@zapier/kitcore 0.20.0 → 0.21.0

package/dist/index.d.ts

@@ -8,6 +8,139 @@ declare module "zod" {
     }
 }
 
+/**
+ * Per-call context threaded explicitly through the method boundary in place of
+ * ambient AsyncLocalStorage. It carries call identity, nesting depth, and a
+ * per-invocation annotation bag. Because it travels as data, correlation and
+ * nested-call dedup work without `async_hooks` — including in browsers, where
+ * the old ALS store was inert and nested calls all looked top-level.
+ *
+ * Framework-neutral: heads surface `callId` under their own name (e.g. a
+ * correlation id) and own their annotation field names.
+ */
+/**
+ * A private brand (a fresh `Symbol()`, never `Symbol.for`) makes a CallContext
+ * unforgeable: no outside code can name the symbol to synthesize an id-bearing
+ * context, and the brand never collides across bundled copies. This is the same
+ * unforgeability the `INTERNAL_CALL` sentinel relies on.
+ */
+declare const CALL_CONTEXT_BRAND: unique symbol;
+/**
+ * The per-invocation annotation bag: an open string-keyed map a head fills with
+ * telemetry-shaping fields (via the boundary annotator, a method's pre-run
+ * `annotator`, or the run bag's mid-`run` `annotate`) and reads back on the
+ * method-lifecycle hook context. Framework-neutral: kitcore does not know or
+ * constrain the keys.
+ */
+type Annotations = Record<string, unknown>;
+/**
+ * Origin of a call's root. `"surface"` = entered through the SDK surface, or a
+ * parent-less runtime delegation that still represents real user work;
+ * `"internal"` = a framework-internal root minted by kitcore's own machinery,
+ * which a head can suppress from telemetry.
+ */
+type CallOrigin = "surface" | "internal";
+interface CallContext {
+    /**
+     * Minted once at the root call; copied verbatim to every nested (child) call.
+     * `readonly`: method code owns only the `annotations` bag. A child copies this
+     * off the live parent when the delegated call fires, so mutating it mid-run
+     * would corrupt the child's correlation id.
+     */
+    readonly callId: string | null;
+    /**
+     * 0 at the outermost call; `parent.depth + 1` for a delegated call. `readonly`
+     * for the same reason as `callId` — a mutated depth would mis-nest children
+     * and, where ALS can't correct it (browsers), duplicate telemetry.
+     */
+    readonly depth: number;
+    /**
+     * Per-invocation scratch space. Never forwarded to callees — a child call
+     * gets a fresh bag — so annotations describe one method's own invocation.
+     * Method `run` code contributes through the run bag's `annotate` function
+     * rather than writing here directly; the bag reference is fixed, only its
+     * contents change.
+     */
+    readonly annotations: Annotations;
+    /**
+     * Origin of the call's root, copied verbatim to every child. `"surface"`
+     * (the default) marks a surface-origin root — a call that entered through the
+     * SDK surface, or a parent-less runtime delegation that still represents real
+     * user work (e.g. a delegation proxy reaching another method). `"internal"`
+     * marks a framework-internal root minted by kitcore's own build-time machinery
+     * (resolver/formatter/dispose/observer twins, `resolvePlugin`), which a head
+     * can suppress from telemetry. Orthogonal to `depth`: an internal root is
+     * still `depth 0`. `readonly` so a child can't inherit a mutated origin.
+     */
+    readonly callOrigin: CallOrigin;
+    readonly [CALL_CONTEXT_BRAND]: true;
+}
+
+/**
+ * Method-call lifecycle hooks. Plugins contribute `onMethodStart` and/or
+ * `onMethodEnd` observers, plus an optional pre-run `annotator` that returns
+ * fields merged into the call's annotation bag; `buildHooks` composes each
+ * across plugins so multiple contributors coexist. Composition is right-additive
+ * (newer plugins fire — and `annotator` fields win — after earlier ones); a
+ * method triggers the hooks only when its boundary fires them, which is every
+ * `item` / `list` method and any raw method that opts in.
+ */
+
+interface OnMethodStartContext {
+    methodName: string;
+    args: unknown[];
+    isPaginated: boolean;
+    /**
+     * Depth of this method invocation in the SDK call tree. 0 = outermost
+     * (user-initiated) call; 1+ = called from inside another SDK method.
+     * Observers can use this to ignore nested calls if they only want
+     * top-level events.
+     */
+    depth: number;
+    /** The call's correlation id, copied from the per-call context; `null` where
+     * id minting was unavailable. */
+    callId: string | null;
+    /**
+     * Origin of the call's root, copied from the per-call context. `"surface"` =
+     * surface-origin (an SDK-surface call or a runtime delegation — real user
+     * work); `"internal"` = a framework-internal call minted by kitcore's own
+     * machinery (resolver/formatter/dispose/observer twins, `resolvePlugin`).
+     * Orthogonal to `depth` (an internal call is still `depth 0`); a head can drop
+     * internal-origin calls from telemetry.
+     */
+    callOrigin: CallOrigin;
+    /**
+     * The call's annotation bag, carried live from the per-call context. At
+     * `onMethodStart` it holds the early-knowable fields (boundary annotator +
+     * a method's pre-run `annotator`); by `onMethodEnd` any mid-`run` writes
+     * are visible too (same object reference throughout the call).
+     */
+    annotations: Annotations;
+}
+type OnMethodStart = (ctx: OnMethodStartContext) => void;
+interface OnMethodEndContext extends OnMethodStartContext {
+    durationMs: number;
+    error?: Error;
+}
+type OnMethodEnd = (ctx: OnMethodEndContext) => void;
+/**
+ * A composed pre-run annotator: given a call's method name and (normalized,
+ * pre-validation) input, it returns {@link Annotations} the boundary merges into
+ * the call's bag before `onMethodStart`. Unlike the `void` lifecycle observers,
+ * this one returns a value; composition merges the returned bags rather than
+ * chaining side effects. A contributor with nothing to add returns an empty bag,
+ * so absence is modelled by no annotator rather than an `undefined` return.
+ */
+type ComposedAnnotator = (ctx: {
+    methodName: string;
+    input: unknown;
+}) => Annotations;
+interface MethodHooks {
+    onMethodStart?: OnMethodStart;
+    onMethodEnd?: OnMethodEnd;
+    annotator?: ComposedAnnotator;
+}
+
 /**
  * What the framework reports about the output it produced.
  *
@@ -140,292 +273,73 @@ interface PaginatedSdkResult<TItem> extends Promise<SdkPage<TItem>> {
 type PaginatedSdkFunction<TOptions, TItem> = (options: TOptions) => PaginatedSdkResult<TItem>;
 
 /**
- * The external escape-hatch key for an SDK's context. A Symbol,
- * not a string, so it stays off the string surface (which is exactly the root's
- * exports) and is collision-free and clearly internal. It is attached at
- * runtime but kept OUT of the public SDK type (a `unique symbol` in an exported
- * type can't be named in a consumer's emitted `.d.ts`); reach it through the
- * typed `getContext(sdk)` accessor.
- *
- * `Symbol.for`, not `Symbol()`: heads bundle kitcore (tsup `noExternal`), so
- * an sdk built by one bundle's copy must still be readable by another copy's
- * `getContext` / `resolvePlugin` (e.g. a CLI sdk inspected with helpers
- * imported from `@zapier/zapier-sdk`). The global symbol registry makes every
- * copy agree on the key.
- */
-declare const CONTEXT: unique symbol;
-
-/**
- * Per-call context threaded explicitly through the method boundary in place of
- * ambient AsyncLocalStorage. It carries call identity, nesting depth, and a
- * per-invocation annotation bag. Because it travels as data, correlation and
- * nested-call dedup work without `async_hooks` — including in browsers, where
- * the old ALS store was inert and nested calls all looked top-level.
+ * Plugins with a required-parameter rename declare two schemas: a canonical one
+ * (new names only, carrying `.meta({ aliases })`) and a `z.union([canonical,
+ * deprecated])` for runtime input parsing (so callers passing old names still
+ * validate). The union has no object shape, so everything that reads parameter
+ * shape/requiredness — the registry projection, generated docs, and the
+ * resolution planner — must read the canonical variant, not the union.
  *
- * Framework-neutral: heads surface `callId` under their own name (e.g. a
- * correlation id) and own their annotation field names.
- */
-/**
- * A private brand (a fresh `Symbol()`, never `Symbol.for`) makes a CallContext
- * unforgeable: no outside code can name the symbol to synthesize an id-bearing
- * context, and the brand never collides across bundled copies. This is the same
- * unforgeability the `INTERNAL_CALL` sentinel relies on.
- */
-declare const CALL_CONTEXT_BRAND: unique symbol;
-/**
- * The per-invocation annotation bag: an open string-keyed map a head fills with
- * telemetry-shaping fields (via the boundary annotator, a method's pre-run
- * `annotator`, or the run bag's mid-`run` `annotate`) and reads back on the
- * method-lifecycle hook context. Framework-neutral: kitcore does not know or
- * constrain the keys.
+ * Convention: the FIRST union variant is the canonical schema. Every plugin
+ * that uses unions follows this; it's explicit and needs no extra metadata.
+ * Runtime validation still uses the full union; only shape reading canonicalizes.
  */
-type Annotations = Record<string, unknown>;
+declare function canonicalInputSchema(schema: z.ZodSchema | undefined): z.ZodSchema | undefined;
+/** Strip optional/default/nullable wrappers to the inner schema, tracking
+ * whether the wrappers made the field non-required. */
+declare function unwrapSchema(schema: z.ZodType): {
+    inner: z.ZodType;
+    required: boolean;
+};
 /**
- * Origin of a call's root. `"surface"` = entered through the SDK surface, or a
- * parent-less runtime delegation that still represents real user work;
- * `"internal"` = a framework-internal root minted by kitcore's own machinery,
- * which a head can suppress from telemetry.
+ * The object shape of a method's input schema, or undefined when the schema is
+ * absent or not a plain object. A required-rename union (`z.union([canonical,
+ * deprecated])`) is canonicalized to its first variant first, and
+ * optional/default/nullable wrappers are stripped, so a schema whose fields are
+ * readable at all is read rather than treated as shapeless.
  */
-type CallOrigin = "surface" | "internal";
-interface CallContext {
-    /**
-     * Minted once at the root call; copied verbatim to every nested (child) call.
-     * `readonly`: method code owns only the `annotations` bag. A child copies this
-     * off the live parent when the delegated call fires, so mutating it mid-run
-     * would corrupt the child's correlation id.
-     */
-    readonly callId: string | null;
+declare function objectShapeOf(schema: z.ZodSchema | undefined): Record<string, z.ZodType> | undefined;
+interface FormattedItem {
+    title: string;
     /**
-     * 0 at the outermost call; `parent.depth + 1` for a delegated call. `readonly`
-     * for the same reason as `callId` — a mutated depth would mis-nest children
-     * and, where ALS can't correct it (browsers), duplicate telemetry.
+     * Secondary identifying context shown dimmed after the title (ids, keys,
+     * slugs, ...). A dumb visual string a renderer shows verbatim, never
+     * structured data it has to interpret; the same role as a prompt choice's
+     * `hint`. An array is joined with ", ". Structured fields live on the
+     * response / `outputSchema`, not here, so the renderer stays dumb.
      */
-    readonly depth: number;
+    hint?: string | string[];
+    /** @deprecated Use `hint` (the renderer no longer interprets ids). */
+    id?: string;
+    /** @deprecated Use `hint`. */
+    key?: string;
+    /** @deprecated Use `hint`. */
+    keys?: string[];
+    description?: string;
+    /** If provided, the renderer shows this raw (verbatim) instead of `details`. */
+    raw?: unknown;
+    details: Array<{
+        label?: string;
+        text: string;
+        style: "normal" | "dim" | "accent" | "warning" | "success";
+    }>;
+}
+declare function getOutputSchema(inputSchema: z.ZodType): z.ZodType | undefined;
+declare function withOutputSchema<T extends z.ZodType>(inputSchema: T, outputSchema: z.ZodType): T & {
+    _def: T["_def"] & {
+        outputSchema: z.ZodType;
+    };
+};
+/** A selectable option in a prompt. `label` is the display text; `value` is
+ * what the resolver returns when picked. */
+interface PromptConfigChoice {
+    label: string;
+    value: unknown;
     /**
-     * Per-invocation scratch space. Never forwarded to callees — a child call
-     * gets a fresh bag — so annotations describe one method's own invocation.
-     * Method `run` code contributes through the run bag's `annotate` function
-     * rather than writing here directly; the bag reference is fixed, only its
-     * contents change.
-     */
-    readonly annotations: Annotations;
-    /**
-     * Origin of the call's root, copied verbatim to every child. `"surface"`
-     * (the default) marks a surface-origin root — a call that entered through the
-     * SDK surface, or a parent-less runtime delegation that still represents real
-     * user work (e.g. a delegation proxy reaching another method). `"internal"`
-     * marks a framework-internal root minted by kitcore's own build-time machinery
-     * (resolver/formatter/dispose/observer twins, `resolvePlugin`), which a head
-     * can suppress from telemetry. Orthogonal to `depth`: an internal root is
-     * still `depth 0`. `readonly` so a child can't inherit a mutated origin.
-     */
-    readonly callOrigin: CallOrigin;
-    readonly [CALL_CONTEXT_BRAND]: true;
-}
-
-/**
- * Method-call lifecycle hooks. Plugins contribute `onMethodStart` and/or
- * `onMethodEnd` observers, plus an optional pre-run `annotator` that returns
- * fields merged into the call's annotation bag; `buildHooks` composes each
- * across plugins so multiple contributors coexist. Composition is right-additive
- * (newer plugins fire — and `annotator` fields win — after earlier ones); only
- * opt-in methods built through `createPluginMethod` /
- * `createPaginatedPluginMethod` trigger the hooks.
- */
-
-interface OnMethodStartContext {
-    methodName: string;
-    args: unknown[];
-    isPaginated: boolean;
-    /**
-     * Depth of this method invocation in the SDK call tree. 0 = outermost
-     * (user-initiated) call; 1+ = called from inside another SDK method.
-     * Observers can use this to ignore nested calls if they only want
-     * top-level events.
-     */
-    depth: number;
-    /** The call's correlation id, copied from the per-call context; `null` where
-     * id minting was unavailable. */
-    callId: string | null;
-    /**
-     * Origin of the call's root, copied from the per-call context. `"surface"` =
-     * surface-origin (an SDK-surface call or a runtime delegation — real user
-     * work); `"internal"` = a framework-internal call minted by kitcore's own
-     * machinery (resolver/formatter/dispose/observer twins, `resolvePlugin`).
-     * Orthogonal to `depth` (an internal call is still `depth 0`); a head can drop
-     * internal-origin calls from telemetry.
-     */
-    callOrigin: CallOrigin;
-    /**
-     * The call's annotation bag, carried live from the per-call context. At
-     * `onMethodStart` it holds the early-knowable fields (boundary annotator +
-     * a method's pre-run `annotator`); by `onMethodEnd` any mid-`run` writes
-     * are visible too (same object reference throughout the call).
-     */
-    annotations: Annotations;
-}
-type OnMethodStart = (ctx: OnMethodStartContext) => void;
-interface OnMethodEndContext extends OnMethodStartContext {
-    durationMs: number;
-    error?: Error;
-}
-type OnMethodEnd = (ctx: OnMethodEndContext) => void;
-/**
- * A composed pre-run annotator: given a call's method name and (normalized,
- * pre-validation) input, it returns {@link Annotations} the boundary merges into
- * the call's bag before `onMethodStart`. Unlike the `void` lifecycle observers,
- * this one returns a value; composition merges the returned bags rather than
- * chaining side effects. A contributor with nothing to add returns an empty bag,
- * so absence is modelled by no annotator rather than an `undefined` return.
- */
-type ComposedAnnotator = (ctx: {
-    methodName: string;
-    input: unknown;
-}) => Annotations;
-interface MethodHooks {
-    onMethodStart?: OnMethodStart;
-    onMethodEnd?: OnMethodEnd;
-    annotator?: ComposedAnnotator;
-}
-
-/**
- * API stability tiers.
- *
- * A plugin declares exactly one level via `PluginMeta.stability`; tier
- * membership (which subpath aggregate exports the plugin) is structural,
- * so nothing here compares levels ordinally. The array is the single
- * source of truth: it derives the {@link StabilityLevel} type, gives the
- * ladder tests their adjacent-tier iteration order, and gives docs a
- * render order.
- */
-declare const STABILITY_LEVELS: readonly ["stable", "beta", "experimental"];
-type StabilityLevel = (typeof STABILITY_LEVELS)[number];
-/**
- * Title-case display names for each level, for section-level badges in
- * generated docs (e.g. `Code Workflows (Beta)`). Inline description
- * labels go through {@link applyStabilityLabel} instead.
- */
-declare const STABILITY_TITLES: {
-    readonly stable: "Stable";
-    readonly beta: "Beta";
-    readonly experimental: "Experimental";
-};
-/**
- * Normalize authored meta to a concrete level: absent means `"stable"`,
- * and the deprecated `experimental: true` boolean means `"experimental"`.
- * The registry projection runs every entry through this, so
- * `FunctionRegistryEntry.stability` is always concrete and consumers
- * never branch on `undefined`.
- *
- * The declared value can cross a JSON boundary from a hand-written
- * plugin, so at runtime it may be any string. An unrecognized level
- * clamps to `"experimental"` — the author declared the method not
- * stable, and clamping keeps the raw string out of notices and labels.
- * It doesn't throw because this also runs in the `getStability` live
- * read on the call path, where a throw would break the observed call.
- */
-declare function normalizeStability(meta: {
-    stability?: StabilityLevel;
-    experimental?: boolean;
-}): StabilityLevel;
-/**
- * The shared label renderer: every consumer that renders a registry
- * entry's description (CLI help, MCP tool descriptions) labels it
- * through this function, so a new consumer cannot silently drop the
- * label. `stability` stays structured data on the registry entry — the
- * label is applied at render time, never baked into the stored
- * description (docs badge at the section level, so baking it in would
- * double-badge).
- *
- * The label follows the plugin's declared level, not the subpath that
- * surfaced it: a beta method surfaced through an experimental-tier
- * consumer still reads "(beta)".
- */
-declare function applyStabilityLabel({ description, stability, placement, }: {
-    description: string;
-    /** Absent means stable (the value may arrive from outside the
-     * normalized registry projection, e.g. hand-built JSON). */
-    stability: StabilityLevel | undefined;
-    /**
-     * `"suffix"` renders `<description> (beta)` (CLI help);
-     * `"prefix"` renders `[Beta] <description>` (MCP tool descriptions,
-     * where the front of the string is what an LLM reads first).
-     */
-    placement?: "suffix" | "prefix";
-}): string;
-
-/**
- * Plugins with a required-parameter rename declare two schemas: a canonical one
- * (new names only, carrying `.meta({ aliases })`) and a `z.union([canonical,
- * deprecated])` for runtime input parsing (so callers passing old names still
- * validate). The union has no object shape, so everything that reads parameter
- * shape/requiredness — the registry projection, generated docs, and the
- * resolution planner — must read the canonical variant, not the union.
- *
- * Convention: the FIRST union variant is the canonical schema. Every plugin
- * that uses unions follows this; it's explicit and needs no extra metadata.
- * Runtime validation still uses the full union; only shape reading canonicalizes.
- */
-declare function canonicalInputSchema(schema: z.ZodSchema | undefined): z.ZodSchema | undefined;
-/** Strip optional/default/nullable wrappers to the inner schema, tracking
- * whether the wrappers made the field non-required. */
-declare function unwrapSchema(schema: z.ZodType): {
-    inner: z.ZodType;
-    required: boolean;
-};
-/**
- * The object shape of a method's input schema, or undefined when the schema is
- * absent or not a plain object. A required-rename union (`z.union([canonical,
- * deprecated])`) is canonicalized to its first variant first, and
- * optional/default/nullable wrappers are stripped, so a schema whose fields are
- * readable at all is read rather than treated as shapeless.
- */
-declare function objectShapeOf(schema: z.ZodSchema | undefined): Record<string, z.ZodType> | undefined;
-interface FormattedItem {
-    title: string;
-    /**
-     * Secondary identifying context shown dimmed after the title (ids, keys,
-     * slugs, ...). A dumb visual string a renderer shows verbatim, never
-     * structured data it has to interpret; the same role as a prompt choice's
-     * `hint`. An array is joined with ", ". Structured fields live on the
-     * response / `outputSchema`, not here, so the renderer stays dumb.
