esoul-sdk 0.24.0 → 0.25.2

package/dist/manifest.d.ts

@@ -107,19 +107,26 @@ export declare const PluginConnectionSchema: z.ZodEffects<z.ZodObject<{
     headerNames?: string[] | undefined;
 }>;
 /**
- * PLATFORM ACCOUNTS — the person's Google account, used by an app without the app ever holding it.
+ * THE PERSON'S ACCOUNTS — used by an app without the app ever holding them.
  *
- * A person connects a Google account once, in Account settings, and assigns it to an app. The
- * app's server code calls Google through `credentials(ctx).slot(name).fetch(url)` in
- * `esoul-sdk/server`: the platform checks who is calling and that the URL is one the slot's
- * declared scopes reach, then adds the token itself. The token never reaches the app — the
- * platform's Google token carries every scope the platform was granted and cannot be narrowed,
- * so the declared scopes are enforced at the proxy, not at Google.
+ * A person connects an account once, at the user level (Account settings → Google for Google,
+ * Account settings → Accounts for every other service), and assigns it to an app. The app's
+ * server code calls the service through `credentials(ctx).slot(name).fetch(url)` in
+ * `esoul-sdk/server`: the platform checks who is calling and that the URL is one the slot may
+ * reach, then adds the token or key itself. The secret never reaches the app or its developer.
  *
- * A scope is written as Google's full URL or as its short name (`gmail.modify`). `openid`,
- * `email` and `profile` are implicit and may be left out.
+ * Three families:
+ *   - `google` — the platform's verified Google client. Scopes are Google's (`gmail.modify`);
+ *     the platform's token cannot be narrowed, so the declared scopes are enforced at the proxy.
+ *   - `oauth2` — any OAuth 2.0 provider (Microsoft, Dropbox, Spotify, …): the slot declares the
+ *     provider's endpoints, the scopes it asks for and the API hosts the token may be sent to.
+ *   - `apiKey` — a key the person pastes (an API key, a personal access token): the slot declares
+ *     the hosts it may be sent to and the header that carries it.
+ *
+ * For `google` a scope is written as Google's full URL or as its short name (`gmail.modify`).
+ * `openid`, `email` and `profile` are implicit and may be left out.
  */
-export declare const CREDENTIAL_FAMILIES: readonly ["google"];
+export declare const CREDENTIAL_FAMILIES: readonly ["google", "oauth2", "apiKey"];
 export type CredentialFamilyName = (typeof CREDENTIAL_FAMILIES)[number];
 /** The Google scopes an app may declare, by short name. Everything else is refused. */
 export declare const GOOGLE_CREDENTIAL_SCOPES: readonly ["gmail.readonly", "gmail.modify", "gmail.send", "gmail.compose", "gmail.labels", "calendar.events", "calendar.readonly", "contacts", "contacts.readonly", "drive.readonly", "drive.file"];
@@ -136,8 +143,8 @@ export declare function normaliseGoogleScope(scope: string): string | "implicit"
 export declare function normaliseCredentialScopes(scopes: readonly string[]): string[];
 /** Slot names: lower-case words joined by `-` (`mailbox`, `work-calendar`). */
 export declare const CREDENTIAL_SLOT_RE: RegExp;
-/** One slot of a manifest's `credentials` block. */
-export declare const PluginCredentialSlotSchema: z.ZodObject<{
+/** A `google` slot of a manifest's `credentials` block. */
+export declare const GoogleCredentialSlotSchema: z.ZodObject<{
     family: z.ZodLiteral<"google">;
     scopes: z.ZodEffects<z.ZodArray<z.ZodString, "many">, string[], string[]>;
     label: z.ZodOptional<z.ZodString>;
@@ -156,9 +163,496 @@ export declare const PluginCredentialSlotSchema: z.ZodObject<{
     label?: string | undefined;
     background?: boolean | undefined;
 }>;
+export type GoogleCredentialSlot = z.infer<typeof GoogleCredentialSlotSchema>;
+/**
+ * An API host an `oauth2` or `apiKey` secret may be sent to: a DNS name (`graph.microsoft.com`),
+ * lower-case, no scheme, no port, no IP address, no `localhost`.
+ */
+export declare const CREDENTIAL_HOST_RE: RegExp;
+/** Authorize parameters the platform sets itself; a slot may not override them. */
+export declare const RESERVED_AUTHORIZE_PARAMS: readonly ["response_type", "client_id", "redirect_uri", "scope", "state", "code_challenge", "code_challenge_method", "nonce"];
+/** The OAuth 2.0 provider an `oauth2` slot signs in with. */
+export declare const OAuth2ProviderSchema: z.ZodEffects<z.ZodObject<{
+    name: z.ZodString;
+    authorizeUrl: z.ZodEffects<z.ZodString, string, string>;
+    tokenUrl: z.ZodEffects<z.ZodString, string, string>;
+    scopes: z.ZodArray<z.ZodString, "many">;
+    hosts: z.ZodArray<z.ZodString, "many">;
+    accountUrl: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+    accountField: z.ZodOptional<z.ZodString>;
+    authorizeParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    tokenAuth: z.ZodOptional<z.ZodEnum<["body", "basic"]>>;
+    clientIdEnv: z.ZodOptional<z.ZodString>;
+    clientSecretEnv: z.ZodOptional<z.ZodString>;
+}, "strict", z.ZodTypeAny, {
+    name: string;
+    authorizeUrl: string;
+    tokenUrl: string;
+    scopes: string[];
+    hosts: string[];
+    clientIdEnv?: string | undefined;
+    clientSecretEnv?: string | undefined;
+    accountUrl?: string | undefined;
+    accountField?: string | undefined;
+    authorizeParams?: Record<string, string> | undefined;
+    tokenAuth?: "body" | "basic" | undefined;
+}, {
+    name: string;
+    authorizeUrl: string;
+    tokenUrl: string;
+    scopes: string[];
+    hosts: string[];
+    clientIdEnv?: string | undefined;
+    clientSecretEnv?: string | undefined;
+    accountUrl?: string | undefined;
+    accountField?: string | undefined;
+    authorizeParams?: Record<string, string> | undefined;
+    tokenAuth?: "body" | "basic" | undefined;
+}>, {
+    name: string;
+    authorizeUrl: string;
+    tokenUrl: string;
+    scopes: string[];
+    hosts: string[];
+    clientIdEnv?: string | undefined;
+    clientSecretEnv?: string | undefined;
+    accountUrl?: string | undefined;
+    accountField?: string | undefined;
+    authorizeParams?: Record<string, string> | undefined;
+    tokenAuth?: "body" | "basic" | undefined;
