apps 0.0.1-beta.1 → 0.0.1-beta.100

package/js/index.js

@@ -1,93 +1,95 @@
 import {
-  CacheError,
+  ResponseDecodeError,
+  ResponseStatusError,
+  base64,
+  basic,
+  bearer,
+  declarePlacements,
   defineApp,
-  defineDatabase,
-  table,
+  event,
+  header,
+  query,
+  t,
   workflow
-} from "./chunk-RBAC33PQ.js";
-import "./chunk-PLCMJREA.js";
+} from "./chunk-ILYCJ3HV.js";
 import {
-  fromPromise,
+  dynamicRouter,
   mutation,
   nativeOperation,
+  nativeRouter,
   operationDeclaration,
-  query,
-  withApproval
-} from "./chunk-PZ36XMXW.js";
+  query as query2,
+  renameTools,
+  router,
+  routerDeclaration,
+  toolAnnotations,
+  withApproval,
+  withApprovals
+} from "./chunk-2CURR5Y7.js";
 import {
-  accountProviderError
-} from "./chunk-ZJWDMTE3.js";
+  accountProviderError,
+  fromPromise
+} from "./chunk-7STIP5CS.js";
 import {
+  CacheError,
   CalendarSchedule,
   ElicitationFailed,
+  FetchOptionUnsupported,
   HostedTool,
   HostedToolSummary,
   Interval,
+  NetworkRefused,
   NonRetryableError,
   OAuth2AccessToken,
   OAuth2Config,
   OAuth2Method,
   Provider,
+  ProviderError,
   ScheduleTiming,
   SecretsMethod,
   WorkflowFailure
-} from "./chunk-IHQ4ML7K.js";
-import "./chunk-BMOIAIVR.js";
-import "./chunk-YEJOQEII.js";
-import "./chunk-SWPD52J7.js";
-import {
-  ProviderError
-} from "./chunk-W7D7WVSY.js";
+} from "./chunk-4UPC36ZL.js";
+import "./chunk-4PIQKACY.js";
 import {
   array,
   boolean,
+  combineJsonSchemas,
   decoderOf,
-  id,
+  fieldExposure,
   importedJsonSchema,
+  isSchema,
   json,
   jsonSchema,
   literal,
-  nestJsonSchema,
   number,
   object,
   once,
   parse,
+  parseDeclaration,
+  plain,
+  raw,
   record,
   string,
-  userId,
   withLazyJsonSchemaDocument,
   wrap
-} from "./chunk-2HHMABB6.js";
-import "./chunk-FZJOYIZO.js";
+} from "./chunk-VAI3EVCS.js";
+import "./chunk-URKOTNDA.js";
+import "./chunk-YDW7DX3A.js";
+import "./chunk-OWN3DP2W.js";
 import {
+  DeclarationInvalid,
   JsonObject,
   JsonValue,
   ValidationError
-} from "./chunk-SATWJKN6.js";
+} from "./chunk-7HG422GB.js";
+import "./chunk-DILSCQPJ.js";
+import "./chunk-ACQXVKVQ.js";
 import {
   Effect_exports,
   Schema_exports
-} from "./chunk-FW5HBOIK.js";
+} from "./chunk-ZKDXML77.js";
 import "./chunk-CZ7CSFO4.js";
 
-// src/contracts/http.ts
-var ResponseStatusError = class extends Schema_exports.TaggedError()(
-  "ResponseStatusError",
-  { status: Schema_exports.Number }
-) {
-  get message() {
-    return `Request failed with status ${this.status}`;
-  }
-};
-var ResponseDecodeError = class extends Schema_exports.TaggedError()(
-  "ResponseDecodeError",
-  {}
-) {
-  get message() {
-    return "Response body did not match the expected schema";
-  }
-};
-
 // src/implementation/http.ts
 var decodeJson = (response, schema) => Effect_exports.gen(function* () {
   if (response.status < 200 || response.status >= 300) {
@@ -99,86 +101,145 @@ var decodeJson = (response, schema) => Effect_exports.gen(function* () {
 
 // src/implementation/provider.ts
 var secrets = (options) => new SecretsMethod(options);
-var oauth2 = (config, response) => parse(OAuth2Config, config).pipe(Effect_exports.map((config2) => new OAuth2Method({ config: config2, response })));
-var defineProvider = (options) => new Provider(options);
+var clientCredentials = Schema_exports.is(Schema_exports.Struct({ grant: Schema_exports.Literal("client_credentials") }));
+var oauth2Form = (config) => {
+  const [discovered, declared, discoveredMachine, declaredMachine] = OAuth2Config.members;
+  const discovers = typeof config === "object" && config !== null && Object.hasOwn(config, "discover");
+  if (clientCredentials(config)) return discovers ? discoveredMachine : declaredMachine;
+  return discovers ? discovered : declared;
+};
