npm - @floegence/redevplugin-contracts - Versions diffs - 0.6.7 → 0.6.8 - Mend

@floegence/redevplugin-contracts 0.6.7 → 0.6.8

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (4) hide show

package/dist/contracts.gen.d.ts CHANGED Viewed

@@ -134,8 +134,8 @@ export declare const generatedContractArtifacts: readonly [{
     readonly id: "plugin-platform-openapi";
     readonly path: "spec/openapi/plugin-platform-v8.yaml";
     readonly version: "plugin-platform-v8";
-    readonly sha256: "290883ff79b74badbf9f6feddb4dfbef820a4ef4622a7e3fca815e3abb2c4eac";
-    readonly body: "openapi: 3.1.0\ninfo:\n  title: ReDevPlugin Plugin Platform API\n  version: plugin-platform-v8\n  description: Host-agnostic plugin management, bridge, operation, data, and sandbox routes. Release-ref install and update routes resolve host-controlled package artifacts server-side and do not accept requested trust_state values; local-import package install/update routes are explicit developer/import flows and also do not accept caller-supplied trust_state values.\nx-redevplugin-query-policy:\n  reject_url_query_strings: true\n  require_closed_json_bodies: true\n  require_exact_origin: true\n  require_csrf: true\npaths:\n  /_redevplugin/api/plugins/{plugin_instance_id}/local-import:\n    post:\n      operationId: importLocalPackage\n      x-redevplugin-route-effect: mutation\n      parameters:\n        - $ref: \"#/components/parameters/PluginInstanceID\"\n      requestBody:\n        required: true\n        content:\n          application/vnd.redevplugin.package+zip:\n            schema: { type: string, format: binary }\n      responses:\n        \"200\": { $ref: \"#/components/responses/PluginRecordResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n    put:\n      operationId: updateLocalPackage\n      x-redevplugin-route-effect: mutation\n      parameters:\n        - $ref: \"#/components/parameters/PluginInstanceID\"\n        - name: X-ReDevPlugin-Expected-Management-Revision\n          in: header\n          required: true\n          description: Canonical decimal management revision. Duplicate, combined, empty, or whitespace-padded values are rejected.\n          schema: { type: integer, minimum: 1, maximum: 9007199254740991 }\n      requestBody:\n        required: true\n        content:\n          application/vnd.redevplugin.package+zip:\n            schema: { type: string, format: binary }\n      responses:\n        \"200\": { $ref: \"#/components/responses/PluginRecordResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/install-release-ref:\n    post:\n      operationId: installReleaseRef\n      x-redevplugin-route-effect: mutation\n      requestBody:\n        $ref: \"#/components/requestBodies/InstallReleaseRefRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/PluginRecordResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/enable:\n    post:\n      operationId: enablePlugin\n      x-redevplugin-route-effect: mutation\n      requestBody:\n        $ref: \"#/components/requestBodies/EnableRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/PluginRecordResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/disable:\n    post:\n      operationId: disablePlugin\n      x-redevplugin-route-effect: mutation\n      requestBody:\n        $ref: \"#/components/requestBodies/DisableRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/PluginRecordResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/uninstall:\n    post:\n      operationId: uninstallPlugin\n      x-redevplugin-route-effect: mutation\n      requestBody:\n        $ref: \"#/components/requestBodies/UninstallRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/PluginRecordResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/update-release-ref:\n    post:\n      operationId: updateReleaseRef\n      x-redevplugin-route-effect: mutation\n      requestBody:\n        $ref: \"#/components/requestBodies/UpdateReleaseRefRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/PluginRecordResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/downgrade:\n    post:\n      operationId: downgradePlugin\n      x-redevplugin-route-effect: mutation\n      requestBody:\n        $ref: \"#/components/requestBodies/DowngradeRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/PluginRecordResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/catalog/query:\n    post:\n      operationId: listPlugins\n      x-redevplugin-route-effect: query\n      requestBody:\n        $ref: \"#/components/requestBodies/EmptyQueryRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/PluginCatalogResponse\" }\n        default: { $ref: \"#/components/responses/PlatformErrorResponse\" }\n  /_redevplugin/api/plugins/features/query:\n    post:\n      operationId: getPluginFeatures\n      x-redevplugin-route-effect: query\n      requestBody:\n        $ref: \"#/components/requestBodies/EmptyQueryRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/PluginFeaturesResponse\" }\n        default: { $ref: \"#/components/responses/PlatformErrorResponse\" }\n  /_redevplugin/api/plugins/platform/compatibility/query:\n    post:\n      operationId: getPluginPlatformCompatibility\n      x-redevplugin-route-effect: query\n      description: Returns the host-consumable ReDevPlugin compatibility manifest for the mounted platform artifact set.\n      requestBody:\n        $ref: \"#/components/requestBodies/EmptyQueryRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/CompatibilityResponse\" }\n        default: { $ref: \"#/components/responses/PlatformErrorResponse\" }\n  /_redevplugin/api/plugins/surfaces/open:\n    post:\n      operationId: openPluginSurface\n      x-redevplugin-route-effect: mutation\n      requestBody:\n        $ref: \"#/components/requestBodies/OpenSurfaceRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/SurfaceBootstrapResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/session/revoke-scope:\n    post:\n      operationId: revokePluginSessionScope\n      x-redevplugin-route-effect: mutation\n      description: Irreversibly fences the authenticated session, drains every exact-session platform and runtime resource, and returns only public cumulative counts.\n      requestBody:\n        $ref: \"#/components/requestBodies/RevokeSessionScopeRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/SessionScopeRevokeResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/surfaces/{surface_instance_id}/prepare:\n    post:\n      operationId: preparePluginSurface\n      x-redevplugin-route-effect: mutation\n      parameters:\n        - $ref: \"#/components/parameters/SurfaceInstanceID\"\n      requestBody:\n        $ref: \"#/components/requestBodies/PrepareSurfaceRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/SurfacePreparationResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/surfaces/{surface_instance_id}/bridge-token:\n    post:\n      operationId: createSurfaceBridgeToken\n      x-redevplugin-route-effect: mutation\n      parameters:\n        - $ref: \"#/components/parameters/SurfaceInstanceID\"\n      requestBody:\n        $ref: \"#/components/requestBodies/TrustedParentBridgeTokenRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/BridgeTokenResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/surfaces/{surface_instance_id}/assets/read:\n    post:\n      operationId: readPreparedSurfaceAsset\n      x-redevplugin-route-effect: query\n      parameters:\n        - $ref: \"#/components/parameters/SurfaceInstanceID\"\n      requestBody:\n        $ref: \"#/components/requestBodies/ReadSurfaceAssetRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/SurfaceAssetResponse\" }\n        default: { $ref: \"#/components/responses/PlatformErrorResponse\" }\n  /_redevplugin/api/plugins/surfaces/{surface_instance_id}/streams/read:\n    post:\n      operationId: readPreparedSurfaceStream\n      x-redevplugin-route-effect: query\n      parameters:\n        - $ref: \"#/components/parameters/SurfaceInstanceID\"\n      requestBody:\n        $ref: \"#/components/requestBodies/ReadSurfaceStreamRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/SurfaceStreamResponse\" }\n        default: { $ref: \"#/components/responses/PlatformErrorResponse\" }\n  /_redevplugin/api/plugins/surfaces/{surface_instance_id}/streams/ack:\n    post:\n      operationId: acknowledgePreparedSurfaceStream\n      x-redevplugin-route-effect: mutation\n      parameters:\n        - $ref: \"#/components/parameters/SurfaceInstanceID\"\n      requestBody:\n        $ref: \"#/components/requestBodies/AcknowledgeSurfaceStreamRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/SurfaceStreamAcknowledgementResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/surfaces/{surface_instance_id}/operations/cancel:\n    post:\n      operationId: cancelSurfacePluginOperation\n      x-redevplugin-route-effect: mutation\n      description: Cancels an operation only when it belongs to the authenticated surface, session, and private bridge channel.\n      parameters:\n        - $ref: \"#/components/parameters/SurfaceInstanceID\"\n      requestBody:\n        $ref: \"#/components/requestBodies/CancelSurfaceOperationRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/OperationRecordResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/surfaces/{surface_instance_id}/confirmations/reject:\n    post:\n      operationId: rejectSurfacePluginConfirmation\n      x-redevplugin-route-effect: mutation\n      description: Atomically rejects a pending confirmation only when it belongs to the authenticated surface, session, current plugin revision, and private bridge channel.\n      parameters:\n        - $ref: \"#/components/parameters/SurfaceInstanceID\"\n      requestBody:\n        $ref: \"#/components/requestBodies/RejectSurfaceConfirmationRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/ConfirmationRejectionResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/surfaces/{surface_instance_id}/dispose:\n    post:\n      operationId: disposePluginSurface\n      x-redevplugin-route-effect: mutation\n      parameters:\n        - $ref: \"#/components/parameters/SurfaceInstanceID\"\n      requestBody:\n        $ref: \"#/components/requestBodies/DisposeSurfaceRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/SurfaceDisposeResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/rpc:\n    post:\n      operationId: callPluginMethod\n      x-redevplugin-route-effect: mutation\n      requestBody:\n        $ref: \"#/components/requestBodies/RPCRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/RPCResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/confirmations/prepare:\n    post:\n      operationId: preparePluginMethodConfirmation\n      x-redevplugin-route-effect: mutation\n      requestBody:\n        $ref: \"#/components/requestBodies/PrepareMethodConfirmationRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/PluginMethodConfirmationPreparationResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/intents/query:\n    post:\n      operationId: listPluginIntents\n      x-redevplugin-route-effect: query\n      description: 'Lists enabled, runnable plugin intents available to host-mediated interop. The response data is `{ \"intents\": [...] }`.'\n      requestBody:\n        $ref: \"#/components/requestBodies/ListIntentsQueryRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/IntentListResponse\" }\n        default: { $ref: \"#/components/responses/PlatformErrorResponse\" }\n  /_redevplugin/api/plugins/intents/invoke:\n    post:\n      operationId: invokePluginIntent\n      x-redevplugin-route-effect: mutation\n      description: Invokes a host-mediated plugin intent without iframe gateway tokens while preserving local policy, permission grants, and dangerous-method fail-closed checks.\n      requestBody:\n        $ref: \"#/components/requestBodies/InvokeIntentRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/RPCResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/operations/query:\n    post:\n      operationId: listPluginOperations\n      x-redevplugin-route-effect: query\n      requestBody:\n        $ref: \"#/components/requestBodies/ListOperationsQueryRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/OperationListResponse\" }\n        default: { $ref: \"#/components/responses/PlatformErrorResponse\" }\n  /_redevplugin/api/plugins/operations/{operation_id}/query:\n    post:\n      operationId: getPluginOperation\n      x-redevplugin-route-effect: query\n      parameters:\n        - $ref: \"#/components/parameters/OperationID\"\n      requestBody:\n        $ref: \"#/components/requestBodies/EmptyQueryRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/OperationRecordResponse\" }\n        default: { $ref: \"#/components/responses/PlatformErrorResponse\" }\n  /_redevplugin/api/plugins/operations/{operation_id}/cancel:\n    post:\n      operationId: cancelPluginOperation\n      x-redevplugin-route-effect: mutation\n      parameters:\n        - $ref: \"#/components/parameters/OperationID\"\n      requestBody:\n        $ref: \"#/components/requestBodies/CancelOperationRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/OperationRecordResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/runtime/start:\n    post:\n      operationId: startPluginRuntime\n      x-redevplugin-route-effect: mutation\n      requestBody:\n        $ref: \"#/components/requestBodies/StartRuntimeRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/RuntimeHealthResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/runtime/stop:\n    post:\n      operationId: stopPluginRuntime\n      x-redevplugin-route-effect: mutation\n      requestBody:\n        $ref: \"#/components/requestBodies/EmptyRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/RuntimeStopResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/runtime/refresh-enabled:\n    post:\n      operationId: refreshEnabledPluginRuntimeState\n      x-redevplugin-route-effect: mutation\n      description: 'Replays runtime-derived state for enabled plugins after the embedding host process restarts or reattaches adapters. The response data is `{ \"results\": [...] }`.'\n      requestBody:\n        $ref: \"#/components/requestBodies/EmptyRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/RuntimeRefreshResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/runtime/health/query:\n    post:\n      operationId: getPluginRuntimeHealth\n      x-redevplugin-route-effect: query\n      requestBody:\n        $ref: \"#/components/requestBodies/EmptyQueryRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/RuntimeHealthResponse\" }\n        default: { $ref: \"#/components/responses/PlatformErrorResponse\" }\n  /_redevplugin/api/plugins/data/export:\n    post:\n      operationId: exportPluginData\n      x-redevplugin-route-effect: mutation\n      requestBody:\n        $ref: \"#/components/requestBodies/ExportDataRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/DataExportResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/data/export/delete:\n    post:\n      operationId: deletePluginDataExport\n      x-redevplugin-route-effect: mutation\n      requestBody:\n        $ref: \"#/components/requestBodies/DeleteDataExportRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/DataExportDeleteResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/data/import:\n    post:\n      operationId: importPluginData\n      x-redevplugin-route-effect: mutation\n      requestBody:\n        $ref: \"#/components/requestBodies/ImportDataRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/DataImportResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/retained-data/query:\n    post:\n      operationId: listPluginRetainedData\n      x-redevplugin-route-effect: query\n      requestBody:\n        $ref: \"#/components/requestBodies/ListRetainedDataQueryRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/RetainedDataListResponse\" }\n        default: { $ref: \"#/components/responses/PlatformErrorResponse\" }\n  /_redevplugin/api/plugins/retained-data/delete:\n    post:\n      operationId: deletePluginRetainedData\n      x-redevplugin-route-effect: mutation\n      requestBody:\n        $ref: \"#/components/requestBodies/DeleteRetainedDataRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/RetainedDataBindingResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/retained-data/bind:\n    post:\n      operationId: bindPluginRetainedData\n      x-redevplugin-route-effect: mutation\n      requestBody:\n        $ref: \"#/components/requestBodies/BindRetainedDataRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/RetainedDataBindingResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/retained-data/cleanup-expired:\n    post:\n      operationId: cleanupExpiredPluginRetainedData\n      x-redevplugin-route-effect: mutation\n      requestBody:\n        $ref: \"#/components/requestBodies/CleanupExpiredRetainedDataRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/RetainedDataCleanupResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/permissions/query:\n    post:\n      operationId: listPluginPermissionGrants\n      x-redevplugin-route-effect: query\n      requestBody:\n        $ref: \"#/components/requestBodies/ListPermissionsQueryRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/PermissionListResponse\" }\n        default: { $ref: \"#/components/responses/PlatformErrorResponse\" }\n  /_redevplugin/api/plugins/permissions/grant:\n    post:\n      operationId: grantPluginPermission\n      x-redevplugin-route-effect: mutation\n      requestBody:\n        $ref: \"#/components/requestBodies/GrantPermissionRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/PermissionMutationResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/permissions/revoke:\n    post:\n      operationId: revokePluginPermission\n      x-redevplugin-route-effect: mutation\n      requestBody:\n        $ref: \"#/components/requestBodies/RevokePermissionRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/PermissionMutationResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/security-policies/query:\n    post:\n      operationId: listPluginSecurityPolicies\n      x-redevplugin-route-effect: query\n      requestBody:\n        $ref: \"#/components/requestBodies/EmptyQueryRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/SecurityPolicyListResponse\" }\n        default: { $ref: \"#/components/responses/PlatformErrorResponse\" }\n  /_redevplugin/api/plugins/security-policies/{plugin_instance_id}/query:\n    post:\n      operationId: getPluginSecurityPolicy\n      x-redevplugin-route-effect: query\n      parameters:\n        - $ref: \"#/components/parameters/PluginInstanceID\"\n      requestBody:\n        $ref: \"#/components/requestBodies/EmptyQueryRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/SecurityPolicyRecordResponse\" }\n        default: { $ref: \"#/components/responses/PlatformErrorResponse\" }\n  /_redevplugin/api/plugins/security-policies/{plugin_instance_id}:\n    put:\n      operationId: putPluginSecurityPolicy\n      x-redevplugin-route-effect: mutation\n      parameters:\n        - $ref: \"#/components/parameters/PluginInstanceID\"\n      requestBody:\n        $ref: \"#/components/requestBodies/PutSecurityPolicyRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/SecurityPolicyRecordResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n    delete:\n      operationId: deletePluginSecurityPolicy\n      x-redevplugin-route-effect: mutation\n      parameters:\n        - $ref: \"#/components/parameters/PluginInstanceID\"\n      requestBody:\n        $ref: \"#/components/requestBodies/DeleteSecurityPolicyRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/SecurityPolicyDeleteResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/diagnostics/query:\n    post:\n      operationId: listPluginDiagnosticEvents\n      x-redevplugin-route-effect: query\n      requestBody:\n        $ref: \"#/components/requestBodies/ListDiagnosticsQueryRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/DiagnosticEventListResponse\" }\n        default: { $ref: \"#/components/responses/PlatformErrorResponse\" }\n  /_redevplugin/api/plugins/secrets/bind:\n    post:\n      operationId: bindPluginSecret\n      x-redevplugin-route-effect: mutation\n      requestBody:\n        $ref: \"#/components/requestBodies/SecretRefRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/SecretBindResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/secrets/test:\n    post:\n      operationId: testPluginSecret\n      x-redevplugin-route-effect: mutation\n      requestBody:\n        $ref: \"#/components/requestBodies/SecretRefRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/SecretTestResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/secrets/delete:\n    post:\n      operationId: deletePluginSecret\n      x-redevplugin-route-effect: mutation\n      requestBody:\n        $ref: \"#/components/requestBodies/SecretRefRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/SecretDeleteResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/{plugin_instance_id}/settings/schema/query:\n    post:\n      operationId: getPluginSettingsSchema\n      x-redevplugin-route-effect: query\n      parameters:\n        - $ref: \"#/components/parameters/PluginInstanceID\"\n      requestBody:\n        $ref: \"#/components/requestBodies/SettingsQueryRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/SettingsSchemaResponse\" }\n        default: { $ref: \"#/components/responses/PlatformErrorResponse\" }\n  /_redevplugin/api/plugins/{plugin_instance_id}/settings/query:\n    post:\n      operationId: getPluginSettings\n      x-redevplugin-route-effect: query\n      parameters:\n        - $ref: \"#/components/parameters/PluginInstanceID\"\n      requestBody:\n        $ref: \"#/components/requestBodies/SettingsQueryRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/SettingsSnapshotResponse\" }\n        default: { $ref: \"#/components/responses/PlatformErrorResponse\" }\n  /_redevplugin/api/plugins/{plugin_instance_id}/settings:\n    patch:\n      operationId: patchPluginSettings\n      x-redevplugin-route-effect: mutation\n      parameters:\n        - $ref: \"#/components/parameters/PluginInstanceID\"\n      requestBody:\n        $ref: \"#/components/requestBodies/PatchSettingsRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/SettingsSnapshotResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\ncomponents:\n  parameters:\n    OperationID:\n      name: operation_id\n      in: path\n      required: true\n      schema: { type: string }\n    PluginInstanceID:\n      name: plugin_instance_id\n      in: path\n      required: true\n      schema: { type: string }\n    SurfaceInstanceID:\n      name: surface_instance_id\n      in: path\n      required: true\n      schema: { type: string }\n  responses:\n    PlatformErrorResponse:\n      description: Closed non-success response for read-only platform operations.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/PlatformErrorResponse\"\n    MutationPlatformErrorResponse:\n      description: Closed non-success response for operations that may change durable platform state.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/MutationPlatformErrorResponse\"\n    RPCResponse:\n      description: Typed plugin method result. Subscriptions always bind one operation and one stream.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/RPCSuccessResponse\"\n    SurfaceBootstrapResponse:\n      description: Trusted-parent surface bootstrap. Capability-bearing fields are never forwarded into the opaque iframe or plugin worker.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/SurfaceBootstrapSuccessResponse\"\n    SurfacePreparationResponse:\n      description: Trusted-parent asset-session exchange and validated opaque surface document.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/SurfacePreparationSuccessResponse\"\n    BridgeTokenResponse:\n      description: Trusted-parent plugin gateway token response.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/BridgeTokenSuccessResponse\"\n    SurfaceAssetResponse:\n      description: Trusted-parent package asset response. The plugin receives only a renderer-created blob URL.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/SurfaceAssetSuccessResponse\"\n    SurfaceStreamResponse:\n      description: Trusted-parent stream redemption response. Stream tickets remain outside the plugin worker.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/SurfaceStreamSuccessResponse\"\n    SurfaceStreamAcknowledgementResponse:\n      description: Confirms one exact stream delivery so the platform may release its events.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/SurfaceStreamAcknowledgementSuccessResponse\"\n    SurfaceDisposeResponse:\n      description: Surface revocation response.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/SurfaceDisposeSuccessResponse\"\n    SessionScopeRevokeResponse:\n      description: Completed authenticated-session teardown response.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/SessionScopeRevokeSuccessResponse\"\n    PluginRecordResponse:\n      description: Plugin lifecycle response with typed registry trust assessment.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/PluginRecordSuccessResponse\"\n    PluginCatalogResponse:\n      description: Installed plugin catalog response with typed registry records.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/PluginCatalogSuccessResponse\"\n    PluginFeaturesResponse:\n      description: Closed set of optional host modules configured for this platform.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/PluginFeaturesSuccessResponse\"\n    CompatibilityResponse:\n      description: Released platform compatibility manifest.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/CompatibilitySuccessResponse\"\n    PluginMethodConfirmationPreparationResponse:\n      description: Prepared plugin method confirmation. The raw confirmation token stays server-side and is never returned to parent JavaScript or the plugin iframe.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/PluginMethodConfirmationPreparationSuccessResponse\"\n    ConfirmationRejectionResponse:\n      description: Trusted-parent acknowledgement that the pending confirmation was atomically rejected and cannot be replayed.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/ConfirmationRejectionSuccessResponse\"\n    IntentListResponse:\n      description: Enabled plugin intent records.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/IntentListSuccessResponse\"\n    RetainedDataListResponse:\n      description: Retained plugin data list response.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/RetainedDataListSuccessResponse\"\n    RetainedDataBindingResponse:\n      description: Plugin data binding returned after a retained-data mutation.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/RetainedDataBindingSuccessResponse\"\n    RetainedDataCleanupResponse:\n      description: Retained plugin data cleanup response.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/RetainedDataCleanupSuccessResponse\"\n    OperationRecordResponse:\n      description: Host-owned operation record with its immutable execution binding.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/OperationRecordSuccessResponse\"\n    OperationListResponse:\n      description: Host-owned operation records with immutable execution bindings.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/OperationListSuccessResponse\"\n    RuntimeHealthResponse:\n      description: Runtime manager and shard health.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/RuntimeHealthSuccessResponse\"\n    RuntimeStopResponse:\n      description: Runtime manager stop acknowledgement.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/RuntimeStopSuccessResponse\"\n    RuntimeRefreshResponse:\n      description: Enabled plugin runtime refresh result.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/RuntimeRefreshSuccessResponse\"\n    DataExportResponse:\n      description: Plugin data export result.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/DataExportSuccessResponse\"\n    DataExportDeleteResponse:\n      description: Immutable plugin data export deletion acknowledgement.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/DataExportDeleteSuccessResponse\"\n    DataImportResponse:\n      description: Plugin record after the imported dataset becomes active.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/PluginRecordSuccessResponse\"\n    PermissionListResponse:\n      description: Permission grants for the requested plugin scope.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/PermissionListSuccessResponse\"\n    PermissionMutationResponse:\n      description: Permission grant mutation result.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/PermissionMutationSuccessResponse\"\n    SecurityPolicyListResponse:\n      description: Complete list of configured plugin security policies.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/SecurityPolicyListSuccessResponse\"\n    SecurityPolicyRecordResponse:\n      description: Complete security policy for one plugin instance.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/SecurityPolicyRecordSuccessResponse\"\n    SecurityPolicyDeleteResponse:\n      description: Security policy deletion acknowledgement.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/SecurityPolicyDeleteSuccessResponse\"\n    DiagnosticEventListResponse:\n      description: Diagnostic events matching the requested filters.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/DiagnosticEventListSuccessResponse\"\n    SecretBindResponse:\n      description: Secret reference bind acknowledgement.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/SecretBindSuccessResponse\"\n    SecretTestResponse:\n      description: Secret reference test acknowledgement.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/SecretTestSuccessResponse\"\n    SecretDeleteResponse:\n      description: Secret reference deletion acknowledgement.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/SecretDeleteSuccessResponse\"\n    SettingsSchemaResponse:\n      description: Plugin settings schema.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/SettingsSchemaSuccessResponse\"\n    SettingsSnapshotResponse:\n      description: Plugin settings snapshot.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/SettingsSnapshotSuccessResponse\"\n  requestBodies:\n    InstallReleaseRefRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/InstallReleaseRefRequest\"\n    UpdateReleaseRefRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/UpdateReleaseRefRequest\"\n    DowngradeRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/DowngradeRequest\"\n    EnableRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/EnableRequest\"\n    DisableRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/DisableRequest\"\n    UninstallRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/UninstallRequest\"\n    OpenSurfaceRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/OpenSurfaceRequest\"\n    RevokeSessionScopeRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/RevokeSessionScopeRequest\"\n    EmptyRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/EmptyRequest\"\n    EmptyQueryRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/EmptyQueryRequest\"\n    ListIntentsQueryRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/ListIntentsQueryRequest\"\n    ListOperationsQueryRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/ListOperationsQueryRequest\"\n    ListRetainedDataQueryRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/ListRetainedDataQueryRequest\"\n    ListPermissionsQueryRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/ListPermissionsQueryRequest\"\n    ListDiagnosticsQueryRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/ListDiagnosticsQueryRequest\"\n    SettingsQueryRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/SettingsQueryRequest\"\n    PrepareSurfaceRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/PrepareSurfaceRequest\"\n    TrustedParentBridgeTokenRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/TrustedParentBridgeTokenRequest\"\n    ReadSurfaceAssetRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/ReadSurfaceAssetRequest\"\n    ReadSurfaceStreamRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/ReadSurfaceStreamRequest\"\n    AcknowledgeSurfaceStreamRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/AcknowledgeSurfaceStreamRequest\"\n    CancelSurfaceOperationRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/CancelSurfaceOperationRequest\"\n    RejectSurfaceConfirmationRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/RejectSurfaceConfirmationRequest\"\n    DisposeSurfaceRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/DisposeSurfaceRequest\"\n    RPCRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/RPCRequest\"\n    PrepareMethodConfirmationRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/PrepareMethodConfirmationRequest\"\n    InvokeIntentRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/InvokeIntentRequest\"\n    CancelOperationRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/CancelOperationRequest\"\n    StartRuntimeRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/StartRuntimeRequest\"\n    ExportDataRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/ExportDataRequest\"\n    DeleteDataExportRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/DeleteDataExportRequest\"\n    ImportDataRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/ImportDataRequest\"\n    DeleteRetainedDataRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/DeleteRetainedDataRequest\"\n    BindRetainedDataRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/BindRetainedDataRequest\"\n    CleanupExpiredRetainedDataRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/CleanupExpiredRetainedDataRequest\"\n    GrantPermissionRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/GrantPermissionRequest\"\n    RevokePermissionRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/RevokePermissionRequest\"\n    PutSecurityPolicyRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/PutSecurityPolicyRequest\"\n    DeleteSecurityPolicyRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/DeleteSecurityPolicyRequest\"\n    SecretRefRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/SecretRefRequest\"\n    PatchSettingsRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/PatchSettingsRequest\"\n  schemas:\n    PlatformErrorResponse:\n      type: object\n      required: [ok, error]\n      additionalProperties: false\n      properties:\n        ok: { const: false }\n        error:\n          $ref: \"#/components/schemas/PlatformError\"\n    MutationPlatformErrorResponse:\n      type: object\n      required: [ok, error]\n      additionalProperties: false\n      properties:\n        ok: { const: false }\n        error:\n          $ref: \"#/components/schemas/MutationPlatformError\"\n    RPCSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/RPCResult\" }\n    SurfaceBootstrapSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/SurfaceBootstrap\" }\n    SurfacePreparationSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/SurfacePreparation\" }\n    BridgeTokenSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/BridgeTokenResult\" }\n    SurfaceAssetSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/SurfaceAssetResult\" }\n    SurfaceStreamSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/SurfaceStreamResult\" }\n    SurfaceStreamAcknowledgementSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/SurfaceStreamAcknowledgementResult\" }\n    SurfaceDisposeSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/SurfaceDisposeResult\" }\n    SessionScopeRevokeSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/SessionScopeRevokeCompleteResult\" }\n    PluginRecordSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/PluginRecord\" }\n    PluginCatalogSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/PluginCatalogResult\" }\n    PluginFeaturesSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data:\n          type: array\n          uniqueItems: true\n          items:\n            type: string\n            enum: [release, runtime, capability, connectivity, secrets, core_action]\n    CompatibilitySuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/PluginCompatibilityManifest\" }\n    PluginMethodConfirmationPreparationSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/PluginMethodConfirmationPreparation\" }\n    ConfirmationRejectionSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/ConfirmationRejectionResult\" }\n    IntentListSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/PluginIntentList\" }\n    RetainedDataListSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/RetainedDataList\" }\n    RetainedDataBindingSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/PluginDataBinding\" }\n    RetainedDataCleanupSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/RetainedDataCleanupResult\" }\n    OperationRecordSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/OperationRecord\" }\n    OperationListSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/PluginOperationList\" }\n    RuntimeHealthSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/PluginRuntimeHealth\" }\n    RuntimeStopSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/PluginRuntimeStopResult\" }\n    RuntimeRefreshSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/PluginRuntimeRefreshResult\" }\n    DataExportSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/PluginDataExportResult\" }\n    DataExportDeleteSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/PluginDataExportDeleteResult\" }\n    PermissionListSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/PluginPermissionList\" }\n    PermissionMutationSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/PluginPermissionMutationResult\" }\n    SecurityPolicyListSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/PluginSecurityPolicyList\" }\n    SecurityPolicyRecordSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/PluginSecurityPolicy\" }\n    SecurityPolicyDeleteSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/PluginSecurityPolicyDeleteResult\" }\n    DiagnosticEventListSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/PluginDiagnosticEventList\" }\n    SecretBindSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/PluginSecretBindResult\" }\n    SecretTestSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/PluginSecretTestResult\" }\n    SecretDeleteSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/PluginSecretDeleteResult\" }\n    SettingsSchemaSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/PluginSettingsSchema\" }\n    SettingsSnapshotSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/PluginSettingsSnapshot\" }\n    PlatformError:\n      oneOf:\n        - $ref: \"#/components/schemas/GenericPlatformError\"\n        - $ref: \"#/components/schemas/JSONLimitPlatformError\"\n        - $ref: \"#/components/schemas/PackageValidationPlatformError\"\n        - $ref: \"#/components/schemas/ManagementRevisionPlatformError\"\n        - $ref: \"#/components/schemas/AuthorizationRevisionPlatformError\"\n        - $ref: \"#/components/schemas/BindingRevisionPlatformError\"\n        - $ref: \"#/components/schemas/ValuesRevisionPlatformError\"\n        - $ref: \"#/components/schemas/CapabilityPlatformError\"\n        - $ref: \"#/components/schemas/WorkerPlatformError\"\n    MutationPlatformError:\n      oneOf:\n        - $ref: \"#/components/schemas/MutationGenericPlatformError\"\n        - $ref: \"#/components/schemas/MutationJSONLimitPlatformError\"\n        - $ref: \"#/components/schemas/MutationPackageValidationPlatformError\"\n        - $ref: \"#/components/schemas/MutationManagementRevisionPlatformError\"\n        - $ref: \"#/components/schemas/MutationAuthorizationRevisionPlatformError\"\n        - $ref: \"#/components/schemas/MutationBindingRevisionPlatformError\"\n        - $ref: \"#/components/schemas/MutationValuesRevisionPlatformError\"\n        - $ref: \"#/components/schemas/MutationCapabilityPlatformError\"\n        - $ref: \"#/components/schemas/MutationWorkerPlatformError\"\n        - $ref: \"#/components/schemas/MutationSessionTeardownPlatformError\"\n    GenericPlatformError:\n      type: object\n      required: [code, message, details]\n      additionalProperties: false\n      properties:\n        code:\n          $ref: \"#/components/schemas/GenericPlatformErrorCode\"\n        message: { $ref: \"#/components/schemas/PlatformErrorMessage\" }\n        details:\n          $ref: \"#/components/schemas/EmptyErrorDetails\"\n    JSONLimitPlatformError:\n      type: object\n      required: [code, message, details]\n      additionalProperties: false\n      properties:\n        code: { const: PLUGIN_JSON_LIMIT_EXCEEDED }\n        message: { $ref: \"#/components/schemas/PlatformErrorMessage\" }\n        details: { $ref: \"#/components/schemas/JSONLimitErrorDetails\" }\n    PackageValidationPlatformError:\n      type: object\n      required: [code, message, details]\n      additionalProperties: false\n      properties:\n        code:\n          type: string\n          enum: [PLUGIN_MANIFEST_INVALID, PLUGIN_PACKAGE_INVALID, PLUGIN_PACKAGE_TOO_LARGE, PLUGIN_PACKAGE_PATH_FORBIDDEN]\n        message: { $ref: \"#/components/schemas/PlatformErrorMessage\" }\n        details: { $ref: \"#/components/schemas/PackageValidationErrorDetails\" }\n    ManagementRevisionPlatformError:\n      type: object\n      required: [code, message, details]\n      additionalProperties: false\n      properties:\n        code: { const: PLUGIN_MANAGEMENT_REVISION_MISMATCH }\n        message: { $ref: \"#/components/schemas/PlatformErrorMessage\" }\n        details: { $ref: \"#/components/schemas/ManagementRevisionMismatchDetails\" }\n    AuthorizationRevisionPlatformError:\n      type: object\n      required: [code, message, details]\n      additionalProperties: false\n      properties:\n        code: { const: PLUGIN_AUTHORIZATION_REVISION_MISMATCH }\n        message: { $ref: \"#/components/schemas/PlatformErrorMessage\" }\n        details: { $ref: \"#/components/schemas/AuthorizationRevisionMismatchDetails\" }\n    BindingRevisionPlatformError:\n      type: object\n      required: [code, message, details]\n      additionalProperties: false\n      properties:\n        code: { const: PLUGIN_BINDING_REVISION_MISMATCH }\n        message: { $ref: \"#/components/schemas/PlatformErrorMessage\" }\n        details: { $ref: \"#/components/schemas/BindingRevisionMismatchDetails\" }\n    ValuesRevisionPlatformError:\n      type: object\n      required: [code, message, details]\n      additionalProperties: false\n      properties:\n        code: { const: PLUGIN_VALUES_REVISION_MISMATCH }\n        message: { $ref: \"#/components/schemas/PlatformErrorMessage\" }\n        details: { $ref: \"#/components/schemas/ValuesRevisionMismatchDetails\" }\n    CapabilityPlatformError:\n      type: object\n      required: [code, message, details]\n      additionalProperties: false\n      properties:\n        code: { const: PLUGIN_CAPABILITY_ERROR }\n        message: { $ref: \"#/components/schemas/PlatformErrorMessage\" }\n        details: { $ref: \"#/components/schemas/CapabilityBusinessErrorDetails\" }\n    WorkerPlatformError:\n      type: object\n      required: [code, message, details]\n      additionalProperties: false\n      properties:\n        code: { const: PLUGIN_WORKER_ERROR }\n        message: { $ref: \"#/components/schemas/PlatformErrorMessage\" }\n        details: { $ref: \"#/components/schemas/WorkerErrorDetails\" }\n    MutationGenericPlatformError:\n      type: object\n      required: [code, message, details, mutation_outcome]\n      additionalProperties: false\n      properties:\n        code: { $ref: \"#/components/schemas/GenericPlatformErrorCode\" }\n        message: { $ref: \"#/components/schemas/PlatformErrorMessage\" }\n        details: { $ref: \"#/components/schemas/EmptyErrorDetails\" }\n        mutation_outcome: { $ref: \"#/components/schemas/MutationOutcome\" }\n    MutationJSONLimitPlatformError:\n      type: object\n      required: [code, message, details, mutation_outcome]\n      additionalProperties: false\n      properties:\n        code: { const: PLUGIN_JSON_LIMIT_EXCEEDED }\n        message: { $ref: \"#/components/schemas/PlatformErrorMessage\" }\n        details: { $ref: \"#/components/schemas/JSONLimitErrorDetails\" }\n        mutation_outcome: { $ref: \"#/components/schemas/MutationOutcome\" }\n    MutationPackageValidationPlatformError:\n      type: object\n      required: [code, message, details, mutation_outcome]\n      additionalProperties: false\n      properties:\n        code:\n          type: string\n          enum: [PLUGIN_MANIFEST_INVALID, PLUGIN_PACKAGE_INVALID, PLUGIN_PACKAGE_TOO_LARGE, PLUGIN_PACKAGE_PATH_FORBIDDEN]\n        message: { $ref: \"#/components/schemas/PlatformErrorMessage\" }\n        details: { $ref: \"#/components/schemas/PackageValidationErrorDetails\" }\n        mutation_outcome: { $ref: \"#/components/schemas/MutationOutcome\" }\n    MutationManagementRevisionPlatformError:\n      type: object\n      required: [code, message, details, mutation_outcome]\n      additionalProperties: false\n      properties:\n        code: { const: PLUGIN_MANAGEMENT_REVISION_MISMATCH }\n        message: { $ref: \"#/components/schemas/PlatformErrorMessage\" }\n        details: { $ref: \"#/components/schemas/ManagementRevisionMismatchDetails\" }\n        mutation_outcome: { $ref: \"#/components/schemas/MutationOutcome\" }\n    MutationAuthorizationRevisionPlatformError:\n      type: object\n      required: [code, message, details, mutation_outcome]\n      additionalProperties: false\n      properties:\n        code: { const: PLUGIN_AUTHORIZATION_REVISION_MISMATCH }\n        message: { $ref: \"#/components/schemas/PlatformErrorMessage\" }\n        details: { $ref: \"#/components/schemas/AuthorizationRevisionMismatchDetails\" }\n        mutation_outcome: { $ref: \"#/components/schemas/MutationOutcome\" }\n    MutationBindingRevisionPlatformError:\n      type: object\n      required: [code, message, details, mutation_outcome]\n      additionalProperties: false\n      properties:\n        code: { const: PLUGIN_BINDING_REVISION_MISMATCH }\n        message: { $ref: \"#/components/schemas/PlatformErrorMessage\" }\n        details: { $ref: \"#/components/schemas/BindingRevisionMismatchDetails\" }\n        mutation_outcome: { $ref: \"#/components/schemas/MutationOutcome\" }\n    MutationValuesRevisionPlatformError:\n      type: object\n      required: [code, message, details, mutation_outcome]\n      additionalProperties: false\n      properties:\n        code: { const: PLUGIN_VALUES_REVISION_MISMATCH }\n        message: { $ref: \"#/components/schemas/PlatformErrorMessage\" }\n        details: { $ref: \"#/components/schemas/ValuesRevisionMismatchDetails\" }\n        mutation_outcome: { $ref: \"#/components/schemas/MutationOutcome\" }\n    MutationCapabilityPlatformError:\n      type: object\n      required: [code, message, details, mutation_outcome]\n      additionalProperties: false\n      properties:\n        code: { const: PLUGIN_CAPABILITY_ERROR }\n        message: { $ref: \"#/components/schemas/PlatformErrorMessage\" }\n        details: { $ref: \"#/components/schemas/CapabilityBusinessErrorDetails\" }\n        mutation_outcome: { $ref: \"#/components/schemas/MutationOutcome\" }\n    MutationWorkerPlatformError:\n      type: object\n      required: [code, message, details, mutation_outcome]\n      additionalProperties: false\n      properties:\n        code: { const: PLUGIN_WORKER_ERROR }\n        message: { $ref: \"#/components/schemas/PlatformErrorMessage\" }\n        details: { $ref: \"#/components/schemas/WorkerErrorDetails\" }\n        mutation_outcome: { $ref: \"#/components/schemas/MutationOutcome\" }\n    MutationSessionTeardownPlatformError:\n      type: object\n      required: [code, message, details, mutation_outcome]\n      additionalProperties: false\n      properties:\n        code: { const: PLUGIN_SESSION_TEARDOWN_INCOMPLETE }\n        message: { $ref: \"#/components/schemas/PlatformErrorMessage\" }\n        details: { $ref: \"#/components/schemas/SessionTeardownIncompleteErrorDetails\" }\n        mutation_outcome: { const: committed }\n    MutationOutcome:\n      type: string\n      enum: [committed, not_committed, unknown]\n    EmptyErrorDetails:\n      type: object\n      additionalProperties: false\n    JSONLimitErrorDetails:\n      type: object\n      required: [reason]\n      additionalProperties: false\n      properties:\n        reason:\n          type: string\n          enum: [payload_bytes, json_depth, prototype_key, number_precision]\n    PackageValidationErrorDetails:\n      type: object\n      required: [reason]\n      additionalProperties: false\n      properties:\n        reason:\n          type: string\n          enum: [manifest_missing, manifest_field, manifest_decode, zip_invalid, file_count, duplicate_entry, ambiguous_entry, non_regular_entry, invalid_utf8_path, non_nfc_path, symlink_entry, directory_entry, entry_bytes, path_length, compression_ratio, total_uncompressed_bytes, entry_open_failed, entry_read_failed, entry_close_failed, entry_size_mismatch, unsupported_signature_entry, manifest_artifact, package_asset_security, package_artifact_boundary, entry_path, manifest_canonical_json, canonical_hash, package_signature, empty_path, slash_separator, non_canonical_path, path_traversal, hidden_path, external_icon_path, unsupported_icon_format, missing_icon_asset, icon_magic_mismatch, query_or_fragment]\n        path:\n          type: string\n          description: Package-local entry path related to the error, when available.\n        pointer:\n          type: string\n          description: JSON Pointer into manifest.json related to the error, when available.\n    CapabilityBusinessErrorDetails:\n      type: object\n      additionalProperties: false\n      required: [capability_id, capability_version, detail_schema_sha256, business_error_code]\n      properties:\n        capability_id:\n          type: string\n          minLength: 1\n        capability_version:\n          $ref: \"#/components/schemas/StrictSemVer\"\n        detail_schema_sha256:\n          type: string\n          pattern: \"^[0-9a-f]{64}$\"\n        business_error_code:\n          type: string\n          pattern: \"^[A-Z][A-Z0-9_]*$\"\n        business_error_details:\n          type: object\n          additionalProperties: true\n    WorkerErrorDetails:\n      type: object\n      additionalProperties: false\n      required: [worker_error_code, worker_error_message, worker_error_origin]\n      properties:\n        worker_error_code:\n          type: string\n          pattern: \"^[A-Z][A-Z0-9_]*$\"\n        worker_error_message:\n          type: string\n          minLength: 1\n          maxLength: 4096\n        worker_error_origin:\n          type: string\n          enum: [runtime, hostcall, plugin]\n    SessionTeardownIncompleteErrorDetails:\n      type: object\n      additionalProperties: false\n      required: [session_scope]\n      properties:\n        session_scope:\n          $ref: \"#/components/schemas/SessionScopeRevokeIncompleteResult\"\n    ManagementRevisionMismatchDetails:\n      type: object\n      additionalProperties: false\n      required: [plugin_instance_id, expected_management_revision, actual_management_revision]\n      properties:\n        plugin_instance_id: { type: string, minLength: 1 }\n        expected_management_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n        actual_management_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n    AuthorizationRevisionMismatchDetails:\n      type: object\n      additionalProperties: false\n      required:\n        - plugin_instance_id\n        - expected_policy_revision\n        - actual_policy_revision\n        - expected_management_revision\n        - actual_management_revision\n        - expected_revoke_epoch\n        - actual_revoke_epoch\n      properties:\n        plugin_instance_id: { type: string, minLength: 1 }\n        expected_policy_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n        actual_policy_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n        expected_management_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n        actual_management_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n        expected_revoke_epoch: { type: integer, minimum: 0, maximum: 9007199254740991 }\n        actual_revoke_epoch: { type: integer, minimum: 0, maximum: 9007199254740991 }\n    BindingRevisionMismatchDetails:\n      type: object\n      additionalProperties: false\n      required: [plugin_instance_id, expected_binding_revision, actual_binding_revision]\n      properties:\n        plugin_instance_id: { type: string, minLength: 1 }\n        expected_binding_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n        actual_binding_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n    ValuesRevisionMismatchDetails:\n      type: object\n      additionalProperties: false\n      required: [plugin_instance_id, expected_values_revision, actual_values_revision]\n      properties:\n        plugin_instance_id: { type: string, minLength: 1 }\n        expected_values_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n        actual_values_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n    ErrorCode:\n      $ref: \"../plugin/error-codes-v6.schema.json#/$defs/platform_error_code\"\n    PlatformErrorMessage:\n      type: string\n      minLength: 1\n      maxLength: 4096\n      pattern: \".*\\\\S.*\"\n    GenericPlatformErrorCode:\n      type: string\n      enum:\n        - PLUGIN_INVALID_REQUEST\n        - PLUGIN_SIGNATURE_INVALID\n        - PLUGIN_TRUST_STATE_DENIED\n        - PLUGIN_TRUST_VERIFICATION_REQUIRED\n        - PLUGIN_TRUST_VERIFICATION_INVALID\n        - PLUGIN_RELEASE_REF_VERIFICATION_FAILED\n        - PLUGIN_RELEASE_REF_POLICY_DENIED\n        - PLUGIN_DISABLED\n        - PLUGIN_DISABLED_BY_POLICY\n        - PLUGIN_PERMISSION_DENIED\n        - PLUGIN_ORIGIN_DENIED\n        - PLUGIN_ACTION_DENIED\n        - PLUGIN_OWNER_SCOPE_MISMATCH\n        - PLUGIN_SECRET_SCOPE_MISMATCH\n        - PLUGIN_STORAGE_SCOPE_MISMATCH\n        - PLUGIN_ADAPTER_FAILURE\n        - PLUGIN_SESSION_REVOKED\n        - PLUGIN_SESSION_TEARDOWN_INCOMPLETE\n        - PLUGIN_SESSION_FENCE_CAPACITY\n        - PLUGIN_CONFIRMATION_REQUIRED\n        - PLUGIN_CONFIRMATION_INVALID\n        - PLUGIN_TOKEN_EXPIRED\n        - PLUGIN_TOKEN_REPLAY\n        - PLUGIN_GATEWAY_TOKEN_INVALID\n        - PLUGIN_GATEWAY_TOKEN_REPLAYED\n        - PLUGIN_GATEWAY_TOKEN_CHANNEL_MISMATCH\n        - PLUGIN_ASSET_TICKET_INVALID\n        - PLUGIN_ASSET_SESSION_INVALID\n        - PLUGIN_STREAM_TICKET_INVALID\n        - PLUGIN_STREAM_DELIVERY_INVALID\n        - PLUGIN_STREAM_CANCELLED\n        - PLUGIN_LEASE_INVALID\n        - PLUGIN_LEASE_REPLAYED\n        - PLUGIN_GRANT_INVALID\n        - PLUGIN_STORAGE_QUOTA_EXCEEDED\n        - PLUGIN_OPERATION_BLOCKED\n        - PLUGIN_OPERATION_NOT_FOUND\n        - PLUGIN_OPERATION_NOT_CANCELABLE\n        - PLUGIN_NETWORK_TARGET_DENIED\n        - PLUGIN_NETWORK_RATE_LIMITED\n        - PLUGIN_RUNTIME_UNAVAILABLE\n        - PLUGIN_RUNTIME_VERSION_MISMATCH\n        - PLUGIN_RUNTIME_CONTRACT_MISMATCH\n        - PLUGIN_UI_PROTOCOL_UNSUPPORTED\n        - PLUGIN_UI_PROTOCOL_VIOLATION\n        - PLUGIN_SURFACE_QUIESCE_TIMEOUT\n        - PLUGIN_CONTRACT_MISMATCH\n        - PLUGIN_CSRF_REQUIRED\n        - PLUGIN_CSRF_INVALID\n        - PLUGIN_FEATURE_NOT_CONFIGURED\n    SurfaceDisposeResult:\n      type: object\n      required: [disposed]\n      additionalProperties: false\n      properties:\n        disposed: { const: true }\n    SessionScopeRevokeCounts:\n      $ref: \"../plugin/session-scope-v1.schema.json#/$defs/revoke_counts\"\n    SessionScopeRevokeResult:\n      $ref: \"../plugin/session-scope-v1.schema.json#/$defs/public_revoke_result\"\n    SessionScopeRevokeCompleteResult:\n      $ref: \"../plugin/session-scope-v1.schema.json#/$defs/complete_revoke_result\"\n    SessionScopeRevokeIncompleteResult:\n      $ref: \"../plugin/session-scope-v1.schema.json#/$defs/incomplete_revoke_result\"\n    PluginCatalogResult:\n      type: object\n      required: [plugins]\n      additionalProperties: false\n      properties:\n        plugins:\n          type: array\n          items: { $ref: \"#/components/schemas/PluginRecord\" }\n    PluginCompatibilityManifest:\n      $ref: \"../plugin/compatibility-manifest-v8.schema.json\"\n    PluginOperationList:\n      type: object\n      required: [operations]\n      additionalProperties: false\n      properties:\n        operations:\n          type: array\n          items: { $ref: \"#/components/schemas/OperationRecord\" }\n        next_cursor: { type: string, maxLength: 1024 }\n    PluginIntentRecord:\n      type: object\n      required: [plugin_id, plugin_instance_id, publisher_id, display_name, version, active_fingerprint, intent_id, method, effect, execution]\n      additionalProperties: false\n      properties:\n        plugin_id: { type: string }\n        plugin_instance_id: { type: string }\n        publisher_id: { type: string }\n        display_name: { type: string }\n        version: { $ref: \"#/components/schemas/StrictSemVer\" }\n        active_fingerprint: { type: string }\n        intent_id: { type: string }\n        method: { type: string }\n        effect: { type: string, enum: [read, write, delete, execute, admin] }\n        execution: { type: string, enum: [sync, operation, subscription] }\n        payload_schema:\n          type: object\n          additionalProperties: true\n    PluginIntentList:\n      type: object\n      required: [intents]\n      additionalProperties: false\n      properties:\n        intents:\n          type: array\n          items: { $ref: \"#/components/schemas/PluginIntentRecord\" }\n    PluginPermissionGrant:\n      type: object\n      description: Explicit public HTTP projection of a permission grant. Internal actor ownership hashes are never returned.\n      required: [plugin_instance_id, permission_id, effect, granted_at]\n      additionalProperties: false\n      properties:\n        plugin_instance_id: { type: string }\n        permission_id: { type: string }\n        effect: { type: string, enum: [grant, deny] }\n        granted_at: { type: string, format: date-time }\n        expires_at: { type: string, format: date-time }\n        revoked_at: { type: string, format: date-time }\n        revoked_reason: { type: string }\n    PluginPermissionList:\n      type: object\n      required: [permissions]\n      additionalProperties: false\n      properties:\n        permissions:\n          type: array\n          items: { $ref: \"#/components/schemas/PluginPermissionGrant\" }\n    AuthorizationRevisions:\n      type: object\n      required: [policy_revision, management_revision, revoke_epoch]\n      additionalProperties: false\n      properties:\n        policy_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n        management_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n        revoke_epoch: { type: integer, minimum: 0, maximum: 9007199254740991 }\n    PluginPermissionMutationResult:\n      type: object\n      required: [permission, revisions]\n      additionalProperties: false\n      properties:\n        permission: { $ref: \"#/components/schemas/PluginPermissionGrant\" }\n        revisions: { $ref: \"#/components/schemas/AuthorizationRevisions\" }\n    PluginSecurityPolicy:\n      type: object\n      required: [plugin_instance_id, allowed_permissions, denied_methods, policy_revision, management_revision, revoke_epoch, updated_at]\n      additionalProperties: false\n      properties:\n        plugin_instance_id: { type: string, minLength: 1 }\n        allowed_permissions:\n          type: array\n          uniqueItems: true\n          items: { type: string, minLength: 1 }\n        denied_methods:\n          type: array\n          uniqueItems: true\n          items: { type: string, minLength: 1 }\n        policy_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n        management_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n        revoke_epoch: { type: integer, minimum: 0, maximum: 9007199254740991 }\n        updated_at: { type: string, format: date-time }\n    PluginSecurityPolicyList:\n      type: object\n      required: [security_policies]\n      additionalProperties: false\n      properties:\n        security_policies:\n          type: array\n          items: { $ref: \"#/components/schemas/PluginSecurityPolicy\" }\n    PluginSecurityPolicyDeleteResult:\n      type: object\n      required: [plugin_instance_id, deleted, policy_revision, management_revision, revoke_epoch]\n      additionalProperties: false\n      properties:\n        plugin_instance_id: { type: string, minLength: 1 }\n        deleted: { const: true }\n        policy_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n        management_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n        revoke_epoch: { type: integer, minimum: 0, maximum: 9007199254740991 }\n    DiagnosticMutationOutcome:\n      type: string\n      enum: [committed, not_committed, unknown]\n    PluginDiagnosticDetails:\n      type: object\n      additionalProperties: false\n      properties:\n        operations_deleted: { type: integer, minimum: 0, maximum: 9007199254740991 }\n        streams_deleted: { type: integer, minimum: 0, maximum: 9007199254740991 }\n        invocation_id: { type: string }\n        method: { type: string }\n        failure_code: { type: string }\n        runtime_process_failure_code:\n          $ref: \"../plugin/error-codes-v6.schema.json#/$defs/runtime_process_failure_code\"\n        operation_id: { type: string }\n        stream_id: { type: string }\n        runtime_instance_id: { type: string }\n        runtime_generation_id: { type: string }\n        runtime_version: { type: string }\n        rust_ipc_version: { type: string }\n        wasm_abi_version: { type: string }\n        contract_set_sha256: { type: string, pattern: '^[0-9a-f]{64}$' }\n        runtime_target_os: { type: string }\n        runtime_target_arch: { type: string }\n        runtime_binary_sha256: { type: string, pattern: '^[0-9a-f]{64}$' }\n        os: { type: string }\n        arch: { type: string }\n        stream: { type: string }\n        package_hash: { type: string }\n        artifact: { type: string }\n        plugin_instance_id: { type: string }\n        store_id: { type: string }\n        operation: { type: string }\n        hostcall: { type: string }\n        code: { type: string }\n        connector_id: { type: string }\n        transport: { type: string }\n        revoke_epoch: { type: integer, minimum: 0, maximum: 9007199254740991 }\n        stage_id: { type: string }\n        reason: { type: string }\n        surface_instance_id: { type: string }\n    PluginDiagnosticEvent:\n      type: object\n      required: [type, severity, message]\n      additionalProperties: false\n      properties:\n        event_id: { type: string }\n        type: { type: string }\n        severity: { type: string, enum: [info, warning] }\n        message: { type: string }\n        plugin_id: { type: string }\n        plugin_instance_id: { type: string }\n        surface_id: { type: string }\n        surface_instance_id: { type: string }\n        active_fingerprint: { type: string }\n        request_id: { type: string }\n        correlation_id: { type: string }\n        mutation_outcome: { $ref: \"#/components/schemas/DiagnosticMutationOutcome\" }\n        occurred_at: { type: string, format: date-time }\n        details: { $ref: \"#/components/schemas/PluginDiagnosticDetails\" }\n    PluginDiagnosticEventList:\n      type: object\n      required: [diagnostic_events]\n      additionalProperties: false\n      properties:\n        diagnostic_events:\n          type: array\n          items: { $ref: \"#/components/schemas/PluginDiagnosticEvent\" }\n    PluginRuntimeShardHealth:\n      type: object\n      description: Explicit public HTTP projection of runtime shard health. IPC channel credentials and connection nonces are excluded.\n      required: [runtime_shard_id, runtime_instance_id, runtime_generation_id, descriptor, ready, active_invocations, queued_invocations, limits, module_cache]\n      additionalProperties: false\n      properties:\n        runtime_shard_id: { type: string }\n        runtime_instance_id: { type: string }\n        runtime_generation_id: { type: string }\n        descriptor: { $ref: \"#/components/schemas/RuntimeDescriptor\" }\n        ready: { type: boolean }\n        active_invocations: { type: integer, minimum: 0 }\n        queued_invocations: { type: integer, minimum: 0 }\n        limits: { $ref: \"#/components/schemas/RuntimeLimits\" }\n        module_cache: { $ref: \"#/components/schemas/RuntimeModuleCacheMetrics\" }\n    PluginRuntimeHealth:\n      type: object\n      description: Explicit public HTTP projection of runtime manager health.\n      required: [ready, descriptor, shards]\n      additionalProperties: false\n      properties:\n        ready: { type: boolean }\n        descriptor: { $ref: \"#/components/schemas/RuntimeDescriptor\" }\n        shards:\n          type: array\n          items: { $ref: \"#/components/schemas/PluginRuntimeShardHealth\" }\n    RuntimeTarget:\n      oneOf:\n        - type: object\n          required: [os, arch]\n          additionalProperties: false\n          properties:\n            os: { const: darwin }\n            arch: { const: amd64 }\n        - type: object\n          required: [os, arch]\n          additionalProperties: false\n          properties:\n            os: { const: darwin }\n            arch: { const: arm64 }\n        - type: object\n          required: [os, arch]\n          additionalProperties: false\n          properties:\n            os: { const: linux }\n            arch: { const: amd64 }\n        - type: object\n          required: [os, arch]\n          additionalProperties: false\n          properties:\n            os: { const: linux }\n            arch: { const: arm64 }\n    RuntimeAdmissionTarget:\n      type: string\n      enum: [linux/amd64, linux/arm64]\n    StrictSemVer:\n      type: string\n      pattern: '^(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)(?:-(?:(?:0|[1-9][0-9]*|[0-9A-Za-z-]*[A-Za-z-][0-9A-Za-z-]*)(?:\\.(?:0|[1-9][0-9]*|[0-9A-Za-z-]*[A-Za-z-][0-9A-Za-z-]*))*))?(?:\\+[0-9A-Za-z-]+(?:\\.[0-9A-Za-z-]+)*)?$'\n    RuntimeDescriptor:\n      type: object\n      required: [schema_version, platform_version, target, rust_ipc_version, wasm_abi_version, contract_set_sha256, binary_sha256]\n      additionalProperties: false\n      properties:\n        schema_version: { const: runtime-descriptor-v2 }\n        platform_version: { $ref: \"#/components/schemas/StrictSemVer\" }\n        target: { $ref: \"#/components/schemas/RuntimeAdmissionTarget\" }\n        rust_ipc_version: { const: rust-ipc-v6 }\n        wasm_abi_version: { const: redevplugin-wasm-worker-v2 }\n        contract_set_sha256: { type: string, pattern: '^[0-9a-f]{64}$' }\n        binary_sha256: { type: string, pattern: '^[0-9a-f]{64}$' }\n    RuntimeLimits:\n      type: object\n      description: \"Negotiated runtime capacities. per_plugin_concurrency must not exceed worker_count. Route capacities are derived exactly from negotiated limits: active hostcall routes = worker_count, canceled hostcall retention = worker_count + queue_capacity, and compile-flight artifact routes = worker_count.\"\n      required: [worker_count, queue_capacity, per_plugin_concurrency, module_cache_entries, module_cache_source_bytes]\n      additionalProperties: false\n      properties:\n        worker_count: { type: integer, minimum: 1, maximum: 64, description: \"Number of runtime worker threads.\" }\n        queue_capacity: { type: integer, minimum: 1, maximum: 64, description: \"Maximum queued worker invocations.\" }\n        per_plugin_concurrency: { type: integer, minimum: 1, maximum: 64, description: \"Maximum concurrent invocations for one plugin; must not exceed worker_count.\" }\n        module_cache_entries: { type: integer, minimum: 1, maximum: 1024, description: \"Maximum compiled modules retained by the runtime cache.\" }\n        module_cache_source_bytes: { type: integer, minimum: 1, maximum: 134217728, description: \"Maximum source WASM bytes retained by the runtime cache (128 MiB).\" }\n    RuntimeModuleCacheMetrics:\n      type: object\n      required: [hits, misses, compiles, entries, source_bytes]\n      additionalProperties: false\n      properties:\n        hits: { type: integer, minimum: 0, maximum: 9007199254740991 }\n        misses: { type: integer, minimum: 0, maximum: 9007199254740991 }\n        compiles: { type: integer, minimum: 0, maximum: 9007199254740991 }\n        entries: { type: integer, minimum: 0, maximum: 1024 }\n        source_bytes: { type: integer, minimum: 0, maximum: 134217728 }\n    PluginRuntimeStopResult:\n      type: object\n      required: [stopped]\n      additionalProperties: false\n      properties:\n        stopped: { const: true }\n    PluginRuntimeRefreshResult:\n      type: object\n      required: [results]\n      additionalProperties: false\n      properties:\n        results:\n          type: array\n          items: { $ref: \"#/components/schemas/PluginRuntimeRefreshEntry\" }\n    PluginRuntimeRefreshEntry:\n      oneOf:\n        - $ref: \"#/components/schemas/PluginRuntimeRefreshSuccess\"\n        - $ref: \"#/components/schemas/PluginRuntimeRefreshFailure\"\n    PluginRuntimeRefreshSuccess:\n      type: object\n      required: [plugin_instance_id, status]\n      additionalProperties: false\n      properties:\n        plugin_instance_id: { type: string, minLength: 1 }\n        status: { const: refreshed }\n    PluginRuntimeRefreshFailure:\n      type: object\n      required: [plugin_instance_id, status, error]\n      additionalProperties: false\n      properties:\n        plugin_instance_id: { type: string, minLength: 1 }\n        status: { const: failed }\n        error: { $ref: \"#/components/schemas/PluginRuntimeRefreshPublicError\" }\n    PluginRuntimeRefreshPublicError:\n      type: object\n      required: [code, message]\n      additionalProperties: false\n      properties:\n        code:\n          type: string\n          enum: [PLUGIN_RUNTIME_UNAVAILABLE]\n        message: { const: \"Plugin runtime state could not be refreshed\" }\n    PluginDataExportResult:\n      type: object\n      required: [bundle_ref]\n      additionalProperties: false\n      properties:\n        bundle_ref: { type: string, minLength: 1 }\n    PluginDataExportDeleteResult:\n      type: object\n      required: [deleted]\n      additionalProperties: false\n      properties:\n        deleted: { const: true }\n    PluginSecretBindResult:\n      type: object\n      required: [bound]\n      additionalProperties: false\n      properties:\n        bound: { const: true }\n    PluginSecretTestResult:\n      type: object\n      required: [tested]\n      additionalProperties: false\n      properties:\n        tested: { const: true }\n    PluginSecretDeleteResult:\n      type: object\n      required: [deleted]\n      additionalProperties: false\n      properties:\n        deleted: { const: true }\n    PluginSettingsField:\n      type: object\n      required: [key, type, label, scope]\n      additionalProperties: false\n      properties:\n        key: { type: string }\n        type: { type: string }\n        label: { type: string }\n        scope: { $ref: \"#/components/schemas/ResourceScopeKind\" }\n        default: true\n        secret_ref: { type: string }\n        options:\n          type: array\n          items: { type: string }\n        validation:\n          type: object\n          additionalProperties: true\n    PluginSettingsSchema:\n      type: object\n      description: Explicit public HTTP projection of the settings schema for one owner scope.