esoul-sdk 0.23.0 → 0.25.0

package/api-reference.md

@@ -7,11 +7,27 @@ the complete list it teaches from. In a Forge workbench the source itself is rea
 Regenerate: `npm run docs:api`.
 
 ==============================================================================
-## `esoul-sdk` — 250 exports
+## `esoul-sdk` — 265 exports
 
 Manifest, events, tools, ops, bindings, contracts, charts, access words — what app.tsx and the shared modules import.
 
-### Functions and values (150)
+### Functions and values (159)
+
+#### `ApiKeyCredentialSlotSchema` — const · src/manifest.ts
+
+An `apiKey` slot: a key the person pastes.
+
+```ts
+const ApiKeyCredentialSlotSchema: z.ZodObject<{ family: z.ZodLiteral<"apiKey">; provider: z.ZodEffects<z.ZodObject<{ name: z.ZodString; hosts: z.ZodArray<z.ZodString, "many">; header: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>; prefix: z.ZodOptional<z.ZodString>; keyHelp: z.ZodOptional<z.ZodString>; verifyUrl: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>; }, "strict", z.ZodTypeAny, { name?: string; hosts?: string[]; header?: string; prefix?: string; keyHelp?: string; verifyUrl?: string; }, { name?: string; hosts?: string[]; header?: string; prefix?: string; keyHelp?: string; verifyUrl?: string; }>, { name?: string; hosts?: string[]; header?: string; prefix?: string; keyHelp?: string; verifyUrl?: string; }, { name?: string; hosts?: string[]; header?: string; prefix?: string; keyHelp?: string; verifyUrl?: string; }>; label: z.ZodOptional<z.ZodString>; why: z.ZodString; background: z.ZodOptional<z.ZodBoolean>; }, "strict", z.ZodTypeAny, { family?: "apiKey"; provider?: { name?: string; hosts?: string[]; header?: string; prefix?: string; keyHelp?: string; verifyUrl?: string; }; label?: string; why?: string; background?: boolean; }, { family?: "apiKey"; provider?: { name?: string; hosts?: string[]; header?: string; prefix?: string; keyHelp?: string; verifyUrl?: string; }; label?: string; why?: string; background?: boolean; }>
+```
+
+#### `ApiKeyProviderSchema` — const · src/manifest.ts
+
+The service an `apiKey` slot sends a pasted key to.
+
+```ts
+const ApiKeyProviderSchema: z.ZodEffects<z.ZodObject<{ name: z.ZodString; hosts: z.ZodArray<z.ZodString, "many">; header: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>; prefix: z.ZodOptional<z.ZodString>; keyHelp: z.ZodOptional<z.ZodString>; verifyUrl: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>; }, "strict", z.ZodTypeAny, { name?: string; hosts?: string[]; header?: string; prefix?: string; keyHelp?: string; verifyUrl?: string; }, { name?: string; hosts?: string[]; header?: string; prefix?: string; keyHelp?: string; verifyUrl?: string; }>, { name?: string; hosts?: string[]; header?: string; prefix?: string; keyHelp?: string; verifyUrl?: string; }, { name?: string; hosts?: string[]; header?: string; prefix?: string; keyHelp?: string; verifyUrl?: string; }>
+```
 
 #### `ASSET_APP_MAX_BYTES` — const · src/assets.ts
 
@@ -223,10 +239,18 @@ function compileEnvelope( raw: CustomRolesEnvelopeRaw | undefined, models: Recor
 
 #### `CREDENTIAL_FAMILIES` — const · src/manifest.ts
 
-PLATFORM ACCOUNTS — the person's Google account, used by an app without the app ever holding it.
+THE PERSON'S ACCOUNTS — used by an app without the app ever holding them.
+
+```ts
+const CREDENTIAL_FAMILIES: readonly ["google", "oauth2", "apiKey"]
+```
+
+#### `CREDENTIAL_HOST_RE` — const · src/manifest.ts
+
+An API host an `oauth2` or `apiKey` secret may be sent to: a DNS name (`graph.microsoft.com`), lower-case, no scheme, no port, no IP address, no `localhost`.
 
 ```ts
-const CREDENTIAL_FAMILIES: readonly ["google"]
+const CREDENTIAL_HOST_RE: RegExp
 ```
 
 #### `CREDENTIAL_SLOT_RE` — const · src/manifest.ts
@@ -237,6 +261,14 @@ Slot names: lower-case words joined by `-` (`mailbox`, `work-calendar`).
 const CREDENTIAL_SLOT_RE: RegExp
 ```
 
+#### `credentialProviderKey` — function · src/manifest.ts
+
+Which accounts serve a slot: accounts of one provider are interchangeable between apps. `oauth2` — the sign-in AND token endpoints (lower-case host, path), so a slot that points either one somewhere else is another provider and never reuses a person's client or account; `apiKey` — the sorted host list. Pure, so the platform, the box and the SDK agree.
+
+```ts
+function credentialProviderKey(slot: { family: string; provider?: { authorizeUrl?: string; tokenUrl?: string; hosts?: readonly string[] } }): string | null
+```
+
 #### `currentShareId` — function · src/helpers.ts
 
 The public share this page is being viewed through, or null.
@@ -485,6 +517,14 @@ Granted with every sign-in; never declared, never counted as missing.
 const GOOGLE_IMPLICIT_SCOPES: readonly ["openid", "email", "profile"]
 ```
 
+#### `GoogleCredentialSlotSchema` — const · src/manifest.ts
+
+A `google` slot of a manifest's `credentials` block.
+
+```ts
+const GoogleCredentialSlotSchema: z.ZodObject<{ family: z.ZodLiteral<"google">; scopes: z.ZodEffects<z.ZodArray<z.ZodString, "many">, string[], string[]>; label: z.ZodOptional<z.ZodString>; why: z.ZodString; background: z.ZodOptional<z.ZodBoolean>; }, "strict", z.ZodTypeAny, { family?: "google"; label?: string; why?: string; background?: boolean; scopes?: string[]; }, { family?: "google"; label?: string; why?: string; background?: boolean; scopes?: string[]; }>
+```
+
 #### `handleOp` — function · src/ops.ts
 
 Wrap an op so it receives PARSED input and refuses what does not fit. A missing body is `{}`, so an op declared `z.object({})` is called with no arguments the way `callPluginOp(id, "browse", nodeId)` calls it.
@@ -621,6 +661,14 @@ A gateway model id: `provider/model` ("deepseek/deepseek-v3.2").
 const LLM_MODEL_ID_RE: RegExp
 ```
 
+#### `mailWaitDirective` — function · src/agent-wait.ts
+
+The wait's event, for the toolkit's `eventCallback`. Throws on a malformed wait.
+
+```ts
+function mailWaitDirective(runCtx: AgentRunToolContext, a: MailWaitArgs): Record<string, unknown>
+```
+
 #### `makeOpTool` — function · src/ops.ts
 
 `opTool`, bound to a caller. The package binds its own `callPluginOp`; the platform binds the one that carries the acting viewer and targets this deployment — same tool, different wire, decided once at the index.
@@ -757,6 +805,22 @@ function normaliseGoogleScope(scope: string): string | "implicit" | null
 function normaliseTransferPath(path: string | undefined | null): string
 ```
 
+#### `OAuth2CredentialSlotSchema` — const · src/manifest.ts
+
+An `oauth2` slot: any OAuth 2.0 provider.
+
+```ts
+const OAuth2CredentialSlotSchema: z.ZodObject<{ family: z.ZodLiteral<"oauth2">; provider: z.ZodEffects<z.ZodObject<{ name: z.ZodString; authorizeUrl: z.ZodEffects<z.ZodString, string, string>; tokenUrl: z.ZodEffects<z.ZodString, string, string>; scopes: z.ZodArray<z.ZodString, "many">; hosts: z.ZodArray<z.ZodString, "many">; accountUrl: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>; accountField: z.ZodOptional<z.ZodString>; authorizeParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>; tokenAuth: z.ZodOptional<z.ZodEnum<["body", "basic"]>>; clientIdEnv: z.ZodOptional<z.ZodString>; clientSecretEnv: z.ZodOptional<z.ZodString>; }, "strict", z.ZodTypeAny, { name?: string; hosts?: string[]; scopes?: string[]; authorizeUrl?: string; tokenUrl?: string; accountUrl?: string; accountField?: string; authorizeParams?: Record<string, string>; tokenAuth?: "body" | "basic"; clientIdEnv?: string; clientSecretEnv?: string; }, { name?: string; hosts?: string[]; scopes?: string[]; authorizeUrl?: string; tokenUrl?: string; accountUrl?: string; accountField?: string; authorizeParams?: Record<string, string>; tokenAuth?: "body" | "basic"; clientIdEnv?: string; clientSecretEnv?: string; }>, { name?: string; hosts?: string[]; scopes?: string[]; authorizeUrl?: string; tokenUrl?: string; accountUrl?: string; accountField?: string; authorizeParams?: Record<string, string>; tokenAuth?: "body" | "basic"; clientIdEnv?: string; clientSecretEnv?: string; }, { name?: string; hosts?: string[]; scopes?: string[]; authorizeUrl?: string; tokenUrl?: string; accountUrl?: string; accountField?: string; authorizeParams?: Record<string, string>; tokenAuth?: "body" | "basic"; clientIdEnv?: string; clientSecretEnv?: string; }>; label: z.ZodOptional<z.ZodString>; why: z.ZodString; background: z.ZodOptional<z.ZodBoolean>; }, "strict", z.ZodTypeAny, { family?: "oauth2"; provider?: { name?: string; hosts?: string[]; scopes?: string[]; authorizeUrl?: string; tokenUrl?: string; accountUrl?: string; accountField?: string; authorizeParams?: Record<string, string>; tokenAuth?: "body" | "basic"; clientIdEnv?: string; clientSecretEnv?: string; }; label?: string; why?: string; background?: boolean; }, { family?: "oauth2"; provider?: { name?: string; hosts?: string[]; scopes?: string[]; authorizeUrl?: string; tokenUrl?: string; accountUrl?: string; accountField?: string; authorizeParams?: Record<string, string>; tokenAuth?: "body" | "basic"; clientIdEnv?: string; clientSecretEnv?: string; }; label?: string; why?: string; background?: boolean; }>
+```
+
+#### `OAuth2ProviderSchema` — const · src/manifest.ts
+
+The OAuth 2.0 provider an `oauth2` slot signs in with.
+
+```ts
+const OAuth2ProviderSchema: z.ZodEffects<z.ZodObject<{ name: z.ZodString; authorizeUrl: z.ZodEffects<z.ZodString, string, string>; tokenUrl: z.ZodEffects<z.ZodString, string, string>; scopes: z.ZodArray<z.ZodString, "many">; hosts: z.ZodArray<z.ZodString, "many">; accountUrl: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>; accountField: z.ZodOptional<z.ZodString>; authorizeParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>; tokenAuth: z.ZodOptional<z.ZodEnum<["body", "basic"]>>; clientIdEnv: z.ZodOptional<z.ZodString>; clientSecretEnv: z.ZodOptional<z.ZodString>; }, "strict", z.ZodTypeAny, { name?: string; hosts?: string[]; scopes?: string[]; authorizeUrl?: string; tokenUrl?: string; accountUrl?: string; accountField?: string; authorizeParams?: Record<string, string>; tokenAuth?: "body" | "basic"; clientIdEnv?: string; clientSecretEnv?: string; }, { name?: string; hosts?: string[]; scopes?: string[]; authorizeUrl?: string; tokenUrl?: string; accountUrl?: string; accountField?: string; authorizeParams?: Record<string, string>; tokenAuth?: "body" | "basic"; clientIdEnv?: string; clientSecretEnv?: string; }>, { name?: string; hosts?: string[]; scopes?: string[]; authorizeUrl?: string; tokenUrl?: string; accountUrl?: string; accountField?: string; authorizeParams?: Record<string, string>; tokenAuth?: "body" | "basic"; clientIdEnv?: string; clientSecretEnv?: string; }, { name?: string; hosts?: string[]; scopes?: string[]; authorizeUrl?: string; tokenUrl?: string; accountUrl?: string; accountField?: string; authorizeParams?: Record<string, string>; tokenAuth?: "body" | "basic"; clientIdEnv?: string; clientSecretEnv?: string; }>
+```
+
 #### `OpInputError` — class · src/ops.ts
 
 What a handler throws when the call does not fit the declared input. The platform's op routes answer it as `invalid` (400) — the same code the door uses for a malformed call — so a tool relays "add-product does not take imageUrl" rather than a 502 with a zod dump in it.
@@ -767,7 +831,7 @@ class OpInputError extends Error { … }
 
 #### `opTool` — const · src/index.ts
 
-The agent tool for one op, declared once: `opTool(ops.play, { say })` in app.tsx gives a tool whose parameters ARE the op's zod input and whose call goes to `callPluginOp` — as the acting viewer on the platform, over the preview's own route in a Forge box. `say` turns the op's result into the words the model reads.
+The agent tool for one op, declared once: `opTool(ops, "play", { pluginId, nodeId, description, say })` in app.tsx gives a tool whose parameters ARE the op's zod input and whose call goes to `callPluginOp` — as the acting viewer on the platform, over the preview's own route in a Forge box. `say` turns the op's result into the words the model reads.
 
 ```ts
 const opTool: <T extends OpInputs, K extends keyof T & string, R = unknown>(ops: T, name: K, cfg: OpToolConfig<T[K], R>) => DerivedTool
@@ -890,7 +954,7 @@ class PluginCallError extends Error { … }
 The zod schema one entry of a manifest's `connections` must satisfy.
 
 ```ts
-const PluginConnectionSchema: z.ZodEffects<z.ZodObject<{ key: z.ZodString; kind: z.ZodEnum<["oauth2", "apiKey"]>; label: z.ZodString; description: z.ZodOptional<z.ZodString>; authorizeUrl: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>; tokenUrl: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>; oauthScopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>; clientIdEnv: z.ZodOptional<z.ZodString>; clientSecretEnv: z.ZodOptional<z.ZodString>; headerNames: z.ZodOptional<z.ZodArray<z.ZodString, "many">>; }, "strict", z.ZodTypeAny, { key?: string; kind?: "oauth2" | "apiKey"; label?: string; description?: string; authorizeUrl?: string; tokenUrl?: string; oauthScopes?: string[]; clientIdEnv?: string; clientSecretEnv?: string; headerNames?: string[]; }, { key?: string; kind?: "oauth2" | "apiKey"; label?: string; description?: string; authorizeUrl?: string; tokenUrl?: string; oauthScopes?: string[]; clientIdEnv?: string; clientSecretEnv?: string; headerNames?: string[]; }>, { key?: string; kind?: "oauth2" | "apiKey"; label?: string; description?: string; authorizeUrl?: string; tokenUrl?: string; oauthScopes?: string[]; clientIdEnv?: string; clientSecretEnv?: string; headerNames?: string[]; }, { key?: string; kind?: "oauth2" | "apiKey"; label?: string; description?: string; authorizeUrl?: string; tokenUrl?: string; oauthScopes?: string[]; clientIdEnv?: string; clientSecretEnv?: string; headerNames?: string[]; }>
+const PluginConnectionSchema: z.ZodEffects<z.ZodObject<{ key: z.ZodString; kind: z.ZodEnum<["oauth2", "apiKey"]>; label: z.ZodString; description: z.ZodOptional<z.ZodString>; authorizeUrl: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>; tokenUrl: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>; oauthScopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>; clientIdEnv: z.ZodOptional<z.ZodString>; clientSecretEnv: z.ZodOptional<z.ZodString>; headerNames: z.ZodOptional<z.ZodArray<z.ZodString, "many">>; }, "strict", z.ZodTypeAny, { label?: string; authorizeUrl?: string; tokenUrl?: string; clientIdEnv?: string; clientSecretEnv?: string; key?: string; kind?: "apiKey" | "oauth2"; description?: string; oauthScopes?: string[]; headerNames?: string[]; }, { label?: string; authorizeUrl?: string; tokenUrl?: string; clientIdEnv?: string; clientSecretEnv?: string; key?: string; kind?: "apiKey" | "oauth2"; description?: string; oauthScopes?: string[]; headerNames?: string[]; }>, { label?: string; authorizeUrl?: string; tokenUrl?: string; clientIdEnv?: string; clientSecretEnv?: string; key?: string; kind?: "apiKey" | "oauth2"; description?: string; oauthScopes?: string[]; headerNames?: string[]; }, { label?: string; authorizeUrl?: string; tokenUrl?: string; clientIdEnv?: string; clientSecretEnv?: string; key?: string; kind?: "apiKey" | "oauth2"; description?: string; oauthScopes?: string[]; headerNames?: string[]; }>
 ```
 
 #### `PluginCredentialSlotSchema` — const · src/manifest.ts
@@ -898,7 +962,7 @@ const PluginConnectionSchema: z.ZodEffects<z.ZodObject<{ key: z.ZodString; kind:
 One slot of a manifest's `credentials` block.
 
