@m6d/cortex-cli 0.15.0 → 0.17.0

package/src/contracts/manifest/index.ts

@@ -4,7 +4,7 @@ import { canCarrySecret } from "../egress-policy/index";
 import {
     agentSlugSchema,
     EVENT_HEADER,
-    IDENTIFIER_PATTERN,
+    identifierSchema,
     localeSchema,
     SERVER_EVENTS,
     refuseBlockedApprovalTitle,
@@ -12,6 +12,8 @@ import {
 } from "../server/index";
 import { MESSAGE_TRIGGER_NAME } from "../triggers/index";
 import {
+    BASE_LOCALE,
+    byLocale,
     DEFAULT_MEDIA_FORMS,
     MEDIA_FORMS,
     TOOL_SURFACES,
@@ -60,20 +62,14 @@ type Bounds = { min: number; max: number; default: number };
 
 /**
  * The range of every number an author sets, in the console and in a
- * manifest alike, and the value a manifest that leaves one out gets. The
- * console builds its form schemas, with its own messages, from these.
+ * manifest alike, and the value a manifest that leaves one out gets, which
+ * a new row's column holds too. The console builds its form schemas, with
+ * its own messages, from these.
  */
 export const SETTING_BOUNDS = {
     tool: {
         timeoutMs: { min: 100, max: 120_000, default: 30_000 },
         maxResponseBytes: { min: 1_024, max: 1_048_576, default: 262_144 },
-        rateLimitRequests: { min: 1, max: 10_000, default: 60 },
-        rateLimitWindowSeconds: { min: 1, max: 86_400, default: 60 },
-    },
-    agent: {
-        rateLimitRequests: { min: 1, max: 10_000, default: 60 },
-        rateLimitWindowSeconds: { min: 1, max: 86_400, default: 60 },
-        dailyExecutionQuota: { min: 1, max: 1_000_000, default: 10_000 },
     },
     /** How much of the conversation the agent's model sees. */
     agentContext: {
@@ -92,6 +88,18 @@ export const SETTING_BOUNDS = {
     trigger: { disableAfterFailures: { min: 1, max: 1_000, default: 5 } },
     datasetHost: { timeoutMs: { min: 100, max: 120_000, default: 30_000 } },
     webhook: { timeoutMs: { min: 1_000, max: 30_000, default: 10_000 } },
+    /** The score, a fraction, a new visitor of an anonymous agent needs to get an id. */
+    recaptcha: { minScore: { min: 0.1, max: 0.9, default: 0.5 } },
+    /**
+     * How often Cortex checks a caller for the server, per minute: a sign-in
+     * (a new end-user token it asks the server to verify, or a visitor one
+     * of its anonymous agents gives an id), or a trigger's secret. Anyone
+     * can try either, so each bounds what strangers cost it.
+     */
+    server: {
+        signInChecksPerMinute: { min: 1, max: 100_000, default: 600 },
+        triggerChecksPerMinute: { min: 1, max: 10_000, default: 60 },
+    },
 } as const satisfies Record<string, Record<string, Bounds>>;
 
 /** An integer within `bounds`, their default when left out. */
@@ -99,28 +107,90 @@ function setting({ min, max, default: fallback }: Bounds) {
     return z.number().int().min(min).max(max).default(fallback);
 }
 
+/** One number per setting a group of `SETTING_BOUNDS` names. */
+export type SettingValues<TBounds> = { [Name in keyof TBounds]: number };
+
+/** Every setting of a group at its default, as a row that sets none stores them. */
+export function settingDefaults<TBounds extends Record<string, Bounds>>(bounds: TBounds) {
+    return Object.fromEntries(
+        Object.entries(bounds).map(([name, bound]) => [name, bound.default]),
+    ) as SettingValues<TBounds>;
+}
+
+type RateLimitBounds = { max: number; allUsers: number | null; perUser: number | null };
+
+/**
+ * Every rate limit an author sets, in the console and in a manifest alike,
+ * per minute except an agent's tokens, per UTC day. Each holds for all of an
+ * entry's users together and for each user alone, from 1 to `max`, or not
+ * at all (null); a manifest that leaves one out gets the default.
+ */
+export const RATE_LIMITS = {
+    agent: {
+        messagesPerMinute: { max: 10_000, allUsers: 600, perUser: 20 },
+        tokensPerDay: { max: 1_000_000_000_000, allUsers: null, perUser: 1_000_000 },
+    },
+    tool: { callsPerMinute: { max: 10_000, allUsers: 60, perUser: 20 } },
+    datasetHost: { queriesPerMinute: { max: 10_000, allUsers: 60, perUser: 20 } },
+} as const satisfies Record<string, Record<string, RateLimitBounds>>;
+
+/** Whom a rate limit holds for: all of an entry's users together, or each user alone. */
+export const RATE_LIMIT_USERS = ["allUsers", "perUser"] as const;
+export type RateLimitUsers = (typeof RATE_LIMIT_USERS)[number];
+
+/** A group of `RATE_LIMITS`, one value per limit for all users and for each user. */
+export function mapRateLimits<TBounds extends Record<string, RateLimitBounds>, TValue>(
+    bounds: TBounds,
+    value: (bound: RateLimitBounds, users: RateLimitUsers) => TValue,
+) {
+    return Object.fromEntries(
+        RATE_LIMIT_USERS.map((users) => [
+            users,
+            Object.fromEntries(
+                Object.entries(bounds).map(([name, bound]) => [name, value(bound, users)]),
+            ),
+        ]),
+    ) as Record<RateLimitUsers, { [Name in keyof TBounds]: TValue }>;
+}
+
+/** An entry's rate limits as its row holds them; null lifts one. */
+export type RateLimits<TBounds> = Record<
+    RateLimitUsers,
+    { [Name in keyof TBounds]: number | null }
+>;
+
+/** Every limit of a group at its default, as a row that sets none stores them. */
+export function rateLimitDefaults<TBounds extends Record<string, RateLimitBounds>>(
+    bounds: TBounds,
+) {
+    return mapRateLimits(bounds, (bound, users) => bound[users]) satisfies RateLimits<TBounds>;
+}
+
+/** One rate limit as a manifest writes it: null lifts it, and left out it takes its default. */
+function rateLimit(bound: RateLimitBounds, users: RateLimitUsers) {
+    return z.number().int().min(1).max(bound.max).nullable().default(bound[users]);
+}
+
 /**
  * The fields of an entry users may change in Cortex after an apply, each
  * once, from the ones `fields` allows; none when left out. Every other field
  * is the manifest's alone. An apply keeps a live change to a listed field
  * unless the manifest changed that field too (a conflict, see
  * `manifestApplyInputSchema`). Identity, what is fixed at creation, the
- * audience, credentials, and whatever an apply checks against the
- * manifest's own value are never offered.
+ * audience, and whatever an apply checks against the manifest's own value
+ * are never offered.
  */
 function overridable<const TField extends string>(fields: readonly [TField, ...TField[]]) {
     return z
         .array(z.enum(fields))
-        .refine(
-            uniqueBy((field: TField) => field),
-            "a field repeats",
-        )
+        .refine((listed) => new Set(listed).size === listed.length, "a field repeats")
         .default([]);
 }
 
