderDetails {
     unstoredRoutes?: readonly string[];
     extraRoutes?: boolean;
     normalize?: "workers-ai";
+    /**
+     * The request shape the provider's inference routes take: OpenAI's
+     * (chat completions and the OpenAI-compatible family: OpenRouter,
+     * Workers AI, Groq, Mistral, Gemini's `/v1beta/openai`), or Anthropic's
+     * Messages API, or the provider's own (Cohere's v2). The Gateway's
+     * default route (`/api/ai/default/…`) serves OpenAI-shaped chat, so only
+     * an `openai`-shaped entry can be the default; the others are pinned by
+     * an app that speaks them. Absent: `openai`.
+     */
+    shape?: "openai" | "anthropic" | "other";
+    /**
+     * Chat through the default route: the entry's chat route (one of
+     * `inferenceRoutes`) that `/api/ai/default/v1/chat/completions` maps
+     * onto, and the model the Gateway fills in when the app names none or
+     * names `default`. Absent: the entry can't be the Gateway's default.
+     */
+    chat?: AiRoute;
+    /** Embeddings through the default route (`/api/ai/default/v1/embeddings`), the same way. */
+    embeddings?: AiRoute;
+    /**
+     * How Cloudflare AI Gateway fronts the provider: its slug under
+     * `https://gateway.ai.cloudflare.com/v1/{account}/{gateway}/`, and the
+     * prefix of the provider's direct path the gateway's URL leaves out
+     * (OpenRouter's `/api`, OpenAI's `/v1`); or, for Workers AI, whose REST
+     * API is AI Gateway's own host, `header: true`: the call keeps its URL
+     * and carries `cf-aig-gateway-id`. With `AI_GATEWAY_ID` set, every call
+     * to an entry with an `aig` block goes through AI Gateway with the
+     * provider's own key still on it; an entry without one goes direct
+     * (Gemini's and Cohere's OpenAI-shaped paths have no documented AI
+     * Gateway form, 2026-10-25).
+     */
+    aig?: {
+        slug: string;
+        trim?: string;
+        header?: true;
+    };
+    /**
+     * `proxy`: the entry fronts the other AI providers (Cloudflare AI
+     * Gateway) and serves no models of its own: never listed under
+     * `providers`, never the default, reached through the entries it fronts.
+     */
+    kind?: "proxy";
+    /**
+     * The models the provider serves, when the entry says (a registered
+     * `ai` row's `models`): the proxy refuses an inference call naming
+     * another (`model_not_allowed`), and `provider show` lists them. Absent
+     * on the catalog's entries, whose model lists change weekly.
+     */
+    models?: readonly string[];
+}
+/** A route of an AI provider the default route maps onto, with the model used when the app names none. */
+export interface AiRoute {
+    /** One of the entry's `inferenceRoutes`: `/api/v1/chat/completions`. */
+    path: string;
+    /**
+     * The seed: the model the Gateway fills in when its operator set none
+     * for this provider (`everyapp ai model`, `org_settings.ai_models`), a
+     * cheap, capable one of the provider's. Data, never the only answer:
+     * read it through `resolveAiDefault` (./aiDefault.ts), which puts the
+     * operator's setting first.
+     */
+    seedModel: string;
 }
 /** What `access: "write"` adds to a provider's read methods when its entry doesn't say. */
 export declare const DEFAULT_WRITE_METHODS: readonly string[];
@@ -242,166 +313,2096 @@ export interface GatewayServiceCapability {
     /** The everyapp skill's setup guide, when there is anything to set up. */
     setup?: string;
 }
-/** Where the gateway puts an OAuth client on a token request. */
-export type OAuthClientInjection = "form" | "basic" | "query" | "json";
-/** A token endpoint an `oauth_client` capability completes, with its rule. */
-export interface OAuthTokenEndpoint {
+/** Where the Gateway puts its OAuth client on a token request: the form body or HTTP Basic. */
+export type OAuthClientInjection = "form" | "basic";
+/** How a provider separates scopes in its `scope` parameter and its token answer. */
+export type OAuthScopeSeparator = "space" | "comma";
+/** How a provider names the account a new connection is for, read once after the exchange. */
+export interface OAuthIdentity {
+    /** An https URL on one of the provider's `api` hosts, GET with the new token. */
+    url: string;
+    /** A dot path into the JSON answer for the label ("ben", "ben@example.com"). */
+    label: string;
+    /** A dot path for the provider's stable id of the account (optional). */
+    id?: string;
+}
+/**
+ * The provider's authorization-code flow as data, from its spec
+ * (./oauthSpec.ts): everything that differs between providers. The
+ * Gateway runs it; an app never sees a token or the client.
+ */
+export interface OAuthFlow {
+    /** Where the browser goes to consent (https). */
+    authorizeUrl: string;
+    /** The token endpoint the Gateway posts the code and refresh token to (https). */
+    tokenUrl: string;
+    /** Where a disconnect revokes the token; absent means the tokens die at their expiry. */
+    revokeUrl?: string;
+    /** The revoke call's method (default POST). */
+    revokeMethod?: "POST" | "DELETE";
+    /** Where the client goes on the token request. */
+    inject: OAuthClientInjection;
+    /** Whether the authorize request carries a PKCE S256 challenge. */
+    pkce: boolean;
+    scopeSeparator: OAuthScopeSeparator;
     /**
-     * The endpoint's host, always over https. Absent: the host the
-     * capability's `hostSetting` names (an instance the operator chose).
+     * Joined onto an app's short scope (`gmail.modify`) for the authorize
+     * URL, and taken off a granted one for comparison: Google's
+     * `https://www.googleapis.com/auth/`. Absent: scopes as written.
      */
-    host?: string;
-    /** The exact pathname, or a RegExp for versioned ones (Meta's `/v25.0/oauth/access_token`). */
-    path: string | RegExp;
-    methods: readonly ("GET" | "POST")[];
+    scopePrefix?: string;
+    /** Extra query on the authorize URL (Google's `access_type=offline`). */
+    authorizeParams?: Readonly<Record<string, string>>;
+    /** Extra headers on the token request (GitHub's `Accept: application/json`). */
+    tokenHeaders?: Readonly<Record<string, string>>;
+    identity?: OAuthIdentity;
     /**
-     * Where the client goes: the form body, HTTP Basic, the query string, or
-     * the JSON body (injectClientCredentials() in ./oauthClient.ts).
+     * Scopes the Gateway adds to every connect, whatever the app lists: what
+     * the identity URL needs, and a refresh token's (Microsoft's
+     * `offline_access`). Tolerated at mint; apps never list them.
      */
-    inject: OAuthClientInjection;
-    /** The fields' names when not `client_id` / `client_secret` (TikTok's `client_key`). */
-    params?: {
-        clientId?: string;
+    identityScopes: readonly string[];
+    /** Scopes a token may carry beyond what was asked without refusal (another spelling of an identity scope). Never a data scope. */
+    tolerated: readonly string[];
+}
+/**
+ * An OAuth provider the Gateway holds a client for and runs the flow for
+ * (docs/design/2026-11-oauth-simplify.md). A person connects in an app;
+ * the connection is theirs and that app's, for exactly the scopes the
+ * app's `everyapp.config.ts` lists, and the app calls the provider's
+ * `api` hosts through the Gateway, which puts the token on.
+ */
+export interface OAuthClientCapability {
+    mode: "oauth_client";
+    /** The provider's name in errors, pages and logs. */
+    label: string;
+    /** Gateway setting names. No `clientSecret`: a public client, the id alone. */
+    secrets: {
+        clientId: string;
         clientSecret?: string;
     };
-}
-/**
- * One host's allowlist a scope set unlocks. Matched against the raw
- * pathname, case preserved, by `scopeRouteAllows()` in ./oauthScopes.ts:
- * the proxy boundary once the gateway holds tokens, tested data until then.
- */
-export interface OAuthScopeRoute {
-    /** A bare https host, one of the capability's `api` hosts. */
-    host: string;
-    /**
-     * Raw-path entries: exact, or a prefix when the entry ends in `/`. GET
-     * and HEAD go through when one matches.
-     */
-    paths: readonly string[];
-    /**
-     * The read-shaped POSTs a read set allows (queries, watches): anchored,
-     * flagless RegExps over the raw pathname. Every other POST is refused.
-     */
-    posts?: readonly RegExp[];
-}
-/**
- * A named bundle an app lists under `scopes`: what it asks the provider for
- * and what that unlocks.
- */
-export interface OAuthScopeSet {
-    /** What Admin → Apps and a consent page call it: "Gmail (read-only)". */
-    label: string;
-    /**
-     * A read set unlocks GET, HEAD and its `posts` only. No write set exists
-     * on the shared clients yet; adding one is a reviewed registry change.
-     */
-    access: CapabilityAccess;
-    /** The provider's scope strings, requested verbatim (Slack: bot scopes). */
-    scopes: readonly string[];
-    /** Slack's `user_scope` strings, issued to the installing person's own token; absent elsewhere. */
-    userScopes?: readonly string[];
-    routes: readonly OAuthScopeRoute[];
-}
-/** How a provider spells granted scopes in its token response; each has a parser in ./oauthScopes.ts. */
-export type OAuthScopeDialect = "google" | "microsoft" | "slack";
-/**
- * Everything the gateway needs to hold an app to its scope sets at the
- * token endpoint. Present means an app's entry must list `scopes` and the
- * gateway refuses tokens outside them. Data only: the dialect selects the
- * parser, so the registry stays a table.
- */
-export interface OAuthScopePolicy {
-    sets: Readonly<Record<string, OAuthScopeSet>>;
-    /**
-     * Scopes a token may carry beyond the declared sets without refusal:
-     * identity and refresh scopes, in every spelling the provider uses.
-     * Never a data scope.
-     */
-    tolerated: readonly string[];
-    /**
-     * Scopes every declaring app asks for whatever its sets, on the authorize
-     * URL and Microsoft's token leg (`offline_access`). Always tolerated.
-     */
-    alwaysRequested: readonly string[];
-    dialect: OAuthScopeDialect;
-    /**
-     * The `tokenGrantType()` values the gateway completes through this
-     * client. `null` is a code exchange that carries no `grant_type` (Slack's
-     * oauth.v2.access).
-     */
-    grantTypes: readonly (string | null)[];
-    /**
-     * What becomes of the token request's `scope` once it passes the check:
-     * `replace` it with the app's requested list (Microsoft's token-leg
-     * extension, which keeps a token to one resource), `drop` it (Google
-     * documents no `scope` on either token leg), or `keep` it (Slack).
-     */
-    requestScope: "replace" | "drop" | "keep";
-    /**
-     * Decoded path segments no set unlocks on any host, compared
-     * case-insensitively: batch tunnels that carry other requests inside, and
-     * resources that reveal secrets under a read scope.
-     */
-    deniedSegments: readonly string[];
-}
-/**
- * A provider's OAuth client the gateway holds. The gateway completes its
- * token endpoints only (`token`), putting the client on each request; the
- * app builds the authorize URL from the public client id and calls the
- * provider's API with the user tokens it keeps.
- */
-export interface OAuthClientCapability {
-    mode: "oauth_client";
-    /** The provider's name in errors and logs. */
-    label: string;
-    /** Gateway secret names. No `clientSecret`: a public client, the id alone. */
-    secrets: {
-        clientId: string;
-        clientSecret?: string;
+    /** Where the operator registers the client (the spec's `docs`). */
+    console: string;
+    /** The everyapp skill's setup guide for the client, when one exists. */
+    setup?: string;
+    /** The only hosts the held token is ever sent to, over https. */
+    api: readonly string[];
+    flow: OAuthFlow;
+    /** What it is for, in one line. */
+    description?: string;
+    /** The API reference (a spec's `api`), optional. */
+    reference?: string;
+    hint?: string;
+    example?: string;
+    tags?: readonly string[];
+}
+export type Capability = ApiKeyCapability | AiProviderCapability | OAuthClientCapability | GatewayServiceCapability;
+export declare const CAPABILITIES: {
+    readonly firecrawl: {
+        readonly mode: "api_key";
+        readonly label: "Firecrawl";
+        readonly description: "Scrapes, crawls, maps and searches the web, returning clean markdown or structured data.";
+        readonly auth: {
+            readonly kind: "bearer";
+            readonly secret: "FIRECRAWL_API_KEY";
+        };
+        readonly docs: "https://www.firecrawl.dev/app/api-keys";
+        readonly api: "https://docs.firecrawl.dev/api-reference/introduction";
+        readonly hosts: readonly ["api.firecrawl.dev"];
+        readonly data: "per-call";
+        readonly access: readonly ["read", "write"];
+        readonly readMethods: readonly ["GET", "POST"];
+        readonly writeMethods: readonly ["DELETE"];
+        readonly accountWidePaths: readonly [readonly ["team"], readonly ["crawl", "active"], readonly ["monitor"], readonly ["agent"], readonly ["interact"], readonly ["support", "ask"]];
+        readonly hint: "An API key from Firecrawl's API keys page; the Gateway sends it as a bearer token. Scrape, crawl, map, search and extract are POSTs and job status is a GET; cancelling a crawl or batch (DELETE) needs write.";
+        readonly secrets: readonly [{
+            readonly name: "FIRECRAWL_API_KEY";
+            readonly hint: "An API key from Firecrawl's API keys page; it starts with fc-.";
+        }];
+        readonly smoke: {
+            readonly method: "GET";
+            readonly path: "/v2/team/credit-usage";
+            readonly expect: readonly [200];
+            readonly free: true;
+            readonly note: "Remaining credits; account-wide, so the Gateway refuses it for apps: run it from the person's terminal.";
+        };
+        readonly cost: {
+            readonly unit: "result";
+            readonly note: "Credits: 1 per page scraped or crawled, 1 per map call, 2 per 10 search results; JSON extraction and other options add more.";
+        };
+        readonly rate: {
+            readonly note: "Per team per minute, by plan: /scrape 10 on Free, 100 Hobby, 500 Standard, 5,000 Growth; /crawl 2, 20, 100, 1,000.";
+        };
+        readonly example: "scrape https://example.com/pricing into markdown";
+        readonly verified: {
+            readonly on: "2026-10-25";
+            readonly how: "docs";
+        };
+        readonly tags: readonly ["scrape", "crawl", "search"];
+    };
+    readonly exa: {
+        readonly mode: "api_key";
+        readonly label: "Exa";
+        readonly description: "Web search built for AI: search results, page contents, similar links and cited answers.";
+        readonly auth: {
+            readonly kind: "header";
+            readonly secret: "EXA_API_KEY";
+            readonly header: "x-api-key";
+        };
+        readonly docs: "https://dashboard.exa.ai/api-keys";
+        readonly api: "https://exa.ai/docs/reference/search";
+        readonly hosts: readonly ["api.exa.ai"];
+        readonly data: "per-call";
+        readonly access: readonly ["read"];
+        readonly readMethods: readonly ["POST"];
+        readonly accountWidePaths: readonly [readonly ["websets"], readonly ["monitors"], readonly ["agent"], readonly ["batches"]];
+        readonly hint: "An API key from the Exa dashboard (the free tier gives $10 of credit a month); the Gateway sends it in the x-api-key header. Search, contents, find-similar and answer are POSTs.";
+        readonly secrets: readonly [{
+            readonly name: "EXA_API_KEY";
+            readonly hint: "An API key from the API keys page of the Exa dashboard.";
+        }];
+        readonly smoke: {
+            readonly method: "GET";
+            readonly path: "/websets/v0/teams/me";
+            readonly expect: readonly [200];
+            readonly free: true;
+            readonly note: "Team info under the Websets API (the docs page leaves out the /websets prefix); account-wide, so run it from the person's terminal.";
+        };
+        readonly cost: {
+            readonly unit: "call";
+            readonly usd: 0.007;
+            readonly note: "Search $7 per 1k (auto and fast; lite $4), contents $1 per 1k pages, answer $5 per 1k; up to 10 results included.";
+        };
+        readonly rate: {
+            readonly perSecond: 10;
+            readonly note: "Per team: /search and /answer 10 QPS, deep search 5, /contents 100.";
+        };
+        readonly example: "find recent articles about solid-state batteries";
+        readonly verified: {
+            readonly on: "2026-10-25";
+            readonly how: "docs";
+        };
+        readonly tags: readonly ["search"];
+    };
+    readonly tavily: {
+        readonly mode: "api_key";
+        readonly label: "Tavily";
+        readonly description: "Web search, page extraction, crawling and site maps for AI agents, plus research reports.";
+        readonly auth: {
+            readonly kind: "bearer";
+            readonly secret: "TAVILY_API_KEY";
+        };
+        readonly docs: "https://app.tavily.com";
+        readonly api: "https://docs.tavily.com/documentation/api-reference/endpoint/search";
+        readonly hosts: readonly ["api.tavily.com"];
+        readonly data: "per-call";
+        readonly access: readonly ["read"];
+        readonly readMethods: readonly ["GET", "POST"];
+        readonly accountWidePaths: readonly [readonly ["usage"], readonly ["logs"], readonly ["org-usage"]];
+        readonly hint: "An API key from app.tavily.com (1,000 free credits a month); the Gateway sends it as a bearer token. Search, extract, crawl, map and research are POSTs; a research result is a GET.";
+        readonly secrets: readonly [{
+            readonly name: "TAVILY_API_KEY";
+            readonly hint: "An API key from the Tavily dashboard; it starts with tvly-.";
+        }];
+        readonly smoke: {
+            readonly method: "GET";
+            readonly path: "/usage";
+            readonly expect: readonly [200];
+            readonly free: true;
+            readonly note: "Key and account usage, not an endpoint that costs credits; account-wide, so run it from the person's terminal (10 calls per 10 minutes).";
+        };
+        readonly cost: {
+            readonly unit: "call";
+            readonly usd: 0.008;
+            readonly note: "Pay as you go $0.008 per credit: basic search 1 credit, advanced 2; extract 1 credit per 5 URLs; map 1 per 10 pages.";
+        };
+        readonly rate: {
+            readonly perMinute: 100;
+            readonly note: "Development keys 100 per minute, production keys 1,000; crawl 100 and research 20 per minute for both.";
+        };
+        readonly example: "search the web for this week's news on EU AI rules";
+        readonly verified: {
+            readonly on: "2026-10-25";
+            readonly how: "docs";
+        };
+        readonly tags: readonly ["search", "scrape"];
+    };
+    readonly serper: {
+        readonly mode: "api_key";
+        readonly label: "Serper";
+        readonly description: "Google search results as JSON: web, news, images, places, shopping, scholar and patents.";
+        readonly auth: {
+            readonly kind: "header";
+            readonly secret: "SERPER_API_KEY";
+            readonly header: "X-API-KEY";
+        };
+        readonly docs: "https://serper.dev/api-keys";
+        readonly api: "https://serper.dev/playground";
+        readonly hosts: readonly ["google.serper.dev", "scrape.serper.dev"];
+        readonly data: "per-call";
+        readonly access: readonly ["read"];
+        readonly readMethods: readonly ["POST"];
+        readonly accountWidePaths: readonly [];
+        readonly hint: "An API key from serper.dev (2,500 free queries to start); the Gateway sends it in the X-API-KEY header. Every search is a POST to google.serper.dev/<type> (search, news, images, places, …) with a JSON body such as {\"q\": \"…\"}.";
+        readonly secrets: readonly [{
+            readonly name: "SERPER_API_KEY";
+            readonly hint: "The API key on serper.dev's API keys page.";
+        }];
+        readonly cost: {
+            readonly unit: "call";
+            readonly usd: 0.001;
+            readonly note: "Prepaid credits, one per successful query: $1.00 per 1k on the 50k pack, down to $0.30 per 1k on the largest.";
+        };
+        readonly rate: {
+            readonly perSecond: 50;
+            readonly note: "Starter credits 50 queries per second; Standard 100, Scale 200, Ultimate 300.";
+        };
+        readonly example: "get the top Google results for best project management software";
+        readonly verified: false;
+        readonly tags: readonly ["search", "serp"];
+    };
+    readonly "brave-search": {
+        readonly mode: "api_key";
+        readonly label: "Brave Search";
+        readonly description: "Brave's independent web index: web, news, images, videos, places, LLM context and answers.";
+        readonly auth: {
+            readonly kind: "header";
+            readonly secret: "BRAVE_SEARCH_API_KEY";
+            readonly header: "X-Subscription-Token";
+        };
+        readonly docs: "https://api-dashboard.search.brave.com/app/keys";
+        readonly api: "https://api-dashboard.search.brave.com/documentation";
+        readonly hosts: readonly ["api.search.brave.com"];
+        readonly data: "per-call";
+        readonly access: readonly ["read"];
+        readonly readMethods: readonly ["GET", "POST"];
+        readonly accountWidePaths: readonly [];
+        readonly hint: "Activate a plan (it includes $5 of free credit a month), then create a key under API Keys; the Gateway sends it in the X-Subscription-Token header. Searches are GETs (POST works too); answers are a POST to /res/v1/chat/completions.";
+        readonly secrets: readonly [{
+            readonly name: "BRAVE_SEARCH_API_KEY";