+}, {
+    name: string;
+    authorizeUrl: string;
+    tokenUrl: string;
+    scopes: string[];
+    hosts: string[];
+    clientIdEnv?: string | undefined;
+    clientSecretEnv?: string | undefined;
+    accountUrl?: string | undefined;
+    accountField?: string | undefined;
+    authorizeParams?: Record<string, string> | undefined;
+    tokenAuth?: "body" | "basic" | undefined;
+}>;
+export type OAuth2Provider = z.infer<typeof OAuth2ProviderSchema>;
+/** The service an `apiKey` slot sends a pasted key to. */
+export declare const ApiKeyProviderSchema: z.ZodEffects<z.ZodObject<{
+    name: z.ZodString;
+    hosts: z.ZodArray<z.ZodString, "many">;
+    header: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+    prefix: z.ZodOptional<z.ZodString>;
+    keyHelp: z.ZodOptional<z.ZodString>;
+    verifyUrl: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+}, "strict", z.ZodTypeAny, {
+    name: string;
+    hosts: string[];
+    header?: string | undefined;
+    prefix?: string | undefined;
+    keyHelp?: string | undefined;
+    verifyUrl?: string | undefined;
+}, {
+    name: string;
+    hosts: string[];
+    header?: string | undefined;
+    prefix?: string | undefined;
+    keyHelp?: string | undefined;
+    verifyUrl?: string | undefined;
+}>, {
+    name: string;
+    hosts: string[];
+    header?: string | undefined;
+    prefix?: string | undefined;
+    keyHelp?: string | undefined;
+    verifyUrl?: string | undefined;
+}, {
+    name: string;
+    hosts: string[];
+    header?: string | undefined;
+    prefix?: string | undefined;
+    keyHelp?: string | undefined;
+    verifyUrl?: string | undefined;
+}>;
+export type ApiKeyProvider = z.infer<typeof ApiKeyProviderSchema>;
+/** An `oauth2` slot: any OAuth 2.0 provider. */
+export declare const OAuth2CredentialSlotSchema: z.ZodObject<{
+    family: z.ZodLiteral<"oauth2">;
+    provider: z.ZodEffects<z.ZodObject<{
+        name: z.ZodString;
+        authorizeUrl: z.ZodEffects<z.ZodString, string, string>;
+        tokenUrl: z.ZodEffects<z.ZodString, string, string>;
+        scopes: z.ZodArray<z.ZodString, "many">;
+        hosts: z.ZodArray<z.ZodString, "many">;
+        accountUrl: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+        accountField: z.ZodOptional<z.ZodString>;
+        authorizeParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        tokenAuth: z.ZodOptional<z.ZodEnum<["body", "basic"]>>;
+        clientIdEnv: z.ZodOptional<z.ZodString>;
+        clientSecretEnv: z.ZodOptional<z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        name: string;
+        authorizeUrl: string;
+        tokenUrl: string;
+        scopes: string[];
+        hosts: string[];
+        clientIdEnv?: string | undefined;
+        clientSecretEnv?: string | undefined;
+        accountUrl?: string | undefined;
+        accountField?: string | undefined;
+        authorizeParams?: Record<string, string> | undefined;
+        tokenAuth?: "body" | "basic" | undefined;
+    }, {
+        name: string;
+        authorizeUrl: string;
+        tokenUrl: string;
+        scopes: string[];
+        hosts: string[];
+        clientIdEnv?: string | undefined;
+        clientSecretEnv?: string | undefined;
+        accountUrl?: string | undefined;
+        accountField?: string | undefined;
+        authorizeParams?: Record<string, string> | undefined;
+        tokenAuth?: "body" | "basic" | undefined;
+    }>, {
+        name: string;
+        authorizeUrl: string;
+        tokenUrl: string;
+        scopes: string[];
+        hosts: string[];
+        clientIdEnv?: string | undefined;
+        clientSecretEnv?: string | undefined;
+        accountUrl?: string | undefined;
+        accountField?: string | undefined;
+        authorizeParams?: Record<string, string> | undefined;
+        tokenAuth?: "body" | "basic" | undefined;
+    }, {
+        name: string;
+        authorizeUrl: string;
+        tokenUrl: string;
+        scopes: string[];
+        hosts: string[];
+        clientIdEnv?: string | undefined;
+        clientSecretEnv?: string | undefined;
+        accountUrl?: string | undefined;
+        accountField?: string | undefined;
+        authorizeParams?: Record<string, string> | undefined;
+        tokenAuth?: "body" | "basic" | undefined;
+    }>;
+    label: z.ZodOptional<z.ZodString>;
+    why: z.ZodString;
+    background: z.ZodOptional<z.ZodBoolean>;
+}, "strict", z.ZodTypeAny, {
+    why: string;
+    family: "oauth2";
+    provider: {
+        name: string;
+        authorizeUrl: string;
+        tokenUrl: string;
+        scopes: string[];
+        hosts: string[];
+        clientIdEnv?: string | undefined;
+        clientSecretEnv?: string | undefined;
+        accountUrl?: string | undefined;
+        accountField?: string | undefined;
+        authorizeParams?: Record<string, string> | undefined;
+        tokenAuth?: "body" | "basic" | undefined;
+    };
+    label?: string | undefined;
+    background?: boolean | undefined;
+}, {
+    why: string;
+    family: "oauth2";
+    provider: {
+        name: string;
+        authorizeUrl: string;
+        tokenUrl: string;
+        scopes: string[];
+        hosts: string[];
+        clientIdEnv?: string | undefined;
+        clientSecretEnv?: string | undefined;
+        accountUrl?: string | undefined;
+        accountField?: string | undefined;
+        authorizeParams?: Record<string, string> | undefined;
+        tokenAuth?: "body" | "basic" | undefined;
+    };
+    label?: string | undefined;
+    background?: boolean | undefined;
+}>;
+export type OAuth2CredentialSlot = z.infer<typeof OAuth2CredentialSlotSchema>;
+/** An `apiKey` slot: a key the person pastes. */
+export declare const ApiKeyCredentialSlotSchema: z.ZodObject<{
+    family: z.ZodLiteral<"apiKey">;
+    provider: z.ZodEffects<z.ZodObject<{
+        name: z.ZodString;
+        hosts: z.ZodArray<z.ZodString, "many">;
+        header: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+        prefix: z.ZodOptional<z.ZodString>;
+        keyHelp: z.ZodOptional<z.ZodString>;
+        verifyUrl: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+    }, "strict", z.ZodTypeAny, {
