@nextclaw/server 0.20.4 → 0.21.0

package/dist/index.d.ts

@@ -1,7 +1,7 @@
 import * as _$hono from "hono";
 import { Context, Hono } from "hono";
 import * as _$_nextclaw_kernel0 from "@nextclaw/kernel";
-import { AccessManager, AppDataDeleteResult, AppDataEntry, AppDataList, AppDataManager, AppPackageHostTarget, AppPackageList, AppPackageManager, AppPackageOperationInput, AppPackageOperationList, AppPackageOperationStatus, AppPackageOperationView, AppPackageView, InboxDeliveryManager, NextclawKernel, ObservationRelationshipStatus, PanelAppAgentCapability, PanelAppAgentGenerateObjectRequest, PanelAppAgentGenerateObjectResult, PanelAppAgentSendRequest, PanelAppAgentSendResult, PanelAppBridgeSession, PanelAppCapabilityGrant, PanelAppClientGrant, PanelAppEntry, PanelAppList, PanelAppManager, PanelAppPreferencesUpdate, PreferenceJsonValue, PreferenceManager, ProjectRecord, ProjectTemplate, ProjectTemplateId, ServiceAction, ServiceActionGrant, ServiceActionInvokeResult, ServiceAppDeleteResult, ServiceAppList, ServiceAppManager, ServiceAppRecord, SessionTokenUsageSummary } from "@nextclaw/kernel";
+import { AccessManager, AppDataDeleteResult, AppDataEntry, AppDataList, AppDataManager, AppPackageHostTarget, AppPackageList, AppPackageManager, AppPackageOperationInput, AppPackageOperationList, AppPackageOperationStatus, AppPackageOperationView, AppPackageView, InboxDeliveryManager, NextclawKernel, ObservationRelationshipStatus, PanelAppAgentCapability, PanelAppAgentGenerateObjectRequest, PanelAppAgentGenerateObjectResult, PanelAppAgentSendRequest, PanelAppAgentSendResult, PanelAppBridgeSession, PanelAppCapabilityGrant, PanelAppClientGrant, PanelAppEntry, PanelAppList, PanelAppManager, PanelAppPreferencesUpdate, PortableRuntimeAcceptanceContractView, PortableRuntimeAcceptanceManager, PortableRuntimeAcceptanceStatusView, PreferenceJsonValue, PreferenceManager, ProjectRecord, ProjectTemplate, ProjectTemplateId, ServiceAction, ServiceActionGrant, ServiceActionInvokeResult, ServiceAppDeleteResult, ServiceAppJobList, ServiceAppJobView, ServiceAppJobWatch, ServiceAppList, ServiceAppManager, ServiceAppRecord, SessionTokenUsageSummary, VerificationRecordList } from "@nextclaw/kernel";
 import { FSWatcher } from "node:fs";
 import * as NextclawCore from "@nextclaw/core";
 import { Config, ConfigActionExecuteRequest as ConfigActionExecuteRequest$1, ConfigActionExecuteResult as ConfigActionExecuteResult$1, ExtensionChannelBinding, ExtensionUiMetadata, McpServerDefinition, ModelThinkingCapability, ThinkingLevel } from "@nextclaw/core";
@@ -817,7 +817,6 @@ type AppDistributionMode = "bundle" | "source";
 type AppStorageLayout = "legacy" | "instance-v1";
 //#endregion
 //#region ../nextclaw-app-runtime/dist/types/app-registry.types.d.ts
-//#region src/types/app-registry.types.d.ts
 type AppInstallSourceKind = "bundle" | "directory" | "registry";
 //#endregion
 //#region src/features/service-apps/controllers/service-apps.controller.d.ts
@@ -826,6 +825,7 @@ declare class ServiceAppsRoutesController {
   constructor(params: {
     panelAppManager: PanelAppManager;
     serviceAppManager: ServiceAppManager;
+    portableRuntimeAcceptance: PortableRuntimeAcceptanceManager;
   });
   readonly listServiceApps: (c: Context) => Promise<Response & _$hono.TypedResponse<{
     ok: boolean;
@@ -874,6 +874,12 @@ declare class ServiceAppsRoutesController {
             mode: AppDocumentAccessMode;
             description?: string | undefined;
           }[] | undefined;
+          secrets?: {
+            id: string;
+            title: string;
+            description: string;
+            required: boolean;
+          }[] | undefined;
           allowedDomains?: string[] | undefined;
           storage?: boolean | {
             namespace?: string | undefined;
@@ -945,6 +951,12 @@ declare class ServiceAppsRoutesController {
           mode: AppDocumentAccessMode;
           description?: string | undefined;
         }[] | undefined;
+        secrets?: {
+          id: string;
+          title: string;
+          description: string;
+          required: boolean;
+        }[] | undefined;
         allowedDomains?: string[] | undefined;
         storage?: boolean | {
           namespace?: string | undefined;
@@ -974,7 +986,7 @@ declare class ServiceAppsRoutesController {
         [x: string]: _$hono_utils_types0.JSONValue;
       } | undefined;
     };
-  }, 400 | 401 | 403 | 404 | 502, "json">) | (Response & _$hono.TypedResponse<{
+  }, 400 | 401 | 403 | 404 | 422 | 502, "json">) | (Response & _$hono.TypedResponse<{
     ok: boolean;
     error: {
       code: string;
@@ -984,7 +996,7 @@ declare class ServiceAppsRoutesController {
       } | undefined;
     };
   }, 500, "json">)>;
-  readonly listServiceActions: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
+  readonly inspectServiceAppAiCapabilities: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
     ok: boolean;
     error: {
       code: string;
@@ -993,7 +1005,7 @@ declare class ServiceAppsRoutesController {
         [x: string]: _$hono_utils_types0.JSONValue;
       } | undefined;
     };
-  }, 400 | 401 | 403 | 404 | 502, "json">) | (Response & _$hono.TypedResponse<{
+  }, 400 | 401 | 403 | 404 | 422 | 502, "json">) | (Response & _$hono.TypedResponse<{
     ok: boolean;
     error: {
       code: string;
@@ -1005,22 +1017,20 @@ declare class ServiceAppsRoutesController {
   }, 500, "json">) | (Response & _$hono.TypedResponse<{
     ok: boolean;
     data: {
-      actions: {
-        id: string;
-        appId: string;
-        name: string;
-        title?: string | undefined;
-        description?: string | undefined;
-        inputSchema?: {
-          [x: string]: _$hono_utils_types0.JSONValue;
-        } | undefined;
-        risk: _$_nextclaw_kernel0.ServiceActionRisk;
-        runtimeState?: _$_nextclaw_kernel0.ServiceActionRuntimeState | undefined;
-        grantState?: _$_nextclaw_kernel0.ServiceActionGrantState | undefined;
+      ready: boolean;
+      requiredMissing: {
+        kind: "model" | "agent";
+        slotId: string;
+      }[];
+      bindings: {
+        kind: "model" | "agent";
+        slotId: string;
+        targetId: string;
+        grantedAt: string;
       }[];
     };
   }, _$hono_utils_http_status0.ContentfulStatusCode, "json">)>;
-  readonly discoverServiceAppActions: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
+  readonly verifyServiceAppAiCapabilities: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
     ok: boolean;
     error: {
       code: string;
@@ -1029,7 +1039,7 @@ declare class ServiceAppsRoutesController {
         [x: string]: _$hono_utils_types0.JSONValue;
       } | undefined;
     };
-  }, 400 | 401 | 403 | 404 | 502, "json">) | (Response & _$hono.TypedResponse<{
+  }, 400 | 401 | 403 | 404 | 422 | 502, "json">) | (Response & _$hono.TypedResponse<{
     ok: boolean;
     error: {
       code: string;
@@ -1041,22 +1051,20 @@ declare class ServiceAppsRoutesController {
   }, 500, "json">) | (Response & _$hono.TypedResponse<{
     ok: boolean;
     data: {
-      actions: {
-        id: string;
-        appId: string;
-        name: string;
-        title?: string | undefined;
-        description?: string | undefined;
-        inputSchema?: {
-          [x: string]: _$hono_utils_types0.JSONValue;
-        } | undefined;
-        risk: _$_nextclaw_kernel0.ServiceActionRisk;
-        runtimeState?: _$_nextclaw_kernel0.ServiceActionRuntimeState | undefined;
-        grantState?: _$_nextclaw_kernel0.ServiceActionGrantState | undefined;
+      ready: boolean;
+      requiredMissing: {
+        kind: "model" | "agent";
+        slotId: string;
+      }[];
+      bindings: {
+        kind: "model" | "agent";
+        slotId: string;
+        targetId: string;
+        grantedAt: string;
       }[];
     };
   }, _$hono_utils_http_status0.ContentfulStatusCode, "json">)>;
-  readonly invokeServiceAction: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
+  readonly bindServiceAppAiCapability: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
     ok: boolean;
     error: {
       code: string;
@@ -1065,7 +1073,7 @@ declare class ServiceAppsRoutesController {
         [x: string]: _$hono_utils_types0.JSONValue;
       } | undefined;
     };
-  }, 400 | 401 | 403 | 404 | 502, "json">) | (Response & _$hono.TypedResponse<{
+  }, 400 | 401 | 403 | 404 | 422 | 502, "json">) | (Response & _$hono.TypedResponse<{
     ok: boolean;
     error: {
       code: string;
@@ -1077,11 +1085,20 @@ declare class ServiceAppsRoutesController {
   }, 500, "json">) | (Response & _$hono.TypedResponse<{
     ok: boolean;
     data: {
-      actionId: string;
-      result: _$hono_utils_types0.JSONValue;
+      ready: boolean;
+      requiredMissing: {
+        kind: "model" | "agent";
+        slotId: string;
+      }[];
+      bindings: {
+        kind: "model" | "agent";
+        slotId: string;
+        targetId: string;
+        grantedAt: string;
+      }[];
     };
   }, _$hono_utils_http_status0.ContentfulStatusCode, "json">)>;
-  readonly grantServiceAction: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
+  readonly unbindServiceAppAiCapability: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
     ok: boolean;
     error: {
       code: string;
@@ -1090,7 +1107,7 @@ declare class ServiceAppsRoutesController {
         [x: string]: _$hono_utils_types0.JSONValue;
       } | undefined;
     };
-  }, 400 | 401 | 403 | 404 | 502, "json">) | (Response & _$hono.TypedResponse<{
+  }, 400 | 401 | 403 | 404 | 422 | 502, "json">) | (Response & _$hono.TypedResponse<{
     ok: boolean;
     error: {
       code: string;
@@ -1102,19 +1119,20 @@ declare class ServiceAppsRoutesController {
   }, 500, "json">) | (Response & _$hono.TypedResponse<{
     ok: boolean;
     data: {
-      caller: {
-        surface: "panel-app";
-        appId: string;
-      } | {
-        surface: "agent";
-        agentId: string;
-      };
-      actionId: string;
-      risk: _$_nextclaw_kernel0.ServiceActionRisk;
-      grantedAt: string;
+      ready: boolean;
+      requiredMissing: {
+        kind: "model" | "agent";
+        slotId: string;
+      }[];
+      bindings: {
+        kind: "model" | "agent";
+        slotId: string;
+        targetId: string;
+        grantedAt: string;
+      }[];
     };
   }, _$hono_utils_http_status0.ContentfulStatusCode, "json">)>;
-  readonly grantServiceActions: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
+  readonly listServiceActions: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
     ok: boolean;
     error: {
       code: string;
@@ -1123,7 +1141,7 @@ declare class ServiceAppsRoutesController {
         [x: string]: _$hono_utils_types0.JSONValue;
       } | undefined;
     };
-  }, 400 | 401 | 403 | 404 | 502, "json">) | (Response & _$hono.TypedResponse<{
+  }, 400 | 401 | 403 | 404 | 422 | 502, "json">) | (Response & _$hono.TypedResponse<{
     ok: boolean;
     error: {
       code: string;
@@ -1135,21 +1153,22 @@ declare class ServiceAppsRoutesController {
   }, 500, "json">) | (Response & _$hono.TypedResponse<{
     ok: boolean;
     data: {
-      grants: {
-        caller: {
-          surface: "panel-app";
-          appId: string;
-        } | {
-          surface: "agent";
-          agentId: string;
-        };
-        actionId: string;
+      actions: {
+        id: string;
+        appId: string;
+        name: string;
+        title?: string | undefined;
+        description?: string | undefined;
+        inputSchema?: {
+          [x: string]: _$hono_utils_types0.JSONValue;
+        } | undefined;
         risk: _$_nextclaw_kernel0.ServiceActionRisk;
-        grantedAt: string;
+        runtimeState?: _$_nextclaw_kernel0.ServiceActionRuntimeState | undefined;
+        grantState?: _$_nextclaw_kernel0.ServiceActionGrantState | undefined;
       }[];
     };
   }, _$hono_utils_http_status0.ContentfulStatusCode, "json">)>;
-  readonly grantAgentServiceActions: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
+  readonly discoverServiceAppActions: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
     ok: boolean;
     error: {
       code: string;
@@ -1158,7 +1177,7 @@ declare class ServiceAppsRoutesController {
         [x: string]: _$hono_utils_types0.JSONValue;
       } | undefined;
     };
-  }, 400 | 401 | 403 | 404 | 502, "json">) | (Response & _$hono.TypedResponse<{
+  }, 400 | 401 | 403 | 404 | 422 | 502, "json">) | (Response & _$hono.TypedResponse<{
     ok: boolean;
     error: {
       code: string;
@@ -1170,38 +1189,53 @@ declare class ServiceAppsRoutesController {
   }, 500, "json">) | (Response & _$hono.TypedResponse<{
     ok: boolean;
     data: {
-      grants: {
-        caller: {
-          surface: "panel-app";
-          appId: string;
-        } | {
-          surface: "agent";
-          agentId: string;
-        };
-        actionId: string;
+      actions: {
+        id: string;
+        appId: string;
+        name: string;
+        title?: string | undefined;
+        description?: string | undefined;
+        inputSchema?: {
+          [x: string]: _$hono_utils_types0.JSONValue;
+        } | undefined;
         risk: _$_nextclaw_kernel0.ServiceActionRisk;
-        grantedAt: string;
+        runtimeState?: _$_nextclaw_kernel0.ServiceActionRuntimeState | undefined;
+        grantState?: _$_nextclaw_kernel0.ServiceActionGrantState | undefined;
       }[];
     };
   }, _$hono_utils_http_status0.ContentfulStatusCode, "json">)>;
-  readonly listServiceActionGrants: (c: Context) => Promise<Response & _$hono.TypedResponse<{
+  readonly invokeServiceAction: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
+    ok: boolean;
+    error: {
+      code: string;
+      message: string;
+      details: {
+        [x: string]: _$hono_utils_types0.JSONValue;
+      } | undefined;
+    };
+  }, 400 | 401 | 403 | 404 | 422 | 502, "json">) | (Response & _$hono.TypedResponse<{
+    ok: boolean;
+    error: {
+      code: string;
+      message: string;
+      details: {
+        [x: string]: _$hono_utils_types0.JSONValue;
+      } | undefined;
+    };
+  }, 500, "json">) | (Response & _$hono.TypedResponse<{
     ok: boolean;
     data: {
-      grants: {
-        caller: {
-          surface: "panel-app";
-          appId: string;
-        } | {
-          surface: "agent";
-          agentId: string;
-        };
-        actionId: string;
-        risk: _$_nextclaw_kernel0.ServiceActionRisk;
-        grantedAt: string;
-      }[];
+      actionId: string;
+      result: _$hono_utils_types0.JSONValue;
+      invocation?: {
+        callId: string;
+        traceId: string;
+        dataVersion: string;
+        verificationRunId: string;
+      } | undefined;
     };
-  }, _$hono_utils_http_status0.ContentfulStatusCode, "json">>;
-  readonly revokeServiceAction: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
+  }, _$hono_utils_http_status0.ContentfulStatusCode, "json">)>;
+  readonly invokeInstalledServiceAction: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
     ok: boolean;
     error: {
       code: string;
@@ -1210,7 +1244,7 @@ declare class ServiceAppsRoutesController {
         [x: string]: _$hono_utils_types0.JSONValue;
       } | undefined;
     };
-  }, 400 | 401 | 403 | 404 | 502, "json">) | (Response & _$hono.TypedResponse<{
+  }, 400 | 401 | 403 | 404 | 422 | 502, "json">) | (Response & _$hono.TypedResponse<{
     ok: boolean;
     error: {
       code: string;
@@ -1222,10 +1256,23 @@ declare class ServiceAppsRoutesController {
   }, 500, "json">) | (Response & _$hono.TypedResponse<{
     ok: boolean;
     data: {
-      revoked: boolean;
+      actionId: string;
+      result: _$hono_utils_types0.JSONValue;
+      invocation?: {
+        callId: string;
+        traceId: string;
+        dataVersion: string;
+        verificationRunId: string;
+      } | undefined;
     };
   }, _$hono_utils_http_status0.ContentfulStatusCode, "json">)>;
-  readonly revokeServiceActionGrant: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
+  /**
+   * Agent tool providers call the same manager method. This explicit endpoint
+   * is the non-LLM integration/diagnostic surface: it still requires a real
+   * configured Agent and its explicit Service Action grant, so it cannot
+   * impersonate either a Panel bridge or an arbitrary Agent.
