@whooshbang/contracts 1.0.0-rc.20 → 1.0.0-rc.21

package/openapi/generated/whooshbang-v1.bundle.json

@@ -2,7 +2,7 @@
   "openapi": "3.1.1",
   "info": {
     "title": "WhooshBang API",
-    "version": "1.0.0-rc.20",
+    "version": "1.0.0-rc.21",
     "description": "The V1 contract for human account/project administration, project-scoped\nsubscription links, and asynchronous text messages. A Clerk session selects\none account for administration. A project credential selects one account,\nproject, and `test` or `live` environment for product operations; request\nbodies cannot override either authenticated scope.\n\nA person's OAuth grant selects one account and carries scopes, but no\nproject. It names the project and environment it acts in through the URL\npath, on the environment-scoped form of each operation; the service checks\nthat path against the granting person's membership on every call. The flat\nforms remain credential-only and are unchanged.\n\nResource identifiers are opaque and are not authorization. Reads outside the\ncredential scope return the same `404` shape as absent resources. Provider\ncredentials, raw Telegram identity, and protected provider responses are\nnever part of this API.\n",
     "termsOfService": "https://flowxo.com/terms",
     "contact": {
@@ -32,6 +32,10 @@
       "name": "API credentials",
       "description": "Human-administered, environment-scoped bearer credentials with one-time secret reveal."
     },
+    {
+      "name": "Account credentials",
+      "description": "Human-administered, account-scoped bearer credentials that name their project and environment per call."
+    },
     {
       "name": "Subscription links",
       "description": "Single-use, expiring Telegram authorization links."
@@ -119,13 +123,299 @@
         }
       }
     },
+    "/v1/account/credentials": {
+      "get": {
+        "operationId": "listAccountCredentials",
+        "summary": "List safe account credential metadata",
+        "description": "Returns only credentials owned by the account selected by the verified\nClerk organization session. Secrets and digest material are never\nreturned.\n",
+        "tags": ["Account credentials"],
+        "security": [{ "clerkSession": [] }],
+        "x-account-membership": "required",
+        "parameters": [
+          { "$ref": "#/components/parameters/ApiCredentialAfterCursor" },
+          { "$ref": "#/components/parameters/ApiCredentialPageLimit" },
+          { "$ref": "#/components/parameters/PageNumber" }
+        ],
+        "responses": {
+          "200": {
+            "description": "A stable page of safe account credential metadata.",
+            "headers": {
+              "WhooshBang-Diagnostic-Id": {
+                "$ref": "#/components/headers/DiagnosticId"
+              }
+            },
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/AccountCredentialCollection"
+                },
+                "examples": {
+                  "accountCredentials": {
+                    "value": {
+                      "items": [
+                        {
+                          "id": "acred_AAAAAAAAAAAAAAAAAAAAAA",
+                          "prefix": "wb_ac1.acred_AAAAAAAA",
+                          "label": "Synthetic release automation",
+                          "scopes": [
+                            "account:read",
+                            "messages:write",
+                            "messages:read"
+                          ],
+                          "created_by": "member_synthetic_001",
+                          "created_at": "2026-07-25T17:45:00Z",
+                          "last_used_at": "2026-07-25T17:50:00Z",
+                          "status": "active"
+                        }
+                      ],
+                      "page": 1,
+                      "page_size": 50,
+                      "total": 1
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "400": { "$ref": "#/components/responses/BadRequest" },
+          "401": { "$ref": "#/components/responses/Unauthorized" },
+          "403": { "$ref": "#/components/responses/Forbidden" },
+          "404": { "$ref": "#/components/responses/NotFound" },
+          "429": { "$ref": "#/components/responses/RateLimited" }
+        }
+      },
+      "post": {
+        "operationId": "createAccountCredential",
+        "summary": "Create an account-scoped API credential",
+        "description": "Creates one credential against the whole account. It names no project\nand no environment: a request names them in its path, and the\ncredential's authority on that path is the intersection of its scopes\nwith the project-credential vocabulary, so it is never wider than a\nproject credential would have been for the same project environment.\nThe complete bearer secret appears only in this creation response. It\ncannot be read later and is never replayed from an idempotency cache.\n",
+        "tags": ["Account credentials"],
+        "security": [{ "clerkSession": [] }],
+        "x-account-membership": "required",
+        "x-secret-reveal": {
+          "responses": 1,
+          "replayable": false,
+          "later_reads": "metadata_only"
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/CreateAccountCredentialRequest"
+              },
+              "examples": {
+                "createAccountCredential": {
+                  "value": {
+                    "label": "Release automation",
+                    "scopes": [
+                      "account:read",
+                      "messages:write",
+                      "messages:read"
+                    ]
+                  }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "201": {
+            "description": "Creation-only secret reveal and safe credential metadata.",
+            "headers": {
+              "WhooshBang-Diagnostic-Id": {
+                "$ref": "#/components/headers/DiagnosticId"
+              }
+            },
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/AccountCredentialSecretReveal"
+                },
+                "examples": {
+                  "createdAccountCredential": {
+                    "value": {
+                      "credential": {
+                        "id": "acred_AAAAAAAAAAAAAAAAAAAAAA",
+                        "prefix": "wb_ac1.acred_AAAAAAAA",
+                        "label": "Synthetic release automation",
+                        "scopes": [
+                          "account:read",
+                          "messages:write",
+                          "messages:read"
+                        ],
+                        "created_by": "member_synthetic_001",
+                        "created_at": "2026-07-25T17:45:00Z",
+                        "status": "active"
+                      },
+                      "secret": "wb_ac1.acred_AAAAAAAAAAAAAAAAAAAAAA.AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "400": { "$ref": "#/components/responses/BadRequest" },
+          "401": { "$ref": "#/components/responses/Unauthorized" },
+          "403": { "$ref": "#/components/responses/Forbidden" },
+          "404": { "$ref": "#/components/responses/NotFound" },
+          "429": { "$ref": "#/components/responses/RateLimited" }
+        }
+      }
+    },
+    "/v1/account/credentials/{account_credential_id}/rotate": {
+      "parameters": [{ "$ref": "#/components/parameters/AccountCredentialId" }],
+      "post": {
+        "operationId": "rotateAccountCredential",
+        "summary": "Rotate an account-scoped API credential",
+        "description": "Creates one replacement with the same label and scopes. The complete new\nbearer secret appears only in this response. The replaced credential\nremains active for the explicitly declared overlap, from zero through\n86400 seconds, then becomes terminally revoked. A revoked credential\ncannot be rotated. Missing and out-of-account credentials use the same\nnon-enumerating `404`.\n",
+        "tags": ["Account credentials"],
+        "security": [{ "clerkSession": [] }],
+        "x-account-membership": "required",
+        "x-secret-reveal": {
+          "responses": 1,
+          "replayable": false,
+          "later_reads": "metadata_only"
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/RotateAccountCredentialRequest"
+              },
+              "examples": {
+                "rotateAccountCredential": {
+                  "value": { "overlap_seconds": 3600 }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "201": {
+            "description": "Creation-only replacement secret and safe metadata for both credentials.",
+            "headers": {
+              "WhooshBang-Diagnostic-Id": {
+                "$ref": "#/components/headers/DiagnosticId"
+              }
+            },
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/AccountCredentialRotation"
+                },
+                "examples": {
+                  "rotatedAccountCredential": {
+                    "value": {
+                      "credential": {
+                        "credential": {
+                          "id": "acred_BBBBBBBBBBBBBBBBBBBBBA",
+                          "prefix": "wb_ac1.acred_BBBBBBBB",
+                          "label": "Synthetic release automation",
+                          "scopes": [
+                            "account:read",
+                            "messages:write",
+                            "messages:read"
+                          ],
+                          "created_by": "member_synthetic_001",
+                          "created_at": "2026-07-25T17:45:00Z",
+                          "status": "active"
+                        },
+                        "secret": "wb_ac1.acred_BBBBBBBBBBBBBBBBBBBBBA.BBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBBA"
+                      },
+                      "replaced_credential": {
+                        "id": "acred_AAAAAAAAAAAAAAAAAAAAAA",
+                        "prefix": "wb_ac1.acred_AAAAAAAA",
+                        "label": "Synthetic release automation",
+                        "scopes": [
+                          "account:read",
+                          "messages:write",
+                          "messages:read"
+                        ],
+                        "created_by": "member_synthetic_001",
+                        "created_at": "2026-07-25T17:45:00Z",
+                        "last_used_at": "2026-07-25T17:50:00Z",
+                        "scheduled_revocation_at": "2026-07-25T18:45:00Z",
+                        "status": "active"
+                      }
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "400": { "$ref": "#/components/responses/BadRequest" },
+          "401": { "$ref": "#/components/responses/Unauthorized" },
+          "403": { "$ref": "#/components/responses/Forbidden" },
+          "404": { "$ref": "#/components/responses/NotFound" },
+          "429": { "$ref": "#/components/responses/RateLimited" }
+        }
+      }
+    },
+    "/v1/account/credentials/{account_credential_id}/revoke": {
+      "parameters": [{ "$ref": "#/components/parameters/AccountCredentialId" }],
+      "post": {
+        "operationId": "revokeAccountCredential",
+        "summary": "Revoke an account-scoped API credential",
+        "description": "Immediately and terminally revokes the selected credential. Repeating\nthe request for the same visible credential is safe and returns the\nsame revoked metadata without revealing secret or digest material.\nMissing and out-of-account credentials use the same non-enumerating\n`404`.\n",
+        "tags": ["Account credentials"],
+        "security": [{ "clerkSession": [] }],
+        "x-account-membership": "required",
+        "x-repeat-semantics": {
+          "same_target": "idempotent",
+          "secret_returned": false
+        },
+        "responses": {
+          "200": {
+            "description": "Safe terminal credential metadata.",
+            "headers": {
+              "WhooshBang-Diagnostic-Id": {
+                "$ref": "#/components/headers/DiagnosticId"
+              }
+            },
+            "content": {
+              "application/json": {
+                "schema": { "$ref": "#/components/schemas/AccountCredential" },
+                "examples": {
+                  "revokedAccountCredential": {
+                    "value": {
+                      "id": "acred_AAAAAAAAAAAAAAAAAAAAAA",
+                      "prefix": "wb_ac1.acred_AAAAAAAA",
+                      "label": "Synthetic release automation",
+                      "scopes": [
+                        "account:read",
+                        "messages:write",
+                        "messages:read"
+                      ],
+                      "created_by": "member_synthetic_001",
+                      "created_at": "2026-07-25T17:45:00Z",
+                      "last_used_at": "2026-07-25T17:50:00Z",
+                      "status": "revoked",
+                      "revoked_at": "2026-07-25T17:55:00Z"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "401": { "$ref": "#/components/responses/Unauthorized" },
+          "403": { "$ref": "#/components/responses/Forbidden" },
+          "404": { "$ref": "#/components/responses/NotFound" },
+          "429": { "$ref": "#/components/responses/RateLimited" }
+        }
+      }
+    },
     "/v1/projects": {
       "get": {
         "operationId": "listProjects",
         "summary": "List projects in the current account",
         "description": "Returns only projects owned by the account selected by the verified\nClerk organization session. Every project includes its complete test/live\nenvironment and default-notifier bootstrap.\n",
         "tags": ["Projects"],
-        "security": [{ "clerkSession": [] }, { "bearerGrant": [] }],
+        "security": [
+          { "clerkSession": [] },
+          { "bearerGrant": [] },
+          { "bearerAccountCredential": [] }
+        ],
         "x-required-scopes": ["projects:read"],
