install

The install block is required. It says how an installation comes to exist, whose it can be, and what a creator types to make one. The forms are data, not views: the dashboard, GET /connectors, the MCP catalogue and the creator apps all render the same fields.

"install": {
    "mode": "paste_credential",
    "scopes": ["project", "platform"],
    "fields": [ … ],
    "settings_fields": [ … ]
}

mode

Required. One of three ways a creator connects:

The kit's settings.install_fields rule expects a paste_credential connector to declare at least one input field and at least one secret among them, because there is nothing to paste otherwise.

scopes

Required, one or both of:

• project: an installation a project owns (the project's bot, the project's server). Most connectors support this.
• platform: an installation Subscriby itself owns on the platform and every creator shares (the sign-in bot creators talk to, the presence alerts arrive from). A connector that lists it must answer InstallationLifecycle::platformInstallation() with that installation; the core hands it to startLink() for creator handshakes, to RegistersCreators::signupEntry() and to the recovery facets that need the platform's own installation to act.

Telegram declares both: each project has its own bot, and Subscriby's platform bot signs creators in.

fields and settings_fields

Both optional, both a list of fields in display order. fields is the install form a creator fills in to connect; settings_fields is what they may change afterwards, on the installation's Configuration tab. When a connector declares them here it binds no SettingsSchema of its own: the core wires the SDK's ManifestSettingsSchema over the file, which also translates every label through the package's language files. Bind your own SettingsSchema only when the fields depend on the installation (a list of the server's channels, say), and then declare none here.

A field

{
    "name": "token",
    "type": "secret",
    "label": "Bot token",
    "help": "Paste the token @BotFather gave you. Keep it secret: anyone who has it controls the bot.",
    "required": true,
    "rules": ["string", "regex:/^\\d{6,12}:[A-Za-z0-9_-]{30,64}$/"],
    "links": { "@BotFather": "https://t.me/BotFather" }
}

The six types

How the values flow

1. The creator submits the install form. The core validates every field's rules and refuses the form with the messages a Laravel form would show.
2. The core puts every submitted install field, secret or not, into the CredentialBag, builds an InstallationRequest (scope, the acting creator, the project, the same fields as an array, and the existing installation when the creator is reconnecting) and calls InstallationLifecycle::begin().
3. For a complete draft the core calls complete() with that bag, then stores it encrypted on the installation row it records from the summary, merged with whatever the connector put in the summary's meta (a webhook signing secret it minted). The connector never sees how the bag is kept and keeps no secret of its own; every port receives the merged bag, and Core\Installations::credentials() reads it back before any port is called.
4. Settings fields are read through SettingsSchema::settingsFields($installation) with their current values filled in, and written through PATCH …/installation/settings or the Configuration tab.

The Telegram block

"install": {
    "mode": "paste_credential",
    "scopes": ["project", "platform"],
    "fields": [
        {
            "name": "instructions",
            "type": "instructions",
            "label": "Create a bot with @BotFather, then paste its token here.",
            "steps": [
                "Open the Telegram app and search for @BotFather.",
                "Start a chat with @BotFather and send the command /newbot.",
                "Follow the instructions to create your bot and get the token.",
                "Copy the token by tapping on it and paste it in the input below.",
                "Click on \":button\" to connect your bot to :app."
            ],
            "help": "You can use the @BotFather bot to customize your bot such as adding a bio description, adding a display picture or even adding the startup greeting message. Bot activation may take several seconds.",
            "links": { "@BotFather": "https://t.me/BotFather" }
        },
        {
            "name": "token",
            "type": "secret",
            "label": "Bot token",
            "help": "Paste the token @BotFather gave you. Keep it secret: anyone who has it controls the bot.",
            "required": true,
            "rules": ["string", "regex:/^\\d{6,12}:[A-Za-z0-9_-]{30,64}$/"]
        }
    ],
    "settings_fields": []
}

The Connect Bot dialog creators see is this block rendered: the numbered BotFather steps, the @BotFather link, the masked token box and the regex that refuses anything that is not a bot token. The walkthrough video beside it is the connector's install slot, which dresses the form up on the web without replacing it.