+   */
+  readonly invokeAgentServiceAction: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
     ok: boolean;
     error: {
       code: string;
@@ -1234,7 +1281,7 @@ declare class ServiceAppsRoutesController {
         [x: string]: _$hono_utils_types0.JSONValue;
       } | undefined;
     };
-  }, 400 | 401 | 403 | 404 | 502, "json">) | (Response & _$hono.TypedResponse<{
+  }, 400 | 401 | 403 | 404 | 422 | 502, "json">) | (Response & _$hono.TypedResponse<{
     ok: boolean;
     error: {
       code: string;
@@ -1246,74 +1293,116 @@ declare class ServiceAppsRoutesController {
   }, 500, "json">) | (Response & _$hono.TypedResponse<{
     ok: boolean;
     data: {
-      revoked: boolean;
+      actionId: string;
+      result: _$hono_utils_types0.JSONValue;
+      invocation?: {
+        callId: string;
+        traceId: string;
+        dataVersion: string;
+        verificationRunId: string;
+      } | undefined;
     };
   }, _$hono_utils_http_status0.ContentfulStatusCode, "json">)>;
-  readonly restartServiceApp: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
+  readonly listVerificationRecords: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
     ok: boolean;
-    data: {
-      id: string;
-      title: string;
-      description?: string | undefined;
-      dirPath: string;
-      manifestPath: string;
-      command?: string | undefined;
-      args?: string[] | undefined;
-      cwd: string;
-      enabled: boolean;
-      protocol: _$_nextclaw_kernel0.ServiceAppProtocol;
-      status: _$_nextclaw_kernel0.ServiceAppRuntimeStatus;
-      lastError?: string | undefined;
-      lastStartedAt?: string | undefined;
-      lastReadyAt?: string | undefined;
-      lastFailedAt?: string | undefined;
-      sourceKind?: "workspace" | "package" | undefined;
-      packageId?: string | undefined;
-      packageVersion?: string | undefined;
-      packageDirectory?: string | undefined;
-      dataDirectory?: string | undefined;
-      instanceId?: string | undefined;
-      storage?: {
-        layout: AppStorageLayout;
-        layoutVersion: 1;
-        instanceId: string;
-        instanceDirectory: string;
-        dataDirectory: string;
-        configDirectory: string;
-        stateDirectory: string;
-        cacheDirectory: string;
-        temporaryDirectory: string;
-        logsDirectory: string;
+    error: {
+      code: string;
+      message: string;
+      details: {
+        [x: string]: _$hono_utils_types0.JSONValue;
       } | undefined;
-      isolation?: AppRuntimeIsolation | undefined;
-      runtimeProfile?: AppRuntimeProfile | undefined;
-      permissions?: {
-        documentAccess?: {
-          id: string;
-          mode: AppDocumentAccessMode;
-          description?: string | undefined;
-        }[] | undefined;
-        allowedDomains?: string[] | undefined;
-        storage?: boolean | {
-          namespace?: string | undefined;
+    };
+  }, 400 | 401 | 403 | 404 | 422 | 502, "json">) | (Response & _$hono.TypedResponse<{
+    ok: boolean;
+    error: {
+      code: string;
+      message: string;
+      details: {
+        [x: string]: _$hono_utils_types0.JSONValue;
+      } | undefined;
+    };
+  }, 500, "json">) | (Response & _$hono.TypedResponse<{
+    ok: boolean;
+    data: {
+      entries: ({
+        evidenceSchemaVersion: 2;
+        evidenceSource: _$_nextclaw_kernel0.PortableRuntimeAcceptanceEvidenceSource;
+        verificationRunId: string;
+        acceptanceId: string;
+        scenarioVersion: string;
+        productVersion: string;
+        runtimeVersion: string;
+        implementationFingerprint: string;
+        status: _$_nextclaw_kernel0.VerificationRecordStatus;
+        startedAt: string;
+        finishedAt: string;
+        environment: string;
+        appId: string;
+        componentId: string;
+        role: _$_nextclaw_kernel0.VerificationRecordRole;
+        entrySurface: _$_nextclaw_kernel0.VerificationRecordEntrySurface;
+        instanceId?: string | undefined;
+        actionOrEvent: string;
+        callId: string;
+        traceId: string;
+        capabilityDecisions: string[];
+        inputDigest: string;
+        outputDigest?: string | undefined;
+        dataVersion: string;
+        observation?: {
+          durationMs?: number | undefined;
+          runnerPid?: number | null | undefined;
+          memory?: {
+            rssBytes: number | null;
+            pssBytes: number | null;
+          } | null | undefined;
         } | undefined;
-        capabilities?: {
-          hostBridge?: boolean | undefined;
-          nativeProcess?: boolean | undefined;
+        error?: {
+          code?: string | undefined;
+          message: string;
         } | undefined;
-      } | undefined;
-      componentPath?: string | undefined;
-      providerIds?: string[] | undefined;
-      lifecycle?: {
-        mode: "action";
+        recovery?: string | undefined;
+        evidenceRefs: string[];
       } | {
-        mode: "resident";
-        eventIntervalMs: number;
-      } | {
-        mode: "provider";
-      } | undefined;
+        status: _$_nextclaw_kernel0.VerificationRecordStatus;
+        appId: string;
+        error?: {
+          code?: string | undefined;
+          message: string;
+        } | undefined;
+        instanceId?: string | undefined;
+        componentId: string;
+        role: _$_nextclaw_kernel0.VerificationRecordRole;
+        callId: string;
+        traceId: string;
+        dataVersion: string;
+        verificationRunId: string;
+        acceptanceId: string;
+        scenarioVersion: string;
+        startedAt: string;
+        finishedAt: string;
+        environment: string;
+        entrySurface: _$_nextclaw_kernel0.VerificationRecordEntrySurface;
+        actionOrEvent: string;
+        capabilityDecisions: string[];
+        inputDigest: string;
+        outputDigest?: string | undefined;
+        observation?: {
+          durationMs?: number | undefined;
+          runnerPid?: number | null | undefined;
+          memory?: {
+            rssBytes: number | null;
+            pssBytes: number | null;
+          } | null | undefined;
+        } | undefined;
+        recovery?: string | undefined;
+        evidenceRefs: string[];
+        evidenceSchemaVersion: 1;
+      })[];
     };
-  }, _$hono_utils_http_status0.ContentfulStatusCode, "json">) | (Response & _$hono.TypedResponse<{
+  }, _$hono_utils_http_status0.ContentfulStatusCode, "json">)>;
+  /** Stable read-only projection of the single portable-runtime acceptance registry. */
+  readonly getPortableRuntimeAcceptanceContract: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
     ok: boolean;
     error: {
       code: string;
@@ -1322,7 +1411,7 @@ declare class ServiceAppsRoutesController {
         [x: string]: _$hono_utils_types0.JSONValue;
       } | undefined;
     };
-  }, 400 | 401 | 403 | 404 | 502, "json">) | (Response & _$hono.TypedResponse<{
+  }, 400 | 401 | 403 | 404 | 422 | 502, "json">) | (Response & _$hono.TypedResponse<{
     ok: boolean;
     error: {
       code: string;
@@ -1331,8 +1420,29 @@ declare class ServiceAppsRoutesController {
         [x: string]: _$hono_utils_types0.JSONValue;
       } | undefined;
     };
-  }, 500, "json">)>;
-  readonly deleteServiceApp: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
+  }, 500, "json">) | (Response & _$hono.TypedResponse<{
+    ok: boolean;
+    data: {
+      contractFingerprint: string;
+      locale: _$_nextclaw_kernel0.PortableRuntimeAcceptanceLocale;
+      definitions: {
+        id: string;
+        titleKey: string;
+        descriptionKey: string;
+        checkerKey: string;
+        category: "execution" | "capability" | "lifecycle" | "entry" | "quality" | "release";
+        required: boolean;
+        scenarioVersion: string;
+        evidenceSource: _$_nextclaw_kernel0.PortableRuntimeAcceptanceEvidenceSource;
+        platforms: readonly _$_nextclaw_kernel0.PortableRuntimeAcceptancePlatform[];
+        presentation: {
+          title: string;
+          description: string;
+        };
+      }[];
+    };
+  }, _$hono_utils_http_status0.ContentfulStatusCode, "json">)>;
+  readonly getPortableRuntimeAcceptanceStatus: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
     ok: boolean;
     error: {
       code: string;
@@ -1341,7 +1451,7 @@ declare class ServiceAppsRoutesController {
         [x: string]: _$hono_utils_types0.JSONValue;
       } | undefined;
     };
-  }, 400 | 401 | 403 | 404 | 502, "json">) | (Response & _$hono.TypedResponse<{
+  }, 400 | 401 | 403 | 404 | 422 | 502, "json">) | (Response & _$hono.TypedResponse<{
     ok: boolean;
     error: {
       code: string;
@@ -1353,19 +1463,913 @@ declare class ServiceAppsRoutesController {
   }, 500, "json">) | (Response & _$hono.TypedResponse<{
     ok: boolean;
     data: {
-      deleted: true;
-      id: string;
-      dataRemoved: boolean;
-    };
-  }, _$hono_utils_http_status0.ContentfulStatusCode, "json">)>;
-  private requireBridgeSession;
-  private readOptionalBridgeSession;
-  private readCallerQuery;
-  private handleServiceAppError;
-}
-//#endregion
-//#region src/features/service-apps/types/service-app-api.types.d.ts
-type ServiceAppListView = ServiceAppList;
+      schemaVersion: 1;
+      contract: {
+        contractFingerprint: string;
+        locale: _$_nextclaw_kernel0.PortableRuntimeAcceptanceLocale;
+        definitions: {
+          id: string;
+          titleKey: string;
+          descriptionKey: string;
+          checkerKey: string;
+          category: "execution" | "capability" | "lifecycle" | "entry" | "quality" | "release";
+          required: boolean;
+          scenarioVersion: string;
+          evidenceSource: _$_nextclaw_kernel0.PortableRuntimeAcceptanceEvidenceSource;
+          platforms: readonly _$_nextclaw_kernel0.PortableRuntimeAcceptancePlatform[];
+          presentation: {
+            title: string;
+            description: string;
+          };
+        }[];
+      };
+      appId: string;
+      identity: {
+        available: true;
+        context: {
+          appId: string;
+          environment: _$_nextclaw_kernel0.PortableRuntimeAcceptancePlatform;
+          productVersion: string;
+          runtimeVersion: string;
+          implementationFingerprint: string;
+          contractFingerprint: string;
+        };
+        runtimeVersionSource: "configured" | "product-version-fallback";
+        runnerFingerprint: string;
+      } | {
+        available: false;
+        reason: string;
+        environment: _$_nextclaw_kernel0.PortableRuntimeAcceptancePlatform | null;
+        productVersion: string | null;
+        runtimeVersion: string | null;
+        runtimeVersionSource: "configured" | "product-version-fallback" | null;
+      };
+      entries: {
+        id: string;
+        titleKey: string;
+        descriptionKey: string;
+        checkerKey: string;
+        category: "execution" | "capability" | "lifecycle" | "entry" | "quality" | "release";
+        required: boolean;
+        scenarioVersion: string;
+        evidenceSource: _$_nextclaw_kernel0.PortableRuntimeAcceptanceEvidenceSource;
+        platforms: readonly _$_nextclaw_kernel0.PortableRuntimeAcceptancePlatform[];
+        presentation: {
+          title: string;
+          description: string;
+        };
+        result: {
+          status: _$_nextclaw_kernel0.PortableRuntimeAcceptanceResultStatus;
+          required: boolean;
+          acceptanceId: string;
+          latestRecord?: {
+            evidenceSchemaVersion: 2;
+            evidenceSource: _$_nextclaw_kernel0.PortableRuntimeAcceptanceEvidenceSource;
+            verificationRunId: string;
+            acceptanceId: string;
+            scenarioVersion: string;
+            productVersion: string;
+            runtimeVersion: string;
+            implementationFingerprint: string;
+            status: _$_nextclaw_kernel0.VerificationRecordStatus;
+            startedAt: string;
+            finishedAt: string;
+            environment: string;
+            appId: string;
+            componentId: string;
+            role: _$_nextclaw_kernel0.VerificationRecordRole;
+            entrySurface: _$_nextclaw_kernel0.VerificationRecordEntrySurface;
+            instanceId?: string | undefined;
+            actionOrEvent: string;
+            callId: string;
+            traceId: string;
+            capabilityDecisions: string[];
+            inputDigest: string;
+            outputDigest?: string | undefined;
+            dataVersion: string;
+            observation?: {
+              durationMs?: number | undefined;
+              runnerPid?: number | null | undefined;
+              memory?: {
+                rssBytes: number | null;
+                pssBytes: number | null;
+              } | null | undefined;
+            } | undefined;
+            error?: {
+              code?: string | undefined;
+              message: string;
+            } | undefined;
+            recovery?: string | undefined;
+            evidenceRefs: string[];
+          } | {
+            status: _$_nextclaw_kernel0.VerificationRecordStatus;
+            appId: string;
+            error?: {
+              code?: string | undefined;
+              message: string;
+            } | undefined;
+            instanceId?: string | undefined;
+            componentId: string;
+            role: _$_nextclaw_kernel0.VerificationRecordRole;
+            callId: string;
+            traceId: string;
+            dataVersion: string;
+            verificationRunId: string;
+            acceptanceId: string;
+            scenarioVersion: string;
+            startedAt: string;
+            finishedAt: string;
+            environment: string;
+            entrySurface: _$_nextclaw_kernel0.VerificationRecordEntrySurface;
+            actionOrEvent: string;
+            capabilityDecisions: string[];
+            inputDigest: string;
+            outputDigest?: string | undefined;
+            observation?: {
+              durationMs?: number | undefined;
+              runnerPid?: number | null | undefined;
+              memory?: {
+                rssBytes: number | null;
+                pssBytes: number | null;
+              } | null | undefined;
+            } | undefined;
+            recovery?: string | undefined;
+            evidenceRefs: string[];
+            evidenceSchemaVersion: 1;
+          } | undefined;
+          environment: _$_nextclaw_kernel0.PortableRuntimeAcceptancePlatform | null;
+        };
+      }[];
+      summary: {
+        failed: number;
+        missing: number;
+        "current-passed": number;
+        stale: number;
+        "not-applicable": number;
+      };
+    };
+  }, _$hono_utils_http_status0.ContentfulStatusCode, "json">)>;
+  readonly exportPortableRuntimeAcceptance: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
+    ok: boolean;
+    error: {
+      code: string;
+      message: string;
+      details: {
+        [x: string]: _$hono_utils_types0.JSONValue;
+      } | undefined;
+    };
+  }, 400 | 401 | 403 | 404 | 422 | 502, "json">) | (Response & _$hono.TypedResponse<{
+    ok: boolean;
+    error: {
+      code: string;
+      message: string;
+      details: {
+        [x: string]: _$hono_utils_types0.JSONValue;
+      } | undefined;
+    };
+  }, 500, "json">) | (Response & _$hono.TypedResponse<{
+    ok: boolean;
+    data: {
+      schemaVersion: 1;
+      contract: {
+        contractFingerprint: string;
+        locale: _$_nextclaw_kernel0.PortableRuntimeAcceptanceLocale;
+        definitions: {
+          id: string;
+          titleKey: string;
+          descriptionKey: string;
+          checkerKey: string;
+          category: "execution" | "capability" | "lifecycle" | "entry" | "quality" | "release";
+          required: boolean;
+          scenarioVersion: string;
+          evidenceSource: _$_nextclaw_kernel0.PortableRuntimeAcceptanceEvidenceSource;
+          platforms: readonly _$_nextclaw_kernel0.PortableRuntimeAcceptancePlatform[];
+          presentation: {
+            title: string;
+            description: string;
+          };
+        }[];
+      };
+      appId: string;
+      identity: {
+        available: true;
+        context: {
+          appId: string;
+          environment: _$_nextclaw_kernel0.PortableRuntimeAcceptancePlatform;
+          productVersion: string;
+          runtimeVersion: string;
+          implementationFingerprint: string;
+          contractFingerprint: string;
+        };
+        runtimeVersionSource: "configured" | "product-version-fallback";
+        runnerFingerprint: string;
+      } | {
+        available: false;
+        reason: string;
+        environment: _$_nextclaw_kernel0.PortableRuntimeAcceptancePlatform | null;
+        productVersion: string | null;
+        runtimeVersion: string | null;
+        runtimeVersionSource: "configured" | "product-version-fallback" | null;
+      };
+      entries: {
+        id: string;
+        titleKey: string;
+        descriptionKey: string;
+        checkerKey: string;
+        category: "execution" | "capability" | "lifecycle" | "entry" | "quality" | "release";
+        required: boolean;
+        scenarioVersion: string;
+        evidenceSource: _$_nextclaw_kernel0.PortableRuntimeAcceptanceEvidenceSource;
+        platforms: readonly _$_nextclaw_kernel0.PortableRuntimeAcceptancePlatform[];
+        presentation: {
+          title: string;
+          description: string;
+        };
+        result: {
+          status: _$_nextclaw_kernel0.PortableRuntimeAcceptanceResultStatus;
+          required: boolean;
+          acceptanceId: string;
+          latestRecord?: {
+            evidenceSchemaVersion: 2;
+            evidenceSource: _$_nextclaw_kernel0.PortableRuntimeAcceptanceEvidenceSource;
+            verificationRunId: string;
+            acceptanceId: string;
+            scenarioVersion: string;
+            productVersion: string;
+            runtimeVersion: string;
+            implementationFingerprint: string;
+            status: _$_nextclaw_kernel0.VerificationRecordStatus;
+            startedAt: string;
+            finishedAt: string;
+            environment: string;
+            appId: string;
+            componentId: string;
+            role: _$_nextclaw_kernel0.VerificationRecordRole;
+            entrySurface: _$_nextclaw_kernel0.VerificationRecordEntrySurface;
+            instanceId?: string | undefined;
+            actionOrEvent: string;
+            callId: string;
+            traceId: string;
+            capabilityDecisions: string[];
+            inputDigest: string;
+            outputDigest?: string | undefined;
+            dataVersion: string;
+            observation?: {
+              durationMs?: number | undefined;
+              runnerPid?: number | null | undefined;
+              memory?: {
+                rssBytes: number | null;
+                pssBytes: number | null;
+              } | null | undefined;
+            } | undefined;
+            error?: {
+              code?: string | undefined;
+              message: string;
+            } | undefined;
+            recovery?: string | undefined;
+            evidenceRefs: string[];
+          } | {
+            status: _$_nextclaw_kernel0.VerificationRecordStatus;
+            appId: string;
+            error?: {
+              code?: string | undefined;
+              message: string;
+            } | undefined;
+            instanceId?: string | undefined;
+            componentId: string;
+            role: _$_nextclaw_kernel0.VerificationRecordRole;
+            callId: string;
+            traceId: string;
+            dataVersion: string;
+            verificationRunId: string;
+            acceptanceId: string;
+            scenarioVersion: string;
+            startedAt: string;
+            finishedAt: string;
+            environment: string;
+            entrySurface: _$_nextclaw_kernel0.VerificationRecordEntrySurface;
+            actionOrEvent: string;
+            capabilityDecisions: string[];
+            inputDigest: string;
+            outputDigest?: string | undefined;
+            observation?: {
+              durationMs?: number | undefined;
+              runnerPid?: number | null | undefined;
+              memory?: {
+                rssBytes: number | null;
+                pssBytes: number | null;
+              } | null | undefined;
+            } | undefined;
+            recovery?: string | undefined;
+            evidenceRefs: string[];
+            evidenceSchemaVersion: 1;
+          } | undefined;
+          environment: _$_nextclaw_kernel0.PortableRuntimeAcceptancePlatform | null;
+        };
+      }[];
+      summary: {
+        failed: number;
+        missing: number;
+        "current-passed": number;
+        stale: number;
+        "not-applicable": number;
+      };
+    };
+  }, _$hono_utils_http_status0.ContentfulStatusCode, "json">)>;
+  readonly listServiceAppJobs: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
+    ok: boolean;
+    error: {
+      code: string;
+      message: string;
+      details: {
+        [x: string]: _$hono_utils_types0.JSONValue;
+      } | undefined;
+    };
+  }, 400 | 401 | 403 | 404 | 422 | 502, "json">) | (Response & _$hono.TypedResponse<{
+    ok: boolean;
+    error: {
+      code: string;
+      message: string;
+      details: {
+        [x: string]: _$hono_utils_types0.JSONValue;
+      } | undefined;
+    };
+  }, 500, "json">) | (Response & _$hono.TypedResponse<{
+    ok: boolean;
+    data: {
+      entries: {
+        id: string;
+        appId: string;
+        instanceId: string;
