@hearthscale/app 0.1.0 → 0.2.1

package/dist/index.d.ts

@@ -1,3 +1,172 @@
+/** Resolved publisher identity, independent of the model architecture.
+ *  `GET /v1/publishers/{owner}/picture` answers the picture of the Hub
+ *  user or organisation `repository` names first: its bytes as
+ *  `image/png`, `image/jpeg`, `image/webp`, `image/gif` or
+ *  `image/svg+xml`, with `cache-control: max-age=86400`. A 404
+ *  `invalid_request` says no picture is known for the owner, and a 400
+ *  `invalid_request` refuses a name that is not one Hub path segment of
+ *  ASCII letters, digits, `-`, `_` and `.`. */
+interface ModelIdentity {
+    publisher: string;
+    /** The Hub repository whose publisher supplies the artwork; null for other sources. */
+    repository: string | null;
+}
+/** A job kind a model runs: the JSON Schema (draft-07) of its input, every
+ *  object of it closed. A property of `"format": "asset"`, alone or as the
+ *  items of an array, names a file by its asset id on the app's side,
+ *  `contentMediaType` saying what it takes, and its `description` the
+ *  limits the model sets on it; it reaches the Server as a `RenderUpload`
+ *  in the same place. A property's `default` is what the model's saved
+ *  settings give a job that leaves it out, as an image model's picture
+ *  size, steps and guidance. */
+interface JobSpec {
+    input: Record<string, unknown>;
+}
+/** The plan of a load or a media job against the memory as it stands, in
+ *  MiB. A loaded model's process holds the graphics and system memory, and
+ *  may fill the growth beside them as it keeps conversations ready; a
+ *  job's process holds them at most while it runs. */
+interface MemoryPlan {
+    graphicsMib: number;
+    systemMib: number;
+    growthMib: number;
+    /** The graphics and system memory together, written as the words write
+     *  an amount of memory. */
+    takes: string;
+    /** The context a language model's load takes, shorter than its settings
+     *  ask where the memory free now holds no more; absent for a media job. */
+    contextTokens?: number;
+    /** Whether the broker takes the load or the job now: it starts at once,
+     *  or once the busy models and jobs it waits for finish. It is the check
+     *  a load or a job meets as it starts, on the memory free now, and the
+     *  catalogue says it changed when it does. */
+    ready: boolean;
+    /** The plan in words, or why the load cannot start now: the limit that
+     *  stops it, the system memory free or what Windows can still commit,
+     *  and what the person closes or changes. */
+    words: string;
+}
+interface DownloadProgressBytes {
+    receivedBytes: number;
+    totalBytes: number;
+}
+/** The order of a Discover search; trending first where `sort` names
+ *  none. */
+type HubSort = 'trending' | 'downloads' | 'likes' | 'updated';
+/** One Hugging Face repository as Discover lists it: who published it, the
+ *  model it quantises, how it is used, and what its header states of its
+ *  size, its architecture and its window. */
+interface HubRepository {
+    identity: ModelIdentity;
+    formats: string[];
+    tasks: string[];
+    repo: string;
+    author: string;
+    /** The repository the weights were quantised from, where the card
+     *  names one. */
+    baseModel: string | null;
+    downloads: number;
+    likes: number;
+    /** A gated repository's files are read only with the Hugging Face token
+     *  the Server holds. */
+    gated: boolean;
+    updatedAt: string | null;
+    pipeline: string | null;
+    architecture: string | null;
+    params: number | null;
+    contextLength: number | null;
+    vision: boolean;
+    tools: boolean;
+    reasoning: boolean;
+}
+/** A file that can fill a companion role: where it is, how big it is, and
+ *  whether its checksum is published. */
+interface CompanionOption {
+    repo: string;
+    path: string;
+    sizeBytes: number;
+    verifiable: boolean;
+}
+/** One file of a repository a pull can name: the whole shard set where it
+ *  is a numbered shard, with the weights' projector beside it where the
+ *  repository holds one. */
+interface HubCandidate {
+    /** The model id the pull makes, with the projector a lone one picks. */
+    id: string;
+    /** The name the pulled model goes by where no other model of the
+     *  library shares it, as `CatalogModel.label` names it. */
+    name: string;
+    path: string;
+    quantization: string;
+    /** Every byte the pull writes for this file, its set and its projector. */
+    sizeBytes: number;
+    engine: string;
+    /** Whether every byte of it publishes a checksum; a pull refuses the
+     *  rest by name rather than downloading them unverified. */
+    verifiable: boolean;
+    /** The files the repository supplies beside the weights. */
+    components: {
+        role: string;
+        label: string;
+        path: string;
+    }[];
+    /** The companion roles the repository does not supply; a pull names a
+     *  file for each, found in the model's family, the first unless the
+     *  person chooses another. */
+    requires: {
+        role: string;
+        label: string;
+        options: CompanionOption[];
+    }[];
+    /** The companion roles the model loads where a pull names a file for
+     *  them, which the repository does not supply: `llm_vision`, the vision
+     *  part of a language model encoder, for a family that reads reference
+     *  pictures through it. */
+    offers: {
+        role: string;
+        label: string;
+        options: CompanionOption[];
+    }[];
+    /** Whether the repository holds vision projectors beside the file. */
+    projector: boolean;
+    /** The projectors to choose from where there is more than one, each
+     *  with the model id a pull with it makes. */
+    projectorOptions: {
+        path: string;
+        id: string;
+        sizeBytes: number;
+        verifiable: boolean;
+    }[];
+    /** The task the model serves, as `CatalogRole` names it. */
+    role: string;
+    format: string;
+    /** Why the file cannot be pulled, in the Server's words. */
+    reason?: string;
+}
+/** `GET /control/discover?task=&q=&sort=` answers the repositories of one
+ *  task that `q` matches, or with no `q` the whole set, at most 30, as
+ *  `HubRepository[]`; and `GET /control/discover/{owner}/{repo}` one
+ *  repository as `HubListing`: the files a runtime of the Server runs, how
+ *  many files it publishes in all, so a repository whose listing yields
+ *  no candidate is one no runtime there runs, and every file a pull of
+ *  another repository's model can name as a companion. Both read Hugging
+ *  Face on a person's act and on nothing else, and with no token, so they
+ *  reach the public repositories alone; the Server's own window reads the
+ *  same answers from `/local/discover`, with the token the person stored. */
+interface HubListing {
+    repo: string;
+    model: HubRepository;
+    files: number;
+    candidates: HubCandidate[];
+    companions: CompanionOption[];
+    capabilities: {
+        vision: boolean;
+        tools: boolean;
+        reasoning: boolean;
+        tasks: string[];
+    };
+}
+
 /**
  * The platform half of the contract, generated from the Rust types of
  * the `contract` crate by `npm run contract` in `apps/platform/scripts`.
@@ -50,12 +219,26 @@ type Entry = {
 } | {
     attached: SessionRoot[];
     type: 'session.roots';
+} | {
+    level: PermissionLevel;
+    type: 'session.level';
 } | {
     turn: string;
     model: string;
     provider: string;
     location: ModelLocation;
     revision: string;
+    /**
+     * The turn block the message that started the turn carries for
+     * the model in this and every later request; none when nothing it
+     * tells changed since the turns before.
+     */
+    block?: TurnBlock;
+    /**
+     * A hash of the apps the window showed and of their tools, when the
+     * block named them.
+     */
+    shown?: string;
     type: 'turn.started';
 } | {
     turn: string;
@@ -76,11 +259,6 @@ type Entry = {
     provider: string;
     error?: string;
     type: 'agent.message';
-} | {
-    turn: string;
-    partId: string;
-    text: string;
-    type: 'agent.part';
 } | {
     callId: string;
     turn: string;
@@ -283,12 +461,18 @@ type PrincipalRef = {
 };
 /**
  * Where a message or a call came from: the person, the person while a
- * turn ran, an app's backend, an agent, a view, or a window's own act
- * outside any conversation.
+ * turn ran, an app's backend, an agent, a view, a window's own act
+ * outside any conversation, or the platform's own words to the agent.
  */
-type Origin = 'user' | 'steer' | 'app' | 'agent' | 'view' | 'surface';
+type Origin = 'user' | 'steer' | 'app' | 'agent' | 'view' | 'surface' | 'core';
 type MountMode = 'read' | 'read-write';
 type RootKind = 'home' | 'workspace' | 'project' | 'memory' | 'skill' | 'folder' | 'file';
+/**
+ * `manual` is Supervised, `auto` is Auto, `skip` is Full access and
+ * `bypass` is Bypass all permissions, which only an app's own level
+ * holds.
+ */
+type PermissionLevel = 'manual' | 'auto' | 'skip' | 'bypass';
 type ModelLocation = 'local' | 'lan' | 'cloud';
 type StopReason = ('end_turn' | 'length' | 'budget' | 'cancelled' | 'error' | 'refused' | 'app_disabled' | 'app_update' | 'interrupted') | 'no_result';
 /**
@@ -341,6 +525,11 @@ type Content = {
  */
 type AgentPart = {
     text: string;
+    /**
+     * The words came as the model's reasoning, and stand as its
+     * answer because the reply held no other words and no call.
+     */
+    reasoning?: true;
     kind: 'text';
 } | {
     text: string;
@@ -363,7 +552,7 @@ type Authorisation = 'explicitly_no' | 'neutral' | 'explicitly_yes';
 /**
  * The rights a grant may hold; a closed list.
  */
-type Right = 'fs.read' | 'fs.write' | 'net.host' | 'connector' | 'capability' | 'sessions.create' | 'terminal' | 'reader';
+type Right = ('fs.read' | 'fs.write' | 'net.host' | 'connector' | 'capability' | 'sessions.create' | 'terminal' | 'reader') | 'account' | 'device';
 /**
  * How a program ended: at its end, with an error or a limit, stopped, or
  * lost with a daemon that did not stop cleanly.
@@ -383,12 +572,16 @@ type AskKind = CoreAskKind | AppAskKind;
 /**
  * What a card asks about, besides an app's own question.
  */
-type CoreAskKind = ('tool' | 'root' | 'connector.tools' | 'connector.login' | 'app.login' | 'terminal' | 'app.dev' | 'sandbox.violation') | 'question' | 'elicitation';
+type CoreAskKind = ('tool' | 'root' | 'connector.tools' | 'connector.login' | 'app.login' | 'terminal' | 'app.dev' | 'sandbox.violation') | 'pair' | 'question' | 'elicitation' | 'net.host' | 'account' | 'model.install' | 'device';
 /**
  * An app's own question kind, `app:<id>/<kind>`.
  */
 type AppAskKind = `app:${string}`;
 type PathShape = 'folder' | 'file';
+/**
+ * A family of devices a view picks from, as the person's pick names it.
+ */
+type DeviceFamily = 'hid' | 'usb' | 'serial' | 'bluetooth';
 type GrantScope = 'session' | 'always';
 type AskOutcome = 'answered' | 'expired' | 'closed' | 'covered';
 /**
@@ -413,10 +606,38 @@ type SurfaceOp = 'navigate' | 'evaluate' | 'screenshot' | 'show' | 'close';
  */
 type SettingValue = string | number | boolean;
 /**
- * The kinds a job runs on: every kind but chat.
+ * What a model card answers on, and what a job runs: a role word of
+ *         the runtimes, such as chat, embedding, image or transcription.
+ */
+type ModelKind = string;
+/**
+ * How soon a Hearthscale Server runs a completion or a job: `interactive`
+ * for work a person waits on (a conversation's turn, a press or a key
+ * inside a view, a tool call such work started), before the `batch` work
+ * an app does on its own. The platform decides it; no caller names it.
  */
-type JobKind = 'embedding' | 'image' | 'music' | 'speech' | 'transcription';
+type Priority = 'interactive' | 'batch';
 type JobStatus = 'queued' | 'running' | 'completed' | 'failed' | 'cancelled';
+type CardState = ('ready' | 'absent' | 'unavailable') | 'downloading';
+/**
+ * The card a request runs on, or the reason in words that none can.
+ */
+type EffectiveModel = {
+    card: string;
+    source: ModelSource;
+} | {
+    card: null;
+    reason: string;
+};
+/**
+ * Where a chosen card comes from: the session's own model, the card the
+ * person gave the app, the role of its kind, or, where none of them names
+ * one, the recommendation: an agent author's, else a Server's for its
+ * computer, else the first card its computer holds with room to spare. A
+ * utility role that names no card takes the chat choice under this last
+ * source.
+ */
+type ModelSource = 'session' | 'app' | 'role' | 'recommended';
 type SessionStatus = 'idle' | 'running' | 'requires_action' | 'terminated';
 /**
  * One picture for both colour schemes, or one per scheme.
@@ -441,11 +662,11 @@ type PaymentKind = 'free' | 'optional' | 'paid';
  * An entry of `environment.network`.
  */
 type NetworkEntry = string;
-type Lifetime = 'service';
 /**
- * The kinds a model card answers on.
+ * An entry of `environment.listen`: a port no system service holds.
  */
-type ModelKind = 'chat' | 'embedding' | 'image' | 'music' | 'speech' | 'transcription';
+type ListenPort = number;
+type Lifetime = 'service';
 type Reasoning = 'none' | 'auto' | 'high';
 /**
  * A relative path inside the package, forward slashes, never leaving it.
@@ -458,16 +679,118 @@ type PackagePath = string;
 type AgentRoot = 'home' | 'workspace' | 'memory';
 /**
  * Who may call a tool, as MCP Apps names them: `model`, the agents;
- * `app`, the app's own views.
+ * `app`, the app's own views; and `person`, a call that a person's press
+ * or key in any app's view or in a window started, through apps' own code
+ * with no agent deciding a call on its way, such as a tool that sends,
+ * answers, pays or deletes.
+ */
+type ToolVisibility = 'model' | 'app' | 'person';
+/**
+ * How an account proves itself: an OAuth sign-in, or fields the person
+ * fills in, a password or a key among them.
+ */
+type AccountKind = 'oauth' | 'fields';
+/**
+ * What a field of an account holds: words, a secret the keychain keeps,
+ * a server as `host[:port]`, or an address whose host the account
+ * reaches.
+ */
+type AccountFieldKind = 'text' | 'secret' | 'host' | 'url';
+/**
+ * An event that starts the app's backend. The person's desktop client
+ * fires a hotkey, a tray item, a device in use, a program, a device and
+ * a system event; the platform fires a time, a folder and another app's
+ * event.
+ */
+type TriggerDeclaration = {
+    name: string;
+    keys?: string;
+    hold?: boolean;
+    kind: 'hotkey';
+} | {
+    name: string;
+    title: string;
+    kind: 'tray';
+} | {
+    name: string;
+    kind: 'inbound';
+} | {
+    name: string;
+    kind: 'time';
+} | {
+    name: string;
+    kind: 'folder';
+} | {
+    name: string;
+    /**
+     * @minItems 1
+     */
+    devices: InUseDevice[];
+    kind: 'device-in-use';
+} | {
+    name: string;
+    /**
+     * @minItems 1
+     */
+    programs?: ProgramName[];
+    /**
+     * @minItems 1
+     */
+    events: ProgramEvent[];
+    kind: 'program';
+} | {
+    name: string;
+    /**
+     * @minItems 1
+     */
+    filters: DeviceFilter[];
+    kind: 'device';
+} | {
+    name: string;
+    /**
+     * @minItems 1
+     */
+    events: SystemEvent[];
+    idleSeconds?: number;
+    kind: 'system';
+} | {
+    name: string;
+    app: string;
+    event: string;
+    kind: 'event';
+};
+/**
+ * A device another program uses.
  */
-type ToolVisibility = 'model' | 'app';
+type InUseDevice = 'microphone' | 'camera';
+/**
+ * The file name of a program a program trigger names.
+ */
+type ProgramName = string;
+/**
+ * What a program does: it starts, it ends, or its window comes to the
+ * front.
+ */
+type ProgramEvent = 'start' | 'end' | 'front';
+/**
+ * An event of the computer: `idle`, no input for `idleSeconds`;
+ * `active`, input again after it; `power`, a move between mains power
+ * and the battery; `network`, going online or offline.
