apps 0.0.1-beta.0 → 0.0.1-beta.1

package/types/apps/src/contracts/host.d.ts

@@ -1,3 +1,11 @@
+export * from "./skills.js";
+import { SkillLoadFailed, type SkillFile } from "./skills.js";
+import { ProviderError } from "./provider-error.js";
+import { McpError } from "./mcp.js";
+import { OpenapiResponseError } from "./api-response-error.js";
+export { ApiErrorResponse, OpenapiResponseError } from "./api-response-error.js";
+export { ProviderError } from "./provider-error.js";
+export { McpError } from "./mcp.js";
 import { WorkflowFailure, type WorkflowExecution, type WorkflowReplay, type WorkflowHostControls } from "./workflows.js";
 export * from "./workflows.js";
 /** Portable framework dispatch contracts. Requests never carry account bindings. */
@@ -21,8 +29,10 @@ export declare const DeclaredAuthMethod: Schema.Union<readonly [Schema.Struct<{
     readonly discover: Schema.String;
     readonly authorizationUrl: Schema.optionalKey<Schema.Never>;
     readonly tokenUrl: Schema.optionalKey<Schema.Never>;
+    readonly revocationUrl: Schema.optionalKey<Schema.Never>;
     readonly scopes: Schema.optionalKey<Schema.$Array<Schema.String>>;
     readonly grant: Schema.optionalKey<Schema.Literal<"authorization_code">>;
+    readonly authorizationParams: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
     readonly tokenEndpointAuthMethod: Schema.optionalKey<Schema.Literals<readonly ["none", "client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>>;
     readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
     readonly type: Schema.Literal<"oauth2">;
@@ -30,9 +40,12 @@ export declare const DeclaredAuthMethod: Schema.Union<readonly [Schema.Struct<{
     readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
     readonly authorizationUrl: Schema.String;
     readonly tokenUrl: Schema.String;
+    readonly revocationUrl: Schema.optionalKey<Schema.String>;
     readonly scopes: Schema.$Array<Schema.String>;
+    readonly issuer: Schema.optionalKey<Schema.String>;
     readonly discover: Schema.optionalKey<Schema.Never>;
     readonly grant: Schema.optionalKey<Schema.Literal<"authorization_code">>;
+    readonly authorizationParams: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
     readonly tokenEndpointAuthMethod: Schema.optionalKey<Schema.Literals<readonly ["none", "client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>>;
     readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
     readonly type: Schema.Literal<"oauth2">;
@@ -42,6 +55,7 @@ export declare const DeclaredAuthMethod: Schema.Union<readonly [Schema.Struct<{
     readonly discover: Schema.String;
     readonly authorizationUrl: Schema.optionalKey<Schema.Never>;
     readonly tokenUrl: Schema.optionalKey<Schema.Never>;
+    readonly revocationUrl: Schema.optionalKey<Schema.Never>;
     readonly scopes: Schema.optionalKey<Schema.$Array<Schema.String>>;
     readonly tokenEndpointAuthMethod: Schema.Literals<readonly ["client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>;
     readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
@@ -50,6 +64,7 @@ export declare const DeclaredAuthMethod: Schema.Union<readonly [Schema.Struct<{
     readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
     readonly grant: Schema.Literal<"client_credentials">;
     readonly tokenUrl: Schema.String;
+    readonly revocationUrl: Schema.optionalKey<Schema.String>;
     readonly scopes: Schema.$Array<Schema.String>;
     readonly tokenEndpointAuthMethod: Schema.Literals<readonly ["client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>;
     readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
@@ -69,8 +84,10 @@ export declare const DeclaredProvider: Schema.Struct<{
         readonly discover: Schema.String;
         readonly authorizationUrl: Schema.optionalKey<Schema.Never>;
         readonly tokenUrl: Schema.optionalKey<Schema.Never>;
+        readonly revocationUrl: Schema.optionalKey<Schema.Never>;
         readonly scopes: Schema.optionalKey<Schema.$Array<Schema.String>>;
         readonly grant: Schema.optionalKey<Schema.Literal<"authorization_code">>;
+        readonly authorizationParams: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
         readonly tokenEndpointAuthMethod: Schema.optionalKey<Schema.Literals<readonly ["none", "client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>>;
         readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
         readonly type: Schema.Literal<"oauth2">;
@@ -78,9 +95,12 @@ export declare const DeclaredProvider: Schema.Struct<{
         readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
         readonly authorizationUrl: Schema.String;
         readonly tokenUrl: Schema.String;
+        readonly revocationUrl: Schema.optionalKey<Schema.String>;
         readonly scopes: Schema.$Array<Schema.String>;
+        readonly issuer: Schema.optionalKey<Schema.String>;
         readonly discover: Schema.optionalKey<Schema.Never>;
         readonly grant: Schema.optionalKey<Schema.Literal<"authorization_code">>;
+        readonly authorizationParams: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
         readonly tokenEndpointAuthMethod: Schema.optionalKey<Schema.Literals<readonly ["none", "client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>>;
         readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
         readonly type: Schema.Literal<"oauth2">;
@@ -90,6 +110,7 @@ export declare const DeclaredProvider: Schema.Struct<{
         readonly discover: Schema.String;
         readonly authorizationUrl: Schema.optionalKey<Schema.Never>;
         readonly tokenUrl: Schema.optionalKey<Schema.Never>;
+        readonly revocationUrl: Schema.optionalKey<Schema.Never>;
         readonly scopes: Schema.optionalKey<Schema.$Array<Schema.String>>;
         readonly tokenEndpointAuthMethod: Schema.Literals<readonly ["client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>;
         readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
@@ -98,6 +119,7 @@ export declare const DeclaredProvider: Schema.Struct<{
         readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
         readonly grant: Schema.Literal<"client_credentials">;
         readonly tokenUrl: Schema.String;
+        readonly revocationUrl: Schema.optionalKey<Schema.String>;
         readonly scopes: Schema.$Array<Schema.String>;
         readonly tokenEndpointAuthMethod: Schema.Literals<readonly ["client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>;
         readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
@@ -110,6 +132,16 @@ export declare const DeclaredProvider: Schema.Struct<{
 export type DeclaredProvider = typeof DeclaredProvider.Type;
 /** Account slots available without binding accounts or evaluating the app factory. */
 export declare const DeclaredRequirements: Schema.Struct<{
+    /** Protocol support of this retained framework build, not an author-declared requirement. */
+    readonly capabilities: Schema.optionalKey<Schema.Struct<{
+        readonly skills: Schema.Literal<true>;
+        /** Accepts inspect detail and tools. Earlier builds reject both as excess fields. */
+        readonly toolIndex: Schema.optionalKey<Schema.Literal<true>>;
+        /** Accepts skills sources and reports whether the catalog includes a live loader. */
+        readonly skillSources: Schema.optionalKey<Schema.Literal<true>>;
+        /** Accepts scheduled inspection. Earlier builds reject it as an excess field. */
+        readonly scheduledTools: Schema.optionalKey<Schema.Literal<true>>;
+    }>>;
     readonly database: Schema.optionalKey<Schema.$Record<Schema.String, Schema.Struct<{
         readonly fields: Schema.$Record<Schema.String, Schema.Struct<{
             readonly kind: Schema.Literals<readonly ["string", "number", "boolean", "id", "userId"]>;
@@ -134,8 +166,10 @@ export declare const DeclaredRequirements: Schema.Struct<{
                 readonly discover: Schema.String;
                 readonly authorizationUrl: Schema.optionalKey<Schema.Never>;
                 readonly tokenUrl: Schema.optionalKey<Schema.Never>;
+                readonly revocationUrl: Schema.optionalKey<Schema.Never>;
                 readonly scopes: Schema.optionalKey<Schema.$Array<Schema.String>>;
                 readonly grant: Schema.optionalKey<Schema.Literal<"authorization_code">>;
+                readonly authorizationParams: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
                 readonly tokenEndpointAuthMethod: Schema.optionalKey<Schema.Literals<readonly ["none", "client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>>;
                 readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
                 readonly type: Schema.Literal<"oauth2">;
@@ -143,9 +177,12 @@ export declare const DeclaredRequirements: Schema.Struct<{
                 readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
                 readonly authorizationUrl: Schema.String;
                 readonly tokenUrl: Schema.String;
+                readonly revocationUrl: Schema.optionalKey<Schema.String>;
                 readonly scopes: Schema.$Array<Schema.String>;
+                readonly issuer: Schema.optionalKey<Schema.String>;
                 readonly discover: Schema.optionalKey<Schema.Never>;
                 readonly grant: Schema.optionalKey<Schema.Literal<"authorization_code">>;
+                readonly authorizationParams: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
                 readonly tokenEndpointAuthMethod: Schema.optionalKey<Schema.Literals<readonly ["none", "client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>>;
                 readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
                 readonly type: Schema.Literal<"oauth2">;
@@ -155,6 +192,7 @@ export declare const DeclaredRequirements: Schema.Struct<{
                 readonly discover: Schema.String;
                 readonly authorizationUrl: Schema.optionalKey<Schema.Never>;
                 readonly tokenUrl: Schema.optionalKey<Schema.Never>;
+                readonly revocationUrl: Schema.optionalKey<Schema.Never>;
                 readonly scopes: Schema.optionalKey<Schema.$Array<Schema.String>>;
                 readonly tokenEndpointAuthMethod: Schema.Literals<readonly ["client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>;
                 readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
@@ -163,6 +201,7 @@ export declare const DeclaredRequirements: Schema.Struct<{
                 readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
                 readonly grant: Schema.Literal<"client_credentials">;
                 readonly tokenUrl: Schema.String;
+                readonly revocationUrl: Schema.optionalKey<Schema.String>;
                 readonly scopes: Schema.$Array<Schema.String>;
                 readonly tokenEndpointAuthMethod: Schema.Literals<readonly ["client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>;
                 readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
@@ -190,8 +229,10 @@ export declare const ResolvedAccount: Schema.Struct<{
             readonly discover: Schema.String;
             readonly authorizationUrl: Schema.optionalKey<Schema.Never>;
             readonly tokenUrl: Schema.optionalKey<Schema.Never>;
+            readonly revocationUrl: Schema.optionalKey<Schema.Never>;
             readonly scopes: Schema.optionalKey<Schema.$Array<Schema.String>>;
             readonly grant: Schema.optionalKey<Schema.Literal<"authorization_code">>;
+            readonly authorizationParams: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
             readonly tokenEndpointAuthMethod: Schema.optionalKey<Schema.Literals<readonly ["none", "client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>>;
             readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
             readonly type: Schema.Literal<"oauth2">;
@@ -199,9 +240,12 @@ export declare const ResolvedAccount: Schema.Struct<{
             readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
             readonly authorizationUrl: Schema.String;
             readonly tokenUrl: Schema.String;
+            readonly revocationUrl: Schema.optionalKey<Schema.String>;
             readonly scopes: Schema.$Array<Schema.String>;
+            readonly issuer: Schema.optionalKey<Schema.String>;
             readonly discover: Schema.optionalKey<Schema.Never>;
             readonly grant: Schema.optionalKey<Schema.Literal<"authorization_code">>;
+            readonly authorizationParams: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
             readonly tokenEndpointAuthMethod: Schema.optionalKey<Schema.Literals<readonly ["none", "client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>>;
             readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
             readonly type: Schema.Literal<"oauth2">;
@@ -211,6 +255,7 @@ export declare const ResolvedAccount: Schema.Struct<{
             readonly discover: Schema.String;
             readonly authorizationUrl: Schema.optionalKey<Schema.Never>;
             readonly tokenUrl: Schema.optionalKey<Schema.Never>;
+            readonly revocationUrl: Schema.optionalKey<Schema.Never>;
             readonly scopes: Schema.optionalKey<Schema.$Array<Schema.String>>;
             readonly tokenEndpointAuthMethod: Schema.Literals<readonly ["client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>;
             readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
@@ -219,6 +264,7 @@ export declare const ResolvedAccount: Schema.Struct<{
             readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
             readonly grant: Schema.Literal<"client_credentials">;
             readonly tokenUrl: Schema.String;
+            readonly revocationUrl: Schema.optionalKey<Schema.String>;
             readonly scopes: Schema.$Array<Schema.String>;
             readonly tokenEndpointAuthMethod: Schema.Literals<readonly ["client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>;
             readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
@@ -246,8 +292,10 @@ export declare const ResolvedAccounts: Schema.$Record<Schema.NonEmptyString, Sch
             readonly discover: Schema.String;
             readonly authorizationUrl: Schema.optionalKey<Schema.Never>;
             readonly tokenUrl: Schema.optionalKey<Schema.Never>;
+            readonly revocationUrl: Schema.optionalKey<Schema.Never>;
             readonly scopes: Schema.optionalKey<Schema.$Array<Schema.String>>;
             readonly grant: Schema.optionalKey<Schema.Literal<"authorization_code">>;
+            readonly authorizationParams: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
             readonly tokenEndpointAuthMethod: Schema.optionalKey<Schema.Literals<readonly ["none", "client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>>;
             readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
             readonly type: Schema.Literal<"oauth2">;
@@ -255,9 +303,12 @@ export declare const ResolvedAccounts: Schema.$Record<Schema.NonEmptyString, Sch
             readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
             readonly authorizationUrl: Schema.String;
             readonly tokenUrl: Schema.String;
+            readonly revocationUrl: Schema.optionalKey<Schema.String>;
             readonly scopes: Schema.$Array<Schema.String>;
+            readonly issuer: Schema.optionalKey<Schema.String>;
             readonly discover: Schema.optionalKey<Schema.Never>;
             readonly grant: Schema.optionalKey<Schema.Literal<"authorization_code">>;
+            readonly authorizationParams: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
             readonly tokenEndpointAuthMethod: Schema.optionalKey<Schema.Literals<readonly ["none", "client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>>;
             readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
             readonly type: Schema.Literal<"oauth2">;
@@ -267,6 +318,7 @@ export declare const ResolvedAccounts: Schema.$Record<Schema.NonEmptyString, Sch
             readonly discover: Schema.String;
             readonly authorizationUrl: Schema.optionalKey<Schema.Never>;
             readonly tokenUrl: Schema.optionalKey<Schema.Never>;
+            readonly revocationUrl: Schema.optionalKey<Schema.Never>;
             readonly scopes: Schema.optionalKey<Schema.$Array<Schema.String>>;
             readonly tokenEndpointAuthMethod: Schema.Literals<readonly ["client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>;
             readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
@@ -275,6 +327,7 @@ export declare const ResolvedAccounts: Schema.$Record<Schema.NonEmptyString, Sch
             readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
             readonly grant: Schema.Literal<"client_credentials">;
             readonly tokenUrl: Schema.String;
+            readonly revocationUrl: Schema.optionalKey<Schema.String>;
             readonly scopes: Schema.$Array<Schema.String>;
             readonly tokenEndpointAuthMethod: Schema.Literals<readonly ["client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>;
             readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
@@ -298,8 +351,10 @@ export declare const ResolvedAccounts: Schema.$Record<Schema.NonEmptyString, Sch
             readonly discover: Schema.String;
             readonly authorizationUrl: Schema.optionalKey<Schema.Never>;
             readonly tokenUrl: Schema.optionalKey<Schema.Never>;