 /** Consumer-facing slugs: the manifest id, service keys, skill names and trigger names share it. */
 export const SLUG_PATTERN = /^[a-z0-9]+(-[a-z0-9]+)*$/;
-const slugSchema = z.string().regex(SLUG_PATTERN).max(64);
+export const SLUG_MAX_LENGTH = 64;
+const slugSchema = z.string().regex(SLUG_PATTERN).max(SLUG_MAX_LENGTH);
 
 /** A DNS host name in lower case, the way `URL` reports one: dot-separated labels of letters, digits and inner hyphens. */
 export const HOSTNAME_PATTERN =
@@ -243,6 +313,92 @@ export const toolConfigByType = {
     client: z.object({}),
 };
 
+/** Every tool type, in the order the database enum lists them; see `TOOL_TYPES`. */
+export const TOOL_TYPE_NAMES = ["http", "embedded", "soap", "native", "client"] as const;
+
+/**
+ * What each tool type is, so no reader restates it: who answers its calls
+ * (`kind`: Cortex for a server tool, the browser for a client one), whether
+ * it calls an endpoint, whether a call may wait for the end user's
+ * approval, whether an input field may be filled from a source Cortex holds
+ * (`x-source`) or name its place in the request (`x-target`), whether an
+ * author creates one, and the `method` or `readOnly` the type pins whatever
+ * the author says. An embedded tool's initiate is never read-only, so a
+ * widget reload rejoins its session, and asks no approval, since the widget
+ * answers it. SOAP and native tools are POSTed, and a native tool comes from
+ * its server's manifest alone, with no field Cortex fills or places. A
+ * client tool calls nothing: the client answers it.
+ */
+export const TOOL_TYPES = {
+    http: {
+        kind: "server",
+        calls: true,
+        approval: true,
+        sources: true,
+        targets: true,
+        creatable: true,
+    },
+    embedded: {
+        kind: "client",
+        calls: true,
+        approval: false,
+        sources: true,
+        targets: false,
+        creatable: true,
+        readOnly: false,
+    },
+    soap: {
+        kind: "server",
+        calls: true,
+        approval: true,
+        sources: true,
+        targets: true,
+        creatable: true,
+        method: "POST",
+    },
+    native: {
+        kind: "server",
+        calls: true,
+        approval: true,
+        sources: false,
+        targets: false,
+        creatable: false,
+        method: "POST",
+    },
+    client: {
+        kind: "client",
+        calls: false,
+        approval: false,
+        sources: false,
+        targets: false,
+        creatable: true,
+        readOnly: true,
+    },
+} as const satisfies Record<
+    (typeof TOOL_TYPE_NAMES)[number],
+    {
+        kind: "server" | "client";
+        calls: boolean;
+        approval: boolean;
+        sources: boolean;
+        targets: boolean;
+        creatable: boolean;
+        method?: (typeof TOOL_METHODS)[number];
+        readOnly?: boolean;
+    }
+>;
+
+type CreatableToolType = {
+    [TType in keyof typeof TOOL_TYPES]: (typeof TOOL_TYPES)[TType]["creatable"] extends true
+        ? TType
+        : never;
+}[keyof typeof TOOL_TYPES];
+
+/** The types an author creates a tool as, in `TOOL_TYPE_NAMES` order; a native tool comes from its server's manifest. */
+export const CREATABLE_TOOL_TYPES = TOOL_TYPE_NAMES.filter(
+    (type): type is CreatableToolType => TOOL_TYPES[type].creatable,
+);
+
 /** A `{name}` parameter in a tool's endpoint URL, filled from the input on each call. */
 export const ENDPOINT_PARAM_PATTERN = /\{([^{}]+)\}/g;
 
@@ -261,9 +417,27 @@ export function confinesEndpointParams(url: string) {
 /** An upstream Cortex calls: http or https. */
 const upstreamUrlSchema = z.url({ protocol: /^https?$/ });
 
+/**
+ * The headers a call carries: a header name and the prefix before the value
+ * in characters, and how many headers at most. The console caps its header
+ * rows at the same.
+ */
+export const HEADER_LIMITS = { headerLength: 120, prefixLength: 40, headers: 8 } as const;
+
 /** An HTTP header field name (RFC 9110 token). */
 export const HEADER_NAME_PATTERN = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
-const headerNameSchema = z.string().trim().min(1).max(120).regex(HEADER_NAME_PATTERN);
+
+/**
+ * A header value fetch sends: visible ASCII, tab, space and obs-text.
+ * Control characters, and any character past one byte, make fetch throw.
+ */
+export const HEADER_VALUE_PATTERN = /^[\t\x20-\x7e\x80-\xff]*$/;
+const headerNameSchema = z
+    .string()
+    .trim()
+    .min(1)
+    .max(HEADER_LIMITS.headerLength)
+    .regex(HEADER_NAME_PATTERN);
 
 /** Headers Cortex or fetch fills on every request. Lower-cased. */
 export const transportSetHeaders = ["accept", "content-type", "content-length", "host"] as const;
@@ -279,24 +453,21 @@ export const transportForbiddenHeaders = [
     "proxy-authorization",
 ] as const;
 
-/** Headers the MCP transport sets on its own requests: no MCP server's credential travels under one. Lower-cased. */
+/** Headers the MCP transport sets on its own requests: no header an MCP server's entry declares travels under one. Lower-cased. */
 export const mcpTransportHeaders = new Set<string>([
     "mcp-session-id",
     "mcp-protocol-version",
     "last-event-id",
 ]);
 
-/** Headers no credential or field may travel under; test lower-cased names. */
+/** Headers no declared header or field may travel under; test lower-cased names. */
 export const transportOwnedHeaders = new Set<string>([
     ...transportSetHeaders,
     ...transportForbiddenHeaders,
 ]);
 
-/** At most this many headers a call presents; a real upstream wants one or two. */
-export const CREDENTIAL_PRESENTATION_LIMIT = 8;
-
-/** The index of each entry presenting a header an earlier entry already presents, compared case-insensitively. */
-export function repeatedHeaders(entries: ReadonlyArray<{ header: string }>) {
+/** The index of each entry declaring a header an earlier entry already declares, compared case-insensitively. */
+function repeatedHeaders(entries: ReadonlyArray<{ header: string }>) {
     const seen = new Set<string>();
     return entries.flatMap((entry, index) => {
         const name = entry.header.toLowerCase();
@@ -306,8 +477,10 @@ export function repeatedHeaders(entries: ReadonlyArray<{ header: string }>) {
     });
 }
 
