diff --git a/CHANGELOG b/CHANGELOG
index 40c0f07f..101c71d6 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -14,20 +14,28 @@ it into an Android APK. The same source becomes both.
   - `src/feldspar/` is generated on every build: the typed client, `hooks.ts` (the React scaffold's
     `useX` / `useCreateX` / `useUpdateX` / `useDeleteX` hooks) and `config.ts`.
   - The web bundle comes from `expo export --platform web`.
-  - The APK comes from `expo prebuild` plus `./gradlew assembleRelease`.
-  - The Android package is `com.feldspar.<subdomain>`.
+  - The APK comes from `expo prebuild` plus Gradle, as a release or a debug build; both carry
+    their JavaScript, and native code for 64-bit devices only (`arm64-v8a`, `x86_64`).
+- **Android app settings** ("Android app" card in the application form): app ID, version, icon,
+  release or debug, and APK or AAB. Release builds can be signed with your own keystore (the
+  password is a secret, never written into the project); **Generate a keystore** creates one in
+  the file store. Bad values fail only the Android build.
 - **CSP**: React's policy plus `style-src 'unsafe-inline'`, because react-native-web's
   `StyleSheet` writes a `<style>` element at run time without a nonce. `script-src` stays strict.
 - **Build targets (generic)**: a declared framework can offer builds that produce a file (rather
   than a bundle to serve) next to its web bundle:
-  `targets: { android: { label, command, artifact, env, requires } }`.
-  - `artifact` is a path template over the framework's settings.
-  - `env` holds extra environment variables for the build; a blank value falls back to the
-    server's own.
-  - `requires` lists what the machine needs: an environment variable (optionally an existing
-    directory), a command on `PATH`, or an operating system, each with a hint on how to fix it.
-    Unmet requirements are shown on the target's button and refuse the build before anything runs.
+  `targets: { android: { label, command, artifact, env, requires, options, operations } }`.
+  - `command`, `artifact` and `env` are templates over the framework's settings; a blank `env`
+    value falls back to the server's own.
+  - `options` are the target's own settings, shown in a card of their own in the form.
+  - `operations` are buttons under those settings that run the module's code; the server
+    writes the files it returns into the store and saves the settings.
+  - `requires` lists what the machine needs (an environment variable or directory, a command, an
+    operating system), checked before a build starts and shown on its button.
   - A malformed declaration is refused when the module loads.
+- **Settings**: a setting can be shown conditionally (v1's `showIf`) or pick a file of given
+  types from the app's store. An application's secret settings are masked in the admin API and
+  kept on save.
 - **Target builds run as background jobs**: `POST /api/applications/{id}/targets/{target}/build`
   starts a build and answers at once; `GET` on the same path reports `running`, `succeeded` (with
   artifact and size) or `failed`.
@@ -37,7 +45,7 @@ it into an Android APK. The same source becomes both.
     lock; Gradle runs outside it.
   - The log is written as the build runs to `<project>/build-logs/<target>-<timestamp>.log`, and
     the last 10 per target are kept.
-  - The admin sidebar has a **Build Android APK** button under Build. It polls until the build is
+  - The admin sidebar has a **Build Android app** button under Build. It polls until the build is
     done, picks up a build still running after a reload, and its toast names the APK and the log.
 - **Android toolchain**: `ANDROID_HOME` and `JAVA_HOME` are the module's own settings
   (Settings → Modules → React Native), passed to the APK build. The shell that started the server
@@ -61,6 +69,11 @@ it into an Android APK. The same source becomes both.
     anonymous.
 - Known gaps are listed in TODO.md (RN.6–RN.12).
 
+## Fix: the file manager downloads large files
+
+Download now links to a new route, `GET /download/{store}/{*path}`, which serves the file as
+is, instead of loading it as base64 inside JSON, which failed for files as large as an APK.
+
 ## Fix: Reinstall picks up an edited local or bundled module
 
 npm kept the copy it had made earlier (`--install-links`) because the name and version were
diff --git a/Cargo.lock b/Cargo.lock
index 19332cf6..38fe0f1c 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -8763,6 +8763,7 @@ name = "sc-module"
 version = "0.1.0"
 dependencies = [
  "async-trait",
+ "base64 0.22.1",
  "deno_core",
  "deno_error",
  "deno_path_util",
diff --git a/TODO.md b/TODO.md
index c77ccd05..f201c041 100644
--- a/TODO.md
+++ b/TODO.md
@@ -806,6 +806,13 @@ Outside the analytics milestones. See CHANGELOG for what each item covers.
 - [ ] RN.12 A build dropped while the server runs (a future "cancel build", or a server killed
       on its own) kills only `npm`, not the `sh` / `gradlew` / Gradle under it: run the command
       in its own process group and kill the group.
+- [x] RN.13 The APK's own settings (application ID, version, icon from the app's file store,
+      debug or release) as a target's `options`, shown in the application form under the target.
+- [x] RN.14 Release signing with the admin's own keystore (file from the store, alias, password
+      as a secret), shown only for a release build once "Sign with your own keystore" is ticked.
+- [x] RN.15 "Generate a keystore": a target operation that makes one in the file store and fills
+      in the signing settings; warns when the store is a git repository.
+- [ ] RN.16 Keep secrets such as a generated keystore out of a git file store's commits.
 
 # Not in a milestone yet
 
diff --git a/crates/sc-api/src/admin.rs b/crates/sc-api/src/admin.rs
index 7af80e0b..d1fb2167 100644
--- a/crates/sc-api/src/admin.rs
+++ b/crates/sc-api/src/admin.rs
@@ -1441,6 +1441,28 @@ pub fn admin_endpoints() -> EndpointSet {
         .auth(AuthRequirement::admin()),
     );
 
+    // The files of a kind in a store, by path — what a setting that names a file
+    // (`store_files:png,jpg`, an app icon or a keystore) offers as its choices.
+    // Dependency and generated directories are skipped, so a project's
+    // `node_modules` does not bury the one icon the admin is looking for.
+    set.register(
+        Endpoint::new(
+            "listStoreFiles",
+            Method::Get,
+            api()
+                .lit("file-stores")
+                .param("store", ValueType::Text)
+                .lit("files-by-type"),
+        )
+        // Comma-separated, without dots: `png,jpg,jpeg`.
+        .query([QueryParam::new("extensions", ValueType::Text)])
+        .output(TypeSchema::struct_of([
+            StructField::new("paths", TypeSchema::array(TypeSchema::text())),
+            StructField::new("truncated", TypeSchema::bool()),
+        ]))
+        .auth(AuthRequirement::admin()),
+    );
+
     // Search a store's text files, server-side. This is the endpoint the IDE's
     // find-in-files runs on (§12.1): walking the tree through the filesystem
     // provider is one request per directory, and the same walk done where the
@@ -1748,6 +1770,41 @@ pub fn admin_endpoints() -> EndpointSet {
         .auth(AuthRequirement::admin()),
     );
 
+    // Run an operation a target declares — what a button under the target's
+    // settings does, such as generating a signing keystore. The module makes the
+    // files and settings; the server writes the files into the application's
+    // store (never over an existing one) and saves the settings on it. The body
+    // is the form's current framework settings, unsaved edits included, so the
+    // module sees what the admin sees.
+    set.register(
+        Endpoint::new(
+            "runApplicationTargetOperation",
+            Method::Post,
+            api()
+                .lit("applications")
+                .param("id", ValueType::Uuid)
+                .lit("targets")
+                .param("target", ValueType::Text)
+                .lit("operations")
+                .param("operation", ValueType::Text),
+        )
+        .input(TypeSchema::struct_of([StructField::new(
+            "config",
+            TypeSchema::json(),
+        )]))
+        .output(TypeSchema::struct_of([
+            StructField::new("message", TypeSchema::text()),
+            StructField::new("store", TypeSchema::text()),
+            StructField::new("files", TypeSchema::array(TypeSchema::text())),
+            // Whether the store is a git repository, whose next commit would
+            // carry the files.
+            StructField::new("git_repo", TypeSchema::bool()),
+            // The settings it set, as now stored, secrets masked.
+            StructField::new("settings", TypeSchema::json()),
+        ]))
+        .auth(AuthRequirement::admin()),
+    );
+
     // The latest build of a target, running or finished — what the UI polls, and
     // what it asks after a reload to find a build still running. A 404 when this
     // process has not built that target since it started.
@@ -5627,6 +5684,46 @@ fn framework_info_schema() -> TypeSchema {
         // because on those pickers it offers to create a local store rather
         // than making the admin leave the form to define one first.
         StructField::new("file_store_settings", TypeSchema::array(TypeSchema::text())),
+        // The settings whose value is a file in the application's store (an
+        // app icon, a keystore), each with the extensions it accepts: the form
+        // fills their choices from `listStoreFiles` for the store the
+        // application names.
+        StructField::new(
+            "file_settings",
+            TypeSchema::array(TypeSchema::struct_of([
+                StructField::new("name", TypeSchema::text()),
+                StructField::new("extensions", TypeSchema::array(TypeSchema::text())),
+            ])),
+        ),
+        // The builds the framework offers beside its web bundle, each with the
+        // settings that configure it alone. Those settings are in `config_spec`
+        // too; the form shows them under their target instead of among the
+        // framework's own.
+        StructField::new(
+            "targets",
+            TypeSchema::array(TypeSchema::struct_of([
+                StructField::new("name", TypeSchema::text()),
+                StructField::new("label", TypeSchema::text()),
+                StructField::new("options", TypeSchema::array(TypeSchema::text())),
+                // What the module does for the target on request: a button
+                // each, shown while its `show_if` holds.
+                StructField::new(
+                    "operations",
+                    TypeSchema::array(TypeSchema::struct_of([
+                        StructField::new("name", TypeSchema::text()),
+                        StructField::new("label", TypeSchema::text()),
+                        StructField::new("description", TypeSchema::text()),
+                        StructField::new(
+                            "show_if",
+                            TypeSchema::array(TypeSchema::struct_of([
+                                StructField::new("name", TypeSchema::text()),
+                                StructField::new("values", TypeSchema::array(TypeSchema::json())),
+                            ])),
+                        ),
+                    ])),
+                ),
+            ])),
+        ),
     ])
 }
 
@@ -6083,6 +6180,16 @@ fn form_field_schema() -> TypeSchema {
         // The language this value is source code in (`"javascript"`), or null for
         // a setting that is not code: the form renders a code editor for it.
         StructField::new("code_language", TypeSchema::optional(TypeSchema::text())),
+        // When the setting applies: every named setting holds one of its
+        // values. Empty means always. The form hides a setting that does not
+        // apply, and the server does not require it.
+        StructField::new(
+            "show_if",
+            TypeSchema::array(TypeSchema::struct_of([
+                StructField::new("name", TypeSchema::text()),
+                StructField::new("values", TypeSchema::array(TypeSchema::json())),
+            ])),
+        ),
     ])
 }
 
diff --git a/crates/sc-app/src/build.rs b/crates/sc-app/src/build.rs
index 25bd4a80..8fc794ab 100644
--- a/crates/sc-app/src/build.rs
+++ b/crates/sc-app/src/build.rs
@@ -644,19 +644,25 @@ pub async fn build_code_framework(
 
 /// One build target an application's framework offers — what a button says and
 /// what a build request names.
-#[derive(Debug, Clone, PartialEq, Eq)]
+#[derive(Debug, Clone, PartialEq)]
 pub struct TargetInfo {
     /// The key — `android`.
     pub name: String,
     /// The label — `Android APK`.
     pub label: String,
+    /// The framework settings that configure this target alone (see
+    /// [`crate::TargetTemplate::options`]).
+    pub options: Vec<String>,
+    /// What the module can do for the target on request (see
+    /// [`crate::TargetOperation`]).
+    pub operations: Vec<crate::TargetOperation>,
 }
 
-/// The build targets `app`'s framework declares, in declaration order. Empty for
-/// the built-in frameworks, which only serve.
-pub fn app_build_targets(app: &Application) -> Vec<TargetInfo> {
+/// The build targets framework `name` declares, in declaration order. Empty for
+/// the built-in frameworks and for a name nothing declares.
+pub fn framework_build_targets(name: &str) -> Vec<TargetInfo> {
     installed_frameworks()
-        .find(&app.framework.name)
+        .find(name)
         .map(|decl| {
             decl.targets
                 .iter()
@@ -667,6 +673,8 @@ pub fn app_build_targets(app: &Application) -> Vec<TargetInfo> {
                     } else {
                         t.label.clone()
                     },
+                    options: t.options.clone(),
+                    operations: t.operations.clone(),
                 })
                 .collect()
         })
diff --git a/crates/sc-app/src/declared.rs b/crates/sc-app/src/declared.rs
index 364ac586..ffdf4539 100644
--- a/crates/sc-app/src/declared.rs
+++ b/crates/sc-app/src/declared.rs
@@ -83,35 +83,87 @@ pub struct BuildTemplate {
     pub client_file: String,
 }
 
-/// A build a framework offers **beside** its web bundle — an Android APK — before
-/// its settings are known.
+/// An extra build a framework offers next to its web build, such as an Android
+/// APK, as declared — before any application's settings are filled in.
 ///
-/// The web bundle is what an application *serves*; a target is something an
-/// application *produces*: one file, left in the file store for the admin to take
-/// away. So a target has a command and an artifact path, and no output directory
-/// to load and no mount to replace. It runs in the framework's source directory,
-/// after the same install step the web build runs.
+/// The web build produces the site the application serves. A target instead
+/// produces a single file (the artifact) that is left in the file store for the
+/// admin to download; nothing is served from it. It runs in the same project
+/// directory as the web build, after the same dependency install.
+///
+/// `sc-module` builds one per declared target when a module loads (on
+/// [`FrameworkDecl::targets`]); [`FrameworkDecl::target_spec`] fills in one
+/// application's settings to get the [`TargetSpec`] a build actually runs.
 #[derive(Debug, Clone, PartialEq)]
 pub struct TargetTemplate {
     /// The key a build request names — `android`. Unique within the framework.
     pub name: String,
     /// What the admin UI's button says — `Android APK`.
     pub label: String,
-    /// The command line, split on whitespace as the build command is.
-    pub command: String,
+    /// The command that builds the target, e.g. `npm run build:android:{{ build_type }}`.
+    ///
+    /// `{{ name }}` is replaced by the application's value for that setting
+    /// before the command runs, so a setting can choose what is built: with
+    /// `build_type` set to `debug`, the line above runs `npm run build:android:debug`.
+    /// The result is then split on spaces into the program and its arguments;
+    /// there is no quoting, so no single argument can contain a space.
+    pub command: Template,
     /// The file the command produces, relative to the store — a template over the
     /// framework's settings, as the build's `output` is.
     pub artifact: PathTemplate,
     /// Environment variables the command and its install step are started
     /// with, on top of the server's own — the toolchain a target needs on this
-    /// machine (`ANDROID_HOME`, `JAVA_HOME`). A module fills them from its own
-    /// settings, so they are adjusted on the Modules tab, not in the shell that
-    /// started the server.
-    pub env: BTreeMap<String, String>,
+    /// machine (`ANDROID_HOME`, `JAVA_HOME`), which a module fills from its own
+    /// settings, and values from the application's settings (a keystore
+    /// password), which reach the build this way rather than through a file in
+    /// the project. Templates over the framework's settings, as `artifact` is;
+    /// a value that renders blank is left out, so the server's own applies.
+    pub env: BTreeMap<String, Template>,
     /// What this machine must have before the target can build — checked before
     /// a build starts and shown beside its button, so an admin hears "the Android
     /// SDK is not configured" at once rather than from Gradle minutes later.
     pub requires: Vec<TargetRequirement>,
+    /// The names of the settings that configure this target alone — an APK's
+    /// application id, version and icon. They are part of the framework's
+    /// `config_spec` (stored, validated and handed to its generators like any
+    /// other setting); this list is what lets a form show them under the target
+    /// rather than among the framework's own.
+    pub options: Vec<String>,
+    /// What the admin can have the module **do** for this target, as buttons
+    /// beside its settings — generate a signing keystore.
+    pub operations: Vec<TargetOperation>,
+}
+
+/// One thing a module does for a target on request: a button under the
+/// target's settings, which runs the module's code with the application's
+/// settings and answers files to write into its store and settings to set.
+///
+/// Declared as data, like the rest of a target, so the form can show the button
+/// without asking the module; only running it is a call ([`FrameworkHost::call_target_operation`]).
+#[derive(Debug, Clone, PartialEq)]
+pub struct TargetOperation {
+    /// The key a request names — `generate_keystore`. Unique within the target.
+    pub name: String,
+    /// The button's text.
+    pub label: String,
+    /// A sentence beside the button saying what pressing it does. May be empty.
+    pub description: String,
+    /// When it is offered, in the vocabulary of a setting's
+    /// [`show_if`](sc_types::FormField::show_if): the keystore generator only
+    /// once "Sign with your own keystore" is ticked.
+    pub show_if: Vec<sc_types::ShowIfCondition>,
+}
+
+/// What a [`TargetOperation`] answered: files for the application's store and
+/// settings to set on it.
+#[derive(Debug, Clone, Default, PartialEq)]
+pub struct OperationAnswer {
+    /// Files to write, relative to the **store** (not the project), as bytes.
+    pub files: Vec<(String, Vec<u8>)>,
+    /// Settings to set on the application, by name.
+    pub settings: Attrs,
+    /// What to tell the admin.
+    pub message: String,
 }
 
 /// One thing a build target needs from the machine it builds on.
@@ -339,7 +391,11 @@ impl FrameworkDecl {
             let rendered = t.render_static(&bindings).map_err(|e| self.blame(e))?;
             self.safe_path(&rendered)
         };
-        let (command, args) = split_command(&target.command, &self.name)?;
+        let command = target
+            .command
+            .render_static(&bindings)
+            .map_err(|e| self.blame(e))?;
+        let (command, args) = split_command(&command, &self.name)?;
         Ok(TargetSpec {
             name: target.name.clone(),
             label: target.label.clone(),
@@ -348,11 +404,42 @@ impl FrameworkDecl {
             source_dir: render(&self.build.source)?,
             artifact: render(&target.artifact)?,
             install: self.build.install.clone(),
-            env: target.env.clone(),
+            env: self.target_env(target, &bindings)?,
             requires: target.requires.clone(),
         })
     }
 
+    /// A target's environment rendered for one application: blank values left
+    /// out, so the server's own environment applies to them.
+    ///
+    /// For example, declared as
+    /// `{ JAVA_HOME: "/opt/jdk", KEYSTORE_PASSWORD: "{{ keystore_password }}" }`:
+    /// with the password set to `s3cret`, the build gets both variables; with
+    /// it blank, only `JAVA_HOME`.
+    fn target_env(
+        &self,
+        target: &TargetTemplate,
+        bindings: &BTreeMap<String, String>,
+    ) -> Result<BTreeMap<String, String>> {
+        let mut env = BTreeMap::new();
+        for (name, template) in &target.env {
+            let value = template
+                .render_static(bindings)
+                .map_err(|e| self.blame(e))?;
+            let value = value.trim();
+            if value.contains('\0') {
+                return Err(self.blame(Error::invalid(format!(
+                    "target `{}`'s `{name}` has a NUL in it, which no process can be given",
+                    target.name
+                ))));
+            }
+            if !value.is_empty() {
+                env.insert(name.clone(), value.to_owned());
+            }
+        }
+        Ok(env)
+    }
+
     /// Where its generated runtime goes, relative to the store — or `None` for a
     /// framework that consumes no generated code.
     pub fn runtime_dir(&self, config: &Attrs) -> Result<Option<String>> {
@@ -506,6 +593,22 @@ pub trait FrameworkHost: Send + Sync {
         phase: FilePhase,
         context: Json,
     ) -> Result<Vec<DeclaredFile>>;
+
+    /// Run operation `operation` of framework `name`'s target `target` for
+    /// `context` (see [`TargetOperation`]). A host whose frameworks declare no
+    /// operations need not answer.
+    async fn call_target_operation(
+        &self,
+        name: &str,
+        target: &str,
+        operation: &str,
+        context: Json,
+    ) -> Result<OperationAnswer> {
+        let _ = context;
+        Err(Error::not_found(format!(
+            "framework `{name}`'s target `{target}` has no operation `{operation}` this host runs"
+        )))
+    }
 }
 
 /// The installed set: the declarations, and the host that generates their files.
@@ -571,6 +674,34 @@ impl FrameworkSet {
         })?;
         host.framework_files(name, phase, context).await
     }
+
+    /// Run a target's operation through the host (see [`TargetOperation`]).
+    /// Refused here, before any call, when the framework does not declare it.
+    pub async fn call_target_operation(
+        &self,
+        name: &str,
+        target: &str,
+        operation: &str,
+        context: Json,
+    ) -> Result<OperationAnswer> {
+        let declared = self
+            .find(name)
+            .and_then(|f| f.targets.iter().find(|t| t.name == target))
+            .is_some_and(|t| t.operations.iter().any(|o| o.name == operation));
+        if !declared {
+            return Err(Error::not_found(format!(
+                "framework `{name}` has no target `{target}` with an operation `{operation}`"
+            )));
+        }
+        let host = self.host.as_ref().ok_or_else(|| {
+            Error::config(format!(
+                "framework `{name}` is declared by a module, but no module host is running \
+                 to run its operations"
+            ))
+        })?;
+        host.call_target_operation(name, target, operation, context)
+            .await
+    }
 }
 
 /// The process-wide installed set.
@@ -657,9 +788,9 @@ pub(crate) mod tests {
             targets: vec![TargetTemplate {
                 name: "android".to_owned(),
                 label: "Android APK".to_owned(),
-                command: "npm run build:android".to_owned(),
+                command: template("npm run build:android"),
                 artifact: template("{{ project }}/android/app-release.apk"),
-                env: [("ANDROID_HOME".to_owned(), "/opt/sdk".to_owned())]
+                env: [("ANDROID_HOME".to_owned(), template("/opt/sdk"))]
                     .into_iter()
                     .collect(),
                 requires: vec![TargetRequirement {
@@ -669,6 +800,8 @@ pub(crate) mod tests {
                     },
                     hint: "Set the Android SDK directory.".to_owned(),
                 }],
+                options: Vec::new(),
+                operations: Vec::new(),
             }],
         }
     }
@@ -792,6 +925,32 @@ pub(crate) mod tests {
         assert_eq!(spec.artifact, "android/app-release.apk");
     }
 
+    #[test]
+    fn a_targets_command_and_artifact_follow_its_settings() {
+        let mut decl = vue_decl();
+        decl.config_spec
+            .push(FormField::new("variant", BasicType::Text).default_value(json!("release")));
+        decl.targets[0].command = template("npm run build:android:{{ variant }}");
+        decl.targets[0].artifact =
+            template("{{ project }}/apk/{{ variant }}/app-{{ variant }}.apk");
+        let spec = decl
+            .target_spec(
+                "android",
+                &config(&[("store", "apps"), ("project", "todo"), ("variant", "debug")]),
+            )
+            .unwrap();
+        assert_eq!(spec.args, ["run", "build:android:debug"]);
+        assert_eq!(spec.artifact, "todo/apk/debug/app-debug.apk");
+        // A setting left unset renders as its default.
+        let spec = decl
+            .target_spec(
+                "android",
+                &config(&[("store", "apps"), ("project", "todo")]),
+            )
+            .unwrap();
+        assert_eq!(spec.args, ["run", "build:android:release"]);
+    }
+
     #[test]
     fn an_unknown_target_names_the_ones_there_are() {
         let msg = vue_decl()
diff --git a/crates/sc-app/src/lib.rs b/crates/sc-app/src/lib.rs
index c6d28e75..d99d1d23 100644
--- a/crates/sc-app/src/lib.rs
+++ b/crates/sc-app/src/lib.rs
@@ -68,6 +68,7 @@ mod scaffold;
 mod skill;
 mod store;
 mod streams;
+mod target_ops;
 
 pub use api::{
     ApiProviderInfo, AppGraphql, api_provider_config_spec, app_client, app_client_with,
@@ -85,11 +86,11 @@ pub use applications::{
     COL_TABLES, COL_TRIGGERS, bootstrap,
 };
 pub use build::{
-    AppSource, BuildReport, TargetInfo, TargetReadiness, TargetReport, app_build_targets,
-    app_output_dir, app_source_from_config, app_source_in, app_target_readiness, app_target_spec,
-    build_app, build_application, build_application_if_changed, build_application_target,
-    build_code_framework, emit_app_client, emit_client, load_app_bundle, remove_app_dependencies,
-    remove_dependencies, require_target_ready, run_build, target_log_path,
+    AppSource, BuildReport, TargetInfo, TargetReadiness, TargetReport, app_output_dir,
+    app_source_from_config, app_source_in, app_target_readiness, app_target_spec, build_app,
+    build_application, build_application_if_changed, build_application_target,
+    build_code_framework, emit_app_client, emit_client, framework_build_targets, load_app_bundle,
+    remove_app_dependencies, remove_dependencies, require_target_ready, run_build, target_log_path,
 };
 pub use builder_agent::{
     BuilderAgentSpec, BuilderTrait, EDIT_FORMAT_AUTO, HTTP_NAME_WEB, TRAIT_CFG_APPLICATION,
@@ -102,8 +103,9 @@ pub use builder_agent::{
 };
 pub use declared::{
     BuildTemplate, DeclaredFile, FilePhase, FrameworkDecl, FrameworkHost, FrameworkSet,
-    PathTemplate, TargetRequirement, TargetRequirementKind, TargetSpec, TargetTemplate, clean_path,
-    declared_framework, install_frameworks, installed_frameworks,
+    OperationAnswer, PathTemplate, TargetOperation, TargetRequirement, TargetRequirementKind,
+    TargetSpec, TargetTemplate, clean_path, declared_framework, install_frameworks,
+    installed_frameworks,
 };
 pub use diagnostics::{Diagnostic, build_diagnostics, parse_diagnostics};
 pub use factory::{
@@ -145,3 +147,4 @@ pub use streams::{
     ExposedStream, app_streams, element_value_schema, install_stream_registry, stream_exports,
     stream_in_path, stream_registry, stream_socket_path,
 };
+pub use target_ops::{OperationOutcome, run_target_operation};
diff --git a/crates/sc-app/src/target_ops.rs b/crates/sc-app/src/target_ops.rs
new file mode 100644
index 00000000..62247eb4
--- /dev/null
+++ b/crates/sc-app/src/target_ops.rs
@@ -0,0 +1,137 @@
+//! Running a build target's **operations**: what a module does for a target on
+//! request, such as generating an Android signing keystore.
+//!
+//! The module's code decides what to make; Saltcorn decides where it may go. An
+//! operation answers files and settings, and this module writes the files into
+//! the application's file store — never over an existing one — and sets the
+//! settings on the stored application, so the two cannot drift apart: a
+//! keystore exists exactly when the settings that name it and hold its password
+//! are saved.
+
+use sc_catalog::Catalog;
+use sc_error::{Error, Result};
+use sc_types::{Attrs, merge_secrets, validate_attrs};
+use serde_json::{Value as Json, json};
+
+use crate::application::Application;
+use crate::build::app_source_from_config;
+use crate::declared::{clean_path, installed_frameworks};
+use crate::framework::framework_config_spec;
+use crate::store::save_application;
+
+/// What running an operation did.
+#[derive(Debug, Clone)]
+pub struct OperationOutcome {
+    /// What the module said, for the admin.
+    pub message: String,
+    /// The file store the files were written to.
+    pub store: String,
+    /// The files written, relative to the store.
+    pub files: Vec<String>,
+    /// Whether that store is a git repository — whose next commit would carry
+    /// the files, a keystore included.
+    pub git_repo: bool,
+    /// The names of the settings the operation set.
+    pub settings: Vec<String>,
+    /// The application as saved with them.
+    pub app: Application,
+}
+
+/// Run operation `operation` of `app`'s framework's target `target`.
+///
+/// `form_settings` is the application form's current framework settings, unsaved
+/// edits included, with any secret the form holds only as the mask restored
+/// from what is stored: the module sees what the admin sees (a password typed
+/// but not yet saved), and its answer is applied to the **stored** settings, so
+/// the admin's other unsaved edits stay theirs to save or discard.
+///
+/// Refused before anything is written when the operation answers a setting
+/// that is not one of the target's, or a file that climbs out of the store or
+/// already exists — a keystore that is replaced is an app that can no longer
+/// be updated.
+pub async fn run_target_operation(
+    cat: &Catalog,
+    app: &Application,
+    target: &str,
+    operation: &str,
+    form_settings: &Attrs,
+) -> Result<OperationOutcome> {
+    let framework = &app.framework.name;
+    let set = installed_frameworks();
+    let decl = set.find(framework).ok_or_else(|| {
+        Error::not_found(format!("framework `{framework}` declares no build targets"))
+    })?;
+    let options = decl
+        .targets
+        .iter()
+        .find(|t| t.name == target)
+        .map(|t| t.options.clone())
+        .unwrap_or_default();
+    let spec = framework_config_spec(framework)?;
+    let settings = merge_secrets(&spec, &app.framework.config, form_settings);
+
+    let source = app_source_from_config(&app.framework)?;
+    let store = cat.require_file_store(&source.store.0)?;
+    let context = json!({
+        "app": {
+            "name": app.name,
+            "subdomain": app.subdomain.trim(),
+        },
+        "project": source.build.source_dir,
+        "settings": Json::Object(settings),
+    });
+    let answer = set
+        .call_target_operation(framework, target, operation, context)
+        .await?;
+
+    // The settings first: a stray one would be refused by the save anyway, but
+    // only after the files were written.
+    if let Some(name) = answer.settings.keys().find(|k| !options.contains(k)) {
+        return Err(Error::config(format!(
+            "operation `{operation}` of target `{target}` answered the setting `{name}`, \
+             which is not one of the target's own ({})",
+            options.join(", ")
+        )));
+    }
+    let mut files = Vec::new();
+    for (path, _) in &answer.files {
+        let clean = clean_path(path);
+        if clean.is_empty() || clean.split('/').any(|s| s == "..") {
+            return Err(Error::config(format!(
+                "operation `{operation}` answered a file at `{path}`, which is not a path \
+                 inside the file store"
+            )));
+        }
+        if store.stat(&clean).await?.is_some() {
+            return Err(Error::invalid(format!(
+                "`{clean}` already exists in file store `{}` and was not replaced; if it is \
+                 a key an app is already signed with, replacing it would stop that app from \
+                 being updated. Delete or rename it first to make a new one.",
+                source.store.0
+            )));
+        }
+        files.push(clean);
+    }
+
+    let mut updated = app.clone();
+    for (name, value) in &answer.settings {
+        updated.framework.config.insert(name.clone(), value.clone());
+    }
+    validate_attrs(&spec, &updated.framework.config)?;
+    // Save first, then write. A failed save then writes nothing, so a
+    // generated password is never lost behind a keystore nobody can open; a
+    // failed write leaves settings naming a missing file, and running the
+    // operation again simply makes it.
+    let saved = save_application(cat, &updated).await?;
+    for ((_, bytes), path) in answer.files.iter().zip(&files) {
+        store.write(path, bytes.clone().into()).await?;
+    }
+    Ok(OperationOutcome {
+        message: answer.message,
+        store: source.store.0.clone(),
+        files,
+        git_repo: store.is_git_repo(),
+        settings: answer.settings.keys().cloned().collect(),
+        app: saved,
+    })
+}
diff --git a/crates/sc-catalog/src/file_stores.rs b/crates/sc-catalog/src/file_stores.rs
index 9cb1ae89..eb3ee61f 100644
--- a/crates/sc-catalog/src/file_stores.rs
+++ b/crates/sc-catalog/src/file_stores.rs
@@ -336,6 +336,18 @@ pub async fn connect_all_file_stores(catalog: &Catalog) -> Result<FileStoreConne
 /// different languages.
 pub const QUERY_FILE_STORES: &str = "file_stores";
 
+/// The prefix of a [`ServerQuery`](sc_types::OptionsSource::ServerQuery) whose
+/// setting names a **file of a kind** in the application's own file store, as
+/// a path relative to that store: `store_files:png,jpg,jpeg` is an app icon,
+/// `store_files:jks,keystore,p12` a keystore.
+///
+/// Not answered by [`resolve_options`]: the files are a property of whichever
+/// store the application's store setting names, which the form knows and a
+/// framework's spec does not. The spec says which settings ask and for what
+/// ([`store_file_settings`]); the form fills them from `listStoreFiles`. On save
+/// the value is unrestricted, as for any query this server does not resolve.
+pub const QUERY_STORE_FILES: &str = "store_files:";
+
 /// The value a setting answered by [`QUERY_FILE_STORES`] carries to mean "no
 /// store yet — create a local one for me", in place of a store's name.
 ///
@@ -360,6 +372,35 @@ pub fn file_store_settings(spec: &[FormField]) -> Vec<String> {
         .collect()
 }
 
+/// A setting that picks a file from the application's store (an app icon, a
+/// keystore), and the file extensions it accepts.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct StoreFileSetting {
+    /// The setting's name — `app_icon`.
+    pub name: String,
+    /// The extensions it accepts, lowercase and without the dot — `png`, `jpg`.
+    pub extensions: Vec<String>,
+}
+
+/// The settings in `spec` whose value is a file in the application's store
+/// ([`QUERY_STORE_FILES`]). Read off the unresolved spec, as
+/// [`file_store_settings`] is.
+pub fn store_file_settings(spec: &[FormField]) -> Vec<StoreFileSetting> {
+    spec.iter()
+        .filter_map(|field| {
+            let extensions = field.query()?.strip_prefix(QUERY_STORE_FILES)?;
+            Some(StoreFileSetting {
+                name: field.base.name.clone(),
+                extensions: extensions
+                    .split(',')
+                    .map(|e| e.trim().trim_start_matches('.').to_lowercase())
+                    .filter(|e| !e.is_empty())
+                    .collect(),
+            })
+        })
+        .collect()
+}
+
 /// A store name that is not in `taken`: `base` itself when it is free, otherwise
 /// `base` with the first of 1, 2, 3, … appended that makes it free.
 ///
diff --git a/crates/sc-catalog/src/lib.rs b/crates/sc-catalog/src/lib.rs
index 61c0554b..49cc0a3f 100644
--- a/crates/sc-catalog/src/lib.rs
+++ b/crates/sc-catalog/src/lib.rs
@@ -69,10 +69,11 @@ pub use field_meta::{
 };
 pub use file_stores::{
     FILE_STORES_TABLE, FileStoreConnections, NEW_LOCAL_FILE_STORE, QUERY_FILE_STORES,
-    bootstrap_file_stores, check_file_store_saveable, choosable_file_stores,
-    connect_all_file_stores, connect_file_store_def, delete_file_store,
+    QUERY_STORE_FILES, StoreFileSetting, bootstrap_file_stores, check_file_store_saveable,
+    choosable_file_stores, connect_all_file_stores, connect_file_store_def, delete_file_store,
     file_store_field_references, file_store_settings, list_file_stores, load_file_store,
-    load_file_store_by_name, resolve_options, save_file_store, unique_file_store_name,
+    load_file_store_by_name, resolve_options, save_file_store, store_file_settings,
+    unique_file_store_name,
 };
 pub use model_host::{ModelHost, ModelSummary, PredictRows, check_model_calls};
 pub use observer::{ReprojectedApp, SchemaChanged, SchemaObserver};
diff --git a/crates/sc-files/src/lib.rs b/crates/sc-files/src/lib.rs
index 9f178acb..bd6020ad 100644
--- a/crates/sc-files/src/lib.rs
+++ b/crates/sc-files/src/lib.rs
@@ -49,8 +49,8 @@ pub use paths::{DATA_DIR_ENV, data_dir, local_store_dir, suggest_local_dir};
 pub use reference::{mime_for_path, validate_file_path};
 pub use search::{
     DEFAULT_EXCLUDED_DIRS, DEFAULT_MAX_FOUND, DEFAULT_MAX_RESULTS, FoundFiles, MAX_FILE_BYTES,
-    MAX_FILES_SCANNED, MAX_LINE_CHARS, SearchHit, SearchOutcome, SearchQuery, find_files,
-    glob_matches, search_store, walk_store,
+    MAX_FILES_SCANNED, MAX_LINE_CHARS, SearchHit, SearchOutcome, SearchQuery, find_by_extension,
+    find_files, glob_matches, search_store, walk_store,
 };
 pub use store::{Entry, FileMeta, FileStat, FileStore};
 
diff --git a/crates/sc-files/src/search.rs b/crates/sc-files/src/search.rs
index bc372fbc..dc7e30f7 100644
--- a/crates/sc-files/src/search.rs
+++ b/crates/sc-files/src/search.rs
@@ -562,6 +562,55 @@ pub async fn find_files(
     Ok(found)
 }
 