+        name: string;
+        hosts: string[];
+        header?: string | undefined;
+        prefix?: string | undefined;
+        keyHelp?: string | undefined;
+        verifyUrl?: string | undefined;
+    }, {
+        name: string;
+        hosts: string[];
+        header?: string | undefined;
+        prefix?: string | undefined;
+        keyHelp?: string | undefined;
+        verifyUrl?: string | undefined;
+    }>, {
+        name: string;
+        hosts: string[];
+        header?: string | undefined;
+        prefix?: string | undefined;
+        keyHelp?: string | undefined;
+        verifyUrl?: string | undefined;
+    }, {
+        name: string;
+        hosts: string[];
+        header?: string | undefined;
+        prefix?: string | undefined;
+        keyHelp?: string | undefined;
+        verifyUrl?: string | undefined;
+    }>;
+    label: z.ZodOptional<z.ZodString>;
+    why: z.ZodString;
+    background: z.ZodOptional<z.ZodBoolean>;
+}, "strict", z.ZodTypeAny, {
+    why: string;
+    family: "apiKey";
+    provider: {
+        name: string;
+        hosts: string[];
+        header?: string | undefined;
+        prefix?: string | undefined;
+        keyHelp?: string | undefined;
+        verifyUrl?: string | undefined;
+    };
+    label?: string | undefined;
+    background?: boolean | undefined;
+}, {
+    why: string;
+    family: "apiKey";
+    provider: {
+        name: string;
+        hosts: string[];
+        header?: string | undefined;
+        prefix?: string | undefined;
+        keyHelp?: string | undefined;
+        verifyUrl?: string | undefined;
+    };
+    label?: string | undefined;
+    background?: boolean | undefined;
+}>;
+export type ApiKeyCredentialSlot = z.infer<typeof ApiKeyCredentialSlotSchema>;
+/** One slot of a manifest's `credentials` block. */
+export declare const PluginCredentialSlotSchema: z.ZodDiscriminatedUnion<"family", [z.ZodObject<{
+    family: z.ZodLiteral<"google">;
+    scopes: z.ZodEffects<z.ZodArray<z.ZodString, "many">, string[], string[]>;
+    label: z.ZodOptional<z.ZodString>;
+    why: z.ZodString;
+    background: z.ZodOptional<z.ZodBoolean>;
+}, "strict", z.ZodTypeAny, {
+    why: string;
+    family: "google";
+    scopes: string[];
+    label?: string | undefined;
+    background?: boolean | undefined;
+}, {
+    why: string;
+    family: "google";
+    scopes: string[];
+    label?: string | undefined;
+    background?: boolean | undefined;
+}>, z.ZodObject<{
+    family: z.ZodLiteral<"oauth2">;
+    provider: z.ZodEffects<z.ZodObject<{
+        name: z.ZodString;
+        authorizeUrl: z.ZodEffects<z.ZodString, string, string>;
+        tokenUrl: z.ZodEffects<z.ZodString, string, string>;
+        scopes: z.ZodArray<z.ZodString, "many">;
+        hosts: z.ZodArray<z.ZodString, "many">;
+        accountUrl: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+        accountField: z.ZodOptional<z.ZodString>;
+        authorizeParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        tokenAuth: z.ZodOptional<z.ZodEnum<["body", "basic"]>>;
+        clientIdEnv: z.ZodOptional<z.ZodString>;
+        clientSecretEnv: z.ZodOptional<z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        name: string;
+        authorizeUrl: string;
+        tokenUrl: string;
+        scopes: string[];
+        hosts: string[];
+        clientIdEnv?: string | undefined;
+        clientSecretEnv?: string | undefined;
+        accountUrl?: string | undefined;
+        accountField?: string | undefined;
+        authorizeParams?: Record<string, string> | undefined;
+        tokenAuth?: "body" | "basic" | undefined;
+    }, {
+        name: string;
+        authorizeUrl: string;
+        tokenUrl: string;
+        scopes: string[];
+        hosts: string[];
+        clientIdEnv?: string | undefined;
+        clientSecretEnv?: string | undefined;
+        accountUrl?: string | undefined;
+        accountField?: string | undefined;
+        authorizeParams?: Record<string, string> | undefined;
+        tokenAuth?: "body" | "basic" | undefined;
+    }>, {
+        name: string;
+        authorizeUrl: string;
+        tokenUrl: string;
+        scopes: string[];
+        hosts: string[];
+        clientIdEnv?: string | undefined;
+        clientSecretEnv?: string | undefined;
+        accountUrl?: string | undefined;
+        accountField?: string | undefined;
+        authorizeParams?: Record<string, string> | undefined;
+        tokenAuth?: "body" | "basic" | undefined;
+    }, {
+        name: string;
+        authorizeUrl: string;
+        tokenUrl: string;
+        scopes: string[];
+        hosts: string[];
+        clientIdEnv?: string | undefined;
+        clientSecretEnv?: string | undefined;
+        accountUrl?: string | undefined;
+        accountField?: string | undefined;
+        authorizeParams?: Record<string, string> | undefined;
+        tokenAuth?: "body" | "basic" | undefined;
+    }>;
+    label: z.ZodOptional<z.ZodString>;
+    why: z.ZodString;
+    background: z.ZodOptional<z.ZodBoolean>;
+}, "strict", z.ZodTypeAny, {
+    why: string;
+    family: "oauth2";
+    provider: {
+        name: string;
+        authorizeUrl: string;
+        tokenUrl: string;
+        scopes: string[];
+        hosts: string[];
+        clientIdEnv?: string | undefined;
+        clientSecretEnv?: string | undefined;
+        accountUrl?: string | undefined;
+        accountField?: string | undefined;
+        authorizeParams?: Record<string, string> | undefined;
+        tokenAuth?: "body" | "basic" | undefined;
+    };
+    label?: string | undefined;
+    background?: boolean | undefined;
+}, {
+    why: string;
+    family: "oauth2";
+    provider: {
+        name: string;
+        authorizeUrl: string;
+        tokenUrl: string;
+        scopes: string[];
+        hosts: string[];
+        clientIdEnv?: string | undefined;
+        clientSecretEnv?: string | undefined;
+        accountUrl?: string | undefined;
+        accountField?: string | undefined;
+        authorizeParams?: Record<string, string> | undefined;
+        tokenAuth?: "body" | "basic" | undefined;