+var oauth2 = (config, response, exposure, request) => parseDeclaration(OAuth2Config, config, "oauth2()", oauth2Form).pipe(
+  Effect_exports.map(
+    (config2) => new OAuth2Method({
+      config: config2,
+      response,
+      ...exposure === void 0 ? {} : { exposure },
+      ...request === void 0 ? {} : { request }
+    })
+  )
+);
+var defineProvider = ({
+  health,
+  ...options
+}) => {
+  const placed = Object.entries(options.auth).filter(([, method]) => method.request !== void 0);
+  if (options.hosts === void 0 && placed.length > 0)
+    throw new TypeError(
+      `Provider "${options.name}" declares a request for ${placed.map(([name]) => name).join(", ")} but no hosts. Declare the hosts its credentials may be sent to.`
+    );
+  if (health === void 0) return new Provider(options);
+  const run = fromPromise(health, "check");
+  return new Provider({ ...options, health: { run } });
+};
 
-// src/implementation/account-operations.ts
-var inputDocument = (operation) => {
-  const imported = importedJsonSchema(operation.input);
+// src/implementation/account-router.ts
+var decoderDocument = (decoder) => {
+  const imported = importedJsonSchema(decoder);
   if (imported !== void 0) return Schema_exports.decodeUnknownSync(JsonObject)(imported);
-  const document = Schema_exports.toJsonSchemaDocument(operation.input);
+  const document = Schema_exports.toJsonSchemaDocument(decoder);
   return Schema_exports.decodeUnknownSync(JsonObject)({ ...document.schema, $defs: document.definitions });
 };
+var accountBranches = (variants) => {
+  const groups = /* @__PURE__ */ new Map();
+  for (const [accountId, schema] of variants) {
+    const key = JSON.stringify(schema);
+    const group = groups.get(key);
+    if (group === void 0) groups.set(key, { schema, first: accountId, rest: [] });
+    else group.rest.push(accountId);
+  }
+  const branches = [...groups.values()];
+  const { $defs, schemas } = combineJsonSchemas(
+    branches.map(({ schema }) => schema),
+    (index) => `#/anyOf/${index}/properties/input`
+  );
+  return {
+    type: "object",
+    ...$defs === void 0 ? {} : { $defs },
+    anyOf: schemas.map((input, index) => {
+      const { first, rest } = branches[index];
+      return {
+        type: "object",
+        properties: {
+          accountId: rest.length === 0 ? { type: "string", const: first } : { type: "string", enum: [first, ...rest] },
+          input
+        },
+        required: ["accountId", "input"]
+      };
+    })
+  };
+};
+var outputBranches = (outputs) => {
+  const { $defs, schemas } = combineJsonSchemas(
+    [...new Map(outputs.map((output) => [JSON.stringify(output), output])).values()],
+    (index) => `#/anyOf/${index}`
+  );
+  return { ...$defs === void 0 ? {} : { $defs }, anyOf: schemas };
+};
 var declaresOutput = (operation) => {
+  if (operation.output !== void 0) return true;
   const property = Object.getOwnPropertyDescriptor(operation, "outputSchema");
   return property !== void 0 && (property.get !== void 0 || property.value !== void 0);
 };
-var combine = (kind, groups) => Object.fromEntries(
-  [...groups].map(([name, accounts]) => {
-    const variants = [...accounts.values()];
-    const first = variants[0];
-    if (first === void 0)
-      throw new Error("An account operation must have at least one account");
-    const select = (input2) => {
-      const operation = accounts.get(input2.accountId);
-      if (operation === void 0)
-        throw new Error("Account selection must be decoded before execution");
-      return operation;
-    };
-    const input = Schema_exports.Union(
-      [...accounts].map(
-        ([accountId, operation]) => Schema_exports.Struct({ accountId: Schema_exports.Literal(accountId), input: operation.input })
+var outputDocument = (operation) => operation.output === void 0 ? operation.outputSchema : decoderDocument(operation.output);