+// --- finding files by type --------------------------------------------------
+
+/// Directories [`find_by_extension`] does not descend into, on top of
+/// [`DEFAULT_EXCLUDED_DIRS`]: the native projects mobile tooling writes (Expo,
+/// Capacitor and Cordova all use these names), which hold dozens of generated
+/// launcher icons and a debug keystore that are copies, not sources.
+const GENERATED_PROJECT_DIRS: [&str; 2] = ["android", "ios"];
+
+/// The files under `dir` the caller may see whose extension is one of
+/// `extensions` (any case, without the dot), in path order — the choices for a
+/// setting that names a file of a kind, such as an app icon or a keystore.
+///
+/// Dependency and generated directories are skipped ([`DEFAULT_EXCLUDED_DIRS`]
+/// and [`GENERATED_PROJECT_DIRS`]): a project's `node_modules` holds thousands
+/// of images and none of them is the app's.
+pub async fn find_by_extension(
+    store: &dyn FileStore,
+    store_min_role: Option<u8>,
+    role: u8,
+    dir: &str,
+    extensions: &[String],
+) -> Result<FoundFiles> {
+    let excluded: Vec<&str> = DEFAULT_EXCLUDED_DIRS
+        .iter()
+        .chain(GENERATED_PROJECT_DIRS.iter())
+        .copied()
+        .collect();
+    let walked = walk_store(store, store_min_role, role, dir, &excluded).await?;
+    let mut entries: Vec<Entry> = walked
+        .entries
+        .into_iter()
+        .filter(|e| !e.is_dir && has_extension(&e.name, extensions))
+        .collect();
+    entries.sort_by(|a, b| a.path.cmp(&b.path));
+    Ok(FoundFiles {
+        entries,
+        truncated: walked.truncated,
+    })
+}
+
+/// Whether a file name ends in one of `extensions`, in any case.
+fn has_extension(name: &str, extensions: &[String]) -> bool {
+    name.rsplit_once('.').is_some_and(|(_, ext)| {
+        extensions
+            .iter()
+            .any(|known| ext.eq_ignore_ascii_case(known.trim_start_matches('.')))
+    })
+}
+
 // --- walking the visible tree ------------------------------------------------
 
 /// Every entry under `dir` the caller may see, files and directories, depth
diff --git a/crates/sc-module/Cargo.toml b/crates/sc-module/Cargo.toml
index d3e28816..e8b87455 100644
--- a/crates/sc-module/Cargo.toml
+++ b/crates/sc-module/Cargo.toml
@@ -36,6 +36,9 @@ deno-host = [
 ]
 
 [dependencies]
+# A target operation's files arrive base64-encoded, since a keystore is bytes
+# and a module's answer crosses from its JavaScript into Rust as JSON text.
+base64.workspace = true
 sc-error.workspace = true
 sc-log.workspace = true
 # `FormField` for a module action's declared configuration, translated from v1's
diff --git a/crates/sc-module/src/deno/mod.rs b/crates/sc-module/src/deno/mod.rs
index 20faa639..353500dc 100644
--- a/crates/sc-module/src/deno/mod.rs
+++ b/crates/sc-module/src/deno/mod.rs
@@ -767,6 +767,33 @@ impl DenoModuleHost {
         .map_err(|e| denial(module, e))
     }
 
+    /// Run an operation of one of a module's frameworks' build targets, routed
+    /// to the module's worker as its generators are.
+    pub async fn call_target_operation(
+        &self,
+        module: &str,
+        framework: &str,
+        target: &str,
+        operation: &str,
+        context: &Json,
+    ) -> Result<Json> {
+        let index = self.worker_for(module).await;
+        self.send(
+            index,
+            json!({
+                "op": "call_target_operation",
+                "module": module,
+                "framework": framework,
+                "target": target,
+                "operation": operation,
+                "context": context,
+            }),
+            None,
+        )
+        .await
+        .map_err(|e| denial(module, e))
+    }
+
     /// **Predict** with one, over a frame of any height.
     pub async fn model_predict(
         &self,
diff --git a/crates/sc-module/src/frameworks.rs b/crates/sc-module/src/frameworks.rs
index 46602be2..dac7a46f 100644
--- a/crates/sc-module/src/frameworks.rs
+++ b/crates/sc-module/src/frameworks.rs
@@ -53,7 +53,7 @@ use std::sync::Arc;
 use async_trait::async_trait;
 use sc_app::{
     BuildTemplate, CspPolicy, DeclaredFile, FilePhase, FrameworkDecl, FrameworkHost, InstallSpec,
-    TargetRequirement, TargetRequirementKind, TargetTemplate,
+    OperationAnswer, TargetOperation, TargetRequirement, TargetRequirementKind, TargetTemplate,
 };
 use sc_error::{Error, Result};
 use sc_expr::Template;
@@ -61,7 +61,7 @@ use serde_json::Value as Json;
 
 use crate::host::{FrameworkManifest, ModuleHost};
 use crate::modules::ModuleSet;
-use crate::spec::config_fields_to_form_fields;
+use crate::spec::{config_fields_to_form_fields, show_if_conditions};
 
 /// The frameworks this server's JavaScript modules supply, over the pool they
 /// run on.
@@ -183,6 +183,66 @@ impl FrameworkHost for ModuleFrameworks {
             .map(|file| declared_file(file, name, &module, phase))
             .collect()
     }
+
+    async fn call_target_operation(
+        &self,
+        name: &str,
+        target: &str,
+        operation: &str,
+        context: Json,
+    ) -> Result<OperationAnswer> {
+        let module = self.require(name)?.to_owned();
+        let answer = self
+            .host
+            .call_target_operation(&module, name, target, operation, &context)
+            .await?;
+        operation_answer(&answer, operation, &module)
+    }
+}
+
+/// An operation's answer, `{ files: [{ path, base64 }], settings, message }`,
+/// checked rather than trusted, as a generated file is ([`declared_file`]): it
+/// is whatever the module's JavaScript returned.
+fn operation_answer(answer: &Json, operation: &str, module: &str) -> Result<OperationAnswer> {
+    use base64::Engine as _;
+    let bad = |what: String| {
+        Error::config(format!(
+            "operation `{operation}` of module {module} answered {what}"
+        ))
+    };
+    let mut out = OperationAnswer {
+        message: answer
+            .get("message")
+            .and_then(Json::as_str)
+            .unwrap_or("")
+            .to_owned(),
+        ..OperationAnswer::default()
+    };
+    match answer.get("settings") {
+        None | Some(Json::Null) => {}
+        Some(Json::Object(settings)) => out.settings = settings.clone(),
+        Some(other) => return Err(bad(format!("settings that are not an object: {other}"))),
+    }
+    let files = match answer.get("files") {
+        None | Some(Json::Null) => Vec::new(),
+        Some(Json::Array(files)) => files.clone(),
+        Some(other) => return Err(bad(format!("files that are not a list: {other}"))),
+    };
+    for file in &files {
+        let path = file
+            .get("path")
+            .and_then(Json::as_str)
+            .map(str::trim)
+            .filter(|p| !p.is_empty())
+            .ok_or_else(|| bad("a file with no path".to_owned()))?;
+        let bytes = file
+            .get("base64")
+            .and_then(Json::as_str)
+            .and_then(|b| base64::engine::general_purpose::STANDARD.decode(b).ok())
+            .ok_or_else(|| bad(format!("the file `{path}` without base64 contents")))?;
+        out.files.push((path.to_owned(), bytes));
+    }
+    Ok(out)
 }
 
 /// One `{ path, contents }` answer.
@@ -233,14 +293,15 @@ fn declaration(manifest: &FrameworkManifest, module: &str) -> Result<FrameworkDe
     // the module's, the loader records them on its card, and reporting them again
     // on every application form would put a module's problem in front of an admin
     // creating an unrelated app.
-    let (config_spec, _) =
+    let (mut config_spec, _) =
         config_fields_to_form_fields(&manifest.config_fields, &format!("the framework `{name}`"));
+    let options = target_options(&manifest.targets, &mut config_spec, name)?;
     Ok(FrameworkDecl {
         name: name.to_owned(),
         module: module.to_owned(),
         label: manifest.label.trim().to_owned(),
         description: manifest.description.trim().to_owned(),
-        targets: targets(&manifest.targets, &config_spec)?,
+        targets: targets(&manifest.targets, &config_spec, &options)?,
         build: build_template(&manifest.build, &config_spec)?,
         config_spec,
         csp: csp(&manifest.csp),
@@ -289,7 +350,11 @@ fn checks(declared: &[String]) -> Result<Vec<String>> {
 /// Refused whole when one target is malformed, for the reason a bad `build` is:
 /// the author hears about it on the module's card when it loads, not the admin
 /// when they press the button.
-fn targets(declared: &Json, spec: &[sc_types::FormField]) -> Result<Vec<TargetTemplate>> {
+fn targets(
+    declared: &Json,
+    spec: &[sc_types::FormField],
+    options: &BTreeMap<String, Vec<String>>,
+) -> Result<Vec<TargetTemplate>> {
     let Json::Object(entries) = declared else {
         return Ok(Vec::new());
     };
@@ -309,22 +374,140 @@ fn targets(declared: &Json, spec: &[sc_types::FormField]) -> Result<Vec<TargetTe
         out.push(TargetTemplate {
             name: name.clone(),
             label: text("label").unwrap_or(name).to_owned(),
-            command: command.to_owned(),
+            command: settings_template(command, spec, &format!("target `{name}`'s `command`"))?,
             artifact: settings_template(
                 artifact_source,
                 spec,
                 &format!("target `{name}`'s `artifact`"),
             )?,
-            env: target_env(name, target.get("env"))?,
+            env: target_env(name, target.get("env"), spec)?,
             requires: target_requires(name, target.get("requires"))?,
+            options: options.get(name).cloned().unwrap_or_default(),
+            operations: parse_target_operations(name, target.get("operations"))?,
         });
     }
     Ok(out)
 }
 
+/// Read a target's buttons — its `operations` — from the module's declaration.
+///
+/// In the plugin, an operation looks like this:
+///
+/// ```js
+/// operations: {
+///   generate_keystore: {
+///     label: "Generate a keystore",           // the button's text (required)
+///     description: "Creates a new key …",     // shown under the button
+///     showIf: { own_keystore: true },         // when the button is shown
+///     run: generateKeystore,                  // what pressing it does
+///   },
+/// }
+/// ```
+///
+/// Everything except `run` is read here, once, when the module loads, so the
+/// form can show the button without asking the module. `run` is a function, so
+/// it stays inside the module, where it is called when the button is pressed.
+///
+/// No `operations` means no buttons. A malformed one — not an object, or a
+/// button without a label — is refused when the module loads, so its author
+/// sees the mistake on the module's card rather than an admin seeing a broken
+/// button.
+fn parse_target_operations(target: &str, declared: Option<&Json>) -> Result<Vec<TargetOperation>> {
+    let entries = match declared {
+        None | Some(Json::Null) => return Ok(Vec::new()),
+        Some(Json::Object(by_name)) => by_name,
+        Some(_) => {
+            return Err(Error::invalid(format!(
+                "its target `{target}`'s `operations` is not an object of operations by name"
+            )));
+        }
+    };
+    let mut out = Vec::new();
+    for (name, operation) in entries {
+        let text = |key: &str| {
+            operation
+                .get(key)
+                .and_then(Json::as_str)
+                .map(str::trim)
+                .unwrap_or("")
+                .to_owned()
+        };
+        let label = text("label");
+        if label.is_empty() {
+            return Err(Error::invalid(format!(
+                "its target `{target}`'s operation `{name}` has no `label` for its button"
+            )));
+        }
+        out.push(TargetOperation {
+            name: name.clone(),
+            label,
+            description: text("description"),
+            show_if: show_if_conditions(operation.get("showIf")),
+        });
+    }
+    Ok(out)
+}
+
+/// Each target's `options`: settings that configure that target alone, in the
+/// same field vocabulary as the framework's `config_fields`.
+///
+/// ```js
+/// targets: { android: { options: [{ name: "app_version", type: "String" }], … } }
+/// ```
+///
+/// They are **appended to the framework's settings** (`spec`), so an
+/// application stores, validates and hands them to the framework's generators
+/// exactly as it does its other settings, and the target's templates may
+/// interpolate them. What is returned is which names belong to which target, so
+/// a form can show them under the target. A name that is already a setting, or
+/// another target's option, is refused: one application config holds them all.
+fn target_options(
+    declared: &Json,
+    spec: &mut Vec<sc_types::FormField>,
+    framework: &str,
+) -> Result<BTreeMap<String, Vec<String>>> {
+    let mut out = BTreeMap::new();
+    let Json::Object(entries) = declared else {
+        return Ok(out);
+    };
+    for (target, declaration) in entries {
+        let fields = match declaration.get("options") {
+            None | Some(Json::Null) => continue,
+            Some(Json::Array(fields)) => fields,
+            Some(_) => {
+                return Err(Error::invalid(format!(
+                    "its target `{target}`'s `options` is not a list of fields"
+                )));
+            }
+        };
+        let (fields, _) = config_fields_to_form_fields(
+            fields,
+            &format!("the framework `{framework}`'s target `{target}`"),
+        );
+        let mut names = Vec::new();
+        for field in fields {
+            if spec.iter().any(|f| f.name() == field.name()) {
+                return Err(Error::invalid(format!(
+                    "its target `{target}`'s option `{}` has the name of a setting it already \
+                     has; every setting and option shares one namespace",
+                    field.name()
+                )));
+            }
+            names.push(field.name().to_owned());
+            spec.push(field);
+        }
+        out.insert(target.clone(), names);
+    }
+    Ok(out)
+}
+
 /// A target's `env`: `{ ANDROID_HOME: "/opt/sdk" }`, the variables its command is
 /// started with.
 ///
+/// Each value is a template over the framework's settings, so an application's
+/// own setting (a keystore password) reaches the build here rather than through
+/// a file in its project.
+///
 /// No `.env` file is written: the map is kept in memory, rebuilt whenever the
 /// module (re)loads with its settings, and handed to the build process alone
 /// when it starts (`Command::envs` in `sc_app`'s `run_target`).
@@ -334,7 +517,11 @@ fn targets(declared: &Json, spec: &[sc_types::FormField]) -> Result<Vec<TargetTe
 /// leave the variable to the server's environment, not blank it for the build.
 /// A name a process environment cannot carry — empty, or with `=` or a NUL — is
 /// refused, as is a value that is not text.
-fn target_env(target: &str, declared: Option<&Json>) -> Result<BTreeMap<String, String>> {
+fn target_env(
+    target: &str,
+    declared: Option<&Json>,
+    spec: &[sc_types::FormField],
+) -> Result<BTreeMap<String, Template>> {
     let mut env = BTreeMap::new();
     let Some(json) = declared.filter(|v| !v.is_null()) else {
         return Ok(env);
@@ -366,7 +553,10 @@ fn target_env(target: &str, declared: Option<&Json>) -> Result<BTreeMap<String,
             )));
         }
         if !value.is_empty() {
-            env.insert(key.clone(), value.to_owned());
+            env.insert(
+                key.clone(),
+                settings_template(value, spec, &format!("target `{target}`'s `env` `{key}`"))?,
+            );
         }
     }
     Ok(env)
@@ -686,6 +876,76 @@ mod tests {
         assert!(msg.contains("output"), "{msg}");
     }
 
+    #[test]
+    fn a_targets_options_become_settings_its_templates_can_use() {
+        let mut with_options = vue();
+        with_options["targets"] = json!({
+            "android": {
+                "command": "npm run build:android:{{ build_type }}",
+                "artifact": "{{ project }}/{{ build_type }}.apk",
+                "options": [
+                    { "name": "app_version", "label": "Version", "type": "String", "default": "1.0.0" },
+                    { "name": "build_type", "type": "String", "default": "release",
+                      "attributes": { "options": ["debug", "release"] } }
+                ]
+            }
+        });
+        let decl = declaration(&manifest(with_options), "@feldspar/vue").unwrap();
+        // Appended to the framework's own settings, so they are stored and
+        // validated like them…
+        let names: Vec<&str> = decl.config_spec.iter().map(|f| f.name()).collect();
+        assert_eq!(names, ["store", "project", "app_version", "build_type"]);
+        // …and recorded as the target's, for the form.
+        assert_eq!(decl.targets[0].options, ["app_version", "build_type"]);
+        let config = [
+            ("store".to_owned(), json!("apps")),
+            ("project".to_owned(), json!("todo")),
+            ("build_type".to_owned(), json!("debug")),
+        ]
+        .into_iter()
+        .collect();
+        let spec = decl.target_spec("android", &config).unwrap();
+        assert_eq!(spec.args, ["run", "build:android:debug"]);
+        assert_eq!(spec.artifact, "todo/debug.apk");
+    }
+
+    #[test]
+    fn a_target_option_that_reuses_a_setting_name_or_is_not_a_list_is_refused() {
+        let mut clash = vue();
+        clash["targets"] = json!({
+            "android": {
+                "command": "npm run apk",
+                "artifact": "x.apk",
+                "options": [{ "name": "project", "type": "String" }]
+            }
+        });
+        let msg = declaration(&manifest(clash), "@feldspar/vue")
+            .unwrap_err()
+            .to_string();
+        assert!(msg.contains("android") && msg.contains("project"), "{msg}");
+
+        let mut not_a_list = vue();
+        not_a_list["targets"] = json!({
+            "android": { "command": "npm run apk", "artifact": "x.apk", "options": {} }
+        });
+        let msg = declaration(&manifest(not_a_list), "@feldspar/vue")
+            .unwrap_err()
+            .to_string();
+        assert!(msg.contains("options"), "{msg}");
+    }
+
+    #[test]
+    fn a_target_command_naming_an_unknown_setting_is_refused_on_load() {
+        let mut typo = vue();
+        typo["targets"] = json!({
+            "android": { "command": "npm run {{ varient }}", "artifact": "x.apk" }
+        });
+        let msg = declaration(&manifest(typo), "@feldspar/vue")
+            .unwrap_err()
+            .to_string();
+        assert!(msg.contains("varient") && msg.contains("command"), "{msg}");
+    }
+
     #[test]
     fn declared_targets_become_templates_over_the_frameworks_settings() {
         let mut with_targets = vue();
@@ -729,7 +989,8 @@ mod tests {
             }
         });
         let decl = declaration(&manifest(with_env), "@feldspar/vue").unwrap();
-        let env = &decl.targets[0].env;
+        let config = [("store".to_owned(), json!("apps"))].into_iter().collect();
+        let env = decl.target_spec("android", &config).unwrap().env;
         assert_eq!(
             env.get("ANDROID_HOME").map(String::as_str),
             Some("/opt/sdk")
@@ -747,6 +1008,108 @@ mod tests {
         assert!(msg.contains("android") && msg.contains("A=B"), "{msg}");
     }
 
+    #[test]
+    fn a_targets_env_carries_an_application_setting_and_drops_it_when_blank() {
+        let mut with_secret = vue();
+        with_secret["targets"] = json!({
+            "android": {
+                "command": "npm run apk",
+                "artifact": "a.apk",
+                "env": { "KEYSTORE_PASSWORD": "{{ keystore_password }}" },
+                "options": [{ "name": "keystore_password", "type": "String", "input_type": "password" }]
+            }
+        });
+        let decl = declaration(&manifest(with_secret), "@feldspar/vue").unwrap();
+        let config = |password: &str| -> sc_types::Attrs {
+            [
+                ("store".to_owned(), json!("apps")),
+                ("keystore_password".to_owned(), json!(password)),
+            ]
+            .into_iter()
+            .collect()
+        };
+        let env = decl.target_spec("android", &config("s3cret")).unwrap().env;
+        assert_eq!(env["KEYSTORE_PASSWORD"], "s3cret");
+        let env = decl.target_spec("android", &config("")).unwrap().env;
+        assert!(!env.contains_key("KEYSTORE_PASSWORD"));
+
+        // A setting the framework has not got is refused on load, as in any
+        // other template.
+        let mut typo = vue();
+        typo["targets"] = json!({
+            "android": { "command": "x", "artifact": "a.apk", "env": { "P": "{{ pasword }}" } }
+        });
+        let msg = declaration(&manifest(typo), "@feldspar/vue")
+            .unwrap_err()
+            .to_string();
+        assert!(msg.contains("pasword"), "{msg}");
+    }
+
+    #[test]
+    fn a_targets_operations_are_read_as_data_and_one_without_a_label_refused() {
+        let mut with_ops = vue();
+        with_ops["targets"] = json!({
+            "android": {
+                "command": "npm run apk",
+                "artifact": "a.apk",
+                "operations": {
+                    "generate_keystore": {
+                        "label": "Generate a keystore",
+                        "description": "Makes one.",
+                        "showIf": { "own_keystore": true }
+                    }
+                }
+            }
+        });
+        let decl = declaration(&manifest(with_ops), "@feldspar/vue").unwrap();
+        let op = &decl.targets[0].operations[0];
+        assert_eq!(op.name, "generate_keystore");
+        assert_eq!(op.label, "Generate a keystore");
+        assert_eq!(op.description, "Makes one.");
+        assert_eq!(
+            op.show_if,
+            [sc_types::ShowIfCondition::new(
+                "own_keystore",
+                vec![json!(true)]
+            )]
+        );
+
+        let mut unlabelled = vue();
+        unlabelled["targets"] = json!({
+            "android": { "command": "x", "artifact": "a.apk", "operations": { "go": {} } }
+        });
+        let msg = declaration(&manifest(unlabelled), "@feldspar/vue")
+            .unwrap_err()
+            .to_string();
+        assert!(msg.contains("go") && msg.contains("label"), "{msg}");
+    }
+
+    #[test]
+    fn an_operations_answer_is_read_and_a_malformed_one_refused() {
+        let answer = operation_answer(
+            &json!({
+                "files": [{ "path": "keys/a.p12", "base64": "AAEC" }],
+                "settings": { "keystore_alias": "upload" },
+                "message": "done"
+            }),
+            "generate_keystore",
+            "@feldspar/react-native",
+        )
+        .unwrap();
+        assert_eq!(answer.files, [("keys/a.p12".to_owned(), vec![0u8, 1, 2])]);
+        assert_eq!(answer.settings["keystore_alias"], json!("upload"));
+        assert_eq!(answer.message, "done");
+
+        for bad in [
+            json!({ "files": [{ "path": "a", "base64": "!!" }] }),
+            json!({ "files": [{ "base64": "AAEC" }] }),
+            json!({ "files": "a" }),
+            json!({ "settings": [1] }),
+        ] {
+            assert!(operation_answer(&bad, "op", "m").is_err(), "{bad}");
+        }
+    }
+
     #[test]
     fn a_targets_requirements_are_read_and_a_malformed_one_is_refused() {
         let mut with_requires = vue();
diff --git a/crates/sc-module/src/host.rs b/crates/sc-module/src/host.rs
index 181974ac..18b29abe 100644
--- a/crates/sc-module/src/host.rs
+++ b/crates/sc-module/src/host.rs
@@ -856,6 +856,33 @@ impl ModuleHost {
         }
     }
 
+    /// Press a target's button: call the plugin's `run` function for
+    /// `operation` (e.g. `generate_keystore` on the `android` target) with
+    /// `context`, and return what it answered as raw JSON.
+    ///
+    /// The call goes to the worker the module is loaded in, since `run` only
+    /// exists there. See `sc_app::TargetOperation`.
+    pub async fn call_target_operation(
+        &self,
+        module: &str,
+        framework: &str,
+        target: &str,
+        operation: &str,
+        context: &Json,
+    ) -> Result<Json> {
+        #[cfg(feature = "deno-host")]
+        {
+            self.pool
+                .call_target_operation(module, framework, target, operation, context)
+                .await
+        }
+        #[cfg(not(feature = "deno-host"))]
+        {
+            let _ = (module, framework, target, operation, context);
+            Err(no_runtime())
+        }
+    }
+
     /// The files one of a module's frameworks generates for an application —
     /// the whole project (`scaffold`), or the framework's own generated code
     /// (`runtime`).
diff --git a/crates/sc-module/src/js/module-host.mjs b/crates/sc-module/src/js/module-host.mjs
index edf0c7f6..f58793ef 100644
--- a/crates/sc-module/src/js/module-host.mjs
+++ b/crates/sc-module/src/js/module-host.mjs
@@ -1397,6 +1397,25 @@ async function frameworkFiles({ module: name, framework: frameworkName, phase, c
   });
 }
 
+/** Run an operation a framework's build target declares: the module's `run`,
+ * with the application's context. Its answer — `{ files: [{ path, base64 }],
+ * settings, message }` — is checked on the Rust side, which writes the files
+ * and saves the settings. */
+async function callTargetOperation({ module: name, framework: frameworkName, target, operation, context }) {
+  const entry = loaded.get(name);
+  if (!entry) throw new Error(`the module ${name} is not loaded in this host`);
+  const impl = entry.frameworks && entry.frameworks[frameworkName];
+  if (!impl) throw new Error(`the module ${name} has no framework ${frameworkName}`);
+  const declared = impl.targets && impl.targets[target];
+  const op = declared && declared.operations && declared.operations[operation];
+  if (!op || typeof op.run !== "function")
+    throw new Error(
+      `framework ${frameworkName} of module ${name} has no operation ${operation} on target ${target}`,
+    );
+  const answer = await op.run(context || {});
+  return answer && typeof answer === "object" ? answer : {};
+}
+
 /** The loaded model provider, or a sentence naming what is missing. */
 function requireModelProvider(name, providerName) {
   const entry = loaded.get(name);
@@ -3853,6 +3872,11 @@ async function handle(request) {
       if (pending) await pending;
       return await frameworkFiles(request);
     }
+    case "call_target_operation": {
+      const pending = loading.get(request.module);
+      if (pending) await pending;
+      return await callTargetOperation(request);
+    }
     // Saltcorn UI's view runtime (TODO "Saltcorn UI" §3). No module to wait
     // on: the runtime is not a module in `loaded`, and imports itself.
     case "view_patterns":
diff --git a/crates/sc-module/src/spec.rs b/crates/sc-module/src/spec.rs
index eb8b2260..f24f3d5e 100644
--- a/crates/sc-module/src/spec.rs
+++ b/crates/sc-module/src/spec.rs
@@ -21,7 +21,7 @@
 //! actions to a fifth. So the field is rendered as text, the module carries an
 //! issue saying which field and which type, and the admin can see both.
 
-use sc_types::{BasicType, FormField, TypeRef};
+use sc_types::{BasicType, FormField, ShowIfCondition, TypeRef};
 use serde_json::Value as Json;
 
 /// What a translated field set could not express faithfully.
@@ -155,6 +155,9 @@ fn config_field(field: &Json, owner: &str) -> Result<Option<(FormField, Option<S
     if let Some(query) = field.get("server_query").and_then(Json::as_str) {
         form_field = form_field.server_query(query);
     }
+    form_field
+        .show_if
+        .extend(show_if_conditions(field.get("showIf")));
     // `sublabel` — v1's sentence under the control — has nowhere to go:
     // `FormField` carries no help text (a `ConfigDef` does, and that is a
     // settings-screen type). Dropped deliberately rather than folded into the
@@ -162,6 +165,29 @@ fn config_field(field: &Json, owner: &str) -> Result<Option<(FormField, Option<S
     Ok(Some((form_field, issue)))
 }
 
+/// Read a v1-style `showIf`: when something (a setting, or an operation's
+/// button) is shown.
+///
+/// `{ build_type: "release", own_keystore: true }` means "only while
+/// `build_type` is `release` **and** `own_keystore` is ticked". A list allows
+/// several values: `{ build_type: ["release", "staging"] }`. Anything that is
+/// not an object means no conditions, so always shown.
+pub(crate) fn show_if_conditions(declared: Option<&Json>) -> Vec<ShowIfCondition> {
+    let Some(Json::Object(conditions)) = declared else {
+        return Vec::new();
+    };
+    conditions
+        .iter()
+        .map(|(setting, declared)| {
+            let allowed = match declared {
+                Json::Array(list) => list.clone(),
+                single => vec![single.clone()],
+            };
+            ShowIfCondition::new(setting.clone(), allowed)
+        })
+        .collect()
+}
+
 /// v1's type names, and what they are here.
 ///
 /// The list is v1's built-in scalar types plus the two spellings of a JSON
@@ -269,6 +295,22 @@ mod tests {
         assert!(fields[0].required);
     }
 
+    #[test]
+    fn a_v1_show_if_becomes_the_fields_condition() {
+        let (fields, issues) = translate(json!([
+            { "name": "alias", "type": "String",
+              "showIf": { "own_key": true, "build_type": ["release", "staging"] } }
+        ]));
+        assert!(issues.is_empty(), "{issues:?}");
+        assert_eq!(
+            fields[0].show_if,
+            [
+                ShowIfCondition::new("own_key", vec![json!(true)]),
+                ShowIfCondition::new("build_type", vec![json!("release"), json!("staging")]),
+            ]
+        );
+    }
+
     #[test]
     fn the_scalar_types_map_across() {
         let (fields, issues) = translate(json!([
diff --git a/crates/sc-module/tests/bundled_react_native.rs b/crates/sc-module/tests/bundled_react_native.rs
index bd3194f8..bc612202 100644
--- a/crates/sc-module/tests/bundled_react_native.rs
+++ b/crates/sc-module/tests/bundled_react_native.rs
@@ -21,7 +21,7 @@ use sc_module::{
     BundledModules, Installer, LoadedModule, Module, ModuleFrameworks, ModuleHost,
     ModulePermissions, ModuleSet, ModuleSource,
 };
-use sc_types::Attrs;
+use sc_types::{Attrs, ShowIfCondition};
 use serde_json::{Value as Json, json};
 
 /// The framework's name, as an application row stores it.
@@ -248,7 +248,20 @@ async fn the_bundled_react_native_module_declares_a_web_framework() {
     assert_eq!(rn.checks, ["typecheck"]);
     assert_eq!(
         rn.config_spec.iter().map(|f| f.name()).collect::<Vec<_>>(),
-        ["store", "project", "mobile_url"]
+        [
+            "store",
+            "project",
+            "mobile_url",
+            "app_id",
+            "app_version",
+            "app_icon",
+            "build_type",
+            "package_format",
+            "own_keystore",
+            "keystore_file",
+            "keystore_alias",
+            "keystore_password"
+        ]
     );
 
     let config: Attrs = [
@@ -269,14 +282,76 @@ async fn the_bundled_react_native_module_declares_a_web_framework() {
     // The APK is a build target beside the web bundle, run in the same project.
     assert_eq!(rn.targets.len(), 1);
     let apk = rn.target_spec("android", &config).unwrap();
-    assert_eq!(apk.label, "Android APK");
+    assert_eq!(apk.label, "Android app");
     assert_eq!(apk.command, "npm");
-    assert_eq!(apk.args, ["run", "build:android"]);
+    // A release APK unless the application says otherwise, left where
+    // `prebuild --clean` does not delete it.
+    assert_eq!(apk.args, ["run", "build:android:release-apk"]);
     assert_eq!(apk.source_dir, "todo");
+    assert_eq!(apk.artifact, "todo/android-output/app-release.apk");
+    // An AAB for the Play Store, offered for a release build only.
+    let mut aab = config.clone();
+    aab.insert("package_format".to_owned(), json!("aab"));
+    let spec = rn.target_spec("android", &aab).unwrap();
+    assert_eq!(spec.args, ["run", "build:android:release-aab"]);
+    assert_eq!(spec.artifact, "todo/android-output/app-release.aab");
+    // Its own settings, which the application form shows under the target; the
+    // icon is picked from the application's store.
     assert_eq!(
-        apk.artifact,
-        "todo/android/app/build/outputs/apk/release/app-release.apk"
+        rn.targets[0].options,
+        [
+            "app_id",
+            "app_version",
+            "app_icon",
+            "build_type",
+            "package_format",
+            "own_keystore",
+            "keystore_file",
+            "keystore_alias",
+            "keystore_password"
+        ]
     );
+    let icon = rn
+        .config_spec
+        .iter()
+        .find(|f| f.name() == "app_icon")
+        .unwrap();
+    assert_eq!(icon.query(), Some("store_files:png,jpg,jpeg"));
+    // The keystore settings: a release build's, once its own keystore is
+    // chosen, and the password a secret that reaches the build as its
+    // environment.
+    let field = |name: &str| rn.config_spec.iter().find(|f| f.name() == name).unwrap();
+    assert_eq!(
+        field("package_format").show_if,
+        [ShowIfCondition::new("build_type", vec![json!("release")])]
+    );
+    assert_eq!(
+        field("own_keystore").show_if,
+        [ShowIfCondition::new("build_type", vec![json!("release")])]
+    );
+    assert_eq!(
+        field("keystore_alias").show_if,
+        [
+            ShowIfCondition::new("build_type", vec![json!("release")]),
+            ShowIfCondition::new("own_keystore", vec![json!(true)])
+        ]
+    );
+    assert!(field("keystore_password").secret);
+    assert_eq!(
+        field("keystore_file").query(),
+        Some("store_files:jks,keystore,p12")
+    );
+    let mut signed = config.clone();
+    signed.insert("keystore_password".to_owned(), json!("s3cret"));
+    let apk = rn.target_spec("android", &signed).unwrap();
+    assert_eq!(apk.env["FELDSPAR_KEYSTORE_PASSWORD"], "s3cret");
+    // Unsigned, or switched off with nothing filled in: the build needs nothing.
+    sc_types::validate_attrs(&rn.config_spec, &config).unwrap();
+    let mut debug = config.clone();
+    debug.insert("build_type".to_owned(), json!("debug"));
+    let apk = rn.target_spec("android", &debug).unwrap();
+    assert_eq!(apk.args, ["run", "build:android:debug-apk"]);
+    assert_eq!(apk.artifact, "todo/android-output/app-debug.apk");
 
     // One widening beyond React's policy: react-native-web injects its styles at
     // run time. Scripts stay strict.
@@ -359,7 +434,7 @@ async fn the_scaffold_is_an_expo_project_whose_every_import_resolves() {
     let paths: Vec<&str> = files.iter().map(|f| f.path.as_str()).collect();
     for expected in [
         "package.json",
-        "app.json",
+        "app.config.js",
         "tsconfig.json",
         "AGENTS.md",
         "index.ts",
@@ -375,6 +450,7 @@ async fn the_scaffold_is_an_expo_project_whose_every_import_resolves() {
         "src/screens/Readings.tsx",
         "src/feldspar/hooks.ts",
         "src/feldspar/config.ts",
+        "src/feldspar/native.json",
         "src/feldspar/README.md",
     ] {
         assert!(paths.contains(&expected), "missing {expected}: {paths:?}");
@@ -399,19 +475,65 @@ async fn the_scaffold_is_an_expo_project_whose_every_import_resolves() {
         package.contains("\"typecheck\": \"tsc --noEmit\""),
         "{package}"
     );
+    // One script per build type and package, each copying its result to
+    // `android-output/`.
+    for (script, task, output) in [
+        (
+            "release-apk",
+            "assembleRelease",
+            "apk/release/app-release.apk",
+        ),
+        (
+            "release-aab",
+            "bundleRelease",
+            "bundle/release/app-release.aab",
+        ),
+        ("debug-apk", "assembleDebug", "apk/debug/app-debug.apk"),
+        ("debug-aab", "bundleDebug", "bundle/debug/app-debug.aab"),
+    ] {
+        let line = package
+            .lines()
+            .find(|l| l.contains(&format!("\"build:android:{script}\"")))
+            .unwrap_or_else(|| panic!("no {script} script: {package}"));
+        assert!(
+            line.contains("expo prebuild --platform android --clean"),
+            "{line}"
+        );
+        assert!(line.contains(&format!("./gradlew {task}")), "{line}");
+        assert!(
+            line.contains(&format!("cp app/build/outputs/{output} ../android-output/")),
+            "{line}"
+        );
+    }
+    assert!(file(&files, ".gitignore").contains("android-output"));
+    assert!(file(&files, "index.ts").contains("registerRootComponent(Root)"));
+    let app_config = file(&files, "app.config.js");
+    assert!(
+        app_config.contains("src/feldspar/native.json"),
+        "{app_config}"
+    );
+    assert!(app_config.contains("package: native.appId"), "{app_config}");
+    assert!(app_config.contains("output: \"single\""), "{app_config}");
+    // The checks' regular expressions survive the template they are written
+    // from: an unescaped `.` or `d` would refuse every version.
     assert!(
-        package.contains("\"build:android\": \"expo prebuild --platform android"),
-        "{package}"
+        app_config.contains(r"/^(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/"),
+        "{app_config}"
     );
-    assert!(file(&files, "index.ts").contains("registerRootComponent(Root)"));
-    let app_json = file(&files, "app.json");
     assert!(
-        app_json.contains("\"package\": \"com.feldspar.todo\""),
-        "{app_json}"
+        app_config.contains(r"(\.[a-zA-Z][a-zA-Z0-9_]*)+$/"),
+        "{app_config}"
     );
-    assert!(app_json.contains("\"output\": \"single\""), "{app_json}");
     // Served over HTTPS, so the APK asks for no cleartext permission.
-    assert!(!app_json.contains("usesCleartextTraffic"), "{app_json}");
+    assert!(!app_config.contains("usesCleartextTraffic"), "{app_config}");
+    // Nothing set: the default application id, version and build type, and
+    // Expo's own icon.
+    let native: Json = serde_json::from_str(&file(&files, "src/feldspar/native.json")).unwrap();
+    assert_eq!(
+        native,
+        json!({ "appId": "com.feldspar.todo", "version": "1.0.0", "icon": null,
+                "buildType": "release", "signing": null })
+    );
     assert!(!package.contains("expo-build-properties"), "{package}");
 