-     */
-    hint?: string | string[];
-    /** @deprecated Use `hint` (the renderer no longer interprets ids). */
-    id?: string;
-    /** @deprecated Use `hint`. */
-    key?: string;
-    /** @deprecated Use `hint`. */
-    keys?: string[];
-    description?: string;
-    /** If provided, the renderer shows this raw (verbatim) instead of `details`. */
-    raw?: unknown;
-    details: Array<{
-        label?: string;
-        text: string;
-        style: "normal" | "dim" | "accent" | "warning" | "success";
-    }>;
-}
-interface OutputFormatter<TSdk, TItem = unknown, TParams = Record<string, unknown>, TContext = unknown> {
-    fetch?: (sdk: TSdk, params: TParams, item: TItem, context: TContext | undefined) => Promise<TContext>;
-    format: (item: TItem, context?: TContext) => FormattedItem;
-}
-declare function getOutputSchema(inputSchema: z.ZodType): z.ZodType | undefined;
-declare function withOutputSchema<T extends z.ZodType>(inputSchema: T, outputSchema: z.ZodType): T & {
-    _def: T["_def"] & {
-        outputSchema: z.ZodType;
-    };
-};
-/** A selectable option in a prompt. `label` is the display text; `value` is
- * what the resolver returns when picked. */
-interface PromptConfigChoice {
-    label: string;
-    value: unknown;
-    /**
-     * Optional secondary info shown after the label. The CLI wraps it in
-     * dimmed parens; an array is joined with ", ". Use for keys, ids, or
-     * other context that's useful but shouldn't compete visually with
-     * the primary label.
+     * Optional secondary info shown after the label. The CLI wraps it in
+     * dimmed parens; an array is joined with ", ". Use for keys, ids, or
+     * other context that's useful but shouldn't compete visually with
+     * the primary label.
      */
     hint?: string | string[];
 }
@@ -681,69 +595,288 @@ declare function openEnum<const T extends readonly [string, ...string[]]>(values
 }>, z.ZodString]>;
 
 /**
- * Descriptive metadata a leaf carries for the registry / CLI / MCP / docs:
- * description, categories, type, formatter, resolvers, etc.
- * Reuses the shipped `PluginMeta` minus `inputSchema`, which is a first-class
- * descriptor field (it also drives `input` typing and runtime validation).
+ * The external escape-hatch key for an SDK's context. A Symbol,
+ * not a string, so it stays off the string surface (which is exactly the root's
+ * exports) and is collision-free and clearly internal. It is attached at
+ * runtime but kept OUT of the public SDK type (a `unique symbol` in an exported
+ * type can't be named in a consumer's emitted `.d.ts`); reach it through the
+ * typed `getContext(sdk)` accessor.
+ *
+ * `Symbol.for`, not `Symbol()`: heads bundle kitcore (tsup `noExternal`), so
+ * an sdk built by one bundle's copy must still be readable by another copy's
+ * `getContext` / `resolvePlugin` (e.g. a CLI sdk inspected with helpers
+ * imported from `@zapier/zapier-sdk`). The global symbol registry makes every
+ * copy agree on the key.
  */
-type LeafMeta = Omit<PluginMeta, "inputSchema">;
+declare const CONTEXT: unique symbol;
+
 /**
- * The descriptive registry fields a `defineMethod` / `defineProperty` author
- * sets directly on the config (hoisted, not nested under a `meta` wrapper).
- * The impl folds whichever are present back into the stored `LeafMeta`. This is
- * the strict, explicit subset of `PluginMeta` (no `[key: string]: any` escape
- * hatch, no `inputSchema` / `formatter` / `resolvers` — those are first-class
- * config fields of their own).
+ * API stability tiers.
+ *
+ * A plugin declares exactly one level via `MethodMeta.stability`; tier
+ * membership (which subpath aggregate exports the plugin) is structural,
+ * so nothing here compares levels ordinally. The array is the single
+ * source of truth: it derives the {@link StabilityLevel} type, gives the
+ * ladder tests their adjacent-tier iteration order, and gives docs a
+ * render order.
  */
-interface LeafMetaFields {
-    description?: string;
-    categories?: (string | CategoryDefinition)[];
-    type?: "list" | "item" | "create" | "update" | "delete" | "function";
-    itemType?: string;
-    returnType?: string;
-    outputSchema?: z.ZodSchema;
-    /** Behavioral opt-out that rides on this config for every `defineMethod`
-     * overload (all merge `LeafMetaFields`), the partner of `outputSchema`: when
-     * true, the materializer skips validating/stripping the output. It is
-     * consumed at build time and stored as a first-class plugin field, NOT folded
-     * into the projected meta (hence absent from `LEAF_META_KEYS`), so it stays
-     * off the registry / CLI / MCP surface, exactly like `skipInputValidation`. */
-    skipOutputValidation?: boolean;
-    packages?: string[];
-    stability?: StabilityLevel;
-    /** @deprecated Use `stability: "experimental"` instead. */
-    experimental?: boolean;
-    confirm?: "create-secret" | "delete";
-    deprecation?: FunctionDeprecation;
-    aliases?: Record<string, string>;
-    supportsJsonOutput?: boolean;
-}
+declare const STABILITY_LEVELS: readonly ["stable", "beta", "experimental"];
+type StabilityLevel = (typeof STABILITY_LEVELS)[number];
 /**
- * The meta an override may patch onto an already-built method.
- *
- * An allow-list, so a field added to {@link LeafMetaFields} later is refused
- * until someone decides it is safe. Naming the dangerous fields instead would
- * hand every future field to overrides by default, and the default has to be
- * the safe one: an override changes how a surface PRESENTS a method, never what
- * runs, what input is accepted, or what safety gate fires. Nothing re-checks
- * the method's declared TypeScript type after `defineMethod` fixes it.
- *
- * What that rule rules out, and why each is dangerous rather than merely
- * unused:
- *
- * - `outputSchema` decides what output validation enforces. Patching it makes
- *   a call fail against a contract its own return type says it satisfies.
- * - `confirm` gates a host's confirmation prompt. Patching it can drop the
- *   prompt in front of a destructive call.
+ * Title-case display names for each level, for section-level badges in
+ * generated docs (e.g. `Code Workflows (Beta)`). Inline description
+ * labels go through {@link applyStabilityLabel} instead.
+ */
+declare const STABILITY_TITLES: {
+    readonly stable: "Stable";
+    readonly beta: "Beta";
+    readonly experimental: "Experimental";
+};
+/**
+ * Normalize authored meta to a concrete level: absent means `"stable"`,
+ * and the deprecated `experimental: true` boolean means `"experimental"`.
+ * The registry projection runs every entry through this, so
+ * `FunctionRegistryEntry.stability` is always concrete and consumers
+ * never branch on `undefined`.
+ *
+ * The declared value can cross a JSON boundary from a hand-written
+ * plugin, so at runtime it may be any string. An unrecognized level
+ * clamps to `"experimental"` — the author declared the method not
+ * stable, and clamping keeps the raw string out of notices and labels.
+ * It doesn't throw because this also runs in the `getStability` live
+ * read on the call path, where a throw would break the observed call.
+ */
+declare function normalizeStability(meta: {
+    stability?: StabilityLevel;
+    experimental?: boolean;
+}): StabilityLevel;
+/**
+ * The shared label renderer: every consumer that renders a registry
+ * entry's description (CLI help, MCP tool descriptions) labels it
+ * through this function, so a new consumer cannot silently drop the
+ * label. `stability` stays structured data on the registry entry — the
+ * label is applied at render time, never baked into the stored
+ * description (docs badge at the section level, so baking it in would
+ * double-badge).
+ *
+ * The label follows the plugin's declared level, not the subpath that
+ * surfaced it: a beta method surfaced through an experimental-tier
+ * consumer still reads "(beta)".
+ */
+declare function applyStabilityLabel({ description, stability, placement, }: {
+    description: string;
+    /** Absent means stable (the value may arrive from outside the
+     * normalized registry projection, e.g. hand-built JSON). */
+    stability: StabilityLevel | undefined;
+    /**
+     * `"suffix"` renders `<description> (beta)` (CLI help);
+     * `"prefix"` renders `[Beta] <description>` (MCP tool descriptions,
+     * where the front of the string is what an LLM reads first).
+     */
+    placement?: "suffix" | "prefix";
+}): string;
+
+/**
+ * Declaration for a registry category (a bucket grouping related functions).
+ * Plugins reference categories in their `meta.categories` field, as either a
+ * bare key (auto-derive title and plural) or this object (override either).
+ *
+ * Examples (with auto-derive rules):
+ * - `{ key: "app" }`               → title "App", plural "Apps"
+ * - `{ key: "client-credentials" }` → title "Client Credentials", plural "Client Credentials"
+ * - `{ key: "utility" }`           → title "Utility", plural "Utilities"
+ * - `{ key: "http", title: "HTTP Request" }` → plural "HTTP Requests"
+ */
+interface CategoryDefinition {
+    key: string;
+    /** Display title for the category. Auto-derived from `key` if omitted. */
+    title?: string;
+    /** Plural form of `title`. Auto-derived from the resolved title if omitted. */
+    titlePlural?: string;
+}
+interface FunctionRegistryEntry {
+    name: string;
+    /**
+     * Human-readable description of the function. Surfaced wherever the
+     * registry is consumed (command help, tool/RPC descriptions, generated
+     * documentation). Prefer providing this directly rather than relying
+     * solely on inputSchema.describe().
+     */
+    description?: string;
+    type?: "list" | "item" | "create" | "update" | "delete" | "function";
+    itemType?: string;
+    returnType?: string;
+    inputSchema?: z.ZodSchema;
+    /**
+     * When true, the method owns its input validation and its boundary passes the
+     * input through unparsed. The resolution controller reads this to skip its
+     * final `safeParse` (it still uses `inputSchema` to plan/prompt parameters),
+     * so a method routed through the controller isn't re-validated against a
+     * schema it deliberately opts out of. Lifted off the materialized entry.
+     */
+    skipInputValidation?: boolean;
+    outputSchema?: z.ZodSchema;
+    /**
+     * Ordered input keys the public surface projects onto positional arguments
+     * (the method's `positional` declaration). Absent when the method takes only
+     * the canonical single bag. Lifted off the materialized method entry by the
+     * surface builder, like `resolvers` — a runtime projection, not
+     * descriptive meta.
+     */
+    positional?: readonly string[];
+    categories: string[];
+    /**
+     * Per-parameter bound resolvers (imports already captured, called with
+     * `input` only, no sdk). Lifted off the materialized method entry by the
+     * surface builder.
+     */
+    resolvers?: Record<string, BoundResolver>;
+    packages?: string[];
+    /**
+     * API stability tier of the plugin, normalized from `MethodMeta.stability`
+     * (absent means `"stable"`; the legacy `experimental: true` boolean means
+     * `"experimental"`). Always concrete here, so consumers never branch on
+     * `undefined`.
+     */
+    stability: StabilityLevel;
+    /**
+     * @deprecated Read `stability` instead. Derived as
+     * `stability === "experimental"` — literal by name, so beta reads
+     * `false`; the not-stable warning duty lives in `stability` and the
+     * runtime stability notice.
+     */
+    experimental?: boolean;
+    /** Confirmation prompt type - prompts user before executing */
+    confirm?: "create-secret" | "delete";
+    /**
+     * Optional deprecation metadata for commands.
+     */
+    deprecation?: FunctionDeprecation;
+    /**
+     * Short aliases for parameter names (e.g., { request: "X", header: "H" }).
+     * Consumers that render the function as a flag-style command surface use
+     * these as short forms.
+     */
+    aliases?: Record<string, string>;
+    /**
+     * Output formatter, normalized to the bound runtime shape (its imports
+     * already captured), so consumers call `getContext`/`format` with no sdk.
+     * The surface builder lifts this off the method entry, where `defineFormatter`
+     * bound it at materialization.
+     */
+    formatter?: BoundFormatter;
+    /** Defaults to true. Set to false to suppress --json (e.g. login/logout/init). */
+    supportsJsonOutput: boolean;
+}
+interface FunctionDeprecation {
+    /** User-facing deprecation message for why/how to migrate */
+    message: string;
+}
+interface RegistryResult {
+    functions: FunctionRegistryEntry[];
+    categories: {
+        key: string;
+        title: string;
+        titlePlural: string;
+        functions: string[];
+    }[];
+}
+
+/**
+ * ------------------------------
+ * Plugin Metadata
+ * ------------------------------
+ *
+ * The description fields a method or property carries for the registry, the
+ * CLI, MCP, and the docs generators. An author sets them directly on a
+ * `defineMethod` / `defineProperty` config, the descriptor carries them as its
+ * own fields, a `defineOverride` patches a subset onto the entry, and the
+ * registry projection merges the two.
+ * Nothing here changes what a method does. The two schemas are not here: they
+ * drive typing and validation, so they are fields of the method itself.
+ */
+
+interface PropertyMeta {
+    /**
+     * Human-readable description. Used by the CLI (help text), MCP (tool
+     * description), and README generators. For a method, falls back to the
+     * inputSchema's `.describe()` value when omitted.
+     */
+    description?: string;
+    /**
+     * Buckets this plugin belongs to in `getRegistry()` output. Each entry is
+     * either a bare key (`"app"`) for auto-derived titles or a {@link CategoryDefinition}
+     * object to override the title or plural. Only one plugin needs to supply
+     * the object form per category key; object refs win over string refs, so
+     * other plugins in the same bucket can stay on bare strings.
+     */
+    categories?: (string | CategoryDefinition)[];
+    /** Which package surfaces (`"sdk"`, `"cli"`, `"mcp"`) include it. */
+    packages?: string[];
+    /**
+     * API stability tier this plugin belongs to. Absent means `"stable"`;
+     * the registry projection normalizes it, so registry consumers always
+     * read a concrete {@link StabilityLevel}. Wrappers keep non-stable
+     * plugins out of their stable build (by gating them behind a `beta` /
+     * `experimental` subpath import) and consumers badge the level in
+     * generated docs, CLI help, and MCP tool descriptions. No runtime
+     * capability check.
+     */
+    stability?: StabilityLevel;
+    /**
+     * @deprecated Use `stability: "experimental"` instead. Kept as an
+     * input for external authors; `true` normalizes to
+     * `stability: "experimental"` in the registry projection.
+     */
+    experimental?: boolean;
+    deprecation?: FunctionDeprecation;
+}
+/**
+ * A method's description fields: everything a property has, plus what only a
+ * callable can carry. A `defineOverride` patches the safe subset of these, see
+ * `OverridableMetaFields`.
+ */
+interface MethodMeta extends PropertyMeta {
+    type?: "list" | "item" | "create" | "update" | "delete" | "function";
+    itemType?: string;
+    returnType?: string;
+    /** Confirmation prompt type - prompts user before executing */
+    confirm?: "create-secret" | "delete";
+    /** Parameter name to CLI flag name. */
+    aliases?: Record<string, string>;
+    supportsJsonOutput?: boolean;
+}
+/** @deprecated Use {@link MethodMeta} or {@link PropertyMeta}. */
+type PluginMeta = MethodMeta;
+
+/** @deprecated Use {@link MethodMeta} or {@link PropertyMeta}. */
+type LeafMeta = MethodMeta;
+/**
+ * The description fields an override may patch onto an already-built method.
+ * One list serves both sides: `defineOverride` refuses any other key at
+ * runtime, and `OverridableMetaFields` is derived from it, so the type and the
+ * runtime guard cannot drift.
+ *
+ * An allow-list, so a field added to {@link MethodMeta} later is refused
+ * until someone decides it is safe. Naming the dangerous fields instead would
+ * hand every future field to overrides by default, and the default has to be
+ * the safe one: an override changes how a surface PRESENTS a method, never what
+ * runs, what input is accepted, or what safety gate fires. Nothing re-checks
+ * the method's declared TypeScript type after `defineMethod` fixes it.
+ *
+ * What that rule rules out, and why each is dangerous rather than merely
+ * unused:
+ *
+ * - `confirm` gates a host's confirmation prompt. Patching it can drop the
+ *   prompt in front of a destructive call.
  * - `type` reaches `confirm` indirectly: the registry derives
  *   `confirm: m.confirm ?? (m.type === "delete" ? "delete" : undefined)`, so
  *   moving a method off `"delete"` removes the same prompt quietly.
  * - `aliases` maps a parameter to a CLI flag, so patching it changes which
  *   input a caller can pass.
- * - `skipOutputValidation` is already unreachable, being absent from
- *   `LEAF_META_KEYS` and never folded into the projected meta.
  */
-type OverridableMetaFields = Pick<LeafMetaFields, "description" | "categories" | "itemType" | "returnType" | "packages" | "experimental" | "deprecation" | "supportsJsonOutput">;
+declare const OVERRIDABLE_META_KEYS: readonly ["description", "categories", "itemType", "returnType", "packages", "experimental", "deprecation", "supportsJsonOutput"];
+type OverridableMetaFields = Pick<MethodMeta, (typeof OVERRIDABLE_META_KEYS)[number]>;
 /** One segment of a {@link DynamicMember} path: a literal binding/segment name,
  * or a `{ param }` placeholder for an open-ended key (rendered `{param}`). */
 type DynamicMemberSegment = string | {
@@ -754,22 +887,25 @@ type DynamicMemberSegment = string | {
  * (e.g. `apps.{appKey}.{actionType}.{actionKey}`), backed at runtime by a proxy.
  * It is a bodyless declaration — the same descriptive fields an author sets on a
  * leaf, keyed by a `path` instead of a `name`. The framework derives the
- * registry name by joining the path (params rendered `{param}`) and folds these
- * fields into a `PluginMeta` for the registry / CLI / MCP / docs projection.
+ * registry name by joining the path (params rendered `{param}`) and projects
+ * these fields into the registry / CLI / MCP / docs like a method's.
  * `path[0]` must be a literal that resolves to a real surfaced binding (the
  * owning member).
  */
 type DynamicMember = {
     path: readonly DynamicMemberSegment[];
-    /** Projection-only input schema (no runtime; the proxy validates its own). */
+    /** Projection-only schemas (no runtime; the proxy validates its own). */
     inputSchema?: z.ZodType;
-} & LeafMetaFields;
+    outputSchema?: z.ZodSchema;
+} & MethodMeta;
 /** A {@link DynamicMember} normalized at define time: the derived registry name,
- * the literal root segment (validated against the surface), and the folded meta. */
-interface NormalizedDynamicMember {
+ * the literal root segment (validated against the surface), and its description. */
+interface NormalizedDynamicMember extends MethodMeta {
     name: string;
     rootBinding: string;
-    meta: PluginMeta;
+    /** Projection-only, like the schemas a method entry carries. */
+    inputSchema?: z.ZodType;
+    outputSchema?: z.ZodSchema;
 }
 type AnyMethodPlugin = MethodPlugin<string, any, any, readonly string[]>;
 type AnyPropertyPlugin = PropertyPlugin<string, any>;
@@ -781,7 +917,7 @@ type AnyLeafPlugin = AnyMethodPlugin | AnyPropertyPlugin;
  * `selectExports(...)` element contributes its chosen bindings. To rename or
  * subset, wrap an element in `selectExports`; there is no alias-map form.
  */
-type ImportsInput = readonly AnyPlugin[];
+type ImportsInput = readonly Plugin[];
 /** A resolved import edge: the local binding name and the plugin id it reads
  * from `context.plugins` (id, not identity, so a swap stays transparent). */
 interface ImportBinding {
@@ -838,7 +974,7 @@ type SurfaceCall<TInput, TOutput, TPositional extends readonly string[]> = TPosi
  * its own name (method callable or property value), an aggregate under each of
  * its export names — exactly the dependency's {@link PluginSurface}.
  */
-type BindingsOf<TDep extends AnyPlugin> = PluginSurface<TDep>;
+type BindingsOf<TDep extends Plugin> = PluginSurface<TDep>;
 /**
  * The `imports` a body receives. Each element contributes its bindings
  * (`BindingsOf`); empty imports yield an empty object.