+var combineOperation = (accounts) => {
+  const variants = [...accounts.values()];
+  const first = variants[0];
+  if (first === void 0) throw new Error("An account operation must have at least one account");
+  const kind = variants.every((operation) => operation.kind === "query") ? "query" : "mutation";
+  const select = (input2) => {
+    const operation = accounts.get(input2.accountId);
+    if (operation === void 0)
+      throw new Error("Account selection must be decoded before execution");
+    return operation;
+  };
+  const input = Schema_exports.Union(
+    [...accounts].map(
+      ([accountId, operation]) => Schema_exports.Struct({ accountId: Schema_exports.Literal(accountId), input: operation.input })
+    )
+  );
+  const inputSchema = () => accountBranches(
+    [...accounts].map(([accountId, operation]) => [accountId, decoderDocument(operation.input)])
+  );
+  const declaration2 = operationDeclaration({
+    kind,
+    ...first.description === void 0 ? {} : { description: first.description },
+    ...first.title === void 0 ? {} : { title: first.title },
+    ...first.annotations === void 0 || !variants.every(
+      (operation) => JSON.stringify(operation.annotations) === JSON.stringify(first.annotations)
+    ) ? {} : { annotations: first.annotations },
+    ...first._meta === void 0 || !variants.every((operation) => JSON.stringify(operation._meta) === JSON.stringify(first._meta)) ? {} : { _meta: first._meta },
+    input: withLazyJsonSchemaDocument(input, inputSchema),
+    approval: (context) => {
+      const operation = select(context.toolInput);
+      return operation.approval === void 0 ? Effect_exports.succeed("approved") : operation.approval({ ...context, toolInput: context.toolInput.input });
+    },
+    run: (context, input2) => {
+      const operation = select(input2);
+      return operation.run(context, input2.input).pipe(
+        Effect_exports.mapError((error) => accountProviderError(error, input2.accountId)),
+        Effect_exports.flatMap(
+          (output) => operation.output === void 0 ? Effect_exports.succeed(output) : Schema_exports.decodeUnknownEffect(operation.output)(output)
+        )
+      );
+    }
+  });
+  if (variants.every(declaresOutput)) {
+    const outputSchema = once(
+      () => outputBranches(
+        variants.flatMap((operation) => {
+          const output = outputDocument(operation);
+          return output === void 0 ? [] : [output];
+        })
       )
     );
-    const inputSchema = () => ({
-      type: "object",
-      anyOf: [...accounts].map(([accountId, operation], index) => ({
-        type: "object",
-        properties: {
-          accountId: { type: "string", const: accountId },
-          input: nestJsonSchema(inputDocument(operation), `#/anyOf/${index}/properties/input`)
-        },
-        required: ["accountId", "input"]
-      }))
-    });
-    const declaration2 = operationDeclaration({
-      kind,
-      ...first.description === void 0 ? {} : { description: first.description },
-      ...first.title === void 0 ? {} : { title: first.title },
-      ...first.annotations === void 0 || !variants.every(
-        (operation) => JSON.stringify(operation.annotations) === JSON.stringify(first.annotations)
-      ) ? {} : { annotations: first.annotations },
-      ...first._meta === void 0 || !variants.every(
-        (operation) => JSON.stringify(operation._meta) === JSON.stringify(first._meta)
-      ) ? {} : { _meta: first._meta },
-      input: withLazyJsonSchemaDocument(input, inputSchema),
-      approval: (context) => {
-        const operation = select(context.toolInput);
-        return operation.approval === void 0 ? Effect_exports.succeed("approved") : operation.approval({ ...context, toolInput: context.toolInput.input });
-      },