     // A phone has no page to be relative to: its requests go to the app's URL.
@@ -509,10 +631,10 @@ async fn an_app_served_over_http_lets_its_apk_reach_it() {
         .expect("the scaffold runs");
     // A release APK refuses plain HTTP unless it says otherwise, and a
     // development server is plain HTTP.
-    let app_json = file(&files, "app.json");
+    let app_config = file(&files, "app.config.js");
     assert!(
-        app_json.contains("\"usesCleartextTraffic\": true"),
-        "{app_json}"
+        app_config.contains("usesCleartextTraffic: true"),
+        "{app_config}"
     );
     assert!(file(&files, "package.json").contains("\"expo-build-properties\":"));
     assert!(
@@ -538,7 +660,72 @@ async fn the_mobile_url_setting_is_where_the_apk_sends_its_requests() {
     );
     // That URL is plain HTTP, so the APK may speak it — although the
     // application itself is served over HTTPS.
-    assert!(file(&files, "app.json").contains("\"usesCleartextTraffic\": true"));
+    assert!(file(&files, "app.config.js").contains("usesCleartextTraffic: true"));
+}
+
+#[tokio::test]
+async fn the_apk_settings_reach_native_json_on_every_build() {
+    skip_without!(have_npm(), "npm is not on the PATH");
+    let mut ctx = context(true, vec![tasks_table()]);
+    // The icon is picked from the store; the project is `todo` in that store,
+    // and Expo resolves the icon against the project.
+    ctx["settings"] = json!({
+        "app_id": " com.example.todo ",
+        "app_version": "2.3.4",
+        "app_icon": "todo/assets/icon.png",
+        "build_type": "debug"
+    });
+    let files = frameworks("bundled-rn-native")
+        .await
+        .framework_files(FRAMEWORK, FilePhase::Runtime, ctx.clone())
+        .await
+        .expect("the runtime runs");
+    let native: Json = serde_json::from_str(&file(&files, "src/feldspar/native.json")).unwrap();
+    assert_eq!(
+        native,
+        json!({ "appId": "com.example.todo", "version": "2.3.4",
+                "icon": "assets/icon.png", "buildType": "debug", "signing": null })
+    );
+    // An icon outside the project is reached from it.
+    ctx["settings"]["app_icon"] = json!("branding/logo.png");
+    let files = frameworks("bundled-rn-native-outside")
+        .await
+        .framework_files(FRAMEWORK, FilePhase::Runtime, ctx.clone())
+        .await
+        .expect("the runtime runs");
+    let native: Json = serde_json::from_str(&file(&files, "src/feldspar/native.json")).unwrap();
+    assert_eq!(native["icon"], json!("../branding/logo.png"));
+
+    // A release build signed with the application's own keystore: its path
+    // and alias are in `native.json`, its password is not.
+    ctx["settings"] = json!({
+        "build_type": "release",
+        "own_keystore": true,
+        "keystore_file": "keys/release.jks",
+        "keystore_alias": "upload",
+        "keystore_password": "s3cret"
+    });
+    let files = frameworks("bundled-rn-native-signed")
+        .await
+        .framework_files(FRAMEWORK, FilePhase::Runtime, ctx.clone())
+        .await
+        .expect("the runtime runs");
+    let native_text = file(&files, "src/feldspar/native.json");
+    let native: Json = serde_json::from_str(&native_text).unwrap();
+    assert_eq!(
+        native["signing"],
+        json!({ "keystore": "../keys/release.jks", "alias": "upload" })
+    );
+    assert!(!native_text.contains("s3cret"), "{native_text}");
+    // A debug build is signed with the debug key, whatever the settings say.
+    ctx["settings"]["build_type"] = json!("debug");
+    let files = frameworks("bundled-rn-native-debug")
+        .await
+        .framework_files(FRAMEWORK, FilePhase::Runtime, ctx)
+        .await
+        .expect("the runtime runs");
+    let native: Json = serde_json::from_str(&file(&files, "src/feldspar/native.json")).unwrap();
+    assert_eq!(native["signing"], Json::Null);
 }
 
 #[tokio::test]
@@ -559,6 +746,7 @@ async fn a_rebuild_rewrites_the_generated_directory_and_nothing_else() {
         [
             "src/feldspar/hooks.ts",
             "src/feldspar/config.ts",
+            "src/feldspar/native.json",
             "src/feldspar/README.md"
         ],
         "a build must not rewrite a screen the developer owns"
@@ -652,3 +840,79 @@ async fn the_bundled_react_native_module_scaffolds_an_application_that_builds()
 
     std::fs::remove_dir_all(&dir).ok();
 }
+
+/// "Generate a keystore": the module makes a PKCS12 keystore in pure JavaScript
+/// and answers it with the settings that name it. Writing and saving are the
+/// server's (`sc_app::run_target_operation`); this checks what the module makes.
+#[tokio::test]
+async fn the_keystore_operation_makes_a_keystore_and_the_settings_naming_it() {
+    skip_without!(have_npm(), "npm is not on the PATH");
+    let frameworks = frameworks("bundled-rn-keystore").await;
+    let declared = frameworks.frameworks();
+    let op = &declared[0].targets[0].operations[0];
+    assert_eq!(op.name, "generate_keystore");
+    assert_eq!(
+        op.show_if,
+        [
+            ShowIfCondition::new("build_type", vec![json!("release")]),
+            ShowIfCondition::new("own_keystore", vec![json!(true)])
+        ]
+    );
+
+    let context = |settings: Json| {
+        json!({ "app": { "name": "My Todo", "subdomain": "todo" }, "project": "todo",
+                "settings": settings })
+    };
+    // Nothing filled in: the alias `upload` and a generated password, shown once.
+    let answer = frameworks
+        .call_target_operation(
+            FRAMEWORK,
+            "android",
+            "generate_keystore",
+            context(json!({ "build_type": "release", "own_keystore": true })),
+        )
+        .await
+        .expect("the operation runs");
+    assert_eq!(answer.files.len(), 1);
+    let (path, bytes) = &answer.files[0];
+    assert_eq!(path, "keys/todo-release.p12");
+    // A DER SEQUENCE, of a size a 2048-bit key and its certificate make.
+    assert_eq!(bytes[0], 0x30);
+    assert!(bytes.len() > 2000, "{} bytes", bytes.len());
+    assert_eq!(answer.settings["own_keystore"], json!(true));
+    assert_eq!(
+        answer.settings["keystore_file"],
+        json!("keys/todo-release.p12")
+    );
+    assert_eq!(answer.settings["keystore_alias"], json!("upload"));
+    let password = answer.settings["keystore_password"].as_str().unwrap();
+    assert_eq!(password.len(), 24);
+    assert!(answer.message.contains(password), "{}", answer.message);
+
+    // The alias and password the admin typed are used, and not repeated back.
+    let answer = frameworks
+        .call_target_operation(
+            FRAMEWORK,
+            "android",
+            "generate_keystore",
+            context(json!({ "keystore_alias": "release", "keystore_password": "typed-pass" })),
+        )
+        .await
+        .expect("the operation runs");
+    assert_eq!(answer.settings["keystore_alias"], json!("release"));
+    assert_eq!(answer.settings["keystore_password"], json!("typed-pass"));
+    assert!(!answer.message.contains("typed-pass"), "{}", answer.message);
+
+    // Java refuses a password shorter than six characters, so the module does.
+    let err = frameworks
+        .call_target_operation(
+            FRAMEWORK,
+            "android",
+            "generate_keystore",
+            context(json!({ "keystore_password": "short" })),
+        )
+        .await
+        .unwrap_err()
+        .to_string();
+    assert!(err.contains("6 characters"), "{err}");
+}
diff --git a/crates/sc-server/src/handlers.rs b/crates/sc-server/src/handlers.rs
index acf71ff8..48a9446f 100644
--- a/crates/sc-server/src/handlers.rs
+++ b/crates/sc-server/src/handlers.rs
@@ -2283,6 +2283,38 @@ pub fn admin_handlers(catalog: Arc<Catalog>, apps: Arc<AppMounts>) -> HandlerReg
         }
     });
 
+    reg.register("listStoreFiles", {
+        let catalog = catalog.clone();
+        move |ctx| {
+            let catalog = catalog.clone();
+            async move {
+                let name = ctx.path_param("store")?.to_owned();
+                let (store, floor) = resolve_store(&catalog, &name).await?;
+                let role = caller_role(&ctx);
+                check_access(store.as_ref(), floor, "", role).await?;
+                let extensions: Vec<String> = ctx
+                    .query_get("extensions")
+                    .unwrap_or("")
+                    .split(',')
+                    .map(|e| e.trim().to_owned())
+                    .filter(|e| !e.is_empty())
+                    .collect();
+                if extensions.is_empty() {
+                    return Err(Error::invalid(
+                        "say which files to list: `extensions`, e.g. png,jpg",
+                    ));
+                }
+                let found =
+                    sc_files::find_by_extension(store.as_ref(), floor, role, "", &extensions)
+                        .await?;
+                Ok(HandlerResponse::ok(json!({
+                    "paths": found.entries.into_iter().map(|e| e.path).collect::<Vec<_>>(),
+                    "truncated": found.truncated,
+                })))
+            }
+        }
+    });
+
     reg.register("searchFiles", {
         let catalog = catalog.clone();
         move |ctx| {
@@ -2468,6 +2500,31 @@ pub fn admin_handlers(catalog: Arc<Catalog>, apps: Arc<AppMounts>) -> HandlerReg
         }
     });
 
+    // The bytes of one file, as a download (the `/download/{store}/{*path}`
+    // route): what the file manager's Download fetches, however large.
+    reg.register("downloadFile", {
+        let catalog = catalog.clone();
+        move |ctx| {
+            let catalog = catalog.clone();
+            async move {
+                let name = ctx.path_param("store")?.to_owned();
+                let (store, floor) = resolve_store(&catalog, &name).await?;
+                let path = ctx.path_param("path")?.to_owned();
+                check_access(store.as_ref(), floor, &path, caller_role(&ctx)).await?;
+                let bytes = store.read(&path).await?;
+                let file_name = path.rsplit('/').next().unwrap_or(&path);
+                Ok(HandlerResponse::download(crate::handler::Download {
+                    bytes,
+                    content_type: sc_files::mime_for_path(&path)
+                        .unwrap_or_else(|| "application/octet-stream".to_owned()),
+                    // Quoted in the header: a quote or backslash in the name
+                    // would end it early.
+                    filename: file_name.replace(['"', '\\'], "_"),
+                }))
+            }
+        }
+    });
+
     reg.register("getFileMeta", {
         let catalog = catalog.clone();
         move |ctx| {
@@ -4488,7 +4545,7 @@ pub fn admin_handlers(catalog: Arc<Catalog>, apps: Arc<AppMounts>) -> HandlerReg
             let catalog = catalog.clone();
             async move {
                 let apps = list_applications(&catalog).await?;
-                let out: Vec<Json> = apps.iter().map(application_json).collect();
+                let out: Vec<Json> = apps.iter().map(application_api_json).collect();
                 Ok(HandlerResponse::ok(Json::Array(out)))
             }
         }
@@ -4647,7 +4704,7 @@ pub fn admin_handlers(catalog: Arc<Catalog>, apps: Arc<AppMounts>) -> HandlerReg
                 // saved and valid, and an unwritable store or an occupied
                 // directory is a thing the admin fixes and re-tries, not a reason
                 // to lose the application they just configured.
-                let mut body = application_json(&app);
+                let mut body = application_api_json(&app);
                 if !new_stores.is_empty()
                     && let Some(obj) = body.as_object_mut()
                 {
@@ -4698,12 +4755,13 @@ pub fn admin_handlers(catalog: Arc<Catalog>, apps: Arc<AppMounts>) -> HandlerReg
             let apps = apps.clone();
             async move {
                 let id = parse_app_id(ctx.path_param("id")?)?;
-                if load_application(&catalog, id).await?.is_none() {
+                let Some(stored) = load_application(&catalog, id).await? else {
                     return Err(Error::not_found(format!("no application with id {id}")));
-                }
+                };
                 // The id is the path's, not the body's — the row's identity is not
                 // something a payload gets to reassign.
                 let mut updated = application_from_body(id, &ctx.body)?;
+                merge_framework_secrets(&stored, &mut updated);
                 framable_by_the_admin(&mut updated, &ctx.body, &apps);
                 let app = save_application(&catalog, &updated).await?;
                 // A save is an API-definition change: a table added to the
@@ -4713,7 +4771,7 @@ pub fn admin_handlers(catalog: Arc<Catalog>, apps: Arc<AppMounts>) -> HandlerReg
                 // application is already saved and an unreachable store is not a
                 // reason to report that it was not.
                 reemit_app_client(&catalog, &app, apps.triggers()).await;
-                let mut body = application_json(&app);
+                let mut body = application_api_json(&app);
                 refresh_mounted_app(&apps, &app, &mut body).await;
                 Ok(HandlerResponse::ok(body))
             }
@@ -5675,6 +5733,54 @@ pub fn admin_handlers(catalog: Arc<Catalog>, apps: Arc<AppMounts>) -> HandlerReg
         }
     });
 
+    // Run an operation a target declares (a keystore generator): the module's
+    // files written into the application's store, its settings saved on it.
+    reg.register("runApplicationTargetOperation", {
+        let catalog = catalog.clone();
+        move |ctx| {
+            let catalog = catalog.clone();
+            async move {
+                let id = parse_app_id(ctx.path_param("id")?)?;
+                let target = ctx.path_param("target")?.to_owned();
+                let operation = ctx.path_param("operation")?.to_owned();
+                let app = load_application(&catalog, id)
+                    .await?
+                    .ok_or_else(|| Error::not_found(format!("no application with id {id}")))?;
+                // The form's current settings, unsaved edits included; the
+                // stored ones when the request sends none.
+                let form_settings = match require_object(&ctx.body)?.get("config") {
+                    Some(Json::Object(config)) => config.clone(),
+                    None | Some(Json::Null) => app.framework.config.clone(),
+                    Some(_) => return Err(Error::invalid("`config` is not an object of settings")),
+                };
+                let outcome = sc_app::run_target_operation(
+                    &catalog,
+                    &app,
+                    &target,
+                    &operation,
+                    &form_settings,
+                )
+                .await?;
+                // The app's settings with secrets masked, as the form shows
+                // them; of those, the ones the operation set go back.
+                let spec = framework_config_spec(&outcome.app.framework.name)?;
+                let masked = sc_types::redact_attrs(&spec, &outcome.app.framework.config);
+                let settings: sc_types::Attrs = outcome
+                    .settings
+                    .iter()
+                    .filter_map(|name| Some((name.clone(), masked.get(name)?.clone())))
+                    .collect();
+                Ok(HandlerResponse::ok(json!({
+                    "message": outcome.message,
+                    "store": outcome.store,
+                    "files": outcome.files,
+                    "git_repo": outcome.git_repo,
+                    "settings": Json::Object(settings),
+                })))
+            }
+        }
+    });
+
     // The latest build of a target: what the UI polls while one runs, and asks
     // after a reload to pick up a build that is still going.
     reg.register("getApplicationTargetBuild", {
@@ -5812,7 +5918,29 @@ pub fn admin_handlers(catalog: Arc<Catalog>, apps: Arc<AppMounts>) -> HandlerReg
                     // Read before resolving: afterwards a store picker is just a
                     // list of names, and the form can no longer tell it is one.
                     let store_settings = file_store_settings(&declared);
+                    let file_settings: Vec<Json> = sc_catalog::store_file_settings(&declared)
+                        .into_iter()
+                        .map(|f| json!({ "name": f.name, "extensions": f.extensions }))
+                        .collect();
                     let spec = resolve_options(&catalog, declared).await?;
+                    let targets: Vec<Json> = sc_app::framework_build_targets(&info.name)
+                        .into_iter()
+                        .map(|t| {
+                            json!({
+                                "name": t.name,
+                                "label": t.label,
+                                "options": t.options,
+                                "operations": t.operations.iter().map(|o| json!({
+                                    "name": o.name,
+                                    "label": say(&o.label, &ctx.locale),
+                                    "description": say(&o.description, &ctx.locale),
+                                    "show_if": o.show_if.iter().map(|c| {
+                                        json!({ "name": c.setting, "values": c.allowed })
+                                    }).collect::<Vec<_>>(),
+                                })).collect::<Vec<_>>(),
+                            })
+                        })
+                        .collect();
                     out.push(json!({
                         "name": info.name,
                         "label": say(&info.label, &ctx.locale),
@@ -5820,6 +5948,8 @@ pub fn admin_handlers(catalog: Arc<Catalog>, apps: Arc<AppMounts>) -> HandlerReg
                         "config_spec": spec_json(&spec, &ctx.locale),
                         "has_views": info.name == sc_viewpattern::SALTCORN_UI_FRAMEWORK,
                         "file_store_settings": store_settings,
+                        "file_settings": file_settings,
+                        "targets": targets,
                     }));
                 }
                 Ok(HandlerResponse::ok(Json::Array(out)))
@@ -6472,6 +6602,33 @@ fn description_of(metas: &[FieldMeta], field: &str) -> String {
 
 // --- applications: wire shaping ------------------------------------------------
 
+/// [`application_json`] as an admin is shown it: the framework's
+/// [`secret`](sc_types::FormField::secret) settings (a keystore password)
+/// replaced by the sentinel, which a save hands back and
+/// `merge_framework_secrets` restores. The unredacted form is what a backup
+/// keeps.
+pub(crate) fn application_api_json(app: &Application) -> Json {
+    let mut out = application_json(app);
+    if let Ok(spec) = framework_config_spec(&app.framework.name) {
+        out["framework"]["config"] =
+            Json::Object(sc_types::redact_attrs(&spec, &app.framework.config));
+    }
+    out
+}
+
+/// A submitted application's framework settings with every secret the form
+/// handed back unchanged (the sentinel) replaced by what `stored` holds — so
+/// saving an application's name does not save the mask over its password.
+fn merge_framework_secrets(stored: &Application, submitted: &mut Application) {
+    if stored.framework.name != submitted.framework.name {
+        return;
+    }
+    if let Ok(spec) = framework_config_spec(&submitted.framework.name) {
+        submitted.framework.config =
+            sc_types::merge_secrets(&spec, &stored.framework.config, &submitted.framework.config);
+    }
+}
+
 /// An [`Application`] as the API returns it (matching `application_schema`): the
 /// id plus every field, with the nested framework/CSP/attributes as plain JSON.
 pub(crate) fn application_json(app: &Application) -> Json {
@@ -6497,7 +6654,7 @@ pub(crate) fn application_json(app: &Application) -> Json {
         "installs": sc_app::framework_factory(&app.framework.name).is_none()
             && app_source_from_config(&app.framework).is_ok_and(|s| s.build.install.is_some()),
         "has_views": app.framework.name == sc_viewpattern::SALTCORN_UI_FRAMEWORK,
-        "targets": sc_app::app_build_targets(app)
+        "targets": sc_app::framework_build_targets(&app.framework.name)
             .into_iter()
             .map(|t| {
                 // A state of this machine, next to the target's description: what
@@ -9904,6 +10061,11 @@ fn form_field_json(field: &FormField) -> Json {
         "secret": field.secret,
         "create_only": field.create_only,
         "code_language": field.code_language,
+        "show_if": field
+            .show_if
+            .iter()
+            .map(|c| json!({ "name": c.setting, "values": c.allowed }))
+            .collect::<Vec<_>>(),
     })
 }
 
diff --git a/crates/sc-server/src/router.rs b/crates/sc-server/src/router.rs
index 3471430b..9c7728a0 100644
--- a/crates/sc-server/src/router.rs
+++ b/crates/sc-server/src/router.rs
@@ -271,6 +271,12 @@ pub fn build_router_with_apps(
         // is repeated here rather than inherited. CSRF is *not* repeated: the
         // middleware wraps every route including this one.
         .route("/upload/{store}/{*path}", axum::routing::post(upload))
+        // …and its mirror: a store file as itself, for the file manager's
+        // Download. `readFile` answers base64 inside JSON, which a browser has
+        // to hold twice and decode by hand — fine for a source file, hopeless
+        // for a 100 MB APK. A plain `GET`, so a link downloads it; it reads
+        // nothing it does not check access to, as `readFile` does.
+        .route("/download/{store}/{*path}", axum::routing::get(download))
         // Backup and restore, **outside** the typed `EndpointSet` for the same
         // reason the upload above is: one route's response is a file and the
         // other's request is one, and a `TypeSchema` has no bytes shape. Both
@@ -465,6 +471,44 @@ async fn upload(
     }
 }
 
+/// Serve one store file as a download (`GET /download/{store}/{*path}`), behind
+/// the same session lookup and admin check as the typed endpoints.
+async fn download(
+    State(state): State<AppState>,
+    jar: CookieJar,
+    AxumPath((store_name, path)): AxumPath<(String, String)>,
+) -> Response {
+    let session_token = jar.get(SESSION_COOKIE).map(|c| c.value().to_owned());
+    let user = match session_user(&state, &jar).await {
+        Ok(user) => user,
+        Err(response) => return *response,
+    };
+    if let Some(rejection) = enforce_auth(&AuthRequirement::admin(), user.as_ref()) {
+        return rejection;
+    }
+    let Some(handler) = state.handlers.get("downloadFile").cloned() else {
+        return json_error(
+            StatusCode::NOT_FOUND,
+            "this server has no file-download handler registered",
+        );
+    };
+    let route = format!("/download/{store_name}/{path}");
+    let caller = user.clone();
+    let ctx = HandlerCtx {
+        raw_body: None,
+        path_params: HashMap::from([("store".to_owned(), store_name), ("path".to_owned(), path)]),
+        query: Vec::new(),
+        body: serde_json::Value::Null,
+        user,
+        // As `upload`: bytes, not prose.
+        locale: sc_i18n::active().default_locale().clone(),
+    };
+    match handler(ctx).await {
+        Ok(resp) => apply_response(&state, jar, session_token, false, resp).await,
+        Err(e) => error_out(&state, &e, Audience::Admin, "GET", &route, caller.as_ref()).await,
+    }
+}
+
 /// Build a backup and serve it as a file (see [`BACKUP_CREATE_ROUTE`]).
 ///
 /// The request body is JSON — the selection — and the response is a zip, which is
diff --git a/crates/sc-server/tests/build_updates_client.rs b/crates/sc-server/tests/build_updates_client.rs
index 8be33fda..d9fdb525 100644
--- a/crates/sc-server/tests/build_updates_client.rs
+++ b/crates/sc-server/tests/build_updates_client.rs
@@ -28,7 +28,8 @@ use axum::http::{Request, StatusCode, header};
 use sc_api::admin_endpoints;
 use sc_app::{
     ApiConfig, Application, BuildTemplate, DeclaredFile, FilePhase, FrameworkDecl, FrameworkHost,
-    FrameworkRef, FrameworkSet, InstallSpec, bootstrap, install_frameworks, save_application,
+    FrameworkRef, FrameworkSet, InstallSpec, OperationAnswer, TargetOperation, TargetTemplate,
+    bootstrap, install_frameworks, load_application, save_application,
 };
 use sc_auth::SessionStore;
 use sc_catalog::{Catalog, FileStoreId, TableId};
@@ -40,7 +41,7 @@ use sc_server::{
     AppMounts, CSRF_COOKIE, CSRF_HEADER, ServerConfig, admin_handlers, build_router_with_apps,
 };
 use sc_test_harness::TestDb;
-use sc_types::{BasicType, FormField};
+use sc_types::{BasicType, FormField, SECRET_SENTINEL};
 use serde_json::{Value, json};
 use tower::ServiceExt;
 
@@ -61,6 +62,11 @@ fn shell_framework() -> FrameworkDecl {
         config_spec: vec![
             FormField::new("store", BasicType::Text).required(),
             FormField::new("project", BasicType::Text).default_value(""),
+            // A secret, as a keystore password is: shown masked, kept on save.
+            FormField::new("token", BasicType::Text).secret(),
+            // The `bundle` target's own settings.
+            FormField::new("key_file", BasicType::Text),
+            FormField::new("key_password", BasicType::Text).secret(),
         ],
         build: BuildTemplate {
             store: template("{{ store }}"),
@@ -75,7 +81,26 @@ fn shell_framework() -> FrameworkDecl {
         builder_prompt: None,
         checks: Vec::new(),
         scaffolds: true,
-        targets: Vec::new(),
+        // A target whose operation makes a key, as the Android one makes a
+        // keystore — and one that misbehaves.
+        targets: vec![TargetTemplate {
+            name: "bundle".to_owned(),
+            label: "Bundle".to_owned(),
+            command: template("sh bundle.sh"),
+            artifact: template("{{ project }}/bundle.zip"),
+            env: Default::default(),
+            requires: Vec::new(),
+            options: vec!["key_file".to_owned(), "key_password".to_owned()],
+            operations: ["make_key", "stray"]
+                .into_iter()
+                .map(|name| TargetOperation {
+                    name: name.to_owned(),
+                    label: name.to_owned(),
+                    description: String::new(),
+                    show_if: Vec::new(),
+                })
+                .collect(),
+        }],
     }
 }
 
@@ -124,6 +149,46 @@ impl FrameworkHost for StubHost {
         }
         Ok(files)
     }
+
+    async fn call_target_operation(
+        &self,
+        _name: &str,
+        _target: &str,
+        operation: &str,
+        context: Value,
+    ) -> sc_error::Result<OperationAnswer> {
+        let mut answer = OperationAnswer {
+            files: vec![(
+                format!(
+                    "keys/{}.key",
+                    context["app"]["subdomain"].as_str().unwrap_or("")
+                ),
+                b"KEY".to_vec(),
+            )],
+            message: "made".to_owned(),
+            ..OperationAnswer::default()
+        };
+        answer.settings.insert(
+            "key_file".to_owned(),
+            json!(format!(
+                "keys/{}.key",
+                context["app"]["subdomain"].as_str().unwrap_or("")
+            )),
+        );
+        // The password the form holds (typed, or the stored one behind the mask).
+        answer.settings.insert(
+            "key_password".to_owned(),
+            context["settings"]["key_password"].clone(),
+        );
+        if operation == "stray" {
+            // Not one of the target's settings.
+            answer
+                .settings
+                .insert("project".to_owned(), json!("elsewhere"));
+            answer.files[0].0 = "keys/stray.key".to_owned();
+        }
+        Ok(answer)
+    }
 }
 
 struct Client {
@@ -382,3 +447,130 @@ async fn deep_clean_reinstalls_the_dependencies_and_builds() -> sc_error::Result
     assert_eq!(status, StatusCode::BAD_REQUEST, "{body}");
     Ok(())
 }
+
+/// A framework's secret setting (a keystore password) is never sent back to the
+/// admin, and an edit that hands back the mask keeps the stored value.
+#[tokio::test]
+async fn a_framework_secret_is_masked_and_survives_an_edit() -> sc_error::Result<()> {
+    let (mut client, catalog, _dir, _db) = serve("secret").await?;
+    let app = Application::new(
+        "Vault",
+        "vault",
+        FrameworkRef::new("shell")
+            .with("store", "apps")
+            .with("project", "vault")
+            .with("token", "s3cret"),
+    )
+    .with_file_store(FileStoreId("apps".to_owned()))
+    .with_api(ApiConfig::new("rest", "/api"));
+    save_application(&catalog, &app).await?;
+
+    let (status, list) = client.send("GET", "/api/applications", None).await;
+    assert_eq!(status, StatusCode::OK, "{list}");
+    let mut row = list
+        .as_array()
+        .unwrap()
+        .iter()
+        .find(|a| a["subdomain"] == json!("vault"))
+        .unwrap()
+        .clone();
+    assert_eq!(row["framework"]["config"]["token"], json!(SECRET_SENTINEL));
+    assert!(!list.to_string().contains("s3cret"));
+
+    // Save the row as the form would: renamed, the mask handed back.
+    row["name"] = json!("Vault 2");
+    let (status, saved) = client
+        .send("PUT", &format!("/api/applications/{}", app.id), Some(row))
+        .await;
+    assert_eq!(status, StatusCode::OK, "{saved}");
+    assert_eq!(
+        saved["framework"]["config"]["token"],
+        json!(SECRET_SENTINEL)
+    );
+    let stored = load_application(&catalog, app.id).await?.unwrap();
+    assert_eq!(stored.name, "Vault 2");
+    assert_eq!(stored.framework.config["token"], json!("s3cret"));
+    Ok(())
+}
+
+/// A target's operation (a keystore generator): the module's file lands in the
+/// store and its settings are saved, a second run does not replace the file,
+/// and an answer reaching beyond the target's settings changes nothing.
+#[tokio::test]
+async fn a_target_operation_writes_its_file_and_saves_its_settings() -> sc_error::Result<()> {
+    let (mut client, catalog, dir, _db) = serve("operation").await?;
+    let app = Application::new(
+        "Keys",
+        "keys",
+        FrameworkRef::new("shell")
+            .with("store", "apps")
+            .with("project", "keys"),
+    )
+    .with_file_store(FileStoreId("apps".to_owned()))
+    .with_api(ApiConfig::new("rest", "/api"));
+    save_application(&catalog, &app).await?;
+    let url = |op: &str| {
+        format!(
+            "/api/applications/{}/targets/bundle/operations/{op}",
+            app.id
+        )
+    };
+
+    // The form's unsaved password is what the module is given.
+    let (status, body) = client
+        .send(
+            "POST",
+            &url("make_key"),
+            Some(json!({ "config": { "store": "apps", "project": "keys", "key_password": "typed" } })),
+        )
+        .await;
+    assert_eq!(status, StatusCode::OK, "{body}");
+    assert_eq!(body["message"], json!("made"));
+    assert_eq!(body["files"], json!(["keys/keys.key"]));
+    assert_eq!(body["git_repo"], json!(false));
+    // Settings come back as the form shows them: the secret masked.
+    assert_eq!(body["settings"]["key_file"], json!("keys/keys.key"));
+    assert_eq!(body["settings"]["key_password"], json!(SECRET_SENTINEL));
+    assert_eq!(std::fs::read(dir.0.join("keys/keys.key"))?, b"KEY");
+    let stored = load_application(&catalog, app.id).await?.unwrap();
+    assert_eq!(stored.framework.config["key_file"], json!("keys/keys.key"));
+    assert_eq!(stored.framework.config["key_password"], json!("typed"));
+
+    // Again: the key is not replaced, and nothing is changed.
+    std::fs::write(dir.0.join("keys/keys.key"), "SIGNED-WITH")?;
+    let (status, body) = client
+        .send(
+            "POST",
+            &url("make_key"),
+            Some(json!({ "config": { "store": "apps", "key_password": SECRET_SENTINEL } })),
+        )
+        .await;
+    assert_eq!(status, StatusCode::BAD_REQUEST, "{body}");
+    assert!(body.to_string().contains("already exists"), "{body}");
+    assert_eq!(
+        std::fs::read_to_string(dir.0.join("keys/keys.key"))?,
+        "SIGNED-WITH"
+    );
+
+    // An answer naming a setting that is not the target's writes nothing.
+    let (status, body) = client.send("POST", &url("stray"), Some(json!({}))).await;
+    assert!(
+        status.is_server_error() || status.is_client_error(),
+        "{body}"
+    );
+    assert!(body.to_string().contains("project"), "{body}");
+    assert!(!dir.0.join("keys/stray.key").exists());
+    assert_eq!(
+        load_application(&catalog, app.id)
+            .await?
+            .unwrap()
+            .framework
+            .config["project"],
+        json!("keys")
+    );
+
+    // An operation the target does not declare is not run at all.
+    let (status, _) = client.send("POST", &url("nope"), Some(json!({}))).await;
+    assert_eq!(status, StatusCode::NOT_FOUND);
+    Ok(())
+}
diff --git a/crates/sc-server/tests/file_manager.rs b/crates/sc-server/tests/file_manager.rs
index 10e8bda8..d91f0fb4 100644
--- a/crates/sc-server/tests/file_manager.rs
+++ b/crates/sc-server/tests/file_manager.rs
@@ -603,6 +603,48 @@ async fn a_listing_carries_the_columns_a_file_browser_shows() -> sc_error::Resul
     Ok(())
 }
 
+/// A file setting's choices: the store's files of that kind, without the ones
+/// in dependency folders or a generated native project.
+#[tokio::test]
+async fn list_store_files_skips_dependencies_and_native_projects() -> sc_error::Result<()> {
+    let (mut client, store, _db) = setup().await?;
+    for path in [
+        "todo/assets/icon.png",
+        "todo/assets/Splash.JPG",
+        "todo/src/App.tsx",
+        "logo.svg",
+        "todo/node_modules/pkg/img.png",
+        "todo/android/app/src/main/res/mipmap-hdpi/ic_launcher.png",
+        "todo/android/app/debug.keystore",
+        "keys/release.jks",
+    ] {
+        store.write(path, bytes::Bytes::from_static(b"x")).await?;
+    }
+    let (status, body) = client
+        .send(
+            "GET",
+            "/api/file-stores/docs/files-by-type?extensions=png,jpg,svg",
+            None,
+        )
+        .await;
+    assert_eq!(status, StatusCode::OK, "{body}");
+    assert_eq!(
+        body["paths"],
+        json!(["logo.svg", "todo/assets/Splash.JPG", "todo/assets/icon.png"])
+    );
+    assert_eq!(body["truncated"], json!(false));
+    // A keystore picker, which must not offer the generated debug keystore.
+    let (_, body) = client
+        .send(
+            "GET",
+            "/api/file-stores/docs/files-by-type?extensions=jks,keystore",
+            None,
+        )
+        .await;
+    assert_eq!(body["paths"], json!(["keys/release.jks"]));
+    Ok(())
+}
+
 /// Finding a file by **name**, anywhere under a directory — the file manager's
 /// search box.
 ///
diff --git a/crates/sc-server/tests/file_operations_api.rs b/crates/sc-server/tests/file_operations_api.rs
index 85ce4c6a..c9770d56 100644
--- a/crates/sc-server/tests/file_operations_api.rs
+++ b/crates/sc-server/tests/file_operations_api.rs
@@ -76,6 +76,29 @@ impl Client {
         (status, value)
     }
 
+    /// `GET` a route whose answer is a file: the status, the headers and the
+    /// bytes as they are.
+    async fn get_raw(&mut self, path: &str) -> (StatusCode, axum::http::HeaderMap, Vec<u8>) {
+        let mut builder = Request::builder().method("GET").uri(path);
+        if !self.cookies.is_empty() {
+            let cookie_header = self
+                .cookies
+                .iter()
+                .map(|(k, v)| format!("{k}={v}"))
+                .collect::<Vec<_>>()
+                .join("; ");
+            builder = builder.header(header::COOKIE, cookie_header);
+        }
+        let request = builder.body(Body::empty()).unwrap();
+        let response = self.router.clone().oneshot(request).await.unwrap();
+        let status = response.status();
+        let headers = response.headers().clone();
+        let body = axum::body::to_bytes(response.into_body(), usize::MAX)
+            .await
+            .unwrap();
+        (status, headers, body.to_vec())
+    }
+
     async fn send(&mut self, method: &str, path: &str, body: Option<Value>) -> (StatusCode, Value) {
         let mut builder = Request::builder().method(method).uri(path);
         if !self.cookies.is_empty() {
@@ -457,6 +480,48 @@ async fn upload_rejects_an_unauthenticated_caller() -> sc_error::Result<()> {
     Ok(())
 }
 