+ */
+type SystemEvent = 'idle' | 'active' | 'lock' | 'unlock' | 'sleep' | 'wake' | 'power' | 'network';
 /**
  * The namespaces `uses` may name: the backend's channel namespaces, the
  * view extensions, and `files.open`. A backend and a view reach `store`,
  * `events`, `models`, `jobs` and `peers` alike, each only when its app
  * names it here. An agent's core tools need no namespace here.
  */
-type Uses = 'sessions' | 'sessions.create' | 'secrets' | 'notifications' | 'readers' | 'roots' | 'exec' | 'catalogue' | 'oauth' | 'surface' | 'store' | 'events' | 'models' | 'jobs' | 'terminals' | 'files.open' | 'surfaces.open' | 'peers';
+type Uses = ('sessions' | 'sessions.create' | 'secrets' | 'notifications' | 'readers' | 'roots' | 'exec' | 'catalogue' | 'surface' | 'store' | 'db' | 'events' | 'models' | 'jobs' | 'terminals' | 'files.open' | 'surfaces.open' | 'peers' | 'index' | 'capture.microphone' | 'capture.system-sound' | 'capture.program-sound' | 'capture.screen' | 'capture.window' | 'capture.camera' | 'desktop.context' | 'desktop.actions') | 'net.ask' | 'desktop.overlay' | 'input.controller' | 'system.state';
+/**
+ * The model an introduction card downloads on this computer's Server: one
+ * its catalogue lists, by the id its device row gives it, or a file of a
+ * Hugging Face repository.
+ */
+type OnboardingDownload = string | HubFile;
 /**
  * What a surface is: `view`, an MCP Apps document in a sandboxed frame,
  * which may reserve slots for the chat the shell draws for the app's own
@@ -558,9 +881,12 @@ type SurfaceDeclaration = {
  * a tab of a tile; `inline` draws it in a transcript, under the result of
  * each of the app's tools whose `view` names it; `modal` draws it over a
  * tile of its app when a view of the app opens it with
- * `hearthscale/ui/open-modal`.
+ * `hearthscale/ui/open-modal`; `overlay` draws it over the person's other
+ * programs, in a window of its own that never takes the focus, when the
+ * app's backend shows it with `ctx.overlay.view`; `popover` draws it at
+ * the tray icon, whose menu opens it, until it loses the focus.
  */
-type Placement = 'rail' | 'tab' | 'inline' | 'modal';
+type Placement = 'rail' | 'tab' | 'inline' | 'modal' | 'overlay' | 'popover';
 /**
  * What a view surface opens: a file extension, or a scheme of web
  * addresses.
@@ -670,31 +996,71 @@ type SettingsItem = {
  */
 type McpServerDeclaration = RemoteMcpServer | BundledMcpServer;
 /**
- * The device capabilities a view may ask for, each a consent fact, as the
- * MCP Apps sandbox permissions name them.
+ * What a view may use of the computer, each a consent fact: a device
+ * capability as the MCP Apps sandbox permissions name it, a word; or a
+ * family of devices the view opens through the browser's device API,
+ * with the filters that name the devices the person may pick for it.
+ * Neither a filter nor a pick reaches a keyboard, a mouse, a security
+ * key, a smart card, or a device of the USB mass storage, audio or video
+ * classes.
  */
-type ViewPermission = 'camera' | 'microphone' | 'geolocation' | 'clipboard-write';
-/**
- * The card a request runs on, or the reason in words that none can.
- */
-type EffectiveModel = {
-    card: string;
-    source: ModelSource;
+type ViewPermission = ('camera' | 'microphone' | 'geolocation' | 'clipboard-write') | {
+    /**
+     * @minItems 1
+     */
+    'device.hid': HidFilter[];
 } | {
-    card: null;
-    reason: string;
+    /**
+     * @minItems 1
+     */
+    'device.usb': UsbFilter[];
+} | {
+    /**
+     * @minItems 1
+     */
+    'device.serial': SerialFilter[];
+} | {
+    /**
+     * @minItems 1
+     */
+    'device.bluetooth': BluetoothFilter[];
+} | {
+    'device.midi': MidiAccess;
 };
 /**
- * Where a chosen card comes from: the session's own model, the card the
- * person gave the app, the role of its kind, or the daemon's rule.
+ * A GATT service as Web Bluetooth names it.
  */
-type ModelSource = 'session' | 'app' | 'role' | 'automatic';
+type GattService = string;
+type ProviderStatus = ('ready' | 'unreachable' | 'unauthenticated' | 'error') | 'stopped';
 /**
- * One frame of a streamed completion.
+ * One option of a completion beyond its sampling, as `CompletionOptions`
+ * names it, which a chat card takes where its provider reads it.
+ */
+type CompletionOption = 'logprobs' | 'topLogprobs' | 'topK' | 'minP' | 'grammar' | 'stop' | 'seed';
+/**
+ * The kinds of model an app's Discover search lists, each a task word of
+ * the inference contract's `HubTask` whose models answer an app's
+ * requests: chat models in GGUF, one word for each kind of media and
+ * vector model a runtime of the Server installs from Hugging Face, and
+ * every format a runtime of the Server reads. Draft weights, which load
+ * only beside another model, are none of them, and an upscaler, which the
+ * Server takes from its catalogue alone, has no word.
+ */
+type DiscoverTask = 'text' | 'image' | 'transcription' | 'diarization' | 'separation' | 'speech' | 'music' | 'embedding' | 'rerank' | 'all';
+/**
+ * What an app asks to install on a Hearthscale Server: a card a Server
+ * lists and does not hold, by its id, or a file of a Hugging Face
+ * repository.
+ */
+type InstallTarget = string | HubInstall;
+/**
+ * One frame of a streamed completion. A text frame of a request that
+ * asks for `logprobs` carries the tokens its text is made of.
  */
 type CompletionDelta = {
     text: string;
     reasoning?: boolean;
+    logprobs?: TokenLogprob[];
 } | {
     done: true;
     toolCalls?: ToolCall[];
@@ -703,11 +1069,40 @@ type CompletionDelta = {
     error?: string;
 };
 type CompletionStop = 'end_turn' | 'tool_calls' | 'length' | 'cancelled' | 'error';
+/**
+ * A statement's parameters: in order for `?` and `?N`, or by name for
+ * `:name`, `@name` and `$name`.
+ */
+type DbParams = DbValue[] | {
+    [k: string]: DbValue;
+};
+/**
+ * One value of a statement or a row: null, a boolean (stored as 0 or 1),
+ * an integer, a real, text, or bytes.
+ */
+type DbValue = null | boolean | number | string | {
+    $bytes: string;
+};
+/**
+ * What an app reads of an account attached to it: an access token the
+ * platform refreshes, or the fields, its secrets included.
+ */
+type AccountCredential = {
+    accessToken: string;
+    kind: 'oauth';
+} | {
+    fields: {
+        [k: string]: string;
+    };
+    kind: 'fields';
+};
 type ChatRole = 'system' | 'user' | 'assistant' | 'tool';
 type ChatContent = string | ChatContentPart[];
 /**
- * A part of a message's content: text, or a picture by its asset, which
- * the model registry turns into its data URL.
+ * A part of a message's content: text; a picture by its asset, which the
+ * model registry turns into its data URL; or untrusted text, such as a
+ * mail or a page, which the registry fences as data with `source` as its
+ * label and explains in the system message.
  */
 type ChatContentPart = {
     text: string;
@@ -716,6 +1111,10 @@ type ChatContentPart = {
     asset: string;
     mediaType: string;
     type: 'image';
+} | {
+    text: string;
+    source: string;
+    type: 'untrusted';
 };
 /**
  * A frame on `GET /terminals/:id/stream`: the snapshot once, then the
@@ -736,7 +1135,7 @@ type TerminalStatus = 'running' | 'exited';
  * What a view's `openai/resources/write` of an opened file did: saved
  * with the new version's ETag; nothing written because the version on
  * disk is another, which `etag` names; or nothing written because the
- * bytes exceed `max_bytes`.
+ * bytes exceed `maxBytes`.
  */
 type ResourceWriteResult = {
     etag: string;
@@ -750,19 +1149,95 @@ type ResourceWriteResult = {
 };
 /**
  * What a patch compares: the working tree with the index, the index with
- * `HEAD`, or the current branch with a base.
+ * `HEAD`, the current branch with a base from where they part, or one
+ * commit with its first parent.
+ */
+type VcsScope = 'working' | 'staged' | 'branch' | 'commit';
+/**
+ * What a transcription stream tells an app's backend: the open
+ * segment's text so far, a segment's final text with its start and end in
+ * seconds of the sound written to the stream, counted from its first
+ * sample, a failure, and the end after the last segment. A stream that is
+ * written every part of a capture from its first holds the capture's own
+ * time: a segment's start in milliseconds is the `at` of the capture's
+ * sound at that point.
+ */
+type ListenEvent = {
+    stream: string;
+    index: number;
+    text: string;
+    type: 'partial';
+} | {
+    stream: string;
+    index: number;
+    start: number;
+    end: number;
+    text: string;
+    type: 'segment';
+} | {
+    stream: string;
+    index?: number;
+    message: string;
+    type: 'error';
+} | {
+    stream: string;
+    type: 'done';
+};
+/**
+ * A button of a notice: one opens an `https:` address, the other tells
+ * the app's backend its `id`.
+ */
+type NoticeAction = {
+    title: string;
+    url: string;
+} | {
+    title: string;
+    id: string;
+};
+type HotkeyPhase = 'pressed' | 'released';
+type DeviceEvent = 'connected' | 'removed';
+type PowerSource = 'ac' | 'battery';
+/**
+ * How a path changed: `created`, made or moved in; `changed`; or
+ * `removed`, removed or moved out.
+ */
+type FolderChange = 'created' | 'changed' | 'removed';
+/**
+ * What changed about a controller.
  */
-type VcsScope = 'working' | 'staged' | 'branch';
+type ControllerEvent = ('connected' | 'disconnected') | 'input';
 /**
- * What one job takes.
+ * The scheme of colours Hearthscale shows, which follows the system's
+ * unless the person chose one.
  */
-type JobInput = ImageJobInput | MusicJobInput | SpeechJobInput | TranscriptionJobInput | EmbeddingJobInput;
+type ColourScheme = 'dark' | 'light';
+/**
+ * A media key: play/pause, next track, previous track or stop.
+ */
+type MediaKey = 'play-pause' | 'next' | 'previous' | 'stop';
+/**
+ * Where a view over other programs shows, in screen points: beside the
+ * pointer where it is when the view shows; at an edge or a corner of the
+ * work area of the screen the pointer is on then, `margin` points in from
+ * it; or filling a rectangle of the screen.
+ */
+type OverlayAnchor = {
+    at: 'pointer';
+} | {
+    place: ScreenPlace;
+    margin?: number;
+    at: 'screen';
+} | {
+    x: number;
+    y: number;
+    width: number;
+    height: number;
+    at: 'rect';
+};
 /**
- * How a sign-in reaches the person: `loopback` opens their browser and
- * comes back to this computer; `device` shows a code to enter on any
- * device.
+ * An edge or a corner of a screen.
  */
-type OAuthGrant = 'loopback' | 'device';
+type ScreenPlace = 'top' | 'bottom' | 'left' | 'right' | 'top-left' | 'top-right' | 'bottom-left' | 'bottom-right';
 interface ForkPoint {
     session: string;
     leaf: string;
@@ -787,6 +1262,19 @@ interface SessionRoot {
     mode: MountMode;
     kind: RootKind;
 }
+/**
+ * A turn's block and the message it follows.
+ */
+interface TurnBlock {
+    /**
+     * The id of the message that started the turn.
+     */
+    after: string;
+    /**
+     * The block as the model reads it after that message.
+     */
+    text: string;
+}
 /**
  * One item of the composer's `@` list, as an MCP resource link: the
  * address the app resolves it by, its name, and the words the list shows
@@ -872,7 +1360,10 @@ interface ReviewRecord {
 /**
  * One durable allowance. `fs.write` implies `fs.read`. A grant with
  * `session` belongs to that session and its helpers, and ends with it.
- * `pin` is the hash of a tool's name, description, schemas and flags.
+ * `pin` is, on a tool's grant, the hash of its name, description, schemas
+ * and flags; on a `net.host` grant, the SHA-256 of the server certificate
+ * the person accepted for the host, in hexadecimal, which the relay then
+ * trusts for it.
  */
 interface Grant {
     principal: PrincipalRef;
@@ -953,7 +1444,16 @@ interface AskFacts {
      * so.
      */
     paths?: string[];
+    /**
+     * On a `net.host` card, the one host asked for.
+     */
     hosts?: string[];
+    /**
+     * On a `net.host` card: the SHA-256 of the certificate the host
+     * presented, which no authority the system trusts signed, in
+     * hexadecimal; allowing the host trusts it.
+     */
+    certificate?: string;
     stderr?: string;
     /**
      * The command still runs, and the fence holds its connection to the
@@ -961,7 +1461,8 @@ interface AskFacts {
      */
     running?: true;
     /**
-     * What a backend wants a folder for, on a `root` card it raised.
+     * What a backend wants a folder for, on a `root` card it raised, or
+     * a host for, on a `net.host` card.
      */
     purpose?: string;
     /**
@@ -973,8 +1474,9 @@ interface AskFacts {
      */
     text?: string;
     /**
-     * On an elicitation card: the form, as the JSON Schema object the
-     * server sent.
+     * On a card with a form: the form, as a JSON Schema object. An
+     * elicitation card's is the one its server sent; an account card's
+     * names the account's fields, a secret one `writeOnly`.
      */
     schema?: {
         [k: string]: unknown;
@@ -994,6 +1496,28 @@ interface AskFacts {
     scopes?: string[];
     login?: string;
     authorizationEndpoint?: string;
+    /**
+     * On a `pair` card: the computer that asks to drive this one, by its
+     * name and its endpoint id.
+     */
+    computer?: string;
+    endpointId?: string;
+    /**
+     * On a `model.install` card: the model, by the name its Server shows
+     * it under, and what it takes on that Server's disk once installed.
+     */
+    model?: string;
+    sizeBytes?: number;
+    /**
+     * On a `model.install` card: the Server on another computer that
+     * installs the model once the person there approves; none for this
+     * computer's own.
+     */
+    server?: string;
+    /**
+     * On a `device` card: the family of the devices its options offer.
+     */
+    family?: DeviceFamily;
 }
 interface ToolSummary {
     name: string;
@@ -1022,6 +1546,21 @@ interface OptionGrant {
     scope: GrantScope;
     pin?: string;
 }
+/**
+ * A place in an app a notice opens: a surface the app places in the rail
+ * or a tab, at `path` inside a view.
+ */
+interface NoticeOpen {
+    surface: string;
+    path?: string;
+}
+/**
+ * A file opened in an app, by an address only the host resolves.
+ */
+interface OpenedFile {
+    name: string;
+    resourceUri: string;
+}
 /**
  * What the chips of a view hold from its last `ui/update-model-context`:
  * the id the host gave that update, and its blocks.
@@ -1080,19 +1619,21 @@ interface Room {
 }
 /**
  * One job as `POST /models/jobs` answers it and `job.progress` frames it.
- * The result is one asset per output: a picture, a WAV, a text or a JSON
- * document, owned by the session the job ran for or else by the app.
  */
 interface Job {
     id: string;
-    kind: JobKind;
+    kind: ModelKind;
     app: string;
     session?: string;
     /**
      * The tool call that submitted it, for a job a tool started.
      */
     callId?: string;
-    card: string;
+    /**
+     * The card it runs on.
+     */
+    model: string;
+    priority: Priority;
     status: JobStatus;
     submittedAt: string;
     /**
@@ -1101,12 +1642,57 @@ interface Job {
      */
     waiting?: string;
     progress?: JobProgress;
-    result?: string[];
+    /**
+     * What a completed job made, in the order its runtime gave them.
+     */
+    outputs?: JobOutput[];
+    /**
+     * What a completed job states beside its outputs, such as the seeds
+     * of its pictures or the times of a transcript's segments.
+     */
+    data?: {
+        [k: string]: unknown;
+    };
     error?: string;
     finishedAt?: string;
 }
+/**
+ * Where a running job stands: the share done, the step it is on in its
+ * runtime's words, and the asset of the latest picture of the work in
+ * progress, where its runtime makes them.
