apps 0.0.1-beta.0

package/types/apps/src/implementation/elicitation.d.ts

@@ -0,0 +1,103 @@
+/** Validate both sides of a tool's form and bind delivery to its invocation lifetime. */
+import { Effect, Schema } from "effect";
+import { ElicitationFailed, type ElicitationHandler, type Elicit } from "../contracts/elicitation.js";
+/** Parse a form and retain its response parser, so invalid answers can be rejected before consuming a host continuation. */
+export declare const prepareElicitation: (input: unknown) => Effect.Effect<{
+    request: {
+        readonly message: string;
+        readonly mode: "form";
+        readonly requestedSchema: {
+            readonly properties: {
+                readonly [x: string]: {
+                    readonly type: "string";
+                    readonly enum: readonly string[];
+                    readonly default?: string;
+                    readonly title?: string;
+                    readonly description?: string;
+                    readonly enumNames?: readonly string[];
+                } | {
+                    readonly type: "string";
+                    readonly enum: readonly string[];
+                    readonly default?: string;
+                    readonly title?: string;
+                    readonly description?: string;
+                } | {
+                    readonly oneOf: readonly {
+                        readonly const: string;
+                        readonly title: string;
+                    }[];
+                    readonly type: "string";
+                    readonly default?: string;
+                    readonly title?: string;
+                    readonly description?: string;
+                } | {
+                    readonly items: {
+                        readonly type: "string";
+                        readonly enum: readonly string[];
+                    };
+                    readonly type: "array";
+                    readonly default?: readonly string[];
+                    readonly title?: string;
+                    readonly description?: string;
+                    readonly minItems?: number;
+                    readonly maxItems?: number;
+                } | {
+                    readonly items: {
+                        readonly anyOf: readonly {
+                            readonly const: string;
+                            readonly title: string;
+                        }[];
+                    };
+                    readonly type: "array";
+                    readonly default?: readonly string[];
+                    readonly title?: string;
+                    readonly description?: string;
+                    readonly minItems?: number;
+                    readonly maxItems?: number;
+                } | {
+                    readonly type: "string";
+                    readonly default?: string;
+                    readonly format?: "email" | "uri" | "date" | "date-time";
+                    readonly title?: string;
+                    readonly description?: string;
+                    readonly minLength?: number;
+                    readonly maxLength?: number;
+                } | {
+                    readonly type: "number" | "integer";
+                    readonly default?: number;
+                    readonly title?: string;
+                    readonly description?: string;
+                    readonly minimum?: number;
+                    readonly maximum?: number;
+                } | {
+                    readonly type: "boolean";
+                    readonly default?: boolean;
+                    readonly title?: string;
+                    readonly description?: string;
+                };
+            };
+            readonly type: "object";
+            readonly required?: readonly string[];
+            readonly $schema?: string;
+        };
+        readonly _meta?: {
+            readonly [x: string]: Schema.Json;
+        } | undefined;
+    };
+    respond: (input: unknown) => Effect.Effect<{
+        readonly action: "cancel" | "decline";
+        readonly _meta?: {
+            readonly [x: string]: Schema.Json;
+        } | undefined;
+    } | {
+        content: {
+            readonly [x: string]: string | number | boolean | readonly string[];
+        };
+        action: "accept";
+        _meta?: {
+            readonly [x: string]: Schema.Json;
+        } | undefined;
+    }, ElicitationFailed, never>;
+}, ElicitationFailed, never>;
+/** Bind a validated interaction to the live invocation; transport adapters share its form parser. */
+export declare const makeElicit: (handler: ElicitationHandler | undefined, signal: AbortSignal) => Elicit;

package/types/apps/src/implementation/graphql.d.ts

@@ -0,0 +1,5 @@
+/** Discover GraphQL tools live; transport, decoding and cancellation stay in Effect. */
+import { Effect } from "effect";
+import { GraphqlError, GraphqlToolsOptions, type GraphqlTools } from "../contracts/graphql.js";
+/** Resolve schema and calls per account evaluation; never cache credentials or tools globally. */
+export declare const graphqlToolsEffect: (input: GraphqlToolsOptions) => Effect.Effect<GraphqlTools, GraphqlError>;

package/types/apps/src/implementation/host.d.ts

@@ -0,0 +1,3 @@
+import { type AppHandler } from "../contracts/host.js";
+/** Construct a lazy native handler; requirements never evaluate the app factory. */
+export declare const createAppHandler: (app: unknown) => AppHandler;