+    };
+    label?: string | undefined;
+    background?: boolean | undefined;
+}>, z.ZodObject<{
+    family: z.ZodLiteral<"apiKey">;
+    provider: z.ZodEffects<z.ZodObject<{
+        name: z.ZodString;
+        hosts: z.ZodArray<z.ZodString, "many">;
+        header: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+        prefix: z.ZodOptional<z.ZodString>;
+        keyHelp: z.ZodOptional<z.ZodString>;
+        verifyUrl: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+    }, "strict", z.ZodTypeAny, {
+        name: string;
+        hosts: string[];
+        header?: string | undefined;
+        prefix?: string | undefined;
+        keyHelp?: string | undefined;
+        verifyUrl?: string | undefined;
+    }, {
+        name: string;
+        hosts: string[];
+        header?: string | undefined;
+        prefix?: string | undefined;
+        keyHelp?: string | undefined;
+        verifyUrl?: string | undefined;
+    }>, {
+        name: string;
+        hosts: string[];
+        header?: string | undefined;
+        prefix?: string | undefined;
+        keyHelp?: string | undefined;
+        verifyUrl?: string | undefined;
+    }, {
+        name: string;
+        hosts: string[];
+        header?: string | undefined;
+        prefix?: string | undefined;
+        keyHelp?: string | undefined;
+        verifyUrl?: string | undefined;
+    }>;
+    label: z.ZodOptional<z.ZodString>;
+    why: z.ZodString;
+    background: z.ZodOptional<z.ZodBoolean>;
+}, "strict", z.ZodTypeAny, {
+    why: string;
+    family: "apiKey";
+    provider: {
+        name: string;
+        hosts: string[];
+        header?: string | undefined;
+        prefix?: string | undefined;
+        keyHelp?: string | undefined;
+        verifyUrl?: string | undefined;
+    };
+    label?: string | undefined;
+    background?: boolean | undefined;
+}, {
+    why: string;
+    family: "apiKey";
+    provider: {
+        name: string;
+        hosts: string[];
+        header?: string | undefined;
+        prefix?: string | undefined;
+        keyHelp?: string | undefined;
+        verifyUrl?: string | undefined;
+    };
+    label?: string | undefined;
+    background?: boolean | undefined;
+}>]>;
 export type PluginCredentialSlot = z.infer<typeof PluginCredentialSlotSchema>;
+/**
+ * Which accounts serve a slot: accounts of one provider are interchangeable between apps.
+ * `oauth2` — the sign-in AND token endpoints (lower-case host, path), so a slot that points either
+ * one somewhere else is another provider and never reuses a person's client or account;
+ * `apiKey` — the sorted host list. Pure, so the platform, the box and the SDK agree.
+ */
+export declare function credentialProviderKey(slot: {
+    family: string;
+    provider?: {
+        authorizeUrl?: string;
+        tokenUrl?: string;
+        hosts?: readonly string[];
+    };
+}): string | null;
 /** The `credentials` block: slot name → slot. At most ONE slot per app for now. */
-export declare const PluginCredentialsSchema: z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodObject<{
+export declare const PluginCredentialsSchema: z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodDiscriminatedUnion<"family", [z.ZodObject<{
     family: z.ZodLiteral<"google">;
     scopes: z.ZodEffects<z.ZodArray<z.ZodString, "many">, string[], string[]>;
     label: z.ZodOptional<z.ZodString>;
@@ -176,18 +670,249 @@ export declare const PluginCredentialsSchema: z.ZodEffects<z.ZodRecord<z.ZodStri
     scopes: string[];
     label?: string | undefined;
     background?: boolean | undefined;
-}>>, Record<string, {
+}>, z.ZodObject<{
+    family: z.ZodLiteral<"oauth2">;
+    provider: z.ZodEffects<z.ZodObject<{
+        name: z.ZodString;
+        authorizeUrl: z.ZodEffects<z.ZodString, string, string>;
+        tokenUrl: z.ZodEffects<z.ZodString, string, string>;
+        scopes: z.ZodArray<z.ZodString, "many">;
+        hosts: z.ZodArray<z.ZodString, "many">;
+        accountUrl: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+        accountField: z.ZodOptional<z.ZodString>;
+        authorizeParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+        tokenAuth: z.ZodOptional<z.ZodEnum<["body", "basic"]>>;
+        clientIdEnv: z.ZodOptional<z.ZodString>;
+        clientSecretEnv: z.ZodOptional<z.ZodString>;
+    }, "strict", z.ZodTypeAny, {
+        name: string;
+        authorizeUrl: string;
+        tokenUrl: string;
+        scopes: string[];
+        hosts: string[];
+        clientIdEnv?: string | undefined;
+        clientSecretEnv?: string | undefined;
+        accountUrl?: string | undefined;
+        accountField?: string | undefined;
+        authorizeParams?: Record<string, string> | undefined;
+        tokenAuth?: "body" | "basic" | undefined;
+    }, {
+        name: string;
+        authorizeUrl: string;
+        tokenUrl: string;
+        scopes: string[];
+        hosts: string[];
+        clientIdEnv?: string | undefined;
+        clientSecretEnv?: string | undefined;
+        accountUrl?: string | undefined;
+        accountField?: string | undefined;
+        authorizeParams?: Record<string, string> | undefined;
+        tokenAuth?: "body" | "basic" | undefined;
+    }>, {
+        name: string;
+        authorizeUrl: string;
+        tokenUrl: string;
+        scopes: string[];
+        hosts: string[];
+        clientIdEnv?: string | undefined;
+        clientSecretEnv?: string | undefined;
+        accountUrl?: string | undefined;
+        accountField?: string | undefined;
+        authorizeParams?: Record<string, string> | undefined;
+        tokenAuth?: "body" | "basic" | undefined;
+    }, {
+        name: string;
+        authorizeUrl: string;
+        tokenUrl: string;
+        scopes: string[];
+        hosts: string[];
+        clientIdEnv?: string | undefined;
+        clientSecretEnv?: string | undefined;
+        accountUrl?: string | undefined;
+        accountField?: string | undefined;
+        authorizeParams?: Record<string, string> | undefined;
+        tokenAuth?: "body" | "basic" | undefined;
+    }>;
+    label: z.ZodOptional<z.ZodString>;
+    why: z.ZodString;