+            readonly hint: "A key from the API Keys section of the Brave Search API dashboard, made after activating a plan.";
+        }];
+        readonly cost: {
+            readonly unit: "call";
+            readonly usd: 0.005;
+            readonly note: "Search $5 per 1k requests; Answers $4 per 1k plus $5 per million tokens; $5 free credit a month; only successful calls count.";
+        };
+        readonly rate: {
+            readonly perSecond: 50;
+            readonly note: "Search plan 50 queries per second; Answers 2 per second.";
+        };
+        readonly example: "search the web for the latest Cloudflare Workers release notes";
+        readonly verified: {
+            readonly on: "2026-10-25";
+            readonly how: "docs";
+        };
+        readonly tags: readonly ["search"];
+    };
+    readonly apify: {
+        readonly mode: "api_key";
+        readonly label: "Apify";
+        readonly description: "Runs Apify Actors (ready-made scrapers and automations) and reads their datasets and stores.";
+        readonly auth: {
+            readonly kind: "bearer";
+            readonly secret: "APIFY_API_TOKEN";
+        };
+        readonly docs: "https://console.apify.com/settings/integrations";
+        readonly api: "https://docs.apify.com/api/v2";
+        readonly hosts: readonly ["api.apify.com"];
+        readonly data: "account";
+        readonly access: readonly ["read", "write"];
+        readonly readMethods: readonly ["GET", "HEAD"];
+        readonly writeMethods: readonly ["POST", "PUT", "DELETE"];
+        readonly accountWidePaths: readonly [readonly ["users"], readonly ["webhooks"], readonly ["webhook-dispatches"], readonly ["env-vars"]];
+        readonly hint: "The API token from Apify Console, Settings > API & Integrations; the Gateway sends it as a bearer token. Reading Actors, runs and datasets needs read; starting a run is a POST, so it needs write.";
+        readonly secrets: readonly [{
+            readonly name: "APIFY_API_TOKEN";
+            readonly hint: "The API token under Settings > API & Integrations in Apify Console.";
+        }];
+        readonly smoke: {
+            readonly method: "GET";
+            readonly path: "/v2/users/me";
+            readonly expect: readonly [200];
+            readonly free: true;
+            readonly note: "The docs' verify call; account-wide, so the Gateway refuses it for apps: run it from the person's terminal.";
+        };
+        readonly rate: {
+            readonly perSecond: 60;
+            readonly note: "60 requests per second per resource (one Actor, run, dataset or store); 250,000 requests per minute per user overall.";
+        };
+        readonly example: "run the Google Maps scraper Actor for coffee shops in Austin and list the results";
+        readonly verified: {
+            readonly on: "2026-10-25";
+            readonly how: "docs";
+        };
+        readonly tags: readonly ["scrape", "automation"];
+    };
+    readonly deepgram: {
+        readonly mode: "api_key";
+        readonly label: "Deepgram";
+        readonly description: "Speech to text, text to speech and text analysis.";
+        readonly auth: {
+            readonly kind: "bearer";
+            readonly secret: "DEEPGRAM_API_KEY";
+            readonly scheme: "Token";
+        };
+        readonly docs: "https://console.deepgram.com/";
+        readonly api: "https://developers.deepgram.com/reference/deepgram-api-overview";
+        readonly hosts: readonly ["api.deepgram.com", "api.eu.deepgram.com", "api.au.deepgram.com", "api.in.deepgram.com"];
+        readonly data: "per-call";
+        readonly access: readonly ["read"];
+        readonly readMethods: readonly ["GET", "POST"];
+        readonly accountWidePaths: readonly [readonly ["projects"], readonly ["auth", "grant"]];
+        readonly hint: "An API key from the Deepgram Console; the Gateway sends it as Authorization: Token <key>, and the EU, Australia and India hosts take the same key. Transcription (/v1/listen), speech (/v1/speak) and text analysis (/v1/read) are POSTs.";
+        readonly secrets: readonly [{
+            readonly name: "DEEPGRAM_API_KEY";
+            readonly hint: "A project API key created in the Deepgram Console.";
+        }];
+        readonly smoke: {
+            readonly method: "GET";
+            readonly path: "/v1/models";
+            readonly expect: readonly [200];
+            readonly free: true;
+            readonly note: "Lists the public models; it needs the key and processes no audio.";
+        };
+        readonly cost: {
+            readonly unit: "call";
+            readonly note: "Nova-3 pre-recorded $0.0043 per audio minute (pay as you go); Aura-2 speech $0.030 per 1k characters; $200 free credit.";
+        };
+        readonly rate: {
+            readonly note: "Concurrency per project on pay as you go: 50 pre-recorded transcriptions, 15 text-to-speech requests.";
+        };
+        readonly example: "transcribe this podcast episode and label the speakers";
+        readonly verified: {
+            readonly on: "2026-10-25";
+            readonly how: "docs";
+        };
+        readonly tags: readonly ["speech", "transcription"];
+    };
+    readonly elevenlabs: {
+        readonly mode: "api_key";
+        readonly label: "ElevenLabs";
+        readonly description: "Text to speech, speech to text, sound effects, music and voice changing.";
+        readonly auth: {
+            readonly kind: "header";
+            readonly secret: "ELEVENLABS_API_KEY";
+            readonly header: "xi-api-key";
+        };
+        readonly docs: "https://elevenlabs.io/app/settings/api-keys";
+        readonly api: "https://elevenlabs.io/docs/api-reference/introduction";
+        readonly hosts: readonly ["api.elevenlabs.io"];
+        readonly data: "per-call";
+        readonly access: readonly ["read"];
+        readonly readMethods: readonly ["GET", "POST"];
+        readonly accountWidePaths: readonly [readonly ["v1", "user"], readonly ["v1", "usage"], readonly ["v1", "workspace"], readonly ["v1", "workspaces"], readonly ["v1", "service-accounts"], readonly ["v1", "history"], readonly ["v1", "single-use-token"], readonly ["v1", "convai"], readonly ["v1", "dubbing"], readonly ["v1", "studio"], readonly ["v1", "pronunciation-dictionaries"], readonly ["v1", "voices", "add"], readonly ["v1", "voices", "pvc"], readonly ["v1", "voices", "collections"], readonly ["edit"], readonly ["replicate-to-isolated-environment"], readonly ["v1", "text-to-voice"], readonly ["v1", "audio-native"], readonly ["v1", "productions"], readonly ["v1", "speech-engine"], readonly ["v1", "music", "finetunes"], readonly ["v1", "flows"], readonly ["v1", "assets"], readonly ["v1", "audio-isolation", "history"]];
+        readonly hint: "An API key from ElevenLabs' API keys page; the Gateway sends it in the xi-api-key header. Speech, transcription and sound generation are POSTs; listing voices and models are GETs.";
+        readonly secrets: readonly [{
+            readonly name: "ELEVENLABS_API_KEY";
+            readonly hint: "An API key from ElevenLabs' API keys page; it can be scoped to the endpoints the app uses and given a credit cap.";
+        }];
+        readonly smoke: {
+            readonly method: "GET";
+            readonly path: "/v1/models";
+            readonly expect: readonly [200];
+            readonly free: true;
+            readonly note: "The first request in ElevenLabs' authentication docs; it generates nothing.";
+        };
+        readonly example: "read this paragraph aloud in a calm narrator voice";
+        readonly verified: {
+            readonly on: "2026-10-25";
+            readonly how: "docs";
+        };
+        readonly tags: readonly ["speech", "audio"];
+    };
+    readonly assemblyai: {
+        readonly mode: "api_key";
+        readonly label: "AssemblyAI";
+        readonly description: "Transcribes recorded audio and video, with speaker labels, redaction and subtitles.";
+        readonly auth: {
+            readonly kind: "header";
+            readonly secret: "ASSEMBLYAI_API_KEY";
+            readonly header: "Authorization";
+        };
+        readonly docs: "https://www.assemblyai.com/dashboard/home";
+        readonly api: "https://www.assemblyai.com/docs";
+        readonly hosts: readonly ["api.assemblyai.com", "api.eu.assemblyai.com"];
+        readonly data: "account";
+        readonly access: readonly ["read", "write"];
+        readonly readMethods: readonly ["GET", "POST"];
+        readonly writeMethods: readonly ["DELETE"];
+        readonly accountWidePaths: readonly [];
+        readonly hint: "The API key from your AssemblyAI dashboard; the Gateway sends it as the whole Authorization header, with no Bearer word. Audio is submitted with a POST to /v2/transcript and the app polls GET /v2/transcript/<id>; deleting a transcript needs write.";
+        readonly secrets: readonly [{
+            readonly name: "ASSEMBLYAI_API_KEY";
+            readonly hint: "The API key on your AssemblyAI dashboard.";
+        }];
+        readonly smoke: {
+            readonly method: "GET";
+            readonly path: "/v2/transcript?limit=1";
+            readonly expect: readonly [200];
+            readonly free: true;
+            readonly note: "Lists the account's latest transcript; it transcribes nothing.";
+        };
+        readonly cost: {
+            readonly unit: "call";
+            readonly note: "Per hour of audio submitted: Universal-3.5 Pro $0.21, Universal-2 $0.15; the free tier covers up to 185 hours of pre-recorded audio.";
+        };
+        readonly rate: {
+            readonly perMinute: 4000;
+            readonly note: "20,000 requests per 5 minutes per account; 5 transcriptions in parallel on free accounts, 200 or more on paid.";
+        };
+        readonly example: "transcribe this sales call recording with speaker labels";
+        readonly verified: {
+            readonly on: "2026-10-25";
+            readonly how: "docs";
+        };
+        readonly tags: readonly ["speech", "transcription"];
+    };
+    readonly newsapi: {
+        readonly mode: "api_key";
+        readonly label: "NewsAPI";
+        readonly description: "Searches news articles and live headlines from over 150,000 sources.";
+        readonly auth: {
+            readonly kind: "header";
+            readonly secret: "NEWSAPI_API_KEY";
+            readonly header: "X-Api-Key";
+        };
+        readonly docs: "https://newsapi.org/register";
+        readonly api: "https://newsapi.org/docs";
+        readonly hosts: readonly ["newsapi.org"];
+        readonly data: "per-call";
+        readonly access: readonly ["read"];
+        readonly readMethods: readonly ["GET"];
+        readonly accountWidePaths: readonly [];
+        readonly hint: "An API key from newsapi.org/register; the Gateway sends it in the X-Api-Key header. The free Developer plan allows 100 requests a day, delays articles by 24 hours and is for development only; production needs a paid plan.";
+        readonly secrets: readonly [{
+            readonly name: "NEWSAPI_API_KEY";
+            readonly hint: "The API key NewsAPI shows after you register.";
+        }];
+        readonly cost: {
+            readonly unit: "call";
+            readonly usd: 0.0018;
+            readonly note: "Developer plan free (100 requests a day, development only); Business $449 a month for 250,000 requests, then $0.0018 each.";
+        };
+        readonly rate: {
+            readonly perDay: 100;
+            readonly note: "Developer plan; Business includes 250,000 requests a month, Advanced 2,000,000.";
+        };
+        readonly example: "find today's top business headlines in the US";
+        readonly verified: {
+            readonly on: "2026-10-25";
+            readonly how: "docs";
+        };
+        readonly tags: readonly ["news"];
+    };
+    readonly anthropic: {
+        readonly mode: "ai";
+        readonly label: "Anthropic";
+        readonly description: "Claude models through the Messages API.";
+        readonly auth: {
+            readonly kind: "bearer";
+            readonly secret: "ANTHROPIC_API_KEY";
+        };
+        readonly docs: "https://platform.claude.com/settings/keys";
+        readonly api: "https://platform.claude.com/docs/en/api/overview";
+        readonly origin: "https://api.anthropic.com";
+        readonly inferenceRoutes: readonly ["/v1/messages", "/v1/messages/count_tokens", "/v1/chat/completions"];
+        readonly unstoredRoutes: readonly ["/v1/chat/completions"];
+        readonly shape: "anthropic";
+        readonly chat: {
+            readonly path: "/v1/chat/completions";
+            readonly seedModel: "claude-haiku-5-5";
+        };
+        readonly aig: {
+            readonly slug: "anthropic";
+        };
+        readonly hint: "An API key from the Claude Console's API keys page; the Gateway sends it as a bearer token. Apps send the anthropic-version header themselves.";
+        readonly secrets: readonly [{
+            readonly name: "ANTHROPIC_API_KEY";
+            readonly hint: "A key scoped to one workspace; the Gateway strips any anthropic-workspace-id header an app sends, so the key alone decides the workspace.";
+        }];
+        readonly smoke: {
+            readonly method: "GET";
+            readonly path: "/v1/models";
+            readonly expect: readonly [200];
+            readonly free: true;
+            readonly note: "Send an anthropic-version header, as every call does.";
+        };
+        readonly rate: {
+            readonly note: "Requests and tokens per minute by usage tier, on the Console's Rate limits page; token counting is free, with its own per-minute limit.";
+        };
+        readonly example: "summarize this support thread in three bullet points";
+        readonly verified: {
+            readonly on: "2026-10-25";
+            readonly how: "docs";
+        };
+        readonly tags: readonly ["ai", "llm"];
+    };
+    readonly gemini: {
+        readonly mode: "ai";
+        readonly label: "Google Gemini";
+        readonly description: "Google's Gemini models through their OpenAI-compatible endpoint: chat, embeddings, images.";
+        readonly auth: {
+            readonly kind: "bearer";
+            readonly secret: "GEMINI_API_KEY";
+        };
+        readonly docs: "https://aistudio.google.com/apikey";
+        readonly api: "https://ai.google.dev/gemini-api/docs/openai";
+        readonly origin: "https://generativelanguage.googleapis.com";
+        readonly inferenceRoutes: readonly ["/v1beta/openai/chat/completions", "/v1beta/openai/embeddings", "/v1beta/openai/images/generations"];
+        readonly chat: {
+            readonly path: "/v1beta/openai/chat/completions";
+            readonly seedModel: "gemini-3.1-flash-lite";
+        };
+        readonly embeddings: {
+            readonly path: "/v1beta/openai/embeddings";
+            readonly seedModel: "gemini-embedding-001";
+        };
+        readonly hint: "An API key from Google AI Studio; the Gateway sends it as a bearer token. Apps call Gemini's OpenAI-shaped paths under /v1beta/openai.";
+        readonly secrets: readonly [{
+            readonly name: "GEMINI_API_KEY";
+            readonly hint: "A Google AI Studio key restricted to the Gemini API only.";
+        }];
+        readonly smoke: {
+            readonly method: "GET";
+            readonly path: "/v1beta/openai/models";
+            readonly expect: readonly [200];
+            readonly free: true;
+        };
+        readonly rate: {
+            readonly note: "Per project, not per key: requests and tokens per minute and requests per day, by tier (Free, then Tiers 1 to 3).";
+        };
+        readonly example: "describe what is in this product photo";
+        readonly verified: {
+            readonly on: "2026-10-25";
+            readonly how: "docs";
+        };
+        readonly tags: readonly ["ai", "llm", "embeddings", "images"];
+    };
+    readonly mistral: {
+        readonly mode: "ai";
+        readonly label: "Mistral AI";
+        readonly description: "Mistral's models: chat, code completion, embeddings, moderation, OCR, speech.";
+        readonly auth: {
+            readonly kind: "bearer";
+            readonly secret: "MISTRAL_API_KEY";
+        };
+        readonly docs: "https://console.mistral.ai";
+        readonly api: "https://docs.mistral.ai/api/";
+        readonly origin: "https://api.mistral.ai";
+        readonly inferenceRoutes: readonly ["/v1/chat/completions", "/v1/fim/completions", "/v1/embeddings", "/v1/moderations", "/v1/chat/moderations", "/v1/classifications", "/v1/chat/classifications", "/v1/ocr", "/v1/audio/transcriptions", "/v1/audio/speech"];
+        readonly chat: {
+            readonly path: "/v1/chat/completions";
+            readonly seedModel: "mistral-small-latest";
+        };
+        readonly embeddings: {
+            readonly path: "/v1/embeddings";
+            readonly seedModel: "mistral-embed";
+        };
+        readonly aig: {
+            readonly slug: "mistral";
+        };
+        readonly hint: "An API key from API Keys in the Mistral Studio console; the Gateway sends it as a bearer token. Free mode needs no card; usage and rate limits apply.";
+        readonly secrets: readonly [{
+            readonly name: "MISTRAL_API_KEY";
+            readonly hint: "A key from API Keys in the Studio console, with an expiry date.";
+        }];
+        readonly smoke: {
+            readonly method: "GET";
+            readonly path: "/v1/models";
+            readonly expect: readonly [200];
+            readonly free: true;
+        };
+        readonly example: "extract the text from this scanned invoice";
+        readonly verified: {
+            readonly on: "2026-10-25";
+            readonly how: "docs";
+        };
+        readonly tags: readonly ["ai", "llm", "ocr", "embeddings"];
+    };
+    readonly groq: {
+        readonly mode: "ai";
+        readonly label: "Groq";
+        readonly description: "Open models on Groq through OpenAI's API shape: chat, responses, transcription, speech.";
+        readonly auth: {
+            readonly kind: "bearer";
+            readonly secret: "GROQ_API_KEY";
+        };
+        readonly docs: "https://console.groq.com/keys";
+        readonly api: "https://console.groq.com/docs/api-reference";
+        readonly origin: "https://api.groq.com";
+        readonly inferenceRoutes: readonly ["/openai/v1/chat/completions", "/openai/v1/responses", "/openai/v1/audio/transcriptions", "/openai/v1/audio/translations", "/openai/v1/audio/speech"];
+        readonly chat: {
+            readonly path: "/openai/v1/chat/completions";
+            readonly seedModel: "openai/gpt-oss-20b";
+        };
+        readonly aig: {
+            readonly slug: "groq";
+            readonly trim: "/openai/v1";
+        };
+        readonly hint: "An API key from the Groq console; the Gateway sends it as a bearer token. Apps call the OpenAI-shaped paths under /openai/v1.";
+        readonly secrets: readonly [{
+            readonly name: "GROQ_API_KEY";
+            readonly hint: "A key from the API Keys page of the Groq console.";
+        }];
+        readonly smoke: {
+            readonly method: "GET";
+            readonly path: "/openai/v1/models";
+            readonly expect: readonly [200];
+            readonly free: true;
+        };
+        readonly rate: {
+            readonly note: "Requests and tokens per minute and per day, per model and plan, for the whole organization; the console Limits page shows them.";
+        };
+        readonly example: "transcribe this voice memo";
+        readonly verified: {
+            readonly on: "2026-10-25";
+            readonly how: "docs";
+        };
+        readonly tags: readonly ["ai", "llm", "speech"];
+    };
+    readonly cohere: {
+        readonly mode: "ai";
+        readonly label: "Cohere";
+        readonly description: "Cohere's models: chat, embeddings, reranking, classification, transcription, document parsing.";
+        readonly auth: {
+            readonly kind: "bearer";
+            readonly secret: "COHERE_API_KEY";
+        };
+        readonly docs: "https://dashboard.cohere.com/api-keys";
+        readonly api: "https://docs.cohere.com/reference/about";
+        readonly origin: "https://api.cohere.com";
+        readonly inferenceRoutes: readonly ["/v2/chat", "/v2/embed", "/v2/rerank", "/v1/classify", "/v2/audio/transcriptions", "/v2/parse", "/v1/tokenize", "/v1/detokenize"];
+        readonly shape: "other";
+        readonly hint: "An API key from the Cohere dashboard; the Gateway sends it as a bearer token. Trial keys are free and limited; production keys are paid.";
+        readonly secrets: readonly [{
+            readonly name: "COHERE_API_KEY";
+            readonly hint: "A production key; a trial key is limited to 1,000 calls a month.";
+        }];
+        readonly smoke: {
+            readonly method: "GET";
+            readonly path: "/v1/models";
+            readonly expect: readonly [200];
+            readonly free: true;
+        };
+        readonly rate: {
+            readonly note: "Production: 500 calls a minute for Command A chat and most endpoints, rerank 1,000. Trial: 20 chat calls a minute, 1,000 calls a month.";
+        };
+        readonly example: "rerank these search results for the query refund policy";
+        readonly verified: {
+            readonly on: "2026-10-25";
+            readonly how: "docs";
+        };
+        readonly tags: readonly ["ai", "llm", "embeddings", "rerank"];
+    };
+    readonly voyage: {
+        readonly mode: "api_key";
+        readonly label: "Voyage AI";
+        readonly description: "Embeddings and rerankers for search and retrieval: text, code, multimodal, contextualized chunks.";
+        readonly auth: {
+            readonly kind: "bearer";
+            readonly secret: "VOYAGE_API_KEY";
+        };
+        readonly docs: "https://dashboard.voyageai.com/organization/api-keys";
+        readonly api: "https://docs.voyageai.com/reference/embeddings-api";