+/// The download route: a store file as itself, however large, named for the
+/// browser's save dialog, and behind the same auth and access model as upload.
+#[tokio::test]
+async fn download_serves_the_bytes_as_a_named_file() -> sc_error::Result<()> {
+    let (mut client, store, _db) = setup().await?;
+
+    // Large and binary: what base64-in-JSON could not carry.
+    let payload: Vec<u8> = (0u8..=255).cycle().take(3 * 1024 * 1024).collect();
+    store
+        .write(
+            "app/outputs/app-debug.apk",
+            bytes::Bytes::from(payload.clone()),
+        )
+        .await?;
+
+    let (status, headers, body) = client
+        .get_raw("/download/docs/app/outputs/app-debug.apk")
+        .await;
+    assert_eq!(status, StatusCode::OK);
+    assert_eq!(body, payload);
+    assert_eq!(
+        headers[header::CONTENT_DISPOSITION],
+        "attachment; filename=\"app-debug.apk\""
+    );
+    assert_eq!(
+        headers[header::CONTENT_TYPE],
+        "application/vnd.android.package-archive"
+    );
+
+    // A missing file is a 404, and a caller without a session gets nothing.
+    let (status, _, _) = client.get_raw("/download/docs/app/nothing.apk").await;
+    assert_eq!(status, StatusCode::NOT_FOUND);
+    client.cookies.remove(sc_server::SESSION_COOKIE);
+    let (status, _, body) = client
+        .get_raw("/download/docs/app/outputs/app-debug.apk")
+        .await;
+    assert_eq!(status, StatusCode::UNAUTHORIZED);
+    assert_ne!(body, payload);
+
+    Ok(())
+}
+
 /// A path that is not there is **404, not 500** — the distinction the IDE's
 /// filesystem (§12.1) is built on.
 ///
diff --git a/crates/sc-types/src/field.rs b/crates/sc-types/src/field.rs
index bfa17d97..5d7e1153 100644
--- a/crates/sc-types/src/field.rs
+++ b/crates/sc-types/src/field.rs
@@ -99,6 +99,26 @@ pub enum OptionsSource {
     ServerQuery(String),
 }
 
+/// One condition of a [`show_if`](FormField::show_if): setting `setting` must
+/// hold one of the `allowed` values — `build_type` must be `"release"`.
+#[derive(Debug, Clone, PartialEq)]
+pub struct ShowIfCondition {
+    /// The setting the condition looks at — `build_type`.
+    pub setting: String,
+    /// The values it may hold for the condition to be met — `["release"]`.
+    pub allowed: Vec<Json>,
+}
+
+impl ShowIfCondition {
+    /// The condition that `setting` holds one of `allowed`.
+    pub fn new(setting: impl Into<String>, allowed: Vec<Json>) -> ShowIfCondition {
+        ShowIfCondition {
+            setting: setting.into(),
+            allowed,
+        }
+    }
+}
+
 /// A field in a form: enough to render an input control for it, and to check
 /// what comes back (design §6.2).
 ///
@@ -179,6 +199,15 @@ pub struct FormField {
     /// alternative is an admin screen that knows `run_js_code`'s `code` setting
     /// by name, which is the coupling this vocabulary exists to remove.
     pub code_language: Option<String>,
+    /// When the field applies at all: every named setting resolves to one of
+    /// the values listed for it — v1's `showIf`, `{ build_type: ["release"] }`.
+    /// Empty means always.
+    ///
+    /// A field that does not apply is hidden by the admin UI and is **not
+    /// required** ([`validate`](FormField::validate)): an own keystore's alias
+    /// is required only when signing with an own keystore is switched on. Its
+    /// value is kept rather than cleared, so switching back restores it.
+    pub show_if: Vec<ShowIfCondition>,
     // Post-MVP (§6.2, §6.3, §12): `fieldview: FieldViewRef` and
     // `visibility: Option<Formula>`. Both name types that do not exist yet —
     // fieldviews and formulas are out of MVP scope — so they are left out rather
@@ -198,9 +227,32 @@ impl FormField {
             secret: false,
             create_only: false,
             code_language: None,
+            show_if: Vec::new(),
         }
     }
 
+    /// Apply this field only while setting `name` resolves to one of `values`
+    /// (see [`show_if`](FormField::show_if)). Called again for another setting,
+    /// every condition must hold.
+    pub fn show_if(mut self, name: impl Into<String>, values: Vec<Json>) -> FormField {
+        self.show_if.push(ShowIfCondition::new(name, values));
+        self
+    }
+
+    /// Whether the field applies to `attrs` under `spec` (see
+    /// [`show_if`](FormField::show_if)). A condition naming a setting `spec`
+    /// does not have compares against nothing, and so does not hold.
+    pub fn applies(&self, spec: &[FormField], attrs: &Attrs) -> bool {
+        self.show_if.iter().all(|condition| {
+            let current = spec
+                .iter()
+                .find(|f| f.base.name == condition.setting)
+                .and_then(|f| f.resolve(attrs))
+                .or_else(|| attrs.get(&condition.setting));
+            current.is_some_and(|v| condition.allowed.iter().any(|a| same_setting(a, v)))
+        })
+    }
+
     /// The field's name — the key it occupies in an [`Attrs`] bag.
     pub fn name(&self) -> &str {
         &self.base.name
@@ -387,7 +439,17 @@ impl FormField {
 /// inventing one here is out of proportion to a settings form.
 pub fn validate_attrs(spec: &[FormField], attrs: &Attrs) -> Result<()> {
     for field in spec {
-        field.validate(attrs)?;
+        if field.applies(spec, attrs) {
+            field.validate(attrs)?;
+        } else {
+            // Not applying, it is not required — but what it holds is still
+            // checked, since it comes back the moment the field applies again.
+            let optional = FormField {
+                required: false,
+                ..field.clone()
+            };
+            optional.validate(attrs)?;
+        }
     }
     for key in attrs.keys() {
         if !spec.iter().any(|f| &f.base.name == key) {
@@ -501,6 +563,17 @@ pub fn preserve_create_only(spec: &[FormField], stored: &Attrs, submitted: &Attr
 }
 
 /// A JSON value's shape, for error messages.
+/// Whether a `show_if` value matches a setting's value. Compared as JSON, and
+/// also as text, because a form posts a checkbox as `"true"` where a
+/// declaration says `true`.
+fn same_setting(allowed: &Json, value: &Json) -> bool {
+    let text = |v: &Json| match v {
+        Json::String(s) => s.clone(),
+        other => other.to_string(),
+    };
+    allowed == value || text(allowed) == text(value)
+}
+
 fn json_kind(value: &Json) -> &'static str {
     match value {
         Json::Null => "null",
@@ -856,4 +929,43 @@ mod tests {
             submitted
         );
     }
+
+    #[test]
+    fn a_field_that_does_not_apply_is_not_required() {
+        let spec = vec![
+            FormField::new("build_type", BasicType::Text).default_value("release"),
+            FormField::new("own_key", BasicType::Bool)
+                .default_value(false)
+                .show_if("build_type", vec![json!("release")]),
+            FormField::new("alias", BasicType::Text)
+                .required()
+                .show_if("build_type", vec![json!("release")])
+                .show_if("own_key", vec![json!(true)]),
+        ];
+        let attrs = |pairs: &[(&str, Json)]| -> Attrs {
+            pairs
+                .iter()
+                .map(|(k, v)| ((*k).to_owned(), v.clone()))
+                .collect()
+        };
+        // Switched off (by default): the alias is not asked for.
+        assert!(!spec[2].applies(&spec, &attrs(&[])));
+        validate_attrs(&spec, &attrs(&[])).unwrap();
+        // Switched on, for a release build: it is.
+        let on = attrs(&[("own_key", json!(true))]);
+        assert!(spec[2].applies(&spec, &on));
+        let msg = validate_attrs(&spec, &on).unwrap_err().to_string();
+        assert!(msg.contains("alias"), "{msg}");
+        // A form posts the checkbox as text; it means the same.
+        assert!(spec[2].applies(&spec, &attrs(&[("own_key", json!("true"))])));
+        // A debug build hides it again, whatever the checkbox says.
+        let debug = attrs(&[("own_key", json!(true)), ("build_type", json!("debug"))]);
+        assert!(!spec[2].applies(&spec, &debug));
+        validate_attrs(&spec, &debug).unwrap();
+        // A hidden value is still checked for what it holds, required or not.
+        let wrong = attrs(&[("build_type", json!("debug")), ("alias", json!(5))]);
+        assert!(validate_attrs(&spec, &wrong).is_err());
+        let wrong = attrs(&[("build_type", json!("debug")), ("own_key", json!("maybe"))]);
+        assert!(validate_attrs(&spec, &wrong).is_err());
+    }
 }
diff --git a/crates/sc-types/src/lib.rs b/crates/sc-types/src/lib.rs
index 0307080f..d0b13e20 100644
--- a/crates/sc-types/src/lib.rs
+++ b/crates/sc-types/src/lib.rs
@@ -48,8 +48,8 @@ mod type_ref;
 pub use attrs::Attrs;
 pub use basic::BasicType;
 pub use field::{
-    BaseField, FormField, OptionsSource, SECRET_SENTINEL, merge_secrets, preserve_create_only,
-    redact_attrs, validate_attrs,
+    BaseField, FormField, OptionsSource, SECRET_SENTINEL, ShowIfCondition, merge_secrets,
+    preserve_create_only, redact_attrs, validate_attrs,
 };
 pub use i18n::{translate_field, translate_spec};
 pub use json::{json_to_value, value_to_json};
diff --git a/docs/TECHNICAL_DESIGN.md b/docs/TECHNICAL_DESIGN.md
index 96abd401..091bc58c 100644
--- a/docs/TECHNICAL_DESIGN.md
+++ b/docs/TECHNICAL_DESIGN.md
@@ -5298,6 +5298,36 @@ needs `ANDROID_HOME` and `JAVA_HOME`; an iOS target will add `{ os: "macos" }`,
 with the tools' own message, and still builds and serves the web bundle. The built-in frameworks declare none.
 `plugins/react-native` is the one that does.
 
+**A target's own settings are application settings, shown under the target.** A target may
+declare `options`, fields in the same vocabulary as `config_fields`. They configure that target
+for one application (an APK's application ID, version, icon and build type), so they are not the
+module's settings (which hold the machine's toolchain) and not the build button's (which only
+starts a build). When the module loads they are **appended to the framework's `config_spec`**,
+so they are stored, validated, handed to the generators as `ctx.settings` and interpolated by
+templates exactly as the framework's own settings are. A name already taken by a setting or by
+another target's option is refused. The target's `command` is a template too, as its `artifact`
+is, so an option can pick the task (`npm run build:android:{{ build_type }}`). `listFrameworks`
+names each target's options, and the application form shows them in a card per target instead
+of among the framework's settings. A setting declaring `server_query: "store_files:png,jpg"`
+holds a file of that kind in the application's store (an icon, a keystore). The form offers the
+files `listStoreFiles` finds there, skipping dependency folders and generated native projects.
+The value is a store-relative path, and on save it is unrestricted. A setting may also declare
+v1's `showIf` (`{ build_type: "release", own_keystore: true }`): the form hides it while any
+condition fails, and the server does not require it then, so "sign with your own keystore" shows
+the keystore's settings only when it is ticked. A target's `env` values are templates too, which
+is how a secret setting (the keystore password) reaches the build without being written into
+the project. An application's secret framework settings are masked in what the admin API sends
+and kept when a save hands the mask back, as a provider's are; a backup keeps them.
+A target may also declare `operations`, buttons under its settings shown on a `showIf`: the module
+runs its own code (`plugins/react-native` generates a signing keystore with node-forge, so no JDK
+or permission to run one is needed) and answers files and settings. The server writes the files
+into the application's store, never over an existing file (a replaced keystore is an app that
+can no longer be updated), saves the settings, which must be the target's own, and says when the
+store is a git repository that would commit them.
+`plugins/react-native` writes everything else into `src/feldspar/native.json` on every build,
+and the project's `app.config.js` checks it when `expo prebuild` writes the Android project
+(not on the web export, which reads the same file).
+
 **The context the generator receives carries the derivations, not just the data.** Whether a
 page may offer a delete button, what a table hangs off the client as, which columns a create
 form asks for and which the database issues — each is a question answered *by asking the
diff --git a/plugins/react-native/index.js b/plugins/react-native/index.js
index 49e170a6..800d9bc8 100644
--- a/plugins/react-native/index.js
+++ b/plugins/react-native/index.js
@@ -5,7 +5,7 @@
 // Native components through react-native-web into a static SPA, which is served,
 // mounted and reloaded exactly as a React or Vue app is. The **Android APK** is a
 // build *target* (`targets.android` below): `expo prebuild` writes the native
-// project and Gradle builds a release APK from it, left in the file store for the
+// project and Gradle builds a release or debug APK from it, left in the file store for the
 // admin to take away. It needs an Android SDK and a JDK, whose directories are
 // this module's own settings (Settings → Modules → React Native): they are set
 // as `ANDROID_HOME` and `JAVA_HOME` on the APK build, so the server does not
@@ -124,19 +124,119 @@ const configuration_workflow = () => ({
   ],
 });
 
-/** The builds offered beside the web bundle. The artifact is where Gradle
- * leaves a release APK in the project `expo prebuild` writes; the environment
- * is this module's settings. A setting left blank is left out, so the build
- * falls back to the server's own environment. */
+/** The APK's own settings: the target's `options`. Saltcorn stores them with
+ * the application's other settings and shows them in the application's form,
+ * under the target; the sidebar's button only starts a build. `runtime` writes
+ * them into `src/feldspar/native.json`, which `app.config.js` reads when
+ * `expo prebuild` writes the native project. Blank means the default here. */
+const ANDROID_DEFAULTS = { app_version: "1.0.0", build_type: "release" };
+
+const android_options = [
+  {
+    name: "app_id",
+    label: "Application ID (blank: com.feldspar.<subdomain>)",
+    type: "String",
+    default: "",
+  },
+  {
+    name: "app_version",
+    label: "Version (major.minor.patch)",
+    type: "String",
+    default: ANDROID_DEFAULTS.app_version,
+  },
+  {
+    name: "app_icon",
+    label: "Icon (a square PNG, ideally 1024×1024; blank: Expo's)",
+    type: "String",
+    server_query: "store_files:png,jpg,jpeg",
+  },
+  {
+    name: "build_type",
+    label: "Build type",
+    type: "String",
+    required: true,
+    default: ANDROID_DEFAULTS.build_type,
+    attributes: { options: ["release", "debug"] },
+  },
+  // What a release build is packaged as. An APK installs on a phone; an AAB
+  // cannot be installed directly and is what the Play Store takes, which
+  // also wants it signed with your own keystore. A debug build is always an
+  // APK, so the choice is offered for release builds only.
+  {
+    name: "package_format",
+    label: "Package (apk: installs on a phone; aab: for Play Store upload, signed with your own keystore)",
+    type: "String",
+    required: true,
+    default: "apk",
+    attributes: { options: ["apk", "aab"] },
+    showIf: { build_type: "release" },
+  },
+  // Signing. A debug APK is always signed with the debug key, which is what a
+  // debug build is for; a release one is signed with Expo's debug keystore too
+  // unless the admin brings their own — fine for sideloading, refused by the
+  // Play Store. So the choice exists for release builds only, and the keystore
+  // settings only once it is made.
+  {
+    name: "own_keystore",
+    label: "Sign with your own keystore (otherwise the debug key: fine for sideloading, not for the Play Store)",
+    type: "Bool",
+    default: false,
+    showIf: { build_type: "release" },
+  },
+  {
+    name: "keystore_file",
+    label: "Keystore file (.jks, .keystore or .p12, uploaded to the file store)",
+    type: "String",
+    required: true,
+    server_query: "store_files:jks,keystore,p12",
+    showIf: { build_type: "release", own_keystore: true },
+  },
+  {
+    name: "keystore_alias",
+    label: "Key alias",
+    type: "String",
+    required: true,
+    showIf: { build_type: "release", own_keystore: true },
+  },
+  {
+    name: "keystore_password",
+    label: "Keystore password (also the key's password)",
+    type: "String",
+    input_type: "password",
+    required: true,
+    showIf: { build_type: "release", own_keystore: true },
+  },
+];
+
+/** The builds offered beside the web bundle. The build type picks the Gradle
+ * task and so where the APK lands; the environment is this module's settings.
+ * A setting left blank is left out, so the build falls back to the server's own
+ * environment. */
 function targets(configuration) {
   return {
     android: {
-      label: "Android APK",
-      command: "npm run build:android",
-      artifact: "{{ project }}/android/app/build/outputs/apk/release/app-release.apk",
+      label: "Android app",
+      // One script per build type and package; each leaves its result at a
+      // fixed path outside `android/`, which `prebuild --clean` deletes.
+      command: "npm run build:android:{{ build_type }}-{{ package_format }}",
+      artifact: "{{ project }}/android-output/app-{{ build_type }}.{{ package_format }}",
+      options: android_options,
+      operations: {
+        generate_keystore: {
+          label: "Generate a keystore",
+          description:
+            "Creates a new signing key in the file store (keys/<subdomain>-release.p12) and fills " +
+            "in the settings above. A blank password gets a strong one, shown once.",
+          showIf: { build_type: "release", own_keystore: true },
+          run: generateKeystore,
+        },
+      },
       env: {
         ANDROID_HOME: configuration.android_home || "",
         JAVA_HOME: configuration.java_home || "",
+        // The keystore password reaches Gradle here, never through a file in
+        // the project (`app.config.js` reads it from the environment).
+        FELDSPAR_KEYSTORE_PASSWORD: "{{ keystore_password }}",
       },
       // Checked before a build starts and shown on the button: a server without
       // the toolchain says so at once, instead of Gradle saying it minutes into a
@@ -157,6 +257,64 @@ function targets(configuration) {
   };
 }
 
+/** Generate a signing keystore for the application: an RSA 2048 key with a
+ * self-signed certificate valid for 10,000 days (Google Play wants validity
+ * past 2033), as PKCS12, which Gradle and Java's `keytool` read. Pure
+ * JavaScript (node-forge), so it needs no JDK and no permission to run one.
+ *
+ * Saltcorn writes the file into the application's store — refusing to replace
+ * an existing one — and saves the settings; this only makes them. The alias
+ * and password are the ones in the form, or `upload` and a random password. */
+function generateKeystore(ctx) {
+  const forge = require("node-forge");
+  const settings = ctx.settings || {};
+  const app = ctx.app || {};
+  const alias = String(settings.keystore_alias || "").trim() || "upload";
+  let password = String(settings.keystore_password || "");
+  const generated = password === "";
+  if (generated) {
+    password = forge.util.encode64(forge.random.getBytesSync(18)).replace(/[+/=]/g, "x");
+  }
+  if (password.length < 6) {
+    throw new Error("A keystore password needs at least 6 characters; Java refuses shorter ones.");
+  }
+
+  const keys = forge.pki.rsa.generateKeyPair({ bits: 2048 });
+  const cert = forge.pki.createCertificate();
+  cert.publicKey = keys.publicKey;
+  // Positive, and random so two keys are never confused for each other.
+  cert.serialNumber = `01${forge.util.bytesToHex(forge.random.getBytesSync(15))}`;
+  cert.validity.notBefore = new Date();
+  cert.validity.notAfter = new Date(Date.now() + 10000 * 24 * 60 * 60 * 1000);
+  const subject = [{ name: "commonName", value: String(app.name || app.subdomain || "App") }];
+  cert.setSubject(subject);
+  cert.setIssuer(subject);
+  cert.sign(keys.privateKey, forge.md.sha256.create());
+  const p12 = forge.pkcs12.toPkcs12Asn1(keys.privateKey, [cert], password, {
+    algorithm: "3des",
+    friendlyName: alias,
+    generateLocalKeyId: true,
+  });
+
+  const name = String(app.subdomain || "app").toLowerCase().replace(/[^a-z0-9_-]/g, "-");
+  const path = `keys/${name}-release.p12`;
+  const keep =
+    "Keep a copy of the keystore and its password somewhere safe: an app signed with it " +
+    "can only be updated with it.";
+  return {
+    files: [{ path, base64: forge.util.encode64(forge.asn1.toDer(p12).getBytes()) }],
+    settings: {
+      own_keystore: true,
+      keystore_file: path,
+      keystore_alias: alias,
+      keystore_password: password,
+    },
+    message: generated
+      ? `Generated ${path} with the key "${alias}". Its password, shown only now: ${password} — ${keep}`
+      : `Generated ${path} with the key "${alias}" and the password you entered. ${keep}`,
+  };
+}
+
 /** The builder agent's system prompt: its role and this platform. */
 const builder_prompt = `You build the \`{{ app }}\` application, an Expo (React Native) project \
 served on the web at the \`{{ subdomain }}\` subdomain and built into an Android APK. Its source \
@@ -416,6 +574,7 @@ matching types and hooks exist at the next build.
 | \`helper.ts\` | how a request is made and how a failure is reported — the same in every application |
 | \`hooks.ts\` | React hooks over that client, one set per table |
 | \`config.ts\` | the application's URL, which a phone sends its requests to |
+| \`native.json\` | the APK's application ID, version, icon and build type, which \`app.config.js\` reads |
 | \`schema.sql\` | a description of this application's tables, for writing SQL against |
 | \`SKILL.md\` | the half of the application that is *not* in this repository |
 
@@ -445,12 +604,17 @@ feldspar api add-query --app ${ctx.app.subdomain} --name recentPosts \\
  * `react-native`, `react-dom` and `react-native-web` it was tested with, and a
  * project that mixes SDKs builds on neither target.
  *
- * `build` is the web bundle Saltcorn serves. `build:android` is the Android
- * target: `expo prebuild` writes the native project into `android/` (generated,
- * ignored by git), and Gradle builds a release APK from it. A release build
- * because it carries its JavaScript inside — a debug one would need a Metro dev
- * server running beside the phone. `--no-daemon` because it is a server that
- * runs it, and a Gradle daemon left behind is a gigabyte nobody asked for. */
+ * `build` is the web bundle Saltcorn serves. The `build:android:<type>-<package>`
+ * scripts are the Android target, one per build type (release, debug) and
+ * package (apk, aab): `expo prebuild --clean` writes the native project into
+ * `android/` afresh (generated, ignored by git, so a changed application id or
+ * icon is never half-applied), Gradle builds it (`assemble…` for an APK,
+ * `bundle…` for an AAB), and the result is copied to
+ * `android-output/app-<type>.<package>`, where the server picks it up. Every
+ * build carries its JavaScript inside (`app.config.js` sees to the debug one),
+ * so none needs a Metro dev server beside the phone. `--no-daemon` because it is
+ * a server that runs it, and a Gradle daemon left behind is a gigabyte nobody
+ * asked for. */
 function packageJson(ctx) {
   const buildProperties = cleartext(ctx)
     ? `,\n    "expo-build-properties": "~57.0.22"`
@@ -464,7 +628,7 @@ function packageJson(ctx) {
     "start": "expo start",
     "build": "tsc --noEmit && expo export --platform web --output-dir dist",
     "typecheck": "tsc --noEmit",
-    "build:android": "expo prebuild --platform android --no-install && cd android && ./gradlew assembleRelease --no-daemon"
+${androidScripts()}
   },
   "dependencies": {
     "@expo/metro-runtime": "~57.0.16",
@@ -482,6 +646,29 @@ function packageJson(ctx) {
 `;
 }
 
+/** The `build:android:<type>-<package>` scripts (see `packageJson`), as
+ * `package.json` lines. A debug AAB is not offered in the form, but its script
+ * exists: a release build switched back to debug keeps "aab" in its (then
+ * hidden) package setting. */
+function androidScripts() {
+  const prebuild = "expo prebuild --platform android --clean --no-install";
+  const lines = [];
+  for (const type of ["release", "debug"]) {
+    const Type = type[0].toUpperCase() + type.slice(1);
+    for (const [pkg, task, dir] of [
+      ["apk", `assemble${Type}`, "apk"],
+      ["aab", `bundle${Type}`, "bundle"],
+    ]) {
+      const output = `app/build/outputs/${dir}/${type}/app-${type}.${pkg}`;
+      lines.push(
+        `    "build:android:${type}-${pkg}": "${prebuild} && cd android && ./gradlew ${task} ` +
+          `--no-daemon && mkdir -p ../android-output && cp ${output} ../android-output/app-${type}.${pkg}"`,
+      );
+    }
+  }
+  return lines.join(",\n");
+}
+
 /** Where the APK sends its requests: the `mobile_url` setting when the admin
  * gave one, the application's own URL otherwise. Without a trailing slash, since
  * the client appends paths that start with one. */
@@ -496,8 +683,8 @@ function mobileUrl(ctx) {
  * carry the permission it does not need. Decided when the project is written. */
 const cleartext = (ctx) => /^http:/i.test(mobileUrl(ctx));
 
-/** The Android application id: `com.feldspar.<subdomain>`, as Java package
- * segments — lowercase letters, digits and `_`, starting with a letter. */
+/** The default Android application id: `com.feldspar.<subdomain>`, as Java
+ * package segments — lowercase letters, digits and `_`, starting with a letter. */
 function androidPackage(ctx) {
   let segment = String(ctx.app.subdomain || ctx.name || "app")
     .toLowerCase()
@@ -506,26 +693,181 @@ function androidPackage(ctx) {
   return `com.feldspar.${segment}`;
 }
 
-/** Expo's app configuration. `web.output: "single"` is an SPA — one
- * `index.html` Saltcorn's fallback serves for every path. */
-function appJson(ctx) {
-  const config = {
-    expo: {
-      name: ctx.app.name,
-      slug: ctx.name,
-      version: "1.0.0",
+/** A store-relative path as a path relative to the project directory, which
+ * is what Expo resolves `icon` against. `null` for a path that climbs. */
+function projectRelative(ctx, storePath) {
+  const parts = String(storePath).split("/").filter((p) => p && p !== ".");
+  if (parts.includes("..")) return null;
+  const project = String(ctx.project || "").split("/").filter((p) => p && p !== ".");
+  let common = 0;
+  while (common < project.length && project[common] === parts[common]) common++;
+  return [...project.slice(common).map(() => ".."), ...parts.slice(common)].join("/");
+}
+
+/** `native.json`: the APK's settings, rewritten on every build so a changed
+ * setting reaches the next APK. Checked by `app.config.js` when the Android
+ * project is written, not here: this is written by every web build too, which
+ * a bad version must not fail. The keystore password is not in it: it reaches
+ * the build through its environment. */
+function nativeJson(ctx) {
+  const settings = ctx.settings || {};
+  const text = (name) => String(settings[name] ?? "").trim();
+  const icon = text("app_icon");
+  const buildType = text("build_type") || ANDROID_DEFAULTS.build_type;
+  // Its own keystore signs a release build only; the password is not here.
+  const keystore = text("keystore_file");
+  const signing =
+    buildType === "release" && text("own_keystore") === "true"
+      ? {
+          keystore: keystore ? projectRelative(ctx, keystore) ?? keystore : null,
+          alias: text("keystore_alias"),
+        }
+      : null;
+  return `${JSON.stringify(
+    {
+      appId: text("app_id") || androidPackage(ctx),
+      version: text("app_version") || ANDROID_DEFAULTS.app_version,
+      icon: icon ? projectRelative(ctx, icon) ?? icon : null,
+      buildType,
+      signing,
+    },
+    null,
+    2,
+  )}\n`;
+}
+
+/** Expo's app configuration, as code so it can read what Saltcorn generates.
+ * The application id, version, icon and signing come from `native.json` (the
+ * application's "Android app" settings) and are checked when `expo prebuild`
+ * writes the Android project — not on the web export, which reads this file
+ * too — so a bad one fails the APK build with a sentence rather than Gradle's.
+ * `web.output: "single"` is an SPA — one `index.html` Saltcorn's fallback
+ * serves for every path. Written once: the project's to change. */
+function appConfigJs(ctx) {
+  const cleartextPlugin = cleartext(ctx)
+    ? `\n        ["expo-build-properties", { android: { usesCleartextTraffic: true } }],`
+    : "";
+  return `// Expo's configuration. The Android settings come from the application's
+// "Android app" settings in Saltcorn, which every build writes into
+// ${ctx.runtime}/native.json.
+const fs = require("fs");
+const path = require("path");
+const { withAppBuildGradle, withGradleProperties } = require("expo/config-plugins");
+
+const native = JSON.parse(fs.readFileSync(path.join(__dirname, ${JSON.stringify(`${ctx.runtime}/native.json`)}), "utf8"));
+
+// Android installs an update only over a lower versionCode, so it follows the
+// version: 1.2.3 is 1002003.
+const version = /^(\\d{1,3})\\.(\\d{1,3})\\.(\\d{1,3})$/.exec(native.version || "");
+const versionCode = version
+  ? Number(version[1]) * 1000000 + Number(version[2]) * 1000 + Number(version[3])
+  : undefined;
+const iconExists = Boolean(native.icon) && fs.existsSync(path.join(__dirname, native.icon));
+
+/** The Android settings, checked when \`expo prebuild\` writes the Android
+ * project, so a bad one fails the APK build with a sentence rather than
+ * Gradle's — and never the web export, which evaluates this file too. */
+function checkAndroid() {
+  if (!/^[a-zA-Z][a-zA-Z0-9_]*(\\.[a-zA-Z][a-zA-Z0-9_]*)+$/.test(native.appId)) {
+    throw new Error(
+      \`The application ID "\${native.appId}" is not a Java package name: two or more dot-separated \` +
+        "segments of letters, digits and _, each starting with a letter (com.example.todo).",
+    );
+  }
+  if (!version) {
+    throw new Error(\`The version "\${native.version}" is not major.minor.patch, e.g. 1.2.3.\`);
+  }
+  if (versionCode === 0) {
+    throw new Error("The version 0.0.0 cannot be installed; use 0.0.1 or later.");
+  }
+  if (native.icon) {
+    if (!/\\.(png|jpe?g)$/i.test(native.icon)) {
+      throw new Error(\`The icon "\${native.icon}" is not a PNG or JPEG, which Android needs.\`);
+    }
+    if (!iconExists) {
+      throw new Error(\`The icon "\${native.icon}" does not exist (relative to the project).\`);
+    }
+  }
+  if (native.signing) {
+    const { keystore, alias } = native.signing;
+    if (!keystore || !fs.existsSync(path.join(__dirname, keystore))) {
+      throw new Error(\`The keystore "\${keystore || ""}" does not exist (relative to the project).\`);
+    }
+    if (!alias) throw new Error("Signing with your own keystore needs the key's alias.");
+    if (!process.env.FELDSPAR_KEYSTORE_PASSWORD) {
+      throw new Error(
+        "Signing with your own keystore needs its password; set it in the application's " +
+          "Android app settings and build from Saltcorn.",
+      );
+    }
+  }
+}
+
+/** A Groovy string literal: single-quoted, so a \`$\` in it is not interpolated. */
+const groovy = (text) => \`'\${String(text).replace(/\\\\/g, "\\\\\\\\").replace(/'/g, "\\\\'")}'\`;
+
+/** What \`app/build.gradle\` needs beyond Expo's: a debug build that carries its
+ * JavaScript bundle (as a release one does, so it runs without a Metro dev
+ * server beside the phone), and a release build signed with the application's
+ * own keystore. The password is read from the build's environment, so it is
+ * never written into the project. */
+const withAndroidBuild = (config) =>
+  withAppBuildGradle(config, (mod) => {
+    checkAndroid();
+    let gradle = mod.modResults.contents;
+    if (native.buildType === "debug" && !gradle.includes("debuggableVariants = []")) {
+      gradle = gradle.replace(/react\\s*\\{/, (open) => \`\${open}\\n    debuggableVariants = []\`);
+    }
+    if (native.buildType === "release" && native.signing && !gradle.includes("FELDSPAR_KEYSTORE_PASSWORD")) {
+      const keystore = path.resolve(__dirname, native.signing.keystore);
+      gradle = gradle.replace(
+        /signingConfigs\\s*\\{/,
+        (open) =>
+          \`\${open}\\n        release {\\n\` +
+          \`            storeFile file(\${groovy(keystore)})\\n\` +
+          \`            storePassword System.getenv("FELDSPAR_KEYSTORE_PASSWORD")\\n\` +
+          \`            keyAlias \${groovy(native.signing.alias)}\\n\` +
+          \`            keyPassword System.getenv("FELDSPAR_KEYSTORE_PASSWORD")\\n\` +
+          \`        }\`,
+      );
+      gradle = gradle.replace(
+        /(buildTypes\\s*\\{[\\s\\S]*?release\\s*\\{[\\s\\S]*?)signingConfig signingConfigs\\.debug/,
+        "$1signingConfig signingConfigs.release",
+      );
+    }
+    mod.modResults.contents = gradle;
+    return mod;
+  });
+
+/** Native code for 64-bit devices only: \`arm64-v8a\` (nearly every phone) and
+ * \`x86_64\` (an emulator on a PC). Each architecture adds 20–30 MB to the APK,
+ * and the 32-bit ones (\`armeabi-v7a\`, \`x86\`) are for devices too old to matter. */
+const ARCHITECTURES = "arm64-v8a,x86_64";
+const withArchitectures = (config) =>
+  withGradleProperties(config, (mod) => {
+    mod.modResults = mod.modResults.filter(
+      (item) => !(item.type === "property" && item.key === "reactNativeArchitectures"),
+    );
+    mod.modResults.push({ type: "property", key: "reactNativeArchitectures", value: ARCHITECTURES });
+    return mod;
+  });
+
+module.exports = () =>
+  withArchitectures(
+    withAndroidBuild({
+      name: ${JSON.stringify(ctx.app.name)},
+      slug: ${JSON.stringify(ctx.name)},
+      version: native.version,
       orientation: "portrait",
       userInterfaceStyle: "light",
-      android: { package: androidPackage(ctx) },
+      ...(iconExists ? { icon: native.icon } : {}),
+      android: { package: native.appId, ...(versionCode ? { versionCode } : {}) },
       web: { output: "single", bundler: "metro" },
-    },
-  };
-  if (cleartext(ctx)) {
-    config.expo.plugins = [
-      ["expo-build-properties", { android: { usesCleartextTraffic: true } }],
-    ];
-  }
-  return `${JSON.stringify(config, null, 2)}\n`;
+      plugins: [${cleartextPlugin}
+      ],
+    }),
+  );
+`;
 }
 
 /** Expo's base settings (it knows what Metro and React Native expect), with the
@@ -546,13 +888,15 @@ const TSCONFIG = `{
 `;
 
 /** The generated runtime is part of the source; `android/` and `ios/` are what
- * `expo prebuild` writes, and are rewritten from `app.json` on every target
- * build; `build-logs/` is where the server writes each target build's log. The last lines are the session files `feldspar auth token` writes. */
+ * `expo prebuild` writes, and are rewritten from `app.config.js` on every target
+ * build; `android-output/` is where each build leaves its APK or AAB;
+ * `build-logs/` is where the server writes each target build's log. The last lines are the session files `feldspar auth token` writes. */
 const GITIGNORE = `node_modules
 dist
 .expo
 android
 ios
+android-output
 build-logs
 *.local
 .feldspar-session
@@ -1114,15 +1458,19 @@ function agentsMd(ctx) {
   return `# ${ctx.app.name}
 
 An Expo (React Native) application, served by Saltcorn on the web at
-${ctx.app.url} and built into an Android APK with the admin UI's
-**Build Android APK** button (\`npm run build:android\`).
+${ctx.app.url} and built into an Android APK or AAB with the admin UI's
+**Build Android app** button (\`npm run build:android:<type>-<package>\`, e.g.
+\`build:android:release-aab\`, by the application's "Build type" and "Package"
+settings; the result lands in \`android-output/\`). The application ID, version,
+icon and signing are the application's "Android app" settings in Saltcorn,
+written into \`${ctx.runtime}/native.json\` on every build.
 