+/** The longest name Cortex holds a server, model provider, credential or secret under. */
+export const NAME_MAX_LENGTH = 120;
 /** A server, model provider, credential or secret, by the name Cortex holds it under. */
-const nameSchema = z.string().trim().min(1).max(120);
+const nameSchema = z.string().trim().min(1).max(NAME_MAX_LENGTH);
 
 const presentedHeaderSchema = headerNameSchema.refine(
     (name) => !transportOwnedHeaders.has(name.toLowerCase()),
@@ -315,31 +488,94 @@ const presentedHeaderSchema = headerNameSchema.refine(
 );
 
 /**
- * What every call carries: each entry a header, what precedes the value in
- * it (`"Bearer "`, say), and the credential by name. A header is presented
- * once.
+ * The headers every call carries: each entry a header, what precedes the
+ * value in it (`"Bearer "`, say), and where the value comes from, as `entry`
+ * validates it, at most `HEADER_LIMITS.headers` of them. A header is
+ * declared once; `repeated` words the refusal of a later one.
  */
-function presentationsSchema<TCredential extends string | null>(
-    header: z.ZodString,
-    credential: z.ZodType<TCredential, TCredential>,
+export function headerListSchema<TEntry extends z.ZodType<{ header: string }>>(
+    entry: TEntry,
+    repeated: () => string,
 ) {
     return z
-        .array(z.strictObject({ header, prefix: z.string().max(40).default(""), credential }))
-        .max(CREDENTIAL_PRESENTATION_LIMIT)
+        .array(entry)
+        .max(HEADER_LIMITS.headers)
         .superRefine((entries, context) => {
             for (const index of repeatedHeaders(entries)) {
                 context.addIssue({
                     code: "custom",
                     path: [index, "header"],
-                    message: "a header presented twice",
+                    message: repeated(),
                 });
             }
-        })
-        .default([]);
+        });
 }
 
-/** A credential, or `null` for the run's own token (the end user's in a chat, the trigger's in a firing). */
-const credentialsSchema = presentationsSchema(presentedHeaderSchema, nameSchema.nullable());
+/** A variable by name: one the agent's server declares, or a built-in (`timezone`, `locale`, `utcTime`). */
+const variableSourceSchema = z.object({
+    kind: z.literal("variable"),
+    name: z.string().trim().min(1).max(64),
+});
+
+/** A credential Cortex holds or acquires, by name. */
+const credentialSourceSchema = z.object({ kind: z.literal("credential"), name: nameSchema });
+
+/** A value written as is. */
+const constantHeaderSourceSchema = z.object({
+    kind: z.literal("constant"),
+    value: z.string().max(4_000),
+});
+
+/**
+ * Where a header's value comes from: a credential, the run's own token (the
+ * end user's in a chat, the trigger's in a firing), a variable, or a
+ * constant. A run token or a variable needs a run; a call without one (a
+ * webhook delivery, a catalog read) presents only credentials and constants.
+ */
+export const headerSourceSchema = z.discriminatedUnion("kind", [
+    credentialSourceSchema,
+    z.object({ kind: z.literal("runToken") }),
+    variableSourceSchema,
+    constantHeaderSourceSchema,
+]);
+export type HeaderSource = z.infer<typeof headerSourceSchema>;
+
+/** The sources a call without a run can present. */
+export const runlessHeaderSourceSchema = z.discriminatedUnion("kind", [
+    credentialSourceSchema,
+    constantHeaderSourceSchema,
+]);
+
+/**
+ * The headers a manifest entry declares: no unknown key, an omitted prefix
+ * or list empty, and a prefix or constant only of what a header can carry
+ * (`HEADER_VALUE_PATTERN`).
+ */
+function declaredHeadersSchema<TSource extends HeaderSource>(
+    header: z.ZodString,
+    from: z.ZodType<TSource, TSource>,
+) {
+    return headerListSchema(
+        z
+            .strictObject({
+                header,
+                prefix: z
+                    .string()
+                    .max(HEADER_LIMITS.prefixLength)
+                    .regex(HEADER_VALUE_PATTERN, "a prefix a header cannot carry")
+                    .default(""),
+                from,
+            })
+            .refine(
+                (entry) =>
+                    entry.from.kind !== "constant" || HEADER_VALUE_PATTERN.test(entry.from.value),
+                { path: ["from", "value"], message: "a value a header cannot carry" },
+            ),
+        () => "a header declared twice",
+    ).default([]);
+}
+
+const headersSchema = declaredHeadersSchema(presentedHeaderSchema, headerSourceSchema);
 
 /**
  * Where Cortex fills a top-level scalar input field from, out of the model's
@@ -347,8 +583,8 @@ const credentialsSchema = presentationsSchema(presentedHeaderSchema, nameSchema.
  * a constant, or the end user's bearer.
  */
 export const fieldSourceSchema = z.discriminatedUnion("kind", [
-    z.object({ kind: z.literal("variable"), name: z.string().trim().min(1).max(64) }),
-    z.object({ kind: z.literal("secret"), name: z.string().trim().min(1).max(120) }),
+    variableSourceSchema,
+    z.object({ kind: z.literal("secret"), name: nameSchema }),
     z.object({
         kind: z.literal("constant"),
         value: z.union([z.string().max(4_000), z.number(), z.boolean()]),
@@ -363,7 +599,7 @@ export type FieldSource = z.infer<typeof fieldSourceSchema>;
  * string only, and a constant must be a value of the field's type. Whether a
  * variable is declared is the agent's server's to say.
  */
-export function sourceFits(
+function sourceFits(
     source: FieldSource,
     field: { type: unknown; enum?: ReadonlyArray<string | null> },
 ) {
@@ -426,16 +662,26 @@ export const fieldTargetSchema = z.discriminatedUnion("kind", [
 ]);
 export type FieldTarget = z.infer<typeof fieldTargetSchema>;
 
-const SCALAR_TYPES = ["string", "number", "integer", "boolean"] as const;
+/** The types a field holds one value of. */
+export const SCALAR_TYPES = ["string", "number", "integer", "boolean"] as const;
 const schemaTypeSchema = z.enum([...SCALAR_TYPES, "object", "array"]);
 
+/** A field's name and description in characters, and the values its enum lists. The console caps its field rows at the same. */
+export const FIELD_LIMITS = { nameLength: 120, descriptionLength: 500, enumValues: 50 } as const;
+
 /** Untrimmed: two names that differ only in surrounding spaces would collapse into one. */
 const propertyNameSchema = z
     .string()
     .min(1)
-    .max(120)
+    .max(FIELD_LIMITS.nameLength)
     .refine((name) => name === name.trim(), "no surrounding spaces");
 
+/** The order an object's properties are shown in, each named once. */
+const propertyOrderSchema = z
+    .array(z.string())
+    .refine((names) => new Set(names).size === names.length, "a name repeats")
+    .optional();
+
 /** What an array holds: a scalar, or an object with properties of its own. */
 const itemsSchema = z.strictObject({
     type: z.enum([...SCALAR_TYPES, "object"]),
@@ -443,29 +689,32 @@ const itemsSchema = z.strictObject({
         return z.record(propertyNameSchema, schemaPropertySchema).optional();
     },
     required: z.array(z.string()).optional(),
+    "x-order": propertyOrderSchema,
 });
 