\n      required: [plugin_instance_id, scope, schema_version, fields, values_revision]\n      additionalProperties: false\n      properties:\n        plugin_instance_id: { type: string }\n        scope: { $ref: \"#/components/schemas/ResourceScopeKind\" }\n        schema_version: { type: integer, minimum: 1 }\n        fields:\n          type: array\n          items: { $ref: \"#/components/schemas/PluginSettingsField\" }\n        values_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n    PluginSettingsSnapshot:\n      type: object\n      description: Explicit public HTTP projection of settings values and redacted secret metadata for one owner scope.\n      required: [plugin_instance_id, scope, schema_version, values_revision, values, secret_metadata]\n      additionalProperties: false\n      properties:\n        plugin_instance_id: { type: string }\n        scope: { $ref: \"#/components/schemas/ResourceScopeKind\" }\n        schema_version: { type: integer, minimum: 1 }\n        values_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n        values:\n          type: object\n          additionalProperties: true\n        secret_metadata:\n          type: array\n          items: { $ref: \"#/components/schemas/PluginSettingsSecretMetadata\" }\n    PluginSettingsSecretMetadata:\n      type: object\n      required: [key, secret_ref, scope, bound]\n      additionalProperties: false\n      properties:\n        key: { type: string, minLength: 1 }\n        secret_ref: { type: string, minLength: 1 }\n        scope: { type: string, enum: [user, environment] }\n        bound: { type: boolean }\n        last_test_status: { type: string }\n        bound_at: { type: string, format: date-time }\n        tested_at: { type: string, format: date-time }\n        updated_at: { type: string, format: date-time }\n    TrustState:\n      type: string\n      enum: [verified, unsigned_local, untrusted, needs_review, trust_unavailable, blocked_security]\n    TrustHashSet:\n      type: object\n      required: [package_sha256, manifest_sha256, entries_sha256]\n      additionalProperties: false\n      properties:\n        package_sha256: { type: string, pattern: \"^(sha256:)?[0-9a-f]{64}$\" }\n        manifest_sha256: { type: string, pattern: \"^(sha256:)?[0-9a-f]{64}$\" }\n        entries_sha256: { type: string, pattern: \"^(sha256:)?[0-9a-f]{64}$\" }\n    VerifiedSignature:\n      type: object\n      required: [algorithm, key_id]\n      additionalProperties: false\n      properties:\n        algorithm: { type: string, minLength: 1 }\n        key_id: { type: string, minLength: 1 }\n    TrustAssessment:\n      type: object\n      required: [trust_state, verified_hashes]\n      additionalProperties: false\n      properties:\n        trust_state:\n          $ref: \"#/components/schemas/TrustState\"\n        reason_codes:\n          type: array\n          items: { type: string }\n        verified_hashes:\n          $ref: \"#/components/schemas/TrustHashSet\"\n        verified_signature:\n          $ref: \"#/components/schemas/VerifiedSignature\"\n        trust_assessment_epoch: { type: string }\n        policy_epoch: { type: string }\n        revocation_epoch: { type: string }\n        metadata:\n          type: object\n          additionalProperties: { type: string }\n    PluginVersion:\n      type: object\n      required: [version, active_fingerprint, package_hash, manifest_hash, entries_hash, trust_state, trust_assessment, manifest, package_entries, activated_at]\n      additionalProperties: false\n      properties:\n        version: { $ref: \"#/components/schemas/StrictSemVer\" }\n        active_fingerprint: { type: string, minLength: 1 }\n        package_hash: { type: string, minLength: 1 }\n        manifest_hash: { type: string, minLength: 1 }\n        entries_hash: { type: string, minLength: 1 }\n        trust_state:\n          $ref: \"#/components/schemas/TrustState\"\n        trust_assessment:\n          $ref: \"#/components/schemas/TrustAssessment\"\n        source_policy_snapshot_hash: { type: string, pattern: \"^(sha256:)?[0-9a-f]{64}$\" }\n        source_policy_snapshot:\n          type: object\n          additionalProperties: true\n        local_import_provenance:\n          $ref: \"#/components/schemas/LocalImportProvenance\"\n        capability_contracts:\n          type: array\n          items: { $ref: \"#/components/schemas/CapabilityContractPin\" }\n        manifest:\n          $ref: \"../plugin/manifest-v5.schema.json\"\n        package_entries:\n          type: array\n          items: { $ref: \"#/components/schemas/PackageEntry\" }\n        runtime_requirement: { $ref: \"#/components/schemas/RuntimeRequirement\" }\n        activated_at: { type: string, format: date-time }\n        metadata:\n          type: object\n          additionalProperties: { type: string }\n    PluginRecord:\n      type: object\n      description: Explicit public HTTP projection of a registry record. Persistent owner identity is excluded.\n      required: [plugin_instance_id, publisher_id, plugin_id, version, active_fingerprint, package_hash, manifest_hash, entries_hash, trust_state, trust_assessment, enable_state, policy_revision, management_revision, revoke_epoch, manifest, package_entries, installed_at, updated_at]\n      additionalProperties: false\n      properties:\n        plugin_instance_id: { type: string, minLength: 1 }\n        publisher_id: { type: string }\n        plugin_id: { type: string, minLength: 1 }\n        version: { $ref: \"#/components/schemas/StrictSemVer\" }\n        active_fingerprint: { type: string, minLength: 1 }\n        package_hash: { type: string }\n        manifest_hash: { type: string }\n        entries_hash: { type: string }\n        trust_state:\n          $ref: \"#/components/schemas/TrustState\"\n        trust_assessment:\n          $ref: \"#/components/schemas/TrustAssessment\"\n        source_policy_snapshot_hash: { type: string, pattern: \"^(sha256:)?[0-9a-f]{64}$\" }\n        source_policy_snapshot:\n          type: object\n          additionalProperties: true\n        local_import_provenance:\n          $ref: \"#/components/schemas/LocalImportProvenance\"\n        capability_contracts:\n          type: array\n          items: { $ref: \"#/components/schemas/CapabilityContractPin\" }\n        enable_state:\n          type: string\n          enum: [disabled, enabled, disabled_by_policy, disabled_incompatible]\n        disabled_reason: { type: string }\n        policy_revision: { type: integer, minimum: 0, maximum: 9007199254740991 }\n        management_revision: { type: integer, minimum: 0, maximum: 9007199254740991 }\n        revoke_epoch: { type: integer, minimum: 0, maximum: 9007199254740991 }\n        manifest:\n          $ref: \"../plugin/manifest-v5.schema.json\"\n        package_entries:\n          type: array\n          items: { $ref: \"#/components/schemas/PackageEntry\" }\n        runtime_requirement: { $ref: \"#/components/schemas/RuntimeRequirement\" }\n        version_history:\n          type: array\n          items:\n            $ref: \"#/components/schemas/PluginVersion\"\n        installed_at: { type: string, format: date-time }\n        enabled_at: { type: string, format: date-time }\n        updated_at: { type: string, format: date-time }\n        deleted_at: { type: string, format: date-time }\n        metadata:\n          type: object\n          additionalProperties: { type: string }\n    PackageEntry:\n      type: object\n      required: [path, size, sha256, mode]\n      additionalProperties: false\n      properties:\n        path: { type: string, minLength: 1 }\n        size: { type: integer, minimum: 0 }\n        sha256: { type: string, pattern: \"^[0-9a-f]{64}$\" }\n        mode: { type: string, minLength: 1 }\n        content_type: { type: string }\n    RuntimeRequirement:\n      type: object\n      required: [min_version]\n      additionalProperties: false\n      properties:\n        min_version: { $ref: \"#/components/schemas/StrictSemVer\" }\n        supported_targets:\n          type: array\n          uniqueItems: true\n          items:\n            type: string\n            enum: [darwin/amd64, darwin/arm64, linux/amd64, linux/arm64]\n    LocalImportProvenance:\n      type: object\n      required: [import_id, distribution, policy_epoch, unsigned_policy, assessed_at]\n      additionalProperties: false\n      properties:\n        import_id: { type: string, minLength: 1 }\n        distribution: { enum: [local_import] }\n        policy_epoch: { type: string, minLength: 1 }\n        unsigned_policy: { enum: [dev_only, review_required, block] }\n        assessed_at: { type: string, format: date-time }\n    PackageHashSet:\n      type: object\n      required: [package_sha256, manifest_sha256, entries_sha256]\n      additionalProperties: false\n      properties:\n        package_sha256: { type: string, pattern: \"^(sha256:)?[0-9a-f]{64}$\" }\n        manifest_sha256: { type: string, pattern: \"^(sha256:)?[0-9a-f]{64}$\" }\n        entries_sha256: { type: string, pattern: \"^(sha256:)?[0-9a-f]{64}$\" }\n    PluginReleaseRef:\n      type: object\n      required: [source_id, channel, release_metadata_ref, release_metadata_sha256, publisher_id, plugin_id, version, expected_hashes]\n      additionalProperties: false\n      properties:\n        source_id: { type: string, minLength: 1 }\n        channel: { type: string, pattern: \"^[a-z][a-z0-9._-]{0,127}$\" }\n        release_metadata_ref: { type: string, minLength: 1 }\n        release_metadata_sha256: { type: string, pattern: \"^(sha256:)?[0-9a-f]{64}$\" }\n        publisher_id: { type: string, minLength: 1 }\n        plugin_id: { type: string, minLength: 1 }\n        version: { $ref: \"#/components/schemas/StrictSemVer\" }\n        expected_hashes:\n          $ref: \"#/components/schemas/PackageHashSet\"\n    InstallReleaseRefRequest:\n      type: object\n      required: [plugin_instance_id, release_ref]\n      additionalProperties: false\n      properties:\n        release_ref:\n          $ref: \"#/components/schemas/PluginReleaseRef\"\n        plugin_instance_id: { type: string, minLength: 1 }\n    UpdateReleaseRefRequest:\n      type: object\n      required: [plugin_instance_id, release_ref, expected_management_revision]\n      additionalProperties: false\n      properties:\n        plugin_instance_id: { type: string, minLength: 1 }\n        release_ref:\n          $ref: \"#/components/schemas/PluginReleaseRef\"\n        expected_management_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n    DowngradeRequest:\n      type: object\n      required: [plugin_instance_id, expected_management_revision]\n      additionalProperties: false\n      properties:\n        plugin_instance_id: { type: string, minLength: 1 }\n        version: { $ref: \"#/components/schemas/StrictSemVer\" }\n        package_hash: { type: string }\n        expected_management_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n    EnableRequest:\n      type: object\n      required: [plugin_instance_id, expected_management_revision]\n      additionalProperties: false\n      properties:\n        plugin_instance_id: { type: string, minLength: 1 }\n        expected_management_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n    DisableRequest:\n      type: object\n      required: [plugin_instance_id, expected_management_revision]\n      additionalProperties: false\n      properties:\n        plugin_instance_id: { type: string, minLength: 1 }\n        reason: { type: string }\n        expected_management_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n    UninstallRequest:\n      type: object\n      required: [plugin_instance_id, delete_data, expected_management_revision]\n      additionalProperties: false\n      properties:\n        plugin_instance_id: { type: string, minLength: 1 }\n        delete_data: { type: boolean }\n        expected_management_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n    OpenSurfaceRequest:\n      type: object\n      required: [plugin_instance_id, surface_id, expected_management_revision]\n      additionalProperties: false\n      properties:\n        plugin_instance_id: { type: string, minLength: 1 }\n        surface_id: { type: string, minLength: 1 }\n        surface_instance_id: { type: string }\n        expected_management_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n    RevokeSessionScopeRequest:\n      type: object\n      additionalProperties: false\n      maxProperties: 0\n    EmptyRequest:\n      type: object\n      additionalProperties: false\n      maxProperties: 0\n    EmptyQueryRequest:\n      type: object\n      additionalProperties: false\n      maxProperties: 0\n    ListIntentsQueryRequest:\n      type: object\n      additionalProperties: false\n      properties:\n        intent_id: { type: string, minLength: 1 }\n        plugin_instance_id: { type: string, minLength: 1 }\n    ListOperationsQueryRequest:\n      type: object\n      additionalProperties: false\n      properties:\n        plugin_instance_id: { type: string, minLength: 1 }\n        cursor: { type: string, minLength: 1, maxLength: 1024 }\n        limit: { type: integer, minimum: 1, maximum: 500 }\n    ListRetainedDataQueryRequest:\n      type: object\n      additionalProperties: false\n      properties:\n        plugin_instance_id: { type: string, minLength: 1 }\n    ListPermissionsQueryRequest:\n      type: object\n      additionalProperties: false\n      properties:\n        plugin_instance_id: { type: string, minLength: 1 }\n        active_only: { type: boolean }\n    ListDiagnosticsQueryRequest:\n      type: object\n      additionalProperties: false\n      properties:\n        plugin_id: { type: string, minLength: 1 }\n        plugin_instance_id: { type: string, minLength: 1 }\n        surface_instance_id: { type: string, minLength: 1 }\n        type: { type: string, minLength: 1 }\n        severity: { type: string, enum: [info, warning] }\n        limit: { type: integer, minimum: 1, maximum: 1000 }\n    SettingsQueryRequest:\n      type: object\n      additionalProperties: false\n      required: [scope]\n      properties:\n        scope: { $ref: \"#/components/schemas/ResourceScopeKind\" }\n    SurfaceBootstrap:\n      type: object\n      additionalProperties: false\n      required:\n        - plugin_id\n        - plugin_instance_id\n        - plugin_version\n        - surface_id\n        - surface_instance_id\n        - active_fingerprint\n        - entry_path\n        - entry_sha256\n        - asset_session_nonce\n        - management_revision\n        - revoke_epoch\n        - runtime_generation_id\n        - asset_ticket\n        - asset_ticket_id\n        - bridge_nonce\n        - issued_at\n        - expires_at\n      properties:\n        plugin_id: { type: string, minLength: 1 }\n        plugin_instance_id: { type: string, minLength: 1 }\n        plugin_version: { $ref: \"#/components/schemas/StrictSemVer\" }\n        surface_id: { type: string, minLength: 1 }\n        surface_instance_id: { type: string, minLength: 1 }\n        active_fingerprint: { type: string, minLength: 1 }\n        entry_path: { type: string, minLength: 1 }\n        entry_sha256: { type: string, pattern: '^sha256:[0-9a-f]{64}$' }\n        asset_session_nonce: { type: string, minLength: 16 }\n        management_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n        revoke_epoch: { type: integer, minimum: 1, maximum: 9007199254740991 }\n        runtime_generation_id: { type: string, minLength: 1 }\n        asset_ticket: { type: string, minLength: 1 }\n        asset_ticket_id: { type: string, minLength: 1 }\n        bridge_nonce: { type: string, minLength: 16 }\n        issued_at: { type: string, format: date-time }\n        expires_at: { type: string, format: date-time }\n    PrepareSurfaceRequest:\n      type: object\n      required: [asset_ticket]\n      additionalProperties: false\n      properties:\n        asset_ticket: { type: string, minLength: 1 }\n    SurfacePreparation:\n      type: object\n      additionalProperties: false\n      required:\n        - asset_session\n        - asset_session_id\n        - asset_session_nonce\n        - entry_path\n        - entry_sha256\n        - management_revision\n        - revoke_epoch\n        - issued_at\n        - expires_at\n        - document\n      properties:\n        asset_session: { type: string, minLength: 1 }\n        asset_session_id: { type: string, minLength: 1 }\n        asset_session_nonce: { type: string, minLength: 16 }\n        entry_path: { type: string, minLength: 1 }\n        entry_sha256: { type: string, pattern: '^sha256:[0-9a-f]{64}$' }\n        management_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n        revoke_epoch: { type: integer, minimum: 1, maximum: 9007199254740991 }\n        issued_at: { type: string, format: date-time }\n        expires_at: { type: string, format: date-time }\n        document:\n          $ref: \"../plugin/opaque-surface-document-v3.schema.json\"\n    TrustedParentBridgeHandshake:\n      type: object\n      required: [type, plugin_id, surface_id, surface_instance_id, active_fingerprint, bridge_nonce, asset_session_nonce, management_revision, revoke_epoch, ui_protocol_version]\n      additionalProperties: false\n      properties:\n        type: { const: redevplugin.bridge.handshake }\n        plugin_id: { type: string, minLength: 1 }\n        surface_id: { type: string, minLength: 1 }\n        surface_instance_id: { type: string, minLength: 1 }\n        active_fingerprint: { type: string, minLength: 1 }\n        bridge_nonce: { type: string, minLength: 16 }\n        asset_session_nonce: { type: string, minLength: 16 }\n        management_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n        revoke_epoch: { type: integer, minimum: 1, maximum: 9007199254740991 }\n        ui_protocol_version: { const: plugin-ui-v5 }\n    TrustedParentBridgeTokenRequest:\n      type: object\n      required: [handshake, bridge_channel_id, handshake_transcript_sha256]\n      additionalProperties: false\n      properties:\n        handshake:\n          $ref: \"#/components/schemas/TrustedParentBridgeHandshake\"\n        bridge_channel_id: { type: string, minLength: 1 }\n        handshake_transcript_sha256:\n          type: string\n          pattern: '^sha256:[0-9a-f]{64}$'\n        previous_plugin_gateway_token:\n          type: string\n          minLength: 1\n          description: Required only when renewing the current bridge channel lease.\n    BridgeTokenResult:\n      type: object\n      additionalProperties: false\n      required: [plugin_gateway_token, plugin_gateway_token_id, asset_session, asset_session_id, issued_at, expires_at]\n      properties:\n        plugin_gateway_token: { type: string, minLength: 1 }\n        plugin_gateway_token_id: { type: string, minLength: 1 }\n        asset_session: { type: string, minLength: 1 }\n        asset_session_id: { type: string, minLength: 1 }\n        issued_at: { type: string, format: date-time }\n        expires_at: { type: string, format: date-time }\n    ReadSurfaceAssetRequest:\n      type: object\n      additionalProperties: false\n      required: [asset_session, asset_session_id, binding_id]\n      properties:\n        asset_session: { type: string, minLength: 1 }\n        asset_session_id: { type: string, minLength: 1 }\n        binding_id: { type: string, pattern: '^asset_[A-Za-z0-9_-]{8,128}$' }\n    SurfaceAssetResult:\n      type: object\n      additionalProperties: false\n      required: [path, sha256, content_type, content_base64]\n      properties:\n        path: { type: string, minLength: 1 }\n        sha256: { type: string, pattern: '^sha256:[0-9a-f]{64}$' }\n        content_type: { type: string, minLength: 1 }\n        content_base64: { type: string, contentEncoding: base64 }\n    ReadSurfaceStreamRequest:\n      type: object\n      additionalProperties: false\n      required: [stream_id, stream_ticket, read_id]\n      properties:\n        stream_id: { type: string, minLength: 1 }\n        stream_ticket: { type: string, minLength: 1 }\n        read_id: { type: string, pattern: '^read_[A-Za-z0-9_-]{8,128}$' }\n    AcknowledgeSurfaceStreamRequest:\n      type: object\n      additionalProperties: false\n      required: [stream_id, stream_ticket, delivery_id]\n      properties:\n        stream_id: { type: string, minLength: 1 }\n        stream_ticket: { type: string, minLength: 1 }\n        delivery_id: { type: string, pattern: '^delivery_[A-Za-z0-9_-]{8,128}$' }\n    SurfaceStreamResult:\n      type: object\n      additionalProperties: false\n      required: [read_id, events, done]\n      properties:\n        delivery_id: { type: string, pattern: '^delivery_[A-Za-z0-9_-]{8,128}$' }\n        read_id: { type: string, pattern: '^read_[A-Za-z0-9_-]{8,128}$' }\n        events:\n          type: array\n          items:\n            $ref: \"#/components/schemas/StreamEvent\"\n        done: { type: boolean }\n        terminal_status:\n          enum: [closed, canceled, failed, orphaned_after_disable, orphaned_after_uninstall]\n      allOf:\n        - if:\n            properties: { events: { minItems: 1 } }\n            required: [events]\n          then:\n            required: [delivery_id]\n        - if:\n            properties: { done: { const: false } }\n            required: [done]\n          then:\n            not:\n              required: [terminal_status]\n        - if:\n            properties: { done: { const: true } }\n            required: [done]\n          then:\n            required: [delivery_id, terminal_status]\n    SurfaceStreamAcknowledgementResult:\n      type: object\n      required: [acknowledged]\n      additionalProperties: false\n      properties:\n        acknowledged: { const: true }\n    CancelSurfaceOperationRequest:\n      type: object\n      additionalProperties: false\n      required: [operation_id, bridge_channel_id]\n      properties:\n        operation_id: { type: string, pattern: '^operation_[A-Za-z0-9_-]{8,150}$' }\n        bridge_channel_id: { type: string, minLength: 1, maxLength: 256 }\n        reason: { type: string, maxLength: 256 }\n    RejectSurfaceConfirmationRequest:\n      type: object\n      additionalProperties: false\n      required: [plugin_instance_id, bridge_channel_id, plugin_gateway_token, confirmation_id]\n      properties:\n        plugin_instance_id: { type: string, minLength: 1 }\n        bridge_channel_id: { type: string, minLength: 1, maxLength: 256 }\n        plugin_gateway_token: { type: string, minLength: 1 }\n        confirmation_id: { type: string, pattern: '^confirmation_[A-Za-z0-9_-]{8,128}$' }\n    ConfirmationRejectionResult:\n      type: object\n      additionalProperties: false\n      required: [rejected]\n      properties:\n        rejected: { const: true }\n    StreamEvent:\n      type: object\n      additionalProperties: false\n      required: [stream_id, sequence, kind, at]\n      properties:\n        stream_id: { type: string, minLength: 1 }\n        sequence: { type: integer, minimum: 0 }\n        kind: { type: string, minLength: 1 }\n        data: { type: string, contentEncoding: base64 }\n        error: { type: string }\n        at: { type: string, format: date-time }\n    DisposeSurfaceRequest:\n      type: object\n      additionalProperties: false\n      required: [bridge_nonce]\n      properties:\n        bridge_nonce: { type: string, minLength: 16 }\n    RPCRequest:\n      type: object\n      required: [plugin_instance_id, surface_instance_id, bridge_channel_id, plugin_gateway_token, method]\n      additionalProperties: false\n      properties:\n        plugin_instance_id: { type: string, minLength: 1 }\n        surface_instance_id: { type: string, minLength: 1 }\n        bridge_channel_id: { type: string, minLength: 1 }\n        plugin_gateway_token: { type: string, minLength: 1 }\n        confirmation_id: { type: string }\n        method: { type: string, minLength: 1 }\n        params:\n          type: object\n          additionalProperties: true\n    PrepareMethodConfirmationRequest:\n      type: object\n      required: [plugin_instance_id, surface_instance_id, bridge_channel_id, plugin_gateway_token, method]\n      additionalProperties: false\n      properties:\n        plugin_instance_id: { type: string, minLength: 1 }\n        surface_instance_id: { type: string, minLength: 1 }\n        bridge_channel_id: { type: string, minLength: 1 }\n        plugin_gateway_token: { type: string, minLength: 1 }\n        method: { type: string, minLength: 1 }\n        params:\n          type: object\n          additionalProperties: true\n    RPCResult:\n      oneOf:\n        - type: object\n          additionalProperties: false\n          properties:\n            data: true\n          not:\n            anyOf:\n              - required: [operation_id]\n              - required: [stream_id]\n              - required: [confirmation_required]\n        - type: object\n          additionalProperties: false\n          required: [operation_id]\n          properties:\n            data: true\n            operation_id: { type: string, minLength: 1 }\n        - type: object\n          additionalProperties: false\n          required: [operation_id, stream_id, stream_ticket, stream_ticket_id, stream_expires_at]\n          properties:\n            data: true\n            operation_id: { type: string, minLength: 1 }\n            stream_id: { type: string, minLength: 1 }\n            stream_ticket: { type: string, minLength: 1 }\n            stream_ticket_id: { type: string, minLength: 1 }\n            stream_expires_at: { type: string, format: date-time }\n        - type: object\n          additionalProperties: false\n          required: [confirmation_required, confirmation_token_id, request_hash, plan_hash]\n          properties:\n            confirmation_required: { const: true }\n            confirmation_token_id: { type: string, minLength: 1 }\n            request_hash: { type: string, pattern: '^sha256:[0-9a-f]{64}$' }\n            plan_hash: { type: string, pattern: '^sha256:[0-9a-f]{64}$' }\n    RiskFlag:\n      type: object\n      required: [id, severity, summary]\n      additionalProperties: false\n      properties:\n        id:\n          type: string\n          minLength: 1\n          description: Stable machine-readable risk identifier.\n        severity:\n          type: string\n          enum: [info, low, medium, high, critical]\n        summary: { type: string, minLength: 1 }\n        description: { type: string }\n        requires_confirmation: { type: boolean }\n        requires_admin: { type: boolean }\n        data_loss_risk: { type: boolean }\n        destructive: { type: boolean }\n    RiskPlan:\n      type: object\n      required: [schema_version, summary, risk_flags]\n      additionalProperties: false\n      properties:\n        schema_version: { const: redevplugin.capability.risk_plan.v1 }\n        capability_id: { type: string }\n        binding_id: { type: string }\n        method: { type: string }\n        target_method: { type: string }\n        action: { type: string }\n        effect:\n          type: string\n          enum: [read, write, execute, delete, admin]\n        resource_ref: { type: string }\n        resource_display_name: { type: string }\n        summary: { type: string, minLength: 1 }\n        risk_flags:\n          type: array\n          items:\n            $ref: \"#/components/schemas/RiskFlag\"\n        requires_confirmation: { type: boolean }\n        requires_admin: { type: boolean }\n        data_loss_risk: { type: boolean }\n        destructive: { type: boolean }\n        deny_reason: { type: string }\n        details:\n          type: object\n          additionalProperties: true\n    PluginMethodConfirmationPreparation:\n      type: object\n      required: [confirmation_id, confirmation_token_id, request_hash, plan_hash, expires_at]\n      additionalProperties: false\n      properties:\n        confirmation_id: { type: string, minLength: 1 }\n        confirmation_token_id:\n          type: string\n          minLength: 1\n          description: Opaque audit/display id for the server-held confirmation token. It is not a credential.\n        request_hash:\n          type: string\n          pattern: \"^sha256:[0-9a-f]{64}$\"\n        plan_hash:\n          type: string\n          pattern: \"^sha256:[0-9a-f]{64}$\"\n        plan:\n          description: Host-redacted confirmation plan payload returned by the declared preflight method, when available.\n          oneOf:\n            - $ref: \"#/components/schemas/RiskPlan\"\n            - type: object\n              additionalProperties: true\n        expires_at: { type: string, format: date-time }\n    InvokeIntentRequest:\n      type: object\n      required: [intent_id]\n      additionalProperties: false\n      properties:\n        plugin_instance_id: { type: string }\n        intent_id: { type: string, minLength: 1 }\n        params:\n          type: object\n          additionalProperties: true\n    CancelOperationRequest:\n      type: object\n      additionalProperties: false\n      properties:\n        reason: { type: string }\n    CapabilityContractPin:\n      $ref: \"../plugin/host-capability-pin-v1.schema.json\"\n    PublicOperationBinding:\n      type: object\n      description: Public immutable execution evidence embedded into operation responses. Session and bridge channel ownership fields are excluded.\n      required:\n        - invocation_id\n        - audit_correlation_id\n        - publisher_id\n        - plugin_id\n        - plugin_instance_id\n        - plugin_version\n        - active_fingerprint\n        - route_kind\n        - capability_id\n        - capability_version\n        - binding_id\n        - method\n        - target_method\n        - effect\n        - execution\n        - permissions\n        - confirmation\n        - revision\n        - quota\n        - target\n        - target_descriptor_sha256\n      properties:\n        invocation_id: { type: string, minLength: 1 }\n        audit_correlation_id: { type: string, minLength: 1 }\n        operation_id: { type: string, minLength: 1 }\n        stream_id: { type: string, minLength: 1 }\n        publisher_id: { type: string, minLength: 1 }\n        plugin_id: { type: string, minLength: 1 }\n        plugin_instance_id: { type: string, minLength: 1 }\n        plugin_version: { $ref: \"#/components/schemas/StrictSemVer\" }\n        active_fingerprint: { type: string, minLength: 1 }\n        surface_instance_id: { type: string }\n        route_kind: { type: string, enum: [capability, worker, core_action] }\n        capability_id: { type: string, minLength: 1 }\n        capability_version: { $ref: \"#/components/schemas/StrictSemVer\" }\n        binding_id: { type: string, minLength: 1 }\n        contract:\n          $ref: \"#/components/schemas/CapabilityContractPin\"\n        method: { type: string, minLength: 1 }\n        target_method: { type: string, minLength: 1 }\n        effect: { type: string, enum: [read, write, execute, delete, admin] }\n        execution: { type: string, enum: [sync, operation, subscription] }\n        permissions:\n          type: object\n          additionalProperties: false\n          required: [required, granted]\n          properties:\n            required: { type: array, items: { type: string } }\n            granted: { type: array, items: { type: string } }\n        confirmation:\n          type: object\n          additionalProperties: false\n          required: [required, confirmed]\n          properties:\n            required: { type: boolean }\n            confirmed: { type: boolean }\n            confirmation_id: { type: string }\n            request_sha256: { type: string }\n            plan_sha256: { type: string }\n            target_sha256: { type: string }\n        revision:\n          type: object\n          additionalProperties: false\n          required: [policy_revision, management_revision, revoke_epoch]\n          properties:\n            policy_revision: { type: integer, minimum: 0, maximum: 9007199254740991 }\n            management_revision: { type: integer, minimum: 0, maximum: 9007199254740991 }\n            revoke_epoch: { type: integer, minimum: 0, maximum: 9007199254740991 }\n        quota:\n          type: object\n          additionalProperties: false\n          properties:\n            max_concurrent: { type: integer, minimum: 0, maximum: 9007199254740991 }\n            max_duration_ms: { type: integer, minimum: 0, maximum: 9007199254740991 }\n            max_stream_bytes: { type: integer, minimum: 0, maximum: 9007199254740991 }\n            expires_at: { type: string, format: date-time }\n        target:\n          type: object\n          additionalProperties: false\n          required: [kind, fields]\n          properties:\n            kind: { type: string, minLength: 1 }\n            fields: { type: object, additionalProperties: true }\n        target_descriptor_sha256: { type: string, pattern: '^sha256:[0-9a-f]{64}$' }\n        stream_event_type_name: { type: string, minLength: 1 }\n        stream_event_schema_sha256: { type: string, pattern: '^[0-9a-f]{64}$' }\n      oneOf:\n        - required: [route_kind, contract]\n          properties:\n            route_kind: { const: capability }\n        - required: [route_kind]\n          properties:\n            route_kind: { const: worker }\n          not:\n            required: [contract]\n        - required: [route_kind]\n          properties:\n            route_kind: { const: core_action }\n          not:\n            required: [contract]\n    OperationRecord:\n      allOf:\n        - $ref: \"#/components/schemas/PublicOperationBinding\"\n        - type: object\n          required:\n            - operation_id\n            - cancelable\n            - created_at\n            - updated_at\n          properties:\n            operation_id: { type: string, minLength: 1 }\n            execution: { type: string, enum: [operation, subscription] }\n            cancelable: { type: boolean }\n            cancel_ack_timeout_ms: { type: integer, minimum: 0 }\n            disable_behavior: { type: string, enum: [cancel, orphan, wait] }\n            uninstall_behavior: { type: string, enum: [cancel_then_block_delete, force_cleanup_allowed] }\n            created_at: { type: string, format: date-time }\n            updated_at: { type: string, format: date-time }\n            cancel_requested_at: { type: string, format: date-time }\n            orphaned_at: { type: string, format: date-time }\n            terminal_at: { type: string, format: date-time }\n          oneOf:\n            - type: object\n              required: [status, failure_code, reason]\n              properties:\n                status: { const: failed }\n                failure_code: { $ref: \"#/components/schemas/ExecutionFailureCode\" }\n                reason: { const: \"execution failed\" }\n            - type: object\n              required: [status]\n              properties:\n                status:\n                  enum: [running, cancel_requested, canceled, completed, orphaned_after_disable, orphaned_after_uninstall]\n                reason: { type: string }\n              not:\n                required: [failure_code]\n      unevaluatedProperties: false\n    ExecutionFailureCode:\n      type: string\n      enum: [adapter_failed, contract_invalid, platform_failed, quota_exceeded, runtime_failed]\n    StartRuntimeRequest:\n      