@@ -888,7 +1024,7 @@ type HookAnnotator<TState = unknown> = (bag: {
 /** Shared plumbing for the method attachments: each declares its own
  * dependencies. Resolvers and formatters are otherwise separate concepts. */
 interface MethodAttachment {
-    imports: readonly AnyPlugin[];
+    imports: readonly Plugin[];
     /** Binding-name to plugin-id edges, normalized from `imports`; what the
      * narrowed bag captured at materialization is built from. */
     importBindings: readonly ImportBinding[];
@@ -1261,29 +1397,43 @@ interface BoundFormatter<TItem = unknown, TInput = Record<string, unknown>, TCon
  * `run` is loosely typed for `imports` (the precise type lives on the
  * `defineMethod` authoring surface, like the shipped definePlugin).
  */
-interface MethodPlugin<TName extends string = string, TInput = unknown, TOutput = unknown, TPositional extends readonly string[] = readonly [], 
+/** Every `pluginType` the model builds. */
+type PluginType = "method" | "property" | "aggregate" | "hook" | "method-override";
 /**
- * What `run` receives, when that differs from what a CALLER may pass.
- *
- * They part company for item and list, whose call type mixes in
- * {@link CallOutputOptions} and {@link PaginatedCallInput}. Those are the
- * framework's, peeled off before `run`, so folding them into one parameter
- * told a consumer reading `Parameters<typeof plugin.run>[0]` that `run` gets
- * a flag the runtime always removes.
- *
- * Defaults to `TInput`, since raw's caller and `run` see the same object.
+ * What every plugin descriptor carries, whatever its kind. `pluginType` is the
+ * discriminant, and each kind narrows it. `imports` and `importBindings` are on
+ * every kind so the graph walk treats them alike (an override's are empty).
  */
-TRunInput = TInput> {
-    pluginType: "method";
+interface PluginBase<TName extends string = string> {
+    pluginType: PluginType;
     name: TName;
     namespace?: string;
     /** `namespace/name`, or bare `name`. The `context.plugins` key. */
     id: string;
-    /** True for a `declareMethod` stand-in: a typed reference with no real
+    imports: readonly Plugin[];
+    /** Binding-name to plugin-id edges, normalized from `imports`; what the
+     * `imports` bag is built from. */
+    importBindings: readonly ImportBinding[];
+}
+/** `setup` runs once at build, dependencies first, and returns the plugin's
+ * private state. `dispose` releases what it acquired, in reverse build order. */
+interface PluginLifecycle {
+    setup?: (bag: {
+        imports: Record<string, unknown>;
+    }) => unknown;
+    dispose?: DisposeFn;
+}
+/**
+ * A method or property. A `declare*` stand-in wears the same shape with no
+ * implementation, and a `declareDefault` wrapper marks the fallback provider
+ * for an id.
+ */
+interface LeafBase<TName extends string = string> extends PluginBase<TName>, PluginLifecycle {
+    /** True for a `declare*` stand-in: a typed reference with no real
      * implementation. A real plugin under the same id satisfies it. */
     standIn?: boolean;
-    /** True for a `declareOptionalMethod` stand-in: dependents bind `undefined` if
-     * no real plugin satisfies it, and `PluginSurface` types the binding
+    /** True for a `declareOptional*` stand-in: dependents bind `undefined` if no
+     * real plugin satisfies it, and `PluginSurface` types the binding
      * `| undefined`. */
     optional?: boolean;
     /** Present on a `declareDefault` wrapper: this entry is the DEFAULT provider
@@ -1291,34 +1441,37 @@ TRunInput = TInput> {
      * plugin, so two defaults for one id dedup (same source) or conflict
      * (different source). */
     defaultSource?: AnyLeafPlugin;
-    imports: readonly AnyPlugin[];
-    /** Binding-name to plugin-id edges, normalized from `imports`;
-     * what the `imports` bag is built from. */
-    importBindings: readonly ImportBinding[];
-    /** Optional per-materialization constructor: runs once at createSdk
-     * (dependencies first), may side-effect, and returns the method's private
-     * state (delivered to `run` as `bag.state`). */
-    setup?: (bag: {
-        imports: Record<string, unknown>;
-    }) => unknown;
-    /** `setup`'s dual: releases what setup acquired. Run by `disposeSdk` in
-     * reverse dependency order. */
-    dispose?: DisposeFn;
-    /** Validates `input` before `run` and drives the authoring `input` type. */
-    inputSchema?: z.ZodType;
-    /** When true, skip the runtime validation/parse of `input`: `run` receives the
-     * raw input untouched — no coercion, stripping, or cloning — even if
-     * `inputSchema` is set (the schema stays for registry / CLI / MCP projection).
-     * For raw methods that own their own validation and must not have their input
-     * transformed, e.g. `fetch` passing a `RequestInit` bag through unchanged. */
-    skipInputValidation?: boolean;
-    /** When true, the materializer skips validating/stripping `run`'s output
-     * against `meta.outputSchema` (the schema stays for projection). The output
-     * partner of {@link MethodPlugin.skipInputValidation}. */
-    skipOutputValidation?: boolean;
-    /** Descriptive metadata for the registry / CLI / MCP / docs (carry-only at
-     * runtime). */
-    meta?: LeafMeta;
+}
+interface MethodPlugin<TName extends string = string, TInput = unknown, TOutput = unknown, TPositional extends readonly string[] = readonly [], 
+/**
+ * What `run` receives, when that differs from what a CALLER may pass.
+ *
+ * They part company for item and list, whose call type mixes in
+ * {@link CallOutputOptions} and {@link PaginatedCallInput}. Those are the
+ * framework's, peeled off before `run`, so folding them into one parameter
+ * told a consumer reading `Parameters<typeof plugin.run>[0]` that `run` gets
+ * a flag the runtime always removes.
+ *
+ * Defaults to `TInput`, since raw's caller and `run` see the same object.
+ */
+TRunInput = TInput> extends LeafBase<TName>, MethodMeta {
+    pluginType: "method";
+    /** Validates `input` before `run` and drives the authoring `input` type. */
+    inputSchema?: z.ZodType;
+    /** When true, skip the runtime validation/parse of `input`: `run` receives the
+     * raw input untouched — no coercion, stripping, or cloning — even if
+     * `inputSchema` is set (the schema stays for registry / CLI / MCP projection).
+     * For raw methods that own their own validation and must not have their input
+     * transformed, e.g. `fetch` passing a `RequestInit` bag through unchanged. */
+    skipInputValidation?: boolean;
+    /** Validates and strips `run`'s output, and describes it for the registry. */
+    outputSchema?: z.ZodSchema;
+    /** When true, the materializer skips validating/stripping `run`'s output
+     * against `outputSchema` (the schema stays for projection). The output
+     * partner of {@link MethodPlugin.skipInputValidation}. */
+    skipOutputValidation?: boolean;
+    /** Descriptive metadata for the registry / CLI / MCP / docs (carry-only at
+     * runtime). */
     /** Per-parameter input resolvers (method attachments). Reached for
      * materialization and bound into the entry at createSdk; a reachability-only
      * edge whose imports never enter this method's `importBindings`. */
@@ -1427,11 +1580,11 @@ type CallOutputOptions = {
  * list-standard overload: a raw envelope with extra keys is not a `StrictPage`
  * and falls through to the adapted overload, where `adaptPage` is required.
  */
-type StrictPage$1<TResponse> = SdkPage<unknown> & {
+type StrictPage<TResponse> = SdkPage<unknown> & {
     [K in Exclude<keyof TResponse, keyof SdkPage<unknown>>]?: never;
 };
 /** Item type sourced from a page-ish response. */
-type ItemOf$1<TResponse> = TResponse extends SdkPage<infer TItem> ? TItem : TResponse extends {
+type ItemOf<TResponse> = TResponse extends SdkPage<infer TItem> ? TItem : TResponse extends {
     data: readonly (infer TItem)[];
 } ? TItem : never;
 /**
@@ -1456,37 +1609,8 @@ type DataOf<TResponse> = TResponse extends {
  * eagerly at createSdk (dependencies first, like a method's `setup`) to build
  * that state. An imported/surfaced property yields the value, not a callable.
  */
-interface PropertyPlugin<TName extends string = string, TValue = unknown> {
+interface PropertyPlugin<TName extends string = string, TValue = unknown> extends LeafBase<TName>, PropertyMeta {
     pluginType: "property";
-    name: TName;
-    namespace?: string;
-    /** `namespace/name`, or bare `name`. The `context.plugins` key. */
-    id: string;
-    /** True for a `declareProperty` stand-in: a typed reference with no value. A
-     * real property under the same id satisfies it. */
-    standIn?: boolean;
-    /** True for a `declareOptionalProperty` stand-in: an optional reference. If no real
-     * property satisfies it, dependents bind `undefined` rather than the build
-     * failing on a missing dependency. */
-    optional?: boolean;
-    /** Present on a `declareDefault` wrapper: this entry is the DEFAULT provider
-     * for its id (preempted by any explicit provider). Its value is the wrapped
-     * plugin, so two defaults for one id dedup (same source) or conflict
-     * (different source). */
-    defaultSource?: AnyLeafPlugin;
-    imports: readonly AnyPlugin[];
-    /** Binding-name to plugin-id edges, normalized from `imports`;
-     * what the `imports` bag is built from. */
-    importBindings: readonly ImportBinding[];
-    /** Optional once-eager constructor (the property twin of a method's `setup`):
-     * runs once at createSdk (dependencies first), may side-effect, and returns the
-     * private state delivered to `get` as `bag.state`. */
-    setup?: (bag: {
-        imports: Record<string, unknown>;
-    }) => unknown;
-    /** `setup`'s dual: releases what setup acquired. Run by `disposeSdk` in
-     * reverse dependency order. */
-    dispose?: DisposeFn;
     value?: TValue;
     /** A live getter: computes the value from imports and `setup` state on each
      * read (not once). The stored shape is loose; the precise typing lives on the
@@ -1496,8 +1620,6 @@ interface PropertyPlugin<TName extends string = string, TValue = unknown> {
         state: unknown;
         callContext?: CallContext;
     }) => TValue;
-    /** Descriptive metadata for the registry / CLI / MCP / docs (carry-only). */
-    meta?: LeafMeta;
     /** Templated registry members for this property's dynamic sub-surface (e.g. a
      * proxy). Carry-only: normalized at define time, folded into the registry. */
     dynamicMembers?: readonly NormalizedDynamicMember[];
@@ -1536,6 +1658,21 @@ type MiddlewareMap<TImports, TState = unknown> = {
         state: TState;
     }) => TOutput : never;
 };
+/**
+ * An aggregate plugin: it re-exports child plugins under binding names. Has no
+ * body of its own; composition is "declare what to re-export".
+ * `exports` keys are binding names; re-exporting a child implies a dependency
+ * on it (it is pulled into the graph). `imports` lists extra internal
+ * plugins to materialize that are not re-exported. `middleware` wraps imported
+ * methods, keyed by the target's binding name.
+ */
+/**
+ * How a module declares its `exports`: an array, mirroring {@link ImportsInput}. A
+ * leaf binds under its own `name`; a module (or `selectExports(...)`)
+ * contributes each of its export bindings (spread). A binding-name collision
+ * throws (wrap one in `selectExports` to rename).
+ */
+type ExportsInput = readonly (AnyLeafPlugin | AnyAggregatePlugin)[];
 /** The export record one array element contributes: a leaf under its own name,
  * a module under each of its export bindings. */
 type ElementExports<E> = E extends MethodPlugin<infer N, any, any, any> ? {
@@ -1550,49 +1687,36 @@ type ElementExports<E> = E extends MethodPlugin<infer N, any, any, any> ? {
 type ArrayExports<T extends readonly (AnyLeafPlugin | AnyAggregatePlugin)[]> = T extends readonly [] ? Record<never, never> : UnionToIntersection<{
     [I in keyof T]: ElementExports<T[I]>;
 }[number]>;
-interface AggregatePlugin<TName extends string = string, TExports extends Record<string, AnyLeafPlugin> = Record<string, AnyLeafPlugin>> {
+/**
+ * Coerce a computed export record to the shape {@link AggregatePlugin} requires.
+ * `ArrayExports` folds with `UnionToIntersection`, whose result the checker
+ * cannot prove satisfies the constraint, so name the fallback rather than
+ * asserting at each use.
+ */
+type AsExports<T> = T extends Record<string, AnyLeafPlugin> ? T : Record<string, AnyLeafPlugin>;
+/**
+ * Reject an `exports` entry that is not a plugin: identity in the good case, an
+ * error brand in the bad case. A deferred conditional rather than a constraint
+ * on the type parameter, because a plugin-shaped constraint contextually types
+ * the array literal and an inline `define*` call then infers `input` as `any`.
+ * `declarePlugin`'s `exports` and every `imports` still carry the constraint;
+ * move them here when something writes an inline `define*` there.
+ */
+type PluginList<T extends readonly unknown[]> = Exclude<T[number], AnyLeafPlugin | AnyAggregatePlugin> extends never ? unknown : {
+    readonly __kitcoreError: "every exports entry must be a plugin built by define*, declare*, selectExports, or omitExports";
+};
+interface AggregatePlugin<TName extends string = string, TExports extends Record<string, AnyLeafPlugin> = Record<string, AnyLeafPlugin>> extends PluginBase<TName> {
     pluginType: "aggregate";
-    name: TName;
-    namespace?: string;
-    /** `namespace/name`, or bare `name`. The `context.plugins` key. */
-    id: string;
     /** True for a `declarePlugin` stand-in: a typed reference to a whole module
      * with no implementation. A real aggregate under the same id satisfies it. */
     standIn?: boolean;
-    imports: readonly AnyPlugin[];
-    /** Binding-name to plugin-id edges, normalized from `imports`; what a
-     * wrap's `imports` is built from, and how a wrap target
-     * binding resolves to a method id. */
-    importBindings: readonly ImportBinding[];
     exports: TExports;
 }
 type AnyAggregatePlugin = AggregatePlugin<string, Record<string, any>>;
-/**
- * A legacy bridge plugin: wraps an old function plugin
- * (`(sdk) => provides`) so it materializes inside the new graph. At
- * materialization it runs `run` against a live compat view, merges the
- * returned context contributions into the shared `SdkContext`, and synthesizes
- * a `context.plugins` entry per root key. `TSurface` is the surfaced shape (the
- * provides minus `context`). This is the single shape `createPluginStack()
- * .toPlugin()` emits; there is no separate interim definition format.
- */
-interface LegacyPlugin<TSurface = Record<string, unknown>> {
-    pluginType: "legacy";
-    name: string;
-    namespace?: string;
-    /** `namespace/name`, or bare `name`. The `context.plugins` key. */
-    id: string;
-    imports: readonly AnyPlugin[];
-    importBindings: readonly ImportBinding[];
-    run: (sdk: any) => PluginProvides;
-    /** Type-only carrier for the surfaced shape; never set at runtime. */
-    readonly __surface?: TSurface;
-}
-type AnyLegacyPlugin = LegacyPlugin<any>;
 /**
  * A patch over an already-defined method's descriptive fields. It carries no
  * `run`: it names an existing method by id (`target`) and, after that method
- * materializes, merges its `meta` (the same public {@link LeafMetaFields} an
+ * materializes, merges its `meta` (the same public {@link MethodMeta} an
  * author sets on `defineMethod`) onto the method's entry, so the surface
  * registry / CLI / MCP / docs project the patched values. For surface-specific
  * tweaks a base method should not carry (e.g. a CLI that deprecates `fetch`
@@ -1602,16 +1726,13 @@ type AnyLegacyPlugin = LegacyPlugin<any>;
  * swaps the whole implementation and forces re-declaring `run`. An override
  * inherits the target's implementation untouched and only patches meta.
  */
-interface MethodOverridePlugin {
+interface MethodOverridePlugin extends PluginBase {
     pluginType: "method-override";
-    name: string;
-    id: string;
     /** The id of the method whose meta is patched (its bare name if the method is
      * namespace-less). */
     target: string;
-    imports: readonly AnyPlugin[];
-    importBindings: readonly ImportBinding[];
-    meta?: LeafMeta;
+    /** The description fields this override sets on its target. */
+    patch: OverridableMetaFields;
 }
 /**
  * A method-lifecycle hook leaf (`defineHook`). `observe` contributes
@@ -1621,22 +1742,10 @@ interface MethodOverridePlugin {
  * (e.g. a telemetry queue), delivered to the observers.
  * Each observer bag mirrors a method's: `{ imports, input, state }` — `input` is
  * the lifecycle context, and there is no `next` (observers don't participate in
- * the call). The module-model replacement for a legacy plugin that contributed
- * `context.hooks`.
+ * the call).
  */
-interface HookPlugin<TName extends string = string> {
+interface HookPlugin<TName extends string = string> extends PluginBase<TName>, PluginLifecycle {
     pluginType: "hook";
-    name: TName;
-    namespace?: string;
-    id: string;
-    imports: readonly AnyPlugin[];
-    importBindings: readonly ImportBinding[];
-    setup?: (bag: {
-        imports: any;
-    }) => unknown;
-    /** `setup`'s dual: releases what setup acquired. Run by `disposeSdk` in
-     * reverse dependency order. */
-    dispose?: DisposeFn;
     /** Contract-preserving wraps around imported methods (the middleware onion,
      * folded dependents-outermost in topological order). Keyed by the target's
      * binding among this hook's `imports`. */
@@ -1657,30 +1766,13 @@ interface HookPlugin<TName extends string = string> {
      * bag before `onMethodStart`. Coexists with other hooks' annotators. */
     annotator?: HookAnnotator;
 }
-type AnyPlugin = AnyLeafPlugin | AnyAggregatePlugin | AnyLegacyPlugin | HookPlugin | MethodOverridePlugin;
-/**
- * A transitional root that merges a legacy function-plugin stack with the
- * module-model plugins migrated off it (see Migration order). At `createSdk` it
- * lifts and runs the legacy stack (like `fromFunctionPlugin`), materializes the
- * module-model `plugin`, and surfaces the union: the legacy stack's methods plus
- * the module plugin's exports. The migrated plugins live in one `plugin`
- * aggregate, so each migration only edits that aggregate's exports, not the
- * heads. Deleted once every plugin is module-model.
- */
-interface LegacyMergePlugin<TProvides extends PluginProvides = PluginProvides, TPlugin extends AnyPlugin = AnyPlugin> {
-    pluginType: "legacy-merge";
-    name: string;
-    namespace?: string;
-    id: string;
-    /** The lifted legacy stack (one node). */
-    legacy: LegacyPlugin<TProvides & {
-        getRegistry: (options?: {
-            package?: string;
-        }) => RegistryResult;
-    }>;
-    /** The module-model plugins migrated off the legacy stack. */
-    plugin: TPlugin;
-}
+/**
+ * A plugin: the descriptor any `define*` call returns, what `createSdk` builds
+ * and `addPlugin` adds, and the type a host gives a slot that accepts plugins.
+ * A `declare*` stand-in matches structurally, so both entry points refuse one
+ * by name at runtime.
+ */
+type Plugin = AnyLeafPlugin | AnyAggregatePlugin | HookPlugin | MethodOverridePlugin;
 /** One middleware layer on a method's chain: the wrap and its owning hook
  * (whose `imports` the wrap receives, built live at call time). */
 interface MiddlewareWrap {
@@ -1689,25 +1781,33 @@ interface MiddlewareWrap {
 }
 /** A materialized method: a stable callable `value` that folds `chain` around
  * the core at call time. The chain is ordered dependents-outermost; it is
- * mutable so post-seal `addPlugin` middleware can append. */
-interface MethodEntry {
+ * mutable so post-seal `addPlugin` middleware can append.
