v2 makes httpAuth mandatory on every integration definition: it is the server-owned authentication the Stats widget and arbitrary requests reuse. Both APIs take the key in an X-API-KEY header; Site Manager reads it from its own secret kind. Also split the inline type imports v2's stricter oxlint rejects. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>