+ */
 interface JobProgress {
     fraction?: number;
+    phase?: string;
+    preview?: string;
+}
+/**
+ * One output of a job, under the file name its runtime gave it: an asset
+ * owned by the session the job ran for or else by the app, or a file
+ * written into the folder the request names, at its path inside that
+ * mount.
+ */
+interface JobOutput {
+    name: string;
+    mediaType: string;
+    asset?: string;
+    path?: string;
+}
+/**
+ * Where a download of a model of a Hearthscale Server stands: its card;
+ * `downloading`, with what has arrived, while it runs; and once it ends,
+ * the state it left the card in, with the Server's words where a failed
+ * download left it absent or the model cannot run.
+ */
+interface ModelDownload {
+    card: string;
+    state: CardState;
+    /**
+     * How much of a download has arrived: the inference contract's
+     * `DownloadProgressBytes`.
+     */
+    progress?: DownloadProgressBytes;
+    reason?: string;
 }
 /**
  * A program of a session that runs now.
@@ -1153,12 +1739,7 @@ interface Manifest {
         [k: string]: AgentDefinition;
     };
     models?: {
-        chat?: ModelNeed;
-        embedding?: ModelNeed;
-        image?: ModelNeed;
-        music?: ModelNeed;
-        speech?: ModelNeed;
-        transcription?: ModelNeed;
+        [k: string]: ModelNeed;
     };
     tools?: ToolDeclaration[];
     capabilities?: Capabilities;
@@ -1167,11 +1748,27 @@ interface Manifest {
      * kind, each with the title its card shows: a sign-in, a handoff.
      */
     asks?: AskDeclaration[];
+    /**
+     * The person's accounts the app uses, by provider: the person
+     * attaches each, and the app reads its credential, never its sign-in.
+     */
+    accounts?: AccountNeed[];
+    /**
+     * Kinds of account the package adds to the ones Hearthscale names.
+     */
+    providers?: AccountProvider[];
     /**
      * The file formats the app's backend turns into text for the read
      * tool, each an id and the extensions it claims.
      */
     formats?: FormatDeclaration[];
+    /**
+     * The events that start the app's backend and reach its
+     * `ctx.triggers.on(name)`, each a consent fact.
+     *
+     * @minItems 1
+     */
+    triggers?: TriggerDeclaration[];
     uses?: Uses[];
     recommends?: string[];
     onboarding?: Onboarding;
@@ -1215,6 +1812,12 @@ interface Environment {
      * and its web surfaces. Each is a consent fact.
      */
     network?: NetworkEntry[];
+    /**
+     * The ports of this computer's loopback the backend listens on, for
+     * programs on this computer to connect to. Each is a consent fact,
+     * and a backend that listens is a service.
+     */
+    listen?: ListenPort[];
     lifetime?: Lifetime;
 }
 interface AgentDefinition {
@@ -1266,6 +1869,12 @@ interface Budget {
  */
 interface ModelNeed {
     required: boolean;
+    /**
+     * The Hugging Face tasks the kind's card states, every one of them.
+     *
+     * @minItems 1
+     */
+    tasks?: string[];
 }
 interface ToolDeclaration {
     name: string;
@@ -1294,13 +1903,96 @@ interface ToolDeclaration {
     visibility?: ToolVisibility[];
 }
 interface Capabilities {
+    /**
+     * The tools other apps' agents reach: declared ones, or ones the
+     * app's MCP servers serve.
+     */
     tools?: string[];
     skills?: PackagePath[];
+    /**
+     * The events the app's backend publishes with `ctx.events.publish`,
+     * which other apps hear through an `event` trigger. Each is a
+     * consent fact.
+     *
+     * @minItems 1
+     */
+    events?: EventOffer[];
+}
+/**
+ * An event an app offers: its name, what it means, and the JSON Schema
+ * of the data each one carries, which the platform holds every publish
+ * to.
+ */
+interface EventOffer {
+    name: string;
+    description: string;
+    data: {
+        [k: string]: unknown;
+    };
 }
 interface AskDeclaration {
     kind: string;
     title: string;
 }
+/**
+ * An account an app's manifest uses: the provider, the OAuth scopes the
+ * app asks for beyond the provider's own, and why, as the person reads
+ * it on the enable card and the account card.
+ */
+interface AccountNeed {
+    provider: string;
+    scopes?: string[];
+    purpose: string;
+}
+/**
+ * A kind of account. `hosts` are the servers every account of it
+ * reaches; a `host` or `url` field adds its own.
+ */
+interface AccountProvider {
+    id: string;
+    name: string;
+    kind: AccountKind;
+    oauth?: ProviderOAuth;
+    fields?: AccountField[];
+    hosts: NetworkEntry[];
+}
+/**
+ * Where an OAuth account signs in: the issuer's endpoints, the client
+ * the service registered for Hearthscale, the scopes every sign-in asks
+ * for, the OpenID Connect `userinfo` address that names the account, and
+ * the service's own fields on the authorization address, such as
+ * `access_type`.
+ */
+interface ProviderOAuth {
+    issuer: string;
+    authorization: string;
+    token: string;
+    revocation?: string;
+    userinfo: string;
+    clientId: string;
+    /**
+     * For a service that demands one even from a desktop client, where
+     * it is no secret.
+     */
+    clientSecret?: string;
+    scopes: string[];
+    params?: {
+        [k: string]: string;
+    };
+}
+/**
+ * One field of an account the person fills in. The first `text` field
+ * names the account.
+ */
+interface AccountField {
+    name: string;
+    label: string;
+    kind: AccountFieldKind;
+    /**
+     * The person may leave it empty.
+     */
+    optional?: boolean;
+}
 interface FormatDeclaration {
     id: string;
     /**
@@ -1308,6 +2000,13 @@ interface FormatDeclaration {
      */
     extensions: string[];
 }
+/**
+ * The devices a device trigger hears: a vendor's, or one product of it.
+ */
+interface DeviceFilter {
+    vendorId: string;
+    productId?: string;
+}
 interface Onboarding {
     version: number;
     /**
@@ -1320,17 +2019,33 @@ interface OnboardingCard {
     text?: string;
     image?: ServedPicture;
     rows?: OnboardingRow[];
-    /**
-     * A model this computer's engine can pull, by the id its device row
-     * gives it.
-     */
-    download?: string;
+    download?: OnboardingDownload;
 }
 interface OnboardingRow {
     icon: ChatIconRole;
     title: string;
     text: string;
 }
+/**
+ * A file of a Hugging Face repository that an app's introduction card
+ * installs on this computer's Server: a `HubInstall` without the Server.
+ */
+interface HubFile {
+    kind: ModelKind;
+    repo: string;
+    file: string;
+    projector?: string;
+    companions?: HubCompanion[];
+}
+/**
+ * The file that fills one companion role of a Hugging Face install: a
+ * weights file of any repository, as a candidate's `requires` offers it.
+ */
+interface HubCompanion {
+    role: string;
+    repo: string;
+    file: string;
+}
 /**
  * A right-click entry of the app's rail button: a call of one of the
  * app's tools with these arguments, `{}` when absent. A result that names
@@ -1374,10 +2089,32 @@ interface Mentions {
     tool: string;
 }
 /**
- * A remote MCP server, by its address.
+ * A remote MCP server, by its address, with the sign-in its service
+ * documents where the server publishes no OAuth metadata.
  */
 interface RemoteMcpServer {
     url: string;
+    oauth?: RemoteOAuth;
+}
+/**
+ * The sign-in of a remote MCP server that publishes no OAuth metadata, as
+ * its service documents it: the public client the service issued, its
+ * endpoints, and the scopes a sign-in asks for. With a device endpoint the person types a code at the service;
+ * without one the browser comes back to this computer, which needs the
+ * authorization endpoint.
+ */
+interface RemoteOAuth {
+    clientId: string;
+    endpoints: OAuthEndpoints;
+    scopes?: string[];
+}
+/**
+ * The endpoints of an authorization server that publishes no metadata.
+ */
+interface OAuthEndpoints {
+    authorization?: string;
+    token: string;
+    device?: string;
 }
 /**
  * A JavaScript file in the package the platform runs in the app's
@@ -1388,6 +2125,190 @@ interface BundledMcpServer {
     entry: string;
     env?: string[];
 }
+/**
+ * The HID devices a filter names: a vendor's, one product of it, the
+ * devices of a usage page or of one usage of it, or both.
+ */
+interface HidFilter {
+    vendorId?: string;
+    productId?: string;
+    usagePage?: string;
+    usage?: string;
+}
+/**
+ * The USB devices a filter names: a vendor's, one product of it, the
+ * devices of a class, or both.
+ */
+interface UsbFilter {
+    vendorId?: string;
+    productId?: string;
+    classCode?: string;
+}
+/**
+ * The serial ports a filter names: those of a USB vendor's devices, or of
+ * one product of it.
+ */
+interface SerialFilter {
+    usbVendorId: string;
+    usbProductId?: string;
+}
+/**
+ * The Bluetooth devices a filter names: those that offer every one of
+ * the GATT services, those whose name starts with the prefix, or both.
+ */
+interface BluetoothFilter {
+    /**
+     * @minItems 1
+     */
+    services?: GattService[];
+    namePrefix?: string;
+}
+/**
+ * What MIDI a view takes: the notes and controls of every port, and with
+ * `sysex` the system exclusive messages, which can change a device's
+ * settings and its firmware.
+ */
+interface MidiAccess {
+    sysex?: boolean;
+}
+/**
+ * One model card: `<provider>/<model>`, what it answers on and the window
+ * one request gets, as its provider publishes them. A card with no window
+ * is listed and cannot run.
+ */
+interface ModelCard {
+    id: string;
+    kind: ModelKind;
+    provider: string;
+    label: string;
+    contextTokens?: number;
+    params?: number;
+    /**
+     * The size of the model's files, where its provider states it.
+     */
+    sizeBytes?: number;
+    /**
+     * The Hugging Face task words of the model, where its provider
+     * states them.
+     */
+    tasks?: string[];
+    vision?: boolean;
+    tools?: boolean;
+    /**
+     * Whether the model reasons before it answers, where its provider
+     * states it.
+     */
+    reasoning?: boolean;
+    /**
+     * The job kinds the card runs, by kind word, each with the input it
+     * takes.
+     */
+    jobs?: {
+        /**
+         * One job kind a card runs: the input it takes, a JSON Schema object, as
+         * the inference contract's `JobSpec` states it. A property of
+         * `"format": "asset"`, alone or as the items of an array, takes the id of
+         * an asset its app holds, whose media type fits the property's
+         * `contentMediaType`.
+         */
+        [k: string]: JobSpec;
+    };
+    /**
+     * The completion options a chat card's provider reads; a completion
+     * that names another is refused before it is sent.
+     */
+    options?: CompletionOption[];
+    location: ModelLocation;
+    state: CardState;
+    /**
+     * The model's publisher as a Server resolves it; cards of other
+     * providers have none.
+     */
+    identity?: ModelIdentity;
+    /**
+     * Why an unavailable card cannot run, or why the last download of an
+     * absent one failed, in its provider's words, where the provider
+     * states it.
+     */
+    reason?: string;
+    /**
+     * What loading the card's model, or a job of it, takes now, where a
+     * Server plans it.
+     */
+    memory?: MemoryPlan;
+    /**
+     * How much of a downloading card's model has arrived, where its
+     * Server reports it.
+     */
+    progress?: DownloadProgressBytes;
+}
+/**
+ * A Hearthscale Server this computer names, as `ctx.models.servers` and
+ * `GET /models/servers` list it: its id, which the ids of its cards start
+ * with; its name; whether it is this computer's own; and whether it
+ * serves now, with its words where it does not.
+ */
+interface ModelServer {
+    id: string;
+    name: string;
+    here: boolean;
+    status: ProviderStatus;
+    message?: string;
+}
+/**
+ * A search of a Hearthscale Server's Discover: the words it looks for,
+ * where there are any, the kind of model it lists, and its order,
+ * trending first where it names none.
+ */
+interface HubSearch {
+    search?: string;
+    task: DiscoverTask;
+    /**
+     * The order of a Discover search: the inference contract's `HubSort`.
+     */
+    sort?: HubSort;
+}
+/**
+ * A file of a Hugging Face repository to install on a Hearthscale Server,
+ * as its Discover lists the repository: the Server, by its id; the kind
+ * the app runs the model as, which names the install on that Server; the
+ * repository and the file; the vision projector where the file has more
+ * than one to choose from; and a file for each companion role the
+ * repository does not supply.
+ */
+interface HubInstall {
+    server: string;
+    kind: ModelKind;
+    repo: string;
+    file: string;
+    projector?: string;
+    companions?: HubCompanion[];
+}
+/**
+ * The answer of an install an app asked for: the card the model installs
+ * as, once the person allowed it, or null where they did not.
+ */
+interface ModelInstalled {
+    card: string | null;
+}
+/**
+ * One token of an answer: its text, its log probability, and the
+ * likeliest tokens the model weighed in its place, as many as the
+ * request's `topLogprobs` asks.
+ */
+interface TokenLogprob {
+    token: string;
+    logprob: number;
+    top: TokenAlternative[];
+}
+/**
+ * A token the model weighed in another's place, with its log
+ * probability.
+ */
+interface TokenAlternative {
+    token: string;
+    logprob: number;
+}
 /**
  * What `net.fetch` takes.
  */
@@ -1398,9 +2319,15 @@ interface FetchParams {
         [k: string]: string;
     };
     body?: string;
+    /**
+     * The longest the request may take, its redirects included, in
+     * milliseconds: 1 to 600000.
+     */
+    timeoutMs?: number;
 }
 /**
- * What `net.fetch` answers.
+ * What `net.fetch` answers: `url` is the address that answered, after
+ * the redirects.
  */
 interface FetchAnswer {
     status: number;
@@ -1408,6 +2335,27 @@ interface FetchAnswer {
         [k: string]: string;
     };
     body: string;
+    url: string;
+}
+/**
+ * What a statement changed: the rows, and the row id it last inserted.
+ */
+interface DbChange {
+    changes: number;
+    lastInsertRowid: number;
+}
+/**
+ * An account as an app it is attached to reads it: its kind, its name,
+ * the servers it reaches, and whether the app's sign-in of it ended and
+ * needs a new one. No other app's use of it shows.
+ */
+interface AppAccount {
+    id: string;
+    provider: string;
+    providerName: string;
+    name: string;
+    hosts: string[];
+    lapsed: boolean;
 }
 /**
  * The body of `POST /models/complete` and of one model call of a turn.
@@ -1429,6 +2377,23 @@ interface CompletionRequest {
      * read again rather than partly from an earlier request's cache.
      */
     repeatable?: true;
+    /**
+     * The context, in tokens, the request needs at least: a Hearthscale
+     * Server loads the model with at least this many, or refuses the
+     * request in words before it runs. Other providers serve the window
+     * they have.
+     */
+    context?: number;
+    /**
+     * A usable chat card an app's own completion runs on; absent, the
+     * card the app runs chat on. A turn's model call names none.
+     */
+    model?: string;
+    /**
+     * What an app's own completion asks of the runtime beyond its
+     * sampling. A turn's model call names none.
+     */
+    options?: CompletionOptions;
 }
 /**
  * One message of a request, in the OpenAI v1 roles.
@@ -1461,6 +2426,47 @@ interface CompletionFormat {
         [k: string]: unknown;
     };
 }
+/**
+ * What a completion asks of the runtime beyond its sampling. Each option
+ * runs only on a card whose `options` names it.
+ */
+interface CompletionOptions {
+    /**
+     * The log probability of each token of the answer, on the text
+     * frames.
+     */
+    logprobs?: boolean;
+    /**
+     * How many of the likeliest other tokens each token names, with
+     * `logprobs`.
+     */
+    topLogprobs?: number;
+    /**
+     * Samples among this many likeliest tokens only; 0 turns it off.
+     */
+    topK?: number;
+    /**
+     * Leaves out every token less likely than this share of the likeliest
+     * one.
+     */
+    minP?: number;
+    /**
+     * A GBNF grammar the answer follows; a request with `format` names
+     * none.