+        componentId: string;
+        actionName: string;
+        status: _$_nextclaw_kernel0.ServiceAppJobStatus;
+        createdAt: string;
+        updatedAt: string;
+        startedAt?: string | undefined;
+        completedAt?: string | undefined;
+        cancelRequestedAt?: string | undefined;
+        retryOf?: string | undefined;
+        callId: string;
+        traceId: string;
+        caller?: {
+          surface: "panel" | "agent" | "installed-app-cli";
+          id?: string | undefined;
+        } | undefined;
+        error?: {
+          code?: string | undefined;
+          message: string;
+        } | undefined;
+      }[];
+    };
+  }, _$hono_utils_http_status0.ContentfulStatusCode, "json">)>;
+  readonly getServiceAppJob: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
+    ok: boolean;
+    error: {
+      code: string;
+      message: string;
+      details: {
+        [x: string]: _$hono_utils_types0.JSONValue;
+      } | undefined;
+    };
+  }, 400 | 401 | 403 | 404 | 422 | 502, "json">) | (Response & _$hono.TypedResponse<{
+    ok: boolean;
+    error: {
+      code: string;
+      message: string;
+      details: {
+        [x: string]: _$hono_utils_types0.JSONValue;
+      } | undefined;
+    };
+  }, 500, "json">) | (Response & _$hono.TypedResponse<{
+    ok: boolean;
+    data: {
+      id: string;
+      appId: string;
+      instanceId: string;
+      componentId: string;
+      actionName: string;
+      status: _$_nextclaw_kernel0.ServiceAppJobStatus;
+      createdAt: string;
+      updatedAt: string;
+      startedAt?: string | undefined;
+      completedAt?: string | undefined;
+      cancelRequestedAt?: string | undefined;
+      retryOf?: string | undefined;
+      callId: string;
+      traceId: string;
+      caller?: {
+        surface: "panel" | "agent" | "installed-app-cli";
+        id?: string | undefined;
+      } | undefined;
+      error?: {
+        code?: string | undefined;
+        message: string;
+      } | undefined;
+    };
+  }, _$hono_utils_http_status0.ContentfulStatusCode, "json">)>;
+  /** Cursor replay only; a disconnected client never changes Job execution. */
+  readonly watchServiceAppJob: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
+    ok: boolean;
+    error: {
+      code: string;
+      message: string;
+      details: {
+        [x: string]: _$hono_utils_types0.JSONValue;
+      } | undefined;
+    };
+  }, 400 | 401 | 403 | 404 | 422 | 502, "json">) | (Response & _$hono.TypedResponse<{
+    ok: boolean;
+    error: {
+      code: string;
+      message: string;
+      details: {
+        [x: string]: _$hono_utils_types0.JSONValue;
+      } | undefined;
+    };
+  }, 500, "json">) | (Response & _$hono.TypedResponse<{
+    ok: boolean;
+    data: {
+      job: {
+        id: string;
+        appId: string;
+        instanceId: string;
+        componentId: string;
+        actionName: string;
+        status: _$_nextclaw_kernel0.ServiceAppJobStatus;
+        createdAt: string;
+        updatedAt: string;
+        startedAt?: string | undefined;
+        completedAt?: string | undefined;
+        cancelRequestedAt?: string | undefined;
+        retryOf?: string | undefined;
+        callId: string;
+        traceId: string;
+        caller?: {
+          surface: "panel" | "agent" | "installed-app-cli";
+          id?: string | undefined;
+        } | undefined;
+        error?: {
+          code?: string | undefined;
+          message: string;
+        } | undefined;
+      };
+      events: ({
+        sequence: number;
+        timestamp: string;
+        type: "progress";
+        current?: number | undefined;
+        total?: number | undefined;
+        message?: string | undefined;
+      } | {
+        sequence: number;
+        timestamp: string;
+        type: "stream-chunk";
+        content: string;
+      } | {
+        sequence: number;
+        timestamp: string;
+        type: "terminal";
+        status: _$_nextclaw_kernel0.ServiceAppTerminalJobStatus;
+        error?: {
+          code?: string | undefined;
+          message: string;
+        } | undefined;
+      })[];
+      cursor: number;
+    };
+  }, _$hono_utils_http_status0.ContentfulStatusCode, "json">)>;
+  readonly cancelServiceAppJob: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
+    ok: boolean;
+    error: {
+      code: string;
+      message: string;
+      details: {
+        [x: string]: _$hono_utils_types0.JSONValue;
+      } | undefined;
+    };
+  }, 400 | 401 | 403 | 404 | 422 | 502, "json">) | (Response & _$hono.TypedResponse<{
+    ok: boolean;
+    error: {
+      code: string;
+      message: string;
+      details: {
+        [x: string]: _$hono_utils_types0.JSONValue;
+      } | undefined;
+    };
+  }, 500, "json">) | (Response & _$hono.TypedResponse<{
+    ok: boolean;
+    data: {
+      id: string;
+      appId: string;
+      instanceId: string;
+      componentId: string;
+      actionName: string;
+      status: _$_nextclaw_kernel0.ServiceAppJobStatus;
+      createdAt: string;
+      updatedAt: string;
+      startedAt?: string | undefined;
+      completedAt?: string | undefined;
+      cancelRequestedAt?: string | undefined;
+      retryOf?: string | undefined;
+      callId: string;
+      traceId: string;
+      caller?: {
+        surface: "panel" | "agent" | "installed-app-cli";
+        id?: string | undefined;
+      } | undefined;
+      error?: {
+        code?: string | undefined;
+        message: string;
+      } | undefined;
+    };
+  }, _$hono_utils_http_status0.ContentfulStatusCode, "json">)>;
+  /** Inspect durable Resident delivery facts; payload stays private to the instance journal. */
+  readonly listResidentInbox: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
+    ok: boolean;
+    error: {
+      code: string;
+      message: string;
+      details: {
+        [x: string]: _$hono_utils_types0.JSONValue;
+      } | undefined;
+    };
+  }, 400 | 401 | 403 | 404 | 422 | 502, "json">) | (Response & _$hono.TypedResponse<{
+    ok: boolean;
+    error: {
+      code: string;
+      message: string;
+      details: {
+        [x: string]: _$hono_utils_types0.JSONValue;
+      } | undefined;
+    };
+  }, 500, "json">) | (Response & _$hono.TypedResponse<{
+    ok: boolean;
+    data: {
+      entries: {
+        id: string;
+        appId: string;
+        instanceId: string;
+        componentId: string;
+        eventId: string;
+        streamKey: string;
+        sequence: number;
+        status: _$_nextclaw_kernel0.ServiceAppResidentEventStatus;
+        receivedAt: string;
+        updatedAt: string;
+        attempt: number;
+        leaseExpiresAt?: string | undefined;
+        nextAttemptAt?: string | undefined;
+        ackedAt?: string | undefined;
+        deadLetteredAt?: string | undefined;
+        lastError?: {
+          code?: string | undefined;
+          message: string;
+        } | undefined;
+      }[];
+      cursors: {
+        [x: string]: number;
+      };
+      frozen: boolean;
+    };
+  }, _$hono_utils_http_status0.ContentfulStatusCode, "json">)>;
+  readonly replayResidentDeadLetter: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
+    ok: boolean;
+    error: {
+      code: string;
+      message: string;
+      details: {
+        [x: string]: _$hono_utils_types0.JSONValue;
+      } | undefined;
+    };
+  }, 400 | 401 | 403 | 404 | 422 | 502, "json">) | (Response & _$hono.TypedResponse<{
+    ok: boolean;
+    error: {
+      code: string;
+      message: string;
+      details: {
+        [x: string]: _$hono_utils_types0.JSONValue;
+      } | undefined;
+    };
+  }, 500, "json">) | (Response & _$hono.TypedResponse<{
+    ok: boolean;
+    data: {
+      id: string;
+      appId: string;
+      instanceId: string;
+      componentId: string;
+      eventId: string;
+      streamKey: string;
+      sequence: number;
+      status: _$_nextclaw_kernel0.ServiceAppResidentEventStatus;
+      receivedAt: string;
+      updatedAt: string;
+      attempt: number;
+      leaseExpiresAt?: string | undefined;
+      nextAttemptAt?: string | undefined;
+      ackedAt?: string | undefined;
+      deadLetteredAt?: string | undefined;
+      lastError?: {
+        code?: string | undefined;
+        message: string;
+      } | undefined;
+    };
+  }, _$hono_utils_http_status0.ContentfulStatusCode, "json">)>;
+  readonly grantServiceAction: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
+    ok: boolean;
+    error: {
+      code: string;
+      message: string;
+      details: {
+        [x: string]: _$hono_utils_types0.JSONValue;
+      } | undefined;
+    };
+  }, 400 | 401 | 403 | 404 | 422 | 502, "json">) | (Response & _$hono.TypedResponse<{
+    ok: boolean;
+    error: {
+      code: string;
+      message: string;
+      details: {
+        [x: string]: _$hono_utils_types0.JSONValue;
+      } | undefined;
+    };
+  }, 500, "json">) | (Response & _$hono.TypedResponse<{
+    ok: boolean;
+    data: {
+      caller: {
+        surface: "panel-app";
+        appId: string;
+      } | {
+        surface: "agent";
+        agentId: string;
+      };
+      actionId: string;
+      risk: _$_nextclaw_kernel0.ServiceActionRisk;
+      grantedAt: string;
+    };
+  }, _$hono_utils_http_status0.ContentfulStatusCode, "json">)>;
+  readonly grantServiceActions: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
+    ok: boolean;
+    error: {
+      code: string;
+      message: string;
+      details: {
+        [x: string]: _$hono_utils_types0.JSONValue;
+      } | undefined;
+    };
+  }, 400 | 401 | 403 | 404 | 422 | 502, "json">) | (Response & _$hono.TypedResponse<{
+    ok: boolean;
+    error: {
+      code: string;
+      message: string;
+      details: {
+        [x: string]: _$hono_utils_types0.JSONValue;
+      } | undefined;
+    };
+  }, 500, "json">) | (Response & _$hono.TypedResponse<{
+    ok: boolean;
+    data: {
+      grants: {
+        caller: {
+          surface: "panel-app";
+          appId: string;
+        } | {
+          surface: "agent";
+          agentId: string;
+        };
+        actionId: string;
+        risk: _$_nextclaw_kernel0.ServiceActionRisk;
+        grantedAt: string;
+      }[];
+    };
+  }, _$hono_utils_http_status0.ContentfulStatusCode, "json">)>;
+  readonly grantAgentServiceActions: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
+    ok: boolean;
+    error: {
+      code: string;
+      message: string;
+      details: {
+        [x: string]: _$hono_utils_types0.JSONValue;
+      } | undefined;
+    };
+  }, 400 | 401 | 403 | 404 | 422 | 502, "json">) | (Response & _$hono.TypedResponse<{
+    ok: boolean;
+    error: {
+      code: string;
+      message: string;
+      details: {
+        [x: string]: _$hono_utils_types0.JSONValue;
+      } | undefined;
+    };
+  }, 500, "json">) | (Response & _$hono.TypedResponse<{
+    ok: boolean;
+    data: {
+      grants: {
+        caller: {
+          surface: "panel-app";
+          appId: string;
+        } | {
+          surface: "agent";
+          agentId: string;
+        };
+        actionId: string;
+        risk: _$_nextclaw_kernel0.ServiceActionRisk;
+        grantedAt: string;
+      }[];
+    };
+  }, _$hono_utils_http_status0.ContentfulStatusCode, "json">)>;
+  readonly listServiceActionGrants: (c: Context) => Promise<Response & _$hono.TypedResponse<{
+    ok: boolean;
+    data: {
+      grants: {
+        caller: {
+          surface: "panel-app";
+          appId: string;
+        } | {
+          surface: "agent";
+          agentId: string;
+        };
+        actionId: string;
+        risk: _$_nextclaw_kernel0.ServiceActionRisk;
+        grantedAt: string;
+      }[];
+    };
+  }, _$hono_utils_http_status0.ContentfulStatusCode, "json">>;
+  readonly revokeServiceAction: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
+    ok: boolean;
+    error: {
+      code: string;
+      message: string;
+      details: {
+        [x: string]: _$hono_utils_types0.JSONValue;
+      } | undefined;
+    };
+  }, 400 | 401 | 403 | 404 | 422 | 502, "json">) | (Response & _$hono.TypedResponse<{
+    ok: boolean;
+    error: {
+      code: string;
+      message: string;
+      details: {
+        [x: string]: _$hono_utils_types0.JSONValue;
+      } | undefined;
+    };
+  }, 500, "json">) | (Response & _$hono.TypedResponse<{
+    ok: boolean;
+    data: {
+      revoked: boolean;
+    };
+  }, _$hono_utils_http_status0.ContentfulStatusCode, "json">)>;
+  readonly revokeServiceActionGrant: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
+    ok: boolean;
+    error: {
+      code: string;
+      message: string;
+      details: {
+        [x: string]: _$hono_utils_types0.JSONValue;
+      } | undefined;
+    };
+  }, 400 | 401 | 403 | 404 | 422 | 502, "json">) | (Response & _$hono.TypedResponse<{
+    ok: boolean;
+    error: {
+      code: string;
+      message: string;
+      details: {
+        [x: string]: _$hono_utils_types0.JSONValue;
+      } | undefined;
+    };
+  }, 500, "json">) | (Response & _$hono.TypedResponse<{
+    ok: boolean;
+    data: {
+      revoked: boolean;
+    };
+  }, _$hono_utils_http_status0.ContentfulStatusCode, "json">)>;
+  readonly restartServiceApp: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
+    ok: boolean;
+    data: {
+      id: string;
+      title: string;
+      description?: string | undefined;
+      dirPath: string;
+      manifestPath: string;
+      command?: string | undefined;
+      args?: string[] | undefined;
+      cwd: string;
+      enabled: boolean;
+      protocol: _$_nextclaw_kernel0.ServiceAppProtocol;
+      status: _$_nextclaw_kernel0.ServiceAppRuntimeStatus;
+      lastError?: string | undefined;
+      lastStartedAt?: string | undefined;
+      lastReadyAt?: string | undefined;
+      lastFailedAt?: string | undefined;
+      sourceKind?: "workspace" | "package" | undefined;
+      packageId?: string | undefined;
+      packageVersion?: string | undefined;
+      packageDirectory?: string | undefined;
+      dataDirectory?: string | undefined;
+      instanceId?: string | undefined;
+      storage?: {
+        layout: AppStorageLayout;
+        layoutVersion: 1;
+        instanceId: string;
+        instanceDirectory: string;
+        dataDirectory: string;
+        configDirectory: string;
+        stateDirectory: string;
+        cacheDirectory: string;
+        temporaryDirectory: string;
+        logsDirectory: string;
+      } | undefined;
+      isolation?: AppRuntimeIsolation | undefined;
+      runtimeProfile?: AppRuntimeProfile | undefined;
+      permissions?: {
+        documentAccess?: {
+          id: string;
+          mode: AppDocumentAccessMode;
+          description?: string | undefined;
+        }[] | undefined;
+        secrets?: {
+          id: string;
+          title: string;
+          description: string;
+          required: boolean;
+        }[] | undefined;
+        allowedDomains?: string[] | undefined;
+        storage?: boolean | {
+          namespace?: string | undefined;
+        } | undefined;
+        capabilities?: {
+          hostBridge?: boolean | undefined;
+          nativeProcess?: boolean | undefined;
+        } | undefined;
+      } | undefined;
+      componentPath?: string | undefined;
+      providerIds?: string[] | undefined;
+      lifecycle?: {
+        mode: "action";
+      } | {
+        mode: "resident";
+        eventIntervalMs: number;
+      } | {
+        mode: "provider";
+      } | undefined;
+    };
+  }, _$hono_utils_http_status0.ContentfulStatusCode, "json">) | (Response & _$hono.TypedResponse<{
+    ok: boolean;
+    error: {
+      code: string;
+      message: string;
+      details: {
+        [x: string]: _$hono_utils_types0.JSONValue;
+      } | undefined;
+    };
+  }, 400 | 401 | 403 | 404 | 422 | 502, "json">) | (Response & _$hono.TypedResponse<{
+    ok: boolean;
+    error: {
+      code: string;
+      message: string;
+      details: {
+        [x: string]: _$hono_utils_types0.JSONValue;
+      } | undefined;
+    };
+  }, 500, "json">)>;
+  readonly deleteServiceApp: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
+    ok: boolean;
+    error: {
+      code: string;
+      message: string;
+      details: {
+        [x: string]: _$hono_utils_types0.JSONValue;
+      } | undefined;
+    };
+  }, 400 | 401 | 403 | 404 | 422 | 502, "json">) | (Response & _$hono.TypedResponse<{
+    ok: boolean;
+    error: {
+      code: string;
+      message: string;
+      details: {
+        [x: string]: _$hono_utils_types0.JSONValue;
+      } | undefined;
+    };
+  }, 500, "json">) | (Response & _$hono.TypedResponse<{
+    ok: boolean;
+    data: {
+      deleted: true;
+      id: string;
+      dataRemoved: boolean;
+    };
+  }, _$hono_utils_http_status0.ContentfulStatusCode, "json">)>;
+  private requireBridgeSession;
+  private readOptionalBridgeSession;
+  private readCallerQuery;
+  private readOptionalQuery;
+  private readLocale;
+  private readLimit;
+  private readAfterSequence;
+  private handleServiceAppError;
+}
+//#endregion
+//#region src/features/service-apps/types/service-app-api.types.d.ts
+type ServiceAppListView = ServiceAppList;
 type ServiceAppRecordView = ServiceAppRecord;
 type ServiceAppDeleteResultView = ServiceAppDeleteResult;
 type ServiceActionView = ServiceAction;
@@ -1383,6 +2387,13 @@ type ServiceActionGrantBatchRequestView = {
 type ServiceActionGrantListView = {
   grants: ServiceActionGrantView[];
 };
+type ServiceAppJobListView = ServiceAppJobList;
+type ServiceAppJobViewResponse = ServiceAppJobView;
+type ServiceAppJobWatchView = ServiceAppJobWatch;
+type RuntimeVerificationRecordListView = VerificationRecordList;
+type PortableRuntimeAcceptanceContractApiView = PortableRuntimeAcceptanceContractView;
+type PortableRuntimeAcceptanceStatusApiView = PortableRuntimeAcceptanceStatusView;
+type PortableRuntimeAcceptanceExportApiView = PortableRuntimeAcceptanceStatusView;
 //#endregion
 //#region src/features/sessions/types/session-observation-api.types.d.ts
 type UiNcpSessionObservationKind = "context" | "events";
@@ -2659,7 +3670,7 @@ type UiExtensionHost = {
   getChannelBindings: () => ExtensionChannelBinding[];
   getUiMetadata: () => ExtensionUiMetadata[];
 };
-type UiKernelHost = Pick<NextclawKernel, "assetStore" | "eventBus" | "ingress" | "inboxDeliveryManager" | "systemObjectReferenceManager" | "isSessionRunning" | "listSessionTypes" | "agentRunRequestManager" | "agentContextWindowManager" | "appPackageManager" | "appDataManager" | "llmProviders" | "providerModelCatalog" | "sessionManager" | "sessionRunManager" | "observations" | "extensions" | "capabilityGrants" | "featureControls" | "panelAppManager" | "preferenceManager" | "projectManager" | "serviceAppManager" | "sessionContextCompactionManager"> & {
+type UiKernelHost = Pick<NextclawKernel, "assetStore" | "eventBus" | "ingress" | "inboxDeliveryManager" | "systemObjectReferenceManager" | "isSessionRunning" | "listSessionTypes" | "agentRunRequestManager" | "agentContextWindowManager" | "appPackageManager" | "appDataManager" | "llmProviders" | "providerModelCatalog" | "sessionManager" | "sessionRunManager" | "observations" | "extensions" | "capabilityGrants" | "featureControls" | "portableRuntimeAcceptance" | "panelAppManager" | "preferenceManager" | "projectManager" | "serviceAppManager" | "sessionContextCompactionManager"> & {
   accessManager?: NextclawKernel["accessManager"];
 };
 type UiCronHost = {
@@ -3415,8 +4426,97 @@ declare class ConfigRoutesController {
         } | undefined;
       };
     };
-  }, _$hono_utils_http_status0.ContentfulStatusCode, "json">)>;
-  readonly deleteProvider: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
+  }, _$hono_utils_http_status0.ContentfulStatusCode, "json">)>;
+  readonly deleteProvider: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
+    ok: boolean;
+    error: {
+      code: string;
+      message: string;
+      details: {
+        [x: string]: _$hono_utils_types0.JSONValue;
+      } | undefined;
+    };
+  }, 404, "json">) | (Response & _$hono.TypedResponse<{
+    ok: boolean;
+    data: {
+      deleted: true;
+      providerId: string;
+    };
+  }, _$hono_utils_http_status0.ContentfulStatusCode, "json">)>;
+  readonly testProviderConnection: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
+    ok: boolean;
+    error: {
+      code: string;
+      message: string;
+      details: {
+        [x: string]: _$hono_utils_types0.JSONValue;
+      } | undefined;
+    };
+  }, 400, "json">) | (Response & _$hono.TypedResponse<{
+    ok: boolean;
+    error: {
+      code: string;
+      message: string;
+      details: {
+        [x: string]: _$hono_utils_types0.JSONValue;
+      } | undefined;
+    };
+  }, 404, "json">) | (Response & _$hono.TypedResponse<{
+    ok: boolean;
+    data: {
+      success: boolean;
+      provider: string;
+      model?: string | undefined;
+      latencyMs: number;
+      message: string;
+    };
+  }, _$hono_utils_http_status0.ContentfulStatusCode, "json">)>;
+  discoverProviderModels: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
+    ok: boolean;
+    error: {
+      code: string;
+      message: string;
+      details: {
+        [x: string]: _$hono_utils_types0.JSONValue;
+      } | undefined;
+    };
+  }, 400, "json">) | (Response & _$hono.TypedResponse<{
+    ok: boolean;
+    error: {
+      code: string;
+      message: string;
+      details: {
+        [x: string]: _$hono_utils_types0.JSONValue;
+      } | undefined;
+    };
+  }, 404, "json">) | (Response & _$hono.TypedResponse<{
+    ok: boolean;
+    data: {
