okengine 0.18.4 → 0.19.0

package/src/console/server/flows.ts

@@ -92,11 +92,18 @@ const ManifestOut = z.object({
 });
 
 const EffectEntryOut = z.object({
-  kind: z.enum(["read", "write", "emit", "send", "ask", "secret", "call"]),
+  kind: z.enum(["read", "write", "emit", "send", "ask", "embed", "secret", "call", "fetch"]),
   resource: z.string(),
   timestamp: z.number(),
   duration: z.number(),
   reversibility: z.enum(["none", "reversible", "deferred", "irreversible", "capability", "portal"]),
+  external: z
+    .object({
+      host: z.string(),
+      provider: z.string().optional(),
+      kind: z.enum(["third-party", "infrastructure"]).optional(),
+    })
+    .optional(),
 });
 
 const LogLineOut = z.object({
@@ -259,7 +266,7 @@ const SignalsReplayOut = z.object({
   ),
   wouldHaveFired: z.array(
     z.object({
-      kind: z.enum(["send", "ask"]),
+      kind: z.enum(["send", "ask", "embed", "fetch"]),
       resource: z.string(),
       messageId: z.string().optional(),
     }),
@@ -893,7 +900,17 @@ const AiListOut = z.object({
           status: z.enum(["ok", "denied"]),
           effects: z.array(
             z.object({
-              kind: z.enum(["read", "write", "emit", "send", "ask", "secret", "call"]),
+              kind: z.enum([
+                "read",
+                "write",
+                "emit",
+                "send",
+                "ask",
+                "embed",
+                "secret",
+                "call",
+                "fetch",
+              ]),
               resource: z.string(),
             }),
           ),
@@ -1541,7 +1558,7 @@ const StoreEditOut = z.object({
   willNotFire: WillNotFireOut,
   wouldHaveFired: z.array(
     z.object({
-      kind: z.enum(["send", "ask"]),
+      kind: z.enum(["send", "ask", "embed", "fetch"]),
       resource: z.string(),
     }),
   ),
@@ -1754,7 +1771,7 @@ const StorePreviewOut = z.object({
   willNotFire: WillNotFireOut,
   wouldHaveFired: z.array(
     z.object({
-      kind: z.enum(["send", "ask"]),
+      kind: z.enum(["send", "ask", "embed", "fetch"]),
       resource: z.string(),
     }),
   ),
@@ -1926,67 +1943,419 @@ export function createConsoleBindings(state: ConsoleState): {
   const channelSendTest = createChannelSendTest(state);
 
   const bindings: Binding[] = [
-    bindHttp(http.get("/console/setup/status"), setupStatus),
-    bindHttp(http.post("/console/setup/claim"), setupClaim),
-    bindHttp(http.post("/console/session/login"), sessionLogin),
-    bindHttp(http.get("/console/session/me"), sessionMe),
-    bindHttp(http.post("/console/session/logout"), sessionLogout),
-    bindHttp(http.get("/console/manifest"), manifestGet),
-    bindHttp(http.get("/console/runs"), runsList),
-    bindHttp(http.post("/console/runs/query"), runsQuery),
-    bindHttp(http.post("/console/action/ping"), actionPing),
-    bindHttp(http.post("/console/structural/propose"), structuralPropose),
-    bindHttp(http.get("/console/flows/identities"), flowsIdentities),
-    bindHttp(http.post("/console/flows/invoke"), flowsInvoke),
-    bindHttp(http.post("/console/traces/replay"), tracesReplay),
-    bindHttp(http.get("/console/signals"), signalsList),
-    bindHttp(http.post("/console/signals/replay"), signalsReplay),
-    bindHttp(http.post("/console/signals/dry-run-replay"), signalsDryRunReplay),
-    bindHttp(http.post("/console/signals/discard"), signalsDiscard),
-    bindHttp(http.get("/console/store"), storeList),
-    bindHttp(http.query("/console/store/query"), storeQuery),
-    bindHttp(http.post("/console/store/reveal"), storeReveal),
-    bindHttp(http.post("/console/store/object"), storeObject),
-    bindHttp(http.post("/console/store/edit"), storeEdit),
-    bindHttp(http.post("/console/store/delete"), storeDelete),
-    bindHttp(http.post("/console/store/purge-cache"), storePurgeCache),
-    bindHttp(http.post("/console/store/sql"), storeSql),
-    bindHttp(http.post("/console/store/preview"), storePreview),
-    bindHttp(http.query("/console/store/sql/stats"), storeStats),
-    bindHttp(http.query("/console/store/sql/locks"), storeLocks),
-    bindHttp(http.query("/console/store/kv/stats"), storeKvStats),
-    bindHttp(http.post("/console/store/sql/advise"), storeAdvise),
-    bindHttp(http.get("/console/vault"), vaultList),
-    bindHttp(http.post("/console/vault/set"), vaultSet),
-    bindHttp(http.post("/console/vault/create"), vaultCreate),
-    bindHttp(http.post("/console/vault/rotate"), vaultRotate),
-    bindHttp(http.post("/console/vault/rotate-master"), vaultRotateMaster),
-    bindHttp(http.get("/console/vault/audit/verify"), vaultAuditVerify),
-    bindHttp(http.get("/console/ai"), aiList),
-    bindHttp(http.get("/console/gates"), gatesList),
-    bindHttp(http.query("/console/gates/simulate"), gatesSimulate),
-    bindHttp(http.query("/console/gates/powers"), gatesPowers),
-    bindHttp(http.get("/console/access"), accessList),
-    bindHttp(http.query("/console/access/effective"), accessEffective),
-    bindHttp(http.post("/console/access/key-blast"), accessKeyBlast),
-    bindHttp(http.post("/console/access/keys"), accessCreateKeyFlow),
-    bindHttp(http.post("/console/access/keys/revoke"), accessRevokeKeyFlow),
-    bindHttp(http.post("/console/access/keys/rotate"), accessRotateKeyFlow),
-    bindHttp(http.post("/console/access/keys/update"), accessUpdateKeyFlow),
-    bindHttp(http.post("/console/access/roles/grants"), accessSetRoleGrantsFlow),
-    bindHttp(http.get("/console/diff"), diffList),
-    bindHttp(http.get("/console/plugins"), pluginsList),
-    bindHttp(http.get("/console/clock"), clockList),
-    bindHttp(http.get("/console/instances"), instancesList),
-    bindHttp(http.post("/console/clock/run-now"), clockRunNow),
-    bindHttp(http.post("/console/clock/pause"), clockPause),