+     */
+    grammar?: string;
+    /**
+     * Texts that end the answer where it would write them.
+     *
+     * @minItems 1
+     */
+    stop?: string[];
+    /**
+     * The sampler's seed: the same request with the same seed gives the
+     * same answer as far as the runtime allows.
+     */
+    seed?: number;
+}
 /**
  * What a conversation's requests have spent, by the log.
  */
@@ -1497,13 +2503,6 @@ interface ProjectRecord {
     createdAt: string;
     folder: string;
 }
-/**
- * A file opened in an app, by an address only the host resolves.
- */
-interface OpenedFile {
-    name: string;
-    resourceUri: string;
-}
 /**
  * One folder as `GET /fs/list` answers it.
  */
@@ -1524,6 +2523,10 @@ interface FsRead {
     size: number;
     binary: boolean;
     text?: string;
+    /**
+     * Set when the text holds only the file's first part.
+     */
+    cut?: true;
 }
 /**
  * What one repository answers about itself.
@@ -1560,6 +2563,35 @@ interface VcsDiff {
 interface VcsFile {
     text: string;
 }
+/**
+ * `GET /vcs/log`: the commits of the current branch that a base does not
+ * hold, newest first.
+ */
+interface VcsLog {
+    commits: VcsCommit[];
+    /**
+     * The branch holds more commits than the log answers.
+     */
+    truncated: boolean;
+}
+/**
+ * One commit as a log lists it.
+ */
+interface VcsCommit {
+    /**
+     * The commit's full id.
+     */
+    sha: string;
+    /**
+     * The first line of its message.
+     */
+    subject: string;
+    author: string;
+    /**
+     * When it was made, as an ISO 8601 date.
+     */
+    date: string;
+}
 /**
  * One terminal as `POST /terminals` answers it and as its stream's first
  * frame carries it.
@@ -1653,6 +2685,10 @@ interface VcsDiffQuery {
      * The ref a `branch` scope compares the current branch against.
      */
     base?: string;
+    /**
+     * The full id of the commit a `commit` scope reads.
+     */
+    commit?: string;
     /**
      * Root-relative pathspecs the patch is narrowed to.
      */
@@ -1661,49 +2697,59 @@ interface VcsDiffQuery {
 /**
  * `GET /vcs/file`: one file whole, as a scope's new side holds it, which
  * the diff panel's unmodified runs are read from: the working tree's copy
- * for `working`, the index's for `staged` and `HEAD`'s for `branch`.
+ * for `working`, the index's for `staged`, `HEAD`'s for `branch` and the
+ * commit's for `commit`.
  */
 interface VcsFileQuery {
     root: string;
     scope: VcsScope;
+    /**
+     * The full id of the commit a `commit` scope reads.
+     */
+    commit?: string;
     /**
      * Relative to the repository's top, as the patch names it.
      */
     path: string;
 }
 /**
- * What one job of each kind takes, by kind. Audio and images cross as
- * assets.
+ * One job an app asks for: the kind, the input the card's schema for
+ * the kind takes, the card it runs on where the caller names one, and the
+ * folder of one of the app's writable mounts its outputs are written to
+ * where it names one.
  */
-interface JobInputs {
-    image: ImageJobInput;
-    music: MusicJobInput;
-    speech: SpeechJobInput;
-    transcription: TranscriptionJobInput;
-    embedding: EmbeddingJobInput;
-}
-interface ImageJobInput {
-    prompt: string;
-    size?: string;
-}
-interface MusicJobInput {
-    prompt: string;
-    seconds: number;
-    lyrics?: string;
-}
-interface SpeechJobInput {
-    text: string;
-    voice?: string;
+interface JobRequest {
+    kind: ModelKind;
+    input: {
+        [k: string]: unknown;
+    };
+    /**
+     * A usable card of the kind; absent, the card the app runs the kind
+     * on.
+     */
+    model?: string;
+    save?: MountPath;
 }
 /**
- * `audio` is an asset.
+ * A path inside a mount, as the backend names files: the mount's handle
+ * and the path under it.
  */
-interface TranscriptionJobInput {
-    audio: string;
-    language?: string;
+interface MountPath {
+    root: string;
+    path: string;
 }
-interface EmbeddingJobInput {
-    texts: string[];
+/**
+ * The cards an app's backend or view may run a request on or install, as
+ * `ctx.models.list` and `hearthscale/models/list` answer them: every card
+ * of the kind, the task and the state asked, in catalogue order, the
+ * usable ones where no state is asked, and the app's choice of each
+ * kind, by kind word.
+ */
+interface ModelList {
+    cards: ModelCard[];
+    chosen: {
+        [k: string]: EffectiveModel;
+    };
 }
 /**
  * The executor's answer to a command: what the command answers the body,
@@ -1718,14 +2764,6 @@ interface SurfaceResult {
     shown?: boolean;
     error?: string;
 }
-/**
- * A path inside a mount, as the backend names files: the mount's handle
- * and the path under it.
- */
-interface MountPath {
-    root: string;
-    path: string;
-}
 /**
  * What a tool body answers: content for the model and the view that
  * renders the result.
@@ -1804,112 +2842,366 @@ interface TurnOutcome {
     result?: Structured;
 }
 /**
- * One enabled app as `apps.list` lists it.
+ * A document an app puts in the shared index: its source, which names it
+ * for the app and replaces what was put under it before, its title, and
+ * its text by page.
+ */
+interface IndexDocument {
+    source: string;
+    title?: string;
+    pages: IndexPage[];
+}
+/**
+ * One page of a document's text, with its number where the document has
+ * pages.
+ */
+interface IndexPage {
+    text: string;
+    page?: number;
+}
+/**
+ * One answer of a search of the shared index: the passage, the document
+ * it came from and its page, and how well it answers the query.
+ */
+interface IndexHit {
+    source: string;
+    title?: string;
+    page?: number;
+    text: string;
+    score: number;
+}
+/**
+ * One enabled app as `apps.list` lists it.
+ */
+interface AppListing {
+    id: string;
+    name: string;
+    description: string;
+    /**
+     * The icon's file in the app's package per colour scheme, which a page
+     * loads from `/apps/<id>/ui/<file>`; null when it has none.
+     */
+    icon: SchemedIcon | null;
+    agent: boolean;
+    capabilities: string[];
+}
+/**
+ * One chat card an app's sessions may run on, as `models.for` lists it.
+ */
+interface ModelListing {
+    id: string;
+    name: string;
+    provider: string;
+}
+/**
+ * One project as `projects.list` lists it.
+ */
+interface ProjectListing {
+    id: string;
+    name: string;
+    folder: string;
+}
+/**
+ * An app's own question to the person during a tool call: a choice, a
+ * sign-in, a handoff; `kind` is one the manifest's `asks` declares. It
+ * widens nothing.
+ */
+interface AppQuestion {
+    kind: string;
+    text: string;
+}
+/**
+ * The person's answer to an app's question.
+ */
+interface AppAnswer {
+    allow: boolean;
+    option?: string;
+}
+/**
+ * A durable entry in one of the app's own sessions, or a transient event
+ * for the app's views.
+ */
+interface AppEvent {
+    name: string;
+    session?: string;
+    data: unknown;
+    durable: boolean;
+    context?: string;
+}
+/**
+ * An OS notification an app asks for. A press opens `session`, a
+ * conversation of the app or one it started, or else the place `open`
+ * names in the app's own surface.
+ */
+interface AppNotice {
+    title: string;
+    body: string;
+    session?: string;
+    open?: NoticeOpen;
+    /**
+     * At most two buttons, where the system draws them.
+     */
+    actions?: NoticeAction[];
+}
+/**
+ * A skill an app adds while it runs, with `ctx.skills.add`: its name, a
+ * lowercase kebab-case word of at most 64 characters; its title and its
+ * description, each one line; and the body of its `SKILL.md`, the
+ * instructions an agent reads. The app's own agents carry it, and the
+ * composer's `/` lists it, as they do the skills of its package.
+ */
+interface AppSkill {
+    name: string;
+    title: string;
+    description: string;
+    body: string;
+}
+/**
+ * A hotkey trigger of an app, as its backend reads it with
+ * `ctx.triggers.hotkeys`.
+ */
+interface HotkeyState {
+    name: string;
+    /**
+     * The keys that fire the hotkey now, the person's or else the
+     * declared ones; none where neither names any, or where another
+     * app's hotkey holds them.
+     */
+    keys?: string;
+    /**
+     * The app whose hotkey holds the keys this one names.
+     */
+    takenBy?: string;
+}
+/**
+ * What a hotkey fires with. A `hold` hotkey fires `pressed` and
+ * `released`; any other only `pressed`.
+ */
+interface HotkeyFire {
+    phase: HotkeyPhase;
+}
+/**
+ * What a device-in-use trigger fires with: one of its devices, and
+ * whether another program uses it now.
+ */
+interface InUseFire {
+    device: InUseDevice;
+    inUse: boolean;
+}
+/**
+ * What a program trigger fires with: one of its events, and the
+ * program's file name.
+ */
+interface ProgramFire {
+    event: ProgramEvent;
+    program: string;
+}
+/**
+ * What a device trigger fires with: the device's ids, which one of its
+ * filters names, and the name the device gives itself.
+ */
+interface DeviceFire {
+    event: DeviceEvent;
+    vendorId: string;
+    productId: string;
+    name?: string;
+}
+/**
+ * What a system trigger fires with: one of its events, the power source
+ * after a `power` event, and whether the computer is online after a
+ * `network` event.
+ */
+interface SystemFire {
+    event: SystemEvent;
+    power?: PowerSource;
+    online?: boolean;
+}
+/**
+ * What a time trigger fires with: the alarm that came due, and the data
+ * it was set with.
+ */
+interface AlarmFire {
+    alarm: string;
+    data?: unknown;
+}
+/**
+ * What a folder trigger fires with: the mount, the path inside it that
+ * changed, and how. With `many`, the path is the watched place, which
+ * changed in more places than fire one by one.
+ */
+interface FolderFire {
+    root: string;
+    path: string;
+    change: FolderChange;
+    many?: true;
+}
+/**
+ * What an event trigger fires with: the app that published, its event,
+ * and the data, which matches the schema that app's offer names.
+ */
+interface EventFire {
+    app: string;
+    event: string;
+    data: unknown;
+}
+/**
+ * An alarm a backend sets with `ctx.alarms.set`: the time trigger it
+ * fires, the first time, a repeat in minutes on a fixed schedule from
+ * that first time, and the data it fires with. Without `at` the first
+ * fire is `every` minutes from now.
  */
-interface AppListing {
-    id: string;
-    name: string;
-    description: string;
+interface AlarmRequest {
+    trigger: string;
     /**
-     * The icon's file in the app's package per colour scheme, which a page
-     * loads from `/apps/<id>/ui/<file>`; null when it has none.
+     * An ISO 8601 time with its offset, such as `Date.toISOString()`
+     * writes.
      */
-    icon: SchemedIcon | null;
-    agent: boolean;
-    capabilities: string[];
-}
-/**
- * One chat card an app's sessions may run on, as `models.for` lists it.
- */
-interface ModelListing {
-    id: string;
-    name: string;
-    provider: string;
+    at?: string;
+    every?: number;
+    data?: unknown;
 }
 /**
- * One project as `projects.list` lists it.
+ * An alarm as `ctx.alarms` lists it; `at` is the next time it fires, in
+ * UTC.
  */
-interface ProjectListing {
+interface Alarm {
     id: string;
-    name: string;
-    folder: string;
+    trigger: string;
+    at: string;
+    every?: number;
+    data?: unknown;
 }
 /**
- * An app's own question to the person during a tool call: a choice, a
- * sign-in, a handoff; `kind` is one the manifest's `asks` declares. It
- * widens nothing.
+ * How the person reads dates and numbers on the computer they use: a
+ * BCP 47 locale, with the hour cycle (`-u-hc-`) and the first day of the
+ * week (`-u-fw-`) where the system's settings state them, and the IANA
+ * time zone.
  */
-interface AppQuestion {
-    kind: string;
-    text: string;
+interface Region {
+    locale: string;
+    timeZone: string;
 }
 /**
- * The person's answer to an app's question.
+ * A device a capture can take, as `ctx.capture.devices` lists it: a
+ * microphone or a camera by the window page's id, a screen by its
+ * display, a window by its capture source, and a program by its process.
+ * The ids hold while the computer's window runs.
  */
-interface AppAnswer {
-    allow: boolean;
-    option?: string;
+interface CaptureDevice {
+    id: string;
+    /**
+     * The device's name, a window's title, or a program's file name.
+     */
+    name: string;
+    /**
+     * The file name of the program a window belongs to, where it is
+     * known.
+     */
+    program?: string;
 }
 /**
- * A durable entry in one of the app's own sessions, or a transient event
- * for the app's views.
+ * What other programs show, as far as the computer can read it.
  */
-interface AppEvent {
-    name: string;
-    session?: string;
-    data: unknown;
-    durable: boolean;
-    context?: string;
+interface DesktopContext {
+    /**
+     * The program in front.
+     */
+    program?: string;
+    /**
+     * The title of the window in front.
+     */
+    window?: string;
+    /**
+     * The selected text.
+     */
+    selection?: string;
+    clipboard?: string;
+    pointer?: ScreenPoint;
 }
 /**
- * An OS notification an app asks for.
+ * A point on the screen, in the screen's own pixels.
  */
-interface AppNotice {
-    title: string;
-    body: string;
-    session?: string;
+interface ScreenPoint {
+    x: number;
+    y: number;
 }
 /**
- * A sign-in to an online service of the app's own, with the app's own
- * client registered at that service.
+ * A game controller, as `ctx.controllers.list` answers it and each of its
+ * changes carries it.
  */
-interface OAuthLogin {
+interface Controller {
     /**
-     * The authorization server's identifier, an https address without a
-     * query or a fragment; its metadata names the endpoints unless
-     * `endpoints` does.
+     * The controller's id while the computer's window runs.
      */
-    issuer: string;
+    id: string;
+    name: string;
     /**
-     * Absent when the server registers clients itself (RFC 7591).
+     * Whether it rumbles.
      */
-    clientId?: string;
+    rumble: boolean;
     /**
-     * For a server that demands one even from a desktop client.
+     * Each button it has, by its name, from 0, up, to 1, fully down; a
+     * trigger that is pressed in part is between.
      */
-    clientSecret?: string;
-    scopes?: string[];
+    buttons: {
+        [k: string]: number;
+    };
+    /**
+     * Each axis of its sticks, by its name, from -1 to 1; up is 1.
+     */
+    axes: {
+        [k: string]: number;
+    };
+}
+/**
+ * One change of a controller, `POST /sensors/controllers`, which the apps
+ * that watch the controllers hear as `controllers.change`.
+ */
+interface ControllerChange {
+    event: ControllerEvent;
+    /**
+     * The controller after the change.
+     */
+    controller: Controller;
+}
+/**
+ * The state of the computer, `ctx.system.state()`, and each change of it,
+ * `POST /sensors/system`, which the apps that watch it hear as
+ * `system.change`. `locked` and `power` are absent where the system does
+ * not tell the client, and `battery` where the computer has none or does
+ * not say its level.
+ */
+interface SystemState {
     /**
-     * The RFC 8707 resource the token is for.
+     * How long the person has given no input, in whole seconds.
      */
-    resource?: string;
-    endpoints?: OAuthEndpoints;
-    grant?: OAuthGrant;
+    idleSeconds: number;
+    locked?: boolean;
+    power?: PowerSource;
     /**
-     * The server's own fields on the authorization address, such as
-     * `access_type`.
+     * The battery's charge, from 0 to 1.
      */
-    params?: {
-        [k: string]: string;
-    };
+    battery?: number;
+    online: boolean;
+    displays: DisplayState[];
+    theme: ColourScheme;
 }
 /**
- * The endpoints of an authorization server that publishes no metadata.
+ * One display of the computer: its size in points, and how many pixels
+ * one point takes.
  */
-interface OAuthEndpoints {
-    authorization?: string;
-    token: string;
-    device?: string;
+interface DisplayState {
+    width: number;
+    height: number;
+    scale: number;
+}
+/**
+ * A media key that went down on the computer, `POST /sensors/media-keys`,
+ * which the apps that watch the state of the computer hear as
+ * `system.media-key`. The key still reaches the program it is meant for.