+      provider: string;
+      models: string[];
+      source: "provider" | "catalog";
+      fetchedAt: string;
+    };
+  }, _$hono_utils_http_status0.ContentfulStatusCode, "json">) | (Response & _$hono.TypedResponse<{
+    ok: boolean;
+    error: {
+      code: string;
+      message: string;
+      details: {
+        [x: string]: _$hono_utils_types0.JSONValue;
+      } | undefined;
+    };
+  }, 502, "json">)>;
+  readonly startProviderAuth: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
+    ok: boolean;
+    error: {
+      code: string;
+      message: string;
+      details: {
+        [x: string]: _$hono_utils_types0.JSONValue;
+      } | undefined;
+    };
+  }, 400, "json">) | (Response & _$hono.TypedResponse<{
     ok: boolean;
     error: {
       code: string;
@@ -3428,11 +4528,18 @@ declare class ConfigRoutesController {
   }, 404, "json">) | (Response & _$hono.TypedResponse<{
     ok: boolean;
     data: {
-      deleted: true;
-      providerId: string;
+      provider: string;
+      kind: "device_code";
+      methodId?: string | undefined;
+      sessionId: string;
+      verificationUri: string;
+      userCode: string;
+      expiresAt: string;
+      intervalMs: number;
+      note?: string | undefined;
     };
   }, _$hono_utils_http_status0.ContentfulStatusCode, "json">)>;
-  readonly testProviderConnection: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
+  readonly pollProviderAuth: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
     ok: boolean;
     error: {
       code: string;
@@ -3453,14 +4560,13 @@ declare class ConfigRoutesController {
   }, 404, "json">) | (Response & _$hono.TypedResponse<{
     ok: boolean;
     data: {
-      success: boolean;
       provider: string;
-      model?: string | undefined;
-      latencyMs: number;
-      message: string;
+      status: "pending" | "authorized" | "denied" | "expired" | "error";
+      message?: string | undefined;
+      nextPollMs?: number | undefined;
     };
   }, _$hono_utils_http_status0.ContentfulStatusCode, "json">)>;
-  discoverProviderModels: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
+  readonly importProviderAuthFromCli: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
     ok: boolean;
     error: {
       code: string;
@@ -3482,11 +4588,12 @@ declare class ConfigRoutesController {
     ok: boolean;
     data: {
       provider: string;
-      models: string[];
-      source: "provider" | "catalog";
-      fetchedAt: string;
+      status: "imported";
+      source: "cli";
+      expiresAt?: string | undefined;
     };
-  }, _$hono_utils_http_status0.ContentfulStatusCode, "json">) | (Response & _$hono.TypedResponse<{
+  }, _$hono_utils_http_status0.ContentfulStatusCode, "json">)>;
+  readonly updateChannel: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
     ok: boolean;
     error: {
       code: string;
@@ -3495,8 +4602,22 @@ declare class ConfigRoutesController {
         [x: string]: _$hono_utils_types0.JSONValue;
       } | undefined;
     };
-  }, 502, "json">)>;
-  readonly startProviderAuth: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
+  }, 400, "json">) | (Response & _$hono.TypedResponse<{
+    ok: boolean;
+    error: {
+      code: string;
+      message: string;
+      details: {
+        [x: string]: _$hono_utils_types0.JSONValue;
+      } | undefined;
+    };
+  }, 404, "json">) | (Response & _$hono.TypedResponse<{
+    ok: boolean;
+    data: {
+      [x: string]: _$hono_utils_types0.JSONValue;
+    };
+  }, _$hono_utils_http_status0.ContentfulStatusCode, "json">)>;
+  readonly startChannelAuth: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
     ok: boolean;
     error: {
       code: string;
@@ -3517,18 +4638,17 @@ declare class ConfigRoutesController {
   }, 404, "json">) | (Response & _$hono.TypedResponse<{
     ok: boolean;
     data: {
-      provider: string;
-      kind: "device_code";
-      methodId?: string | undefined;
+      channel: string;
+      kind: "qr_code";
       sessionId: string;
-      verificationUri: string;
-      userCode: string;
+      qrCode: string;
+      qrCodeUrl: string;
       expiresAt: string;
       intervalMs: number;
       note?: string | undefined;
     };
   }, _$hono_utils_http_status0.ContentfulStatusCode, "json">)>;
-  readonly pollProviderAuth: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
+  readonly pollChannelAuth: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
     ok: boolean;
     error: {
       code: string;
@@ -3549,13 +4669,15 @@ declare class ConfigRoutesController {
   }, 404, "json">) | (Response & _$hono.TypedResponse<{
     ok: boolean;
     data: {
-      provider: string;
-      status: "pending" | "authorized" | "denied" | "expired" | "error";
+      channel: string;
+      status: "pending" | "scanned" | "authorized" | "expired" | "error";
       message?: string | undefined;
       nextPollMs?: number | undefined;
+      accountId?: string | null | undefined;
+      notes?: string[] | undefined;
     };
   }, _$hono_utils_http_status0.ContentfulStatusCode, "json">)>;
-  readonly importProviderAuthFromCli: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
+  readonly connectChannelAuth: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
     ok: boolean;
     error: {
       code: string;
@@ -3576,13 +4698,186 @@ declare class ConfigRoutesController {
   }, 404, "json">) | (Response & _$hono.TypedResponse<{
     ok: boolean;
     data: {
-      provider: string;
-      status: "imported";
-      source: "cli";
-      expiresAt?: string | undefined;
+      channel: string;
+      status: "pending" | "scanned" | "authorized" | "expired" | "error";
+      message?: string | undefined;
+      nextPollMs?: number | undefined;
+      accountId?: string | null | undefined;
+      notes?: string[] | undefined;
+    };
+  }, _$hono_utils_http_status0.ContentfulStatusCode, "json">)>;
+  readonly updateSecrets: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
+    ok: boolean;
+    error: {
+      code: string;
+      message: string;
+      details: {
+        [x: string]: _$hono_utils_types0.JSONValue;
+      } | undefined;
+    };
+  }, 400, "json">) | (Response & _$hono.TypedResponse<{
+    ok: boolean;
+    data: {
+      enabled: boolean;
+      defaults: {
+        env?: string | undefined;
+        file?: string | undefined;
+        exec?: string | undefined;
+      };
+      providers: {
+        [x: string]: {
+          source: "env";
+          prefix?: string | undefined;
+        } | {
+          source: "file";
+          path: string;
+          format?: "json" | undefined;
+        } | {
+          source: "exec";
+          command: string;
+          args?: string[] | undefined;
+          cwd?: string | undefined;
+          timeoutMs?: number | undefined;
+        };
+      };
+      refs: {
+        [x: string]: {
+          source: SecretSourceView;
+          provider?: string | undefined;
+          id: string;
+        };
+      };
+    };
+  }, _$hono_utils_http_status0.ContentfulStatusCode, "json">)>;
+  readonly updateProductAnalytics: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
+    ok: boolean;
+    error: {
+      code: string;
+      message: string;
+      details: {
+        [x: string]: _$hono_utils_types0.JSONValue;
+      } | undefined;
+    };
+  }, 400, "json">) | (Response & _$hono.TypedResponse<{
+    ok: boolean;
+    data: {
+      enabled: boolean;
+      schemaVersion: 2;
+      audience: "external" | "internal" | "qa";
+    };
+  }, _$hono_utils_http_status0.ContentfulStatusCode, "json">)>;
+  readonly updateRuntime: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
+    ok: boolean;
+    error: {
+      code: string;
+      message: string;
+      details: {
+        [x: string]: _$hono_utils_types0.JSONValue;
+      } | undefined;
+    };
+  }, 400, "json">) | (Response & _$hono.TypedResponse<{
+    ok: boolean;
+    data: {
+      agents: {
+        defaults: {
+          model: string;
+          workspace?: string | undefined;
+          engine?: string | undefined;
+          engineConfig?: {
+            [x: string]: _$hono_utils_types0.JSONValue;
+          } | undefined;
+          thinkingDefault?: NextclawCore.ThinkingLevel | undefined;
+          models?: {
+            [x: string]: {
+              [x: string]: _$hono_utils_types0.JSONValue;
+              params: {
+                [x: string]: _$hono_utils_types0.JSONValue;
+              };
+            };
+          } | undefined;
+          contextTokens?: number | undefined;
+          reservedContextTokens?: number | undefined;
+        };
+        runtimes?: {
+          entries?: {
+            [x: string]: {
+              enabled?: boolean | undefined;
+              label?: string | undefined;
+              icon?: {
+                kind: "image";
+                src: string;
+                alt?: string | null | undefined;
+              } | null | undefined;
+              type: string;
+              config?: {
+                [x: string]: _$hono_utils_types0.JSONValue;
+              } | undefined;
+            };
+          } | undefined;
+        } | undefined;
+        list?: {
+          id: string;
+          default?: boolean | undefined;
+          displayName?: string | undefined;
+          description?: string | undefined;
+          avatar?: string | undefined;
+          avatarUrl?: string | undefined;
+          workspace?: string | undefined;
+          model?: string | undefined;
+          runtime?: string | undefined;
+          runtimeConfig?: {
+            [x: string]: _$hono_utils_types0.JSONValue;
+          } | null | undefined;
+          engine?: string | undefined;
+          engineConfig?: {
+            [x: string]: _$hono_utils_types0.JSONValue;
+          } | undefined;
+          thinkingDefault?: NextclawCore.ThinkingLevel | undefined;
+          models?: {
+            [x: string]: {
+              [x: string]: _$hono_utils_types0.JSONValue;
+              params: {
+                [x: string]: _$hono_utils_types0.JSONValue;
+              };
+            };
+          } | undefined;
+          contextTokens?: number | undefined;
+          reservedContextTokens?: number | undefined;
+          builtIn?: boolean | undefined;
+        }[] | undefined;
+        context?: {
+          bootstrap?: {
+            files?: string[] | undefined;
+            minimalFiles?: string[] | undefined;
+            perFileChars?: number | undefined;
+            totalChars?: number | undefined;
+          } | undefined;
+          memory?: {
+            enabled?: boolean | undefined;
+            maxChars?: number | undefined;
+          } | undefined;
+        } | undefined;
+      };
+      bindings?: {
+        agentId: string;
+        match: {
+          channel: string;
+          accountId?: string | undefined;
+          peer?: {
+            kind: "direct" | "group" | "channel";
+            id: string;
+          } | undefined;
+        };
+      }[] | undefined;
+      session?: {
+        dmScope?: "main" | "per-peer" | "per-channel-peer" | "per-account-channel-peer" | undefined;
+      } | undefined;
+      companion?: {
+        enabled?: boolean | undefined;
+      } | undefined;
     };
   }, _$hono_utils_http_status0.ContentfulStatusCode, "json">)>;
-  readonly updateChannel: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
+  readonly executeAction: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
     ok: boolean;
     error: {
       code: string;
@@ -3593,51 +4888,332 @@ declare class ConfigRoutesController {
     };
   }, 400, "json">) | (Response & _$hono.TypedResponse<{
     ok: boolean;
-    error: {
-      code: string;
+    data: {
+      ok: boolean;
+      status: "success" | "failed";
       message: string;
-      details: {
+      data?: {
         [x: string]: _$hono_utils_types0.JSONValue;
       } | undefined;
-    };
-  }, 404, "json">) | (Response & _$hono.TypedResponse<{
-    ok: boolean;
-    data: {
-      [x: string]: _$hono_utils_types0.JSONValue;
+      patch?: {
+        [x: string]: _$hono_utils_types0.JSONValue;
+      } | undefined;
+      nextActions?: string[] | undefined;
     };
   }, _$hono_utils_http_status0.ContentfulStatusCode, "json">)>;
-  readonly startChannelAuth: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
+}
+//#endregion
+//#region src/features/config/utils/extension-channel-config-projection.utils.d.ts
+type ExtensionConfigProjectionOptions = {
+  extensionChannelBindings?: ExtensionChannelBinding[];
+  extensionUiMetadata?: ExtensionUiMetadata[];
+};
+//#endregion
+//#region src/features/config/utils/search-config.utils.d.ts
+declare function updateSearch(configPath: string, patch: SearchConfigUpdate): ConfigView["search"];
+//#endregion
+//#region src/features/config/stores/server-config.store.d.ts
+type ExecuteActionResult = {
+  ok: true;
+  data: ConfigActionExecuteResult$1;
+} | {
+  ok: false;
+  code: string;
+  message: string;
+  details?: Record<string, unknown>;
+};
+declare function buildConfigView(config: Config, options?: ExtensionConfigProjectionOptions): ConfigView;
+declare function buildConfigMeta(config: Config, options?: ExtensionConfigProjectionOptions): ConfigMetaView;
+declare function buildProviderTemplatesView(): ProviderTemplatesView;
+declare function buildProvidersView(config: Config): ProvidersView;
+declare function buildConfigSchemaView(_config: Config, options?: ExtensionConfigProjectionOptions): ConfigSchemaResponse;
+declare function executeConfigAction(configPath: string, actionId: string, request: ConfigActionExecuteRequest$1): Promise<ExecuteActionResult>;
+declare function loadConfigOrDefault(configPath: string): Config;
+declare function updateModel(configPath: string, patch: {
+  model?: string;
+  workspace?: string;
+}): ConfigView;
+declare function updateProvider(configPath: string, providerId: string, patch: ProviderConfigUpdate): ProviderConfigView | null;
+declare function createProvider(configPath: string, patch?: ProviderCreateRequest): {
+  providerId: string;
+  provider: ProviderConfigView;
+} | null;
+declare function deleteProvider(configPath: string, providerId: string): boolean | null;
+declare function updateChannel(configPath: string, channelName: string, patch: Record<string, unknown>, options?: ExtensionConfigProjectionOptions): Record<string, unknown> | null;
+declare function updateRuntime(configPath: string, patch: RuntimeConfigUpdate): Pick<ConfigView, "companion" | "agents" | "bindings" | "session">;
+declare function updateSecrets(configPath: string, patch: SecretsConfigUpdate): SecretsView;
+declare function updateProductAnalytics(configPath: string, patch: ProductAnalyticsConfigUpdate): ProductAnalyticsView;
+//#endregion
+//#region src/features/app-packages/controllers/app-packages.controller.d.ts
+declare class AppPackagesRoutesController {
+  private readonly manager;
+  constructor(manager: AppPackageManager);
+  readonly list: (c: Context) => Promise<Response & _$hono.TypedResponse<{
     ok: boolean;
-    error: {
-      code: string;
-      message: string;
-      details: {
-        [x: string]: _$hono_utils_types0.JSONValue;
+    data: {
+      entries: {
+        id: string;
+        name: string;
+        description?: string | undefined;
+        icon?: string | undefined;
+        nameI18n?: {
+          [x: string]: string;
+        } | undefined;
+        descriptionI18n?: {
+          [x: string]: string;
+        } | undefined;
+        activeVersion: string;
+        installedVersions: string[];
+        enabled: boolean;
+        builtIn: boolean;
+        primaryPanelId?: string | undefined;
+        components: {
+          kind: _$_nextclaw_kernel0.AppPackageComponentKind;
+          id: string;
+          packageId: string;
+          packageVersion: string;
+          sourcePath: string;
+          manifestPath: string;
+          dataDirectory: string;
+          instanceId: string;
+          storage: {
+            layout: AppStorageLayout;
+            layoutVersion: 1;
+            instanceId: string;
+            instanceDirectory: string;
+            dataDirectory: string;
+            configDirectory: string;
+            stateDirectory: string;
+            cacheDirectory: string;
+            temporaryDirectory: string;
+            logsDirectory: string;
+          };
+          runtimeProfile: AppRuntimeProfile;
+          isolation: AppRuntimeIsolation;
+          permissions: {
+            documentAccess?: {
+              id: string;
+              mode: AppDocumentAccessMode;
+              description?: string | undefined;
+            }[] | undefined;
+            secrets?: {
+              id: string;
+              title: string;
+              description: string;
+              required: boolean;
+            }[] | undefined;
+            allowedDomains?: string[] | undefined;
+            storage?: boolean | {
+              namespace?: string | undefined;
+            } | undefined;
+            capabilities?: {
+              hostBridge?: boolean | undefined;
+              nativeProcess?: boolean | undefined;
+            } | undefined;
+          };
+          resolvedProviderIds?: string[] | undefined;
+          title?: string | undefined;
+          description?: string | undefined;
+          icon?: string | undefined;
+          titleI18n?: {
+            [x: string]: string;
+          } | undefined;
+          descriptionI18n?: {
+            [x: string]: string;
+          } | undefined;
+        }[];
+        dataDirectory: string;
+        instanceId: string;
+        storage: {
+          layout: AppStorageLayout;
+          layoutVersion: 1;
+          instanceId: string;
+          instanceDirectory: string;
+          dataDirectory: string;
+          configDirectory: string;
+          stateDirectory: string;
+          cacheDirectory: string;
+          temporaryDirectory: string;
+          logsDirectory: string;
+        };
+        storageUsage?: {
+          dataBytes: number;
+          configBytes: number;
+          stateBytes: number;
+          cacheBytes: number;
+          temporaryBytes: number;
+          logsBytes: number;
+          totalBytes: number;
+        } | undefined;
+        runtimeProfile: AppRuntimeProfile;
+        isolation: AppRuntimeIsolation;
+        readiness: {
+          status: _$_nextclaw_kernel0.AppPackageReadinessStatus;
+          requirements: {
+            componentId: string;
+            kind: "capability" | "configuration";
+            id: string;
+            title: string;
+            description?: string | undefined;
+            remediation?: {
+              kind: "agent-setup";
+              summary: string;
+              requiresUserAction?: boolean | undefined;
+            } | undefined;
+          }[];
+        };
+        secrets: {
+          readiness: {
+            status: _$_nextclaw_kernel0.AppPackageReadinessStatus;
+            requirements: {
+              componentId: string;
+              kind: "capability" | "configuration";
+              id: string;
+              title: string;
+              description?: string | undefined;
+              remediation?: {
+                kind: "agent-setup";
+                summary: string;
+                requiresUserAction?: boolean | undefined;
+              } | undefined;
+            }[];
+          };
+          slots: {
+            id: string;
+            description: string;
+            title: string;
+            required: boolean;
+            status: _$_nextclaw_kernel0.AppPackageSecretStatus;
+            binding?: {
+              source: "env" | "file" | "exec";
+              provider?: string | undefined;
+              id: string;
+            } | undefined;
+            errorCode?: "SECRET_BINDING_MISSING" | "SECRET_RESOLUTION_FAILED" | undefined;
+          }[];
+        };
+        dependencies: {
+          readiness: {
+            status: _$_nextclaw_kernel0.AppPackageReadinessStatus;
+            requirements: {
+              componentId: string;
+              kind: "capability" | "configuration";
+              id: string;
+              title: string;
+              description?: string | undefined;
+              remediation?: {
+                kind: "agent-setup";
+                summary: string;
+                requiresUserAction?: boolean | undefined;
+              } | undefined;
+            }[];
+          };
+          bindings: {
+            componentId: string;
+            requirementKind: "capability" | "resource";
+            requirementId: string;
+            providerId: string;
+          }[];
+          candidates: {
+            requirement: {
+              componentId: string;
+              kind: "capability" | "configuration";
+              id: string;
+              title: string;
+              description?: string | undefined;
+              remediation?: {
+                kind: "agent-setup";
+                summary: string;
+                requiresUserAction?: boolean | undefined;
+              } | undefined;
+            };
+            providers: {
+              providerId: string;
+              appId: string;
+              componentId: string;
+              capabilities: {
+                id: string;
+                version?: string | undefined;
+                resourceTypes?: string[] | undefined;
+                wit?: {
+                  package: string;
+                  interface: string;
+                  version: string;
+                } | undefined;
+              }[];
+            }[];
+          }[];
+          resolvedProviderIds: {