 ```ts
-const PluginCredentialSlotSchema: z.ZodObject<{ family: z.ZodLiteral<"google">; scopes: z.ZodEffects<z.ZodArray<z.ZodString, "many">, string[], string[]>; label: z.ZodOptional<z.ZodString>; why: z.ZodString; background: z.ZodOptional<z.ZodBoolean>; }, "strict", z.ZodTypeAny, { label?: string; family?: "google"; scopes?: string[]; why?: string; background?: boolean; }, { label?: string; family?: "google"; scopes?: string[]; why?: string; background?: boolean; }>
+const PluginCredentialSlotSchema: z.ZodDiscriminatedUnion<"family", [z.ZodObject<{ family: z.ZodLiteral<"google">; scopes: z.ZodEffects<z.ZodArray<z.ZodString, "many">, string[], string[]>; label: z.ZodOptional<z.ZodString>; why: z.ZodString; background: z.ZodOptional<z.ZodBoolean>; }, "strict", z.ZodTypeAny, { family?: "google"; label?: string; why?: string; background?: boolean; scopes?: string[]; }, { family?: "google"; label?: string; why?: string; background?: boolean; scopes?: string[]; }>, z.ZodObject<{ family: z.ZodLiteral<"oauth2">; provider: z.ZodEffects<z.ZodObject<{ name: z.ZodString; authorizeUrl: z.ZodEffects<z.ZodString, string, string>; tokenUrl: z.ZodEffects<z.ZodString, string, string>; scopes: z.ZodArray<z.ZodString, "many">; hosts: z.ZodArray<z.ZodString, "many">; accountUrl: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>; accountField: z.ZodOptional<z.ZodString>; authorizeParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>; tokenAuth: z.ZodOptional<z.ZodEnum<["body", "basic"]>>; clientIdEnv: z.ZodOptional<z.ZodString>; clientSecretEnv: z.ZodOptional<z.ZodString>; }, "strict", z.ZodTypeAny, { name?: string; hosts?: string[]; scopes?: string[]; authorizeUrl?: string; tokenUrl?: string; accountUrl?: string; accountField?: string; authorizeParams?: Record<string, string>; tokenAuth?: "body" | "basic"; clientIdEnv?: string; clientSecretEnv?: string; }, { name?: string; hosts?: string[]; scopes?: string[]; authorizeUrl?: string; tokenUrl?: string; accountUrl?: string; accountField?: string; authorizeParams?: Record<string, string>; tokenAuth?: "body" | "basic"; clientIdEnv?: string; clientSecretEnv?: string; }>, { name?: string; hosts?: string[]; scopes?: string[]; authorizeUrl?: string; tokenUrl?: string; accountUrl?: string; accountField?: string; authorizeParams?: Record<string, string>; tokenAuth?: "body" | "basic"; clientIdEnv?: string; clientSecretEnv?: string; }, { name?: string; hosts?: string[]; scopes?: string[]; authorizeUrl?: string; tokenUrl?: string; accountUrl?: string; accountField?: string; authorizeParams?: Record<string, string>; tokenAuth?: "body" | "basic"; clientIdEnv?: string; clientSecretEnv?: string; }>; label: z.ZodOptional<z.ZodString>; why: z.ZodString; background: z.ZodOptional<z.ZodBoolean>; }, "strict", z.ZodTypeAny, { family?: "oauth2"; provider?: { name?: string; hosts?: string[]; scopes?: string[]; authorizeUrl?: string; tokenUrl?: string; accountUrl?: string; accountField?: string; authorizeParams?: Record<string, string>; tokenAuth?: "body" | "basic"; clientIdEnv?: string; clientSecretEnv?: string; }; label?: string; why?: string; background?: boolean; }, { family?: "oauth2"; provider?: { name?: string; hosts?: string[]; scopes?: string[]; authorizeUrl?: string; tokenUrl?: string; accountUrl?: string; accountField?: string; authorizeParams?: Record<string, string>; tokenAuth?: "body" | "basic"; clientIdEnv?: string; clientSecretEnv?: string; }; label?: string; why?: string; background?: boolean; }>, z.ZodObject<{ family: z.ZodLiteral<"apiKey">; provider: z.ZodEffects<z.ZodObject<{ name: z.ZodString; hosts: z.ZodArray<z.ZodString, "many">; header: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>; prefix: z.ZodOptional<z.ZodString>; keyHelp: z.ZodOptional<z.ZodString>; verifyUrl: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>; }, "strict", z.ZodTypeAny, { name?: string; hosts?: string[]; header?: string; prefix?: string; keyHelp?: string; verifyUrl?: string; }, { name?: string; hosts?: string[]; header?: string; prefix?: string; keyHelp?: string; verifyUrl?: string; }>, { name?: string; hosts?: string[]; header?: string; prefix?: string; keyHelp?: string; verifyUrl?: string; }, { name?: string; hosts?: string[]; header?: string; prefix?: string; keyHelp?: string; verifyUrl?: string; }>; label: z.ZodOptional<z.ZodString>; why: z.ZodString; background: z.ZodOptional<z.ZodBoolean>; }, "strict", z.ZodTypeAny, { family?: "apiKey"; provider?: { name?: string; hosts?: string[]; header?: string; prefix?: string; keyHelp?: string; verifyUrl?: string; }; label?: string; why?: string; background?: boolean; }, { family?: "apiKey"; provider?: { name?: string; hosts?: string[]; header?: string; prefix?: string; keyHelp?: string; verifyUrl?: string; }; label?: string; why?: string; background?: boolean; }>]>
 ```
 
 #### `PluginCredentialsSchema` — const · src/manifest.ts
@@ -906,7 +970,7 @@ const PluginCredentialSlotSchema: z.ZodObject<{ family: z.ZodLiteral<"google">;
 The `credentials` block: slot name → slot. At most ONE slot per app for now.
 
 ```ts
-const PluginCredentialsSchema: z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodObject<{ family: z.ZodLiteral<"google">; scopes: z.ZodEffects<z.ZodArray<z.ZodString, "many">, string[], string[]>; label: z.ZodOptional<z.ZodString>; why: z.ZodString; background: z.ZodOptional<z.ZodBoolean>; }, "strict", z.ZodTypeAny, { label?: string; family?: "google"; scopes?: string[]; why?: string; background?: boolean; }, { label?: string; family?: "google"; scopes?: string[]; why?: string; background?: boolean; }>>, Record<string, { label?: string; family?: "google"; scopes?: string[]; why?: string; background?: boolean; }>, Record<string, { label?: string; family?: "google"; scopes?: string[]; why?: string; background?: boolean; }>>
+const PluginCredentialsSchema: z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodDiscriminatedUnion<"family", [z.ZodObject<{ family: z.ZodLiteral<"google">; scopes: z.ZodEffects<z.ZodArray<z.ZodString, "many">, string[], string[]>; label: z.ZodOptional<z.ZodString>; why: z.ZodString; background: z.ZodOptional<z.ZodBoolean>; }, "strict", z.ZodTypeAny, { family?: "google"; label?: string; why?: string; background?: boolean; scopes?: string[]; }, { family?: "google"; label?: string; why?: string; background?: boolean; scopes?: string[]; }>, z.ZodObject<{ family: z.ZodLiteral<"oauth2">; provider: z.ZodEffects<z.ZodObject<{ name: z.ZodString; authorizeUrl: z.ZodEffects<z.ZodString, string, string>; tokenUrl: z.ZodEffects<z.ZodString, string, string>; scopes: z.ZodArray<z.ZodString, "many">; hosts: z.ZodArray<z.ZodString, "many">; accountUrl: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>; accountField: z.ZodOptional<z.ZodString>; authorizeParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>; tokenAuth: z.ZodOptional<z.ZodEnum<["body", "basic"]>>; clientIdEnv: z.ZodOptional<z.ZodString>; clientSecretEnv: z.ZodOptional<z.ZodString>; }, "strict", z.ZodTypeAny, { name?: string; hosts?: string[]; scopes?: string[]; authorizeUrl?: string; tokenUrl?: string; accountUrl?: string; accountField?: string; authorizeParams?: Record<string, string>; tokenAuth?: "body" | "basic"; clientIdEnv?: string; clientSecretEnv?: string; }, { name?: string; hosts?: string[]; scopes?: string[]; authorizeUrl?: string; tokenUrl?: string; accountUrl?: string; accountField?: string; authorizeParams?: Record<string, string>; tokenAuth?: "body" | "basic"; clientIdEnv?: string; clientSecretEnv?: string; }>, { name?: string; hosts?: string[]; scopes?: string[]; authorizeUrl?: string; tokenUrl?: string; accountUrl?: string; accountField?: string; authorizeParams?: Record<string, string>; tokenAuth?: "body" | "basic"; clientIdEnv?: string; clientSecretEnv?: string; }, { name?: string; hosts?: string[]; scopes?: string[]; authorizeUrl?: string; tokenUrl?: string; accountUrl?: string; accountField?: string; authorizeParams?: Record<string, string>; tokenAuth?: "body" | "basic"; clientIdEnv?: string; clientSecretEnv?: string; }>; label: z.ZodOptional<z.ZodString>; why: z.ZodString; background: z.ZodOptional<z.ZodBoolean>; }, "strict", z.ZodTypeAny, { family?: "oauth2"; provider?: { name?: string; hosts?: string[]; scopes?: string[]; authorizeUrl?: string; tokenUrl?: string; accountUrl?: string; accountField?: string; authorizeParams?: Record<string, string>; tokenAuth?: "body" | "basic"; clientIdEnv?: string; clientSecretEnv?: string; }; label?: string; why?: string; background?: boolean; }, { family?: "oauth2"; provider?: { name?: string; hosts?: string[]; scopes?: string[]; authorizeUrl?: string; tokenUrl?: string; accountUrl?: string; accountField?: string; authorizeParams?: Record<string, string>; tokenAuth?: "body" | "basic"; clientIdEnv?: string; clientSecretEnv?: string; }; label?: string; why?: string; background?: boolean; }>, z.ZodObject<{ family: z.ZodLiteral<"apiKey">; provider: z.ZodEffects<z.ZodObject<{ name: z.ZodString; hosts: z.ZodArray<z.ZodString, "many">; header: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>; prefix: z.ZodOptional<z.ZodString>; keyHelp: z.ZodOptional<z.ZodString>; verifyUrl: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>; }, "strict", z.ZodTypeAny, { name?: string; hosts?: string[]; header?: string; prefix?: string; keyHelp?: string; verifyUrl?: string; }, { name?: string; hosts?: string[]; header?: string; prefix?: string; keyHelp?: string; verifyUrl?: string; }>, { name?: string; hosts?: string[]; header?: string; prefix?: string; keyHelp?: string; verifyUrl?: string; }, { name?: string; hosts?: string[]; header?: string; prefix?: string; keyHelp?: string; verifyUrl?: string; }>; label: z.ZodOptional<z.ZodString>; why: z.ZodString; background: z.ZodOptional<z.ZodBoolean>; }, "strict", z.ZodTypeAny, { family?: "apiKey"; provider?: { name?: string; hosts?: string[]; header?: string; prefix?: string; keyHelp?: string; verifyUrl?: string; }; label?: string; why?: string; background?: boolean; }, { family?: "apiKey"; provider?: { name?: string; hosts?: string[]; header?: string; prefix?: string; keyHelp?: string; verifyUrl?: string; }; label?: string; why?: string; background?: boolean; }>]>>, Record<string, { family?: "apiKey"; provider?: { name?: string; hosts?: string[]; header?: string; prefix?: string; keyHelp?: string; verifyUrl?: string; }; label?: string; why?: string; background?: boolean; } | { family?: "google"; label?: string; why?: string; background?: boolean; scopes?: string[]; } | { family?: "oauth2"; provider?: { name?: string; hosts?: string[]; scopes?: string[]; authorizeUrl?: string; tokenUrl?: string; accountUrl?: string; accountField?: string; authorizeParams?: Record<string, string>; tokenAuth?: "body" | "basic"; clientIdEnv?: string; clientSecretEnv?: string; }; label?: string; why?: string; background?: boolean; }>, Record<string, { family?: "apiKey"; provider?: { name?: string; hosts?: string[]; header?: string; prefix?: string; keyHelp?: string; verifyUrl?: string; }; label?: string; why?: string; background?: boolean; } | { family?: "google"; label?: string; why?: string; background?: boolean; scopes?: string[]; } | { family?: "oauth2"; provider?: { name?: string; hosts?: string[]; scopes?: string[]; authorizeUrl?: string; tokenUrl?: string; accountUrl?: string; accountField?: string; authorizeParams?: Record<string, string>; tokenAuth?: "body" | "basic"; clientIdEnv?: string; clientSecretEnv?: string; }; label?: string; why?: string; background?: boolean; }>>
 ```
 
 #### `pluginEndpointProblem` — function · src/manifest.ts
@@ -946,7 +1010,7 @@ const PluginLlmSchema: z.ZodObject<{ why: z.ZodString; dailyBudgetUsd: z.ZodOpti
 The zod schema `plugin.json` must satisfy — the sync and `check_app` refuse a manifest that fails it, with the path.
 