         "x-account-membership": "required",
         "parameters": [
@@ -308,7 +598,11 @@
         "summary": "Read one project in the current account",
         "description": "Returns the complete project bootstrap. An absent project and a project\noutside the authenticated account use the same non-enumerating `404`.\n",
         "tags": ["Projects"],
-        "security": [{ "clerkSession": [] }, { "bearerGrant": [] }],
+        "security": [
+          { "clerkSession": [] },
+          { "bearerGrant": [] },
+          { "bearerAccountCredential": [] }
+        ],
         "x-required-scopes": ["projects:read"],
         "x-account-membership": "required",
         "responses": {
@@ -1059,7 +1353,11 @@
         "summary": "Normalize and retain one environment-owned notification image",
         "description": "Accepts one bounded raw PNG, validates and re-encodes it as canonical\nRGBA PNG bytes, and retains the immutable asset for a 30-day admission\nwindow. The service never fetches a customer URL. An equivalent replay\nreturns the original asset with `200`; a new asset returns `201`.\n",
         "tags": ["Messages"],
-        "security": [{ "bearerCredential": [] }, { "bearerGrant": [] }],
+        "security": [
+          { "bearerCredential": [] },
+          { "bearerGrant": [] },
+          { "bearerAccountCredential": [] }
+        ],
         "x-required-scopes": ["messages:write"],
         "x-idempotency": {
           "required": true,
@@ -1146,7 +1444,11 @@
         "summary": "Delete one environment-owned notification image",
         "description": "Immediately prevents new notification references. Repeating deletion\nof an asset already deleted in this exact scope remains successful;\nunknown and foreign identifiers return the same non-enumerating `404`.\nAccepted notifications retain their existing delivery lease.\n",
         "tags": ["Messages"],
-        "security": [{ "bearerCredential": [] }, { "bearerGrant": [] }],
+        "security": [
+          { "bearerCredential": [] },
+          { "bearerGrant": [] },
+          { "bearerAccountCredential": [] }
+        ],
         "x-required-scopes": ["messages:write"],
         "x-repeat-semantics": {
           "same_target": "idempotent",
@@ -2282,7 +2584,8 @@
         "security": [
           { "clerkSession": [] },
           { "bearerCredential": [] },
-          { "bearerGrant": [] }
+          { "bearerGrant": [] },
+          { "bearerAccountCredential": [] }
         ],
         "x-required-scopes": ["messages:read"],
         "parameters": [
@@ -2355,7 +2658,8 @@
         "security": [
           { "clerkSession": [] },
           { "bearerCredential": [] },
-          { "bearerGrant": [] }
+          { "bearerGrant": [] },
+          { "bearerAccountCredential": [] }
         ],
         "x-required-scopes": ["messages:write"],
         "x-idempotency": {
@@ -2488,7 +2792,8 @@
         "security": [
           { "clerkSession": [] },
           { "bearerCredential": [] },
-          { "bearerGrant": [] }
+          { "bearerGrant": [] },
+          { "bearerAccountCredential": [] }
         ],
         "x-required-scopes": ["messages:read"],
         "responses": {
@@ -2519,7 +2824,8 @@
         "security": [
           { "clerkSession": [] },
           { "bearerCredential": [] },
-          { "bearerGrant": [] }
+          { "bearerGrant": [] },
+          { "bearerAccountCredential": [] }
         ],
         "x-required-scopes": ["messages:write"],
         "responses": {
@@ -2552,7 +2858,8 @@
         "security": [
           { "clerkSession": [] },
           { "bearerCredential": [] },
-          { "bearerGrant": [] }
+          { "bearerGrant": [] },
+          { "bearerAccountCredential": [] }
         ],
         "x-required-scopes": ["messages:write"],
         "x-idempotency": {
@@ -2655,7 +2962,8 @@
         "security": [
           { "clerkSession": [] },
           { "bearerCredential": [] },
-          { "bearerGrant": [] }
+          { "bearerGrant": [] },
+          { "bearerAccountCredential": [] }
         ],
         "x-required-scopes": ["messages:write"],
         "x-repeat-semantics": {
@@ -2691,7 +2999,8 @@
         "security": [
           { "clerkSession": [] },
           { "bearerCredential": [] },
-          { "bearerGrant": [] }
+          { "bearerGrant": [] },
+          { "bearerAccountCredential": [] }
         ],
         "x-required-scopes": ["messages:read"],
         "parameters": [
@@ -2751,7 +3060,8 @@
         "security": [
           { "clerkSession": [] },
           { "bearerCredential": [] },
-          { "bearerGrant": [] }
+          { "bearerGrant": [] },
+          { "bearerAccountCredential": [] }
         ],
         "x-required-scopes": ["connections:read"],
         "responses": {
@@ -2825,7 +3135,8 @@
         "security": [
           { "clerkSession": [] },
           { "bearerCredential": [] },
-          { "bearerGrant": [] }
+          { "bearerGrant": [] },
+          { "bearerAccountCredential": [] }
         ],
         "x-required-scopes": ["connections:read"],
         "parameters": [
@@ -2895,7 +3206,8 @@
         "security": [
           { "clerkSession": [] },
           { "bearerCredential": [] },
-          { "bearerGrant": [] }
+          { "bearerGrant": [] },
+          { "bearerAccountCredential": [] }
         ],
         "x-required-scopes": ["connections:write"],
         "x-idempotency": {
@@ -3084,7 +3396,8 @@
         "security": [
           { "clerkSession": [] },
           { "bearerCredential": [] },
-          { "bearerGrant": [] }
+          { "bearerGrant": [] },
+          { "bearerAccountCredential": [] }
         ],
         "x-required-scopes": ["connections:read"],
         "responses": {
@@ -3162,7 +3475,8 @@
         "security": [
           { "clerkSession": [] },
           { "bearerCredential": [] },
-          { "bearerGrant": [] }
+          { "bearerGrant": [] },
+          { "bearerAccountCredential": [] }
         ],
         "x-required-scopes": ["connections:write"],
         "requestBody": {
@@ -3214,7 +3528,8 @@
         "security": [
           { "clerkSession": [] },
           { "bearerCredential": [] },
-          { "bearerGrant": [] }
+          { "bearerGrant": [] },
+          { "bearerAccountCredential": [] }
         ],
         "x-required-scopes": ["connections:write"],
         "responses": {
@@ -3274,7 +3589,8 @@
         "security": [
           { "clerkSession": [] },
           { "bearerCredential": [] },
-          { "bearerGrant": [] }
+          { "bearerGrant": [] },
+          { "bearerAccountCredential": [] }
         ],
         "x-required-scopes": ["connections:write"],
         "responses": {
@@ -3342,7 +3658,8 @@
         "security": [
           { "clerkSession": [] },
           { "bearerCredential": [] },
-          { "bearerGrant": [] }
+          { "bearerGrant": [] },
+          { "bearerAccountCredential": [] }
         ],
         "x-required-scopes": ["connections:write"],
         "x-idempotency": {
@@ -3385,13 +3702,14 @@
       ],
       "post": {
         "operationId": "restartChannelConnectionSetup",
-        "summary": "Start a fresh managed setup on a connection that never finished one",
-        "description": "Issues a new handoff for a `customer_managed` connection whose guided\nsetup expired, failed, or was simply abandoned, and returns the same\nconnection carrying a fresh `setup`. The connection is reused rather\nthan replaced because it is still `pending`: nothing was ever\nprovisioned under it, no identity was claimed, and no subscriber ever\nconsented to anything through it.\n\nRestart takes no body. The suggested identity recorded when the\nconnection was created is what the new attempt proposes again, so a\ncaller resuming a half-finished setup cannot accidentally rename a bot\nan administrator was already looking at. A different suggestion means\na different connection.\n\nRepeating the call is safe. A setup that is still live is returned as\nit stands rather than being replaced, so two dashboard tabs converge\non one session instead of racing to strand each other's link, and only\na session that can no longer be used is exchanged for a new one.\n\nA bot the previous attempt already created is not withdrawn and cannot\nbe: Telegram exposes no way to delete a bot. The administrator keeps it\nin their own account until they retire it in BotFather, and a restart\nwalks them through creating another rather than pretending the first\nnever happened.\n\nRefusals reuse the closed Problem vocabulary and differ by\n`field_errors[].code`:\n\n- the connection did not come from guided setup, so there is no setup\n  to restart — `idempotency_conflict` 409, `setup_not_managed` at `/`;\n- the connection already finished setup, or is archived, so restarting\n  would offer a second identity for something subscribers may already\n  be bound to — `idempotency_conflict` 409,\n  `invalid_connection_transition` at `/`;\n- the provider could not be reached, so whether a new session exists is\n  genuinely unknown — `provider_outcome_unknown` 502; read the\n  connection before calling again;\n- the provider rate-limited the call — `provider_retryable` 503 with\n  `retry_at`.\n",
+        "summary": "Start a fresh setup on a connection that never finished one",
+        "description": "Issues a new guided setup for a `customer_managed` connection whose\nsetup expired, failed, or was simply abandoned. Nothing was ever\nprovisioned under it, no identity was claimed, and no subscriber ever\nconsented to anything through it, so nothing is lost.\n\n**Telegram reuses the connection and answers `200`.** A fresh `setup`\nappears on the same resource.\n\n**Customer-owned Slack replaces the connection and answers `201`.** The\nabandoned connection is archived and a new one is returned, carrying a\nnew `app_setup` and a new creation link. The connection cannot be\nreused, because Slack bakes this deployment's request URLs into the app\nat the moment it is created and they are not ours to change afterwards:\na second setup on one connection would mean two Slack apps answering to\none address. **Read `id` on the response** — the connection you were\npolling is now archived. A Slack app the previous attempt already\ncreated is not withdrawn and cannot be; it is the customer's, and they\ndelete it in Slack when they are ready.\n\nEntering the three app-specific values again is not a restart, and does\nnot need one. `rotate-credential` replaces them on the connection that\nalready exists.\n\nRestart takes no body. The suggested identity recorded when the\nconnection was created is what the new attempt proposes again, so a\ncaller resuming a half-finished setup cannot accidentally rename a bot\nan administrator was already looking at. A different suggestion means\na different connection.\n\nRepeating the call is safe. A setup that is still live is returned as\nit stands rather than being replaced, so two dashboard tabs converge\non one session instead of racing to strand each other's link, and only\na session that can no longer be used is exchanged for a new one.\n\nA bot the previous attempt already created is not withdrawn and cannot\nbe: Telegram exposes no way to delete a bot. The administrator keeps it\nin their own account until they retire it in BotFather, and a restart\nwalks them through creating another rather than pretending the first\nnever happened.\n\nRefusals reuse the closed Problem vocabulary and differ by\n`field_errors[].code`:\n\n- the connection did not come from guided setup, so there is no setup\n  to restart — `idempotency_conflict` 409, `setup_not_managed` at `/`;\n- the connection already finished setup, or is archived, so restarting\n  would offer a second identity for something subscribers may already\n  be bound to — `idempotency_conflict` 409,\n  `invalid_connection_transition` at `/`;\n- the provider could not be reached, so whether a new session exists is\n  genuinely unknown — `provider_outcome_unknown` 502; read the\n  connection before calling again;\n- the provider rate-limited the call — `provider_retryable` 503 with\n  `retry_at`.\n",
         "tags": ["Channel connections"],
         "security": [
           { "clerkSession": [] },
           { "bearerCredential": [] },
-          { "bearerGrant": [] }
+          { "bearerGrant": [] },
+          { "bearerAccountCredential": [] }
         ],
         "x-required-scopes": ["connections:write"],
         "x-repeat-semantics": {
@@ -3439,9 +3757,62 @@
               }
             }
           },
-          "401": { "$ref": "#/components/responses/Unauthorized" },
-          "403": { "$ref": "#/components/responses/Forbidden" },
-          "404": { "$ref": "#/components/responses/NotFound" },
+          "201": {
+            "description": "A replacement connection carrying a fresh setup, for a\ncustomer-owned Slack app whose request URLs cannot be re-pointed.\nThe connection named in the request is now archived.\n",
+            "headers": {
+              "WhooshBang-Diagnostic-Id": {
+                "$ref": "#/components/headers/DiagnosticId"
+              }
+            },
+            "content": {
+              "application/json": {
+                "schema": { "$ref": "#/components/schemas/ChannelConnection" },
+                "examples": {
+                  "setupReplaced": {
+                    "value": {
+                      "id": "chcon_77777777777777777777777777777777",
+                      "project_id": "project_synthetic_alpha",
+                      "environment_id": "environment_test_synthetic_alpha",
+                      "environment": "test",
+                      "provider": "slack",
+                      "mode": "customer_managed",
+                      "display_name": "Acme Slack",
+                      "status": "pending",
+                      "health": "unknown",
+                      "installation": {