+            [x: string]: string[];
+          };
+          diagnostics: {
+            code: _$_nextclaw_kernel0.AppPackageDependencyDiagnosticCode;
+            componentId: string;
+            requirementKind: "capability" | "resource";
+            requirementId: string;
+            providerId?: string | undefined;
+            message: string;
+          }[];
+        };
+      }[];
+      hostTarget?: {
+        key: string;
+        operatingSystem: "darwin" | "linux" | "win32";
+        architecture: "x64" | "arm64";
+        abi?: "gnu" | "musl" | "msvc" | undefined;
       } | undefined;
     };
-  }, 400, "json">) | (Response & _$hono.TypedResponse<{
+  }, _$hono_utils_http_status0.ContentfulStatusCode, "json">>;
+  readonly listOperations: (c: Context) => Promise<Response & _$hono.TypedResponse<{
     ok: boolean;
-    error: {
-      code: string;
-      message: string;
-      details: {
-        [x: string]: _$hono_utils_types0.JSONValue;
-      } | undefined;
+    data: {
+      entries: {
+        id: string;
+        action: _$_nextclaw_kernel0.AppPackageOperationAction;
+        appId?: string | undefined;
+        source?: string | undefined;
+        targetVersion?: string | undefined;
+        status: _$_nextclaw_kernel0.AppPackageOperationStatus;
+        completedSteps: number;
+        totalSteps: number;
+        createdAt: string;
+        updatedAt: string;
+        completedAt?: string | undefined;
+        error?: string | undefined;
+        result?: {
+          appId: string;
+          activeVersion?: string | undefined;
+          changed?: boolean | undefined;
+          removedVersions?: string[] | undefined;
+          dataRemoved?: boolean | undefined;
+        } | undefined;
+      }[];
     };
-  }, 404, "json">) | (Response & _$hono.TypedResponse<{
+  }, _$hono_utils_http_status0.ContentfulStatusCode, "json">>;
+  readonly startInstallOperation: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
     ok: boolean;
     data: {
-      channel: string;
-      kind: "qr_code";
-      sessionId: string;
-      qrCode: string;
-      qrCodeUrl: string;
-      expiresAt: string;
-      intervalMs: number;
-      note?: string | undefined;
+      id: string;
+      action: _$_nextclaw_kernel0.AppPackageOperationAction;
+      appId?: string | undefined;
+      source?: string | undefined;
+      targetVersion?: string | undefined;
+      status: _$_nextclaw_kernel0.AppPackageOperationStatus;
+      completedSteps: number;
+      totalSteps: number;
+      createdAt: string;
+      updatedAt: string;
+      completedAt?: string | undefined;
+      error?: string | undefined;
+      result?: {
+        appId: string;
+        activeVersion?: string | undefined;
+        changed?: boolean | undefined;
+        removedVersions?: string[] | undefined;
+        dataRemoved?: boolean | undefined;
+      } | undefined;
     };
-  }, _$hono_utils_http_status0.ContentfulStatusCode, "json">)>;
-  readonly pollChannelAuth: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
+  }, 202, "json">) | (Response & _$hono.TypedResponse<{
     ok: boolean;
     error: {
       code: string;
@@ -3646,7 +5222,31 @@ declare class ConfigRoutesController {
         [x: string]: _$hono_utils_types0.JSONValue;
       } | undefined;
     };
-  }, 400, "json">) | (Response & _$hono.TypedResponse<{
+  }, 400 | 404 | 409, "json">)>;
+  readonly startUpdateOperation: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
+    ok: boolean;
+    data: {
+      id: string;
+      action: _$_nextclaw_kernel0.AppPackageOperationAction;
+      appId?: string | undefined;
+      source?: string | undefined;
+      targetVersion?: string | undefined;
+      status: _$_nextclaw_kernel0.AppPackageOperationStatus;
+      completedSteps: number;
+      totalSteps: number;
+      createdAt: string;
+      updatedAt: string;
+      completedAt?: string | undefined;
+      error?: string | undefined;
+      result?: {
+        appId: string;
+        activeVersion?: string | undefined;
+        changed?: boolean | undefined;
+        removedVersions?: string[] | undefined;
+        dataRemoved?: boolean | undefined;
+      } | undefined;
+    };
+  }, 202, "json">) | (Response & _$hono.TypedResponse<{
     ok: boolean;
     error: {
       code: string;
@@ -3655,18 +5255,31 @@ declare class ConfigRoutesController {
         [x: string]: _$hono_utils_types0.JSONValue;
       } | undefined;
     };
-  }, 404, "json">) | (Response & _$hono.TypedResponse<{
+  }, 400 | 404 | 409, "json">)>;
+  readonly startRollbackOperation: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
     ok: boolean;
     data: {
-      channel: string;
-      status: "pending" | "scanned" | "authorized" | "expired" | "error";
-      message?: string | undefined;
-      nextPollMs?: number | undefined;
-      accountId?: string | null | undefined;
-      notes?: string[] | undefined;
+      id: string;
+      action: _$_nextclaw_kernel0.AppPackageOperationAction;
+      appId?: string | undefined;
+      source?: string | undefined;
+      targetVersion?: string | undefined;
+      status: _$_nextclaw_kernel0.AppPackageOperationStatus;
+      completedSteps: number;
+      totalSteps: number;
+      createdAt: string;
+      updatedAt: string;
+      completedAt?: string | undefined;
+      error?: string | undefined;
+      result?: {
+        appId: string;
+        activeVersion?: string | undefined;
+        changed?: boolean | undefined;
+        removedVersions?: string[] | undefined;
+        dataRemoved?: boolean | undefined;
+      } | undefined;
     };
-  }, _$hono_utils_http_status0.ContentfulStatusCode, "json">)>;
-  readonly connectChannelAuth: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
+  }, 202, "json">) | (Response & _$hono.TypedResponse<{
     ok: boolean;
     error: {
       code: string;
@@ -3675,7 +5288,31 @@ declare class ConfigRoutesController {
         [x: string]: _$hono_utils_types0.JSONValue;
       } | undefined;
     };
-  }, 400, "json">) | (Response & _$hono.TypedResponse<{
+  }, 400 | 404 | 409, "json">)>;
+  readonly startUninstallOperation: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
+    ok: boolean;
+    data: {
+      id: string;
+      action: _$_nextclaw_kernel0.AppPackageOperationAction;
+      appId?: string | undefined;
+      source?: string | undefined;
+      targetVersion?: string | undefined;
+      status: _$_nextclaw_kernel0.AppPackageOperationStatus;
+      completedSteps: number;
+      totalSteps: number;
+      createdAt: string;
+      updatedAt: string;
+      completedAt?: string | undefined;
+      error?: string | undefined;
+      result?: {
+        appId: string;
+        activeVersion?: string | undefined;
+        changed?: boolean | undefined;
+        removedVersions?: string[] | undefined;
+        dataRemoved?: boolean | undefined;
+      } | undefined;
+    };
+  }, 202, "json">) | (Response & _$hono.TypedResponse<{
     ok: boolean;
     error: {
       code: string;
@@ -3684,18 +5321,8 @@ declare class ConfigRoutesController {
         [x: string]: _$hono_utils_types0.JSONValue;
       } | undefined;
     };
-  }, 404, "json">) | (Response & _$hono.TypedResponse<{
-    ok: boolean;
-    data: {
-      channel: string;
-      status: "pending" | "scanned" | "authorized" | "expired" | "error";
-      message?: string | undefined;
-      nextPollMs?: number | undefined;
-      accountId?: string | null | undefined;
-      notes?: string[] | undefined;
-    };
-  }, _$hono_utils_http_status0.ContentfulStatusCode, "json">)>;
-  readonly updateSecrets: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
+  }, 400 | 404 | 409, "json">)>;
+  readonly get: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
     ok: boolean;
     error: {
       code: string;
@@ -3704,58 +5331,215 @@ declare class ConfigRoutesController {
         [x: string]: _$hono_utils_types0.JSONValue;
       } | undefined;
     };
-  }, 400, "json">) | (Response & _$hono.TypedResponse<{
+  }, 400 | 404 | 409, "json">) | (Response & _$hono.TypedResponse<{
     ok: boolean;
     data: {
+      id: string;
+      name: string;
+      description?: string | undefined;
+      icon?: string | undefined;
+      nameI18n?: {
+        [x: string]: string;
+      } | undefined;
+      descriptionI18n?: {
+        [x: string]: string;
+      } | undefined;
+      activeVersion: string;
+      installedVersions: string[];
       enabled: boolean;
-      defaults: {
-        env?: string | undefined;
-        file?: string | undefined;
-        exec?: string | undefined;
-      };
-      providers: {
-        [x: string]: {
-          source: "env";
-          prefix?: string | undefined;
-        } | {
-          source: "file";
-          path: string;
-          format?: "json" | undefined;
-        } | {
-          source: "exec";
-          command: string;
-          args?: string[] | undefined;
-          cwd?: string | undefined;
-          timeoutMs?: number | undefined;
+      builtIn: boolean;
+      primaryPanelId?: string | undefined;
+      components: {
+        kind: _$_nextclaw_kernel0.AppPackageComponentKind;
+        id: string;
+        packageId: string;
+        packageVersion: string;
+        sourcePath: string;
+        manifestPath: string;
+        dataDirectory: string;
+        instanceId: string;
+        storage: {
+          layout: AppStorageLayout;
+          layoutVersion: 1;
+          instanceId: string;
+          instanceDirectory: string;
+          dataDirectory: string;
+          configDirectory: string;
+          stateDirectory: string;
+          cacheDirectory: string;
+          temporaryDirectory: string;
+          logsDirectory: string;
+        };
+        runtimeProfile: AppRuntimeProfile;
+        isolation: AppRuntimeIsolation;
+        permissions: {
+          documentAccess?: {
+            id: string;
+            mode: AppDocumentAccessMode;
+            description?: string | undefined;
+          }[] | undefined;
+          secrets?: {
+            id: string;
+            title: string;
+            description: string;
+            required: boolean;
+          }[] | undefined;
+          allowedDomains?: string[] | undefined;
+          storage?: boolean | {
+            namespace?: string | undefined;
+          } | undefined;
+          capabilities?: {
+            hostBridge?: boolean | undefined;
+            nativeProcess?: boolean | undefined;
+          } | undefined;
         };
+        resolvedProviderIds?: string[] | undefined;
+        title?: string | undefined;
+        description?: string | undefined;
+        icon?: string | undefined;
+        titleI18n?: {
+          [x: string]: string;
+        } | undefined;
+        descriptionI18n?: {
+          [x: string]: string;
+        } | undefined;
+      }[];
+      dataDirectory: string;
+      instanceId: string;
+      storage: {
+        layout: AppStorageLayout;
+        layoutVersion: 1;
+        instanceId: string;
+        instanceDirectory: string;
+        dataDirectory: string;
+        configDirectory: string;
+        stateDirectory: string;
+        cacheDirectory: string;
+        temporaryDirectory: string;
+        logsDirectory: string;
       };
-      refs: {
-        [x: string]: {
-          source: SecretSourceView;
-          provider?: string | undefined;
+      storageUsage?: {
+        dataBytes: number;
+        configBytes: number;
+        stateBytes: number;
+        cacheBytes: number;
+        temporaryBytes: number;
+        logsBytes: number;
+        totalBytes: number;
+      } | undefined;
+      runtimeProfile: AppRuntimeProfile;
+      isolation: AppRuntimeIsolation;
+      readiness: {
+        status: _$_nextclaw_kernel0.AppPackageReadinessStatus;
+        requirements: {
+          componentId: string;
+          kind: "capability" | "configuration";
           id: string;
+          title: string;
+          description?: string | undefined;
+          remediation?: {
+            kind: "agent-setup";
+            summary: string;
+            requiresUserAction?: boolean | undefined;
+          } | undefined;
+        }[];
+      };
+      secrets: {
+        readiness: {
+          status: _$_nextclaw_kernel0.AppPackageReadinessStatus;
+          requirements: {
+            componentId: string;
+            kind: "capability" | "configuration";
+            id: string;
+            title: string;
+            description?: string | undefined;
+            remediation?: {
+              kind: "agent-setup";
+              summary: string;
+              requiresUserAction?: boolean | undefined;
+            } | undefined;
+          }[];
         };
+        slots: {
+          id: string;
+          description: string;
+          title: string;
+          required: boolean;
+          status: _$_nextclaw_kernel0.AppPackageSecretStatus;
+          binding?: {
+            source: "env" | "file" | "exec";
+            provider?: string | undefined;
+            id: string;
+          } | undefined;
+          errorCode?: "SECRET_BINDING_MISSING" | "SECRET_RESOLUTION_FAILED" | undefined;
+        }[];
+      };
+      dependencies: {
+        readiness: {
+          status: _$_nextclaw_kernel0.AppPackageReadinessStatus;
+          requirements: {
+            componentId: string;
+            kind: "capability" | "configuration";
+            id: string;
+            title: string;
+            description?: string | undefined;
+            remediation?: {
+              kind: "agent-setup";
+              summary: string;
+              requiresUserAction?: boolean | undefined;
+            } | undefined;
+          }[];
+        };
+        bindings: {
+          componentId: string;
+          requirementKind: "capability" | "resource";
+          requirementId: string;
+          providerId: string;
+        }[];
+        candidates: {
+          requirement: {
+            componentId: string;
+            kind: "capability" | "configuration";
+            id: string;
+            title: string;
+            description?: string | undefined;
+            remediation?: {
+              kind: "agent-setup";
+              summary: string;
+              requiresUserAction?: boolean | undefined;
+            } | undefined;
+          };
+          providers: {
+            providerId: string;
+            appId: string;
+            componentId: string;
+            capabilities: {
+              id: string;
+              version?: string | undefined;
+              resourceTypes?: string[] | undefined;
+              wit?: {
+                package: string;
+                interface: string;
+                version: string;
+              } | undefined;
+            }[];
+          }[];
+        }[];
+        resolvedProviderIds: {
+          [x: string]: string[];
+        };
+        diagnostics: {
+          code: _$_nextclaw_kernel0.AppPackageDependencyDiagnosticCode;
+          componentId: string;
+          requirementKind: "capability" | "resource";
+          requirementId: string;
+          providerId?: string | undefined;
+          message: string;
+        }[];
       };
     };
   }, _$hono_utils_http_status0.ContentfulStatusCode, "json">)>;
-  readonly updateProductAnalytics: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
-    ok: boolean;
-    error: {
-      code: string;
-      message: string;
-      details: {
-        [x: string]: _$hono_utils_types0.JSONValue;
-      } | undefined;
-    };
-  }, 400, "json">) | (Response & _$hono.TypedResponse<{
-    ok: boolean;
-    data: {
-      enabled: boolean;
-      schemaVersion: 2;
-      audience: "external" | "internal" | "qa";
-    };
-  }, _$hono_utils_http_status0.ContentfulStatusCode, "json">)>;
-  readonly updateRuntime: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
+  readonly inspectDependencies: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
     ok: boolean;
     error: {
       code: string;
@@ -3764,109 +5548,73 @@ declare class ConfigRoutesController {
         [x: string]: _$hono_utils_types0.JSONValue;
       } | undefined;
     };
-  }, 400, "json">) | (Response & _$hono.TypedResponse<{
+  }, 400 | 404 | 409, "json">) | (Response & _$hono.TypedResponse<{
     ok: boolean;
     data: {
-      agents: {
-        defaults: {
-          model: string;
-          workspace?: string | undefined;
-          engine?: string | undefined;
-          engineConfig?: {
-            [x: string]: _$hono_utils_types0.JSONValue;
-          } | undefined;
-          thinkingDefault?: NextclawCore.ThinkingLevel | undefined;
-          models?: {
-            [x: string]: {
-              [x: string]: _$hono_utils_types0.JSONValue;
-              params: {
-                [x: string]: _$hono_utils_types0.JSONValue;
-              };
-            };
-          } | undefined;
-          contextTokens?: number | undefined;
-          reservedContextTokens?: number | undefined;
-        };
-        runtimes?: {
-          entries?: {
-            [x: string]: {
-              enabled?: boolean | undefined;
-              label?: string | undefined;
-              icon?: {
-                kind: "image";
-                src: string;
-                alt?: string | null | undefined;
-              } | null | undefined;
-              type: string;
-              config?: {
-                [x: string]: _$hono_utils_types0.JSONValue;
-              } | undefined;
-            };
-          } | undefined;
-        } | undefined;
-        list?: {
+      readiness: {
+        status: _$_nextclaw_kernel0.AppPackageReadinessStatus;
+        requirements: {
+          componentId: string;
+          kind: "capability" | "configuration";
           id: string;
-          default?: boolean | undefined;
-          displayName?: string | undefined;
+          title: string;
           description?: string | undefined;
-          avatar?: string | undefined;
-          avatarUrl?: string | undefined;
-          workspace?: string | undefined;
-          model?: string | undefined;
-          runtime?: string | undefined;
-          runtimeConfig?: {
-            [x: string]: _$hono_utils_types0.JSONValue;
-          } | null | undefined;
-          engine?: string | undefined;
-          engineConfig?: {
-            [x: string]: _$hono_utils_types0.JSONValue;
-          } | undefined;
-          thinkingDefault?: NextclawCore.ThinkingLevel | undefined;
-          models?: {
-            [x: string]: {
-              [x: string]: _$hono_utils_types0.JSONValue;
-              params: {
-                [x: string]: _$hono_utils_types0.JSONValue;
-              };
-            };
+          remediation?: {
+            kind: "agent-setup";
+            summary: string;
+            requiresUserAction?: boolean | undefined;
           } | undefined;
-          contextTokens?: number | undefined;
-          reservedContextTokens?: number | undefined;
-          builtIn?: boolean | undefined;
-        }[] | undefined;
-        context?: {
-          bootstrap?: {
-            files?: string[] | undefined;
-            minimalFiles?: string[] | undefined;
-            perFileChars?: number | undefined;
-            totalChars?: number | undefined;
-          } | undefined;
-          memory?: {
-            enabled?: boolean | undefined;
-            maxChars?: number | undefined;
-          } | undefined;
-        } | undefined;
+        }[];
       };
-      bindings?: {
-        agentId: string;
-        match: {
-          channel: string;
-          accountId?: string | undefined;
-          peer?: {
-            kind: "direct" | "group" | "channel";
-            id: string;
+      bindings: {
+        componentId: string;
+        requirementKind: "capability" | "resource";
+        requirementId: string;
+        providerId: string;
+      }[];
+      candidates: {
+        requirement: {
+          componentId: string;
+          kind: "capability" | "configuration";
+          id: string;
+          title: string;
+          description?: string | undefined;
+          remediation?: {
+            kind: "agent-setup";
+            summary: string;
+            requiresUserAction?: boolean | undefined;
           } | undefined;
         };
-      }[] | undefined;
-      session?: {
-        dmScope?: "main" | "per-peer" | "per-channel-peer" | "per-account-channel-peer" | undefined;
-      } | undefined;
-      companion?: {
-        enabled?: boolean | undefined;
-      } | undefined;
+        providers: {
+          providerId: string;
+          appId: string;
+          componentId: string;
+          capabilities: {
+            id: string;
+            version?: string | undefined;
+            resourceTypes?: string[] | undefined;
+            wit?: {
+              package: string;
+              interface: string;
+              version: string;
+            } | undefined;
+          }[];
+        }[];
+      }[];
+      resolvedProviderIds: {
+        [x: string]: string[];
+      };
+      diagnostics: {
+        code: _$_nextclaw_kernel0.AppPackageDependencyDiagnosticCode;
+        componentId: string;
+        requirementKind: "capability" | "resource";
+        requirementId: string;
+        providerId?: string | undefined;
+        message: string;
+      }[];
     };
   }, _$hono_utils_http_status0.ContentfulStatusCode, "json">)>;
-  readonly executeAction: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
+  readonly verifyDependencies: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
     ok: boolean;
     error: {
       code: string;