type: object\n      required: [target]\n      additionalProperties: false\n      properties:\n        target: { $ref: \"#/components/schemas/RuntimeTarget\" }\n    ExportDataRequest:\n      type: object\n      required: [plugin_instance_id]\n      additionalProperties: false\n      properties:\n        plugin_instance_id: { type: string, minLength: 1 }\n    DeleteDataExportRequest:\n      type: object\n      required: [plugin_instance_id, bundle_ref]\n      additionalProperties: false\n      properties:\n        plugin_instance_id: { type: string, minLength: 1 }\n        bundle_ref: { type: string, minLength: 1 }\n    ImportDataRequest:\n      type: object\n      required: [plugin_instance_id, bundle_ref, expected_management_revision]\n      additionalProperties: false\n      properties:\n        plugin_instance_id: { type: string, minLength: 1 }\n        bundle_ref: { type: string, minLength: 1 }\n        expected_management_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n    PluginDataBinding:\n      type: object\n      required: [plugin_instance_id, generation_id, state, revision, shape_hash]\n      additionalProperties: false\n      properties:\n        plugin_instance_id: { type: string, minLength: 1 }\n        generation_id: { type: string, minLength: 1 }\n        state: { type: string, enum: [active, retained] }\n        revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n        shape_hash: { type: string, pattern: \"^[0-9a-f]{64}$\" }\n        retained_at: { type: string, format: date-time }\n        expires_at: { type: string, format: date-time }\n    RetainedDataList:\n      type: object\n      required: [retained_data]\n      additionalProperties: false\n      properties:\n        retained_data:\n          type: array\n          items:\n            $ref: \"#/components/schemas/PluginDataBinding\"\n    RetainedDataCleanupResult:\n      type: object\n      required: [deleted]\n      additionalProperties: false\n      properties:\n        deleted:\n          type: array\n          items:\n            $ref: \"#/components/schemas/PluginDataBinding\"\n    DeleteRetainedDataRequest:\n      type: object\n      required: [plugin_instance_id, expected_binding_revision]\n      additionalProperties: false\n      properties:\n        plugin_instance_id: { type: string, minLength: 1 }\n        expected_binding_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n    BindRetainedDataRequest:\n      type: object\n      required: [source_plugin_instance_id, expected_source_binding_revision, target_plugin_instance_id, target_expected_management_revision]\n      additionalProperties: false\n      properties:\n        source_plugin_instance_id: { type: string, minLength: 1 }\n        expected_source_binding_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n        target_plugin_instance_id: { type: string, minLength: 1 }\n        target_expected_management_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n    CleanupExpiredRetainedDataRequest:\n      type: object\n      additionalProperties: false\n    GrantPermissionRequest:\n      type: object\n      required: [plugin_instance_id, permission_id, expected_policy_revision, expected_management_revision, expected_revoke_epoch]\n      additionalProperties: false\n      properties:\n        plugin_instance_id: { type: string, minLength: 1 }\n        permission_id: { type: string, minLength: 1 }\n        expected_policy_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n        expected_management_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n        expected_revoke_epoch: { type: integer, minimum: 0, maximum: 9007199254740991 }\n        expires_at: { type: string, format: date-time }\n    RevokePermissionRequest:\n      type: object\n      required: [plugin_instance_id, permission_id, expected_policy_revision, expected_management_revision, expected_revoke_epoch]\n      additionalProperties: false\n      properties:\n        plugin_instance_id: { type: string, minLength: 1 }\n        permission_id: { type: string, minLength: 1 }\n        expected_policy_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n        expected_management_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n        expected_revoke_epoch: { type: integer, minimum: 0, maximum: 9007199254740991 }\n        reason: { type: string }\n    PutSecurityPolicyRequest:\n      type: object\n      required: [expected_policy_revision, expected_management_revision, expected_revoke_epoch, allowed_permissions, denied_methods]\n      additionalProperties: false\n      properties:\n        expected_policy_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n        expected_management_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n        expected_revoke_epoch: { type: integer, minimum: 0, maximum: 9007199254740991 }\n        allowed_permissions:\n          type: array\n          uniqueItems: true\n          items: { type: string, minLength: 1 }\n        denied_methods:\n          type: array\n          uniqueItems: true\n          items: { type: string, minLength: 1 }\n    DeleteSecurityPolicyRequest:\n      type: object\n      required: [expected_policy_revision, expected_management_revision, expected_revoke_epoch]\n      additionalProperties: false\n      properties:\n        expected_policy_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n        expected_management_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n        expected_revoke_epoch: { type: integer, minimum: 0, maximum: 9007199254740991 }\n    SecretRefRequest:\n      type: object\n      required: [plugin_instance_id, secret_ref, scope]\n      additionalProperties: false\n      properties:\n        plugin_instance_id: { type: string, minLength: 1 }\n        secret_ref: { type: string, minLength: 1 }\n        scope: { type: string, enum: [user, environment] }\n    ResourceScopeKind:\n      type: string\n      enum: [user, environment]\n    PatchSettingsRequest:\n      type: object\n      required: [scope, expected_values_revision]\n      additionalProperties: false\n      minProperties: 3\n      properties:\n        scope: { $ref: \"#/components/schemas/ResourceScopeKind\" }\n        expected_values_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n        set:\n          type: object\n          minProperties: 1\n          additionalProperties: true\n        remove:\n          type: array\n          minItems: 1\n          uniqueItems: true\n          items: { type: string, minLength: 1 }\n";
+    readonly sha256: "39bcfcfb846c868945ab0d21404747b2f5f083574c7ead5aca64f65b98212b7d";
+    readonly body: "openapi: 3.1.0\ninfo:\n  title: ReDevPlugin Plugin Platform API\n  version: plugin-platform-v8\n  description: Host-agnostic plugin management, bridge, operation, data, and sandbox routes. Release-ref install and update routes resolve host-controlled package artifacts server-side and do not accept requested trust_state values; external package URL, GitHub repository, and uploaded-package inspection flows derive package identity and trust facts server-side before reusing the shared commit/query lifecycle; local-import package install/update routes remain explicit developer/import flows and do not accept caller-supplied trust_state values.\nx-redevplugin-query-policy:\n  reject_url_query_strings: true\n  require_closed_json_bodies: true\n  require_exact_origin: true\n  require_csrf: true\npaths:\n  /_redevplugin/api/plugins/{plugin_instance_id}/local-import:\n    post:\n      operationId: importLocalPackage\n      x-redevplugin-route-effect: mutation\n      parameters:\n        - $ref: \"#/components/parameters/PluginInstanceID\"\n      requestBody:\n        required: true\n        content:\n          application/vnd.redevplugin.package+zip:\n            schema: { type: string, format: binary }\n      responses:\n        \"200\": { $ref: \"#/components/responses/PluginRecordResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n    put:\n      operationId: updateLocalPackage\n      x-redevplugin-route-effect: mutation\n      parameters:\n        - $ref: \"#/components/parameters/PluginInstanceID\"\n        - name: X-ReDevPlugin-Expected-Management-Revision\n          in: header\n          required: true\n          description: Canonical decimal management revision. Duplicate, combined, empty, or whitespace-padded values are rejected.\n          schema: { type: integer, minimum: 1, maximum: 9007199254740991 }\n      requestBody:\n        required: true\n        content:\n          application/vnd.redevplugin.package+zip:\n            schema: { type: string, format: binary }\n      responses:\n        \"200\": { $ref: \"#/components/responses/PluginRecordResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/external-packages/inspect:\n    post:\n      operationId: inspectExternalPackage\n      x-redevplugin-route-effect: mutation\n      description: Resolves and inspects a package from a caller-selected URL or GitHub repository without installing it. Package identity, hashes, provenance, signature state, approval, and update eligibility are computed by the platform and cannot be supplied by the caller.\n      requestBody:\n        $ref: \"#/components/requestBodies/InspectExternalPackageRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/ExternalPackageInspectionResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/external-packages/upload/inspect:\n    post:\n      operationId: inspectUploadedExternalPackageInstall\n      x-redevplugin-route-effect: mutation\n      description: Uploads and inspects a package for installation without committing it. Package identity, hashes, provenance, signature state, approval, and update eligibility are computed by the platform and cannot be supplied by the caller. The returned inspection is committed and reconciled through the shared external-package commit/query routes.\n      requestBody:\n        required: true\n        content:\n          application/vnd.redevplugin.package+zip:\n            schema: { type: string, format: binary }\n      responses:\n        \"200\": { $ref: \"#/components/responses/ExternalPackageInspectionResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/{plugin_instance_id}/external-packages/upload/inspect:\n    put:\n      operationId: inspectUploadedExternalPackageUpdate\n      x-redevplugin-route-effect: mutation\n      description: Uploads and inspects a package for an optimistic-concurrency-controlled update without committing it. Package identity, hashes, provenance, signature state, approval, and update eligibility are computed by the platform and cannot be supplied by the caller. The returned inspection is committed and reconciled through the shared external-package commit/query routes.\n      parameters:\n        - $ref: \"#/components/parameters/PluginInstanceID\"\n        - name: X-ReDevPlugin-Expected-Management-Revision\n          in: header\n          required: true\n          description: Canonical decimal management revision. Duplicate, combined, empty, or whitespace-padded values are rejected.\n          schema: { type: integer, minimum: 1, maximum: 9007199254740991 }\n      requestBody:\n        required: true\n        content:\n          application/vnd.redevplugin.package+zip:\n            schema: { type: string, format: binary }\n      responses:\n        \"200\": { $ref: \"#/components/responses/ExternalPackageInspectionResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/external-packages/commit:\n    post:\n      operationId: commitExternalPackage\n      x-redevplugin-route-effect: mutation\n      description: Commits one unexpired inspection after the user confirms its exact server-computed digest. An absent signature does not make a package ineligible for installation; signature assessment affects trust classification and automatic-update eligibility only.\n      requestBody:\n        $ref: \"#/components/requestBodies/CommitExternalPackageRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/ExternalPackageCommitResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/external-packages/commit/query:\n    post:\n      operationId: queryExternalPackageCommit\n      x-redevplugin-route-effect: query\n      description: Reconciles the commit result for one inspection without repeating the mutation.\n      requestBody:\n        $ref: \"#/components/requestBodies/QueryExternalPackageCommitRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/ExternalPackageCommitResponse\" }\n        default: { $ref: \"#/components/responses/PlatformErrorResponse\" }\n  /_redevplugin/api/plugins/install-release-ref:\n    post:\n      operationId: installReleaseRef\n      x-redevplugin-route-effect: mutation\n      requestBody:\n        $ref: \"#/components/requestBodies/InstallReleaseRefRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/PluginRecordResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/enable:\n    post:\n      operationId: enablePlugin\n      x-redevplugin-route-effect: mutation\n      requestBody:\n        $ref: \"#/components/requestBodies/EnableRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/PluginRecordResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/disable:\n    post:\n      operationId: disablePlugin\n      x-redevplugin-route-effect: mutation\n      requestBody:\n        $ref: \"#/components/requestBodies/DisableRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/PluginRecordResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/uninstall:\n    post:\n      operationId: uninstallPlugin\n      x-redevplugin-route-effect: mutation\n      requestBody:\n        $ref: \"#/components/requestBodies/UninstallRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/PluginRecordResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/update-release-ref:\n    post:\n      operationId: updateReleaseRef\n      x-redevplugin-route-effect: mutation\n      requestBody:\n        $ref: \"#/components/requestBodies/UpdateReleaseRefRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/PluginRecordResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/downgrade:\n    post:\n      operationId: downgradePlugin\n      x-redevplugin-route-effect: mutation\n      requestBody:\n        $ref: \"#/components/requestBodies/DowngradeRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/PluginRecordResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/catalog/query:\n    post:\n      operationId: listPlugins\n      x-redevplugin-route-effect: query\n      requestBody:\n        $ref: \"#/components/requestBodies/EmptyQueryRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/PluginCatalogResponse\" }\n        default: { $ref: \"#/components/responses/PlatformErrorResponse\" }\n  /_redevplugin/api/plugins/features/query:\n    post:\n      operationId: getPluginFeatures\n      x-redevplugin-route-effect: query\n      requestBody:\n        $ref: \"#/components/requestBodies/EmptyQueryRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/PluginFeaturesResponse\" }\n        default: { $ref: \"#/components/responses/PlatformErrorResponse\" }\n  /_redevplugin/api/plugins/platform/compatibility/query:\n    post:\n      operationId: getPluginPlatformCompatibility\n      x-redevplugin-route-effect: query\n      description: Returns the host-consumable ReDevPlugin compatibility manifest for the mounted platform artifact set.\n      requestBody:\n        $ref: \"#/components/requestBodies/EmptyQueryRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/CompatibilityResponse\" }\n        default: { $ref: \"#/components/responses/PlatformErrorResponse\" }\n  /_redevplugin/api/plugins/surfaces/open:\n    post:\n      operationId: openPluginSurface\n      x-redevplugin-route-effect: mutation\n      requestBody:\n        $ref: \"#/components/requestBodies/OpenSurfaceRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/SurfaceBootstrapResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/session/revoke-scope:\n    post:\n      operationId: revokePluginSessionScope\n      x-redevplugin-route-effect: mutation\n      description: Irreversibly fences the authenticated session, drains every exact-session platform and runtime resource, and returns only public cumulative counts.\n      requestBody:\n        $ref: \"#/components/requestBodies/RevokeSessionScopeRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/SessionScopeRevokeResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/surfaces/{surface_instance_id}/prepare:\n    post:\n      operationId: preparePluginSurface\n      x-redevplugin-route-effect: mutation\n      parameters:\n        - $ref: \"#/components/parameters/SurfaceInstanceID\"\n      requestBody:\n        $ref: \"#/components/requestBodies/PrepareSurfaceRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/SurfacePreparationResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/surfaces/{surface_instance_id}/bridge-token:\n    post:\n      operationId: createSurfaceBridgeToken\n      x-redevplugin-route-effect: mutation\n      parameters:\n        - $ref: \"#/components/parameters/SurfaceInstanceID\"\n      requestBody:\n        $ref: \"#/components/requestBodies/TrustedParentBridgeTokenRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/BridgeTokenResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/surfaces/{surface_instance_id}/assets/read:\n    post:\n      operationId: readPreparedSurfaceAsset\n      x-redevplugin-route-effect: query\n      parameters:\n        - $ref: \"#/components/parameters/SurfaceInstanceID\"\n      requestBody:\n        $ref: \"#/components/requestBodies/ReadSurfaceAssetRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/SurfaceAssetResponse\" }\n        default: { $ref: \"#/components/responses/PlatformErrorResponse\" }\n  /_redevplugin/api/plugins/surfaces/{surface_instance_id}/streams/read:\n    post:\n      operationId: readPreparedSurfaceStream\n      x-redevplugin-route-effect: query\n      parameters:\n        - $ref: \"#/components/parameters/SurfaceInstanceID\"\n      requestBody:\n        $ref: \"#/components/requestBodies/ReadSurfaceStreamRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/SurfaceStreamResponse\" }\n        default: { $ref: \"#/components/responses/PlatformErrorResponse\" }\n  /_redevplugin/api/plugins/surfaces/{surface_instance_id}/streams/ack:\n    post:\n      operationId: acknowledgePreparedSurfaceStream\n      x-redevplugin-route-effect: mutation\n      parameters:\n        - $ref: \"#/components/parameters/SurfaceInstanceID\"\n      requestBody:\n        $ref: \"#/components/requestBodies/AcknowledgeSurfaceStreamRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/SurfaceStreamAcknowledgementResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/surfaces/{surface_instance_id}/operations/cancel:\n    post:\n      operationId: cancelSurfacePluginOperation\n      x-redevplugin-route-effect: mutation\n      description: Cancels an operation only when it belongs to the authenticated surface, session, and private bridge channel.\n      parameters:\n        - $ref: \"#/components/parameters/SurfaceInstanceID\"\n      requestBody:\n        $ref: \"#/components/requestBodies/CancelSurfaceOperationRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/OperationRecordResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/surfaces/{surface_instance_id}/confirmations/reject:\n    post:\n      operationId: rejectSurfacePluginConfirmation\n      x-redevplugin-route-effect: mutation\n      description: Atomically rejects a pending confirmation only when it belongs to the authenticated surface, session, current plugin revision, and private bridge channel.\n      parameters:\n        - $ref: \"#/components/parameters/SurfaceInstanceID\"\n      requestBody:\n        $ref: \"#/components/requestBodies/RejectSurfaceConfirmationRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/ConfirmationRejectionResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/surfaces/{surface_instance_id}/dispose:\n    post:\n      operationId: disposePluginSurface\n      x-redevplugin-route-effect: mutation\n      parameters:\n        - $ref: \"#/components/parameters/SurfaceInstanceID\"\n      requestBody:\n        $ref: \"#/components/requestBodies/DisposeSurfaceRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/SurfaceDisposeResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/rpc:\n    post:\n      operationId: callPluginMethod\n      x-redevplugin-route-effect: mutation\n      requestBody:\n        $ref: \"#/components/requestBodies/RPCRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/RPCResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/confirmations/prepare:\n    post:\n      operationId: preparePluginMethodConfirmation\n      x-redevplugin-route-effect: mutation\n      requestBody:\n        $ref: \"#/components/requestBodies/PrepareMethodConfirmationRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/PluginMethodConfirmationPreparationResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/intents/query:\n    post:\n      operationId: listPluginIntents\n      x-redevplugin-route-effect: query\n      description: 'Lists enabled, runnable plugin intents available to host-mediated interop. The response data is `{ \"intents\": [...] }`.'\n      requestBody:\n        $ref: \"#/components/requestBodies/ListIntentsQueryRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/IntentListResponse\" }\n        default: { $ref: \"#/components/responses/PlatformErrorResponse\" }\n  /_redevplugin/api/plugins/intents/invoke:\n    post:\n      operationId: invokePluginIntent\n      x-redevplugin-route-effect: mutation\n      description: Invokes a host-mediated plugin intent without iframe gateway tokens while preserving local policy, permission grants, and dangerous-method fail-closed checks.\n      requestBody:\n        $ref: \"#/components/requestBodies/InvokeIntentRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/RPCResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/operations/query:\n    post:\n      operationId: listPluginOperations\n      x-redevplugin-route-effect: query\n      requestBody:\n        $ref: \"#/components/requestBodies/ListOperationsQueryRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/OperationListResponse\" }\n        default: { $ref: \"#/components/responses/PlatformErrorResponse\" }\n  /_redevplugin/api/plugins/operations/{operation_id}/query:\n    post:\n      operationId: getPluginOperation\n      x-redevplugin-route-effect: query\n      parameters:\n        - $ref: \"#/components/parameters/OperationID\"\n      requestBody:\n        $ref: \"#/components/requestBodies/EmptyQueryRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/OperationRecordResponse\" }\n        default: { $ref: \"#/components/responses/PlatformErrorResponse\" }\n  /_redevplugin/api/plugins/operations/{operation_id}/cancel:\n    post:\n      operationId: cancelPluginOperation\n      x-redevplugin-route-effect: mutation\n      parameters:\n        - $ref: \"#/components/parameters/OperationID\"\n      requestBody:\n        $ref: \"#/components/requestBodies/CancelOperationRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/OperationRecordResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/runtime/start:\n    post:\n      operationId: startPluginRuntime\n      x-redevplugin-route-effect: mutation\n      requestBody:\n        $ref: \"#/components/requestBodies/StartRuntimeRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/RuntimeHealthResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/runtime/stop:\n    post:\n      operationId: stopPluginRuntime\n      x-redevplugin-route-effect: mutation\n      requestBody:\n        $ref: \"#/components/requestBodies/EmptyRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/RuntimeStopResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/runtime/refresh-enabled:\n    post:\n      operationId: refreshEnabledPluginRuntimeState\n      x-redevplugin-route-effect: mutation\n      description: 'Replays runtime-derived state for enabled plugins after the embedding host process restarts or reattaches adapters. The response data is `{ \"results\": [...] }`.'\n      requestBody:\n        $ref: \"#/components/requestBodies/EmptyRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/RuntimeRefreshResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/runtime/health/query:\n    post:\n      operationId: getPluginRuntimeHealth\n      x-redevplugin-route-effect: query\n      requestBody:\n        $ref: \"#/components/requestBodies/EmptyQueryRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/RuntimeHealthResponse\" }\n        default: { $ref: \"#/components/responses/PlatformErrorResponse\" }\n  /_redevplugin/api/plugins/data/export:\n    post:\n      operationId: exportPluginData\n      x-redevplugin-route-effect: mutation\n      requestBody:\n        $ref: \"#/components/requestBodies/ExportDataRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/DataExportResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/data/export/delete:\n    post:\n      operationId: deletePluginDataExport\n      x-redevplugin-route-effect: mutation\n      requestBody:\n        $ref: \"#/components/requestBodies/DeleteDataExportRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/DataExportDeleteResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/data/import:\n    post:\n      operationId: importPluginData\n      x-redevplugin-route-effect: mutation\n      requestBody:\n        $ref: \"#/components/requestBodies/ImportDataRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/DataImportResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/retained-data/query:\n    post:\n      operationId: listPluginRetainedData\n      x-redevplugin-route-effect: query\n      requestBody:\n        $ref: \"#/components/requestBodies/ListRetainedDataQueryRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/RetainedDataListResponse\" }\n        default: { $ref: \"#/components/responses/PlatformErrorResponse\" }\n  /_redevplugin/api/plugins/retained-data/delete:\n    post:\n      operationId: deletePluginRetainedData\n      x-redevplugin-route-effect: mutation\n      requestBody:\n        $ref: \"#/components/requestBodies/DeleteRetainedDataRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/RetainedDataBindingResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/retained-data/bind:\n    post:\n      operationId: bindPluginRetainedData\n      x-redevplugin-route-effect: mutation\n      requestBody:\n        $ref: \"#/components/requestBodies/BindRetainedDataRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/RetainedDataBindingResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/retained-data/cleanup-expired:\n    post:\n      operationId: cleanupExpiredPluginRetainedData\n      x-redevplugin-route-effect: mutation\n      requestBody:\n        $ref: \"#/components/requestBodies/CleanupExpiredRetainedDataRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/RetainedDataCleanupResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/permissions/query:\n    post:\n      operationId: listPluginPermissionGrants\n      x-redevplugin-route-effect: query\n      requestBody:\n        $ref: \"#/components/requestBodies/ListPermissionsQueryRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/PermissionListResponse\" }\n        default: { $ref: \"#/components/responses/PlatformErrorResponse\" }\n  /_redevplugin/api/plugins/permissions/grant:\n    post:\n      operationId: grantPluginPermission\n      x-redevplugin-route-effect: mutation\n      requestBody:\n        $ref: \"#/components/requestBodies/GrantPermissionRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/PermissionMutationResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/permissions/revoke:\n    post:\n      operationId: revokePluginPermission\n      x-redevplugin-route-effect: mutation\n      requestBody:\n        $ref: \"#/components/requestBodies/RevokePermissionRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/PermissionMutationResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/security-policies/query:\n    post:\n      operationId: listPluginSecurityPolicies\n      x-redevplugin-route-effect: query\n      requestBody:\n        $ref: \"#/components/requestBodies/EmptyQueryRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/SecurityPolicyListResponse\" }\n        default: { $ref: \"#/components/responses/PlatformErrorResponse\" }\n  /_redevplugin/api/plugins/security-policies/{plugin_instance_id}/query:\n    post:\n      operationId: getPluginSecurityPolicy\n      x-redevplugin-route-effect: query\n      parameters:\n        - $ref: \"#/components/parameters/PluginInstanceID\"\n      requestBody:\n        $ref: \"#/components/requestBodies/EmptyQueryRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/SecurityPolicyRecordResponse\" }\n        default: { $ref: \"#/components/responses/PlatformErrorResponse\" }\n  /_redevplugin/api/plugins/security-policies/{plugin_instance_id}:\n    put:\n      operationId: putPluginSecurityPolicy\n      x-redevplugin-route-effect: mutation\n      parameters:\n        - $ref: \"#/components/parameters/PluginInstanceID\"\n      requestBody:\n        $ref: \"#/components/requestBodies/PutSecurityPolicyRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/SecurityPolicyRecordResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n    delete:\n      operationId: deletePluginSecurityPolicy\n      x-redevplugin-route-effect: mutation\n      parameters:\n        - $ref: \"#/components/parameters/PluginInstanceID\"\n      requestBody:\n        $ref: \"#/components/requestBodies/DeleteSecurityPolicyRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/SecurityPolicyDeleteResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/diagnostics/query:\n    post:\n      operationId: listPluginDiagnosticEvents\n      x-redevplugin-route-effect: query\n      requestBody:\n        $ref: \"#/components/requestBodies/ListDiagnosticsQueryRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/DiagnosticEventListResponse\" }\n        default: { $ref: \"#/components/responses/PlatformErrorResponse\" }\n  /_redevplugin/api/plugins/secrets/bind:\n    post:\n      operationId: bindPluginSecret\n      x-redevplugin-route-effect: mutation\n      requestBody:\n        $ref: \"#/components/requestBodies/SecretRefRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/SecretBindResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/secrets/test:\n    post:\n      operationId: testPluginSecret\n      x-redevplugin-route-effect: mutation\n      requestBody:\n        $ref: \"#/components/requestBodies/SecretRefRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/SecretTestResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/secrets/delete:\n    post:\n      operationId: deletePluginSecret\n      x-redevplugin-route-effect: mutation\n      requestBody:\n        $ref: \"#/components/requestBodies/SecretRefRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/SecretDeleteResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\n  /_redevplugin/api/plugins/{plugin_instance_id}/settings/schema/query:\n    post:\n      operationId: getPluginSettingsSchema\n      x-redevplugin-route-effect: query\n      parameters:\n        - $ref: \"#/components/parameters/PluginInstanceID\"\n      requestBody:\n        $ref: \"#/components/requestBodies/SettingsQueryRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/SettingsSchemaResponse\" }\n        default: { $ref: \"#/components/responses/PlatformErrorResponse\" }\n  /_redevplugin/api/plugins/{plugin_instance_id}/settings/query:\n    post:\n      operationId: getPluginSettings\n      x-redevplugin-route-effect: query\n      parameters:\n        - $ref: \"#/components/parameters/PluginInstanceID\"\n      requestBody:\n        $ref: \"#/components/requestBodies/SettingsQueryRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/SettingsSnapshotResponse\" }\n        default: { $ref: \"#/components/responses/PlatformErrorResponse\" }\n  /_redevplugin/api/plugins/{plugin_instance_id}/settings:\n    patch:\n      operationId: patchPluginSettings\n      x-redevplugin-route-effect: mutation\n      parameters:\n        - $ref: \"#/components/parameters/PluginInstanceID\"\n      requestBody:\n        $ref: \"#/components/requestBodies/PatchSettingsRequest\"\n      responses:\n        \"200\": { $ref: \"#/components/responses/SettingsSnapshotResponse\" }\n        default: { $ref: \"#/components/responses/MutationPlatformErrorResponse\" }\ncomponents:\n  parameters:\n    OperationID:\n      name: operation_id\n      in: path\n      required: true\n      schema: { type: string }\n    PluginInstanceID:\n      name: plugin_instance_id\n      in: path\n      required: true\n      schema:\n        type: string\n        minLength: 1\n        pattern: \"^[^./\\\\s](?:[^/]*[^/\\\\s])?$\"\n    SurfaceInstanceID:\n      name: surface_instance_id\n      in: path\n      required: true\n      schema: { type: string }\n  responses:\n    PlatformErrorResponse:\n      description: Closed non-success response for read-only platform operations.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/PlatformErrorResponse\"\n    MutationPlatformErrorResponse:\n      description: Closed non-success response for operations that may change durable platform state.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/MutationPlatformErrorResponse\"\n    RPCResponse:\n      description: Typed plugin method result. Subscriptions always bind one operation and one stream.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/RPCSuccessResponse\"\n    SurfaceBootstrapResponse:\n      description: Trusted-parent surface bootstrap. Capability-bearing fields are never forwarded into the opaque iframe or plugin worker.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/SurfaceBootstrapSuccessResponse\"\n    SurfacePreparationResponse:\n      description: Trusted-parent asset-session exchange and validated opaque surface document.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/SurfacePreparationSuccessResponse\"\n    BridgeTokenResponse:\n      description: Trusted-parent plugin gateway token response.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/BridgeTokenSuccessResponse\"\n    SurfaceAssetResponse:\n      description: Trusted-parent package asset response. The plugin receives only a renderer-created blob URL.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/SurfaceAssetSuccessResponse\"\n    SurfaceStreamResponse:\n      description: Trusted-parent stream redemption response. Stream tickets remain outside the plugin worker.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/SurfaceStreamSuccessResponse\"\n    SurfaceStreamAcknowledgementResponse:\n      description: Confirms one exact stream delivery so the platform may release its events.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/SurfaceStreamAcknowledgementSuccessResponse\"\n    SurfaceDisposeResponse:\n      description: Surface revocation response.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/SurfaceDisposeSuccessResponse\"\n    SessionScopeRevokeResponse:\n      description: Completed authenticated-session teardown response.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/SessionScopeRevokeSuccessResponse\"\n    PluginRecordResponse:\n      description: Plugin lifecycle response with typed registry trust assessment.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/PluginRecordSuccessResponse\"\n    ExternalPackageInspectionResponse:\n      description: Immutable server-computed package inspection and confirmation boundary.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/ExternalPackageInspectionSuccessResponse\"\n    ExternalPackageCommitResponse:\n      description: External package commit reconciliation result with explicit trust, approval, provenance, and update facts.