 /**
  * A JSON Schema property, in the part of JSON Schema a field editor holds:
  * a type (with `"null"` beside it when the value may be null), an `enum` of
- * strings for a string, an object's `properties` and `required`, an
- * array's `items`, a `description`, and the extensions `x-sensitive`
- * (redacted from logs), `x-source` (top-level scalar fields of a tool's
- * input only) and `x-target` (top-level fields of a tool's input only).
+ * strings for a string, an object's `properties`, `required` and the
+ * `x-order` they are shown in, an array's `items`, a `description`, and
+ * the extensions `x-sensitive` (redacted from logs), `x-source` (top-level
+ * scalar fields of a tool's input only) and `x-target` (top-level fields of
+ * a tool's input only).
  */
 const schemaPropertySchema = z.strictObject({
     type: z.union([schemaTypeSchema, z.tuple([schemaTypeSchema, z.literal("null")])]),
-    description: z.string().trim().max(500).optional(),
+    description: z.string().trim().max(FIELD_LIMITS.descriptionLength).optional(),
     /** A nullable enum lists `null` beside its values, as the console stores one. */
     enum: z
         .array(z.union([z.string().trim().min(1), z.null()]))
         .min(1)
-        .max(51)
+        .max(FIELD_LIMITS.enumValues + 1)
         .optional(),
     get properties() {
         return z.record(propertyNameSchema, schemaPropertySchema).optional();
     },
     required: z.array(z.string()).optional(),
+    "x-order": propertyOrderSchema,
     get items() {
         return itemsSchema.optional();
     },
@@ -483,24 +732,30 @@ function typeOf(node: { type: SchemaProperty["type"] }) {
 /** A refusal below a node: where, relative to it, and why. */
 type RowIssue = { at: Array<string | number>; message: string };
 
-/** What a node's own keywords break: `properties` or `required` off an object, or `required` naming no property. */
-function nodeIssues(node: {
+/** A node holding properties: a property, an array's items, or an input or output schema. */
+type ObjectNode = {
     type: SchemaProperty["type"];
     properties?: Record<string, SchemaProperty>;
     required?: string[];
-}) {
+    "x-order"?: string[];
+};
+
+/** What a node's own keywords break: `properties`, `required` or `x-order` off an object, or the last two naming no property. */
+function nodeIssues(node: ObjectNode) {
     const issues = new Array<RowIssue>();
     const object = typeOf(node) === "object";
-    for (const keyword of ["properties", "required"] as const) {
+    for (const keyword of ["properties", "required", "x-order"] as const) {
         if (!object && node[keyword] !== undefined) {
             issues.push({ at: [keyword], message: "only an object has it" });
         }
     }
-    node.required?.forEach((name, index) => {
-        if (!Object.hasOwn(node.properties ?? {}, name)) {
-            issues.push({ at: ["required", index], message: "names no property" });
-        }
-    });
+    for (const keyword of ["required", "x-order"] as const) {
+        node[keyword]?.forEach((name, index) => {
+            if (!Object.hasOwn(node.properties ?? {}, name)) {
+                issues.push({ at: [keyword, index], message: "names no property" });
+            }
+        });
+    }
     return issues;
 }
 
@@ -513,20 +768,24 @@ function enumIssueOf(property: SchemaProperty, type: string | undefined) {
     if (property.enum === undefined) return undefined;
     if (type !== "string") return "an enum lists a string's values";
     const values = property.enum.filter((value) => value !== null);
-    if (values.length === 0 || values.length > 50) return "an enum lists 1 to 50 values";
+    if (values.length === 0 || values.length > FIELD_LIMITS.enumValues) {
+        return `an enum lists 1 to ${FIELD_LIMITS.enumValues} values`;
+    }
     const nullable = Array.isArray(property.type);
     if (nullable === property.enum.includes(null)) return undefined;
     return nullable ? "a nullable enum lists null" : "only a nullable enum lists null";
 }
 
+/** The extensions a tool's input binds a field with: a source filling it, a place in the request. */
+type Binding = "x-source" | "x-target";
+
 /**
  * What one property breaks of itself: an `enum` off a string, with no value,
  * or listing `null` when the type does not allow it or the other way round;
- * `items` off an array or an array without them; `x-source` off a scalar
- * of a `bindable` node, or a source that does not fit the field; and
- * `x-target` off a `bindable` node.
+ * `items` off an array or an array without them; and what its bindings
+ * break (`bindingIssues`).
  */
-function propertyIssues(property: SchemaProperty, bindable: boolean) {
+function propertyIssues(property: SchemaProperty, bindings: ReadonlyArray<Binding> | undefined) {
     const issues = new Array<RowIssue>();
     const type = typeOf(property);
     const enumIssue = enumIssueOf(property, type);
@@ -537,21 +796,41 @@ function propertyIssues(property: SchemaProperty, bindable: boolean) {
             message: type === "array" ? "an array declares its items" : "only an array has it",
         });
     }
-    const binds = bindable && SCALAR_TYPES.some((scalar) => scalar === type);
-    if (property["x-source"] !== undefined && !binds) {
-        issues.push({
-            at: ["x-source"],
-            message: "only a top-level scalar field of a tool's input has it",
-        });
-    }
-    if (property["x-target"] !== undefined && !bindable) {
+    return [...issues, ...bindingIssues(property, type, bindings)];
+}
+
+/**
+ * What a property's bindings break: one other than `bindings` directly under
+ * a tool's input (none anywhere else), an `x-source` off a scalar, or a
+ * source that does not fit the field.
+ */
+function bindingIssues(
+    property: SchemaProperty,
+    type: string | undefined,
+    bindings: ReadonlyArray<Binding> | undefined,
+) {
+    const issues = new Array<RowIssue>();
+    const scalar = SCALAR_TYPES.some((scalar) => scalar === type);
+    // A source fills a scalar; a target places a field of any type.
+    const fields = { "x-source": "a top-level scalar field", "x-target": "a top-level field" };
+    for (const binding of ["x-source", "x-target"] as const) {
+        if (property[binding] === undefined) continue;
+        const reaches = bindings !== undefined && (binding === "x-target" || scalar);
+        if (reaches && bindings.includes(binding)) continue;
         issues.push({
-            at: ["x-target"],
-            message: "only a top-level field of a tool's input has it",
+            at: [binding],
+            message: reaches
+                ? "this type of tool takes none"
+                : `only ${fields[binding]} of a tool's input has it`,
         });
     }
     const source = property["x-source"];
-    if (binds && source && !sourceFits(source, { type, enum: property.enum })) {
+    if (
+        scalar &&
+        bindings?.includes("x-source") &&
+        source &&
+        !sourceFits(source, { type, enum: property.enum })
+    ) {
         issues.push({ at: ["x-source"], message: "the source does not fit the field's type" });
     }
     return issues;
@@ -560,18 +839,15 @@ function propertyIssues(property: SchemaProperty, bindable: boolean) {
 /**
  * Refuses, at every depth below `path`, what the console's field rows cannot
  * hold, since it stores a schema as rows and would drop or change it in
- * silence (`nodeIssues`, `propertyIssues`); `x-source` only on a scalar,
- * and `x-target` only on a field, directly under a node where `bindable`.
+ * silence (`nodeIssues`, `propertyIssues`); a binding only one of
+ * `bindings`, directly under the node they are given for, and `x-source`
+ * only on a scalar.
  */
 function heldByRows(
-    node: {
-        type: SchemaProperty["type"];
-        properties?: Record<string, SchemaProperty>;
-        required?: string[];
-    },
+    node: ObjectNode,
     context: z.RefinementCtx,
     path: Array<string | number>,
-    bindable: boolean,
+    bindings: ReadonlyArray<Binding> | undefined,
 ) {
     const report = (under: Array<string | number>, issues: ReadonlyArray<RowIssue>) => {
         for (const { at, message } of issues) {
@@ -581,27 +857,29 @@ function heldByRows(
     report(path, nodeIssues(node));
     for (const [name, property] of Object.entries(node.properties ?? {})) {
         const at = [...path, "properties", name];
-        report(at, propertyIssues(property, bindable));
-        heldByRows(property, context, at, false);
-        if (property.items) heldByRows(property.items, context, [...at, "items"], false);
+        report(at, propertyIssues(property, bindings));
+        heldByRows(property, context, at, undefined);
+        if (property.items) heldByRows(property.items, context, [...at, "items"], undefined);
     }
 }
 