+            readonly revocationUrl: Schema.optionalKey<Schema.Never>;
             readonly scopes: Schema.optionalKey<Schema.$Array<Schema.String>>;
             readonly grant: Schema.optionalKey<Schema.Literal<"authorization_code">>;
+            readonly authorizationParams: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
             readonly tokenEndpointAuthMethod: Schema.optionalKey<Schema.Literals<readonly ["none", "client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>>;
             readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
             readonly type: Schema.Literal<"oauth2">;
@@ -307,9 +362,12 @@ export declare const ResolvedAccounts: Schema.$Record<Schema.NonEmptyString, Sch
             readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
             readonly authorizationUrl: Schema.String;
             readonly tokenUrl: Schema.String;
+            readonly revocationUrl: Schema.optionalKey<Schema.String>;
             readonly scopes: Schema.$Array<Schema.String>;
+            readonly issuer: Schema.optionalKey<Schema.String>;
             readonly discover: Schema.optionalKey<Schema.Never>;
             readonly grant: Schema.optionalKey<Schema.Literal<"authorization_code">>;
+            readonly authorizationParams: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
             readonly tokenEndpointAuthMethod: Schema.optionalKey<Schema.Literals<readonly ["none", "client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>>;
             readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
             readonly type: Schema.Literal<"oauth2">;
@@ -319,6 +377,7 @@ export declare const ResolvedAccounts: Schema.$Record<Schema.NonEmptyString, Sch
             readonly discover: Schema.String;
             readonly authorizationUrl: Schema.optionalKey<Schema.Never>;
             readonly tokenUrl: Schema.optionalKey<Schema.Never>;
+            readonly revocationUrl: Schema.optionalKey<Schema.Never>;
             readonly scopes: Schema.optionalKey<Schema.$Array<Schema.String>>;
             readonly tokenEndpointAuthMethod: Schema.Literals<readonly ["client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>;
             readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
@@ -327,6 +386,7 @@ export declare const ResolvedAccounts: Schema.$Record<Schema.NonEmptyString, Sch
             readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
             readonly grant: Schema.Literal<"client_credentials">;
             readonly tokenUrl: Schema.String;
+            readonly revocationUrl: Schema.optionalKey<Schema.String>;
             readonly scopes: Schema.$Array<Schema.String>;
             readonly tokenEndpointAuthMethod: Schema.Literals<readonly ["client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>;
             readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
@@ -348,8 +408,16 @@ export declare const TrustedToolApproval: Schema.Struct<{
     readonly input: Schema.Codec<Schema.Json, Schema.Json, never, never>;
 }>;
 export type TrustedToolApproval = typeof TrustedToolApproval.Type;
+/** Absolute Unix time in milliseconds; remote hosts enforce it inside the operation transaction. */
+export declare const InvocationDeadline: Schema.Finite;
 /** Trusted invocation context, supplied separately from the Request. */
 export interface HostContext {
+    /** Trusted host deadline; never accepted in public operation JSON. */
+    readonly deadline?: typeof InvocationDeadline.Type;
+    /** Host-owned cache storage and refresh lifetime, separate from app database transactions. */
+    readonly cache?: import("./cache.js").HostCache;
+    /** Packaged app text files supplied by the build bridge. Direct hosts may omit them for an empty package. */
+    readonly files?: readonly SkillFile[];
     /** Private delivery capability. It is never accepted in public request JSON or stored in a build. */
     readonly workflowControls?: WorkflowHostControls;
     readonly workflow?: WorkflowExecution;
@@ -394,6 +462,112 @@ export declare const HostedTool: Schema.Struct<{
 }>;
 /** Parsed live tool description. */
 export type HostedTool = typeof HostedTool.Type;
+/** Catalog entry without schemas. Browsing lists these and reads one full tool on selection. */
+export declare const HostedToolSummary: Schema.Struct<{
+    readonly schedules: Schema.optionalKey<Schema.$Array<Schema.Struct<{
+        readonly name: Schema.NonEmptyString;
+        readonly timing: Schema.Union<readonly [Schema.Struct<{
+            readonly kind: Schema.Literal<"interval">;
+            readonly milliseconds: Schema.Int;
+        }>, Schema.Struct<{
+            readonly kind: Schema.Literal<"cron">;
+            readonly calendar: Schema.Struct<{
+                readonly expression: Schema.NonEmptyString;
+                readonly timezone: Schema.NonEmptyString;
+            }>;
+        }>]>;
+        readonly input: Schema.Codec<Schema.Json, Schema.Json, never, never>;
+    }>>>;
+    readonly name: Schema.NonEmptyString;
+    readonly description: Schema.String;
+    readonly readOnly: Schema.optionalKey<Schema.Boolean>;
+    readonly title: Schema.optionalKey<Schema.String>;
+    readonly annotations: Schema.optionalKey<Schema.Struct<{
+        readonly title: Schema.optionalKey<Schema.String>;
+        readonly readOnlyHint: Schema.optionalKey<Schema.Boolean>;
+        readonly destructiveHint: Schema.optionalKey<Schema.Boolean>;
+        readonly idempotentHint: Schema.optionalKey<Schema.Boolean>;
+        readonly openWorldHint: Schema.optionalKey<Schema.Boolean>;
+    }>>;
+}>;
+export type HostedToolSummary = typeof HostedToolSummary.Type;
+/**
+ * A skill catalog and whether any of it came from `dynamicSkills`. Without a live loader the
+ * catalog is determined by the build and its evaluation inputs; with one it reflects a publisher.