-    bindHttp(http.post("/console/clock/edit-schedule"), clockEditSchedule),
-    bindHttp(http.post("/console/clock/wake-early"), clockWakeEarly),
-    bindHttp(http.get("/console/channels"), channelsList),
-    bindHttp(http.query("/console/channels/preview"), channelPreview),
-    bindHttp(http.post("/console/channels/verify-auth"), channelVerifyAuth),
-    bindHttp(http.post("/console/channels/reveal"), channelReveal),
-    bindHttp(http.post("/console/channels/send-test"), channelSendTest),
+    bindHttp(http.get("/console/setup/status", { out: SetupStatusOut }), setupStatus),
+    bindHttp(
+      http.post("/console/setup/claim", {
+        in: ClaimIn,
+        out: SessionOut,
+        errors: { SetupClosed, ClaimFailed },
+      }),
+      setupClaim,
+    ),
+    bindHttp(
+      http.post("/console/session/login", {
+        in: LoginIn,
+        out: SessionOut,
+        errors: { AuthFailed, AuthRateLimited },
+      }),
+      sessionLogin,
+    ),
+    bindHttp(http.get("/console/session/me", { out: MeOut, errors: { AuthFailed } }), sessionMe),
+    bindHttp(
+      http.post("/console/session/logout", { out: z.object({ ok: z.literal(true) }) }),
+      sessionLogout,
+    ),
+    bindHttp(
+      http.get("/console/manifest", { out: ManifestOut, errors: { AuthFailed } }),
+      manifestGet,
+    ),
+    bindHttp(http.get("/console/runs", { out: RunsListOut, errors: { AuthFailed } }), runsList),
+    bindHttp(
+      http.post("/console/runs/query", {
+        in: RunsQueryIn,
+        out: RunsQueryOut,
+        errors: { AuthFailed, QueryRejected, QueryTimeout, QueryFailed },
+      }),
+      runsQuery,
+    ),
+    bindHttp(
+      http.post("/console/action/ping", {
+        in: ActionPingIn,
+        out: ActionPingOut,
+        errors: { AuthFailed },
+      }),
+      actionPing,
+    ),
+    bindHttp(
+      http.post("/console/structural/propose", {
+        in: StructuralIn,
+        out: StructuralOut,
+        errors: { AuthFailed },
+      }),
+      structuralPropose,
+    ),
+    bindHttp(
+      http.get("/console/flows/identities", { out: IdentitiesOut, errors: { AuthFailed } }),
+      flowsIdentities,
+    ),
+    bindHttp(
+      http.post("/console/flows/invoke", {
+        in: InvokeIn,
+        out: InvokeOut,
+        errors: { AuthFailed, NotFound, InvokeDenied, ConfirmRequired },
+      }),
+      flowsInvoke,
+    ),
+    bindHttp(
+      http.post("/console/traces/replay", {
+        in: TracesReplayIn,
+        out: TracesReplayOut,
+        errors: { AuthFailed, NotFound, ReplayUnavailable, ReplayFailed },
+      }),
+      tracesReplay,
+    ),
+    bindHttp(
+      http.get("/console/signals", { out: SignalsListOut, errors: { AuthFailed } }),
+      signalsList,
+    ),
+    bindHttp(
+      http.post("/console/signals/replay", {
+        in: SignalsReplayIn,
+        out: SignalsReplayOut,
+        errors: { AuthFailed, SignalNotFound, ConfirmRequired },
+      }),
+      signalsReplay,
+    ),
+    bindHttp(
+      http.post("/console/signals/dry-run-replay", {
+        in: SignalsReplayIn.omit({ dryRun: true }),
+        out: SignalsReplayOut,
+        errors: { AuthFailed, SignalNotFound, DryRunUnsafe },
+      }),
+      signalsDryRunReplay,
+    ),
+    bindHttp(
+      http.post("/console/signals/discard", {
+        in: SignalsDiscardIn,
+        out: SignalsDiscardOut,
+        errors: { AuthFailed, SignalNotFound, ConfirmRequired },
+      }),
+      signalsDiscard,
+    ),
+    bindHttp(http.get("/console/store", { out: StoreListOut, errors: { AuthFailed } }), storeList),
+    bindHttp(
+      http.query("/console/store/query", {
+        in: StoreQueryIn,
+        out: StoreQueryOut,
+        errors: { AuthFailed, TenantRequired, StoreNotFound },
+      }),
+      storeQuery,
+    ),
+    bindHttp(
+      http.post("/console/store/reveal", {
+        in: StoreRevealIn,
+        out: StoreRevealOut,
+        errors: { AuthFailed, TenantRequired, StoreNotFound },
+      }),
+      storeReveal,
+    ),
+    bindHttp(
+      http.post("/console/store/object", {
+        in: StoreFileGetIn,
+        out: StoreFileGetOut,
+        errors: { AuthFailed, TenantRequired, StoreNotFound },
+      }),
+      storeObject,
+    ),
+    bindHttp(
+      http.post("/console/store/edit", {
+        in: StoreEditIn,
+        out: StoreEditOut,
+        errors: { AuthFailed, TenantRequired, ConfirmRequired, StoreNotFound },
+      }),
+      storeEdit,
+    ),
+    bindHttp(
+      http.post("/console/store/delete", {
+        in: StoreDeleteIn,
+        out: StoreDeleteOut,
+        errors: { AuthFailed, TenantRequired, ConfirmRequired },
+      }),
+      storeDelete,
+    ),
+    bindHttp(
+      http.post("/console/store/purge-cache", {
+        in: StorePurgeIn,
+        out: StorePurgeOut,
+        errors: { AuthFailed, ConfirmRequired },
+      }),
+      storePurgeCache,
+    ),
+    bindHttp(
+      http.post("/console/store/sql", {
+        in: StoreSqlIn,
+        out: StoreSqlOut,
+        errors: { AuthFailed, TenantRequired, StoreNotFound },
+      }),
+      storeSql,
+    ),
+    bindHttp(
+      http.post("/console/store/preview", {
+        in: StorePreviewIn,
+        out: StorePreviewOut,
+        errors: { AuthFailed, TenantRequired, DryRunUnsafe },
+      }),
+      storePreview,
+    ),
+    bindHttp(
+      http.query("/console/store/sql/stats", {
+        in: StoreSqlStatsIn,
+        out: StoreSqlStatsOut,
+        errors: {
+          AuthFailed,
+          TenantRequired,
+          StoreNotFound,
+          PgStatStatementsNotPreloaded,
+          PgStatStatementsUnsupported,
+          PgStatStatementsNotCreated,
+        },
+      }),
+      storeStats,
+    ),
+    bindHttp(