+ */
+interface MediaKeyPress {
+    key: MediaKey;
 }
 
 /**
@@ -1935,25 +3227,30 @@ interface OAuthEndpoints {
  * `{}`, `openai/files` holds `{}` when the app names `files.open` in
  * `uses`, and `hearthscale` holds `HearthscaleHostCapability`. In the host
  * context, `displayMode` and `availableDisplayModes` follow
- * `MCP_DISPLAY_MODES` and the surface's placements, and
- * `containerDimensions` is the size of the view's frame, `width` and
- * `height` in a tab or a modal and `width` and `maxHeight` under a
- * result, sent again on each change.
+ * `MCP_DISPLAY_MODES` and the surface's placements, `pip` alone in an
+ * overlay or a popover, and `containerDimensions` is the size of the
+ * view's frame, `width` and `height` in a tab, a modal, an overlay or a
+ * popover and `width` and `maxHeight` under a result, sent again on each
+ * change.
  *
  * Every block a view sends with `ui/update-model-context` shows as a
  * removable chip above the composer of each chat on screen in the same
  * window, and rides the next message sent there as a `context` part; no
  * block reaches a model without a chip, whatever its
- * `annotations.audience` says.
+ * `annotations.audience` says. An update that aims at one of the view's
+ * own `chat` or `composer` slots (`ModelContextOptions`) shows its chips
+ * on that slot's composer alone, and they ride only a message sent there,
+ * to a conversation of the view's app.
  */
 
 /** The extensions a view calls as `hearthscale/<extension>/…`, each only
  *  when its app names it in `uses`: the app's own conversations and
- *  projects, its store, its backend's events, its folders, its models,
- *  its jobs, its terminals, opening a surface, and its rooms. Opening a
+ *  projects, its store, its database, its backend's events, its folders,
+ *  its models, its jobs, its terminals, opening a surface, and its
+ *  rooms. Opening a
  *  file is OpenAI's `openai/files/open`, which `files.open` in `uses`
  *  gates. */
-declare const VIEW_EXTENSIONS: readonly ["sessions", "store", "events", "roots", "models", "jobs", "terminals", "surfaces.open", "peers"];
+declare const VIEW_EXTENSIONS: readonly ["sessions", "store", "db", "events", "roots", "models", "jobs", "terminals", "surfaces.open", "peers"];
 type ViewExtension = (typeof VIEW_EXTENSIONS)[number];
 /** `hostCapabilities.experimental.hearthscale`: the extensions this view
  *  may call. The `hearthscale/ui/*` methods are offered to every view. */
@@ -1965,6 +3262,42 @@ interface HearthscaleHostCapability {
 interface ViewHostContext {
     /** The look the host wears, as one style sheet of `@layer` bodies. */
     'hearthscale/appearance': string;
+    /** The address of the app's own package files under `assets/`, which the
+     *  view fetches, streams with byte ranges, and loads worklets from. */
+    'hearthscale/assets': {
+        url: string;
+    };
+    /** The address an asset of the view's conversation, or else of its app,
+     *  streams from: this address and the asset's id, read whole or by one
+     *  byte range, by `fetch` or as the source of a picture, a sound or a
+     *  video, as `resources/read` of `hearthscale-asset://<asset>` reads it
+     *  whole. It answers while the view is hosted. */
+    'hearthscale/assetBytes': {
+        url: string;
+    };
+    /** The path of the app's data folder, where its backend keeps files,
+     *  which the view reads with `hearthscale/fs/*`. */
+    'hearthscale/data': {
+        path: string;
+    };
+    /** The address a file of the app's data folder streams from: this
+     *  address and the file's path inside the folder, its parts joined by
+     *  `/` and each percent-encoded, read whole or by one byte range, by
+     *  `fetch` or as the source of a picture, a sound or a video, where
+     *  `hearthscale/fs/raw` reads a file of at most 64 MiB whole. It answers
+     *  while the view is hosted. */
+    'hearthscale/dataBytes': {
+        url: string;
+    };
+    /** The address a model's publisher picture loads from as the source of
+     *  a picture: this address, the Hearthscale Server the model comes from
+     *  (a card's `provider`, or the Server a Discover search ran on), `/`,
+     *  and the Hugging Face user or organisation that publishes it (the
+     *  first part of its `identity.repository`). It answers 404 for a
+     *  publisher the Server knows no picture of. */
+    'hearthscale/publishers': {
+        url: string;
+    };
     /** The app's settings; absent for an app that declares none. */
     'hearthscale/settings'?: SettingValues;
     /** What the view's chips hold from its last `ui/update-model-context`;
@@ -1995,6 +3328,15 @@ interface ContentBlockMeta {
 interface ModelContextAnswer {
     updateId: string;
 }
+/** `_meta['hearthscale/modelContext']` on a `ui/update-model-context`
+ *  request. `slot`, the id of a `chat` or `composer` slot the view
+ *  reserves now, aims the update's chips at that slot alone: they show on
+ *  its composer, ride only a message sent there, to a conversation of the
+ *  view's app, and go when the view goes. Any other id is refused. Absent,
+ *  the chips show above every composer on screen in the window. */
+interface ModelContextOptions {
+    slot?: string;
+}
 /** `_meta['openai/message']` on a `ui/message` request. */
 interface MessageOptions {
     /** `active`, also when absent: the conversation whose transcript shows
@@ -2009,16 +3351,19 @@ interface MessageOptions {
      *  composer for the person to send. */
     send?: boolean;
 }
-/** The tool input a view gets when its surface opens a file. */
+/** The tool input a view gets when its surface opens a file: one the
+ *  person opened, or a file or an asset another app handed its app, which
+ *  the view reads and never writes. */
 interface FileInput {
     file: OpenedFile;
 }
 /** `_meta['openai/resource']` on a `resources/read` of an opened file:
- *  whether its bytes come as text or as a base64 blob; absent, by the
- *  file's kind. The host answers the read, the subscription and its
- *  `notifications/resources/updated` itself. */
+ *  whether its bytes come as text or as a base64 blob; absent, as a blob
+ *  when the file holds a zero byte and as text otherwise. The host answers
+ *  the read, the subscription and its `notifications/resources/updated`
+ *  itself. */
 interface ResourceReadOptions {
-    representation: 'text' | 'blob';
+    representation?: 'text' | 'blob';
 }
 /** `_meta['openai/resource']` on the content a read of an opened file
  *  answers: the version read, and whether `openai/resources/write` may
@@ -2052,8 +3397,14 @@ type ResourceWrite = {
  *  its own authority and the view never reads or types into; `web`, the
  *  tab's web page on the app's own partition, which reaches only the hosts
  *  the app declares, and which the view drives with `hearthscale/web/*`.
- *  A view reserves at most one `web` slot. */
-declare const HOST_SLOT_KINDS: readonly ["chat", "composer", "cards", "terminal", "web"];
+ *  A view reserves at most one `web` slot. `model`, the shell's model
+ *  picker for one kind of model the app runs: the app's usable models of
+ *  that kind with their publishers' pictures, the ones a Server can
+ *  download or install for it, each with the memory it takes and its
+ *  download; a pick sets the app's model of that kind, the choice its page
+ *  in Settings shows, and the picker follows that choice wherever it
+ *  changes. */
+declare const HOST_SLOT_KINDS: readonly ["chat", "composer", "cards", "terminal", "web", "model"];
 type HostSlotKind = (typeof HOST_SLOT_KINDS)[number];
 /** The distances, in the view's CSS pixels, from each edge of the view to
  *  the same edge of a slot. The shell anchors the slot by them in its own
@@ -2064,24 +3415,48 @@ interface SlotInsets {
     right: number;
     bottom: number;
 }
+/** A rectangle of a view, in its CSS pixels from its top left corner. */
+interface SlotHole {
+    left: number;
+    top: number;
+    width: number;
+    height: number;
+}
 /** One rectangle a view reserves for the shell's trusted parts. */
 interface HostSlot {
     /** The view's own name for the slot, unique among its slots. */
     id: string;
     kind: HostSlotKind;
     /** On a `chat` or `composer` slot: the conversation of the view's app
-     *  it shows. Null or absent, it shows a new conversation, which the
-     *  first message creates in `project` when one is named, and
-     *  `hearthscale/ui/slot-session` tells the view its id. */
+     *  it shows; null, a new conversation, which the first message creates
+     *  in `project` when one is named, and `hearthscale/ui/slot-session`
+     *  tells the view its id. Absent, the first chat slot of a rail tab
+     *  shows the tab's conversation, and any other slot a new one. A
+     *  conversation the first chat slot of a rail tab names, null among
+     *  them, becomes the tab's. */
     session?: string | null;
     project?: string;
+    /** On a `chat` or `composer` slot: false draws the composer with no
+     *  model picker, for an app whose models are chosen only on its page in
+     *  Settings; the rest of the composer's footer keeps its place. Absent,
+     *  the composer shows the picker. */
+    modelPicker?: boolean;
     /** On a `terminal` slot: the folder its shell starts in, inside a folder
      *  the person gave the view's app. The slot's id, letters, digits, `-`
      *  and `_`, names the shell in the view's tab: the same id takes up the
      *  shell it opened while the platform holds it, and the shell ends with
      *  the tab. */
     cwd?: string;
+    /** On a `model` slot: the kind of model it chooses, one the app's
+     *  manifest names in `models` or its agent runs on. */
+    model?: ModelKind;
     insets: SlotInsets;
+    /** On a `chat` slot: at most `SLOT_HOLES_MAX` rectangles where the
+     *  view's own drawing shows through the chat and takes the pointer,
+     *  such as a bar of its own that floats over the chat. A hole stops at
+     *  the top of the composer, so the composer and the requests on it
+     *  always show. */
+    holes?: SlotHole[];
 }
 /** The notifications the host sends every view that reserved a slot. */
 type HostSlotNotification = 
@@ -2096,13 +3471,15 @@ type HostSlotNotification =
     };
 }
 /** The chat or the composer in the slot shows another conversation of
- *  the app: the one its first message created, a fork, or a helper. The
- *  shell shows it at once; the view's next report of the slot names it. */
+ *  the app: the one its first message created, a fork, a helper, or one
+ *  the window opened in the slot's tab; null is a new conversation the
+ *  window opened there. The shell shows it at once; the view's next
+ *  report of the slot names it. */
  | {
     method: 'hearthscale/ui/slot-session';
     params: {
         id: string;
-        session: string;
+        session: string | null;
     };
 }
 /** The tab's web page changed: its address, title, icon, load, history
@@ -2135,6 +3512,14 @@ type HostSlotNotification =
     params: {
         id: string;
     } & WebLogin;
+}
+/** The person pressed a key that `hearthscale/web/keys` names while the
+ *  tab's page had the keyboard; the page did not hear it. */
+ | {
+    method: 'hearthscale/web/key';
+    params: {
+        key: string;
+    };
 };
 /** The web page of a view's tab as the view hears it. The page lives as
  *  long as the tab, whether or not the view reserves its `web` slot, and
@@ -2155,7 +3540,8 @@ type Empty = Record<never, never>;
 /** The host methods beyond MCP Apps that every view may call. */
 interface ViewHostMethods {
     /** Reserves rectangles of a view that fills a tab, each for a part the
-     *  shell draws and answers there: the chat, the composer or the cards.
+     *  shell draws and answers there: the chat, the composer, the cards, the
+     *  person's shell, the tab's web page or a model picker.