+ */
+export declare const SkillSources: Schema.Struct<{
+    readonly skills: Schema.$Array<Schema.Struct<{
+        readonly files: Schema.$Array<Schema.Struct<{
+            readonly path: Schema.NonEmptyString;
+            readonly content: Schema.String;
+        }>>;
+        readonly name: Schema.NonEmptyString;
+        readonly description: Schema.String;
+        readonly license: Schema.optionalKey<Schema.String>;
+        readonly compatibility: Schema.optionalKey<Schema.String>;
+        readonly metadata: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
+        readonly "allowed-tools": Schema.optionalKey<Schema.String>;
+    }>>;
+    readonly dynamic: Schema.Boolean;
+}>;
+export type SkillSources = typeof SkillSources.Type;
+/** Skill commands. Send sources only to builds that declare skillSources. */
+export declare const skillsCommand: (sources: boolean) => {
+    readonly operation: "skills";
+    readonly sources: true;
+} | {
+    readonly operation: "skills";
+    readonly sources?: never;
+};
+/** Either response shape; `dynamic` is unknown for builds that predate skillSources. */
+export declare const SkillCatalogResponse: Schema.Union<readonly [Schema.Struct<{
+    readonly skills: Schema.$Array<Schema.Struct<{
+        readonly files: Schema.$Array<Schema.Struct<{
+            readonly path: Schema.NonEmptyString;
+            readonly content: Schema.String;
+        }>>;
+        readonly name: Schema.NonEmptyString;
+        readonly description: Schema.String;
+        readonly license: Schema.optionalKey<Schema.String>;
+        readonly compatibility: Schema.optionalKey<Schema.String>;
+        readonly metadata: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
+        readonly "allowed-tools": Schema.optionalKey<Schema.String>;
+    }>>;
+    readonly dynamic: Schema.Boolean;
+}>, Schema.$Array<Schema.Struct<{
+    readonly files: Schema.$Array<Schema.Struct<{
+        readonly path: Schema.NonEmptyString;
+        readonly content: Schema.String;
+    }>>;
+    readonly name: Schema.NonEmptyString;
+    readonly description: Schema.String;
+    readonly license: Schema.optionalKey<Schema.String>;
+    readonly compatibility: Schema.optionalKey<Schema.String>;
+    readonly metadata: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
+    readonly "allowed-tools": Schema.optionalKey<Schema.String>;
+}>>]>;
+export interface SkillCatalog {
+    readonly skills: SkillSources["skills"];
+    readonly dynamic?: boolean;
+}
+export declare const skillCatalog: (response: typeof SkillCatalogResponse.Type) => SkillCatalog;
+/**
+ * Inspection commands. Send detail or tools only to builds that declare toolIndex,
+ * and scheduled only to builds that declare scheduledTools.
+ */
+export declare const inspectCommand: (tools?: readonly string[], scheduled?: true) => {
+    scheduled?: true;
+    tools?: string[];
+    operation: "inspect";
+};
+export declare const indexCommand: {
+    readonly operation: "inspect";
+    readonly detail: "summary";
+};
+/** Keep only the requested tools from an inspection that may have described every tool. */
+export declare const selectTools: (tools?: readonly string[]) => <A extends {
+    readonly name: string;
+}>(all: readonly A[]) => readonly A[];
 /** Framework-owned dispatch, independent of app-authored HTTP routing. */
 export declare const HostRequest: Schema.Union<readonly [Schema.Union<readonly [Schema.Struct<{
     readonly operation: Schema.Literal<"workflows">;
@@ -460,6 +634,19 @@ export declare const HostRequest: Schema.Union<readonly [Schema.Union<readonly [
     readonly operation: Schema.Literal<"requirements">;
 }>, Schema.Struct<{
     readonly operation: Schema.Literal<"inspect">;
+    /** Omit schemas. Only builds that declare the toolIndex capability accept this. */
+    readonly detail: Schema.optionalKey<Schema.Literal<"summary">>;
+    /** Describe only these tools. Only builds that declare the toolIndex capability accept this. */
+    readonly tools: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+    /**
+     * Describe only declared operations that have schedules, without dynamic tool discovery.