-      run: (context, input2) => {
-        const operation = select(input2);
-        return operation.run(context, input2.input).pipe(
-          Effect_exports.mapError((error) => accountProviderError(error, input2.accountId)),
-          Effect_exports.flatMap(
-            (output) => operation.output === void 0 ? Effect_exports.succeed(output) : Schema_exports.decodeUnknownEffect(operation.output)(output)
-          )
-        );
-      }
-    });
-    if (variants.every(declaresOutput)) {
-      const outputSchema = once(() => ({
-        anyOf: variants.flatMap(
-          (operation) => operation.outputSchema === void 0 ? [] : [operation.outputSchema]
-        ).map((output, index) => nestJsonSchema(output, `#/anyOf/${index}`))
-      }));
-      const native = nativeOperation(declaration2);
-      if (native !== void 0)
-        Object.defineProperty(native, "outputSchema", { enumerable: true, get: outputSchema });
-    }
-    return [name, declaration2];
-  })
-);
+    const native2 = nativeOperation(declaration2);
+    if (native2 !== void 0)
+      Object.defineProperty(native2, "outputSchema", { enumerable: true, get: outputSchema });
+  }
+  const native = nativeOperation(declaration2);
+  if (native === void 0) throw new Error("Expected a combined operation");
+  return native;
+};
 var sameAcross = (key, variants) => {
   const first = variants[0]?.[1][key];
   return first !== void 0 && variants.every(([, tool]) => JSON.stringify(tool[key]) === JSON.stringify(first)) ? { [key]: first } : {};
@@ -190,141 +251,144 @@ var mergeSummary = (name, variants) => {
     name,
     description: first.description,
     ...first.title === void 0 ? {} : { title: first.title },
-    readOnly: name.startsWith("queries."),
+    readOnly: variants.every(([, tool]) => tool.readOnly === true),
     ...sameAcross("annotations", variants)
   });
 };
 var merge = (name, variants) => Schema_exports.decodeUnknownSync(HostedTool)({
   ...mergeSummary(name, variants),
-  inputSchema: {
-    type: "object",
-    anyOf: variants.map(([accountId, tool], index) => ({
-      type: "object",
-      properties: {
-        accountId: { type: "string", const: accountId },
-        input: nestJsonSchema(tool.inputSchema, `#/anyOf/${index}/properties/input`)
-      },
-      required: ["accountId", "input"]
-    }))
-  },
+  inputSchema: accountBranches(
+    variants.map(([accountId, tool]) => [accountId, tool.inputSchema])
+  ),
   ...variants.every(([, tool]) => tool.outputSchema !== void 0) ? {
-    outputSchema: {
-      anyOf: variants.flatMap(
-        ([, tool], index) => tool.outputSchema === void 0 ? [] : [nestJsonSchema(tool.outputSchema, `#/anyOf/${index}`)]
+    outputSchema: outputBranches(
+      variants.flatMap(
+        ([, tool]) => tool.outputSchema === void 0 ? [] : [tool.outputSchema]
       )
-    }
+    )
   } : {},
   ...sameAcross("_meta", variants)
 });
-var accountOperations = (accounts, discover, options) => Effect_exports.runPromise(
+var combineDynamic = (sources) => {
+  const first = [...sources.values()][0];
+  const grouped = (read) => Effect_exports.gen(function* () {
+    const groups = /* @__PURE__ */ new Map();
+    for (const [accountId, source] of sources) {
+      const tools = yield* read(source).pipe(
+        Effect_exports.mapError((error) => accountProviderError(error, accountId))
+      );
+      for (const tool of tools) {
+        const variants = groups.get(tool.name) ?? [];
+        if (variants.some(([id]) => id === accountId))
+          return yield* Effect_exports.die(new Error("Duplicate source operation"));
+        variants.push([accountId, tool]);
+        groups.set(tool.name, variants);
+      }
+    }
+    return groups;
+  });
+  return {
+    kind: "dynamic",
+    // Accounts share one source, so the first account describes the router.