+        readonly hosts: readonly ["api.voyageai.com"];
+        readonly data: "per-call";
+        readonly access: readonly ["read"];
+        readonly readMethods: readonly ["POST"];
+        readonly accountWidePaths: readonly [readonly ["v1", "files"], readonly ["v1", "batches"]];
+        readonly hint: "A secret key from the Voyage dashboard; the Gateway sends it as a bearer token. Apps POST to /v1/embeddings, /v1/multimodalembeddings, /v1/contextualizedembeddings and /v1/rerank.";
+        readonly secrets: readonly [{
+            readonly name: "VOYAGE_API_KEY";
+            readonly hint: "A secret key from API keys in the Voyage dashboard.";
+        }];
+        readonly smoke: {
+            readonly method: "GET";
+            readonly path: "/v1/batches";
+            readonly expect: readonly [200];
+            readonly free: true;
+            readonly note: "Lists the organization's batches, so the Gateway refuses it for apps; run it from the person's terminal.";
+        };
+        readonly cost: {
+            readonly unit: "token";
+            readonly note: "voyage-4 $0.06 per million tokens; the first 200 million tokens of the voyage-4 family are free per account.";
+        };
+        readonly rate: {
+            readonly perMinute: 2000;
+            readonly note: "2,000 requests a minute at tier 1, doubled at tier 2, tripled at tier 3; tokens per minute vary by model.";
+        };
+        readonly example: "embed these product descriptions for semantic search";
+        readonly verified: {
+            readonly on: "2026-10-25";
+            readonly how: "docs";
+        };
+        readonly tags: readonly ["embeddings", "rerank", "search"];
+    };
+    readonly perplexity: {
+        readonly mode: "api_key";
+        readonly label: "Perplexity";
+        readonly description: "Web-grounded answers from the Agent API, raw web search results, and embeddings.";
+        readonly auth: {
+            readonly kind: "bearer";
+            readonly secret: "PERPLEXITY_API_KEY";
+        };
+        readonly docs: "https://console.perplexity.ai/project/keys";
+        readonly api: "https://docs.perplexity.ai/api-reference/agent-post";
+        readonly hosts: readonly ["api.perplexity.ai"];
+        readonly data: "per-call";
+        readonly access: readonly ["read"];
+        readonly readMethods: readonly ["GET", "POST"];
+        readonly accountWidePaths: readonly [readonly ["v1", "batches"], readonly ["v1", "files"], readonly ["v1", "skills"], readonly ["v1", "analytics"], readonly ["v2", "analytics"], readonly ["generate_auth_token"], readonly ["revoke_auth_token"]];
+        readonly hint: "An API key from the Perplexity console; the Gateway sends it as a bearer token. Apps POST to /v1/agent for researched answers and /search for result lists, and GET /v1/agent/{id} to poll a background run.";
+        readonly secrets: readonly [{
+            readonly name: "PERPLEXITY_API_KEY";
+            readonly hint: "An API key from the project's API keys page in the Perplexity console.";
+        }];
+        readonly smoke: {
+            readonly method: "GET";
+            readonly path: "/orchestrator/v1/models";
+            readonly expect: readonly [200];
+            readonly free: true;
+        };
+        readonly cost: {
+            readonly unit: "token";
+            readonly note: "Agent API per token plus tool fees (web_search $0.0025 a call); Search API $5 per 1,000 requests.";
+        };
+        readonly example: "research the latest pricing changes from our three main competitors";
+        readonly verified: {
+            readonly on: "2026-10-25";
+            readonly how: "docs";
+        };
+        readonly tags: readonly ["search", "ai", "research"];
+    };
+    readonly jina: {
+        readonly mode: "api_key";
+        readonly label: "Jina AI";
+        readonly description: "Reads web pages as Markdown, searches the web, and embeds and reranks text and images.";
+        readonly auth: {
+            readonly kind: "bearer";
+            readonly secret: "JINA_API_KEY";
+        };
+        readonly docs: "https://jina.ai/api-dashboard/key-manager";
+        readonly api: "https://docs.jina.ai/";
+        readonly hosts: readonly ["api.jina.ai", "r.jina.ai", "s.jina.ai"];
+        readonly data: "per-call";
+        readonly access: readonly ["read"];
+        readonly readMethods: readonly ["GET", "POST"];
+        readonly accountWidePaths: readonly [readonly ["v1", "batches"], readonly ["echo"]];
+        readonly hint: "An API key from the Jina API dashboard; the Gateway sends it as a bearer token. Reader is r.jina.ai (POST {\"url\": ...}), Search is s.jina.ai, and embeddings and rerank are on api.jina.ai.";
+        readonly secrets: readonly [{
+            readonly name: "JINA_API_KEY";
+            readonly hint: "A key starting jina_, from Manage API Key in the Jina API dashboard.";
+        }];
+        readonly smoke: {
+            readonly method: "GET";
+            readonly host: "api.jina.ai";
+            readonly path: "/v1/batches";
+            readonly expect: readonly [200];
+            readonly free: true;
+            readonly note: "Lists the account's batch jobs, so the Gateway refuses it for apps; run it from the person's terminal.";
+        };
+        readonly cost: {
+            readonly unit: "token";
+            readonly note: "Billed in tokens against the account balance; GET /v1/models lists each model's price.";
+        };
+        readonly rate: {
+            readonly note: "Reader 500 requests a minute, Search 100, embeddings and rerank 500; premium keys get ten times more.";
+        };
+        readonly example: "read this article as Markdown and pull out the key claims";
+        readonly verified: {
+            readonly on: "2026-10-25";
+            readonly how: "docs";
+        };
+        readonly tags: readonly ["scrape", "search", "embeddings", "rerank"];
+    };
+    readonly replicate: {
+        readonly mode: "api_key";
+        readonly label: "Replicate";
+        readonly description: "Runs open-source and official models by API: images, video, audio and language.";
+        readonly auth: {
+            readonly kind: "bearer";
+            readonly secret: "REPLICATE_API_TOKEN";
+        };
+        readonly docs: "https://replicate.com/account/api-tokens";
+        readonly api: "https://replicate.com/docs/reference/http";
+        readonly hosts: readonly ["api.replicate.com"];
+        readonly data: "per-call";
+        readonly access: readonly ["read"];
+        readonly readMethods: readonly ["POST"];
+        readonly accountWidePaths: readonly [readonly ["v1", "account"], readonly ["v1", "deployments"], readonly ["v1", "files"], readonly ["v1", "webhooks"], readonly ["trainings"]];
+        readonly hint: "An API token from Replicate's API tokens page; the Gateway sends it as a bearer token. Apps POST to /v1/models/{owner}/{name}/predictions or /v1/predictions with Prefer: wait (up to 60 seconds), or pass a webhook URL for longer runs.";
+        readonly secrets: readonly [{
+            readonly name: "REPLICATE_API_TOKEN";
+            readonly hint: "An API token from the API tokens page of the Replicate account.";
+        }];
+        readonly smoke: {
+            readonly method: "GET";
+            readonly path: "/v1/account";
+            readonly expect: readonly [200];
+            readonly free: true;
+            readonly note: "Account-wide, so the Gateway refuses it for apps; run it from the person's terminal.";
+        };
+        readonly rate: {
+            readonly perMinute: 600;
+            readonly note: "Creating predictions 600 a minute; every other endpoint 3,000 a minute.";
+        };
+        readonly example: "generate a product photo of a ceramic mug on a wooden table";
+        readonly verified: {
+            readonly on: "2026-10-25";
+            readonly how: "docs";
+        };
+        readonly tags: readonly ["ai", "images", "video", "audio"];
+    };
+    readonly huggingface: {
+        readonly mode: "api_key";
+        readonly label: "Hugging Face Inference";
+        readonly description: "Open models from Hugging Face's inference providers through one router: chat, embeddings, images, speech.";
+        readonly auth: {
+            readonly kind: "bearer";
+            readonly secret: "HUGGINGFACE_API_TOKEN";
+        };
+        readonly docs: "https://huggingface.co/settings/tokens/new?ownUserPermissions=inference.serverless.write&tokenType=fineGrained";
+        readonly api: "https://huggingface.co/docs/inference-providers/index";
+        readonly hosts: readonly ["router.huggingface.co"];
+        readonly data: "per-call";
+        readonly access: readonly ["read"];
+        readonly readMethods: readonly ["GET", "POST"];
+        readonly accountWidePaths: readonly [];
+        readonly hint: "A fine-grained access token from Hugging Face settings with the Inference Providers permission; the Gateway sends it as a bearer token. Apps POST OpenAI-style chat to /v1/chat/completions, or other tasks under /<provider>/, such as /hf-inference/models/<model>.";
+        readonly secrets: readonly [{
+            readonly name: "HUGGINGFACE_API_TOKEN";
+            readonly hint: "A fine-grained token with only the Make calls to Inference Providers permission.";
+        }];
+        readonly cost: {
+            readonly unit: "call";
+            readonly note: "Pay as you go at each provider's own rate with no markup; PRO accounts get $2 of compute credits a month.";
+        };
+        readonly example: "embed these support articles for semantic search";
+        readonly verified: {
+            readonly on: "2026-10-25";
+            readonly how: "docs";
+        };
+        readonly tags: readonly ["ai", "llm", "embeddings", "images"];
+    };
+    readonly cloudflare: {
+        readonly mode: "api_key";
+        readonly label: "Cloudflare";
+        readonly description: "Cloudflare's API: zones, DNS, Workers, R2, D1, KV and the rest of an account.";
+        readonly auth: {
+            readonly kind: "bearer";
+            readonly secret: "CLOUDFLARE_PROVIDER_API_TOKEN";
+        };
+        readonly docs: "https://dash.cloudflare.com/profile/api-tokens";
+        readonly api: "https://developers.cloudflare.com/api/";
+        readonly hosts: readonly ["api.cloudflare.com"];
+        readonly data: "account";
+        readonly access: readonly ["read", "write"];
+        readonly readMethods: readonly ["GET", "HEAD"];
+        readonly writeMethods: readonly ["POST", "PUT", "PATCH", "DELETE"];
+        readonly accountWidePaths: readonly [readonly ["client", "v4", "user"], readonly ["client", "v4", "memberships"], readonly ["client", "v4", "organizations"], readonly ["client", "v4", "tenants"], readonly ["members"], readonly ["tokens"], readonly ["roles"], readonly ["iam"], readonly ["subscriptions"], readonly ["payment-methods"], readonly ["pay-invoice"], readonly ["receipts"], readonly ["invoices"], readonly ["client-secret"], readonly ["billing"], readonly ["logs", "audit"], readonly ["audit_logs"], readonly ["alerting", "v3", "destinations", "webhooks"], readonly ["ai", "run"], readonly ["ai", "v1"]];
+        readonly hint: "An API token from My Profile > API Tokens with only the permissions the app needs; the Gateway sends it as a bearer token. A token on the Gateway's own account can read and change the Gateway, so keep it narrow or use another account.";
+        readonly secrets: readonly [{
+            readonly name: "CLOUDFLARE_PROVIDER_API_TOKEN";
+            readonly hint: "A user or account-owned API token scoped to the zones and permissions the app needs, never a Global API Key.";
+        }];
+        readonly smoke: {
+            readonly method: "GET";
+            readonly path: "/client/v4/user/tokens/verify";
+            readonly expect: readonly [200];
+            readonly free: true;
+            readonly note: "For a user token; account-owned tokens use /client/v4/accounts/<id>/tokens/verify. Account-wide, so run it from the person's terminal.";
+        };
+        readonly rate: {
+            readonly note: "1,200 requests per 5 minutes per user or account token; 200 a second per IP; GraphQL by query cost, at most 320 per 5 minutes.";
+        };
+        readonly example: "list the DNS records for my domain";
+        readonly verified: {
+            readonly on: "2026-10-25";
+            readonly how: "docs";
+        };
+        readonly tags: readonly ["infrastructure", "dns", "hosting"];
+    };
+    readonly posthog: {
+        readonly mode: "api_key";
+        readonly label: "PostHog";
+        readonly description: "Product analytics: insights, feature flags, persons, cohorts, experiments and HogQL queries.";
+        readonly auth: {
+            readonly kind: "bearer";
+            readonly secret: "POSTHOG_PERSONAL_API_KEY";
+        };
+        readonly docs: "https://us.posthog.com/settings/user-api-keys";
+        readonly api: "https://posthog.com/docs/api";
+        readonly hosts: readonly ["us.posthog.com", "eu.posthog.com"];
+        readonly data: "account";
+        readonly access: readonly ["read", "write"];
+        readonly readMethods: readonly ["GET", "HEAD"];
+        readonly writeMethods: readonly ["POST", "PUT", "PATCH", "DELETE"];
+        readonly accountWidePaths: readonly [readonly ["api", "users"], readonly ["api", "user"], readonly ["api", "organizations"], readonly ["api", "billing"], readonly ["api", "revoke_leaked_key"], readonly ["project_secret_api_keys"], readonly ["billing"], readonly ["activity_log"], readonly ["advanced_activity_logs"], readonly ["hog_functions"], readonly ["batch_exports"], readonly ["integrations"]];
+        readonly hint: "A personal API key from Settings > Personal API keys, with only the scopes the app needs; the Gateway sends it as a bearer token to us.posthog.com or eu.posthog.com. HogQL queries are POSTs, so an app that runs them asks for write.";
+        readonly secrets: readonly [{
+            readonly name: "POSTHOG_PERSONAL_API_KEY";
+            readonly hint: "A personal API key (phx_...) with only the scopes the app needs, from the region the project lives in; never the project token.";
+        }];
+        readonly smoke: {
+            readonly method: "GET";
+            readonly host: "us.posthog.com";
+            readonly path: "/api/users/@me/";
+            readonly expect: readonly [200];
+            readonly free: true;
+            readonly note: "Needs the user:read scope; use eu.posthog.com for an EU project. Account-wide, so run it from the person's terminal.";
+        };
+        readonly rate: {
+            readonly perMinute: 480;
+            readonly note: "Create, read, update and delete endpoints 480 a minute and 4,800 an hour; analytics endpoints 240 a minute; the query endpoint 2,400 an hour.";
+        };
+        readonly example: "list the feature flags in my project and whether each is on";
+        readonly verified: {
+            readonly on: "2026-10-25";
+            readonly how: "docs";
+        };
+        readonly tags: readonly ["analytics", "product", "feature-flags"];
+    };
+    readonly mixpanel: {
+        readonly mode: "api_key";
+        readonly label: "Mixpanel";
+        readonly description: "Product analytics: saved reports, profiles, raw event export and event import.";
+        readonly auth: {
+            readonly kind: "basic";
+            readonly secret: "MIXPANEL_SERVICE_ACCOUNT_SECRET";
+            readonly as: "password";
+            readonly user: {
+                readonly secret: "MIXPANEL_SERVICE_ACCOUNT_USERNAME";
+            };
+        };
+        readonly docs: "https://mixpanel.com/settings/org#serviceaccounts";
+        readonly api: "https://docs.mixpanel.com/reference/overview";
+        readonly hosts: readonly ["mixpanel.com", "eu.mixpanel.com", "in.mixpanel.com", "data.mixpanel.com", "data-eu.mixpanel.com", "data-in.mixpanel.com", "api.mixpanel.com", "api-eu.mixpanel.com", "api-in.mixpanel.com"];
+        readonly data: "account";
+        readonly access: readonly ["read", "write"];
+        readonly readMethods: readonly ["GET", "HEAD"];
+        readonly writeMethods: readonly ["POST", "PUT", "PATCH", "DELETE"];
+        readonly accountWidePaths: readonly [readonly ["api", "app", "me"], readonly ["api", "app", "organizations"], readonly ["service-accounts"], readonly ["data-retrievals"], readonly ["data-deletions"], readonly ["nessie"]];
+        readonly hint: "A service account from Organization Settings > Service Accounts; the Gateway sends its username and secret as HTTP Basic. Most calls also need the project_id parameter, and an EU or India project uses its own hosts.";
+        readonly secrets: readonly [{
+            readonly name: "MIXPANEL_SERVICE_ACCOUNT_USERNAME";
+            readonly hint: "The service account's username, shown when it is created in Organization Settings > Service Accounts.";
+        }, {
+            readonly name: "MIXPANEL_SERVICE_ACCOUNT_SECRET";
+            readonly hint: "The service account's secret, shown once when it is created; give the account the narrowest role and only the projects the app needs.";
+        }];
+        readonly smoke: {
+            readonly method: "GET";
+            readonly host: "mixpanel.com";
+            readonly path: "/api/app/me";
+            readonly expect: readonly [200];
+            readonly free: true;
+            readonly note: "Lists the organizations and projects the service account reaches. Account-wide, so run it from the person's terminal.";
+        };
+        readonly rate: {
+            readonly note: "Per project: Query API 60 queries an hour, 5 at once; Raw Data Export 60 an hour, 3 a second, 100 at once; ingestion about 2 GB a minute.";
+        };
+        readonly example: "pull last week's numbers from my saved Insights report";
+        readonly verified: {
+            readonly on: "2026-10-25";
+            readonly how: "docs";
+        };
+        readonly tags: readonly ["analytics", "product"];
+    };
+    readonly segment: {
+        readonly mode: "api_key";
+        readonly label: "Segment";
+        readonly description: "Sends identify, track, page, group and alias events to a Segment source.";
+        readonly auth: {
+            readonly kind: "basic";
+            readonly secret: "SEGMENT_WRITE_KEY";
+            readonly as: "username";
+        };
+        readonly docs: "https://www.twilio.com/docs/segment/connections/find-writekey";
+        readonly api: "https://www.twilio.com/docs/segment/connections/sources/catalog/libraries/server/http-api";
+        readonly hosts: readonly ["api.segment.io", "events.eu1.segmentapis.com"];
+        readonly data: "account";
+        readonly access: readonly ["write"];
+        readonly readMethods: readonly [];
+        readonly writeMethods: readonly ["POST"];
+        readonly accountWidePaths: readonly [];
+        readonly hint: "The write key of an HTTP API source, from the source's Settings > API Keys; the Gateway sends it as the Basic username with an empty password. It only sends events; an EU workspace uses events.eu1.segmentapis.com.";
+        readonly secrets: readonly [{
+            readonly name: "SEGMENT_WRITE_KEY";
+            readonly hint: "The write key of an HTTP API source, from the source's Settings > API Keys.";
+        }];
+        readonly rate: {
+            readonly perSecond: 1000;
+            readonly note: "Recommended ceiling per workspace; 32 KB per call, 500 KB and 2,500 events per batch.";
+        };
+        readonly example: "record a Signed Up event for a new user";
+        readonly verified: {
+            readonly on: "2026-10-25";
+            readonly how: "docs";
+        };
+        readonly tags: readonly ["analytics", "events", "cdp"];
+    };
+    readonly supabase: {
+        readonly mode: "api_key";
+        readonly label: "Supabase";
+        readonly description: "A Supabase project's Postgres REST API and Storage, with its secret key.";
+        readonly auth: {
+            readonly kind: "header";
+            readonly secret: "SUPABASE_SECRET_KEY";
+            readonly header: "apikey";
+        };
+        readonly docs: "https://supabase.com/dashboard/project/_/settings/api-keys";
+        readonly api: "https://supabase.com/docs/guides/api";
+        readonly hosts: readonly [];
+        readonly hostSetting: "SUPABASE_HOST";
+        readonly data: "account";
+        readonly access: readonly ["read", "write"];
+        readonly readMethods: readonly ["GET", "HEAD"];
+        readonly writeMethods: readonly ["POST", "PUT", "PATCH", "DELETE"];
+        readonly accountWidePaths: readonly [readonly ["auth", "v1", "admin"], readonly ["pg"]];
+        readonly hint: "A secret key (sb_secret_...) from Settings > API Keys and the project's host; the Gateway sends the key in the apikey header. The key bypasses Row Level Security, and RPC calls are POSTs, so they need write.";
+        readonly secrets: readonly [{
+            readonly name: "SUPABASE_SECRET_KEY";
+            readonly hint: "A secret key (sb_secret_...) from Settings > API Keys, made for this Gateway alone; it bypasses Row Level Security.";
+        }, {
+            readonly name: "SUPABASE_HOST";
+            readonly hint: "The project's host, <project-ref>.supabase.co, from the project URL.";
+        }];
+        readonly smoke: {
+            readonly method: "GET";
+            readonly path: "/rest/v1/";
+            readonly expect: readonly [200];
+            readonly free: true;
+            readonly note: "The REST API's OpenAPI root, which only a secret key may read; sent to the host in SUPABASE_HOST.";
+        };
+        readonly example: "list the ten newest rows in my orders table";
+        readonly verified: {
+            readonly on: "2026-10-25";
+            readonly how: "docs";
+        };
+        readonly tags: readonly ["database", "postgres", "storage"];
+    };
+    readonly turso: {
+        readonly mode: "api_key";
+        readonly label: "Turso";