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/ExternalPackageCommitSuccessResponse\"\n    PluginCatalogResponse:\n      description: Installed plugin catalog response with typed registry records.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/PluginCatalogSuccessResponse\"\n    PluginFeaturesResponse:\n      description: Closed set of optional host modules configured for this platform.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/PluginFeaturesSuccessResponse\"\n    CompatibilityResponse:\n      description: Released platform compatibility manifest.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/CompatibilitySuccessResponse\"\n    PluginMethodConfirmationPreparationResponse:\n      description: Prepared plugin method confirmation. The raw confirmation token stays server-side and is never returned to parent JavaScript or the plugin iframe.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/PluginMethodConfirmationPreparationSuccessResponse\"\n    ConfirmationRejectionResponse:\n      description: Trusted-parent acknowledgement that the pending confirmation was atomically rejected and cannot be replayed.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/ConfirmationRejectionSuccessResponse\"\n    IntentListResponse:\n      description: Enabled plugin intent records.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/IntentListSuccessResponse\"\n    RetainedDataListResponse:\n      description: Retained plugin data list response.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/RetainedDataListSuccessResponse\"\n    RetainedDataBindingResponse:\n      description: Plugin data binding returned after a retained-data mutation.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/RetainedDataBindingSuccessResponse\"\n    RetainedDataCleanupResponse:\n      description: Retained plugin data cleanup response.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/RetainedDataCleanupSuccessResponse\"\n    OperationRecordResponse:\n      description: Host-owned operation record with its immutable execution binding.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/OperationRecordSuccessResponse\"\n    OperationListResponse:\n      description: Host-owned operation records with immutable execution bindings.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/OperationListSuccessResponse\"\n    RuntimeHealthResponse:\n      description: Runtime manager and shard health.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/RuntimeHealthSuccessResponse\"\n    RuntimeStopResponse:\n      description: Runtime manager stop acknowledgement.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/RuntimeStopSuccessResponse\"\n    RuntimeRefreshResponse:\n      description: Enabled plugin runtime refresh result.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/RuntimeRefreshSuccessResponse\"\n    DataExportResponse:\n      description: Plugin data export result.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/DataExportSuccessResponse\"\n    DataExportDeleteResponse:\n      description: Immutable plugin data export deletion acknowledgement.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/DataExportDeleteSuccessResponse\"\n    DataImportResponse:\n      description: Plugin record after the imported dataset becomes active.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/PluginRecordSuccessResponse\"\n    PermissionListResponse:\n      description: Permission grants for the requested plugin scope.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/PermissionListSuccessResponse\"\n    PermissionMutationResponse:\n      description: Permission grant mutation result.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/PermissionMutationSuccessResponse\"\n    SecurityPolicyListResponse:\n      description: Complete list of configured plugin security policies.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/SecurityPolicyListSuccessResponse\"\n    SecurityPolicyRecordResponse:\n      description: Complete security policy for one plugin instance.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/SecurityPolicyRecordSuccessResponse\"\n    SecurityPolicyDeleteResponse:\n      description: Security policy deletion acknowledgement.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/SecurityPolicyDeleteSuccessResponse\"\n    DiagnosticEventListResponse:\n      description: Diagnostic events matching the requested filters.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/DiagnosticEventListSuccessResponse\"\n    SecretBindResponse:\n      description: Secret reference bind acknowledgement.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/SecretBindSuccessResponse\"\n    SecretTestResponse:\n      description: Secret reference test acknowledgement.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/SecretTestSuccessResponse\"\n    SecretDeleteResponse:\n      description: Secret reference deletion acknowledgement.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/SecretDeleteSuccessResponse\"\n    SettingsSchemaResponse:\n      description: Plugin settings schema.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/SettingsSchemaSuccessResponse\"\n    SettingsSnapshotResponse:\n      description: Plugin settings snapshot.\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/SettingsSnapshotSuccessResponse\"\n  requestBodies:\n    InspectExternalPackageRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/InspectExternalPackageRequest\"\n    CommitExternalPackageRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/CommitExternalPackageRequest\"\n    QueryExternalPackageCommitRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/QueryExternalPackageCommitRequest\"\n    InstallReleaseRefRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/InstallReleaseRefRequest\"\n    UpdateReleaseRefRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/UpdateReleaseRefRequest\"\n    DowngradeRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/DowngradeRequest\"\n    EnableRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/EnableRequest\"\n    DisableRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/DisableRequest\"\n    UninstallRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/UninstallRequest\"\n    OpenSurfaceRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/OpenSurfaceRequest\"\n    RevokeSessionScopeRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/RevokeSessionScopeRequest\"\n    EmptyRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/EmptyRequest\"\n    EmptyQueryRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/EmptyQueryRequest\"\n    ListIntentsQueryRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/ListIntentsQueryRequest\"\n    ListOperationsQueryRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/ListOperationsQueryRequest\"\n    ListRetainedDataQueryRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/ListRetainedDataQueryRequest\"\n    ListPermissionsQueryRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/ListPermissionsQueryRequest\"\n    ListDiagnosticsQueryRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/ListDiagnosticsQueryRequest\"\n    SettingsQueryRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/SettingsQueryRequest\"\n    PrepareSurfaceRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/PrepareSurfaceRequest\"\n    TrustedParentBridgeTokenRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/TrustedParentBridgeTokenRequest\"\n    ReadSurfaceAssetRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/ReadSurfaceAssetRequest\"\n    ReadSurfaceStreamRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/ReadSurfaceStreamRequest\"\n    AcknowledgeSurfaceStreamRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/AcknowledgeSurfaceStreamRequest\"\n    CancelSurfaceOperationRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/CancelSurfaceOperationRequest\"\n    RejectSurfaceConfirmationRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/RejectSurfaceConfirmationRequest\"\n    DisposeSurfaceRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/DisposeSurfaceRequest\"\n    RPCRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/RPCRequest\"\n    PrepareMethodConfirmationRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/PrepareMethodConfirmationRequest\"\n    InvokeIntentRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/InvokeIntentRequest\"\n    CancelOperationRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/CancelOperationRequest\"\n    StartRuntimeRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/StartRuntimeRequest\"\n    ExportDataRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/ExportDataRequest\"\n    DeleteDataExportRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/DeleteDataExportRequest\"\n    ImportDataRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/ImportDataRequest\"\n    DeleteRetainedDataRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/DeleteRetainedDataRequest\"\n    BindRetainedDataRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/BindRetainedDataRequest\"\n    CleanupExpiredRetainedDataRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/CleanupExpiredRetainedDataRequest\"\n    GrantPermissionRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/GrantPermissionRequest\"\n    RevokePermissionRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/RevokePermissionRequest\"\n    PutSecurityPolicyRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/PutSecurityPolicyRequest\"\n    DeleteSecurityPolicyRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/DeleteSecurityPolicyRequest\"\n    SecretRefRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/SecretRefRequest\"\n    PatchSettingsRequest:\n      required: true\n      content:\n        application/json:\n          schema:\n            $ref: \"#/components/schemas/PatchSettingsRequest\"\n  schemas:\n    PlatformErrorResponse:\n      type: object\n      required: [ok, error]\n      additionalProperties: false\n      properties:\n        ok: { const: false }\n        error:\n          $ref: \"#/components/schemas/PlatformError\"\n    MutationPlatformErrorResponse:\n      type: object\n      required: [ok, error]\n      additionalProperties: false\n      properties:\n        ok: { const: false }\n        error:\n          $ref: \"#/components/schemas/MutationPlatformError\"\n    RPCSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/RPCResult\" }\n    SurfaceBootstrapSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/SurfaceBootstrap\" }\n    SurfacePreparationSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/SurfacePreparation\" }\n    BridgeTokenSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/BridgeTokenResult\" }\n    SurfaceAssetSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/SurfaceAssetResult\" }\n    SurfaceStreamSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/SurfaceStreamResult\" }\n    SurfaceStreamAcknowledgementSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/SurfaceStreamAcknowledgementResult\" }\n    SurfaceDisposeSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/SurfaceDisposeResult\" }\n    SessionScopeRevokeSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/SessionScopeRevokeCompleteResult\" }\n    PluginRecordSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/PluginRecord\" }\n    ExternalPackageInspectionSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/ExternalPackageInspection\" }\n    ExternalPackageCommitSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/ExternalPackageCommitResult\" }\n    PluginCatalogSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/PluginCatalogResult\" }\n    PluginFeaturesSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data:\n          type: array\n          uniqueItems: true\n          items:\n            type: string\n            enum: [release, runtime, capability, connectivity, secrets, core_action, external_package]\n    CompatibilitySuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/PluginCompatibilityManifest\" }\n    PluginMethodConfirmationPreparationSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/PluginMethodConfirmationPreparation\" }\n    ConfirmationRejectionSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/ConfirmationRejectionResult\" }\n    IntentListSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/PluginIntentList\" }\n    RetainedDataListSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/RetainedDataList\" }\n    RetainedDataBindingSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/PluginDataBinding\" }\n    RetainedDataCleanupSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/RetainedDataCleanupResult\" }\n    OperationRecordSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/OperationRecord\" }\n    OperationListSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/PluginOperationList\" }\n    RuntimeHealthSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/PluginRuntimeHealth\" }\n    RuntimeStopSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/PluginRuntimeStopResult\" }\n    RuntimeRefreshSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/PluginRuntimeRefreshResult\" }\n    DataExportSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/PluginDataExportResult\" }\n    DataExportDeleteSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/PluginDataExportDeleteResult\" }\n    PermissionListSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/PluginPermissionList\" }\n    PermissionMutationSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/PluginPermissionMutationResult\" }\n    SecurityPolicyListSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/PluginSecurityPolicyList\" }\n    SecurityPolicyRecordSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/PluginSecurityPolicy\" }\n    SecurityPolicyDeleteSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/PluginSecurityPolicyDeleteResult\" }\n    DiagnosticEventListSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/PluginDiagnosticEventList\" }\n    SecretBindSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/PluginSecretBindResult\" }\n    SecretTestSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/PluginSecretTestResult\" }\n    SecretDeleteSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/PluginSecretDeleteResult\" }\n    SettingsSchemaSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/PluginSettingsSchema\" }\n    SettingsSnapshotSuccessResponse:\n      type: object\n      required: [ok, data]\n      additionalProperties: false\n      properties:\n        ok: { const: true }\n        data: { $ref: \"#/components/schemas/PluginSettingsSnapshot\" }\n    PlatformError:\n      oneOf:\n        - $ref: \"#/components/schemas/GenericPlatformError\"\n        - $ref: \"#/components/schemas/JSONLimitPlatformError\"\n        - $ref: \"#/components/schemas/PackageValidationPlatformError\"\n        - $ref: \"#/components/schemas/ManagementRevisionPlatformError\"\n        - $ref: \"#/components/schemas/AuthorizationRevisionPlatformError\"\n        - $ref: \"#/components/schemas/BindingRevisionPlatformError\"\n        - $ref: \"#/components/schemas/ValuesRevisionPlatformError\"\n        - $ref: \"#/components/schemas/CapabilityPlatformError\"\n        - $ref: \"#/components/schemas/WorkerPlatformError\"\n    MutationPlatformError:\n      oneOf:\n        - $ref: \"#/components/schemas/MutationGenericPlatformError\"\n        - $ref: \"#/components/schemas/MutationJSONLimitPlatformError\"\n        - $ref: \"#/components/schemas/MutationPackageValidationPlatformError\"\n        - $ref: \"#/components/schemas/MutationManagementRevisionPlatformError\"\n        - $ref: \"#/components/schemas/MutationAuthorizationRevisionPlatformError\"\n        - $ref: \"#/components/schemas/MutationBindingRevisionPlatformError\"\n        - $ref: \"#/components/schemas/MutationValuesRevisionPlatformError\"\n        - $ref: \"#/components/schemas/MutationCapabilityPlatformError\"\n        - $ref: \"#/components/schemas/MutationWorkerPlatformError\"\n        - $ref: \"#/components/schemas/MutationSessionTeardownPlatformError\"\n    GenericPlatformError:\n      type: object\n      required: [code, message, details]\n      additionalProperties: false\n      properties:\n        code:\n          $ref: \"#/components/schemas/GenericPlatformErrorCode\"\n        message: { $ref: \"#/components/schemas/PlatformErrorMessage\" }\n        details:\n          $ref: \"#/components/schemas/EmptyErrorDetails\"\n    JSONLimitPlatformError:\n      type: object\n      required: [code, message, details]\n      additionalProperties: false\n      properties:\n        code: { const: PLUGIN_JSON_LIMIT_EXCEEDED }\n        message: { $ref: \"#/components/schemas/PlatformErrorMessage\" }\n        details: { $ref: \"#/components/schemas/JSONLimitErrorDetails\" }\n    PackageValidationPlatformError:\n      type: object\n      required: [code, message, details]\n      additionalProperties: false\n      properties:\n        code:\n          type: string\n          enum: [PLUGIN_MANIFEST_INVALID, PLUGIN_PACKAGE_INVALID, PLUGIN_PACKAGE_TOO_LARGE, PLUGIN_PACKAGE_PATH_FORBIDDEN]\n        message: { $ref: \"#/components/schemas/PlatformErrorMessage\" }\n        details: { $ref: \"#/components/schemas/PackageValidationErrorDetails\" }\n    ManagementRevisionPlatformError:\n      type: object\n      required: [code, message, details]\n      additionalProperties: false\n      properties:\n        code: { const: PLUGIN_MANAGEMENT_REVISION_MISMATCH }\n        message: { $ref: \"#/components/schemas/PlatformErrorMessage\" }\n        details: { $ref: \"#/components/schemas/ManagementRevisionMismatchDetails\" }\n    AuthorizationRevisionPlatformError:\n      type: object\n      required: [code, message, details]\n      additionalProperties: false\n      properties:\n        code: { const: PLUGIN_AUTHORIZATION_REVISION_MISMATCH }\n        message: { $ref: \"#/components/schemas/PlatformErrorMessage\" }\n        details: { $ref: \"#/components/schemas/AuthorizationRevisionMismatchDetails\" }\n    BindingRevisionPlatformError:\n      type: object\n      required: [code, message, details]\n      additionalProperties: false\n      properties:\n        code: { const: PLUGIN_BINDING_REVISION_MISMATCH }\n        message: { $ref: \"#/components/schemas/PlatformErrorMessage\" }\n        details: { $ref: \"#/components/schemas/BindingRevisionMismatchDetails\" }\n    ValuesRevisionPlatformError:\n      type: object\n      required: [code, message, details]\n      additionalProperties: false\n      properties:\n        code: { const: PLUGIN_VALUES_REVISION_MISMATCH }\n        message: { $ref: \"#/components/schemas/PlatformErrorMessage\" }\n        details: { $ref: \"#/components/schemas/ValuesRevisionMismatchDetails\" }\n    CapabilityPlatformError:\n      type: object\n      required: [code, message, details]\n      additionalProperties: false\n      properties:\n        code: { const: PLUGIN_CAPABILITY_ERROR }\n        message: { $ref: \"#/components/schemas/PlatformErrorMessage\" }\n        details: { $ref: \"#/components/schemas/CapabilityBusinessErrorDetails\" }\n    WorkerPlatformError:\n      type: object\n      required: [code, message, details]\n      additionalProperties: false\n      properties:\n        code: { const: PLUGIN_WORKER_ERROR }\n        message: { $ref: \"#/components/schemas/PlatformErrorMessage\" }\n        details: { $ref: \"#/components/schemas/WorkerErrorDetails\" }\n    MutationGenericPlatformError:\n      type: object\n      required: [code, message, details, mutation_outcome]\n      additionalProperties: false\n      properties:\n        code: { $ref: \"#/components/schemas/GenericPlatformErrorCode\" }\n        message: { $ref: \"#/components/schemas/PlatformErrorMessage\" }\n        details: { $ref: \"#/components/schemas/EmptyErrorDetails\" }\n        mutation_outcome: { $ref: \"#/components/schemas/MutationOutcome\" }\n    MutationJSONLimitPlatformError:\n      type: object\n      required: [code, message, details, mutation_outcome]\n      additionalProperties: false\n      properties:\n        code: { const: PLUGIN_JSON_LIMIT_EXCEEDED }\n        message: { $ref: \"#/components/schemas/PlatformErrorMessage\" }\n        details: { $ref: \"#/components/schemas/JSONLimitErrorDetails\" }\n        mutation_outcome: { $ref: \"#/components/schemas/MutationOutcome\" }\n    MutationPackageValidationPlatformError:\n      type: object\n      required: [code, message, details, mutation_outcome]\n      additionalProperties: false\n      properties:\n        code:\n          type: string\n          enum: [PLUGIN_MANIFEST_INVALID, PLUGIN_PACKAGE_INVALID, PLUGIN_PACKAGE_TOO_LARGE, PLUGIN_PACKAGE_PATH_FORBIDDEN]\n        message: { $ref: \"#/components/schemas/PlatformErrorMessage\" }\n        details: { $ref: \"#/components/schemas/PackageValidationErrorDetails\" }\n        mutation_outcome: { $ref: \"#/components/schemas/MutationOutcome\" }\n    MutationManagementRevisionPlatformError:\n      type: object\n      required: [code, message, details, mutation_outcome]\n      additionalProperties: false\n      properties:\n        code: { const: PLUGIN_MANAGEMENT_REVISION_MISMATCH }\n        message: { $ref: \"#/components/schemas/PlatformErrorMessage\" }\n        details: { $ref: \"#/components/schemas/ManagementRevisionMismatchDetails\" }\n        mutation_outcome: { $ref: \"#/components/schemas/MutationOutcome\" }\n    MutationAuthorizationRevisionPlatformError:\n      type: object\n      required: [code, message, details, mutation_outcome]\n      additionalProperties: false\n      properties:\n        code: { const: PLUGIN_AUTHORIZATION_REVISION_MISMATCH }\n        message: { $ref: \"#/components/schemas/PlatformErrorMessage\" }\n        details: { $ref: \"#/components/schemas/AuthorizationRevisionMismatchDetails\" }\n        mutation_outcome: { $ref: \"#/components/schemas/MutationOutcome\" }\n    MutationBindingRevisionPlatformError:\n      type: object\n      required: [code, message, details, mutation_outcome]\n      additionalProperties: false\n      properties:\n        code: { const: PLUGIN_BINDING_REVISION_MISMATCH }\n        message: { $ref: \"#/components/schemas/PlatformErrorMessage\" }\n        details: { $ref: \"#/components/schemas/BindingRevisionMismatchDetails\" }\n        mutation_outcome: { $ref: \"#/components/schemas/MutationOutcome\" }\n    MutationValuesRevisionPlatformError:\n      type: object\n      required: [code, message, details, mutation_outcome]\n      additionalProperties: false\n      properties:\n        code: { const: PLUGIN_VALUES_REVISION_MISMATCH }\n        message: { $ref: \"#/components/schemas/PlatformErrorMessage\" }\n        details: { $ref: \"#/components/schemas/ValuesRevisionMismatchDetails\" }\n        mutation_outcome: { $ref: \"#/components/schemas/MutationOutcome\" }\n    MutationCapabilityPlatformError:\n      type: object\n      required: [code, message, details, mutation_outcome]\n      additionalProperties: false\n      properties:\n        code: { const: PLUGIN_CAPABILITY_ERROR }\n        message: { $ref: \"#/components/schemas/PlatformErrorMessage\" }\n        details: { $ref: \"#/components/schemas/CapabilityBusinessErrorDetails\" }\n        mutation_outcome: { $ref: \"#/components/schemas/MutationOutcome\" }\n    MutationWorkerPlatformError:\n      type: object\n      required: [code, message, details, mutation_outcome]\n      additionalProperties: false\n      properties:\n        code: { const: PLUGIN_WORKER_ERROR }\n        message: { $ref: \"#/components/schemas/PlatformErrorMessage\" }\n        details: { $ref: \"#/components/schemas/WorkerErrorDetails\" }\n        mutation_outcome: { $ref: \"#/components/schemas/MutationOutcome\" }\n    MutationSessionTeardownPlatformError:\n      type: object\n      required: [code, message, details, mutation_outcome]\n      additionalProperties: false\n      properties:\n        code: { const: PLUGIN_SESSION_TEARDOWN_INCOMPLETE }\n        message: { $ref: \"#/components/schemas/PlatformErrorMessage\" }\n        details: { $ref: \"#/components/schemas/SessionTeardownIncompleteErrorDetails\" }\n        mutation_outcome: { const: committed }\n    MutationOutcome:\n      type: string\n      enum: [committed, not_committed, unknown]\n    EmptyErrorDetails:\n      type: object\n      additionalProperties: false\n    JSONLimitErrorDetails:\n      type: object\n      required: [reason]\n      additionalProperties: false\n      properties:\n        reason:\n          type: string\n          enum: [payload_bytes, json_depth, prototype_key, number_precision]\n    PackageValidationErrorDetails:\n      type: object\n      required: [reason]\n      additionalProperties: false\n      properties:\n        reason:\n          type: string\n          enum: [manifest_missing, manifest_field, manifest_decode, zip_invalid, file_count, duplicate_entry, ambiguous_entry, non_regular_entry, invalid_utf8_path, non_nfc_path, symlink_entry, directory_entry, entry_bytes, path_length, compression_ratio, total_uncompressed_bytes, entry_open_failed, entry_read_failed, entry_close_failed, entry_size_mismatch, unsupported_signature_entry, manifest_artifact, package_asset_security, package_artifact_boundary, entry_path, manifest_canonical_json, canonical_hash, package_signature, empty_path, slash_separator, non_canonical_path, path_traversal, hidden_path, external_icon_path, unsupported_icon_format, missing_icon_asset, icon_magic_mismatch, query_or_fragment]\n        path:\n          type: string\n          description: Package-local entry path related to the error, when available.\n        pointer:\n          type: string\n          description: JSON Pointer into manifest.json related to the error, when available.\n    CapabilityBusinessErrorDetails:\n      type: object\n      additionalProperties: false\n      required: [capability_id, capability_version, detail_schema_sha256, business_error_code]\n      properties:\n        capability_id:\n          type: string\n          minLength: 1\n        capability_version:\n          $ref: \"#/components/schemas/StrictSemVer\"\n        detail_schema_sha256:\n          type: string\n          pattern: \"^[0-9a-f]{64}$\"\n        business_error_code:\n          type: string\n          pattern: \"^[A-Z][A-Z0-9_]*$\"\n        business_error_details:\n          type: object\n          additionalProperties: true\n    WorkerErrorDetails:\n      type: object\n      additionalProperties: false\n      required: [worker_error_code, worker_error_message, worker_error_origin]\n      properties:\n        worker_error_code:\n          type: string\n          pattern: \"^[A-Z][A-Z0-9_]*$\"\n        worker_error_message:\n          type: string\n          minLength: 1\n          maxLength: 4096\n        worker_error_origin:\n          type: string\n          enum: [runtime, hostcall, plugin]\n    SessionTeardownIncompleteErrorDetails:\n      type: object\n      additionalProperties: false\n      required: [session_scope]\n      properties:\n        session_scope:\n          $ref: \"#/components/schemas/SessionScopeRevokeIncompleteResult\"\n    ManagementRevisionMismatchDetails:\n      type: object\n      additionalProperties: false\n      required: [plugin_instance_id, expected_management_revision, actual_management_revision]\n      properties:\n        plugin_instance_id: { type: string, minLength: 1 }\n        expected_management_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n        actual_management_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n    AuthorizationRevisionMismatchDetails:\n      type: object\n      additionalProperties: false\n      required:\n        - plugin_instance_id\n        - expected_policy_revision\n        - actual_policy_revision\n        - expected_management_revision\n        - actual_management_revision\n        - expected_revoke_epoch\n        - actual_revoke_epoch\n      properties:\n        plugin_instance_id: { type: string, minLength: 1 }\n        expected_policy_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n        actual_policy_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n        expected_management_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n        actual_management_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n        expected_revoke_epoch: { type: integer, minimum: 0, maximum: 9007199254740991 }\n        actual_revoke_epoch: { type: integer, minimum: 0, maximum: 9007199254740991 }\n    BindingRevisionMismatchDetails:\n      type: object\n      additionalProperties: false\n      required: [plugin_instance_id, expected_binding_revision, actual_binding_revision]\n      properties:\n        plugin_instance_id: { type: string, minLength: 1 }\n        expected_binding_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n        actual_binding_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n    ValuesRevisionMismatchDetails:\n      type: object\n      additionalProperties: false\n      required: [plugin_instance_id, expected_values_revision, actual_values_revision]\n      properties:\n        plugin_instance_id: { type: string, minLength: 1 }\n        expected_values_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n        actual_values_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n    ErrorCode:\n      $ref: \"../plugin/error-codes-v6.schema.json#/$defs/platform_error_code\"\n    PlatformErrorMessage:\n      type: string\n      minLength: 1\n      maxLength: 4096\n      pattern: \".*\\\\S.*\"\n    GenericPlatformErrorCode:\n      type: string\n      enum:\n        - PLUGIN_INVALID_REQUEST\n        - PLUGIN_SIGNATURE_INVALID\n        - PLUGIN_TRUST_STATE_DENIED\n        - PLUGIN_TRUST_VERIFICATION_REQUIRED\n        - PLUGIN_TRUST_VERIFICATION_INVALID\n        - PLUGIN_RELEASE_REF_VERIFICATION_FAILED\n        - PLUGIN_RELEASE_REF_POLICY_DENIED\n        - PLUGIN_DISABLED\n        - PLUGIN_DISABLED_BY_POLICY\n        - PLUGIN_PERMISSION_DENIED\n        - PLUGIN_ORIGIN_DENIED\n        - PLUGIN_ACTION_DENIED\n        - PLUGIN_OWNER_SCOPE_MISMATCH\n        - PLUGIN_SECRET_SCOPE_MISMATCH\n        - PLUGIN_STORAGE_SCOPE_MISMATCH\n        - PLUGIN_ADAPTER_FAILURE\n        - PLUGIN_SESSION_REVOKED\n        - PLUGIN_SESSION_TEARDOWN_INCOMPLETE\n        - PLUGIN_SESSION_FENCE_CAPACITY\n        - PLUGIN_CONFIRMATION_REQUIRED\n        - PLUGIN_CONFIRMATION_INVALID\n        - PLUGIN_TOKEN_EXPIRED\n        - PLUGIN_TOKEN_REPLAY\n        - PLUGIN_GATEWAY_TOKEN_INVALID\n        - PLUGIN_GATEWAY_TOKEN_REPLAYED\n        - PLUGIN_GATEWAY_TOKEN_CHANNEL_MISMATCH\n        - PLUGIN_ASSET_TICKET_INVALID\n        - PLUGIN_ASSET_SESSION_INVALID\n        - PLUGIN_STREAM_TICKET_INVALID\n        - PLUGIN_STREAM_DELIVERY_INVALID\n        - PLUGIN_STREAM_CANCELLED\n        - PLUGIN_LEASE_INVALID\n        - PLUGIN_LEASE_REPLAYED\n        - PLUGIN_GRANT_INVALID\n        - PLUGIN_STORAGE_QUOTA_EXCEEDED\n        - PLUGIN_OPERATION_BLOCKED\n        - PLUGIN_OPERATION_NOT_FOUND\n        - PLUGIN_OPERATION_NOT_CANCELABLE\n        - PLUGIN_NETWORK_TARGET_DENIED\n        - PLUGIN_NETWORK_RATE_LIMITED\n        - PLUGIN_RUNTIME_UNAVAILABLE\n        - PLUGIN_RUNTIME_VERSION_MISMATCH\n        - PLUGIN_RUNTIME_CONTRACT_MISMATCH\n        - PLUGIN_UI_PROTOCOL_UNSUPPORTED\n        - PLUGIN_UI_PROTOCOL_VIOLATION\n        - PLUGIN_SURFACE_QUIESCE_TIMEOUT\n        - PLUGIN_CONTRACT_MISMATCH\n        - PLUGIN_CSRF_REQUIRED\n        - PLUGIN_CSRF_INVALID\n        - PLUGIN_FEATURE_NOT_CONFIGURED\n    SurfaceDisposeResult:\n      type: object\n      required: [disposed]\n      additionalProperties: false\n      properties:\n        disposed: { const: true }\n    SessionScopeRevokeCounts:\n      $ref: \"../plugin/session-scope-v1.schema.json#/$defs/revoke_counts\"\n    SessionScopeRevokeResult:\n      $ref: \"../plugin/session-scope-v1.schema.json#/$defs/public_revoke_result\"\n    SessionScopeRevokeCompleteResult:\n      $ref: \"../plugin/session-scope-v1.schema.json#/$defs/complete_revoke_result\"\n    SessionScopeRevokeIncompleteResult:\n      $ref: \"../plugin/session-scope-v1.schema.json#/$defs/incomplete_revoke_result\"\n    PluginCatalogResult:\n      type: object\n      required: [plugins]\n      additionalProperties: false\n      properties:\n        plugins:\n          type: array\n          items: { $ref: \"#/components/schemas/PluginRecord\" }\n    PluginCompatibilityManifest:\n      $ref: \"../plugin/compatibility-manifest-v8.schema.json\"\n    PluginOperationList:\n      type: object\n      required: [operations]\n      additionalProperties: false\n      properties:\n        operations:\n          type: array\n          items: { $ref: \"#/components/schemas/OperationRecord\" }\n        next_cursor: { type: string, maxLength: 1024 }\n    PluginIntentRecord:\n      type: object\n      required: [plugin_id, plugin_instance_id, publisher_id, display_name, version, active_fingerprint, intent_id, method, effect, execution]\n      additionalProperties: false\n      properties:\n        plugin_id: { type: string }\n        plugin_instance_id: { type: string }\n        publisher_id: { type: string }\n        display_name: { type: string }\n        version: { $ref: \"#/components/schemas/StrictSemVer\" }\n        active_fingerprint: { type: string }\n        intent_id: { type: string }\n        method: { type: string }\n        effect: { type: string, enum: [read, write, delete, execute, admin] }\n        execution: { type: string, enum: [sync, operation, subscription] }\n        payload_schema:\n          type: object\n          additionalProperties: true\n    PluginIntentList:\n      type: object\n      required: [intents]\n      additionalProperties: false\n      properties:\n        intents:\n          type: array\n          items: { $ref: \"#/components/schemas/PluginIntentRecord\" }\n    PluginPermissionGrant:\n      type: object\n      description: Explicit public HTTP projection of a permission grant. Internal actor ownership hashes are never returned.