+ *
+ * The description fields are copied off the descriptor at build, like the
+ * runtime fields, and a `defineOverride` writes into them. `descriptor` keeps
+ * what the author wrote. */
+interface MethodEntry extends MethodMeta {
     pluginType: "method";
     name: string;
+    /** The plugin object this entry was built from. Identity for `addPlugin`:
+     * re-adding this object is a no-op, a different object under the same id is
+     * refused. */
+    descriptor: AnyMethodPlugin;
     value: (input: any) => any;
     /** The import-facing twin of `value`: the same boundary, called with the
      * internal-call sentinel so surface-only concerns (the deprecation signal)
      * don't fire when a sibling plugin delegates. `buildImports` and
-     * `resolvePlugin` bind this; the surface and registry bind `value`. Absent
-     * on legacy graph entries (they bind `value`). */
-    internalValue?: (input: any) => any;
+     * `resolvePlugin` bind this through `bindInternal`; the surface and registry
+     * bind `value`. */
+    internalValue: (input: any) => any;
     /** Produce the import-facing twin for a given call context: with a context,
      * the twin mints a fresh child per invocation (callee inherits `callId`, its
      * origin, and sits one level deeper); without one it is parent-less — the
      * surface-origin `internalValue` by default, or a framework-internal root when
      * `frameworkOrigin` is set (kitcore's own build-time passes request it, so
      * their delegated calls can be dropped from telemetry). `buildImports` binds
-     * this. Absent on legacy graph entries. */
-    bindInternal?: (opts: {
+     * this. */
+    bindInternal: (opts: {
         ctx?: CallContext;
         frameworkOrigin?: boolean;
     }) => (...args: any[]) => any;
@@ -1718,7 +1818,9 @@ interface MethodEntry {
      * through unparsed; carried so the controller skips its final `safeParse` too
      * (it still uses `inputSchema` to plan/prompt parameters). */
     skipInputValidation?: boolean;
-    meta?: LeafMeta;
+    /** Carried from the descriptor: validates the output, and the registry
+     * projects it. */
+    outputSchema?: z.ZodSchema;
     /** Resolved output mode; the registry derives presentation from it. */
     output?: NormalizedOutput;
     /** Positional input projection (see Output): ordered canonical-input keys the
@@ -1733,16 +1835,16 @@ interface MethodEntry {
 /** A materialized property: a static `value`, or a live `getValue` thunk that
  * re-derives the value per read (consumers install it as a getter on the surface
  * and on `imports`). Exactly one of `value` / `getValue` is set. */
-interface PropertyEntry {
+interface PropertyEntry extends PropertyMeta {
     pluginType: "property";
     name: string;
+    descriptor: AnyPropertyPlugin;
     value?: any;
     /** Re-derives the value per read. Receives the live per-call `CallContext`
      * when installed on a method's `imports` bag with a threaded context, and
      * nothing on a surface / build-time read. */
     getValue?: (callContext?: CallContext) => any;
     /** Carried from the descriptor for the registry / CLI / MCP / docs. */
-    meta?: LeafMeta;
     /** Carried from the descriptor: templated registry members for this
      * property's dynamic sub-surface (folded into the registry by getRegistry). */
     dynamicMembers?: readonly NormalizedDynamicMember[];
@@ -1752,27 +1854,42 @@ interface PropertyEntry {
 interface AggregateEntry {
     pluginType: "aggregate";
     name: string;
+    descriptor: AnyAggregatePlugin;
     exports: Record<string, any>;
 }
-/** An entry in `context.plugins`. The `value`
- * of a method entry is its callable; of a property entry, its value. */
-type PluginEntry = MethodEntry | PropertyEntry | AggregateEntry;
-/**
- * The materialization substrate: every reachable plugin keyed by
- * id, plus the legacy-compat surface used during migration. The
- * compat fields let adapted function plugins read/write `context` exactly as
- * they do on the shipped stack: `meta` is the per-method registry source, `hooks`
- * the composed lifecycle hooks, and the index signature covers arbitrary legacy
- * fields a function plugin contributes (`api`, `options`, `manifest` helpers,
- * ...). A pure module-model SDK leaves `meta`/`hooks` empty and uses entry-level
- * metadata instead.
+/** A materialized hook. It has no value: its wraps sit on other methods'
+ * chains and its observers in `context.hooks`. The entry records that the
+ * hook is in the graph. */
+interface HookEntry {
+    pluginType: "hook";
+    name: string;
+    descriptor: HookPlugin;
+}
+/** A materialized `defineOverride`. No value: its patch is on the target
+ * method's `meta`. The entry records that the override is in the graph. */
+interface OverrideEntry {
+    pluginType: "method-override";
+    name: string;
+    descriptor: MethodOverridePlugin;
+}
+/** An entry in `context.plugins`, one per plugin in the graph. A method's
+ * `value` is its callable, a property's its value, an aggregate's `exports`
+ * its bindings. A hook and an override have no value. */
+type PluginEntry = MethodEntry | PropertyEntry | AggregateEntry | HookEntry | OverrideEntry;
+/**
+ * The materialization substrate: every reachable plugin keyed by id, plus the
+ * ambient state the method boundary reads. Exhaustive, with no index signature:
+ * a plugin keeps its state in `setup` and reads values through `imports`.
  */
 interface SdkContext {
+    /** Every reachable plugin by id. Created with `Object.create(null)`, as is
+     * `surface`, because the keys are names an author chose: on a `{}` a lookup
+     * of `"toString"` finds `Object.prototype.toString` and a `"__proto__"` write
+     * replaces the prototype instead of adding a key. */
     plugins: Record<string, PluginEntry>;
-    meta: Record<string, PluginMeta>;
     hooks: MethodHooks;
     /** The SDK surface: each callable/value binding name mapped to the leaf plugin
-     * id it resolves to. This is what the consumer actually calls (the root's
+     * id it resolves to. No prototype, for the reason given on `plugins`. This is what the consumer actually calls (the root's
      * re-exports plus `addPlugin` additions), so the registry reports entries by
      * binding (with meta from the leaf) rather than dumping `plugins` by id. An
      * aliased re-export (`{ hi: greet }`) appears here as `hi -> "greet"`. */
@@ -1783,7 +1900,6 @@ interface SdkContext {
     /** The first `disposeSdk` call's settled result; later calls return it
      * (idempotent, first input wins). */
     disposed?: Promise<void>;
-    [key: string]: any;
 }
 /** One leaf's recorded teardown: built at materialization (closing over the
  * leaf's imports + setup state), run by `disposeSdk`. */
@@ -1810,16 +1926,15 @@ type AggregateBindings<TExports extends Record<string, AnyLeafPlugin>> = {
  * The SDK surface a plugin contributes, derived from its descriptor: a
  * method's callable or a property's value under its name, or an aggregate's
  * export bindings. No `SdkInternals` — this is the plugin's own slice, not a
- * whole SDK. The inference replacement for a hand-written
- * `<Name>PluginProvides` interface:
+ * whole SDK. Derive a package's provides type from it rather than hand-writing
+ * the shape:
  *
  *   export type ListAppsPluginProvides = PluginSurface<typeof listAppsPlugin>;
  *
- * "Surface", not "Provides": `PluginProvides` is the legacy function-plugin
- * bag and `ProvidesOf` is the completeness ledger's phantom ids — both
- * different concepts.
+ * "Surface", not "Provides": `ProvidesOf` already names the completeness
+ * ledger's phantom ids, which is a different concept.
  */
-type PluginSurface<P extends AnyPlugin> = P extends MethodPlugin<infer TName, infer TInput, infer TOutput, infer TPositional> ? P extends {
+type PluginSurface<P extends Plugin> = P extends MethodPlugin<infer TName, infer TInput, infer TOutput, infer TPositional> ? P extends {
     optional: true;
 } ? {
     [K in TName]: SurfaceCall<TInput, TOutput, TPositional> | undefined;
@@ -1851,7 +1966,7 @@ type SdkInternals = {
  * The materialized SDK for a leaf root: the root's callable (method) or value
  * (property) under its name, plus framework access.
  */
-type Sdk$1<TName extends string, TInput, TOutput, TPositional extends readonly string[] = readonly []> = {
+type Sdk<TName extends string, TInput, TOutput, TPositional extends readonly string[] = readonly []> = {
     [K in TName]: SurfaceCall<TInput, TOutput, TPositional>;
 } & SdkInternals;
 /** The materialized SDK for a property root: the value under its name. */
@@ -1866,12 +1981,11 @@ type PropertySdk<TName extends string, TValue> = {
 type AggregateSdk<TExports extends Record<string, AnyLeafPlugin>> = AggregateBindings<TExports> & SdkInternals;
 /**
  * The surface a plugin adds to an SDK when passed to `addPlugin`: a method
- * under its name, a property's value, an aggregate's export bindings, or a
- * legacy function plugin's root provides (minus `context`).
+ * under its name, a property's value, or an aggregate's export bindings.
  */
-type AddedSurface<P> = [P] extends [AnyPlugin] ? [
+type AddedSurface<P> = [P] extends [Plugin] ? [
     PluginSurface<P>
-] extends [never] ? Record<never, never> : PluginSurface<P> : P extends (sdk: any) => infer TProvides ? TProvides extends PluginProvides ? Omit<TProvides, "context"> : Record<never, never> : Record<never, never>;
+] extends [never] ? Record<never, never> : PluginSurface<P> : Record<never, never>;
 /** `T` when it is a specific string literal, else `never`. Used on a stand-in's
  * `name` so the id is always captured as a literal: a widened `string` (or the
  * stale `declareMethod<TInput, TOutput>(...)` call shape, where the contract
@@ -1958,7 +2072,7 @@ type RequiresOf<P> = P extends {
     readonly [REQUIRES]?: infer R;
 } ? Extract<R, string> : never;
 /** The ids a plugin and its subgraph provide (reads the phantom carrier). */
-type ProvidesOf$1<P> = P extends {
+type ProvidesOf<P> = P extends {
     readonly [PROVIDES]?: infer R;
 } ? Extract<R, string> : never;
 /** The contracts a plugin's subgraph declared (reads the phantom carrier). */
@@ -1971,7 +2085,7 @@ type ProvidedContractsOf<P> = P extends {
 } ? Extract<C, ContractEntry> : never;
 /** Union the requires / provides across an inline imports or exports tuple. */
 type RequiresIn<T extends readonly unknown[]> = RequiresOf<T[number]>;
-type ProvidesIn<T extends readonly unknown[]> = ProvidesOf$1<T[number]>;
+type ProvidesIn<T extends readonly unknown[]> = ProvidesOf<T[number]>;
 /** Union the contracts across an inline imports or exports tuple. */
 type RequiredContractsIn<T extends readonly unknown[]> = RequiredContractsOf<T[number]>;
 type ProvidedContractsIn<T extends readonly unknown[]> = ProvidedContractsOf<T[number]>;
@@ -1986,753 +2100,182 @@ type StaticList<T extends readonly unknown[]> = number extends T["length"] ? {
     readonly __kitcoreError: "must be a fixed inline list of plugins, not a widened Plugin[]; declare them inline so the dependency graph stays statically known";
 } : T;
 /** A plugin's id as a type: `namespace/name`, or bare `name` when the namespace
- * is empty. The ledger keys on this (matching runtime id resolution), not the
- * bare name, so same-named plugins in different namespaces stay distinct. */
-type IdOf<TNamespace extends string, TName extends string> = TNamespace extends "" ? TName : `${TNamespace}/${TName}`;
-/** The binding name of an id: its last `/`-separated segment. The inverse view
- * of `IdOf`, used by `declare*` to derive the bare binding from a full id. */
-type LastSegment<TId extends string> = TId extends `${string}/${infer Rest}` ? LastSegment<Rest> : TId;
-/**
- * The `PluginSummary` a leaf carries, keyed on its full id. `TBinding` is the
- * surfaced binding the leaf implements (its call signature or its value).
- *
- * `TBinding` is REQUIRED, deliberately. Defaulting it to `never` would make a
- * three-argument annotation contribute no contract, so a hand-written
- * annotation would keep compiling and silently drop the leaf out of the
- * compatibility check.
- * A missing argument is a compile error instead.
- */
-type LeafSummary<TNamespace extends string, TName extends string, TImports extends readonly unknown[], TBinding> = LeafSummaryById<IdOf<TNamespace, TName>, TImports, TBinding>;
-/** {@link LeafSummary} for a leaf whose full id is already known rather than
- * composed from a namespace and a name, which is what the by-reference
- * `define*(ref, config)` forms have: the id comes off the stand-in. */
-type LeafSummaryById<TId extends string, TImports extends readonly unknown[], TBinding> = LeafSummaryOf<TId, RequiresIn<TImports>, ProvidesIn<TImports>, RequiredContractsIn<TImports>, ProvidedContractsIn<TImports>, TBinding>;
-/**
- * {@link LeafSummaryById} with each import ledger already read, so it is read
- * ONCE per leaf. See the rule on {@link AggregateSummaryOf}.
- */
-type LeafSummaryOf<TId extends string, TRequires extends string, TProvides extends string, TRequiredContracts extends ContractEntry, TProvidedContracts extends ContractEntry, TBinding> = PluginSummary<Exclude<TRequires, TId | TProvides>, TId | TProvides, TRequiredContracts, ContractEntry<TId, TBinding> | TProvidedContracts>;
-/**
- * The `PluginSummary` an aggregate carries, keyed on its full id.
- *
- * It contributes no contract for its own id. A module's contract IS its
- * exports, and each export already carries one keyed by its own id, so
- * `declarePlugin` is checked against the real module leaf by leaf. Carrying the
- * whole export-bindings record as a second entry would only add the binding
- * NAMES to the comparison, and it costs a mapped type over every export inside
- * every enclosing summary. That cost grows with the graph, for nothing.
- */
-type AggregateSummary<TNamespace extends string, TName extends string, TImports extends readonly unknown[], TExports extends readonly unknown[]> = AggregateSummaryOf<IdOf<TNamespace, TName>, RequiresIn<TImports> | RequiresIn<TExports>, ProvidesIn<TImports> | ProvidesIn<TExports>, RequiredContractsIn<TImports> | RequiredContractsIn<TExports>, ProvidedContractsIn<TImports> | ProvidedContractsIn<TExports>>;
-/**
- * {@link AggregateSummary} with each child ledger already read, so it is read
- * ONCE per aggregate.
- *
- * THE RULE FOR EVERY SUMMARY: read each child ledger ONCE, at the call site,
- * and pass it in. A summary's phantom slots must never contain an expression
- * that reads the children again.
- *
- * Duplicating a read makes the cost grow exponentially with graph depth rather
- * than linearly, and a deep graph then fails to compile at all. TypeScript has
- * no way to name an intermediate type, so a helper that takes the ledgers as
- * parameters is the only way to read each one exactly once.
- *
- * So `Exclude<TRequires, TId | TProvides>` is safe here: `TProvides` is a
- * parameter, already resolved, shared by both slots. Inlining it back to
- * `Exclude<RequiresIn<TImports>, TId | ProvidesIn<TImports>>` reads the
- * children twice and brings the exponential back. Do not "simplify" these
- * helpers away. `composition-depth.test.ts` and `import-chain-depth.test.ts`
- * are the canaries.
- */
-type AggregateSummaryOf<TId extends string, TRequires extends string, TProvides extends string, TRequiredContracts extends ContractEntry, TProvidedContracts extends ContractEntry> = PluginSummary<Exclude<TRequires, TId | TProvides>, TId | TProvides, TRequiredContracts, TProvidedContracts>;
-/**
- * The `PluginSummary` a re-export synthetic forwards from its source: the
- * source's own ledgers, unchanged, since `selectExports` / `omitExports` change
- * which bindings are visible and never which ids the graph reaches. Each read
- * appears once, per the rule on {@link AggregateSummaryOf}.
- *
- * `TSource` is inferred from an intersection parameter, which is fragile. If it
- * ever stops binding the source's summary it falls back to `unknown`, these
- * ledgers come out empty, and every check behind the helper switches off
- * SILENTLY, with nothing failing to compile. The forwarding case in
- * `select-exports.test.ts` is the only thing that catches that, so it is
- * load-bearing rather than illustrative.
- */
-type ForwardedSummary<TSource> = PluginSummary<RequiresOf<TSource>, ProvidesOf$1<TSource>, RequiredContractsOf<TSource>, ProvidedContractsOf<TSource>>;
-/** The `PluginSummary` a `declarePlugin` declaration carries: its id in the
- * requirements ledger, plus the contracts its export stand-ins declared, read
- * once at the call site per the rule on {@link AggregateSummaryOf}. */
-type AggregateDeclarationSummary<TId extends string, TRequiredContracts extends ContractEntry> = PluginSummary<TId, never, TRequiredContracts, never>;
-/** The `PluginSummary` a required declaration carries: its id in the
- * requirements ledger, and the contract every provider of that id must honor. */
-type DeclarationSummary<TId extends string, TBinding> = PluginSummary<TId, never, ContractEntry<TId, TBinding>, never>;
-/** The optional twin of {@link DeclarationSummary}: it claims no slot, so it is
- * never a missing dependency, but a provider that DOES appear under the id
- * still has to honor the contract. */
-type OptionalDeclarationSummary<TId extends string, TBinding> = PluginSummary<never, never, ContractEntry<TId, TBinding>, never>;
-/**
- * The runtime-input channel for `createSdk`. `configuration` maps plugin ids to
- * immutable values; each entry materializes as a static value property under
- * that id, satisfying a `declareProperty` / `declareOptionalProperty` stand-in exactly
- * as a registered provider would (DI value injection). Strict at build time:
- * an id must resolve to a property stand-in reachable from the root, so
- * unknown ids, non-property targets, and collisions with a registered real
- * provider all throw. kitcore keeps the map untyped; a head's factory is the
- * typed wrapper (`createMySdk(options)` passes
- * `{ configuration: { "my/config": options } }`).
- */
-interface CreateSdkOptions {
-    configuration?: Record<string, unknown>;
-}
-/**
- * Surfaced by `createSdk` when reachable declarations have no provider.
- *
- * The guard names the property it checks (`CompletenessOf`) and the brand
- * names the fault, so the pair shares no root. That is deliberate: "missing"
- * tells a reader what to do, where "incomplete" only restates the property.
- */
-interface MissingProviders<TIds extends string> {
-    readonly __kitcoreError: "Missing concrete provider(s) for required declaration id(s)";
-    readonly missing: TIds;
-}
-/**
- * `unknown` when every reachable declaration is provided, otherwise a
- * `MissingProviders` brand. `createSdk` takes `root: P & CompletenessOf<P>`,
- * so a complete root infers `P` unchanged (intersect `unknown`) while an
- * incomplete one fails to assign (the argument lacks `missing`).
- */
-type CompletenessOf<P> = [
-    Exclude<RequiresOf<P>, ProvidesOf$1<P>>
-] extends [never] ? unknown : MissingProviders<Exclude<RequiresOf<P>, ProvidesOf$1<P>>>;
-/** The provided entries registered under one id. */
-type ProvidersFor<TProvided extends ContractEntry, TId extends string> = Extract<TProvided, {
-    readonly id: TId;
-}>;
-/**
- * The ids whose reachable providers do not all honor the declared contract.
- *
- * EVERY provider under an id must honor it, not just one: `declareDefault` lets
- * a default coexist with an explicit provider, so "some compatible provider
- * exists" would pass a good default beside a bad explicit one while the runtime
- * picks the bad one.
- *
- * An id with no provider yields nothing here. That is `CompletenessOf`'s
- * report, and two errors for one cause read worse than one.
- */
-type IncompatibleIds<TRequired extends ContractEntry, TProvided extends ContractEntry> = TRequired extends ContractEntry ? MismatchedProviders<TRequired, ProvidersFor<TProvided, TRequired["id"]>> : never;
-/** The required id, once per provider of it that fails the contract. An id with
- * no provider yields `never` here, since a distributive conditional over
- * `never` is `never`. */
-type MismatchedProviders<TRequired extends ContractEntry, TCandidate extends ContractEntry> = TCandidate extends ContractEntry ? [TCandidate["binding"]] extends [TRequired["binding"]] ? never : ServesEveryDeclaredCall<TCandidate["binding"], TRequired["binding"]> extends true ? never : TRequired["id"] : never;
-/** The keys a caller of `T` must supply. */
-type RequiredKeys<T> = keyof {
-    [K in keyof T as {} extends Pick<T, K> ? never : K]: unknown;
-};
-/**
- * Rescues a provider that whole-function assignability rejects for a reason
- * that does not apply here.
- *
- * TypeScript's weak-type rule refuses to relate two object types that share no
- * properties, even when the target needs none of them. So a declaration
- * promising `{ search: string }` failed against a provider taking
- * `{ locale?: string }`, though that provider requires nothing and reads
- * nothing the declaration sends. That contradicts the rule this check is built
- * on, which is that a provider may accept WIDER input.
- *
- * The escape stays sound by demanding all three: the output is still a subtype,
- * the provider requires no input field, and the two inputs share no key, so
- * there is no field the provider can read at a type it does not expect.