+                        "display_name": "Slack app not yet created",
+                        "health": "unknown",
+                        "status": "pending"
+                      },
+                      "capabilities": [],
+                      "recovery_action": "complete_authorization",
+                      "app_setup": {
+                        "status": "awaiting_authorities",
+                        "creation_url": "https://api.slack.com/apps?new_app=1&manifest_json=%7B%22_metadata%22%3A%7B%22major_version%22%3A1%7D%7D",
+                        "expires_at": "2026-09-01T12:30:00.000Z",
+                        "app_name": "Acme Notifications",
+                        "bot_display_name": "Acme Notify",
+                        "outstanding_authorities": [
+                          "client_identity",
+                          "client_secret",
+                          "signing_secret"
+                        ]
+                      },
+                      "row_version": 1,
+                      "created_at": "2026-09-01T12:00:00.000Z",
+                      "updated_at": "2026-09-01T12:00:00.000Z",
+                      "last_transition_at": "2026-09-01T12:00:00.000Z",
+                      "last_transition_reason": "slack_setup_awaiting_authorities",
+                      "diagnostic_id": "diag_slack_customer_pending_001"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "401": { "$ref": "#/components/responses/Unauthorized" },
+          "403": { "$ref": "#/components/responses/Forbidden" },
+          "404": { "$ref": "#/components/responses/NotFound" },
           "409": { "$ref": "#/components/responses/Conflict" },
           "502": { "$ref": "#/components/responses/ProviderOutcomeUnknown" },
           "503": { "$ref": "#/components/responses/ProviderRetryable" }
@@ -3462,7 +3833,8 @@
         "security": [
           { "clerkSession": [] },
           { "bearerCredential": [] },
-          { "bearerGrant": [] }
+          { "bearerGrant": [] },
+          { "bearerAccountCredential": [] }
         ],
         "x-required-scopes": ["connections:write"],
         "requestBody": {
@@ -3573,7 +3945,8 @@
         "security": [
           { "clerkSession": [] },
           { "bearerCredential": [] },
-          { "bearerGrant": [] }
+          { "bearerGrant": [] },
+          { "bearerAccountCredential": [] }
         ],
         "x-required-scopes": ["connections:write"],
         "responses": {
@@ -3639,7 +4012,8 @@
         "security": [
           { "clerkSession": [] },
           { "bearerCredential": [] },
-          { "bearerGrant": [] }
+          { "bearerGrant": [] },
+          { "bearerAccountCredential": [] }
         ],
         "x-required-scopes": ["connections:write"],
         "responses": {
@@ -3691,6 +4065,352 @@
         }
       }
     },
+    "/v1/projects/{project_id}/environments/{environment_id}/channel-connections/{connection_id}/app-manifest": {
+      "parameters": [
+        { "$ref": "#/components/parameters/ProjectId" },
+        { "$ref": "#/components/parameters/EnvironmentId" },
+        { "$ref": "#/components/parameters/ChannelConnectionId" }
+      ],
+      "get": {
+        "operationId": "getChannelConnectionAppManifest",
+        "summary": "Read the generated app configuration a customer-owned setup will create",
+        "description": "Returns the exact configuration WhooshBang generated for this\ncustomer-owned Slack setup — the scopes it will ask for, the request\nURLs it will point at, the literal manifest document, and the same\nprefilled creation link the setup already carries.\n\nIt exists so the owner can read what they are about to approve, and a\nreviewer can check it, without opening Slack or decoding a URL. It\ncarries configuration only: no account, project, or environment, no\ncredential, and no provider-native identifier.\n\nOnly a `customer_managed` Slack connection has one. Every other\nprovider and mode answers `404`, because a manifest they do not have is\nnot a manifest that is empty.\n",
+        "tags": ["Channel connections"],
+        "security": [
+          { "clerkSession": [] },
+          { "bearerCredential": [] },
+          { "bearerGrant": [] },
+          { "bearerAccountCredential": [] }
+        ],
+        "x-required-scopes": ["connections:read"],
+        "responses": {
+          "200": {
+            "description": "The generated app configuration for exactly this setup.",
+            "headers": {
+              "WhooshBang-Diagnostic-Id": {
+                "$ref": "#/components/headers/DiagnosticId"
+              }
+            },
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/CustomerOwnedSlackAppManifest"
+                },
+                "examples": {
+                  "manifest": {
+                    "value": {
+                      "creation_url": "https://api.slack.com/apps?new_app=1&manifest_json=%7B%22_metadata%22%3A%7B%22major_version%22%3A1%7D%7D",
+                      "app_name": "Acme Notifications",
+                      "bot_display_name": "Acme Notify",
+                      "description": "Delivery notifications from Acme.",
+                      "bot_scopes": ["chat:write"],
+                      "user_scopes": ["openid"],
+                      "request_urls": {
+                        "events": "https://api.whooshbang.com/internal/webhooks/slack/apps/CTBQNURSpqxDgLcqvbEDcA/events",
+                        "interactions": "https://api.whooshbang.com/internal/webhooks/slack/apps/CTBQNURSpqxDgLcqvbEDcA/interactions",
+                        "installation_redirect": "https://api.whooshbang.com/v1/provider-authorizations/slack/apps/callback",
+                        "recipient_redirect": "https://api.whooshbang.com/v1/provider-authorizations/slack/apps/recipient/callback"
+                      },
+                      "manifest": {
+                        "_metadata": { "major_version": 1, "minor_version": 1 },
+                        "display_information": {
+                          "name": "Acme Notifications",
+                          "description": "Delivery notifications from Acme."
+                        },
+                        "features": {
+                          "app_home": {
+                            "home_tab_enabled": true,
+                            "messages_tab_enabled": true,
+                            "messages_tab_read_only_enabled": true
+                          },
+                          "bot_user": {
+                            "display_name": "Acme Notify",
+                            "always_online": false
+                          }
+                        },
+                        "oauth_config": {
+                          "pkce_enabled": false,
+                          "redirect_urls": [
+                            "https://api.whooshbang.com/v1/provider-authorizations/slack/apps/callback",
+                            "https://api.whooshbang.com/v1/provider-authorizations/slack/apps/recipient/callback"
+                          ],
+                          "scopes": {
+                            "bot": ["chat:write"],
+                            "user": ["openid"]
+                          }
+                        },
+                        "settings": {
+                          "event_subscriptions": {
+                            "request_url": "https://api.whooshbang.com/internal/webhooks/slack/apps/CTBQNURSpqxDgLcqvbEDcA/events",
+                            "bot_events": [
+                              "app_home_opened",
+                              "app_uninstalled",
+                              "tokens_revoked"
+                            ]
+                          },
+                          "interactivity": {
+                            "is_enabled": true,
+                            "request_url": "https://api.whooshbang.com/internal/webhooks/slack/apps/CTBQNURSpqxDgLcqvbEDcA/interactions"
+                          },
+                          "is_hosted": false,
+                          "is_mcp_enabled": false,
+                          "org_deploy_enabled": false,
+                          "socket_mode_enabled": false,
+                          "token_rotation_enabled": true
+                        }
+                      },
+                      "diagnostic_id": "diag_slack_app_manifest_001"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "401": { "$ref": "#/components/responses/Unauthorized" },
+          "403": { "$ref": "#/components/responses/Forbidden" },
+          "404": { "$ref": "#/components/responses/NotFound" }
+        }
+      }
+    },
+    "/v1/projects/{project_id}/environments/{environment_id}/channel-connections/{connection_id}/tests": {
+      "parameters": [
+        { "$ref": "#/components/parameters/ProjectId" },
+        { "$ref": "#/components/parameters/EnvironmentId" },
+        { "$ref": "#/components/parameters/ChannelConnectionId" }
+      ],
+      "get": {
+        "operationId": "listConnectionTests",
+        "summary": "List this connection's recent owner-triggered tests",
+        "description": "Newest first. This is the audit-safe failure history for one\nconnection: what was tried, when, what came back, and what to do about\nit. Every entry is safe to render, log, and paste into an issue.\n",
+        "tags": ["Channel connections"],
+        "security": [
+          { "clerkSession": [] },
+          { "bearerCredential": [] },
+          { "bearerGrant": [] },
+          { "bearerAccountCredential": [] }
+        ],
+        "x-required-scopes": ["connections:read"],
+        "parameters": [
+          { "$ref": "#/components/parameters/ListAfterCursor" },
+          { "$ref": "#/components/parameters/ListPageLimit" },
+          { "$ref": "#/components/parameters/PageNumber" }
+        ],
+        "responses": {
+          "200": {
+            "description": "Tests placed against exactly this connection.",
+            "headers": {
+              "WhooshBang-Diagnostic-Id": {
+                "$ref": "#/components/headers/DiagnosticId"
+              }
+            },
+            "content": {
+              "application/json": {
+                "schema": {
+                  "$ref": "#/components/schemas/ConnectionTestCollection"
+                },
+                "examples": {
+                  "tests": {
+                    "value": {
+                      "items": [
+                        {
+                          "id": "cntest_11111111111111111111111111111111",
+                          "connection_id": "chcon_77777777777777777777777777777777",
+                          "kind": "signed_interaction",
+                          "status": "succeeded",
+                          "requested_at": "2026-09-02T09:00:00.000Z",
+                          "completed_at": "2026-09-02T09:00:22.000Z",
+                          "expires_at": "2026-09-02T09:15:00.000Z",
+                          "evidence": {
+                            "identity_handle": "Acme Notify",
+                            "workspace_display_name": "Acme",
+                            "accepted_at": "2026-09-02T09:00:01.000Z",
+                            "observed_at": "2026-09-02T09:00:22.000Z",
+                            "round_trip_ms": 22000,
+                            "signature_verified": true,
+                            "ingress_host": "api.whooshbang.com"
+                          },
+                          "recovery_action": "none",
+                          "diagnostic_id": "diag_connection_test_succeeded_001"
+                        },
+                        {
+                          "id": "cntest_22222222222222222222222222222222",
+                          "connection_id": "chcon_77777777777777777777777777777777",
+                          "kind": "outbound_notification",
+                          "status": "failed",
+                          "requested_at": "2026-09-02T08:40:00.000Z",
+                          "completed_at": "2026-09-02T08:40:02.000Z",
+                          "expires_at": "2026-09-02T08:55:00.000Z",
+                          "failure_code": "credential_unavailable",
+                          "recovery_action": "reinstall",
+                          "diagnostic_id": "diag_connection_test_failed_001"
+                        }
+                      ],
+                      "page": 1,
+                      "page_size": 25,
+                      "total": 2
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "401": { "$ref": "#/components/responses/Unauthorized" },
+          "403": { "$ref": "#/components/responses/Forbidden" },
+          "404": { "$ref": "#/components/responses/NotFound" }
+        }
+      },
+      "post": {
+        "operationId": "createConnectionTest",
+        "summary": "Prove this exact connection still works",