\n      required: [plugin_instance_id, permission_id, effect, granted_at]\n      additionalProperties: false\n      properties:\n        plugin_instance_id: { type: string }\n        permission_id: { type: string }\n        effect: { type: string, enum: [grant, deny] }\n        granted_at: { type: string, format: date-time }\n        expires_at: { type: string, format: date-time }\n        revoked_at: { type: string, format: date-time }\n        revoked_reason: { type: string }\n    PluginPermissionList:\n      type: object\n      required: [permissions]\n      additionalProperties: false\n      properties:\n        permissions:\n          type: array\n          items: { $ref: \"#/components/schemas/PluginPermissionGrant\" }\n    AuthorizationRevisions:\n      type: object\n      required: [policy_revision, management_revision, revoke_epoch]\n      additionalProperties: false\n      properties:\n        policy_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n        management_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n        revoke_epoch: { type: integer, minimum: 0, maximum: 9007199254740991 }\n    PluginPermissionMutationResult:\n      type: object\n      required: [permission, revisions]\n      additionalProperties: false\n      properties:\n        permission: { $ref: \"#/components/schemas/PluginPermissionGrant\" }\n        revisions: { $ref: \"#/components/schemas/AuthorizationRevisions\" }\n    PluginSecurityPolicy:\n      type: object\n      required: [plugin_instance_id, allowed_permissions, denied_methods, policy_revision, management_revision, revoke_epoch, updated_at]\n      additionalProperties: false\n      properties:\n        plugin_instance_id: { type: string, minLength: 1 }\n        allowed_permissions:\n          type: array\n          uniqueItems: true\n          items: { type: string, minLength: 1 }\n        denied_methods:\n          type: array\n          uniqueItems: true\n          items: { type: string, minLength: 1 }\n        policy_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n        management_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n        revoke_epoch: { type: integer, minimum: 0, maximum: 9007199254740991 }\n        updated_at: { type: string, format: date-time }\n    PluginSecurityPolicyList:\n      type: object\n      required: [security_policies]\n      additionalProperties: false\n      properties:\n        security_policies:\n          type: array\n          items: { $ref: \"#/components/schemas/PluginSecurityPolicy\" }\n    PluginSecurityPolicyDeleteResult:\n      type: object\n      required: [plugin_instance_id, deleted, policy_revision, management_revision, revoke_epoch]\n      additionalProperties: false\n      properties:\n        plugin_instance_id: { type: string, minLength: 1 }\n        deleted: { const: true }\n        policy_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n        management_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n        revoke_epoch: { type: integer, minimum: 0, maximum: 9007199254740991 }\n    DiagnosticMutationOutcome:\n      type: string\n      enum: [committed, not_committed, unknown]\n    PluginDiagnosticDetails:\n      type: object\n      additionalProperties: false\n      properties:\n        operations_deleted: { type: integer, minimum: 0, maximum: 9007199254740991 }\n        streams_deleted: { type: integer, minimum: 0, maximum: 9007199254740991 }\n        invocation_id: { type: string }\n        method: { type: string }\n        failure_code: { type: string }\n        runtime_process_failure_code:\n          $ref: \"../plugin/error-codes-v6.schema.json#/$defs/runtime_process_failure_code\"\n        operation_id: { type: string }\n        stream_id: { type: string }\n        runtime_instance_id: { type: string }\n        runtime_generation_id: { type: string }\n        runtime_version: { type: string }\n        rust_ipc_version: { type: string }\n        wasm_abi_version: { type: string }\n        contract_set_sha256: { type: string, pattern: '^[0-9a-f]{64}$' }\n        runtime_target_os: { type: string }\n        runtime_target_arch: { type: string }\n        runtime_binary_sha256: { type: string, pattern: '^[0-9a-f]{64}$' }\n        os: { type: string }\n        arch: { type: string }\n        stream: { type: string }\n        package_hash: { type: string }\n        artifact: { type: string }\n        plugin_instance_id: { type: string }\n        store_id: { type: string }\n        operation: { type: string }\n        hostcall: { type: string }\n        code: { type: string }\n        connector_id: { type: string }\n        transport: { type: string }\n        revoke_epoch: { type: integer, minimum: 0, maximum: 9007199254740991 }\n        stage_id: { type: string }\n        reason: { type: string }\n        surface_instance_id: { type: string }\n    PluginDiagnosticEvent:\n      type: object\n      required: [type, severity, message]\n      additionalProperties: false\n      properties:\n        event_id: { type: string }\n        type: { type: string }\n        severity: { type: string, enum: [info, warning] }\n        message: { type: string }\n        plugin_id: { type: string }\n        plugin_instance_id: { type: string }\n        surface_id: { type: string }\n        surface_instance_id: { type: string }\n        active_fingerprint: { type: string }\n        request_id: { type: string }\n        correlation_id: { type: string }\n        mutation_outcome: { $ref: \"#/components/schemas/DiagnosticMutationOutcome\" }\n        occurred_at: { type: string, format: date-time }\n        details: { $ref: \"#/components/schemas/PluginDiagnosticDetails\" }\n    PluginDiagnosticEventList:\n      type: object\n      required: [diagnostic_events]\n      additionalProperties: false\n      properties:\n        diagnostic_events:\n          type: array\n          items: { $ref: \"#/components/schemas/PluginDiagnosticEvent\" }\n    PluginRuntimeShardHealth:\n      type: object\n      description: Explicit public HTTP projection of runtime shard health. IPC channel credentials and connection nonces are excluded.\n      required: [runtime_shard_id, runtime_instance_id, runtime_generation_id, descriptor, ready, active_invocations, queued_invocations, limits, module_cache]\n      additionalProperties: false\n      properties:\n        runtime_shard_id: { type: string }\n        runtime_instance_id: { type: string }\n        runtime_generation_id: { type: string }\n        descriptor: { $ref: \"#/components/schemas/RuntimeDescriptor\" }\n        ready: { type: boolean }\n        active_invocations: { type: integer, minimum: 0 }\n        queued_invocations: { type: integer, minimum: 0 }\n        limits: { $ref: \"#/components/schemas/RuntimeLimits\" }\n        module_cache: { $ref: \"#/components/schemas/RuntimeModuleCacheMetrics\" }\n    PluginRuntimeHealth:\n      type: object\n      description: Explicit public HTTP projection of runtime manager health.\n      required: [ready, descriptor, shards]\n      additionalProperties: false\n      properties:\n        ready: { type: boolean }\n        descriptor: { $ref: \"#/components/schemas/RuntimeDescriptor\" }\n        shards:\n          type: array\n          items: { $ref: \"#/components/schemas/PluginRuntimeShardHealth\" }\n    RuntimeTarget:\n      oneOf:\n        - type: object\n          required: [os, arch]\n          additionalProperties: false\n          properties:\n            os: { const: darwin }\n            arch: { const: amd64 }\n        - type: object\n          required: [os, arch]\n          additionalProperties: false\n          properties:\n            os: { const: darwin }\n            arch: { const: arm64 }\n        - type: object\n          required: [os, arch]\n          additionalProperties: false\n          properties:\n            os: { const: linux }\n            arch: { const: amd64 }\n        - type: object\n          required: [os, arch]\n          additionalProperties: false\n          properties:\n            os: { const: linux }\n            arch: { const: arm64 }\n    RuntimeAdmissionTarget:\n      type: string\n      enum: [linux/amd64, linux/arm64]\n    StrictSemVer:\n      type: string\n      pattern: '^(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)\\.(0|[1-9][0-9]*)(?:-(?:(?:0|[1-9][0-9]*|[0-9A-Za-z-]*[A-Za-z-][0-9A-Za-z-]*)(?:\\.(?:0|[1-9][0-9]*|[0-9A-Za-z-]*[A-Za-z-][0-9A-Za-z-]*))*))?(?:\\+[0-9A-Za-z-]+(?:\\.[0-9A-Za-z-]+)*)?$'\n    RuntimeDescriptor:\n      type: object\n      required: [schema_version, platform_version, target, rust_ipc_version, wasm_abi_version, contract_set_sha256, binary_sha256]\n      additionalProperties: false\n      properties:\n        schema_version: { const: runtime-descriptor-v2 }\n        platform_version: { $ref: \"#/components/schemas/StrictSemVer\" }\n        target: { $ref: \"#/components/schemas/RuntimeAdmissionTarget\" }\n        rust_ipc_version: { const: rust-ipc-v6 }\n        wasm_abi_version: { const: redevplugin-wasm-worker-v2 }\n        contract_set_sha256: { type: string, pattern: '^[0-9a-f]{64}$' }\n        binary_sha256: { type: string, pattern: '^[0-9a-f]{64}$' }\n    RuntimeLimits:\n      type: object\n      description: \"Negotiated runtime capacities. per_plugin_concurrency must not exceed worker_count. Route capacities are derived exactly from negotiated limits: active hostcall routes = worker_count, canceled hostcall retention = worker_count + queue_capacity, and compile-flight artifact routes = worker_count.\"\n      required: [worker_count, queue_capacity, per_plugin_concurrency, module_cache_entries, module_cache_source_bytes]\n      additionalProperties: false\n      properties:\n        worker_count: { type: integer, minimum: 1, maximum: 64, description: \"Number of runtime worker threads.\" }\n        queue_capacity: { type: integer, minimum: 1, maximum: 64, description: \"Maximum queued worker invocations.\" }\n        per_plugin_concurrency: { type: integer, minimum: 1, maximum: 64, description: \"Maximum concurrent invocations for one plugin; must not exceed worker_count.\" }\n        module_cache_entries: { type: integer, minimum: 1, maximum: 1024, description: \"Maximum compiled modules retained by the runtime cache.\" }\n        module_cache_source_bytes: { type: integer, minimum: 1, maximum: 134217728, description: \"Maximum source WASM bytes retained by the runtime cache (128 MiB).\" }\n    RuntimeModuleCacheMetrics:\n      type: object\n      required: [hits, misses, compiles, entries, source_bytes]\n      additionalProperties: false\n      properties:\n        hits: { type: integer, minimum: 0, maximum: 9007199254740991 }\n        misses: { type: integer, minimum: 0, maximum: 9007199254740991 }\n        compiles: { type: integer, minimum: 0, maximum: 9007199254740991 }\n        entries: { type: integer, minimum: 0, maximum: 1024 }\n        source_bytes: { type: integer, minimum: 0, maximum: 134217728 }\n    PluginRuntimeStopResult:\n      type: object\n      required: [stopped]\n      additionalProperties: false\n      properties:\n        stopped: { const: true }\n    PluginRuntimeRefreshResult:\n      type: object\n      required: [results]\n      additionalProperties: false\n      properties:\n        results:\n          type: array\n          items: { $ref: \"#/components/schemas/PluginRuntimeRefreshEntry\" }\n    PluginRuntimeRefreshEntry:\n      oneOf:\n        - $ref: \"#/components/schemas/PluginRuntimeRefreshSuccess\"\n        - $ref: \"#/components/schemas/PluginRuntimeRefreshFailure\"\n    PluginRuntimeRefreshSuccess:\n      type: object\n      required: [plugin_instance_id, status]\n      additionalProperties: false\n      properties:\n        plugin_instance_id: { type: string, minLength: 1 }\n        status: { const: refreshed }\n    PluginRuntimeRefreshFailure:\n      type: object\n      required: [plugin_instance_id, status, error]\n      additionalProperties: false\n      properties:\n        plugin_instance_id: { type: string, minLength: 1 }\n        status: { const: failed }\n        error: { $ref: \"#/components/schemas/PluginRuntimeRefreshPublicError\" }\n    PluginRuntimeRefreshPublicError:\n      type: object\n      required: [code, message]\n      additionalProperties: false\n      properties:\n        code:\n          type: string\n          enum: [PLUGIN_RUNTIME_UNAVAILABLE]\n        message: { const: \"Plugin runtime state could not be refreshed\" }\n    PluginDataExportResult:\n      type: object\n      required: [bundle_ref]\n      additionalProperties: false\n      properties:\n        bundle_ref: { type: string, minLength: 1 }\n    PluginDataExportDeleteResult:\n      type: object\n      required: [deleted]\n      additionalProperties: false\n      properties:\n        deleted: { const: true }\n    PluginSecretBindResult:\n      type: object\n      required: [bound]\n      additionalProperties: false\n      properties:\n        bound: { const: true }\n    PluginSecretTestResult:\n      type: object\n      required: [tested]\n      additionalProperties: false\n      properties:\n        tested: { const: true }\n    PluginSecretDeleteResult:\n      type: object\n      required: [deleted]\n      additionalProperties: false\n      properties:\n        deleted: { const: true }\n    PluginSettingsField:\n      type: object\n      required: [key, type, label, scope]\n      additionalProperties: false\n      properties:\n        key: { type: string }\n        type: { type: string }\n        label: { type: string }\n        scope: { $ref: \"#/components/schemas/ResourceScopeKind\" }\n        default: true\n        secret_ref: { type: string }\n        options:\n          type: array\n          items: { type: string }\n        validation:\n          type: object\n          additionalProperties: true\n    PluginSettingsSchema:\n      type: object\n      description: Explicit public HTTP projection of the settings schema for one owner scope.\n      required: [plugin_instance_id, scope, schema_version, fields, values_revision]\n      additionalProperties: false\n      properties:\n        plugin_instance_id: { type: string }\n        scope: { $ref: \"#/components/schemas/ResourceScopeKind\" }\n        schema_version: { type: integer, minimum: 1 }\n        fields:\n          type: array\n          items: { $ref: \"#/components/schemas/PluginSettingsField\" }\n        values_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n    PluginSettingsSnapshot:\n      type: object\n      description: Explicit public HTTP projection of settings values and redacted secret metadata for one owner scope.\n      required: [plugin_instance_id, scope, schema_version, values_revision, values, secret_metadata]\n      additionalProperties: false\n      properties:\n        plugin_instance_id: { type: string }\n        scope: { $ref: \"#/components/schemas/ResourceScopeKind\" }\n        schema_version: { type: integer, minimum: 1 }\n        values_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n        values:\n          type: object\n          additionalProperties: true\n        secret_metadata:\n          type: array\n          items: { $ref: \"#/components/schemas/PluginSettingsSecretMetadata\" }\n    PluginSettingsSecretMetadata:\n      type: object\n      required: [key, secret_ref, scope, bound]\n      additionalProperties: false\n      properties:\n        key: { type: string, minLength: 1 }\n        secret_ref: { type: string, minLength: 1 }\n        scope: { type: string, enum: [user, environment] }\n        bound: { type: boolean }\n        last_test_status: { type: string }\n        bound_at: { type: string, format: date-time }\n        tested_at: { type: string, format: date-time }\n        updated_at: { type: string, format: date-time }\n    ExternalPackageIntentRequest:\n      description: Closed install or update intent. Update concurrency values are supplied by the caller, while package identity is always derived from the inspected artifact.\n      oneOf:\n        - type: object\n          required: [action]\n          additionalProperties: false\n          properties:\n            action: { const: install }\n        - type: object\n          required: [action, plugin_instance_id, expected_management_revision]\n          additionalProperties: false\n          properties:\n            action: { const: update }\n            plugin_instance_id: { type: string, minLength: 1 }\n            expected_management_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n    ExternalPackageIntent:\n      description: Server-resolved install or update intent. The platform generates the install instance identifier during inspection.\n      oneOf:\n        - type: object\n          required: [action, plugin_instance_id]\n          additionalProperties: false\n          properties:\n            action: { const: install }\n            plugin_instance_id: { type: string, minLength: 1 }\n        - type: object\n          required: [action, plugin_instance_id, expected_management_revision]\n          additionalProperties: false\n          properties:\n            action: { const: update }\n            plugin_instance_id: { type: string, minLength: 1 }\n            expected_management_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n    ExternalPackageSource:\n      description: Caller-selected external source. Redirect resolution, package hashes, identity, and provenance are derived by the platform.\n      oneOf:\n        - type: object\n          required: [kind, url]\n          additionalProperties: false\n          properties:\n            kind: { const: package_url }\n            url: { type: string, format: uri, minLength: 1 }\n        - type: object\n          required: [kind, url]\n          additionalProperties: false\n          properties:\n            kind: { const: github_repository }\n            url: { type: string, format: uri, minLength: 1 }\n            tag:\n              type: string\n              minLength: 1\n              maxLength: 255\n              description: Optional exact release tag. When omitted, the resolver selects the repository's latest eligible release.\n    InspectExternalPackageRequest:\n      type: object\n      description: Requests server-side inspection. Trust, hashes, package identity, approval, provenance, signature assessment, and update eligibility are intentionally not caller-controlled.\n      required: [intent, source]\n      additionalProperties: false\n      properties:\n        intent: { $ref: \"#/components/schemas/ExternalPackageIntentRequest\" }\n        source: { $ref: \"#/components/schemas/ExternalPackageSource\" }\n    CommitExternalPackageRequest:\n      type: object\n      description: Confirms the exact immutable inspection. The digest cannot override any inspected fact.\n      required: [inspection_id, confirmation_digest]\n      additionalProperties: false\n      properties:\n        inspection_id: { type: string, minLength: 1 }\n        confirmation_digest: { type: string, pattern: \"^sha256:[0-9a-f]{64}$\" }\n    QueryExternalPackageCommitRequest:\n      type: object\n      required: [inspection_id]\n      additionalProperties: false\n      properties:\n        inspection_id: { type: string, minLength: 1 }\n        commit_id: { type: string, minLength: 1 }\n    ExternalPackageSignatureAssessment:\n      type: object\n      description: Cryptographic signature fact computed over the inspected artifact. The absent state is installable and affects trust classification and automatic-update eligibility only.\n      required: [state, reason_codes, assessed_hashes, assessed_at]\n      additionalProperties: false\n      properties:\n        state:\n          type: string\n          enum: [verified, absent, unknown_signer, invalid, revoked, unavailable]\n        reason_codes:\n          type: array\n          uniqueItems: true\n          items: { type: string, minLength: 1 }\n        assessed_hashes: { $ref: \"#/components/schemas/TrustHashSet\" }\n        algorithm: { type: string, minLength: 1 }\n        key_id: { type: string, minLength: 1 }\n        assessed_at: { type: string, format: date-time }\n        assessment_epoch: { type: string, minLength: 1 }\n    ExternalPackageRedirectHop:\n      type: object\n      description: Credential-free redirect projection. Userinfo, query strings, and fragments are never exposed.\n      required: [origin, path]\n      additionalProperties: false\n      properties:\n        origin: { type: string, format: uri, minLength: 1 }\n        path: { type: string, pattern: \"^/\" }\n    ExternalPackageSourceProvenance:\n      description: Stable, credential-free source provenance computed after URL, GitHub release, or uploaded-package resolution. Upload identifiers are opaque server-generated values and cannot be supplied by callers.\n      oneOf:\n        - type: object\n          required: [kind, source_origin, source_path, redirect_chain, package_sha256, resolved_at]\n          additionalProperties: false\n          properties:\n            kind: { const: package_url }\n            source_origin: { type: string, format: uri, minLength: 1 }\n            source_path: { type: string, pattern: \"^/\" }\n            redirect_chain:\n              type: array\n              items: { $ref: \"#/components/schemas/ExternalPackageRedirectHop\" }\n            package_sha256: { type: string, pattern: \"^(sha256:)?[0-9a-f]{64}$\" }\n            resolved_at: { type: string, format: date-time }\n        - type: object\n          required: [kind, upload_id, package_sha256, resolved_at]\n          additionalProperties: false\n          properties:\n            kind: { const: package_upload }\n            upload_id:\n              type: string\n              minLength: 1\n              description: Opaque server-generated identifier for the staged uploaded artifact.\n            package_sha256: { type: string, pattern: \"^(sha256:)?[0-9a-f]{64}$\" }\n            resolved_at: { type: string, format: date-time }\n        - type: object\n          required: [kind, repository_id, release_id, asset_id, repository_url, owner, repository, resolved_commit_sha, package_sha256, resolved_at]\n          additionalProperties: false\n          properties:\n            kind: { const: github_repository }\n            repository_id:\n              type: string\n              pattern: \"^[1-9][0-9]*$\"\n              description: Stable GitHub repository database ID encoded as decimal text.\n            release_id:\n              type: string\n              pattern: \"^[1-9][0-9]*$\"\n              description: Stable GitHub release database ID encoded as decimal text.\n            asset_id:\n              type: string\n              pattern: \"^[1-9][0-9]*$\"\n              description: Stable GitHub release asset database ID encoded as decimal text.\n            repository_url: { type: string, format: uri, minLength: 1 }\n            owner:\n              type: string\n              minLength: 1\n              description: Display-only owner login; repository_id remains authoritative across renames.\n            repository:\n              type: string\n              minLength: 1\n              description: Display-only repository name; repository_id remains authoritative across renames.\n            resolved_commit_sha: { type: string, pattern: \"^[0-9a-f]{40}$\" }\n            release_tag: { type: string, minLength: 1 }\n            asset_name: { type: string, minLength: 1 }\n            package_sha256: { type: string, pattern: \"^(sha256:)?[0-9a-f]{64}$\" }\n            resolved_at: { type: string, format: date-time }\n    ExternalPackageExecutionApproval:\n      type: object\n      description: Execution decision independent from signature state. Session and owner hashes are excluded from this public projection.\n      required: [state, reason_codes, assessed_at]\n      additionalProperties: false\n      properties:\n        state:\n          type: string\n          enum: [pending, user_approved, policy_approved, policy_blocked]\n        reason_codes:\n          type: array\n          uniqueItems: true\n          items: { type: string, minLength: 1 }\n        assessed_at: { type: string, format: date-time }\n        approved_at: { type: string, format: date-time }\n    ExternalPackageUpdateEligibility:\n      type: object\n      description: Automatic-update decision. Unsigned or otherwise unverified packages remain installable but are normally manual-only.\n      required: [state, reason_codes, assessed_at]\n      additionalProperties: false\n      properties:\n        state:\n          type: string\n          enum: [manual_only, automatic_eligible]\n        reason_codes:\n          type: array\n          uniqueItems: true\n          items: { type: string, minLength: 1 }\n        assessed_at: { type: string, format: date-time }\n    ExternalPackagePermissionSummary:\n      type: object\n      required: [permission_id, methods]\n      additionalProperties: false\n      properties:\n        permission_id: { type: string, minLength: 1 }\n        methods:\n          type: array\n          uniqueItems: true\n          items: { type: string, minLength: 1 }\n    ExternalPackageMethodRouteSummary:\n      type: object\n      required: [kind]\n      additionalProperties: false\n      properties:\n        kind: { type: string, enum: [capability, worker, core_action] }\n        binding_id: { type: string, minLength: 1 }\n        target_method: { type: string, minLength: 1 }\n        worker_id: { type: string, minLength: 1 }\n        action_id: { type: string, minLength: 1 }\n    ExternalPackageConfirmationSummary:\n      type: object\n      required: [mode, request_hash_fields, plan_hash_required]\n      additionalProperties: false\n      properties:\n        mode: { type: string, enum: [none, required, risk_based] }\n        preflight_method: { type: string, minLength: 1 }\n        request_hash_fields:\n          type: array\n          uniqueItems: true\n          items: { type: string, minLength: 1 }\n        plan_hash_required: { type: boolean }\n    ExternalPackageCancelSummary:\n      type: object\n      required: [cancelable, disable_behavior, uninstall_behavior, ack_timeout_ms]\n      additionalProperties: false\n      properties:\n        cancelable: { type: boolean }\n        disable_behavior: { type: string, enum: [cancel, orphan, wait] }\n        uninstall_behavior: { type: string, enum: [cancel_then_block_delete, force_cleanup_allowed] }\n        ack_timeout_ms: { type: integer, minimum: 0 }\n    ExternalPackageMethodSummary:\n      type: object\n      required: [method, route, effect, execution, dangerous, preflight_only, required_permissions, confirmation]\n      additionalProperties: false\n      properties:\n        method: { type: string, minLength: 1 }\n        route: { $ref: \"#/components/schemas/ExternalPackageMethodRouteSummary\" }\n        effect: { type: string, enum: [read, write, delete, execute, admin] }\n        execution: { type: string, enum: [sync, operation, subscription] }\n        dangerous: { type: boolean }\n        preflight_only: { type: boolean }\n        required_permissions:\n          type: array\n          uniqueItems: true\n          items: { type: string, minLength: 1 }\n        confirmation: { $ref: \"#/components/schemas/ExternalPackageConfirmationSummary\" }\n        cancel: { $ref: \"#/components/schemas/ExternalPackageCancelSummary\" }\n    ExternalPackageCapabilityContractSummary:\n      type: object\n      required: [binding_id, capability_id, capability_version, contract_sha256]\n      additionalProperties: false\n      properties:\n        binding_id: { type: string, minLength: 1 }\n        capability_id: { type: string, minLength: 1 }\n        capability_version: { type: string, minLength: 1 }\n        contract_sha256: { type: string, pattern: \"^sha256:[0-9a-f]{64}$\" }\n    ExternalPackageWorkerSummary:\n      type: object\n      required: [worker_id, artifact, abi, mode, scope, memory_limit_bytes, idle_timeout_ms]\n      additionalProperties: false\n      properties:\n        worker_id: { type: string, minLength: 1 }\n        artifact: { type: string, minLength: 1 }\n        abi: { const: redevplugin-wasm-worker-v2 }\n        mode: { const: job }\n        scope: { $ref: \"#/components/schemas/ResourceScopeKind\" }\n        memory_limit_bytes: { type: integer, minimum: 1, maximum: 268435456 }\n        idle_timeout_ms: { type: integer, minimum: 0 }\n    ExternalPackageNetworkMethodAccessSummary:\n      type: object\n      required: [method, operations, http_methods]\n      additionalProperties: false\n      properties:\n        method: { type: string, minLength: 1 }\n        operations:\n          type: array\n          uniqueItems: true\n          items: { type: string, enum: [http, http_stream, websocket_round_trip, tcp_round_trip, udp_round_trip] }\n        http_methods:\n          type: array\n          uniqueItems: true\n          items: { type: string, enum: [GET, HEAD, POST, PUT, PATCH, DELETE, OPTIONS] }\n    ExternalPackageNetworkSummary:\n      type: object\n      required: [connector_id, transport, scope, destinations, auth_declared, tls_declared, method_access]\n      additionalProperties: false\n      properties:\n        connector_id: { type: string, minLength: 1 }\n        transport: { type: string, enum: [http, websocket, tcp, udp] }\n        scope: { $ref: \"#/components/schemas/ResourceScopeKind\" }\n        destinations:\n          type: array\n          uniqueItems: true\n          items: { type: string, minLength: 1 }\n        auth_declared: { type: boolean }\n        tls_declared: { type: boolean }\n        method_access:\n          type: array\n          items: { $ref: \"#/components/schemas/ExternalPackageNetworkMethodAccessSummary\" }\n    ExternalPackageStorageMethodAccessSummary:\n      type: object\n      required: [method, operations]\n      additionalProperties: false\n      properties:\n        method: { type: string, minLength: 1 }\n        operations:\n          type: array\n          uniqueItems: true\n          items: { type: string, enum: [read, write, delete, list, get, put, query, exec] }\n    ExternalPackageStorageSummary:\n      type: object\n      required: [store_id, kind, scope, quota_bytes, schema_version, method_access]\n      additionalProperties: false\n      properties:\n        store_id: { type: string, minLength: 1 }\n        kind: { type: string, enum: [kv, files, sqlite] }\n        scope: { $ref: \"#/components/schemas/ResourceScopeKind\" }\n        quota_bytes: { type: integer, minimum: 1, maximum: 1073741824 }\n        quota_files: { type: integer, minimum: 1, maximum: 100000 }\n        schema_version: { type: integer, minimum: 1 }\n        method_access:\n          type: array\n          items: { $ref: \"#/components/schemas/ExternalPackageStorageMethodAccessSummary\" }\n    ExternalPackageSecretRefSummary:\n      type: object\n      required: [setting_key, secret_ref, scope]\n      additionalProperties: false\n      properties:\n        setting_key: { type: string, minLength: 1 }\n        secret_ref: { type: string, minLength: 1 }\n        scope: { $ref: \"#/components/schemas/ResourceScopeKind\" }\n    ExternalPackageCoreActionSummary:\n      type: object\n      required: [method, action_id, effect]\n      additionalProperties: false\n      properties:\n        method: { type: string, minLength: 1 }\n        action_id: { type: string, minLength: 1 }\n        effect: { type: string, enum: [read, write, delete, execute, admin] }\n    ExternalPackageIntentSummary:\n      type: object\n      required: [intent_id, method]\n      additionalProperties: false\n      properties:\n        intent_id: { type: string, minLength: 1 }\n        method: { type: string, minLength: 1 }\n    ExternalPackageSurfaceSummary:\n      type: object\n      required: [surface_id, kind, intent, label, entry]\n      additionalProperties: false\n      properties:\n        surface_id: { type: string, minLength: 1 }\n        kind: { type: string, enum: [view, command, background] }\n        intent: { type: string, enum: [primary, secondary, utility] }\n        label: { type: string, minLength: 1 }\n        entry: { type: string, minLength: 1 }\n        icon: { type: string, minLength: 1 }\n        default_size: { $ref: \"#/components/schemas/ExternalPackageSizeSummary\" }\n    ExternalPackageSizeSummary:\n      type: object\n      required: [width, height]\n      additionalProperties: false\n      properties:\n        width: { type: integer, minimum: 1 }\n        height: { type: integer, minimum: 1 }\n    ExternalPackageSecuritySummary:\n      type: object\n      description: Closed, display-ready projection of every security-relevant declaration in the inspected manifest.\n      required: [summary_sha256, permissions, methods, capability_contracts, workers, network, storage, secret_refs, core_actions, intents, surfaces]\n      additionalProperties: false\n      properties:\n        summary_sha256: { type: string, pattern: \"^sha256:[0-9a-f]{64}$\" }\n        permissions:\n          type: array\n          items: { $ref: \"#/components/schemas/ExternalPackagePermissionSummary\" }\n        methods:\n          type: array\n          items: { $ref: \"#/components/schemas/ExternalPackageMethodSummary\" }\n        capability_contracts:\n          type: array\n          items: { $ref: \"#/components/schemas/ExternalPackageCapabilityContractSummary\" }\n        workers:\n          type: array\n          items: { $ref: \"#/components/schemas/ExternalPackageWorkerSummary\" }\n        network:\n          type: array\n          items: { $ref: \"#/components/schemas/ExternalPackageNetworkSummary\" }\n        storage:\n          type: array\n          items: { $ref: \"#/components/schemas/ExternalPackageStorageSummary\" }\n        secret_refs:\n          type: array\n          items: { $ref: \"#/components/schemas/ExternalPackageSecretRefSummary\" }\n        core_actions:\n          type: array\n          items: { $ref: \"#/components/schemas/ExternalPackageCoreActionSummary\" }\n        intents:\n          type: array\n          items: { $ref: \"#/components/schemas/ExternalPackageIntentSummary\" }\n        surfaces:\n          type: array\n          items: { $ref: \"#/components/schemas/ExternalPackageSurfaceSummary\" }\n    ExternalPackageInspection:\n      type: object\n      description: Immutable inspection projection. Package identity and all four trust/security facts are server-derived.\n      required: [inspection_id, expires_at, intent, publisher_id, plugin_id, version, inspected_hashes, signature_assessment, source_provenance, execution_approval, update_eligibility, security_summary, confirmation_digest]\n      additionalProperties: false\n      properties:\n        inspection_id: { type: string, minLength: 1 }\n        expires_at: { type: string, format: date-time }\n        intent: { $ref: \"#/components/schemas/ExternalPackageIntent\" }\n        publisher_id: { type: string, minLength: 1 }\n        plugin_id: { type: string, minLength: 1 }\n        version: { $ref: \"#/components/schemas/StrictSemVer\" }\n        inspected_hashes: { $ref: \"#/components/schemas/TrustHashSet\" }\n        signature_assessment: { $ref: \"#/components/schemas/ExternalPackageSignatureAssessment\" }\n        source_provenance: { $ref: \"#/components/schemas/ExternalPackageSourceProvenance\" }\n        execution_approval: { $ref: \"#/components/schemas/ExternalPackageExecutionApproval\" }\n        update_eligibility: { $ref: \"#/components/schemas/ExternalPackageUpdateEligibility\" }\n        security_summary: { $ref: \"#/components/schemas/ExternalPackageSecuritySummary\" }\n        confirmation_digest: { type: string, pattern: \"^sha256:[0-9a-f]{64}$\" }\n    ExternalPackageCommitReceipt:\n      type: object\n      description: Immutable successful commit evidence.\n      required: [commit_id, inspection_id, package_sha256, management_revision, committed_at]\n      additionalProperties: false\n      properties:\n        commit_id: { type: string, minLength: 1 }\n        inspection_id: { type: string, minLength: 1 }\n        package_sha256: { type: string, pattern: \"^(sha256:)?[0-9a-f]{64}$\" }\n        management_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n        committed_at: { type: string, format: date-time }\n    ExternalPackageCommitResult:\n      description: Closed commit reconciliation union. A committed result repeats all four facts so clients never infer them from legacy trust_state alone. A failed result is terminal evidence that a durable commit did not occur and requires a fresh inspection before retrying.\n      oneOf:\n        - type: object\n          required: [status, inspection_id, intent, receipt, plugin, signature_assessment, source_provenance, execution_approval, update_eligibility, security_summary]\n          additionalProperties: false\n          properties:\n            status: { const: committed }\n            inspection_id: { type: string, minLength: 1 }\n            intent: { $ref: \"#/components/schemas/ExternalPackageIntent\" }\n            receipt: { $ref: \"#/components/schemas/ExternalPackageCommitReceipt\" }\n            plugin: { $ref: \"#/components/schemas/PluginRecord\" }\n            signature_assessment: { $ref: \"#/components/schemas/ExternalPackageSignatureAssessment\" }\n            source_provenance: { $ref: \"#/components/schemas/ExternalPackageSourceProvenance\" }\n            execution_approval: { $ref: \"#/components/schemas/ExternalPackageExecutionApproval\" }\n            update_eligibility: { $ref: \"#/components/schemas/ExternalPackageUpdateEligibility\" }\n            security_summary: { $ref: \"#/components/schemas/ExternalPackageSecuritySummary\" }\n        - type: object\n          required: [status, inspection_id, intent, retry_after_ms]\n          additionalProperties: false\n          properties:\n            status: { const: in_progress }\n            inspection_id: { type: string, minLength: 1 }\n            intent: { $ref: \"#/components/schemas/ExternalPackageIntent\" }\n            retry_after_ms: { type: integer, minimum: 1, maximum: 60000 }\n        - type: object\n          required: [status, inspection_id, intent, failure_code]\n          additionalProperties: false\n          properties:\n            status: { const: failed }\n            inspection_id: { type: string, minLength: 1 }\n            intent: { $ref: \"#/components/schemas/ExternalPackageIntent\" }\n            failure_code: { const: host_restarted_before_commit }\n    TrustState:\n      type: string\n      enum: [verified, unsigned_local, untrusted, needs_review, trust_unavailable, blocked_security]\n    TrustHashSet:\n      type: object\n      required: [package_sha256, manifest_sha256, entries_sha256]\n      additionalProperties: false\n      properties:\n        package_sha256: { type: string, pattern: \"^(sha256:)?