+    ...first?.meta === void 0 ? {} : { meta: first.meta },
+    ...first?.overrides === void 0 ? {} : { overrides: first.overrides },
+    list: () => grouped((source) => source.list()).pipe(
+      Effect_exports.map((groups) => [...groups].map(([name, variants]) => merge(name, variants)))
+    ),
+    summaries: () => grouped(
+      (source) => source.summaries === void 0 ? source.list() : source.summaries()
+    ).pipe(
+      Effect_exports.map((groups) => [...groups].map(([name, variants]) => mergeSummary(name, variants)))
+    ),
+    describe: (name) => Effect_exports.gen(function* () {
+      const variants = [];
+      for (const [accountId, source] of sources) {
+        const tool = yield* (source.describe === void 0 ? source.list().pipe(Effect_exports.map((tools) => tools.find((tool2) => tool2.name === name))) : source.describe(name)).pipe(Effect_exports.mapError((error) => accountProviderError(error, accountId)));
+        if (tool !== void 0) variants.push([accountId, tool]);
+      }
+      return variants.length === 0 ? void 0 : merge(name, variants);
+    }),
+    resolve: (name) => Effect_exports.gen(function* () {
+      const operations = /* @__PURE__ */ new Map();
+      for (const [accountId, source] of sources) {
+        const operation = yield* source.resolve(name).pipe(Effect_exports.mapError((error) => accountProviderError(error, accountId)));
+        if (operation !== void 0) operations.set(accountId, operation);
+      }
+      return operations.size === 0 ? void 0 : combineOperation(operations);
+    })
+  };
+};
+var combineNode = (variants) => {
+  const nodes = [...variants.values()];
+  const first = nodes[0];
+  if (first === void 0) throw new Error("An account operation must have at least one account");
+  switch (first.kind) {
+    case "query":
+    case "mutation":
+      return combineOperation(
+        narrow(
+          variants,
+          (node) => node.kind === "query" || node.kind === "mutation"
+        )
+      );
+    case "dynamic":
+      return combineDynamic(
+        narrow(variants, (node) => node.kind === "dynamic")
+      );
+    case "router": {
+      const routers = narrow(variants, (node) => node.kind === "router");
+      const keys = new Set([...routers.values()].flatMap((router2) => Object.keys(router2.children)));
+      return {
+        kind: "router",
+        ...first.meta === void 0 ? {} : { meta: first.meta },
+        children: Object.fromEntries(
+          [...keys].map((key) => {
+            const children = /* @__PURE__ */ new Map();
+            for (const [accountId, router2] of routers) {
+              const child = Object.hasOwn(router2.children, key) ? router2.children[key] : void 0;
+              if (child !== void 0) children.set(accountId, child);
+            }
+            return [key, combineNode(children)];
+          })
+        )
+      };
+    }
+  }
+};
+var narrow = (variants, is) => {
+  const narrowed = /* @__PURE__ */ new Map();
+  for (const [accountId, node] of variants) {
+    if (!is(node)) throw new Error("Each account's router must have the same shape");
+    narrowed.set(accountId, node);
+  }
+  return narrowed;
+};
+var accountRouter = (accounts, discover, options) => Effect_exports.runPromise(
   Effect_exports.gen(function* () {
-    const queries = /* @__PURE__ */ new Map();
-    const mutations = /* @__PURE__ */ new Map();
-    const sources = /* @__PURE__ */ new Map();
+    const routers = /* @__PURE__ */ new Map();
     for (const account of accounts) {
-      const operations = yield* Effect_exports.tryPromise({
-        try: () => discover(account),
+      const declaration2 = yield* Effect_exports.tryPromise({
+        try: async () => discover(account),
         catch: (error) => accountProviderError(error, account.id)