+        readonly description: "Turso's Platform API: databases, groups, locations and usage for one organization.";
+        readonly auth: {
+            readonly kind: "bearer";
+            readonly secret: "TURSO_API_TOKEN";
+        };
+        readonly docs: "https://docs.turso.tech/api-reference/authentication";
+        readonly api: "https://docs.turso.tech/api-reference/introduction";
+        readonly hosts: readonly ["api.turso.tech"];
+        readonly data: "account";
+        readonly access: readonly ["read", "write"];
+        readonly readMethods: readonly ["GET", "HEAD"];
+        readonly writeMethods: readonly ["POST", "PATCH", "DELETE"];
+        readonly accountWidePaths: readonly [readonly ["auth"], readonly ["api-tokens"], readonly ["members"], readonly ["invites"], readonly ["invoices"], readonly ["subscription"], readonly ["plans"], readonly ["audit-logs"], readonly ["v1", "user"]];
+        readonly hint: "An organization-scoped Platform API token (turso auth api-tokens mint <name> --org <org>); the Gateway sends it as a bearer token to api.turso.tech. It manages databases and cannot query them: that is the turso-db entry.";
+        readonly secrets: readonly [{
+            readonly name: "TURSO_API_TOKEN";
+            readonly hint: "An organization-scoped or group-scoped Platform API token from turso auth api-tokens mint <name> --org <org>; never an unrestricted one.";
+        }];
+        readonly smoke: {
+            readonly method: "GET";
+            readonly path: "/v1/auth/validate";
+            readonly expect: readonly [200];
+            readonly free: true;
+            readonly note: "Account-wide, so run it from the person's terminal.";
+        };
+        readonly example: "list the databases in my Turso organization";
+        readonly verified: {
+            readonly on: "2026-10-25";
+            readonly how: "docs";
+        };
+        readonly tags: readonly ["database", "sqlite"];
+    };
+    readonly "turso-db": {
+        readonly mode: "api_key";
+        readonly label: "Turso database";
+        readonly description: "SQL over HTTP to one Turso database: queries, dumps and migration status.";
+        readonly auth: {
+            readonly kind: "bearer";
+            readonly secret: "TURSO_DB_AUTH_TOKEN";
+        };
+        readonly docs: "https://docs.turso.tech/sdk/authorization/tokens";
+        readonly api: "https://docs.turso.tech/sdk/http/reference";
+        readonly hosts: readonly [];
+        readonly hostSetting: "TURSO_DB_HOST";
+        readonly data: "account";
+        readonly access: readonly ["read", "write"];
+        readonly readMethods: readonly ["GET", "HEAD"];
+        readonly writeMethods: readonly ["POST"];
+        readonly accountWidePaths: readonly [];
+        readonly hint: "A database token (turso db tokens create <db>) and the database's HTTP host; the Gateway sends the token as a bearer token. Every query is a POST to /v2/pipeline, so an app that queries asks for write; a --read-only token keeps it to reads.";
+        readonly secrets: readonly [{
+            readonly name: "TURSO_DB_AUTH_TOKEN";
+            readonly hint: "A database token from turso db tokens create <db>, with --read-only or fine-grained permissions when the app only reads.";
+        }, {
+            readonly name: "TURSO_DB_HOST";
+            readonly hint: "The database's HTTP host, <db>-<org>.turso.io, from turso db show <db> --http-url.";
+        }];
+        readonly example: "count the rows in my users table";
+        readonly verified: {
+            readonly on: "2026-10-25";
+            readonly how: "docs";
+        };
+        readonly tags: readonly ["database", "sqlite", "sql"];
+    };
+    readonly neon: {
+        readonly mode: "api_key";
+        readonly label: "Neon";
+        readonly description: "Neon's management API: Postgres projects, branches, databases, roles and endpoints.";
+        readonly auth: {
+            readonly kind: "bearer";
+            readonly secret: "NEON_API_KEY";
+        };
+        readonly docs: "https://neon.com/docs/manage/api-keys";
+        readonly api: "https://neon.com/docs/reference/api";
+        readonly hosts: readonly ["console.neon.tech"];
+        readonly data: "account";
+        readonly access: readonly ["read", "write"];
+        readonly readMethods: readonly ["GET", "HEAD"];
+        readonly writeMethods: readonly ["POST", "PUT", "PATCH", "DELETE"];
+        readonly accountWidePaths: readonly [readonly ["api", "v2", "auth"], readonly ["api", "v2", "organizations"], readonly ["users", "me"], readonly ["api_keys"], readonly ["members"], readonly ["invitations"], readonly ["permissions"], readonly ["transfer_requests"], readonly ["billing"], readonly ["consumption_history"], readonly ["connection_uri"], readonly ["reveal_password"], readonly ["reset_password"], readonly ["credentials"], readonly ["realtime", "secret"], readonly ["rotate_secret"], readonly ["auth", "keys"], readonly ["auth", "webhooks"], readonly ["oauth_providers"], readonly ["email_server"], readonly ["email_provider"], readonly ["auth", "plugins"]];
+        readonly hint: "A project-scoped or organization API key from Settings > API keys; the Gateway sends it as a bearer token to console.neon.tech. It manages projects and branches; the database itself takes Postgres credentials, not this key.";
+        readonly secrets: readonly [{
+            readonly name: "NEON_API_KEY";
+            readonly hint: "A project-scoped or organization API key from Settings > API keys; a project-scoped key reaches one project only.";
+        }];
+        readonly smoke: {
+            readonly method: "GET";
+            readonly path: "/api/v2/auth";
+            readonly expect: readonly [200];
+            readonly free: true;
+            readonly note: "Says which credential and identity the key is. Account-wide, so run it from the person's terminal.";
+        };
+        readonly rate: {
+            readonly perMinute: 700;
+            readonly note: "About 11 a second, with bursts of 40 a second per route.";
+        };
+        readonly example: "list my Neon projects and their branches";
+        readonly verified: {
+            readonly on: "2026-10-25";
+            readonly how: "docs";
+        };
+        readonly tags: readonly ["database", "postgres"];
+    };
+    readonly pinecone: {
+        readonly mode: "api_key";
+        readonly label: "Pinecone";
+        readonly description: "Vector database: indexes, namespaces, vectors and documents, plus hosted embedding and rerank.";
+        readonly auth: {
+            readonly kind: "header";
+            readonly secret: "PINECONE_API_KEY";
+            readonly header: "Api-Key";
+        };
+        readonly docs: "https://app.pinecone.io/organizations/-/projects/-/keys";
+        readonly api: "https://docs.pinecone.io/reference/api/introduction";
+        readonly hosts: readonly ["api.pinecone.io"];
+        readonly hostSetting: "PINECONE_HOST";
+        readonly data: "account";
+        readonly access: readonly ["read", "write"];
+        readonly readMethods: readonly ["GET", "HEAD"];
+        readonly writeMethods: readonly ["POST", "PATCH", "DELETE"];
+        readonly accountWidePaths: readonly [readonly ["admin"], readonly ["api-keys"]];
+        readonly hint: "An API key from the project's API keys page and the host of the index the app uses; the Gateway sends the key in the Api-Key header to api.pinecone.io and that host. Query, search, embed and rerank are POSTs, so an app that uses them asks for write.";
+        readonly secrets: readonly [{
+            readonly name: "PINECONE_API_KEY";
+            readonly hint: "An API key from the project's API keys page in the Pinecone console.";
+        }, {
+            readonly name: "PINECONE_HOST";
+            readonly hint: "The host of the index the app uses, <index>-<id>.svc.<env>.pinecone.io, from describe_index or the console.";
+        }];
+        readonly smoke: {
+            readonly method: "GET";
+            readonly host: "api.pinecone.io";
+            readonly path: "/indexes";
+            readonly expect: readonly [200];
+            readonly free: true;
+            readonly note: "Lists the project's indexes; the app sends X-Pinecone-Api-Version itself.";
+        };
+        readonly example: "list my Pinecone indexes and their dimensions";
+        readonly verified: {
+            readonly on: "2026-10-25";
+            readonly how: "docs";
+        };
+        readonly tags: readonly ["vector", "database", "search"];
+    };
+    readonly mapbox: {
+        readonly mode: "api_key";
+        readonly label: "Mapbox";
+        readonly description: "Maps and location: geocoding, directions, styles, tilesets and datasets.";
+        readonly auth: {
+            readonly kind: "query";
+            readonly secret: "MAPBOX_ACCESS_TOKEN";
+            readonly param: "access_token";
+        };
+        readonly docs: "https://console.mapbox.com/account/access-tokens/";
+        readonly api: "https://docs.mapbox.com/api/overview/";
+        readonly hosts: readonly ["api.mapbox.com"];
+        readonly data: "account";
+        readonly access: readonly ["read", "write"];
+        readonly readMethods: readonly ["GET", "HEAD"];
+        readonly writeMethods: readonly ["POST", "PUT", "PATCH", "DELETE"];
+        readonly accountWidePaths: readonly [readonly ["tokens"]];
+        readonly hint: "An access token from Access tokens in the Mapbox console, with only the scopes the app needs; the Gateway adds it to every call as the access_token parameter.";
+        readonly secrets: readonly [{
+            readonly name: "MAPBOX_ACCESS_TOKEN";
+            readonly hint: "An access token with only the scopes the app needs, from Access tokens in the Mapbox console.";
+        }];
+        readonly rate: {
+            readonly note: "Per token and per API: Geocoding 1,000 a minute, Directions 300, Static Images 1,250; the Tokens API 100 a minute per account.";
+        };
+        readonly example: "turn a street address into map coordinates";
+        readonly verified: {
+            readonly on: "2026-10-25";
+            readonly how: "docs";
+        };
+        readonly tags: readonly ["maps", "geocoding", "location"];
+    };
+    readonly openweather: {
+        readonly mode: "api_key";
+        readonly label: "OpenWeather";
+        readonly description: "Weather data: current conditions, forecasts, One Call, history and weather map tiles.";
+        readonly auth: {
+            readonly kind: "query";
+            readonly secret: "OPENWEATHER_API_KEY";
+            readonly param: "appid";
+        };
+        readonly docs: "https://home.openweathermap.org/api_keys";
+        readonly api: "https://openweathermap.org/api";
+        readonly hosts: readonly ["api.openweathermap.org", "pro.openweathermap.org", "history.openweathermap.org", "tile.openweathermap.org", "maps.openweathermap.org"];
+        readonly data: "per-call";
+        readonly access: readonly ["read"];
+        readonly readMethods: readonly ["GET", "HEAD"];
+        readonly accountWidePaths: readonly [readonly ["data", "3", "stations"], readonly ["data", "3", "measurements"]];
+        readonly hint: "An API key from the API keys tab of your OpenWeather account; the Gateway adds it to every call as the appid parameter. Paid products (hourly forecast, history, Weather Maps 2.0) need a plan that includes them.";
+        readonly secrets: readonly [{
+            readonly name: "OPENWEATHER_API_KEY";
+            readonly hint: "An API key from the API keys tab of the OpenWeather account; a new key can take up to two hours to activate.";
+        }];
+        readonly smoke: {
+            readonly method: "GET";
+            readonly host: "api.openweathermap.org";
+            readonly path: "/data/2.5/weather?lat=51.51&lon=-0.13";
+            readonly expect: readonly [200];
+            readonly free: true;
+            readonly note: "Counts one call against the plan's quota; free within it. A bad or not yet active key answers 401.";
+        };
+        readonly cost: {
+            readonly unit: "call";
+            readonly note: "One Call API 3.0 includes 1,000 calls a day free, then is paid per call.";
+        };
+        readonly rate: {
+            readonly perMinute: 60;
+            readonly note: "The Free plan answers 429 past 60 calls a minute.";
+        };
+        readonly example: "get the current weather in Lisbon";
+        readonly verified: {
+            readonly on: "2026-10-25";
+            readonly how: "docs";
+        };
+        readonly tags: readonly ["weather", "forecast"];
+    };
+    readonly daytona: {
+        readonly mode: "api_key";
+        readonly label: "Daytona";
+        readonly description: "Sandboxes for running code: create, start, stop, archive and delete sandboxes, and manage their snapshots and volumes.";
+        readonly auth: {
+            readonly kind: "bearer";
+            readonly secret: "DAYTONA_API_KEY";
+        };
+        readonly docs: "https://www.daytona.io/docs/en/api-keys/";
+        readonly api: "https://www.daytona.io/docs/en/tools/api/";
+        readonly hosts: readonly ["app.daytona.io"];
+        readonly data: "account";
+        readonly access: readonly ["read", "write"];
+        readonly readMethods: readonly ["GET", "HEAD"];
+        readonly writeMethods: readonly ["POST", "PUT", "PATCH", "DELETE"];
+        readonly accountWidePaths: readonly [readonly ["organizations"], readonly ["organization"], readonly ["billing"], readonly ["api-keys"], readonly ["users"], readonly ["audit"], readonly ["webhooks"], readonly ["secret"], readonly ["docker-registry"], readonly ["object-storage"], readonly ["regions"], readonly ["runners"], readonly ["for-runner"], readonly ["jobs"], readonly ["warm-pools"], readonly ["preview"], readonly ["ssh-access", "validate"]];
+        readonly hint: "An API key from the Daytona dashboard's Keys page, with only the permissions the apps need; the Gateway sends it as a bearer token to app.daytona.io. Any key of an organization reaches every running sandbox in it, so give the Gateway a Daytona organization of its own.";
+        readonly secrets: readonly [{
+            readonly name: "DAYTONA_API_KEY";
+            readonly hint: "An API key from the Daytona dashboard's Keys page: write:sandboxes and delete:sandboxes (and the snapshot or volume ones) only if an app needs them, and never manage:api_keys, manage:secrets, manage:billing or the region and runner permissions.";
+        }];
+        readonly smoke: {
+            readonly method: "GET";
+            readonly path: "/api/sandbox";
+            readonly expect: readonly [200];
+            readonly free: true;
+            readonly note: "Lists the organization's sandboxes; any key may read them.";
+        };
+        readonly example: "start a sandbox from my snapshot and stop it when the run is done";
+        readonly verified: {
+            readonly on: "2026-11-01";
+            readonly how: "docs";
+        };
+        readonly tags: readonly ["sandbox", "compute", "hosting"];
+    };
+    readonly postmark: {
+        readonly mode: "api_key";
+        readonly label: "Postmark";
+        readonly description: "Transactional email: single, batch and templated messages from one Postmark server.";
+        readonly auth: {
+            readonly kind: "header";
+            readonly secret: "POSTMARK_API_TOKEN";
+            readonly header: "X-Postmark-Server-Token";
+        };
+        readonly docs: "https://postmarkapp.com/support/article/1008-what-are-the-account-and-server-api-tokens";
+        readonly api: "https://postmarkapp.com/developer/api/overview";
+        readonly hosts: readonly ["api.postmarkapp.com"];
+        readonly data: "account";
+        readonly access: readonly ["write"];
+        readonly readMethods: readonly [];
+        readonly writeMethods: readonly ["POST"];
+        readonly accountWidePaths: readonly [readonly ["server"], readonly ["servers"], readonly ["domains"], readonly ["senders"], readonly ["webhooks"], readonly ["message-streams"], readonly ["triggers"], readonly ["data-removals"]];
+        readonly hint: "A Server API token from the API Tokens tab of the Postmark server the app sends from; the Gateway sends it in the X-Postmark-Server-Token header.";
+        readonly secrets: readonly [{
+            readonly name: "POSTMARK_API_TOKEN";
+            readonly hint: "A Server API token from the server's API Tokens tab, never the Account API token.";
+        }];
+        readonly smoke: {
+            readonly method: "GET";
+            readonly path: "/server";
+            readonly expect: readonly [200];
+            readonly free: true;
+            readonly note: "Returns the server's settings; account-wide, so run it from a terminal.";
+        };
+        readonly example: "send a password reset email";
+        readonly verified: {
+            readonly on: "2026-10-25";
+            readonly how: "docs";
+        };
+        readonly tags: readonly ["email", "transactional"];
+    };
+    readonly sendgrid: {
+        readonly mode: "api_key";
+        readonly label: "SendGrid";
+        readonly description: "Twilio SendGrid email: send transactional and marketing mail through the v3 Mail Send API.";
+        readonly auth: {
+            readonly kind: "bearer";
+            readonly secret: "SENDGRID_API_KEY";
+        };
+        readonly docs: "https://app.sendgrid.com/settings/api_keys";
+        readonly api: "https://www.twilio.com/docs/sendgrid/api-reference";
+        readonly hosts: readonly ["api.sendgrid.com", "api.eu.sendgrid.com"];
+        readonly data: "account";
+        readonly access: readonly ["write"];
+        readonly readMethods: readonly [];
+        readonly writeMethods: readonly ["POST"];
+        readonly accountWidePaths: readonly [readonly ["api_keys"], readonly ["scopes"], readonly ["user"], readonly ["subusers"], readonly ["teammates"], readonly ["sso"], readonly ["access_settings"], readonly ["whitelabel"], readonly ["ips"], readonly ["send_ips"], readonly ["partners"], readonly ["partner_settings"], readonly ["alerts"], readonly ["mail_settings"], readonly ["tracking_settings"], readonly ["verified_senders"], readonly ["senders"], readonly ["marketing", "integrations"], readonly ["recipients", "erasejob"]];
+        readonly hint: "An API key from Settings > API Keys in SendGrid, sent as a bearer token; Custom Access with Mail Send alone is enough to send. EU regional subusers call api.eu.sendgrid.com.";
+        readonly secrets: readonly [{
+            readonly name: "SENDGRID_API_KEY";
+            readonly hint: "A Custom Access key with Mail Send only, never a Full Access key.";
+        }];
+        readonly smoke: {
+            readonly method: "GET";
+            readonly path: "/v3/scopes";
+            readonly expect: readonly [200];
+            readonly free: true;
+            readonly note: "Lists the key's own scopes (the docs don't say whether a Mail-Send-only key may call it); account-wide, so run it from a terminal.";
+        };
+        readonly rate: {
+            readonly note: "Each endpoint has its own limit; answers carry X-RateLimit-Limit, -Remaining and -Reset.";
+        };
+        readonly example: "send an order confirmation email";
+        readonly verified: {
+            readonly on: "2026-10-25";
+            readonly how: "docs";
+        };
+        readonly tags: readonly ["email", "transactional", "marketing"];
+    };
+    readonly twilio: {
+        readonly mode: "api_key";
+        readonly label: "Twilio";
+        readonly description: "SMS, MMS and voice: send text messages and place calls from your Twilio numbers.";
+        readonly auth: {
+            readonly kind: "basic";
+            readonly secret: "TWILIO_API_SECRET";
+            readonly as: "password";
+            readonly user: {
+                readonly secret: "TWILIO_API_KEY";
+            };
+        };
+        readonly docs: "https://www.twilio.com/docs/iam/api-keys/keys-in-console";
+        readonly api: "https://www.twilio.com/docs/usage/requests-to-twilio";
+        readonly hosts: readonly ["api.twilio.com"];
+        readonly data: "account";
+        readonly access: readonly ["write"];
+        readonly readMethods: readonly [];
+        readonly writeMethods: readonly ["POST"];
+        readonly accountWidePaths: readonly [readonly ["keys"], readonly ["signingkeys"], readonly ["incomingphonenumbers"], readonly ["outgoingcallerids"], readonly ["applications"], readonly ["connectapps"], readonly ["authorizedconnectapps"], readonly ["addresses"], readonly ["sip"], readonly ["usage"], readonly ["balance"]];
+        readonly hint: "A Standard or Restricted API key from Account settings > API keys & auth tokens in the Twilio Console, sent as HTTP Basic (the key's SID and secret); a Standard key can't reach the Accounts or Keys resources. Every path names the account, so the app puts its Account SID in it: /2010-04-01/Accounts/<Account SID>/Messages.json, with a form-encoded body.";
+        readonly secrets: readonly [{
+            readonly name: "TWILIO_API_SECRET";
+            readonly hint: "The API key's secret, shown once when the key is created.";
+        }, {
+            readonly name: "TWILIO_API_KEY";
+            readonly hint: "The SID of a Standard or Restricted API key, never a Main key or the Auth Token.";
+        }];
+        readonly example: "text a reminder to a customer's phone number";
+        readonly verified: {
+            readonly on: "2026-10-25";
+            readonly how: "docs";
+        };
+        readonly tags: readonly ["sms", "voice", "messaging"];
+    };
+    readonly intercom: {
+        readonly mode: "api_key";
+        readonly label: "Intercom";
+        readonly description: "Customer messaging: contacts, companies, conversations, tickets and help center articles.";
+        readonly auth: {
+            readonly kind: "bearer";
+            readonly secret: "INTERCOM_API_TOKEN";