 ## Layout
 
 | path | what it is |
 |---|---|
 | \`index.ts\` | the entry point, on every platform |
-| \`app.json\` | Expo's configuration — the app's name and Android package |
+| \`app.config.js\` | Expo's configuration — reads the APK's settings from \`${ctx.runtime}/native.json\` |
 | \`src/Root.tsx\` | the providers around the shell |
 | \`src/App.tsx\` | the shell: header, nav, the current screen |
 | \`src/routes.tsx\` | the routes, as data |
@@ -1171,7 +1519,7 @@ The query becomes a typed method on \`${ctx.client}\` at the next build.
 function scaffold(ctx) {
   const files = [
     { path: "package.json", contents: packageJson(ctx) },
-    { path: "app.json", contents: appJson(ctx) },
+    { path: "app.config.js", contents: appConfigJs(ctx) },
     { path: "tsconfig.json", contents: TSCONFIG },
     { path: ".gitignore", contents: GITIGNORE },
     { path: "AGENTS.md", contents: agentsMd(ctx) },
@@ -1198,6 +1546,7 @@ function runtime(ctx) {
   return [
     { path: at(ctx.runtime, "hooks.ts"), contents: hooksTs(ctx) },
     { path: at(ctx.runtime, "config.ts"), contents: configTs(ctx) },
+    { path: at(ctx.runtime, "native.json"), contents: nativeJson(ctx) },
     { path: at(ctx.runtime, "README.md"), contents: runtimeReadme(ctx) },
   ];
 }
@@ -1213,7 +1562,7 @@ module.exports = {
       label: "React Native",
       description:
         "Saltcorn creates an Expo (React Native) project, generates a typed client and hooks " +
-        "for your tables, and serves it on the web; an Android APK is one more button. " +
+        "for your tables, and serves it on the web; an Android APK or AAB is one more button. " +
         "Pick a file store and a name.",
       config_fields,
       build,
diff --git a/plugins/react-native/package.json b/plugins/react-native/package.json
index 803b3e49..953e4e9f 100644
--- a/plugins/react-native/package.json
+++ b/plugins/react-native/package.json
@@ -4,5 +4,8 @@
   "description": "The React Native (web) application framework for Saltcorn Feldspar.",
   "main": "index.js",
   "license": "MIT",
-  "private": true
+  "private": true,
+  "dependencies": {
+    "node-forge": "^1.4.0"
+  }
 }
diff --git a/ui/admin/src/api.ts b/ui/admin/src/api.ts
index 976d1f0e..6f4c7daf 100644
--- a/ui/admin/src/api.ts
+++ b/ui/admin/src/api.ts
@@ -72,6 +72,15 @@ export async function uploadFile(
   if (!res.ok) throw await rawError("uploadFile", res);
 }
 
+/** Where a store file downloads from as itself (`GET /download/{store}/{*path}`,
+ * outside the generated client for `uploadFile`'s reason). A link to it lets
+ * the browser fetch and save the bytes directly, at any size, instead of
+ * `readFile`'s base64 in JSON. */
+export function downloadUrl(store: string, path: string): string {
+  const encodedPath = path.split("/").map(encodeURIComponent).join("/");
+  return `/download/${encodeURIComponent(store)}/${encodedPath}`;
+}
+
 /** The error a route outside the typed endpoint set failed with, in the same shape
  * the generated client throws — `<name> failed: <status>[: <server message>]` — so
  * `errorStatus` and `errorMessage` below read it the same way. */
diff --git a/ui/admin/src/client.ts b/ui/admin/src/client.ts
index b0afcc88..717a69d0 100644
--- a/ui/admin/src/client.ts
+++ b/ui/admin/src/client.ts
@@ -10,22 +10,22 @@ export type CreateFirstUserRequest = { email: string; password: string };
 export type CreateFirstUserResponse = { id: string; email: string; role: number };
 export type LoginRequest = { email: string; password: string };
 export type LoginResponse = { id: string; email: string; role: number };
-export type ListTablesResponse = Array<{ name: string; label: string; description: string; min_role_read: number; min_role_write: number; ownership_formula: string; rls_enabled: boolean; configured: boolean; ownership_error?: string | null; rls_available: boolean; database: string; metadata: boolean; provider?: { module: string; provider: string; configuration: unknown; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>; writes: { insert: boolean; update: boolean; delete: boolean }; issues: Array<string> } | null }>;
+export type ListTablesResponse = Array<{ name: string; label: string; description: string; min_role_read: number; min_role_write: number; ownership_formula: string; rls_enabled: boolean; configured: boolean; ownership_error?: string | null; rls_available: boolean; database: string; metadata: boolean; provider?: { module: string; provider: string; configuration: unknown; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>; writes: { insert: boolean; update: boolean; delete: boolean }; issues: Array<string> } | null }>;
 export type CreateTableRequest = { name: string; database?: string | null };
-export type CreateTableResponse = { name: string; label: string; description: string; min_role_read: number; min_role_write: number; ownership_formula: string; rls_enabled: boolean; configured: boolean; ownership_error?: string | null; rls_available: boolean; database: string; metadata: boolean; provider?: { module: string; provider: string; configuration: unknown; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>; writes: { insert: boolean; update: boolean; delete: boolean }; issues: Array<string> } | null };
+export type CreateTableResponse = { name: string; label: string; description: string; min_role_read: number; min_role_write: number; ownership_formula: string; rls_enabled: boolean; configured: boolean; ownership_error?: string | null; rls_available: boolean; database: string; metadata: boolean; provider?: { module: string; provider: string; configuration: unknown; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>; writes: { insert: boolean; update: boolean; delete: boolean }; issues: Array<string> } | null };
 export type CreateTableFromCsvRequest = { name: string; csv: string; database?: string | null };
-export type CreateTableFromCsvResponse = { table: { name: string; label: string; description: string; min_role_read: number; min_role_write: number; ownership_formula: string; rls_enabled: boolean; configured: boolean; ownership_error?: string | null; rls_available: boolean; database: string; metadata: boolean; provider?: { module: string; provider: string; configuration: unknown; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>; writes: { insert: boolean; update: boolean; delete: boolean }; issues: Array<string> } | null }; inserted: number };
+export type CreateTableFromCsvResponse = { table: { name: string; label: string; description: string; min_role_read: number; min_role_write: number; ownership_formula: string; rls_enabled: boolean; configured: boolean; ownership_error?: string | null; rls_available: boolean; database: string; metadata: boolean; provider?: { module: string; provider: string; configuration: unknown; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>; writes: { insert: boolean; update: boolean; delete: boolean }; issues: Array<string> } | null }; inserted: number };
 export type UpdateTableRequest = { label: string; description: string; min_role_read: number; min_role_write: number; ownership_formula: string; rls_enabled: boolean };
-export type UpdateTableResponse = { name: string; label: string; description: string; min_role_read: number; min_role_write: number; ownership_formula: string; rls_enabled: boolean; configured: boolean; ownership_error?: string | null; rls_available: boolean; database: string; metadata: boolean; provider?: { module: string; provider: string; configuration: unknown; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>; writes: { insert: boolean; update: boolean; delete: boolean }; issues: Array<string> } | null };
+export type UpdateTableResponse = { name: string; label: string; description: string; min_role_read: number; min_role_write: number; ownership_formula: string; rls_enabled: boolean; configured: boolean; ownership_error?: string | null; rls_available: boolean; database: string; metadata: boolean; provider?: { module: string; provider: string; configuration: unknown; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>; writes: { insert: boolean; update: boolean; delete: boolean }; issues: Array<string> } | null };
 export type DropTableResponse = { dropped: string };
 export type ListMetadataTablesResponse = Array<string>;
 export type CreateMetadataTableRequest = { name: string };
-export type CreateMetadataTableResponse = { name: string; label: string; description: string; min_role_read: number; min_role_write: number; ownership_formula: string; rls_enabled: boolean; configured: boolean; ownership_error?: string | null; rls_available: boolean; database: string; metadata: boolean; provider?: { module: string; provider: string; configuration: unknown; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>; writes: { insert: boolean; update: boolean; delete: boolean }; issues: Array<string> } | null };
-export type ListTableProvidersResponse = Array<{ module: string; provider: string; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }> }>;
+export type CreateMetadataTableResponse = { name: string; label: string; description: string; min_role_read: number; min_role_write: number; ownership_formula: string; rls_enabled: boolean; configured: boolean; ownership_error?: string | null; rls_available: boolean; database: string; metadata: boolean; provider?: { module: string; provider: string; configuration: unknown; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>; writes: { insert: boolean; update: boolean; delete: boolean }; issues: Array<string> } | null };
+export type ListTableProvidersResponse = Array<{ module: string; provider: string; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }> }>;
 export type CreateProvidedTableRequest = { name: string; module: string; provider: string; configuration?: unknown | null };
-export type CreateProvidedTableResponse = { name: string; label: string; description: string; min_role_read: number; min_role_write: number; ownership_formula: string; rls_enabled: boolean; configured: boolean; ownership_error?: string | null; rls_available: boolean; database: string; metadata: boolean; provider?: { module: string; provider: string; configuration: unknown; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>; writes: { insert: boolean; update: boolean; delete: boolean }; issues: Array<string> } | null };
+export type CreateProvidedTableResponse = { name: string; label: string; description: string; min_role_read: number; min_role_write: number; ownership_formula: string; rls_enabled: boolean; configured: boolean; ownership_error?: string | null; rls_available: boolean; database: string; metadata: boolean; provider?: { module: string; provider: string; configuration: unknown; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>; writes: { insert: boolean; update: boolean; delete: boolean }; issues: Array<string> } | null };
 export type UpdateProvidedTableRequest = { configuration: unknown };
-export type UpdateProvidedTableResponse = { name: string; label: string; description: string; min_role_read: number; min_role_write: number; ownership_formula: string; rls_enabled: boolean; configured: boolean; ownership_error?: string | null; rls_available: boolean; database: string; metadata: boolean; provider?: { module: string; provider: string; configuration: unknown; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>; writes: { insert: boolean; update: boolean; delete: boolean }; issues: Array<string> } | null };
+export type UpdateProvidedTableResponse = { name: string; label: string; description: string; min_role_read: number; min_role_write: number; ownership_formula: string; rls_enabled: boolean; configured: boolean; ownership_error?: string | null; rls_available: boolean; database: string; metadata: boolean; provider?: { module: string; provider: string; configuration: unknown; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>; writes: { insert: boolean; update: boolean; delete: boolean }; issues: Array<string> } | null };
 export type DeleteTableSettingsResponse = { deleted: boolean };
 export type ListOrphanTableSettingsResponse = Array<{ name: string; label: string; description: string; min_role_read: number; min_role_write: number; ownership_formula: string; rls_enabled: boolean }>;
 export type ListRolesResponse = Array<{ role: number; name: string; description: string; builtin: boolean }>;
@@ -43,7 +43,7 @@ export type ListConstraintsResponse = Array<{ name: string; type: string; fields
 export type CreateConstraintRequest = { type: string; fields?: Array<string> | null; language?: string | null; formula?: string | null; name?: string | null; error_message?: string | null };
 export type CreateConstraintResponse = { name: string; type: string; fields: Array<string>; expression?: string | null; method?: string | null; language?: string | null; formula?: string | null; error_message?: string | null; managed: boolean };
 export type DeleteConstraintResponse = { dropped: string };
-export type ListFieldTypesResponse = Array<{ name: string; label: string; category: string; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }> }>;
+export type ListFieldTypesResponse = Array<{ name: string; label: string; category: string; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }> }>;
 export type ListRowsQuery = { order?: string; limit?: number; offset?: number; filter?: Record<string, string> };
 export type ListRowsResponse = Array<unknown>;
 export type CountRowsQuery = { filter?: Record<string, string> };
@@ -70,7 +70,7 @@ export type CreateFileStoreResponse = { id?: string | null; name: string; descri
 export type UpdateFileStoreRequest = { name: string; description: string; backend: string; config: unknown; min_role?: number | null };
 export type UpdateFileStoreResponse = { id?: string | null; name: string; description: string; backend: string; config: unknown; min_role?: number | null; connected: boolean; error?: string | null; is_git_repo?: boolean | null };
 export type DeleteFileStoreResponse = { deleted: boolean };
-export type ListFileStoreBackendsResponse = Array<{ name: string; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>; operations: Array<{ name: string; label: string; description: string; scope: string; input_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>; on_create: boolean; automatic: boolean }> }>;
+export type ListFileStoreBackendsResponse = Array<{ name: string; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>; operations: Array<{ name: string; label: string; description: string; scope: string; input_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>; on_create: boolean; automatic: boolean }> }>;
 export type RunBackendOperationRequest = { name: string; config: unknown; input: unknown };
 export type RunBackendOperationResponse = { config: unknown; output: string; data?: unknown | null };
 export type RunFileStoreOperationRequest = { input: unknown };
@@ -81,22 +81,22 @@ export type CreateLlmProviderResponse = { id: string; name: string; description:
 export type UpdateLlmProviderRequest = { name: string; description: string; backend: string; config: unknown };
 export type UpdateLlmProviderResponse = { id: string; name: string; description: string; backend: string; config: unknown };
 export type DeleteLlmProviderResponse = { deleted: boolean };
-export type ListLlmProviderBackendsResponse = Array<{ name: string; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }> }>;
+export type ListLlmProviderBackendsResponse = Array<{ name: string; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }> }>;
 export type ListLlmModelsResponse = Array<{ id: string; provider_id: string; name: string; description: string; is_default: boolean; config: unknown; capabilities: unknown; prices: unknown }>;
 export type CreateLlmModelRequest = { name: string; description: string; is_default: boolean; config: unknown };
 export type CreateLlmModelResponse = { id: string; provider_id: string; name: string; description: string; is_default: boolean; config: unknown; capabilities: unknown; prices: unknown };
 export type UpdateLlmModelRequest = { name: string; description: string; is_default: boolean; config: unknown };
 export type UpdateLlmModelResponse = { id: string; provider_id: string; name: string; description: string; is_default: boolean; config: unknown; capabilities: unknown; prices: unknown };
 export type DeleteLlmModelResponse = { deleted: boolean };
-export type ListLlmModelSettingsResponse = Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>;
+export type ListLlmModelSettingsResponse = Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>;
 export type FetchLlmModelsResponse = { ok: boolean; message: string; names: Array<string> };
 export type TestLlmModelRequest = { provider_id?: string | null; backend: string; config: unknown; name: string; model_config?: unknown | null };
 export type TestLlmModelResponse = { ok: boolean; message: string; model: string; capabilities: unknown; prices: unknown };
-export type ListModulesResponse = { modules: Array<{ id: string; name: string; language: string; source: string; location: string; version?: string | null; configuration: unknown; permissions: unknown; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>; actions: Array<{ name: string; description: string; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }> }>; functions: Array<{ name: string; description: string; is_async: boolean; arguments: Array<{ name: string; type?: string | null }> }>; table_providers: Array<string>; model_providers: Array<string>; stream_providers: Array<string>; view_patterns: Array<string>; unsupported: Array<{ key: string; count?: number | null }>; issues: Array<string>; loaded: boolean; api_version?: number | null }>; root: string; npm: boolean; npm_too_old?: { version: string; minimum: string } | null; node: boolean; python: boolean; pip: boolean; python_dir?: string | null; bundled: Array<{ id: string; name: string; language: string; title: string; description: string; supplies: Array<string>; installs: Array<string>; permissions: unknown; installed: boolean }> };
+export type ListModulesResponse = { modules: Array<{ id: string; name: string; language: string; source: string; location: string; version?: string | null; configuration: unknown; permissions: unknown; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>; actions: Array<{ name: string; description: string; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }> }>; functions: Array<{ name: string; description: string; is_async: boolean; arguments: Array<{ name: string; type?: string | null }> }>; table_providers: Array<string>; model_providers: Array<string>; stream_providers: Array<string>; view_patterns: Array<string>; unsupported: Array<{ key: string; count?: number | null }>; issues: Array<string>; loaded: boolean; api_version?: number | null }>; root: string; npm: boolean; npm_too_old?: { version: string; minimum: string } | null; node: boolean; python: boolean; pip: boolean; python_dir?: string | null; bundled: Array<{ id: string; name: string; language: string; title: string; description: string; supplies: Array<string>; installs: Array<string>; permissions: unknown; installed: boolean }> };
 export type InstallModuleRequest = { source: string; location: string; language?: string | null };
-export type InstallModuleResponse = { id: string; name: string; language: string; source: string; location: string; version?: string | null; configuration: unknown; permissions: unknown; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>; actions: Array<{ name: string; description: string; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }> }>; functions: Array<{ name: string; description: string; is_async: boolean; arguments: Array<{ name: string; type?: string | null }> }>; table_providers: Array<string>; model_providers: Array<string>; stream_providers: Array<string>; view_patterns: Array<string>; unsupported: Array<{ key: string; count?: number | null }>; issues: Array<string>; loaded: boolean; api_version?: number | null };
+export type InstallModuleResponse = { id: string; name: string; language: string; source: string; location: string; version?: string | null; configuration: unknown; permissions: unknown; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>; actions: Array<{ name: string; description: string; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }> }>; functions: Array<{ name: string; description: string; is_async: boolean; arguments: Array<{ name: string; type?: string | null }> }>; table_providers: Array<string>; model_providers: Array<string>; stream_providers: Array<string>; view_patterns: Array<string>; unsupported: Array<{ key: string; count?: number | null }>; issues: Array<string>; loaded: boolean; api_version?: number | null };
 export type UpdateModuleRequest = { configuration?: unknown | null; permissions?: unknown | null };
-export type UpdateModuleResponse = { id: string; name: string; language: string; source: string; location: string; version?: string | null; configuration: unknown; permissions: unknown; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>; actions: Array<{ name: string; description: string; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }> }>; functions: Array<{ name: string; description: string; is_async: boolean; arguments: Array<{ name: string; type?: string | null }> }>; table_providers: Array<string>; model_providers: Array<string>; stream_providers: Array<string>; view_patterns: Array<string>; unsupported: Array<{ key: string; count?: number | null }>; issues: Array<string>; loaded: boolean; api_version?: number | null };
+export type UpdateModuleResponse = { id: string; name: string; language: string; source: string; location: string; version?: string | null; configuration: unknown; permissions: unknown; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>; actions: Array<{ name: string; description: string; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }> }>; functions: Array<{ name: string; description: string; is_async: boolean; arguments: Array<{ name: string; type?: string | null }> }>; table_providers: Array<string>; model_providers: Array<string>; stream_providers: Array<string>; view_patterns: Array<string>; unsupported: Array<{ key: string; count?: number | null }>; issues: Array<string>; loaded: boolean; api_version?: number | null };
 export type DeleteModuleResponse = { deleted: boolean };
 export type ReloadModulesResponse = { modules: number };
 export type ListAgentsResponse = Array<{ id: string; name: string; description: string; provider: string; model?: string | null; system_prompt: string; traits: Array<{ trait: string; config: unknown }>; min_role?: number | null; attributes: unknown; error?: string | null }>;
@@ -105,15 +105,17 @@ export type CreateAgentResponse = { id: string; name: string; description: strin
 export type UpdateAgentRequest = { name: string; description: string; provider: string; model?: string | null; system_prompt: string; traits: Array<{ trait: string; config: unknown }>; min_role?: number | null; attributes: unknown };
 export type UpdateAgentResponse = { id: string; name: string; description: string; provider: string; model?: string | null; system_prompt: string; traits: Array<{ trait: string; config: unknown }>; min_role?: number | null; attributes: unknown; error?: string | null };
 export type DeleteAgentResponse = { deleted: boolean };
-export type ListAgentTraitsResponse = Array<{ name: string; description: string; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }> }>;
+export type ListAgentTraitsResponse = Array<{ name: string; description: string; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }> }>;
 export type ListRunsResponse = Array<{ id: string; kind: string; subject: string; description: string; state: string; error?: string | null; user?: string | null; created_at: string; updated_at: string; subject_version?: number | null; current_step?: string | null; wake_at?: string | null; conclusion?: unknown | null; parent_run?: string | null }>;
-export type GetRunResponse = { id: string; kind: string; subject: string; description: string; state: string; error?: string | null; user?: string | null; created_at: string; updated_at: string; subject_version?: number | null; current_step?: string | null; wake_at?: string | null; conclusion?: unknown | null; parent_run?: string | null; context: unknown; attributes: unknown; trace: Array<{ id: string; seq: number; step: string; started_at: string; finished_at: string; attempt: number; outcome: string; error?: string | null; context: unknown }>; pending_form?: { fields: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>; assign_to: string; min_role?: number | null } | null; plan?: { features: Array<{ id: string; title: string; description: string; kind: string; acceptance: Array<string>; files: Array<string>; pages: Array<string>; status: string; attempts: number; runs: Array<string> }>; progress: Array<{ feature: string; run: string; status: string; summary: string; check: string; diffstat: string }> } | null };
+export type GetRunResponse = { id: string; kind: string; subject: string; description: string; state: string; error?: string | null; user?: string | null; created_at: string; updated_at: string; subject_version?: number | null; current_step?: string | null; wake_at?: string | null; conclusion?: unknown | null; parent_run?: string | null; context: unknown; attributes: unknown; trace: Array<{ id: string; seq: number; step: string; started_at: string; finished_at: string; attempt: number; outcome: string; error?: string | null; context: unknown }>; pending_form?: { fields: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>; assign_to: string; min_role?: number | null } | null; plan?: { features: Array<{ id: string; title: string; description: string; kind: string; acceptance: Array<string>; files: Array<string>; pages: Array<string>; status: string; attempts: number; runs: Array<string> }>; progress: Array<{ feature: string; run: string; status: string; summary: string; check: string; diffstat: string }> } | null };
 export type GetRunDiffResponse = { run: string; runs: Array<string>; scopes: Array<{ store: string; root: string; files: Array<{ path: string; status: string; added?: number | null; removed?: number | null }>; moves: Array<{ from: string; to: string }>; stat: string; unified: string }> };
 export type DeleteRunResponse = { deleted: boolean };
 export type BrowseFilesRequest = { dir: string };
 export type BrowseFilesResponse = Array<{ name: string; path: string; is_dir: boolean; size?: number | null; modified?: string | null; owner?: string | null; min_role?: number | null; effective_min_role?: number | null }>;
 export type FindFilesRequest = { query: string; dir?: string | null; max_results?: number | null };
 export type FindFilesResponse = { entries: Array<{ name: string; path: string; is_dir: boolean; size?: number | null; modified?: string | null; owner?: string | null; min_role?: number | null; effective_min_role?: number | null }>; truncated: boolean };
+export type ListStoreFilesQuery = { extensions?: string };
+export type ListStoreFilesResponse = { paths: Array<string>; truncated: boolean };
 export type SearchFilesRequest = { pattern: string; regex?: boolean | null; case_sensitive?: boolean | null; whole_word?: boolean | null; glob?: string | null; dir?: string | null; max_results?: number | null };
 export type SearchFilesResponse = { matches: Array<{ path: string; line: number; column: number; length: number; text: string }>; files_searched: number; truncated: boolean };
 export type ReadFileRequest = { path: string };
@@ -139,6 +141,8 @@ export type DeleteApplicationResponse = { deleted: boolean; agent?: string | nul
 export type BuildApplicationResponse = { built: boolean; git_repo: boolean; log: string };
 export type DeepCleanApplicationResponse = { built: boolean; git_repo: boolean; log: string };
 export type BuildApplicationTargetResponse = { target: string; label: string; status: string; store: string; log_path: string; started_at: string; finished_at?: string | null; artifact?: string | null; size?: number | null; log?: string | null; error?: string | null };
+export type RunApplicationTargetOperationRequest = { config: unknown };
+export type RunApplicationTargetOperationResponse = { message: string; store: string; files: Array<string>; git_repo: boolean; settings: unknown };
 export type GetApplicationTargetBuildResponse = { target: string; label: string; status: string; store: string; log_path: string; started_at: string; finished_at?: string | null; artifact?: string | null; size?: number | null; log?: string | null; error?: string | null };
 export type UpdateApplicationClientResponse = { scaffolded: boolean; files: Array<string>; log: string };
 export type RunApplicationGraphqlRequest = { query: string; variables?: unknown | null; operationName?: string | null };
@@ -151,7 +155,7 @@ export type DeleteViewResponse = { deleted: boolean };
 export type CreateViewRequest = { name: string; description?: string | null; viewpattern: string; table_name?: string | null; min_role: number };
 export type CreateViewResponse = { id: string; name: string; description: string; viewpattern: string; table_name?: string | null; configuration: unknown; min_role: number; slug?: unknown | null; attributes: unknown };
 export type ViewConfigStepRequest = { viewpattern: string; table_name?: string | null; name?: string | null; step: number; context: unknown };
-export type ViewConfigStepResponse = { index: number; name: string; count: number; builder: boolean; builder_options?: unknown | null; skip: boolean; context_field?: string | null; blurb?: string | null; fields: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>; values: unknown; issues: Array<string> };
+export type ViewConfigStepResponse = { index: number; name: string; count: number; builder: boolean; builder_options?: unknown | null; skip: boolean; context_field?: string | null; blurb?: string | null; fields: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>; values: unknown; issues: Array<string> };
 export type ViewReferencesResponse = { embedded_in: Array<string>; linked_from: Array<string>; pages: Array<string>; library: Array<string>; places: Array<string> };
 export type ListPagesResponse = Array<{ id: string; name: string; title: string; description: string; layout: unknown; min_role: number; attributes: unknown }>;
 export type GetPageResponse = { id: string; name: string; title: string; description: string; layout: unknown; min_role: number; attributes: unknown };
@@ -190,8 +194,8 @@ export type BuilderPagePreviewResponse = { html: string };
 export type BuilderDistinctValuesResponse = { success: unknown };
 export type ListViewPatternsResponse = Array<{ name: string; label: string; description: string; table_required: boolean; view_quantity?: string | null; routes: Array<string>; steps: Array<string>; module?: string | null }>;
 export type BuilderStatusResponse = { available: boolean };
-export type ListFrameworksResponse = Array<{ name: string; label: string; description: string; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>; has_views: boolean; file_store_settings: Array<string> }>;
-export type ListApiProvidersResponse = Array<{ name: string; label: string; description: string; default_mount: string; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>; supports_custom_queries: boolean }>;
+export type ListFrameworksResponse = Array<{ name: string; label: string; description: string; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>; has_views: boolean; file_store_settings: Array<string>; file_settings: Array<{ name: string; extensions: Array<string> }>; targets: Array<{ name: string; label: string; options: Array<string>; operations: Array<{ name: string; label: string; description: string; show_if: Array<{ name: string; values: Array<unknown> }> }> }> }>;
+export type ListApiProvidersResponse = Array<{ name: string; label: string; description: string; default_mount: string; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>; supports_custom_queries: boolean }>;
 export type DescribeCustomQueryRequest = { name: string; description?: string | null; method: string; path: string; language?: string | null; code: string; params: Array<{ name: string; type: string; required?: boolean | null }>; min_role?: number | null; tables?: Array<string> | null };
 export type DescribeCustomQueryResponse = { columns: Array<{ name: string; type: string }> };
 export type ListUsersResponse = Array<{ id: string; email: string; role: number; disabled: boolean; language?: string | null; extra: unknown }>;
@@ -220,7 +224,7 @@ export type RunTriggerResponse = { result: unknown };
 export type TestRunTriggerRequest = unknown;
 export type TestRunTriggerResponse = { ok: boolean; result: unknown; error?: string | null; console: Array<{ level: string; text: string }>; row?: unknown | null };
 export type ListActionsQuery = { table?: string };
-export type ListActionsResponse = Array<{ name: string; description: string; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>; workflow_step: boolean }>;
+export type ListActionsResponse = Array<{ name: string; description: string; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>; workflow_step: boolean }>;
 export type GetWorkflowQuery = { version?: number };
 export type GetWorkflowResponse = { id: string; name: string; channel?: string | null; version: number; workflow: unknown; issues: Array<{ step?: string | null; problem: string }>; versions: Array<{ version: number; description: string; created_at: string; created_by?: string | null }> };
 export type SaveWorkflowRequest = { workflow: unknown; description?: string | null };
@@ -230,12 +234,12 @@ export type RevertWorkflowResponse = { id: string; name: string; channel?: strin
 export type ListWorkflowRunsQuery = { state?: string; limit?: number; offset?: number };
 export type ListWorkflowRunsResponse = Array<{ id: string; kind: string; subject: string; description: string; state: string; error?: string | null; user?: string | null; created_at: string; updated_at: string; subject_version?: number | null; current_step?: string | null; wake_at?: string | null; conclusion?: unknown | null; parent_run?: string | null }>;
 export type ResumeRunRequest = unknown;
-export type ResumeRunResponse = { id: string; kind: string; subject: string; description: string; state: string; error?: string | null; user?: string | null; created_at: string; updated_at: string; subject_version?: number | null; current_step?: string | null; wake_at?: string | null; conclusion?: unknown | null; parent_run?: string | null; context: unknown; attributes: unknown; trace: Array<{ id: string; seq: number; step: string; started_at: string; finished_at: string; attempt: number; outcome: string; error?: string | null; context: unknown }>; pending_form?: { fields: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>; assign_to: string; min_role?: number | null } | null; plan?: { features: Array<{ id: string; title: string; description: string; kind: string; acceptance: Array<string>; files: Array<string>; pages: Array<string>; status: string; attempts: number; runs: Array<string> }>; progress: Array<{ feature: string; run: string; status: string; summary: string; check: string; diffstat: string }> } | null };
+export type ResumeRunResponse = { id: string; kind: string; subject: string; description: string; state: string; error?: string | null; user?: string | null; created_at: string; updated_at: string; subject_version?: number | null; current_step?: string | null; wake_at?: string | null; conclusion?: unknown | null; parent_run?: string | null; context: unknown; attributes: unknown; trace: Array<{ id: string; seq: number; step: string; started_at: string; finished_at: string; attempt: number; outcome: string; error?: string | null; context: unknown }>; pending_form?: { fields: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>; assign_to: string; min_role?: number | null } | null; plan?: { features: Array<{ id: string; title: string; description: string; kind: string; acceptance: Array<string>; files: Array<string>; pages: Array<string>; status: string; attempts: number; runs: Array<string> }>; progress: Array<{ feature: string; run: string; status: string; summary: string; check: string; diffstat: string }> } | null };
 export type CancelRunRequest = { reason?: string | null };
-export type CancelRunResponse = { id: string; kind: string; subject: string; description: string; state: string; error?: string | null; user?: string | null; created_at: string; updated_at: string; subject_version?: number | null; current_step?: string | null; wake_at?: string | null; conclusion?: unknown | null; parent_run?: string | null; context: unknown; attributes: unknown; trace: Array<{ id: string; seq: number; step: string; started_at: string; finished_at: string; attempt: number; outcome: string; error?: string | null; context: unknown }>; pending_form?: { fields: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>; assign_to: string; min_role?: number | null } | null; plan?: { features: Array<{ id: string; title: string; description: string; kind: string; acceptance: Array<string>; files: Array<string>; pages: Array<string>; status: string; attempts: number; runs: Array<string> }>; progress: Array<{ feature: string; run: string; status: string; summary: string; check: string; diffstat: string }> } | null };
-export type RetryRunResponse = { id: string; kind: string; subject: string; description: string; state: string; error?: string | null; user?: string | null; created_at: string; updated_at: string; subject_version?: number | null; current_step?: string | null; wake_at?: string | null; conclusion?: unknown | null; parent_run?: string | null; context: unknown; attributes: unknown; trace: Array<{ id: string; seq: number; step: string; started_at: string; finished_at: string; attempt: number; outcome: string; error?: string | null; context: unknown }>; pending_form?: { fields: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>; assign_to: string; min_role?: number | null } | null; plan?: { features: Array<{ id: string; title: string; description: string; kind: string; acceptance: Array<string>; files: Array<string>; pages: Array<string>; status: string; attempts: number; runs: Array<string> }>; progress: Array<{ feature: string; run: string; status: string; summary: string; check: string; diffstat: string }> } | null };
+export type CancelRunResponse = { id: string; kind: string; subject: string; description: string; state: string; error?: string | null; user?: string | null; created_at: string; updated_at: string; subject_version?: number | null; current_step?: string | null; wake_at?: string | null; conclusion?: unknown | null; parent_run?: string | null; context: unknown; attributes: unknown; trace: Array<{ id: string; seq: number; step: string; started_at: string; finished_at: string; attempt: number; outcome: string; error?: string | null; context: unknown }>; pending_form?: { fields: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>; assign_to: string; min_role?: number | null } | null; plan?: { features: Array<{ id: string; title: string; description: string; kind: string; acceptance: Array<string>; files: Array<string>; pages: Array<string>; status: string; attempts: number; runs: Array<string> }>; progress: Array<{ feature: string; run: string; status: string; summary: string; check: string; diffstat: string }> } | null };
+export type RetryRunResponse = { id: string; kind: string; subject: string; description: string; state: string; error?: string | null; user?: string | null; created_at: string; updated_at: string; subject_version?: number | null; current_step?: string | null; wake_at?: string | null; conclusion?: unknown | null; parent_run?: string | null; context: unknown; attributes: unknown; trace: Array<{ id: string; seq: number; step: string; started_at: string; finished_at: string; attempt: number; outcome: string; error?: string | null; context: unknown }>; pending_form?: { fields: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>; assign_to: string; min_role?: number | null } | null; plan?: { features: Array<{ id: string; title: string; description: string; kind: string; acceptance: Array<string>; files: Array<string>; pages: Array<string>; status: string; attempts: number; runs: Array<string> }>; progress: Array<{ feature: string; run: string; status: string; summary: string; check: string; diffstat: string }> } | null };
 export type ListModelProvidersQuery = { dataset?: string; configuration?: string };
-export type ListModelProvidersResponse = { providers: Array<{ name: string; description: string; module?: string | null; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>; hyperparameters: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>; outcome_spec: unknown; outcome?: unknown | null; outcome_error?: string | null; standardise: boolean; binds_data: boolean; cancellable: boolean; unavailable?: string | null }>; builtins_compiled_out: boolean; notice?: string | null };
+export type ListModelProvidersResponse = { providers: Array<{ name: string; description: string; module?: string | null; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>; hyperparameters: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>; outcome_spec: unknown; outcome?: unknown | null; outcome_error?: string | null; standardise: boolean; binds_data: boolean; cancellable: boolean; unavailable?: string | null }>; builtins_compiled_out: boolean; notice?: string | null };
 export type PreviewDatasetRequest = { dataset: unknown; limit?: number | null };
 export type PreviewDatasetResponse = { columns: Array<{ name: string; type: string }>; rows: Array<unknown>; primary_key?: string | null; split_error?: string | null };
 export type ListModelsQuery = { table?: string };
@@ -273,16 +277,16 @@ export type DownloadModelRunResponse = unknown;
 export type WritePosteriorRequest = { variable: string; mode: string; statistics: unknown; table?: string | null; coordinates?: unknown | null; instance_field?: string | null; elements?: unknown | null };
 export type WritePosteriorResponse = { variable: string; mode: string; table: string; instance: string; written: number };
 export type ListStreamProvidersQuery = { provider?: string; configuration?: string };
-export type ListStreamProvidersResponse = { providers: Array<{ name: string; label: string; description: string; module?: string | null; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>; element_type?: unknown | null; element_type_error?: string | null }>; builtins_compiled_out: boolean; notice?: string | null };
+export type ListStreamProvidersResponse = { providers: Array<{ name: string; label: string; description: string; module?: string | null; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>; element_type?: unknown | null; element_type_error?: string | null }>; builtins_compiled_out: boolean; notice?: string | null };
 export type ListStreamsResponse = Array<{ id: string; name: string; description: string; provider: string; configuration: unknown; min_role?: number | null; attributes: unknown; enabled: boolean; element_type?: unknown | null; error?: string | null; status?: unknown | null; counters?: unknown | null }>;
 export type GetStreamResponse = { id: string; name: string; description: string; provider: string; configuration: unknown; min_role?: number | null; attributes: unknown; enabled: boolean; element_type?: unknown | null; error?: string | null; status?: unknown | null; counters?: unknown | null };
 export type SaveStreamRequest = { id?: string | null; name: string; description?: string | null; provider: string; configuration?: unknown | null; min_role?: number | null; attributes?: unknown | null; enabled?: boolean | null };
 export type SaveStreamResponse = { id: string; name: string; description: string; provider: string; configuration: unknown; min_role?: number | null; attributes: unknown; enabled: boolean; element_type?: unknown | null; error?: string | null; status?: unknown | null; counters?: unknown | null };
 export type DeleteStreamResponse = { deleted: boolean };
 export type StreamStatusResponse = { id: string; name: string; running: boolean; status?: unknown | null; counters?: unknown | null; element_type?: unknown | null; listeners: number };
-export type GetSettingsResponse = { sections: Array<{ name: string; label: string; description: string; fields: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; help: string }> }>; values: unknown };
+export type GetSettingsResponse = { sections: Array<{ name: string; label: string; description: string; fields: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }>; help: string }> }>; values: unknown };
 export type UpdateSettingsRequest = { values: unknown };
-export type UpdateSettingsResponse = { sections: Array<{ name: string; label: string; description: string; fields: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; help: string }> }>; values: unknown };
+export type UpdateSettingsResponse = { sections: Array<{ name: string; label: string; description: string; fields: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }>; help: string }> }>; values: unknown };
 export type SendTestEmailRequest = { to?: string | null };
 export type SendTestEmailResponse = { sent_to: string };
 export type GetPythonStatusResponse = { state: string; version?: string | null; explanation: string; dir?: string | null; site_packages?: string | null; bin?: string | null; packages: Array<{ name: string; version?: string | null }>; max_inflight: number; resident: number; threads: number; stuck: number; max_stuck: number; env_error?: string | null };
@@ -405,6 +409,7 @@ export interface ApiClient {
   deleteRun(id: string): Promise<DeleteRunResponse>;
   browseFiles(store: string, body: BrowseFilesRequest): Promise<BrowseFilesResponse>;
   findFiles(store: string, body: FindFilesRequest): Promise<FindFilesResponse>;
+  listStoreFiles(store: string, query?: ListStoreFilesQuery): Promise<ListStoreFilesResponse>;
   searchFiles(store: string, body: SearchFilesRequest): Promise<SearchFilesResponse>;
   readFile(store: string, body: ReadFileRequest): Promise<ReadFileResponse>;
   writeFile(store: string, body: WriteFileRequest): Promise<WriteFileResponse>;
@@ -420,6 +425,7 @@ export interface ApiClient {
   buildApplication(id: string): Promise<BuildApplicationResponse>;
   deepCleanApplication(id: string): Promise<DeepCleanApplicationResponse>;
   buildApplicationTarget(id: string, target: string): Promise<BuildApplicationTargetResponse>;
+  runApplicationTargetOperation(id: string, target: string, operation: string, body: RunApplicationTargetOperationRequest): Promise<RunApplicationTargetOperationResponse>;
   getApplicationTargetBuild(id: string, target: string): Promise<GetApplicationTargetBuildResponse>;
   updateApplicationClient(id: string): Promise<UpdateApplicationClientResponse>;
   runApplicationGraphql(id: string, body: RunApplicationGraphqlRequest): Promise<RunApplicationGraphqlResponse>;
@@ -1199,6 +1205,17 @@ export function createClient(options: ClientOptions = {}): ApiClient {
       if (!res.ok) throw await clientError("findFiles", res);
       return (await res.json()) as FindFilesResponse;
     },
+    async listStoreFiles(store, query) {
+      const search = new URLSearchParams();
+      if (query?.extensions !== undefined && query?.extensions !== null) search.append("extensions", String(query?.extensions));
+      const qs = search.toString();
+      const res = await doFetch(`${baseUrl}/api/file-stores/${store}/files-by-type${qs ? `?${qs}` : ""}`, {
+        method: "GET",
+        headers: requestHeaders("GET", false),
+      });
+      if (!res.ok) throw await clientError("listStoreFiles", res);
+      return (await res.json()) as ListStoreFilesResponse;
+    },
     async searchFiles(store, body) {
       const res = await doFetch(`${baseUrl}/api/file-stores/${store}/search`, {
         method: "POST",
@@ -1329,6 +1346,15 @@ export function createClient(options: ClientOptions = {}): ApiClient {
       if (!res.ok) throw await clientError("buildApplicationTarget", res);
       return (await res.json()) as BuildApplicationTargetResponse;
     },
+    async runApplicationTargetOperation(id, target, operation, body) {
+      const res = await doFetch(`${baseUrl}/api/applications/${id}/targets/${target}/operations/${operation}`, {
+        method: "POST",
+        headers: requestHeaders("POST", true),
+        body: JSON.stringify(body),
+      });
+      if (!res.ok) throw await clientError("runApplicationTargetOperation", res);
+      return (await res.json()) as RunApplicationTargetOperationResponse;
+    },
     async getApplicationTargetBuild(id, target) {
       const res = await doFetch(`${baseUrl}/api/applications/${id}/targets/${target}/build`, {
         method: "GET",
diff --git a/ui/admin/src/fieldForm.test.ts b/ui/admin/src/fieldForm.test.ts
index 1f66b079..28cead87 100644
--- a/ui/admin/src/fieldForm.test.ts
+++ b/ui/admin/src/fieldForm.test.ts
@@ -67,6 +67,7 @@ const STRING: FieldTypeItem = {
       multiline: false,
       secret: false,
       create_only: false,
+      show_if: [],
     },
   ],
 };
@@ -85,6 +86,7 @@ const FILE: FieldTypeItem = {
       multiline: false,
       secret: false,
       create_only: false,
+      show_if: [],
     },
     {
       name: "folder",
@@ -96,6 +98,7 @@ const FILE: FieldTypeItem = {
       multiline: false,
       secret: false,
       create_only: false,
+      show_if: [],
     },
     {
       name: "mime_allow",
@@ -107,6 +110,7 @@ const FILE: FieldTypeItem = {
       multiline: false,
       secret: false,
       create_only: false,
+      show_if: [],
     },
   ],
 };
diff --git a/ui/admin/src/mcpTokens.test.ts b/ui/admin/src/mcpTokens.test.ts
index 0d8b96fa..dfae1b5a 100644
--- a/ui/admin/src/mcpTokens.test.ts
+++ b/ui/admin/src/mcpTokens.test.ts
@@ -55,6 +55,7 @@ const traits = [
         multiline: false,
         secret: false,
         create_only: false,
+        show_if: [],
       },
       {
         name: "allow_edit",
@@ -66,6 +67,7 @@ const traits = [
         multiline: false,
         secret: false,
         create_only: false,
+        show_if: [],
       },
       {
         name: "allow_drop",
@@ -77,6 +79,7 @@ const traits = [
         multiline: false,
         secret: false,
         create_only: false,
+        show_if: [],
       },
       {
         name: "allow_access_changes",
@@ -88,6 +91,7 @@ const traits = [
         multiline: false,
         secret: false,
         create_only: false,
+        show_if: [],
       },
       {
         name: "allow_triggers",
@@ -99,6 +103,7 @@ const traits = [
         multiline: false,
         secret: false,
         create_only: false,
+        show_if: [],
       },
       {
         name: "allow_applications",
@@ -110,6 +115,7 @@ const traits = [
         multiline: false,
         secret: false,
         create_only: false,
+        show_if: [],
       },
     ],
   },
diff --git a/ui/admin/src/modules.test.ts b/ui/admin/src/modules.test.ts
index 9fe985fb..58d33e7b 100644
--- a/ui/admin/src/modules.test.ts
+++ b/ui/admin/src/modules.test.ts
@@ -416,6 +416,7 @@ describe("how an installed module reads", () => {
               multiline: false,
               secret: false,
               create_only: false,
+              show_if: [],
               code_language: null,
             },
           ],
diff --git a/ui/admin/src/screens/ApplicationForm.tsx b/ui/admin/src/screens/ApplicationForm.tsx
index 586d71c0..4f4a96de 100644
--- a/ui/admin/src/screens/ApplicationForm.tsx
+++ b/ui/admin/src/screens/ApplicationForm.tsx
@@ -23,7 +23,7 @@ import Form from "react-bootstrap/Form";
 import Row from "react-bootstrap/Row";
 import Spinner from "react-bootstrap/Spinner";
 