       });
-      if (sources.has(account.id))
+      if (routers.has(account.id))
         return yield* Effect_exports.die(new Error("Account selections must be unique"));
-      if (operations.dynamicTools !== void 0) sources.set(account.id, operations.dynamicTools);
-      for (const [source, target] of [
-        [operations.queries, queries],
-        [operations.mutations, mutations]
-      ]) {
-        for (const [name, declaration2] of Object.entries(source ?? {})) {
-          const operation = nativeOperation(declaration2);
-          if (operation === void 0)
-            return yield* Effect_exports.die(new Error("Expected a protocol operation"));
-          const group = target.get(name) ?? /* @__PURE__ */ new Map();
-          if (group.has(account.id))
-            return yield* Effect_exports.die(new Error("Account selections must be unique"));
-          group.set(account.id, operation);
-          target.set(name, group);
-        }
-      }
+      const router2 = nativeRouter(declaration2);
+      if (router2 === void 0) return yield* Effect_exports.die(new Error("Expected a protocol router"));
+      routers.set(account.id, router2);
     }
-    const declared = {
-      queries: combine("query", queries),
-      mutations: combine("mutation", mutations)
-    };
-    if (sources.size === 0) return declared;
-    const grouped = (read) => Effect_exports.gen(function* () {
-      const groups = /* @__PURE__ */ new Map();
-      for (const [accountId, source] of sources) {
-        const tools = yield* read(source).pipe(
-          Effect_exports.mapError((error) => accountProviderError(error, accountId))
-        );
-        for (const tool of tools) {
-          const variants = groups.get(tool.name) ?? [];
-          if (variants.some(([id2]) => id2 === accountId))
-            return yield* Effect_exports.die(new Error("Duplicate source operation"));
-          variants.push([accountId, tool]);
-          groups.set(tool.name, variants);
-        }
-      }
-      return groups;
-    });
-    return {
-      ...declared,
-      dynamicTools: {
-        list: () => grouped((source) => source.list()).pipe(
-          Effect_exports.map((groups) => [...groups].map(([name, variants]) => merge(name, variants)))
-        ),
-        summaries: () => grouped(
-          (source) => source.summaries === void 0 ? source.list() : source.summaries()
-        ).pipe(
-          Effect_exports.map(
-            (groups) => [...groups].map(([name, variants]) => mergeSummary(name, variants))
-          )
-        ),
-        describe: (name) => Effect_exports.gen(function* () {
-          const variants = [];
-          for (const [accountId, source] of sources) {
-            const tool = yield* (source.describe === void 0 ? source.list().pipe(Effect_exports.map((tools) => tools.find((tool2) => tool2.name === name))) : source.describe(name)).pipe(Effect_exports.mapError((error) => accountProviderError(error, accountId)));
-            if (tool !== void 0) variants.push([accountId, tool]);
-          }
-          return variants.length === 0 ? void 0 : merge(name, variants);
-        }),
-        resolve: (name) => Effect_exports.gen(function* () {
-          const kind = name.startsWith("queries.") ? "query" : "mutation";
-          const operations = /* @__PURE__ */ new Map();
-          for (const [accountId, source] of sources) {
-            const operation = yield* source.resolve(name).pipe(Effect_exports.mapError((error) => accountProviderError(error, accountId)));
-            if (operation !== void 0) {
-              if (operation.kind !== kind)
-                return yield* Effect_exports.die(new Error("Operation kind changed"));
-              operations.set(accountId, operation);
-            }
-          }