+      http.query("/console/store/sql/locks", {
+        in: StoreSqlLocksIn,
+        out: StoreSqlLocksOut,
+        errors: {
+          AuthFailed,
+          TenantRequired,
+          StoreNotFound,
+          PgStatStatementsNotPreloaded,
+          PgStatStatementsUnsupported,
+          PgStatStatementsNotCreated,
+        },
+      }),
+      storeLocks,
+    ),
+    bindHttp(
+      http.query("/console/store/kv/stats", {
+        in: StoreKvStatsIn,
+        out: StoreKvStatsOut,
+        errors: { AuthFailed, TenantRequired, StoreNotFound, KvStatsUnsupported },
+      }),
+      storeKvStats,
+    ),
+    bindHttp(
+      http.post("/console/store/sql/advise", {
+        in: StoreSqlAdviseIn,
+        out: StoreSqlAdviseOut,
+        errors: {
+          AuthFailed,
+          TenantRequired,
+          StoreNotFound,
+          PgStatStatementsNotPreloaded,
+          PgStatStatementsUnsupported,
+          PgStatStatementsNotCreated,
+        },
+      }),
+      storeAdvise,
+    ),
+    bindHttp(http.get("/console/vault", { out: VaultListOut, errors: { AuthFailed } }), vaultList),
+    bindHttp(
+      http.post("/console/vault/set", {
+        in: VaultWriteIn,
+        out: VaultWriteOut,
+        errors: { AuthFailed, VaultNotFound },
+      }),
+      vaultSet,
+    ),
+    bindHttp(
+      http.post("/console/vault/create", {
+        in: VaultCreateIn,
+        out: VaultWriteOut,
+        errors: { AuthFailed, VaultExists, VaultNotFound },
+      }),
+      vaultCreate,
+    ),
+    bindHttp(
+      http.post("/console/vault/rotate", {
+        in: VaultWriteIn,
+        out: VaultWriteOut,
+        errors: { AuthFailed, VaultNotFound },
+      }),
+      vaultRotate,
+    ),
+    bindHttp(
+      http.post("/console/vault/rotate-master", {
+        in: VaultRotateMasterIn,
+        out: VaultRotateMasterOut,
+        errors: { AuthFailed, ConfirmRequired, VaultSealed, VaultRotateBusy, VaultUnsupported },
+      }),
+      vaultRotateMaster,
+    ),
+    bindHttp(
+      http.get("/console/vault/audit/verify", {
+        out: VaultAuditVerifyOut,
+        errors: { AuthFailed, VaultUnsupported },
+      }),
+      vaultAuditVerify,
+    ),
+    bindHttp(http.get("/console/ai", { out: AiListOut, errors: { AuthFailed } }), aiList),
+    bindHttp(http.get("/console/gates", { out: GatesListOut, errors: { AuthFailed } }), gatesList),
+    bindHttp(
+      http.query("/console/gates/simulate", {
+        in: GatesSimulateIn,
+        out: GatesSimulateOut,
+        errors: { AuthFailed },
+      }),
+      gatesSimulate,
+    ),
+    bindHttp(
+      http.query("/console/gates/powers", {
+        in: GatesPowersIn,
+        out: GatesPowersOut,
+        errors: { AuthFailed },
+      }),
+      gatesPowers,
+    ),
+    bindHttp(
+      http.get("/console/access", { out: AccessListOut, errors: { AuthFailed } }),
+      accessList,
+    ),
+    bindHttp(
+      http.query("/console/access/effective", {
+        in: AccessEffectiveIn,
+        out: AccessEffectiveOut,
+        errors: { AuthFailed, NotFound },
+      }),
+      accessEffective,
+    ),
+    bindHttp(
+      http.post("/console/access/key-blast", {
+        in: AccessKeyBlastIn,
+        out: AccessKeyBlastOut,
+        errors: { AuthFailed, AccessKeyNotFound },
+      }),
+      accessKeyBlast,
+    ),
+    bindHttp(
+      http.post("/console/access/keys", {
+        in: AccessCreateKeyIn,
+        out: AccessCreateKeyOut,
+        errors: { AuthFailed, AccessGrantDenied },
+      }),
+      accessCreateKeyFlow,
+    ),
+    bindHttp(
+      http.post("/console/access/keys/revoke", {
+        in: AccessRevokeKeyIn,
+        out: AccessRevokeKeyOut,
+        errors: { AuthFailed, AccessKeyNotFound, ConfirmRequired },
+      }),
+      accessRevokeKeyFlow,
+    ),
+    bindHttp(
+      http.post("/console/access/keys/rotate", {
+        in: AccessRotateKeyIn,
+        out: AccessRotateKeyOut,
+        errors: { AuthFailed, AccessKeyNotFound, ConfirmRequired },
+      }),
+      accessRotateKeyFlow,
+    ),
+    bindHttp(
+      http.post("/console/access/keys/update", {
+        in: AccessUpdateKeyIn,
+        out: AccessUpdateKeyOut,
+        errors: { AuthFailed, AccessKeyNotFound, AccessGrantDenied },
+      }),
+      accessUpdateKeyFlow,
+    ),
+    bindHttp(
+      http.post("/console/access/roles/grants", {
+        in: AccessSetRoleGrantsIn,
+        out: AccessSetRoleGrantsOut,
+        errors: { AuthFailed, AccessGrantDenied },
+      }),
+      accessSetRoleGrantsFlow,
+    ),
+    bindHttp(http.get("/console/diff", { out: DiffListOut, errors: { AuthFailed } }), diffList),
+    bindHttp(
+      http.get("/console/plugins", { out: PluginsListOut, errors: { AuthFailed } }),
+      pluginsList,
+    ),
+    bindHttp(http.get("/console/clock", { out: ClockListOut, errors: { AuthFailed } }), clockList),
+    bindHttp(
+      http.get("/console/instances", { out: InstancesListOut, errors: { AuthFailed } }),
+      instancesList,
+    ),
+    bindHttp(
+      http.post("/console/clock/run-now", {
+        in: ClockRunNowIn,
+        out: ClockRunNowOut,
+        errors: { AuthFailed, ClockNotFound, ConfirmRequired },
+      }),
+      clockRunNow,
+    ),
+    bindHttp(
+      http.post("/console/clock/pause", {
+        in: ClockPauseIn,
+        out: ClockPauseOut,
+        errors: { AuthFailed, ClockNotFound },
+      }),
+      clockPause,
+    ),
+    bindHttp(
+      http.post("/console/clock/edit-schedule", {
+        in: ClockEditIn,
+        out: ClockEditOut,
+        errors: { AuthFailed, ClockNotFound, ScheduleNotOverridable },
+      }),
+      clockEditSchedule,
+    ),
+    bindHttp(
+      http.post("/console/clock/wake-early", {
+        in: ClockWakeEarlyIn,
+        out: ClockWakeEarlyOut,