-import { api, errorMessage } from "../api";
+import { api, downloadUrl, errorMessage } from "../api";
 import type {
   CreateApplicationRequest,
   ListApiProvidersResponse,
@@ -38,7 +38,14 @@ import { navigate } from "../App";
 import { IconArrowLeft } from "../icons";
 import { PageBody, PageHeader } from "../layout";
 import { setNotice } from "../notice";
-import { SettingsFields, asString, buildConfig, readConfig } from "../settings";
+import {
+  SettingsFields,
+  asString,
+  buildConfig,
+  isShown,
+  readConfig,
+  type FieldSpec,
+} from "../settings";
 import {
   apiRowsFromApp,
   apiRowsToRequest,
@@ -49,6 +56,13 @@ import {
 } from "../apiRows";
 import { MultiSelect } from "../multiSelect";
 import { createdStoresText, newStoreOptions } from "../newFileStore";
+import {
+  fileOptions,
+  storeNameOf,
+  splitTargetSettings,
+  type FileSetting,
+  type TargetOperationDecl,
+} from "../targetSettings";
 import {
   blankStaticRow,
   staticDirsToRequest,
@@ -94,6 +108,11 @@ function textToCsp(text: string): Record<string, string[]> {
   return csp;
 }
 
+/** No file pickers: one shared empty list, so a framework without any does
+ * not hand the effect that loads the pickers' files a new array on every
+ * render. */
+const NO_FILE_PICKERS: FileSetting[] = [];
+
 export function ApplicationForm({
   appId,
   tab = "settings",
@@ -223,8 +242,54 @@ export function ApplicationForm({
     };
   }, [appId]);
 
-  const selected = frameworks?.find((f) => f.name === frameworkName);
-  const ownTab = settingsOnOwnTab(selected);
+  // The framework picked in the form (e.g. React Native), as the server
+  // describes it: its label, settings, build targets and file pickers.
+  const selectedFramework = frameworks?.find((f) => f.name === frameworkName);
+  const ownTab = settingsOnOwnTab(selectedFramework);
+  // The framework's settings, and each build target's own (an APK's id,
+  // version and icon), which get a card of their own below the framework's.
+  const settings = splitTargetSettings(
+    selectedFramework?.config_spec ?? [],
+    selectedFramework?.targets ?? [],
+  );
+  // Load the matching files from the app's store for each file picker (icon,
+  // keystore); if listing fails, its choices just stay empty. `filePickers`
+  // comes from state, so it is a stable dependency.
+  const filePickers = selectedFramework?.file_settings ?? NO_FILE_PICKERS;
+  const storeName = storeNameOf(selectedFramework?.file_store_settings ?? [], config);
+  const [found, setFound] = useState<Record<string, string[]>>({});
+  useEffect(() => {
+    if (!storeName || filePickers.length === 0) {
+      setFound({});
+      return;
+    }
+    let cancelled = false;
+    void Promise.all(
+      filePickers.map(({ name, extensions }) =>
+        api
+          .listStoreFiles(storeName, { extensions: extensions.join(",") })
+          .then((r) => [name, r.paths] as const, () => [name, []] as const),
+      ),
+    ).then((pairs) => {
+      if (!cancelled) setFound(Object.fromEntries(pairs));
+    });
+    return () => {
+      cancelled = true;
+    };
+  }, [storeName, filePickers]);
+  const targetExtraOptions = fileOptions(filePickers, found, config);
+  // A file picker is a drop-down even with nothing in it, saying why.
+  const filePickerHints = Object.fromEntries(
+    filePickers.map(({ name, extensions }) => [
+      name,
+      storeName
+        ? t(
+            "File store “{store}” has no {kinds} files yet. Upload one under Files, then reopen this form.",
+            { store: storeName, kinds: extensions.map((e) => `.${e}`).join(", ") },
+          )
+        : t("Choose the application's file store first; its files are offered here."),
+    ]),
+  );
   const appSettingsHref = stored
     ? appTabs(stored).find((t) => t.id === "app-settings")?.href
     : undefined;
@@ -240,7 +305,7 @@ export function ApplicationForm({
         subdomain: subdomain.trim(),
         framework: {
           name: frameworkName,
-          config: buildConfig(selected?.config_spec ?? [], config),
+          config: buildConfig(selectedFramework?.config_spec ?? [], config),
         },
         extra_frameworks: [],
         tables,
@@ -346,12 +411,12 @@ export function ApplicationForm({
               <Card className="mb-3">
                 <Card.Header>
                   {t("{framework} settings", {
-                    framework: selected?.label || frameworkName,
+                    framework: selectedFramework?.label || frameworkName,
                   })}
                 </Card.Header>
                 <Card.Body>
                   <SettingsFields
-                    spec={selected?.config_spec ?? []}
+                    spec={selectedFramework?.config_spec ?? []}
                     values={config}
                     onChange={(name, v) =>
                       setConfig((c) => ({ ...c, [name]: v }))
@@ -476,7 +541,7 @@ export function ApplicationForm({
                   </Form.Text>
                 ) : (
                   <SettingsFields
-                    spec={selected?.config_spec ?? []}
+                    spec={settings.general}
                     values={config}
                     onChange={(name, v) =>
                       setConfig((c) => ({ ...c, [name]: v }))
@@ -485,7 +550,7 @@ export function ApplicationForm({
                     // the server names it after the subdomain and puts it in
                     // the directory "Suggest a directory" would pick.
                     extraOptions={newStoreOptions(
-                      selected?.file_store_settings ?? [],
+                      selectedFramework?.file_store_settings ?? [],
                       !appId,
                       t("Create a new local file store"),
                     )}
@@ -494,6 +559,41 @@ export function ApplicationForm({
               </Card.Body>
             </Card>
 
+            {/* Each build target's own settings, as the framework declared
+              them — no target-specific code here either. They are saved with
+              the application and used by the target's next build; the
+              sidebar's button only starts it. */}
+            {!ownTab &&
+              settings.targets.map((target) => (
+                <Card className="mb-3" key={target.name}>
+                  <Card.Header>{target.label}</Card.Header>
+                  <Card.Body>
+                    <SettingsFields
+                      spec={target.spec}
+                      values={config}
+                      idPrefix={`target-${target.name}`}
+                      onChange={(name, v) =>
+                        setConfig((c) => ({ ...c, [name]: v }))
+                      }
+                      extraOptions={targetExtraOptions}
+                      pickerHints={filePickerHints}
+                      // A target's settings may depend on the framework's.
+                      conditionSpec={selectedFramework?.config_spec ?? []}
+                    />
+                    <TargetOperationButtons
+                      appId={appId}
+                      target={target.name}
+                      operations={target.operations}
+                      spec={selectedFramework?.config_spec ?? []}
+                      values={config}
+                      onSettings={(changed) =>
+                        setConfig((c) => ({ ...c, ...changed }))
+                      }
+                    />
+                  </Card.Body>
+                </Card>
+              ))}
+
             <Row>
               <Col md={6}>
                 <Form.Group className="mb-3">
@@ -1026,3 +1126,102 @@ function RepeatableRows<T extends Record<string, string>>({
     </Card>
   );
 }
+
+/** The buttons under a target's settings, e.g. "Generate a keystore", each
+ * shown while its `show_if` holds. Pressing one sends the form's current
+ * settings to the server, which runs the module's code, writes its files into
+ * the store and saves the settings it returns; the form then shows them too.
+ * On a new application the buttons are shown but disabled, with a note that
+ * they work once it is saved: before that there is no store to write into and
+ * nothing to save the settings on. */
+function TargetOperationButtons({
+  appId,
+  target,
+  operations,
+  spec,
+  values,
+  onSettings,
+}: {
+  appId?: string;
+  target: string;
+  operations: TargetOperationDecl[];
+  spec: FieldSpec[];
+  values: Record<string, string>;
+  onSettings: (changed: Record<string, string>) => void;
+}) {
+  const { t } = useT();
+  const [busy, setBusy] = useState<string | null>(null);
+  const [error, setError] = useState<string | null>(null);
+  const [result, setResult] = useState<{
+    message: string;
+    store: string;
+    files: string[];
+    git_repo: boolean;
+  } | null>(null);
+
+  const shown = operations.filter((op) => isShown(op, spec, values));
+  if (shown.length === 0) return null;
+
+  const run = async (operation: string) => {
+    if (!appId) return;
+    setBusy(operation);
+    setError(null);
+    setResult(null);
+    try {
+      const done = await api.runApplicationTargetOperation(appId, target, operation, {
+        config: buildConfig(spec, values),
+      });
+      onSettings(readConfig(done.settings));
+      setResult(done);
+    } catch (err) {
+      setError(errorMessage(err, "The operation failed."));
+    } finally {
+      setBusy(null);
+    }
+  };
+
+  return (
+    <div className="border-top pt-3">
+      {shown.map((op) => (
+        <div key={op.name} className="mb-2">
+          <Button
+            variant="outline-primary"
+            disabled={!appId || busy !== null}
+            onClick={() => void run(op.name)}
+          >
+            {busy === op.name ? t("Working…") : op.label}
+          </Button>
+          <Form.Text muted className="d-block">
+            {op.description}
+          </Form.Text>
+          {!appId && (
+            <Form.Text className="d-block text-warning-emphasis">
+              {t("Available once the application is saved: reopen it after saving to use this.")}
+            </Form.Text>
+          )}
+        </div>
+      ))}
+      {error && <Alert variant="danger">{error}</Alert>}
+      {result && (
+        <Alert variant="success" className="mt-2">
+          <div style={{ whiteSpace: "pre-wrap" }}>{result.message}</div>
+          {result.files.map((path) => (
+            <div key={path}>
+              <a href={downloadUrl(result.store, path)} download>
+                {t("Download {file}", { file: path })}
+              </a>
+            </div>
+          ))}
+          {result.git_repo && result.files.length > 0 && (
+            <div className="mt-2 text-warning-emphasis">
+              {t(
+                "File store “{store}” is a git repository: {files} will be part of your next commit, and pushed with it. Keep it out of a repository others can read.",
+                { store: result.store, files: result.files.join(", ") },
+              )}
+            </div>
+          )}
+        </Alert>
+      )}
+    </div>
+  );
+}
diff --git a/ui/admin/src/screens/FileManager.tsx b/ui/admin/src/screens/FileManager.tsx
index 38d1aa99..9dde4669 100644
--- a/ui/admin/src/screens/FileManager.tsx
+++ b/ui/admin/src/screens/FileManager.tsx
@@ -42,7 +42,7 @@ import Modal from "react-bootstrap/Modal";
 import Spinner from "react-bootstrap/Spinner";
 import Table from "react-bootstrap/Table";
 
-import { api, errorMessage, uploadFile } from "../api";
+import { api, downloadUrl, errorMessage, uploadFile } from "../api";
 import type { GetFileMetaResponse } from "../client";
 import { ideUrl, navigate } from "../App";
 import {
@@ -292,26 +292,15 @@ export function FileManager({
     });
   };
 
-  const download = async (entries: Entry[]) => {
+  const download = (entries: Entry[]) => {
     setError(null);
-    try {
-      // One file at a time: there is no archive endpoint, and the browser is
-      // happy to be handed several blobs in a row.
-      for (const entry of entries.filter((e) => !e.is_dir)) {
-        const file = await api.readFile(store, { path: entry.path });
-        // Rebuild the bytes from base64 and hand them to the browser as a blob —
-        // `readFile` always provides base64 precisely so binary survives.
-        const binary = atob(file.base64);
-        const bytes = Uint8Array.from(binary, (c) => c.charCodeAt(0));
-        const url = URL.createObjectURL(new Blob([bytes]));
-        const link = document.createElement("a");
-        link.href = url;
-        link.download = entry.name;
-        link.click();
-        URL.revokeObjectURL(url);
-      }
-    } catch (err) {
-      setError(errorMessage(err, "Could not download the file."));
+    // One link per file: the browser fetches and saves each itself, at any
+    // size, rather than this page holding the bytes (an APK is 100 MB).
+    for (const entry of entries.filter((e) => !e.is_dir)) {
+      const link = document.createElement("a");
+      link.href = downloadUrl(store, entry.path);
+      link.download = entry.name;
+      link.click();
     }
   };
 
@@ -460,7 +449,7 @@ export function FileManager({
             busy={busy}
             onOpen={openEntry}
             onEdit={(entry) => void openEditor(entry)}
-            onDownload={() => void download(selected)}
+            onDownload={() => download(selected)}
             onRename={rename}
             onPermissions={(entry) => void openPermissions(entry)}
             onDelete={() => removeSelected(selected)}
@@ -568,7 +557,7 @@ export function FileManager({
                         busy={busy}
                         onOpen={openEntry}
                         onEdit={(e) => void openEditor(e)}
-                        onDownload={() => void download([entry])}
+                        onDownload={() => download([entry])}
                         onRename={rename}
                         onPermissions={(e) => void openPermissions(e)}
                         onDelete={() => removeSelected([entry])}
diff --git a/ui/admin/src/screens/settingsScreen.test.ts b/ui/admin/src/screens/settingsScreen.test.ts
index c382ddbf..d42014b0 100644
--- a/ui/admin/src/screens/settingsScreen.test.ts
+++ b/ui/admin/src/screens/settingsScreen.test.ts
@@ -52,6 +52,7 @@ const sections = [
         multiline: false,
         secret: false,
         create_only: false,
+        show_if: [],
         help: "off serves plain HTTP.",
       },
       {
@@ -64,6 +65,7 @@ const sections = [
         multiline: true,
         secret: true,
         create_only: false,
+        show_if: [],
         help: "Stored in the database.",
       },
       {
@@ -76,6 +78,7 @@ const sections = [
         multiline: false,
         secret: false,
         create_only: false,
+        show_if: [],
         help: "",
       },
       {
@@ -88,6 +91,7 @@ const sections = [
         multiline: false,
         secret: false,
         create_only: false,
+        show_if: [],
         help: "",
       },
     ],
@@ -182,6 +186,7 @@ const emailSection = {
       multiline: false,
       secret: false,
       create_only: false,
+      show_if: [],
       help: "The mail server's hostname.",
     },
   ],
@@ -204,6 +209,7 @@ const developmentSection = {
       multiline: false,
       secret: false,
       create_only: false,
+      show_if: [],
       help: "Print every statement this server sends to the database.",
     },
     {
@@ -216,6 +222,7 @@ const developmentSection = {
       multiline: false,
       secret: false,
       create_only: false,
+      show_if: [],
       help: "info logs every server request.",
     },
   ],
diff --git a/ui/admin/src/settings.tsx b/ui/admin/src/settings.tsx
index a06adade..b5a8bbce 100644
--- a/ui/admin/src/settings.tsx
+++ b/ui/admin/src/settings.tsx
@@ -53,8 +53,35 @@ export type FieldSpec = {
    * for the same reason `multiline` is one: no screen should know that a
    * particular action's particular setting happens to hold a program. */
   code_language?: string | null;
+  /** When the setting applies: every named setting holds one of its values
+   * (v1's `showIf`). Empty or absent means always. A setting that does not
+   * apply is not shown, and the server does not require it. */
+  show_if?: ShowIfCondition[];
 };
 