+        "description": "Runs one test against one connection, on demand, and answers with what\nit observed rather than with a claim.\n\nAvailable on any Slack connection, whether the app is one the customer\nowns or the one WhooshBang operates. Every other provider and mode is\nrefused rather than reporting a pass it never ran.\n\n**A test addresses the workspace member who authorized this exact\nconnection, and nobody else.** For an app the customer owns that is the\nperson who installed it, once, for one connection. The\nWhooshBang-operated app's installation is shared across tenants, so\n\"whoever installed the app\" is not necessarily anybody the calling\ntenant named; what is recorded instead is the member who approved this\nenvironment's own connection, during its own authorization, and each\nlater authorization replaces it. One tenant therefore cannot cause a\nmessage to somebody another tenant authorized.\n\n`outbound_notification` sends one visible private message through this\nexact identity to that member, and settles when the provider accepts\nit. Nobody else can be addressed: a test cannot reach a channel, and it\ncannot reach a subscriber who has not authorized anything.\n\n`signed_interaction` sends that person a message with one button and\nthen waits. It settles when the provider calls this deployment's\ninteractivity URL and the signature over the untouched body verifies\nagainst the secret this connection custodies — the only proof that the\nsigning secret, the request URL, and public reachability are all\ncorrect at once. A window that closes with nothing arriving settles as\n`expired`, which says nobody pressed it, and a request that arrives and\ndoes not verify settles as `failed` with `unverified_request_received`.\n\nThe response is the placed test. An `outbound_notification` is usually\nalready settled when it returns; a `signed_interaction` is `pending`\nuntil somebody presses the button, so read it again or list this\nconnection's tests.\n\n**A provider failure is an answer, not a refusal.** If the connection\nhas not finished setup, or its grant is unavailable, or Slack refuses,\nrate-limits, or cannot be reached, the test is **recorded** and answers\n`201` carrying `status: failed`, a `failure_code` and a\n`recovery_action`. There is no `502` or `503` on this operation, and\nthat is deliberate: a diagnostic that leaves no trace is the one thing\nan audit-safe failure history cannot have, so the failure goes in the\nhistory rather than into a problem document nobody keeps.\n\nThree things are refused outright, because none describes a test that\nran: the connection is archived, it is not a Slack connection, or it is\na WhooshBang-operated Slack connection whose authorization has been\nrevoked — `idempotency_conflict` 409, `invalid_connection_transition`\nat `/`. A connection that has never recorded who authorized it is not\nrefused: it is a recorded failure with\n`verification_target_unknown`, because there is nobody a test could\nhonestly address.\n\nA test never carries customer notification content, never counts as a\ndelivery to a subscriber, and never changes what any subscriber\nreceives.\n",
+        "tags": ["Channel connections"],
+        "security": [
+          { "clerkSession": [] },
+          { "bearerCredential": [] },
+          { "bearerGrant": [] },
+          { "bearerAccountCredential": [] }
+        ],
+        "x-required-scopes": ["connections:write"],
+        "x-idempotency": {
+          "required": true,
+          "retention_seconds": 604800,
+          "scope": ["authenticated_environment", "operation_id", "key"],
+          "equivalence": "exact_request_body",
+          "replay_retention_extends": false
+        },
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/CreateConnectionTestRequest"
+              },
+              "examples": {
+                "signedInteraction": {
+                  "value": { "kind": "signed_interaction" }
+                }
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "The equivalent test an idempotent replay already placed.",
+            "headers": {
+              "WhooshBang-Diagnostic-Id": {
+                "$ref": "#/components/headers/DiagnosticId"
+              }
+            },
+            "content": {
+              "application/json": {
+                "schema": { "$ref": "#/components/schemas/ConnectionTest" }
+              }
+            }
+          },
+          "201": {
+            "description": "The placed test, settled if it could settle immediately.",
+            "headers": {
+              "WhooshBang-Diagnostic-Id": {
+                "$ref": "#/components/headers/DiagnosticId"
+              }
+            },
+            "content": {
+              "application/json": {
+                "schema": { "$ref": "#/components/schemas/ConnectionTest" },
+                "examples": {
+                  "pending": {
+                    "value": {
+                      "id": "cntest_11111111111111111111111111111111",
+                      "connection_id": "chcon_77777777777777777777777777777777",
+                      "kind": "signed_interaction",
+                      "status": "pending",
+                      "requested_at": "2026-09-02T09:00:00.000Z",
+                      "expires_at": "2026-09-02T09:15:00.000Z",
+                      "evidence": {
+                        "identity_handle": "Acme Notify",
+                        "workspace_display_name": "Acme",
+                        "accepted_at": "2026-09-02T09:00:01.000Z",
+                        "ingress_host": "api.whooshbang.com"
+                      },
+                      "recovery_action": "none",
+                      "diagnostic_id": "diag_connection_test_pending_001"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "400": { "$ref": "#/components/responses/BadRequest" },
+          "401": { "$ref": "#/components/responses/Unauthorized" },
+          "403": { "$ref": "#/components/responses/Forbidden" },
+          "404": { "$ref": "#/components/responses/NotFound" },
+          "409": { "$ref": "#/components/responses/Conflict" }
+        }
+      }
+    },
+    "/v1/projects/{project_id}/environments/{environment_id}/channel-connections/{connection_id}/tests/{test_id}": {
+      "parameters": [
+        { "$ref": "#/components/parameters/ProjectId" },
+        { "$ref": "#/components/parameters/EnvironmentId" },
+        { "$ref": "#/components/parameters/ChannelConnectionId" },
+        { "$ref": "#/components/parameters/ConnectionTestId" }
+      ],
+      "get": {
+        "operationId": "getConnectionTest",
+        "summary": "Read one owner-triggered connection test",
+        "description": "The durable answer to one test. A `signed_interaction` is read again\nhere until it settles; a pending test whose window has closed reads as\n`expired` on the way out rather than waiting for a sweep, so the status\nthe owner sees is the one they actually have.\n",
+        "tags": ["Channel connections"],
+        "security": [
+          { "clerkSession": [] },
+          { "bearerCredential": [] },
+          { "bearerGrant": [] },
+          { "bearerAccountCredential": [] }
+        ],
+        "x-required-scopes": ["connections:read"],
+        "responses": {
+          "200": {
+            "description": "The exact test.",
+            "headers": {
+              "WhooshBang-Diagnostic-Id": {
+                "$ref": "#/components/headers/DiagnosticId"
+              }
+            },
+            "content": {
+              "application/json": {
+                "schema": { "$ref": "#/components/schemas/ConnectionTest" },
+                "examples": {
+                  "succeeded": {
+                    "value": {
+                      "id": "cntest_11111111111111111111111111111111",
+                      "connection_id": "chcon_77777777777777777777777777777777",
+                      "kind": "signed_interaction",
+                      "status": "succeeded",
+                      "requested_at": "2026-09-02T09:00:00.000Z",
+                      "completed_at": "2026-09-02T09:00:22.000Z",
+                      "expires_at": "2026-09-02T09:15:00.000Z",
+                      "evidence": {
+                        "identity_handle": "Acme Notify",
+                        "workspace_display_name": "Acme",
+                        "accepted_at": "2026-09-02T09:00:01.000Z",
+                        "observed_at": "2026-09-02T09:00:22.000Z",
+                        "round_trip_ms": 22000,
+                        "signature_verified": true,
+                        "ingress_host": "api.whooshbang.com"
+                      },
+                      "recovery_action": "none",
+                      "diagnostic_id": "diag_connection_test_succeeded_001"
+                    }
+                  }
+                }
+              }
+            }
+          },
+          "401": { "$ref": "#/components/responses/Unauthorized" },
+          "403": { "$ref": "#/components/responses/Forbidden" },
+          "404": { "$ref": "#/components/responses/NotFound" }
+        }
+      }
+    },
     "/v1/projects/{project_id}/environments/{environment_id}/notifier-connections": {
       "parameters": [
         { "$ref": "#/components/parameters/ProjectId" },
@@ -3704,7 +4424,8 @@
         "security": [
           { "clerkSession": [] },
           { "bearerCredential": [] },
-          { "bearerGrant": [] }
+          { "bearerGrant": [] },
+          { "bearerAccountCredential": [] }
         ],
         "x-required-scopes": ["connections:read"],
         "parameters": [
@@ -3762,7 +4483,8 @@
         "security": [
           { "clerkSession": [] },
           { "bearerCredential": [] },
-          { "bearerGrant": [] }
+          { "bearerGrant": [] },
+          { "bearerAccountCredential": [] }
         ],
         "x-required-scopes": ["connections:write"],
         "requestBody": {
@@ -3843,7 +4565,8 @@
         "security": [
           { "clerkSession": [] },
           { "bearerCredential": [] },
-          { "bearerGrant": [] }
+          { "bearerGrant": [] },
+          { "bearerAccountCredential": [] }
         ],
         "x-required-scopes": ["connections:write"],
         "responses": {
@@ -4055,7 +4778,8 @@
         "security": [
           { "clerkSession": [] },
           { "bearerGrant": [] },
-          { "bearerCredential": [] }
+          { "bearerCredential": [] },
+          { "bearerAccountCredential": [] }
         ],
         "x-required-scopes": ["projects:read"],
         "x-account-membership": "required",
@@ -4103,7 +4827,8 @@
         "security": [
           { "clerkSession": [] },
           { "bearerGrant": [] },
-          { "bearerCredential": [] }
+          { "bearerCredential": [] },
+          { "bearerAccountCredential": [] }
         ],
         "x-required-scopes": ["projects:write"],
         "x-account-membership": "required",
@@ -5279,7 +6004,7 @@
         "summary": "Create a subscription link in a named project environment",
         "description": "The environment-scoped form of `createSubscriptionLink`, for a caller\nwhose authority selects an account rather than a project. Behavior,\nrequest, and response are identical; the path names the scope the\ncredential form takes from its bearer, and the service checks it\nagainst the granting person's membership before acting.\n",
         "tags": ["Subscription links"],
-        "security": [{ "bearerGrant": [] }],
+        "security": [{ "bearerGrant": [] }, { "bearerAccountCredential": [] }],
         "x-required-scopes": ["subscriptions:write"],
         "x-idempotency": {
           "required": true,
@@ -5361,7 +6086,7 @@
         "summary": "Inspect a subscription link in a named project environment",
         "description": "The environment-scoped form of `getSubscriptionLink`. A link outside the\nnamed environment is absent, exactly as it is for a credential.\n",
         "tags": ["Subscription links"],
-        "security": [{ "bearerGrant": [] }],
+        "security": [{ "bearerGrant": [] }, { "bearerAccountCredential": [] }],
         "x-required-scopes": ["subscriptions:read"],
         "responses": {
           "200": {
@@ -5431,7 +6156,7 @@
         "summary": "Create an asynchronous message in a named project environment",
         "description": "The environment-scoped form of `createMessage`. The path names the\naccount, project, and environment the credential form takes from its\nbearer; test and live remain a property of the named environment and are\nnever selected by the request body.\n",
         "tags": ["Messages"],
-        "security": [{ "bearerGrant": [] }],
+        "security": [{ "bearerGrant": [] }, { "bearerAccountCredential": [] }],
         "x-required-scopes": ["messages:write"],
         "x-idempotency": {
           "required": true,
@@ -5520,7 +6245,7 @@
           { "$ref": "#/components/parameters/ResponseInspectionWait" }
         ],
         "tags": ["Messages"],
-        "security": [{ "bearerGrant": [] }],
+        "security": [{ "bearerGrant": [] }, { "bearerAccountCredential": [] }],
         "x-required-scopes": ["messages:read"],
         "responses": {
           "200": {
@@ -5591,7 +6316,7 @@
           { "$ref": "#/components/parameters/ResponseInspectionWait" }
         ],
         "tags": ["Messages"],
-        "security": [{ "bearerGrant": [] }],
+        "security": [{ "bearerGrant": [] }, { "bearerAccountCredential": [] }],
         "x-required-scopes": ["messages:read"],
         "responses": {
           "200": {
@@ -5639,7 +6364,7 @@
         "summary": "Create a destination-bound machine client in a named project environment",
         "description": "The environment-scoped form of `createMachineClient`. Scope remains the\nexact bound destination; the path only names where the client is created.\n",
         "tags": ["Machine clients"],
-        "security": [{ "bearerGrant": [] }],
+        "security": [{ "bearerGrant": [] }, { "bearerAccountCredential": [] }],
         "x-required-scopes": ["machine-clients:write"],
         "x-idempotency": {
           "required": true,
@@ -5706,24 +6431,91 @@
         }
       }
     },
-    "/v1/projects/{project_id}/environments/{environment_id}/capabilities": {
+    "/v1/projects/{project_id}/environments/{environment_id}/machine-clients/{machine_client_id}/credentials": {
       "parameters": [
         { "$ref": "#/components/parameters/ProjectId" },
-        { "$ref": "#/components/parameters/EnvironmentId" }
+        { "$ref": "#/components/parameters/EnvironmentId" },
+        { "$ref": "#/components/parameters/MachineClientId" }
       ],
-      "get": {
-        "operationId": "getCapabilitiesInEnvironment",
-        "summary": "Inspect provider-neutral capabilities for a named project environment",
-        "description": "The environment-scoped form of `getCapabilities`. The vocabulary is\nprovider-neutral and identical; the path names the environment whose\nactive degradation is reported.\n",
-        "tags": ["Capabilities"],
-        "security": [{ "bearerGrant": [] }],