package/types/apps/src/implementation/http.d.ts

@@ -0,0 +1,5 @@
+/** Effect-native decoding; fetch adaptation happens at the author boundary. */
+import { Effect, type Schema } from "effect";
+import { type JsonResponse, ResponseDecodeError, ResponseStatusError } from "../contracts/http.js";
+/** Reject unsuccessful status before reading the body, then parse without leaking its contents. */
+export declare const decodeJson: <T>(response: JsonResponse, schema: Schema.Decoder<T>) => Effect.Effect<T, ResponseStatusError | ResponseDecodeError>;

package/types/apps/src/implementation/live.d.ts

@@ -0,0 +1,18 @@
+import { Atom } from "effect/unstable/reactivity";
+import { AppQueryFailed, type OperationReference, type QueryTransport } from "../contracts/live.js";
+import type { Operation } from "./operations.js";
+import { type Schema } from "./schema.js";
+type InputOf<OperationType> = OperationType extends Operation<infer Input, infer _Output, infer _Kind, infer _Context> ? Input : never;
+type OutputOf<OperationType> = OperationType extends Operation<infer _Input, infer Output, infer _Kind, infer _Context> ? Output : never;
+/** Make a query reference using a type-only server import. No handler is passed or bundled. */
+export declare const queryReference: <Query>(name: Query extends Operation<infer _Input, infer _Output, "query", infer _Context> ? string : never) => OperationReference<InputOf<Query>, OutputOf<Query>, "query">;
+/** Make a mutation reference using a type-only server import. */
+export declare const mutationReference: <Mutation>(name: Mutation extends Operation<infer _Input, infer _Output, "mutation", infer _Context> ? string : never) => OperationReference<InputOf<Mutation>, OutputOf<Mutation>, "mutation">;
+/** Subscribe for the atom's mounted lifetime and parse every result using a shared output schema.
+ * The host supplies routing, authentication and reconnection behavior through transport.
+ */
+export declare const liveQueryAtom: <Input, Output>(reference: OperationReference<Input, Output, "query">, input: NoInfer<Input>, options: {
+    readonly output: Schema<NoInfer<Output>, boolean>;
+    readonly transport: QueryTransport;
+}) => Atom.Atom<import("effect/unstable/reactivity/AsyncResult").AsyncResult<NoInfer<Output>, import("effect/Cause").NoSuchElementError | AppQueryFailed>>;
+export {};

package/types/apps/src/implementation/mcp-call.d.ts

@@ -0,0 +1,19 @@
+/** One upstream call, with form requests forwarded to the invocation's existing elicitation capability. */
+import type { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import { Effect, Schema } from "effect";
+import { ElicitationFailed } from "../contracts/elicitation.js";
+import { McpError, type McpToolContext } from "../contracts/mcp.js";
+import type { JsonObject } from "../contracts/schema.js";
+/** Register prompts only around tools/call, preserve metadata, and close every callback with the call. Never retries. */
+export declare const mcpCall: (client: Client, name: string, input: JsonObject, context: McpToolContext, timeoutMs: number, failure: (phase: McpError["phase"], error: unknown) => McpError) => Effect.Effect<{
+    readonly content: readonly {
+        readonly [x: string]: Schema.Json;
+    }[];
+    readonly _meta?: {
+        readonly [x: string]: Schema.Json;
+    } | undefined;
+    readonly structuredContent?: {
+        readonly [x: string]: Schema.Json;
+    } | undefined;
+    readonly isError?: boolean | undefined;
+}, ElicitationFailed | McpError, never>;