      *  The list replaces the last one; an empty list gives every rectangle
      *  back, and a new document of the view starts with none. A slot is cut
      *  to the view. A slot below `SLOT_MIN_WIDTH` or `SLOT_MIN_HEIGHT`, or
@@ -2163,10 +3549,26 @@ interface ViewHostMethods {
      *  never receives what the person types there. Requests of the app dock
      *  on the composer of its slot or in its `cards` slot, and a press on a
      *  card counts only once the slot has kept its place for a moment. A
-     *  view in a transcript reserves none. */
+     *  view in a transcript reserves none. With `animate`, the parts glide
+     *  to their new places over the shell's slow duration, as the view moves
+     *  its own layout, such as a sidebar it folds; without, they move at
+     *  once. */
     'hearthscale/ui/slots': {
         params: {
             slots: HostSlot[];
+            animate?: boolean;
+        };
+        result: Empty;
+    };
+    /** Lays the tab's web page and the chat, the composer and the model
+     *  picker of the view's slots under the view while `covered`, so a menu,
+     *  a dialog or a tip the view draws over them shows above them; they
+     *  show through where the view draws nothing, and take no pointer. The terminal and the cards lie
+     *  above the view however it is covered. A new document of the view
+     *  starts uncovered. */
+    'hearthscale/ui/cover': {
+        params: {
+            covered: boolean;
         };
         result: Empty;
     };
@@ -2198,7 +3600,7 @@ interface ViewHostMethods {
      *  tile dims under the modal, and the modal's view fills the tile on a
      *  clear plate and draws its own box. It takes `input` as its tool
      *  input, `{}` when absent, and the tool its surface names is called
-     *  with it. One modal per tile: another replaces it. The app's
+     *  with it. One modal per tab: another replaces it. The app's
      *  requests draw above the modal. */
     'hearthscale/ui/open-modal': {
         params: {
@@ -2214,7 +3616,7 @@ interface ViewHostMethods {
     };
     /** Keeps a JSON value for this view's tab, which the host gives back in
      *  `hearthscale/widgetState`; it never reaches a model. The value takes
-     *  at most 64 KiB as JSON text. */
+     *  at most 65,536 UTF-16 code units as JSON text. */
     'hearthscale/ui/set-widget-state': {
         params: {
             state: unknown;
@@ -2235,15 +3637,15 @@ interface ViewHostMethods {
             files: OpenedFile[];
         };
     };
-    /** Stores `blob`, base64 of at most 64 MiB, as an
-     *  asset of the conversation the view belongs to, else of its app; the
-     *  view reads it back as `hearthscale-asset://<asset>` and hands `asset`
-     *  to its tools. */
+    /** Stores `blob`'s bytes as an asset of the conversation the view
+     *  belongs to, else of its app, streamed as they are read and held to
+     *  the room the disk gives the assets; the view reads it back as
+     *  `hearthscale-asset://<asset>` and hands `asset` to its tools. */
     'hearthscale/ui/upload-file': {
         params: {
             name: string;
             mediaType: string;
-            blob: string;
+            blob: Blob;
         };
         result: {
             asset: string;
@@ -2270,9 +3672,9 @@ interface ViewHostMethods {
         };
         result: Empty;
     };
-    /** Finds text in the page, the next match with `next`, backwards
-     *  unless `forward`; empty text ends the find and clears its marks. The
-     *  matches arrive as `hearthscale/web/found`. */
+    /** Finds text in the page, the next match with `next`, forwards
+     *  unless `forward` is false; empty text ends the find and clears its
+     *  marks. The matches arrive as `hearthscale/web/found`. */
     'hearthscale/web/find': {
         params: {
             text: string;
@@ -2300,16 +3702,6 @@ interface ViewHostMethods {
             png: string;
         };
     };
-    /** Lays the page under the view while `covered`, so a menu or a mark the
-     *  view draws over the slot shows above it; the page shows through
-     *  where the view is transparent and takes no pointer. Uncovered, the
-     *  page lies over its slot. */
-    'hearthscale/web/cover': {
-        params: {
-            covered: boolean;
-        };
-        result: Empty;
-    };
     /** Opens a new tab of the calling view's surface in its tile, after its
      *  tab, with its page on `url` when one is given, and its view starting
      *  from `state` as the state it saved; needs a click. */
@@ -2349,13 +3741,63 @@ interface ViewHostMethods {
         result: Empty;
     };
     /** Whether a download of the app's pages asks where to save it, with
-     *  the system's dialog, or goes to the system's downloads folder. */
+     *  the system's dialog, or goes to the app's downloads folder. */
     'hearthscale/web/downloads': {
         params: {
             ask: boolean;
         };
         result: Empty;
     };
+    /** The folder the downloads of the app's pages go to; null for the
+     *  system's downloads folder. */
+    'hearthscale/web/downloads-folder': {
+        params: Empty;
+        result: {
+            folder: string | null;
+        };
+    };
+    /** With `pick`, the person picks the folder the downloads of the app's
+     *  pages go to with the system's dialog, which keeps the folder before
+     *  for a cancelled pick; without it, they go to the system's downloads
+     *  folder again. Answers the folder they go to now. Needs a click. */
+    'hearthscale/web/set-downloads-folder': {
+        params: {
+            pick: boolean;
+        };
+        result: {
+            folder: string | null;
+        };
+    };
+    /** The keys the app's views take from their pages: while a page has the
+     *  keyboard, a press of one of them reaches the view of the page's tab
+     *  as `hearthscale/web/key`, and the page does not hear it. A key is
+     *  written as the shell's keybindings write it (`Control+F`, `Meta+L`,
+     *  `F6`); the list replaces the one before. */
+    'hearthscale/web/keys': {
+        params: {
+            keys: string[];
+        };
+        result: Empty;
+    };
+    /** The person's contact details the system's keychain keeps for the
+     *  app's pages; null before the person saves any. When the person
+     *  presses a field of a page's form that names one of them in its
+     *  `autocomplete`, or moves into one with Tab, the host fills the
+     *  empty fields of that form that name one. */
+    'hearthscale/web/contact': {
+        params: Empty;
+        result: {
+            contact: WebContact | null;
+        };
+    };
+    /** Keeps the person's contact details, or forgets them with null; needs
+     *  a click. */
+    'hearthscale/web/set-contact': {
+        params: {
+            contact: WebContact | null;
+        };
+        result: Empty;
+    };
     /** The origins and accounts the system's keychain keeps passwords of
      *  the app's pages for. No view reads a password: the host fills a
      *  sign-in form of a page with the password of the page's own origin
@@ -2457,6 +3899,24 @@ type WebLogin = {
     origin: string;
     username: string;
 };
+/** The person's contact details, each one a form may ask for by its
+ *  `autocomplete`: `given-name`, `family-name` and `name`; `email`;
+ *  `tel`; `organization`; `street-address`, and `address-line1` and
+ *  `address-line2` from its lines; `address-level2`, the city;
+ *  `address-level1`, the region; `postal-code`; and `country-name` and
+ *  `country`. */
+type WebContact = {
+    givenName?: string;
+    familyName?: string;
+    email?: string;
+    tel?: string;
+    organization?: string;
+    street?: string;
+    city?: string;
+    region?: string;
+    postalCode?: string;
+    country?: string;
+};
 /** A download of one of the app's pages, as its tab's view hears it. */
 type WebDownload = {
     id: string;
@@ -2473,8 +3933,9 @@ type WebDownload = {
  *  changes is its app's own, a terminal line it types goes at its app's
  *  level as one a page types, and the platform's log names the app. An
  *  act that sends the person's words, deletes what cannot come back,
- *  opens something on the person's screen or puts the app in a room runs
- *  only on a click inside the view. */
+ *  opens something on the person's screen, puts the app in a room, reads
+ *  Hugging Face or installs a model runs only on a click inside the
+ *  view. */
 interface ViewExtensionMethods {
     /** The app's own conversations, newest first; archived ones only when
      *  asked. Without `spawnedBy` the list holds the conversations no helper
@@ -2620,6 +4081,44 @@ interface ViewExtensionMethods {
         };
         result: Empty;
     };
+    /** The rows one statement of the app's database answers, each an object
+     *  by column name; bytes are `{ $bytes: base64 }`. Parameters are an
+     *  array for `?` and `?N`, or an object for `:name`, `@name` and
+     *  `$name`. */
+    'hearthscale/db/query': {
+        uses: 'db';
+        params: {
+            sql: string;
+            params?: DbParams;
+        };
+        result: {
+            rows: Record<string, unknown>[];
+        };
+    };
+    /** Runs one statement with its parameters, or, with none, every
+     *  statement of the text. */
+    'hearthscale/db/exec': {
+        uses: 'db';
+        params: {
+            sql: string;
+            params?: DbParams;
+        };
+        result: DbChange;
+    };
+    /** Runs statements in one transaction: all of them change the database
+     *  or none does. */
+    'hearthscale/db/batch': {
+        uses: 'db';
+        params: {
+            statements: {
+                sql: string;
+                params?: DbParams;
+            }[];
+        };
+        result: {
+            results: DbChange[];
+        };
+    };
     'hearthscale/roots/list': {
         uses: 'roots';
         params: Empty;
@@ -2642,11 +4141,13 @@ interface ViewExtensionMethods {
     };
     /** A folder's folders and files by name, hidden ones left out. Every
      *  path of `hearthscale/fs/*` and `hearthscale/vcs/*` is absolute on the
-     *  platform's machine and lies inside a folder or file the person gave
-     *  the app; one outside, or in a folder that holds credentials, is
-     *  refused in words. Each reads and never writes. */
+     *  platform's machine and lies inside the app's own data folder
+     *  (`hearthscale/data`) or a folder or file the person gave the app; one
+     *  outside, or in a folder that holds credentials, is refused in words.
+     *  Each reads and never writes. `list`, `read` and `raw` need no entry
+     *  in `uses`: without `roots`, the data folder is all they reach. */
     'hearthscale/fs/list': {
-        uses: 'roots';
+        uses: null;
         params: {
             path: string;
         };
@@ -2654,7 +4155,7 @@ interface ViewExtensionMethods {
     };
     /** A file's size, and its head as text unless it is binary. */
     'hearthscale/fs/read': {
-        uses: 'roots';
+        uses: null;
         params: {
             path: string;
         };
@@ -2663,7 +4164,7 @@ interface ViewExtensionMethods {
     /** A whole file of at most 64 MiB, in base64, with the media type of
      *  its extension. */
     'hearthscale/fs/raw': {
-        uses: 'roots';
+        uses: null;
         params: {
             path: string;
         };
@@ -2704,6 +4205,16 @@ interface ViewExtensionMethods {
         };
         result: VcsRefs;
     };
+    /** The commits of the current branch that `base` does not hold, newest
+     *  first. */
+    'hearthscale/vcs/log': {
+        uses: 'roots';
+        params: {
+            root: string;
+            base: string;
+        };
+        result: VcsLog;
+    };
     /** One scope's patch. */
     'hearthscale/vcs/diff': {
         uses: 'roots';
@@ -2716,9 +4227,10 @@ interface ViewExtensionMethods {
         params: VcsFileQuery;
         result: VcsFile;
     };
-    /** One streaming completion on the app's chat card or the chat role;
-     *  the frames arrive as `hearthscale/models/delta` with `stream`, and
-     *  the call answers once the stream has ended. */
+    /** One streaming completion on the usable chat card the request's
+     *  `model` names, or else on the app's chat card or the chat role; the
+     *  frames arrive as `hearthscale/models/delta` with `stream`, and the
+     *  call answers once the stream has ended. */
     'hearthscale/models/complete': {
         uses: 'models';
         params: {
@@ -2734,12 +4246,68 @@ interface ViewExtensionMethods {
         };
         result: Empty;
     };
-    'hearthscale/jobs/submit': {
-        uses: 'jobs';
+    /** The cards of a kind, a Hugging Face task and a state, the usable ones
+     *  the app may name as `model` unless another state is named, each with
+     *  what it takes, and the app's choice of the kind, or of each kind. */
+    'hearthscale/models/list': {
+        uses: 'models';
+        params: {
+            kind?: ModelKind;
+            task?: string;
+            state?: CardState;
+        };
+        result: ModelList;
+    };
+    /** The Hearthscale Servers the app may install on: this computer's
+     *  first, then each paired one, with whether each serves now. */
+    'hearthscale/models/servers': {
+        uses: 'models';
+        params: Empty;
+        result: {
+            servers: ModelServer[];
+        };
+    };
+    /** A search of a Server's Discover: the public Hugging Face
+     *  repositories of `task` that `search` matches, as that Server answers
+     *  it. Needs a click, as it reads Hugging Face. */
+    'hearthscale/models/discover': {
+        uses: 'models';
+        params: HubSearch & {
+            server: string;
+        };
+        result: {
+            repositories: HubRepository[];
+        };
+    };
+    /** One public repository as a Server's Discover lists its files: the
+     *  ones a runtime there runs whose model answers an app's requests,
+     *  each with the companion files it needs. Needs a click. */
+    'hearthscale/models/repository': {
+        uses: 'models';
+        params: {
+            server: string;
+            repo: string;
+        };
+        result: {
+            listing: HubListing;
+        };
+    };
+    /** Asks the person to install a model on a Hearthscale Server, on a
+     *  card at every level: a card a Server lists, or a file of a Hugging
+     *  Face repository. `card` is the card the model installs as, or null
+     *  where the person declined. Needs a click. */
+    'hearthscale/models/install': {
+        uses: 'models';
         params: {
-            kind: JobKind;
-            input: JobInput;
+            target: InstallTarget;
         };
+        result: ModelInstalled;
+    };
+    /** One job on the card `model` names, or else on the card the app runs
+     *  the kind on; its outputs are assets of the app. */
+    'hearthscale/jobs/submit': {
+        uses: 'jobs';
+        params: Omit<JobRequest, 'save'>;
         result: {
             job: Job;
         };
@@ -2816,11 +4384,18 @@ interface ViewExtensionMethods {
         result: Empty;
     };
     /** Opens a surface of this app, or of `app`, that its manifest places
-     *  in the rail or a tab, beside the view's tile; `session` is a
-     *  conversation of that app a chat opens on, `path` the address a view
-     *  opens on, as a deep link gives it. With `session` and no `surface`,
-     *  the conversation opens in its own app, as a notification's click
-     *  opens it; `app`, when given, must be that app. Needs a click. */
+     *  in the rail or a tab, beside the view's tile, on `path`, the address
+     *  a view opens on, as a deep link gives it. With `file`, the absolute
+     *  path of a file inside a folder or a file the person gave this app or
+     *  its data folder, or `asset`, an asset this app holds, it hands `app`
+     *  the file and opens its view surface whose `opens` names the file's
+     *  kind, `surface` or else the first, on it, and only once it opens:
+     *  `app` gets a grant to read that one file, which lasts while this app
+     *  is switched on and reaches the file, or for a file of the data folder
+     *  and for an asset an asset of its own. With `session` and no `surface`, the conversation
+     *  opens in its own app, as a notification's click opens it; `app`,
+     *  when given, must be that app. A `surface` and a `session` together
+     *  are refused, and so are a `path` and a file. Needs a click. */
     'hearthscale/surfaces/open': {
         uses: 'surfaces.open';
         params: {
@@ -2828,6 +4403,8 @@ interface ViewExtensionMethods {
             surface?: string;
             session?: string;
             path?: string;
+            file?: string;
+            asset?: string;
         };
         result: Empty;
     };
@@ -2882,8 +4459,10 @@ type ViewExtensionMethod = keyof ViewExtensionMethods;
 /** The notifications the host sends a view, each only to a view whose app
  *  names the extension in `uses`: a conversation of the app changed or
  *  went, a project of any app changed, the app's backend emitted an
- *  event, a completion or a terminal of the view moved, a job of the app
- *  moved, a room of the app changed, ended or carried a message. */
+ *  event, a completion or a terminal of the view moved, a model of a
+ *  Server downloads or its download ended, the app's model of a kind
+ *  changed, a job of the app moved, a room of the app changed, ended or
+ *  carried a message. */
 type ViewExtensionNotification = {
     method: 'hearthscale/sessions/changed';
     params: {
@@ -2912,6 +4491,20 @@ type ViewExtensionNotification = {
         stream: string;
         delta: CompletionDelta;
     };
+} | {
+    method: 'hearthscale/models/download';
+    params: {
+        download: ModelDownload;
+    };
+}
+/** The app's choice of a kind as `hearthscale/models/list` answers it in
+ *  `chosen`. */
+ | {
+    method: 'hearthscale/models/chosen';
+    params: {
+        kind: ModelKind;
+        chosen: EffectiveModel;
+    };
 } | {
     method: 'hearthscale/jobs/progress';
     params: {
@@ -2957,9 +4550,23 @@ type ViewExtensionNotification = {
  * the view may call in `getHostCapabilities().experimental.hearthscale`.
  */
 
-/** One extension call, typed by its method: the request's params in, its
- *  result out. A refusal rejects with the host's words. */
-type ViewExtensionCall = <M extends ViewExtensionMethod>(method: M, params: ViewExtensionMethods[M]['params']) => Promise<ViewExtensionMethods[M]['result']>;
+/** Every request beyond MCP Apps a view sends its host: the methods every
+ *  view may call and the extensions its app's `uses` opens, each with its
+ *  params and its result. */
+type ViewMethods = ViewHostMethods & ViewExtensionMethods;
+/** One request of a method map, typed by its method: its params in, its
+ *  result out, the params left out where each of them is optional. A
+ *  refusal rejects with the MCP SDK's `McpError`, whose message is
+ *  `MCP error <code>: ` followed by the host's words. */
+type CallOf<Methods> = <M extends keyof Methods & string>(method: M, ...params: Record<never, never> extends ParamsOf<Methods[M]> ? [params?: ParamsOf<Methods[M]>] : [params: ParamsOf<Methods[M]>]) => Promise<ResultOf<Methods[M]>>;
+type ParamsOf<Method> = Method extends {
+    params: infer P;
+} ? P : never;
+type ResultOf<Method> = Method extends {
+    result: infer R;
+} ? R : never;
+/** One request beyond MCP Apps, typed by its method. */
+type HostCall = CallOf<ViewMethods>;
 
 /**
  * `@hearthscale/app`: the types an app's backend and its views import,
@@ -2970,13 +4577,23 @@ type ViewExtensionCall = <M extends ViewExtensionMethod>(method: M, params: View
  * are handles inside mounts, and no callable crosses to the core.