 ```ts
-const PluginManifestSchema: z.ZodEffects<z.ZodObject<{ manifestVersion: z.ZodLiteral<1>; id: z.ZodString; name: z.ZodString; version: z.ZodString; description: z.ZodString; applicationType: z.ZodString; entry: z.ZodString; icon: z.ZodOptional<z.ZodString>; author: z.ZodOptional<z.ZodObject<{ name: z.ZodString; email: z.ZodOptional<z.ZodString>; url: z.ZodOptional<z.ZodString>; }, "strip", z.ZodTypeAny, { email?: string; name?: string; url?: string; }, { email?: string; name?: string; url?: string; }>>; kickableTasks: z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodArray<z.ZodString, "many">, z.ZodRecord<z.ZodString, z.ZodObject<{ access: z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodEnum<["write", "read", "public", "token"]>, z.ZodArray<z.ZodString, "many">]>>>; requires: z.ZodOptional<z.ZodLiteral<"account">>; }, "strict", z.ZodTypeAny, { access?: "write" | "read" | "public" | "token" | string[]; requires?: "account"; }, { access?: "write" | "read" | "public" | "token" | string[]; requires?: "account"; }>>]>>>; webhooks: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>; ops: z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodArray<z.ZodString, "many">, z.ZodRecord<z.ZodString, z.ZodObject<{ access: z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodEnum<["write", "read", "public", "token"]>, z.ZodArray<z.ZodString, "many">]>>>; requires: z.ZodOptional<z.ZodLiteral<"account">>; }, "strict", z.ZodTypeAny, { access?: "write" | "read" | "public" | "token" | string[]; requires?: "account"; }, { access?: "write" | "read" | "public" | "token" | string[]; requires?: "account"; }>>]>>>; routes: z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodArray<z.ZodString, "many">, z.ZodRecord<z.ZodString, z.ZodObject<{ access: z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodEnum<["write", "read", "public", "token"]>, z.ZodArray<z.ZodString, "many">]>>>; requires: z.ZodOptional<z.ZodLiteral<"account">>; }, "strict", z.ZodTypeAny, { access?: "write" | "read" | "public" | "token" | string[]; requires?: "account"; }, { access?: "write" | "read" | "public" | "token" | string[]; requires?: "account"; }>>]>>>; pollTasks: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodObject<{ task: z.ZodString; everyMinutes: z.ZodNumber; }, "strip", z.ZodTypeAny, { task?: string; everyMinutes?: number; }, { task?: string; everyMinutes?: number; }>, "many">>>; platformApi: z.ZodOptional<z.ZodObject<{ min: z.ZodString; max: z.ZodOptional<z.ZodString>; }, "strip", z.ZodTypeAny, { min?: string; max?: string; }, { min?: string; max?: string; }>>; scopes: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>; roles: z.ZodOptional<z.ZodEffects<z.ZodObject<{ vocabulary: z.ZodArray<z.ZodString, "many">; default: z.ZodDefault<z.ZodOptional<z.ZodObject<{ owner: z.ZodOptional<z.ZodString>; "member-edit": z.ZodOptional<z.ZodString>; "member-readonly": z.ZodOptional<z.ZodString>; visitor: z.ZodOptional<z.ZodString>; anonymous: z.ZodOptional<z.ZodString>; agent: z.ZodOptional<z.ZodString>; }, "strict", z.ZodTypeAny, { owner?: string; "member-edit"?: string; "member-readonly"?: string; visitor?: string; anonymous?: string; agent?: string; }, { owner?: string; "member-edit"?: string; "member-readonly"?: string; visitor?: string; anonymous?: string; agent?: string; }>>>; describe: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>; attributes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["string", "int", "boolean"]>>>; custom: z.ZodOptional<z.ZodObject<{ attributes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>; models: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{ where: z.ZodOptional<z.ZodArray<z.ZodString, "many">>; hide: z.ZodOptional<z.ZodArray<z.ZodString, "many">>; update: z.ZodOptional<z.ZodObject<{ fields: z.ZodOptional<z.ZodArray<z.ZodString, "many">>; transitions: z.ZodOptional<z.ZodString>; }, "strict", z.ZodTypeAny, { fields?: string[]; transitions?: string; }, { fields?: string[]; transitions?: string; }>>; }, "strict", z.ZodTypeAny, { where?: string[]; hide?: string[]; update?: { fields?: string[]; transitions?: string; }; }, { where?: string[]; hide?: string[]; update?: { fields?: string[]; transitions?: string; }; }>>>; ops: z.ZodOptional<z.ZodArray<z.ZodString, "many">>; }, "strict", z.ZodTypeAny, { models?: Record<string, { where?: string[]; hide?: string[]; update?: { fields?: string[]; transitions?: string; }; }>; ops?: string[]; attributes?: string[]; }, { models?: Record<string, { where?: string[]; hide?: string[]; update?: { fields?: string[]; transitions?: string; }; }>; ops?: string[]; attributes?: string[]; }>>; }, "strict", z.ZodTypeAny, { default?: { owner?: string; "member-edit"?: string; "member-readonly"?: string; visitor?: string; anonymous?: string; agent?: string; }; custom?: { models?: Record<string, { where?: string[]; hide?: string[]; update?: { fields?: string[]; transitions?: string; }; }>; ops?: string[]; attributes?: string[]; }; vocabulary?: string[]; describe?: Record<string, string>; attributes?: Record<string, "string" | "boolean" | "int">; }, { default?: { owner?: string; "member-edit"?: string; "member-readonly"?: string; visitor?: string; anonymous?: string; agent?: string; }; custom?: { models?: Record<string, { where?: string[]; hide?: string[]; update?: { fields?: string[]; transitions?: string; }; }>; ops?: string[]; attributes?: string[]; }; vocabulary?: string[]; describe?: Record<string, string>; attributes?: Record<string, "string" | "boolean" | "int">; }>, { default?: { owner?: string; "member-edit"?: string; "member-readonly"?: string; visitor?: string; anonymous?: string; agent?: string; }; custom?: { models?: Record<string, { where?: string[]; hide?: string[]; update?: { fields?: string[]; transitions?: string; }; }>; ops?: string[]; attributes?: string[]; }; vocabulary?: string[]; describe?: Record<string, string>; attributes?: Record<string, "string" | "boolean" | "int">; }, { default?: { owner?: string; "member-edit"?: string; "member-readonly"?: string; visitor?: string; anonymous?: string; agent?: string; }; custom?: { models?: Record<string, { where?: string[]; hide?: string[]; update?: { fields?: string[]; transitions?: string; }; }>; ops?: string[]; attributes?: string[]; }; vocabulary?: string[]; describe?: Record<string, string>; attributes?: Record<string, "string" | "boolean" | "int">; }>>; workspaceTools: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>; device: z.ZodOptional<z.ZodEffects<z.ZodObject<{ commands: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{ argv: z.ZodArray<z.ZodString, "many">; params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<[z.ZodEnum<["int", "number", "bool", "string"]>, z.ZodObject<{ type: z.ZodEnum<["int", "number"]>; min: z.ZodOptional<z.ZodNumber>; max: z.ZodOptional<z.ZodNumber>; describe: z.ZodOptional<z.ZodString>; }, "strict", z.ZodTypeAny, { type?: "number" | "int"; min?: number; max?: number; describe?: string; }, { type?: "number" | "int"; min?: number; max?: number; describe?: string; }>, z.ZodObject<{ type: z.ZodLiteral<"string">; pattern: z.ZodOptional<z.ZodString>; maxLength: z.ZodOptional<z.ZodNumber>; allowDash: z.ZodOptional<z.ZodBoolean>; describe: z.ZodOptional<z.ZodString>; }, "strict", z.ZodTypeAny, { type?: "string"; maxLength?: number; describe?: string; pattern?: string; allowDash?: boolean; }, { type?: "string"; maxLength?: number; describe?: string; pattern?: string; allowDash?: boolean; }>, z.ZodObject<{ type: z.ZodLiteral<"enum">; values: z.ZodArray<z.ZodString, "many">; describe: z.ZodOptional<z.ZodString>; }, "strict", z.ZodTypeAny, { values?: string[]; type?: "enum"; describe?: string; }, { values?: string[]; type?: "enum"; describe?: string; }>, z.ZodObject<{ type: z.ZodLiteral<"bool">; describe: z.ZodOptional<z.ZodString>; }, "strict", z.ZodTypeAny, { type?: "bool"; describe?: string; }, { type?: "bool"; describe?: string; }>]>>>; cwd: z.ZodOptional<z.ZodString>; env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>; config: z.ZodOptional<z.ZodArray<z.ZodString, "many">>; timeoutSeconds: z.ZodOptional<z.ZodNumber>; onRestart: z.ZodOptional<z.ZodEnum<["report", "rerun"]>>; output: z.ZodOptional<z.ZodObject<{ mode: z.ZodOptional<z.ZodEnum<["live", "batched", "final"]>>; flushMs: z.ZodOptional<z.ZodNumber>; maxChunkKb: z.ZodOptional<z.ZodNumber>; keep: z.ZodOptional<z.ZodEnum<["head", "tail", "both"]>>; maxKb: z.ZodOptional<z.ZodNumber>; }, "strict", z.ZodTypeAny, { mode?: "live" | "batched" | "final"; flushMs?: number; maxChunkKb?: number; keep?: "head" | "tail" | "both"; maxKb?: number; }, { mode?: "live" | "batched" | "final"; flushMs?: number; maxChunkKb?: number; keep?: "head" | "tail" | "both"; maxKb?: number; }>>; result: z.ZodOptional<z.ZodEnum<["text", "json"]>>; describe: z.ZodOptional<z.ZodString>; }, "strict", z.ZodTypeAny, { params?: Record<string, "string" | "number" | "int" | "bool" | { type?: "number" | "int"; min?: number; max?: number; describe?: string; } | { type?: "string"; maxLength?: number; describe?: string; pattern?: string; allowDash?: boolean; } | { values?: string[]; type?: "enum"; describe?: string; } | { type?: "bool"; describe?: string; }>; describe?: string; argv?: string[]; cwd?: string; env?: Record<string, string>; config?: string[]; timeoutSeconds?: number; onRestart?: "report" | "rerun"; output?: { mode?: "live" | "batched" | "final"; flushMs?: number; maxChunkKb?: number; keep?: "head" | "tail" | "both"; maxKb?: number; }; result?: "text" | "json"; }, { params?: Record<string, "string" | "number" | "int" | "bool" | { type?: "number" | "int"; min?: number; max?: number; describe?: string; } | { type?: "string"; maxLength?: number; describe?: string; pattern?: string; allowDash?: boolean; } | { values?: string[]; type?: "enum"; describe?: string; } | { type?: "bool"; describe?: string; }>; describe?: string; argv?: string[]; cwd?: string; env?: Record<string, string>; config?: string[]; timeoutSeconds?: number; onRestart?: "report" | "rerun"; output?: { mode?: "live" | "batched" | "final"; flushMs?: number; maxChunkKb?: number; keep?: "head" | "tail" | "both"; maxKb?: number; }; result?: "text" | "json"; }>>>; program: z.ZodOptional<z.ZodObject<{ main: z.ZodString; resident: z.ZodOptional<z.ZodBoolean>; setup: z.ZodOptional<z.ZodArray<z.ZodObject<{ id: z.ZodString; describe: z.ZodString; run: z.ZodArray<z.ZodString, "many">; inputs: z.ZodOptional<z.ZodArray<z.ZodString, "many">>; timeoutSeconds: z.ZodOptional<z.ZodNumber>; }, "strict", z.ZodTypeAny, { id?: string; describe?: string; timeoutSeconds?: number; run?: string[]; inputs?: string[]; }, { id?: string; describe?: string; timeoutSeconds?: number; run?: string[]; inputs?: string[]; }>, "many">>; selfTest: z.ZodOptional<z.ZodObject<{ run: z.ZodArray<z.ZodString, "many">; timeoutSeconds: z.ZodOptional<z.ZodNumber>; }, "strict", z.ZodTypeAny, { timeoutSeconds?: number; run?: string[]; }, { timeoutSeconds?: number; run?: string[]; }>>; }, "strict", z.ZodTypeAny, { main?: string; resident?: boolean; setup?: { id?: string; describe?: string; timeoutSeconds?: number; run?: string[]; inputs?: string[]; }[]; selfTest?: { timeoutSeconds?: number; run?: string[]; }; }, { main?: string; resident?: boolean; setup?: { id?: string; describe?: string; timeoutSeconds?: number; run?: string[]; inputs?: string[]; }[]; selfTest?: { timeoutSeconds?: number; run?: string[]; }; }>>; config: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{ secret: z.ZodOptional<z.ZodBoolean>; required: z.ZodOptional<z.ZodBoolean>; describe: z.ZodOptional<z.ZodString>; }, "strict", z.ZodTypeAny, { required?: boolean; describe?: string; secret?: boolean; }, { required?: boolean; describe?: string; secret?: boolean; }>>>; redact: z.ZodOptional<z.ZodArray<z.ZodString, "many">>; onAppDeleted: z.ZodOptional<z.ZodEnum<["kill", "finish"]>>; }, "strict", z.ZodTypeAny, { config?: Record<string, { required?: boolean; describe?: string; secret?: boolean; }>; commands?: Record<string, { params?: Record<string, "string" | "number" | "int" | "bool" | { type?: "number" | "int"; min?: number; max?: number; describe?: string; } | { type?: "string"; maxLength?: number; describe?: string; pattern?: string; allowDash?: boolean; } | { values?: string[]; type?: "enum"; describe?: string; } | { type?: "bool"; describe?: string; }>; describe?: string; argv?: string[]; cwd?: string; env?: Record<string, string>; config?: string[]; timeoutSeconds?: number; onRestart?: "report" | "rerun"; output?: { mode?: "live" | "batched" | "final"; flushMs?: number; maxChunkKb?: number; keep?: "head" | "tail" | "both"; maxKb?: number; }; result?: "text" | "json"; }>; program?: { main?: string; resident?: boolean; setup?: { id?: string; describe?: string; timeoutSeconds?: number; run?: string[]; inputs?: string[]; }[]; selfTest?: { timeoutSeconds?: number; run?: string[]; }; }; redact?: string[]; onAppDeleted?: "kill" | "finish"; }, { config?: Record<string, { required?: boolean; describe?: string; secret?: boolean; }>; commands?: Record<string, { params?: Record<string, "string" | "number" | "int" | "bool" | { type?: "number" | "int"; min?: number; max?: number; describe?: string; } | { type?: "string"; maxLength?: number; describe?: string; pattern?: string; allowDash?: boolean; } | { values?: string[]; type?: "enum"; describe?: string; } | { type?: "bool"; describe?: string; }>; describe?: string; argv?: string[]; cwd?: string; env?: Record<string, string>; config?: string[]; timeoutSeconds?: number; onRestart?: "report" | "rerun"; output?: { mode?: "live" | "batched" | "final"; flushMs?: number; maxChunkKb?: number; keep?: "head" | "tail" | "both"; maxKb?: number; }; result?: "text" | "json"; }>; program?: { main?: string; resident?: boolean; setup?: { id?: string; describe?: string; timeoutSeconds?: number; run?: string[]; inputs?: string[]; }[]; selfTest?: { timeoutSeconds?: number; run?: string[]; }; }; redact?: string[]; onAppDeleted?: "kill" | "finish"; }>, { config?: Record<string, { required?: boolean; describe?: string; secret?: boolean; }>; commands?: Record<string, { params?: Record<string, "string" | "number" | "int" | "bool" | { type?: "number" | "int"; min?: number; max?: number; describe?: string; } | { type?: "string"; maxLength?: number; describe?: string; pattern?: string; allowDash?: boolean; } | { values?: string[]; type?: "enum"; describe?: string; } | { type?: "bool"; describe?: string; }>; describe?: string; argv?: string[]; cwd?: string; env?: Record<string, string>; config?: string[]; timeoutSeconds?: number; onRestart?: "report" | "rerun"; output?: { mode?: "live" | "batched" | "final"; flushMs?: number; maxChunkKb?: number; keep?: "head" | "tail" | "both"; maxKb?: number; }; result?: "text" | "json"; }>; program?: { main?: string; resident?: boolean; setup?: { id?: string; describe?: string; timeoutSeconds?: number; run?: string[]; inputs?: string[]; }[]; selfTest?: { timeoutSeconds?: number; run?: string[]; }; }; redact?: string[]; onAppDeleted?: "kill" | "finish"; }, { config?: Record<string, { required?: boolean; describe?: string; secret?: boolean; }>; commands?: Record<string, { params?: Record<string, "string" | "number" | "int" | "bool" | { type?: "number" | "int"; min?: number; max?: number; describe?: string; } | { type?: "string"; maxLength?: number; describe?: string; pattern?: string; allowDash?: boolean; } | { values?: string[]; type?: "enum"; describe?: string; } | { type?: "bool"; describe?: string; }>; describe?: string; argv?: string[]; cwd?: string; env?: Record<string, string>; config?: string[]; timeoutSeconds?: number; onRestart?: "report" | "rerun"; output?: { mode?: "live" | "batched" | "final"; flushMs?: number; maxChunkKb?: number; keep?: "head" | "tail" | "both"; maxKb?: number; }; result?: "text" | "json"; }>; program?: { main?: string; resident?: boolean; setup?: { id?: string; describe?: string; timeoutSeconds?: number; run?: string[]; inputs?: string[]; }[]; selfTest?: { timeoutSeconds?: number; run?: string[]; }; }; redact?: string[]; onAppDeleted?: "kill" | "finish"; }>>; connections: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodObject<{ key: z.ZodString; kind: z.ZodEnum<["oauth2", "apiKey"]>; label: z.ZodString; description: z.ZodOptional<z.ZodString>; authorizeUrl: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>; tokenUrl: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>; oauthScopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>; clientIdEnv: z.ZodOptional<z.ZodString>; clientSecretEnv: z.ZodOptional<z.ZodString>; headerNames: z.ZodOptional<z.ZodArray<z.ZodString, "many">>; }, "strict", z.ZodTypeAny, { key?: string; kind?: "oauth2" | "apiKey"; label?: string; description?: string; authorizeUrl?: string; tokenUrl?: string; oauthScopes?: string[]; clientIdEnv?: string; clientSecretEnv?: string; headerNames?: string[]; }, { key?: string; kind?: "oauth2" | "apiKey"; label?: string; description?: string; authorizeUrl?: string; tokenUrl?: string; oauthScopes?: string[]; clientIdEnv?: string; clientSecretEnv?: string; headerNames?: string[]; }>, { key?: string; kind?: "oauth2" | "apiKey"; label?: string; description?: string; authorizeUrl?: string; tokenUrl?: string; oauthScopes?: string[]; clientIdEnv?: string; clientSecretEnv?: string; headerNames?: string[]; }, { key?: string; kind?: "oauth2" | "apiKey"; label?: string; description?: string; authorizeUrl?: string; tokenUrl?: string; oauthScopes?: string[]; clientIdEnv?: string; clientSecretEnv?: string; headerNames?: string[]; }>, "many">>>; credentials: z.ZodOptional<z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodObject<{ family: z.ZodLiteral<"google">; scopes: z.ZodEffects<z.ZodArray<z.ZodString, "many">, string[], string[]>; label: z.ZodOptional<z.ZodString>; why: z.ZodString; background: z.ZodOptional<z.ZodBoolean>; }, "strict", z.ZodTypeAny, { label?: string; family?: "google"; scopes?: string[]; why?: string; background?: boolean; }, { label?: string; family?: "google"; scopes?: string[]; why?: string; background?: boolean; }>>, Record<string, { label?: string; family?: "google"; scopes?: string[]; why?: string; background?: boolean; }>, Record<string, { label?: string; family?: "google"; scopes?: string[]; why?: string; background?: boolean; }>>>; llm: z.ZodOptional<z.ZodObject<{ why: z.ZodString; dailyBudgetUsd: z.ZodOptional<z.ZodNumber>; models: z.ZodOptional<z.ZodArray<z.ZodString, "many">>; }, "strict", z.ZodTypeAny, { why?: string; dailyBudgetUsd?: number; models?: string[]; }, { why?: string; dailyBudgetUsd?: number; models?: string[]; }>>; fileSources: z.ZodOptional<z.ZodEffects<z.ZodObject<{ workspace: z.ZodOptional<z.ZodEnum<["read", "readwrite"]>>; providers: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>; write: z.ZodOptional<z.ZodArray<z.ZodString, "many">>; }, "strict", z.ZodTypeAny, { write?: string[]; workspace?: "read" | "readwrite"; providers?: string[]; }, { write?: string[]; workspace?: "read" | "readwrite"; providers?: string[]; }>, { write?: string[]; workspace?: "read" | "readwrite"; providers?: string[]; }, { write?: string[]; workspace?: "read" | "readwrite"; providers?: string[]; }>>; fileProviders: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodObject<{ key: z.ZodString; connectionKey: z.ZodString; label: z.ZodString; }, "strict", z.ZodTypeAny, { key?: string; label?: string; connectionKey?: string; }, { key?: string; label?: string; connectionKey?: string; }>, "many">>>; fileProducers: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodObject<{ key: z.ZodString; label: z.ZodString; }, "strict", z.ZodTypeAny, { key?: string; label?: string; }, { key?: string; label?: string; }>, "many">>>; uses: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{ contract: z.ZodString; label: z.ZodOptional<z.ZodString>; optional: z.ZodOptional<z.ZodBoolean>; }, "strict", z.ZodTypeAny, { label?: string; contract?: string; optional?: boolean; }, { label?: string; contract?: string; optional?: boolean; }>>>; provides: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{ tools: z.ZodOptional<z.ZodArray<z.ZodString, "many">>; events: z.ZodOptional<z.ZodArray<z.ZodString, "many">>; models: z.ZodOptional<z.ZodArray<z.ZodString, "many">>; }, "strict", z.ZodTypeAny, { models?: string[]; tools?: string[]; events?: string[]; }, { models?: string[]; tools?: string[]; events?: string[]; }>>>; channel: z.ZodOptional<z.ZodObject<{ topics: z.ZodRecord<z.ZodString, z.ZodObject<{ audience: z.ZodOptional<z.ZodUnion<[z.ZodLiteral<"all">, z.ZodLiteral<"viewer">, z.ZodString]>>; mayAddress: z.ZodOptional<z.ZodArray<z.ZodString, "many">>; description: z.ZodOptional<z.ZodString>; }, "strict", z.ZodTypeAny, { description?: string; audience?: string; mayAddress?: string[]; }, { description?: string; audience?: string; mayAddress?: string[]; }>>; }, "strict", z.ZodTypeAny, { topics?: Record<string, { description?: string; audience?: string; mayAddress?: string[]; }>; }, { topics?: Record<string, { description?: string; audience?: string; mayAddress?: string[]; }>; }>>; db: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{ scope: z.ZodOptional<z.ZodEnum<["instance", "workspace", "user"]>>; owner: z.ZodOptional<z.ZodLiteral<"creator">>; fields: z.ZodRecord<z.ZodString, z.ZodString>; sealed: z.ZodOptional<z.ZodArray<z.ZodString, "many">>; unique: z.ZodOptional<z.ZodArray<z.ZodArray<z.ZodString, "many">, "many">>; indexes: z.ZodOptional<z.ZodArray<z.ZodUnion<[z.ZodArray<z.ZodString, "many">, z.ZodObject<{ fields: z.ZodArray<z.ZodString, "many">; kind: z.ZodOptional<z.ZodEnum<["btree", "contains", "text"]>>; }, "strict", z.ZodTypeAny, { kind?: "text" | "btree" | "contains"; fields?: string[]; }, { kind?: "text" | "btree" | "contains"; fields?: string[]; }>]>, "many">>; rules: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>; }, "strict", z.ZodTypeAny, { owner?: "creator"; fields?: Record<string, string>; scope?: "workspace" | "instance" | "user"; sealed?: string[]; unique?: string[][]; indexes?: (string[] | { kind?: "text" | "btree" | "contains"; fields?: string[]; })[]; rules?: Record<string, unknown>; }, { owner?: "creator"; fields?: Record<string, string>; scope?: "workspace" | "instance" | "user"; sealed?: string[]; unique?: string[][]; indexes?: (string[] | { kind?: "text" | "btree" | "contains"; fields?: string[]; })[]; rules?: Record<string, unknown>; }>>>; }, "strict", z.ZodTypeAny, { roles?: { default?: { owner?: string; "member-edit"?: string; "member-readonly"?: string; visitor?: string; anonymous?: string; agent?: string; }; custom?: { models?: Record<string, { where?: string[]; hide?: string[]; update?: { fields?: string[]; transitions?: string; }; }>; ops?: string[]; attributes?: string[]; }; vocabulary?: string[]; describe?: Record<string, string>; attributes?: Record<string, "string" | "boolean" | "int">; }; description?: string; scopes?: string[]; manifestVersion?: 1; id?: string; name?: string; version?: string; applicationType?: string; entry?: string; icon?: string; author?: { email?: string; name?: string; url?: string; }; kickableTasks?: string[] | Record<string, { access?: "write" | "read" | "public" | "token" | string[]; requires?: "account"; }>; webhooks?: string[]; ops?: string[] | Record<string, { access?: "write" | "read" | "public" | "token" | string[]; requires?: "account"; }>; routes?: string[] | Record<string, { access?: "write" | "read" | "public" | "token" | string[]; requires?: "account"; }>; pollTasks?: { task?: string; everyMinutes?: number; }[]; platformApi?: { min?: string; max?: string; }; workspaceTools?: string[]; device?: { config?: Record<string, { required?: boolean; describe?: string; secret?: boolean; }>; commands?: Record<string, { params?: Record<string, "string" | "number" | "int" | "bool" | { type?: "number" | "int"; min?: number; max?: number; describe?: string; } | { type?: "string"; maxLength?: number; describe?: string; pattern?: string; allowDash?: boolean; } | { values?: string[]; type?: "enum"; describe?: string; } | { type?: "bool"; describe?: string; }>; describe?: string; argv?: string[]; cwd?: string; env?: Record<string, string>; config?: string[]; timeoutSeconds?: number; onRestart?: "report" | "rerun"; output?: { mode?: "live" | "batched" | "final"; flushMs?: number; maxChunkKb?: number; keep?: "head" | "tail" | "both"; maxKb?: number; }; result?: "text" | "json"; }>; program?: { main?: string; resident?: boolean; setup?: { id?: string; describe?: string; timeoutSeconds?: number; run?: string[]; inputs?: string[]; }[]; selfTest?: { timeoutSeconds?: number; run?: string[]; }; }; redact?: string[]; onAppDeleted?: "kill" | "finish"; }; connections?: { key?: string; kind?: "oauth2" | "apiKey"; label?: string; description?: string; authorizeUrl?: string; tokenUrl?: string; oauthScopes?: string[]; clientIdEnv?: string; clientSecretEnv?: string; headerNames?: string[]; }[]; credentials?: Record<string, { label?: string; family?: "google"; scopes?: string[]; why?: string; background?: boolean; }>; llm?: { why?: string; dailyBudgetUsd?: number; models?: string[]; }; fileSources?: { write?: string[]; workspace?: "read" | "readwrite"; providers?: string[]; }; fileProviders?: { key?: string; label?: string; connectionKey?: string; }[]; fileProducers?: { key?: string; label?: string; }[]; uses?: Record<string, { label?: string; contract?: string; optional?: boolean; }>; provides?: Record<string, { models?: string[]; tools?: string[]; events?: string[]; }>; channel?: { topics?: Record<string, { description?: string; audience?: string; mayAddress?: string[]; }>; }; db?: Record<string, { owner?: "creator"; fields?: Record<string, string>; scope?: "workspace" | "instance" | "user"; sealed?: string[]; unique?: string[][]; indexes?: (string[] | { kind?: "text" | "btree" | "contains"; fields?: string[]; })[]; rules?: Record<string, unknown>; }>; }, { roles?: { default?: { owner?: string; "member-edit"?: string; "member-readonly"?: string; visitor?: string; anonymous?: string; agent?: string; }; custom?: { models?: Record<string, { where?: string[]; hide?: string[]; update?: { fields?: string[]; transitions?: string; }; }>; ops?: string[]; attributes?: string[]; }; vocabulary?: string[]; describe?: Record<string, string>; attributes?: Record<string, "string" | "boolean" | "int">; }; description?: string; scopes?: string[]; manifestVersion?: 1; id?: string; name?: string; version?: string; applicationType?: string; entry?: string; icon?: string; author?: { email?: string; name?: string; url?: string; }; kickableTasks?: string[] | Record<string, { access?: "write" | "read" | "public" | "token" | string[]; requires?: "account"; }>; webhooks?: string[]; ops?: string[] | Record<string, { access?: "write" | "read" | "public" | "token" | string[]; requires?: "account"; }>; routes?: string[] | Record<string, { access?: "write" | "read" | "public" | "token" | string[]; requires?: "account"; }>; pollTasks?: { task?: string; everyMinutes?: number; }[]; platformApi?: { min?: string; max?: string; }; workspaceTools?: string[]; device?: { config?: Record<string, { required?: boolean; describe?: string; secret?: boolean; }>; commands?: Record<string, { params?: Record<string, "string" | "number" | "int" | "bool" | { type?: "number" | "int"; min?: number; max?: number; describe?: string; } | { type?: "string"; maxLength?: number; describe?: string; pattern?: string; allowDash?: boolean; } | { values?: string[]; type?: "enum"; describe?: string; } | { type?: "bool"; describe?: string; }>; describe?: string; argv?: string[]; cwd?: string; env?: Record<string, string>; config?: string[]; timeoutSeconds?: number; onRestart?: "report" | "rerun"; output?: { mode?: "live" | "batched" | "final"; flushMs?: number; maxChunkKb?: number; keep?: "head" | "tail" | "both"; maxKb?: number; }; result?: "text" | "json"; }>; program?: { main?: string; resident?: boolean; setup?: { id?: string; describe?: string; timeoutSeconds?: number; run?: string[]; inputs?: string[]; }[]; selfTest?: { timeoutSeconds?: number; run?: string[]; }; }; redact?: string[]; onAppDeleted?: "kill" | "finish"; }; connections?: { key?: string; kind?: "oauth2" | "apiKey"; label?: string; description?: string; authorizeUrl?: string; tokenUrl?: string; oauthScopes?: string[]; clientIdEnv?: string; clientSecretEnv?: string; headerNames?: string[]; }[]; credentials?: Record<string, { label?: string; family?: "google"; scopes?: string[]; why?: string; background?: boolean; }>; llm?: { why?: string; dailyBudgetUsd?: number; models?: string[]; }; fileSources?: { write?: string[]; workspace?: "read" | "readwrite"; providers?: string[]; }; fileProviders?: { key?: string; label?: string; connectionKey?: string; }[]; fileProducers?: { key?: string; label?: string; }[]; uses?: Record<string, { label?: string; contract?: string; optional?: boolean; }>; provides?: Record<string, { models?: string[]; tools?: string[]; events?: string[]; }>; channel?: { topics?: Record<string, { description?: string; audience?: string; mayAddress?: string[]; }>; }; db?: Record<string, { owner?: "creator"; fields?: Record<string, string>; scope?: "workspace" | "instance" | "user"; sealed?: string[]; unique?: string[][]; indexes?: (string[] | { kind?: "text" | "btree" | "contains"; fields?: string[]; })[]; rules?: Record<string, unknown>; }>; }>, { roles?: { default?: { owner?: string; "member-edit"?: string; "member-readonly"?: string; visitor?: string; anonymous?: string; agent?: string; }; custom?: { models?: Record<string, { where?: string[]; hide?: string[]; update?: { fields?: string[]; transitions?: string; }; }>; ops?: string[]; attributes?: string[]; }; vocabulary?: string[]; describe?: Record<string, string>; attributes?: Record<string, "string" | "boolean" | "int">; }; description?: string; scopes?: string[]; manifestVersion?: 1; id?: string; name?: string; version?: string; applicationType?: string; entry?: string; icon?: string; author?: { email?: string; name?: string; url?: string; }; kickableTasks?: string[] | Record<string, { access?: "write" | "read" | "public" | "token" | string[]; requires?: "account"; }>; webhooks?: string[]; ops?: string[] | Record<string, { access?: "write" | "read" | "public" | "token" | string[]; requires?: "account"; }>; routes?: string[] | Record<string, { access?: "write" | "read" | "public" | "token" | string[]; requires?: "account"; }>; pollTasks?: { task?: string; everyMinutes?: number; }[]; platformApi?: { min?: string; max?: string; }; workspaceTools?: string[]; device?: { config?: Record<string, { required?: boolean; describe?: string; secret?: boolean; }>; commands?: Record<string, { params?: Record<string, "string" | "number" | "int" | "bool" | { type?: "number" | "int"; min?: number; max?: number; describe?: string; } | { type?: "string"; maxLength?: number; describe?: string; pattern?: string; allowDash?: boolean; } | { values?: string[]; type?: "enum"; describe?: string; } | { type?: "bool"; describe?: string; }>; describe?: string; argv?: string[]; cwd?: string; env?: Record<string, string>; config?: string[]; timeoutSeconds?: number; onRestart?: "report" | "rerun"; output?: { mode?: "live" | "batched" | "final"; flushMs?: number; maxChunkKb?: number; keep?: "head" | "tail" | "both"; maxKb?: number; }; result?: "text" | "json"; }>; program?: { main?: string; resident?: boolean; setup?: { id?: string; describe?: string; timeoutSeconds?: number; run?: string[]; inputs?: string[]; }[]; selfTest?: { timeoutSeconds?: number; run?: string[]; }; }; redact?: string[]; onAppDeleted?: "kill" | "finish"; }; connections?: { key?: string; kind?: "oauth2" | "apiKey"; label?: string; description?: string; authorizeUrl?: string; tokenUrl?: string; oauthScopes?: string[]; clientIdEnv?: string; clientSecretEnv?: string; headerNames?: string[]; }[]; credentials?: Record<string, { label?: string; family?: "google"; scopes?: string[]; why?: string; background?: boolean; }>; llm?: { why?: string; dailyBudgetUsd?: number; models?: string[]; }; fileSources?: { write?: string[]; workspace?: "read" | "readwrite"; providers?: string[]; }; fileProviders?: { key?: string; label?: string; connectionKey?: string; }[]; fileProducers?: { key?: string; label?: string; }[]; uses?: Record<string, { label?: string; contract?: string; optional?: boolean; }>; provides?: Record<string, { models?: string[]; tools?: string[]; events?: string[]; }>; channel?: { topics?: Record<string, { description?: string; audience?: string; mayAddress?: string[]; }>; }; db?: Record<string, { owner?: "creator"; fields?: Record<string, string>; scope?: "workspace" | "instance" | "user"; sealed?: string[]; unique?: string[][]; indexes?: (string[] | { kind?: "text" | "btree" | "contains"; fields?: string[]; })[]; rules?: Record<string, unknown>; }>; }, { roles?: { default?: { owner?: string; "member-edit"?: string; "member-readonly"?: string; visitor?: string; anonymous?: string; agent?: string; }; custom?: { models?: Record<string, { where?: string[]; hide?: string[]; update?: { fields?: string[]; transitions?: string; }; }>; ops?: string[]; attributes?: string[]; }; vocabulary?: string[]; describe?: Record<string, string>; attributes?: Record<string, "string" | "boolean" | "int">; }; description?: string; scopes?: string[]; manifestVersion?: 1; id?: string; name?: string; version?: string; applicationType?: string; entry?: string; icon?: string; author?: { email?: string; name?: string; url?: string; }; kickableTasks?: string[] | Record<string, { access?: "write" | "read" | "public" | "token" | string[]; requires?: "account"; }>; webhooks?: string[]; ops?: string[] | Record<string, { access?: "write" | "read" | "public" | "token" | string[]; requires?: "account"; }>; routes?: string[] | Record<string, { access?: "write" | "read" | "public" | "token" | string[]; requires?: "account"; }>; pollTasks?: { task?: string; everyMinutes?: number; }[]; platformApi?: { min?: string; max?: string; }; workspaceTools?: string[]; device?: { config?: Record<string, { required?: boolean; describe?: string; secret?: boolean; }>; commands?: Record<string, { params?: Record<string, "string" | "number" | "int" | "bool" | { type?: "number" | "int"; min?: number; max?: number; describe?: string; } | { type?: "string"; maxLength?: number; describe?: string; pattern?: string; allowDash?: boolean; } | { values?: string[]; type?: "enum"; describe?: string; } | { type?: "bool"; describe?: string; }>; describe?: string; argv?: string[]; cwd?: string; env?: Record<string, string>; config?: string[]; timeoutSeconds?: number; onRestart?: "report" | "rerun"; output?: { mode?: "live" | "batched" | "final"; flushMs?: number; maxChunkKb?: number; keep?: "head" | "tail" | "both"; maxKb?: number; }; result?: "text" | "json"; }>; program?: { main?: string; resident?: boolean; setup?: { id?: string; describe?: string; timeoutSeconds?: number; run?: string[]; inputs?: string[]; }[]; selfTest?: { timeoutSeconds?: number; run?: string[]; }; }; redact?: string[]; onAppDeleted?: "kill" | "finish"; }; connections?: { key?: string; kind?: "oauth2" | "apiKey"; label?: string; description?: string; authorizeUrl?: string; tokenUrl?: string; oauthScopes?: string[]; clientIdEnv?: string; clientSecretEnv?: string; headerNames?: string[]; }[]; credentials?: Record<string, { label?: string; family?: "google"; scopes?: string[]; why?: string; background?: boolean; }>; llm?: { why?: string; dailyBudgetUsd?: number; models?: string[]; }; fileSources?: { write?: string[]; workspace?: "read" | "readwrite"; providers?: string[]; }; fileProviders?: { key?: string; label?: string; connectionKey?: string; }[]; fileProducers?: { key?: string; label?: string; }[]; uses?: Record<string, { label?: string; contract?: string; optional?: boolean; }>; provides?: Record<string, { models?: string[]; tools?: string[]; events?: string[]; }>; channel?: { topics?: Record<string, { description?: string; audience?: string; mayAddress?: string[]; }>; }; db?: Record<string, { owner?: "creator"; fields?: Record<string, string>; scope?: "workspace" | "instance" | "user"; sealed?: string[]; unique?: string[][]; indexes?: (string[] | { kind?: "text" | "btree" | "contains"; fields?: string[]; })[]; rules?: Record<string, unknown>; }>; }>
+const PluginManifestSchema: z.ZodEffects<z.ZodObject<{ manifestVersion: z.ZodLiteral<1>; id: z.ZodString; name: z.ZodString; version: z.ZodString; description: z.ZodString; applicationType: z.ZodString; entry: z.ZodString; icon: z.ZodOptional<z.ZodString>; author: z.ZodOptional<z.ZodObject<{ name: z.ZodString; email: z.ZodOptional<z.ZodString>; url: z.ZodOptional<z.ZodString>; }, "strip", z.ZodTypeAny, { name?: string; email?: string; url?: string; }, { name?: string; email?: string; url?: string; }>>; kickableTasks: z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodArray<z.ZodString, "many">, z.ZodRecord<z.ZodString, z.ZodObject<{ access: z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodEnum<["write", "read", "public", "token"]>, z.ZodArray<z.ZodString, "many">]>>>; requires: z.ZodOptional<z.ZodLiteral<"account">>; }, "strict", z.ZodTypeAny, { access?: string[] | "write" | "read" | "public" | "token"; requires?: "account"; }, { access?: string[] | "write" | "read" | "public" | "token"; requires?: "account"; }>>]>>>; webhooks: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>; ops: z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodArray<z.ZodString, "many">, z.ZodRecord<z.ZodString, z.ZodObject<{ access: z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodEnum<["write", "read", "public", "token"]>, z.ZodArray<z.ZodString, "many">]>>>; requires: z.ZodOptional<z.ZodLiteral<"account">>; }, "strict", z.ZodTypeAny, { access?: string[] | "write" | "read" | "public" | "token"; requires?: "account"; }, { access?: string[] | "write" | "read" | "public" | "token"; requires?: "account"; }>>]>>>; routes: z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodArray<z.ZodString, "many">, z.ZodRecord<z.ZodString, z.ZodObject<{ access: z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodEnum<["write", "read", "public", "token"]>, z.ZodArray<z.ZodString, "many">]>>>; requires: z.ZodOptional<z.ZodLiteral<"account">>; }, "strict", z.ZodTypeAny, { access?: string[] | "write" | "read" | "public" | "token"; requires?: "account"; }, { access?: string[] | "write" | "read" | "public" | "token"; requires?: "account"; }>>]>>>; pollTasks: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodObject<{ task: z.ZodString; everyMinutes: z.ZodNumber; }, "strip", z.ZodTypeAny, { task?: string; everyMinutes?: number; }, { task?: string; everyMinutes?: number; }>, "many">>>; platformApi: z.ZodOptional<z.ZodObject<{ min: z.ZodString; max: z.ZodOptional<z.ZodString>; }, "strip", z.ZodTypeAny, { min?: string; max?: string; }, { min?: string; max?: string; }>>; scopes: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>; roles: z.ZodOptional<z.ZodEffects<z.ZodObject<{ vocabulary: z.ZodArray<z.ZodString, "many">; default: z.ZodDefault<z.ZodOptional<z.ZodObject<{ owner: z.ZodOptional<z.ZodString>; "member-edit": z.ZodOptional<z.ZodString>; "member-readonly": z.ZodOptional<z.ZodString>; visitor: z.ZodOptional<z.ZodString>; anonymous: z.ZodOptional<z.ZodString>; agent: z.ZodOptional<z.ZodString>; }, "strict", z.ZodTypeAny, { owner?: string; "member-edit"?: string; "member-readonly"?: string; visitor?: string; anonymous?: string; agent?: string; }, { owner?: string; "member-edit"?: string; "member-readonly"?: string; visitor?: string; anonymous?: string; agent?: string; }>>>; describe: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>; attributes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["string", "int", "boolean"]>>>; custom: z.ZodOptional<z.ZodObject<{ attributes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>; models: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{ where: z.ZodOptional<z.ZodArray<z.ZodString, "many">>; hide: z.ZodOptional<z.ZodArray<z.ZodString, "many">>; update: z.ZodOptional<z.ZodObject<{ fields: z.ZodOptional<z.ZodArray<z.ZodString, "many">>; transitions: z.ZodOptional<z.ZodString>; }, "strict", z.ZodTypeAny, { fields?: string[]; transitions?: string; }, { fields?: string[]; transitions?: string; }>>; }, "strict", z.ZodTypeAny, { where?: string[]; hide?: string[]; update?: { fields?: string[]; transitions?: string; }; }, { where?: string[]; hide?: string[]; update?: { fields?: string[]; transitions?: string; }; }>>>; ops: z.ZodOptional<z.ZodArray<z.ZodString, "many">>; }, "strict", z.ZodTypeAny, { models?: Record<string, { where?: string[]; hide?: string[]; update?: { fields?: string[]; transitions?: string; }; }>; ops?: string[]; attributes?: string[]; }, { models?: Record<string, { where?: string[]; hide?: string[]; update?: { fields?: string[]; transitions?: string; }; }>; ops?: string[]; attributes?: string[]; }>>; }, "strict", z.ZodTypeAny, { custom?: { models?: Record<string, { where?: string[]; hide?: string[]; update?: { fields?: string[]; transitions?: string; }; }>; ops?: string[]; attributes?: string[]; }; default?: { owner?: string; "member-edit"?: string; "member-readonly"?: string; visitor?: string; anonymous?: string; agent?: string; }; vocabulary?: string[]; describe?: Record<string, string>; attributes?: Record<string, "string" | "boolean" | "int">; }, { custom?: { models?: Record<string, { where?: string[]; hide?: string[]; update?: { fields?: string[]; transitions?: string; }; }>; ops?: string[]; attributes?: string[]; }; default?: { owner?: string; "member-edit"?: string; "member-readonly"?: string; visitor?: string; anonymous?: string; agent?: string; }; vocabulary?: string[]; describe?: Record<string, string>; attributes?: Record<string, "string" | "boolean" | "int">; }>, { custom?: { models?: Record<string, { where?: string[]; hide?: string[]; update?: { fields?: string[]; transitions?: string; }; }>; ops?: string[]; attributes?: string[]; }; default?: { owner?: string; "member-edit"?: string; "member-readonly"?: string; visitor?: string; anonymous?: string; agent?: string; }; vocabulary?: string[]; describe?: Record<string, string>; attributes?: Record<string, "string" | "boolean" | "int">; }, { custom?: { models?: Record<string, { where?: string[]; hide?: string[]; update?: { fields?: string[]; transitions?: string; }; }>; ops?: string[]; attributes?: string[]; }; default?: { owner?: string; "member-edit"?: string; "member-readonly"?: string; visitor?: string; anonymous?: string; agent?: string; }; vocabulary?: string[]; describe?: Record<string, string>; attributes?: Record<string, "string" | "boolean" | "int">; }>>; workspaceTools: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>; device: z.ZodOptional<z.ZodEffects<z.ZodObject<{ commands: z.ZodDefault<z.ZodRecord<z.ZodString, z.ZodObject<{ argv: z.ZodArray<z.ZodString, "many">; params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnion<[z.ZodEnum<["int", "number", "bool", "string"]>, z.ZodObject<{ type: z.ZodEnum<["int", "number"]>; min: z.ZodOptional<z.ZodNumber>; max: z.ZodOptional<z.ZodNumber>; describe: z.ZodOptional<z.ZodString>; }, "strict", z.ZodTypeAny, { type?: "number" | "int"; min?: number; max?: number; describe?: string; }, { type?: "number" | "int"; min?: number; max?: number; describe?: string; }>, z.ZodObject<{ type: z.ZodLiteral<"string">; pattern: z.ZodOptional<z.ZodString>; maxLength: z.ZodOptional<z.ZodNumber>; allowDash: z.ZodOptional<z.ZodBoolean>; describe: z.ZodOptional<z.ZodString>; }, "strict", z.ZodTypeAny, { type?: "string"; maxLength?: number; describe?: string; pattern?: string; allowDash?: boolean; }, { type?: "string"; maxLength?: number; describe?: string; pattern?: string; allowDash?: boolean; }>, z.ZodObject<{ type: z.ZodLiteral<"enum">; values: z.ZodArray<z.ZodString, "many">; describe: z.ZodOptional<z.ZodString>; }, "strict", z.ZodTypeAny, { values?: string[]; type?: "enum"; describe?: string; }, { values?: string[]; type?: "enum"; describe?: string; }>, z.ZodObject<{ type: z.ZodLiteral<"bool">; describe: z.ZodOptional<z.ZodString>; }, "strict", z.ZodTypeAny, { type?: "bool"; describe?: string; }, { type?: "bool"; describe?: string; }>]>>>; cwd: z.ZodOptional<z.ZodString>; env: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>; config: z.ZodOptional<z.ZodArray<z.ZodString, "many">>; timeoutSeconds: z.ZodOptional<z.ZodNumber>; onRestart: z.ZodOptional<z.ZodEnum<["report", "rerun"]>>; output: z.ZodOptional<z.ZodObject<{ mode: z.ZodOptional<z.ZodEnum<["live", "batched", "final"]>>; flushMs: z.ZodOptional<z.ZodNumber>; maxChunkKb: z.ZodOptional<z.ZodNumber>; keep: z.ZodOptional<z.ZodEnum<["head", "tail", "both"]>>; maxKb: z.ZodOptional<z.ZodNumber>; }, "strict", z.ZodTypeAny, { mode?: "live" | "batched" | "final"; flushMs?: number; maxChunkKb?: number; keep?: "head" | "tail" | "both"; maxKb?: number; }, { mode?: "live" | "batched" | "final"; flushMs?: number; maxChunkKb?: number; keep?: "head" | "tail" | "both"; maxKb?: number; }>>; result: z.ZodOptional<z.ZodEnum<["text", "json"]>>; describe: z.ZodOptional<z.ZodString>; }, "strict", z.ZodTypeAny, { params?: Record<string, "string" | "number" | "int" | "bool" | { type?: "number" | "int"; min?: number; max?: number; describe?: string; } | { type?: "string"; maxLength?: number; describe?: string; pattern?: string; allowDash?: boolean; } | { values?: string[]; type?: "enum"; describe?: string; } | { type?: "bool"; describe?: string; }>; describe?: string; argv?: string[]; cwd?: string; env?: Record<string, string>; config?: string[]; timeoutSeconds?: number; onRestart?: "report" | "rerun"; output?: { mode?: "live" | "batched" | "final"; flushMs?: number; maxChunkKb?: number; keep?: "head" | "tail" | "both"; maxKb?: number; }; result?: "text" | "json"; }, { params?: Record<string, "string" | "number" | "int" | "bool" | { type?: "number" | "int"; min?: number; max?: number; describe?: string; } | { type?: "string"; maxLength?: number; describe?: string; pattern?: string; allowDash?: boolean; } | { values?: string[]; type?: "enum"; describe?: string; } | { type?: "bool"; describe?: string; }>; describe?: string; argv?: string[]; cwd?: string; env?: Record<string, string>; config?: string[]; timeoutSeconds?: number; onRestart?: "report" | "rerun"; output?: { mode?: "live" | "batched" | "final"; flushMs?: number; maxChunkKb?: number; keep?: "head" | "tail" | "both"; maxKb?: number; }; result?: "text" | "json"; }>>>; program: z.ZodOptional<z.ZodObject<{ main: z.ZodString; resident: z.ZodOptional<z.ZodBoolean>; setup: z.ZodOptional<z.ZodArray<z.ZodObject<{ id: z.ZodString; describe: z.ZodString; run: z.ZodArray<z.ZodString, "many">; inputs: z.ZodOptional<z.ZodArray<z.ZodString, "many">>; timeoutSeconds: z.ZodOptional<z.ZodNumber>; }, "strict", z.ZodTypeAny, { id?: string; describe?: string; timeoutSeconds?: number; run?: string[]; inputs?: string[]; }, { id?: string; describe?: string; timeoutSeconds?: number; run?: string[]; inputs?: string[]; }>, "many">>; selfTest: z.ZodOptional<z.ZodObject<{ run: z.ZodArray<z.ZodString, "many">; timeoutSeconds: z.ZodOptional<z.ZodNumber>; }, "strict", z.ZodTypeAny, { timeoutSeconds?: number; run?: string[]; }, { timeoutSeconds?: number; run?: string[]; }>>; }, "strict", z.ZodTypeAny, { main?: string; resident?: boolean; setup?: { id?: string; describe?: string; timeoutSeconds?: number; run?: string[]; inputs?: string[]; }[]; selfTest?: { timeoutSeconds?: number; run?: string[]; }; }, { main?: string; resident?: boolean; setup?: { id?: string; describe?: string; timeoutSeconds?: number; run?: string[]; inputs?: string[]; }[]; selfTest?: { timeoutSeconds?: number; run?: string[]; }; }>>; config: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{ secret: z.ZodOptional<z.ZodBoolean>; required: z.ZodOptional<z.ZodBoolean>; describe: z.ZodOptional<z.ZodString>; }, "strict", z.ZodTypeAny, { required?: boolean; describe?: string; secret?: boolean; }, { required?: boolean; describe?: string; secret?: boolean; }>>>; redact: z.ZodOptional<z.ZodArray<z.ZodString, "many">>; onAppDeleted: z.ZodOptional<z.ZodEnum<["kill", "finish"]>>; }, "strict", z.ZodTypeAny, { config?: Record<string, { required?: boolean; describe?: string; secret?: boolean; }>; commands?: Record<string, { params?: Record<string, "string" | "number" | "int" | "bool" | { type?: "number" | "int"; min?: number; max?: number; describe?: string; } | { type?: "string"; maxLength?: number; describe?: string; pattern?: string; allowDash?: boolean; } | { values?: string[]; type?: "enum"; describe?: string; } | { type?: "bool"; describe?: string; }>; describe?: string; argv?: string[]; cwd?: string; env?: Record<string, string>; config?: string[]; timeoutSeconds?: number; onRestart?: "report" | "rerun"; output?: { mode?: "live" | "batched" | "final"; flushMs?: number; maxChunkKb?: number; keep?: "head" | "tail" | "both"; maxKb?: number; }; result?: "text" | "json"; }>; program?: { main?: string; resident?: boolean; setup?: { id?: string; describe?: string; timeoutSeconds?: number; run?: string[]; inputs?: string[]; }[]; selfTest?: { timeoutSeconds?: number; run?: string[]; }; }; redact?: string[]; onAppDeleted?: "kill" | "finish"; }, { config?: Record<string, { required?: boolean; describe?: string; secret?: boolean; }>; commands?: Record<string, { params?: Record<string, "string" | "number" | "int" | "bool" | { type?: "number" | "int"; min?: number; max?: number; describe?: string; } | { type?: "string"; maxLength?: number; describe?: string; pattern?: string; allowDash?: boolean; } | { values?: string[]; type?: "enum"; describe?: string; } | { type?: "bool"; describe?: string; }>; describe?: string; argv?: string[]; cwd?: string; env?: Record<string, string>; config?: string[]; timeoutSeconds?: number; onRestart?: "report" | "rerun"; output?: { mode?: "live" | "batched" | "final"; flushMs?: number; maxChunkKb?: number; keep?: "head" | "tail" | "both"; maxKb?: number; }; result?: "text" | "json"; }>; program?: { main?: string; resident?: boolean; setup?: { id?: string; describe?: string; timeoutSeconds?: number; run?: string[]; inputs?: string[]; }[]; selfTest?: { timeoutSeconds?: number; run?: string[]; }; }; redact?: string[]; onAppDeleted?: "kill" | "finish"; }>, { config?: Record<string, { required?: boolean; describe?: string; secret?: boolean; }>; commands?: Record<string, { params?: Record<string, "string" | "number" | "int" | "bool" | { type?: "number" | "int"; min?: number; max?: number; describe?: string; } | { type?: "string"; maxLength?: number; describe?: string; pattern?: string; allowDash?: boolean; } | { values?: string[]; type?: "enum"; describe?: string; } | { type?: "bool"; describe?: string; }>; describe?: string; argv?: string[]; cwd?: string; env?: Record<string, string>; config?: string[]; timeoutSeconds?: number; onRestart?: "report" | "rerun"; output?: { mode?: "live" | "batched" | "final"; flushMs?: number; maxChunkKb?: number; keep?: "head" | "tail" | "both"; maxKb?: number; }; result?: "text" | "json"; }>; program?: { main?: string; resident?: boolean; setup?: { id?: string; describe?: string; timeoutSeconds?: number; run?: string[]; inputs?: string[]; }[]; selfTest?: { timeoutSeconds?: number; run?: string[]; }; }; redact?: string[]; onAppDeleted?: "kill" | "finish"; }, { config?: Record<string, { required?: boolean; describe?: string; secret?: boolean; }>; commands?: Record<string, { params?: Record<string, "string" | "number" | "int" | "bool" | { type?: "number" | "int"; min?: number; max?: number; describe?: string; } | { type?: "string"; maxLength?: number; describe?: string; pattern?: string; allowDash?: boolean; } | { values?: string[]; type?: "enum"; describe?: string; } | { type?: "bool"; describe?: string; }>; describe?: string; argv?: string[]; cwd?: string; env?: Record<string, string>; config?: string[]; timeoutSeconds?: number; onRestart?: "report" | "rerun"; output?: { mode?: "live" | "batched" | "final"; flushMs?: number; maxChunkKb?: number; keep?: "head" | "tail" | "both"; maxKb?: number; }; result?: "text" | "json"; }>; program?: { main?: string; resident?: boolean; setup?: { id?: string; describe?: string; timeoutSeconds?: number; run?: string[]; inputs?: string[]; }[]; selfTest?: { timeoutSeconds?: number; run?: string[]; }; }; redact?: string[]; onAppDeleted?: "kill" | "finish"; }>>; connections: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodEffects<z.ZodObject<{ key: z.ZodString; kind: z.ZodEnum<["oauth2", "apiKey"]>; label: z.ZodString; description: z.ZodOptional<z.ZodString>; authorizeUrl: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>; tokenUrl: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>; oauthScopes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>; clientIdEnv: z.ZodOptional<z.ZodString>; clientSecretEnv: z.ZodOptional<z.ZodString>; headerNames: z.ZodOptional<z.ZodArray<z.ZodString, "many">>; }, "strict", z.ZodTypeAny, { label?: string; authorizeUrl?: string; tokenUrl?: string; clientIdEnv?: string; clientSecretEnv?: string; key?: string; kind?: "apiKey" | "oauth2"; description?: string; oauthScopes?: string[]; headerNames?: string[]; }, { label?: string; authorizeUrl?: string; tokenUrl?: string; clientIdEnv?: string; clientSecretEnv?: string; key?: string; kind?: "apiKey" | "oauth2"; description?: string; oauthScopes?: string[]; headerNames?: string[]; }>, { label?: string; authorizeUrl?: string; tokenUrl?: string; clientIdEnv?: string; clientSecretEnv?: string; key?: string; kind?: "apiKey" | "oauth2"; description?: string; oauthScopes?: string[]; headerNames?: string[]; }, { label?: string; authorizeUrl?: string; tokenUrl?: string; clientIdEnv?: string; clientSecretEnv?: string; key?: string; kind?: "apiKey" | "oauth2"; description?: string; oauthScopes?: string[]; headerNames?: string[]; }>, "many">>>; credentials: z.ZodOptional<z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodDiscriminatedUnion<"family", [z.ZodObject<{ family: z.ZodLiteral<"google">; scopes: z.ZodEffects<z.ZodArray<z.ZodString, "many">, string[], string[]>; label: z.ZodOptional<z.ZodString>; why: z.ZodString; background: z.ZodOptional<z.ZodBoolean>; }, "strict", z.ZodTypeAny, { family?: "google"; label?: string; why?: string; background?: boolean; scopes?: string[]; }, { family?: "google"; label?: string; why?: string; background?: boolean; scopes?: string[]; }>, z.ZodObject<{ family: z.ZodLiteral<"oauth2">; provider: z.ZodEffects<z.ZodObject<{ name: z.ZodString; authorizeUrl: z.ZodEffects<z.ZodString, string, string>; tokenUrl: z.ZodEffects<z.ZodString, string, string>; scopes: z.ZodArray<z.ZodString, "many">; hosts: z.ZodArray<z.ZodString, "many">; accountUrl: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>; accountField: z.ZodOptional<z.ZodString>; authorizeParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>; tokenAuth: z.ZodOptional<z.ZodEnum<["body", "basic"]>>; clientIdEnv: z.ZodOptional<z.ZodString>; clientSecretEnv: z.ZodOptional<z.ZodString>; }, "strict", z.ZodTypeAny, { name?: string; hosts?: string[]; scopes?: string[]; authorizeUrl?: string; tokenUrl?: string; accountUrl?: string; accountField?: string; authorizeParams?: Record<string, string>; tokenAuth?: "body" | "basic"; clientIdEnv?: string; clientSecretEnv?: string; }, { name?: string; hosts?: string[]; scopes?: string[]; authorizeUrl?: string; tokenUrl?: string; accountUrl?: string; accountField?: string; authorizeParams?: Record<string, string>; tokenAuth?: "body" | "basic"; clientIdEnv?: string; clientSecretEnv?: string; }>, { name?: string; hosts?: string[]; scopes?: string[]; authorizeUrl?: string; tokenUrl?: string; accountUrl?: string; accountField?: string; authorizeParams?: Record<string, string>; tokenAuth?: "body" | "basic"; clientIdEnv?: string; clientSecretEnv?: string; }, { name?: string; hosts?: string[]; scopes?: string[]; authorizeUrl?: string; tokenUrl?: string; accountUrl?: string; accountField?: string; authorizeParams?: Record<string, string>; tokenAuth?: "body" | "basic"; clientIdEnv?: string; clientSecretEnv?: string; }>; label: z.ZodOptional<z.ZodString>; why: z.ZodString; background: z.ZodOptional<z.ZodBoolean>; }, "strict", z.ZodTypeAny, { family?: "oauth2"; provider?: { name?: string; hosts?: string[]; scopes?: string[]; authorizeUrl?: string; tokenUrl?: string; accountUrl?: string; accountField?: string; authorizeParams?: Record<string, string>; tokenAuth?: "body" | "basic"; clientIdEnv?: string; clientSecretEnv?: string; }; label?: string; why?: string; background?: boolean; }, { family?: "oauth2"; provider?: { name?: string; hosts?: string[]; scopes?: string[]; authorizeUrl?: string; tokenUrl?: string; accountUrl?: string; accountField?: string; authorizeParams?: Record<string, string>; tokenAuth?: "body" | "basic"; clientIdEnv?: string; clientSecretEnv?: string; }; label?: string; why?: string; background?: boolean; }>, z.ZodObject<{ family: z.ZodLiteral<"apiKey">; provider: z.ZodEffects<z.ZodObject<{ name: z.ZodString; hosts: z.ZodArray<z.ZodString, "many">; header: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>; prefix: z.ZodOptional<z.ZodString>; keyHelp: z.ZodOptional<z.ZodString>; verifyUrl: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>; }, "strict", z.ZodTypeAny, { name?: string; hosts?: string[]; header?: string; prefix?: string; keyHelp?: string; verifyUrl?: string; }, { name?: string; hosts?: string[]; header?: string; prefix?: string; keyHelp?: string; verifyUrl?: string; }>, { name?: string; hosts?: string[]; header?: string; prefix?: string; keyHelp?: string; verifyUrl?: string; }, { name?: string; hosts?: string[]; header?: string; prefix?: string; keyHelp?: string; verifyUrl?: string; }>; label: z.ZodOptional<z.ZodString>; why: z.ZodString; background: z.ZodOptional<z.ZodBoolean>; }, "strict", z.ZodTypeAny, { family?: "apiKey"; provider?: { name?: string; hosts?: string[]; header?: string; prefix?: string; keyHelp?: string; verifyUrl?: string; }; label?: string; why?: string; background?: boolean; }, { family?: "apiKey"; provider?: { name?: string; hosts?: string[]; header?: string; prefix?: string; keyHelp?: string; verifyUrl?: string; }; label?: string; why?: string; background?: boolean; }>]>>, Record<string, { family?: "apiKey"; provider?: { name?: string; hosts?: string[]; header?: string; prefix?: string; keyHelp?: string; verifyUrl?: string; }; label?: string; why?: string; background?: boolean; } | { family?: "google"; label?: string; why?: string; background?: boolean; scopes?: string[]; } | { family?: "oauth2"; provider?: { name?: string; hosts?: string[]; scopes?: string[]; authorizeUrl?: string; tokenUrl?: string; accountUrl?: string; accountField?: string; authorizeParams?: Record<string, string>; tokenAuth?: "body" | "basic"; clientIdEnv?: string; clientSecretEnv?: string; }; label?: string; why?: string; background?: boolean; }>, Record<string, { family?: "apiKey"; provider?: { name?: string; hosts?: string[]; header?: string; prefix?: string; keyHelp?: string; verifyUrl?: string; }; label?: string; why?: string; background?: boolean; } | { family?: "google"; label?: string; why?: string; background?: boolean; scopes?: string[]; } | { family?: "oauth2"; provider?: { name?: string; hosts?: string[]; scopes?: string[]; authorizeUrl?: string; tokenUrl?: string; accountUrl?: string; accountField?: string; authorizeParams?: Record<string, string>; tokenAuth?: "body" | "basic"; clientIdEnv?: string; clientSecretEnv?: string; }; label?: string; why?: string; background?: boolean; }>>>; llm: z.ZodOptional<z.ZodObject<{ why: z.ZodString; dailyBudgetUsd: z.ZodOptional<z.ZodNumber>; models: z.ZodOptional<z.ZodArray<z.ZodString, "many">>; }, "strict", z.ZodTypeAny, { why?: string; dailyBudgetUsd?: number; models?: string[]; }, { why?: string; dailyBudgetUsd?: number; models?: string[]; }>>; fileSources: z.ZodOptional<z.ZodEffects<z.ZodObject<{ workspace: z.ZodOptional<z.ZodEnum<["read", "readwrite"]>>; providers: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodString, "many">>>; write: z.ZodOptional<z.ZodArray<z.ZodString, "many">>; }, "strict", z.ZodTypeAny, { write?: string[]; workspace?: "read" | "readwrite"; providers?: string[]; }, { write?: string[]; workspace?: "read" | "readwrite"; providers?: string[]; }>, { write?: string[]; workspace?: "read" | "readwrite"; providers?: string[]; }, { write?: string[]; workspace?: "read" | "readwrite"; providers?: string[]; }>>; fileProviders: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodObject<{ key: z.ZodString; connectionKey: z.ZodString; label: z.ZodString; }, "strict", z.ZodTypeAny, { label?: string; key?: string; connectionKey?: string; }, { label?: string; key?: string; connectionKey?: string; }>, "many">>>; fileProducers: z.ZodDefault<z.ZodOptional<z.ZodArray<z.ZodObject<{ key: z.ZodString; label: z.ZodString; }, "strict", z.ZodTypeAny, { label?: string; key?: string; }, { label?: string; key?: string; }>, "many">>>; uses: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{ contract: z.ZodString; label: z.ZodOptional<z.ZodString>; optional: z.ZodOptional<z.ZodBoolean>; }, "strict", z.ZodTypeAny, { label?: string; contract?: string; optional?: boolean; }, { label?: string; contract?: string; optional?: boolean; }>>>; provides: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{ tools: z.ZodOptional<z.ZodArray<z.ZodString, "many">>; events: z.ZodOptional<z.ZodArray<z.ZodString, "many">>; models: z.ZodOptional<z.ZodArray<z.ZodString, "many">>; }, "strict", z.ZodTypeAny, { models?: string[]; tools?: string[]; events?: string[]; }, { models?: string[]; tools?: string[]; events?: string[]; }>>>; channel: z.ZodOptional<z.ZodObject<{ topics: z.ZodRecord<z.ZodString, z.ZodObject<{ audience: z.ZodOptional<z.ZodUnion<[z.ZodLiteral<"all">, z.ZodLiteral<"viewer">, z.ZodString]>>; mayAddress: z.ZodOptional<z.ZodArray<z.ZodString, "many">>; description: z.ZodOptional<z.ZodString>; }, "strict", z.ZodTypeAny, { description?: string; audience?: string; mayAddress?: string[]; }, { description?: string; audience?: string; mayAddress?: string[]; }>>; }, "strict", z.ZodTypeAny, { topics?: Record<string, { description?: string; audience?: string; mayAddress?: string[]; }>; }, { topics?: Record<string, { description?: string; audience?: string; mayAddress?: string[]; }>; }>>; db: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{ scope: z.ZodOptional<z.ZodEnum<["instance", "workspace", "user"]>>; owner: z.ZodOptional<z.ZodLiteral<"creator">>; fields: z.ZodRecord<z.ZodString, z.ZodString>; sealed: z.ZodOptional<z.ZodArray<z.ZodString, "many">>; unique: z.ZodOptional<z.ZodArray<z.ZodArray<z.ZodString, "many">, "many">>; indexes: z.ZodOptional<z.ZodArray<z.ZodUnion<[z.ZodArray<z.ZodString, "many">, z.ZodObject<{ fields: z.ZodArray<z.ZodString, "many">; kind: z.ZodOptional<z.ZodEnum<["btree", "contains", "text"]>>; }, "strict", z.ZodTypeAny, { kind?: "text" | "btree" | "contains"; fields?: string[]; }, { kind?: "text" | "btree" | "contains"; fields?: string[]; }>]>, "many">>; rules: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodUnknown>>; }, "strict", z.ZodTypeAny, { owner?: "creator"; fields?: Record<string, string>; scope?: "workspace" | "instance" | "user"; sealed?: string[]; unique?: string[][]; indexes?: (string[] | { kind?: "text" | "btree" | "contains"; fields?: string[]; })[]; rules?: Record<string, unknown>; }, { owner?: "creator"; fields?: Record<string, string>; scope?: "workspace" | "instance" | "user"; sealed?: string[]; unique?: string[][]; indexes?: (string[] | { kind?: "text" | "btree" | "contains"; fields?: string[]; })[]; rules?: Record<string, unknown>; }>>>; }, "strict", z.ZodTypeAny, { name?: string; scopes?: string[]; roles?: { custom?: { models?: Record<string, { where?: string[]; hide?: string[]; update?: { fields?: string[]; transitions?: string; }; }>; ops?: string[]; attributes?: string[]; }; default?: { owner?: string; "member-edit"?: string; "member-readonly"?: string; visitor?: string; anonymous?: string; agent?: string; }; vocabulary?: string[]; describe?: Record<string, string>; attributes?: Record<string, "string" | "boolean" | "int">; }; description?: string; manifestVersion?: 1; id?: string; version?: string; applicationType?: string; entry?: string; icon?: string; author?: { name?: string; email?: string; url?: string; }; kickableTasks?: string[] | Record<string, { access?: string[] | "write" | "read" | "public" | "token"; requires?: "account"; }>; webhooks?: string[]; ops?: string[] | Record<string, { access?: string[] | "write" | "read" | "public" | "token"; requires?: "account"; }>; routes?: string[] | Record<string, { access?: string[] | "write" | "read" | "public" | "token"; requires?: "account"; }>; pollTasks?: { task?: string; everyMinutes?: number; }[]; platformApi?: { min?: string; max?: string; }; workspaceTools?: string[]; device?: { config?: Record<string, { required?: boolean; describe?: string; secret?: boolean; }>; commands?: Record<string, { params?: Record<string, "string" | "number" | "int" | "bool" | { type?: "number" | "int"; min?: number; max?: number; describe?: string; } | { type?: "string"; maxLength?: number; describe?: string; pattern?: string; allowDash?: boolean; } | { values?: string[]; type?: "enum"; describe?: string; } | { type?: "bool"; describe?: string; }>; describe?: string; argv?: string[]; cwd?: string; env?: Record<string, string>; config?: string[]; timeoutSeconds?: number; onRestart?: "report" | "rerun"; output?: { mode?: "live" | "batched" | "final"; flushMs?: number; maxChunkKb?: number; keep?: "head" | "tail" | "both"; maxKb?: number; }; result?: "text" | "json"; }>; program?: { main?: string; resident?: boolean; setup?: { id?: string; describe?: string; timeoutSeconds?: number; run?: string[]; inputs?: string[]; }[]; selfTest?: { timeoutSeconds?: number; run?: string[]; }; }; redact?: string[]; onAppDeleted?: "kill" | "finish"; }; connections?: { label?: string; authorizeUrl?: string; tokenUrl?: string; clientIdEnv?: string; clientSecretEnv?: string; key?: string; kind?: "apiKey" | "oauth2"; description?: string; oauthScopes?: string[]; headerNames?: string[]; }[]; credentials?: Record<string, { family?: "apiKey"; provider?: { name?: string; hosts?: string[]; header?: string; prefix?: string; keyHelp?: string; verifyUrl?: string; }; label?: string; why?: string; background?: boolean; } | { family?: "google"; label?: string; why?: string; background?: boolean; scopes?: string[]; } | { family?: "oauth2"; provider?: { name?: string; hosts?: string[]; scopes?: string[]; authorizeUrl?: string; tokenUrl?: string; accountUrl?: string; accountField?: string; authorizeParams?: Record<string, string>; tokenAuth?: "body" | "basic"; clientIdEnv?: string; clientSecretEnv?: string; }; label?: string; why?: string; background?: boolean; }>; llm?: { why?: string; dailyBudgetUsd?: number; models?: string[]; }; fileSources?: { write?: string[]; workspace?: "read" | "readwrite"; providers?: string[]; }; fileProviders?: { label?: string; key?: string; connectionKey?: string; }[]; fileProducers?: { label?: string; key?: string; }[]; uses?: Record<string, { label?: string; contract?: string; optional?: boolean; }>; provides?: Record<string, { models?: string[]; tools?: string[]; events?: string[]; }>; channel?: { topics?: Record<string, { description?: string; audience?: string; mayAddress?: string[]; }>; }; db?: Record<string, { owner?: "creator"; fields?: Record<string, string>; scope?: "workspace" | "instance" | "user"; sealed?: string[]; unique?: string[][]; indexes?: (string[] | { kind?: "text" | "btree" | "contains"; fields?: string[]; })[]; rules?: Record<string, unknown>; }>; }, { name?: string; scopes?: string[]; roles?: { custom?: { models?: Record<string, { where?: string[]; hide?: string[]; update?: { fields?: string[]; transitions?: string; }; }>; ops?: string[]; attributes?: string[]; }; default?: { owner?: string; "member-edit"?: string; "member-readonly"?: string; visitor?: string; anonymous?: string; agent?: string; }; vocabulary?: string[]; describe?: Record<string, string>; attributes?: Record<string, "string" | "boolean" | "int">; }; description?: string; manifestVersion?: 1; id?: string; version?: string; applicationType?: string; entry?: string; icon?: string; author?: { name?: string; email?: string; url?: string; }; kickableTasks?: string[] | Record<string, { access?: string[] | "write" | "read" | "public" | "token"; requires?: "account"; }>; webhooks?: string[]; ops?: string[] | Record<string, { access?: string[] | "write" | "read" | "public" | "token"; requires?: "account"; }>; routes?: string[] | Record<string, { access?: string[] | "write" | "read" | "public" | "token"; requires?: "account"; }>; pollTasks?: { task?: string; everyMinutes?: number; }[]; platformApi?: { min?: string; max?: string; }; workspaceTools?: string[]; device?: { config?: Record<string, { required?: boolean; describe?: string; secret?: boolean; }>; commands?: Record<string, { params?: Record<string, "string" | "number" | "int" | "bool" | { type?: "number" | "int"; min?: number; max?: number; describe?: string; } | { type?: "string"; maxLength?: number; describe?: string; pattern?: string; allowDash?: boolean; } | { values?: string[]; type?: "enum"; describe?: string; } | { type?: "bool"; describe?: string; }>; describe?: string; argv?: string[]; cwd?: string; env?: Record<string, string>; config?: string[]; timeoutSeconds?: number; onRestart?: "report" | "rerun"; output?: { mode?: "live" | "batched" | "final"; flushMs?: number; maxChunkKb?: number; keep?: "head" | "tail" | "both"; maxKb?: number; }; result?: "text" | "json"; }>; program?: { main?: string; resident?: boolean; setup?: { id?: string; describe?: string; timeoutSeconds?: number; run?: string[]; inputs?: string[]; }[]; selfTest?: { timeoutSeconds?: number; run?: string[]; }; }; redact?: string[]; onAppDeleted?: "kill" | "finish"; }; connections?: { label?: string; authorizeUrl?: string; tokenUrl?: string; clientIdEnv?: string; clientSecretEnv?: string; key?: string; kind?: "apiKey" | "oauth2"; description?: string; oauthScopes?: string[]; headerNames?: string[]; }[]; credentials?: Record<string, { family?: "apiKey"; provider?: { name?: string; hosts?: string[]; header?: string; prefix?: string; keyHelp?: string; verifyUrl?: string; }; label?: string; why?: string; background?: boolean; } | { family?: "google"; label?: string; why?: string; background?: boolean; scopes?: string[]; } | { family?: "oauth2"; provider?: { name?: string; hosts?: string[]; scopes?: string[]; authorizeUrl?: string; tokenUrl?: string; accountUrl?: string; accountField?: string; authorizeParams?: Record<string, string>; tokenAuth?: "body" | "basic"; clientIdEnv?: string; clientSecretEnv?: string; }; label?: string; why?: string; background?: boolean; }>; llm?: { why?: string; dailyBudgetUsd?: number; models?: string[]; }; fileSources?: { write?: string[]; workspace?: "read" | "readwrite"; providers?: string[]; }; fileProviders?: { label?: string; key?: string; connectionKey?: string; }[]; fileProducers?: { label?: string; key?: string; }[]; uses?: Record<string, { label?: string; contract?: string; optional?: boolean; }>; provides?: Record<string, { models?: string[]; tools?: string[]; events?: string[]; }>; channel?: { topics?: Record<string, { description?: string; audience?: string; mayAddress?: string[]; }>; }; db?: Record<string, { owner?: "creator"; fields?: Record<string, string>; scope?: "workspace" | "instance" | "user"; sealed?: string[]; unique?: string[][]; indexes?: (string[] | { kind?: "text" | "btree" | "contains"; fields?: string[]; })[]; rules?: Record<string, unknown>; }>; }>, { name?: string; scopes?: string[]; roles?: { custom?: { models?: Record<string, { where?: string[]; hide?: string[]; update?: { fields?: string[]; transitions?: string; }; }>; ops?: string[]; attributes?: string[]; }; default?: { owner?: string; "member-edit"?: string; "member-readonly"?: string; visitor?: string; anonymous?: string; agent?: string; }; vocabulary?: string[]; describe?: Record<string, string>; attributes?: Record<string, "string" | "boolean" | "int">; }; description?: string; manifestVersion?: 1; id?: string; version?: string; applicationType?: string; entry?: string; icon?: string; author?: { name?: string; email?: string; url?: string; }; kickableTasks?: string[] | Record<string, { access?: string[] | "write" | "read" | "public" | "token"; requires?: "account"; }>; webhooks?: string[]; ops?: string[] | Record<string, { access?: string[] | "write" | "read" | "public" | "token"; requires?: "account"; }>; routes?: string[] | Record<string, { access?: string[] | "write" | "read" | "public" | "token"; requires?: "account"; }>; pollTasks?: { task?: string; everyMinutes?: number; }[]; platformApi?: { min?: string; max?: string; }; workspaceTools?: string[]; device?: { config?: Record<string, { required?: boolean; describe?: string; secret?: boolean; }>; commands?: Record<string, { params?: Record<string, "string" | "number" | "int" | "bool" | { type?: "number" | "int"; min?: number; max?: number; describe?: string; } | { type?: "string"; maxLength?: number; describe?: string; pattern?: string; allowDash?: boolean; } | { values?: string[]; type?: "enum"; describe?: string; } | { type?: "bool"; describe?: string; }>; describe?: string; argv?: string[]; cwd?: string; env?: Record<string, string>; config?: string[]; timeoutSeconds?: number; onRestart?: "report" | "rerun"; output?: { mode?: "live" | "batched" | "final"; flushMs?: number; maxChunkKb?: number; keep?: "head" | "tail" | "both"; maxKb?: number; }; result?: "text" | "json"; }>; program?: { main?: string; resident?: boolean; setup?: { id?: string; describe?: string; timeoutSeconds?: number; run?: string[]; inputs?: string[]; }[]; selfTest?: { timeoutSeconds?: number; run?: string[]; }; }; redact?: string[]; onAppDeleted?: "kill" | "finish"; }; connections?: { label?: string; authorizeUrl?: string; tokenUrl?: string; clientIdEnv?: string; clientSecretEnv?: string; key?: string; kind?: "apiKey" | "oauth2"; description?: string; oauthScopes?: string[]; headerNames?: string[]; }[]; credentials?: Record<string, { family?: "apiKey"; provider?: { name?: string; hosts?: string[]; header?: string; prefix?: string; keyHelp?: string; verifyUrl?: string; }; label?: string; why?: string; background?: boolean; } | { family?: "google"; label?: string; why?: string; background?: boolean; scopes?: string[]; } | { family?: "oauth2"; provider?: { name?: string; hosts?: string[]; scopes?: string[]; authorizeUrl?: string; tokenUrl?: string; accountUrl?: string; accountField?: string; authorizeParams?: Record<string, string>; tokenAuth?: "body" | "basic"; clientIdEnv?: string; clientSecretEnv?: string; }; label?: string; why?: string; background?: boolean; }>; llm?: { why?: string; dailyBudgetUsd?: number; models?: string[]; }; fileSources?: { write?: string[]; workspace?: "read" | "readwrite"; providers?: string[]; }; fileProviders?: { label?: string; key?: string; connectionKey?: string; }[]; fileProducers?: { label?: string; key?: string; }[]; uses?: Record<string, { label?: string; contract?: string; optional?: boolean; }>; provides?: Record<string, { models?: string[]; tools?: string[]; events?: string[]; }>; channel?: { topics?: Record<string, { description?: string; audience?: string; mayAddress?: string[]; }>; }; db?: Record<string, { owner?: "creator"; fields?: Record<string, string>; scope?: "workspace" | "instance" | "user"; sealed?: string[]; unique?: string[][]; indexes?: (string[] | { kind?: "text" | "btree" | "contains"; fields?: string[]; })[]; rules?: Record<string, unknown>; }>; }, { name?: string; scopes?: string[]; roles?: { custom?: { models?: Record<string, { where?: string[]; hide?: string[]; update?: { fields?: string[]; transitions?: string; }; }>; ops?: string[]; attributes?: string[]; }; default?: { owner?: string; "member-edit"?: string; "member-readonly"?: string; visitor?: string; anonymous?: string; agent?: string; }; vocabulary?: string[]; describe?: Record<string, string>; attributes?: Record<string, "string" | "boolean" | "int">; }; description?: string; manifestVersion?: 1; id?: string; version?: string; applicationType?: string; entry?: string; icon?: string; author?: { name?: string; email?: string; url?: string; }; kickableTasks?: string[] | Record<string, { access?: string[] | "write" | "read" | "public" | "token"; requires?: "account"; }>; webhooks?: string[]; ops?: string[] | Record<string, { access?: string[] | "write" | "read" | "public" | "token"; requires?: "account"; }>; routes?: string[] | Record<string, { access?: string[] | "write" | "read" | "public" | "token"; requires?: "account"; }>; pollTasks?: { task?: string; everyMinutes?: number; }[]; platformApi?: { min?: string; max?: string; }; workspaceTools?: string[]; device?: { config?: Record<string, { required?: boolean; describe?: string; secret?: boolean; }>; commands?: Record<string, { params?: Record<string, "string" | "number" | "int" | "bool" | { type?: "number" | "int"; min?: number; max?: number; describe?: string; } | { type?: "string"; maxLength?: number; describe?: string; pattern?: string; allowDash?: boolean; } | { values?: string[]; type?: "enum"; describe?: string; } | { type?: "bool"; describe?: string; }>; describe?: string; argv?: string[]; cwd?: string; env?: Record<string, string>; config?: string[]; timeoutSeconds?: number; onRestart?: "report" | "rerun"; output?: { mode?: "live" | "batched" | "final"; flushMs?: number; maxChunkKb?: number; keep?: "head" | "tail" | "both"; maxKb?: number; }; result?: "text" | "json"; }>; program?: { main?: string; resident?: boolean; setup?: { id?: string; describe?: string; timeoutSeconds?: number; run?: string[]; inputs?: string[]; }[]; selfTest?: { timeoutSeconds?: number; run?: string[]; }; }; redact?: string[]; onAppDeleted?: "kill" | "finish"; }; connections?: { label?: string; authorizeUrl?: string; tokenUrl?: string; clientIdEnv?: string; clientSecretEnv?: string; key?: string; kind?: "apiKey" | "oauth2"; description?: string; oauthScopes?: string[]; headerNames?: string[]; }[]; credentials?: Record<string, { family?: "apiKey"; provider?: { name?: string; hosts?: string[]; header?: string; prefix?: string; keyHelp?: string; verifyUrl?: string; }; label?: string; why?: string; background?: boolean; } | { family?: "google"; label?: string; why?: string; background?: boolean; scopes?: string[]; } | { family?: "oauth2"; provider?: { name?: string; hosts?: string[]; scopes?: string[]; authorizeUrl?: string; tokenUrl?: string; accountUrl?: string; accountField?: string; authorizeParams?: Record<string, string>; tokenAuth?: "body" | "basic"; clientIdEnv?: string; clientSecretEnv?: string; }; label?: string; why?: string; background?: boolean; }>; llm?: { why?: string; dailyBudgetUsd?: number; models?: string[]; }; fileSources?: { write?: string[]; workspace?: "read" | "readwrite"; providers?: string[]; }; fileProviders?: { label?: string; key?: string; connectionKey?: string; }[]; fileProducers?: { label?: string; key?: string; }[]; uses?: Record<string, { label?: string; contract?: string; optional?: boolean; }>; provides?: Record<string, { models?: string[]; tools?: string[]; events?: string[]; }>; channel?: { topics?: Record<string, { description?: string; audience?: string; mayAddress?: string[]; }>; }; db?: Record<string, { owner?: "creator"; fields?: Record<string, string>; scope?: "workspace" | "instance" | "user"; sealed?: string[]; unique?: string[][]; indexes?: (string[] | { kind?: "text" | "btree" | "contains"; fields?: string[]; })[]; rules?: Record<string, unknown>; }>; }>
 ```
 
 #### `PluginRolesSchema` — const · src/manifest.ts
@@ -954,7 +1018,7 @@ const PluginManifestSchema: z.ZodEffects<z.ZodObject<{ manifestVersion: z.ZodLit
 WHAT THE APP CALLS ITS PEOPLE.
 