package/types/apps/src/implementation/mcp-client.d.ts

@@ -0,0 +1,50 @@
+/** Shared MCP pagination, wire parsing and calls. Transport owns connection lifetime. */
+import type { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import type { jsonSchemaValidator } from "@modelcontextprotocol/sdk/validation/types.js";
+import { Effect, Schema } from "effect";
+import { McpError, type McpToolContext } from "../contracts/mcp.js";
+import type { JsonObject } from "../effect.js";
+/** Use the framework-owned interpreter at the MCP SDK's synchronous validation boundary. */
+export declare const mcpJsonSchemaValidator: jsonSchemaValidator;
+/** An operation owns its connection; it must close even when interrupted. */
+export interface WithMcpClient {
+    <A, E>(mode: "discover" | "call", use: (client: Client) => Effect.Effect<A, E>): Effect.Effect<A, E | McpError>;
+}
+/** Shared client operations never cache catalogs or account credentials. */
+export declare function mcpClient(withClient: WithMcpClient, timeoutMs: number, failure: (phase: McpError["phase"], error: unknown) => McpError): {
+    list: Effect.Effect<{
+        readonly name: string;
+        readonly inputSchema: {
+            readonly [x: string]: Schema.Json;
+        };
+        readonly _meta?: {
+            readonly [x: string]: Schema.Json;
+        } | undefined;
+        readonly title?: string | undefined;
+        readonly description?: string | undefined;
+        readonly annotations?: {
+            readonly title?: string;
+            readonly readOnlyHint?: boolean;
+            readonly destructiveHint?: boolean;
+            readonly idempotentHint?: boolean;
+            readonly openWorldHint?: boolean;
+        } | undefined;
+        readonly outputSchema?: {
+            readonly [x: string]: Schema.Json;
+        } | undefined;
+    }[], McpError, never>;
+    call: (name: string, input: JsonObject, context: McpToolContext) => Effect.Effect<{
+        readonly content: readonly {
+            readonly [x: string]: Schema.Json;
+        }[];
+        readonly _meta?: {
+            readonly [x: string]: Schema.Json;
+        } | undefined;
+        readonly structuredContent?: {
+            readonly [x: string]: Schema.Json;
+        } | undefined;
+        readonly isError?: boolean | undefined;
+    }, import("../index.js").ElicitationFailed | McpError, never>;
+};
+/** Transport-independent operations consumed by the app tool adapter. */
+export type McpClient = ReturnType<typeof mcpClient>;

package/types/apps/src/implementation/mcp-stdio.d.ts

@@ -0,0 +1,4 @@
+import { Effect } from "effect";
+import { McpError, ProcessConfig } from "../contracts/mcp.js";
+/** Each discovery/call owns and closes its subprocess. Deployment never starts it. */
+export declare const stdioToolsEffect: (input: ProcessConfig) => Effect.Effect<Readonly<Record<string, import("../contracts/mcp.js").McpTool>>, McpError, never>;

package/types/apps/src/implementation/mcp-tools.d.ts

@@ -0,0 +1,6 @@
+/** Adapt any MCP transport into ordinary tools with shared validation behavior. */
+import { Effect } from "effect";
+import { McpError, type McpTools } from "../contracts/mcp.js";
+import type { McpClient } from "./mcp-client.js";
+/** Evaluate fresh metadata for the account bound to this client. */
+export declare const adaptMcpTools: (client: McpClient) => Effect.Effect<McpTools, McpError>;

package/types/apps/src/implementation/mcp.d.ts

@@ -0,0 +1,4 @@
+import { Effect } from "effect";
+import { McpError, McpToolsOptions } from "../contracts/mcp.js";
+/** Discover and call with a fresh selected-account transport for each operation. */
+export declare const mcpToolsEffect: (input: McpToolsOptions) => Effect.Effect<Readonly<Record<string, import("../contracts/mcp.js").McpTool>>, McpError, never>;

package/types/apps/src/implementation/openapi-request.d.ts

@@ -0,0 +1,11 @@
+/** HTTP serialization for normalized OpenAPI operations. */
+import { Effect, Schema } from "effect";
+import { OpenapiError, type CredentialBinding, type OpenapiOperation, type OpenapiAccount } from "../contracts/openapi.js";
+/** Create request helpers from credential-free generated authentication metadata. */
+export declare function createRequest(config: {
+    readonly methods: Readonly<Record<string, readonly CredentialBinding[]>>;
+    readonly oauth: readonly string[];
+}): {
+    available: (op: OpenapiOperation, method: string | undefined) => boolean;
+    call: (op: OpenapiOperation, input: unknown, account: OpenapiAccount | undefined) => Effect.Effect<Schema.Json, OpenapiError, never>;
+};

package/types/apps/src/implementation/openapi.d.ts

@@ -0,0 +1,5 @@
+/** Evaluate normalized metadata into ordinary tools, with account-specific security filtering. */
+import { Effect } from "effect";
+import { OpenapiError, OpenapiToolsOptions, type OpenapiTools } from "../contracts/openapi.js";
+/** Decode retained metadata and expose only operations supported by the selected account. */
+export declare const openapiToolsEffect: (options: OpenapiToolsOptions) => Effect.Effect<OpenapiTools, OpenapiError>;