 /**
  * An object's JSON Schema, the shape of a tool's or trigger's input and
- * output. `bindable` admits `x-source` on its top-level scalar fields and
- * `x-target` on its top-level fields, as a tool's input has them.
+ * output, and of what the console's field rows write. `bindings`, given for
+ * a tool's input, are the extensions its top-level fields may carry:
+ * `x-source` on a scalar, `x-target` on any field.
  */
-function objectSchemaOf(bindable: boolean) {
+export function objectJsonSchemaOf(bindings?: ReadonlyArray<Binding>) {
     return z
         .strictObject({
             type: z.literal("object"),
             properties: z.record(propertyNameSchema, schemaPropertySchema).optional(),
             required: z.array(z.string()).optional(),
+            "x-order": propertyOrderSchema,
         })
-        .superRefine((schema, context) => heldByRows(schema, context, [], bindable));
+        .superRefine((schema, context) => heldByRows(schema, context, [], bindings));
 }
-const objectSchema = objectSchemaOf(false);
+const objectSchema = objectJsonSchemaOf();
 
 const EMPTY_OBJECT = { type: "object" } as const satisfies z.input<typeof objectSchema>;
 
@@ -617,82 +895,126 @@ const audienceSchema = z.union([
     }),
 ]);
 
+/** A model provider's base URL and each model it lists in characters, and how many it lists. The console caps a provider at the same. */
+export const MODEL_PROVIDER_LIMITS = { urlLength: 2_048, modelLength: 200, models: 100 } as const;
+
 /** A model a provider lists, and the reasoning effort sent with it. */
 const modelSchema = z.strictObject({
     provider: nameSchema,
-    model: z.string().trim().min(1).max(200),
+    model: z.string().trim().min(1).max(MODEL_PROVIDER_LIMITS.modelLength),
     effort: z.string().trim().min(1).max(64).optional(),
 });
 
+/** A service's name and description, in characters per locale. The console caps its editor at the same lengths. */
+export const SERVICE_LIMITS = { nameLength: 120, descriptionLength: 4_000 } as const;
+
 /** One line per locale, trimmed. */
-const localizedLineSchema = z.record(localeSchema, z.string().trim().min(1).max(120));
-const localizedTextSchema = z.record(localeSchema, z.string().trim().min(1).max(4_000));
+const localizedLineSchema = z.record(
+    localeSchema,
+    z.string().trim().min(1).max(SERVICE_LIMITS.nameLength),
+);
+const localizedTextSchema = z.record(
+    localeSchema,
+    z.string().trim().min(1).max(SERVICE_LIMITS.descriptionLength),
+);
 
 const { tool: toolBounds } = SETTING_BOUNDS;
+const { tool: toolRateLimits, datasetHost: datasetHostRateLimits } = RATE_LIMITS;
+
+/** A `type` tool's input schema, its fields bound only as `TOOL_TYPES` lets the type: filled from a source, placed in the request. */
+function toolInputSchemaOf(type: (typeof TOOL_TYPE_NAMES)[number]) {
+    const { sources, targets } = TOOL_TYPES[type];
+    return objectJsonSchemaOf([
+        ...(sources ? ["x-source" as const] : []),
+        ...(targets ? ["x-target" as const] : []),
+    ]).default(EMPTY_OBJECT);
+}
 
-/** Shared by every tool type; a tool that calls nothing (`client`) has no endpoint, credentials, approval or bound fields. */
+/** What a live write may change on a manifest's tool, and keep through the next apply. */
+const TOOL_OVERRIDABLES = [
+    "description",
+    "timeoutMs",
+    "maxResponseBytes",
+    "rateLimits",
+    "pinned",
+    "tags",
+] as const;
+
+/** The same for a tool that calls an endpoint, whose headers are its own. */
+const CALLED_TOOL_OVERRIDABLES = [...TOOL_OVERRIDABLES, "headers"] as const;
+
+/** Shared by every tool type; a tool that calls nothing (`client`) has no endpoint, headers, approval or bound fields. */
 const toolBaseSchema = z.strictObject({
     ...serverToolSchema.pick({ name: true, description: true }).shape,
-    inputSchema: objectSchema.default(EMPTY_OBJECT),
+    inputSchema: toolInputSchemaOf("client"),
     outputSchema: objectSchema.default(EMPTY_OBJECT),
     timeoutMs: setting(toolBounds.timeoutMs),
     maxResponseBytes: setting(toolBounds.maxResponseBytes),
-    rateLimitRequests: setting(toolBounds.rateLimitRequests),
-    rateLimitWindowSeconds: setting(toolBounds.rateLimitWindowSeconds),
+    rateLimits: z
+        .strictObject({
+            allUsers: z
+                .strictObject({
+                    callsPerMinute: rateLimit(toolRateLimits.callsPerMinute, "allUsers"),
+                })
+                .prefault({}),
+            perUser: z
+                .strictObject({
+                    callsPerMinute: rateLimit(toolRateLimits.callsPerMinute, "perUser"),
+                })
+                .prefault({}),
+        })
+        .prefault({}),
     /** Trims the upstream's answer to what the output schema declares. */
     projectOutput: z.boolean().default(false),
     /** Listed in every turn of every agent the tool reaches, whatever the question. */
     pinned: z.boolean().default(false),
     tags: toolTagsSchema.default([]),
     audience: audienceSchema,
-    overridable: overridable([
-        "description",
-        "timeoutMs",
-        "maxResponseBytes",
-        "rateLimitRequests",
-        "rateLimitWindowSeconds",
-        "pinned",
-        "tags",
-    ]),
+    overridable: overridable(TOOL_OVERRIDABLES),
 });
 