-        "x-required-scopes": ["capabilities:read"],
-        "responses": {
-          "200": {
-            "description": "Current stable capability vocabulary and active degradation.",
-            "headers": {
-              "WhooshBang-Diagnostic-Id": {
-                "$ref": "#/components/headers/DiagnosticId"
+      "post": {
+        "operationId": "registerMachineCredentialInEnvironment",
+        "summary": "Register a machine-credential digest in a named project environment",
+        "description": "The environment-scoped form of `registerMachineCredential`. Registers\nonly the credential ID and SHA-256 digest; the path only names where the\nowning machine client lives. Request and response shapes are that\noperation's exactly, including its published examples.\n",
+        "tags": ["Machine clients"],
+        "security": [{ "bearerGrant": [] }, { "bearerAccountCredential": [] }],
+        "x-required-scopes": ["machine-clients:write"],
+        "x-idempotency": {
+          "required": true,
+          "retention_seconds": 604800,
+          "scope": ["authenticated_environment", "operation_id", "key"],
+          "equivalence": "validated_request_after_documented_defaults",
+          "replay_retention_extends": false
+        },
+        "parameters": [{ "$ref": "#/components/parameters/IdempotencyKey" }],
+        "requestBody": {
+          "required": true,
+          "content": {
+            "application/json": {
+              "schema": {
+                "$ref": "#/components/schemas/RegisterMachineCredentialRequest"
+              }
+            }
+          }
+        },
+        "responses": {
+          "200": {
+            "description": "Existing safe credential metadata on an equivalent registration replay; never secret or digest.",
+            "headers": {
+              "WhooshBang-Diagnostic-Id": {
+                "$ref": "#/components/headers/DiagnosticId"
+              }
+            },
+            "content": {
+              "application/json": {
+                "schema": { "$ref": "#/components/schemas/MachineCredential" }
+              }
+            }
+          },
+          "201": {
+            "description": "Newly registered safe credential metadata; never secret or digest.",
+            "headers": {
+              "WhooshBang-Diagnostic-Id": {
+                "$ref": "#/components/headers/DiagnosticId"
+              }
+            },
+            "content": {
+              "application/json": {
+                "schema": { "$ref": "#/components/schemas/MachineCredential" }
+              }
+            }
+          },
+          "400": { "$ref": "#/components/responses/BadRequest" },
+          "401": { "$ref": "#/components/responses/Unauthorized" },
+          "403": { "$ref": "#/components/responses/Forbidden" },
+          "404": { "$ref": "#/components/responses/NotFound" },
+          "409": { "$ref": "#/components/responses/Conflict" },
+          "429": { "$ref": "#/components/responses/RateLimited" }
+        }
+      }
+    },
+    "/v1/projects/{project_id}/environments/{environment_id}/capabilities": {
+      "parameters": [
+        { "$ref": "#/components/parameters/ProjectId" },
+        { "$ref": "#/components/parameters/EnvironmentId" }
+      ],
+      "get": {
+        "operationId": "getCapabilitiesInEnvironment",
+        "summary": "Inspect provider-neutral capabilities for a named project environment",
+        "description": "The environment-scoped form of `getCapabilities`. The vocabulary is\nprovider-neutral and identical; the path names the environment whose\nactive degradation is reported.\n",
+        "tags": ["Capabilities"],
+        "security": [{ "bearerGrant": [] }, { "bearerAccountCredential": [] }],
+        "x-required-scopes": ["capabilities:read"],
+        "responses": {
+          "200": {
+            "description": "Current stable capability vocabulary and active degradation.",
+            "headers": {
+              "WhooshBang-Diagnostic-Id": {
+                "$ref": "#/components/headers/DiagnosticId"
               }
             },
             "content": {
@@ -5803,7 +6595,8 @@
         "security": [
           { "clerkSession": [] },
           { "bearerCredential": [] },
-          { "bearerGrant": [] }
+          { "bearerGrant": [] },
+          { "bearerAccountCredential": [] }
         ],
         "x-required-scopes": ["subscriptions:write"],
         "x-idempotency": {
@@ -5880,7 +6673,8 @@
         "security": [
           { "clerkSession": [] },
           { "bearerCredential": [] },
-          { "bearerGrant": [] }
+          { "bearerGrant": [] },
+          { "bearerAccountCredential": [] }
         ],
         "x-required-scopes": ["subscriptions:read"],
         "responses": {
@@ -5911,7 +6705,8 @@
         "security": [
           { "clerkSession": [] },
           { "bearerCredential": [] },
-          { "bearerGrant": [] }
+          { "bearerGrant": [] },
+          { "bearerAccountCredential": [] }
         ],
         "x-required-scopes": ["subscriptions:read"],
         "parameters": [
@@ -5963,7 +6758,8 @@
         "security": [
           { "clerkSession": [] },
           { "bearerCredential": [] },
-          { "bearerGrant": [] }
+          { "bearerGrant": [] },
+          { "bearerAccountCredential": [] }
         ],
         "x-required-scopes": ["subscriptions:write"],
         "x-idempotency": {
@@ -6051,7 +6847,8 @@
         "security": [
           { "clerkSession": [] },
           { "bearerCredential": [] },
-          { "bearerGrant": [] }
+          { "bearerGrant": [] },
+          { "bearerAccountCredential": [] }
         ],
         "x-required-scopes": ["subscriptions:read"],
         "responses": {
@@ -6076,7 +6873,8 @@
         "security": [
           { "clerkSession": [] },
           { "bearerCredential": [] },
-          { "bearerGrant": [] }
+          { "bearerGrant": [] },
+          { "bearerAccountCredential": [] }
         ],
         "x-required-scopes": ["subscriptions:write"],
         "requestBody": {
@@ -6113,7 +6911,8 @@
         "security": [
           { "clerkSession": [] },
           { "bearerCredential": [] },
-          { "bearerGrant": [] }
+          { "bearerGrant": [] },
+          { "bearerAccountCredential": [] }
         ],
         "x-required-scopes": ["subscriptions:write"],
         "responses": {
@@ -6155,7 +6954,8 @@
         "security": [
           { "clerkSession": [] },
           { "bearerCredential": [] },
-          { "bearerGrant": [] }
+          { "bearerGrant": [] },
+          { "bearerAccountCredential": [] }
         ],
         "x-required-scopes": ["subscriptions:read"],
         "parameters": [
@@ -6255,7 +7055,8 @@
         "security": [
           { "clerkSession": [] },
           { "bearerCredential": [] },
-          { "bearerGrant": [] }
+          { "bearerGrant": [] },
+          { "bearerAccountCredential": [] }
         ],
         "x-required-scopes": ["subscriptions:write"],
         "responses": {
@@ -6298,7 +7099,8 @@
         "security": [
           { "clerkSession": [] },
           { "bearerCredential": [] },
-          { "bearerGrant": [] }
+          { "bearerGrant": [] },
+          { "bearerAccountCredential": [] }
         ],
         "x-required-scopes": ["subscriptions:write"],
         "responses": {
@@ -6336,7 +7138,8 @@
         "security": [
           { "clerkSession": [] },
           { "bearerCredential": [] },
-          { "bearerGrant": [] }
+          { "bearerGrant": [] },
+          { "bearerAccountCredential": [] }
         ],
         "x-required-scopes": ["messages:write"],
         "x-idempotency": {
@@ -6434,7 +7237,8 @@
         "security": [
           { "clerkSession": [] },
           { "bearerCredential": [] },
-          { "bearerGrant": [] }
+          { "bearerGrant": [] },
+          { "bearerAccountCredential": [] }
         ],
         "x-required-scopes": ["messages:read"],
         "responses": {
@@ -6493,7 +7297,13 @@
         "type": "http",
         "scheme": "bearer",
         "bearerFormat": "OAuth 2.0 access token",
-        "description": "An access token issued by the WhooshBang authorization server for one\nconsenting account member. It selects exactly one account and carries\nthe scopes that member consented to, and never a project: an operation\nnames its project and environment in the path, and the service checks\nboth against the granting person's membership before acting. It can\nhold account-level scopes, which no credential can.\n"
+        "description": "An access token issued by the WhooshBang authorization server for one\nconsenting account member. It selects exactly one account and carries\nthe scopes that member consented to, and never a project: an operation\nnames its project and environment in the path, and the service checks\nboth against the granting person's membership before acting. A project\ncredential can name no project but its own; an account credential names\none per call the same way this does.\n"
+      },
+      "bearerAccountCredential": {
+        "type": "http",
+        "scheme": "bearer",
+        "bearerFormat": "wb_ac1.acred_<16-byte-base64url>.<32-byte-base64url-secret>",
+        "description": "Selects exactly one account and nothing below it. It names no project\nand no environment, so it authenticates only operations whose path does,\nand its authority there is the intersection of its scopes with the\nproject-credential vocabulary — never wider than a project credential\nwould have been for the same project environment. A path naming a\nproject outside its account is refused with `credential_account_mismatch`\nrather than a bare scope failure. `account:read` is the one scope it can\nhold that a project credential cannot, and it authorizes only the\naccount's project directory: listing the account's projects and reading\none, which is the account-wide question a project credential cannot ask\nand the reason a `--project <slug>` selector can work at all. It is\nrequired *in addition to* each of those operations' own\n`x-required-scopes`, never instead of them.\nCredentials cannot be read after creation.\n"
       },
       "bearerCredential": {
         "type": "http",
@@ -6550,6 +7360,13 @@
         "description": "Canonical opaque project credential identity; never a readable secret.",
         "schema": { "$ref": "#/components/schemas/ApiCredentialId" }
       },
+      "AccountCredentialId": {
+        "name": "account_credential_id",
+        "in": "path",
+        "required": true,
+        "description": "Canonical opaque account credential identity; never a readable secret.",
+        "schema": { "$ref": "#/components/schemas/AccountCredentialId" }
+      },
       "ApiCredentialAfterCursor": {
         "name": "after",
         "in": "query",
@@ -6678,6 +7495,13 @@
         "description": "Opaque connection identity; never authorization.",
         "schema": { "$ref": "#/components/schemas/OpaqueIdentifier" }
       },
+      "ConnectionTestId": {
+        "name": "test_id",
+        "in": "path",
+        "required": true,
+        "description": "Opaque identity of one owner-triggered connection test; never authorization.",
+        "schema": { "$ref": "#/components/schemas/OpaqueIdentifier" }
+      },
       "NotifierId": {
         "name": "notifier_id",
         "in": "path",
@@ -6880,7 +7704,10 @@
               },
               "setup_modes": {
                 "type": "array",
-                "const": ["whooshbang_hosted"]
+                "minItems": 1,
+                "maxItems": 2,
+                "uniqueItems": true,
+                "items": { "enum": ["whooshbang_hosted", "customer_managed"] }
               },
               "lifecycle_operations": {
                 "type": "array",
@@ -6914,7 +7741,8 @@
         "description": "One environment's provider-discriminated connection. Credentials and provider-native authority identifiers are structurally absent.",
         "oneOf": [
           { "$ref": "#/components/schemas/TelegramChannelConnection" },
-          { "$ref": "#/components/schemas/HostedChannelConnection" }
+          { "$ref": "#/components/schemas/HostedChannelConnection" },
+          { "$ref": "#/components/schemas/CustomerOwnedSlackChannelConnection" }
         ]
       },
       "ChannelConnectionCollection": {
@@ -7024,6 +7852,47 @@
             },
             "additionalProperties": false
           },
+          {
+            "type": "object",
+            "description": "Starts a guided setup in which the customer creates and owns their own Slack app. The connection comes back `pending` with an `app_setup` carrying Slack's own creation link, already filled in with this app's manifest.\n\nThis arm carries no credential field, because at this point no credential exists: Slack issues the app's secrets when the owner presses Create. They arrive later through the write-only rotation boundary, and the bot grant never arrives from the caller at all — WhooshBang obtains it from Slack's installation exchange. The three names here are what the owner's whole workspace will see, which is why the caller chooses them rather than WhooshBang: a generated name would permanently brand a customer's own app with ours, and that is the one thing customer-owned modes exist to prevent.",
+            "required": [
+              "mode",
+              "provider",
+              "display_name",
+              "app_name",
+              "bot_display_name",
+              "app_description"
+            ],
+            "properties": {
+              "mode": { "type": "string", "const": "customer_managed" },
+              "provider": { "type": "string", "const": "slack" },
+              "display_name": {
+                "type": "string",
+                "minLength": 1,
+                "maxLength": 100,
+                "description": "What this connection is called inside WhooshBang. Unrelated to what Slack shows the workspace."