+        errors: { AuthFailed, ClockNotFound },
+      }),
+      clockWakeEarly,
+    ),
+    bindHttp(
+      http.get("/console/channels", { out: ChannelsListOut, errors: { AuthFailed } }),
+      channelsList,
+    ),
+    bindHttp(
+      http.query("/console/channels/preview", {
+        in: ChannelPreviewIn,
+        out: ChannelPreviewOut,
+        errors: { AuthFailed, ChannelNotFound },
+      }),
+      channelPreview,
+    ),
+    bindHttp(
+      http.post("/console/channels/verify-auth", {
+        in: ChannelVerifyAuthIn,
+        out: ChannelVerifyAuthOut,
+        errors: { AuthFailed },
+      }),
+      channelVerifyAuth,
+    ),
+    bindHttp(
+      http.post("/console/channels/reveal", {
+        in: ChannelRevealIn,
+        out: ChannelRevealOut,
+        errors: { AuthFailed, ChannelNotFound },
+      }),
+      channelReveal,
+    ),
+    bindHttp(
+      http.post("/console/channels/send-test", {
+        in: ChannelSendTestIn,
+        out: ChannelSendTestOut,
+        errors: { AuthFailed, ChannelNotFound, ConfirmRequired },
+      }),
+      channelSendTest,
+    ),
   ];
 
   return {
@@ -2069,7 +2438,6 @@ export function createConsoleBindings(state: ConsoleState): {
 function createSetupStatus(state: ConsoleState) {
   return flow("console.setup.status", {
     plane: "operator",
-    out: SetupStatusOut,
     do: () => ({
       setupClosed: state.setupClosed,
       claimRequired: !state.setupClosed,
@@ -2080,9 +2448,6 @@ function createSetupStatus(state: ConsoleState) {
 function createSetupClaim(state: ConsoleState) {
   return flow("console.setup.claim", {
     plane: "operator",
-    in: ClaimIn,
-    out: SessionOut,
-    errors: { SetupClosed, ClaimFailed },
     do: async (input: z.infer<typeof ClaimIn>, fx) => {
       if (state.setupClosed) {
         const data = { reason: "first_operator_exists" };
@@ -2131,9 +2496,6 @@ function createSetupClaim(state: ConsoleState) {
 function createSessionLogin(state: ConsoleState) {
   return flow("console.session.login", {
     plane: "operator",
-    in: LoginIn,
-    out: SessionOut,
-    errors: { AuthFailed, AuthRateLimited },
     do: async (input: z.infer<typeof LoginIn>, fx) => {
       if (touchLoginRateLimit(state.loginAttempts, input.email, state.now()) === "rate_limited") {
         return fail("AuthRateLimited", {
@@ -2152,8 +2514,6 @@ function createSessionLogin(state: ConsoleState) {
 function createSessionMe(state: ConsoleState) {
   return flow("console.session.me", {
     plane: "operator",
-    out: MeOut,
-    errors: { AuthFailed },
     do: (_input, fx) => {
       const id = fx.operator.id;
       if (!id) return fail("AuthFailed", {});
@@ -2172,7 +2532,6 @@ function createSessionMe(state: ConsoleState) {
 function createSessionLogout() {
   return flow("console.session.logout", {
     plane: "operator",
-    out: z.object({ ok: z.literal(true) }),
     do: (_input, fx) => {
       fx.log.info("console.session.logout", {
         operatorId: fx.operator.id,
@@ -2185,8 +2544,6 @@ function createSessionLogout() {
 function createManifestGet(state: ConsoleState) {
   return flow("console.manifest.get", {
     plane: "operator",
-    out: ManifestOut,
-    errors: { AuthFailed },
     do: (_input, fx) => {
       if (!fx.operator.id) return fail("AuthFailed", {});
       return { manifest: state.manifest };
@@ -2197,9 +2554,6 @@ function createManifestGet(state: ConsoleState) {
 function createRunsQuery(state: ConsoleState) {
   return flow("console.runs.query", {
     plane: "operator",
-    in: RunsQueryIn,
-    out: RunsQueryOut,
-    errors: { AuthFailed, QueryRejected, QueryTimeout, QueryFailed },
     do: async (input: z.infer<typeof RunsQueryIn>, fx) => {
       if (!fx.operator.id) return fail("AuthFailed", {});
       if (input.revealPii === true) {
@@ -2241,8 +2595,6 @@ function createRunsQuery(state: ConsoleState) {
 function createRunsList(state: ConsoleState) {
   return flow("console.runs.list", {
     plane: "operator",
-    out: RunsListOut,
-    errors: { AuthFailed },
     do: async (_input, fx) => {
       if (!fx.operator.id) return fail("AuthFailed", {});
       const all = await state.listRuns();
@@ -2304,6 +2656,7 @@ export function projectRun(r: WideEvent, piiFields: ReadonlySet<string> = new Se
       timestamp: e.timestamp,
       duration: e.duration,
       reversibility: e.reversibility,
+      ...(e.external !== undefined ? { external: e.external } : {}),
     })),
     logs: masked.logs.map((line) => ({
       level: line.level,
@@ -2320,9 +2673,6 @@ export function projectRun(r: WideEvent, piiFields: ReadonlySet<string> = new Se
 function createTracesReplay(state: ConsoleState) {
   return flow("console.traces.replay", {
     plane: "operator",
-    in: TracesReplayIn,
-    out: TracesReplayOut,
-    errors: { AuthFailed, NotFound, ReplayUnavailable, ReplayFailed },
     do: async (input: z.infer<typeof TracesReplayIn>, fx) => {
       if (!fx.operator.id) return fail("AuthFailed", {});
       const all = await state.listRuns();
@@ -2385,8 +2735,6 @@ function createTracesReplay(state: ConsoleState) {
 function createSignalsList(state: ConsoleState) {
   return flow("console.signals.list", {
     plane: "operator",
-    out: SignalsListOut,
-    errors: { AuthFailed },
     do: async (_input, fx) => {
       if (!fx.operator.id) return fail("AuthFailed", {});
       const signals = await state.listSignals();
@@ -2398,9 +2746,6 @@ function createSignalsList(state: ConsoleState) {
 function createSignalsReplay(state: ConsoleState) {
   return flow("console.signals.replay", {
     plane: "operator",
-    in: SignalsReplayIn,
-    out: SignalsReplayOut,
-    errors: { AuthFailed, SignalNotFound, ConfirmRequired },
     do: async (input: z.infer<typeof SignalsReplayIn>, fx) => {