+    background: z.ZodOptional<z.ZodBoolean>;
+}, "strict", z.ZodTypeAny, {
+    why: string;
+    family: "oauth2";
+    provider: {
+        name: string;
+        authorizeUrl: string;
+        tokenUrl: string;
+        scopes: string[];
+        hosts: string[];
+        clientIdEnv?: string | undefined;
+        clientSecretEnv?: string | undefined;
+        accountUrl?: string | undefined;
+        accountField?: string | undefined;
+        authorizeParams?: Record<string, string> | undefined;
+        tokenAuth?: "body" | "basic" | undefined;
+    };
+    label?: string | undefined;
+    background?: boolean | undefined;
+}, {
+    why: string;
+    family: "oauth2";
+    provider: {
+        name: string;
+        authorizeUrl: string;
+        tokenUrl: string;
+        scopes: string[];
+        hosts: string[];
+        clientIdEnv?: string | undefined;
+        clientSecretEnv?: string | undefined;
+        accountUrl?: string | undefined;
+        accountField?: string | undefined;
+        authorizeParams?: Record<string, string> | undefined;
+        tokenAuth?: "body" | "basic" | undefined;
+    };
+    label?: string | undefined;
+    background?: boolean | undefined;
+}>, z.ZodObject<{
+    family: z.ZodLiteral<"apiKey">;
+    provider: z.ZodEffects<z.ZodObject<{
+        name: z.ZodString;
+        hosts: z.ZodArray<z.ZodString, "many">;
+        header: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+        prefix: z.ZodOptional<z.ZodString>;
+        keyHelp: z.ZodOptional<z.ZodString>;
+        verifyUrl: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+    }, "strict", z.ZodTypeAny, {
+        name: string;
+        hosts: string[];
+        header?: string | undefined;
+        prefix?: string | undefined;
+        keyHelp?: string | undefined;
+        verifyUrl?: string | undefined;
+    }, {
+        name: string;
+        hosts: string[];
+        header?: string | undefined;
+        prefix?: string | undefined;
+        keyHelp?: string | undefined;
+        verifyUrl?: string | undefined;
+    }>, {
+        name: string;
+        hosts: string[];
+        header?: string | undefined;
+        prefix?: string | undefined;
+        keyHelp?: string | undefined;
+        verifyUrl?: string | undefined;
+    }, {
+        name: string;
+        hosts: string[];
+        header?: string | undefined;
+        prefix?: string | undefined;
+        keyHelp?: string | undefined;
+        verifyUrl?: string | undefined;
+    }>;
+    label: z.ZodOptional<z.ZodString>;
+    why: z.ZodString;
+    background: z.ZodOptional<z.ZodBoolean>;
+}, "strict", z.ZodTypeAny, {
+    why: string;
+    family: "apiKey";
+    provider: {
+        name: string;
+        hosts: string[];
+        header?: string | undefined;
+        prefix?: string | undefined;
+        keyHelp?: string | undefined;
+        verifyUrl?: string | undefined;
+    };
+    label?: string | undefined;
+    background?: boolean | undefined;
+}, {
+    why: string;
+    family: "apiKey";
+    provider: {
+        name: string;
+        hosts: string[];
+        header?: string | undefined;
+        prefix?: string | undefined;
+        keyHelp?: string | undefined;
+        verifyUrl?: string | undefined;
+    };
+    label?: string | undefined;
+    background?: boolean | undefined;
+}>]>>, Record<string, {
     why: string;
     family: "google";
     scopes: string[];
     label?: string | undefined;
     background?: boolean | undefined;
+} | {
+    why: string;
+    family: "oauth2";
+    provider: {
+        name: string;
+        authorizeUrl: string;
+        tokenUrl: string;
+        scopes: string[];
+        hosts: string[];
+        clientIdEnv?: string | undefined;
+        clientSecretEnv?: string | undefined;
+        accountUrl?: string | undefined;
+        accountField?: string | undefined;
+        authorizeParams?: Record<string, string> | undefined;
+        tokenAuth?: "body" | "basic" | undefined;
+    };
+    label?: string | undefined;
+    background?: boolean | undefined;
+} | {
+    why: string;
+    family: "apiKey";
+    provider: {
+        name: string;
+        hosts: string[];
+        header?: string | undefined;
+        prefix?: string | undefined;
+        keyHelp?: string | undefined;
+        verifyUrl?: string | undefined;
+    };
+    label?: string | undefined;
+    background?: boolean | undefined;
 }>, Record<string, {
     why: string;
     family: "google";
     scopes: string[];
     label?: string | undefined;
     background?: boolean | undefined;
+} | {
+    why: string;
+    family: "oauth2";
+    provider: {
+        name: string;
+        authorizeUrl: string;
+        tokenUrl: string;
+        scopes: string[];
+        hosts: string[];
+        clientIdEnv?: string | undefined;
+        clientSecretEnv?: string | undefined;
+        accountUrl?: string | undefined;
+        accountField?: string | undefined;
+        authorizeParams?: Record<string, string> | undefined;
+        tokenAuth?: "body" | "basic" | undefined;
+    };
+    label?: string | undefined;
+    background?: boolean | undefined;
+} | {
+    why: string;
+    family: "apiKey";
+    provider: {
+        name: string;
+        hosts: string[];
+        header?: string | undefined;
+        prefix?: string | undefined;
+        keyHelp?: string | undefined;
+        verifyUrl?: string | undefined;
+    };
+    label?: string | undefined;
+    background?: boolean | undefined;
 }>>;
 /** A gateway model id: `provider/model` ("deepseek/deepseek-v3.2"). */
 export declare const LLM_MODEL_ID_RE: RegExp;
@@ -765,7 +1490,7 @@ export declare const PluginManifestSchema: z.ZodEffects<z.ZodObject<{
      * Parts of the app that run ON THE PERSON'S COMPUTER (plugin-device-arm.md
      * §10–§11). The declared commands are the whole authority: the owner
      * approves this list by name when they connect a machine, the app calls
-     * them with `device(ctx, linkId).run(name, params)`, and nothing else can
+     * them with `devices(ctx).run(name, params, { linkId })`, and nothing else can
      * run. Adding or changing a command in an update waits for a fresh approval.