+     * Only builds that declare the scheduledTools capability accept this.
+     */
+    readonly scheduled: Schema.optionalKey<Schema.Literal<true>>;
+}>, Schema.Struct<{
+    readonly operation: Schema.Literal<"skills">;
+    /** Answer with SkillSources. Only builds that declare the skillSources capability accept this. */
+    readonly sources: Schema.optionalKey<Schema.Literal<true>>;
 }>, Schema.Struct<{
     readonly operation: Schema.Literal<"query">;
     readonly name: Schema.NonEmptyString;
@@ -503,8 +690,14 @@ declare const HostToolNotFound_base: Schema.Class<HostToolNotFound, Schema.Tagge
 /** The freshly evaluated catalog did not contain the requested tool. */
 export declare class HostToolNotFound extends HostToolNotFound_base {
 }
-declare const HostInputInvalid_base: Schema.Class<HostInputInvalid, Schema.TaggedStruct<"HostInputInvalid", {}>, import("effect/Cause").YieldableError>;
-/** Native input decoding failed; supplied values are omitted. */
+/** One failing input location and its expected shape; never the supplied value. */
+export declare const InputProblem: Schema.String;
+/** Input decoding reports at most this many problems. */
+export declare const maxInputProblems = 10;
+declare const HostInputInvalid_base: Schema.Class<HostInputInvalid, Schema.TaggedStruct<"HostInputInvalid", {
+    readonly problems: Schema.optionalKey<Schema.$Array<Schema.String>>;
+}>, import("effect/Cause").YieldableError>;
+/** Native input decoding failed; supplied values are omitted. Builds before problems were reported send none. */
 export declare class HostInputInvalid extends HostInputInvalid_base {
 }
 declare const HostToolBlocked_base: Schema.Class<HostToolBlocked, Schema.TaggedStruct<"HostToolBlocked", {}>, import("effect/Cause").YieldableError>;
@@ -537,13 +730,13 @@ export declare class HostOutputInvalid extends HostOutputInvalid_base {
 /** Declaration reads do not bind accounts or evaluate the app factory. */
 export declare const HostRequirementsError: Schema.Union<readonly [typeof HostRequestInvalid, typeof HostDeclarationInvalid]>;
 /** Inspection can fail while binding accounts or evaluating the live definition. */
-export declare const HostInspectError: Schema.Union<readonly [typeof HostRequestInvalid, typeof HostDeclarationInvalid, typeof HostAccountsInvalid, typeof HostEvaluationFailed]>;
+export declare const HostInspectError: Schema.Union<readonly [typeof ProviderError, typeof McpError, typeof SkillLoadFailed, typeof HostRequestInvalid, typeof HostDeclarationInvalid, typeof HostAccountsInvalid, typeof HostEvaluationFailed]>;
 /** Tool invocation adds lookup, input, execution and output failures to inspection. */
-export declare const HostCallError: Schema.Union<readonly [typeof WorkflowFailure, Schema.Union<readonly [typeof HostRequestInvalid, typeof HostDeclarationInvalid, typeof HostAccountsInvalid, typeof HostEvaluationFailed]>, typeof HostToolNotFound, typeof HostOperationNotFound, typeof HostOperationFailed, typeof HostInputInvalid, typeof HostOutputInvalid, typeof HostToolBlocked, typeof HostToolApprovalRequired, typeof HostToolPolicyFailed, typeof ElicitationFailed]>;
+export declare const HostCallError: Schema.Union<readonly [typeof OpenapiResponseError, typeof WorkflowFailure, Schema.Union<readonly [typeof ProviderError, typeof McpError, typeof SkillLoadFailed, typeof HostRequestInvalid, typeof HostDeclarationInvalid, typeof HostAccountsInvalid, typeof HostEvaluationFailed]>, typeof HostToolNotFound, typeof HostOperationNotFound, typeof HostOperationFailed, typeof HostInputInvalid, typeof HostOutputInvalid, typeof HostToolBlocked, typeof HostToolApprovalRequired, typeof HostToolPolicyFailed, typeof ElicitationFailed]>;
 /** Queries, mutations and agent calls use the same operation failures. */
-export declare const HostDataError: Schema.Union<readonly [typeof WorkflowFailure, Schema.Union<readonly [typeof HostRequestInvalid, typeof HostDeclarationInvalid, typeof HostAccountsInvalid, typeof HostEvaluationFailed]>, typeof HostToolNotFound, typeof HostOperationNotFound, typeof HostOperationFailed, typeof HostInputInvalid, typeof HostOutputInvalid, typeof HostToolBlocked, typeof HostToolApprovalRequired, typeof HostToolPolicyFailed, typeof ElicitationFailed]>;