       if (!fx.operator.id) return fail("AuthFailed", {});
       return runSignalReplay(state, fx, { ...input, dryRun: false });
@@ -2411,9 +2756,6 @@ function createSignalsReplay(state: ConsoleState) {
 function createSignalsDryRunReplay(state: ConsoleState) {
   return flow("console.signals.dryRunReplay", {
     plane: "operator",
-    in: SignalsReplayIn.omit({ dryRun: true }),
-    out: SignalsReplayOut,
-    errors: { AuthFailed, SignalNotFound, DryRunUnsafe },
     do: async (input: Omit<z.infer<typeof SignalsReplayIn>, "dryRun">, fx) => {
       if (!fx.operator.id) return fail("AuthFailed", {});
       return runSignalReplay(state, fx, { ...input, dryRun: true });
@@ -2424,9 +2766,6 @@ function createSignalsDryRunReplay(state: ConsoleState) {
 function createSignalsDiscard(state: ConsoleState) {
   return flow("console.signals.discard", {
     plane: "operator",
-    in: SignalsDiscardIn,
-    out: SignalsDiscardOut,
-    errors: { AuthFailed, SignalNotFound, ConfirmRequired },
     do: async (input: z.infer<typeof SignalsDiscardIn>, fx) => {
       if (!fx.operator.id) return fail("AuthFailed", {});
       const rows = await state.listSignals();
@@ -2566,9 +2905,6 @@ function dryRunSafety(row: {
 function createActionPing(state: ConsoleState) {
   return flow("console.action.ping", {
     plane: "operator",
-    in: ActionPingIn,
-    out: ActionPingOut,
-    errors: { AuthFailed },
     do: (input: z.infer<typeof ActionPingIn>, fx) => {
       if (!fx.operator.id) return fail("AuthFailed", {});
       fx.log.info("console.action.ping", {
@@ -2583,9 +2919,6 @@ function createActionPing(state: ConsoleState) {
 function createStructuralPropose(state: ConsoleState) {
   return flow("console.structural.propose", {
     plane: "operator",
-    in: StructuralIn,
-    out: StructuralOut,
-    errors: { AuthFailed },
     do: async (input: z.infer<typeof StructuralIn>, fx) => {
       if (!fx.operator.id) return fail("AuthFailed", {});
       const proposal = await emitStructuralDiff({
@@ -2609,8 +2942,6 @@ function createStructuralPropose(state: ConsoleState) {
 function createFlowsIdentities(state: ConsoleState) {
   return flow("console.flows.identities", {
     plane: "operator",
-    out: IdentitiesOut,
-    errors: { AuthFailed },
     do: (_input, fx) => {
       if (!fx.operator.id) return fail("AuthFailed", {});
       return {
@@ -2629,9 +2960,6 @@ function createFlowsIdentities(state: ConsoleState) {
 function createFlowsInvoke(state: ConsoleState) {
   return flow("console.flows.invoke", {
     plane: "operator",
-    in: InvokeIn,
-    out: InvokeOut,
-    errors: { AuthFailed, NotFound, InvokeDenied, ConfirmRequired },
     do: async (input: z.infer<typeof InvokeIn>, fx) => {
       if (!fx.operator.id) return fail("AuthFailed", {});
       const manifest = state.manifest;
@@ -2816,8 +3144,6 @@ function requireTenantIfDeclared(
 function createStoreList(state: ConsoleState) {
   return flow("console.store.list", {
     plane: "operator",
-    out: StoreListOut,
-    errors: { AuthFailed },
     do: async (_input, fx) => {
       if (!fx.operator.id) return fail("AuthFailed", {});
       return state.listStores();
@@ -2854,9 +3180,6 @@ function consoleStoreRls(
 function createStoreQuery(state: ConsoleState) {
   return flow("console.store.query", {
     plane: "operator",
-    in: StoreQueryIn,
-    out: StoreQueryOut,
-    errors: { AuthFailed, TenantRequired, StoreNotFound },
     do: async (input: z.infer<typeof StoreQueryIn>, fx) => {
       if (!fx.operator.id) return fail("AuthFailed", {});
       const tenantFail = requireTenantIfDeclared(state, input.tenant);
@@ -2892,9 +3215,6 @@ function createStoreQuery(state: ConsoleState) {
 function createStoreReveal(state: ConsoleState) {
   return flow("console.store.reveal", {
     plane: "operator",
-    in: StoreRevealIn,
-    out: StoreRevealOut,
-    errors: { AuthFailed, TenantRequired, StoreNotFound },
     do: async (input: z.infer<typeof StoreRevealIn>, fx) => {
       if (!fx.operator.id) return fail("AuthFailed", {});
       const tenantFail = requireTenantIfDeclared(state, input.tenant);
@@ -2928,9 +3248,6 @@ function createStoreReveal(state: ConsoleState) {
 function createStoreObject(state: ConsoleState) {
   return flow("console.store.object", {
     plane: "operator",
-    in: StoreFileGetIn,
-    out: StoreFileGetOut,
-    errors: { AuthFailed, TenantRequired, StoreNotFound },
     do: async (input: z.infer<typeof StoreFileGetIn>, fx) => {
       if (!fx.operator.id) return fail("AuthFailed", {});
       const tenantFail = requireTenantIfDeclared(state, input.tenant);
@@ -2964,9 +3281,6 @@ function createStoreObject(state: ConsoleState) {
 function createStoreEdit(state: ConsoleState) {
   return flow("console.store.edit", {
     plane: "operator",
-    in: StoreEditIn,
-    out: StoreEditOut,
-    errors: { AuthFailed, TenantRequired, ConfirmRequired, StoreNotFound },
     do: async (input: z.infer<typeof StoreEditIn>, fx) => {
       if (!fx.operator.id) return fail("AuthFailed", {});
       const tenantFail = requireTenantIfDeclared(state, input.tenant);
@@ -3049,9 +3363,6 @@ function createStoreEdit(state: ConsoleState) {
 function createStoreDelete(state: ConsoleState) {
   return flow("console.store.delete", {
     plane: "operator",
-    in: StoreDeleteIn,
-    out: StoreDeleteOut,
-    errors: { AuthFailed, TenantRequired, ConfirmRequired },
     do: async (input: z.infer<typeof StoreDeleteIn>, fx) => {
       if (!fx.operator.id) return fail("AuthFailed", {});
       const tenantFail = requireTenantIfDeclared(state, input.tenant);
@@ -3089,9 +3400,6 @@ function createStoreDelete(state: ConsoleState) {
 function createStorePurgeCache(state: ConsoleState) {