+        };
+        readonly docs: "https://app.intercom.com/a/apps/_/developer-hub";
+        readonly api: "https://developers.intercom.com/docs/build-an-integration/learn-more/rest-apis";
+        readonly hosts: readonly ["api.intercom.io", "api.eu.intercom.io", "api.au.intercom.io"];
+        readonly data: "account";
+        readonly access: readonly ["read", "write"];
+        readonly readMethods: readonly ["GET", "HEAD"];
+        readonly writeMethods: readonly ["POST", "PUT", "PATCH", "DELETE"];
+        readonly accountWidePaths: readonly [readonly ["me"], readonly ["admins"], readonly ["teams"], readonly ["export"], readonly ["download"], readonly ["ip_allowlist"]];
+        readonly hint: "The Access Token of a private app in your workspace's Developer Hub, sent as a bearer token. Searching contacts, conversations or tickets is a POST, so an app that searches asks for write.";
+        readonly secrets: readonly [{
+            readonly name: "INTERCOM_API_TOKEN";
+            readonly hint: "The Access Token on your private app's Configure > Authentication page in the Developer Hub.";
+        }];
+        readonly smoke: {
+            readonly method: "GET";
+            readonly path: "/me";
+            readonly expect: readonly [200];
+            readonly free: true;
+            readonly note: "Returns the admin behind the token; account-wide, so run it from a terminal.";
+        };
+        readonly rate: {
+            readonly perMinute: 10000;
+            readonly note: "Per workspace, shared by its private apps; 25,000 a minute across all apps; counted in 10-second windows.";
+        };
+        readonly example: "list the latest open conversations";
+        readonly verified: {
+            readonly on: "2026-10-25";
+            readonly how: "docs";
+        };
+        readonly tags: readonly ["support", "crm", "messaging"];
+    };
+    readonly crisp: {
+        readonly mode: "api_key";
+        readonly label: "Crisp";
+        readonly description: "Customer chat: conversations, messages, people and visitors of one Crisp workspace.";
+        readonly auth: {
+            readonly kind: "basic";
+            readonly secret: "CRISP_API_KEY";
+            readonly as: "password";
+            readonly user: {
+                readonly secret: "CRISP_API_IDENTIFIER";
+            };
+        };
+        readonly docs: "https://docs.crisp.chat/guides/rest-api/authentication/website-token/";
+        readonly api: "https://docs.crisp.chat/references/rest-api/v1/";
+        readonly hosts: readonly ["api.crisp.chat"];
+        readonly data: "account";
+        readonly access: readonly ["read", "write"];
+        readonly readMethods: readonly ["GET", "HEAD"];
+        readonly writeMethods: readonly ["POST", "PUT", "PATCH", "DELETE"];
+        readonly accountWidePaths: readonly [readonly ["operators"], readonly ["operator"], readonly ["teams"], readonly ["team"], readonly ["settings"], readonly ["verify"], readonly ["audit"], readonly ["plans"], readonly ["plugins"], readonly ["plugin"], readonly ["connect"]];
+        readonly hint: "A website token, which the workspace owner generates under Settings > Workspace Settings > Advanced configuration > API Token. The Gateway sends the identifier and key as HTTP Basic; the app sends X-Crisp-Tier: website on every call.";
+        readonly secrets: readonly [{
+            readonly name: "CRISP_API_KEY";
+            readonly hint: "The token's key, shown once when the workspace owner generates it.";
+        }, {
+            readonly name: "CRISP_API_IDENTIFIER";
+            readonly hint: "The token's identifier, shown beside the key.";
+        }];
+        readonly rate: {
+            readonly perDay: 10000;
+            readonly note: "The website token's daily quota.";
+        };
+        readonly example: "list the latest chat conversations on my website";
+        readonly verified: {
+            readonly on: "2026-10-25";
+            readonly how: "docs";
+        };
+        readonly tags: readonly ["support", "chat", "messaging"];
+    };
+    readonly granola: {
+        readonly mode: "api_key";
+        readonly label: "Granola";
+        readonly description: "Meeting notes: list, search and read notes with their AI summaries, transcripts, folders and spaces.";
+        readonly auth: {
+            readonly kind: "bearer";
+            readonly secret: "GRANOLA_API_KEY";
+        };
+        readonly docs: "https://docs.granola.ai/help-center/sharing/integrations/granola-api";
+        readonly api: "https://docs.granola.ai/introduction";
+        readonly hosts: readonly ["public-api.granola.ai"];
+        readonly data: "account";
+        readonly access: readonly ["read"];
+        readonly readMethods: readonly ["GET", "POST"];
+        readonly accountWidePaths: readonly [readonly ["audit"], readonly ["webhook-endpoints"], readonly ["legal-holds"]];
+        readonly hint: "An API key (grn_...) from the Granola desktop app's Settings > Connectors > API keys, on a Business or Enterprise plan; the Gateway sends it as a bearer token. It reads only the notes its scopes allow.";
+        readonly secrets: readonly [{
+            readonly name: "GRANOLA_API_KEY";
+            readonly hint: "A personal or workspace API key (grn_...), with only the note scopes the apps need.";
+        }];
+        readonly rate: {
+            readonly perSecond: 5;
+            readonly note: "Bursts of 25 requests in 5 seconds; per user or per workspace, by the key's scope.";
+        };
+        readonly smoke: {
+            readonly method: "GET";
+            readonly path: "/v1/notes?page_size=1";
+            readonly expect: readonly [200];
+            readonly free: true;
+        };
+        readonly example: "summarize what we decided in this week's customer calls";
+        readonly verified: {
+            readonly on: "2026-10-30";
+            readonly how: "docs";
+        };
+        readonly tags: readonly ["meetings", "notes", "transcripts"];
+    };
+    readonly linear: {
+        readonly mode: "api_key";
+        readonly label: "Linear";
+        readonly description: "Issue tracking over GraphQL: issues, projects, cycles, comments and teams.";
+        readonly auth: {
+            readonly kind: "header";
+            readonly secret: "LINEAR_API_KEY";
+            readonly header: "Authorization";
+        };
+        readonly docs: "https://linear.app/settings/account/security";
+        readonly api: "https://linear.app/developers/graphql";
+        readonly hosts: readonly ["api.linear.app"];
+        readonly data: "account";
+        readonly access: readonly ["write"];
+        readonly readMethods: readonly [];
+        readonly writeMethods: readonly ["POST"];
+        readonly accountWidePaths: readonly [];
+        readonly hint: "A personal API key from Settings > Account > Security & access; the Gateway sends it as the Authorization header with no Bearer word. Every call is a POST to /graphql, queries included, so the app asks for write.";
+        readonly secrets: readonly [{
+            readonly name: "LINEAR_API_KEY";
+            readonly hint: "A personal API key, restricted to the permissions and teams the app needs.";
+        }];
+        readonly rate: {
+            readonly note: "2,500 requests and 3,000,000 complexity points an hour per API key.";
+        };
+        readonly example: "create an issue for this bug in the Engineering team";
+        readonly verified: {
+            readonly on: "2026-10-25";
+            readonly how: "docs";
+        };
+        readonly tags: readonly ["issues", "project-management", "graphql"];
+    };
+    readonly github: {
+        readonly mode: "api_key";
+        readonly label: "GitHub";
+        readonly description: "Code hosting: repositories, issues, pull requests, Actions and releases through the REST API.";
+        readonly auth: {
+            readonly kind: "bearer";
+            readonly secret: "GITHUB_API_TOKEN";
+        };
+        readonly docs: "https://github.com/settings/personal-access-tokens/new";
+        readonly api: "https://docs.github.com/en/rest";
+        readonly hosts: readonly ["api.github.com"];
+        readonly data: "account";
+        readonly access: readonly ["read", "write"];
+        readonly readMethods: readonly ["GET", "HEAD"];
+        readonly writeMethods: readonly ["POST", "PUT", "PATCH", "DELETE"];
+        readonly accountWidePaths: readonly [readonly ["user", "email"], readonly ["user", "emails"], readonly ["user", "public_emails"], readonly ["user", "gpg_keys"], readonly ["user", "ssh_signing_keys"], readonly ["user", "social_accounts"], readonly ["keys"], readonly ["hooks"], readonly ["secrets"], readonly ["members"], readonly ["memberships"], readonly ["invitations"], readonly ["failed_invitations"], readonly ["collaborators"], readonly ["outside_collaborators"], readonly ["blocks"], readonly ["installations"], readonly ["personal-access-tokens"], readonly ["personal-access-token-requests"], readonly ["credential-authorizations"], readonly ["audit-log"], readonly ["billing"]];
+        readonly hint: "A fine-grained personal access token from Settings > Developer settings, limited to one owner, the repositories the app needs and the least permissions; sent as a bearer token. GraphQL is a POST to /graphql, so it needs write.";
+        readonly secrets: readonly [{
+            readonly name: "GITHUB_API_TOKEN";
+            readonly hint: "A fine-grained personal access token limited to the repositories and permissions the app needs.";
+        }];
+        readonly smoke: {
+            readonly method: "GET";
+            readonly path: "/user";
+            readonly expect: readonly [200];
+            readonly free: true;
+            readonly note: "Returns the token's owner; 401 means the token is wrong.";
+        };
+        readonly rate: {
+            readonly note: "5,000 requests an hour per token; at most 100 concurrent requests and 900 points a minute across REST endpoints.";
+        };
+        readonly example: "list the open pull requests in my repository";
+        readonly verified: {
+            readonly on: "2026-10-25";
+            readonly how: "docs";
+        };
+        readonly tags: readonly ["code", "git", "issues"];
+    };
+    readonly gitlab: {
+        readonly mode: "api_key";
+        readonly label: "GitLab";
+        readonly description: "Code hosting on GitLab.com: projects, issues, merge requests, pipelines and releases.";
+        readonly auth: {
+            readonly kind: "header";
+            readonly secret: "GITLAB_API_TOKEN";
+            readonly header: "PRIVATE-TOKEN";
+        };
+        readonly docs: "https://gitlab.com/-/user_settings/personal_access_tokens";
+        readonly api: "https://docs.gitlab.com/api/rest/";
+        readonly hosts: readonly ["gitlab.com"];
+        readonly data: "account";
+        readonly access: readonly ["read", "write"];
+        readonly readMethods: readonly ["GET", "HEAD"];
+        readonly writeMethods: readonly ["POST", "PUT", "PATCH", "DELETE"];
+        readonly accountWidePaths: readonly [readonly ["user"], readonly ["personal_access_tokens"], readonly ["access_tokens"], readonly ["deploy_tokens"], readonly ["deploy_keys"], readonly ["project_deploy_keys"], readonly ["hooks"], readonly ["members"], readonly ["pending_members"], readonly ["billable_members"], readonly ["invitations"], readonly ["variables"], readonly ["audit_events"]];
+        readonly hint: "A personal, project or group access token from GitLab.com, sent in the PRIVATE-TOKEN header; read_api is enough to read. Paths start with /api/v4. A self-managed GitLab needs its own registered provider.";
+        readonly secrets: readonly [{
+            readonly name: "GITLAB_API_TOKEN";
+            readonly hint: "A personal, project or group access token with read_api, or api when the app writes.";
+        }];
+        readonly smoke: {
+            readonly method: "GET";
+            readonly path: "/api/v4/personal_access_tokens/self";
+            readonly expect: readonly [200];
+            readonly free: true;
+            readonly note: "Describes a personal access token itself (401 when it is wrong or revoked); account-wide, so run it from a terminal.";
+        };
+        readonly rate: {
+            readonly perMinute: 2000;
+            readonly note: "Authenticated API traffic per user on GitLab.com.";
+        };
+        readonly example: "list the open merge requests in my project";
+        readonly verified: {
+            readonly on: "2026-10-25";
+            readonly how: "docs";
+        };
+        readonly tags: readonly ["code", "git", "ci"];
+    };
+    readonly vercel: {
+        readonly mode: "api_key";
+        readonly label: "Vercel";
+        readonly description: "Frontend hosting: projects, deployments, domains and logs through the Vercel REST API.";
+        readonly auth: {
+            readonly kind: "bearer";
+            readonly secret: "VERCEL_API_TOKEN";
+        };
+        readonly docs: "https://vercel.com/account/tokens";
+        readonly api: "https://vercel.com/docs/rest-api";
+        readonly hosts: readonly ["api.vercel.com"];
+        readonly data: "account";
+        readonly access: readonly ["read", "write"];
+        readonly readMethods: readonly ["GET", "HEAD"];
+        readonly writeMethods: readonly ["POST", "PUT", "PATCH", "DELETE"];
+        readonly accountWidePaths: readonly [readonly ["user"], readonly ["teams"], readonly ["members"], readonly ["organizations"], readonly ["access-groups"], readonly ["billing"], readonly ["webhooks"], readonly ["drains"], readonly ["env"], readonly ["v3", "events"], readonly ["v1", "events"], readonly ["v1", "integrations"], readonly ["installations"], readonly ["connect"], readonly ["kms"], readonly ["api-keys"], readonly ["ai-gateway"], readonly ["token"], readonly ["tokens"], readonly ["registrar"], readonly ["transfer-request"]];
+        readonly hint: "An access token from your account's Tokens page, sent as a bearer token; scope it to one team or one project. A team- or project-scoped token needs no teamId parameter.";
+        readonly secrets: readonly [{
+            readonly name: "VERCEL_API_TOKEN";
+            readonly hint: "An access token scoped to one team or one project, never Full Account.";
+        }];
+        readonly smoke: {
+            readonly method: "GET";
+            readonly path: "/v10/projects";
+            readonly expect: readonly [200];
+            readonly free: true;
+            readonly note: "Lists the projects the token can reach.";
+        };
+        readonly rate: {
+            readonly note: "Limits are per action (deployments, domains, teams), listed on Vercel's limits page.";
+        };
+        readonly example: "list the latest deployments of my project";
+        readonly verified: {
+            readonly on: "2026-10-25";
+            readonly how: "docs";
+        };
+        readonly tags: readonly ["hosting", "deploy", "frontend"];
+    };
+    readonly stripe: {
+        readonly mode: "api_key";
+        readonly label: "Stripe";
+        readonly description: "Payments: customers, subscriptions, invoices, charges and payouts.";
+        readonly auth: {
+            readonly kind: "bearer";
+            readonly secret: "STRIPE_API_KEY";
+        };
+        readonly docs: "https://dashboard.stripe.com/apikeys";
+        readonly api: "https://docs.stripe.com/api";
+        readonly hosts: readonly ["api.stripe.com", "files.stripe.com"];
+        readonly data: "account";
+        readonly access: readonly ["read", "write"];
+        readonly readMethods: readonly ["GET", "HEAD"];
+        readonly writeMethods: readonly ["POST", "DELETE"];
+        readonly accountWidePaths: readonly [readonly ["v1", "account"], readonly ["v1", "accounts"], readonly ["v2", "core", "accounts"], readonly ["v1", "webhook_endpoints"], readonly ["v2", "core", "event_destinations"], readonly ["v1", "apps", "secrets"]];
+        readonly hint: "A restricted API key from the API keys page of the Stripe dashboard, with only the permissions the app needs. The Gateway sends it as a bearer token.";
+        readonly secrets: readonly [{
+            readonly name: "STRIPE_API_KEY";
+            readonly hint: "A restricted key (rk_live_...) with only the permissions the app needs; a sandbox key (rk_test_... or sk_test_...) to try it.";
+        }];
+        readonly smoke: {
+            readonly method: "GET";
+            readonly path: "/v1/balance";
+            readonly expect: readonly [200];
+            readonly free: true;
+            readonly note: "A restricted key needs Balance read for this one.";
+        };
+        readonly cost: {
+            readonly unit: "call";
+            readonly note: "No per-call price; reads should average under 500 per transaction over 30 days, with at least 10,000 a month allowed.";
+        };
+        readonly rate: {
+            readonly perSecond: 100;
+            readonly note: "Live mode, per account; sandbox 25/s; most single endpoints 25/s; Search 20/s.";
+        };
+        readonly example: "list my latest customers and their subscriptions";
+        readonly verified: {
+            readonly on: "2026-10-25";
+            readonly how: "docs";
+        };
+        readonly tags: readonly ["payments", "billing"];
+    };
+    readonly lemonsqueezy: {
+        readonly mode: "api_key";
+        readonly label: "Lemon Squeezy";
+        readonly description: "Merchant of record for software: stores, products, orders, subscriptions, license keys.";
+        readonly auth: {
+            readonly kind: "bearer";
+            readonly secret: "LEMONSQUEEZY_API_KEY";
+        };
+        readonly docs: "https://app.lemonsqueezy.com/settings/api";
+        readonly api: "https://docs.lemonsqueezy.com/api";
+        readonly hosts: readonly ["api.lemonsqueezy.com"];
+        readonly data: "account";
+        readonly access: readonly ["read", "write"];
+        readonly readMethods: readonly ["GET", "HEAD"];
+        readonly writeMethods: readonly ["POST", "PATCH", "DELETE"];
+        readonly accountWidePaths: readonly [readonly ["v1", "users"], readonly ["v1", "webhooks"]];
+        readonly hint: "An API key from Settings > API in Lemon Squeezy; the Gateway sends it as a bearer token. The API is JSON:API, so the app sends Accept and Content-Type application/vnd.api+json.";
+        readonly secrets: readonly [{
+            readonly name: "LEMONSQUEEZY_API_KEY";
+            readonly hint: "An API key from Settings > API; a test mode key reaches test mode store data only.";
+        }];
+        readonly smoke: {
+            readonly method: "GET";
+            readonly path: "/v1/users/me";
+            readonly expect: readonly [200];
+            readonly free: true;
+            readonly note: "Account-wide, so the Gateway refuses it for apps; run it from the person's terminal.";
+        };
+        readonly rate: {
+            readonly perMinute: 300;
+            readonly note: "300 API calls per minute.";
+        };
+        readonly example: "list this month's orders and active subscriptions";
+        readonly verified: {
+            readonly on: "2026-10-25";
+            readonly how: "docs";
+        };
+        readonly tags: readonly ["payments", "billing"];
+    };
+    readonly paddle: {
+        readonly mode: "api_key";
+        readonly label: "Paddle";
+        readonly description: "Paddle Billing: products, prices, customers, subscriptions and transactions.";
+        readonly auth: {
+            readonly kind: "bearer";
+            readonly secret: "PADDLE_API_KEY";
+        };
+        readonly docs: "https://developer.paddle.com/api-reference/about/authentication/";
+        readonly api: "https://developer.paddle.com/api-reference/";
+        readonly hosts: readonly ["api.paddle.com", "sandbox-api.paddle.com"];
+        readonly data: "account";
+        readonly access: readonly ["read", "write"];
+        readonly readMethods: readonly ["GET", "HEAD"];
+        readonly writeMethods: readonly ["POST", "PATCH", "DELETE"];
+        readonly accountWidePaths: readonly [readonly ["account"], readonly ["settings"], readonly ["notification-settings"], readonly ["notifications"], readonly ["simulations"], readonly ["simulation-runs"], readonly ["client-tokens"], readonly ["checkout-domains"], readonly ["verifications"]];
+        readonly hint: "An API key from Paddle > My account > Settings > Authentication (API keys tab), with only the permissions the app needs; the Gateway sends it as a bearer token. Live and sandbox are separate hosts with separate keys.";
+        readonly secrets: readonly [{
+            readonly name: "PADDLE_API_KEY";
+            readonly hint: "An API key (pdl_live_apikey_... or pdl_sdbx_apikey_...) with only the permissions the app needs; a sandbox key works on the sandbox host only.";
+        }];
+        readonly smoke: {
+            readonly method: "GET";
+            readonly path: "/event-types";
+            readonly expect: readonly [200];
+            readonly free: true;
+            readonly note: "Paddle's own first request: needs no permissions. Send it to sandbox-api.paddle.com with a sandbox key.";
+        };
+        readonly rate: {
+            readonly perMinute: 240;
+            readonly note: "Per IP address; pricing previews 1,000 a minute; 20 immediate-charge updates per subscription an hour.";
+        };
+        readonly example: "list the active subscriptions that renew this week";
+        readonly verified: {
+            readonly on: "2026-10-25";
+            readonly how: "docs";
+        };
+        readonly tags: readonly ["payments", "billing"];
     };
-    /** The only calls the gateway completes; anything else is refused. */
-    token: readonly OAuthTokenEndpoint[];
-    /**
-     * A gateway setting naming the provider's origin, for a provider with no
-     * fixed one (Mastodon's instance): the host of `token` entries without
-     * their own, and of the authorize URL.