[0-9a-f]{64}$\" }\n        manifest_sha256: { type: string, pattern: \"^(sha256:)?[0-9a-f]{64}$\" }\n        entries_sha256: { type: string, pattern: \"^(sha256:)?[0-9a-f]{64}$\" }\n    VerifiedSignature:\n      type: object\n      required: [algorithm, key_id]\n      additionalProperties: false\n      properties:\n        algorithm: { type: string, minLength: 1 }\n        key_id: { type: string, minLength: 1 }\n    TrustAssessment:\n      type: object\n      required: [trust_state, verified_hashes]\n      additionalProperties: false\n      properties:\n        trust_state:\n          $ref: \"#/components/schemas/TrustState\"\n        reason_codes:\n          type: array\n          items: { type: string }\n        verified_hashes:\n          $ref: \"#/components/schemas/TrustHashSet\"\n        verified_signature:\n          $ref: \"#/components/schemas/VerifiedSignature\"\n        trust_assessment_epoch: { type: string }\n        policy_epoch: { type: string }\n        revocation_epoch: { type: string }\n        metadata:\n          type: object\n          additionalProperties: { type: string }\n    PluginVersion:\n      type: object\n      required: [version, active_fingerprint, package_hash, manifest_hash, entries_hash, trust_state, trust_assessment, manifest, package_entries, activated_at]\n      additionalProperties: false\n      properties:\n        version: { $ref: \"#/components/schemas/StrictSemVer\" }\n        active_fingerprint: { type: string, minLength: 1 }\n        package_hash: { type: string, minLength: 1 }\n        manifest_hash: { type: string, minLength: 1 }\n        entries_hash: { type: string, minLength: 1 }\n        trust_state:\n          $ref: \"#/components/schemas/TrustState\"\n        trust_assessment:\n          $ref: \"#/components/schemas/TrustAssessment\"\n        source_policy_snapshot_hash: { type: string, pattern: \"^(sha256:)?[0-9a-f]{64}$\" }\n        source_policy_snapshot:\n          type: object\n          additionalProperties: true\n        local_import_provenance:\n          $ref: \"#/components/schemas/LocalImportProvenance\"\n        signature_assessment:\n          $ref: \"#/components/schemas/ExternalPackageSignatureAssessment\"\n        source_provenance:\n          $ref: \"#/components/schemas/ExternalPackageSourceProvenance\"\n        execution_approval:\n          $ref: \"#/components/schemas/ExternalPackageExecutionApproval\"\n        update_eligibility:\n          $ref: \"#/components/schemas/ExternalPackageUpdateEligibility\"\n        security_summary:\n          $ref: \"#/components/schemas/ExternalPackageSecuritySummary\"\n        capability_contracts:\n          type: array\n          items: { $ref: \"#/components/schemas/CapabilityContractPin\" }\n        manifest:\n          $ref: \"../plugin/manifest-v5.schema.json\"\n        package_entries:\n          type: array\n          items: { $ref: \"#/components/schemas/PackageEntry\" }\n        runtime_requirement: { $ref: \"#/components/schemas/RuntimeRequirement\" }\n        activated_at: { type: string, format: date-time }\n        metadata:\n          type: object\n          additionalProperties: { type: string }\n    PluginRecord:\n      type: object\n      description: Explicit public HTTP projection of a registry record. Persistent owner identity is excluded.\n      required: [plugin_instance_id, publisher_id, plugin_id, version, active_fingerprint, package_hash, manifest_hash, entries_hash, trust_state, trust_assessment, enable_state, policy_revision, management_revision, revoke_epoch, manifest, package_entries, installed_at, updated_at]\n      additionalProperties: false\n      properties:\n        plugin_instance_id: { type: string, minLength: 1 }\n        publisher_id: { type: string }\n        plugin_id: { type: string, minLength: 1 }\n        version: { $ref: \"#/components/schemas/StrictSemVer\" }\n        active_fingerprint: { type: string, minLength: 1 }\n        package_hash: { type: string }\n        manifest_hash: { type: string }\n        entries_hash: { type: string }\n        trust_state:\n          $ref: \"#/components/schemas/TrustState\"\n        trust_assessment:\n          $ref: \"#/components/schemas/TrustAssessment\"\n        source_policy_snapshot_hash: { type: string, pattern: \"^(sha256:)?[0-9a-f]{64}$\" }\n        source_policy_snapshot:\n          type: object\n          additionalProperties: true\n        local_import_provenance:\n          $ref: \"#/components/schemas/LocalImportProvenance\"\n        signature_assessment:\n          $ref: \"#/components/schemas/ExternalPackageSignatureAssessment\"\n        source_provenance:\n          $ref: \"#/components/schemas/ExternalPackageSourceProvenance\"\n        execution_approval:\n          $ref: \"#/components/schemas/ExternalPackageExecutionApproval\"\n        update_eligibility:\n          $ref: \"#/components/schemas/ExternalPackageUpdateEligibility\"\n        security_summary:\n          $ref: \"#/components/schemas/ExternalPackageSecuritySummary\"\n        capability_contracts:\n          type: array\n          items: { $ref: \"#/components/schemas/CapabilityContractPin\" }\n        enable_state:\n          type: string\n          enum: [disabled, enabled, disabled_by_policy, disabled_incompatible]\n        disabled_reason: { type: string }\n        policy_revision: { type: integer, minimum: 0, maximum: 9007199254740991 }\n        management_revision: { type: integer, minimum: 0, maximum: 9007199254740991 }\n        revoke_epoch: { type: integer, minimum: 0, maximum: 9007199254740991 }\n        manifest:\n          $ref: \"../plugin/manifest-v5.schema.json\"\n        package_entries:\n          type: array\n          items: { $ref: \"#/components/schemas/PackageEntry\" }\n        runtime_requirement: { $ref: \"#/components/schemas/RuntimeRequirement\" }\n        version_history:\n          type: array\n          items:\n            $ref: \"#/components/schemas/PluginVersion\"\n        installed_at: { type: string, format: date-time }\n        enabled_at: { type: string, format: date-time }\n        updated_at: { type: string, format: date-time }\n        deleted_at: { type: string, format: date-time }\n        metadata:\n          type: object\n          additionalProperties: { type: string }\n    PackageEntry:\n      type: object\n      required: [path, size, sha256, mode]\n      additionalProperties: false\n      properties:\n        path: { type: string, minLength: 1 }\n        size: { type: integer, minimum: 0 }\n        sha256: { type: string, pattern: \"^[0-9a-f]{64}$\" }\n        mode: { type: string, minLength: 1 }\n        content_type: { type: string }\n    RuntimeRequirement:\n      type: object\n      required: [min_version]\n      additionalProperties: false\n      properties:\n        min_version: { $ref: \"#/components/schemas/StrictSemVer\" }\n        supported_targets:\n          type: array\n          uniqueItems: true\n          items:\n            type: string\n            enum: [darwin/amd64, darwin/arm64, linux/amd64, linux/arm64]\n    LocalImportProvenance:\n      type: object\n      required: [import_id, distribution, policy_epoch, unsigned_policy, assessed_at]\n      additionalProperties: false\n      properties:\n        import_id: { type: string, minLength: 1 }\n        distribution: { enum: [local_import] }\n        policy_epoch: { type: string, minLength: 1 }\n        unsigned_policy: { enum: [dev_only, review_required, block] }\n        assessed_at: { type: string, format: date-time }\n    PackageHashSet:\n      type: object\n      required: [package_sha256, manifest_sha256, entries_sha256]\n      additionalProperties: false\n      properties:\n        package_sha256: { type: string, pattern: \"^(sha256:)?[0-9a-f]{64}$\" }\n        manifest_sha256: { type: string, pattern: \"^(sha256:)?[0-9a-f]{64}$\" }\n        entries_sha256: { type: string, pattern: \"^(sha256:)?[0-9a-f]{64}$\" }\n    PluginReleaseRef:\n      type: object\n      required: [source_id, channel, release_metadata_ref, release_metadata_sha256, publisher_id, plugin_id, version, expected_hashes]\n      additionalProperties: false\n      properties:\n        source_id: { type: string, minLength: 1 }\n        channel: { type: string, pattern: \"^[a-z][a-z0-9._-]{0,127}$\" }\n        release_metadata_ref: { type: string, minLength: 1 }\n        release_metadata_sha256: { type: string, pattern: \"^(sha256:)?[0-9a-f]{64}$\" }\n        publisher_id: { type: string, minLength: 1 }\n        plugin_id: { type: string, minLength: 1 }\n        version: { $ref: \"#/components/schemas/StrictSemVer\" }\n        expected_hashes:\n          $ref: \"#/components/schemas/PackageHashSet\"\n    InstallReleaseRefRequest:\n      type: object\n      required: [plugin_instance_id, release_ref]\n      additionalProperties: false\n      properties:\n        release_ref:\n          $ref: \"#/components/schemas/PluginReleaseRef\"\n        plugin_instance_id: { type: string, minLength: 1 }\n    UpdateReleaseRefRequest:\n      type: object\n      required: [plugin_instance_id, release_ref, expected_management_revision]\n      additionalProperties: false\n      properties:\n        plugin_instance_id: { type: string, minLength: 1 }\n        release_ref:\n          $ref: \"#/components/schemas/PluginReleaseRef\"\n        expected_management_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n    DowngradeRequest:\n      type: object\n      required: [plugin_instance_id, expected_management_revision]\n      additionalProperties: false\n      properties:\n        plugin_instance_id: { type: string, minLength: 1 }\n        version: { $ref: \"#/components/schemas/StrictSemVer\" }\n        package_hash: { type: string }\n        expected_management_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n    EnableRequest:\n      type: object\n      required: [plugin_instance_id, expected_management_revision]\n      additionalProperties: false\n      properties:\n        plugin_instance_id: { type: string, minLength: 1 }\n        expected_management_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n    DisableRequest:\n      type: object\n      required: [plugin_instance_id, expected_management_revision]\n      additionalProperties: false\n      properties:\n        plugin_instance_id: { type: string, minLength: 1 }\n        reason: { type: string }\n        expected_management_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n    UninstallRequest:\n      type: object\n      required: [plugin_instance_id, delete_data, expected_management_revision]\n      additionalProperties: false\n      properties:\n        plugin_instance_id: { type: string, minLength: 1 }\n        delete_data: { type: boolean }\n        expected_management_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n    OpenSurfaceRequest:\n      type: object\n      required: [plugin_instance_id, surface_id, expected_management_revision]\n      additionalProperties: false\n      properties:\n        plugin_instance_id: { type: string, minLength: 1 }\n        surface_id: { type: string, minLength: 1 }\n        surface_instance_id: { type: string }\n        expected_management_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n    RevokeSessionScopeRequest:\n      type: object\n      additionalProperties: false\n      maxProperties: 0\n    EmptyRequest:\n      type: object\n      additionalProperties: false\n      maxProperties: 0\n    EmptyQueryRequest:\n      type: object\n      additionalProperties: false\n      maxProperties: 0\n    ListIntentsQueryRequest:\n      type: object\n      additionalProperties: false\n      properties:\n        intent_id: { type: string, minLength: 1 }\n        plugin_instance_id: { type: string, minLength: 1 }\n    ListOperationsQueryRequest:\n      type: object\n      additionalProperties: false\n      properties:\n        plugin_instance_id: { type: string, minLength: 1 }\n        cursor: { type: string, minLength: 1, maxLength: 1024 }\n        limit: { type: integer, minimum: 1, maximum: 500 }\n    ListRetainedDataQueryRequest:\n      type: object\n      additionalProperties: false\n      properties:\n        plugin_instance_id: { type: string, minLength: 1 }\n    ListPermissionsQueryRequest:\n      type: object\n      additionalProperties: false\n      properties:\n        plugin_instance_id: { type: string, minLength: 1 }\n        active_only: { type: boolean }\n    ListDiagnosticsQueryRequest:\n      type: object\n      additionalProperties: false\n      properties:\n        plugin_id: { type: string, minLength: 1 }\n        plugin_instance_id: { type: string, minLength: 1 }\n        surface_instance_id: { type: string, minLength: 1 }\n        type: { type: string, minLength: 1 }\n        severity: { type: string, enum: [info, warning] }\n        limit: { type: integer, minimum: 1, maximum: 1000 }\n    SettingsQueryRequest:\n      type: object\n      additionalProperties: false\n      required: [scope]\n      properties:\n        scope: { $ref: \"#/components/schemas/ResourceScopeKind\" }\n    SurfaceBootstrap:\n      type: object\n      additionalProperties: false\n      required:\n        - plugin_id\n        - plugin_instance_id\n        - plugin_version\n        - surface_id\n        - surface_instance_id\n        - active_fingerprint\n        - entry_path\n        - entry_sha256\n        - asset_session_nonce\n        - management_revision\n        - revoke_epoch\n        - runtime_generation_id\n        - asset_ticket\n        - asset_ticket_id\n        - bridge_nonce\n        - issued_at\n        - expires_at\n      properties:\n        plugin_id: { type: string, minLength: 1 }\n        plugin_instance_id: { type: string, minLength: 1 }\n        plugin_version: { $ref: \"#/components/schemas/StrictSemVer\" }\n        surface_id: { type: string, minLength: 1 }\n        surface_instance_id: { type: string, minLength: 1 }\n        active_fingerprint: { type: string, minLength: 1 }\n        entry_path: { type: string, minLength: 1 }\n        entry_sha256: { type: string, pattern: '^sha256:[0-9a-f]{64}$' }\n        asset_session_nonce: { type: string, minLength: 16 }\n        management_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n        revoke_epoch: { type: integer, minimum: 1, maximum: 9007199254740991 }\n        runtime_generation_id: { type: string, minLength: 1 }\n        asset_ticket: { type: string, minLength: 1 }\n        asset_ticket_id: { type: string, minLength: 1 }\n        bridge_nonce: { type: string, minLength: 16 }\n        issued_at: { type: string, format: date-time }\n        expires_at: { type: string, format: date-time }\n    PrepareSurfaceRequest:\n      type: object\n      required: [asset_ticket]\n      additionalProperties: false\n      properties:\n        asset_ticket: { type: string, minLength: 1 }\n    SurfacePreparation:\n      type: object\n      additionalProperties: false\n      required:\n        - asset_session\n        - asset_session_id\n        - asset_session_nonce\n        - entry_path\n        - entry_sha256\n        - management_revision\n        - revoke_epoch\n        - issued_at\n        - expires_at\n        - document\n      properties:\n        asset_session: { type: string, minLength: 1 }\n        asset_session_id: { type: string, minLength: 1 }\n        asset_session_nonce: { type: string, minLength: 16 }\n        entry_path: { type: string, minLength: 1 }\n        entry_sha256: { type: string, pattern: '^sha256:[0-9a-f]{64}$' }\n        management_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n        revoke_epoch: { type: integer, minimum: 1, maximum: 9007199254740991 }\n        issued_at: { type: string, format: date-time }\n        expires_at: { type: string, format: date-time }\n        document:\n          $ref: \"../plugin/opaque-surface-document-v3.schema.json\"\n    TrustedParentBridgeHandshake:\n      type: object\n      required: [type, plugin_id, surface_id, surface_instance_id, active_fingerprint, bridge_nonce, asset_session_nonce, management_revision, revoke_epoch, ui_protocol_version]\n      additionalProperties: false\n      properties:\n        type: { const: redevplugin.bridge.handshake }\n        plugin_id: { type: string, minLength: 1 }\n        surface_id: { type: string, minLength: 1 }\n        surface_instance_id: { type: string, minLength: 1 }\n        active_fingerprint: { type: string, minLength: 1 }\n        bridge_nonce: { type: string, minLength: 16 }\n        asset_session_nonce: { type: string, minLength: 16 }\n        management_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n        revoke_epoch: { type: integer, minimum: 1, maximum: 9007199254740991 }\n        ui_protocol_version: { const: plugin-ui-v5 }\n    TrustedParentBridgeTokenRequest:\n      type: object\n      required: [handshake, bridge_channel_id, handshake_transcript_sha256]\n      additionalProperties: false\n      properties:\n        handshake:\n          $ref: \"#/components/schemas/TrustedParentBridgeHandshake\"\n        bridge_channel_id: { type: string, minLength: 1 }\n        handshake_transcript_sha256:\n          type: string\n          pattern: '^sha256:[0-9a-f]{64}$'\n        previous_plugin_gateway_token:\n          type: string\n          minLength: 1\n          description: Required only when renewing the current bridge channel lease.\n    BridgeTokenResult:\n      type: object\n      additionalProperties: false\n      required: [plugin_gateway_token, plugin_gateway_token_id, asset_session, asset_session_id, issued_at, expires_at]\n      properties:\n        plugin_gateway_token: { type: string, minLength: 1 }\n        plugin_gateway_token_id: { type: string, minLength: 1 }\n        asset_session: { type: string, minLength: 1 }\n        asset_session_id: { type: string, minLength: 1 }\n        issued_at: { type: string, format: date-time }\n        expires_at: { type: string, format: date-time }\n    ReadSurfaceAssetRequest:\n      type: object\n      additionalProperties: false\n      required: [asset_session, asset_session_id, binding_id]\n      properties:\n        asset_session: { type: string, minLength: 1 }\n        asset_session_id: { type: string, minLength: 1 }\n        binding_id: { type: string, pattern: '^asset_[A-Za-z0-9_-]{8,128}$' }\n    SurfaceAssetResult:\n      type: object\n      additionalProperties: false\n      required: [path, sha256, content_type, content_base64]\n      properties:\n        path: { type: string, minLength: 1 }\n        sha256: { type: string, pattern: '^sha256:[0-9a-f]{64}$' }\n        content_type: { type: string, minLength: 1 }\n        content_base64: { type: string, contentEncoding: base64 }\n    ReadSurfaceStreamRequest:\n      type: object\n      additionalProperties: false\n      required: [stream_id, stream_ticket, read_id]\n      properties:\n        stream_id: { type: string, minLength: 1 }\n        stream_ticket: { type: string, minLength: 1 }\n        read_id: { type: string, pattern: '^read_[A-Za-z0-9_-]{8,128}$' }\n    AcknowledgeSurfaceStreamRequest:\n      type: object\n      additionalProperties: false\n      required: [stream_id, stream_ticket, delivery_id]\n      properties:\n        stream_id: { type: string, minLength: 1 }\n        stream_ticket: { type: string, minLength: 1 }\n        delivery_id: { type: string, pattern: '^delivery_[A-Za-z0-9_-]{8,128}$' }\n    SurfaceStreamResult:\n      type: object\n      additionalProperties: false\n      required: [read_id, events, done]\n      properties:\n        delivery_id: { type: string, pattern: '^delivery_[A-Za-z0-9_-]{8,128}$' }\n        read_id: { type: string, pattern: '^read_[A-Za-z0-9_-]{8,128}$' }\n        events:\n          type: array\n          items:\n            $ref: \"#/components/schemas/StreamEvent\"\n        done: { type: boolean }\n        terminal_status:\n          enum: [closed, canceled, failed, orphaned_after_disable, orphaned_after_uninstall]\n      allOf:\n        - if:\n            properties: { events: { minItems: 1 } }\n            required: [events]\n          then:\n            required: [delivery_id]\n        - if:\n            properties: { done: { const: false } }\n            required: [done]\n          then:\n            not:\n              required: [terminal_status]\n        - if:\n            properties: { done: { const: true } }\n            required: [done]\n          then:\n            required: [delivery_id, terminal_status]\n    SurfaceStreamAcknowledgementResult:\n      type: object\n      required: [acknowledged]\n      additionalProperties: false\n      properties:\n        acknowledged: { const: true }\n    CancelSurfaceOperationRequest:\n      type: object\n      additionalProperties: false\n      required: [operation_id, bridge_channel_id]\n      properties:\n        operation_id: { type: string, pattern: '^operation_[A-Za-z0-9_-]{8,150}$' }\n        bridge_channel_id: { type: string, minLength: 1, maxLength: 256 }\n        reason: { type: string, maxLength: 256 }\n    RejectSurfaceConfirmationRequest:\n      type: object\n      additionalProperties: false\n      required: [plugin_instance_id, bridge_channel_id, plugin_gateway_token, confirmation_id]\n      properties:\n        plugin_instance_id: { type: string, minLength: 1 }\n        bridge_channel_id: { type: string, minLength: 1, maxLength: 256 }\n        plugin_gateway_token: { type: string, minLength: 1 }\n        confirmation_id: { type: string, pattern: '^confirmation_[A-Za-z0-9_-]{8,128}$' }\n    ConfirmationRejectionResult:\n      type: object\n      additionalProperties: false\n      required: [rejected]\n      properties:\n        rejected: { const: true }\n    StreamEvent:\n      type: object\n      additionalProperties: false\n      required: [stream_id, sequence, kind, at]\n      properties:\n        stream_id: { type: string, minLength: 1 }\n        sequence: { type: integer, minimum: 0 }\n        kind: { type: string, minLength: 1 }\n        data: { type: string, contentEncoding: base64 }\n        error: { type: string }\n        at: { type: string, format: date-time }\n    DisposeSurfaceRequest:\n      type: object\n      additionalProperties: false\n      required: [bridge_nonce]\n      properties:\n        bridge_nonce: { type: string, minLength: 16 }\n    RPCRequest:\n      type: object\n      required: [plugin_instance_id, surface_instance_id, bridge_channel_id, plugin_gateway_token, method]\n      additionalProperties: false\n      properties:\n        plugin_instance_id: { type: string, minLength: 1 }\n        surface_instance_id: { type: string, minLength: 1 }\n        bridge_channel_id: { type: string, minLength: 1 }\n        plugin_gateway_token: { type: string, minLength: 1 }\n        confirmation_id: { type: string }\n        method: { type: string, minLength: 1 }\n        params:\n          type: object\n          additionalProperties: true\n    PrepareMethodConfirmationRequest:\n      type: object\n      required: [plugin_instance_id, surface_instance_id, bridge_channel_id, plugin_gateway_token, method]\n      additionalProperties: false\n      properties:\n        plugin_instance_id: { type: string, minLength: 1 }\n        surface_instance_id: { type: string, minLength: 1 }\n        bridge_channel_id: { type: string, minLength: 1 }\n        plugin_gateway_token: { type: string, minLength: 1 }\n        method: { type: string, minLength: 1 }\n        params:\n          type: object\n          additionalProperties: true\n    RPCResult:\n      oneOf:\n        - type: object\n          additionalProperties: false\n          properties:\n            data: true\n          not:\n            anyOf:\n              - required: [operation_id]\n              - required: [stream_id]\n              - required: [confirmation_required]\n        - type: object\n          additionalProperties: false\n          required: [operation_id]\n          properties:\n            data: true\n            operation_id: { type: string, minLength: 1 }\n        - type: object\n          additionalProperties: false\n          required: [operation_id, stream_id, stream_ticket, stream_ticket_id, stream_expires_at]\n          properties:\n            data: true\n            operation_id: { type: string, minLength: 1 }\n            stream_id: { type: string, minLength: 1 }\n            stream_ticket: { type: string, minLength: 1 }\n            stream_ticket_id: { type: string, minLength: 1 }\n            stream_expires_at: { type: string, format: date-time }\n        - type: object\n          additionalProperties: false\n          required: [confirmation_required, confirmation_token_id, request_hash, plan_hash]\n          properties:\n            confirmation_required: { const: true }\n            confirmation_token_id: { type: string, minLength: 1 }\n            request_hash: { type: string, pattern: '^sha256:[0-9a-f]{64}$' }\n            plan_hash: { type: string, pattern: '^sha256:[0-9a-f]{64}$' }\n    RiskFlag:\n      type: object\n      required: [id, severity, summary]\n      additionalProperties: false\n      properties:\n        id:\n          type: string\n          minLength: 1\n          description: Stable machine-readable risk identifier.\n        severity:\n          type: string\n          enum: [info, low, medium, high, critical]\n        summary: { type: string, minLength: 1 }\n        description: { type: string }\n        requires_confirmation: { type: boolean }\n        requires_admin: { type: boolean }\n        data_loss_risk: { type: boolean }\n        destructive: { type: boolean }\n    RiskPlan:\n      type: object\n      required: [schema_version, summary, risk_flags]\n      additionalProperties: false\n      properties:\n        schema_version: { const: redevplugin.capability.risk_plan.v1 }\n        capability_id: { type: string }\n        binding_id: { type: string }\n        method: { type: string }\n        target_method: { type: string }\n        action: { type: string }\n        effect:\n          type: string\n          enum: [read, write, execute, delete, admin]\n        resource_ref: { type: string }\n        resource_display_name: { type: string }\n        summary: { type: string, minLength: 1 }\n        risk_flags:\n          type: array\n          items:\n            $ref: \"#/components/schemas/RiskFlag\"\n        requires_confirmation: { type: boolean }\n        requires_admin: { type: boolean }\n        data_loss_risk: { type: boolean }\n        destructive: { type: boolean }\n        deny_reason: { type: string }\n        details:\n          type: object\n          additionalProperties: true\n    PluginMethodConfirmationPreparation:\n      type: object\n      required: [confirmation_id, confirmation_token_id, request_hash, plan_hash, expires_at]\n      additionalProperties: false\n      properties:\n        confirmation_id: { type: string, minLength: 1 }\n        confirmation_token_id:\n          type: string\n          minLength: 1\n          description: Opaque audit/display id for the server-held confirmation token. It is not a credential.\n        request_hash:\n          type: string\n          pattern: \"^sha256:[0-9a-f]{64}$\"\n        plan_hash:\n          type: string\n          pattern: \"^sha256:[0-9a-f]{64}$\"\n        plan:\n          description: Host-redacted confirmation plan payload returned by the declared preflight method, when available.\n          oneOf:\n            - $ref: \"#/components/schemas/RiskPlan\"\n            - type: object\n              additionalProperties: true\n        expires_at: { type: string, format: date-time }\n    InvokeIntentRequest:\n      type: object\n      required: [intent_id]\n      additionalProperties: false\n      properties:\n        plugin_instance_id: { type: string }\n        intent_id: { type: string, minLength: 1 }\n        params:\n          type: object\n          additionalProperties: true\n    CancelOperationRequest:\n      type: object\n      additionalProperties: false\n      properties:\n        reason: { type: string }\n    CapabilityContractPin:\n      $ref: \"../plugin/host-capability-pin-v1.schema.json\"\n    PublicOperationBinding:\n      type: object\n      description: Public immutable execution evidence embedded into operation responses. Session and bridge channel ownership fields are excluded.\n      required:\n        - invocation_id\n        - audit_correlation_id\n        - publisher_id\n        - plugin_id\n        - plugin_instance_id\n        - plugin_version\n        - active_fingerprint\n        - route_kind\n        - capability_id\n        - capability_version\n        - binding_id\n        - method\n        - target_method\n        - effect\n        - execution\n        - permissions\n        - confirmation\n        - revision\n        - quota\n        - target\n        - target_descriptor_sha256\n      properties:\n        invocation_id: { type: string, minLength: 1 }\n        audit_correlation_id: { type: string, minLength: 1 }\n        operation_id: { type: string, minLength: 1 }\n        stream_id: { type: string, minLength: 1 }\n        publisher_id: { type: string, minLength: 1 }\n        plugin_id: { type: string, minLength: 1 }\n        plugin_instance_id: { type: string, minLength: 1 }\n        plugin_version: { $ref: \"#/components/schemas/StrictSemVer\" }\n        active_fingerprint: { type: string, minLength: 1 }\n        surface_instance_id: { type: string }\n        route_kind: { type: string, enum: [capability, worker, core_action] }\n        capability_id: { type: string, minLength: 1 }\n        capability_version: { $ref: \"#/components/schemas/StrictSemVer\" }\n        binding_id: { type: string, minLength: 1 }\n        contract:\n          $ref: \"#/components/schemas/CapabilityContractPin\"\n        method: { type: string, minLength: 1 }\n        target_method: { type: string, minLength: 1 }\n        effect: { type: string, enum: [read, write, execute, delete, admin] }\n        execution: { type: string, enum: [sync, operation, subscription] }\n        permissions:\n          type: object\n          additionalProperties: false\n          required: [required, granted]\n          properties:\n            required: { type: array, items: { type: string } }\n            granted: { type: array, items: { type: string } }\n        confirmation:\n          type: object\n          additionalProperties: false\n          required: [required, confirmed]\n          properties:\n            required: { type: boolean }\n            confirmed: { type: boolean }\n            confirmation_id: { type: string }\n            request_sha256: { type: string }\n            plan_sha256: { type: string }\n            target_sha256: { type: string }\n        revision:\n          type: object\n          additionalProperties: false\n          required: [policy_revision, management_revision, revoke_epoch]\n          properties:\n            policy_revision: { type: integer, minimum: 0, maximum: 9007199254740991 }\n            management_revision: { type: integer, minimum: 0, maximum: 9007199254740991 }\n            revoke_epoch: { type: integer, minimum: 0, maximum: 9007199254740991 }\n        quota:\n          type: object\n          additionalProperties: false\n          properties:\n            max_concurrent: { type: integer, minimum: 0, maximum: 9007199254740991 }\n            max_duration_ms: { type: integer, minimum: 0, maximum: 9007199254740991 }\n            max_stream_bytes: { type: integer, minimum: 0, maximum: 9007199254740991 }\n            expires_at: { type: string, format: date-time }\n        target:\n          type: object\n          additionalProperties: false\n          required: [kind, fields]\n          properties:\n            kind: { type: string, minLength: 1 }\n            fields: { type: object, additionalProperties: true }\n        target_descriptor_sha256: { type: string, pattern: '^sha256:[0-9a-f]{64}$' }\n        stream_event_type_name: { type: string, minLength: 1 }\n        stream_event_schema_sha256: { type: string, pattern: '^[0-9a-f]{64}$' }\n      oneOf:\n        - required: [route_kind, contract]\n          properties:\n            route_kind: { const: capability }\n        - required: [route_kind]\n          properties:\n            route_kind: { const: worker }\n          not:\n            required: [contract]\n        - required: [route_kind]\n          properties:\n            route_kind: { const: core_action }\n          not:\n            required: [contract]\n    OperationRecord:\n      allOf:\n        - $ref: \"#/components/schemas/PublicOperationBinding\"\n        - type: object\n          required:\n            - operation_id\n            - cancelable\n            - created_at\n            - updated_at\n          properties:\n            operation_id: { type: string, minLength: 1 }\n            execution: { type: string, enum: [operation, subscription] }\n            cancelable: { type: boolean }\n            cancel_ack_timeout_ms: { type: integer, minimum: 0 }\n            disable_behavior: { type: string, enum: [cancel, orphan, wait] }\n            uninstall_behavior: { type: string, enum: [cancel_then_block_delete, force_cleanup_allowed] }\n            created_at: { type: string, format: date-time }\n            updated_at: { type: string, format: date-time }\n            cancel_requested_at: { type: string, format: date-time }\n            orphaned_at: { type: string, format: date-time }\n            terminal_at: { type: string, format: date-time }\n          oneOf:\n            - type: object\n              required: [status, failure_code, reason]\n              properties:\n                status: { const: failed }\n                failure_code: { $ref: \"#/components/schemas/ExecutionFailureCode\" }\n                reason: { const: \"execution failed\" }\n            - type: object\n              required: [status]\n              properties:\n                status:\n                  enum: [running, cancel_requested, canceled, completed, orphaned_after_disable, orphaned_after_uninstall]\n                reason: { type: string }\n              not:\n                required: [failure_code]\n      unevaluatedProperties: false\n    ExecutionFailureCode:\n      type: string\n      enum: [adapter_failed, contract_invalid, platform_failed, quota_exceeded, runtime_failed]\n    StartRuntimeRequest:\n      type: object\n      required: [target]\n      additionalProperties: false\n      properties:\n        target: { $ref: \"#/components/schemas/RuntimeTarget\" }\n    ExportDataRequest:\n      type: object\n      required: [plugin_instance_id]\n      additionalProperties: false\n      properties:\n        plugin_instance_id: { type: string, minLength: 1 }\n    DeleteDataExportRequest:\n      type: object\n      required: [plugin_instance_id, bundle_ref]\n      additionalProperties: false\n      properties:\n        plugin_instance_id: { type: string, minLength: 1 }\n        