 /** A tool that calls an endpoint; with `requiresApproval`, every call waits for the end user to approve it. */
 const calledToolSchema = toolBaseSchema.extend({
-    inputSchema: objectSchemaOf(true).default(EMPTY_OBJECT),
     url: upstreamUrlSchema.refine(
         confinesEndpointParams,
         "a {parameter} outside the path or query",
     ),
-    credentials: credentialsSchema,
+    headers: headersSchema,
     requiresApproval: z.boolean().default(false),
+    overridable: overridable(CALLED_TOOL_OVERRIDABLES),
 });
 
 const manifestToolSchema = z
     .discriminatedUnion("type", [
         calledToolSchema.extend({
             type: z.literal("http"),
+            inputSchema: toolInputSchemaOf("http"),
             method: z.enum(TOOL_METHODS),
             readOnly: z.boolean(),
             ...toolConfigByType.http.shape,
         }),
-        /** The endpoint is the initiate call that opens the page; never read-only, so a reload rejoins it. */
-        calledToolSchema.extend({
+        /**
+         * The endpoint is the initiate call that opens the page; never read-only, so a reload rejoins it.
+         * No `requiresApproval`: the widget answers the call, so nothing would ask for it. No field
+         * names its place in the request (`x-target`).
+         */
+        calledToolSchema.omit({ requiresApproval: true }).extend({
             type: z.literal("embedded"),
+            inputSchema: toolInputSchemaOf("embedded"),
             method: z.enum(TOOL_METHODS),
             ...toolConfigByType.embedded.shape,
         }),
         /** Always POSTed. */
         calledToolSchema.extend({
             type: z.literal("soap"),
+            inputSchema: toolInputSchemaOf("soap"),
             readOnly: z.boolean(),
             ...toolConfigByType.soap.shape,
         }),
         /** Answered by your app: the model calls it and the widget hands the call over. */
         toolBaseSchema.extend({ type: z.literal("client") }),
     ])
-    .superRefine((tool, context) => {
-        if (tool.type !== "client") refuseBlockedApprovalTitle(tool, context, []);
-    });
+    .superRefine((tool, context) => refuseBlockedApprovalTitle(tool, context, []));
 export type ManifestTool = z.input<typeof manifestToolSchema>;
 
 const toolNamesSchema = z.array(serverToolSchema.shape.name).max(500).default([]);
@@ -701,16 +1023,16 @@ const toolNamesSchema = z.array(serverToolSchema.shape.name).max(500).default([]
  * An OpenAPI document whose operations become HTTP tools this manifest owns.
  * Each apply reads it, imports every operation Cortex supports, keeps those
  * tools in step with the document and deletes the ones it no longer has.
- * Every tool presents `credentials`. A GET call runs at once; any other
+ * Every tool carries the source's `headers`. A GET call runs at once; any other
  * method waits for the end user's approval, unless `approval` names the
  * tool the other way.
  */
 const manifestOpenApiSchema = z.strictObject({
     /** Names the source in what an apply reports. */
     name: nameSchema,
-    /** Where the document is read, with no credentials: OpenAPI 3 or Swagger 2, JSON or YAML. */
+    /** Where the document is read, with no headers: OpenAPI 3 or Swagger 2, JSON or YAML. */
     url: upstreamUrlSchema,
-    credentials: credentialsSchema,
+    headers: headersSchema,
     /** Where every operation's successful response keeps its result, when the API wraps each answer. */
     resultPath: jsonPointerSchema.optional(),
     /** Tools listed in every turn of every agent they reach, whatever the question. */
@@ -723,6 +1045,8 @@ const manifestOpenApiSchema = z.strictObject({
             "a tool both never and always needs approval",
         ),
     audience: audienceSchema,
+    /** What a live write may change on each of the source's tools, and keep through the next apply. */
+    overridable: overridable(CALLED_TOOL_OVERRIDABLES),
 });
 export type ManifestOpenApi = z.input<typeof manifestOpenApiSchema>;
 
@@ -738,9 +1062,12 @@ const manifestServiceSchema = z.strictObject({
 });
 export type ManifestService = z.input<typeof manifestServiceSchema>;
 
+/** A skill's description in characters. The console caps its editor at the same. */
+export const SKILL_LIMITS = { descriptionLength: 500 } as const;
+
 const manifestSkillSchema = z.strictObject({
     name: slugSchema,
-    description: z.string().trim().min(1).max(500),
+    description: z.string().trim().min(1).max(SKILL_LIMITS.descriptionLength),
     /** Rich text: it may mention tools, skills and datasets, and read `{{variables}}`. */
     body: z.string().trim().min(1),
     /** The key of the service the skill renders inside; fixed once created. */
@@ -767,11 +1094,14 @@ export const triggerThreadPolicySchema = z.discriminatedUnion("policy", [
 ]);
 export type TriggerThreadPolicy = z.infer<typeof triggerThreadPolicySchema>;
 
+/** A trigger's description and instructions in characters. The console caps its editor at the same. */
+export const TRIGGER_LIMITS = { descriptionLength: 500, instructionsLength: 20_000 } as const;
+
 /** Fired with its secret, which the apply that creates it answers once and no manifest holds. */
 const manifestTriggerSchema = z.strictObject({
     /** `message` is the built-in trigger every agent has. */
     name: slugSchema.refine((name) => name !== MESSAGE_TRIGGER_NAME, "the built-in trigger's name"),
-    description: z.string().trim().min(1).max(500),
+    description: z.string().trim().min(1).max(TRIGGER_LIMITS.descriptionLength),
     inputSchema: objectSchema.default(EMPTY_OBJECT),
     /** The shape the run answers in; absent, the run answers in free text. */
     outputSchema: objectSchema
@@ -781,7 +1111,7 @@ const manifestTriggerSchema = z.strictObject({
         )
         .optional(),
     /** Rich text: it may mention tools, skills and datasets, and read `{{variables}}` and `{{/payload/pointer}}`s. */
-    instructions: z.string().trim().min(1).max(20_000),
+    instructions: z.string().trim().min(1).max(TRIGGER_LIMITS.instructionsLength),
     threadPolicy: triggerThreadPolicySchema.default({ policy: "single" }),
     /** Firings a day per agent; absent, no limit. */
     budgetPerDay: z.number().int().positive().optional(),
@@ -818,14 +1148,34 @@ const manifestDatasetHostSchema = z
     .strictObject({
         name: datasetIdentifierSchema,
         url: upstreamUrlSchema,
-        credentials: credentialsSchema,
+        headers: headersSchema,
         timeoutMs: setting(SETTING_BOUNDS.datasetHost.timeoutMs),
+        rateLimits: z
+            .strictObject({
+                allUsers: z
+                    .strictObject({
+                        queriesPerMinute: rateLimit(
+                            datasetHostRateLimits.queriesPerMinute,
+                            "allUsers",
+                        ),
+                    })
+                    .prefault({}),
+                perUser: z
+                    .strictObject({
+                        queriesPerMinute: rateLimit(
+                            datasetHostRateLimits.queriesPerMinute,
+                            "perUser",
+                        ),
+                    })
+                    .prefault({}),
+            })
+            .prefault({}),
         /** The datasets the host serves that agents may query. */
         expose: z.array(datasetIdentifierSchema).min(1).max(500),
         /** Among those, the ones listed in every turn, whatever the question. */
         pinned: z.array(datasetIdentifierSchema).max(50).default([]),
         audience: audienceSchema,
-        overridable: overridable(["timeoutMs"]),
+        overridable: overridable(["timeoutMs", "rateLimits", "headers"]),
     })
     .superRefine((host, context) => {
         const unexposed = unexposedPins(host);
@@ -853,50 +1203,53 @@ export const mcpToolNamesSchema = z
 