@@ -3875,219 +5623,223 @@ declare class ConfigRoutesController {
         [x: string]: _$hono_utils_types0.JSONValue;
       } | undefined;
     };
-  }, 400, "json">) | (Response & _$hono.TypedResponse<{
+  }, 400 | 404 | 409, "json">) | (Response & _$hono.TypedResponse<{
     ok: boolean;
     data: {
-      ok: boolean;
-      status: "success" | "failed";
+      readiness: {
+        status: _$_nextclaw_kernel0.AppPackageReadinessStatus;
+        requirements: {
+          componentId: string;
+          kind: "capability" | "configuration";
+          id: string;
+          title: string;
+          description?: string | undefined;
+          remediation?: {
+            kind: "agent-setup";
+            summary: string;
+            requiresUserAction?: boolean | undefined;
+          } | undefined;
+        }[];
+      };
+      bindings: {
+        componentId: string;
+        requirementKind: "capability" | "resource";
+        requirementId: string;
+        providerId: string;
+      }[];
+      candidates: {
+        requirement: {
+          componentId: string;
+          kind: "capability" | "configuration";
+          id: string;
+          title: string;
+          description?: string | undefined;
+          remediation?: {
+            kind: "agent-setup";
+            summary: string;
+            requiresUserAction?: boolean | undefined;
+          } | undefined;
+        };
+        providers: {
+          providerId: string;
+          appId: string;
+          componentId: string;
+          capabilities: {
+            id: string;
+            version?: string | undefined;
+            resourceTypes?: string[] | undefined;
+            wit?: {
+              package: string;
+              interface: string;
+              version: string;
+            } | undefined;
+          }[];
+        }[];
+      }[];
+      resolvedProviderIds: {
+        [x: string]: string[];
+      };
+      diagnostics: {
+        code: _$_nextclaw_kernel0.AppPackageDependencyDiagnosticCode;
+        componentId: string;
+        requirementKind: "capability" | "resource";
+        requirementId: string;
+        providerId?: string | undefined;
+        message: string;
+      }[];
+    };
+  }, _$hono_utils_http_status0.ContentfulStatusCode, "json">)>;
+  readonly setupDependencies: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
+    ok: boolean;
+    error: {
+      code: string;
       message: string;
-      data?: {
-        [x: string]: _$hono_utils_types0.JSONValue;
-      } | undefined;
-      patch?: {
+      details: {
         [x: string]: _$hono_utils_types0.JSONValue;
       } | undefined;
-      nextActions?: string[] | undefined;
     };
-  }, _$hono_utils_http_status0.ContentfulStatusCode, "json">)>;
-}
-//#endregion
-//#region src/features/config/utils/extension-channel-config-projection.utils.d.ts
-type ExtensionConfigProjectionOptions = {
-  extensionChannelBindings?: ExtensionChannelBinding[];
-  extensionUiMetadata?: ExtensionUiMetadata[];
-};
-//#endregion
-//#region src/features/config/utils/search-config.utils.d.ts
-declare function updateSearch(configPath: string, patch: SearchConfigUpdate): ConfigView["search"];
-//#endregion
-//#region src/features/config/stores/server-config.store.d.ts
-type ExecuteActionResult = {
-  ok: true;
-  data: ConfigActionExecuteResult$1;
-} | {
-  ok: false;
-  code: string;
-  message: string;
-  details?: Record<string, unknown>;
-};
-declare function buildConfigView(config: Config, options?: ExtensionConfigProjectionOptions): ConfigView;
-declare function buildConfigMeta(config: Config, options?: ExtensionConfigProjectionOptions): ConfigMetaView;
-declare function buildProviderTemplatesView(): ProviderTemplatesView;
-declare function buildProvidersView(config: Config): ProvidersView;
-declare function buildConfigSchemaView(_config: Config, options?: ExtensionConfigProjectionOptions): ConfigSchemaResponse;
-declare function executeConfigAction(configPath: string, actionId: string, request: ConfigActionExecuteRequest$1): Promise<ExecuteActionResult>;
-declare function loadConfigOrDefault(configPath: string): Config;
-declare function updateModel(configPath: string, patch: {
-  model?: string;
-  workspace?: string;
-}): ConfigView;
-declare function updateProvider(configPath: string, providerId: string, patch: ProviderConfigUpdate): ProviderConfigView | null;
-declare function createProvider(configPath: string, patch?: ProviderCreateRequest): {
-  providerId: string;
-  provider: ProviderConfigView;
-} | null;
-declare function deleteProvider(configPath: string, providerId: string): boolean | null;
-declare function updateChannel(configPath: string, channelName: string, patch: Record<string, unknown>, options?: ExtensionConfigProjectionOptions): Record<string, unknown> | null;
-declare function updateRuntime(configPath: string, patch: RuntimeConfigUpdate): Pick<ConfigView, "companion" | "agents" | "bindings" | "session">;
-declare function updateSecrets(configPath: string, patch: SecretsConfigUpdate): SecretsView;
-declare function updateProductAnalytics(configPath: string, patch: ProductAnalyticsConfigUpdate): ProductAnalyticsView;
-//#endregion
-//#region src/features/app-packages/controllers/app-packages.controller.d.ts
-declare class AppPackagesRoutesController {
-  private readonly manager;
-  constructor(manager: AppPackageManager);
-  readonly list: (c: Context) => Promise<Response & _$hono.TypedResponse<{
-    ok: boolean;
-    data: {
-      entries: {
-        id: string;
-        name: string;
-        description?: string | undefined;
-        icon?: string | undefined;
-        nameI18n?: {
-          [x: string]: string;
-        } | undefined;
-        descriptionI18n?: {
-          [x: string]: string;
-        } | undefined;
-        activeVersion: string;
-        installedVersions: string[];
-        enabled: boolean;
-        builtIn: boolean;
-        primaryPanelId?: string | undefined;
-        components: {
-          kind: _$_nextclaw_kernel0.AppPackageComponentKind;
-          id: string;
-          packageId: string;
-          packageVersion: string;
-          sourcePath: string;
-          manifestPath: string;
-          dataDirectory: string;
-          instanceId: string;
-          storage: {
-            layout: AppStorageLayout;
-            layoutVersion: 1;
-            instanceId: string;
-            instanceDirectory: string;
-            dataDirectory: string;
-            configDirectory: string;
-            stateDirectory: string;
-            cacheDirectory: string;
-            temporaryDirectory: string;
-            logsDirectory: string;
-          };
-          runtimeProfile: AppRuntimeProfile;
-          isolation: AppRuntimeIsolation;
-          permissions: {
-            documentAccess?: {
-              id: string;
-              mode: AppDocumentAccessMode;
-              description?: string | undefined;
-            }[] | undefined;
-            allowedDomains?: string[] | undefined;
-            storage?: boolean | {
-              namespace?: string | undefined;
-            } | undefined;
-            capabilities?: {
-              hostBridge?: boolean | undefined;
-              nativeProcess?: boolean | undefined;
-            } | undefined;
-          };
-          title?: string | undefined;
+  }, 400 | 404 | 409, "json">) | (Response & _$hono.TypedResponse<{
+    ok: boolean;
+    data: {
+      readiness: {
+        status: _$_nextclaw_kernel0.AppPackageReadinessStatus;
+        requirements: {
+          componentId: string;
+          kind: "capability" | "configuration";
+          id: string;
+          title: string;
           description?: string | undefined;
-          icon?: string | undefined;
-          titleI18n?: {
-            [x: string]: string;
-          } | undefined;
-          descriptionI18n?: {
-            [x: string]: string;
+          remediation?: {
+            kind: "agent-setup";
+            summary: string;
+            requiresUserAction?: boolean | undefined;
           } | undefined;
         }[];
-        dataDirectory: string;
-        instanceId: string;
-        storage: {
-          layout: AppStorageLayout;
-          layoutVersion: 1;
-          instanceId: string;
-          instanceDirectory: string;
-          dataDirectory: string;
-          configDirectory: string;
-          stateDirectory: string;
-          cacheDirectory: string;
-          temporaryDirectory: string;
-          logsDirectory: string;
+      };
+      bindings: {
+        componentId: string;
+        requirementKind: "capability" | "resource";
+        requirementId: string;
+        providerId: string;
+      }[];
+      candidates: {
+        requirement: {
+          componentId: string;
+          kind: "capability" | "configuration";
+          id: string;
+          title: string;
+          description?: string | undefined;
+          remediation?: {
+            kind: "agent-setup";
+            summary: string;
+            requiresUserAction?: boolean | undefined;
+          } | undefined;
         };
-        storageUsage?: {
-          dataBytes: number;
-          configBytes: number;
-          stateBytes: number;
-          cacheBytes: number;
-          temporaryBytes: number;
-          logsBytes: number;
-          totalBytes: number;
-        } | undefined;
-        runtimeProfile: AppRuntimeProfile;
-        isolation: AppRuntimeIsolation;
+        providers: {
+          providerId: string;
+          appId: string;
+          componentId: string;
+          capabilities: {
+            id: string;
+            version?: string | undefined;
+            resourceTypes?: string[] | undefined;
+            wit?: {
+              package: string;
+              interface: string;
+              version: string;
+            } | undefined;
+          }[];
+        }[];
       }[];
-      hostTarget?: {
-        key: string;
-        operatingSystem: "darwin" | "linux" | "win32";
-        architecture: "x64" | "arm64";
-        abi?: "gnu" | "musl" | "msvc" | undefined;
+      resolvedProviderIds: {
+        [x: string]: string[];
+      };
+      diagnostics: {
+        code: _$_nextclaw_kernel0.AppPackageDependencyDiagnosticCode;
+        componentId: string;
+        requirementKind: "capability" | "resource";
+        requirementId: string;
+        providerId?: string | undefined;
+        message: string;
+      }[];
+    };
+  }, _$hono_utils_http_status0.ContentfulStatusCode, "json">)>;
+  readonly bindDependency: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
+    ok: boolean;
+    error: {
+      code: string;
+      message: string;
+      details: {
+        [x: string]: _$hono_utils_types0.JSONValue;
       } | undefined;
     };
-  }, _$hono_utils_http_status0.ContentfulStatusCode, "json">>;
-  readonly listOperations: (c: Context) => Promise<Response & _$hono.TypedResponse<{
+  }, 400 | 404 | 409, "json">) | (Response & _$hono.TypedResponse<{
     ok: boolean;
     data: {
-      entries: {
-        id: string;
-        action: _$_nextclaw_kernel0.AppPackageOperationAction;
-        appId?: string | undefined;
-        source?: string | undefined;
-        targetVersion?: string | undefined;
-        status: _$_nextclaw_kernel0.AppPackageOperationStatus;
-        completedSteps: number;
-        totalSteps: number;
-        createdAt: string;
-        updatedAt: string;
-        completedAt?: string | undefined;
-        error?: string | undefined;
-        result?: {
+      readiness: {
+        status: _$_nextclaw_kernel0.AppPackageReadinessStatus;
+        requirements: {
+          componentId: string;
+          kind: "capability" | "configuration";
+          id: string;
+          title: string;
+          description?: string | undefined;
+          remediation?: {
+            kind: "agent-setup";
+            summary: string;
+            requiresUserAction?: boolean | undefined;
+          } | undefined;
+        }[];
+      };
+      bindings: {
+        componentId: string;
+        requirementKind: "capability" | "resource";
+        requirementId: string;
+        providerId: string;
+      }[];
+      candidates: {
+        requirement: {
+          componentId: string;
+          kind: "capability" | "configuration";
+          id: string;
+          title: string;
+          description?: string | undefined;
+          remediation?: {
+            kind: "agent-setup";
+            summary: string;
+            requiresUserAction?: boolean | undefined;
+          } | undefined;
+        };
+        providers: {
+          providerId: string;
           appId: string;
-          activeVersion?: string | undefined;
-          changed?: boolean | undefined;
-          removedVersions?: string[] | undefined;
-          dataRemoved?: boolean | undefined;
-        } | undefined;
+          componentId: string;
+          capabilities: {
+            id: string;
+            version?: string | undefined;
+            resourceTypes?: string[] | undefined;
+            wit?: {
+              package: string;
+              interface: string;
+              version: string;
+            } | undefined;
+          }[];
+        }[];
+      }[];
+      resolvedProviderIds: {
+        [x: string]: string[];
+      };
+      diagnostics: {
+        code: _$_nextclaw_kernel0.AppPackageDependencyDiagnosticCode;
+        componentId: string;
+        requirementKind: "capability" | "resource";
+        requirementId: string;
+        providerId?: string | undefined;
+        message: string;
       }[];
     };
-  }, _$hono_utils_http_status0.ContentfulStatusCode, "json">>;
-  readonly startInstallOperation: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
-    ok: boolean;
-    data: {
-      id: string;
-      action: _$_nextclaw_kernel0.AppPackageOperationAction;
-      appId?: string | undefined;
-      source?: string | undefined;
-      targetVersion?: string | undefined;
-      status: _$_nextclaw_kernel0.AppPackageOperationStatus;
-      completedSteps: number;
-      totalSteps: number;
-      createdAt: string;
-      updatedAt: string;
-      completedAt?: string | undefined;
-      error?: string | undefined;
-      result?: {
-        appId: string;
-        activeVersion?: string | undefined;
-        changed?: boolean | undefined;
-        removedVersions?: string[] | undefined;
-        dataRemoved?: boolean | undefined;
-      } | undefined;
-    };
-  }, 202, "json">) | (Response & _$hono.TypedResponse<{
+  }, _$hono_utils_http_status0.ContentfulStatusCode, "json">)>;
+  readonly unbindDependency: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
     ok: boolean;
     error: {
       code: string;
@@ -4096,31 +5848,73 @@ declare class AppPackagesRoutesController {
         [x: string]: _$hono_utils_types0.JSONValue;
       } | undefined;
     };
-  }, 400 | 404 | 409, "json">)>;
-  readonly startUpdateOperation: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
+  }, 400 | 404 | 409, "json">) | (Response & _$hono.TypedResponse<{
     ok: boolean;
     data: {
-      id: string;
-      action: _$_nextclaw_kernel0.AppPackageOperationAction;
-      appId?: string | undefined;
-      source?: string | undefined;
-      targetVersion?: string | undefined;
-      status: _$_nextclaw_kernel0.AppPackageOperationStatus;
-      completedSteps: number;
-      totalSteps: number;
-      createdAt: string;
-      updatedAt: string;
-      completedAt?: string | undefined;
-      error?: string | undefined;
-      result?: {
-        appId: string;
-        activeVersion?: string | undefined;
-        changed?: boolean | undefined;
-        removedVersions?: string[] | undefined;
-        dataRemoved?: boolean | undefined;
-      } | undefined;
+      readiness: {
+        status: _$_nextclaw_kernel0.AppPackageReadinessStatus;
+        requirements: {
+          componentId: string;
+          kind: "capability" | "configuration";
+          id: string;
+          title: string;
+          description?: string | undefined;
+          remediation?: {
+            kind: "agent-setup";
+            summary: string;
+            requiresUserAction?: boolean | undefined;
+          } | undefined;
+        }[];
+      };
+      bindings: {
+        componentId: string;
+        requirementKind: "capability" | "resource";
+        requirementId: string;
+        providerId: string;
+      }[];
+      candidates: {
+        requirement: {
+          componentId: string;
+          kind: "capability" | "configuration";
+          id: string;
+          title: string;
+          description?: string | undefined;
+          remediation?: {
+            kind: "agent-setup";
+            summary: string;
+            requiresUserAction?: boolean | undefined;
+          } | undefined;
+        };
+        providers: {
+          providerId: string;
+          appId: string;
+          componentId: string;
+          capabilities: {
+            id: string;
+            version?: string | undefined;
+            resourceTypes?: string[] | undefined;
+            wit?: {
+              package: string;
+              interface: string;
+              version: string;
+            } | undefined;
+          }[];
+        }[];
+      }[];
+      resolvedProviderIds: {
+        [x: string]: string[];
+      };
+      diagnostics: {
+        code: _$_nextclaw_kernel0.AppPackageDependencyDiagnosticCode;
+        componentId: string;
+        requirementKind: "capability" | "resource";
+        requirementId: string;
+        providerId?: string | undefined;
+        message: string;
+      }[];
     };
-  }, 202, "json">) | (Response & _$hono.TypedResponse<{
+  }, _$hono_utils_http_status0.ContentfulStatusCode, "json">)>;
+  readonly inspectSecrets: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
     ok: boolean;
     error: {
       code: string;
@@ -4129,31 +5923,40 @@ declare class AppPackagesRoutesController {
         [x: string]: _$hono_utils_types0.JSONValue;
       } | undefined;
     };
-  }, 400 | 404 | 409, "json">)>;
-  readonly startRollbackOperation: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
+  }, 400 | 404 | 409, "json">) | (Response & _$hono.TypedResponse<{
     ok: boolean;
     data: {
-      id: string;
-      action: _$_nextclaw_kernel0.AppPackageOperationAction;
-      appId?: string | undefined;
-      source?: string | undefined;
-      targetVersion?: string | undefined;
-      status: _$_nextclaw_kernel0.AppPackageOperationStatus;
-      completedSteps: number;
-      totalSteps: number;
-      createdAt: string;
-      updatedAt: string;
-      completedAt?: string | undefined;
-      error?: string | undefined;
-      result?: {
-        appId: string;
-        activeVersion?: string | undefined;
-        changed?: boolean | undefined;
-        removedVersions?: string[] | undefined;
-        dataRemoved?: boolean | undefined;
-      } | undefined;
+      readiness: {
+        status: _$_nextclaw_kernel0.AppPackageReadinessStatus;
+        requirements: {
+          componentId: string;
+          kind: "capability" | "configuration";
+          id: string;
+          title: string;
+          description?: string | undefined;
+          remediation?: {
+            kind: "agent-setup";
+            summary: string;
+            requiresUserAction?: boolean | undefined;
+          } | undefined;
+        }[];
+      };
+      slots: {
+        id: string;
+        description: string;
+        title: string;
+        required: boolean;
+        status: _$_nextclaw_kernel0.AppPackageSecretStatus;
+        binding?: {
+          source: "env" | "file" | "exec";
+          provider?: string | undefined;
+          id: string;
+        } | undefined;
+        errorCode?: "SECRET_BINDING_MISSING" | "SECRET_RESOLUTION_FAILED" | undefined;
+      }[];
     };
-  }, 202, "json">) | (Response & _$hono.TypedResponse<{
+  }, _$hono_utils_http_status0.ContentfulStatusCode, "json">)>;
+  readonly verifySecrets: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
     ok: boolean;
     error: {
       code: string;
@@ -4162,31 +5965,40 @@ declare class AppPackagesRoutesController {
         [x: string]: _$hono_utils_types0.JSONValue;
       } | undefined;
     };
-  }, 400 | 404 | 409, "json">)>;
-  readonly startUninstallOperation: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
+  }, 400 | 404 | 409, "json">) | (Response & _$hono.TypedResponse<{
     ok: boolean;
     data: {
-      id: string;
-      action: _$_nextclaw_kernel0.AppPackageOperationAction;
-      appId?: string | undefined;
-      source?: string | undefined;
-      targetVersion?: string | undefined;
-      status: _$_nextclaw_kernel0.AppPackageOperationStatus;
-      completedSteps: number;
-      totalSteps: number;
-      createdAt: string;
-      updatedAt: string;
-      completedAt?: string | undefined;
-      error?: string | undefined;
-      result?: {
-        appId: string;
-        activeVersion?: string | undefined;
-        changed?: boolean | undefined;
-        removedVersions?: string[] | undefined;
-        dataRemoved?: boolean | undefined;
-      } | undefined;
+      readiness: {
+        status: _$_nextclaw_kernel0.AppPackageReadinessStatus;
+        requirements: {
+          componentId: string;
+          kind: "capability" | "configuration";
+          id: string;
+          title: string;
+          description?: string | undefined;
+          remediation?: {
+            kind: "agent-setup";
+            summary: string;
+            requiresUserAction?: boolean | undefined;
+          } | undefined;
+        }[];
+      };
+      slots: {
+        id: string;