 ```ts
-const PluginRolesSchema: z.ZodEffects<z.ZodObject<{ vocabulary: z.ZodArray<z.ZodString, "many">; default: z.ZodDefault<z.ZodOptional<z.ZodObject<{ owner: z.ZodOptional<z.ZodString>; "member-edit": z.ZodOptional<z.ZodString>; "member-readonly": z.ZodOptional<z.ZodString>; visitor: z.ZodOptional<z.ZodString>; anonymous: z.ZodOptional<z.ZodString>; agent: z.ZodOptional<z.ZodString>; }, "strict", z.ZodTypeAny, { owner?: string; "member-edit"?: string; "member-readonly"?: string; visitor?: string; anonymous?: string; agent?: string; }, { owner?: string; "member-edit"?: string; "member-readonly"?: string; visitor?: string; anonymous?: string; agent?: string; }>>>; describe: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>; attributes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["string", "int", "boolean"]>>>; custom: z.ZodOptional<z.ZodObject<{ attributes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>; models: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{ where: z.ZodOptional<z.ZodArray<z.ZodString, "many">>; hide: z.ZodOptional<z.ZodArray<z.ZodString, "many">>; update: z.ZodOptional<z.ZodObject<{ fields: z.ZodOptional<z.ZodArray<z.ZodString, "many">>; transitions: z.ZodOptional<z.ZodString>; }, "strict", z.ZodTypeAny, { fields?: string[]; transitions?: string; }, { fields?: string[]; transitions?: string; }>>; }, "strict", z.ZodTypeAny, { where?: string[]; hide?: string[]; update?: { fields?: string[]; transitions?: string; }; }, { where?: string[]; hide?: string[]; update?: { fields?: string[]; transitions?: string; }; }>>>; ops: z.ZodOptional<z.ZodArray<z.ZodString, "many">>; }, "strict", z.ZodTypeAny, { models?: Record<string, { where?: string[]; hide?: string[]; update?: { fields?: string[]; transitions?: string; }; }>; ops?: string[]; attributes?: string[]; }, { models?: Record<string, { where?: string[]; hide?: string[]; update?: { fields?: string[]; transitions?: string; }; }>; ops?: string[]; attributes?: string[]; }>>; }, "strict", z.ZodTypeAny, { default?: { owner?: string; "member-edit"?: string; "member-readonly"?: string; visitor?: string; anonymous?: string; agent?: string; }; custom?: { models?: Record<string, { where?: string[]; hide?: string[]; update?: { fields?: string[]; transitions?: string; }; }>; ops?: string[]; attributes?: string[]; }; vocabulary?: string[]; describe?: Record<string, string>; attributes?: Record<string, "string" | "boolean" | "int">; }, { default?: { owner?: string; "member-edit"?: string; "member-readonly"?: string; visitor?: string; anonymous?: string; agent?: string; }; custom?: { models?: Record<string, { where?: string[]; hide?: string[]; update?: { fields?: string[]; transitions?: string; }; }>; ops?: string[]; attributes?: string[]; }; vocabulary?: string[]; describe?: Record<string, string>; attributes?: Record<string, "string" | "boolean" | "int">; }>, { default?: { owner?: string; "member-edit"?: string; "member-readonly"?: string; visitor?: string; anonymous?: string; agent?: string; }; custom?: { models?: Record<string, { where?: string[]; hide?: string[]; update?: { fields?: string[]; transitions?: string; }; }>; ops?: string[]; attributes?: string[]; }; vocabulary?: string[]; describe?: Record<string, string>; attributes?: Record<string, "string" | "boolean" | "int">; }, { default?: { owner?: string; "member-edit"?: string; "member-readonly"?: string; visitor?: string; anonymous?: string; agent?: string; }; custom?: { models?: Record<string, { where?: string[]; hide?: string[]; update?: { fields?: string[]; transitions?: string; }; }>; ops?: string[]; attributes?: string[]; }; vocabulary?: string[]; describe?: Record<string, string>; attributes?: Record<string, "string" | "boolean" | "int">; }>
+const PluginRolesSchema: z.ZodEffects<z.ZodObject<{ vocabulary: z.ZodArray<z.ZodString, "many">; default: z.ZodDefault<z.ZodOptional<z.ZodObject<{ owner: z.ZodOptional<z.ZodString>; "member-edit": z.ZodOptional<z.ZodString>; "member-readonly": z.ZodOptional<z.ZodString>; visitor: z.ZodOptional<z.ZodString>; anonymous: z.ZodOptional<z.ZodString>; agent: z.ZodOptional<z.ZodString>; }, "strict", z.ZodTypeAny, { owner?: string; "member-edit"?: string; "member-readonly"?: string; visitor?: string; anonymous?: string; agent?: string; }, { owner?: string; "member-edit"?: string; "member-readonly"?: string; visitor?: string; anonymous?: string; agent?: string; }>>>; describe: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>; attributes: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodEnum<["string", "int", "boolean"]>>>; custom: z.ZodOptional<z.ZodObject<{ attributes: z.ZodOptional<z.ZodArray<z.ZodString, "many">>; models: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodObject<{ where: z.ZodOptional<z.ZodArray<z.ZodString, "many">>; hide: z.ZodOptional<z.ZodArray<z.ZodString, "many">>; update: z.ZodOptional<z.ZodObject<{ fields: z.ZodOptional<z.ZodArray<z.ZodString, "many">>; transitions: z.ZodOptional<z.ZodString>; }, "strict", z.ZodTypeAny, { fields?: string[]; transitions?: string; }, { fields?: string[]; transitions?: string; }>>; }, "strict", z.ZodTypeAny, { where?: string[]; hide?: string[]; update?: { fields?: string[]; transitions?: string; }; }, { where?: string[]; hide?: string[]; update?: { fields?: string[]; transitions?: string; }; }>>>; ops: z.ZodOptional<z.ZodArray<z.ZodString, "many">>; }, "strict", z.ZodTypeAny, { models?: Record<string, { where?: string[]; hide?: string[]; update?: { fields?: string[]; transitions?: string; }; }>; ops?: string[]; attributes?: string[]; }, { models?: Record<string, { where?: string[]; hide?: string[]; update?: { fields?: string[]; transitions?: string; }; }>; ops?: string[]; attributes?: string[]; }>>; }, "strict", z.ZodTypeAny, { custom?: { models?: Record<string, { where?: string[]; hide?: string[]; update?: { fields?: string[]; transitions?: string; }; }>; ops?: string[]; attributes?: string[]; }; default?: { owner?: string; "member-edit"?: string; "member-readonly"?: string; visitor?: string; anonymous?: string; agent?: string; }; vocabulary?: string[]; describe?: Record<string, string>; attributes?: Record<string, "string" | "boolean" | "int">; }, { custom?: { models?: Record<string, { where?: string[]; hide?: string[]; update?: { fields?: string[]; transitions?: string; }; }>; ops?: string[]; attributes?: string[]; }; default?: { owner?: string; "member-edit"?: string; "member-readonly"?: string; visitor?: string; anonymous?: string; agent?: string; }; vocabulary?: string[]; describe?: Record<string, string>; attributes?: Record<string, "string" | "boolean" | "int">; }>, { custom?: { models?: Record<string, { where?: string[]; hide?: string[]; update?: { fields?: string[]; transitions?: string; }; }>; ops?: string[]; attributes?: string[]; }; default?: { owner?: string; "member-edit"?: string; "member-readonly"?: string; visitor?: string; anonymous?: string; agent?: string; }; vocabulary?: string[]; describe?: Record<string, string>; attributes?: Record<string, "string" | "boolean" | "int">; }, { custom?: { models?: Record<string, { where?: string[]; hide?: string[]; update?: { fields?: string[]; transitions?: string; }; }>; ops?: string[]; attributes?: string[]; }; default?: { owner?: string; "member-edit"?: string; "member-readonly"?: string; visitor?: string; anonymous?: string; agent?: string; }; vocabulary?: string[]; describe?: Record<string, string>; attributes?: Record<string, "string" | "boolean" | "int">; }>
 ```
 
 #### `pluginRouteUrl` — function · src/helpers.ts
@@ -970,7 +1034,7 @@ function pluginRouteUrl( pluginId: string, routeName: string, nodeId: string, pa
 `access` is a platform level — or a LIST OF THE APP'S OWN ROLE WORDS, which opens the surface to exactly those roles (the owner always passes) and to nobody else, whatever their workspace standing. A granted outsider who holds `staff` reaches `set-order-status` this way; a workspace editor the owner never named does not. A composed role reaches it only when it was handed the surface (`roles.custom.ops`).
 