package/types/apps/src/implementation/operations.d.ts

@@ -0,0 +1,65 @@
+/** Pure operation declarations. Only the author callback crosses the Promise boundary. */
+import { Effect, Schema as EffectSchema } from "effect";
+import type { AppOperation } from "../contracts/operations.js";
+import type { AppContext, QueryContext, MutationContext } from "../contracts/context.js";
+import type { Approval } from "../approval.js";
+import type { ToolAnnotations } from "../contracts/tools.js";
+import type { JsonObject } from "../contracts/schema.js";
+import { type Schema } from "./schema.js";
+declare const NativeOperation: unique symbol;
+declare const HandlerContext: unique symbol;
+/** A server-only declaration with its category preserved for catalog validation. */
+export interface OperationDeclaration<Kind extends "query" | "mutation", Context = never> {
+    readonly [HandlerContext]?: (context: Context) => void;
+    readonly kind: Kind;
+    readonly [NativeOperation]: Omit<AppOperation<never>, "kind" | "input"> & {
+        readonly kind: Kind;
+        readonly input: EffectSchema.Decoder<unknown>;
+    };
+}
+/** Typed operation handles drive browser reference inference without bundling handlers. */
+export interface Operation<Input, Output, Kind extends "query" | "mutation", Context = AppContext> extends OperationDeclaration<Kind, Context> {
+    readonly [NativeOperation]: AppOperation<Input, Output> & {
+        readonly kind: Kind;
+    };
+}
+/** Retain a native operation without evaluating it. Used by database and protocol constructors. */
+export declare const operationDeclaration: <Input, Output, Kind extends "query" | "mutation", Context = AppContext>(operation: AppOperation<Input, Output> & {
+    readonly kind: Kind;
+}) => Operation<Input, Output, Kind, Context>;
+/** Accept only framework-created declarations; input is decoded before its erased callback is invoked. */
+export declare const nativeOperation: (value: unknown) => AppOperation | undefined;
+/** Options shared by database and external operations. Output defaults to a JSON-safe host check. */
+export interface OperationOptions<Input, Output> {
+    readonly description?: string;
+    readonly title?: string;
+    readonly input: Schema<Input, boolean>;
+    readonly output?: Schema<Output, boolean>;
+    readonly approval?: Approval<Input>;
+    readonly annotations?: ToolAnnotations;
+    readonly _meta?: JsonObject;
+}
+/** Adapt metadata and approval without running user code. */
+export declare const operationOptions: <Input, Output>(options: OperationOptions<Input, Output>) => {
+    approval?: (context: Parameters<Approval<Input>>[0]) => Effect.Effect<"approved" | "denied" | "user-approval", unknown, never>;
+    input: EffectSchema.Decoder<Input, never>;
+    _meta?: {
+        readonly [x: string]: EffectSchema.Json;
+    };
+    annotations?: {
+        readonly title?: string;
+        readonly readOnlyHint?: boolean;
+        readonly destructiveHint?: boolean;
+        readonly idempotentHint?: boolean;
+        readonly openWorldHint?: boolean;
+    };
+    title?: string;
+    description?: string;
+};
+/** Attach the same approval function to a generated or shared operation. */
+export declare const withApproval: <Input, Output, Kind extends "query" | "mutation", Context>(operation: Operation<Input, Output, Kind, Context>, approval: Approval<Input>) => Operation<Input, Output, Kind, Context>;
+/** Read operation. External reads are allowed; only database writes are mechanically prohibited. */
+export declare const query: <Input, Output, Context extends AppContext = QueryContext>(options: OperationOptions<Input, Output>, run: (context: Context, input: Input) => Promise<Output>) => Operation<Input, Output, "query", Context>;
+/** Explicit write operation. Database writes roll back on failure; external effects cannot be undone. */
+export declare const mutation: <Input, Output, Context extends AppContext = MutationContext>(options: OperationOptions<Input, Output>, run: (context: Context, input: Input) => Promise<Output>) => Operation<Input, Output, "mutation", Context>;
+export {};

package/types/apps/src/implementation/optimistic.d.ts

@@ -0,0 +1,30 @@
+/** One client's mounted queries and ordered optimistic write/read handoffs. */
+import { Effect } from "effect";
+import { Atom, AsyncResult } from "effect/unstable/reactivity";
+import type { AppMutation } from "../contracts/optimistic.js";
+import type { OperationReference } from "../contracts/live.js";
+import { JsonValue } from "../contracts/schema.js";
+import type { Schema } from "./schema.js";
+type Snapshot = AsyncResult.AsyncResult<unknown, unknown>;
+/** Transport and fiber ownership remain with the browser client's runtime. */
+export interface OptimisticTransport {
+    readonly source: (name: string, input: JsonValue, output: Schema<unknown, boolean>) => Atom.Atom<Snapshot>;
+    readonly read: (name: string, input: JsonValue, output: Schema<unknown, boolean>) => Effect.Effect<unknown, unknown>;
+    readonly write: (name: string, input: JsonValue, output: Schema<unknown, boolean>) => Effect.Effect<unknown, unknown>;
+    readonly fork: (effect: Effect.Effect<void>) => void;
+    readonly run: <A>(effect: Effect.Effect<A, unknown>) => Promise<A>;
+    readonly reportProjectionError: (details: {
+        readonly operationId: string;
+        readonly name: string;
+        readonly sent: boolean;
+    }) => void;
+}
+/** Owns cache entries and projections. Dispose before closing the transport runtime. */
+export declare const makeOptimisticClient: (transport: OptimisticTransport) => {
+    mutation: <Input, Output>(reference: OperationReference<Input, Output, "mutation">, output: Schema<NoInfer<Output>, boolean>) => AppMutation<Input, Output>;
+    /** Shares state across mounts; the last subscriber releases the stream and cache entry. */
+    queryAtom: <Input, Output>(reference: OperationReference<Input, Output, "query">, input: NoInfer<Input>, output: Schema<NoInfer<Output>, boolean>) => Atom.Atom<AsyncResult.AsyncResult<Output, unknown>>;
+    /** Cancel callers and close streams; the transport owner then interrupts its fibers. */
+    dispose: () => void;
+};
+export {};