-          if (operations.size === 0) return void 0;
-          return nativeOperation(combine(kind, /* @__PURE__ */ new Map([[name, operations]]))[name]);
-        })
-      }
-    };
+    if (routers.size === 0) return routerDeclaration({ kind: "router", children: {} });
+    const combined = combineNode(routers);
+    if (combined.kind !== "router" && combined.kind !== "dynamic")
+      return yield* Effect_exports.die(new Error("Expected a protocol router"));
+    return routerDeclaration(combined);
   }),
   options
 );
 
-// src/implementation/dynamic-tools.ts
-var dynamicTools = (source) => ({
-  list: () => fromPromise(source.list)().pipe(
-    Effect_exports.flatMap(Schema_exports.decodeUnknownEffect(Schema_exports.Array(HostedTool)))
-  ),
-  resolve: (name) => fromPromise(source.resolve)(name).pipe(
-    Effect_exports.map((value) => {
-      if (value === void 0) return void 0;
-      const operation = nativeOperation(value);
-      if (operation === void 0) throw new Error("Expected an operation declaration");
-      return operation;
-    })
-  )
-});
-
 // src/implementation/dynamic-skills.ts
 var dynamicSkills = (source) => ({
-  list: fromPromise(async () => source.list())
+  list: fromPromise(async () => source.list(), "skills")
 });
 
 // src/contracts/app.ts
@@ -334,58 +398,102 @@ var NotImplemented = class extends Schema_exports.TaggedError()("NotImplemented"
 };
 
 // src/implementation/schedules.ts
-var declaration = (timing, operation, input) => {
+var declaration = (scope, timing, operation, input) => {
   const native = nativeOperation(operation);
   if (native === void 0 || native.kind !== "mutation")
     throw new Error("A schedule must reference a mutation");
+  if (scope === "app" && native.approval !== void 0)
+    throw new Error("An app schedule must reference a mutation without an approval");
   Schema_exports.decodeUnknownSync(native.input)(input);
-  return { operation, timing, input: Schema_exports.decodeUnknownSync(JsonValue)(input) };
+  return { scope, operation, timing, input: Schema_exports.decodeUnknownSync(JsonValue)(input) };
 };
-var interval = (duration, operation, input) => {
+var intervalTiming = (duration) => {
   const value = Schema_exports.decodeUnknownSync(Interval)(duration);
   const milliseconds = value.seconds !== void 0 ? value.seconds * 1e3 : value.minutes !== void 0 ? value.minutes * 6e4 : value.hours * 36e5;
-  return declaration(
-    Schema_exports.decodeUnknownSync(ScheduleTiming)({ kind: "interval", milliseconds }),
-    operation,
-    input
-  );
+  return Schema_exports.decodeUnknownSync(ScheduleTiming)({ kind: "interval", milliseconds });
 };
-var cron = (calendar, operation, input) => declaration(
-  {
-    kind: "cron",
-    calendar: Schema_exports.decodeUnknownSync(CalendarSchedule)({
-      ...calendar,
-      timezone: calendar.timezone ?? "UTC"
-    })
-  },
-  operation,
-  input
-);
+var cronTiming = (calendar) => ({
+  kind: "cron",
+  calendar: Schema_exports.decodeUnknownSync(CalendarSchedule)({
+    ...calendar,
+    timezone: calendar.timezone ?? "UTC"
+  })
+});
+var userInterval = (duration, operation, input) => declaration("user", intervalTiming(duration), operation, input);
+var userCron = (calendar, operation, input) => declaration("user", cronTiming(calendar), operation, input);
+var appInterval = (duration, operation, input) => declaration("app", intervalTiming(duration), operation, input);
+var appCron = (calendar, operation, input) => declaration("app", cronTiming(calendar), operation, input);
 
 // src/index.ts
+var isFields = (value) => typeof value === "object" && value !== null && Object.values(value).every(isSchema);
+var accountDecoder = (schema) => (
+  // SAFETY: the brand exists only in types; secret values are strings at runtime.