 ```ts
-const PluginSurfaceEntrySchema: z.ZodObject<{ access: z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodEnum<["write", "read", "public", "token"]>, z.ZodArray<z.ZodString, "many">]>>>; requires: z.ZodOptional<z.ZodLiteral<"account">>; }, "strict", z.ZodTypeAny, { access?: "write" | "read" | "public" | "token" | string[]; requires?: "account"; }, { access?: "write" | "read" | "public" | "token" | string[]; requires?: "account"; }>
+const PluginSurfaceEntrySchema: z.ZodObject<{ access: z.ZodDefault<z.ZodOptional<z.ZodUnion<[z.ZodEnum<["write", "read", "public", "token"]>, z.ZodArray<z.ZodString, "many">]>>>; requires: z.ZodOptional<z.ZodLiteral<"account">>; }, "strict", z.ZodTypeAny, { access?: string[] | "write" | "read" | "public" | "token"; requires?: "account"; }, { access?: string[] | "write" | "read" | "public" | "token"; requires?: "account"; }>
 ```
 
 #### `previewPersona` — function · src/helpers.ts
@@ -1013,6 +1077,14 @@ Render one declared command. Throws `DeviceCommandError` with a sentence for any
 function renderCommand(block: DeviceBlock, name: string, params: Record<string, unknown> = {}): RenderedCommand
 ```
 