package/types/apps/src/implementation/protocol-operations.d.ts

@@ -0,0 +1,24 @@
+/** Project upstream protocol metadata into the same operations authors declare by hand. */
+import type { Effect, Schema } from "effect";
+import type { OperationContext } from "../contracts/operations.js";
+import type { ToolAnnotations } from "../contracts/tools.js";
+import type { JsonObject, JsonValue } from "../contracts/schema.js";
+import { type Operation } from "./operations.js";
+/** Explicit corrections for upstream read-only hints or unusual HTTP semantics. */
+export type OperationKinds = Readonly<Record<string, "query" | "mutation">>;
+interface ProtocolOperation {
+    readonly description: string;
+    readonly title?: string | undefined;
+    readonly readOnly?: boolean | undefined;
+    readonly annotations?: ToolAnnotations | undefined;
+    readonly _meta?: JsonObject | undefined;
+    readonly input: Schema.Decoder<JsonValue>;
+    readonly outputSchema?: JsonObject | undefined;
+    readonly run: (context: OperationContext, input: JsonValue) => Effect.Effect<unknown, unknown>;
+}
+/** Unknown behavior defaults to mutation. Classification never enforces an external service's behavior. */
+export declare const protocolOperations: (operations: Readonly<Record<string, ProtocolOperation>>, kinds?: OperationKinds) => {
+    queries: Record<string, Operation<Schema.Json, unknown, "query", OperationContext>>;
+    mutations: Record<string, Operation<Schema.Json, unknown, "mutation", OperationContext>>;
+};
+export {};

package/types/apps/src/implementation/provider.d.ts

@@ -0,0 +1,16 @@
+/** Pure constructors over the native provider contracts. */
+import { Effect, Schema } from "effect";
+import { type AuthMethods, OAuth2Config, OAuth2Method, Provider, SecretsMethod } from "../contracts/provider.js";
+import type { ValidationError } from "../contracts/schema.js";
+/** Declare a secrets method with an Effect decoder. */
+export declare const secrets: <Fields extends Schema.Decoder<unknown>>(options: {
+    readonly label: string;
+    readonly fields: Fields;
+}) => SecretsMethod<Fields>;
+/** Validate OAuth endpoints while declaring their app-visible response projection. */
+export declare const oauth2: <Response extends Schema.Decoder<unknown>>(config: OAuth2Config, response: Response) => Effect.Effect<OAuth2Method<Response>, ValidationError>;
+/** Retain the provider and literal method names without registering or authenticating it. */
+export declare const defineProvider: <const Auth extends AuthMethods>(options: {
+    readonly name: string;
+    readonly auth: Auth;
+}) => Provider<Auth>;

package/types/apps/src/implementation/query-commit.d.ts

@@ -0,0 +1,10 @@
+import { AsyncResult } from "effect/unstable/reactivity";
+/** Per-result metadata follows the exact Atom registry snapshot, including concurrent mounts. */
+export interface ObservedQueryValue<A> {
+    readonly value: A;
+    readonly commit: () => void;
+}
+/** Strip internal metadata at the atom boundary and retain only a weak association to its result. */
+export declare const queryResult: <A, E>(result: AsyncResult.AsyncResult<ObservedQueryValue<A>, E>) => AsyncResult.AsyncResult<A, E>;
+/** Called after React has committed this exact result to the DOM; unrelated atoms have no callback. */
+export declare const queryCommitted: (result: object) => void;