+              },
+              "app_name": {
+                "type": "string",
+                "minLength": 1,
+                "maxLength": 35,
+                "description": "The app name Slack's creation dialog is prefilled with, constrained to Slack's own 35-character limit. The owner can still change it in Slack; this is a suggestion, not a reservation."
+              },
+              "bot_display_name": {
+                "type": "string",
+                "minLength": 1,
+                "maxLength": 80,
+                "description": "The bot display name in the same dialog — what a recipient reads at the top of the conversation. Slack's own 80-character limit."
+              },
+              "app_description": {
+                "type": "string",
+                "minLength": 1,
+                "maxLength": 140,
+                "description": "The short description Slack shows beside the app, within Slack's own 140-character limit."
+              }
+            },
+            "additionalProperties": false
+          },
           {
             "type": "object",
             "description": "Starts the hosted authorization for a WhooshBang-owned distributed app installed independently at the provider authority Slack derives during OAuth. The caller supplies neither installation identity nor credential material.",
@@ -7057,8 +7926,43 @@
         "additionalProperties": false
       },
       "RotateChannelConnectionCredentialRequest": {
-        "description": "Replaces the secret behind a connection, discriminated by where a replacement can come from at all. A customer-owned bot has one only its owner can produce and therefore sends it; a managed bot has one only Telegram can issue and therefore sends nothing. Either way the connection keeps its provider identity, so a subscriber stays bound to the identity it consented to and only the secret changes.",
+        "description": "Replaces the secret behind a connection, discriminated by where a replacement can come from at all. A customer-owned bot has one only its owner can produce and therefore sends it; a managed bot has one only Telegram can issue and therefore sends nothing. A customer-owned Slack app has three separate authorities and names which of them it is replacing. Either way the connection keeps its provider identity, so a subscriber stays bound to the identity it consented to and only the secret changes.\n\nThe first submission during setup uses this same boundary. Handing a secret over and replacing it are the same operation — a write that never reads the old value back — and giving initial setup its own endpoint would have meant two ways to do one thing, differing only in what the connection's status happened to be.",
         "oneOf": [
+          {
+            "type": "object",
+            "description": "Supplies or replaces the app-specific authorities of a Slack app the customer owns. All three are sent together, both for the first submission during setup and for every later replacement.\n\nSending only the one that changed would read as the kinder API, and it is the wrong shape: the three are sealed as one versioned set, so replacing one alone would mean decrypting the other two and writing them back — reading secrets at a boundary whose whole purpose is that nothing reads them. Slack shows all three on one screen, so re-entering them costs the owner a copy each and costs the system no read at all.\n\n`client_identity` is safe metadata and is echoed back; the other two are write-only and are never readable afterwards by any surface.\n\nThere is no bot-token field here, and the absence is the point: WhooshBang obtains the bot grant from Slack's installation exchange, so it never passes through a browser, a clipboard, this request, or any response.",
+            "required": [
+              "provider",
+              "client_identity",
+              "client_secret",
+              "signing_secret"
+            ],
+            "properties": {
+              "provider": { "type": "string", "const": "slack" },
+              "client_identity": {
+                "type": "string",
+                "minLength": 7,
+                "maxLength": 66,
+                "pattern": "^[0-9]{3,32}\\.[0-9]{3,32}$",
+                "description": "The app's Client ID, in Slack's own `<digits>.<digits>` shape. Safe app metadata rather than an authority: it identifies the app in an OAuth redirect the workspace can already see, so unlike the other two it is echoed back."
+              },
+              "client_secret": {
+                "type": "string",
+                "minLength": 1,
+                "maxLength": 512,
+                "writeOnly": true,
+                "description": "The app's Client Secret. Write-only: sealed on arrival, never echoed here or by any later read, and reachable only by the installation and identity exchanges — delivery cannot obtain it, and holding it sends no message."
+              },
+              "signing_secret": {
+                "type": "string",
+                "minLength": 1,
+                "maxLength": 512,
+                "writeOnly": true,
+                "description": "The app's Signing Secret, which verifies that an inbound request really came from Slack. Write-only on the same terms, and reachable only by ingress verification."
+              }
+            },
+            "additionalProperties": false
+          },
           {
             "type": "object",
             "description": "Replaces the customer-owned credential behind a connection. The connection keeps its provider identity, so a subscriber stays bound to the identity it consented to and only the secret changes; a credential for a different identity is refused.",
@@ -7089,6 +7993,245 @@
           }
         ]
       },
+      "ConnectionTestKind": {
+        "type": "string",
+        "enum": ["outbound_notification", "signed_interaction"],
+        "description": "Which half of a connection a test exercises. `outbound_notification` proves this exact identity can put a message in front of the person who set it up. `signed_interaction` proves the opposite direction: that the provider can reach this deployment's interactivity URL and that the request it signs verifies against the secret we hold. The two fail for entirely different reasons, so they are never collapsed into one result.",
+        "$comment": "Provider-neutral vocabulary. Slack is the only provider that implements either today; a provider that cannot run one refuses it rather than reporting a pass it never proved."
+      },
+      "ConnectionTestRecoveryAction": {
+        "type": "string",
+        "enum": [
+          "none",
+          "complete_setup",
+          "replace_credentials",
+          "reinstall",
+          "retry_later",
+          "check_request_url",
+          "contact_support"
+        ],
+        "description": "The exact safe next action for one test result, in product vocabulary.\n\nIt is a different vocabulary from a connection's own recovery action because the actions genuinely differ: a test that nothing answered is fixed by checking the request URL the provider was given, and a request that arrived and did not verify is fixed by re-entering the app's secrets — neither of which is a lifecycle transition on the connection.\n\n`check_request_url` is also the honest answer when nobody simply pressed the button: the window closed with nothing arriving, and that has exactly two causes."
+      },
+      "ConnectionTestStatus": {
+        "type": "string",
+        "enum": ["pending", "succeeded", "failed", "expired"],
+        "description": "`pending` means the test is placed and its answer has not arrived; a signed-interaction test stays there until somebody presses the button it sent. `expired` is the honest reading of a pending test whose window closed: nothing failed, nobody answered."
+      },
+      "ConnectionTestFailureCode": {
+        "type": "string",
+        "enum": [
+          "setup_incomplete",
+          "verification_target_unknown",
+          "credential_unavailable",
+          "provider_rejected",
+          "provider_unavailable",
+          "provider_rate_limited",
+          "unverified_request_received"
+        ],
+        "description": "Why a test did not pass, in a vocabulary the owner can act on rather than the provider's wire error.\n\n`verification_target_unknown` means nobody has installed the app from this deployment yet, so there is no owner to send a test to. `unverified_request_received` is a statement of fact and not a diagnosis: a request carrying this test's own challenge reached the interactivity URL and its signature did not verify against the secret this connection holds.\n\nA window that closed with nothing arriving is not in this list, because it is not a failure: it reads as `expired`, which says nobody answered rather than that anything broke."
+      },
+      "ConnectionTestEvidence": {
+        "type": "object",
+        "description": "What a finished test actually observed. Every field is safe to render, log, and paste into an issue: no credential, no provider-native app, workspace, channel, or user identifier, and no message content.",
+        "properties": {
+          "identity_handle": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 128,
+            "description": "The visible handle the test went out as — the same identity a subscriber would see."
+          },
+          "workspace_display_name": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 100,
+            "description": "The provider workspace the test ran in, as its own members see it named."
+          },
+          "accepted_at": {
+            "$ref": "#/components/schemas/Timestamp",
+            "description": "When the provider accepted the outbound message. Acceptance is the provider's own answer, not our belief."
+          },
+          "observed_at": {
+            "$ref": "#/components/schemas/Timestamp",
+            "description": "When the signed request the test was waiting for arrived and verified."
+          },
+          "round_trip_ms": {
+            "type": "integer",
+            "minimum": 0,
+            "maximum": 86400000,
+            "description": "Milliseconds from placing the test to observing its answer."
+          },
+          "signature_verified": {
+            "type": "boolean",
+            "description": "Whether the provider's signature over the untouched request body verified against the secret this connection custodies. Present only once a request has arrived."
+          },
+          "ingress_host": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 253,
+            "description": "The public host the provider actually called, which is what a misconfigured or stale request URL gets wrong. It is this deployment's own hostname and names no tenant."
+          }
+        },
+        "additionalProperties": false
+      },
+      "ConnectionTest": {
+        "type": "object",
+        "description": "One owner-triggered proof that an exact connection still works, run on demand and answered with evidence rather than with a claim.\n\nIt is deliberately incapable of carrying a secret: nothing here is a credential, a provider-native identifier, or message content, and a test that failed says why in a closed vocabulary rather than by quoting a provider.",
+        "required": [
+          "id",
+          "connection_id",
+          "kind",
+          "status",
+          "requested_at",
+          "expires_at",
+          "recovery_action",
+          "diagnostic_id"
+        ],
+        "properties": {
+          "id": { "$ref": "#/components/schemas/OpaqueIdentifier" },
+          "connection_id": { "$ref": "#/components/schemas/OpaqueIdentifier" },
+          "kind": { "$ref": "#/components/schemas/ConnectionTestKind" },
+          "status": { "$ref": "#/components/schemas/ConnectionTestStatus" },
+          "requested_at": { "$ref": "#/components/schemas/Timestamp" },
+          "completed_at": {
+            "$ref": "#/components/schemas/Timestamp",
+            "description": "When the test settled. Absent while it is still pending."
+          },
+          "expires_at": {
+            "$ref": "#/components/schemas/Timestamp",
+            "description": "When a pending test stops waiting. A test that reaches this without an answer becomes `expired`, which is not a failure of the connection."
+          },
+          "evidence": { "$ref": "#/components/schemas/ConnectionTestEvidence" },
+          "failure_code": {
+            "$ref": "#/components/schemas/ConnectionTestFailureCode"
+          },
+          "recovery_action": {
+            "$ref": "#/components/schemas/ConnectionTestRecoveryAction",
+            "description": "The exact safe next action for this result. `none` on a pass."