-     */
-    hostSetting?: string;
-    /** The origin when `hostSetting` is unset. */
-    defaultOrigin?: string;
-    /** Obtaining and refreshing user tokens with the operator's client writes. */
-    access: readonly ["write"];
-    /** Where the operator registers the client. */
-    console: string;
-    /** The everyapp skill's setup guide for the client, when one exists. */
-    setup?: string;
-    /**
-     * The authorize endpoint the app sends people to (a path on the
-     * `hostSetting` origin when the provider has none fixed) and the scopes
-     * the client must be allowed: the operator's checklist and the docs. With
-     * a `scopePolicy`, the union of its sets' scopes and `alwaysRequested`.
-     */
-    authorize: {
-        url: string;
-        scopes: readonly string[];
+    readonly shopify: {
+        readonly mode: "api_key";
+        readonly label: "Shopify";
+        readonly description: "One store's Admin API (GraphQL): products, orders, customers and inventory.";
+        readonly auth: {
+            readonly kind: "header";
+            readonly secret: "SHOPIFY_API_TOKEN";
+            readonly header: "X-Shopify-Access-Token";
+        };
+        readonly docs: "https://shopify.dev/docs/apps/build/authentication-authorization/legacy/admin-custom-apps";
+        readonly api: "https://shopify.dev/docs/api/admin-graphql";
+        readonly hosts: readonly [];
+        readonly hostSetting: "SHOPIFY_HOST";
+        readonly data: "account";
+        readonly access: readonly ["write"];
+        readonly readMethods: readonly [];
+        readonly writeMethods: readonly ["POST"];
+        readonly accountWidePaths: readonly [readonly ["webhooks"], readonly ["storefront_access_tokens"]];
+        readonly hint: "An Admin API access token from a custom app created in the store's admin, sent in the X-Shopify-Access-Token header to the store's myshopify.com host. Shopify no longer lets stores create new admin custom apps, and Dev Dashboard tokens expire after 24 hours, which the Gateway can't refresh yet.";
+        readonly secrets: readonly [{
+            readonly name: "SHOPIFY_API_TOKEN";
+            readonly hint: "The Admin API access token of a custom app made in the store's admin (Apps > Develop apps > the app > API credentials); it is shown once.";
+        }, {
+            readonly name: "SHOPIFY_HOST";
+            readonly hint: "The store's own host, like your-store.myshopify.com.";
+        }];
+        readonly smoke: {
+            readonly method: "GET";
+            readonly path: "/admin/api/2026-10/shop.json";
+            readonly expect: readonly [200];
+            readonly free: true;
+            readonly note: "The legacy REST read of the store; the Gateway forwards no GET for this entry, so run it from the person's terminal.";
+        };
+        readonly rate: {
+            readonly note: "GraphQL cost points per second by plan: Standard 100, Advanced 200, Plus 1,000, enterprise 2,000.";
+        };
+        readonly example: "list the ten newest orders and what was in them";
+        readonly verified: {
+            readonly on: "2026-10-25";
+            readonly how: "docs";
+        };
+        readonly tags: readonly ["ecommerce"];
+    };
+    readonly plaid: {
+        readonly mode: "api_key";
+        readonly label: "Plaid";
+        readonly description: "Bank data: accounts, balances, transactions and identity, for the Items an app links.";
+        readonly auth: {
+            readonly kind: "header";
+            readonly secret: "PLAID_SECRET";
+            readonly header: "PLAID-SECRET";
+        };
+        readonly docs: "https://dashboard.plaid.com/developers/keys";
+        readonly api: "https://plaid.com/docs/api/";
+        readonly hosts: readonly ["sandbox.plaid.com", "production.plaid.com"];
+        readonly data: "account";
+        readonly access: readonly ["read"];
+        readonly readMethods: readonly ["POST"];
+        readonly accountWidePaths: readonly [readonly ["item", "webhook", "update"], readonly ["item", "access_token", "invalidate"], readonly ["item", "remove"], readonly ["webhook_verification_key"], readonly ["dashboard_user"], readonly ["transfer"], readonly ["payment_initiation"]];
+        readonly hint: "Plaid needs a client_id and a secret on every call, in the JSON body or in the PLAID-CLIENT-ID and PLAID-SECRET headers. The Gateway puts on one header, so the app would have to send PLAID-CLIENT-ID itself. Every endpoint is a POST.";
+        readonly secrets: readonly [{
+            readonly name: "PLAID_SECRET";
+            readonly hint: "The secret for one environment (Sandbox or Production) from the Keys page of the Plaid Dashboard.";
+        }];
+        readonly rate: {
+            readonly note: "Set per endpoint and per Item: /accounts/get allows 15 a minute per Item and 15,000 a minute per client.";
+        };
+        readonly example: "list the last 30 days of transactions on a linked account";
+        readonly verified: false;
+        readonly tags: readonly ["finance", "banking"];
+    };
+    readonly attio: {
+        readonly mode: "api_key";
+        readonly label: "Attio";
+        readonly description: "CRM: people, companies, deals, lists, notes and tasks in one Attio workspace.";
+        readonly auth: {
+            readonly kind: "bearer";
+            readonly secret: "ATTIO_API_KEY";
+        };
+        readonly docs: "https://attio.com/help/reference/apps/generating-an-api-key";
+        readonly api: "https://docs.attio.com/rest-api/overview";
+        readonly hosts: readonly ["api.attio.com"];
+        readonly data: "account";
+        readonly access: readonly ["read", "write"];
+        readonly readMethods: readonly ["GET", "HEAD"];
+        readonly writeMethods: readonly ["POST", "PUT", "PATCH", "DELETE"];
+        readonly accountWidePaths: readonly [readonly ["v2", "self"], readonly ["v2", "webhooks"], readonly ["v2", "workspace_members"]];
+        readonly hint: "An access token a workspace admin makes under Workspace settings > Developers, scoped to what the app needs; the Gateway sends it as a bearer token. Listing and searching records are POSTs, so an app that lists records needs write access.";
+        readonly secrets: readonly [{
+            readonly name: "ATTIO_API_KEY";
+            readonly hint: "An access token from Workspace settings > Developers, with only the scopes the app needs.";
+        }];
+        readonly smoke: {
+            readonly method: "GET";
+            readonly path: "/v2/objects";
+            readonly expect: readonly [200];
+            readonly free: true;
+            readonly note: "Lists the workspace's objects; needs the object_configuration:read scope. /v2/self answers 200 even for a revoked token.";
+        };
+        readonly rate: {
+            readonly perSecond: 100;
+            readonly note: "100 reads and 25 writes per second; listing records and entries also has score-based limits.";
+        };
+        readonly example: "find the companies we added this week and their open deals";
+        readonly verified: {
+            readonly on: "2026-10-25";
+            readonly how: "docs";
+        };
+        readonly tags: readonly ["crm"];
+    };
+    readonly hubspot: {
+        readonly mode: "api_key";
+        readonly label: "HubSpot";
+        readonly description: "CRM and marketing: contacts, companies, deals, tickets and more in one HubSpot account.";
+        readonly auth: {
+            readonly kind: "bearer";
+            readonly secret: "HUBSPOT_API_TOKEN";
+        };
+        readonly docs: "https://developers.hubspot.com/docs/apps/legacy-apps/private-apps/overview";
+        readonly api: "https://developers.hubspot.com/docs/api-reference/latest/overview";
+        readonly hosts: readonly ["api.hubapi.com"];
+        readonly data: "account";
+        readonly access: readonly ["read", "write"];
+        readonly readMethods: readonly ["GET", "HEAD"];
+        readonly writeMethods: readonly ["POST", "PUT", "PATCH", "DELETE"];
+        readonly accountWidePaths: readonly [readonly ["account-info"], readonly ["settings", "users"], readonly ["settings", "v3", "users"], readonly ["settings", "teams"], readonly ["app-webhooks"], readonly ["webhooks"], readonly ["webhooks-journal"], readonly ["oauth"]];
+        readonly hint: "An access token from a HubSpot legacy private app (Development > Legacy apps > Create legacy app > Private), scoped to what the app needs; the Gateway sends it as a bearer token. CRM search is a POST, so an app that searches needs write access.";
+        readonly secrets: readonly [{
+            readonly name: "HUBSPOT_API_TOKEN";
+            readonly hint: "The access token of a legacy private app (Development > Legacy apps > the app > Auth), with only the scopes the app needs.";
+        }];
+        readonly smoke: {
+            readonly method: "GET";
+            readonly path: "/account-info/2026-09/details";
+            readonly expect: readonly [200];
+            readonly free: true;
+            readonly note: "Account-wide, so the Gateway refuses it for apps; run it from the person's terminal.";
+        };
+        readonly rate: {
+            readonly perDay: 250000;
+            readonly note: "Private apps on Free and Starter: 100 per 10 seconds per app and 250,000 a day per account; Pro 190 and 625,000; Enterprise 190 and 1,000,000.";
+        };
+        readonly example: "list the deals that moved to closed won this month";
+        readonly verified: {
+            readonly on: "2026-10-25";
+            readonly how: "docs";
+        };
+        readonly tags: readonly ["crm", "marketing"];
+    };
+    readonly pipedrive: {
+        readonly mode: "api_key";
+        readonly label: "Pipedrive";
+        readonly description: "Sales CRM: deals, persons, organizations, activities and pipelines.";
+        readonly auth: {
+            readonly kind: "header";
+            readonly secret: "PIPEDRIVE_API_TOKEN";
+            readonly header: "x-api-token";
+        };
+        readonly docs: "https://app.pipedrive.com/settings/api";
+        readonly api: "https://developers.pipedrive.com/docs/api/v1";
+        readonly hosts: readonly ["api.pipedrive.com"];
+        readonly data: "account";
+        readonly access: readonly ["read", "write"];
+        readonly readMethods: readonly ["GET", "HEAD"];
+        readonly writeMethods: readonly ["POST", "PUT", "PATCH", "DELETE"];
+        readonly accountWidePaths: readonly [readonly ["v1", "users"], readonly ["v1", "webhooks"], readonly ["v1", "billing"], readonly ["v1", "permissionsets"], readonly ["v1", "roles"], readonly ["v1", "usersettings"], readonly ["v1", "userconnections"], readonly ["v1", "legacyteams"]];
+        readonly hint: "A personal API token from Settings > Personal preferences > API in Pipedrive; the Gateway sends it in the x-api-token header. If API is missing there, an admin enables it for the person's permission set.";
+        readonly secrets: readonly [{
+            readonly name: "PIPEDRIVE_API_TOKEN";
+            readonly hint: "Your personal API token from Settings > Personal preferences > API; it acts as you, and each company you belong to has its own.";
+        }];
+        readonly smoke: {
+            readonly method: "GET";
+            readonly path: "/v1/users/me";
+            readonly expect: readonly [200];
+            readonly free: true;
+            readonly note: "Account-wide, so the Gateway refuses it for apps; run it from the person's terminal.";
+        };
+        readonly cost: {
+            readonly unit: "call";
+            readonly note: "Each endpoint spends API tokens from a daily company budget of 30,000 x plan multiplier (1 to 7) x seats.";
+        };
+        readonly rate: {
+            readonly note: "Per API token: 20 (Lite) to 120 (Ultimate) requests per 2 seconds; Search 10 per 2 seconds.";
+        };
+        readonly example: "list the open deals in my main pipeline";
+        readonly verified: {
+            readonly on: "2026-10-25";
+            readonly how: "docs";
+        };
+        readonly tags: readonly ["crm", "sales"];
+    };
+    readonly airtable: {
+        readonly mode: "api_key";
+        readonly label: "Airtable";
+        readonly description: "Bases, tables and records in the Airtable workspaces a token can reach.";
+        readonly auth: {
+            readonly kind: "bearer";
+            readonly secret: "AIRTABLE_API_TOKEN";
+        };
+        readonly docs: "https://airtable.com/create/tokens";
+        readonly api: "https://airtable.com/developers/web/api/introduction";
+        readonly hosts: readonly ["api.airtable.com"];
+        readonly data: "account";
+        readonly access: readonly ["read", "write"];
+        readonly readMethods: readonly ["GET", "HEAD"];
+        readonly writeMethods: readonly ["POST", "PUT", "PATCH", "DELETE"];
+        readonly accountWidePaths: readonly [readonly ["v0", "meta", "whoami"], readonly ["v0", "meta", "enterpriseaccounts"], readonly ["v0", "meta", "workspaces"], readonly ["v0", "meta", "groups"], readonly ["v0", "bases"], readonly ["scim"], readonly ["collaborators"], readonly ["invites"], readonly ["shares"], readonly ["blockinstallations"]];
+        readonly hint: "A personal access token from airtable.com/create/tokens, limited to the scopes and bases the app needs; the Gateway sends it as a bearer token. Listing records by POST (listRecords) needs write access; the GET form doesn't.";
+        readonly secrets: readonly [{
+            readonly name: "AIRTABLE_API_TOKEN";
+            readonly hint: "A personal access token limited to the scopes and bases the app needs.";
+        }];
+        readonly smoke: {
+            readonly method: "GET";
+            readonly path: "/v0/meta/whoami";
+            readonly expect: readonly [200];
+            readonly free: true;
+            readonly note: "Account-wide, so the Gateway refuses it for apps; run it from the person's terminal.";
+        };
+        readonly rate: {
+            readonly perSecond: 5;
+            readonly note: "5 requests per second per base; 50 per second across all of one user's personal access tokens.";
+        };
+        readonly example: "list this week's new rows in my Leads table";
+        readonly verified: {
+            readonly on: "2026-10-25";
+            readonly how: "docs";
+        };
+        readonly tags: readonly ["database", "spreadsheet"];
+    };
+    readonly notion: {
+        readonly mode: "api_key";
+        readonly label: "Notion";
+        readonly description: "Pages, databases and blocks that a Notion connection has been given.";
+        readonly auth: {
+            readonly kind: "bearer";
+            readonly secret: "NOTION_API_TOKEN";
+        };
+        readonly docs: "https://app.notion.com/developers/connections";
+        readonly api: "https://developers.notion.com/reference/intro";
+        readonly hosts: readonly ["api.notion.com"];
+        readonly data: "account";
+        readonly access: readonly ["read", "write"];
+        readonly readMethods: readonly ["GET", "HEAD"];
+        readonly writeMethods: readonly ["POST", "PATCH", "DELETE"];
+        readonly accountWidePaths: readonly [readonly ["v1", "users"], readonly ["v1", "oauth"], readonly ["admin"]];
+        readonly hint: "An internal connection's API token (a workspace owner creates the connection in Notion's developer portal), sent as a bearer token; it reaches only pages shared with it. The app sends the Notion-Version header itself. Search and data source queries are POSTs, so an app that queries needs write access.";
+        readonly secrets: readonly [{
+            readonly name: "NOTION_API_TOKEN";
+            readonly hint: "The API token on an internal connection's Configuration tab; share the pages it should reach with the connection.";
+        }];
+        readonly smoke: {
+            readonly method: "GET";
+            readonly path: "/v1/users/me";
+            readonly expect: readonly [200];
+            readonly free: true;
+            readonly note: "Send Notion-Version: 2026-03-11 with it; account-wide, so run it from the person's terminal.";
+        };
+        readonly rate: {
+            readonly perMinute: 180;
+            readonly note: "Per connection: 180 a minute, 600 on Business and Enterprise; data source queries about 3 per second.";
+        };
+        readonly example: "find the pages in my Projects database that are due this week";
+        readonly verified: {
+            readonly on: "2026-10-25";
+            readonly how: "docs";
+        };
+        readonly tags: readonly ["docs", "notes", "database"];
     };
-    /**
-     * Named scope sets an app lists in its manifest entry's `scopes`, for a
-     * client several apps share with different needs. Absent: the whole
-     * client is the grant, as for Postiz's social networks.