+export declare const HostDataError: Schema.Union<readonly [typeof OpenapiResponseError, typeof WorkflowFailure, Schema.Union<readonly [typeof ProviderError, typeof McpError, typeof SkillLoadFailed, typeof HostRequestInvalid, typeof HostDeclarationInvalid, typeof HostAccountsInvalid, typeof HostEvaluationFailed]>, typeof HostToolNotFound, typeof HostOperationNotFound, typeof HostOperationFailed, typeof HostInputInvalid, typeof HostOutputInvalid, typeof HostToolBlocked, typeof HostToolApprovalRequired, typeof HostToolPolicyFailed, typeof ElicitationFailed]>;
 /** Safe error envelope; no author exception, source, account fields or stack is serialized. */
-export declare const HostError: Schema.Union<readonly [typeof WorkflowFailure, typeof HostRequestInvalid, typeof HostAccountsInvalid, typeof HostDeclarationInvalid, typeof HostEvaluationFailed, typeof HostOperationNotFound, typeof HostOperationFailed, typeof HostToolNotFound, typeof HostInputInvalid, typeof HostOutputInvalid, typeof HostToolBlocked, typeof HostToolApprovalRequired, typeof HostToolPolicyFailed, typeof ElicitationFailed]>;
+export declare const HostError: Schema.Union<readonly [typeof OpenapiResponseError, typeof ProviderError, typeof McpError, typeof SkillLoadFailed, typeof WorkflowFailure, typeof HostRequestInvalid, typeof HostAccountsInvalid, typeof HostDeclarationInvalid, typeof HostEvaluationFailed, typeof HostOperationNotFound, typeof HostOperationFailed, typeof HostToolNotFound, typeof HostInputInvalid, typeof HostOutputInvalid, typeof HostToolBlocked, typeof HostToolApprovalRequired, typeof HostToolPolicyFailed, typeof ElicitationFailed]>;
 /** Expected host failures. */
 export type HostError = typeof HostError.Type;
 /** Invocation-owned outcome sink. Framework adapters report semantic failures
@@ -558,7 +751,7 @@ export declare const HostResponse: Schema.Union<readonly [Schema.Struct<{
     readonly toolError: Schema.optionalKey<Schema.Literal<true>>;
 }>, Schema.Struct<{
     readonly ok: Schema.Literal<false>;
-    readonly error: Schema.Union<readonly [typeof WorkflowFailure, typeof HostRequestInvalid, typeof HostAccountsInvalid, typeof HostDeclarationInvalid, typeof HostEvaluationFailed, typeof HostOperationNotFound, typeof HostOperationFailed, typeof HostToolNotFound, typeof HostInputInvalid, typeof HostOutputInvalid, typeof HostToolBlocked, typeof HostToolApprovalRequired, typeof HostToolPolicyFailed, typeof ElicitationFailed]>;
+    readonly error: Schema.Union<readonly [typeof OpenapiResponseError, typeof ProviderError, typeof McpError, typeof SkillLoadFailed, typeof WorkflowFailure, typeof HostRequestInvalid, typeof HostAccountsInvalid, typeof HostDeclarationInvalid, typeof HostEvaluationFailed, typeof HostOperationNotFound, typeof HostOperationFailed, typeof HostToolNotFound, typeof HostInputInvalid, typeof HostOutputInvalid, typeof HostToolBlocked, typeof HostToolApprovalRequired, typeof HostToolPolicyFailed, typeof ElicitationFailed]>;
 }>]>;
 /** Parsed response envelope. */
 export type HostResponse = typeof HostResponse.Type;

package/types/apps/src/contracts/mcp.d.ts

@@ -1,3 +1,4 @@
+import type { ProviderError } from "./provider-error.js";
 /** MCP protocol data uses Effect Schema; executable tool methods use Effect. */
 import { type Effect, type Redacted, Schema } from "effect";
 import type { Elicit, ElicitationFailed } from "./elicitation.js";
@@ -24,6 +25,7 @@ export declare const mcpSdkTimerCeilingMs = 2147483647;
 /** Server and headers for this selected account. Headers are a credential snapshot. */
 export declare const McpToolsOptions: Schema.Struct<{
     readonly url: Schema.String;
+    readonly accountId: Schema.optional<Schema.brand<Schema.String, "acc">>;
     readonly headers: Schema.optional<Schema.$Record<Schema.String, Schema.String>>;
     readonly signal: Schema.optional<Schema.instanceOf<AbortSignal, AbortSignal>>;
     readonly timeoutMs: Schema.optional<Schema.Number>;
@@ -70,7 +72,7 @@ export interface McpTool extends McpToolMetadata {
     readonly description: string;
     readonly input: Schema.Decoder<JsonValue>;
     readonly readOnly?: boolean;
-    readonly run: (context: McpToolContext, input: JsonValue) => Effect.Effect<McpToolResult, McpError | ElicitationFailed>;
+    readonly run: (context: McpToolContext, input: JsonValue) => Effect.Effect<McpToolResult, McpError | ProviderError | ElicitationFailed>;
 }
 /** The discovered catalog keyed by remote tool name. */
 export type McpTools = Readonly<Record<string, McpTool>>;

package/types/apps/src/contracts/openapi-compile.d.ts

@@ -0,0 +1,11 @@
+/** Shared OpenAPI compilation diagnostics. */
+import { Schema } from "effect";