 const manifestMcpServerSchema = z.strictObject({
     /** Prefixes every tool the server contributes: scripts call `tools.<name>_<tool>()`. */
-    name: z.string().regex(IDENTIFIER_PATTERN).max(64),
+    name: identifierSchema,
     url: upstreamUrlSchema,
-    credentials: presentationsSchema(
+    headers: declaredHeadersSchema(
         presentedHeaderSchema.refine(
             (name) => !mcpTransportHeaders.has(name.toLowerCase()),
             "a header the MCP transport sets",
         ),
-        nameSchema.nullable(),
+        headerSourceSchema,
     ),
     /** The server's own tool names to offer; empty offers every tool. */
     include: mcpToolNamesSchema.default([]),
     exclude: mcpToolNamesSchema.default([]),
     audience: audienceSchema,
-    overridable: overridable(["include", "exclude"]),
+    overridable: overridable(["include", "exclude", "headers"]),
 });
 export type ManifestMcpServer = z.input<typeof manifestMcpServerSchema>;
 
 /**
  * Delivers its event to a receiver while it is declared. A delivery carries
- * no run, so every credential it presents is named, and none under the
- * header that names the event.
+ * no run, so its headers come from credentials and constants, and none
+ * travels under the header that names the event.
  */
 const manifestWebhookSchema = z.strictObject({
     name: slugSchema,
     description: z.string().trim().max(500).default(""),
     event: z.enum(SERVER_EVENTS),
     url: upstreamUrlSchema,
-    credentials: presentationsSchema(
+    headers: declaredHeadersSchema(
         presentedHeaderSchema.refine(
             (name) => name.toLowerCase() !== EVENT_HEADER.toLowerCase(),
             "the header that names the event",
         ),
-        nameSchema,
+        runlessHeaderSourceSchema,
     ),
     timeoutMs: setting(SETTING_BOUNDS.webhook.timeoutMs),
     audience: audienceSchema,
-    overridable: overridable(["description", "timeoutMs"]),
+    overridable: overridable(["description", "timeoutMs", "headers"]),
 });
 export type ManifestWebhook = z.input<typeof manifestWebhookSchema>;
 
+/** A collection's name and description in characters. The console caps its editor at the same. */
+export const COLLECTION_LIMITS = { nameLength: 80, descriptionLength: 2_000 } as const;
+
 /** Holds documents, which are uploaded to it apart from the manifest. */
 const manifestCollectionSchema = z.strictObject({
-    name: z.string().trim().min(1).max(80),
-    description: z.string().trim().max(2_000).default(""),
+    name: z.string().trim().min(1).max(COLLECTION_LIMITS.nameLength),
+    description: z.string().trim().max(COLLECTION_LIMITS.descriptionLength).default(""),
     /** The key of the service every document in the collection belongs to. */
     service: slugSchema.optional(),
     /** Whether answers may name its documents; false keeps their names, sections and pages from the model. */
@@ -916,9 +1269,9 @@ const tokenAudienceSchema = z.string().trim().min(1).max(2048).optional();
  * How the agent verifies end-user tokens: against the keys its issuer
  * publishes at a JWKS URI, with a shared secret named in Cortex's secret
  * store and the one algorithm tokens are signed with, through its server's
- * `/verify`, or not at all.
+ * `/verify`, or not at all. Cortex stores it on the agent as written here.
  */
-const agentAuthSchema = z.discriminatedUnion("kind", [
+export const agentAuthSchema = z.discriminatedUnion("kind", [
     z.strictObject({
         kind: z.literal("jwks"),
         jwksUri: tlsUrlSchema,
@@ -932,14 +1285,38 @@ const agentAuthSchema = z.discriminatedUnion("kind", [
         issuer: issuerSchema,
         audience: tokenAudienceSchema,
     }),
-    z.strictObject({ kind: z.literal("anonymous") }),
+    /**
+     * Each visitor gets an id of their own from Cortex, kept in their
+     * browser. With `recaptcha`, reCAPTCHA Enterprise scores each new
+     * visitor first, and one below `minScore` gets none.
+     */
+    z.strictObject({
+        kind: z.literal("anonymous"),
+        recaptcha: z
+            .strictObject({
+                siteKey: z.string().trim().min(1).max(200),
+                projectId: z.string().trim().min(1).max(200),
+                /** The secret holding a Google Cloud API key allowed to create assessments. */
+                secret: nameSchema,
+                minScore: z
+                    .number()
+                    .min(SETTING_BOUNDS.recaptcha.minScore.min)
+                    .max(SETTING_BOUNDS.recaptcha.minScore.max)
+                    .default(SETTING_BOUNDS.recaptcha.minScore.default),
+            })
+            .optional(),
+    }),
     z.strictObject({ kind: z.literal("server") }),
 ]);
 
-const { agent: agentBounds, agentContext, agentLimits } = SETTING_BOUNDS;
+const { agentContext, agentLimits } = SETTING_BOUNDS;
+const { agent: agentRateLimits } = RATE_LIMITS;
 
-/** How the agent runs; every setting left out keeps its default. */
-const agentSettingsSchema = z.strictObject({
+/**
+ * How the agent runs; every setting left out keeps its default. The
+ * console's settings input requires each of them.
+ */
+export const agentSettingsSchema = z.strictObject({
     /** Lets `searchRegistries` search the knowledge in the collections the agent sees. */
     ragEnabled: z.boolean().default(false),
     /** Lets `searchRegistries` search the tools the agent sees, beyond the pinned and mentioned ones. */
@@ -957,10 +1334,23 @@ const agentSettingsSchema = z.strictObject({
     media: z.array(z.enum(MEDIA_FORMS)).default([...DEFAULT_MEDIA_FORMS]),
     /** Off, end users cannot message the agent: only its triggers reach it. */
     messageTrigger: z.boolean().default(true),
-    defaultLocale: localeSchema.default("en"),
-    rateLimitRequests: setting(agentBounds.rateLimitRequests),
-    rateLimitWindowSeconds: setting(agentBounds.rateLimitWindowSeconds),
-    dailyExecutionQuota: setting(agentBounds.dailyExecutionQuota),
+    defaultLocale: localeSchema.default(BASE_LOCALE),
+    rateLimits: z
+        .strictObject({
+            allUsers: z
+                .strictObject({
+                    messagesPerMinute: rateLimit(agentRateLimits.messagesPerMinute, "allUsers"),
+                    tokensPerDay: rateLimit(agentRateLimits.tokensPerDay, "allUsers"),
+                })
+                .prefault({}),
+            perUser: z
+                .strictObject({
+                    messagesPerMinute: rateLimit(agentRateLimits.messagesPerMinute, "perUser"),
+                    tokensPerDay: rateLimit(agentRateLimits.tokensPerDay, "perUser"),
+                })
+                .prefault({}),
+        })
+        .prefault({}),
     context: z
         .strictObject({
             maxContextTokens: setting(agentContext.maxContextTokens),
@@ -982,9 +1372,12 @@ const agentSettingsSchema = z.strictObject({
         .prefault({}),
 });
 