bundle_ref: { type: string, minLength: 1 }\n    ImportDataRequest:\n      type: object\n      required: [plugin_instance_id, bundle_ref, expected_management_revision]\n      additionalProperties: false\n      properties:\n        plugin_instance_id: { type: string, minLength: 1 }\n        bundle_ref: { type: string, minLength: 1 }\n        expected_management_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n    PluginDataBinding:\n      type: object\n      required: [plugin_instance_id, generation_id, state, revision, shape_hash]\n      additionalProperties: false\n      properties:\n        plugin_instance_id: { type: string, minLength: 1 }\n        generation_id: { type: string, minLength: 1 }\n        state: { type: string, enum: [active, retained] }\n        revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n        shape_hash: { type: string, pattern: \"^[0-9a-f]{64}$\" }\n        retained_at: { type: string, format: date-time }\n        expires_at: { type: string, format: date-time }\n    RetainedDataList:\n      type: object\n      required: [retained_data]\n      additionalProperties: false\n      properties:\n        retained_data:\n          type: array\n          items:\n            $ref: \"#/components/schemas/PluginDataBinding\"\n    RetainedDataCleanupResult:\n      type: object\n      required: [deleted]\n      additionalProperties: false\n      properties:\n        deleted:\n          type: array\n          items:\n            $ref: \"#/components/schemas/PluginDataBinding\"\n    DeleteRetainedDataRequest:\n      type: object\n      required: [plugin_instance_id, expected_binding_revision]\n      additionalProperties: false\n      properties:\n        plugin_instance_id: { type: string, minLength: 1 }\n        expected_binding_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n    BindRetainedDataRequest:\n      type: object\n      required: [source_plugin_instance_id, expected_source_binding_revision, target_plugin_instance_id, target_expected_management_revision]\n      additionalProperties: false\n      properties:\n        source_plugin_instance_id: { type: string, minLength: 1 }\n        expected_source_binding_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n        target_plugin_instance_id: { type: string, minLength: 1 }\n        target_expected_management_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n    CleanupExpiredRetainedDataRequest:\n      type: object\n      additionalProperties: false\n    GrantPermissionRequest:\n      type: object\n      required: [plugin_instance_id, permission_id, expected_policy_revision, expected_management_revision, expected_revoke_epoch]\n      additionalProperties: false\n      properties:\n        plugin_instance_id: { type: string, minLength: 1 }\n        permission_id: { type: string, minLength: 1 }\n        expected_policy_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n        expected_management_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n        expected_revoke_epoch: { type: integer, minimum: 0, maximum: 9007199254740991 }\n        expires_at: { type: string, format: date-time }\n    RevokePermissionRequest:\n      type: object\n      required: [plugin_instance_id, permission_id, expected_policy_revision, expected_management_revision, expected_revoke_epoch]\n      additionalProperties: false\n      properties:\n        plugin_instance_id: { type: string, minLength: 1 }\n        permission_id: { type: string, minLength: 1 }\n        expected_policy_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n        expected_management_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n        expected_revoke_epoch: { type: integer, minimum: 0, maximum: 9007199254740991 }\n        reason: { type: string }\n    PutSecurityPolicyRequest:\n      type: object\n      required: [expected_policy_revision, expected_management_revision, expected_revoke_epoch, allowed_permissions, denied_methods]\n      additionalProperties: false\n      properties:\n        expected_policy_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n        expected_management_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n        expected_revoke_epoch: { type: integer, minimum: 0, maximum: 9007199254740991 }\n        allowed_permissions:\n          type: array\n          uniqueItems: true\n          items: { type: string, minLength: 1 }\n        denied_methods:\n          type: array\n          uniqueItems: true\n          items: { type: string, minLength: 1 }\n    DeleteSecurityPolicyRequest:\n      type: object\n      required: [expected_policy_revision, expected_management_revision, expected_revoke_epoch]\n      additionalProperties: false\n      properties:\n        expected_policy_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n        expected_management_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n        expected_revoke_epoch: { type: integer, minimum: 0, maximum: 9007199254740991 }\n    SecretRefRequest:\n      type: object\n      required: [plugin_instance_id, secret_ref, scope]\n      additionalProperties: false\n      properties:\n        plugin_instance_id: { type: string, minLength: 1 }\n        secret_ref: { type: string, minLength: 1 }\n        scope: { type: string, enum: [user, environment] }\n    ResourceScopeKind:\n      type: string\n      enum: [user, environment]\n    PatchSettingsRequest:\n      type: object\n      required: [scope, expected_values_revision]\n      additionalProperties: false\n      minProperties: 3\n      properties:\n        scope: { $ref: \"#/components/schemas/ResourceScopeKind\" }\n        expected_values_revision: { type: integer, minimum: 1, maximum: 9007199254740991 }\n        set:\n          type: object\n          minProperties: 1\n          additionalProperties: true\n        remove:\n          type: array\n          minItems: 1\n          uniqueItems: true\n          items: { type: string, minLength: 1 }\n";
 }, {
     readonly id: "process-containment-schema";
     readonly path: "spec/plugin/process-containment-v1.schema.json";
@@ -297,8 +297,8 @@ export declare const generatedRegistryContract: {
     readonly id: "contract-registry";
     readonly path: "spec/plugin/contract-registry-v2.json";
     readonly version: "contract-registry-v2";
-    readonly sha256: "49cf1ddb6049dfb3e7960d57aa87f3a7385ae1836ca7c7b12cefe03c0588a1ac";
-    readonly body: "{\n  \"schema_version\": \"redevplugin.contract_registry.v2\",\n  \"registry_version\": \"contract-registry-v2\",\n  \"artifacts\": [\n    {\n      \"id\": \"compatibility-manifest-schema\",\n      \"path\": \"spec/plugin/compatibility-manifest-v8.schema.json\",\n      \"version\": \"compatibility-manifest-v8\",\n      \"sha256\": \"a1831e0ae9a1b47d92e7ad9879b1ca4e3510ebc212b87360595b672e8b87bc79\"\n    },\n    {\n      \"id\": \"contract-registry-schema\",\n      \"path\": \"spec/plugin/contract-registry-v2.schema.json\",\n      \"version\": \"contract-registry-v2\",\n      \"sha256\": \"d516b3565158ac1b0d5e9f86b91b13ac19321ab3ff54468be41951b68d7085ac\"\n    },\n    {\n      \"id\": \"error-codes-schema\",\n      \"path\": \"spec/plugin/error-codes-v6.schema.json\",\n      \"version\": \"error-codes-v6\",\n      \"sha256\": \"094cb980156c17af4866942b51e6a1032ea7d1ae0675b329d59a765223ccda28\"\n    },\n    {\n      \"id\": \"host-capability-compatibility-schema\",\n      \"path\": \"spec/plugin/host-capability-compatibility-v1.schema.json\",\n      \"version\": \"host-capability-compatibility-v1\",\n      \"sha256\": \"361ebbf7009aeb66c763ecde46427b17b6cf7d2307c01886c5987a1f4f1762de\"\n    },\n    {\n      \"id\": \"host-capability-contract-schema\",\n      \"path\": \"spec/plugin/host-capability-contract-v1.schema.json\",\n      \"version\": \"host-capability-contract-v1\",\n      \"sha256\": \"0a653e36d44104f1d16b06ee424648086c146f23c907b176bdf470ae73025485\"\n    },\n    {\n      \"id\": \"host-capability-manifest-schema\",\n      \"path\": \"spec/plugin/host-capability-manifest-v1.schema.json\",\n      \"version\": \"host-capability-manifest-v1\",\n      \"sha256\": \"5f13a8e5f918378b9cba9fdc133a9a75ba3a8311c30cb6a02ca0aba09035110e\"\n    },\n    {\n      \"id\": \"host-capability-notices-schema\",\n      \"path\": \"spec/plugin/host-capability-notices-v1.schema.json\",\n      \"version\": \"host-capability-notices-v1\",\n      \"sha256\": \"6affd5d0ae90239f6fd08cbeddae4eef393efa2838c9e4935874ba3dc0e05948\"\n    },\n    {\n      \"id\": \"host-capability-pin-schema\",\n      \"path\": \"spec/plugin/host-capability-pin-v1.schema.json\",\n      \"version\": \"host-capability-pin-v1\",\n      \"sha256\": \"20526a5934f0d85a3db7882492487266f09de5bcd176e2c7936f05d0b7fe0338\"\n    },\n    {\n      \"id\": \"host-capability-signature-schema\",\n      \"path\": \"spec/plugin/host-capability-signature-v1.schema.json\",\n      \"version\": \"host-capability-signature-v1\",\n      \"sha256\": \"88cbc1d63afb7e289ca4f8b7c76f702b8d20156f7722c1b71f3ab9138a240a5e\"\n    },\n    {\n      \"id\": \"iframe-bridge-schema\",\n      \"path\": \"spec/plugin/bridge-v5.schema.json\",\n      \"version\": \"bridge-v5\",\n      \"sha256\": \"ad8ccc7e1900ecb871432f07296dd681ae6faea9377e52f5ddca90300c04f4da\"\n    },\n    {\n      \"id\": \"manifest-schema\",\n      \"path\": \"spec/plugin/manifest-v5.schema.json\",\n      \"version\": \"manifest-v5\",\n      \"sha256\": \"9695f6163aa539b9e3a933367c98850257c6d7bb8d61b36fd5f83b3ab61746f7\"\n    },\n    {\n      \"id\": \"network-grant-schema\",\n      \"path\": \"spec/plugin/network-grant-v2.schema.json\",\n      \"version\": \"network-grant-v2\",\n      \"sha256\": \"5fc1cfc3469a992e551fd392fab982abb6f95e456a1cb768ceca137f7c693abc\"\n    },\n    {\n      \"id\": \"opaque-surface-document-schema\",\n      \"path\": \"spec/plugin/opaque-surface-document-v3.schema.json\",\n      \"version\": \"opaque-surface-document-v3\",\n      \"sha256\": \"63419ff5b5a8890e14f97ca29aaae175b93daff61d4567c5bdff7f6e6a9e7450\"\n    },\n    {\n      \"id\": \"opaque-surface-transport-schema\",\n      \"path\": \"spec/plugin/opaque-surface-transport-v4.schema.json\",\n      \"version\": \"opaque-surface-transport-v4\",\n      \"sha256\": \"70a32dc8bf281cea2c92492c466fd477070c62156a3f593d45eb460cde62dca2\"\n    },\n    {\n      \"id\": \"owner-scope-inventory-registry\",\n      \"path\": \"spec/plugin/owner-scope-inventories-v1.json\",\n      \"version\": \"owner-scope-inventory-registry-v1\",\n      \"sha256\": \"f655313a641368383b3d84b6ea4f6a2a2ef42a44a4dd23f71211361c9c2e0505\"\n    },\n    {\n      \"id\": \"owner-scope-inventory-schema\",\n      \"path\": \"spec/plugin/owner-scope-inventory-v1.schema.json\",\n      \"version\": \"owner-scope-inventory-v1\",\n      \"sha256\": \"21dc4980103f3a36f4252ce141d7350476ec00968e8a320695e450274e928be1\"\n    },\n    {\n      \"id\": \"owner-scope-migration-schema\",\n      \"path\": \"spec/plugin/owner-scope-migration-v1.schema.json\",\n      \"version\": \"owner-scope-migration-v1\",\n      \"sha256\": \"e73443813e19e4cfb05748eb75d5cf04f43db3bed9d2be0c893c13bda88a5993\"\n    },\n    {\n      \"id\": \"package-signature-schema\",\n      \"path\": \"spec/plugin/package-signature-v1.schema.json\",\n      \"version\": \"package-signature-v1\",\n      \"sha256\": \"13951c0f6831ba28647774368c76a817868aeb7984628e2cf3dc4ad1b54f8284\"\n    },\n    {\n      \"id\": \"performance-contract\",\n      \"path\": \"spec/plugin/performance-contract-v3.json\",\n      \"version\": \"performance-contract-v3\",\n      \"sha256\": \"a4e1a099dc16f2b0a4d6bdc5fdf8f6ce622948ffec40f70bfc2743286a2b816b\"\n    },\n    {\n      \"id\": \"performance-evidence-schema\",\n      \"path\": \"spec/plugin/performance-evidence-v3.schema.json\",\n      \"version\": \"performance-evidence-v3\",\n      \"sha256\": \"a2f5e94071bb09a9327fc55ad3f6c39052b01c3e54cceb8b974dc244667a0326\"\n    },\n    {\n      \"id\": \"platform-package-publication-schema\",\n      \"path\": \"spec/plugin/platform-package-publication-v1.schema.json\",\n      \"version\": \"platform-package-publication-v1\",\n      \"sha256\": \"20450b516c34d5a122020f4064ddfa03ffcb97ffea661e0868cd09760b3f08b0\"\n    },\n    {\n      \"id\": \"platform-package-set-schema\",\n      \"path\": \"spec/plugin/platform-package-set-v1.schema.json\",\n      \"version\": \"platform-package-set-v1\",\n      \"sha256\": \"4d9979f5205ec047895b64c995312c588d998bb1c1448f6c9c559f1b7ab0d796\"\n    },\n    {\n      \"id\": \"plugin-platform-openapi\",\n      \"path\": \"spec/openapi/plugin-platform-v8.yaml\",\n      \"version\": \"plugin-platform-v8\",\n      \"sha256\": \"290883ff79b74badbf9f6feddb4dfbef820a4ef4622a7e3fca815e3abb2c4eac\"\n    },\n    {\n      \"id\": \"process-containment-schema\",\n      \"path\": \"spec/plugin/process-containment-v1.schema.json\",\n      \"version\": \"process-containment-v1\",\n      \"sha256\": \"930ea44b1f62361706e994649e84f62af0a6418b77a661ae9bf9c10f1398e3fc\"\n    },\n    {\n      \"id\": \"quarantine-cleanup-schema\",\n      \"path\": \"spec/plugin/quarantine-cleanup-v1.schema.json\",\n      \"version\": \"quarantine-cleanup-v1\",\n      \"sha256\": \"0aced01a8d409953d5075a799ac273cae79e285ac82debe93ac4d8b706571ad1\"\n    },\n    {\n      \"id\": \"release-metadata-schema\",\n      \"path\": \"spec/plugin/release-metadata-v5.schema.json\",\n      \"version\": \"release-metadata-v5\",\n      \"sha256\": \"255ef3deb7d2758a43e69e533a08aa28106f8edc2e7385ab0aec0d50c1ef3d7a\"\n    },\n    {\n      \"id\": \"release-revocation-pointer-schema\",\n      \"path\": \"spec/plugin/release-revocation-pointer-v1.schema.json\",\n      \"version\": \"release-revocation-pointer-v1\",\n      \"sha256\": \"a9b7b64cb2dbf89500f0d191a6b2b9ab42eb806a452eb8338895a48ec7d7551e\"\n    },\n    {\n      \"id\": \"release-revocation-schema\",\n      \"path\": \"spec/plugin/release-revocation-v2.schema.json\",\n      \"version\": \"release-revocation-v2\",\n      \"sha256\": \"c3b40c05bc0dea422a272ee62ca45d0efb6456278b0707c5a12f39b004b84cb4\"\n    },\n    {\n      \"id\": \"release-root-delegation-schema\",\n      \"path\": \"spec/plugin/release-root-delegation-v1.schema.json\",\n      \"version\": \"release-root-delegation-v1\",\n      \"sha256\": \"c1adbb13eaeeca145d5ee787ff43777e60a5f329e460d20b8db358e4f5fc4825\"\n    },\n    {\n      \"id\": \"release-signature-envelope-schema\",\n      \"path\": \"spec/plugin/release-signature-envelope-v1.schema.json\",\n      \"version\": \"release-signature-envelope-v1\",\n      \"sha256\": \"7df9afd22bfdebfa89dc3bdb46ecdbe22a91ecce35fa46c492dd9795c66fae29\"\n    },\n    {\n      \"id\": \"release-signing-ledger-evidence-schema\",\n      \"path\": \"spec/plugin/release-signing-ledger-evidence-v1.schema.json\",\n      \"version\": \"release-signing-ledger-evidence-v1\",\n      \"sha256\": \"9ab8b7f65dedcd119d578debb4f6ff97fc35f4c7ac95c0e5435f8b0959bc1a5c\"\n    },\n    {\n      \"id\": \"release-signing-ledger-receipt-schema\",\n      \"path\": \"spec/plugin/release-signing-ledger-receipt-v1.schema.json\",\n      \"version\": \"release-signing-ledger-receipt-v1\",\n      \"sha256\": \"29210cfefd967017c5c74bcf8489bd50511c5c9f36d17b0200056ccb90c30561\"\n    },\n    {\n      \"id\": \"release-signing-ledger-schema\",\n      \"path\": \"spec/plugin/release-signing-ledger-v1.schema.json\",\n      \"version\": \"release-signing-ledger-v1\",\n      \"sha256\": \"0c72b30bfd6b857b9809e48e1b7eaaeb7134d5afd6a935aa8373465054403765\"\n    },\n    {\n      \"id\": \"release-signing-subject-schema\",\n      \"path\": \"spec/plugin/release-signing-subject-v1.schema.json\",\n      \"version\": \"release-signing-subject-v1\",\n      \"sha256\": \"876b1459824f90042bd141e96bfea4633333bdf2a227e15b6e25c72db1179c8e\"\n    },\n    {\n      \"id\": \"release-source-policy-pointer-schema\",\n      \"path\": \"spec/plugin/release-source-policy-pointer-v1.schema.json\",\n      \"version\": \"release-source-policy-pointer-v1\",\n      \"sha256\": \"1a78cc3897ffbcdb605d2e9265d765207a4647d3f53fa5736aec65bf5f54e81c\"\n    },\n    {\n      \"id\": \"release-source-policy-schema\",\n      \"path\": \"spec/plugin/release-source-policy-v2.schema.json\",\n      \"version\": \"release-source-policy-v2\",\n      \"sha256\": \"6a5a5eab317a86beea925a611ca8a7a2d937547c039ce147b5993f69a5611237\"\n    },\n    {\n      \"id\": \"release-trust-state-schema\",\n      \"path\": \"spec/plugin/release-trust-state-v1.schema.json\",\n      \"version\": \"release-trust-state-v1\",\n      \"sha256\": \"19ffa182932a22401a33ee4c9921e957c67895c2d8b041c9a27ee3530bdfb2d2\"\n    },\n    {\n      \"id\": \"resource-scope-schema\",\n      \"path\": \"spec/plugin/resource-scope-v1.schema.json\",\n      \"version\": \"resource-scope-v1\",\n      \"sha256\": \"e6021bd576c7220ad5536645a7ad8e57ee7aeb9901c31a89444fa6b695d8dc6f\"\n    },\n    {\n      \"id\": \"runtime-admission-schema\",\n      \"path\": \"spec/plugin/runtime-admission-v1.schema.json\",\n      \"version\": \"runtime-admission-v1\",\n      \"sha256\": \"bee7b149876447d663a4099dbd71e71fa97f8ff80ddf4e12cbfba951a47c4beb\"\n    },\n    {\n      \"id\": \"runtime-descriptor-schema\",\n      \"path\": \"spec/plugin/runtime-descriptor-v2.schema.json\",\n      \"version\": \"runtime-descriptor-v2\",\n      \"sha256\": \"2ba59f6fb70d4ad757f60aca5541f4a44886542525e5bf76c393cd2368188351\"\n    },\n    {\n      \"id\": \"runtime-exec-journal-schema\",\n      \"path\": \"spec/plugin/runtime-exec-journal-v1.schema.json\",\n      \"version\": \"runtime-exec-journal-v1\",\n      \"sha256\": \"2bddbba383843b8ebc1554009909f0bb25e98616be763826a697cb0f408870d2\"\n    },\n    {\n      \"id\": \"rust-ipc-schema\",\n      \"path\": \"spec/plugin/ipc-v6.schema.json\",\n      \"version\": \"rust-ipc-v6\",\n      \"sha256\": \"9814ca091ac2e4e8435c1ab553e248e9d2e792de93ce9fd27bd030486774837f\"\n    },\n    {\n      \"id\": \"session-scope-schema\",\n      \"path\": \"spec/plugin/session-scope-v1.schema.json\",\n      \"version\": \"session-scope-v1\",\n      \"sha256\": \"3df0084264f0aff9fe2261c237cea439adb5cdc2534bfaaa0488d5992d4a7d2e\"\n    },\n    {\n      \"id\": \"target-classifier-fixture\",\n      \"path\": \"spec/plugin/target-classifier-v2.json\",\n      \"version\": \"target-classifier-v2\",\n      \"sha256\": \"ae7336cce77a2e820f96f1cc309b93f8442c932dcebec25e3890d31cd098e2d1\"\n    },\n    {\n      \"id\": \"token-ticket-schema\",\n      \"path\": \"spec/plugin/token-ticket-v4.schema.json\",\n      \"version\": \"token-ticket-v4\",\n      \"sha256\": \"5cf365b5b52a331ac0d3ad35a98be3c2ce668804ae88fdeaf9679a44db14feb1\"\n    },\n    {\n      \"id\": \"trusted-time-evidence-schema\",\n      \"path\": \"spec/plugin/trusted-time-evidence-v1.schema.json\",\n      \"version\": \"trusted-time-evidence-v1\",\n      \"sha256\": \"4398cbd2a3eea42a85008ee16a69d7adb265673e6749b1f13a4f1610f36e5e38\"\n    },\n    {\n      \"id\": \"trusted-time-leaf-schema\",\n      \"path\": \"spec/plugin/trusted-time-leaf-v1.schema.json\",\n      \"version\": \"trusted-time-leaf-v1\",\n      \"sha256\": \"1c25eb0040800eef145aa2bb4c0e1ae197ae584d365e9595ab89037e26fe5ddb\"\n    },\n    {\n      \"id\": \"wasm-worker-schema\",\n      \"path\": \"spec/plugin/wasm-worker-v2.schema.json\",\n      \"version\": \"redevplugin-wasm-worker-v2\",\n      \"sha256\": \"00bf123f3a9ed932de4b71c180e2a5c34af0f82050defb271fedec42cf217902\"\n    },\n    {\n      \"id\": \"worker-invocation-schema\",\n      \"path\": \"spec/plugin/worker-invocation-v3.schema.json\",\n      \"version\": \"worker-invocation-v3\",\n      \"sha256\": \"f08af491cbf5e7b71d1aeafbeac9ae581ee5fc3bcb76184daec369f94bab3927\"\n    }\n  ]\n}\n";
+    readonly sha256: "280c8d1cd4697369c4bef757ca9f6d8aa7e6992d28df4ce3ea06df9f3317a2b8";
+    readonly body: "{\n  \"schema_version\": \"redevplugin.contract_registry.v2\",\n  \"registry_version\": \"contract-registry-v2\",\n  \"artifacts\": [\n    {\n      \"id\": \"compatibility-manifest-schema\",\n      \"path\": \"spec/plugin/compatibility-manifest-v8.schema.json\",\n      \"version\": \"compatibility-manifest-v8\",\n      \"sha256\": \"a1831e0ae9a1b47d92e7ad9879b1ca4e3510ebc212b87360595b672e8b87bc79\"\n    },\n    {\n      \"id\": \"contract-registry-schema\",\n      \"path\": \"spec/plugin/contract-registry-v2.schema.json\",\n      \"version\": \"contract-registry-v2\",\n      \"sha256\": \"d516b3565158ac1b0d5e9f86b91b13ac19321ab3ff54468be41951b68d7085ac\"\n    },\n    {\n      \"id\": \"error-codes-schema\",\n      \"path\": \"spec/plugin/error-codes-v6.schema.json\",\n      \"version\": \"error-codes-v6\",\n      \"sha256\": \"094cb980156c17af4866942b51e6a1032ea7d1ae0675b329d59a765223ccda28\"\n    },\n    {\n      \"id\": \"host-capability-compatibility-schema\",\n      \"path\": \"spec/plugin/host-capability-compatibility-v1.schema.json\",\n      \"version\": \"host-capability-compatibility-v1\",\n      \"sha256\": \"361ebbf7009aeb66c763ecde46427b17b6cf7d2307c01886c5987a1f4f1762de\"\n    },\n    {\n      \"id\": \"host-capability-contract-schema\",\n      \"path\": \"spec/plugin/host-capability-contract-v1.schema.json\",\n      \"version\": \"host-capability-contract-v1\",\n      \"sha256\": \"0a653e36d44104f1d16b06ee424648086c146f23c907b176bdf470ae73025485\"\n    },\n    {\n      \"id\": \"host-capability-manifest-schema\",\n      \"path\": \"spec/plugin/host-capability-manifest-v1.schema.json\",\n      \"version\": \"host-capability-manifest-v1\",\n      \"sha256\": \"5f13a8e5f918378b9cba9fdc133a9a75ba3a8311c30cb6a02ca0aba09035110e\"\n    },\n    {\n      \"id\": \"host-capability-notices-schema\",\n      \"path\": \"spec/plugin/host-capability-notices-v1.schema.json\",\n      \"version\": \"host-capability-notices-v1\",\n      \"sha256\": \"6affd5d0ae90239f6fd08cbeddae4eef393efa2838c9e4935874ba3dc0e05948\"\n    },\n    {\n      \"id\": \"host-capability-pin-schema\",\n      \"path\": \"spec/plugin/host-capability-pin-v1.schema.json\",\n      \"version\": \"host-capability-pin-v1\",\n      \"sha256\": \"20526a5934f0d85a3db7882492487266f09de5bcd176e2c7936f05d0b7fe0338\"\n    },\n    {\n      \"id\": \"host-capability-signature-schema\",\n      \"path\": \"spec/plugin/host-capability-signature-v1.schema.json\",\n      \"version\": \"host-capability-signature-v1\",\n      \"sha256\": \"88cbc1d63afb7e289ca4f8b7c76f702b8d20156f7722c1b71f3ab9138a240a5e\"\n    },\n    {\n      \"id\": \"iframe-bridge-schema\",\n      \"path\": \"spec/plugin/bridge-v5.schema.json\",\n      \"version\": \"bridge-v5\",\n      \"sha256\": \"ad8ccc7e1900ecb871432f07296dd681ae6faea9377e52f5ddca90300c04f4da\"\n    },\n    {\n      \"id\": \"manifest-schema\",\n      \"path\": \"spec/plugin/manifest-v5.schema.json\",\n      \"version\": \"manifest-v5\",\n      \"sha256\": \"9695f6163aa539b9e3a933367c98850257c6d7bb8d61b36fd5f83b3ab61746f7\"\n    },\n    {\n      \"id\": \"network-grant-schema\",\n      \"path\": \"spec/plugin/network-grant-v2.schema.json\",\n      \"version\": \"network-grant-v2\",\n      \"sha256\": \"5fc1cfc3469a992e551fd392fab982abb6f95e456a1cb768ceca137f7c693abc\"\n    },\n    {\n      \"id\": \"opaque-surface-document-schema\",\n      \"path\": \"spec/plugin/opaque-surface-document-v3.schema.json\",\n      \"version\": \"opaque-surface-document-v3\",\n      \"sha256\": \"63419ff5b5a8890e14f97ca29aaae175b93daff61d4567c5bdff7f6e6a9e7450\"\n    },\n    {\n      \"id\": \"opaque-surface-transport-schema\",\n      \"path\": \"spec/plugin/opaque-surface-transport-v4.schema.json\",\n      \"version\": \"opaque-surface-transport-v4\",\n      \"sha256\": \"70a32dc8bf281cea2c92492c466fd477070c62156a3f593d45eb460cde62dca2\"\n    },\n    {\n      \"id\": \"owner-scope-inventory-registry\",\n      \"path\": \"spec/plugin/owner-scope-inventories-v1.json\",\n      \"version\": \"owner-scope-inventory-registry-v1\",\n      \"sha256\": \"f655313a641368383b3d84b6ea4f6a2a2ef42a44a4dd23f71211361c9c2e0505\"\n    },\n    {\n      \"id\": \"owner-scope-inventory-schema\",\n      \"path\": \"spec/plugin/owner-scope-inventory-v1.schema.json\",\n      \"version\": \"owner-scope-inventory-v1\",\n      \"sha256\": \"21dc4980103f3a36f4252ce141d7350476ec00968e8a320695e450274e928be1\"\n    },\n    {\n      \"id\": \"owner-scope-migration-schema\",\n      \"path\": \"spec/plugin/owner-scope-migration-v1.schema.json\",\n      \"version\": \"owner-scope-migration-v1\",\n      \"sha256\": \"e73443813e19e4cfb05748eb75d5cf04f43db3bed9d2be0c893c13bda88a5993\"\n    },\n    {\n      \"id\": \"package-signature-schema\",\n      \"path\": \"spec/plugin/package-signature-v1.schema.json\",\n      \"version\": \"package-signature-v1\",\n      \"sha256\": \"13951c0f6831ba28647774368c76a817868aeb7984628e2cf3dc4ad1b54f8284\"\n    },\n    {\n      \"id\": \"performance-contract\",\n      \"path\": \"spec/plugin/performance-contract-v3.json\",\n      \"version\": \"performance-contract-v3\",\n      \"sha256\": \"a4e1a099dc16f2b0a4d6bdc5fdf8f6ce622948ffec40f70bfc2743286a2b816b\"\n    },\n    {\n      \"id\": \"performance-evidence-schema\",\n      \"path\": \"spec/plugin/performance-evidence-v3.schema.json\",\n      \"version\": \"performance-evidence-v3\",\n      \"sha256\": \"a2f5e94071bb09a9327fc55ad3f6c39052b01c3e54cceb8b974dc244667a0326\"\n    },\n    {\n      \"id\": \"platform-package-publication-schema\",\n      \"path\": \"spec/plugin/platform-package-publication-v1.schema.json\",\n      \"version\": \"platform-package-publication-v1\",\n      \"sha256\": \"20450b516c34d5a122020f4064ddfa03ffcb97ffea661e0868cd09760b3f08b0\"\n    },\n    {\n      \"id\": \"platform-package-set-schema\",\n      \"path\": \"spec/plugin/platform-package-set-v1.schema.json\",\n      \"version\": \"platform-package-set-v1\",\n      \"sha256\": \"4d9979f5205ec047895b64c995312c588d998bb1c1448f6c9c559f1b7ab0d796\"\n    },\n    {\n      \"id\": \"plugin-platform-openapi\",\n      \"path\": \"spec/openapi/plugin-platform-v8.yaml\",\n      \"version\": \"plugin-platform-v8\",\n      \"sha256\": \"39bcfcfb846c868945ab0d21404747b2f5f083574c7ead5aca64f65b98212b7d\"\n    },\n    {\n      \"id\": \"process-containment-schema\",\n      \"path\": \"spec/plugin/process-containment-v1.schema.json\",\n      \"version\": \"process-containment-v1\",\n      \"sha256\": \"930ea44b1f62361706e994649e84f62af0a6418b77a661ae9bf9c10f1398e3fc\"\n    },\n    {\n      \"id\": \"quarantine-cleanup-schema\",\n      \"path\": \"spec/plugin/quarantine-cleanup-v1.schema.json\",\n      \"version\": \"quarantine-cleanup-v1\",\n      \"sha256\": \"0aced01a8d409953d5075a799ac273cae79e285ac82debe93ac4d8b706571ad1\"\n    },\n    {\n      \"id\": \"release-metadata-schema\",\n      \"path\": \"spec/plugin/release-metadata-v5.schema.json\",\n      \"version\": \"release-metadata-v5\",\n      \"sha256\": \"255ef3deb7d2758a43e69e533a08aa28106f8edc2e7385ab0aec0d50c1ef3d7a\"\n    },\n    {\n      \"id\": \"release-revocation-pointer-schema\",\n      \"path\": \"spec/plugin/release-revocation-pointer-v1.schema.json\",\n      \"version\": \"release-revocation-pointer-v1\",\n      \"sha256\": \"a9b7b64cb2dbf89500f0d191a6b2b9ab42eb806a452eb8338895a48ec7d7551e\"\n    },\n    {\n      \"id\": \"release-revocation-schema\",\n      \"path\": \"spec/plugin/release-revocation-v2.schema.json\",\n      \"version\": \"release-revocation-v2\",\n      \"sha256\": \"c3b40c05bc0dea422a272ee62ca45d0efb6456278b0707c5a12f39b004b84cb4\"\n    },\n    {\n      \"id\": \"release-root-delegation-schema\",\n      \"path\": \"spec/plugin/release-root-delegation-v1.schema.json\",\n      \"version\": \"release-root-delegation-v1\",\n      \"sha256\": \"c1adbb13eaeeca145d5ee787ff43777e60a5f329e460d20b8db358e4f5fc4825\"\n    },\n    {\n      \"id\": \"release-signature-envelope-schema\",\n      \"path\": \"spec/plugin/release-signature-envelope-v1.schema.json\",\n      \"version\": \"release-signature-envelope-v1\",\n      \"sha256\": \"7df9afd22bfdebfa89dc3bdb46ecdbe22a91ecce35fa46c492dd9795c66fae29\"\n    },\n    {\n      \"id\": \"release-signing-ledger-evidence-schema\",\n      \"path\": \"spec/plugin/release-signing-ledger-evidence-v1.schema.json\",\n      \"version\": \"release-signing-ledger-evidence-v1\",\n      \"sha256\": \"9ab8b7f65dedcd119d578debb4f6ff97fc35f4c7ac95c0e5435f8b0959bc1a5c\"\n    },\n    {\n      \"id\": \"release-signing-ledger-receipt-schema\",\n      \"path\": \"spec/plugin/release-signing-ledger-receipt-v1.schema.json\",\n      \"version\": \"release-signing-ledger-receipt-v1\",\n      \"sha256\": \"29210cfefd967017c5c74bcf8489bd50511c5c9f36d17b0200056ccb90c30561\"\n    },\n    {\n      \"id\": \"release-signing-ledger-schema\",\n      \"path\": \"spec/plugin/release-signing-ledger-v1.schema.json\",\n      \"version\": \"release-signing-ledger-v1\",\n      \"sha256\": \"0c72b30bfd6b857b9809e48e1b7eaaeb7134d5afd6a935aa8373465054403765\"\n    },\n    {\n      \"id\": \"release-signing-subject-schema\",\n      \"path\": \"spec/plugin/release-signing-subject-v1.schema.json\",\n      \"version\": \"release-signing-subject-v1\",\n      \"sha256\": \"876b1459824f90042bd141e96bfea4633333bdf2a227e15b6e25c72db1179c8e\"\n    },\n    {\n      \"id\": \"release-source-policy-pointer-schema\",\n      \"path\": \"spec/plugin/release-source-policy-pointer-v1.schema.json\",\n      \"version\": \"release-source-policy-pointer-v1\",\n      \"sha256\": \"1a78cc3897ffbcdb605d2e9265d765207a4647d3f53fa5736aec65bf5f54e81c\"\n    },\n    {\n      \"id\": \"release-source-policy-schema\",\n      \"path\": \"spec/plugin/release-source-policy-v2.schema.json\",\n      \"version\": \"release-source-policy-v2\",\n      \"sha256\": \"6a5a5eab317a86beea925a611ca8a7a2d937547c039ce147b5993f69a5611237\"\n    },\n    {\n      \"id\": \"release-trust-state-schema\",\n      \"path\": \"spec/plugin/release-trust-state-v1.schema.json\",\n      \"version\": \"release-trust-state-v1\",\n      \"sha256\": \"19ffa182932a22401a33ee4c9921e957c67895c2d8b041c9a27ee3530bdfb2d2\"\n    },\n    {\n      \"id\": \"resource-scope-schema\",\n      \"path\": \"spec/plugin/resource-scope-v1.schema.json\",\n      \"version\": \"resource-scope-v1\",\n      \"sha256\": \"e6021bd576c7220ad5536645a7ad8e57ee7aeb9901c31a89444fa6b695d8dc6f\"\n    },\n    {\n      \"id\": \"runtime-admission-schema\",\n      \"path\": \"spec/plugin/runtime-admission-v1.schema.json\",\n      \"version\": \"runtime-admission-v1\",\n      \"sha256\": \"bee7b149876447d663a4099dbd71e71fa97f8ff80ddf4e12cbfba951a47c4beb\"\n    },\n    {\n      \"id\": \"runtime-descriptor-schema\",\n      \"path\": \"spec/plugin/runtime-descriptor-v2.schema.json\",\n      \"version\": \"runtime-descriptor-v2\",\n      \"sha256\": \"2ba59f6fb70d4ad757f60aca5541f4a44886542525e5bf76c393cd2368188351\"\n    },\n    {\n      \"id\": \"runtime-exec-journal-schema\",\n      \"path\": \"spec/plugin/runtime-exec-journal-v1.schema.json\",\n      \"version\": \"runtime-exec-journal-v1\",\n      \"sha256\": \"2bddbba383843b8ebc1554009909f0bb25e98616be763826a697cb0f408870d2\"\n    },\n    {\n      \"id\": \"rust-ipc-schema\",\n      \"path\": \"spec/plugin/ipc-v6.schema.json\",\n      \"version\": \"rust-ipc-v6\",\n      \"sha256\": \"9814ca091ac2e4e8435c1ab553e248e9d2e792de93ce9fd27bd030486774837f\"\n    },\n    {\n      \"id\": \"session-scope-schema\",\n      \"path\": \"spec/plugin/session-scope-v1.schema.json\",\n      \"version\": \"session-scope-v1\",\n      \"sha256\": \"3df0084264f0aff9fe2261c237cea439adb5cdc2534bfaaa0488d5992d4a7d2e\"\n    },\n    {\n      \"id\": \"target-classifier-fixture\",\n      \"path\": \"spec/plugin/target-classifier-v2.json\",\n      \"version\": \"target-classifier-v2\",\n      \"sha256\": \"ae7336cce77a2e820f96f1cc309b93f8442c932dcebec25e3890d31cd098e2d1\"\n    },\n    {\n      \"id\": \"token-ticket-schema\",\n      \"path\": \"spec/plugin/token-ticket-v4.schema.json\",\n      \"version\": \"token-ticket-v4\",\n      \"sha256\": \"5cf365b5b52a331ac0d3ad35a98be3c2ce668804ae88fdeaf9679a44db14feb1\"\n    },\n    {\n      \"id\": \"trusted-time-evidence-schema\",\n      \"path\": \"spec/plugin/trusted-time-evidence-v1.schema.json\",\n      \"version\": \"trusted-time-evidence-v1\",\n      \"sha256\": \"4398cbd2a3eea42a85008ee16a69d7adb265673e6749b1f13a4f1610f36e5e38\"\n    },\n    {\n      \"id\": \"trusted-time-leaf-schema\",\n      \"path\": \"spec/plugin/trusted-time-leaf-v1.schema.json\",\n      \"version\": \"trusted-time-leaf-v1\",\n      \"sha256\": \"1c25eb0040800eef145aa2bb4c0e1ae197ae584d365e9595ab89037e26fe5ddb\"\n    },\n    {\n      \"id\": \"wasm-worker-schema\",\n      \"path\": \"spec/plugin/wasm-worker-v2.schema.json\",\n      \"version\": \"redevplugin-wasm-worker-v2\",\n      \"sha256\": \"00bf123f3a9ed932de4b71c180e2a5c34af0f82050defb271fedec42cf217902\"\n    },\n    {\n      \"id\": \"worker-invocation-schema\",\n      \"path\": \"spec/plugin/worker-invocation-v3.schema.json\",\n      \"version\": \"worker-invocation-v3\",\n      \"sha256\": \"f08af491cbf5e7b71d1aeafbeac9ae581ee5fc3bcb76184daec369f94bab3927\"\n    }\n  ]\n}\n";
 };
 export declare const generatedContractRegistry: {
     readonly schema_version: "redevplugin.contract_registry.v2";
@@ -417,7 +417,7 @@ export declare const generatedContractRegistry: {
         readonly id: "plugin-platform-openapi";
         readonly path: "spec/openapi/plugin-platform-v8.yaml";
         readonly version: "plugin-platform-v8";
-        readonly sha256: "290883ff79b74badbf9f6feddb4dfbef820a4ef4622a7e3fca815e3abb2c4eac";
+        readonly sha256: "39bcfcfb846c868945ab0d21404747b2f5f083574c7ead5aca64f65b98212b7d";
     }, {
         readonly id: "process-containment-schema";
         readonly path: "spec/plugin/process-containment-v1.schema.json";
@@ -552,44 +552,44 @@ export declare const generatedContractRegistry: {
 };
 export declare const generatedPackageSet: {
     readonly schema_version: "redevplugin.platform_package_set.v1";
-    readonly platform_version: "0.6.7";
+    readonly platform_version: "0.6.8";
     readonly go_module: {
         readonly module: "github.com/floegence/redevplugin";
-        readonly version: "v0.6.7";
+        readonly version: "v0.6.8";
     };
     readonly npm_packages: readonly [{
         readonly name: "@floegence/redevplugin-contracts";
-        readonly version: "0.6.7";
+        readonly version: "0.6.8";
     }, {
         readonly name: "@floegence/redevplugin-ui";
-        readonly version: "0.6.7";
+        readonly version: "0.6.8";
     }];
     readonly rust_crates: readonly [{
         readonly name: "redevplugin-contracts";
-        readonly version: "0.6.7";
+        readonly version: "0.6.8";
         readonly role: "contracts";
     }, {
         readonly name: "redevplugin-ipc";
-        readonly version: "0.6.7";
+        readonly version: "0.6.8";
         readonly role: "ipc";
     }, {
         readonly name: "redevplugin-wasm-abi";
-        readonly version: "0.6.7";
+        readonly version: "0.6.8";
         readonly role: "wasm_abi";
     }, {
         readonly name: "redevplugin-target-classifier";
-        readonly version: "0.6.7";
+        readonly version: "0.6.8";
         readonly role: "target_classifier";
     }, {
         readonly name: "redevplugin-worker-sdk";
-        readonly version: "0.6.7";
+        readonly version: "0.6.8";
         readonly role: "worker_sdk";
     }, {
         readonly name: "redevplugin-runtime";
-        readonly version: "0.6.7";
+        readonly version: "0.6.8";
         readonly role: "runtime";
     }];
     readonly contract_registry_version: "contract-registry-v2";
-    readonly contract_set_sha256: "679c643d0313859dbdfb7a3075f9915a7b91ae1c48001b2a69bdaff178f35454";
+    readonly contract_set_sha256: "e056df0c65513c96f64ee501b55cceec4715ebdc95fe29f9c88117b243ce9c6e";
 };
-export declare const generatedContractSetSHA256: "679c643d0313859dbdfb7a3075f9915a7b91ae1c48001b2a69bdaff178f35454";
+export declare const generatedContractSetSHA256: "e056df0c65513c96f64ee501b55cceec4715ebdc95fe29f9c88117b243ce9c6e";