+          },
+          "diagnostic_id": { "$ref": "#/components/schemas/DiagnosticId" }
+        },
+        "additionalProperties": false
+      },
+      "ConnectionTestCollection": {
+        "type": "object",
+        "description": "This connection's recent tests, newest first. It is the audit-safe failure history for a connection: what was tried, when, and what came back.",
+        "required": ["items"],
+        "properties": {
+          "items": {
+            "type": "array",
+            "maxItems": 100,
+            "items": { "$ref": "#/components/schemas/ConnectionTest" }
+          },
+          "next_cursor": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 256,
+            "pattern": "^[A-Za-z0-9_-]+$"
+          },
+          "page": { "$ref": "#/components/schemas/ListPageNumber" },
+          "page_size": { "$ref": "#/components/schemas/ListPageSize" },
+          "total": { "$ref": "#/components/schemas/ListTotal" }
+        },
+        "additionalProperties": false
+      },
+      "CreateConnectionTestRequest": {
+        "type": "object",
+        "description": "Places one test against an exact connection. It carries nothing but which test to run: a test needs no target, because the only person it may address is the one who installed the app.",
+        "required": ["kind"],
+        "properties": {
+          "kind": { "$ref": "#/components/schemas/ConnectionTestKind" }
+        },
+        "additionalProperties": false
+      },
+      "CustomerOwnedSlackAppManifest": {
+        "type": "object",
+        "description": "The exact configuration a customer-owned Slack app is created from, as data rather than as a URL-encoded blob.\n\nIt exists so the owner can read what they are about to approve, and so a reviewer can check it, without opening Slack. It carries configuration only: no account, project, or environment, no credential, and no provider-native identifier. The opaque handle inside the request URLs selects candidate setup state and authorizes nothing — a request still has to carry Slack's signature over the untouched body before anything inside it is believed.",
+        "required": [
+          "creation_url",
+          "app_name",
+          "bot_display_name",
+          "description",
+          "bot_scopes",
+          "user_scopes",
+          "request_urls",
+          "manifest",
+          "diagnostic_id"
+        ],
+        "properties": {
+          "creation_url": {
+            "type": "string",
+            "format": "uri",
+            "pattern": "^https://api\\.slack\\.com/apps\\?[^\\s]+$",
+            "maxLength": 8192,
+            "description": "The same prefilled creation link the setup carries, repeated here so one read answers both questions."
+          },
+          "app_name": { "type": "string", "minLength": 1, "maxLength": 35 },
+          "bot_display_name": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 80
+          },
+          "description": { "type": "string", "minLength": 1, "maxLength": 140 },
+          "bot_scopes": {
+            "type": "array",
+            "maxItems": 20,
+            "uniqueItems": true,
+            "items": { "type": "string", "minLength": 1, "maxLength": 64 },
+            "description": "Every provider scope the bot will ask for, exactly as Slack will show them. Raw provider vocabulary on purpose: this is the screen the owner is about to approve, and translating it would make it unverifiable."
+          },
+          "user_scopes": {
+            "type": "array",
+            "maxItems": 20,
+            "uniqueItems": true,
+            "items": { "type": "string", "minLength": 1, "maxLength": 64 },
+            "description": "Every provider scope a recipient will be asked for when they sign in. Separate from the bot scopes because they are approved by different people at different moments."
+          },
+          "request_urls": {
+            "type": "object",
+            "description": "Where this deployment answers the app. A stale or edited value here is the failure a signed-interaction test detects.",
+            "required": [
+              "events",
+              "interactions",
+              "installation_redirect",
+              "recipient_redirect"
+            ],
+            "properties": {
+              "events": {
+                "type": "string",
+                "format": "uri",
+                "pattern": "^https://[^\\s]+$",
+                "maxLength": 2048
+              },
+              "interactions": {
+                "type": "string",
+                "format": "uri",
+                "pattern": "^https://[^\\s]+$",
+                "maxLength": 2048
+              },
+              "installation_redirect": {
+                "type": "string",
+                "format": "uri",
+                "pattern": "^https://[^\\s]+$",
+                "maxLength": 2048
+              },
+              "recipient_redirect": {
+                "type": "string",
+                "format": "uri",
+                "pattern": "^https://[^\\s]+$",
+                "maxLength": 2048
+              }
+            },
+            "additionalProperties": false
+          },
+          "manifest": {
+            "type": "object",
+            "description": "The literal manifest document Slack is handed. Reproduced whole so what the owner reviews and what Slack receives cannot drift apart.",
+            "additionalProperties": true
+          },
+          "diagnostic_id": { "$ref": "#/components/schemas/DiagnosticId" }
+        },
+        "additionalProperties": false
+      },
       "NotifierConnectionRoute": {
         "type": "object",
         "description": "One notifier's use of one connection in the same environment. This is the record that decides which identity a send actually leaves through: a connection nothing routes to is configured and inert, and a subscriber cannot authorize against it either. Routing is deliberately separate from creating the connection so that adding a second identity never moves traffic on its own.",
@@ -7455,13 +8598,133 @@
             },
             "additionalProperties": false
           },
-          "supported_languages": {
+          "supported_languages": {
+            "type": "array",
+            "description": "Every canonical recipient language independently addressable by the update endpoint.",
+            "minItems": 16,
+            "maxItems": 16,
+            "uniqueItems": true,
+            "items": { "$ref": "#/components/schemas/RecipientLanguage" }
+          },
+          "next_cursor": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 256,
+            "pattern": "^[A-Za-z0-9_-]+$"
+          },
+          "page": { "$ref": "#/components/schemas/ListPageNumber" },
+          "page_size": { "$ref": "#/components/schemas/ListPageSize" },
+          "total": { "$ref": "#/components/schemas/ListTotal" }
+        },
+        "additionalProperties": false
+      },
+      "UpdateRecipientCopyOverrideRequest": {
+        "type": "object",
+        "description": "Sets one exact project + language + string value. Delete the same address to restore the shipped default.",
+        "required": ["value"],
+        "properties": {
+          "value": { "$ref": "#/components/schemas/RecipientCopyOverrideValue" }
+        },
+        "additionalProperties": false,
+        "x-max-json-bytes": 2048
+      },
+      "CreateApiCredentialRequest": {
+        "type": "object",
+        "description": "Creates one credential inside the project environment selected by the authenticated administration path.",
+        "required": ["label", "scopes"],
+        "properties": {
+          "label": { "type": "string", "minLength": 1, "maxLength": 100 },
+          "scopes": { "$ref": "#/components/schemas/ApiCredentialScopeSet" }
+        },
+        "additionalProperties": false
+      },
+      "CreateAccountCredentialRequest": {
+        "type": "object",
+        "description": "Creates one credential against the whole account rather than one project environment.",
+        "required": ["label", "scopes"],
+        "properties": {
+          "label": { "type": "string", "minLength": 1, "maxLength": 100 },
+          "scopes": { "$ref": "#/components/schemas/AccountCredentialScopeSet" }
+        },
+        "additionalProperties": false
+      },
+      "RotateAccountCredentialRequest": {
+        "type": "object",
+        "description": "Creates a replacement with the same label and scopes and schedules terminal revocation of the replaced credential after the declared overlap.",
+        "required": ["overlap_seconds"],
+        "properties": {
+          "overlap_seconds": {
+            "type": "integer",
+            "minimum": 0,
+            "maximum": 86400
+          }
+        },
+        "additionalProperties": false
+      },
+      "AccountCredentialId": {
+        "type": "string",
+        "pattern": "^acred_[A-Za-z0-9_-]{21}[AQgw]$",
+        "description": "acred_ followed by the canonical unpadded base64url encoding of exactly 16 random bytes."
+      },
+      "AccountCredential": {
+        "type": "object",
+        "description": "Safe account-scoped API credential metadata. It carries no project or environment, because it names neither: a request does, in its path. It never contains a bearer secret, digest, Clerk identifier, or digest-key reference.",
+        "required": [
+          "id",
+          "prefix",
+          "label",
+          "scopes",
+          "created_by",
+          "created_at",
+          "status"
+        ],
+        "properties": {
+          "id": { "$ref": "#/components/schemas/AccountCredentialId" },
+          "prefix": { "$ref": "#/components/schemas/AccountCredentialPrefix" },
+          "label": { "type": "string", "minLength": 1, "maxLength": 100 },
+          "scopes": {
+            "$ref": "#/components/schemas/AccountCredentialScopeSet"
+          },
+          "created_by": {
+            "$ref": "#/components/schemas/OpaqueIdentifier",
+            "description": "An opaque WhooshBang member identifier. It is never a Clerk user identifier."
+          },
+          "created_at": { "$ref": "#/components/schemas/Timestamp" },
+          "last_used_at": { "$ref": "#/components/schemas/Timestamp" },
+          "scheduled_revocation_at": {
+            "$ref": "#/components/schemas/Timestamp",
+            "description": "When an active credential in a rotation overlap becomes terminally revoked."
+          },
+          "status": { "type": "string", "enum": ["active", "revoked"] },
+          "revoked_at": { "$ref": "#/components/schemas/Timestamp" }
+        },
+        "allOf": [
+          {
+            "if": {
+              "properties": { "status": { "const": "revoked" } },
+              "required": ["status"]
+            },
+            "then": {
+              "required": ["revoked_at"],
+              "properties": {
+                "revoked_at": {},
+                "scheduled_revocation_at": false
+              }
+            },
+            "else": { "properties": { "revoked_at": false } }
+          }
+        ],
+        "additionalProperties": false
+      },
+      "AccountCredentialCollection": {
+        "type": "object",
+        "description": "A stable page of safe account-credential metadata for one account.",
+        "required": ["items"],
+        "properties": {
+          "items": {
             "type": "array",
-            "description": "Every canonical recipient language independently addressable by the update endpoint.",
-            "minItems": 16,
-            "maxItems": 16,
-            "uniqueItems": true,
-            "items": { "$ref": "#/components/schemas/RecipientLanguage" }
+            "maxItems": 100,
+            "items": { "$ref": "#/components/schemas/AccountCredential" }
           },
           "next_cursor": {
             "type": "string",
@@ -7475,23 +8738,27 @@
         },
         "additionalProperties": false
       },
-      "UpdateRecipientCopyOverrideRequest": {
+      "AccountCredentialSecretReveal": {
         "type": "object",
-        "description": "Sets one exact project + language + string value. Delete the same address to restore the shipped default.",
-        "required": ["value"],
+        "description": "The creation-only response. The secret is emitted in this response exactly once and is never available from list, rotate-target, revoke, or later read responses.",
+        "required": ["credential", "secret"],
         "properties": {
-          "value": { "$ref": "#/components/schemas/RecipientCopyOverrideValue" }
+          "credential": { "$ref": "#/components/schemas/AccountCredential" },
+          "secret": { "$ref": "#/components/schemas/AccountCredentialSecret" }
         },
-        "additionalProperties": false,
-        "x-max-json-bytes": 2048
+        "additionalProperties": false
       },
-      "CreateApiCredentialRequest": {
+      "AccountCredentialRotation": {
         "type": "object",
-        "description": "Creates one credential inside the project environment selected by the authenticated administration path.",
-        "required": ["label", "scopes"],
+        "description": "A creation-only replacement secret plus safe metadata for the credential it replaces.",
+        "required": ["credential", "replaced_credential"],
         "properties": {
-          "label": { "type": "string", "minLength": 1, "maxLength": 100 },
-          "scopes": { "$ref": "#/components/schemas/ApiCredentialScopeSet" }
+          "credential": {
+            "$ref": "#/components/schemas/AccountCredentialSecretReveal"
+          },
+          "replaced_credential": {
+            "$ref": "#/components/schemas/AccountCredential"
+          }
         },
         "additionalProperties": false
       },
@@ -8737,6 +10004,18 @@
               "retryable": { "const": false }
             }
           },
+          {
+            "type": "object",
+            "properties": {
+              "type": {
+                "const": "https://whooshbang.flowxo.com/problems/credential_account_mismatch"
+              },
+              "title": { "const": "Credential account mismatch" },
+              "status": { "const": 403 },
+              "code": { "const": "credential_account_mismatch" },
+              "retryable": { "const": false }
+            }
+          },
           {
             "type": "object",
             "properties": {
@@ -9957,6 +11236,7 @@
           "resource_not_found",
           "resource_expired",
           "cancellation_too_late",
+          "credential_account_mismatch",
           "endpoint_rotation_conflict",
           "rate_limited",
           "provider_retryable",
@@ -10075,10 +11355,35 @@
           }
         ]
       },
-      "Environment": {
+      "AccountCredentialPrefix": {
         "type": "string",
-        "enum": ["test", "live"],
-        "description": "The single environment selected by the authenticated credential."