+/** One condition of a `show_if`: setting `name` must hold one of `values`. */
+export type ShowIfCondition = { name: string; values: unknown[] };
+
+/** Something the form shows only while its conditions hold (v1's `showIf`):
+ * a setting ({@link FieldSpec}), or a target's operation button. */
+export type Conditional = { show_if?: ShowIfCondition[] };
+
+/** Whether `item` is shown: every condition in its `show_if` holds for the
+ * form's current `values`. A setting the form has no value for yet counts as
+ * its default, looked up in `spec`. Compared as text, which is how a form holds
+ * every value — a checkbox is `"true"`. */
+export function isShown(
+  item: Conditional,
+  spec: readonly FieldSpec[],
+  values: Record<string, string>,
+): boolean {
+  return (item.show_if ?? []).every(({ name, values: allowed }) => {
+    const setting = spec.find((f) => f.name === name);
+    const current = values[name] ?? (setting ? asString(setting.default) : "");
+    return allowed.some((v) => asString(v) === current);
+  });
+}
+
 /** What the server substitutes for a secret setting's value on read, and what it
  * reads back as "unchanged" on write (`sc_types::SECRET_SENTINEL`).
  *
@@ -158,12 +185,18 @@ export function SettingField({
   locked = false,
   codeScope,
   extraOptions = [],
+  pickerHint,
 }: {
   field: FieldSpec;
   value: string;
   onChange: (value: string) => void;
   idPrefix?: string;
   locked?: boolean;
+  /** Makes the field a drop-down even while it has no choices, with this
+   * sentence under it saying why there are none and what to do — an app icon
+   * picked from a store that holds no images yet. A text box there would
+   * invite typing a path the screen could have offered. */
+  pickerHint?: string;
   /** Choices the *screen* adds after the field's own, each with its own label —
    * "Create a new local file store" at the end of a new application's store
    * picker. Passed in because the field only knows the values it may hold; what
@@ -180,7 +213,8 @@ export function SettingField({
   const fixedHint = fixed ? (
     <Form.Text muted><T text="Chosen when this was created; it cannot be changed." /></Form.Text>
   ) : null;
-  if (field.options.length > 0 || extraOptions.length > 0) {
+  const choices = field.options.length + extraOptions.length;
+  if (choices > 0 || pickerHint !== undefined) {
     return (
       <Form.Group className="mb-3" controlId={controlId}>
         <Form.Label>
@@ -207,6 +241,7 @@ export function SettingField({
             </option>
           ))}
         </Form.Select>
+        {choices === 0 && pickerHint && <Form.Text muted>{pickerHint}</Form.Text>}
         {fixedHint}
       </Form.Group>
     );
@@ -331,6 +366,8 @@ export function SettingsFields({
   locked = false,
   codeScope,
   extraOptions = {},
+  pickerHints = {},
+  conditionSpec,
 }: {
   spec: FieldSpec[];
   values: Record<string, string>;
@@ -345,10 +382,18 @@ export function SettingsFields({
   /** Screen-supplied choices appended to a setting's own, by setting name (see
    * [`SettingField`]). */
   extraOptions?: Record<string, ExtraOption[]>;
+  /** Settings that are always drop-downs, by name, each with the sentence shown
+   * while it has no choices (see [`SettingField`]). */
+  pickerHints?: Record<string, string>;
+  /** The settings a field's `show_if` may name, when that is more than `spec`
+   * — a form split into cards, whose conditions reach across them. */
+  conditionSpec?: readonly FieldSpec[];
 }) {
   return (
     <>
-      {spec.map((field) => (
+      {spec
+        .filter((field) => isShown(field, conditionSpec ?? spec, values))
+        .map((field) => (
         <SettingField
           key={field.name}
           field={field}
@@ -358,6 +403,7 @@ export function SettingsFields({
           locked={locked}
           codeScope={codeScope}
           extraOptions={extraOptions[field.name]}
+          pickerHint={pickerHints[field.name]}
         />
       ))}
     </>
diff --git a/ui/admin/src/targetSettings.test.ts b/ui/admin/src/targetSettings.test.ts
new file mode 100644
index 00000000..16402acc
--- /dev/null
+++ b/ui/admin/src/targetSettings.test.ts
@@ -0,0 +1,109 @@
+/**
+ * A build target's own settings on the application form: split out of the
+ * framework's, and a file picker's choices from the application's store.
+ */
+
+import { describe, expect, it } from "vitest";
+
+import { NEW_LOCAL_FILE_STORE } from "./newFileStore";
+import { isShown, type FieldSpec } from "./settings";
+import { fileOptions, storeNameOf, splitTargetSettings } from "./targetSettings";
+
+const field = (name: string): FieldSpec =>
+  ({
+    name,
+    label: name,
+    type: "text",
+    required: false,
+    options: [],
+    multiline: false,
+    secret: false,
+    create_only: false,
+  }) as FieldSpec;
+
+describe("splitTargetSettings", () => {
+  it("moves each target's settings into a card of its own", () => {
+    const spec = ["store", "project", "app_id", "app_icon"].map(field);
+    const split = splitTargetSettings(spec, [
+      { name: "android", label: "Android APK", options: ["app_id", "app_icon"] },
+    ]);
+    expect(split.general.map((f) => f.name)).toEqual(["store", "project"]);
+    expect(split.targets).toHaveLength(1);
+    expect(split.targets[0].label).toBe("Android APK");
+    expect(split.targets[0].spec.map((f) => f.name)).toEqual(["app_id", "app_icon"]);
+    expect(split.targets[0].operations).toEqual([]);
+  });
+
+  it("gives a target without settings no card", () => {
+    const split = splitTargetSettings([field("store")], [
+      { name: "android", label: "Android APK", options: [] },
+    ]);
+    expect(split.general.map((f) => f.name)).toEqual(["store"]);
+    expect(split.targets).toEqual([]);
+  });
+});
+
+describe("storeNameOf", () => {
+  it("is the name of the store the application uses", () => {
+    expect(storeNameOf(["store"], { store: "apps" })).toBe("apps");
+  });
+
+  it("is none while the store is blank or still to be created", () => {
+    expect(storeNameOf(["store"], { store: "" })).toBeNull();
+    expect(storeNameOf(["store"], { store: NEW_LOCAL_FILE_STORE })).toBeNull();
+  });
+});
+
+describe("fileOptions", () => {
+  const settings = [
+    { name: "app_icon", extensions: ["png"] },
+    { name: "keystore", extensions: ["jks"] },
+  ];
+
+  it("offers each setting the files of its own kind", () => {
+    const options = fileOptions(
+      settings,
+      { app_icon: ["a.png", "b.png"], keystore: ["keys/release.jks"] },
+      {},
+    );
+    expect(options.app_icon.map((o) => o.value)).toEqual(["a.png", "b.png"]);
+    expect(options.keystore.map((o) => o.value)).toEqual(["keys/release.jks"]);
+  });
+
+  it("keeps a current value the store no longer has", () => {
+    const options = fileOptions(settings, { app_icon: ["a.png"] }, { app_icon: "gone.png" });
+    expect(options.app_icon.map((o) => o.value)).toEqual(["a.png", "gone.png"]);
+    expect(options.keystore).toEqual([]);
+  });
+});
+
+describe("isShown", () => {
+  const spec: FieldSpec[] = [
+    { ...field("build_type"), default: "release" },
+    {
+      ...field("own_key"),
+      type: "bool",
+      default: false,
+      show_if: [{ name: "build_type", values: ["release"] }],
+    },
+    {
+      ...field("keystore_alias"),
+      show_if: [
+        { name: "build_type", values: ["release"] },
+        { name: "own_key", values: [true] },
+      ],
+    },
+  ];
+  const [, ownKey, alias] = spec;
+
+  it("shows the checkbox for a release build, by default", () => {
+    expect(isShown(ownKey, spec, {})).toBe(true);
+    expect(isShown(ownKey, spec, { build_type: "debug" })).toBe(false);
+  });
+
+  it("shows the keystore settings only once the checkbox is ticked", () => {
+    expect(isShown(alias, spec, {})).toBe(false);
+    expect(isShown(alias, spec, { own_key: "true" })).toBe(true);
+    expect(isShown(alias, spec, { own_key: "true", build_type: "debug" })).toBe(false);
+  });
+});
diff --git a/ui/admin/src/targetSettings.ts b/ui/admin/src/targetSettings.ts
new file mode 100644
index 00000000..09598549
--- /dev/null
+++ b/ui/admin/src/targetSettings.ts
@@ -0,0 +1,106 @@
+// A framework's build targets' own settings on the application form.
+//
+// A target (an Android APK) may declare settings that configure it alone: an
+// application id, a version, an icon, debug or release. The server lists them in
+// the framework's `config_spec` like every other setting — they are stored,
+// validated and handed to the framework's generators the same way — and names
+// them per target in `targets`. This module splits them out so the form shows
+// each target's settings in a card of its own, and fills each file picker (a
+// setting that picks a file: an app icon, a keystore) with the matching files
+// from the application's file store (`storeNameOf`, `fileOptions`).
+//
+// A module rather than inline in the screen for the reason `newFileStore.ts` is
+// one: what goes where is testable without a browser (`targetSettings.test.ts`).
+
+import { NEW_LOCAL_FILE_STORE, type ExtraOption } from "./newFileStore";
+import type { FieldSpec, ShowIfCondition } from "./settings";
+
+/** Something the module does for a target on request: a button under the
+ * target's settings, shown while its `show_if` holds. */
+export type TargetOperationDecl = {
+  name: string;
+  label: string;
+  description: string;
+  show_if: ShowIfCondition[];
+};
+
+/** A target as `listFrameworks` describes it. */
+export type TargetDecl = {
+  name: string;
+  label: string;
+  options: string[];
+  operations?: TargetOperationDecl[];
+};
+
+/** One target's settings, in the order the framework declared them, and its
+ * operations. */
+export type TargetSettings = {
+  name: string;
+  label: string;
+  spec: FieldSpec[];
+  operations: TargetOperationDecl[];
+};
+
+/** The framework's own settings, and each target's, from one `config_spec`. A
+ * target that declares no settings gets no card. */
+export function splitTargetSettings(
+  spec: readonly FieldSpec[],
+  targets: readonly TargetDecl[],
+): { general: FieldSpec[]; targets: TargetSettings[] } {
+  const owned = new Set(targets.flatMap((t) => t.options));
+  return {
+    general: spec.filter((f) => !owned.has(f.name)),
+    targets: targets
+      .map((t) => ({
+        name: t.name,
+        label: t.label,
+        spec: spec.filter((f) => t.options.includes(f.name)),
+        operations: t.operations ?? [],
+      }))
+      .filter((t) => t.spec.length > 0),
+  };
+}
+
+/** A file picker: a setting whose value is a file in the application's store
+ * (an app icon, a keystore), with the extensions it accepts, as
+ * `listFrameworks` describes it (`file_settings`). */
+export type FileSetting = { name: string; extensions: string[] };
+
+/** The name of the application's file store, which the file pickers list
+ * files from: the value of its file store setting (e.g. `"withcard"`). `null` while
+ * that is blank, or set to a store still to be created, which has no files yet. */
+export function storeNameOf(
+  fileStoreSettings: readonly string[],
+  config: Record<string, string>,
+): string | null {
+  for (const setting of fileStoreSettings) {
+    const store = (config[setting] ?? "").trim();
+    if (store && store !== NEW_LOCAL_FILE_STORE) return store;
+  }
+  return null;
+}
+
+/** The dropdown choices for each file picker (an icon, a keystore).
+ *
+ * A picker's choices are the matching files found in the store (`found`).
+ * If the picker already holds a file that is no longer there, that file is
+ * added as a choice too. Otherwise the dropdown could not show it, and
+ * opening and saving the form would quietly clear the setting.
+ *
+ * Example: `found = { app_icon: ["a.png", "b.png"] }`, and the icon is set to
+ * `"old.png"`, which has since been deleted. The icon's dropdown offers
+ * `a.png`, `b.png` and `old.png`, with `old.png` still selected. */
+export function fileOptions(
+  filePickers: readonly FileSetting[],
+  found: Record<string, readonly string[]>,
+  config: Record<string, string>,
+): Record<string, ExtraOption[]> {
+  return Object.fromEntries(
+    filePickers.map(({ name }) => {
+      const files = found[name] ?? [];
+      const current = (config[name] ?? "").trim();
+      const paths = current && !files.includes(current) ? [...files, current] : files;
+      return [name, paths.map((path) => ({ value: path, label: path }))];
+    }),
+  );
+}
diff --git a/ui/admin/src/views.test.ts b/ui/admin/src/views.test.ts
index 141183d9..d6647392 100644
--- a/ui/admin/src/views.test.ts
+++ b/ui/admin/src/views.test.ts
@@ -286,6 +286,7 @@ const field = (
   multiline: false,
   secret: false,
   create_only: false,
+  show_if: [],
   code_language: null,
   ...extra,
 });
diff --git a/ui/builder/src/client.ts b/ui/builder/src/client.ts
index b0afcc88..717a69d0 100644
--- a/ui/builder/src/client.ts
+++ b/ui/builder/src/client.ts
@@ -10,22 +10,22 @@ export type CreateFirstUserRequest = { email: string; password: string };
 export type CreateFirstUserResponse = { id: string; email: string; role: number };
 export type LoginRequest = { email: string; password: string };
 export type LoginResponse = { id: string; email: string; role: number };
-export type ListTablesResponse = Array<{ name: string; label: string; description: string; min_role_read: number; min_role_write: number; ownership_formula: string; rls_enabled: boolean; configured: boolean; ownership_error?: string | null; rls_available: boolean; database: string; metadata: boolean; provider?: { module: string; provider: string; configuration: unknown; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>; writes: { insert: boolean; update: boolean; delete: boolean }; issues: Array<string> } | null }>;
+export type ListTablesResponse = Array<{ name: string; label: string; description: string; min_role_read: number; min_role_write: number; ownership_formula: string; rls_enabled: boolean; configured: boolean; ownership_error?: string | null; rls_available: boolean; database: string; metadata: boolean; provider?: { module: string; provider: string; configuration: unknown; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>; writes: { insert: boolean; update: boolean; delete: boolean }; issues: Array<string> } | null }>;
 export type CreateTableRequest = { name: string; database?: string | null };
-export type CreateTableResponse = { name: string; label: string; description: string; min_role_read: number; min_role_write: number; ownership_formula: string; rls_enabled: boolean; configured: boolean; ownership_error?: string | null; rls_available: boolean; database: string; metadata: boolean; provider?: { module: string; provider: string; configuration: unknown; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>; writes: { insert: boolean; update: boolean; delete: boolean }; issues: Array<string> } | null };
+export type CreateTableResponse = { name: string; label: string; description: string; min_role_read: number; min_role_write: number; ownership_formula: string; rls_enabled: boolean; configured: boolean; ownership_error?: string | null; rls_available: boolean; database: string; metadata: boolean; provider?: { module: string; provider: string; configuration: unknown; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>; writes: { insert: boolean; update: boolean; delete: boolean }; issues: Array<string> } | null };
 export type CreateTableFromCsvRequest = { name: string; csv: string; database?: string | null };
-export type CreateTableFromCsvResponse = { table: { name: string; label: string; description: string; min_role_read: number; min_role_write: number; ownership_formula: string; rls_enabled: boolean; configured: boolean; ownership_error?: string | null; rls_available: boolean; database: string; metadata: boolean; provider?: { module: string; provider: string; configuration: unknown; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>; writes: { insert: boolean; update: boolean; delete: boolean }; issues: Array<string> } | null }; inserted: number };
+export type CreateTableFromCsvResponse = { table: { name: string; label: string; description: string; min_role_read: number; min_role_write: number; ownership_formula: string; rls_enabled: boolean; configured: boolean; ownership_error?: string | null; rls_available: boolean; database: string; metadata: boolean; provider?: { module: string; provider: string; configuration: unknown; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>; writes: { insert: boolean; update: boolean; delete: boolean }; issues: Array<string> } | null }; inserted: number };
 export type UpdateTableRequest = { label: string; description: string; min_role_read: number; min_role_write: number; ownership_formula: string; rls_enabled: boolean };
-export type UpdateTableResponse = { name: string; label: string; description: string; min_role_read: number; min_role_write: number; ownership_formula: string; rls_enabled: boolean; configured: boolean; ownership_error?: string | null; rls_available: boolean; database: string; metadata: boolean; provider?: { module: string; provider: string; configuration: unknown; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>; writes: { insert: boolean; update: boolean; delete: boolean }; issues: Array<string> } | null };
+export type UpdateTableResponse = { name: string; label: string; description: string; min_role_read: number; min_role_write: number; ownership_formula: string; rls_enabled: boolean; configured: boolean; ownership_error?: string | null; rls_available: boolean; database: string; metadata: boolean; provider?: { module: string; provider: string; configuration: unknown; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>; writes: { insert: boolean; update: boolean; delete: boolean }; issues: Array<string> } | null };
 export type DropTableResponse = { dropped: string };
 export type ListMetadataTablesResponse = Array<string>;
 export type CreateMetadataTableRequest = { name: string };
-export type CreateMetadataTableResponse = { name: string; label: string; description: string; min_role_read: number; min_role_write: number; ownership_formula: string; rls_enabled: boolean; configured: boolean; ownership_error?: string | null; rls_available: boolean; database: string; metadata: boolean; provider?: { module: string; provider: string; configuration: unknown; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>; writes: { insert: boolean; update: boolean; delete: boolean }; issues: Array<string> } | null };
-export type ListTableProvidersResponse = Array<{ module: string; provider: string; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }> }>;
+export type CreateMetadataTableResponse = { name: string; label: string; description: string; min_role_read: number; min_role_write: number; ownership_formula: string; rls_enabled: boolean; configured: boolean; ownership_error?: string | null; rls_available: boolean; database: string; metadata: boolean; provider?: { module: string; provider: string; configuration: unknown; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>; writes: { insert: boolean; update: boolean; delete: boolean }; issues: Array<string> } | null };
+export type ListTableProvidersResponse = Array<{ module: string; provider: string; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }> }>;
 export type CreateProvidedTableRequest = { name: string; module: string; provider: string; configuration?: unknown | null };
-export type CreateProvidedTableResponse = { name: string; label: string; description: string; min_role_read: number; min_role_write: number; ownership_formula: string; rls_enabled: boolean; configured: boolean; ownership_error?: string | null; rls_available: boolean; database: string; metadata: boolean; provider?: { module: string; provider: string; configuration: unknown; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>; writes: { insert: boolean; update: boolean; delete: boolean }; issues: Array<string> } | null };
+export type CreateProvidedTableResponse = { name: string; label: string; description: string; min_role_read: number; min_role_write: number; ownership_formula: string; rls_enabled: boolean; configured: boolean; ownership_error?: string | null; rls_available: boolean; database: string; metadata: boolean; provider?: { module: string; provider: string; configuration: unknown; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>; writes: { insert: boolean; update: boolean; delete: boolean }; issues: Array<string> } | null };
 export type UpdateProvidedTableRequest = { configuration: unknown };
-export type UpdateProvidedTableResponse = { name: string; label: string; description: string; min_role_read: number; min_role_write: number; ownership_formula: string; rls_enabled: boolean; configured: boolean; ownership_error?: string | null; rls_available: boolean; database: string; metadata: boolean; provider?: { module: string; provider: string; configuration: unknown; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>; writes: { insert: boolean; update: boolean; delete: boolean }; issues: Array<string> } | null };
+export type UpdateProvidedTableResponse = { name: string; label: string; description: string; min_role_read: number; min_role_write: number; ownership_formula: string; rls_enabled: boolean; configured: boolean; ownership_error?: string | null; rls_available: boolean; database: string; metadata: boolean; provider?: { module: string; provider: string; configuration: unknown; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>; writes: { insert: boolean; update: boolean; delete: boolean }; issues: Array<string> } | null };
 export type DeleteTableSettingsResponse = { deleted: boolean };
 export type ListOrphanTableSettingsResponse = Array<{ name: string; label: string; description: string; min_role_read: number; min_role_write: number; ownership_formula: string; rls_enabled: boolean }>;
 export type ListRolesResponse = Array<{ role: number; name: string; description: string; builtin: boolean }>;
@@ -43,7 +43,7 @@ export type ListConstraintsResponse = Array<{ name: string; type: string; fields
 export type CreateConstraintRequest = { type: string; fields?: Array<string> | null; language?: string | null; formula?: string | null; name?: string | null; error_message?: string | null };
 export type CreateConstraintResponse = { name: string; type: string; fields: Array<string>; expression?: string | null; method?: string | null; language?: string | null; formula?: string | null; error_message?: string | null; managed: boolean };
 export type DeleteConstraintResponse = { dropped: string };
-export type ListFieldTypesResponse = Array<{ name: string; label: string; category: string; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }> }>;
+export type ListFieldTypesResponse = Array<{ name: string; label: string; category: string; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }> }>;
 export type ListRowsQuery = { order?: string; limit?: number; offset?: number; filter?: Record<string, string> };
 export type ListRowsResponse = Array<unknown>;
 export type CountRowsQuery = { filter?: Record<string, string> };
@@ -70,7 +70,7 @@ export type CreateFileStoreResponse = { id?: string | null; name: string; descri
 export type UpdateFileStoreRequest = { name: string; description: string; backend: string; config: unknown; min_role?: number | null };
 export type UpdateFileStoreResponse = { id?: string | null; name: string; description: string; backend: string; config: unknown; min_role?: number | null; connected: boolean; error?: string | null; is_git_repo?: boolean | null };
 export type DeleteFileStoreResponse = { deleted: boolean };
-export type ListFileStoreBackendsResponse = Array<{ name: string; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>; operations: Array<{ name: string; label: string; description: string; scope: string; input_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>; on_create: boolean; automatic: boolean }> }>;
+export type ListFileStoreBackendsResponse = Array<{ name: string; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>; operations: Array<{ name: string; label: string; description: string; scope: string; input_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>; on_create: boolean; automatic: boolean }> }>;
 export type RunBackendOperationRequest = { name: string; config: unknown; input: unknown };
 export type RunBackendOperationResponse = { config: unknown; output: string; data?: unknown | null };
 export type RunFileStoreOperationRequest = { input: unknown };
@@ -81,22 +81,22 @@ export type CreateLlmProviderResponse = { id: string; name: string; description:
 export type UpdateLlmProviderRequest = { name: string; description: string; backend: string; config: unknown };
 export type UpdateLlmProviderResponse = { id: string; name: string; description: string; backend: string; config: unknown };
 export type DeleteLlmProviderResponse = { deleted: boolean };
-export type ListLlmProviderBackendsResponse = Array<{ name: string; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }> }>;
+export type ListLlmProviderBackendsResponse = Array<{ name: string; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }> }>;
 export type ListLlmModelsResponse = Array<{ id: string; provider_id: string; name: string; description: string; is_default: boolean; config: unknown; capabilities: unknown; prices: unknown }>;
 export type CreateLlmModelRequest = { name: string; description: string; is_default: boolean; config: unknown };
 export type CreateLlmModelResponse = { id: string; provider_id: string; name: string; description: string; is_default: boolean; config: unknown; capabilities: unknown; prices: unknown };
 export type UpdateLlmModelRequest = { name: string; description: string; is_default: boolean; config: unknown };
 export type UpdateLlmModelResponse = { id: string; provider_id: string; name: string; description: string; is_default: boolean; config: unknown; capabilities: unknown; prices: unknown };
 export type DeleteLlmModelResponse = { deleted: boolean };
-export type ListLlmModelSettingsResponse = Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>;
+export type ListLlmModelSettingsResponse = Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>;
 export type FetchLlmModelsResponse = { ok: boolean; message: string; names: Array<string> };
 export type TestLlmModelRequest = { provider_id?: string | null; backend: string; config: unknown; name: string; model_config?: unknown | null };
 export type TestLlmModelResponse = { ok: boolean; message: string; model: string; capabilities: unknown; prices: unknown };
-export type ListModulesResponse = { modules: Array<{ id: string; name: string; language: string; source: string; location: string; version?: string | null; configuration: unknown; permissions: unknown; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>; actions: Array<{ name: string; description: string; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }> }>; functions: Array<{ name: string; description: string; is_async: boolean; arguments: Array<{ name: string; type?: string | null }> }>; table_providers: Array<string>; model_providers: Array<string>; stream_providers: Array<string>; view_patterns: Array<string>; unsupported: Array<{ key: string; count?: number | null }>; issues: Array<string>; loaded: boolean; api_version?: number | null }>; root: string; npm: boolean; npm_too_old?: { version: string; minimum: string } | null; node: boolean; python: boolean; pip: boolean; python_dir?: string | null; bundled: Array<{ id: string; name: string; language: string; title: string; description: string; supplies: Array<string>; installs: Array<string>; permissions: unknown; installed: boolean }> };
+export type ListModulesResponse = { modules: Array<{ id: string; name: string; language: string; source: string; location: string; version?: string | null; configuration: unknown; permissions: unknown; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>; actions: Array<{ name: string; description: string; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }> }>; functions: Array<{ name: string; description: string; is_async: boolean; arguments: Array<{ name: string; type?: string | null }> }>; table_providers: Array<string>; model_providers: Array<string>; stream_providers: Array<string>; view_patterns: Array<string>; unsupported: Array<{ key: string; count?: number | null }>; issues: Array<string>; loaded: boolean; api_version?: number | null }>; root: string; npm: boolean; npm_too_old?: { version: string; minimum: string } | null; node: boolean; python: boolean; pip: boolean; python_dir?: string | null; bundled: Array<{ id: string; name: string; language: string; title: string; description: string; supplies: Array<string>; installs: Array<string>; permissions: unknown; installed: boolean }> };
 export type InstallModuleRequest = { source: string; location: string; language?: string | null };
-export type InstallModuleResponse = { id: string; name: string; language: string; source: string; location: string; version?: string | null; configuration: unknown; permissions: unknown; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>; actions: Array<{ name: string; description: string; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }> }>; functions: Array<{ name: string; description: string; is_async: boolean; arguments: Array<{ name: string; type?: string | null }> }>; table_providers: Array<string>; model_providers: Array<string>; stream_providers: Array<string>; view_patterns: Array<string>; unsupported: Array<{ key: string; count?: number | null }>; issues: Array<string>; loaded: boolean; api_version?: number | null };
+export type InstallModuleResponse = { id: string; name: string; language: string; source: string; location: string; version?: string | null; configuration: unknown; permissions: unknown; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>; actions: Array<{ name: string; description: string; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }> }>; functions: Array<{ name: string; description: string; is_async: boolean; arguments: Array<{ name: string; type?: string | null }> }>; table_providers: Array<string>; model_providers: Array<string>; stream_providers: Array<string>; view_patterns: Array<string>; unsupported: Array<{ key: string; count?: number | null }>; issues: Array<string>; loaded: boolean; api_version?: number | null };
 export type UpdateModuleRequest = { configuration?: unknown | null; permissions?: unknown | null };
-export type UpdateModuleResponse = { id: string; name: string; language: string; source: string; location: string; version?: string | null; configuration: unknown; permissions: unknown; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>; actions: Array<{ name: string; description: string; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }> }>; functions: Array<{ name: string; description: string; is_async: boolean; arguments: Array<{ name: string; type?: string | null }> }>; table_providers: Array<string>; model_providers: Array<string>; stream_providers: Array<string>; view_patterns: Array<string>; unsupported: Array<{ key: string; count?: number | null }>; issues: Array<string>; loaded: boolean; api_version?: number | null };
+export type UpdateModuleResponse = { id: string; name: string; language: string; source: string; location: string; version?: string | null; configuration: unknown; permissions: unknown; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>; actions: Array<{ name: string; description: string; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }> }>; functions: Array<{ name: string; description: string; is_async: boolean; arguments: Array<{ name: string; type?: string | null }> }>; table_providers: Array<string>; model_providers: Array<string>; stream_providers: Array<string>; view_patterns: Array<string>; unsupported: Array<{ key: string; count?: number | null }>; issues: Array<string>; loaded: boolean; api_version?: number | null };
 export type DeleteModuleResponse = { deleted: boolean };
 export type ReloadModulesResponse = { modules: number };
 export type ListAgentsResponse = Array<{ id: string; name: string; description: string; provider: string; model?: string | null; system_prompt: string; traits: Array<{ trait: string; config: unknown }>; min_role?: number | null; attributes: unknown; error?: string | null }>;
@@ -105,15 +105,17 @@ export type CreateAgentResponse = { id: string; name: string; description: strin
 export type UpdateAgentRequest = { name: string; description: string; provider: string; model?: string | null; system_prompt: string; traits: Array<{ trait: string; config: unknown }>; min_role?: number | null; attributes: unknown };
 export type UpdateAgentResponse = { id: string; name: string; description: string; provider: string; model?: string | null; system_prompt: string; traits: Array<{ trait: string; config: unknown }>; min_role?: number | null; attributes: unknown; error?: string | null };
 export type DeleteAgentResponse = { deleted: boolean };
-export type ListAgentTraitsResponse = Array<{ name: string; description: string; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }> }>;
+export type ListAgentTraitsResponse = Array<{ name: string; description: string; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }> }>;
 export type ListRunsResponse = Array<{ id: string; kind: string; subject: string; description: string; state: string; error?: string | null; user?: string | null; created_at: string; updated_at: string; subject_version?: number | null; current_step?: string | null; wake_at?: string | null; conclusion?: unknown | null; parent_run?: string | null }>;
-export type GetRunResponse = { id: string; kind: string; subject: string; description: string; state: string; error?: string | null; user?: string | null; created_at: string; updated_at: string; subject_version?: number | null; current_step?: string | null; wake_at?: string | null; conclusion?: unknown | null; parent_run?: string | null; context: unknown; attributes: unknown; trace: Array<{ id: string; seq: number; step: string; started_at: string; finished_at: string; attempt: number; outcome: string; error?: string | null; context: unknown }>; pending_form?: { fields: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>; assign_to: string; min_role?: number | null } | null; plan?: { features: Array<{ id: string; title: string; description: string; kind: string; acceptance: Array<string>; files: Array<string>; pages: Array<string>; status: string; attempts: number; runs: Array<string> }>; progress: Array<{ feature: string; run: string; status: string; summary: string; check: string; diffstat: string }> } | null };
+export type GetRunResponse = { id: string; kind: string; subject: string; description: string; state: string; error?: string | null; user?: string | null; created_at: string; updated_at: string; subject_version?: number | null; current_step?: string | null; wake_at?: string | null; conclusion?: unknown | null; parent_run?: string | null; context: unknown; attributes: unknown; trace: Array<{ id: string; seq: number; step: string; started_at: string; finished_at: string; attempt: number; outcome: string; error?: string | null; context: unknown }>; pending_form?: { fields: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>; assign_to: string; min_role?: number | null } | null; plan?: { features: Array<{ id: string; title: string; description: string; kind: string; acceptance: Array<string>; files: Array<string>; pages: Array<string>; status: string; attempts: number; runs: Array<string> }>; progress: Array<{ feature: string; run: string; status: string; summary: string; check: string; diffstat: string }> } | null };
 export type GetRunDiffResponse = { run: string; runs: Array<string>; scopes: Array<{ store: string; root: string; files: Array<{ path: string; status: string; added?: number | null; removed?: number | null }>; moves: Array<{ from: string; to: string }>; stat: string; unified: string }> };
 export type DeleteRunResponse = { deleted: boolean };
 export type BrowseFilesRequest = { dir: string };
 export type BrowseFilesResponse = Array<{ name: string; path: string; is_dir: boolean; size?: number | null; modified?: string | null; owner?: string | null; min_role?: number | null; effective_min_role?: number | null }>;
 export type FindFilesRequest = { query: string; dir?: string | null; max_results?: number | null };
 export type FindFilesResponse = { entries: Array<{ name: string; path: string; is_dir: boolean; size?: number | null; modified?: string | null; owner?: string | null; min_role?: number | null; effective_min_role?: number | null }>; truncated: boolean };
+export type ListStoreFilesQuery = { extensions?: string };
+export type ListStoreFilesResponse = { paths: Array<string>; truncated: boolean };
 export type SearchFilesRequest = { pattern: string; regex?: boolean | null; case_sensitive?: boolean | null; whole_word?: boolean | null; glob?: string | null; dir?: string | null; max_results?: number | null };
 export type SearchFilesResponse = { matches: Array<{ path: string; line: number; column: number; length: number; text: string }>; files_searched: number; truncated: boolean };
 export type ReadFileRequest = { path: string };
@@ -139,6 +141,8 @@ export type DeleteApplicationResponse = { deleted: boolean; agent?: string | nul
 export type BuildApplicationResponse = { built: boolean; git_repo: boolean; log: string };
 export type DeepCleanApplicationResponse = { built: boolean; git_repo: boolean; log: string };
 export type BuildApplicationTargetResponse = { target: string; label: string; status: string; store: string; log_path: string; started_at: string; finished_at?: string | null; artifact?: string | null; size?: number | null; log?: string | null; error?: string | null };
+export type RunApplicationTargetOperationRequest = { config: unknown };
+export type RunApplicationTargetOperationResponse = { message: string; store: string; files: Array<string>; git_repo: boolean; settings: unknown };
 export type GetApplicationTargetBuildResponse = { target: string; label: string; status: string; store: string; log_path: string; started_at: string; finished_at?: string | null; artifact?: string | null; size?: number | null; log?: string | null; error?: string | null };
 export type UpdateApplicationClientResponse = { scaffolded: boolean; files: Array<string>; log: string };
 export type RunApplicationGraphqlRequest = { query: string; variables?: unknown | null; operationName?: string | null };
@@ -151,7 +155,7 @@ export type DeleteViewResponse = { deleted: boolean };
 export type CreateViewRequest = { name: string; description?: string | null; viewpattern: string; table_name?: string | null; min_role: number };
 export type CreateViewResponse = { id: string; name: string; description: string; viewpattern: string; table_name?: string | null; configuration: unknown; min_role: number; slug?: unknown | null; attributes: unknown };
 export type ViewConfigStepRequest = { viewpattern: string; table_name?: string | null; name?: string | null; step: number; context: unknown };
-export type ViewConfigStepResponse = { index: number; name: string; count: number; builder: boolean; builder_options?: unknown | null; skip: boolean; context_field?: string | null; blurb?: string | null; fields: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>; values: unknown; issues: Array<string> };
+export type ViewConfigStepResponse = { index: number; name: string; count: number; builder: boolean; builder_options?: unknown | null; skip: boolean; context_field?: string | null; blurb?: string | null; fields: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>; values: unknown; issues: Array<string> };
 export type ViewReferencesResponse = { embedded_in: Array<string>; linked_from: Array<string>; pages: Array<string>; library: Array<string>; places: Array<string> };
 export type ListPagesResponse = Array<{ id: string; name: string; title: string; description: string; layout: unknown; min_role: number; attributes: unknown }>;
 export type GetPageResponse = { id: string; name: string; title: string; description: string; layout: unknown; min_role: number; attributes: unknown };
@@ -190,8 +194,8 @@ export type BuilderPagePreviewResponse = { html: string };
 export type BuilderDistinctValuesResponse = { success: unknown };
 export type ListViewPatternsResponse = Array<{ name: string; label: string; description: string; table_required: boolean; view_quantity?: string | null; routes: Array<string>; steps: Array<string>; module?: string | null }>;
 export type BuilderStatusResponse = { available: boolean };
-export type ListFrameworksResponse = Array<{ name: string; label: string; description: string; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>; has_views: boolean; file_store_settings: Array<string> }>;
-export type ListApiProvidersResponse = Array<{ name: string; label: string; description: string; default_mount: string; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>; supports_custom_queries: boolean }>;
+export type ListFrameworksResponse = Array<{ name: string; label: string; description: string; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>; has_views: boolean; file_store_settings: Array<string>; file_settings: Array<{ name: string; extensions: Array<string> }>; targets: Array<{ name: string; label: string; options: Array<string>; operations: Array<{ name: string; label: string; description: string; show_if: Array<{ name: string; values: Array<unknown> }> }> }> }>;
+export type ListApiProvidersResponse = Array<{ name: string; label: string; description: string; default_mount: string; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>; supports_custom_queries: boolean }>;
 export type DescribeCustomQueryRequest = { name: string; description?: string | null; method: string; path: string; language?: string | null; code: string; params: Array<{ name: string; type: string; required?: boolean | null }>; min_role?: number | null; tables?: Array<string> | null };
 export type DescribeCustomQueryResponse = { columns: Array<{ name: string; type: string }> };
 export type ListUsersResponse = Array<{ id: string; email: string; role: number; disabled: boolean; language?: string | null; extra: unknown }>;
@@ -220,7 +224,7 @@ export type RunTriggerResponse = { result: unknown };
 export type TestRunTriggerRequest = unknown;
 export type TestRunTriggerResponse = { ok: boolean; result: unknown; error?: string | null; console: Array<{ level: string; text: string }>; row?: unknown | null };
 export type ListActionsQuery = { table?: string };
-export type ListActionsResponse = Array<{ name: string; description: string; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>; workflow_step: boolean }>;
+export type ListActionsResponse = Array<{ name: string; description: string; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>; workflow_step: boolean }>;
 export type GetWorkflowQuery = { version?: number };
 export type GetWorkflowResponse = { id: string; name: string; channel?: string | null; version: number; workflow: unknown; issues: Array<{ step?: string | null; problem: string }>; versions: Array<{ version: number; description: string; created_at: string; created_by?: string | null }> };
 export type SaveWorkflowRequest = { workflow: unknown; description?: string | null };
@@ -230,12 +234,12 @@ export type RevertWorkflowResponse = { id: string; name: string; channel?: strin
 export type ListWorkflowRunsQuery = { state?: string; limit?: number; offset?: number };
 export type ListWorkflowRunsResponse = Array<{ id: string; kind: string; subject: string; description: string; state: string; error?: string | null; user?: string | null; created_at: string; updated_at: string; subject_version?: number | null; current_step?: string | null; wake_at?: string | null; conclusion?: unknown | null; parent_run?: string | null }>;
 export type ResumeRunRequest = unknown;
-export type ResumeRunResponse = { id: string; kind: string; subject: string; description: string; state: string; error?: string | null; user?: string | null; created_at: string; updated_at: string; subject_version?: number | null; current_step?: string | null; wake_at?: string | null; conclusion?: unknown | null; parent_run?: string | null; context: unknown; attributes: unknown; trace: Array<{ id: string; seq: number; step: string; started_at: string; finished_at: string; attempt: number; outcome: string; error?: string | null; context: unknown }>; pending_form?: { fields: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>; assign_to: string; min_role?: number | null } | null; plan?: { features: Array<{ id: string; title: string; description: string; kind: string; acceptance: Array<string>; files: Array<string>; pages: Array<string>; status: string; attempts: number; runs: Array<string> }>; progress: Array<{ feature: string; run: string; status: string; summary: string; check: string; diffstat: string }> } | null };
+export type ResumeRunResponse = { id: string; kind: string; subject: string; description: string; state: string; error?: string | null; user?: string | null; created_at: string; updated_at: string; subject_version?: number | null; current_step?: string | null; wake_at?: string | null; conclusion?: unknown | null; parent_run?: string | null; context: unknown; attributes: unknown; trace: Array<{ id: string; seq: number; step: string; started_at: string; finished_at: string; attempt: number; outcome: string; error?: string | null; context: unknown }>; pending_form?: { fields: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>; assign_to: string; min_role?: number | null } | null; plan?: { features: Array<{ id: string; title: string; description: string; kind: string; acceptance: Array<string>; files: Array<string>; pages: Array<string>; status: string; attempts: number; runs: Array<string> }>; progress: Array<{ feature: string; run: string; status: string; summary: string; check: string; diffstat: string }> } | null };
 export type CancelRunRequest = { reason?: string | null };
-export type CancelRunResponse = { id: string; kind: string; subject: string; description: string; state: string; error?: string | null; user?: string | null; created_at: string; updated_at: string; subject_version?: number | null; current_step?: string | null; wake_at?: string | null; conclusion?: unknown | null; parent_run?: string | null; context: unknown; attributes: unknown; trace: Array<{ id: string; seq: number; step: string; started_at: string; finished_at: string; attempt: number; outcome: string; error?: string | null; context: unknown }>; pending_form?: { fields: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>; assign_to: string; min_role?: number | null } | null; plan?: { features: Array<{ id: string; title: string; description: string; kind: string; acceptance: Array<string>; files: Array<string>; pages: Array<string>; status: string; attempts: number; runs: Array<string> }>; progress: Array<{ feature: string; run: string; status: string; summary: string; check: string; diffstat: string }> } | null };
-export type RetryRunResponse = { id: string; kind: string; subject: string; description: string; state: string; error?: string | null; user?: string | null; created_at: string; updated_at: string; subject_version?: number | null; current_step?: string | null; wake_at?: string | null; conclusion?: unknown | null; parent_run?: string | null; context: unknown; attributes: unknown; trace: Array<{ id: string; seq: number; step: string; started_at: string; finished_at: string; attempt: number; outcome: string; error?: string | null; context: unknown }>; pending_form?: { fields: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>; assign_to: string; min_role?: number | null } | null; plan?: { features: Array<{ id: string; title: string; description: string; kind: string; acceptance: Array<string>; files: Array<string>; pages: Array<string>; status: string; attempts: number; runs: Array<string> }>; progress: Array<{ feature: string; run: string; status: string; summary: string; check: string; diffstat: string }> } | null };
+export type CancelRunResponse = { id: string; kind: string; subject: string; description: string; state: string; error?: string | null; user?: string | null; created_at: string; updated_at: string; subject_version?: number | null; current_step?: string | null; wake_at?: string | null; conclusion?: unknown | null; parent_run?: string | null; context: unknown; attributes: unknown; trace: Array<{ id: string; seq: number; step: string; started_at: string; finished_at: string; attempt: number; outcome: string; error?: string | null; context: unknown }>; pending_form?: { fields: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>; assign_to: string; min_role?: number | null } | null; plan?: { features: Array<{ id: string; title: string; description: string; kind: string; acceptance: Array<string>; files: Array<string>; pages: Array<string>; status: string; attempts: number; runs: Array<string> }>; progress: Array<{ feature: string; run: string; status: string; summary: string; check: string; diffstat: string }> } | null };
+export type RetryRunResponse = { id: string; kind: string; subject: string; description: string; state: string; error?: string | null; user?: string | null; created_at: string; updated_at: string; subject_version?: number | null; current_step?: string | null; wake_at?: string | null; conclusion?: unknown | null; parent_run?: string | null; context: unknown; attributes: unknown; trace: Array<{ id: string; seq: number; step: string; started_at: string; finished_at: string; attempt: number; outcome: string; error?: string | null; context: unknown }>; pending_form?: { fields: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>; assign_to: string; min_role?: number | null } | null; plan?: { features: Array<{ id: string; title: string; description: string; kind: string; acceptance: Array<string>; files: Array<string>; pages: Array<string>; status: string; attempts: number; runs: Array<string> }>; progress: Array<{ feature: string; run: string; status: string; summary: string; check: string; diffstat: string }> } | null };
 export type ListModelProvidersQuery = { dataset?: string; configuration?: string };
-export type ListModelProvidersResponse = { providers: Array<{ name: string; description: string; module?: string | null; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>; hyperparameters: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>; outcome_spec: unknown; outcome?: unknown | null; outcome_error?: string | null; standardise: boolean; binds_data: boolean; cancellable: boolean; unavailable?: string | null }>; builtins_compiled_out: boolean; notice?: string | null };
+export type ListModelProvidersResponse = { providers: Array<{ name: string; description: string; module?: string | null; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>; hyperparameters: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>; outcome_spec: unknown; outcome?: unknown | null; outcome_error?: string | null; standardise: boolean; binds_data: boolean; cancellable: boolean; unavailable?: string | null }>; builtins_compiled_out: boolean; notice?: string | null };
 export type PreviewDatasetRequest = { dataset: unknown; limit?: number | null };
 export type PreviewDatasetResponse = { columns: Array<{ name: string; type: string }>; rows: Array<unknown>; primary_key?: string | null; split_error?: string | null };
 export type ListModelsQuery = { table?: string };
@@ -273,16 +277,16 @@ export type DownloadModelRunResponse = unknown;
 export type WritePosteriorRequest = { variable: string; mode: string; statistics: unknown; table?: string | null; coordinates?: unknown | null; instance_field?: string | null; elements?: unknown | null };
 export type WritePosteriorResponse = { variable: string; mode: string; table: string; instance: string; written: number };
 export type ListStreamProvidersQuery = { provider?: string; configuration?: string };
-export type ListStreamProvidersResponse = { providers: Array<{ name: string; label: string; description: string; module?: string | null; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>; element_type?: unknown | null; element_type_error?: string | null }>; builtins_compiled_out: boolean; notice?: string | null };