+        description: string;
+        title: string;
+        required: boolean;
+        status: _$_nextclaw_kernel0.AppPackageSecretStatus;
+        binding?: {
+          source: "env" | "file" | "exec";
+          provider?: string | undefined;
+          id: string;
+        } | undefined;
+        errorCode?: "SECRET_BINDING_MISSING" | "SECRET_RESOLUTION_FAILED" | undefined;
+      }[];
     };
-  }, 202, "json">) | (Response & _$hono.TypedResponse<{
+  }, _$hono_utils_http_status0.ContentfulStatusCode, "json">)>;
+  readonly bindSecret: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
     ok: boolean;
     error: {
       code: string;
@@ -4195,8 +6007,40 @@ declare class AppPackagesRoutesController {
         [x: string]: _$hono_utils_types0.JSONValue;
       } | undefined;
     };
-  }, 400 | 404 | 409, "json">)>;
-  readonly get: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
+  }, 400 | 404 | 409, "json">) | (Response & _$hono.TypedResponse<{
+    ok: boolean;
+    data: {
+      readiness: {
+        status: _$_nextclaw_kernel0.AppPackageReadinessStatus;
+        requirements: {
+          componentId: string;
+          kind: "capability" | "configuration";
+          id: string;
+          title: string;
+          description?: string | undefined;
+          remediation?: {
+            kind: "agent-setup";
+            summary: string;
+            requiresUserAction?: boolean | undefined;
+          } | undefined;
+        }[];
+      };
+      slots: {
+        id: string;
+        description: string;
+        title: string;
+        required: boolean;
+        status: _$_nextclaw_kernel0.AppPackageSecretStatus;
+        binding?: {
+          source: "env" | "file" | "exec";
+          provider?: string | undefined;
+          id: string;
+        } | undefined;
+        errorCode?: "SECRET_BINDING_MISSING" | "SECRET_RESOLUTION_FAILED" | undefined;
+      }[];
+    };
+  }, _$hono_utils_http_status0.ContentfulStatusCode, "json">)>;
+  readonly unbindSecret: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
     ok: boolean;
     error: {
       code: string;
@@ -4208,94 +6052,34 @@ declare class AppPackagesRoutesController {
   }, 400 | 404 | 409, "json">) | (Response & _$hono.TypedResponse<{
     ok: boolean;
     data: {
-      id: string;
-      name: string;
-      description?: string | undefined;
-      icon?: string | undefined;
-      nameI18n?: {
-        [x: string]: string;
-      } | undefined;
-      descriptionI18n?: {
-        [x: string]: string;
-      } | undefined;
-      activeVersion: string;
-      installedVersions: string[];
-      enabled: boolean;
-      builtIn: boolean;
-      primaryPanelId?: string | undefined;
-      components: {
-        kind: _$_nextclaw_kernel0.AppPackageComponentKind;
-        id: string;
-        packageId: string;
-        packageVersion: string;
-        sourcePath: string;
-        manifestPath: string;
-        dataDirectory: string;
-        instanceId: string;
-        storage: {
-          layout: AppStorageLayout;
-          layoutVersion: 1;
-          instanceId: string;
-          instanceDirectory: string;
-          dataDirectory: string;
-          configDirectory: string;
-          stateDirectory: string;
-          cacheDirectory: string;
-          temporaryDirectory: string;
-          logsDirectory: string;
-        };
-        runtimeProfile: AppRuntimeProfile;
-        isolation: AppRuntimeIsolation;
-        permissions: {
-          documentAccess?: {
-            id: string;
-            mode: AppDocumentAccessMode;
-            description?: string | undefined;
-          }[] | undefined;
-          allowedDomains?: string[] | undefined;
-          storage?: boolean | {
-            namespace?: string | undefined;
-          } | undefined;
-          capabilities?: {
-            hostBridge?: boolean | undefined;
-            nativeProcess?: boolean | undefined;
+      readiness: {
+        status: _$_nextclaw_kernel0.AppPackageReadinessStatus;
+        requirements: {
+          componentId: string;
+          kind: "capability" | "configuration";
+          id: string;
+          title: string;
+          description?: string | undefined;
+          remediation?: {
+            kind: "agent-setup";
+            summary: string;
+            requiresUserAction?: boolean | undefined;
           } | undefined;
-        };
-        title?: string | undefined;
-        description?: string | undefined;
-        icon?: string | undefined;
-        titleI18n?: {
-          [x: string]: string;
-        } | undefined;
-        descriptionI18n?: {
-          [x: string]: string;
+        }[];
+      };
+      slots: {
+        id: string;
+        description: string;
+        title: string;
+        required: boolean;
+        status: _$_nextclaw_kernel0.AppPackageSecretStatus;
+        binding?: {
+          source: "env" | "file" | "exec";
+          provider?: string | undefined;
+          id: string;
         } | undefined;
+        errorCode?: "SECRET_BINDING_MISSING" | "SECRET_RESOLUTION_FAILED" | undefined;
       }[];
-      dataDirectory: string;
-      instanceId: string;
-      storage: {
-        layout: AppStorageLayout;
-        layoutVersion: 1;
-        instanceId: string;
-        instanceDirectory: string;
-        dataDirectory: string;
-        configDirectory: string;
-        stateDirectory: string;
-        cacheDirectory: string;
-        temporaryDirectory: string;
-        logsDirectory: string;
-      };
-      storageUsage?: {
-        dataBytes: number;
-        configBytes: number;
-        stateBytes: number;
-        cacheBytes: number;
-        temporaryBytes: number;
-        logsBytes: number;
-        totalBytes: number;
-      } | undefined;
-      runtimeProfile: AppRuntimeProfile;
-      isolation: AppRuntimeIsolation;
     };
   }, _$hono_utils_http_status0.ContentfulStatusCode, "json">)>;
   readonly install: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
@@ -4354,6 +6138,12 @@ declare class AppPackagesRoutesController {
             mode: AppDocumentAccessMode;
             description?: string | undefined;
           }[] | undefined;
+          secrets?: {
+            id: string;
+            title: string;
+            description: string;
+            required: boolean;
+          }[] | undefined;
           allowedDomains?: string[] | undefined;
           storage?: boolean | {
             namespace?: string | undefined;
@@ -4363,6 +6153,7 @@ declare class AppPackagesRoutesController {
             nativeProcess?: boolean | undefined;
           } | undefined;
         };
+        resolvedProviderIds?: string[] | undefined;
         title?: string | undefined;
         description?: string | undefined;
         icon?: string | undefined;
@@ -4398,6 +6189,114 @@ declare class AppPackagesRoutesController {
       } | undefined;
       runtimeProfile: AppRuntimeProfile;
       isolation: AppRuntimeIsolation;
+      readiness: {
+        status: _$_nextclaw_kernel0.AppPackageReadinessStatus;
+        requirements: {
+          componentId: string;
+          kind: "capability" | "configuration";
+          id: string;
+          title: string;
+          description?: string | undefined;
+          remediation?: {
+            kind: "agent-setup";
+            summary: string;
+            requiresUserAction?: boolean | undefined;
+          } | undefined;
+        }[];
+      };
+      secrets: {
+        readiness: {
+          status: _$_nextclaw_kernel0.AppPackageReadinessStatus;
+          requirements: {
+            componentId: string;
+            kind: "capability" | "configuration";
+            id: string;
+            title: string;
+            description?: string | undefined;
+            remediation?: {
+              kind: "agent-setup";
+              summary: string;
+              requiresUserAction?: boolean | undefined;
+            } | undefined;
+          }[];
+        };
+        slots: {
+          id: string;
+          description: string;
+          title: string;
+          required: boolean;
+          status: _$_nextclaw_kernel0.AppPackageSecretStatus;
+          binding?: {
+            source: "env" | "file" | "exec";
+            provider?: string | undefined;
+            id: string;
+          } | undefined;
+          errorCode?: "SECRET_BINDING_MISSING" | "SECRET_RESOLUTION_FAILED" | undefined;
+        }[];
+      };
+      dependencies: {
+        readiness: {
+          status: _$_nextclaw_kernel0.AppPackageReadinessStatus;
+          requirements: {
+            componentId: string;
+            kind: "capability" | "configuration";
+            id: string;
+            title: string;
+            description?: string | undefined;
+            remediation?: {
+              kind: "agent-setup";
+              summary: string;
+              requiresUserAction?: boolean | undefined;
+            } | undefined;
+          }[];
+        };
+        bindings: {
+          componentId: string;
+          requirementKind: "capability" | "resource";
+          requirementId: string;
+          providerId: string;
+        }[];
+        candidates: {
+          requirement: {
+            componentId: string;
+            kind: "capability" | "configuration";
+            id: string;
+            title: string;
+            description?: string | undefined;
+            remediation?: {
+              kind: "agent-setup";
+              summary: string;
+              requiresUserAction?: boolean | undefined;
+            } | undefined;
+          };
+          providers: {
+            providerId: string;
+            appId: string;
+            componentId: string;
+            capabilities: {
+              id: string;
+              version?: string | undefined;
+              resourceTypes?: string[] | undefined;
+              wit?: {
+                package: string;
+                interface: string;
+                version: string;
+              } | undefined;
+            }[];
+          }[];
+        }[];
+        resolvedProviderIds: {
+          [x: string]: string[];
+        };
+        diagnostics: {
+          code: _$_nextclaw_kernel0.AppPackageDependencyDiagnosticCode;
+          componentId: string;
+          requirementKind: "capability" | "resource";
+          requirementId: string;
+          providerId?: string | undefined;
+          message: string;
+        }[];
+      };
     };
   }, _$hono_utils_http_status0.ContentfulStatusCode, "json">)>;
   readonly enable: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
@@ -4456,6 +6355,12 @@ declare class AppPackagesRoutesController {
             mode: AppDocumentAccessMode;
             description?: string | undefined;
           }[] | undefined;
+          secrets?: {
+            id: string;
+            title: string;
+            description: string;
+            required: boolean;
+          }[] | undefined;
           allowedDomains?: string[] | undefined;
           storage?: boolean | {
             namespace?: string | undefined;
@@ -4465,6 +6370,7 @@ declare class AppPackagesRoutesController {
             nativeProcess?: boolean | undefined;
           } | undefined;
         };
+        resolvedProviderIds?: string[] | undefined;
         title?: string | undefined;
         description?: string | undefined;
         icon?: string | undefined;
@@ -4500,6 +6406,114 @@ declare class AppPackagesRoutesController {
       } | undefined;
       runtimeProfile: AppRuntimeProfile;
       isolation: AppRuntimeIsolation;
+      readiness: {
+        status: _$_nextclaw_kernel0.AppPackageReadinessStatus;
+        requirements: {
+          componentId: string;
+          kind: "capability" | "configuration";
+          id: string;
+          title: string;
+          description?: string | undefined;
+          remediation?: {
+            kind: "agent-setup";
+            summary: string;
+            requiresUserAction?: boolean | undefined;
+          } | undefined;
+        }[];
+      };
+      secrets: {
+        readiness: {
+          status: _$_nextclaw_kernel0.AppPackageReadinessStatus;
+          requirements: {
+            componentId: string;
+            kind: "capability" | "configuration";
+            id: string;
+            title: string;
+            description?: string | undefined;
+            remediation?: {
+              kind: "agent-setup";
+              summary: string;
+              requiresUserAction?: boolean | undefined;
+            } | undefined;
+          }[];
+        };
+        slots: {
+          id: string;
+          description: string;
+          title: string;
+          required: boolean;
+          status: _$_nextclaw_kernel0.AppPackageSecretStatus;
+          binding?: {
+            source: "env" | "file" | "exec";
+            provider?: string | undefined;
+            id: string;
+          } | undefined;
+          errorCode?: "SECRET_BINDING_MISSING" | "SECRET_RESOLUTION_FAILED" | undefined;
+        }[];
+      };
+      dependencies: {
+        readiness: {
+          status: _$_nextclaw_kernel0.AppPackageReadinessStatus;
+          requirements: {
+            componentId: string;
+            kind: "capability" | "configuration";
+            id: string;
+            title: string;
+            description?: string | undefined;
+            remediation?: {
+              kind: "agent-setup";
+              summary: string;
+              requiresUserAction?: boolean | undefined;
+            } | undefined;
+          }[];
+        };
+        bindings: {
+          componentId: string;
+          requirementKind: "capability" | "resource";
+          requirementId: string;
+          providerId: string;
+        }[];
+        candidates: {
+          requirement: {
+            componentId: string;
+            kind: "capability" | "configuration";
+            id: string;
+            title: string;
+            description?: string | undefined;
+            remediation?: {
+              kind: "agent-setup";
+              summary: string;
+              requiresUserAction?: boolean | undefined;
+            } | undefined;
+          };
+          providers: {
+            providerId: string;
+            appId: string;
+            componentId: string;
+            capabilities: {
+              id: string;
+              version?: string | undefined;
+              resourceTypes?: string[] | undefined;
+              wit?: {
+                package: string;
+                interface: string;
+                version: string;
+              } | undefined;
+            }[];
+          }[];
+        }[];
+        resolvedProviderIds: {
+          [x: string]: string[];
+        };
+        diagnostics: {
+          code: _$_nextclaw_kernel0.AppPackageDependencyDiagnosticCode;
+          componentId: string;
+          requirementKind: "capability" | "resource";
+          requirementId: string;
+          providerId?: string | undefined;
+          message: string;
+        }[];
+      };
     };
   }, _$hono_utils_http_status0.ContentfulStatusCode, "json">)>;
   readonly disable: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
@@ -4558,6 +6572,12 @@ declare class AppPackagesRoutesController {
             mode: AppDocumentAccessMode;
             description?: string | undefined;
           }[] | undefined;
+          secrets?: {
+            id: string;
+            title: string;
+            description: string;
+            required: boolean;
+          }[] | undefined;
           allowedDomains?: string[] | undefined;
           storage?: boolean | {
             namespace?: string | undefined;
@@ -4567,6 +6587,7 @@ declare class AppPackagesRoutesController {
             nativeProcess?: boolean | undefined;
           } | undefined;
         };
+        resolvedProviderIds?: string[] | undefined;
         title?: string | undefined;
         description?: string | undefined;
         icon?: string | undefined;
@@ -4602,6 +6623,114 @@ declare class AppPackagesRoutesController {
       } | undefined;
       runtimeProfile: AppRuntimeProfile;
       isolation: AppRuntimeIsolation;
+      readiness: {
+        status: _$_nextclaw_kernel0.AppPackageReadinessStatus;
+        requirements: {
+          componentId: string;
+          kind: "capability" | "configuration";
+          id: string;
+          title: string;
+          description?: string | undefined;
+          remediation?: {
+            kind: "agent-setup";
+            summary: string;
+            requiresUserAction?: boolean | undefined;
+          } | undefined;
+        }[];
+      };
+      secrets: {
+        readiness: {
+          status: _$_nextclaw_kernel0.AppPackageReadinessStatus;
+          requirements: {
+            componentId: string;
+            kind: "capability" | "configuration";
+            id: string;
+            title: string;
+            description?: string | undefined;
+            remediation?: {
+              kind: "agent-setup";
+              summary: string;
+              requiresUserAction?: boolean | undefined;
+            } | undefined;
+          }[];
+        };
+        slots: {
+          id: string;
+          description: string;
+          title: string;
+          required: boolean;
+          status: _$_nextclaw_kernel0.AppPackageSecretStatus;
+          binding?: {
+            source: "env" | "file" | "exec";
+            provider?: string | undefined;
+            id: string;
+          } | undefined;
+          errorCode?: "SECRET_BINDING_MISSING" | "SECRET_RESOLUTION_FAILED" | undefined;
+        }[];
+      };
+      dependencies: {
+        readiness: {
+          status: _$_nextclaw_kernel0.AppPackageReadinessStatus;
+          requirements: {
+            componentId: string;
+            kind: "capability" | "configuration";
+            id: string;
+            title: string;
+            description?: string | undefined;
+            remediation?: {
+              kind: "agent-setup";
+              summary: string;
+              requiresUserAction?: boolean | undefined;
+            } | undefined;
+          }[];
+        };
+        bindings: {
+          componentId: string;
+          requirementKind: "capability" | "resource";
+          requirementId: string;
+          providerId: string;
+        }[];
+        candidates: {
+          requirement: {
+            componentId: string;
+            kind: "capability" | "configuration";
+            id: string;
+            title: string;
+            description?: string | undefined;
+            remediation?: {
+              kind: "agent-setup";
+              summary: string;
+              requiresUserAction?: boolean | undefined;
+            } | undefined;
+          };
+          providers: {
+            providerId: string;
+            appId: string;
+            componentId: string;
+            capabilities: {
+              id: string;
+              version?: string | undefined;
+              resourceTypes?: string[] | undefined;
+              wit?: {
+                package: string;
+                interface: string;
+                version: string;
+              } | undefined;
+            }[];
+          }[];
+        }[];
+        resolvedProviderIds: {
+          [x: string]: string[];
+        };
+        diagnostics: {
+          code: _$_nextclaw_kernel0.AppPackageDependencyDiagnosticCode;
+          componentId: string;
+          requirementKind: "capability" | "resource";
+          requirementId: string;
+          providerId?: string | undefined;
+          message: string;
+        }[];
+      };
     };
   }, _$hono_utils_http_status0.ContentfulStatusCode, "json">)>;
   readonly update: (c: Context) => Promise<(Response & _$hono.TypedResponse<{
@@ -4661,6 +6790,12 @@ declare class AppPackagesRoutesController {
               mode: AppDocumentAccessMode;
               description?: string | undefined;
             }[] | undefined;
+            secrets?: {
+              id: string;
+              title: string;
+              description: string;
+              required: boolean;
+            }[] | undefined;
             allowedDomains?: string[] | undefined;
             storage?: boolean | {
               namespace?: string | undefined;
@@ -4670,6 +6805,7 @@ declare class AppPackagesRoutesController {
               nativeProcess?: boolean | undefined;
             } | undefined;
           };
+          resolvedProviderIds?: string[] | undefined;
           title?: string | undefined;
           description?: string | undefined;
           icon?: string | undefined;
@@ -4705,6 +6841,114 @@ declare class AppPackagesRoutesController {
         } | undefined;
         runtimeProfile: AppRuntimeProfile;
         isolation: AppRuntimeIsolation;
+        readiness: {
+          status: _$_nextclaw_kernel0.AppPackageReadinessStatus;
+          requirements: {
+            componentId: string;
+            kind: "capability" | "configuration";
+            id: string;
+            title: string;
+            description?: string | undefined;
+            remediation?: {
+              kind: "agent-setup";
+              summary: string;
+              requiresUserAction?: boolean | undefined;
+            } | undefined;
+          }[];
+        };
+        secrets: {
+          readiness: {
+            status: _$_nextclaw_kernel0.AppPackageReadinessStatus;
+            requirements: {
+              componentId: string;
+              kind: "capability" | "configuration";
+              id: string;
+              title: string;
+              description?: string | undefined;