package/types/apps/src/implementation/schedules.d.ts

@@ -0,0 +1,16 @@
+import { Interval, ScheduleTiming } from "../contracts/schedules.js";
+import { JsonValue } from "../contracts/schema.js";
+import { type Operation, type OperationDeclaration } from "./operations.js";
+/** The app adapter resolves this operation handle to its declared mutation name. */
+export interface ScheduleDeclaration<Context = never> {
+    readonly operation: OperationDeclaration<"mutation", Context>;
+    readonly timing: ScheduleTiming;
+    readonly input: JsonValue;
+}
+/** Run an existing mutation at a fixed interval. Installation enablement belongs to the host. */
+export declare const interval: <Input, Output, Context>(duration: Interval, operation: Operation<Input, Output, "mutation", Context>, input: NoInfer<Input>) => ScheduleDeclaration<Context>;
+/** Calendar alternative for wall-clock schedules. UTC is the explicit default when timezone is omitted. */
+export declare const cron: <Input, Output, Context>(calendar: {
+    readonly expression: string;
+    readonly timezone?: string;
+}, operation: Operation<Input, Output, "mutation", Context>, input: NoInfer<Input>) => ScheduleDeclaration<Context>;

package/types/apps/src/implementation/schema.d.ts

@@ -0,0 +1,93 @@
+/** Author schema facade. Internals use the native decoder retained by each value. */
+import { Effect, Schema as EffectSchema } from "effect";
+import { ValidationError, type JsonObject } from "../contracts/schema.js";
+import type { Field } from "../../../app-data/src/contracts/database.js";
+declare const StorageField: unique symbol;
+declare const Decoder: unique symbol;
+/** An author-facing value schema. Effect is never required in author code. */
+export interface Schema<T, Optional extends boolean = false> {
+    readonly [StorageField]?: Field;
+    readonly [Decoder]: EffectSchema.Decoder<T>;
+    readonly optionalValue: Optional;
+    /** Parse an unknown value; invalid input throws a safe ValidationError. */
+    parse(input: unknown): T;
+    /** Accept an absent field without changing the original schema. */
+    optional(): Schema<T | undefined, true>;
+    /** Validate the default now and use it for undefined input. */
+    default(value: T): Schema<T> & {
+        readonly hasDefault: true;
+        readonly inputOptional: Optional;
+    };
+}
+/** Infer the parsed author value. */
+export type Infer<S> = S extends Schema<infer T, boolean> ? T : never;
+/** Named author fields. */
+export type Fields = Readonly<Record<string, Schema<unknown, boolean>>>;
+/** Optional fields may be absent; defaulted fields are present after decoding. */
+export type ObjectValue<F extends Fields> = {
+    readonly [Key in keyof F as F[Key]["optionalValue"] extends true ? never : Key]: Infer<F[Key]>;
+} & {
+    readonly [Key in keyof F as F[Key]["optionalValue"] extends true ? Key : never]?: Infer<F[Key]>;
+};
+/** An author object schema with retained field declarations. */
+export interface ObjectSchema<F extends Fields> extends Schema<ObjectValue<F>> {
+    readonly fields: F;
+}
+/** Retrieve a native decoder at the author boundary without erasing its type. */
+export declare const decoderOf: <T>(schema: Schema<T, boolean>) => EffectSchema.Decoder<T>;
+/** Recognize schemas made by this author facade when adapting a definition. */
+export declare const isSchema: (value: unknown) => value is Schema<unknown, boolean>;
+/** Decode within an Effect program. Invalid input is omitted from the failure. */
+export declare const parse: <T>(decoder: EffectSchema.Decoder<T>, input: unknown) => Effect.Effect<T, ValidationError>;
+/** Present a native decoder through the synchronous author API. */
+export declare function wrap<T, Optional extends boolean>(decoder: EffectSchema.Decoder<T>, optionalValue: Optional, field?: Field): Schema<T, Optional>;
+/** A string, optionally with a minimum length. No coercion. */
+export declare function string(options?: {
+    readonly minLength?: number;
+}): Schema<string>;
+/** A finite JSON number. No coercion. */
+export declare const number: () => Schema<number>;
+/** A boolean. No coercion. */
+export declare const boolean: () => Schema<boolean>;
+/** Any JSON value. Values still cross the native JSON decoder. */
+export declare const json: () => Schema<EffectSchema.Json>;
+/** Named values with a common schema. */
+export declare const record: <T>(value: Schema<T, boolean>) => Schema<Readonly<Record<string, T>>>;
+/** One exact JSON scalar value. */
+export declare function literal<const T extends string | number | boolean | null>(value: T): Schema<T>;
+/** An array whose elements use the given schema. */
+export declare const array: <T>(item: Schema<T, boolean>) => Schema<readonly T[]>;
+/** Parse declared fields and omit undeclared fields. */
+export declare function object<const F extends Fields>(fields: F): ObjectSchema<F>;
+declare const ImportedJsonSchema: unique symbol;
+/** Read the original document for an imported decoder without a lossy schema round trip. */
+export declare const importedJsonSchema: (decoder: EffectSchema.Decoder<unknown>) => unknown | undefined;
+/** Attach a composed discovery document without replacing its authoritative native decoder. */
+export declare const withJsonSchemaDocument: <S extends EffectSchema.Decoder<unknown>>(decoder: S, document: JsonObject) => S;
+/**
+ * Relocate a self-contained JSON Schema under a document pointer. Resolve references
+ * before nesting so account schemas can reuse definition names, IDs and anchors.
+ * Only schema nodes are rewritten; examples and ordinary property values stay intact.
+ */
+export declare const nestJsonSchema: (input: JsonObject, pointer: string) => JsonObject;
+/** Prepare an interpreted validator. No eval or generated JavaScript runs in any host. */
+export declare const compileJsonSchemaDecoder: (document: JsonObject) => Effect.Effect<EffectSchema.Codec<EffectSchema.Json, EffectSchema.Json, never, never> & {
+    [ImportedJsonSchema]: {
+        readonly [x: string]: EffectSchema.Json;
+    };
+}, ValidationError, never>;
+/** Preserve the JSON document; compile its validator only when a value is first decoded. */
+export declare const jsonSchemaDecoder: (input: unknown) => Effect.Effect<EffectSchema.declareConstructor<EffectSchema.Json, EffectSchema.Json, readonly [], EffectSchema.Json> & {
+    [ImportedJsonSchema]: {
+        readonly [x: string]: EffectSchema.Json;
+    };
+}, ValidationError, never>;
+/** Import JSON metadata now; unsupported schemas and invalid values fail when parsed. */
+export declare const jsonSchema: (input: unknown) => Schema<EffectSchema.Json>;
+/** Database declaration retained by primitive constructors; nested payload schemas are not database fields. */
+export declare const storageFieldOf: (schema: Schema<unknown, boolean>) => Field | undefined;
+/** A row reference records the target table; existence is not a foreign-key constraint. */
+export declare const id: (table: string) => Schema<string>;
+/** A host user identifier, stored as a string without imposing a product auth model. */
+export declare const userId: () => Schema<string>;
+export {};