   return flow("console.store.purgeCache", {
     plane: "operator",
-    in: StorePurgeIn,
-    out: StorePurgeOut,
-    errors: { AuthFailed, ConfirmRequired },
     do: async (input: z.infer<typeof StorePurgeIn>, fx) => {
       if (!fx.operator.id) return fail("AuthFailed", {});
       if (state.production) {
@@ -3121,9 +3429,6 @@ function createStorePurgeCache(state: ConsoleState) {
 function createStoreSql(state: ConsoleState) {
   return flow("console.store.sql", {
     plane: "operator",
-    in: StoreSqlIn,
-    out: StoreSqlOut,
-    errors: { AuthFailed, TenantRequired, StoreNotFound },
     do: async (input: z.infer<typeof StoreSqlIn>, fx) => {
       if (!fx.operator.id) return fail("AuthFailed", {});
       const tenantFail = requireTenantIfDeclared(state, input.tenant);
@@ -3191,16 +3496,6 @@ function failStoreSqlStats(err: unknown) {
 function createStoreSqlStats(state: ConsoleState) {
   return flow("console.store.sql.stats", {
     plane: "operator",
-    in: StoreSqlStatsIn,
-    out: StoreSqlStatsOut,
-    errors: {
-      AuthFailed,
-      TenantRequired,
-      StoreNotFound,
-      PgStatStatementsNotPreloaded,
-      PgStatStatementsUnsupported,
-      PgStatStatementsNotCreated,
-    },
     do: async (input: z.infer<typeof StoreSqlStatsIn>, fx) => {
       if (!fx.operator.id) return fail("AuthFailed", {});
       const tenantFail = requireTenantIfDeclared(state, input.tenant);
@@ -3223,16 +3518,6 @@ function createStoreSqlStats(state: ConsoleState) {
 function createStoreSqlLocks(state: ConsoleState) {
   return flow("console.store.sql.locks", {
     plane: "operator",
-    in: StoreSqlLocksIn,
-    out: StoreSqlLocksOut,
-    errors: {
-      AuthFailed,
-      TenantRequired,
-      StoreNotFound,
-      PgStatStatementsNotPreloaded,
-      PgStatStatementsUnsupported,
-      PgStatStatementsNotCreated,
-    },
     do: async (input: z.infer<typeof StoreSqlLocksIn>, fx) => {
       if (!fx.operator.id) return fail("AuthFailed", {});
       const tenantFail = requireTenantIfDeclared(state, input.tenant);
@@ -3265,16 +3550,6 @@ function createStoreSqlLocks(state: ConsoleState) {
 function createStoreSqlAdvise(state: ConsoleState) {
   return flow("console.store.sql.advise", {
     plane: "operator",
-    in: StoreSqlAdviseIn,
-    out: StoreSqlAdviseOut,
-    errors: {
-      AuthFailed,
-      TenantRequired,
-      StoreNotFound,
-      PgStatStatementsNotPreloaded,
-      PgStatStatementsUnsupported,
-      PgStatStatementsNotCreated,
-    },
     do: async (input: z.infer<typeof StoreSqlAdviseIn>, fx) => {
       if (!fx.operator.id) return fail("AuthFailed", {});
       const tenantFail = requireTenantIfDeclared(state, input.tenant);
@@ -3306,14 +3581,6 @@ function failStoreKvStats(err: unknown) {
 function createStoreKvStats(state: ConsoleState) {
   return flow("console.store.kv.stats", {
     plane: "operator",
-    in: StoreKvStatsIn,
-    out: StoreKvStatsOut,
-    errors: {
-      AuthFailed,
-      TenantRequired,
-      StoreNotFound,
-      KvStatsUnsupported,
-    },
     do: async (input: z.infer<typeof StoreKvStatsIn>, fx) => {
       if (!fx.operator.id) return fail("AuthFailed", {});
       const tenantFail = requireTenantIfDeclared(state, input.tenant);
@@ -3347,9 +3614,6 @@ function createStoreKvStats(state: ConsoleState) {
 function createStorePreview(state: ConsoleState) {
   return flow("console.store.preview", {
     plane: "operator",
-    in: StorePreviewIn,
-    out: StorePreviewOut,
-    errors: { AuthFailed, TenantRequired, DryRunUnsafe },
     do: async (input: z.infer<typeof StorePreviewIn>, fx) => {
       if (!fx.operator.id) return fail("AuthFailed", {});
       const tenantFail = requireTenantIfDeclared(state, input.tenant);
@@ -3397,8 +3661,6 @@ function createStorePreview(state: ConsoleState) {
 function createVaultList(state: ConsoleState) {
   return flow("console.vault.list", {
     plane: "operator",
-    out: VaultListOut,
-    errors: { AuthFailed },
     do: async (_input, fx) => {
       if (!fx.operator.id) return fail("AuthFailed", {});
       return state.listVault();
@@ -3409,9 +3671,6 @@ function createVaultList(state: ConsoleState) {
 function createVaultCreate(state: ConsoleState) {
   return flow("console.vault.create", {
     plane: "operator",
-    in: VaultCreateIn,
-    out: VaultWriteOut,
-    errors: { AuthFailed, VaultExists, VaultNotFound },
     do: async (input: z.infer<typeof VaultCreateIn>, fx) => {
       if (!fx.operator.id) return fail("AuthFailed", {});
       try {
@@ -3448,9 +3707,6 @@ function createVaultCreate(state: ConsoleState) {
 function createVaultSet(state: ConsoleState) {
   return flow("console.vault.set", {
     plane: "operator",
-    in: VaultWriteIn,
-    out: VaultWriteOut,
-    errors: { AuthFailed, VaultNotFound },
     do: async (input: z.infer<typeof VaultWriteIn>, fx) => {
       if (!fx.operator.id) return fail("AuthFailed", {});
       if (!(await vaultNameKnown(state, input.name))) {
@@ -3487,9 +3743,6 @@ function createVaultSet(state: ConsoleState) {
 function createVaultRotate(state: ConsoleState) {
   return flow("console.vault.rotate", {
     plane: "operator",
-    in: VaultWriteIn,
-    out: VaultWriteOut,
-    errors: { AuthFailed, VaultNotFound },
     do: async (input: z.infer<typeof VaultWriteIn>, fx) => {
       if (!fx.operator.id) return fail("AuthFailed", {});
       if (!(await vaultNameKnown(state, input.name))) {
@@ -3531,9 +3784,6 @@ function createVaultRotate(state: ConsoleState) {
 function createVaultRotateMaster(state: ConsoleState) {
   return flow("console.vault.rotateMaster", {
     plane: "operator",
-    in: VaultRotateMasterIn,
-    out: VaultRotateMasterOut,
-    errors: { AuthFailed, ConfirmRequired, VaultSealed, VaultRotateBusy, VaultUnsupported },