+  decoderOf(schema)
+);
+var exposureOf = (schema) => {
+  const marked = "fields" in schema && isFields(schema.fields) ? fieldExposure(schema.fields) : {};
+  return Object.keys(marked).length === 0 ? {} : { exposure: marked };
+};
+var fieldNames = (schema) => "fields" in schema && isFields(schema.fields) ? Object.keys(schema.fields) : schema === OAuth2AccessToken2 ? ["access_token"] : [];
+var placementsOf = (method, schema, request) => request === void 0 ? {} : {
+  request: declarePlacements(
+    method,
+    fieldNames(schema),
+    exposureOf(schema).exposure,
+    request
+  )
+};
 var OAuth2AccessToken2 = wrap(OAuth2AccessToken, false);
-var secrets2 = (options) => secrets({ label: options.label, fields: decoderOf(options.fields) });
+var secrets2 = (options) => secrets({
+  label: options.label,
+  fields: accountDecoder(options.fields),
+  ...exposureOf(options.fields),
+  // SAFETY: the callback receives references named by the schema's own keys.
+  ...placementsOf(
+    `"${options.label}"`,
+    options.fields,
+    options.request
+  )
+});
 function oauth22(options) {
-  const { response = OAuth2AccessToken2, ...config } = options;
-  return Effect_exports.runSync(oauth2(config, decoderOf(response)));
+  const { response = OAuth2AccessToken2, request, ...config } = options;
+  return Effect_exports.runSync(
+    oauth2(
+      config,
+      accountDecoder(response),
+      exposureOf(response).exposure,
+      // SAFETY: the callback receives references named by the response projection's own keys.
+      placementsOf("OAuth", response, request).request
+    )
+  );
 }
 var decodeJson2 = (response, schema) => {
   const native = {
     status: response.status,
-    json: () => Effect_exports.tryPromise({
-      try: () => response.json(),
-      catch: (error) => error
-    }).pipe(
-      Effect_exports.catch(
-        (error) => error instanceof SyntaxError ? Effect_exports.fail(new ResponseDecodeError()) : Effect_exports.die(error)
+    json: () => (
+      // oxlint-disable-next-line executor/authored-code-through-adapter -- a Response the app passes from its own code
+      Effect_exports.tryPromise({
+        try: () => response.json(),
+        catch: (error) => error
+      }).pipe(
+        Effect_exports.catch(
+          (error) => error instanceof SyntaxError ? Effect_exports.fail(new ResponseDecodeError()) : Effect_exports.die(error)
+        )
       )
     )
   };
   return Effect_exports.runPromise(decodeJson(native, decoderOf(schema)));
 };
+function query3(first, second) {
+  if (typeof first === "string") return query(first, second);
+  return query2(...[first, second]);
+}
 export {
   CacheError,
+  DeclarationInvalid,
   ElicitationFailed,
+  FetchOptionUnsupported,
+  NetworkRefused,
   NonRetryableError,
   NotImplemented,
   OAuth2AccessToken2 as OAuth2AccessToken,
@@ -394,18 +502,21 @@ export {
   ResponseStatusError,
   ValidationError,
   WorkflowFailure,
-  accountOperations,
+  accountRouter,
+  appCron,
+  appInterval,
   array,
+  base64,
+  basic,
+  bearer,
   boolean,
-  cron,
   decodeJson2 as decodeJson,
   defineApp,
-  defineDatabase,
   defineProvider,
+  dynamicRouter,
   dynamicSkills,
-  dynamicTools,
-  id,
-  interval,
+  event,
+  header,
   json,
   jsonSchema,
   literal,
@@ -413,12 +524,19 @@ export {
   number,
   oauth22 as oauth2,
   object,
-  query,
+  plain,
+  query3 as query,
+  raw,
   record,
+  renameTools,
+  router,
   secrets2 as secrets,
   string,
-  table,
-  userId,
+  t,
+  toolAnnotations,
+  userCron,
+  userInterval,
   withApproval,
+  withApprovals,
   workflow
 };