      */
     device: z.ZodOptional<z.ZodEffects<z.ZodObject<{
@@ -989,12 +1714,12 @@ export declare const PluginManifestSchema: z.ZodEffects<z.ZodObject<{
             required: z.ZodOptional<z.ZodBoolean>;
             describe: z.ZodOptional<z.ZodString>;
         }, "strict", z.ZodTypeAny, {
-            required?: boolean | undefined;
             describe?: string | undefined;
+            required?: boolean | undefined;
             secret?: boolean | undefined;
         }, {
-            required?: boolean | undefined;
             describe?: string | undefined;
+            required?: boolean | undefined;
             secret?: boolean | undefined;
         }>>>;
         redact: z.ZodOptional<z.ZodArray<z.ZodString, "many">>;
@@ -1052,8 +1777,8 @@ export declare const PluginManifestSchema: z.ZodEffects<z.ZodObject<{
             } | undefined;
         } | undefined;
         config?: Record<string, {
-            required?: boolean | undefined;
             describe?: string | undefined;
+            required?: boolean | undefined;
             secret?: boolean | undefined;
         }> | undefined;
         redact?: string[] | undefined;
@@ -1111,8 +1836,8 @@ export declare const PluginManifestSchema: z.ZodEffects<z.ZodObject<{
             } | undefined;
         } | undefined;
         config?: Record<string, {
-            required?: boolean | undefined;
             describe?: string | undefined;
+            required?: boolean | undefined;
             secret?: boolean | undefined;
         }> | undefined;
         redact?: string[] | undefined;
@@ -1170,8 +1895,8 @@ export declare const PluginManifestSchema: z.ZodEffects<z.ZodObject<{
             } | undefined;
         } | undefined;
         config?: Record<string, {
-            required?: boolean | undefined;
             describe?: string | undefined;
+            required?: boolean | undefined;
             secret?: boolean | undefined;
         }> | undefined;
         redact?: string[] | undefined;
@@ -1229,8 +1954,8 @@ export declare const PluginManifestSchema: z.ZodEffects<z.ZodObject<{
             } | undefined;
         } | undefined;
         config?: Record<string, {
-            required?: boolean | undefined;
             describe?: string | undefined;
+            required?: boolean | undefined;
             secret?: boolean | undefined;
         }> | undefined;
         redact?: string[] | undefined;
@@ -1300,12 +2025,14 @@ export declare const PluginManifestSchema: z.ZodEffects<z.ZodObject<{
         headerNames?: string[] | undefined;
     }>, "many">>>;
     /**
-     * PLATFORM ACCOUNTS the app uses (docs/08): slot name → `{ family, scopes, why, label?, background? }`.
-     * The person assigns one of their connected Google accounts to the slot in Account settings; the
-     * app calls Google through `credentials(ctx).slot(name).fetch(url)` and never sees a token.
-     * At most one slot per app for now.
+     * THE PERSON'S ACCOUNTS the app uses (docs/08): slot name → `{ family: "google", scopes, why }`,
+     * `{ family: "oauth2", provider: { name, authorizeUrl, tokenUrl, scopes, hosts }, why }` or
+     * `{ family: "apiKey", provider: { name, hosts, header?, prefix? }, why }` (+ `label?`,
+     * `background?`). The person connects an account once in Account settings and assigns it to the
+     * app; the app calls through `credentials(ctx).slot(name).fetch(url)` and never sees a token or
+     * key. At most one slot per app for now.
      */
-    credentials: z.ZodOptional<z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodObject<{
+    credentials: z.ZodOptional<z.ZodEffects<z.ZodRecord<z.ZodString, z.ZodDiscriminatedUnion<"family", [z.ZodObject<{
         family: z.ZodLiteral<"google">;
         scopes: z.ZodEffects<z.ZodArray<z.ZodString, "many">, string[], string[]>;
         label: z.ZodOptional<z.ZodString>;
@@ -1323,18 +2050,249 @@ export declare const PluginManifestSchema: z.ZodEffects<z.ZodObject<{
         scopes: string[];
         label?: string | undefined;
         background?: boolean | undefined;
-    }>>, Record<string, {
+    }>, z.ZodObject<{
+        family: z.ZodLiteral<"oauth2">;
+        provider: z.ZodEffects<z.ZodObject<{
+            name: z.ZodString;
+            authorizeUrl: z.ZodEffects<z.ZodString, string, string>;
+            tokenUrl: z.ZodEffects<z.ZodString, string, string>;
+            scopes: z.ZodArray<z.ZodString, "many">;
+            hosts: z.ZodArray<z.ZodString, "many">;
+            accountUrl: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+            accountField: z.ZodOptional<z.ZodString>;
+            authorizeParams: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            tokenAuth: z.ZodOptional<z.ZodEnum<["body", "basic"]>>;
+            clientIdEnv: z.ZodOptional<z.ZodString>;
+            clientSecretEnv: z.ZodOptional<z.ZodString>;
+        }, "strict", z.ZodTypeAny, {
+            name: string;
+            authorizeUrl: string;
+            tokenUrl: string;
+            scopes: string[];
+            hosts: string[];
+            clientIdEnv?: string | undefined;
+            clientSecretEnv?: string | undefined;
+            accountUrl?: string | undefined;
+            accountField?: string | undefined;
+            authorizeParams?: Record<string, string> | undefined;
+            tokenAuth?: "body" | "basic" | undefined;
+        }, {
+            name: string;
+            authorizeUrl: string;
+            tokenUrl: string;
+            scopes: string[];
+            hosts: string[];
+            clientIdEnv?: string | undefined;
+            clientSecretEnv?: string | undefined;
+            accountUrl?: string | undefined;
+            accountField?: string | undefined;
+            authorizeParams?: Record<string, string> | undefined;
+            tokenAuth?: "body" | "basic" | undefined;
+        }>, {
+            name: string;
+            authorizeUrl: string;
+            tokenUrl: string;
+            scopes: string[];
+            hosts: string[];
+            clientIdEnv?: string | undefined;
+            clientSecretEnv?: string | undefined;
+            accountUrl?: string | undefined;
+            accountField?: string | undefined;
+            authorizeParams?: Record<string, string> | undefined;
+            tokenAuth?: "body" | "basic" | undefined;
+        }, {
+            name: string;
+            authorizeUrl: string;
+            tokenUrl: string;
+            scopes: string[];
+            hosts: string[];
+            clientIdEnv?: string | undefined;
+            clientSecretEnv?: string | undefined;
+            accountUrl?: string | undefined;
+            accountField?: string | undefined;