+export type ListStreamProvidersResponse = { providers: Array<{ name: string; label: string; description: string; module?: string | null; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>; element_type?: unknown | null; element_type_error?: string | null }>; builtins_compiled_out: boolean; notice?: string | null };
 export type ListStreamsResponse = Array<{ id: string; name: string; description: string; provider: string; configuration: unknown; min_role?: number | null; attributes: unknown; enabled: boolean; element_type?: unknown | null; error?: string | null; status?: unknown | null; counters?: unknown | null }>;
 export type GetStreamResponse = { id: string; name: string; description: string; provider: string; configuration: unknown; min_role?: number | null; attributes: unknown; enabled: boolean; element_type?: unknown | null; error?: string | null; status?: unknown | null; counters?: unknown | null };
 export type SaveStreamRequest = { id?: string | null; name: string; description?: string | null; provider: string; configuration?: unknown | null; min_role?: number | null; attributes?: unknown | null; enabled?: boolean | null };
 export type SaveStreamResponse = { id: string; name: string; description: string; provider: string; configuration: unknown; min_role?: number | null; attributes: unknown; enabled: boolean; element_type?: unknown | null; error?: string | null; status?: unknown | null; counters?: unknown | null };
 export type DeleteStreamResponse = { deleted: boolean };
 export type StreamStatusResponse = { id: string; name: string; running: boolean; status?: unknown | null; counters?: unknown | null; element_type?: unknown | null; listeners: number };
-export type GetSettingsResponse = { sections: Array<{ name: string; label: string; description: string; fields: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; help: string }> }>; values: unknown };
+export type GetSettingsResponse = { sections: Array<{ name: string; label: string; description: string; fields: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }>; help: string }> }>; values: unknown };
 export type UpdateSettingsRequest = { values: unknown };
-export type UpdateSettingsResponse = { sections: Array<{ name: string; label: string; description: string; fields: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; help: string }> }>; values: unknown };
+export type UpdateSettingsResponse = { sections: Array<{ name: string; label: string; description: string; fields: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }>; help: string }> }>; values: unknown };
 export type SendTestEmailRequest = { to?: string | null };
 export type SendTestEmailResponse = { sent_to: string };
 export type GetPythonStatusResponse = { state: string; version?: string | null; explanation: string; dir?: string | null; site_packages?: string | null; bin?: string | null; packages: Array<{ name: string; version?: string | null }>; max_inflight: number; resident: number; threads: number; stuck: number; max_stuck: number; env_error?: string | null };
@@ -405,6 +409,7 @@ export interface ApiClient {
   deleteRun(id: string): Promise<DeleteRunResponse>;
   browseFiles(store: string, body: BrowseFilesRequest): Promise<BrowseFilesResponse>;
   findFiles(store: string, body: FindFilesRequest): Promise<FindFilesResponse>;
+  listStoreFiles(store: string, query?: ListStoreFilesQuery): Promise<ListStoreFilesResponse>;
   searchFiles(store: string, body: SearchFilesRequest): Promise<SearchFilesResponse>;
   readFile(store: string, body: ReadFileRequest): Promise<ReadFileResponse>;
   writeFile(store: string, body: WriteFileRequest): Promise<WriteFileResponse>;
@@ -420,6 +425,7 @@ export interface ApiClient {
   buildApplication(id: string): Promise<BuildApplicationResponse>;
   deepCleanApplication(id: string): Promise<DeepCleanApplicationResponse>;
   buildApplicationTarget(id: string, target: string): Promise<BuildApplicationTargetResponse>;
+  runApplicationTargetOperation(id: string, target: string, operation: string, body: RunApplicationTargetOperationRequest): Promise<RunApplicationTargetOperationResponse>;
   getApplicationTargetBuild(id: string, target: string): Promise<GetApplicationTargetBuildResponse>;
   updateApplicationClient(id: string): Promise<UpdateApplicationClientResponse>;
   runApplicationGraphql(id: string, body: RunApplicationGraphqlRequest): Promise<RunApplicationGraphqlResponse>;
@@ -1199,6 +1205,17 @@ export function createClient(options: ClientOptions = {}): ApiClient {
       if (!res.ok) throw await clientError("findFiles", res);
       return (await res.json()) as FindFilesResponse;
     },
+    async listStoreFiles(store, query) {
+      const search = new URLSearchParams();
+      if (query?.extensions !== undefined && query?.extensions !== null) search.append("extensions", String(query?.extensions));
+      const qs = search.toString();
+      const res = await doFetch(`${baseUrl}/api/file-stores/${store}/files-by-type${qs ? `?${qs}` : ""}`, {
+        method: "GET",
+        headers: requestHeaders("GET", false),
+      });
+      if (!res.ok) throw await clientError("listStoreFiles", res);
+      return (await res.json()) as ListStoreFilesResponse;
+    },
     async searchFiles(store, body) {
       const res = await doFetch(`${baseUrl}/api/file-stores/${store}/search`, {
         method: "POST",
@@ -1329,6 +1346,15 @@ export function createClient(options: ClientOptions = {}): ApiClient {
       if (!res.ok) throw await clientError("buildApplicationTarget", res);
       return (await res.json()) as BuildApplicationTargetResponse;
     },
+    async runApplicationTargetOperation(id, target, operation, body) {
+      const res = await doFetch(`${baseUrl}/api/applications/${id}/targets/${target}/operations/${operation}`, {
+        method: "POST",
+        headers: requestHeaders("POST", true),
+        body: JSON.stringify(body),
+      });
+      if (!res.ok) throw await clientError("runApplicationTargetOperation", res);
+      return (await res.json()) as RunApplicationTargetOperationResponse;
+    },
     async getApplicationTargetBuild(id, target) {
       const res = await doFetch(`${baseUrl}/api/applications/${id}/targets/${target}/build`, {
         method: "GET",
diff --git a/ui/ide/src/client.ts b/ui/ide/src/client.ts
index b0afcc88..717a69d0 100644
--- a/ui/ide/src/client.ts
+++ b/ui/ide/src/client.ts
@@ -10,22 +10,22 @@ export type CreateFirstUserRequest = { email: string; password: string };
 export type CreateFirstUserResponse = { id: string; email: string; role: number };
 export type LoginRequest = { email: string; password: string };
 export type LoginResponse = { id: string; email: string; role: number };
-export type ListTablesResponse = Array<{ name: string; label: string; description: string; min_role_read: number; min_role_write: number; ownership_formula: string; rls_enabled: boolean; configured: boolean; ownership_error?: string | null; rls_available: boolean; database: string; metadata: boolean; provider?: { module: string; provider: string; configuration: unknown; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>; writes: { insert: boolean; update: boolean; delete: boolean }; issues: Array<string> } | null }>;
+export type ListTablesResponse = Array<{ name: string; label: string; description: string; min_role_read: number; min_role_write: number; ownership_formula: string; rls_enabled: boolean; configured: boolean; ownership_error?: string | null; rls_available: boolean; database: string; metadata: boolean; provider?: { module: string; provider: string; configuration: unknown; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>; writes: { insert: boolean; update: boolean; delete: boolean }; issues: Array<string> } | null }>;
 export type CreateTableRequest = { name: string; database?: string | null };
-export type CreateTableResponse = { name: string; label: string; description: string; min_role_read: number; min_role_write: number; ownership_formula: string; rls_enabled: boolean; configured: boolean; ownership_error?: string | null; rls_available: boolean; database: string; metadata: boolean; provider?: { module: string; provider: string; configuration: unknown; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>; writes: { insert: boolean; update: boolean; delete: boolean }; issues: Array<string> } | null };
+export type CreateTableResponse = { name: string; label: string; description: string; min_role_read: number; min_role_write: number; ownership_formula: string; rls_enabled: boolean; configured: boolean; ownership_error?: string | null; rls_available: boolean; database: string; metadata: boolean; provider?: { module: string; provider: string; configuration: unknown; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>; writes: { insert: boolean; update: boolean; delete: boolean }; issues: Array<string> } | null };
 export type CreateTableFromCsvRequest = { name: string; csv: string; database?: string | null };
-export type CreateTableFromCsvResponse = { table: { name: string; label: string; description: string; min_role_read: number; min_role_write: number; ownership_formula: string; rls_enabled: boolean; configured: boolean; ownership_error?: string | null; rls_available: boolean; database: string; metadata: boolean; provider?: { module: string; provider: string; configuration: unknown; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>; writes: { insert: boolean; update: boolean; delete: boolean }; issues: Array<string> } | null }; inserted: number };
+export type CreateTableFromCsvResponse = { table: { name: string; label: string; description: string; min_role_read: number; min_role_write: number; ownership_formula: string; rls_enabled: boolean; configured: boolean; ownership_error?: string | null; rls_available: boolean; database: string; metadata: boolean; provider?: { module: string; provider: string; configuration: unknown; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>; writes: { insert: boolean; update: boolean; delete: boolean }; issues: Array<string> } | null }; inserted: number };
 export type UpdateTableRequest = { label: string; description: string; min_role_read: number; min_role_write: number; ownership_formula: string; rls_enabled: boolean };
-export type UpdateTableResponse = { name: string; label: string; description: string; min_role_read: number; min_role_write: number; ownership_formula: string; rls_enabled: boolean; configured: boolean; ownership_error?: string | null; rls_available: boolean; database: string; metadata: boolean; provider?: { module: string; provider: string; configuration: unknown; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>; writes: { insert: boolean; update: boolean; delete: boolean }; issues: Array<string> } | null };
+export type UpdateTableResponse = { name: string; label: string; description: string; min_role_read: number; min_role_write: number; ownership_formula: string; rls_enabled: boolean; configured: boolean; ownership_error?: string | null; rls_available: boolean; database: string; metadata: boolean; provider?: { module: string; provider: string; configuration: unknown; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>; writes: { insert: boolean; update: boolean; delete: boolean }; issues: Array<string> } | null };
 export type DropTableResponse = { dropped: string };
 export type ListMetadataTablesResponse = Array<string>;
 export type CreateMetadataTableRequest = { name: string };
-export type CreateMetadataTableResponse = { name: string; label: string; description: string; min_role_read: number; min_role_write: number; ownership_formula: string; rls_enabled: boolean; configured: boolean; ownership_error?: string | null; rls_available: boolean; database: string; metadata: boolean; provider?: { module: string; provider: string; configuration: unknown; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>; writes: { insert: boolean; update: boolean; delete: boolean }; issues: Array<string> } | null };
-export type ListTableProvidersResponse = Array<{ module: string; provider: string; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }> }>;
+export type CreateMetadataTableResponse = { name: string; label: string; description: string; min_role_read: number; min_role_write: number; ownership_formula: string; rls_enabled: boolean; configured: boolean; ownership_error?: string | null; rls_available: boolean; database: string; metadata: boolean; provider?: { module: string; provider: string; configuration: unknown; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>; writes: { insert: boolean; update: boolean; delete: boolean }; issues: Array<string> } | null };
+export type ListTableProvidersResponse = Array<{ module: string; provider: string; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }> }>;
 export type CreateProvidedTableRequest = { name: string; module: string; provider: string; configuration?: unknown | null };
-export type CreateProvidedTableResponse = { name: string; label: string; description: string; min_role_read: number; min_role_write: number; ownership_formula: string; rls_enabled: boolean; configured: boolean; ownership_error?: string | null; rls_available: boolean; database: string; metadata: boolean; provider?: { module: string; provider: string; configuration: unknown; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>; writes: { insert: boolean; update: boolean; delete: boolean }; issues: Array<string> } | null };
+export type CreateProvidedTableResponse = { name: string; label: string; description: string; min_role_read: number; min_role_write: number; ownership_formula: string; rls_enabled: boolean; configured: boolean; ownership_error?: string | null; rls_available: boolean; database: string; metadata: boolean; provider?: { module: string; provider: string; configuration: unknown; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>; writes: { insert: boolean; update: boolean; delete: boolean }; issues: Array<string> } | null };
 export type UpdateProvidedTableRequest = { configuration: unknown };
-export type UpdateProvidedTableResponse = { name: string; label: string; description: string; min_role_read: number; min_role_write: number; ownership_formula: string; rls_enabled: boolean; configured: boolean; ownership_error?: string | null; rls_available: boolean; database: string; metadata: boolean; provider?: { module: string; provider: string; configuration: unknown; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>; writes: { insert: boolean; update: boolean; delete: boolean }; issues: Array<string> } | null };
+export type UpdateProvidedTableResponse = { name: string; label: string; description: string; min_role_read: number; min_role_write: number; ownership_formula: string; rls_enabled: boolean; configured: boolean; ownership_error?: string | null; rls_available: boolean; database: string; metadata: boolean; provider?: { module: string; provider: string; configuration: unknown; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>; writes: { insert: boolean; update: boolean; delete: boolean }; issues: Array<string> } | null };
 export type DeleteTableSettingsResponse = { deleted: boolean };
 export type ListOrphanTableSettingsResponse = Array<{ name: string; label: string; description: string; min_role_read: number; min_role_write: number; ownership_formula: string; rls_enabled: boolean }>;
 export type ListRolesResponse = Array<{ role: number; name: string; description: string; builtin: boolean }>;
@@ -43,7 +43,7 @@ export type ListConstraintsResponse = Array<{ name: string; type: string; fields
 export type CreateConstraintRequest = { type: string; fields?: Array<string> | null; language?: string | null; formula?: string | null; name?: string | null; error_message?: string | null };
 export type CreateConstraintResponse = { name: string; type: string; fields: Array<string>; expression?: string | null; method?: string | null; language?: string | null; formula?: string | null; error_message?: string | null; managed: boolean };
 export type DeleteConstraintResponse = { dropped: string };
-export type ListFieldTypesResponse = Array<{ name: string; label: string; category: string; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }> }>;
+export type ListFieldTypesResponse = Array<{ name: string; label: string; category: string; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }> }>;
 export type ListRowsQuery = { order?: string; limit?: number; offset?: number; filter?: Record<string, string> };
 export type ListRowsResponse = Array<unknown>;
 export type CountRowsQuery = { filter?: Record<string, string> };
@@ -70,7 +70,7 @@ export type CreateFileStoreResponse = { id?: string | null; name: string; descri
 export type UpdateFileStoreRequest = { name: string; description: string; backend: string; config: unknown; min_role?: number | null };
 export type UpdateFileStoreResponse = { id?: string | null; name: string; description: string; backend: string; config: unknown; min_role?: number | null; connected: boolean; error?: string | null; is_git_repo?: boolean | null };
 export type DeleteFileStoreResponse = { deleted: boolean };
-export type ListFileStoreBackendsResponse = Array<{ name: string; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>; operations: Array<{ name: string; label: string; description: string; scope: string; input_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>; on_create: boolean; automatic: boolean }> }>;
+export type ListFileStoreBackendsResponse = Array<{ name: string; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>; operations: Array<{ name: string; label: string; description: string; scope: string; input_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>; on_create: boolean; automatic: boolean }> }>;
 export type RunBackendOperationRequest = { name: string; config: unknown; input: unknown };
 export type RunBackendOperationResponse = { config: unknown; output: string; data?: unknown | null };
 export type RunFileStoreOperationRequest = { input: unknown };
@@ -81,22 +81,22 @@ export type CreateLlmProviderResponse = { id: string; name: string; description:
 export type UpdateLlmProviderRequest = { name: string; description: string; backend: string; config: unknown };
 export type UpdateLlmProviderResponse = { id: string; name: string; description: string; backend: string; config: unknown };
 export type DeleteLlmProviderResponse = { deleted: boolean };
-export type ListLlmProviderBackendsResponse = Array<{ name: string; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }> }>;
+export type ListLlmProviderBackendsResponse = Array<{ name: string; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }> }>;
 export type ListLlmModelsResponse = Array<{ id: string; provider_id: string; name: string; description: string; is_default: boolean; config: unknown; capabilities: unknown; prices: unknown }>;
 export type CreateLlmModelRequest = { name: string; description: string; is_default: boolean; config: unknown };
 export type CreateLlmModelResponse = { id: string; provider_id: string; name: string; description: string; is_default: boolean; config: unknown; capabilities: unknown; prices: unknown };
 export type UpdateLlmModelRequest = { name: string; description: string; is_default: boolean; config: unknown };
 export type UpdateLlmModelResponse = { id: string; provider_id: string; name: string; description: string; is_default: boolean; config: unknown; capabilities: unknown; prices: unknown };
 export type DeleteLlmModelResponse = { deleted: boolean };
-export type ListLlmModelSettingsResponse = Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>;
+export type ListLlmModelSettingsResponse = Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>;
 export type FetchLlmModelsResponse = { ok: boolean; message: string; names: Array<string> };
 export type TestLlmModelRequest = { provider_id?: string | null; backend: string; config: unknown; name: string; model_config?: unknown | null };
 export type TestLlmModelResponse = { ok: boolean; message: string; model: string; capabilities: unknown; prices: unknown };
-export type ListModulesResponse = { modules: Array<{ id: string; name: string; language: string; source: string; location: string; version?: string | null; configuration: unknown; permissions: unknown; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>; actions: Array<{ name: string; description: string; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }> }>; functions: Array<{ name: string; description: string; is_async: boolean; arguments: Array<{ name: string; type?: string | null }> }>; table_providers: Array<string>; model_providers: Array<string>; stream_providers: Array<string>; view_patterns: Array<string>; unsupported: Array<{ key: string; count?: number | null }>; issues: Array<string>; loaded: boolean; api_version?: number | null }>; root: string; npm: boolean; npm_too_old?: { version: string; minimum: string } | null; node: boolean; python: boolean; pip: boolean; python_dir?: string | null; bundled: Array<{ id: string; name: string; language: string; title: string; description: string; supplies: Array<string>; installs: Array<string>; permissions: unknown; installed: boolean }> };
+export type ListModulesResponse = { modules: Array<{ id: string; name: string; language: string; source: string; location: string; version?: string | null; configuration: unknown; permissions: unknown; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>; actions: Array<{ name: string; description: string; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }> }>; functions: Array<{ name: string; description: string; is_async: boolean; arguments: Array<{ name: string; type?: string | null }> }>; table_providers: Array<string>; model_providers: Array<string>; stream_providers: Array<string>; view_patterns: Array<string>; unsupported: Array<{ key: string; count?: number | null }>; issues: Array<string>; loaded: boolean; api_version?: number | null }>; root: string; npm: boolean; npm_too_old?: { version: string; minimum: string } | null; node: boolean; python: boolean; pip: boolean; python_dir?: string | null; bundled: Array<{ id: string; name: string; language: string; title: string; description: string; supplies: Array<string>; installs: Array<string>; permissions: unknown; installed: boolean }> };
 export type InstallModuleRequest = { source: string; location: string; language?: string | null };
-export type InstallModuleResponse = { id: string; name: string; language: string; source: string; location: string; version?: string | null; configuration: unknown; permissions: unknown; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>; actions: Array<{ name: string; description: string; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }> }>; functions: Array<{ name: string; description: string; is_async: boolean; arguments: Array<{ name: string; type?: string | null }> }>; table_providers: Array<string>; model_providers: Array<string>; stream_providers: Array<string>; view_patterns: Array<string>; unsupported: Array<{ key: string; count?: number | null }>; issues: Array<string>; loaded: boolean; api_version?: number | null };
+export type InstallModuleResponse = { id: string; name: string; language: string; source: string; location: string; version?: string | null; configuration: unknown; permissions: unknown; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>; actions: Array<{ name: string; description: string; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }> }>; functions: Array<{ name: string; description: string; is_async: boolean; arguments: Array<{ name: string; type?: string | null }> }>; table_providers: Array<string>; model_providers: Array<string>; stream_providers: Array<string>; view_patterns: Array<string>; unsupported: Array<{ key: string; count?: number | null }>; issues: Array<string>; loaded: boolean; api_version?: number | null };
 export type UpdateModuleRequest = { configuration?: unknown | null; permissions?: unknown | null };
-export type UpdateModuleResponse = { id: string; name: string; language: string; source: string; location: string; version?: string | null; configuration: unknown; permissions: unknown; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>; actions: Array<{ name: string; description: string; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }> }>; functions: Array<{ name: string; description: string; is_async: boolean; arguments: Array<{ name: string; type?: string | null }> }>; table_providers: Array<string>; model_providers: Array<string>; stream_providers: Array<string>; view_patterns: Array<string>; unsupported: Array<{ key: string; count?: number | null }>; issues: Array<string>; loaded: boolean; api_version?: number | null };
+export type UpdateModuleResponse = { id: string; name: string; language: string; source: string; location: string; version?: string | null; configuration: unknown; permissions: unknown; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>; actions: Array<{ name: string; description: string; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }> }>; functions: Array<{ name: string; description: string; is_async: boolean; arguments: Array<{ name: string; type?: string | null }> }>; table_providers: Array<string>; model_providers: Array<string>; stream_providers: Array<string>; view_patterns: Array<string>; unsupported: Array<{ key: string; count?: number | null }>; issues: Array<string>; loaded: boolean; api_version?: number | null };
 export type DeleteModuleResponse = { deleted: boolean };
 export type ReloadModulesResponse = { modules: number };
 export type ListAgentsResponse = Array<{ id: string; name: string; description: string; provider: string; model?: string | null; system_prompt: string; traits: Array<{ trait: string; config: unknown }>; min_role?: number | null; attributes: unknown; error?: string | null }>;
@@ -105,15 +105,17 @@ export type CreateAgentResponse = { id: string; name: string; description: strin
 export type UpdateAgentRequest = { name: string; description: string; provider: string; model?: string | null; system_prompt: string; traits: Array<{ trait: string; config: unknown }>; min_role?: number | null; attributes: unknown };
 export type UpdateAgentResponse = { id: string; name: string; description: string; provider: string; model?: string | null; system_prompt: string; traits: Array<{ trait: string; config: unknown }>; min_role?: number | null; attributes: unknown; error?: string | null };
 export type DeleteAgentResponse = { deleted: boolean };
-export type ListAgentTraitsResponse = Array<{ name: string; description: string; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }> }>;
+export type ListAgentTraitsResponse = Array<{ name: string; description: string; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }> }>;
 export type ListRunsResponse = Array<{ id: string; kind: string; subject: string; description: string; state: string; error?: string | null; user?: string | null; created_at: string; updated_at: string; subject_version?: number | null; current_step?: string | null; wake_at?: string | null; conclusion?: unknown | null; parent_run?: string | null }>;
-export type GetRunResponse = { id: string; kind: string; subject: string; description: string; state: string; error?: string | null; user?: string | null; created_at: string; updated_at: string; subject_version?: number | null; current_step?: string | null; wake_at?: string | null; conclusion?: unknown | null; parent_run?: string | null; context: unknown; attributes: unknown; trace: Array<{ id: string; seq: number; step: string; started_at: string; finished_at: string; attempt: number; outcome: string; error?: string | null; context: unknown }>; pending_form?: { fields: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>; assign_to: string; min_role?: number | null } | null; plan?: { features: Array<{ id: string; title: string; description: string; kind: string; acceptance: Array<string>; files: Array<string>; pages: Array<string>; status: string; attempts: number; runs: Array<string> }>; progress: Array<{ feature: string; run: string; status: string; summary: string; check: string; diffstat: string }> } | null };
+export type GetRunResponse = { id: string; kind: string; subject: string; description: string; state: string; error?: string | null; user?: string | null; created_at: string; updated_at: string; subject_version?: number | null; current_step?: string | null; wake_at?: string | null; conclusion?: unknown | null; parent_run?: string | null; context: unknown; attributes: unknown; trace: Array<{ id: string; seq: number; step: string; started_at: string; finished_at: string; attempt: number; outcome: string; error?: string | null; context: unknown }>; pending_form?: { fields: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>; assign_to: string; min_role?: number | null } | null; plan?: { features: Array<{ id: string; title: string; description: string; kind: string; acceptance: Array<string>; files: Array<string>; pages: Array<string>; status: string; attempts: number; runs: Array<string> }>; progress: Array<{ feature: string; run: string; status: string; summary: string; check: string; diffstat: string }> } | null };
 export type GetRunDiffResponse = { run: string; runs: Array<string>; scopes: Array<{ store: string; root: string; files: Array<{ path: string; status: string; added?: number | null; removed?: number | null }>; moves: Array<{ from: string; to: string }>; stat: string; unified: string }> };
 export type DeleteRunResponse = { deleted: boolean };
 export type BrowseFilesRequest = { dir: string };
 export type BrowseFilesResponse = Array<{ name: string; path: string; is_dir: boolean; size?: number | null; modified?: string | null; owner?: string | null; min_role?: number | null; effective_min_role?: number | null }>;
 export type FindFilesRequest = { query: string; dir?: string | null; max_results?: number | null };
 export type FindFilesResponse = { entries: Array<{ name: string; path: string; is_dir: boolean; size?: number | null; modified?: string | null; owner?: string | null; min_role?: number | null; effective_min_role?: number | null }>; truncated: boolean };
+export type ListStoreFilesQuery = { extensions?: string };
+export type ListStoreFilesResponse = { paths: Array<string>; truncated: boolean };
 export type SearchFilesRequest = { pattern: string; regex?: boolean | null; case_sensitive?: boolean | null; whole_word?: boolean | null; glob?: string | null; dir?: string | null; max_results?: number | null };
 export type SearchFilesResponse = { matches: Array<{ path: string; line: number; column: number; length: number; text: string }>; files_searched: number; truncated: boolean };
 export type ReadFileRequest = { path: string };
@@ -139,6 +141,8 @@ export type DeleteApplicationResponse = { deleted: boolean; agent?: string | nul
 export type BuildApplicationResponse = { built: boolean; git_repo: boolean; log: string };
 export type DeepCleanApplicationResponse = { built: boolean; git_repo: boolean; log: string };
 export type BuildApplicationTargetResponse = { target: string; label: string; status: string; store: string; log_path: string; started_at: string; finished_at?: string | null; artifact?: string | null; size?: number | null; log?: string | null; error?: string | null };
+export type RunApplicationTargetOperationRequest = { config: unknown };
+export type RunApplicationTargetOperationResponse = { message: string; store: string; files: Array<string>; git_repo: boolean; settings: unknown };
 export type GetApplicationTargetBuildResponse = { target: string; label: string; status: string; store: string; log_path: string; started_at: string; finished_at?: string | null; artifact?: string | null; size?: number | null; log?: string | null; error?: string | null };
 export type UpdateApplicationClientResponse = { scaffolded: boolean; files: Array<string>; log: string };
 export type RunApplicationGraphqlRequest = { query: string; variables?: unknown | null; operationName?: string | null };
@@ -151,7 +155,7 @@ export type DeleteViewResponse = { deleted: boolean };
 export type CreateViewRequest = { name: string; description?: string | null; viewpattern: string; table_name?: string | null; min_role: number };
 export type CreateViewResponse = { id: string; name: string; description: string; viewpattern: string; table_name?: string | null; configuration: unknown; min_role: number; slug?: unknown | null; attributes: unknown };
 export type ViewConfigStepRequest = { viewpattern: string; table_name?: string | null; name?: string | null; step: number; context: unknown };
-export type ViewConfigStepResponse = { index: number; name: string; count: number; builder: boolean; builder_options?: unknown | null; skip: boolean; context_field?: string | null; blurb?: string | null; fields: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>; values: unknown; issues: Array<string> };
+export type ViewConfigStepResponse = { index: number; name: string; count: number; builder: boolean; builder_options?: unknown | null; skip: boolean; context_field?: string | null; blurb?: string | null; fields: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>; values: unknown; issues: Array<string> };
 export type ViewReferencesResponse = { embedded_in: Array<string>; linked_from: Array<string>; pages: Array<string>; library: Array<string>; places: Array<string> };
 export type ListPagesResponse = Array<{ id: string; name: string; title: string; description: string; layout: unknown; min_role: number; attributes: unknown }>;
 export type GetPageResponse = { id: string; name: string; title: string; description: string; layout: unknown; min_role: number; attributes: unknown };
@@ -190,8 +194,8 @@ export type BuilderPagePreviewResponse = { html: string };
 export type BuilderDistinctValuesResponse = { success: unknown };
 export type ListViewPatternsResponse = Array<{ name: string; label: string; description: string; table_required: boolean; view_quantity?: string | null; routes: Array<string>; steps: Array<string>; module?: string | null }>;
 export type BuilderStatusResponse = { available: boolean };
-export type ListFrameworksResponse = Array<{ name: string; label: string; description: string; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>; has_views: boolean; file_store_settings: Array<string> }>;
-export type ListApiProvidersResponse = Array<{ name: string; label: string; description: string; default_mount: string; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>; supports_custom_queries: boolean }>;
+export type ListFrameworksResponse = Array<{ name: string; label: string; description: string; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>; has_views: boolean; file_store_settings: Array<string>; file_settings: Array<{ name: string; extensions: Array<string> }>; targets: Array<{ name: string; label: string; options: Array<string>; operations: Array<{ name: string; label: string; description: string; show_if: Array<{ name: string; values: Array<unknown> }> }> }> }>;
+export type ListApiProvidersResponse = Array<{ name: string; label: string; description: string; default_mount: string; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>; supports_custom_queries: boolean }>;
 export type DescribeCustomQueryRequest = { name: string; description?: string | null; method: string; path: string; language?: string | null; code: string; params: Array<{ name: string; type: string; required?: boolean | null }>; min_role?: number | null; tables?: Array<string> | null };
 export type DescribeCustomQueryResponse = { columns: Array<{ name: string; type: string }> };
 export type ListUsersResponse = Array<{ id: string; email: string; role: number; disabled: boolean; language?: string | null; extra: unknown }>;
@@ -220,7 +224,7 @@ export type RunTriggerResponse = { result: unknown };
 export type TestRunTriggerRequest = unknown;
 export type TestRunTriggerResponse = { ok: boolean; result: unknown; error?: string | null; console: Array<{ level: string; text: string }>; row?: unknown | null };
 export type ListActionsQuery = { table?: string };
-export type ListActionsResponse = Array<{ name: string; description: string; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>; workflow_step: boolean }>;
+export type ListActionsResponse = Array<{ name: string; description: string; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>; workflow_step: boolean }>;
 export type GetWorkflowQuery = { version?: number };
 export type GetWorkflowResponse = { id: string; name: string; channel?: string | null; version: number; workflow: unknown; issues: Array<{ step?: string | null; problem: string }>; versions: Array<{ version: number; description: string; created_at: string; created_by?: string | null }> };
 export type SaveWorkflowRequest = { workflow: unknown; description?: string | null };
@@ -230,12 +234,12 @@ export type RevertWorkflowResponse = { id: string; name: string; channel?: strin
 export type ListWorkflowRunsQuery = { state?: string; limit?: number; offset?: number };
 export type ListWorkflowRunsResponse = Array<{ id: string; kind: string; subject: string; description: string; state: string; error?: string | null; user?: string | null; created_at: string; updated_at: string; subject_version?: number | null; current_step?: string | null; wake_at?: string | null; conclusion?: unknown | null; parent_run?: string | null }>;
 export type ResumeRunRequest = unknown;
-export type ResumeRunResponse = { id: string; kind: string; subject: string; description: string; state: string; error?: string | null; user?: string | null; created_at: string; updated_at: string; subject_version?: number | null; current_step?: string | null; wake_at?: string | null; conclusion?: unknown | null; parent_run?: string | null; context: unknown; attributes: unknown; trace: Array<{ id: string; seq: number; step: string; started_at: string; finished_at: string; attempt: number; outcome: string; error?: string | null; context: unknown }>; pending_form?: { fields: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>; assign_to: string; min_role?: number | null } | null; plan?: { features: Array<{ id: string; title: string; description: string; kind: string; acceptance: Array<string>; files: Array<string>; pages: Array<string>; status: string; attempts: number; runs: Array<string> }>; progress: Array<{ feature: string; run: string; status: string; summary: string; check: string; diffstat: string }> } | null };
+export type ResumeRunResponse = { id: string; kind: string; subject: string; description: string; state: string; error?: string | null; user?: string | null; created_at: string; updated_at: string; subject_version?: number | null; current_step?: string | null; wake_at?: string | null; conclusion?: unknown | null; parent_run?: string | null; context: unknown; attributes: unknown; trace: Array<{ id: string; seq: number; step: string; started_at: string; finished_at: string; attempt: number; outcome: string; error?: string | null; context: unknown }>; pending_form?: { fields: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>; assign_to: string; min_role?: number | null } | null; plan?: { features: Array<{ id: string; title: string; description: string; kind: string; acceptance: Array<string>; files: Array<string>; pages: Array<string>; status: string; attempts: number; runs: Array<string> }>; progress: Array<{ feature: string; run: string; status: string; summary: string; check: string; diffstat: string }> } | null };
 export type CancelRunRequest = { reason?: string | null };
-export type CancelRunResponse = { id: string; kind: string; subject: string; description: string; state: string; error?: string | null; user?: string | null; created_at: string; updated_at: string; subject_version?: number | null; current_step?: string | null; wake_at?: string | null; conclusion?: unknown | null; parent_run?: string | null; context: unknown; attributes: unknown; trace: Array<{ id: string; seq: number; step: string; started_at: string; finished_at: string; attempt: number; outcome: string; error?: string | null; context: unknown }>; pending_form?: { fields: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>; assign_to: string; min_role?: number | null } | null; plan?: { features: Array<{ id: string; title: string; description: string; kind: string; acceptance: Array<string>; files: Array<string>; pages: Array<string>; status: string; attempts: number; runs: Array<string> }>; progress: Array<{ feature: string; run: string; status: string; summary: string; check: string; diffstat: string }> } | null };
-export type RetryRunResponse = { id: string; kind: string; subject: string; description: string; state: string; error?: string | null; user?: string | null; created_at: string; updated_at: string; subject_version?: number | null; current_step?: string | null; wake_at?: string | null; conclusion?: unknown | null; parent_run?: string | null; context: unknown; attributes: unknown; trace: Array<{ id: string; seq: number; step: string; started_at: string; finished_at: string; attempt: number; outcome: string; error?: string | null; context: unknown }>; pending_form?: { fields: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>; assign_to: string; min_role?: number | null } | null; plan?: { features: Array<{ id: string; title: string; description: string; kind: string; acceptance: Array<string>; files: Array<string>; pages: Array<string>; status: string; attempts: number; runs: Array<string> }>; progress: Array<{ feature: string; run: string; status: string; summary: string; check: string; diffstat: string }> } | null };
+export type CancelRunResponse = { id: string; kind: string; subject: string; description: string; state: string; error?: string | null; user?: string | null; created_at: string; updated_at: string; subject_version?: number | null; current_step?: string | null; wake_at?: string | null; conclusion?: unknown | null; parent_run?: string | null; context: unknown; attributes: unknown; trace: Array<{ id: string; seq: number; step: string; started_at: string; finished_at: string; attempt: number; outcome: string; error?: string | null; context: unknown }>; pending_form?: { fields: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>; assign_to: string; min_role?: number | null } | null; plan?: { features: Array<{ id: string; title: string; description: string; kind: string; acceptance: Array<string>; files: Array<string>; pages: Array<string>; status: string; attempts: number; runs: Array<string> }>; progress: Array<{ feature: string; run: string; status: string; summary: string; check: string; diffstat: string }> } | null };
+export type RetryRunResponse = { id: string; kind: string; subject: string; description: string; state: string; error?: string | null; user?: string | null; created_at: string; updated_at: string; subject_version?: number | null; current_step?: string | null; wake_at?: string | null; conclusion?: unknown | null; parent_run?: string | null; context: unknown; attributes: unknown; trace: Array<{ id: string; seq: number; step: string; started_at: string; finished_at: string; attempt: number; outcome: string; error?: string | null; context: unknown }>; pending_form?: { fields: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>; assign_to: string; min_role?: number | null } | null; plan?: { features: Array<{ id: string; title: string; description: string; kind: string; acceptance: Array<string>; files: Array<string>; pages: Array<string>; status: string; attempts: number; runs: Array<string> }>; progress: Array<{ feature: string; run: string; status: string; summary: string; check: string; diffstat: string }> } | null };
 export type ListModelProvidersQuery = { dataset?: string; configuration?: string };
-export type ListModelProvidersResponse = { providers: Array<{ name: string; description: string; module?: string | null; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>; hyperparameters: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>; outcome_spec: unknown; outcome?: unknown | null; outcome_error?: string | null; standardise: boolean; binds_data: boolean; cancellable: boolean; unavailable?: string | null }>; builtins_compiled_out: boolean; notice?: string | null };
+export type ListModelProvidersResponse = { providers: Array<{ name: string; description: string; module?: string | null; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>; hyperparameters: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>; outcome_spec: unknown; outcome?: unknown | null; outcome_error?: string | null; standardise: boolean; binds_data: boolean; cancellable: boolean; unavailable?: string | null }>; builtins_compiled_out: boolean; notice?: string | null };
 export type PreviewDatasetRequest = { dataset: unknown; limit?: number | null };
 export type PreviewDatasetResponse = { columns: Array<{ name: string; type: string }>; rows: Array<unknown>; primary_key?: string | null; split_error?: string | null };
 export type ListModelsQuery = { table?: string };
@@ -273,16 +277,16 @@ export type DownloadModelRunResponse = unknown;
 export type WritePosteriorRequest = { variable: string; mode: string; statistics: unknown; table?: string | null; coordinates?: unknown | null; instance_field?: string | null; elements?: unknown | null };
 export type WritePosteriorResponse = { variable: string; mode: string; table: string; instance: string; written: number };
 export type ListStreamProvidersQuery = { provider?: string; configuration?: string };
-export type ListStreamProvidersResponse = { providers: Array<{ name: string; label: string; description: string; module?: string | null; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null }>; element_type?: unknown | null; element_type_error?: string | null }>; builtins_compiled_out: boolean; notice?: string | null };
+export type ListStreamProvidersResponse = { providers: Array<{ name: string; label: string; description: string; module?: string | null; config_spec: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }> }>; element_type?: unknown | null; element_type_error?: string | null }>; builtins_compiled_out: boolean; notice?: string | null };
 export type ListStreamsResponse = Array<{ id: string; name: string; description: string; provider: string; configuration: unknown; min_role?: number | null; attributes: unknown; enabled: boolean; element_type?: unknown | null; error?: string | null; status?: unknown | null; counters?: unknown | null }>;
 export type GetStreamResponse = { id: string; name: string; description: string; provider: string; configuration: unknown; min_role?: number | null; attributes: unknown; enabled: boolean; element_type?: unknown | null; error?: string | null; status?: unknown | null; counters?: unknown | null };
 export type SaveStreamRequest = { id?: string | null; name: string; description?: string | null; provider: string; configuration?: unknown | null; min_role?: number | null; attributes?: unknown | null; enabled?: boolean | null };
 export type SaveStreamResponse = { id: string; name: string; description: string; provider: string; configuration: unknown; min_role?: number | null; attributes: unknown; enabled: boolean; element_type?: unknown | null; error?: string | null; status?: unknown | null; counters?: unknown | null };
 export type DeleteStreamResponse = { deleted: boolean };
 export type StreamStatusResponse = { id: string; name: string; running: boolean; status?: unknown | null; counters?: unknown | null; element_type?: unknown | null; listeners: number };
-export type GetSettingsResponse = { sections: Array<{ name: string; label: string; description: string; fields: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; help: string }> }>; values: unknown };
+export type GetSettingsResponse = { sections: Array<{ name: string; label: string; description: string; fields: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }>; help: string }> }>; values: unknown };
 export type UpdateSettingsRequest = { values: unknown };
-export type UpdateSettingsResponse = { sections: Array<{ name: string; label: string; description: string; fields: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; help: string }> }>; values: unknown };
+export type UpdateSettingsResponse = { sections: Array<{ name: string; label: string; description: string; fields: Array<{ name: string; label: string; type: string; required: boolean; default?: unknown | null; options: Array<unknown>; multiline: boolean; secret: boolean; create_only: boolean; code_language?: string | null; show_if: Array<{ name: string; values: Array<unknown> }>; help: string }> }>; values: unknown };
 export type SendTestEmailRequest = { to?: string | null };
 export type SendTestEmailResponse = { sent_to: string };
 export type GetPythonStatusResponse = { state: string; version?: string | null; explanation: string; dir?: string | null; site_packages?: string | null; bin?: string | null; packages: Array<{ name: string; version?: string | null }>; max_inflight: number; resident: number; threads: number; stuck: number; max_stuck: number; env_error?: string | null };
@@ -405,6 +409,7 @@ export interface ApiClient {
   deleteRun(id: string): Promise<DeleteRunResponse>;
   browseFiles(store: string, body: BrowseFilesRequest): Promise<BrowseFilesResponse>;
   findFiles(store: string, body: FindFilesRequest): Promise<FindFilesResponse>;
+  listStoreFiles(store: string, query?: ListStoreFilesQuery): Promise<ListStoreFilesResponse>;
   searchFiles(store: string, body: SearchFilesRequest): Promise<SearchFilesResponse>;
   readFile(store: string, body: ReadFileRequest): Promise<ReadFileResponse>;
   writeFile(store: string, body: WriteFileRequest): Promise<WriteFileResponse>;
@@ -420,6 +425,7 @@ export interface ApiClient {
   buildApplication(id: string): Promise<BuildApplicationResponse>;
   deepCleanApplication(id: string): Promise<DeepCleanApplicationResponse>;
   buildApplicationTarget(id: string, target: string): Promise<BuildApplicationTargetResponse>;
+  runApplicationTargetOperation(id: string, target: string, operation: string, body: RunApplicationTargetOperationRequest): Promise<RunApplicationTargetOperationResponse>;
   getApplicationTargetBuild(id: string, target: string): Promise<GetApplicationTargetBuildResponse>;
   updateApplicationClient(id: string): Promise<UpdateApplicationClientResponse>;
   runApplicationGraphql(id: string, body: RunApplicationGraphqlRequest): Promise<RunApplicationGraphqlResponse>;
@@ -1199,6 +1205,17 @@ export function createClient(options: ClientOptions = {}): ApiClient {
       if (!res.ok) throw await clientError("findFiles", res);
       return (await res.json()) as FindFilesResponse;
     },
+    async listStoreFiles(store, query) {
+      const search = new URLSearchParams();
+      if (query?.extensions !== undefined && query?.extensions !== null) search.append("extensions", String(query?.extensions));
+      const qs = search.toString();
+      const res = await doFetch(`${baseUrl}/api/file-stores/${store}/files-by-type${qs ? `?${qs}` : ""}`, {
+        method: "GET",
+        headers: requestHeaders("GET", false),
+      });
+      if (!res.ok) throw await clientError("listStoreFiles", res);
+      return (await res.json()) as ListStoreFilesResponse;
+    },
     async searchFiles(store, body) {
       const res = await doFetch(`${baseUrl}/api/file-stores/${store}/search`, {
         method: "POST",
@@ -1329,6 +1346,15 @@ export function createClient(options: ClientOptions = {}): ApiClient {
       if (!res.ok) throw await clientError("buildApplicationTarget", res);
       return (await res.json()) as BuildApplicationTargetResponse;
     },
+    async runApplicationTargetOperation(id, target, operation, body) {
+      const res = await doFetch(`${baseUrl}/api/applications/${id}/targets/${target}/operations/${operation}`, {
+        method: "POST",
+        headers: requestHeaders("POST", true),
+        body: JSON.stringify(body),
+      });
+      if (!res.ok) throw await clientError("runApplicationTargetOperation", res);
+      return (await res.json()) as RunApplicationTargetOperationResponse;
+    },
     async getApplicationTargetBuild(id, target) {
       const res = await doFetch(`${baseUrl}/api/applications/${id}/targets/${target}/build`, {
         method: "GET",