-     */
-    scopePolicy?: OAuthScopePolicy;
-    /** Hosts the app calls afterwards with the user's token (docs only); a scope policy's routes are on them. */
-    api: readonly string[];
-    /**
-     * The redirect paths the operator registers, on the app's host
-     * (`https://<app>.<APP_BASE_DOMAIN><path>`): Postiz's callback pages, the
-     * first app to use these clients.
-     */
-    redirectPaths: readonly string[];
-}
-export type Capability = ApiKeyCapability | AiProviderCapability | OAuthClientCapability | GatewayServiceCapability;
-export declare const CAPABILITIES: {
     readonly openai: {
         readonly mode: "ai";
         readonly label: "OpenAI";
@@ -417,6 +2418,18 @@ export declare const CAPABILITIES: {
         readonly inferenceRoutes: readonly ["/v1/responses", "/v1/chat/completions", "/v1/embeddings", "/v1/audio/speech", "/v1/audio/transcriptions", "/v1/audio/translations", "/v1/images/generations", "/v1/images/edits", "/v1/images/variations"];
         readonly unstoredRoutes: readonly ["/v1/responses", "/v1/chat/completions"];
         readonly extraRoutes: true;
+        readonly chat: {
+            readonly path: "/v1/chat/completions";
+            readonly seedModel: "gpt-6-luna";
+        };
+        readonly embeddings: {
+            readonly path: "/v1/embeddings";
+            readonly seedModel: "text-embedding-3-small";
+        };
+        readonly aig: {
+            readonly slug: "openai";
+            readonly trim: "/v1";
+        };
         readonly hint: "A secret key from the API keys page; the Gateway puts it on every call as a bearer token.";
         readonly verified: {
             readonly on: "2026-10-25";
@@ -436,7 +2449,24 @@ export declare const CAPABILITIES: {
         readonly setup: "setup/openrouter.md";
         readonly origin: "https://openrouter.ai";
         readonly inferenceRoutes: readonly ["/api/v1/chat/completions", "/api/v1/completions", "/api/v1/responses", "/api/v1/embeddings"];
+        readonly chat: {
+            readonly path: "/api/v1/chat/completions";
+            readonly seedModel: "anthropic/claude-haiku-5.5";
+        };
+        readonly embeddings: {
+            readonly path: "/api/v1/embeddings";
+            readonly seedModel: "openai/text-embedding-3-small";
+        };
+        readonly aig: {
+            readonly slug: "openrouter";
+            readonly trim: "/api";
+        };
         readonly hint: "An API key from OpenRouter's keys page; the Gateway puts it on every call as a bearer token.";
+        readonly cost: {
+            readonly unit: "token";
+            readonly responseField: "usage.cost";
+            readonly note: "The answer's usage.cost is the call's price in USD, per model.";
+        };
         readonly verified: {
             readonly on: "2026-10-25";
             readonly how: "live";
@@ -458,12 +2488,56 @@ export declare const CAPABILITIES: {
         readonly basePath: "/client/v4/accounts/{CLOUDFLARE_ACCOUNT_ID}/ai";
         readonly inferenceRoutes: readonly ["/v1/chat/completions", "/v1/embeddings", "/v1/responses"];
         readonly normalize: "workers-ai";
+        readonly chat: {
+            readonly path: "/v1/chat/completions";
+            readonly seedModel: "@cf/meta/llama-4-scout-17b-16e-instruct";
+        };
+        readonly embeddings: {
+            readonly path: "/v1/embeddings";
+            readonly seedModel: "@cf/baai/bge-m3";
+        };
+        readonly aig: {
+            readonly slug: "workers-ai";
+            readonly header: true;
+        };
         readonly hint: "A Cloudflare API token with Workers AI Read (the Workers AI page's prefilled token); the account is the Gateway's own.";
         readonly verified: {
             readonly on: "2026-10-25";
             readonly how: "live";
         };
     };
+    readonly "ai-gateway": {
+        readonly mode: "ai";
+        readonly kind: "proxy";
+        readonly label: "Cloudflare AI Gateway";
+        readonly description: "Cloudflare's proxy in front of the other AI providers: logs, caching, rate limits and spend, with each provider's own key.";
+        readonly auth: {
+            readonly kind: "header";
+            readonly header: "cf-aig-authorization";
+            readonly prefix: "Bearer ";
+            readonly secret: "AI_GATEWAY_API_KEY";
+        };
+        readonly authOptional: true;
+        readonly docs: "https://dash.cloudflare.com/?to=/:account/ai/ai-gateway";
+        readonly api: "https://developers.cloudflare.com/ai-gateway/";
+        readonly setup: "setup/ai-gateway.md";
+        readonly origin: "https://gateway.ai.cloudflare.com";
+        readonly alsoNeeds: readonly ["CLOUDFLARE_ACCOUNT_ID", "AI_GATEWAY_ID"];
+        readonly basePath: "/v1/{CLOUDFLARE_ACCOUNT_ID}/{AI_GATEWAY_ID}";
+        readonly inferenceRoutes: readonly [];
+        readonly hint: "The gateway's id from the AI Gateway page (everyapp ai gateway on makes one named everyapp); AI_GATEWAY_API_KEY only for an authenticated gateway, sent as cf-aig-authorization.";
+        readonly secrets: readonly [{
+            readonly name: "AI_GATEWAY_ID";
+            readonly hint: "The AI Gateway's id (its name in the dashboard), in the Gateway's own Cloudflare account.";
+        }, {
+            readonly name: "AI_GATEWAY_API_KEY";
+            readonly hint: "An AI Gateway token with Run permission, only when the gateway is authenticated; leave unset for an open gateway.";
+        }];
+        readonly verified: {
+            readonly on: "2026-10-25";
+            readonly how: "docs";
+        };
+    };
     readonly dataforseo: {
         readonly mode: "api_key";
         readonly label: "DataForSEO";
@@ -544,622 +2618,23 @@ export declare const CAPABILITIES: {
         readonly settings: readonly [];
         readonly optionalSettings: readonly [];
     };
-    readonly linkedin: {
-        readonly mode: "oauth_client";
-        readonly label: "LinkedIn";
-        readonly secrets: {
-            readonly clientId: "LINKEDIN_CLIENT_ID";
-            readonly clientSecret: "LINKEDIN_CLIENT_SECRET";
-        };
-        readonly token: readonly [{
-            readonly host: "www.linkedin.com";
-            readonly path: "/oauth/v2/accessToken";
-            readonly methods: readonly ["POST"];
-            readonly inject: "form";
-        }];
-        readonly access: readonly ["write"];
-        readonly console: "https://www.linkedin.com/developers/apps";
-        readonly authorize: {
-            readonly url: "https://www.linkedin.com/oauth/v2/authorization";
-            readonly scopes: readonly ["openid", "profile", "w_member_social", "r_basicprofile", "rw_organization_admin", "w_organization_social", "r_organization_social"];
-        };
-        readonly api: readonly ["api.linkedin.com"];
-        readonly redirectPaths: readonly ["/integrations/social/linkedin", "/integrations/social/linkedin-page"];
-    };
-    readonly facebook: {
-        readonly mode: "oauth_client";
-        readonly label: "Facebook";
-        readonly secrets: {
-            readonly clientId: "FACEBOOK_APP_ID";
-            readonly clientSecret: "FACEBOOK_APP_SECRET";
-        };
-        readonly token: readonly [{
-            readonly host: "graph.facebook.com";
-            readonly path: RegExp;
-            readonly methods: readonly ["GET", "POST"];
-            readonly inject: "query";
-        }];
-        readonly access: readonly ["write"];
-        readonly console: "https://developers.facebook.com/apps";
-        readonly authorize: {
-            readonly url: "https://www.facebook.com/v25.0/dialog/oauth";
-            readonly scopes: readonly ["pages_show_list", "business_management", "pages_manage_posts", "pages_manage_engagement", "pages_read_engagement", "read_insights", "instagram_basic", "instagram_content_publish", "instagram_manage_comments", "instagram_manage_insights"];
-        };
-        readonly api: readonly ["graph.facebook.com", "graph.instagram.com"];
-        readonly redirectPaths: readonly ["/integrations/social/facebook", "/integrations/social/instagram"];
-    };
-    readonly instagram: {
-        readonly mode: "oauth_client";
-        readonly label: "Instagram";
-        readonly secrets: {
-            readonly clientId: "INSTAGRAM_APP_ID";
-            readonly clientSecret: "INSTAGRAM_APP_SECRET";
-        };
-        readonly token: readonly [{
-            readonly host: "api.instagram.com";
-            readonly path: "/oauth/access_token";
-            readonly methods: readonly ["POST"];
-            readonly inject: "form";
-        }, {
-            readonly host: "graph.instagram.com";
-            readonly path: "/access_token";
-            readonly methods: readonly ["GET"];
-            readonly inject: "query";
-        }];
-        readonly access: readonly ["write"];
-        readonly console: "https://developers.facebook.com/apps";
-        readonly authorize: {
-            readonly url: "https://www.instagram.com/oauth/authorize";
-            readonly scopes: readonly ["instagram_business_basic", "instagram_business_content_publish", "instagram_business_manage_comments", "instagram_business_manage_insights"];
-        };
-        readonly api: readonly ["graph.instagram.com"];
-        readonly redirectPaths: readonly ["/integrations/social/instagram-standalone"];
-    };
-    readonly threads: {
-        readonly mode: "oauth_client";
-        readonly label: "Threads";
-        readonly secrets: {
-            readonly clientId: "THREADS_APP_ID";
-            readonly clientSecret: "THREADS_APP_SECRET";
-        };
-        readonly token: readonly [{
-            readonly host: "graph.threads.net";
-            readonly path: "/oauth/access_token";
-            readonly methods: readonly ["GET", "POST"];
-            readonly inject: "query";
-        }, {
-            readonly host: "graph.threads.net";
-            readonly path: "/access_token";
-            readonly methods: readonly ["GET"];
-            readonly inject: "query";
-        }];
-        readonly access: readonly ["write"];
-        readonly console: "https://developers.facebook.com/apps";
-        readonly authorize: {
-            readonly url: "https://threads.net/oauth/authorize";
-            readonly scopes: readonly ["threads_basic", "threads_content_publish", "threads_manage_replies", "threads_manage_insights"];
-        };
-        readonly api: readonly ["graph.threads.net"];
-        readonly redirectPaths: readonly ["/integrations/social/threads"];
-    };
-    readonly youtube: {
-        readonly mode: "oauth_client";
-        readonly label: "YouTube";
-        readonly secrets: {
-            readonly clientId: "YOUTUBE_CLIENT_ID";
-            readonly clientSecret: "YOUTUBE_CLIENT_SECRET";
-        };
-        readonly token: readonly [{
-            readonly host: "oauth2.googleapis.com";
-            readonly path: "/token";
-            readonly methods: readonly ["POST"];
-            readonly inject: "form";
-        }];
-        readonly access: readonly ["write"];
-        readonly console: "https://console.cloud.google.com/apis/credentials";
-        readonly setup: "setup/google.md";
-        readonly authorize: {
-            readonly url: "https://accounts.google.com/o/oauth2/v2/auth";
-            readonly scopes: readonly ["https://www.googleapis.com/auth/userinfo.profile", "https://www.googleapis.com/auth/userinfo.email", "https://www.googleapis.com/auth/youtube", "https://www.googleapis.com/auth/youtube.force-ssl", "https://www.googleapis.com/auth/youtube.readonly", "https://www.googleapis.com/auth/youtube.upload", "https://www.googleapis.com/auth/youtubepartner", "https://www.googleapis.com/auth/yt-analytics.readonly", "https://www.googleapis.com/auth/business.manage"];
-        };
-        readonly api: readonly ["www.googleapis.com", "youtubeanalytics.googleapis.com", "mybusinessaccountmanagement.googleapis.com", "mybusinessbusinessinformation.googleapis.com", "mybusiness.googleapis.com", "businessprofileperformance.googleapis.com"];
-        readonly redirectPaths: readonly ["/integrations/social/youtube", "/integrations/social/gmb"];
-    };
-    readonly tiktok: {
-        readonly mode: "oauth_client";
-        readonly label: "TikTok";
-        readonly secrets: {
-            readonly clientId: "TIKTOK_CLIENT_ID";
-            readonly clientSecret: "TIKTOK_CLIENT_SECRET";
-        };
-        readonly token: readonly [{
-            readonly host: "open.tiktokapis.com";
-            readonly path: "/v2/oauth/token/";
-            readonly methods: readonly ["POST"];
-            readonly inject: "form";
-            readonly params: {
-                readonly clientId: "client_key";
-            };
-        }];
-        readonly access: readonly ["write"];
-        readonly console: "https://developers.tiktok.com/apps";
-        readonly authorize: {
-            readonly url: "https://www.tiktok.com/v2/auth/authorize/";
-            readonly scopes: readonly ["video.list", "user.info.basic", "video.publish", "video.upload", "user.info.profile", "user.info.stats"];
-        };
-        readonly api: readonly ["open.tiktokapis.com"];
-        readonly redirectPaths: readonly ["/integrations/social/tiktok"];
-    };
-    readonly "tiktok-business": {
-        readonly mode: "oauth_client";
-        readonly label: "TikTok Business";
-        readonly secrets: {
-            readonly clientId: "TIKTOK_BUSINESS_CLIENT_ID";
-            readonly clientSecret: "TIKTOK_BUSINESS_CLIENT_SECRET";
-        };
-        readonly token: readonly [{
-            readonly host: "business-api.tiktok.com";
-            readonly path: "/open_api/v1.3/tt_user/oauth2/token/";
-            readonly methods: readonly ["POST"];
-            readonly inject: "json";
-        }, {
-            readonly host: "business-api.tiktok.com";
-            readonly path: "/open_api/v1.3/tt_user/oauth2/refresh_token/";
-            readonly methods: readonly ["POST"];
-            readonly inject: "json";
-        }];
-        readonly access: readonly ["write"];
-        readonly console: "https://business-api.tiktok.com/portal/apps";
-        readonly authorize: {
-            readonly url: "https://www.tiktok.com/v2/auth/authorize/";
-            readonly scopes: readonly ["user.info.basic", "user.info.username", "user.info.stats", "video.list", "video.upload", "video.publish"];
-        };
-        readonly api: readonly ["business-api.tiktok.com"];
-        readonly redirectPaths: readonly ["/integrations/social/tiktok-business/"];
-    };
-    readonly reddit: {
-        readonly mode: "oauth_client";
-        readonly label: "Reddit";
-        readonly secrets: {
-            readonly clientId: "REDDIT_CLIENT_ID";
-            readonly clientSecret: "REDDIT_CLIENT_SECRET";
-        };
-        readonly token: readonly [{
-            readonly host: "www.reddit.com";
-            readonly path: "/api/v1/access_token";
-            readonly methods: readonly ["POST"];
-            readonly inject: "basic";
-        }];
-        readonly access: readonly ["write"];
-        readonly console: "https://www.reddit.com/prefs/apps";
-        readonly authorize: {
-            readonly url: "https://www.reddit.com/api/v1/authorize";
-            readonly scopes: readonly ["read", "identity", "submit", "flair"];
-        };
-        readonly api: readonly ["oauth.reddit.com"];
-        readonly redirectPaths: readonly ["/integrations/social/reddit"];
-    };
-    readonly pinterest: {
-        readonly mode: "oauth_client";
-        readonly label: "Pinterest";
-        readonly secrets: {
-            readonly clientId: "PINTEREST_CLIENT_ID";
-            readonly clientSecret: "PINTEREST_CLIENT_SECRET";
-        };
-        readonly token: readonly [{
-            readonly host: "api.pinterest.com";
-            readonly path: "/v5/oauth/token";
-            readonly methods: readonly ["POST"];
-            readonly inject: "basic";
-        }];
-        readonly access: readonly ["write"];
-        readonly console: "https://developers.pinterest.com/apps/";
-        readonly authorize: {
-            readonly url: "https://www.pinterest.com/oauth/";
-            readonly scopes: readonly ["boards:read", "boards:write", "pins:read", "pins:write", "user_accounts:read"];
-        };
-        readonly api: readonly ["api.pinterest.com"];
-        readonly redirectPaths: readonly ["/integrations/social/pinterest"];
-    };
-    readonly discord: {
-        readonly mode: "oauth_client";
-        readonly label: "Discord";
-        readonly secrets: {
-            readonly clientId: "DISCORD_CLIENT_ID";
-            readonly clientSecret: "DISCORD_CLIENT_SECRET";
-        };
-        readonly token: readonly [{
-            readonly host: "discord.com";
-            readonly path: "/api/oauth2/token";
-            readonly methods: readonly ["POST"];
-            readonly inject: "basic";
-        }];
-        readonly access: readonly ["write"];
-        readonly console: "https://discord.com/developers/applications";
-        readonly authorize: {
-            readonly url: "https://discord.com/oauth2/authorize";
-            readonly scopes: readonly ["bot", "identify", "guilds"];
-        };
-        readonly api: readonly ["discord.com"];
-        readonly redirectPaths: readonly ["/integrations/social/discord"];
-    };
-    readonly slack: {
-        readonly mode: "oauth_client";
-        readonly label: "Slack";
-        readonly secrets: {
-            readonly clientId: "SLACK_CLIENT_ID";
-            readonly clientSecret: "SLACK_CLIENT_SECRET";
-        };
-        readonly token: readonly [{
-            readonly host: "slack.com";
-            readonly path: "/api/oauth.v2.access";
-            readonly methods: readonly ["POST"];
-            readonly inject: "form";
-        }];
-        readonly access: readonly ["write"];
-        readonly console: "https://api.slack.com/apps";
-        readonly setup: "setup/slack.md";
-        readonly authorize: {
-            readonly url: "https://slack.com/oauth/v2/authorize";
-            readonly scopes: readonly ["channels:read", "groups:read", "users:read", "users:read.email", "chat:write", "chat:write.public", "chat:write.customize", "channels:join", "channels:manage", "groups:write", "channels:write.invites", "groups:write.invites", "im:write", "files:write", "channels:write"];
-        };
-        readonly scopePolicy: {
-            readonly dialect: "slack";
-            readonly grantTypes: readonly [null, "refresh_token"];
-            readonly requestScope: "keep";
-            readonly alwaysRequested: readonly [];
-            readonly tolerated: readonly [];
-            readonly deniedSegments: readonly [];
-            readonly sets: {
-                readonly "channels.read": {
-                    readonly label: "Channels (read-only)";
-                    readonly access: "read";
-                    readonly scopes: readonly ["channels:read", "groups:read"];
-                    readonly routes: readonly [{
-                        readonly host: "slack.com";
-                        readonly paths: readonly ["/api/conversations.list", "/api/conversations.info", "/api/conversations.members", "/api/users.conversations"];
-                        readonly posts: readonly [RegExp, RegExp];
-                    }];
-                };
-                readonly "users.read": {
-                    readonly label: "Members (read-only)";
-                    readonly access: "read";
-                    readonly scopes: readonly ["users:read"];
-                    readonly routes: readonly [{
-                        readonly host: "slack.com";
-                        readonly paths: readonly ["/api/users.list", "/api/users.info", "/api/users.getPresence", "/api/bots.info"];
-                        readonly posts: readonly [RegExp, RegExp];
-                    }];
-                };
-                readonly "users.email": {
-                    readonly label: "Members' email addresses (read-only)";
-                    readonly access: "read";
-                    readonly scopes: readonly ["users:read.email"];
-                    readonly routes: readonly [{
-                        readonly host: "slack.com";
-                        readonly paths: readonly ["/api/users.lookupByEmail"];
-                        readonly posts: readonly [RegExp];
-                    }];
-                };
-                readonly "messages.write": {
-                    readonly label: "Messages (post as the app)";
-                    readonly access: "write";
-                    readonly scopes: readonly ["chat:write", "chat:write.public", "chat:write.customize"];
-                    readonly routes: readonly [{
-                        readonly host: "slack.com";
-                        readonly paths: readonly ["/api/chat.scheduledMessages.list"];