- */
-type ServesEveryDeclaredCall<TProvided, TRequired> = TRequired extends (...args: infer TDeclaredArgs) => infer TDeclaredOut ? TProvided extends (...args: infer TProviderArgs) => infer TProviderOut ? [TProviderOut] extends [TDeclaredOut] ? [TDeclaredArgs] extends [readonly [unknown?]] ? [TProviderArgs] extends [readonly [unknown?]] ? [
-    Extract<keyof NonNullable<TDeclaredArgs[0]>, keyof NonNullable<TProviderArgs[0]>>
-] extends [never] ? [RequiredKeys<NonNullable<TProviderArgs[0]>>] extends [never] ? true : false : false : false : false : false : false : false;
-/** Surfaced by `createSdk` when a provider contradicts its declaration. */
-interface IncompatibleProviders<TIds extends string> {
-    readonly __kitcoreError: "Provider(s) do not match the contract declared for the id(s); a provider may accept wider input but must return a subtype of the declared output";
-    readonly incompatible: TIds;
-}
-/**
- * `unknown` when every provided id honors the contract declared for it,
- * otherwise an `IncompatibleProviders` brand. `createSdk` takes
- * `root: P & CompletenessOf<P> & CompatibilityOf<P>`, so a sound graph infers
- * `P` unchanged (intersect `unknown`) while an unsound one fails to assign.
- */
-type CompatibilityOf<P> = IncompatibleIds<RequiredContractsOf<P>, ProvidedContractsOf<P>> extends infer TIds extends string ? [TIds] extends [never] ? unknown : IncompatibleProviders<TIds> : never;
-/** Recover the materialized SDK type for a checked root (the summary that
- * rides on the `define*` return is transparent to these). */
-type MethodSdkOf<P> = P extends MethodPlugin<infer TName, infer TInput, infer TOutput, infer TPos> ? Sdk$1<TName, TInput, TOutput, TPos> : never;
-type PropertySdkOf<P> = P extends PropertyPlugin<infer TName, infer TValue> ? PropertySdk<TName, TValue> : never;
-type AggregateSdkOf<P> = P extends AggregatePlugin<string, infer TExports> ? AggregateSdk<TExports> : never;
-
-/**
- * Declaration for a registry category (a bucket grouping related functions).
- * Plugins reference categories in their `meta.categories` field, as either a
- * bare key (auto-derive title and plural) or this object (override either).
- *
- * Examples (with auto-derive rules):
- * - `{ key: "app" }`               → title "App", plural "Apps"
- * - `{ key: "client-credentials" }` → title "Client Credentials", plural "Client Credentials"
- * - `{ key: "utility" }`           → title "Utility", plural "Utilities"
- * - `{ key: "http", title: "HTTP Request" }` → plural "HTTP Requests"
- */
-interface CategoryDefinition {
-    key: string;
-    /** Display title for the category. Auto-derived from `key` if omitted. */
-    title?: string;
-    /** Plural form of `title`. Auto-derived from the resolved title if omitted. */
-    titlePlural?: string;
-}
-interface FunctionRegistryEntry {
-    name: string;
-    /**
-     * Human-readable description of the function. Surfaced wherever the
-     * registry is consumed (command help, tool/RPC descriptions, generated
-     * documentation). Prefer providing this directly rather than relying
-     * solely on inputSchema.describe().
-     */
-    description?: string;
-    type?: "list" | "item" | "create" | "update" | "delete" | "function";
-    itemType?: string;
-    returnType?: string;
-    inputSchema?: z.ZodSchema;
-    /**
-     * When true, the method owns its input validation and its boundary passes the
-     * input through unparsed. The resolution controller reads this to skip its
-     * final `safeParse` (it still uses `inputSchema` to plan/prompt parameters),
-     * so a method routed through the controller isn't re-validated against a
-     * schema it deliberately opts out of. Lifted off the materialized entry.
-     */
-    skipInputValidation?: boolean;
-    outputSchema?: z.ZodSchema;
-    /**
-     * Ordered input keys the public surface projects onto positional arguments
-     * (the method's `positional` declaration). Absent when the method takes only
-     * the canonical single bag. Lifted off the materialized method entry by the
-     * surface builder, like `resolvers` — a runtime projection, not
-     * descriptive meta.
-     */
-    positional?: readonly string[];
-    categories: string[];
-    /**
-     * Per-parameter bound resolvers (imports already captured, called with
-     * `input` only, no sdk). Lifted off the materialized method entry by the
-     * surface builder.
-     */
-    resolvers?: Record<string, BoundResolver>;
-    packages?: string[];
-    /**
-     * API stability tier of the plugin, normalized from `PluginMeta.stability`
-     * (absent means `"stable"`; the legacy `experimental: true` boolean means
-     * `"experimental"`). Always concrete here, so consumers never branch on
-     * `undefined`.
-     */
-    stability: StabilityLevel;
-    /**
-     * @deprecated Read `stability` instead. Derived as
-     * `stability === "experimental"` — literal by name, so beta reads
-     * `false`; the not-stable warning duty lives in `stability` and the
-     * runtime stability notice.
-     */
-    experimental?: boolean;
-    /** Confirmation prompt type - prompts user before executing */
-    confirm?: "create-secret" | "delete";
-    /**
-     * Optional deprecation metadata for commands.
-     */
-    deprecation?: FunctionDeprecation;
-    /**
-     * Short aliases for parameter names (e.g., { request: "X", header: "H" }).
-     * Consumers that render the function as a flag-style command surface use
-     * these as short forms.
-     */
-    aliases?: Record<string, string>;
-    /**
-     * Output formatter, normalized to the bound runtime shape (its imports/sdk
-     * already captured), so consumers call `getContext`/`format` with no sdk.
-     * The surface builder produces this from the method entry — `entry.formatter`
-     * for a migrated plugin, or the legacy `meta.formatter` adapted — so vintage
-     * is invisible here.
-     */
-    formatter?: BoundFormatter;
-    /** Defaults to true. Set to false to suppress --json (e.g. login/logout/init). */
-    supportsJsonOutput: boolean;
-}
-interface FunctionDeprecation {
-    /** User-facing deprecation message for why/how to migrate */
-    message: string;
-}
-interface RegistryResult {
-    functions: FunctionRegistryEntry[];
-    categories: {
-        key: string;
-        title: string;
-        titlePlural: string;
-        functions: string[];
-    }[];
-}
-
-/**
- * ------------------------------
- * Plugin Type System
- * ------------------------------
- *
- * Plugins receive the sdk as a positional parameter. sdk.context holds shared
- * internal state (api client, event emission, meta, options, etc.). SDK methods
- * live at the root, context nests under .context.
- *
- * A plugin is (sdk) => partialSdk. `createPluginStack()` accumulates plugins
- * and materializes a built `Sdk` via `.toSdk()`; `addPlugin(sdk, plugin)`
- * extends an already-built SDK in place with one more plugin.
- */
-
-interface PluginProvides extends Record<string, any> {
-    context?: {
-        meta?: Record<string, PluginMeta<any>>;
-        hooks?: MethodHooks;
-        [key: string]: any;
-    };
-}
-interface PluginMeta<TSdk = unknown> {
-    /**
-     * Human-readable description of the plugin function. Used by the CLI (help text),
-     * MCP (tool description), and README generators. When omitted, falls back to
-     * the inputSchema's `.describe()` value or a generic placeholder.
-     */
-    description?: string;
-    /**
-     * Buckets this function belongs to in `getRegistry()` output. Each entry is
-     * either a bare key (`"app"`) for auto-derived titles or a {@link CategoryDefinition}
-     * object to override the title or plural. Only one plugin needs to supply
-     * the object form per category key; object refs win over string refs, so
-     * other plugins in the same bucket can stay on bare strings.
-     */
-    categories?: (string | CategoryDefinition)[];
-    type?: "list" | "item" | "create" | "update" | "delete" | "function";
-    itemType?: string;
-    returnType?: string;
-    inputSchema?: z.ZodSchema;
-    outputSchema?: z.ZodSchema;
-    /**
-     * Item formatter that the registry hands to the CLI/MCP renderer. The
-     * `sdk` param on `fetch` is typed to the plugin's own declared SDK
-     * surface (`TRequires & TProvides`); reaching into another plugin's
-     * method requires adding it to `TRequires` explicitly.
-     */
-    formatter?: OutputFormatter<TSdk, any, any, any>;
-    /**
-     * Per-parameter resolver metadata. Same `TSdk` surfaces in each
-     * resolver's `fetch`/`tryResolveWithoutPrompt` callbacks.
-     */
-    resolvers?: Record<string, ResolverMetadata<TSdk, any, any>>;
-    /** Confirmation prompt type - prompts user before executing */
-    confirm?: "create-secret" | "delete";
-    /**
-     * API stability tier this plugin belongs to. Absent means `"stable"`;
-     * the registry projection normalizes it, so registry consumers always
-     * read a concrete {@link StabilityLevel}. Wrappers keep non-stable
-     * plugins out of their stable build (by gating them behind a `beta` /
-     * `experimental` subpath import) and consumers badge the level in
-     * generated docs, CLI help, and MCP tool descriptions. No runtime
-     * capability check.
-     */
-    stability?: StabilityLevel;
-    /**
-     * @deprecated Use `stability: "experimental"` instead. Kept as an
-     * input for external authors; `true` normalizes to
-     * `stability: "experimental"` in the registry projection.
-     */
-    experimental?: boolean;
-    [key: string]: any;
-}
-/**
- * Plugin interface — 2 type params:
- *
- *   TSdk = what this plugin needs (the SDK shape including context)
- *   TProvides = what this plugin returns (a partial SDK shape)
- *
- * The sdk param always includes context.meta, even if TSdk doesn't declare it.
- */
-interface Plugin<TSdk = {}, TProvides extends PluginProvides = PluginProvides> {
-    (sdk: TSdk & {
-        context: {
-            meta: Record<string, PluginMeta<any>>;
-            hooks: MethodHooks;
-        };
-    }): TProvides;
-}
-/**
- * A built SDK. Carries the plugins' contributions plus the
- * `getRegistry` accessor over `context.meta`. No `addPlugin` method
- * on the shape: extension after build goes through the top-level
- * `addPlugin(sdk, plugin)` function, which mutates the sdk in place
- * and narrows the caller's binding via TypeScript's assertion
- * functions.
- */
-type Sdk<T = {
-    context: {
-        meta: Record<string, PluginMeta<any>>;
-        hooks: MethodHooks;
-    };
-}> = T & {
-    getRegistry(options?: {
-        package?: string;
-    }): RegistryResult;
-};
-
-/**
- * ------------------------------
- * Plugin authoring helpers
- * ------------------------------
- *
- * - `createPluginMethod` / `createPaginatedPluginMethod`: per-method
- *   primitives that sit inside a `definePlugin` callback and build the
- *
- *     { [name]: wrappedFn, context: { meta: { [name]: meta } } }
- *
- *   fragment a plugin returns for a single method, wiring up
- *   `createFunction` / `createPaginatedFunction`, the method-call hooks,
- *   and the doubled `name` (function key + meta key) in one place.
- *
- * Two method helpers (rather than one with a `paginated: true` discriminant)
- * because the handler signature changes shape across pagination, and
- * discriminated unions on optional booleans produce noisy TS errors.
- *
- * @deprecated The module model replaces this exit; it logs a runtime
- * deprecation and will be removed in a release after this warning ships.
- */
-
-/**
- * Method-level meta fields. Mirrors `PluginMeta` minus `inputSchema`, which is
- * passed at the top level alongside the handler and merged into the meta by
- * the helpers themselves.
- *
- * @deprecated The module model replaces this exit; it logs a runtime
- * deprecation and will be removed in a release after this warning ships.
- */
-type MethodMeta<TSdk> = Omit<PluginMeta<TSdk>, "inputSchema">;
-/**
- * The plugin's own method signature, synthesized from the method config.
- * Mixed into the resolver-side SDK so a resolver may freely reference the
- * host plugin's own method (e.g. `appKeyResolver` calling `sdk.getApp`)
- * without forcing the plugin to declare a circular dependency on itself.
- *
- * Uses `any` for options and return: we only need to assert the method
- * exists on `sdk`, not pin its full signature. Using `TInput`/`TResult`
- * here would create a circular inference (TSdk depends on TInput/TResult
- * via the resolvers slot, TInput/TResult are inferred from the handler
- * which depends on TSdk), and TS resolves the cycle by widening to
- * `unknown`. With `any`, the resolver check still verifies the method's
- * presence on the SDK; signature precision for self is the plugin
- * author's responsibility.
- *
- * Not mixed into the handler's `sdk`: handlers run against the SDK that
- * existed when the plugin was added to the stack (closure-captured), so
- * self-method access there would be a lie at runtime.
- *
- * @deprecated The module model replaces this exit; it logs a runtime
- * deprecation and will be removed in a release after this warning ships.
- */
-type SelfMethod<TName extends string> = {
-    [K in TName]: (options?: any) => any;
-};
-interface PluginMethodConfig<TSdk, TInput, TResult, TName extends string, TResolvers> extends Omit<MethodMeta<TSdk>, "resolvers"> {
-    name: TName;
-    /**
-     * Schema for runtime input validation; drives the handler's `options`
-     * type. For plugins that accept deprecated parameter aliases this is a
-     * `z.union([CanonicalSchema, DeprecatedSchema])` — the registry
-     * unwraps unions and exposes only the first variant (canonical) to
-     * documentation and downstream consumer surfaces.
-     *
-     * @deprecated The module model replaces this exit; it logs a runtime
-     * deprecation and will be removed in a release after this warning ships.
-     */
-    inputSchema?: z.ZodSchema<TInput>;
-    handler: (args: {
-        sdk: TSdk;
-        options: TInput;
-    }) => Promise<TResult>;
-    /**
-     * Per-parameter resolvers. Each entry's `TSdk` requirement is checked
-     * against the plugin's own `TSdk` (plus the plugin's own method via
-     * {@link SelfMethod}) using {@link ValidResolvers}; mismatches surface
-     * at the offending key. `NoInfer` pins `TSdk` to the `sdk` argument so
-     * resolver entries don't widen the inferred `TSdk`.
-     *
-     * @deprecated The module model replaces this exit; it logs a runtime
-     * deprecation and will be removed in a release after this warning ships.
-     */
-    resolvers?: ValidResolvers<NoInfer<TSdk & SelfMethod<TName>>, TResolvers> & TResolvers;
-}
-type PluginMethodReturn<TName extends string, TInput, TResult> = {
-    [K in TName]: (options?: TInput) => Promise<TResult>;
-} & {
-    context: {
-        meta: {
-            [K in TName]: PluginMeta;
-        };
-    };
-};
+ * is empty. The ledger keys on this (matching runtime id resolution), not the
+ * bare name, so same-named plugins in different namespaces stay distinct. */
+type IdOf<TNamespace extends string, TName extends string> = TNamespace extends "" ? TName : `${TNamespace}/${TName}`;
+/** The binding name of an id: its last `/`-separated segment. The inverse view
+ * of `IdOf`, used by `declare*` to derive the bare binding from a full id. */
+type LastSegment<TId extends string> = TId extends `${string}/${infer Rest}` ? LastSegment<Rest> : TId;
 /**
- * Build the method fragment for a non-paginated SDK method. Used inside a
- * `definePlugin(...)` callback:
- *
- *   export const getProfilePlugin = definePlugin(
- *     (sdk: ApiPluginProvides & EventEmissionProvides) =>
- *       createPluginMethod(sdk, {
- *         name: "getProfile",
- *         categories: ["account"],
- *         inputSchema: GetProfileSchema,
- *         handler: async ({ sdk }) => { ... },
- *       }),
- *   );
+ * The `PluginSummary` a leaf carries, keyed on its full id. `TBinding` is the
+ * surfaced binding the leaf implements (its call signature or its value).
  *
- * @deprecated The module model replaces this exit; it logs a runtime
- * deprecation and will be removed in a release after this warning ships.
+ * `TBinding` is REQUIRED, deliberately. Defaulting it to `never` would make a
+ * three-argument annotation contribute no contract, so a hand-written
+ * annotation would keep compiling and silently drop the leaf out of the
+ * compatibility check.
+ * A missing argument is a compile error instead.
  */
-declare function createPluginMethod<const TName extends string, TSdk extends {
-    context: unknown;
-}, TInput, TResult, const TResolvers extends Record<string, ResolverMetadata<any, any, any>> = {}>(sdk: TSdk, config: PluginMethodConfig<TSdk, TInput, TResult, TName, TResolvers>): PluginMethodReturn<TName, TInput, TResult>;
-interface PaginatedPluginMethodConfigBase<TSdk, TInput, TName extends string, TResolvers> extends Omit<MethodMeta<TSdk>, "resolvers"> {
-    name: TName;
-    /** Same semantics as `createPluginMethod`'s `inputSchema`. */
-    inputSchema?: z.ZodSchema<TInput>;
-    /**
-     * Optional default page size when the caller doesn't pass one. Mirrors
-     * `createPaginatedFunction`'s `defaultPageSize` arg.
-     */
-    defaultPageSize?: number;
-    /** See {@link PluginMethodConfig.resolvers}. */
-    resolvers?: ValidResolvers<NoInfer<TSdk & SelfMethod<TName>>, TResolvers> & TResolvers;
-}
+type LeafSummary<TNamespace extends string, TName extends string, TImports extends readonly unknown[], TBinding> = LeafSummaryById<IdOf<TNamespace, TName>, TImports, TBinding>;
+/** {@link LeafSummary} for a leaf whose full id is already known rather than
+ * composed from a namespace and a name, which is what the by-reference
+ * `define*(ref, config)` forms have: the id comes off the stand-in. */
+type LeafSummaryById<TId extends string, TImports extends readonly unknown[], TBinding> = LeafSummaryOf<TId, RequiresIn<TImports>, ProvidesIn<TImports>, RequiredContractsIn<TImports>, ProvidedContractsIn<TImports>, TBinding>;
 /**
- * A page whose *only* own keys are `data` / `nextCursor`. Used to constrain
- * the Standard overload: a raw envelope with extra keys (a JSON:API
- * `links`/`meta`, a top-level `next`, etc.) is NOT a `StrictPage`, so it falls
- * through to the Adapted overload and `adaptPage` becomes required. Each excess
- * key is mapped to `?: never`, which a real value (e.g. `links: {...}`) can't
- * satisfy — that's what a plain `SdkPage` assignability check (which allows
- * excess keys structurally) misses.
+ * {@link LeafSummaryById} with each import ledger already read, so it is read
+ * ONCE per leaf. See the rule on {@link AggregateSummaryOf}.
  */
-type StrictPage<TResponse> = SdkPage<unknown> & {
-    [K in Exclude<keyof TResponse, keyof SdkPage<unknown>>]?: never;
-};
-/**
- * Config for a paginated method whose handler already returns a clean page
- * (`{ data, nextCursor? }` and nothing else — see `StrictPage`, enforced on
- * the overload). No `adaptPage` needed; `TItem` is sourced from the handler's
- * `data`. Interface extension keeps this a single flattened object type (not
- * an intersection), preserving clean inference of the `resolvers` /
- * `TResolvers` slot.
- */
-interface PaginatedPluginMethodConfigStandard<TSdk, TInput, TResponse, TName extends string, TResolvers> extends PaginatedPluginMethodConfigBase<TSdk, TInput, TName, TResolvers> {
-    handler: (args: {
-        sdk: TSdk;
-        options: TInput & {
-            cursor?: string;
-            pageSize?: number;
-        };
-    }) => Promise<TResponse>;
-    /** No adapter: the handler already returns a page. */
-    adaptPage?: undefined;
-}
-/**
- * Config for a paginated method whose handler returns a raw upstream shape
- * (`TResponse`, e.g. a JSON:API `links.next` envelope). `adaptPage` is required
- * to translate it into a page. `TItem` is sourced from `TResponse` (`ItemOf`),
- * not the adapter — the adapter is item-agnostic (relocates the cursor; items
- * are finalized in the handler's `data`), hence `NoInfer`, so a generic adapter
- * (e.g. `<T>(r) => SdkPage<T>`) doesn't collapse `TItem` to `unknown`.