     do: async (input: z.infer<typeof VaultRotateMasterIn>, fx) => {
       if (!fx.operator.id) return fail("AuthFailed", {});
       if (input.confirmation !== "ROTATE_MASTER" || !input.reason || input.reason.length < 3) {
@@ -3568,8 +3818,6 @@ function createVaultRotateMaster(state: ConsoleState) {
 function createVaultAuditVerify(state: ConsoleState) {
   return flow("console.vault.auditVerify", {
     plane: "operator",
-    out: VaultAuditVerifyOut,
-    errors: { AuthFailed, VaultUnsupported },
     do: async (_input, fx) => {
       if (!fx.operator.id) return fail("AuthFailed", {});
       try {
@@ -3612,8 +3860,6 @@ async function vaultNameKnown(state: ConsoleState, name: string): Promise<boolea
 function createAiList(state: ConsoleState) {
   return flow("console.ai.list", {
     plane: "operator",
-    out: AiListOut,
-    errors: { AuthFailed },
     do: async (_input, fx) => {
       if (!fx.operator.id) return fail("AuthFailed", {});
       const projection = await state.listAi();
@@ -3668,8 +3914,6 @@ function createAiList(state: ConsoleState) {
 function createGatesList(state: ConsoleState) {
   return flow("console.gates.list", {
     plane: "operator",
-    out: GatesListOut,
-    errors: { AuthFailed },
     do: async (_input, fx) => {
       if (!fx.operator.id) return fail("AuthFailed", {});
       const projection = await state.listGates();
@@ -3732,8 +3976,6 @@ function createGatesList(state: ConsoleState) {
 function createDiffList(state: ConsoleState) {
   return flow("console.diff.list", {
     plane: "operator",
-    out: DiffListOut,
-    errors: { AuthFailed },
     do: async (_input, fx) => {
       if (!fx.operator.id) return fail("AuthFailed", {});
       const projection = await state.listDiff();
@@ -3764,8 +4006,6 @@ function createDiffList(state: ConsoleState) {
 function createPluginsList(state: ConsoleState) {
   return flow("console.plugin.list", {
     plane: "operator",
-    out: PluginsListOut,
-    errors: { AuthFailed },
     do: async (_input, fx) => {
       if (!fx.operator.id) return fail("AuthFailed", {});
       return state.listPlugins();
@@ -3776,9 +4016,6 @@ function createPluginsList(state: ConsoleState) {
 function createGatesSimulate(state: ConsoleState) {
   return flow("console.gates.simulate", {
     plane: "operator",
-    in: GatesSimulateIn,
-    out: GatesSimulateOut,
-    errors: { AuthFailed },
     do: async (input: z.infer<typeof GatesSimulateIn>, fx) => {
       if (!fx.operator.id) return fail("AuthFailed", {});
       const result = await state.simulateGates(input);
@@ -3810,9 +4047,6 @@ function createGatesSimulate(state: ConsoleState) {
 function createGatesPowers(state: ConsoleState) {
   return flow("console.gates.powers", {
     plane: "operator",
-    in: GatesPowersIn,
-    out: GatesPowersOut,
-    errors: { AuthFailed },
     do: async (input: z.infer<typeof GatesPowersIn>, fx) => {
       if (!fx.operator.id) return fail("AuthFailed", {});
       const result = await state.powersForPrincipal(input);
@@ -3881,8 +4115,6 @@ export function resolveAccessKeyIssuer(
 function createAccessList(state: ConsoleState) {
   return flow("console.access.list", {
     plane: "operator",
-    out: AccessListOut,
-    errors: { AuthFailed },
     do: async (_input, fx) => {
       if (!fx.operator.id) return fail("AuthFailed", {});
       return state.listAccess(actorScopesOf(state, fx.operator.id));
@@ -3893,9 +4125,6 @@ function createAccessList(state: ConsoleState) {
 function createAccessEffective(state: ConsoleState) {
   return flow("console.access.effective", {
     plane: "operator",
-    in: AccessEffectiveIn,
-    out: AccessEffectiveOut,
-    errors: { AuthFailed, NotFound },
     do: async (input: z.infer<typeof AccessEffectiveIn>, fx) => {
       if (!fx.operator.id) return fail("AuthFailed", {});
       const result = await state.accessEffective(input);
@@ -3918,9 +4147,6 @@ function createAccessEffective(state: ConsoleState) {
 function createAccessKeyBlast(state: ConsoleState) {
   return flow("console.access.keyBlast", {
     plane: "operator",
-    in: AccessKeyBlastIn,
-    out: AccessKeyBlastOut,
-    errors: { AuthFailed, AccessKeyNotFound },
     do: async (input: z.infer<typeof AccessKeyBlastIn>, fx) => {
       if (!fx.operator.id) return fail("AuthFailed", {});
       if (!state.apiKeys.keys.has(input.keyId)) {
@@ -3934,9 +4160,6 @@ function createAccessKeyBlast(state: ConsoleState) {
 function createAccessCreateKey(state: ConsoleState) {
   return flow("console.access.createKey", {
     plane: "operator",
-    in: AccessCreateKeyIn,
-    out: AccessCreateKeyOut,
-    errors: { AuthFailed, AccessGrantDenied },
     do: async (input: z.infer<typeof AccessCreateKeyIn>, fx) => {
       if (!fx.operator.id) return fail("AuthFailed", {});
       try {
@@ -3972,9 +4195,6 @@ function createAccessCreateKey(state: ConsoleState) {
 function createAccessRevokeKey(state: ConsoleState) {
   return flow("console.access.revokeKey", {
     plane: "operator",
-    in: AccessRevokeKeyIn,
-    out: AccessRevokeKeyOut,
-    errors: { AuthFailed, AccessKeyNotFound, ConfirmRequired },
     do: async (input: z.infer<typeof AccessRevokeKeyIn>, fx) => {
       if (!fx.operator.id) return fail("AuthFailed", {});
       if (input.confirmation !== "REVOKE" || (input.reason?.trim().length ?? 0) < 3) {
@@ -4002,9 +4222,6 @@ function createAccessRevokeKey(state: ConsoleState) {
 function createAccessRotateKey(state: ConsoleState) {
   return flow("console.access.rotateKey", {
     plane: "operator",
-    in: AccessRotateKeyIn,
-    out: AccessRotateKeyOut,
-    errors: { AuthFailed, AccessKeyNotFound, ConfirmRequired },
     do: async (input: z.infer<typeof AccessRotateKeyIn>, fx) => {
       if (!fx.operator.id) return fail("AuthFailed", {});