package/types/apps/src/implementation/storage.d.ts

@@ -0,0 +1,13 @@
+import { type DatabaseSession } from "../../../app-data/src/index.js";
+import { type AppStorage } from "../contracts/storage.js";
+import type { DatabaseDefinition, Database, Table, Tables } from "../contracts/storage.js";
+import { type Fields } from "./schema.js";
+export type { DatabaseDefinition, Database, DatabaseReader, Table, Tables, RowOf, } from "../contracts/storage.js";
+/** Declare scalar columns using the same schemas as operation inputs. */
+export declare const table: <const F extends Fields>(fields: F) => Table<F>;
+/** Build a fresh Promise database facade for one authorized invocation. */
+export declare const authorDatabase: <T extends Tables>(tables: T, session: DatabaseSession, signal: AbortSignal, writable: boolean) => Database<T>;
+/** Declare storage independently of handlers; the host binds each invocation's database. */
+export declare const defineDatabase: <const T extends Tables>(tables: T) => DatabaseDefinition<T>;
+/** Explicit missing capability, never a fallback to another app's data. */
+export declare const unavailableStorage: AppStorage;

package/types/apps/src/implementation/ui-auth.d.ts

@@ -0,0 +1,13 @@
+/** Trusted bootstrap documents run before authored UI and never contain product credentials. */
+import { HttpServerResponse } from "effect/unstable/http";
+/** Private app responses must not leak authentication URLs through caches or referrers. */
+export declare const appPrivateHeaders: {
+    "cache-control": string;
+    "referrer-policy": string;
+    "x-content-type-options": string;
+    "content-security-policy": string;
+};
+/** Serve only a fixed host script while authentication runs; the original URL remains available to that script. */
+export declare const appSignInPage: () => HttpServerResponse.HttpServerResponse;
+/** Preserve deep links, erase callback proofs before any request, and let the host set HttpOnly cookies. */
+export declare const appSignInScript: () => HttpServerResponse.HttpServerResponse;