- */
-interface PaginatedPluginMethodConfigAdapted<TSdk, TInput, TResponse, TItem, TName extends string, TResolvers> extends PaginatedPluginMethodConfigBase<TSdk, TInput, TName, TResolvers> {
-    handler: (args: {
-        sdk: TSdk;
-        options: TInput & {
-            cursor?: string;
-            pageSize?: number;
-        };
-    }) => Promise<TResponse>;
-    adaptPage: (response: TResponse) => SdkPage<NoInfer<TItem>>;
-}
-type ItemOf<TResponse> = TResponse extends SdkPage<infer TItem> ? TItem : TResponse extends {
-    data: readonly (infer TItem)[];
-} ? TItem : never;
-type PaginatedPluginMethodReturn<TName extends string, TInput, TItem> = {
-    [K in TName]: (options?: TInput & {
-        cursor?: string;
-        pageSize?: number;
-        maxItems?: number;
-    }) => PaginatedSdkResult<TItem>;
-} & {
-    context: {
-        meta: {
-            [K in TName]: PluginMeta;
-        };
-    };
-};
+type LeafSummaryOf<TId extends string, TRequires extends string, TProvides extends string, TRequiredContracts extends ContractEntry, TProvidedContracts extends ContractEntry, TBinding> = PluginSummary<Exclude<TRequires, TId | TProvides>, TId | TProvides, TRequiredContracts, ContractEntry<TId, TBinding> | TProvidedContracts>;
 /**
- * Paginated variant of `createPluginMethod`. Two overloads enforce the
- * response contract at compile time:
+ * The `PluginSummary` an aggregate carries, keyed on its full id.
  *
- *  - **Standard** — the handler returns a strict `SdkPage<TItem>`
- *    (`{ data, nextCursor? }` and nothing else); no `adaptPage`.
- *  - **Adapted** — the handler returns a raw upstream shape and `adaptPage` is
- *    *required* to translate it.
+ * It contributes no contract for its own id. A module's contract IS its
+ * exports, and each export already carries one keyed by its own id, so
+ * `declarePlugin` is checked against the real module leaf by leaf. Carrying the
+ * whole export-bindings record as a second entry would only add the binding
+ * NAMES to the comparison, and it costs a mapped type over every export inside
+ * every enclosing summary. That cost grows with the graph, for nothing.
+ */
+type AggregateSummary<TNamespace extends string, TName extends string, TImports extends readonly unknown[], TExports extends readonly unknown[]> = AggregateSummaryOf<IdOf<TNamespace, TName>, RequiresIn<TImports> | RequiresIn<TExports>, ProvidesIn<TImports> | ProvidesIn<TExports>, RequiredContractsIn<TImports> | RequiredContractsIn<TExports>, ProvidedContractsIn<TImports> | ProvidedContractsIn<TExports>>;
+/**
+ * {@link AggregateSummary} with each child ledger already read, so it is read
+ * ONCE per aggregate.
  *
- * A handler that returns neither a page-like shape nor pairs a raw shape with
- * `adaptPage` matches no overload and is a compile error.
+ * THE RULE FOR EVERY SUMMARY: read each child ledger ONCE, at the call site,
+ * and pass it in. A summary's phantom slots must never contain an expression
+ * that reads the children again.
  *
- *   createPaginatedPluginMethod(sdk, {
- *     name: "listThings",
- *     inputSchema: ListThingsSchema,
- *     adaptPage: (res) => ({ data: res.items, nextCursor: res.next }),
- *     handler: ({ sdk, options }) => sdk.context.api.get("/things", { ... }),
- *   });
+ * Duplicating a read makes the cost grow exponentially with graph depth rather
+ * than linearly, and a deep graph then fails to compile at all. TypeScript has
+ * no way to name an intermediate type, so a helper that takes the ledgers as
+ * parameters is the only way to read each one exactly once.
  *
- * @deprecated The module model replaces this exit; it logs a runtime
- * deprecation and will be removed in a release after this warning ships.
+ * So `Exclude<TRequires, TId | TProvides>` is safe here: `TProvides` is a
+ * parameter, already resolved, shared by both slots. Inlining it back to
+ * `Exclude<RequiresIn<TImports>, TId | ProvidesIn<TImports>>` reads the
+ * children twice and brings the exponential back. Do not "simplify" these
+ * helpers away. `composition-depth.test.ts` and `import-chain-depth.test.ts`
+ * are the canaries.
  */
-declare function createPaginatedPluginMethod<const TName extends string, TSdk extends {
-    context: unknown;
-}, TInput, TResponse extends StrictPage<TResponse>, TItem = ItemOf<TResponse>, const TResolvers extends Record<string, ResolverMetadata<any, any, any>> = {}>(sdk: TSdk, config: PaginatedPluginMethodConfigStandard<TSdk, TInput, TResponse, TName, TResolvers>): PaginatedPluginMethodReturn<TName, TInput, TItem>;
-declare function createPaginatedPluginMethod<const TName extends string, TSdk extends {
-    context: unknown;
-}, TInput, TResponse, TItem = ItemOf<TResponse>, const TResolvers extends Record<string, ResolverMetadata<any, any, any>> = {}>(sdk: TSdk, config: PaginatedPluginMethodConfigAdapted<TSdk, TInput, TResponse, TItem, TName, TResolvers>): PaginatedPluginMethodReturn<TName, TInput, TItem>;
+type AggregateSummaryOf<TId extends string, TRequires extends string, TProvides extends string, TRequiredContracts extends ContractEntry, TProvidedContracts extends ContractEntry> = PluginSummary<Exclude<TRequires, TId | TProvides>, TId | TProvides, TRequiredContracts, TProvidedContracts>;
 /**
- * Maps a tuple of plugins to a tuple of their TSdk requirement types.
+ * The `PluginSummary` a re-export synthetic forwards from its source: the
+ * source's own ledgers, unchanged, since `selectExports` / `omitExports` change
+ * which bindings are visible and never which ids the graph reaches. Each read
+ * appears once, per the rule on {@link AggregateSummaryOf}.
  *
- *   SdkRequirementsOf<[Plugin<{ api }, _>, Plugin<{ options }, _>]>
- *     = [{ api }, { options }]
+ * `TSource` is inferred from an intersection parameter, which is fragile. If it
+ * ever stops binding the source's summary it falls back to `unknown`, these
+ * ledgers come out empty, and every check behind the helper switches off
+ * SILENTLY, with nothing failing to compile. The forwarding case in
+ * `select-exports.test.ts` is the only thing that catches that, so it is
+ * load-bearing rather than illustrative.
  */
-type SdkRequirementsOf<T extends readonly Plugin<any, any>[]> = {
-    [K in keyof T]: T[K] extends Plugin<infer Sdk, any> ? Sdk : never;
-};
+type ForwardedSummary<TSource> = PluginSummary<RequiresOf<TSource>, ProvidesOf<TSource>, RequiredContractsOf<TSource>, ProvidedContractsOf<TSource>>;
+/** The `PluginSummary` a `declarePlugin` declaration carries: its id in the
+ * requirements ledger, plus the contracts its export stand-ins declared, read
+ * once at the call site per the rule on {@link AggregateSummaryOf}. */
+type AggregateDeclarationSummary<TId extends string, TRequiredContracts extends ContractEntry> = PluginSummary<TId, never, TRequiredContracts, never>;
+/** The `PluginSummary` a required declaration carries: its id in the
+ * requirements ledger, and the contract every provider of that id must honor. */
+type DeclarationSummary<TId extends string, TBinding> = PluginSummary<TId, never, ContractEntry<TId, TBinding>, never>;
+/** The optional twin of {@link DeclarationSummary}: it claims no slot, so it is
+ * never a missing dependency, but a provider that DOES appear under the id
+ * still has to honor the contract. */
+type OptionalDeclarationSummary<TId extends string, TBinding> = PluginSummary<never, never, ContractEntry<TId, TBinding>, never>;
 /**
- * Maps a tuple of plugins to a tuple of their TProvides output types.
- *
- *   ProvidesOf<[Plugin<_, { hello }>, Plugin<_, { goodbye }>]>
- *     = [{ hello }, { goodbye }]
+ * The runtime-input channel for `createSdk`. `configuration` maps plugin ids to
+ * immutable values; each entry materializes as a static value property under
+ * that id, satisfying a `declareProperty` / `declareOptionalProperty` stand-in exactly
+ * as a registered provider would (DI value injection). Strict at build time:
+ * an id must resolve to a property stand-in reachable from the root, so
+ * unknown ids, non-property targets, and collisions with a registered real
+ * provider all throw. kitcore keeps the map untyped; a head's factory is the
+ * typed wrapper (`createMySdk(options)` passes
+ * `{ configuration: { "my/config": options } }`).
  */
-type ProvidesOf<T extends readonly Plugin<any, any>[]> = {
-    [K in keyof T]: T[K] extends Plugin<any, infer Provides> ? Provides : never;
-};
+interface CreateSdkOptions {
+    configuration?: Record<string, unknown>;
+}
 /**
- * Intersects every member of a tuple into a single combined type. The
- * result is an object that has every property of every member at once.
- *
- *   IntersectAll<[{ api }, { options }]> = { api } & { options }
- *   IntersectAll<[]>                     = {}
+ * Surfaced by `createSdk` when reachable declarations have no provider.
  *
- * Walks recursively: head & IntersectAll<tail>, base case is the empty
- * tuple. Why intersection (`&`) and not union (`|`): the composed plugin
- * must require ALL of the sub-plugins' needs at once — an SDK that has
- * both `api` AND `options` — not "either api or options."
- */
-type IntersectAll<T extends readonly unknown[]> = T extends readonly [
-    infer Head,
-    ...infer Tail
-] ? Head & IntersectAll<Tail> : {};
-/**
- * The TSdk a composed plugin requires: every sub-plugin's TSdk requirement,
- * all at once. Composing a plugin that needs `{ api }` with one that needs
- * `{ options }` yields a composed plugin that needs `{ api } & { options }`.
+ * The guard names the property it checks (`CompletenessOf`) and the brand
+ * names the fault, so the pair shares no root. That is deliberate: "missing"
+ * tells a reader what to do, where "incomplete" only restates the property.
  */
-type ComposeSdk<T extends readonly Plugin<any, any>[]> = IntersectAll<SdkRequirementsOf<T>>;
+interface MissingProviders<TIds extends string> {
+    readonly __kitcoreError: "Missing concrete provider(s) for required declaration id(s)";
+    readonly missing: TIds;
+}
 /**
- * What a composed plugin provides: every sub-plugin's TProvides combined.
- * Composing a plugin that provides `{ hello }` with one that provides
- * `{ goodbye }` yields `{ hello } & { goodbye }`.
+ * `unknown` when every reachable declaration is provided, otherwise a
+ * `MissingProviders` brand. `createSdk` takes `root: P & CompletenessOf<P>`,
+ * so a complete root infers `P` unchanged (intersect `unknown`) while an
+ * incomplete one fails to assign (the argument lacks `missing`).
  */
-type ComposeProvides<T extends readonly Plugin<any, any>[]> = IntersectAll<ProvidesOf<T>>;
+type CompletenessOf<P> = [
+    Exclude<RequiresOf<P>, ProvidesOf<P>>
+] extends [never] ? unknown : MissingProviders<Exclude<RequiresOf<P>, ProvidesOf<P>>>;
+/** The provided entries registered under one id. */
+type ProvidersFor<TProvided extends ContractEntry, TId extends string> = Extract<TProvided, {
+    readonly id: TId;
+}>;
 /**
- * @deprecated Use {@link createPluginStack} instead. It carries the same
- * collision-detection and hook-composition behavior and supports
- * per-step `{ override: true }` for intentional duplicates. Migration
- * (note the stack emits a definition, not a bare function):
- *
- *   composePlugins(a, b, c)
- *   //  →
- *   createPluginStack().use(a).use(b).use(c).toPlugin({ name: "bundle" })
+ * The ids whose reachable providers do not all honor the declared contract.
  *
- * Bundles N plugins into a single plugin so a consumer can call
- * `.use(combined)` once on a stack. Bag mode: sub-plugins must not
- * depend on each other; TSdk on sub-plugins is the intersection of
- * every sub-plugin's requirements (so the type system never exposes
- * one sub-plugin's contributions to another).
- */
-declare function composePlugins<const Ts extends readonly Plugin<any, any>[]>(...plugins: Ts): Plugin<ComposeSdk<Ts>, ComposeProvides<Ts>>;
-/**
- * A typed builder that accumulates plugins into an immutable linked list.
- * Each `.use` returns a new stack instance (cons-style); the original
- * stack stays usable for branching. Call `toPlugin()` to collapse the
- * accumulated chain into a single `Plugin<TRequires, TProvides>`.
+ * EVERY provider under an id must honor it, not just one: `declareDefault` lets
+ * a default coexist with an explicit provider, so "some compatible provider
+ * exists" would pass a good default beside a bad explicit one while the runtime
+ * picks the bad one.
  *
- * Type params: `TRequires` is the external surface declared on
- * `createPluginStack<TRequires>()` (what the outer sdk will provide);
- * `TProvides` accumulates every registration's provides.
+ * An id with no provider yields nothing here. That is `CompletenessOf`'s
+ * report, and two errors for one cause read worse than one.
  */
-interface PluginStack<TRequires, TProvides extends PluginProvides> {
-    /**
-     * Register a bare plugin function. Its required surface is constrained
-     * to `TRequires & TProvides` (the external requirements plus everything
-     * provided by earlier `.use` calls), so registration order is enforced
-     * per step: a plugin that reads a dependency at construction can only be
-     * registered after a plugin that provides it. This stack collapses to a
-     * single function plugin and runs its entries in registration order, so
-     * the type-level order matches the runtime order.
-     *
-     * `{ override: true }` lets a registration replace an earlier root/meta
-     * key it would otherwise collide with.
-     */
-    use<TNewProvides extends PluginProvides>(plugin: Plugin<TRequires & TProvides, TNewProvides>, options?: {
-        override?: boolean;
-    }): PluginStack<TRequires, TProvides & TNewProvides>;
-    /**
-     * Collapse the accumulated registrations into a single bare function
-     * plugin. Its TSdk is `TRequires` (the declared external surface);
-     * in-stack inter-plugin dependencies are resolved when its setup runs.
-     * A head lifts it into the module model with `fromFunctionPlugin`.
-     */
-    toPlugin(): Plugin<TRequires, TProvides>;
-    /**
-     * Build the stack into a sealed, ready-to-use SDK. Eagerly applies the
-     * resolved order: each plugin runs once during `toSdk`, contributions
-     * merge into a single accumulator, and the result is wrapped as an
-     * `Sdk<TRequires & TProvides>`. The returned SDK has `context` and
-     * `getRegistry`, but no plugin-registration method.
-     * To extend a built SDK, use the top-level {@link addPlugin}.
-     */
-    toSdk(): Sdk<TRequires & TProvides>;
-}
+type IncompatibleIds<TRequired extends ContractEntry, TProvided extends ContractEntry> = TRequired extends ContractEntry ? MismatchedProviders<TRequired, ProvidersFor<TProvided, TRequired["id"]>> : never;
+/** The required id, once per provider of it that fails the contract. An id with
+ * no provider yields `never` here, since a distributive conditional over
+ * `never` is `never`. */
+type MismatchedProviders<TRequired extends ContractEntry, TCandidate extends ContractEntry> = TCandidate extends ContractEntry ? [TCandidate["binding"]] extends [TRequired["binding"]] ? never : ServesEveryDeclaredCall<TCandidate["binding"], TRequired["binding"]> extends true ? never : TRequired["id"] : never;
+/** The keys a caller of `T` must supply. */
+type RequiredKeys<T> = keyof {
+    [K in keyof T as {} extends Pick<T, K> ? never : K]: unknown;
+};
 /**
- * Create an empty plugin stack. Pass a type parameter to declare external
- * SDK requirements that every plugin in the stack can rely on:
- *
- *   const tablesPlugin = createPluginStack<FetchPluginProvides>()
- *     .use(apiPlugin)
- *     .use(listTablesPlugin)
- *     .use(getTablePlugin)
- *     .toPlugin({ name: "tables" });
+ * Rescues a provider that whole-function assignability rejects for a reason
+ * that does not apply here.
  *
- *   const sdk = createPluginStack()
- *     .use(fetchPlugin)   // provides FetchPluginProvides
- *     .use(tablesPlugin)  // PluginDefinition<FetchPluginProvides, ...>
- *     .toSdk();
+ * TypeScript's weak-type rule refuses to relate two object types that share no
+ * properties, even when the target needs none of them. So a declaration
+ * promising `{ search: string }` failed against a provider taking
+ * `{ locale?: string }`, though that provider requires nothing and reads
+ * nothing the declaration sends. That contradicts the rule this check is built
+ * on, which is that a provider may accept WIDER input.
  *
- * The stack itself is immutable: calling `.use` returns a new stack
- * without mutating the original, so you can branch off a base stack for
- * different consumers. Until the stack materializes, no plugin functions
- * run.
+ * The escape stays sound by demanding all three: the output is still a subtype,
+ * the provider requires no input field, and the two inputs share no key, so
+ * there is no field the provider can read at a type it does not expect.
  */
+type ServesEveryDeclaredCall<TProvided, TRequired> = TRequired extends (...args: infer TDeclaredArgs) => infer TDeclaredOut ? TProvided extends (...args: infer TProviderArgs) => infer TProviderOut ? [TProviderOut] extends [TDeclaredOut] ? [TDeclaredArgs] extends [readonly [unknown?]] ? [TProviderArgs] extends [readonly [unknown?]] ? [
+    Extract<keyof NonNullable<TDeclaredArgs[0]>, keyof NonNullable<TProviderArgs[0]>>
+] extends [never] ? [RequiredKeys<NonNullable<TProviderArgs[0]>>] extends [never] ? true : false : false : false : false : false : false : false;
+/** Surfaced by `createSdk` when a provider contradicts its declaration. */
+interface IncompatibleProviders<TIds extends string> {
+    readonly __kitcoreError: "Provider(s) do not match the contract declared for the id(s); a provider may accept wider input but must return a subtype of the declared output";
+    readonly incompatible: TIds;
+}
 /**
- * @deprecated The module model replaces this exit; it logs a runtime
- * deprecation and will be removed in a release after this warning ships.
+ * `unknown` when every provided id honors the contract declared for it,
+ * otherwise an `IncompatibleProviders` brand. `createSdk` takes
+ * `root: P & CompletenessOf<P> & CompatibilityOf<P>`, so a sound graph infers
+ * `P` unchanged (intersect `unknown`) while an unsound one fails to assign.
  */
-declare function createPluginStack<TRequires = object>(): PluginStack<TRequires, {
-    context: {
-        meta: Record<string, PluginMeta>;
-        hooks: MethodHooks;
-    };
-}>;
+type CompatibilityOf<P> = IncompatibleIds<RequiredContractsOf<P>, ProvidedContractsOf<P>> extends infer TIds extends string ? [TIds] extends [never] ? unknown : IncompatibleProviders<TIds> : never;
+/** Recover the materialized SDK type for a checked root (the summary that
+ * rides on the `define*` return is transparent to these). */
+type MethodSdkOf<P> = P extends MethodPlugin<infer TName, infer TInput, infer TOutput, infer TPos> ? Sdk<TName, TInput, TOutput, TPos> : never;
+type PropertySdkOf<P> = P extends PropertyPlugin<infer TName, infer TValue> ? PropertySdk<TName, TValue> : never;
+type AggregateSdkOf<P> = P extends AggregatePlugin<string, infer TExports> ? AggregateSdk<TExports> : never;
 
 /**
  * Reject a LIST stand-in from the ref form, at the REF rather than at `run`.