  */
 
+/** The kinds of trigger a manifest declares. */
+type TriggerKind = NonNullable<Manifest['triggers']>[number]['kind'];
+
+/** A value of the app's database as a backend sees it: bytes are a
+ *  `Uint8Array`. A view sees them as `{ $bytes: base64 }` (`DbParams`). */
+type RowValue = null | boolean | number | string | Uint8Array;
+/** A statement's parameters in a backend: in order for `?` and `?N`, or
+ *  by name for `:name`, `@name` and `$name`. */
+type StatementParams = RowValue[] | Record<string, RowValue>;
 /** A relayed TCP or TLS stream. Bytes have no message boundaries; the
  *  protocol on top is the app's. */
 interface Connection {
     readonly id: string;
     readonly state: 'plain' | 'tls';
     write(bytes: Uint8Array | string): Promise<void>;
-    /** Upgrades the same socket to TLS after the app's protocol exchange. */
+    /** Upgrades the same socket to TLS after the app's protocol exchange;
+     *  a connection a listener accepted refuses it. */
     startTls(): Promise<void>;
     close(): Promise<void>;
     on(event: 'data', fn: (bytes: Uint8Array) => void): () => void;
@@ -2986,6 +4603,84 @@ interface Connection {
         message: string;
     }) => void): () => void;
 }
+/** A port the backend listens on. Closing it stops new connections and
+ *  keeps the open ones. */
+interface Listener {
+    readonly port: number;
+    close(): Promise<void>;
+}
+/** What `ctx.handoff` hands an agent, and where its answer goes. */
+interface Handoff {
+    /** The app whose agent answers; this app when absent. */
+    app?: string;
+    title?: string;
+    /** What the agent is asked. */
+    text: string;
+    material?: ({
+        kind: 'text';
+        text: string;
+        source: string;
+    } | {
+        kind: 'file';
+        root: string;
+        path: string;
+        source: string;
+    })[];
+    answer?: 'reply' | 'clipboard' | 'caret' | 'selection' | 'notification' | 'overlay' | {
+        file: MountPath;
+    };
+}
+/** A note an app shows over the person's other programs. */
+interface OverlayNote {
+    text: string;
+    title?: string;
+    /** Where the note shows: by the pointer, at the top or the bottom of
+     *  the screen, or by the tray; by the pointer when absent. */
+    at?: 'cursor' | 'top' | 'bottom' | 'tray';
+    /** The milliseconds after which the note hides itself. */
+    hideAfter?: number;
+}
+/** What `ctx.capture` captures. */
+type CaptureSource = 'microphone' | 'system-sound' | 'program-sound' | 'screen' | 'window' | 'camera';
+/** A part of a capture: sound as 16 kHz 16-bit little-endian mono PCM
+ *  with its loudness in dBFS and whether it holds a voice, half a second
+ *  after the part before it, silence included; or one picture of the
+ *  screen, a window or the camera. `at` is the milliseconds from the
+ *  capture's start to the part's first sample or to when the picture was
+ *  taken. */
+type CapturedPart = {
+    capture: string;
+    kind: 'audio';
+    seq: number;
+    at: number;
+    pcm: Uint8Array;
+    level: number;
+    voice: boolean;
+} | {
+    capture: string;
+    kind: 'frame';
+    seq: number;
+    at: number;
+    image: Uint8Array;
+    mediaType: string;
+    width: number;
+    height: number;
+};
+/** A transcription stream. The Server cuts the sound at pauses, and
+ *  each part becomes a segment. */
+interface Listening {
+    readonly id: string;
+    /** 16 kHz mono 16-bit little-endian PCM, at most 10 s at a time, such
+     *  as a part of `ctx.capture`. */
+    write(pcm: Uint8Array): Promise<void>;
+    /** No more sound: the last segments and `done` follow. */
+    end(): Promise<void>;
+    /** Drops the stream at once; answers whether it was open. */
+    close(): Promise<boolean>;
+    on<T extends ListenEvent['type']>(event: T, fn: (event: Extract<ListenEvent, {
+        type: T;
+    }>) => void): () => void;
+}
 /** A sandboxed run of one program in the app's environment. */
 interface Run {
     readonly id: string;
@@ -2996,8 +4691,10 @@ interface Run {
     cancel(): Promise<void>;
     on(event: 'output', fn: (output: string) => void): () => void;
 }
-/** What a backend reaches. A namespace the manifest's `uses` does not
- *  name is absent from this object. */
+/** What a backend reaches. Every member and method is present; a call
+ *  whose `uses` entry, trigger or manifest part is missing rejects, and a
+ *  hook (`on`, `register`) throws, with `capability.denied:` and the
+ *  words that name what is missing. */
 interface AppContext {
     readonly app: {
         id: string;
@@ -3009,7 +4706,8 @@ interface AppContext {
     /** Aborts when the host is disposed. */
     readonly signal: AbortSignal;
     log(level: 'debug' | 'info' | 'warn' | 'error', message: string): Promise<void>;
-    roots?: {
+    /** With `roots` in `uses`. */
+    roots: {
         list(): Promise<Mount[]>;
         /** Raises the folder card; the person's pick becomes a mount, which
          *  the request answers. The host restarts with it once its calls and
@@ -3017,17 +4715,43 @@ interface AppContext {
          *  next call; asked outside any call, the answer comes first. */
         request(purpose: string, shape: 'folder' | 'file'): Promise<Mount | null>;
     };
-    fs?: {
+    /** Files on the app's mounts: its data folder, `data`, and the folders
+     *  and files the person granted it. A write to `data` runs from any
+     *  call; a write to another mount only inside a tool declared
+     *  mutating. */
+    fs: {
         read(path: MountPath, options?: {
             offset?: number;
             limit?: number;
         }): Promise<string>;
+        /** A file's bytes, or the bytes of a range of it. */
+        readBytes(path: MountPath, range?: {
+            offset: number;
+            length: number;
+        }): Promise<Uint8Array>;
         list(path: MountPath): Promise<{
             dirs: string[];
             files: string[];
         }>;
+        /** A file or a folder, its size and when it last changed; null where
+         *  nothing is. */
+        stat(path: MountPath): Promise<{
+            kind: 'file' | 'folder';
+            size: number;
+            modified: string | null;
+        } | null>;
         write(path: MountPath, text: string): Promise<void>;
+        writeBytes(path: MountPath, bytes: Uint8Array | ArrayBuffer | string): Promise<void>;
         edit(path: MountPath, oldText: string, newText: string): Promise<void>;
+        /** Makes a folder and the folders above it. */
+        mkdir(path: MountPath): Promise<void>;
+        /** Moves a file or a folder to another path of the same mount. */
+        rename(path: MountPath, to: string): Promise<void>;
+        /** Removes a file, an empty folder, or with `recursive` a folder and
+         *  all it holds. Nothing there is not a failure. */
+        remove(path: MountPath, options?: {
+            recursive?: boolean;
+        }): Promise<void>;
         /** Copies an asset's bytes to a path inside a read-write mount. */
         export(asset: string, path: MountPath): Promise<void>;
     };
@@ -3044,16 +4768,38 @@ interface AppContext {
         import(path: MountPath, mediaType: string): Promise<string>;
         release(id: string): Promise<void>;
     };
-    net?: {
+    /** With a host in `environment.network`, a port in
+     *  `environment.listen`, `accounts`, or `net.ask` in `uses`. */
+    net: {
         fetch(params: FetchParams): Promise<FetchAnswer>;
         connect(host: string, port: number, tls: boolean): Promise<Connection>;
+        /** Listens on a port `environment.listen` declares, on this
+         *  computer's loopback. Each connection reaches `onConnection` before
+         *  its first bytes, so hooks set there hear them all. With a port in
+         *  `environment.listen`. */
+        listen(port: number, onConnection: (connection: Connection) => void): Promise<Listener>;
+        /** Asks the person to let the backend reach a host they named in the
+         *  app, `name[:port]`, on a card at every level, only inside a call a
+         *  person's press started. With `tls`, the card shows the
+         *  certificate the host presents on that port (443 by default) when
+         *  no authority the system trusts signed it, and allowing the host
+         *  trusts that certificate. Answers whether the person allowed it;
+         *  the backend reaches the host from then on. With `net.ask` in
+         *  `uses`. */
+        ask(request: {
+            host: string;
+            purpose: string;
+            tls?: boolean;
+        }): Promise<boolean>;
     };
-    exec?: {
+    /** With `exec` in `uses`. */
+    exec: {
         run(argv: string[], cwd: MountPath, options?: {
             wall?: number;
         }): Promise<Run>;
     };
-    surface?: {
+    /** With `surface` in `uses`. */
+    surface: {
         /** A tab command on the session's executor surface, from inside a
          *  body whose tool is declared outbound: on the page of the app's
          *  first surface placed in the rail or a tab, a `web` surface's own
@@ -3061,41 +4807,331 @@ interface AppContext {
          *  runs from any body. Rejects with the error the window met. */
         command(op: SurfaceOp, args?: Record<string, unknown>): Promise<SurfaceAnswer>;
     };
-    store?: {
+    /** With `store` in `uses`. */
+    store: {
         get(key: string): Promise<unknown>;
         set(key: string, value: unknown): Promise<void>;
         delete(key: string): Promise<void>;
     };
-    secrets?: {
+    /** The app's SQLite database, with FTS5 and the JSON functions. Values
+     *  are null, booleans (stored as 0 and 1), numbers, strings and bytes;
+     *  parameters an array for `?` and `?N`, or an object for `:name`,
+     *  `@name` and `$name`. With `db` in `uses`. */
+    db: {
+        /** The rows one statement answers, each by column name. */
+        query(sql: string, params?: StatementParams): Promise<Record<string, RowValue>[]>;
+        /** Runs one statement with its parameters, or, with none, every
+         *  statement of the text. */
+        exec(sql: string, params?: StatementParams): Promise<DbChange>;
+        /** Runs statements in one transaction: all change the database or
+         *  none does. */
+        batch(statements: {
+            sql: string;
+            params?: StatementParams;
+        }[]): Promise<DbChange[]>;
+    };
+    /** With `secrets` in `uses`. */
+    secrets: {
         get(name: string): Promise<string | null>;
         set(name: string, value: string): Promise<void>;
         delete(name: string): Promise<void>;
     };
-    oauth?: {
-        /** True once a token for the issuer covers the scopes: at once when
-         *  one is held, else after the person's sign-in card and the grant;
-         *  false when the person or the service said no. Rejects with the
-         *  reason when the request, the manifest's `network` or the service
-         *  does not allow a sign-in. A sign-in replaces the scopes held, so
-         *  each call names every scope the app needs. */
-        login(request: OAuthLogin): Promise<boolean>;
-        /** The access token, refreshed when it is past half its lifetime;
-         *  null when the app must sign in again. A token the service revoked
-         *  early still comes back: after a 401, `logout` and `login` again. */
-        token(issuer: string): Promise<string | null>;
-        /** Forgets the tokens for the issuer, revoked at the service where
-         *  its metadata names a revocation endpoint. Null, or the words when
-         *  the service did not confirm the revocation and may still hold the
-         *  access. */
-        logout(issuer: string): Promise<string | null>;
-    };
-    events?: {
+    /** The person's accounts of the kinds the manifest's `accounts` names,
+     *  which Hearthscale holds: the app reads the credential of one the
+     *  person attached to it, never its sign-in. With `accounts` in the
+     *  manifest. */
+    accounts: {
+        /** The accounts the person attached to the app. */
+        list(): Promise<AppAccount[]>;
+        /** Asks the person for an account of a kind the manifest names, on a
+         *  card at every level, only inside a call a person's press started:
+         *  one they hold, a new one to fill in, or a sign-in. Answers the
+         *  account, attached to the app, or null when the person declines. */
+        add(provider: string): Promise<AppAccount | null>;
+        /** What the app reaches the account's servers with: an access token
+         *  Hearthscale refreshes, or the fields the person filled in, the
+         *  password among them. */
+        credential(id: string): Promise<AccountCredential>;
+    };
+    /** The app's own events to its views and conversations, with
+     *  `events` in `uses`; and the events it offers other apps in
+     *  `capabilities.events`, which every enabled app whose `event` trigger
+     *  names it hears. */
+    events: {
         emit(event: AppEvent): Promise<void>;
+        /** Publishes an offered event; rejects with the words of a misfit
+         *  when the data does not match the offer's schema, or is over 64 KiB
+         *  as JSON. */
+        publish(event: string, data: unknown): Promise<void>;
+    };
+    /** With an agent in the manifest: the skills the app adds while it
+     *  runs, such as the person's own recipes. The platform keeps them; the
+     *  app's agents carry them and the composer's `/` lists them, as the
+     *  skills of its package; they go when the app is removed. */
+    skills: {
+        /** Adds a skill, or replaces the one of the same name. At most 100. */
+        add(skill: AppSkill): Promise<void>;
+        /** Answers whether there was a skill by that name. */
+        remove(name: string): Promise<boolean>;
+        list(): Promise<AppSkill[]>;
+    };
+    /** With `sessions`: one turn of an agent on what the app hands it, in a
+     *  new conversation of this app or, with `sessions.create`, another
+     *  app's. The material reaches the model fenced as untrusted, each with
+     *  its source. Once the turn ends, the answer goes where `answer`
+     *  names, which needs `desktop.actions` for the clipboard, the caret and
+     *  the selection, `notifications` for a notification, `desktop.overlay`
+     *  for a note over other programs and `roots` for a file, and comes
+     *  back in the result. From inside a tool body, the
+     *  tool must be declared `mutating`. */
+    handoff(request: Handoff): Promise<{
+        session: string;
+        text: string;
+        stopReason: string;
+    }>;
+    /** With `triggers` in the manifest: each trigger's handler, called
+     *  with the data its kind carries: `HotkeyFire`, `InUseFire`,
+     *  `ProgramFire`, `DeviceFire`, `SystemFire`, `AlarmFire`, `FolderFire`
+     *  or `EventFire`, the JSON body of an inbound call, or null for a tray
+     *  item. A trigger starts the backend when it is not up. With a folder
+     *  trigger, `watch` and `unwatch` name the places it hears. */
+    triggers: {
+        on(name: string, fn: (data: unknown, trigger: {
+            kind: TriggerKind;
+        }) => void): () => void;
+        /** Watches a place inside a mount, the `data` folder or a granted
+         *  folder or file, for a folder trigger. The platform keeps the watch
+         *  while the backend is stopped and across restarts, until the backend
+         *  unwatches it, the grant goes, or the app is disabled or removed. */
+        watch(name: string, at: {
+            root: string;
+            path?: string;
+        }): Promise<void>;
+        /** Ends a folder trigger's watch of one place, or every watch of the
+         *  trigger when no place is named. Answers whether any ended. */
+        unwatch(name: string, at?: {
+            root: string;
+            path?: string;
+        }): Promise<boolean>;
+        /** With a hotkey trigger: the keys that fire each of the app's
+         *  hotkeys now, the person's or else the declared ones, so the app
+         *  can show them; `keys` is absent where none are set or another
+         *  app's hotkey holds them, which `takenBy` names. */
+        hotkeys: {
+            list(): Promise<HotkeyState[]>;
+            /** Hears a move of the keys of any of them, with every one as
+             *  `list` answers it. */
+            on(event: 'change', fn: (hotkeys: HotkeyState[]) => void): () => void;
+        };
+    };
+    /** With a time trigger in the manifest: alarms the platform keeps and
+     *  fires at their time, starting the backend when it is stopped. A time
+     *  missed while the computer slept or the platform was stopped fires
+     *  once when it can. */
+    alarms: {
+        /** Sets an alarm; `at` is a `Date` or an ISO time with its offset,
+         *  `every` repeats it that many minutes after each fire. */
+        set(alarm: Omit<AlarmRequest, 'at'> & {
+            at?: string | Date;
+        }): Promise<Alarm>;
+        /** Answers whether there was such an alarm. */
+        clear(id: string): Promise<boolean>;
+        /** The app's alarms, the soonest first. */
+        list(): Promise<Alarm[]>;
+    };
+    /** With the `capture.<source>` entry of each source in `uses`. */
+    capture: {
+        /** The devices of a source the manifest's `uses` names: microphones,
+         *  cameras, screens, the windows of other programs, or the programs
+         *  that play sound. The ids hold while the person's window runs. */
+        devices(source: CaptureSource): Promise<CaptureDevice[]>;
+        /** Starts capturing a source of the person's computer, which the
+         *  manifest's `uses` names as `capture.<source>`, and answers the
+         *  capture's id and `startedAt`, when its first sample or picture was
+         *  taken in milliseconds since the Unix epoch on the computer that
+         *  captures, the clock every capture there shares: a part's moment is
+         *  `startedAt + at`. Sound comes as 16 kHz mono 16-bit PCM in parts of
+         *  half a second, one after another, silence included; the screen, a window and the camera as a JPEG
+         *  picture every `interval` ms (1000 unless named, at least 250), the
+         *  screen cut to `region` when named. `device` names a device of
+         *  `devices`; a window and a program need one. `echo` takes the
+         *  computer's own sound out of the microphone. `keep` records a sound
+         *  capture whole, as one WAV asset of the app when it ends. Rejects
+         *  with the reason when the person stopped all sensors or the computer
+         *  cannot serve the source. A capture keeps the backend up. */
+        start(source: CaptureSource, options?: {
+            device?: string;
+            interval?: number;
+            region?: {
+                x: number;
+                y: number;
+                width: number;
+                height: number;
+            };
+            echo?: boolean;
+            keep?: boolean;
+        }): Promise<{
+            capture: string;
+            startedAt: number;
+        }>;
+        /** Answers whether the capture ran; for a capture with `keep`, the id
+         *  of the recording's asset. */
+        stop(capture: string): Promise<boolean | string>;
+        on(event: 'chunk', fn: (part: CapturedPart) => void): () => void;
+        /** A capture the app did not stop ended: its device stopped, the
+         *  person stopped all sensors, or the window that captured closed.