+            authorizeParams?: Record<string, string> | undefined;
+            tokenAuth?: "body" | "basic" | undefined;
+        }>;
+        label: z.ZodOptional<z.ZodString>;
+        why: z.ZodString;
+        background: z.ZodOptional<z.ZodBoolean>;
+    }, "strict", z.ZodTypeAny, {
+        why: string;
+        family: "oauth2";
+        provider: {
+            name: string;
+            authorizeUrl: string;
+            tokenUrl: string;
+            scopes: string[];
+            hosts: string[];
+            clientIdEnv?: string | undefined;
+            clientSecretEnv?: string | undefined;
+            accountUrl?: string | undefined;
+            accountField?: string | undefined;
+            authorizeParams?: Record<string, string> | undefined;
+            tokenAuth?: "body" | "basic" | undefined;
+        };
+        label?: string | undefined;
+        background?: boolean | undefined;
+    }, {
+        why: string;
+        family: "oauth2";
+        provider: {
+            name: string;
+            authorizeUrl: string;
+            tokenUrl: string;
+            scopes: string[];
+            hosts: string[];
+            clientIdEnv?: string | undefined;
+            clientSecretEnv?: string | undefined;
+            accountUrl?: string | undefined;
+            accountField?: string | undefined;
+            authorizeParams?: Record<string, string> | undefined;
+            tokenAuth?: "body" | "basic" | undefined;
+        };
+        label?: string | undefined;
+        background?: boolean | undefined;
+    }>, z.ZodObject<{
+        family: z.ZodLiteral<"apiKey">;
+        provider: z.ZodEffects<z.ZodObject<{
+            name: z.ZodString;
+            hosts: z.ZodArray<z.ZodString, "many">;
+            header: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+            prefix: z.ZodOptional<z.ZodString>;
+            keyHelp: z.ZodOptional<z.ZodString>;
+            verifyUrl: z.ZodOptional<z.ZodEffects<z.ZodString, string, string>>;
+        }, "strict", z.ZodTypeAny, {
+            name: string;
+            hosts: string[];
+            header?: string | undefined;
+            prefix?: string | undefined;
+            keyHelp?: string | undefined;
+            verifyUrl?: string | undefined;
+        }, {
+            name: string;
+            hosts: string[];
+            header?: string | undefined;
+            prefix?: string | undefined;
+            keyHelp?: string | undefined;
+            verifyUrl?: string | undefined;
+        }>, {
+            name: string;
+            hosts: string[];
+            header?: string | undefined;
+            prefix?: string | undefined;
+            keyHelp?: string | undefined;
+            verifyUrl?: string | undefined;
+        }, {
+            name: string;
+            hosts: string[];
+            header?: string | undefined;
+            prefix?: string | undefined;
+            keyHelp?: string | undefined;
+            verifyUrl?: string | undefined;
+        }>;
+        label: z.ZodOptional<z.ZodString>;
+        why: z.ZodString;
+        background: z.ZodOptional<z.ZodBoolean>;
+    }, "strict", z.ZodTypeAny, {
+        why: string;
+        family: "apiKey";
+        provider: {
+            name: string;
+            hosts: string[];
+            header?: string | undefined;
+            prefix?: string | undefined;
+            keyHelp?: string | undefined;
+            verifyUrl?: string | undefined;
+        };
+        label?: string | undefined;
+        background?: boolean | undefined;
+    }, {
+        why: string;
+        family: "apiKey";
+        provider: {
+            name: string;
+            hosts: string[];
+            header?: string | undefined;
+            prefix?: string | undefined;
+            keyHelp?: string | undefined;
+            verifyUrl?: string | undefined;
+        };
+        label?: string | undefined;
+        background?: boolean | undefined;
+    }>]>>, Record<string, {
         why: string;
         family: "google";
         scopes: string[];
         label?: string | undefined;
         background?: boolean | undefined;
+    } | {
+        why: string;
+        family: "oauth2";
+        provider: {
+            name: string;
+            authorizeUrl: string;
+            tokenUrl: string;
+            scopes: string[];
+            hosts: string[];
+            clientIdEnv?: string | undefined;
+            clientSecretEnv?: string | undefined;
+            accountUrl?: string | undefined;
+            accountField?: string | undefined;
+            authorizeParams?: Record<string, string> | undefined;
+            tokenAuth?: "body" | "basic" | undefined;
+        };
+        label?: string | undefined;
+        background?: boolean | undefined;
+    } | {
+        why: string;
+        family: "apiKey";
+        provider: {
+            name: string;
+            hosts: string[];
+            header?: string | undefined;
+            prefix?: string | undefined;
+            keyHelp?: string | undefined;
+            verifyUrl?: string | undefined;
+        };
+        label?: string | undefined;
+        background?: boolean | undefined;
     }>, Record<string, {
         why: string;
         family: "google";
         scopes: string[];
         label?: string | undefined;
         background?: boolean | undefined;
+    } | {
+        why: string;
+        family: "oauth2";
+        provider: {
+            name: string;
+            authorizeUrl: string;
+            tokenUrl: string;
+            scopes: string[];
+            hosts: string[];
+            clientIdEnv?: string | undefined;
+            clientSecretEnv?: string | undefined;
+            accountUrl?: string | undefined;
+            accountField?: string | undefined;
+            authorizeParams?: Record<string, string> | undefined;
+            tokenAuth?: "body" | "basic" | undefined;
+        };
+        label?: string | undefined;
+        background?: boolean | undefined;
+    } | {
+        why: string;
+        family: "apiKey";
+        provider: {
+            name: string;
+            hosts: string[];
+            header?: string | undefined;
+            prefix?: string | undefined;
+            keyHelp?: string | undefined;
+            verifyUrl?: string | undefined;
+        };
+        label?: string | undefined;
+        background?: boolean | undefined;
     }>>>;
     /**
      * MODEL CALLS (docs/19): `{ why, dailyBudgetUsd?, models? }`. The app calls `llm(ctx).generate(…)`;
@@ -1651,8 +2609,8 @@ export declare const PluginManifestSchema: z.ZodEffects<z.ZodObject<{
             } | undefined;
         } | undefined;