@@ -2792,7 +2335,11 @@ declare function defineMethod<const TName extends string, TInput, TOutput, const
         input?: unknown;
     }) => void | Promise<void>;
     run: (bag: MethodRunBag<ImportsOf<TImports>, TInput, TState>) => TOutput;
-} & LeafMetaFields): MethodPlugin<TName, TInput, TOutput, TPositional> & LeafSummary<TNamespace, TName, TImports, MethodContract<TInput, TOutput, TPositional>>;
+    /** Validates and strips the output, and describes it for the registry. */
+    outputSchema?: z.ZodSchema;
+    /** Skip validating and stripping the output against `outputSchema`. */
+    skipOutputValidation?: boolean;
+} & MethodMeta): MethodPlugin<TName, TInput, TOutput, TPositional> & LeafSummary<TNamespace, TName, TImports, MethodContract<TInput, TOutput, TPositional>>;
 declare function defineMethod<const TName extends string, TInput, TResponse extends StrictItem<TResponse>, TData = DataOf<TResponse>, const TImports extends ImportsInput = readonly [], const TNamespace extends string = "", TState = undefined>(config: {
     name: TName;
     namespace?: TNamespace;
@@ -2813,14 +2360,18 @@ declare function defineMethod<const TName extends string, TInput, TResponse exte
         input?: unknown;
     }) => void | Promise<void>;
     run: (bag: MethodRunBag<ImportsOf<TImports>, TInput, TState>) => TResponse | Promise<TResponse>;
-} & LeafMetaFields): MethodPlugin<TName, TInput & CallOutputOptions, Promise<{
+    /** Validates and strips the output, and describes it for the registry. */
+    outputSchema?: z.ZodSchema;
+    /** Skip validating and stripping the output against `outputSchema`. */
+    skipOutputValidation?: boolean;
+} & MethodMeta): MethodPlugin<TName, TInput & CallOutputOptions, Promise<{
     data: TData;
     meta?: ResponseMeta;
 }>, readonly [], ItemRunInput<TInput>> & LeafSummary<TNamespace, TName, TImports, MethodContract<CallContractInput<TInput, CallOutputOptions>, Promise<{
     data: TData;
     meta?: ResponseMeta;
 }>>>;
-declare function defineMethod<const TName extends string, TInput, TResponse extends StrictPage$1<TResponse>, TItem = ItemOf$1<TResponse>, const TImports extends ImportsInput = readonly [], const TNamespace extends string = "", TState = undefined>(config: {
+declare function defineMethod<const TName extends string, TInput, TResponse extends StrictPage<TResponse>, TItem = ItemOf<TResponse>, const TImports extends ImportsInput = readonly [], const TNamespace extends string = "", TState = undefined>(config: {
     name: TName;
     namespace?: TNamespace;
     imports?: TImports & StaticList<TImports>;
@@ -2842,7 +2393,11 @@ declare function defineMethod<const TName extends string, TInput, TResponse exte
         input?: unknown;
     }) => void | Promise<void>;
     run: (bag: MethodRunBag<ImportsOf<TImports>, TInput & PageFetchInput, TState>) => TResponse | Promise<TResponse>;
-} & LeafMetaFields): MethodPlugin<TName, TInput & PaginatedCallInput & CallOutputOptions, PaginatedSdkResult<TItem>, readonly [], ListRunInput<TInput>> & LeafSummary<TNamespace, TName, TImports, MethodContract<CallContractInput<TInput, PaginatedCallInput & CallOutputOptions>, PaginatedSdkResult<TItem>>>;
+    /** Validates and strips the output, and describes it for the registry. */
+    outputSchema?: z.ZodSchema;
+    /** Skip validating and stripping the output against `outputSchema`. */
+    skipOutputValidation?: boolean;
+} & MethodMeta): MethodPlugin<TName, TInput & PaginatedCallInput & CallOutputOptions, PaginatedSdkResult<TItem>, readonly [], ListRunInput<TInput>> & LeafSummary<TNamespace, TName, TImports, MethodContract<CallContractInput<TInput, PaginatedCallInput & CallOutputOptions>, PaginatedSdkResult<TItem>>>;
 declare function defineMethod<const TName extends string, TInput, TResponse, TItem, const TImports extends ImportsInput = readonly [], const TNamespace extends string = "", TState = undefined>(config: {
     name: TName;
     namespace?: TNamespace;
@@ -2865,7 +2420,11 @@ declare function defineMethod<const TName extends string, TInput, TResponse, TIt
         input?: unknown;
     }) => void | Promise<void>;
     run: (bag: MethodRunBag<ImportsOf<TImports>, TInput & PageFetchInput, TState>) => TResponse | Promise<TResponse>;
-} & LeafMetaFields): MethodPlugin<TName, TInput & PaginatedCallInput & CallOutputOptions, PaginatedSdkResult<TItem>, readonly [], ListRunInput<TInput>> & LeafSummary<TNamespace, TName, TImports, MethodContract<CallContractInput<TInput, PaginatedCallInput & CallOutputOptions>, PaginatedSdkResult<TItem>>>;
+    /** Validates and strips the output, and describes it for the registry. */
+    outputSchema?: z.ZodSchema;
+    /** Skip validating and stripping the output against `outputSchema`. */
+    skipOutputValidation?: boolean;
+} & MethodMeta): MethodPlugin<TName, TInput & PaginatedCallInput & CallOutputOptions, PaginatedSdkResult<TItem>, readonly [], ListRunInput<TInput>> & LeafSummary<TNamespace, TName, TImports, MethodContract<CallContractInput<TInput, PaginatedCallInput & CallOutputOptions>, PaginatedSdkResult<TItem>>>;
 declare function defineMethod<const TName extends string, TInput, TOutput, const TId extends string, const TImports extends ImportsInput = readonly [], TState = undefined>(ref: MethodPlugin<TName, TInput, TOutput> & StandInId<TId> & RefFormRawOnly<TOutput>, config: {
     imports?: TImports & StaticList<TImports>;
     inputSchema?: z.ZodType<TInput>;
@@ -2881,7 +2440,11 @@ declare function defineMethod<const TName extends string, TInput, TOutput, const
         input?: unknown;
     }) => void | Promise<void>;
     run: (bag: MethodRunBag<ImportsOf<TImports>, NoInfer<TInput>, TState>) => NoInfer<TOutput>;
-} & LeafMetaFields): MethodPlugin<TName, TInput, TOutput> & LeafSummaryById<TId, TImports, MethodContract<TInput, TOutput>>;
+    /** Validates and strips the output, and describes it for the registry. */
+    outputSchema?: z.ZodSchema;
+    /** Skip validating and stripping the output against `outputSchema`. */
+    skipOutputValidation?: boolean;
+} & MethodMeta): MethodPlugin<TName, TInput, TOutput> & LeafSummaryById<TId, TImports, MethodContract<TInput, TOutput>>;
 /**
  * Patch how a surface PRESENTS an already-defined method, by reference. Pass
  * the method (or its `declareMethod` stand-in) and any of
@@ -3096,7 +2659,7 @@ declare function defineProperty<const TName extends string, TValue, const TNames
     name: TName;
     namespace?: TNamespace;
     value: TValue;
-} & LeafMetaFields): PropertyPlugin<TName, TValue> & LeafSummary<TNamespace, TName, readonly [], TValue>;
+} & PropertyMeta): PropertyPlugin<TName, TValue> & LeafSummary<TNamespace, TName, readonly [], TValue>;
 declare function defineProperty<const TName extends string, TValue, const TImports extends ImportsInput = readonly [], const TNamespace extends string = "", TState = undefined>(config: {
     name: TName;
     namespace?: TNamespace;
@@ -3123,7 +2686,7 @@ declare function defineProperty<const TName extends string, TValue, const TImpor
     /** Templated registry members for this property's dynamic sub-surface (e.g.
      * a proxy): each a bodyless declaration keyed by `path` instead of `name`. */
     dynamicMembers?: readonly DynamicMember[];
-} & LeafMetaFields): PropertyPlugin<TName, TValue> & LeafSummary<TNamespace, TName, TImports, TValue>;
+} & PropertyMeta): PropertyPlugin<TName, TValue> & LeafSummary<TNamespace, TName, TImports, TValue>;
 /**
  * Provide a value for a declared property BY REFERENCE: pass the
  * `declareProperty` / `declareOptionalProperty` stand-in instead of respelling
@@ -3134,7 +2697,7 @@ declare function defineProperty<const TName extends string, TValue, const TImpor
  */
 declare function defineProperty<const TName extends string, TValue, const TId extends string>(ref: PropertyPlugin<TName, TValue> & StandInId<TId>, config: {
     value: NoInfer<TValue>;
-} & LeafMetaFields): PropertyPlugin<TName, TValue> & PluginSummary<never, TId, never, ContractEntry<TId, TValue>>;
+} & PropertyMeta): PropertyPlugin<TName, TValue> & PluginSummary<never, TId, never, ContractEntry<TId, TValue>>;
 /**
  * Declare a stand-in for a property registered elsewhere (a configured factory
  * plugin, e.g. the api client built from options). Carries only a name and a
@@ -3181,10 +2744,8 @@ declare function declareDefault<P extends AnyLeafPlugin>({ plugin, }: {
  * Define a method-lifecycle hook: a leaf whose `observe` contributes
  * fire-and-forget observers (`onMethodStart` / `onMethodEnd`) the method
  * boundary fires around every method, and whose `wrap` contributes
- * contract-preserving middleware around imported methods. This is how a
- * MODULE plugin provides cross-cutting behavior (the module-model successor
- * to a legacy plugin writing `context.hooks` and to `definePlugin`'s
- * deleted `middleware` map).
+ * contract-preserving middleware around imported methods. This is the one way a
+ * plugin provides cross-cutting behavior.
  *
  * `setup` runs once and owns the hook's state (e.g. a telemetry queue),
  * delivered to the observers. Each observer's bag
@@ -3244,26 +2805,6 @@ declare function declarePlugin<const TId extends string, const TExports extends
     id: LiteralString<TId>;
     exports?: TExports & StaticList<TExports>;
 }): AggregatePlugin<LastSegment<TId>, ArrayExports<TExports>> & AggregateDeclarationSummary<TId, RequiredContractsIn<TExports>>;
-/**
- * Function form — the legacy function-plugin identity wrapper: it returns the
- * function unchanged but constrains its return to `PluginProvides` and
- * preserves the narrow inferred shape, so callers derive `*PluginProvides` via
- * `ReturnType<typeof plugin>`. Such a plugin runs through the legacy bridge
- * (`fromFunctionPlugin` / `createPluginStack`), deprecated with it.
- *
- * @deprecated Author plugins with `defineMethod` / `defineProperty` /
- * object-form `definePlugin` instead. This form logs a runtime deprecation and
- * will be removed in a release after the warning ships.
- */
-declare function definePlugin<TSdk, TProvides extends PluginProvides>(fn: (sdk: TSdk & {
-    context: {
-        meta: Record<string, PluginMeta>;
-    };
-}) => TProvides): (sdk: TSdk & {
-    context: {
-        meta: Record<string, PluginMeta>;
-    };
-}) => TProvides;
 /**
  * Define a plugin module: an aggregate that re-exports child plugins.
  * `exports` mirrors `imports`: an array where a leaf binds under its own name
@@ -3272,12 +2813,12 @@ declare function definePlugin<TSdk, TProvides extends PluginProvides>(fn: (sdk:
  * imports-only module can omit it. Re-exporting implies a dependency on the
  * child. To wrap imported methods, export a `defineHook` with `wrap`.
  */
-declare function definePlugin<const TName extends string, const TImports extends ImportsInput = readonly [], const TNamespace extends string = "", const TExports extends readonly (AnyLeafPlugin | AnyAggregatePlugin)[] = readonly []>(config: {
+declare function definePlugin<const TName extends string, const TImports extends ImportsInput = readonly [], const TNamespace extends string = "", const TExports extends readonly unknown[] = readonly []>(config: {
     name: TName;
     namespace?: TNamespace;
     imports?: TImports & StaticList<TImports>;
-    exports?: TExports & StaticList<TExports>;
-}): AggregatePlugin<TName, ArrayExports<TExports>> & AggregateSummary<TNamespace, TName, TImports, TExports>;
+    exports?: TExports & StaticList<TExports> & PluginList<TExports>;
+}): AggregatePlugin<TName, AsExports<ArrayExports<Extract<TExports, ExportsInput>>>> & AggregateSummary<TNamespace, TName, TImports, TExports>;
 
 /**
  * A `selectExports` spec: a bare export name to keep (`"getApp"`), or a rename
@@ -3294,9 +2835,6 @@ type ResolveSpec<TExports extends Record<string, AnyLeafPlugin>, S> = S extends
 } : never : {
     [K in keyof S]: S[K] extends keyof TExports ? TExports[S[K]] : never;
 };
-/** Ensure the computed export record satisfies the `AggregatePlugin` constraint
- * (an empty/degenerate selection collapses to a bare exports record). */
-type AsExports<T> = T extends Record<string, AnyLeafPlugin> ? T : Record<string, AnyLeafPlugin>;
 /**
  * Select (and optionally rename) a subset of a module's exports, the ES
  * `{ a, b, c as d }` clause. Works the same in `imports` (import) and
@@ -3321,47 +2859,13 @@ declare function selectExports<TExports extends Record<string, AnyLeafPlugin>, c
  */
 declare function omitExports<TExports extends Record<string, AnyLeafPlugin>, const TOmit extends readonly (keyof TExports & string)[], TSource = unknown>(source: AggregatePlugin<string, TExports> & TSource, omit: TOmit): AggregatePlugin<string, Omit<TExports, TOmit[number]>> & ForwardedSummary<TSource>;
 
-/**
- * Lift a legacy function plugin into the module model. The
- * returned plugin runs `fn` at materialization and surfaces its root methods;
- * `createPluginStack().toPlugin()` is built on this, and `addPlugin` uses it for
- * external function plugins. `fn`'s `context` contributions merge into the live
- * `SdkContext`; its other root keys become the surface.
- *
- * @deprecated The module model replaces this exit; it logs a runtime
- * deprecation and will be removed in a release after this warning ships.
- */
-declare function fromFunctionPlugin<TProvides extends PluginProvides>(fn: (sdk: any) => TProvides, config: {
-    name: string;
-    namespace?: string;
-}): LegacyPlugin<TProvides & {
-    getRegistry: (options?: {
-        package?: string;
-    }) => RegistryResult;
-}>;
-/**
- * Build a {@link LegacyMergePlugin}: pass the collapsed legacy stack
- * (`stack.toPlugin()`) as `legacy` and the migrated module-model plugins as
- * `plugin`. `createSdk(defineLegacyMerge({...}))` surfaces both.
- *
- * @deprecated Build directly with `createSdk(root, { configuration })`
- * instead; it logs a runtime deprecation and will be removed in a release
- * after this warning ships.
- */
-declare function defineLegacyMerge<TProvides extends PluginProvides, const TPlugin extends AnyPlugin>(args: {
-    name: string;
-    namespace?: string;
-    legacy: (sdk: any) => TProvides;
-    plugin: TPlugin;
-}): LegacyMergePlugin<TProvides, TPlugin>;
-
 /**
  * Core error machinery.
  *
  * kitcore constructs errors at two internal throw sites: input
  * validation (`utils/validation.ts`) and non-Error normalization
  * (`utils/function-utils.ts`'s `normalizeError`). Heads supply a
- * `adaptError` factory via `createCorePlugin` to map kitcore's abstract
+ * `adaptError` factory under `CORE_OPTIONS_ID` to map kitcore's abstract
  * `CoreErrorCode` values onto their own branded error classes; if
  * no factory is supplied, kitcore falls back to constructing a plain
  * `CoreError`. Either way, every kitcore-thrown error is brand-stamped
@@ -3386,6 +2890,13 @@ declare const CORE_ERROR_SYMBOL: unique symbol;
 declare const CoreErrorCode: {
     readonly Validation: "VALIDATION_ERROR";
     readonly Unknown: "UNKNOWN_ERROR";
+    /**
+     * The object handed to a framework reader is not an SDK `createSdk` built, so
+     * there is no plugin graph to read. A code rather than prose because a caller
+     * distinguishing "no registry here" from "the registry failed to build" has to
+     * match on something stable, and the message is not that.
+     */
+    readonly NoSdkContext: "NO_SDK_CONTEXT_ERROR";
 };
 type CoreErrorCode = (typeof CoreErrorCode)[keyof typeof CoreErrorCode];
 /**
@@ -3506,9 +3017,7 @@ interface StabilityNotice {
 /**
  * The well-known id for framework options: heads inject a `CoreOptions` bag
  * under it via `createSdk`'s `configuration` (or register a property plugin),
- * and the method boundary resolves it by id at every invocation, falling back
- * to the legacy `context.core` write while the deprecated `createCorePlugin`
- * path still exists.
+ * and the method boundary resolves it by id at every invocation.
  */
 declare const CORE_OPTIONS_ID = "kitcore/coreOptions";
 /**
@@ -3597,15 +3106,14 @@ declare const getRegistryPlugin: MethodPlugin<"getRegistry", {
     package?: string | undefined;
 } | undefined) => RegistryResult>;
 
-/** The off-surface escape hatch to an SDK's `SdkContext`. */
+/** The off-surface reader for an SDK's `SdkContext`. Throws when there is
+ * none, because every caller dereferences the result at once. */
 declare function getContext(sdk: unknown): SdkContext;
 /**
  * Read an SDK's registry from outside its surface, so a head need not re-export
- * `getRegistryPlugin` for a controller to introspect it. Module-model SDKs go
- * through the shared, memoized {@link getCachedRegistry} (context-keyed, so this
- * and a surfaced `getRegistry()` return the same object). A pure-legacy
- * stack-built SDK has no `[CONTEXT]` graph; for those the only path is a
- * surfaced `getRegistry()`, so fall back to it when present. Each package
+ * `getRegistryPlugin` for a controller to introspect it. A `createSdk` build
+ * goes through the shared, memoized {@link getCachedRegistry} (context-keyed, so
+ * this and a surfaced `getRegistry()` return the same object). Each package
  * filter is memoized separately.
  */
 declare function getRegistry(sdk: unknown, packageFilter?: string): RegistryResult;
@@ -3651,21 +3159,14 @@ declare function disposeSdk(sdk: unknown, input?: unknown): Promise<void>;
 declare function createSdk<P extends AnyMethodPlugin>(root: P & CompletenessOf<P> & CompatibilityOf<P>, options?: CreateSdkOptions): MethodSdkOf<P>;
 declare function createSdk<P extends AnyPropertyPlugin>(root: P & CompletenessOf<P> & CompatibilityOf<P>, options?: CreateSdkOptions): PropertySdkOf<P>;
 declare function createSdk<P extends AnyAggregatePlugin>(root: P & CompletenessOf<P> & CompatibilityOf<P>, options?: CreateSdkOptions): AggregateSdkOf<P>;
-declare function createSdk<TSurface>(root: LegacyPlugin<TSurface>, options?: CreateSdkOptions): TSurface & SdkInternals;
-declare function createSdk<TProvides extends PluginProvides, TPlugin extends AnyPlugin>(root: LegacyMergePlugin<TProvides, TPlugin>, options?: CreateSdkOptions): TProvides & {
-    getRegistry: (options?: {
-        package?: string;
-    }) => RegistryResult;
-} & AddedSurface<TPlugin> & SdkInternals;
-declare function createSdk<P extends AnyPlugin>(root: P & CompletenessOf<P> & CompatibilityOf<P>, options?: CreateSdkOptions): never;
+declare function createSdk<P extends Plugin>(root: P & CompletenessOf<P> & CompatibilityOf<P>, options?: CreateSdkOptions): never;
 /**
  * Extend an already-built SDK in place with one more plugin (the post-seal
- * extension path). Dispatches on shape: a module-model plugin (`defineMethod` /
- * `defineProperty` / `definePlugin`) is materialized incrementally into the live
- * graph; a legacy function plugin runs through the legacy merge. Either way the
- * caller's `sdk` binding is narrowed to include the addition.
+ * extension path): the plugin's not-yet-materialized graph is materialized
+ * incrementally into the live graph, and the caller's `sdk` binding is narrowed
+ * to include the addition.
  */
-declare function addPlugin<TSdk extends object, P>(sdk: TSdk, plugin: P, options?: {
+declare function addPlugin<TSdk extends object, P extends Plugin>(sdk: TSdk, plugin: P, options?: {
     override?: boolean;
 }): asserts sdk is TSdk & AddedSurface<P>;
 
@@ -4062,16 +3563,18 @@ interface Controller {
  * What the driver needs of a built SDK: one of two ways to reach a registry.
  *
  * The registry is read with the free {@link getRegistry}, which finds it on the
- * SDK's context and falls back to a surfaced `getRegistry()` for a legacy
- * stack-built SDK. So demanding the surfaced method alone is wrong: a bare tool
- * SDK does not surface one, and it cannot always add `getRegistryPlugin`
+ * SDK's context and falls back to a surfaced `getRegistry()` for an object that
+ * carries no context. So demanding the surfaced method alone is wrong: a bare
+ * tool SDK does not surface one, and it cannot always add `getRegistryPlugin`
  * either, because a head bundling its own kitcore copy would collide with it on
  * the shared `kitcore/getRegistry` id.
  *
  * A union, because those really are two different shapes. `SdkInternals` is
- * what every `createSdk` result carries, and the structural branch is the
- * legacy one. Anything else can never back a controller, and saying so here
- * beats an internal registry error on the caller's first `listMethods()`.
+ * what every `createSdk` result carries; the structural branch covers whatever
+ * else answers the registry contract, such as a test stub or a host wrapper
+ * projecting someone else's registry. Anything else can never back a
+ * controller, and saying so here beats an internal registry error on the
+ * caller's first `listMethods()`.