package/types/apps/src/implementation/ui-client.d.ts

@@ -0,0 +1,16 @@
+import { Atom } from "effect/unstable/reactivity";
+import { type OperationReference } from "../contracts/live.js";
+import { type Schema } from "./schema.js";
+/** A scoped page client. Host-injected context carries only the deployment, never credentials. */
+export declare const createAppClient: () => {
+    /** Close this client when its page or embedding owner is removed. */
+    dispose: () => Promise<void>;
+    /** Query this app once, with a runtime-validated response. Does not populate the mounted query cache. */
+    query: <Input, Output>(reference: OperationReference<Input, Output, "query">, input: NoInfer<Input>, output: Schema<NoInfer<Output>, boolean>) => Promise<NoInfer<Output>>;
+    /** Execute a write once in this client's queue. Success acknowledges the write; queries reconcile afterward. */
+    mutate: <Input, Output>(reference: OperationReference<Input, Output, "mutation">, input: NoInfer<Input>, output: Schema<NoInfer<Output>, boolean>) => Promise<Output>;
+    /** Create a callable mutation with optional withOptimisticUpdate projections over mounted queries. */
+    mutation: <Input, Output>(reference: OperationReference<Input, Output, "mutation">, output: Schema<NoInfer<Output>, boolean>) => import("../client.js").AppMutation<Input, Output>;
+    /** Share a live query across mounts and reconcile optimistic changes against fresh server reads. */
+    queryAtom: <Input, Output>(reference: OperationReference<Input, Output, "query">, input: NoInfer<Input>, output: Schema<NoInfer<Output>, boolean>) => Atom.Atom<import("effect/unstable/reactivity/AsyncResult").AsyncResult<Output, unknown>>;
+};

package/types/apps/src/implementation/ui-errors.d.ts

@@ -0,0 +1,2 @@
+/** Inline host script: no app dependencies, credentials, or authored HTML enter its source. */
+export declare const appFailureBootstrap: string;

package/types/apps/src/implementation/ui-serving.d.ts

@@ -0,0 +1,16 @@
+import { Effect } from "effect";
+import { HttpServerRequest, HttpServerResponse } from "effect/unstable/http";
+import { UiForbidden, type AppUiAsset } from "../contracts/ui.js";
+/** Render an authorized deployment with a host-owned deployment watcher. */
+export declare const appDocument: <E, R>(options: {
+    readonly deployment: string;
+    readonly profile?: string | undefined;
+    readonly expectedProfileRevision?: number | undefined;
+    readonly origin: string;
+    readonly asset: (path: string) => Effect.Effect<AppUiAsset | undefined, E, R>;
+}) => Effect.Effect<HttpServerResponse.HttpServerResponse, UiForbidden | E, HttpServerRequest.HttpServerRequest | R>;
+/** Revalidate immutable assets only after the host has checked current access and file existence.
+ * Browsers may retain bytes, but neither browsers nor shared proxies may reuse them without authorization.
+ * HTML remains an uncached host-rendered entry point.
+ */
+export declare const appAsset: (asset: AppUiAsset | undefined, build: string, path: string) => Effect.Effect<HttpServerResponse.HttpServerResponse, never, HttpServerRequest.HttpServerRequest>;

package/types/apps/src/implementation/ui-watch.d.ts

@@ -0,0 +1,2 @@
+/** Dependency-free browser source served by each host after app authorization. */
+export declare const appWatchScript: string;

package/types/apps/src/implementation/webhooks.d.ts

@@ -0,0 +1,29 @@
+/** Native webhook dispatch. The author verifies signatures before parsing or performing side effects. */
+import { Effect, Schema } from "effect";
+import type { AppDefinition } from "../contracts/app.js";
+import { HostDeclarationInvalid, HostInputInvalid, HostOperationFailed, HostOperationNotFound, HostOutputInvalid, type ResolvedAccounts } from "../contracts/host.js";
+import { type WebhookCommand } from "../contracts/webhook-protocol.js";
+/** Run one hook with freshly bound context. No credentials or raw failures enter the response envelope. */
+export declare const dispatchWebhook: <Context extends {
+    readonly signal?: AbortSignal;
+    readonly accounts: Readonly<Record<string, unknown>>;
+}>(definition: AppDefinition<Context>, command: WebhookCommand, context: Context, accounts: ResolvedAccounts) => Effect.Effect<Schema.Json | {
+    readonly name: string;
+    readonly account: string;
+    readonly configSchema: {
+        readonly [x: string]: Schema.Json;
+    };
+    readonly setup?: {
+        readonly stateSchema: {
+            readonly [x: string]: Schema.Json;
+        };
+        readonly instructions: string;
+        readonly signingSecret: "provider" | "executor";
+    };
+}[] | {
+    readonly status: number;
+    readonly headers: {
+        readonly [x: string]: string;
+    };
+    readonly body: string;
+}, HostDeclarationInvalid | HostOperationNotFound | HostOperationFailed | HostInputInvalid | HostOutputInvalid, never>;