+              remediation?: {
+                kind: "agent-setup";
+                summary: string;
+                requiresUserAction?: boolean | undefined;
+              } | undefined;
+            }[];
+          };
+          slots: {
+            id: string;
+            description: string;
+            title: string;
+            required: boolean;
+            status: _$_nextclaw_kernel0.AppPackageSecretStatus;
+            binding?: {
+              source: "env" | "file" | "exec";
+              provider?: string | undefined;
+              id: string;
+            } | undefined;
+            errorCode?: "SECRET_BINDING_MISSING" | "SECRET_RESOLUTION_FAILED" | undefined;
+          }[];
+        };
+        dependencies: {
+          readiness: {
+            status: _$_nextclaw_kernel0.AppPackageReadinessStatus;
+            requirements: {
+              componentId: string;
+              kind: "capability" | "configuration";
+              id: string;
+              title: string;
+              description?: string | undefined;
+              remediation?: {
+                kind: "agent-setup";
+                summary: string;
+                requiresUserAction?: boolean | undefined;
+              } | undefined;
+            }[];
+          };
+          bindings: {
+            componentId: string;
+            requirementKind: "capability" | "resource";
+            requirementId: string;
+            providerId: string;
+          }[];
+          candidates: {
+            requirement: {
+              componentId: string;
+              kind: "capability" | "configuration";
+              id: string;
+              title: string;
+              description?: string | undefined;
+              remediation?: {
+                kind: "agent-setup";
+                summary: string;
+                requiresUserAction?: boolean | undefined;
+              } | undefined;
+            };
+            providers: {
+              providerId: string;
+              appId: string;
+              componentId: string;
+              capabilities: {
+                id: string;
+                version?: string | undefined;
+                resourceTypes?: string[] | undefined;
+                wit?: {
+                  package: string;
+                  interface: string;
+                  version: string;
+                } | undefined;
+              }[];
+            }[];
+          }[];
+          resolvedProviderIds: {
+            [x: string]: string[];
+          };
+          diagnostics: {
+            code: _$_nextclaw_kernel0.AppPackageDependencyDiagnosticCode;
+            componentId: string;
+            requirementKind: "capability" | "resource";
+            requirementId: string;
+            providerId?: string | undefined;
+            message: string;
+          }[];
+        };
       };
       result: {
         appId: string;
@@ -4741,6 +6985,12 @@ declare class AppPackagesRoutesController {
             mode: AppDocumentAccessMode;
             description?: string | undefined;
           }[] | undefined;
+          secrets?: {
+            id: string;
+            title: string;
+            description: string;
+            required: boolean;
+          }[] | undefined;
           allowedDomains?: string[] | undefined;
           storage?: boolean | {
             namespace?: string | undefined;
@@ -4847,6 +7097,12 @@ declare class AppPackagesRoutesController {
               mode: AppDocumentAccessMode;
               description?: string | undefined;
             }[] | undefined;
+            secrets?: {
+              id: string;
+              title: string;
+              description: string;
+              required: boolean;
+            }[] | undefined;
             allowedDomains?: string[] | undefined;
             storage?: boolean | {
               namespace?: string | undefined;
@@ -4856,6 +7112,7 @@ declare class AppPackagesRoutesController {
               nativeProcess?: boolean | undefined;
             } | undefined;
           };
+          resolvedProviderIds?: string[] | undefined;
           title?: string | undefined;
           description?: string | undefined;
           icon?: string | undefined;
@@ -4891,6 +7148,114 @@ declare class AppPackagesRoutesController {
         } | undefined;
         runtimeProfile: AppRuntimeProfile;
         isolation: AppRuntimeIsolation;
+        readiness: {
+          status: _$_nextclaw_kernel0.AppPackageReadinessStatus;
+          requirements: {
+            componentId: string;
+            kind: "capability" | "configuration";
+            id: string;
+            title: string;
+            description?: string | undefined;
+            remediation?: {
+              kind: "agent-setup";
+              summary: string;
+              requiresUserAction?: boolean | undefined;
+            } | undefined;
+          }[];
+        };
+        secrets: {
+          readiness: {
+            status: _$_nextclaw_kernel0.AppPackageReadinessStatus;
+            requirements: {
+              componentId: string;
+              kind: "capability" | "configuration";
+              id: string;
+              title: string;
+              description?: string | undefined;
+              remediation?: {
+                kind: "agent-setup";
+                summary: string;
+                requiresUserAction?: boolean | undefined;
+              } | undefined;
+            }[];
+          };
+          slots: {
+            id: string;
+            description: string;
+            title: string;
+            required: boolean;
+            status: _$_nextclaw_kernel0.AppPackageSecretStatus;
+            binding?: {
+              source: "env" | "file" | "exec";
+              provider?: string | undefined;
+              id: string;
+            } | undefined;
+            errorCode?: "SECRET_BINDING_MISSING" | "SECRET_RESOLUTION_FAILED" | undefined;
+          }[];
+        };
+        dependencies: {
+          readiness: {
+            status: _$_nextclaw_kernel0.AppPackageReadinessStatus;
+            requirements: {
+              componentId: string;
+              kind: "capability" | "configuration";
+              id: string;
+              title: string;
+              description?: string | undefined;
+              remediation?: {
+                kind: "agent-setup";
+                summary: string;
+                requiresUserAction?: boolean | undefined;
+              } | undefined;
+            }[];
+          };
+          bindings: {
+            componentId: string;
+            requirementKind: "capability" | "resource";
+            requirementId: string;
+            providerId: string;
+          }[];
+          candidates: {
+            requirement: {
+              componentId: string;
+              kind: "capability" | "configuration";
+              id: string;
+              title: string;
+              description?: string | undefined;
+              remediation?: {
+                kind: "agent-setup";
+                summary: string;
+                requiresUserAction?: boolean | undefined;
+              } | undefined;
+            };
+            providers: {
+              providerId: string;
+              appId: string;
+              componentId: string;
+              capabilities: {
+                id: string;
+                version?: string | undefined;
+                resourceTypes?: string[] | undefined;
+                wit?: {
+                  package: string;
+                  interface: string;
+                  version: string;
+                } | undefined;
+              }[];
+            }[];
+          }[];
+          resolvedProviderIds: {
+            [x: string]: string[];
+          };
+          diagnostics: {
+            code: _$_nextclaw_kernel0.AppPackageDependencyDiagnosticCode;
+            componentId: string;
+            requirementKind: "capability" | "resource";
+            requirementId: string;
+            providerId?: string | undefined;
+            message: string;
+          }[];
+        };
       };
       result: {
         appId: string;
@@ -5084,5 +7449,5 @@ declare class InboxDeliveriesRoutesController {
   private handleManagerAction;
 }
 //#endregion
-export { AgentBindingView, type AgentCreateRequest, type AgentDeleteResult, type AgentProfileView, type AgentUpdateRequest, ApiError, ApiResponse, type AppDataDeleteResult, type AppDataEntry, type AppDataList, AppDataRoutesController, AppMetaView, type AppPackageHostTarget, type AppPackageList, type AppPackageOperationInput, type AppPackageOperationList, type AppPackageOperationStatus, type AppPackageOperationView, type AppPackageView, AppPackagesRoutesController, AuthEnabledUpdateRequest, AuthLoginRequest, AuthPasswordUpdateRequest, AuthSetupRequest, AuthStatusView, BindingPeerView, BochaFreshnessValue, BootstrapPhase, BootstrapRemoteState, BootstrapStageState, BootstrapStatusView, ChannelAuthConnectRequest, ChannelAuthConnectResult, ChannelAuthPollRequest, ChannelAuthPollResult, ChannelAuthStartRequest, ChannelAuthStartResult, ChannelSpecView, type ChatSessionTypeCtaView, type ChatSessionTypeOptionView, type ChatSessionTypesView, ConfigActionExecuteRequest, ConfigActionExecuteResult, ConfigActionManifest, ConfigActionType, ConfigMetaView, ConfigRoutesController, ConfigSchemaResponse, ConfigUiHint, ConfigUiHints, ConfigView, CronActionResult, CronCreateRequest, CronCreateResult, CronEnableRequest, CronJobStateView, CronJobView, CronListQuery, CronListStatus, CronListSummaryView, CronListView, CronPayloadView, CronRunRequest, CronScheduleView, InboxDeliveriesRoutesController, MarketplaceApiConfig, MarketplaceInstallKind, MarketplaceInstallRequest, MarketplaceInstallResult, MarketplaceInstallSkillParams, MarketplaceInstallSpec, MarketplaceInstalledRecord, MarketplaceInstalledView, MarketplaceInstaller, MarketplaceItemSummary, MarketplaceItemType, MarketplaceItemView, MarketplaceListView, MarketplaceLocalizedTextMap, MarketplaceManageAction, MarketplaceManageRequest, MarketplaceManageResult, MarketplaceMcpContentView, MarketplaceMcpDoctorResult, MarketplaceMcpInstallKind, MarketplaceMcpInstallRequest, MarketplaceMcpInstallResult, MarketplaceMcpInstallSpec, MarketplaceMcpManageAction, MarketplaceMcpManageRequest, MarketplaceMcpManageResult, MarketplaceMcpTemplateInput, MarketplaceRecommendationView, MarketplaceSceneView, MarketplaceScenesView, MarketplaceSkillContentView, MarketplaceSkillInstallKind, MarketplaceSkillInstallRequest, MarketplaceSkillInstallResult, MarketplaceSkillManageAction, MarketplaceSkillManageRequest, MarketplaceSkillManageResult, MarketplaceSort, McpConnectionCreateResult, McpConnectionRequest, McpConnectionTestResult, NcpAssetRoutesController, NcpSessionContextCompactionView, NcpSessionSkillsView, PanelAppAgentCapabilityView, PanelAppAgentGenerateObjectRequestView, PanelAppAgentGenerateObjectResultView, PanelAppAgentSendRequestView, PanelAppAgentSendResultView, PanelAppBridgeSessionCreateRequest, PanelAppBridgeSessionView, PanelAppCapabilityGrantView, PanelAppClientGrantView, PanelAppDeleteResultView, PanelAppEntryView, PanelAppListView, PanelAppPreferencesUpdateView, PanelAppsRoutesController, PreferenceDeleteResult, PreferenceEntryView, PreferenceUpdateRequest, PreferencesRoutesController, ProductAnalyticsAudience, ProductAnalyticsConfigUpdate, type ProductAnalyticsStatusView, ProductAnalyticsView, type ProjectAddExistingRequest, type ProjectCreateRequest, type ProjectListView, type ProjectTemplateView, type ProjectView, ProviderAuthImportResult, ProviderAuthPollRequest, ProviderAuthPollResult, ProviderAuthStartRequest, ProviderAuthStartResult, ProviderConfigUpdate, ProviderConfigView, ProviderConnectionTestRequest, ProviderConnectionTestResult, ProviderCreateRequest, ProviderCreateResult, ProviderDeleteResult, ProviderInstanceView, ProviderModelCatalogView, ProviderModelDiscoveryRequest, ProviderModelDiscoveryResult, ProviderTemplateView, ProviderTemplatesView, ProvidersView, RemoteAccessView, RemoteAccountProfileUpdateRequest, RemoteAccountView, RemoteBrowserAuthPollRequest, RemoteBrowserAuthPollResult, RemoteBrowserAuthStartRequest, RemoteBrowserAuthStartResult, RemoteConnectionDiagnosticsView, RemoteDisconnectView, RemoteDoctorCheckView, RemoteDoctorView, RemoteLoginRequest, RemoteRuntimeView, RemoteServiceAction, RemoteServiceActionResult, RemoteServiceView, RemoteSettingsUpdateRequest, RemoteSettingsView, RuntimeActionCapability, RuntimeActionImpact, RuntimeConfigUpdate, RuntimeControlAction, RuntimeControlActionResult, RuntimeControlEnvironment, RuntimeControlRoutesController, RuntimeControlView, RuntimeEntryView, RuntimeLifecycleState, RuntimePendingRestart, RuntimeServiceState, SearchConfigUpdate, SearchConfigView, SearchProviderConfigView, SearchProviderName, SearchProviderSpecView, SecretProviderEnvView, SecretProviderExecView, SecretProviderFileView, SecretProviderView, SecretRefView, SecretSourceView, SecretsConfigUpdate, SecretsView, ServerPathBreadcrumbView, ServerPathBrowseView, ServerPathDirectoryCreateRequest, ServerPathDirectoryCreateView, ServerPathEntryDeleteView, ServerPathEntryRenameRequest, ServerPathEntryRenameView, ServerPathEntryView, ServerPathFileCreateRequest, ServerPathFileCreateView, ServerPathFilesUploadView, ServerPathLocationView, ServerPathReadView, ServerPathSearchEntryView, ServerPathSearchView, ServerPathWatchRequest, ServerPathWatchView, ServiceActionGrantBatchRequestView, ServiceActionGrantListView, ServiceActionGrantView, ServiceActionInvokeRequestView, ServiceActionInvokeResultView, ServiceActionListView, ServiceActionView, ServiceAppDeleteResultView, ServiceAppListView, ServiceAppRecordView, ServiceAppsRoutesController, SessionConfigView, SessionEntryView, SessionEventView, SessionHistoryView, SessionMessageView, SessionPatchUpdate, SessionSkillEntryView, SessionTypeDescribeParams, SessionsListView, TavilySearchDepthValue, UiNcpAssetPutView, UiNcpAssetService, UiNcpAssetView, UiNcpSessionListView, UiNcpSessionMessagesView, UiNcpSessionObservationKind, UiNcpSessionObservationView, UiNcpSessionObservationsView, UiNcpSessionPendingInputView, UiNcpSessionPendingInputsView, UiNcpSessionQueuedInputView, UiNcpSessionQueuedInputsView, UiNcpSessionService, UiNcpSessionTokenUsageView, UiNcpStoredAssetRecord, type UiRemoteAccessHost, type UiRouterOptions, type UiRuntimeControlHost, type UiRuntimeUpdateHost, UiServerEvent, UiServerHandle, buildConfigMeta, buildConfigSchemaView, buildConfigView, buildProviderTemplatesView, buildProvidersView, createProvider, createUiRouter, deleteProvider, ensureUiBridgeSecret, executeConfigAction, getUiBridgeSecretPath, loadConfigOrDefault, readUiBridgeSecret, startUiServer, updateChannel, updateModel, updateProductAnalytics, updateProvider, updateRuntime, updateSearch, updateSecrets };
+export { AgentBindingView, type AgentCreateRequest, type AgentDeleteResult, type AgentProfileView, type AgentUpdateRequest, ApiError, ApiResponse, type AppDataDeleteResult, type AppDataEntry, type AppDataList, AppDataRoutesController, AppMetaView, type AppPackageHostTarget, type AppPackageList, type AppPackageOperationInput, type AppPackageOperationList, type AppPackageOperationStatus, type AppPackageOperationView, type AppPackageView, AppPackagesRoutesController, AuthEnabledUpdateRequest, AuthLoginRequest, AuthPasswordUpdateRequest, AuthSetupRequest, AuthStatusView, BindingPeerView, BochaFreshnessValue, BootstrapPhase, BootstrapRemoteState, BootstrapStageState, BootstrapStatusView, ChannelAuthConnectRequest, ChannelAuthConnectResult, ChannelAuthPollRequest, ChannelAuthPollResult, ChannelAuthStartRequest, ChannelAuthStartResult, ChannelSpecView, type ChatSessionTypeCtaView, type ChatSessionTypeOptionView, type ChatSessionTypesView, ConfigActionExecuteRequest, ConfigActionExecuteResult, ConfigActionManifest, ConfigActionType, ConfigMetaView, ConfigRoutesController, ConfigSchemaResponse, ConfigUiHint, ConfigUiHints, ConfigView, CronActionResult, CronCreateRequest, CronCreateResult, CronEnableRequest, CronJobStateView, CronJobView, CronListQuery, CronListStatus, CronListSummaryView, CronListView, CronPayloadView, CronRunRequest, CronScheduleView, InboxDeliveriesRoutesController, MarketplaceApiConfig, MarketplaceInstallKind, MarketplaceInstallRequest, MarketplaceInstallResult, MarketplaceInstallSkillParams, MarketplaceInstallSpec, MarketplaceInstalledRecord, MarketplaceInstalledView, MarketplaceInstaller, MarketplaceItemSummary, MarketplaceItemType, MarketplaceItemView, MarketplaceListView, MarketplaceLocalizedTextMap, MarketplaceManageAction, MarketplaceManageRequest, MarketplaceManageResult, MarketplaceMcpContentView, MarketplaceMcpDoctorResult, MarketplaceMcpInstallKind, MarketplaceMcpInstallRequest, MarketplaceMcpInstallResult, MarketplaceMcpInstallSpec, MarketplaceMcpManageAction, MarketplaceMcpManageRequest, MarketplaceMcpManageResult, MarketplaceMcpTemplateInput, MarketplaceRecommendationView, MarketplaceSceneView, MarketplaceScenesView, MarketplaceSkillContentView, MarketplaceSkillInstallKind, MarketplaceSkillInstallRequest, MarketplaceSkillInstallResult, MarketplaceSkillManageAction, MarketplaceSkillManageRequest, MarketplaceSkillManageResult, MarketplaceSort, McpConnectionCreateResult, McpConnectionRequest, McpConnectionTestResult, NcpAssetRoutesController, NcpSessionContextCompactionView, NcpSessionSkillsView, PanelAppAgentCapabilityView, PanelAppAgentGenerateObjectRequestView, PanelAppAgentGenerateObjectResultView, PanelAppAgentSendRequestView, PanelAppAgentSendResultView, PanelAppBridgeSessionCreateRequest, PanelAppBridgeSessionView, PanelAppCapabilityGrantView, PanelAppClientGrantView, PanelAppDeleteResultView, PanelAppEntryView, PanelAppListView, PanelAppPreferencesUpdateView, PanelAppsRoutesController, PortableRuntimeAcceptanceContractApiView, PortableRuntimeAcceptanceExportApiView, PortableRuntimeAcceptanceStatusApiView, PreferenceDeleteResult, PreferenceEntryView, PreferenceUpdateRequest, PreferencesRoutesController, ProductAnalyticsAudience, ProductAnalyticsConfigUpdate, type ProductAnalyticsStatusView, ProductAnalyticsView, type ProjectAddExistingRequest, type ProjectCreateRequest, type ProjectListView, type ProjectTemplateView, type ProjectView, ProviderAuthImportResult, ProviderAuthPollRequest, ProviderAuthPollResult, ProviderAuthStartRequest, ProviderAuthStartResult, ProviderConfigUpdate, ProviderConfigView, ProviderConnectionTestRequest, ProviderConnectionTestResult, ProviderCreateRequest, ProviderCreateResult, ProviderDeleteResult, ProviderInstanceView, ProviderModelCatalogView, ProviderModelDiscoveryRequest, ProviderModelDiscoveryResult, ProviderTemplateView, ProviderTemplatesView, ProvidersView, RemoteAccessView, RemoteAccountProfileUpdateRequest, RemoteAccountView, RemoteBrowserAuthPollRequest, RemoteBrowserAuthPollResult, RemoteBrowserAuthStartRequest, RemoteBrowserAuthStartResult, RemoteConnectionDiagnosticsView, RemoteDisconnectView, RemoteDoctorCheckView, RemoteDoctorView, RemoteLoginRequest, RemoteRuntimeView, RemoteServiceAction, RemoteServiceActionResult, RemoteServiceView, RemoteSettingsUpdateRequest, RemoteSettingsView, RuntimeActionCapability, RuntimeActionImpact, RuntimeConfigUpdate, RuntimeControlAction, RuntimeControlActionResult, RuntimeControlEnvironment, RuntimeControlRoutesController, RuntimeControlView, RuntimeEntryView, RuntimeLifecycleState, RuntimePendingRestart, RuntimeServiceState, RuntimeVerificationRecordListView, SearchConfigUpdate, SearchConfigView, SearchProviderConfigView, SearchProviderName, SearchProviderSpecView, SecretProviderEnvView, SecretProviderExecView, SecretProviderFileView, SecretProviderView, SecretRefView, SecretSourceView, SecretsConfigUpdate, SecretsView, ServerPathBreadcrumbView, ServerPathBrowseView, ServerPathDirectoryCreateRequest, ServerPathDirectoryCreateView, ServerPathEntryDeleteView, ServerPathEntryRenameRequest, ServerPathEntryRenameView, ServerPathEntryView, ServerPathFileCreateRequest, ServerPathFileCreateView, ServerPathFilesUploadView, ServerPathLocationView, ServerPathReadView, ServerPathSearchEntryView, ServerPathSearchView, ServerPathWatchRequest, ServerPathWatchView, ServiceActionGrantBatchRequestView, ServiceActionGrantListView, ServiceActionGrantView, ServiceActionInvokeRequestView, ServiceActionInvokeResultView, ServiceActionListView, ServiceActionView, ServiceAppDeleteResultView, ServiceAppJobListView, ServiceAppJobViewResponse, ServiceAppJobWatchView, ServiceAppListView, ServiceAppRecordView, ServiceAppsRoutesController, SessionConfigView, SessionEntryView, SessionEventView, SessionHistoryView, SessionMessageView, SessionPatchUpdate, SessionSkillEntryView, SessionTypeDescribeParams, SessionsListView, TavilySearchDepthValue, UiNcpAssetPutView, UiNcpAssetService, UiNcpAssetView, UiNcpSessionListView, UiNcpSessionMessagesView, UiNcpSessionObservationKind, UiNcpSessionObservationView, UiNcpSessionObservationsView, UiNcpSessionPendingInputView, UiNcpSessionPendingInputsView, UiNcpSessionQueuedInputView, UiNcpSessionQueuedInputsView, UiNcpSessionService, UiNcpSessionTokenUsageView, UiNcpStoredAssetRecord, type UiRemoteAccessHost, type UiRouterOptions, type UiRuntimeControlHost, type UiRuntimeUpdateHost, UiServerEvent, UiServerHandle, buildConfigMeta, buildConfigSchemaView, buildConfigView, buildProviderTemplatesView, buildProvidersView, createProvider, createUiRouter, deleteProvider, ensureUiBridgeSecret, executeConfigAction, getUiBridgeSecretPath, loadConfigOrDefault, readUiBridgeSecret, startUiServer, updateChannel, updateModel, updateProductAnalytics, updateProvider, updateRuntime, updateSearch, updateSecrets };
 //# sourceMappingURL=index.d.ts.map