+/** An agent's name in characters. The console caps its editor at the same. */
+export const AGENT_LIMITS = { nameLength: 120 } as const;
+
 const manifestAgentSchema = z.strictObject({
     slug: agentSlugSchema,
-    name: z.string().trim().min(1).max(120),
+    name: z.string().trim().min(1).max(AGENT_LIMITS.nameLength),
     /** The server it belongs to, by name; a manifest never creates one. */
     server: nameSchema,
     /** Rich text: it may mention tools and skills, and read `{{variables}}`. */
@@ -1002,23 +1395,61 @@ const manifestAgentSchema = z.strictObject({
         })
         .default({}),
     settings: agentSettingsSchema.prefault({}),
-    suggestions: suggestionsSchema.default({ en: [], ar: [] }),
-    greeting: greetingSchema.default({ en: "", ar: "" }),
+    suggestions: suggestionsSchema.default(() => byLocale(() => [])),
+    greeting: greetingSchema.default(() => byLocale(() => "")),
     overridable: overridable(["name", "prompt", "models", "settings", "suggestions", "greeting"]),
 });
 export type ManifestAgent = z.input<typeof manifestAgentSchema>;
 
-/** Every name in a list once, so one entry means one row. */
-function uniqueBy<TEntry>(key: (entry: TEntry) => string) {
-    return (entries: ReadonlyArray<TEntry>) => new Set(entries.map(key)).size === entries.length;
-}
+/**
+ * Every kind of entry a manifest owns a row for, in the order an apply
+ * reports a name another row holds and a kind its actor may not write. An
+ * OpenAPI source is none: its operations become `tools` entries.
+ */
+export const MANIFEST_KINDS = [
+    "agents",
+    "services",
+    "tools",
+    "skills",
+    "triggers",
+    "datasetHosts",
+    "mcpServers",
+    "webhooks",
+    "collections",
+] as const;
+export type ManifestKind = (typeof MANIFEST_KINDS)[number];
 
-function listOf<TEntry extends z.ZodType>(entry: TEntry, key: (value: z.output<TEntry>) => string) {
-    return z.array(entry).refine(uniqueBy(key), "a name repeats").default([]);
+/**
+ * The field each kind's entries go by, which its row's name holds: an
+ * agent's slug, a service's key, any other entry's name. A list holds each
+ * once, so one entry means one row.
+ */
+export const MANIFEST_NAME_FIELDS = {
+    agents: "slug",
+    tools: "name",
+    services: "key",
+    skills: "name",
+    triggers: "name",
+    datasetHosts: "name",
+    mcpServers: "name",
+    webhooks: "name",
+    collections: "name",
+} as const satisfies Record<ManifestKind, string>;
+
+/** A list of entries named by their `field`, refusing a name they repeat. */
+function listOf<TField extends string, TEntry extends z.ZodType<Record<TField, string>>>(
+    field: TField,
+    entry: TEntry,
+) {
+    return z
+        .array(entry)
+        .refine(
+            (entries) => new Set(entries.map((value) => value[field])).size === entries.length,
+            "a name repeats",
+        )
+        .default([]);
 }
 
-const byName = (entry: { name: string }) => entry.name;
-
 /** The id of Cortex's own manifest, which only Cortex applies: the management API refuses any other under it. */
 export const CORTEX_MANIFEST_ID = "cortex";
 
@@ -1032,24 +1463,26 @@ export const CORTEX_MANIFEST_ID = "cortex";
 export const manifestSchema = z.strictObject({
     /** Fixed for the deployment it describes: the rows an apply owns carry it. */
     id: slugSchema,
-    agents: listOf(manifestAgentSchema, (agent) => agent.slug),
-    tools: listOf(manifestToolSchema, byName),
-    openapi: listOf(manifestOpenApiSchema, byName),
-    services: listOf(manifestServiceSchema, (service) => service.key),
-    skills: listOf(manifestSkillSchema, byName),
-    triggers: listOf(manifestTriggerSchema, byName),
-    datasetHosts: listOf(manifestDatasetHostSchema, byName),
-    mcpServers: listOf(manifestMcpServerSchema, byName),
-    webhooks: listOf(manifestWebhookSchema, byName),
-    collections: listOf(manifestCollectionSchema, byName),
-});
+    agents: listOf(MANIFEST_NAME_FIELDS.agents, manifestAgentSchema),
+    tools: listOf(MANIFEST_NAME_FIELDS.tools, manifestToolSchema),
+    openapi: listOf("name", manifestOpenApiSchema),
+    services: listOf(MANIFEST_NAME_FIELDS.services, manifestServiceSchema),
+    skills: listOf(MANIFEST_NAME_FIELDS.skills, manifestSkillSchema),
+    triggers: listOf(MANIFEST_NAME_FIELDS.triggers, manifestTriggerSchema),
+    datasetHosts: listOf(MANIFEST_NAME_FIELDS.datasetHosts, manifestDatasetHostSchema),
+    mcpServers: listOf(MANIFEST_NAME_FIELDS.mcpServers, manifestMcpServerSchema),
+    webhooks: listOf(MANIFEST_NAME_FIELDS.webhooks, manifestWebhookSchema),
+    collections: listOf(MANIFEST_NAME_FIELDS.collections, manifestCollectionSchema),
+} satisfies Record<ManifestKind | "id" | "openapi", z.ZodType>);
 /** A manifest as written: every field with a default may be left out. */
 export type Manifest = z.input<typeof manifestSchema>;
 
-/** The kinds of row a manifest owns; an OpenAPI source's operations are `tools`. */
-const manifestKindSchema = manifestSchema.keyof().exclude(["id", "openapi"]);
+const manifestKindSchema = z.enum(MANIFEST_KINDS);
 
-/** Entry names per kind: agents by slug, services by key, everything else by name. */
+/**
+ * Entry names per kind, each by its `MANIFEST_NAME_FIELDS` field. An OpenAPI
+ * source's operations are counted among `tools`.
+ */
 const namesByKindSchema = z.record(manifestKindSchema, z.array(z.string()));
 
 /** What an apply creates, updates and deletes, kind by kind; a preview answers the same without doing it. */