+        "pattern": "^wb_ac1\\.acred_[A-Za-z0-9_-]{8}$",
+        "description": "A safe display prefix containing the account-credential format marker and first eight base64url identity characters, never secret bytes."
+      },
+      "AccountCredentialScope": {
+        "type": "string",
+        "enum": [
+          "account:read",
+          "projects:write",
+          "projects:read",
+          "messages:write",
+          "messages:read",
+          "subscriptions:write",
+          "subscriptions:read",
+          "machine-clients:write",
+          "machine-clients:read",
+          "capabilities:read",
+          "connections:write",
+          "connections:read"
+        ],
+        "description": "One account-credential capability. `account:read` is the account's project directory — listing the account's projects and reading one — and is the only scope here a project credential can never carry; it authorizes nothing below the account. Every other name is the project-credential vocabulary unchanged, and is exercised only on the environment-scoped routes, where the project and environment come from the path and the credential's authority is the intersection of these scopes with the project-credential vocabulary. An account credential is therefore never wider than a project credential would have been for the same project environment."
+      },
+      "AccountCredentialScopeSet": {
+        "type": "array",
+        "minItems": 1,
+        "maxItems": 12,
+        "uniqueItems": true,
+        "items": { "$ref": "#/components/schemas/AccountCredentialScope" }
       },
       "ListPageSize": {
         "type": "integer",
@@ -10091,6 +11396,16 @@
         "minimum": 0,
         "description": "How many records the list holds in total, not only on this page. Counted while the page was read, so a write landing between the count and the page can leave it a record or two out of step with `items`. That is noise on an inspection surface; it never changes which records a page addresses."
       },
+      "AccountCredentialSecret": {
+        "type": "string",
+        "pattern": "^wb_ac1\\.acred_[A-Za-z0-9_-]{21}[AQgw]\\.[A-Za-z0-9_-]{42}[AEIMQUYcgkosw048]$",
+        "description": "The exact one-time runtime bearer syntax. The final segment is canonical unpadded base64url for exactly 32 random secret bytes."
+      },
+      "Environment": {
+        "type": "string",
+        "enum": ["test", "live"],
+        "description": "The single environment selected by the authenticated credential."
+      },
       "RecipientCopyOverrideValue": {
         "type": "string",
         "minLength": 1,
@@ -10830,6 +12145,7 @@
           },
           "setup": { "$ref": "#/components/schemas/ChannelConnectionSetup" },
           "authorization_setup": false,
+          "app_setup": false,
           "installation": false,
           "row_version": {
             "type": "integer",
@@ -10991,6 +12307,7 @@
             "$ref": "#/components/schemas/SlackConnectionIdentity"
           },
           "setup": false,
+          "app_setup": false,
           "authorization_setup": {
             "$ref": "#/components/schemas/HostedChannelConnectionSetup",
             "description": "The additive hosted authorization state. Older tolerant readers discard this unknown field rather than interpreting it as Telegram setup."
@@ -11034,6 +12351,177 @@
         },
         "additionalProperties": false
       },
+      "CustomerOwnedSlackSetupStatus": {
+        "type": "string",
+        "enum": [
+          "awaiting_app_creation",
+          "awaiting_authorities",
+          "awaiting_authorization",
+          "awaiting_ingress_proof",
+          "provisioning",
+          "failed",
+          "expired"
+        ],
+        "description": "How far a customer-owned Slack setup has reached, which is the only thing a caller can act on while the connection is still `pending`. Each verification state names a different authority, because Slack hands the app's secrets over together but exercises them at different moments: `awaiting_authorization` has the three values and is waiting for the install, `awaiting_ingress_proof` has a bot grant Slack confirmed and is waiting for the first request Slack itself signs. Collapsing them would let a connection report a verified ingress it has never verified."
+      },
+      "CustomerOwnedSlackAppAuthority": {
+        "type": "string",
+        "enum": ["client_identity", "client_secret", "signing_secret"],
+        "description": "One app-specific authority the owner hands over. Product vocabulary for what each value is for, never the value: `client_identity` is safe metadata, and the other two are write-only."
+      },
+      "CustomerOwnedSlackConnectionSetup": {
+        "type": "object",
+        "description": "The unfinished half of a customer-owned Slack connection: what the owner still has to do in Slack, and by when.\n\nIt is deliberately incapable of carrying a secret. The creation link contains configuration and nothing else, the two secrets the owner supplies are write-only and have no field here or on the connection, and the bot grant never travels through a browser at all — WhooshBang obtains it from Slack's own installation exchange. Everything here is therefore safe to poll, render, and hand to whoever is doing the setup.",
+        "required": [
+          "status",
+          "creation_url",
+          "expires_at",
+          "app_name",
+          "bot_display_name",
+          "outstanding_authorities"
+        ],
+        "properties": {
+          "status": {
+            "$ref": "#/components/schemas/CustomerOwnedSlackSetupStatus"
+          },
+          "creation_url": {
+            "type": "string",
+            "format": "uri",
+            "pattern": "^https://api\\.slack\\.com/apps\\?[^\\s]+$",
+            "maxLength": 8192,
+            "description": "Slack's own app-creation flow, opened with this app's manifest already filled in, so the owner reviews and presses Create rather than writing or pasting YAML. The URL carries configuration only: it names no account, project, or environment and contains no credential. The opaque handle it does carry selects candidate setup state and authorizes nothing."
+          },
+          "expires_at": {
+            "$ref": "#/components/schemas/Timestamp",
+            "description": "When an unfinished setup stops being usable. A setup that already produced a Slack app stays recoverable past this, because the app exists whether or not the browser came back."
+          },
+          "authorization_url": {
+            "type": "string",
+            "format": "uri",
+            "pattern": "^https://[^\\s]+$",
+            "maxLength": 2048,
+            "description": "The short-lived handoff that installs the owner's app into their workspace, present once the three authorities have arrived and an installation has been started. It carries opaque state, never a provider credential or a raw authorization code, and the bot grant it produces is returned to WhooshBang by Slack rather than to the browser."
+          },
+          "app_name": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 35,
+            "description": "The name the owner chose, echoed so a resumed session shows the same app it started with. Slack's own limit."
+          },
+          "bot_display_name": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 80,
+            "description": "The bot display name the owner chose, echoed for the same reason. Slack's own limit."
+          },
+          "outstanding_authorities": {
+            "type": "array",
+            "maxItems": 3,
+            "uniqueItems": true,
+            "items": {
+              "$ref": "#/components/schemas/CustomerOwnedSlackAppAuthority"
+            },
+            "description": "Which of the three app-specific values this setup is still waiting for. Empty once they have all arrived; it never says what any of them are."
+          },
+          "failure_reason": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 200,
+            "description": "Why this attempt ended, in terms the owner can act on. It never echoes a submitted secret, whole or in part, and never names another customer: a Slack app already connected elsewhere says only that."
+          }
+        },
+        "additionalProperties": false
+      },
+      "CustomerOwnedSlackChannelConnection": {
+        "type": "object",
+        "description": "A Slack app the customer created and owns, referenced by one exact environment connection.\n\nIt differs from the hosted arm in who owns the app and its lifecycle, not in what a notification can do. WhooshBang custodies the three app-specific authorities Slack makes unavoidable and none of them appears here or in any other read: absence, not redaction, is the mechanism.",
+        "required": [
+          "id",
+          "project_id",
+          "environment_id",
+          "environment",
+          "provider",
+          "mode",
+          "display_name",
+          "status",
+          "health",
+          "capabilities",
+          "recovery_action",
+          "row_version",
+          "created_at",
+          "updated_at",
+          "diagnostic_id"
+        ],
+        "properties": {
+          "id": { "$ref": "#/components/schemas/OpaqueIdentifier" },
+          "project_id": { "$ref": "#/components/schemas/OpaqueIdentifier" },
+          "environment_id": { "$ref": "#/components/schemas/OpaqueIdentifier" },
+          "environment": { "$ref": "#/components/schemas/Environment" },
+          "provider": { "const": "slack" },
+          "mode": { "const": "customer_managed" },
+          "display_name": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 100
+          },
+          "status": { "$ref": "#/components/schemas/ChannelConnectionStatus" },
+          "health": { "$ref": "#/components/schemas/ProviderHealthState" },
+          "capabilities": {
+            "type": "array",
+            "maxItems": 1,
+            "uniqueItems": true,
+            "items": {
+              "$ref": "#/components/schemas/HostedConnectionCapability"
+            }
+          },
+          "identity": {
+            "$ref": "#/components/schemas/SlackConnectionIdentity"
+          },
+          "setup": false,
+          "authorization_setup": false,
+          "app_setup": {
+            "$ref": "#/components/schemas/CustomerOwnedSlackConnectionSetup",
+            "description": "The guided customer-owned setup state. A distinct field from Telegram's `setup` and the hosted arm's `authorization_setup` so a tolerant reader can never mistake one journey's progress for another's."
+          },
+          "installation": {
+            "$ref": "#/components/schemas/ProviderInstallationSummary",
+            "description": "The safe installation this exact connection owns. It exposes no provider-native identifier and no credential reference."
+          },
+          "management_url": {
+            "type": "string",
+            "format": "uri",
+            "pattern": "^slack://app\\?[^\\s]+$",
+            "maxLength": 2048,
+            "description": "A provider-owned App Home deep link for the customer's own workspace and their own app. It is not a caller-supplied return URL."
+          },
+          "recovery_action": {
+            "$ref": "#/components/schemas/HostedConnectionRecoveryAction"
+          },
+          "last_successful_verification_at": {
+            "$ref": "#/components/schemas/Timestamp"
+          },
+          "last_successful_delivery_at": {
+            "$ref": "#/components/schemas/Timestamp"
+          },
+          "row_version": {
+            "type": "integer",
+            "minimum": 1,
+            "description": "Send this back on an update. A stale value is refused rather than silently overwriting a change made in between."
+          },
+          "created_at": { "$ref": "#/components/schemas/Timestamp" },
+          "updated_at": { "$ref": "#/components/schemas/Timestamp" },
+          "archived_at": { "$ref": "#/components/schemas/Timestamp" },
+          "health_checked_at": { "$ref": "#/components/schemas/Timestamp" },
+          "last_transition_at": { "$ref": "#/components/schemas/Timestamp" },
+          "last_transition_reason": {
+            "type": "string",
+            "minLength": 1,
+            "maxLength": 200
+          },
+          "diagnostic_id": { "$ref": "#/components/schemas/DiagnosticId" }
+        },
+        "additionalProperties": false
+      },
       "RecipientBrand": {
         "type": "object",
         "description": "Constrained recipient-facing brand tokens. Arbitrary markup, CSS, scripts, remote assets, fonts, and tracking inputs are structurally absent.",
@@ -11295,7 +12783,7 @@
       "provider-capabilities-v1.schema": {
         "$schema": "https://json-schema.org/draft/2020-12/schema",
         "$id": "https://whooshbang.flowxo.com/schemas/provider-capabilities-v1.schema.json",
-        "x-contract-version": "1.0.0-rc.20",
+        "x-contract-version": "1.0.0-rc.21",
         "title": "ProviderCapabilitiesV1",
         "description": "Provider-neutral, renderer-facing delivery and interaction capabilities with explicit degradation.",
         "type": "object",
@@ -11947,5 +13435,5 @@
       }
     }
   },
-  "x-contract-version": "1.0.0-rc.20"
+  "x-contract-version": "1.0.0-rc.21"
 }