       if (input.confirmation !== "ROTATE" || (input.reason?.trim().length ?? 0) < 3) {
@@ -4035,9 +4252,6 @@ function createAccessRotateKey(state: ConsoleState) {
 function createAccessUpdateKey(state: ConsoleState) {
   return flow("console.access.updateKey", {
     plane: "operator",
-    in: AccessUpdateKeyIn,
-    out: AccessUpdateKeyOut,
-    errors: { AuthFailed, AccessKeyNotFound, AccessGrantDenied },
     do: async (input: z.infer<typeof AccessUpdateKeyIn>, fx) => {
       if (!fx.operator.id) return fail("AuthFailed", {});
       try {
@@ -4062,9 +4276,6 @@ function createAccessUpdateKey(state: ConsoleState) {
 function createAccessSetRoleGrants(state: ConsoleState) {
   return flow("console.access.setRoleGrants", {
     plane: "operator",
-    in: AccessSetRoleGrantsIn,
-    out: AccessSetRoleGrantsOut,
-    errors: { AuthFailed, AccessGrantDenied },
     do: async (input: z.infer<typeof AccessSetRoleGrantsIn>, fx) => {
       if (!fx.operator.id) return fail("AuthFailed", {});
       try {
@@ -4091,8 +4302,6 @@ function createAccessSetRoleGrants(state: ConsoleState) {
 function createClockList(state: ConsoleState) {
   return flow("console.clock.list", {
     plane: "operator",
-    out: ClockListOut,
-    errors: { AuthFailed },
     do: async (_input, fx) => {
       if (!fx.operator.id) return fail("AuthFailed", {});
       return state.listClocks();
@@ -4103,8 +4312,6 @@ function createClockList(state: ConsoleState) {
 function createInstancesList(state: ConsoleState) {
   return flow("console.instances.list", {
     plane: "operator",
-    out: InstancesListOut,
-    errors: { AuthFailed },
     do: async (_input, fx) => {
       if (!fx.operator.id) return fail("AuthFailed", {});
       return state.listInstances();
@@ -4115,9 +4322,6 @@ function createInstancesList(state: ConsoleState) {
 function createClockRunNow(state: ConsoleState) {
   return flow("console.clock.runNow", {
     plane: "operator",
-    in: ClockRunNowIn,
-    out: ClockRunNowOut,
-    errors: { AuthFailed, ClockNotFound, ConfirmRequired },
     do: async (input: z.infer<typeof ClockRunNowIn>, fx) => {
       if (!fx.operator.id) return fail("AuthFailed", {});
       const list = await state.listClocks();
@@ -4160,9 +4364,6 @@ function createClockRunNow(state: ConsoleState) {
 function createClockPause(state: ConsoleState) {
   return flow("console.clock.pause", {
     plane: "operator",
-    in: ClockPauseIn,
-    out: ClockPauseOut,
-    errors: { AuthFailed, ClockNotFound },
     do: async (input: z.infer<typeof ClockPauseIn>, fx) => {
       if (!fx.operator.id) return fail("AuthFailed", {});
       try {
@@ -4190,9 +4391,6 @@ function createClockPause(state: ConsoleState) {
 function createClockEditSchedule(state: ConsoleState) {
   return flow("console.clock.editSchedule", {
     plane: "operator",
-    in: ClockEditIn,
-    out: ClockEditOut,
-    errors: { AuthFailed, ClockNotFound, ScheduleNotOverridable },
     do: async (input: z.infer<typeof ClockEditIn>, fx) => {
       if (!fx.operator.id) return fail("AuthFailed", {});
       try {
@@ -4228,9 +4426,6 @@ function createClockEditSchedule(state: ConsoleState) {
 function createClockWakeEarly(state: ConsoleState) {
   return flow("console.clock.wakeEarly", {
     plane: "operator",
-    in: ClockWakeEarlyIn,
-    out: ClockWakeEarlyOut,
-    errors: { AuthFailed, ClockNotFound },
     do: async (input: z.infer<typeof ClockWakeEarlyIn>, fx) => {
       if (!fx.operator.id) return fail("AuthFailed", {});
       try {
@@ -4260,8 +4455,6 @@ function createClockWakeEarly(state: ConsoleState) {
 function createChannelsList(state: ConsoleState) {
   return flow("console.channel.list", {
     plane: "operator",
-    out: ChannelsListOut,
-    errors: { AuthFailed },
     do: async (_input, fx) => {
       if (!fx.operator.id) return fail("AuthFailed", {});
       return state.listChannels();
@@ -4272,9 +4465,6 @@ function createChannelsList(state: ConsoleState) {
 function createChannelPreview(state: ConsoleState) {
   return flow("console.channel.preview", {
     plane: "operator",
-    in: ChannelPreviewIn,
-    out: ChannelPreviewOut,
-    errors: { AuthFailed, ChannelNotFound },
     do: async (input: z.infer<typeof ChannelPreviewIn>, fx) => {
       if (!fx.operator.id) return fail("AuthFailed", {});
       if (
@@ -4292,9 +4482,6 @@ function createChannelPreview(state: ConsoleState) {
 function createChannelVerifyAuth(state: ConsoleState) {
   return flow("console.channel.verifyAuth", {
     plane: "operator",
-    in: ChannelVerifyAuthIn,
-    out: ChannelVerifyAuthOut,
-    errors: { AuthFailed },
     do: async (input: z.infer<typeof ChannelVerifyAuthIn>, fx) => {
       if (!fx.operator.id) return fail("AuthFailed", {});
       return state.verifyChannelAuth(input.from);
@@ -4305,9 +4492,6 @@ function createChannelVerifyAuth(state: ConsoleState) {
 function createChannelReveal(state: ConsoleState) {
   return flow("console.channel.reveal", {
     plane: "operator",
-    in: ChannelRevealIn,
-    out: ChannelRevealOut,
-    errors: { AuthFailed, ChannelNotFound },
     do: async (input: z.infer<typeof ChannelRevealIn>, fx) => {
       if (!fx.operator.id) return fail("AuthFailed", {});
       const revealed = await state.revealChannel(input.id);
@@ -4331,9 +4515,6 @@ function createChannelReveal(state: ConsoleState) {
 function createChannelSendTest(state: ConsoleState) {
   return flow("console.channel.sendTest", {
     plane: "operator",
-    in: ChannelSendTestIn,
-    out: ChannelSendTestOut,
-    errors: { AuthFailed, ChannelNotFound, ConfirmRequired },
     do: async (input: z.infer<typeof ChannelSendTestIn>, fx) => {
       if (!fx.operator.id) return fail("AuthFailed", {});
       if (state.production) {