+export declare const OpenapiCompileErrorCode: Schema.Literals<readonly ["server_protocol", "server_url", "external_reference", "circular_reference", "schema_keyword", "schema_reference", "missing_component", "openapi_version", "auth_helper", "auth_missing", "operation_path", "duplicate_operation", "server_missing", "multiple_hosts", "parameter_encoding", "parameter_style", "request_body", "combined_oauth", "auth_method", "input_schema", "no_operations", "no_supported_operations", "invalid_document", "source_generation", "authoring_reference"]>;
+declare const OpenapiCompileError_base: Schema.Class<OpenapiCompileError, Schema.TaggedStruct<"OpenapiCompileError", {
+    readonly code: Schema.Literals<readonly ["server_protocol", "server_url", "external_reference", "circular_reference", "schema_keyword", "schema_reference", "missing_component", "openapi_version", "auth_helper", "auth_missing", "operation_path", "duplicate_operation", "server_missing", "multiple_hosts", "parameter_encoding", "parameter_style", "request_body", "combined_oauth", "auth_method", "input_schema", "no_operations", "no_supported_operations", "invalid_document", "source_generation", "authoring_reference"]>;
+    readonly reason: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/** A safe generation failure, translated into product HTTP errors at the boundary. */
+export declare class OpenapiCompileError extends OpenapiCompileError_base {
+}
+export {};

package/types/apps/src/contracts/openapi-document.d.ts

@@ -0,0 +1,53 @@
+/** OpenAPI boundary parsing. Unsupported transport/auth features fail before deployment. */
+import { Schema } from "effect";
+/** Parsed OpenAPI 3 source; individual operation references are resolved separately. */
+export declare const Specification: Schema.Struct<{
+    readonly openapi: Schema.String;
+    readonly servers: Schema.optionalKey<Schema.$Array<Schema.Struct<{
+        readonly url: Schema.String;
+        readonly variables: Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
+    }>>>;
+    readonly paths: Schema.$Record<Schema.String, Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
+    readonly components: Schema.optionalKey<Schema.Struct<{
+        readonly schemas: Schema.optionalKey<Schema.$Record<Schema.String, Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>>;
+        readonly securitySchemes: Schema.optionalKey<Schema.$Record<Schema.String, Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>>;
+    }>>;
+    readonly security: Schema.optionalKey<Schema.$Array<Schema.$Record<Schema.String, Schema.$Array<Schema.String>>>>;
+}>;
+export type Specification = typeof Specification.Type;
+export { OpenapiParameter as Parameter, OpenapiRequestBody as RequestBody } from "./openapi.js";
+/** Operation transport details. We never interpolate upstream executable code. */
+export declare const Operation: Schema.Struct<{
+    readonly operationId: Schema.optionalKey<Schema.String>;
+    readonly responses: Schema.optionalKey<Schema.$Record<Schema.String, Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>>;
+    readonly summary: Schema.optionalKey<Schema.String>;
+    readonly description: Schema.optionalKey<Schema.String>;
+    readonly parameters: Schema.optionalKey<Schema.$Array<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>>;
+    readonly requestBody: Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
+    readonly security: Schema.optionalKey<Schema.$Array<Schema.$Record<Schema.String, Schema.$Array<Schema.String>>>>;
+    readonly servers: Schema.optionalKey<Schema.$Array<Schema.Struct<{
+        readonly url: Schema.String;
+        readonly variables: Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
+    }>>>;
+}>;
+export type Operation = typeof Operation.Type;
+import type { CredentialBinding } from "./openapi.js";
+export type { OpenapiOperation as GeneratedOperation, CredentialBinding } from "./openapi.js";
+/** A secrets method can satisfy an AND-set of OpenAPI security schemes. */
+export interface GeneratedSecrets {
+    readonly name: string;
+    readonly label: string;
+    readonly bindings: readonly CredentialBinding[];
+}
+/** Import hints after product catalog overrides have been applied. */
+export interface OpenApiImport {
+    readonly name: string;
+    readonly connectUrl?: string | undefined;
+    /** Prefer protected-resource discovery when the API supports dynamic OAuth client registration. */
+    readonly oauthDiscoveryUrl?: string | undefined;
+    readonly auth?: {
+        readonly kind: string;
+        readonly header?: string | undefined;
+    } | undefined;
+    readonly scopes?: readonly string[] | undefined;
+}