-                        readonly posts: readonly [RegExp];
-                    }];
-                };
-                readonly "channels.join": {
-                    readonly label: "Channels (join public ones)";
-                    readonly access: "write";
-                    readonly scopes: readonly ["channels:join"];
-                    readonly routes: readonly [{
-                        readonly host: "slack.com";
-                        readonly paths: readonly [];
-                        readonly posts: readonly [RegExp];
-                    }];
-                };
-                readonly "channels.manage": {
-                    readonly label: "Channels (create, manage and invite to; open DMs)";
-                    readonly access: "write";
-                    readonly scopes: readonly ["channels:manage", "groups:write", "channels:write.invites", "groups:write.invites", "im:write"];
-                    readonly routes: readonly [{
-                        readonly host: "slack.com";
-                        readonly paths: readonly [];
-                        readonly posts: readonly [RegExp];
-                    }];
-                };
-                readonly "files.write": {
-                    readonly label: "Files (upload)";
-                    readonly access: "write";
-                    readonly scopes: readonly ["files:write"];
-                    readonly routes: readonly [{
-                        readonly host: "slack.com";
-                        readonly paths: readonly [];
-                        readonly posts: readonly [RegExp];
-                    }];
-                };
-                readonly "user-channels.manage": {
-                    readonly label: "Channels (as the installing person: read, manage, invite to)";
-                    readonly access: "write";
-                    readonly scopes: readonly [];
-                    readonly userScopes: readonly ["channels:read", "channels:write", "groups:read", "groups:write"];
-                    readonly routes: readonly [{
-                        readonly host: "slack.com";
-                        readonly paths: readonly ["/api/conversations.list", "/api/conversations.info", "/api/conversations.members", "/api/users.conversations"];
-                        readonly posts: readonly [RegExp, RegExp];
-                    }];
-                };
-            };
+    readonly slack: OAuthClientCapability & {
+        secrets: {
+            clientId: "SLACK_CLIENT_ID";
+            clientSecret: "SLACK_CLIENT_SECRET";
         };
-        readonly api: readonly ["slack.com"];
-        readonly redirectPaths: readonly ["/integrations/social/slack", "/integrations/slack/callback"];
     };
-    readonly mastodon: {
-        readonly mode: "oauth_client";
-        readonly label: "Mastodon";
-        readonly secrets: {
-            readonly clientId: "MASTODON_CLIENT_ID";
-            readonly clientSecret: "MASTODON_CLIENT_SECRET";
-        };
-        readonly token: readonly [{
-            readonly path: "/oauth/token";
-            readonly methods: readonly ["POST"];
-            readonly inject: "form";
-        }];
-        readonly hostSetting: "MASTODON_URL";
-        readonly defaultOrigin: "https://mastodon.social";
-        readonly access: readonly ["write"];
-        readonly console: "/settings/applications";
-        readonly authorize: {
-            readonly url: "/oauth/authorize";
-            readonly scopes: readonly ["write:statuses", "profile", "write:media"];
-        };
-        readonly api: readonly [];
-        readonly redirectPaths: readonly ["/integrations/social/mastodon"];
-    };
-    readonly kick: {
-        readonly mode: "oauth_client";
-        readonly label: "Kick";
-        readonly secrets: {
-            readonly clientId: "KICK_CLIENT_ID";
-            readonly clientSecret: "KICK_CLIENT_SECRET";
-        };
-        readonly token: readonly [{
-            readonly host: "id.kick.com";
-            readonly path: "/oauth/token";
-            readonly methods: readonly ["POST"];
-            readonly inject: "form";
-        }];
-        readonly access: readonly ["write"];
-        readonly console: "https://kick.com/settings/developer";
-        readonly authorize: {
-            readonly url: "https://id.kick.com/oauth/authorize";
-            readonly scopes: readonly ["chat:write", "user:read", "channel:read"];
-        };
-        readonly api: readonly ["api.kick.com"];
-        readonly redirectPaths: readonly ["/integrations/social/kick"];
-    };
-    readonly twitch: {
-        readonly mode: "oauth_client";
-        readonly label: "Twitch";
-        readonly secrets: {
-            readonly clientId: "TWITCH_CLIENT_ID";
-            readonly clientSecret: "TWITCH_CLIENT_SECRET";
-        };
-        readonly token: readonly [{
-            readonly host: "id.twitch.tv";
-            readonly path: "/oauth2/token";
-            readonly methods: readonly ["POST"];
-            readonly inject: "form";
-        }];
-        readonly access: readonly ["write"];
-        readonly console: "https://dev.twitch.tv/console/apps";
-        readonly authorize: {
-            readonly url: "https://id.twitch.tv/oauth2/authorize";
-            readonly scopes: readonly ["user:write:chat", "user:read:chat", "moderator:manage:announcements"];
-        };
-        readonly api: readonly ["api.twitch.tv"];
-        readonly redirectPaths: readonly ["/integrations/social/twitch"];
-    };
-    readonly tumblr: {
-        readonly mode: "oauth_client";
-        readonly label: "Tumblr";
-        readonly secrets: {
-            readonly clientId: "TUMBLR_CLIENT_ID";
-            readonly clientSecret: "TUMBLR_CLIENT_SECRET";
-        };
-        readonly token: readonly [{
-            readonly host: "api.tumblr.com";
-            readonly path: "/v2/oauth2/token";
-            readonly methods: readonly ["POST"];
-            readonly inject: "form";
-        }];
-        readonly access: readonly ["write"];
-        readonly console: "https://www.tumblr.com/oauth/apps";
-        readonly authorize: {
-            readonly url: "https://www.tumblr.com/oauth2/authorize";
-            readonly scopes: readonly ["write", "offline_access"];
-        };
-        readonly api: readonly ["api.tumblr.com"];
-        readonly redirectPaths: readonly ["/integrations/social/tumblr"];
-    };
-    readonly dribbble: {
-        readonly mode: "oauth_client";
-        readonly label: "Dribbble";
-        readonly secrets: {
-            readonly clientId: "DRIBBBLE_CLIENT_ID";
-            readonly clientSecret: "DRIBBBLE_CLIENT_SECRET";
-        };
-        readonly token: readonly [{
-            readonly host: "dribbble.com";
-            readonly path: "/oauth/token";
-            readonly methods: readonly ["POST"];
-            readonly inject: "query";
-        }];
-        readonly access: readonly ["write"];
-        readonly console: "https://dribbble.com/account/applications";
-        readonly authorize: {
-            readonly url: "https://dribbble.com/oauth/authorize";
-            readonly scopes: readonly ["public", "upload"];
-        };
-        readonly api: readonly ["api.dribbble.com"];
-        readonly redirectPaths: readonly ["/integrations/social/dribbble"];
-    };
-    readonly "google-workspace": {
-        readonly mode: "oauth_client";
-        readonly label: "Google (Gmail, Calendar, Search Console and Analytics)";
-        readonly secrets: {
-            readonly clientId: "GOOGLE_WORKSPACE_CLIENT_ID";
-            readonly clientSecret: "GOOGLE_WORKSPACE_CLIENT_SECRET";
-        };
-        readonly token: readonly [{
-            readonly host: "oauth2.googleapis.com";
-            readonly path: "/token";
-            readonly methods: readonly ["POST"];
-            readonly inject: "form";
-        }];
-        readonly access: readonly ["write"];
-        readonly console: "https://console.cloud.google.com/apis/credentials";
-        readonly setup: "setup/google.md";
-        readonly authorize: {
-            readonly url: "https://accounts.google.com/o/oauth2/v2/auth";
-            readonly scopes: readonly ["openid", "email", "profile", "https://www.googleapis.com/auth/gmail.readonly", "https://www.googleapis.com/auth/calendar.readonly", "https://www.googleapis.com/auth/webmasters.readonly", "https://www.googleapis.com/auth/analytics.readonly"];
-        };
-        readonly scopePolicy: {
-            readonly dialect: "google";
-            readonly grantTypes: readonly ["authorization_code", "refresh_token"];
-            readonly requestScope: "drop";
-            readonly alwaysRequested: readonly [];
-            readonly tolerated: readonly ["openid", "email", "profile", "https://www.googleapis.com/auth/userinfo.email", "https://www.googleapis.com/auth/userinfo.profile"];
-            readonly deniedSegments: readonly ["batch", "measurementProtocolSecrets"];
-            readonly sets: {
-                readonly identity: {
-                    readonly label: "Google account (who you are)";
-                    readonly access: "read";
-                    readonly scopes: readonly ["openid", "email", "profile"];
-                    readonly routes: readonly [{
-                        readonly host: "openidconnect.googleapis.com";
-                        readonly paths: readonly ["/v1/userinfo"];
-                    }, {
-                        readonly host: "www.googleapis.com";
-                        readonly paths: readonly ["/oauth2/v2/userinfo", "/oauth2/v3/userinfo", "/userinfo/v2/me"];
-                    }];
-                };
-                readonly "gmail.read": {
-                    readonly label: "Gmail (read-only)";
-                    readonly access: "read";
-                    readonly scopes: readonly ["https://www.googleapis.com/auth/gmail.readonly"];
-                    readonly routes: readonly [{
-                        readonly host: "gmail.googleapis.com";
-                        readonly paths: readonly ["/gmail/v1/users/"];
-                        readonly posts: readonly [RegExp];
-                    }];
-                };
-                readonly "calendar.read": {
-                    readonly label: "Google Calendar (read-only)";
-                    readonly access: "read";
-                    readonly scopes: readonly ["https://www.googleapis.com/auth/calendar.readonly"];
-                    readonly routes: readonly [{
-                        readonly host: "www.googleapis.com";
-                        readonly paths: readonly ["/calendar/v3/"];
-                        readonly posts: readonly [RegExp, RegExp, RegExp, RegExp];
-                    }];
-                };
-                readonly "search-console.read": {
-                    readonly label: "Search Console (read-only)";
-                    readonly access: "read";
-                    readonly scopes: readonly ["https://www.googleapis.com/auth/webmasters.readonly"];
-                    readonly routes: readonly [{
-                        readonly host: "www.googleapis.com";
-                        readonly paths: readonly ["/webmasters/v3/"];
-                        readonly posts: readonly [RegExp];
-                    }, {
-                        readonly host: "searchconsole.googleapis.com";
-                        readonly paths: readonly ["/webmasters/v3/"];
-                        readonly posts: readonly [RegExp, RegExp];
-                    }];
-                };
-                readonly "analytics.read": {
-                    readonly label: "Google Analytics (read-only)";
-                    readonly access: "read";
-                    readonly scopes: readonly ["https://www.googleapis.com/auth/analytics.readonly"];
-                    readonly routes: readonly [{
-                        readonly host: "analyticsdata.googleapis.com";
-                        readonly paths: readonly ["/v1beta/properties/"];
-                        readonly posts: readonly [RegExp];
-                    }, {
-                        readonly host: "analyticsadmin.googleapis.com";
-                        readonly paths: readonly ["/v1beta/accountSummaries", "/v1beta/accounts", "/v1beta/accounts/", "/v1beta/properties", "/v1beta/properties/", "/v1alpha/properties/"];
-                    }];
-                };
-            };
+    readonly "google-workspace": OAuthClientCapability & {
+        secrets: {
+            clientId: "GOOGLE_WORKSPACE_CLIENT_ID";
+            clientSecret: "GOOGLE_WORKSPACE_CLIENT_SECRET";
         };
-        readonly api: readonly ["gmail.googleapis.com", "www.googleapis.com", "searchconsole.googleapis.com", "analyticsdata.googleapis.com", "analyticsadmin.googleapis.com", "openidconnect.googleapis.com"];
-        readonly redirectPaths: readonly ["/integrations/google/callback"];
-    };
-    readonly "microsoft-365": {
-        readonly mode: "oauth_client";
-        readonly label: "Microsoft 365 (Outlook mail and calendar)";
-        readonly secrets: {
-            readonly clientId: "MICROSOFT_365_CLIENT_ID";
-            readonly clientSecret: "MICROSOFT_365_CLIENT_SECRET";
-        };
-        readonly token: readonly [{
-            readonly host: "login.microsoftonline.com";
-            readonly path: "/common/oauth2/v2.0/token";
-            readonly methods: readonly ["POST"];
-            readonly inject: "form";
-        }];
-        readonly access: readonly ["write"];
-        readonly console: "https://entra.microsoft.com/#view/Microsoft_AAD_RegisteredApps/ApplicationsListBlade";
-        readonly setup: "setup/microsoft-365.md";
-        readonly authorize: {
-            readonly url: "https://login.microsoftonline.com/common/oauth2/v2.0/authorize";
-            readonly scopes: readonly ["offline_access", "User.Read", "Mail.Read", "Calendars.Read"];
-        };
-        readonly scopePolicy: {
-            readonly dialect: "microsoft";
-            readonly grantTypes: readonly ["authorization_code", "refresh_token"];
-            readonly requestScope: "replace";
-            readonly alwaysRequested: readonly ["offline_access"];
-            readonly tolerated: readonly ["openid", "profile", "email", "offline_access", "User.Read"];
-            readonly deniedSegments: readonly ["$batch", "beta"];
-            readonly sets: {
-                readonly identity: {
-                    readonly label: "Microsoft account (who you are)";
-                    readonly access: "read";
-                    readonly scopes: readonly ["User.Read"];
-                    readonly routes: readonly [{
-                        readonly host: "graph.microsoft.com";
-                        readonly paths: readonly ["/v1.0/me", "/oidc/userinfo"];
-                    }];
-                };
-                readonly "mail.read": {
-                    readonly label: "Outlook mail (read-only)";
-                    readonly access: "read";
-                    readonly scopes: readonly ["Mail.Read"];
-                    readonly routes: readonly [{
-                        readonly host: "graph.microsoft.com";
-                        readonly paths: readonly ["/v1.0/me/messages", "/v1.0/me/messages/", "/v1.0/me/mailFolders", "/v1.0/me/mailFolders/"];
-                    }];
-                };
-                readonly "calendar.read": {
-                    readonly label: "Outlook calendar (read-only)";
-                    readonly access: "read";
-                    readonly scopes: readonly ["Calendars.Read"];
-                    readonly routes: readonly [{
-                        readonly host: "graph.microsoft.com";
-                        readonly paths: readonly ["/v1.0/me/calendar", "/v1.0/me/calendar/", "/v1.0/me/calendars", "/v1.0/me/calendars/", "/v1.0/me/events", "/v1.0/me/events/", "/v1.0/me/calendarView", "/v1.0/me/calendarView/"];
-                        readonly posts: readonly [RegExp];
-                    }];
-                };
-            };
+    };
+    readonly "microsoft-365": OAuthClientCapability & {
+        secrets: {
+            clientId: "MICROSOFT_365_CLIENT_ID";
+            clientSecret: "MICROSOFT_365_CLIENT_SECRET";
         };
-        readonly api: readonly ["graph.microsoft.com"];
-        readonly redirectPaths: readonly ["/integrations/microsoft/callback"];
     };
 };
 export type CapabilityId = keyof typeof CAPABILITIES;
@@ -1172,23 +2647,13 @@ export type ApiKeyCapabilityId = CapabilityIdOf<"api_key">;
 export type AiProviderId = CapabilityIdOf<"ai">;
 /** Capabilities the gateway performs itself, each with its SDK helper. */
 export type ServiceCapabilityId = CapabilityIdOf<"service">;
-/** OAuth clients whose token endpoints apps reach with `integrationFetch()`. */
+/** The built-in OAuth providers whose APIs apps reach with `integrationFetch()`. */
 export type OAuthClientCapabilityId = CapabilityIdOf<"oauth_client">;
-/**
- * The scope set names an OAuth client offers; `never` for a client without
- * a scope policy. Distributes over a union of ids, so a generic over two
- * clients gets every name either offers rather than the names they share.
- */
-export type OAuthScopeSetName<Id extends OAuthClientCapabilityId> = Id extends unknown ? (typeof CAPABILITIES)[Id] extends {
-    scopePolicy: {
-        sets: infer S;
-    };
-} ? keyof S & string : never : never;
 /** The Gateway settings an `auth` block names: the key, and a Basic username held as a setting. */
 type AuthSettingsOf<A> = (A extends {
     secret: infer S extends string;
 } ? S : never) | (A extends {
-    username: {
+    user: {
         secret: infer U extends string;
     };
 } ? U : never);
@@ -1197,10 +2662,8 @@ type SettingsOf<C> = C extends {
     optionalSettings: readonly (infer O extends string)[];
 } ? S | O : C extends {
     secrets: infer S;
-    token: unknown;
-} ? (S[keyof S] & string) | (C extends {
-    hostSetting: infer H extends string;
-} ? H : never) : C extends {
+    flow: unknown;
+} ? S[keyof S] & string : C extends {
     auth: infer A;
 } ? AuthSettingsOf<A> | (C extends {
     alsoNeeds: readonly (infer N extends string)[];
@@ -1281,13 +2744,12 @@ export type IntegrationProxyRoute =
     capability: ApiKeyCapability;
     upstream: URL;
 }
-/** A call to one of an OAuth client's token endpoints, with its rule. */
+/** A call to one of an OAuth provider's API hosts, which goes with the person's held token. */
  | {
     kind: "oauth_client";
     id: string;
     capability: OAuthClientCapability;
     upstream: URL;
-    endpoint: OAuthTokenEndpoint;
 }
 /** A call to one of the routes a service capability declares. */
  | {
@@ -1301,31 +2763,15 @@ export type CapabilitySettings = Readonly<Record<string, unknown>>;
 /**
  * The capability call an AppGateway path names, or null when the path names
  * an unknown capability (or an AI provider, which has its own route), a
- * host outside the provider's, a path that could leave that host, a path
- * that isn't one of an OAuth client's token endpoints, or a route a service
- * capability doesn't declare. `settings` resolves an OAuth client's
- * `hostSetting` (Mastodon's instance); `lookup` is where the id is found,
+ * host outside the provider's, a path that could leave that host, or a
+ * route a service capability doesn't declare. `settings` resolves an API-key provider's
+ * `hostSetting` (a Shopify store's host); `lookup` is where the id is found,
  * the catalog alone by default.
  */
 export declare function parseIntegrationProxyPath(pathname: string, search: string, settings?: CapabilitySettings, lookup?: CapabilityLookup): IntegrationProxyRoute | null;
-/**
- * The origin an OAuth client's `hostSetting` names (its default when the
- * setting is unset), or null for a client with a fixed host or a setting
- * that isn't an https origin. A bare host is taken as https.
- */
-export declare function oauthClientOrigin(capability: OAuthClientCapability, settings: CapabilitySettings | undefined): string | null;
-/**
- * The token endpoint `upstream` is, by its exact host and path (a RegExp
- * for a versioned one), or null. Its method is the caller's to check.
- */
-export declare function tokenEndpointFor(capability: OAuthClientCapability, upstream: URL, settings: CapabilitySettings | undefined): OAuthTokenEndpoint | null;
-/** An OAuth client's token endpoints, as `POST https://host/path` lines for messages. */
-export declare function describeTokenEndpoints(capability: OAuthClientCapability): string;
-/** A token endpoint's path as people read it: a versioned one as `/v<version>/oauth/access_token`. */
-export declare function tokenPathText(path: string | RegExp): string;
 /**
  * The command that gives the gateway `capability`'s client:
- * `pnpm everyapp secret set <ID> <SECRET> [<HOST SETTING>]`.
+ * `pnpm everyapp secret set <ID> <SECRET>`.
  */
 export declare function oauthClientSecretSetCommand(capability: OAuthClientCapability): string;
 /**