         config?: Record<string, {
-            required?: boolean | undefined;
             describe?: string | undefined;
+            required?: boolean | undefined;
             secret?: boolean | undefined;
         }> | undefined;
         redact?: string[] | undefined;
@@ -1664,6 +2622,37 @@ export declare const PluginManifestSchema: z.ZodEffects<z.ZodObject<{
         scopes: string[];
         label?: string | undefined;
         background?: boolean | undefined;
+    } | {
+        why: string;
+        family: "oauth2";
+        provider: {
+            name: string;
+            authorizeUrl: string;
+            tokenUrl: string;
+            scopes: string[];
+            hosts: string[];
+            clientIdEnv?: string | undefined;
+            clientSecretEnv?: string | undefined;
+            accountUrl?: string | undefined;
+            accountField?: string | undefined;
+            authorizeParams?: Record<string, string> | undefined;
+            tokenAuth?: "body" | "basic" | undefined;
+        };
+        label?: string | undefined;
+        background?: boolean | undefined;
+    } | {
+        why: string;
+        family: "apiKey";
+        provider: {
+            name: string;
+            hosts: string[];
+            header?: string | undefined;
+            prefix?: string | undefined;
+            keyHelp?: string | undefined;
+            verifyUrl?: string | undefined;
+        };
+        label?: string | undefined;
+        background?: boolean | undefined;
     }> | undefined;
     llm?: {
         why: string;
@@ -1800,8 +2789,8 @@ export declare const PluginManifestSchema: z.ZodEffects<z.ZodObject<{
             } | undefined;
         } | undefined;
         config?: Record<string, {
-            required?: boolean | undefined;
             describe?: string | undefined;
+            required?: boolean | undefined;
             secret?: boolean | undefined;
         }> | undefined;
         redact?: string[] | undefined;
@@ -1813,6 +2802,37 @@ export declare const PluginManifestSchema: z.ZodEffects<z.ZodObject<{
         scopes: string[];
         label?: string | undefined;
         background?: boolean | undefined;
+    } | {
+        why: string;
+        family: "oauth2";
+        provider: {
+            name: string;
+            authorizeUrl: string;
+            tokenUrl: string;
+            scopes: string[];
+            hosts: string[];
+            clientIdEnv?: string | undefined;
+            clientSecretEnv?: string | undefined;
+            accountUrl?: string | undefined;
+            accountField?: string | undefined;
+            authorizeParams?: Record<string, string> | undefined;
+            tokenAuth?: "body" | "basic" | undefined;
+        };
+        label?: string | undefined;
+        background?: boolean | undefined;
+    } | {
+        why: string;
+        family: "apiKey";
+        provider: {
+            name: string;
+            hosts: string[];
+            header?: string | undefined;
+            prefix?: string | undefined;
+            keyHelp?: string | undefined;
+            verifyUrl?: string | undefined;
+        };
+        label?: string | undefined;
+        background?: boolean | undefined;
     }> | undefined;
     llm?: {
         why: string;
@@ -2029,8 +3049,8 @@ export declare const PluginManifestSchema: z.ZodEffects<z.ZodObject<{
             } | undefined;
         } | undefined;
         config?: Record<string, {
-            required?: boolean | undefined;
             describe?: string | undefined;
+            required?: boolean | undefined;
             secret?: boolean | undefined;
         }> | undefined;
         redact?: string[] | undefined;
@@ -2042,6 +3062,37 @@ export declare const PluginManifestSchema: z.ZodEffects<z.ZodObject<{
         scopes: string[];
         label?: string | undefined;
         background?: boolean | undefined;
+    } | {
+        why: string;
+        family: "oauth2";
+        provider: {
+            name: string;
+            authorizeUrl: string;
+            tokenUrl: string;
+            scopes: string[];
+            hosts: string[];
+            clientIdEnv?: string | undefined;
+            clientSecretEnv?: string | undefined;
+            accountUrl?: string | undefined;
+            accountField?: string | undefined;
+            authorizeParams?: Record<string, string> | undefined;
+            tokenAuth?: "body" | "basic" | undefined;
+        };
+        label?: string | undefined;
+        background?: boolean | undefined;
+    } | {
+        why: string;
+        family: "apiKey";
+        provider: {
+            name: string;
+            hosts: string[];
+            header?: string | undefined;
+            prefix?: string | undefined;
+            keyHelp?: string | undefined;
+            verifyUrl?: string | undefined;
+        };
+        label?: string | undefined;
+        background?: boolean | undefined;
     }> | undefined;
     llm?: {
         why: string;
@@ -2178,8 +3229,8 @@ export declare const PluginManifestSchema: z.ZodEffects<z.ZodObject<{
             } | undefined;
         } | undefined;
         config?: Record<string, {
-            required?: boolean | undefined;
             describe?: string | undefined;
+            required?: boolean | undefined;
             secret?: boolean | undefined;
         }> | undefined;
         redact?: string[] | undefined;
@@ -2191,6 +3242,37 @@ export declare const PluginManifestSchema: z.ZodEffects<z.ZodObject<{
         scopes: string[];
         label?: string | undefined;
         background?: boolean | undefined;
+    } | {
+        why: string;
+        family: "oauth2";
+        provider: {
+            name: string;
+            authorizeUrl: string;
+            tokenUrl: string;
+            scopes: string[];
+            hosts: string[];
+            clientIdEnv?: string | undefined;
+            clientSecretEnv?: string | undefined;
+            accountUrl?: string | undefined;
+            accountField?: string | undefined;
+            authorizeParams?: Record<string, string> | undefined;
+            tokenAuth?: "body" | "basic" | undefined;
+        };
+        label?: string | undefined;
+        background?: boolean | undefined;
+    } | {
+        why: string;
+        family: "apiKey";
+        provider: {
+            name: string;
+            hosts: string[];
+            header?: string | undefined;
+            prefix?: string | undefined;
+            keyHelp?: string | undefined;
+            verifyUrl?: string | undefined;
+        };
+        label?: string | undefined;
+        background?: boolean | undefined;
     }> | undefined;
     llm?: {
         why: string;