+         *  `asset` is the recording of a capture with `keep`. */
+        on(event: 'ended', fn: (ended: {
+            capture: string;
+            reason: string;
+            asset?: string;
+        }) => void): () => void;
+    };
+    /** Other programs on the person's computer: what they show, with
+     *  `desktop.context`, and typing into the one in front, with
+     *  `desktop.actions`. */
+    desktop: {
+        context(): Promise<DesktopContext>;
+        /** Calls `on('change')` with each change from now on, and keeps the
+         *  backend up. */
+        watch(): Promise<void>;
+        unwatch(): Promise<boolean>;
+        on(event: 'change', fn: (context: DesktopContext) => void): () => void;
+        on(event: 'ended', fn: (ended: {
+            reason: string;
+        }) => void): () => void;
+        /** Types the text into the focused field of the program in front. */
+        type(text: string): Promise<void>;
+        /** Pastes the text there through the clipboard, which it restores. */
+        paste(text: string): Promise<void>;
+        /** Presses each combination in turn, such as `ctrl+a` or `enter`: a
+         *  key with `ctrl`, `shift`, `alt` or `meta` before it. */
+        keys(keys: string[]): Promise<void>;
+    };
+    /** With `input.controller`: the person's game controllers, read also
+     *  while another program has the focus. The first hook of `change`
+     *  watches them, which keeps the backend up, and the last one that goes
+     *  ends the watch; a watch that ends or cannot start says why on
+     *  `ended`. */
+    controllers: {
+        list(): Promise<Controller[]>;
+        /** Runs a controller's strong and weak motors, each from 0 to 1, for
+         *  `ms` milliseconds, up to 10000, in place of its last rumble. A
+         *  motor the call does not name stays still. */
+        rumble(controller: string, rumble: {
+            strong?: number;
+            weak?: number;
+            ms: number;
+        }): Promise<void>;
+        on(event: 'change', fn: (change: ControllerChange) => void): () => void;
+        on(event: 'ended', fn: (ended: {
+            reason: string;
+        }) => void): () => void;
+    };
+    /** With `system.state`: the state of the person's computer. The first
+     *  hook of `change` or `mediaKey` watches it, which keeps the backend
+     *  up; `change` hears each change but the idle time's, and `mediaKey`
+     *  each media key the person presses, which still reaches the program it
+     *  is meant for. The last hook that goes ends the watch. */
+    system: {
+        state(): Promise<SystemState>;
+        on(event: 'change', fn: (state: SystemState) => void): () => void;
+        on(event: 'mediaKey', fn: (press: MediaKeyPress) => void): () => void;
+        on(event: 'ended', fn: (ended: {
+            reason: string;
+        }) => void): () => void;
+    };
+    /** With `desktop.overlay`: one note of the app over the person's other
+     *  programs, which never takes the focus; a note shown replaces the
+     *  app's last. And the app's views its manifest places in `overlay`,
+     *  each in a window of its own over the other programs that never takes
+     *  the focus, up to 8 at once. */
+    overlay: {
+        show(note: OverlayNote): Promise<void>;
+        hide(): Promise<void>;
+        /** Shows a view surface over the other programs, and answers its id.
+         *  It opens with `input` as its tool input, `{}` when absent, and the
+         *  tool its surface names is called with it. With `clickThrough`, the
+         *  pointer's presses pass through it to the programs below. It takes
+         *  the size its view reports, from 48 to 720 points on each side, or
+         *  fills the rectangle its anchor names, within its screen's work
+         *  area. A view shown keeps the backend up. Rejects with the reason
+         *  when the person stopped all sensors or the computer cannot show
+         *  it. */
+        view(surface: string, options: {
+            anchor: OverlayAnchor;
+            clickThrough: boolean;
+            input?: Record<string, unknown>;
+        }): Promise<string>;
+        /** Answers whether the view showed. */
+        close(overlay: string): Promise<boolean>;
+        /** A view the app did not close closed: the view asked to close or
+         *  reported no size within 10 seconds, the person stopped all sensors,
+         *  or the window that showed it closed, loaded again or attached to
+         *  the platform again. */
+        on(event: 'closed', fn: (closed: {
+            overlay: string;
+            reason: string;
+        }) => void): () => void;
+    };
+    /** With `index` in `uses`: the shared index, where the app finds again
+     *  what it put and the text files of the places it watches. */
+    index: {
+        /** Puts a document in place of what was put under its source;
+         *  answers how many passages it holds. */
+        put(document: IndexDocument): Promise<number>;
+        /** Answers whether there was a document under the source. */
+        remove(source: string): Promise<boolean>;
+        /** The passages that best answer the query, best first; ten unless
+         *  a limit is named. */
+        search(query: string, limit?: number): Promise<IndexHit[]>;
+        /** Indexes every text file at or under a path of a mount, under the
+         *  source `file:<mount>/<path>`, and again whenever one changes, also
+         *  after a restart while the app may read the path. */
+        watch(path: MountPath): Promise<void>;
+        /** Stops a watch and removes what it indexed; answers whether there
+         *  was one. */
+        unwatch(path: MountPath): Promise<boolean>;
+    };
+    /** With `notifications` in `uses`: a system notification. A press
+     *  opens `session` or the place `open` names; a button with an `id`
+     *  tells the backend through `notifications.on('action')`, starting it
+     *  when it is not up. */
+    notify(notice: AppNotice): Promise<void>;
+    notifications: {
+        on(event: 'action', fn: (press: {
+            id: string;
+        }) => void): () => void;
     };
-    notify?(notice: AppNotice): Promise<void>;
     /** Drawn in the conversation at every level, from inside a tool body. */
     ask(question: AppQuestion): Promise<AppAnswer>;
-    sessions?: {
+    /** How the person reads dates and numbers, as the window of the computer
+     *  they use states it: a BCP 47 locale with the hour cycle and the first
+     *  day of the week of the system's settings, and the IANA time zone.
+     *  Rejects while no window has stated it. */
+    region(): Promise<Region>;
+    surfaces: {
+        /** Brings a surface this app's manifest places in the rail or a tab, or
+         *  with `surfaces.open` in `uses` one of `app`, to the front beside the
+         *  conversation of the tool call, opening it there when no tab shows
+         *  it; answers what the window does, in words. A view opens at `path`,
+         *  which starts with `/`, or on `file` or `asset`: a file of this
+         *  app's mounts or an asset it holds, which it hands `app` to open in
+         *  its view surface `surface`, whose `opens` names the file's kind.
+         *  `app` reads a granted file through a grant to read that one file,
+         *  and gets a file of the data folder and an asset as an asset of its
+         *  own. A hand-off to another app runs only inside a call a person's
+         *  press started. Rejects outside a conversation's tool call, or while
+         *  no window shows the conversation. */
+        show(surface: string, options?: {
+            app?: string;
+            path?: string;
+            file?: MountPath;
+            asset?: string;
+        }): Promise<string>;
+    };
+    /** With `sessions` in `uses`. */
+    sessions: {
         /** This app's sessions and the ones it started in other apps. */
         list(): Promise<SessionListing[]>;
         open(id: string): Promise<OpenedSession>;
@@ -3125,12 +5161,60 @@ interface AppContext {
         /** Called with every setting's value when the person changed one. */
         on(event: 'changed', fn: (values: SettingValues) => void): () => void;
     };
-    models?: {
-        /** One streaming completion on the card this app runs chat on, or
-         *  the chat role; `format` asks for JSON against a schema. A call
-         *  inside a tool body counts against the budget of the turn that
-         *  made the call. */
+    /** With `models` in `uses`. */
+    models: {
+        /** One streaming completion on the usable chat card `model` names, or
+         *  else on the card this app runs chat on, or the chat role; `format`
+         *  asks for JSON against a schema, and `options` what the card's
+         *  `options` names. A call inside a tool body counts against the
+         *  budget of the turn that made the call. */
         complete(request: CompletionRequest, signal?: AbortSignal): AsyncIterable<CompletionDelta>;
+        /** The cards of a kind, a Hugging Face task and a state, the usable
+         *  ones this app may name as `model` unless another state is named,
+         *  each with its abilities and the input of each job kind it runs, and
+         *  this app's choice of the kind, or of each kind. */
+        list(options?: {
+            kind?: ModelKind;
+            task?: string;
+            state?: CardState;
+        }): Promise<ModelList>;
+        /** The Hearthscale Servers this app may install on: this computer's
+         *  first, then each paired one, with whether each serves now. */
+        servers(): Promise<ModelServer[]>;
+        /** A search of a Server's Discover: the public Hugging Face
+         *  repositories of `task` that `search` matches, of the kinds the
+         *  runtimes there run, as that Server answers it. It reads Hugging
+         *  Face, with no token, so only inside a call a person's press
+         *  started. */
+        discover(server: string, search: HubSearch): Promise<HubRepository[]>;
+        /** One public repository, `<owner>/<name>`, as a Server's Discover
+         *  lists its files: the ones a runtime there runs whose model answers
+         *  an app's requests, each with its size, its projector choices and
+         *  the companion files it needs. Only inside a call a person's press
+         *  started. */
+        repository(server: string, repo: string): Promise<HubListing>;
+        /** Asks the person to install a model on a Hearthscale Server, on a
+         *  card at every level that names the model, its size and, for a
+         *  Server on another computer, that Server, only inside a call a
+         *  person's press started: a card a Server lists and does not hold, by
+         *  its id, or a file of a Hugging Face repository on the Server it
+         *  names, of the kind named. Answers the card the model installs as
+         *  once the person allowed it, and null where they declined; a Server
+         *  on another computer installs it once the person there approves
+         *  too. Another install of the same target while one waits is
+         *  refused. Once ready, the model becomes this app's model of its
+         *  kind, where the app names the kind and has no model of it. */
+        install(target: InstallTarget): Promise<string | null>;
+        /** A model of a Server downloads, with what has arrived, or its
+         *  download ended, with the state it left the card in. */
+        on(event: 'download', fn: (download: ModelDownload) => void): () => void;
+        /** This app's model of a kind changed: the person chose it, gave the
+         *  kind back to the default, or a model installed for this app became
+         *  it once ready; the choice as `list` answers it in `chosen`. */
+        on(event: 'chosen', fn: (choice: {
+            kind: ModelKind;
+            chosen: EffectiveModel;
+        }) => void): () => void;
         /** The chat cards an app's sessions may run on: this app's, or
          *  another app's under the `sessions.create` grant. */
         for(app?: string): Promise<ModelListing[]>;
@@ -3138,10 +5222,20 @@ interface AppContext {
          *  the reason none can: this app's, or another app's under the
          *  `sessions.create` grant. */
         effective(kind: ModelKind, app?: string): Promise<EffectiveModel>;
+        /** Opens a stream on the transcription card `model` names, or else on
+         *  the app's transcription model, which runs on a Hearthscale Server:
+         *  the sound written in goes out as text while it is spoken. Rejects
+         *  when the model is not on a Server. `words` are hint words, such as
+         *  names, for a model whose engine takes them. */
+        listen(options?: {
+            language?: string;
+            model?: string;
+            words?: string[];
+        }): Promise<Listening>;
     };
     /** With `sessions.create`: the projects of an app this one may start
      *  conversations in. */
-    projects?: {
+    projects: {
         list(app?: string): Promise<ProjectListing[]>;
     };
     /** With `catalogue`: the bus. A search reads the catalogue, never
@@ -3151,7 +5245,7 @@ interface AppContext {
      *  call, in its conversation and at its level, and ends with it; the
      *  signal cancels it earlier. A refused or failed call rejects with the
      *  words. */
-    capabilities?: {
+    capabilities: {
         search(queries: string | string[], limit?: number): Promise<string>;
         call(name: string, input?: Record<string, unknown>, options?: {
             signal?: AbortSignal;
@@ -3159,12 +5253,16 @@ interface AppContext {
     };
     /** With `readers`: a reader for a format the manifest declares under
      *  `formats`; the read tool hands it the file's bytes. */
-    readers?: {
+    readers: {
         register(format: string, read: (bytes: Uint8Array, name: string) => Promise<string> | string): () => void;
     };
-    jobs?: {
-        /** One job on the card this app runs that kind on. */
-        submit(kind: JobKind, input: JobInput): Promise<Job>;
+    /** With `jobs` in `uses`. */
+    jobs: {
+        /** One job on the card `model` names, or else on the card this app
+         *  runs the kind on, with the input the card takes for the kind; its
+         *  outputs are written into the folder `save` names, or else kept as
+         *  assets. */
+        submit(request: JobRequest): Promise<Job>;
         get(id: string): Promise<Job>;
         cancel(id: string): Promise<Job>;
         on(event: 'progress', fn: (job: Job) => void): () => void;
@@ -3173,7 +5271,7 @@ interface AppContext {
      *  room through a view of the app; a backend sends to the room's other
      *  members, hears their messages, and may leave. While the app is in a
      *  room, an event of it starts the backend when it is not up. */
-    peers?: {
+    peers: {
         list(): Promise<Room[]>;
         /** Sends `data`, at most 64 KiB as JSON, to every other
          *  member; inside a tool body, the tool is declared outbound. */
@@ -3227,4 +5325,4 @@ interface Backend {
     tools?: Record<string, ToolBody>;
 }
 
-export type { AppAnswer, AppContext, AppEvent, AppListing, AppNotice, AppQuestion, Backend, CallContext, CapabilityAnswer, ChatContentPart, ChatMessage, CompletionDelta, CompletionRequest, CompletionStop, Connection, Content, ContentBlockMeta, EffectiveModel, FetchAnswer, FetchParams, FileInput, HearthscaleHostCapability, HostSlot, HostSlotKind, HostSlotNotification, Job, JobInput, JobInputs, JobKind, Manifest, MessageOptions, ModelContextAnswer, ModelKind, ModelListing, ModelSource, Mount, MountPath, OAuthLogin, OpenedSession, Origin, PrincipalRef, ProjectListing, ResourcePath, ResourceReadOptions, ResourceVersion, Room, Run, Sampling, Session, SessionCell, SessionCreate, SessionListing, SessionProcess, SessionRoot, SessionStatus, SettingValues, SlotInsets, StopReason, Structured, SurfaceAnswer, SurfaceOp, SurfaceResult, TerminalFrame, TerminalSnapshot, ToolAnswer, ToolBody, ToolCall, ToolDefinition, ToolRun, TurnOutcome, Usage, ViewExtension, ViewExtensionCall, ViewExtensionMethod, ViewExtensionMethods, ViewExtensionNotification, ViewHostContext, ViewHostMethods, WebPageState };
+export type { AccountCredential, Alarm, AlarmFire, AlarmRequest, AppAccount, AppAnswer, AppContext, AppEvent, AppListing, AppNotice, AppQuestion, AppSkill, Backend, CallContext, CallOf, CapabilityAnswer, CaptureDevice, CaptureSource, CapturedPart, CardState, ChatContentPart, ChatMessage, CompanionOption, CompletionDelta, CompletionOptions, CompletionRequest, CompletionStop, Connection, Content, ContentBlockMeta, Controller, ControllerChange, DbChange, DbParams, DesktopContext, DeviceFire, DiscoverTask, EffectiveModel, Entry, EventFire, FetchAnswer, FetchParams, FileInput, FolderFire, Handoff, HearthscaleHostCapability, HostCall, HostSlot, HostSlotKind, HostSlotNotification, HotkeyFire, HotkeyState, HubCandidate, HubCompanion, HubInstall, HubListing, HubRepository, HubSearch, HubSort, InUseFire, IndexDocument, IndexHit, InstallTarget, Job, JobOutput, JobProgress, JobRequest, JobSpec, ListenEvent, Listener, Listening, Manifest, MediaKeyPress, MessageOptions, ModelCard, ModelContextAnswer, ModelContextOptions, ModelDownload, ModelKind, ModelList, ModelListing, ModelServer, ModelSource, Mount, MountPath, OpenedSession, Origin, OverlayAnchor, OverlayNote, PrincipalRef, ProgramFire, ProjectListing, Region, ResourcePath, ResourceReadOptions, ResourceVersion, Room, RowValue, Run, Sampling, Session, SessionCell, SessionCreate, SessionListing, SessionProcess, SessionRoot, SessionStatus, SettingValues, SlotInsets, StatementParams, StopReason, Structured, SurfaceAnswer, SurfaceOp, SurfaceResult, SystemFire, SystemState, TerminalFrame, TerminalSnapshot, TokenLogprob, ToolAnswer, ToolBody, ToolCall, ToolDefinition, ToolRun, TurnOutcome, Usage, ViewExtension, ViewExtensionMethod, ViewExtensionMethods, ViewExtensionNotification, ViewHostContext, ViewHostMethods, ViewMethods, WebPageState };