+#### `RESERVED_AUTHORIZE_PARAMS` — const · src/manifest.ts
+
+Authorize parameters the platform sets itself; a slot may not override them.
+
+```ts
+const RESERVED_AUTHORIZE_PARAMS: readonly ["response_type", "client_id", "redirect_uri", "scope", "state", "code_challenge", "code_challenge_method", "nonce"]
+```
+
 #### `resolveAppRole` — function · src/roles.ts
 
 The app's word for this caller.
@@ -1213,7 +1285,7 @@ A manifest with one entry removed (the bytes stay; they may be shared). Pure.
 function withoutAsset(assets: AssetsManifest | null | undefined, pluginId: string, name: string): AssetsManifest
 ```
 
-### Types (100)
+### Types (106)
 
 #### `AgentRunToolContext` — interface · src/types.ts
 
@@ -1230,6 +1302,18 @@ interface AgentRunToolContext {
 }
 ```
 
+#### `ApiKeyCredentialSlot` — type · src/manifest.ts
+
+```ts
+type ApiKeyCredentialSlot = z.infer<typeof ApiKeyCredentialSlotSchema>;
+```
+
+#### `ApiKeyProvider` — type · src/manifest.ts
+
+```ts
+type ApiKeyProvider = z.infer<typeof ApiKeyProviderSchema>;
+```
+
 #### `ApplicationIdentifier` — interface · src/types.ts
 
 MIRRORS the host's `ApplicationIdentifier` (venus-sdk.ts) exactly.
@@ -1903,6 +1987,12 @@ interface FileWriteResult {
 type GoogleCredentialScope = (typeof GOOGLE_CREDENTIAL_SCOPES)[number];
 ```
 
+#### `GoogleCredentialSlot` — type · src/manifest.ts
+
+```ts
+type GoogleCredentialSlot = z.infer<typeof GoogleCredentialSlotSchema>;
+```
+
 #### `InstalledPluginInfo` — interface · src/manifest.ts
 
 Data-only row the host codegen inlines into registry.gen.ts.
@@ -1976,6 +2066,25 @@ interface LabelShape {
 }
 ```
 
+#### `MailWaitArgs` — interface · src/agent-wait.ts
+
+```ts
+interface MailWaitArgs {
+  workspaceId: string;
+  inboxNodeId: string;
+  inboxName: string;
+  toolName: string;
+  threadId?: string;
+  fromEmail?: string;
+  subject?: string;
+  afterTimestamp: number;
+  timeoutSeconds?: number;
+  directiveId: string;
+  onResume?: string;
+  onTimeout?: string;
+}
+```
+
 #### `MergeDescription` — interface · src/types.ts
 
 ```ts
@@ -1998,6 +2107,18 @@ What `notify`'s caller asked for. Absent = the topic's own audience, aimed at th
 type NotifyTarget = { viewerIds: string[] } | { role: string } | "apps";
 ```
 
+#### `OAuth2CredentialSlot` — type · src/manifest.ts
+
+```ts
+type OAuth2CredentialSlot = z.infer<typeof OAuth2CredentialSlotSchema>;
+```
+
+#### `OAuth2Provider` — type · src/manifest.ts
+
+```ts
+type OAuth2Provider = z.infer<typeof OAuth2ProviderSchema>;
+```
+
 #### `OpInput` — type · src/ops.ts
 
 An op's input is always an object: it is the wire body AND a tool's parameters.
@@ -2394,11 +2515,11 @@ interface UsesDecl {
 ```
 
 ==============================================================================
-## `esoul-sdk/server` — 112 exports
+## `esoul-sdk/server` — 115 exports
 
 Server code only (server.ts, ops, routes, tasks): the viewer, the app's database, files, connections, machines, charts, route tokens.
 
-### Functions and values (35)
+### Functions and values (36)
 
 #### `APPROVAL_WAIT` — const · src/computer.ts
 
@@ -2632,6 +2753,14 @@ The consent-enforcing files API for plugin server code. Every call re-checks you
 function pluginFiles(_ctx: PluginFilesCtx): Promise<FilesApi>
 ```
 
+#### `questions` — function · src/server.ts
+
+THE PLATFORM'S QUESTIONS BELL. A question an app needs the person to answer (an agent waiting on a decision) reaches them wherever they are — the bell, on every workspace — not only when they open the app:
+
+```ts
+function questions(_ctx: { pluginId: string; workspaceId: string; nodeId: string; viewer?: { userId: string | null } }): Questions
+```
+
 #### `readAppState` — function · src/server.ts
 
 Read one app's state folded to head, by nodeId — server truth for an op, route, task or webhook. It reads for the app instance of the call the platform is running: your own app and other instances of its type in your workspace; another app type only when plugin.json `workspaceTools` grants a tool of that type (the refusal names the line to add). Null when no such app exists — an app in another workspace is null too. A webhook (it runs for no instance) finds only instances of its own type. Outside a running call it throws. HOST-ONLY.
@@ -2680,7 +2809,23 @@ WHO IS THIS, IN WORDS. The caller's own name and email, for an app with a reason
 function viewerProfile(_viewer: PluginViewer): Promise<ViewerProfile | null>
 ```
 
-### Types (77)
+### Types (79)
+
+#### `AppQuestion` — interface · src/server.ts
+
+A question for the person (questions(ctx).ask).
+
+```ts
+interface AppQuestion {
+  key: string;
+  question: string;
+  options?: string[];
+  details?: Record<string, unknown>;
+  open?: { kind: string; key: string; label?: string };
+  answer: { op: string; args?: Record<string, unknown> };
+  expiresInSeconds?: number;
+}
+```
 
 #### `AppRolePerson` — interface · src/server.ts
 
@@ -2896,7 +3041,9 @@ What `status()` answers. `account` is present only when the caller is the accoun
 interface CredentialStatus {
   state: "ready" | "not_bound" | "needs_consent" | "reconnect" | "not_allowed";
   account?: { email: string | null };
+  provider?: { name: string; family: "google" | "oauth2" | "apiKey" };
   missingScopes?: string[];
+  missingHosts?: string[];
   connectUrl?: string;
   reason?: string;
   candidates?: { storeId: string; email: string | null }[];
@@ -3479,6 +3626,15 @@ interface ProgramStepState {
 }
 ```
 
+#### `Questions` — interface · src/server.ts
+
+```ts
+interface Questions {
+  ask(q: AppQuestion): Promise<{ questionId: string; created: boolean }>;
+  settle(key: string, outcome: { answer: string } | { cancelled: true }): Promise<void>;
+}
+```
+
 #### `RouteTokenGrant` — interface · src/server.ts
 
 ```ts
@@ -4377,7 +4533,9 @@ What `useCredential` answers — the same state the app's server code gets from
 interface UseCredential {
   state: "ready" | "not_bound" | "needs_consent" | "reconnect" | "not_allowed" | "loading" | "error";
   account?: { email: string | null };
+  provider?: { name: string; family: "google" | "oauth2" | "apiKey" };
   missingScopes?: string[];
+  missingHosts?: string[];
   reason?: string;
   connect(): void;
   refresh(): Promise<void>;
@@ -4457,11 +4615,11 @@ interface WorkspaceTools {
 ```
 
 ==============================================================================
-## `esoul-sdk/testing` — 58 exports
+## `esoul-sdk/testing` — 62 exports
 
 Tests: run an op as a persona, an in-memory database with the real rules, recorders.
 
-### Functions and values (16)
+### Functions and values (17)
 
 #### `capture` — function · src/testing/ops.ts
 
@@ -4503,6 +4661,14 @@ Fill a `uses` slot with a stand-in provider, so a consumer's op can be tested wi
 function fakeApps(fixtures: Record<string, BoundAppFixture>): Record<string, unknown>
 ```
 
+#### `fakeCredentials` — function · src/testing/credentials.ts
+
+A stand-in for `credentials(ctx)` from `esoul-sdk/server`: each slot answers as the test says (`status`, `hosts`, `fetch`), the platform's refusals apply, and `calls` records every request.
+
+```ts
+function fakeCredentials(slots: Record<string, FakeCredentialSlot>): FakeCredentials
+```
+
 #### `fakeViewer` — function · src/testing/db.ts
 
 A caller to run something as. Give it a `role` when your app declares its own vocabulary, or let `memoryDb(manifest).as("visitor")` map it for you from the manifest's own `roles.default`.
@@ -4591,7 +4757,7 @@ Be told when the list changes (the banner re-renders on it); returns the unsubsc
 function subscribeFailedRequests(l: Listener): () => void
 ```
 
-### Types (42)
+### Types (45)
 
 #### `BoundAppFixture` — interface · src/testing/ops.ts
 
@@ -4700,6 +4866,36 @@ interface EmitCall {
 }
 ```
 
+#### `FakeCredentialCall` — interface · src/testing/credentials.ts
+
+```ts
+interface FakeCredentialCall {
+  slot: string;
+  method: string;
+  url: string;
+  headers: Record<string, string>;
+}
+```
+
+#### `FakeCredentials` — interface · src/testing/credentials.ts
+
+```ts
+interface FakeCredentials {
+  credentials(ctx: object): Credentials;
+  calls: FakeCredentialCall[];
+}
+```
+
+#### `FakeCredentialSlot` — interface · src/testing/credentials.ts
+
+```ts
+interface FakeCredentialSlot {
+  status?: CredentialStatus;
+  hosts?: string[];
+  fetch?: (url: URL, init: RequestInit) => Response | Promise<Response>;
+}
+```
+
 #### `FaultRule` — interface · src/testing/sim-gmail/faults.ts
 
 ```ts