  *
  * The context branch is `SdkInternals`, which declares the `[CONTEXT]` symbol
  * materialization actually writes. So this checks the real thing rather than a
@@ -4090,167 +3593,6 @@ type ControllerSdk = SdkInternals | {
  */
 declare function createController(sdk: ControllerSdk): Controller;
 
-/**
- * The floor the framework holds its own call parameters to, and the only
- * statement of their shapes. Which of them a given boundary reads at all is
- * that boundary's {@link FrameworkOptionsPolicy}.
- *
- * MINIMAL on purpose. It rejects what the machinery cannot act on and nothing
- * else, leaving a plugin free to tighten it. `pageSize` is at least 1 because a
- * page loop asking upstream for zero items does not terminate. `maxItems` may
- * be 0, since "return nothing" is a coherent request the loop already handles.
- * `cursor` is any string: its meaning belongs to the head's API, including
- * whatever a reverse-paginating one encodes in it.
- *
- * A plugin that wants a tighter rule writes it in its own `inputSchema`, and
- * both run. See {@link parseCallOptions}.
- */
-declare const CallFrameworkOptionsSchema: z.ZodObject<{
-    cursor: z.ZodOptional<z.ZodString>;
-    pageSize: z.ZodOptional<z.ZodNumber>;
-    maxItems: z.ZodOptional<z.ZodNumber>;
-    skipOutputDataValidation: z.ZodOptional<z.ZodBoolean>;
-}, z.core.$strip>;
-type CallFrameworkOptions = z.infer<typeof CallFrameworkOptionsSchema>;
-type CallFrameworkOptionKey = keyof CallFrameworkOptions;
-/**
- * What one boundary does with the framework's call parameters.
- *
- * There is no global answer, because the modes differ. A list call feeds a page
- * loop; an item call has no loop to feed; a legacy handler honors nothing the
- * framework added after it was written.
- *
- * This is a fact about the MODE, decided when the boundary is built. It says
- * nothing about the plugin's schema, which is the difference between this and
- * everything {@link parseCallOptions} used to infer.
- */
-interface FrameworkOptionsPolicy {
-    /** The parameters this boundary reads. Each is also held to
-     * {@link CallFrameworkOptionsSchema}, whatever the plugin's schema says. */
-    claims: readonly CallFrameworkOptionKey[];
-    /** The subset handed to `run` even when the plugin's schema dropped it,
-     * because `run` cannot do its job without it. A list `run` is asked for one
-     * page, so it gets that page. */
-    injects: readonly CallFrameworkOptionKey[];
-}
-
-/**
- * Generic utility functions for creating SDK-method wrappers.
- *
- * Both `createFunction` and `createPaginatedFunction` accept the SDK
- * as a parameter and read framework state (`hooks`, `core.adaptError`)
- * live from `sdk.context.*` at method-invocation time. Plugins registered
- * after a method is built still observe and configure it; ordering of
- * plugin registration doesn't change runtime semantics. (Pagination's
- * `adaptPage` is passed in per method, not read from context.)
- */
-
-/**
- * Minimal SDK shape the function wrappers accept. The wrappers only
- * touch `context.hooks` and the resolved core options, but we keep
- * `context` typed as `unknown` so any kitcore-built SDK (whose context type
- * widens unpredictably as plugins layer on) flows through without
- * upstream type narrowing. Each read inside is asserted at the use
- * site against the small slice we actually need.
- */
-type FunctionSdk = {
-    context: unknown;
-};
-/**
- * Wrap a core async function with input validation, error normalization,
- * and method-call lifecycle hooks. Hooks and `adaptError` are read live
- * from `sdk.context.*` at every invocation, so a plugin registered
- * after this method is built still observes and configures it.
- *
- * @param coreFn - the underlying async function to wrap
- * @param options.sdk - the SDK (or sub-SDK view) providing `context.hooks`
- *                      and `context.core`
- * @param options.schema - optional Zod schema for input validation
- */
-declare function createFunction<TOptions, TResult, TSchemaOptions extends TOptions = TOptions>(coreFn: (options: TOptions, context?: CallContext) => Promise<TResult>, options: {
-    sdk: FunctionSdk;
-    schema?: z.ZodSchema<TSchemaOptions>;
-    name?: string;
-    /** Pre-run per-method annotator (see applyAnnotations): invoked before
-     * onMethodStart with the normalized input, its result merged into the
-     * call's annotation bag. */
-    annotator?: (input: unknown) => Annotations;
-    /** Which framework call parameters this callable reads; see
-     * `FrameworkOptionsPolicy`. Omitted means none, which is what a legacy
-     * handler wants: nothing there honors a framework parameter, so every key
-     * in the call object is the handler's own. */
-    frameworkOptions?: FrameworkOptionsPolicy;
-    /** Live read of the method's deprecation meta (see signalDeprecation). */
-    getDeprecation?: () => FunctionDeprecation | undefined;
-    /** Live read of the method's stability level (see signalStability). */
-    getStability?: () => StabilityLevel | undefined;
-}): (callOptions?: TOptions) => Promise<TResult>;
-/**
- * Higher-order function that creates a paginated function that wraps
- * results in `SdkPage<TItem>`.
- *
- * @param coreFn - Function that returns T directly or throws errors
- * @returns A function that normalizes errors and wraps results in `SdkPage`
- */
-/**
- * Extract the item type from a page handler's return shape. The handler
- * may return a flat `{ data: TItem[] }` (or single `data: TItem`), a bare
- * array, or anything else; in all cases the wrapper normalizes to
- * `SdkPage<TItem>` and this resolves the right `TItem`.
- */
-type ItemType<TResult> = TResult extends {
-    data: infer TData;
-} ? TData extends readonly (infer TItem)[] ? TItem : TData : TResult extends readonly (infer TItem)[] ? TItem : TResult;
-declare function createPaginatedFunction<TUserOptions, TResponse, TItem = ItemType<TResponse>>(coreFn: (options: TUserOptions & {
-    cursor?: string;
-    pageSize?: number;
-}, context?: CallContext) => Promise<TResponse>, options: {
-    sdk: FunctionSdk;
-    schema?: z.ZodSchema<TUserOptions>;
-    name?: string;
-    defaultPageSize?: number;
-    /**
-     * Translate the handler's raw `TResponse` into `SdkPage<TItem>`. `TItem`
-     * is wrapped in `NoInfer`: it is sourced from `TResponse` (via the
-     * `ItemType` default), not from this adapter, which is item-agnostic (it
-     * relocates the cursor; items are finalized in the handler's `data`).
-     * Without `NoInfer`, a generic adapter (e.g. `<T>(r) => SdkPage<T>`)
-     * would collapse `TItem` to `unknown`.
-     */
-    adaptPage?: (response: TResponse) => SdkPage<NoInfer<TItem>>;
-    /** Pre-run per-method annotator (see applyAnnotations). */
-    annotator?: (input: unknown) => Annotations;
-    /** Applied to each canonical page after the shape guard (output validation),
-     * with this call's options so it can read per-call controls. */
-    finalizePage?: (page: SdkPage<TItem>, callOptions: unknown) => SdkPage<TItem>;
-    /** Which framework call parameters this callable reads; see
-     * `FrameworkOptionsPolicy`. */
-    frameworkOptions?: FrameworkOptionsPolicy;
-    /** Live read of the method's deprecation meta (see signalDeprecation). */
-    getDeprecation?: () => FunctionDeprecation | undefined;
-    /** Live read of the method's stability level (see signalStability). */
-    getStability?: () => StabilityLevel | undefined;
-}): (options?: TUserOptions & {
-    cursor?: string;
-    pageSize?: number;
-    maxItems?: number;
-}) => PaginatedSdkResult<TItem>;
-
-/**
- * Register kitcore-level configuration by writing the options to
- * `context.core`; the method boundary falls back to that path when no
- * `kitcore/coreOptions` configuration value exists.
- *
- * @deprecated Inject the `CoreOptions` bag under `CORE_OPTIONS_ID` via
- * `createSdk(root, { configuration })` instead. This factory logs a runtime
- * deprecation and will be removed in a release after the warning ships.
- */
-declare function createCorePlugin(options: CoreOptions): Plugin<object, {
-    context: {
-        core: CoreOptions;
-    };
-}>;
-
 /**
  * Per-invocation scope for SDK method calls. Each top-level SDK method call
  * runs in its own AsyncLocalStorage scope (via `runInMethodScope`), isolating
@@ -4337,12 +3679,6 @@ declare const validateOptions: <TOptions, TSchemaOptions extends TOptions>(schem
     adaptError?: AdaptError;
 }) => TSchemaOptions;
 
-/**
- * Translates a paginated handler's raw response into a normalized
- * `SdkPage<TItem>`. Supplied per method as the `adaptPage` on
- * `createPaginatedPluginMethod` (and forwarded to `createPaginatedFunction`).
- */
-type AdaptPage<TResponse = unknown, TItem = unknown> = (response: TResponse) => SdkPage<TItem>;
 type TPageOptions<TOptions> = TOptions extends undefined ? {
     cursor?: string;
     maxItems?: number;
@@ -4963,4 +4299,4 @@ declare const normalizeConnectionPlugin: MethodPlugin<"normalizeConnection", Nor
  */
 declare const resolveConnectionPlugin: MethodPlugin<"resolveConnection", ResolveConnectionInput, string | undefined, readonly [], ResolveConnectionInput> & LeafSummary<"kitcore", "resolveConnection", readonly [], (input: ResolveConnectionInput) => string | undefined>;
 
-export { type AdaptError, type AdaptErrorOptions, type AdaptPage, type AggregatePlugin, type Annotations, type ArrayResolver$1 as ArrayResolver, type AsyncContext, type AttemptHttpRequestInput, type AuthorizeHttpRequestInput, type BoundFormatter, type BoundResolver, CONTEXT, CORE_ERROR_SYMBOL, CORE_OPTIONS_ID, CORE_SIGNAL_SYMBOL, type CallContext, type CallOrigin, type CategoryDefinition, type ComposedAnnotator, type ConstantResolver$1 as ConstantResolver, type ContractEntry, type Controller, type ControllerAction, type ControllerAffordance, type ControllerAnswerFn, type ControllerChoice, type ControllerError, type ControllerIssue, type ControllerListingPage, type ControllerListingPosition, type ControllerMethodDescription, type ControllerMethodSummary, type ControllerPagination, type ControllerParameterDescription, type ControllerPath, type ControllerQuestion, type ControllerResult, type ControllerSdk, type ControllerSelectPage, type ControllerState, type CoreApiError, CoreCancelledSignal, CoreDisposeError, CoreError, CoreErrorCode, type CoreErrorOptions, type CoreOptions, CoreSignal, type CreateSdkOptions, type DeclarationSummary, type DefaultConnectionSchemeInput, type DeprecatedPromptConfigChoice, type DeprecationLogger, type DeprecationWarning, type DispatchHttpRequestInput, type DisposeFn, type DynamicListResolver, type DynamicMember, type DynamicResolver$1 as DynamicResolver, type DynamicSearchResolver, type FieldsResolver, type FormattedItem, type Formatter, type FunctionDeprecation, type FunctionRegistryEntry, HTTP_FETCH_ID, type HookAnnotator, type HookPlugin, type HttpAttemptContext, type HttpFetchInit, type HttpOperationContext, type HttpOperationStart, type HttpPipelineState, type HttpRequest, type HttpRequestInput, type HttpResponse, type InitializeHttpRequestInput, type LeafMeta, type LeafSummary, type LegacyMergePlugin, type LegacyPlugin, type ListItemsResult, type ListPromptConfig, type MethodAnnotator, type MethodAttachment, type MethodContract, type MethodHooks, type MethodOverridePlugin, type MethodPlugin, type MethodScope, type Resolver as ModelResolver, type NegatableMetadata, type NormalizeConnectionInput, type NormalizedConnection, type OnMethodEnd, type OnMethodEndContext, type OnMethodStart, type OnMethodStartContext, type OptionalDeclarationSummary, type OutputDataValidationReport, type OutputFormatter, type OverridableMetaFields, type PaginatedSdkFunction, type PaginatedSdkResult, type Plugin, type PluginMeta, type PluginProvides, type PluginStack, type PluginSummary, type PluginSurface, type PositionalMetadata, type PrepareHttpRequestInput, type PromptConfig, type PromptConfigChoice, type PropertyPlugin, RETRY_HTTP_REQUEST_OPTIONS_ID, type ReceiveHttpResponseInput, type RegistryResult, type RequiredSdkOf, type ResolveConnectionInput, type Resolver$1 as Resolver, type ResolverConfig, type ResolverFieldItem, type ResolverMetadata, type ResolverPromptConfig, type ResolverRequirement, type ResolverType, type ResponseMeta, type RetryHttpRequestAttempt, type RetryHttpRequestOptions, STABILITY_LEVELS, STABILITY_TITLES, type Sdk, type SdkContext, type SdkContextCarrier, type SdkPage, type SendHttpRequest, type StabilityLevel, type StabilityNotice, type StabilityNoticeLogger, type StandInId, type StaticResolver$1 as StaticResolver, type ValidResolvers, addPlugin, applyStabilityLabel, attemptHttpRequestPlugin, authorizeHttpRequestPlugin, canonicalInputSchema, composePlugins, concatLists, concatPaginated, coreOptionsPluginRef, createAsyncContext, createController, createCoreError, createCorePlugin, createDeprecationLogger, createFunction, createPaginatedFunction, createPaginatedPluginMethod, createPluginMethod, createPluginStack, createPrefixedCursor, createSdk, createStabilityNoticeLogger, createValidator, dangerousContextPlugin, declareDefault, declareMethod, declareOptionalMethod, declareOptionalProperty, declarePlugin, declareProperty, decodeIncomingCursor, defaultConnectionSchemePlugin, defaultLogDeprecation, defineFormatter, defineHook, defineLegacyMerge, defineMethod, defineMethodOverride, defineOverride, definePlugin, defineProperty, defineResolver, dispatchHttpRequestPlugin, disposeSdk, fetchPlugin, fromFunctionPlugin, getContext, getCoreErrorCause, getCoreErrorCode, getCurrentDepth, getCurrentScope, getFieldDescriptions, getNegatable, getOutputSchema, getRegistry, getRegistryPlugin, getSchemaDescription, httpFetchPluginRef, initializeHttpRequestPlugin, isCoreCancelledSignal, isCoreError, isCoreSignal, isNestedMethodCall, isPositional, isTelemetryNested, normalizeConnectionPlugin, normalizeStability, objectShapeOf, omitExports, openEnum, paginate, paginateBuffered, paginateMaxItems, prepareHttpRequestPlugin, receiveHttpResponsePlugin, redactHeaders, redactHttpRequest, resolveConnectionPlugin, resolvePlugin, retryHttpRequestOptionsPluginRef, retryHttpRequestPlugin, runInMethodScope, runWithTelemetryContext, selectExports, sendHttpRequestPlugin, splitPrefixedCursor, toIterable, toSnakeCase, toTitleCase, unwrapSchema, validateOptions, withOutputSchema, withPositional, withResolver };
+export { type AdaptError, type AdaptErrorOptions, type AggregatePlugin, type Annotations, type ArrayResolver$1 as ArrayResolver, type AsyncContext, type AttemptHttpRequestInput, type AuthorizeHttpRequestInput, type BoundFormatter, type BoundResolver, CONTEXT, CORE_ERROR_SYMBOL, CORE_OPTIONS_ID, CORE_SIGNAL_SYMBOL, type CallContext, type CallOrigin, type CategoryDefinition, type ComposedAnnotator, type ConstantResolver$1 as ConstantResolver, type ContractEntry, type Controller, type ControllerAction, type ControllerAffordance, type ControllerAnswerFn, type ControllerChoice, type ControllerError, type ControllerIssue, type ControllerListingPage, type ControllerListingPosition, type ControllerMethodDescription, type ControllerMethodSummary, type ControllerPagination, type ControllerParameterDescription, type ControllerPath, type ControllerQuestion, type ControllerResult, type ControllerSdk, type ControllerSelectPage, type ControllerState, type CoreApiError, CoreCancelledSignal, CoreDisposeError, CoreError, CoreErrorCode, type CoreErrorOptions, type CoreOptions, CoreSignal, type CreateSdkOptions, type DeclarationSummary, type DefaultConnectionSchemeInput, type DeprecatedPromptConfigChoice, type DeprecationLogger, type DeprecationWarning, type DispatchHttpRequestInput, type DisposeFn, type DynamicListResolver, type DynamicMember, type DynamicResolver$1 as DynamicResolver, type DynamicSearchResolver, type FieldsResolver, type FormattedItem, type Formatter, type FunctionDeprecation, type FunctionRegistryEntry, HTTP_FETCH_ID, type HookAnnotator, type HookPlugin, type HttpAttemptContext, type HttpFetchInit, type HttpOperationContext, type HttpOperationStart, type HttpPipelineState, type HttpRequest, type HttpRequestInput, type HttpResponse, type InitializeHttpRequestInput, type LeafBase, type LeafMeta, type LeafSummary, type ListItemsResult, type ListPromptConfig, type MethodAnnotator, type MethodAttachment, type MethodContract, type MethodHooks, type MethodMeta, type MethodOverridePlugin, type MethodPlugin, type MethodScope, type Resolver as ModelResolver, type NegatableMetadata, type NormalizeConnectionInput, type NormalizedConnection, type OnMethodEnd, type OnMethodEndContext, type OnMethodStart, type OnMethodStartContext, type OptionalDeclarationSummary, type OutputDataValidationReport, type OverridableMetaFields, type PaginatedSdkFunction, type PaginatedSdkResult, type Plugin, type PluginBase, type PluginLifecycle, type PluginMeta, type PluginSummary, type PluginSurface, type PluginType, type PositionalMetadata, type PrepareHttpRequestInput, type PromptConfig, type PromptConfigChoice, type PropertyMeta, type PropertyPlugin, RETRY_HTTP_REQUEST_OPTIONS_ID, type ReceiveHttpResponseInput, type RegistryResult, type RequiredSdkOf, type ResolveConnectionInput, type Resolver$1 as Resolver, type ResolverConfig, type ResolverFieldItem, type ResolverMetadata, type ResolverPromptConfig, type ResolverRequirement, type ResolverType, type ResponseMeta, type RetryHttpRequestAttempt, type RetryHttpRequestOptions, STABILITY_LEVELS, STABILITY_TITLES, type SdkContext, type SdkContextCarrier, type SdkPage, type SendHttpRequest, type StabilityLevel, type StabilityNotice, type StabilityNoticeLogger, type StandInId, type StaticResolver$1 as StaticResolver, type ValidResolvers, addPlugin, applyStabilityLabel, attemptHttpRequestPlugin, authorizeHttpRequestPlugin, canonicalInputSchema, concatLists, concatPaginated, coreOptionsPluginRef, createAsyncContext, createController, createCoreError, createDeprecationLogger, createPrefixedCursor, createSdk, createStabilityNoticeLogger, createValidator, dangerousContextPlugin, declareDefault, declareMethod, declareOptionalMethod, declareOptionalProperty, declarePlugin, declareProperty, decodeIncomingCursor, defaultConnectionSchemePlugin, defaultLogDeprecation, defineFormatter, defineHook, defineMethod, defineMethodOverride, defineOverride, definePlugin, defineProperty, defineResolver, dispatchHttpRequestPlugin, disposeSdk, fetchPlugin, getContext, getCoreErrorCause, getCoreErrorCode, getCurrentDepth, getCurrentScope, getFieldDescriptions, getNegatable, getOutputSchema, getRegistry, getRegistryPlugin, getSchemaDescription, httpFetchPluginRef, initializeHttpRequestPlugin, isCoreCancelledSignal, isCoreError, isCoreSignal, isNestedMethodCall, isPositional, isTelemetryNested, normalizeConnectionPlugin, normalizeStability, objectShapeOf, omitExports, openEnum, paginate, paginateBuffered, paginateMaxItems, prepareHttpRequestPlugin, receiveHttpResponsePlugin, redactHeaders, redactHttpRequest, resolveConnectionPlugin, resolvePlugin, retryHttpRequestOptionsPluginRef, retryHttpRequestPlugin, runInMethodScope, runWithTelemetryContext, selectExports, sendHttpRequestPlugin, splitPrefixedCursor, toIterable, toSnakeCase, toTitleCase, unwrapSchema, validateOptions, withOutputSchema, withPositional, withResolver };