apps 0.0.1-beta.1 → 0.0.1-beta.100

package/types/apps/src/contracts/host.d.ts

@@ -1,242 +1,161 @@
 export * from "./skills.js";
-import { SkillLoadFailed, type SkillFile } from "./skills.js";
+import { type SkillFile } from "./skills.js";
 import { ProviderError } from "./provider-error.js";
-import { McpError } from "./mcp.js";
 import { OpenapiResponseError } from "./api-response-error.js";
-export { ApiErrorResponse, OpenapiResponseError } from "./api-response-error.js";
+export { ApiErrorResponse, maxApiErrorInstructionsLength, maxApiErrorMessageLength, OpenapiResponseError, } from "./api-response-error.js";
 export { ProviderError } from "./provider-error.js";
-export { McpError } from "./mcp.js";
+export { FetchOptionUnsupported, NetworkRefusal, NetworkRefused, networkRefusalHeader, networkRefusalResponse, networkRefusalStatus, } from "./network.js";
 import { WorkflowFailure, type WorkflowExecution, type WorkflowReplay, type WorkflowHostControls } from "./workflows.js";
 export * from "./workflows.js";
+export * from "./failure.js";
+import { DatabaseFieldReserved, DatabaseLimitExceeded } from "../../../app-data/src/contracts/database.js";
+export { DatabaseFieldReserved, DatabaseLimitExceeded } from "../../../app-data/src/contracts/database.js";
 /** Portable framework dispatch contracts. Requests never carry account bindings. */
 import { Context, Schema, type Effect, type Redacted } from "effect";
-import type { AppStorage } from "./storage.js";
+import type { AppSqlStorage } from "./sql.js";
 import type { InvocationTelemetry } from "../../../telemetry/src/index.js";
-export { AppStorageError, AppStorageUnavailable, StorageName, type AppStorage } from "./storage.js";
+export { type AppSqlStorage, type Sql, type SqlCursor, type SqlReader, type SqlRow, type SqlValue, } from "./sql.js";
 import { ElicitationFailed, type ElicitationHandler } from "./elicitation.js";
-export { ElicitationLimits, defaultElicitationLimits, FormElicitation, ElicitationResponse, ElicitationReply, ElicitationFailed, type ElicitationHandler, ApprovalElicitation, ApprovalResponse, approvalElicitation, } from "./elicitation.js";
+export { ElicitationLimits, defaultElicitationLimits, FormElicitation, ElicitationResponse, ElicitationReply, ElicitationFailed, type ElicitationHandler, ApprovalElicitation, ApprovalResponse, approvalElicitation, exactApprovalElicitation, } from "./elicitation.js";
 export { McpClientLimits, defaultMcpClientLimits } from "./mcp.js";
 export * from "./webhook-protocol.js";
+export * from "./events.js";
+export { AppIcon, AppIcons, appIconLimits } from "./icons.js";
+export * from "./placement.js";
 export { AccountId, HttpUrl } from "./schema.js";
-export { OAuthClientAuth, OAuthSecretClientAuth } from "./provider.js";
-/** Serializable auth methods shared with SDK hosts; protocol configuration has one schema. */
-export declare const DeclaredAuthMethod: Schema.Union<readonly [Schema.Struct<{
-    readonly type: Schema.Literal<"secrets">;
-    readonly label: Schema.String;
-    readonly fields: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
-}>, Schema.Struct<{
-    readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
-    readonly discover: Schema.String;
-    readonly authorizationUrl: Schema.optionalKey<Schema.Never>;
-    readonly tokenUrl: Schema.optionalKey<Schema.Never>;
-    readonly revocationUrl: Schema.optionalKey<Schema.Never>;
-    readonly scopes: Schema.optionalKey<Schema.$Array<Schema.String>>;
-    readonly grant: Schema.optionalKey<Schema.Literal<"authorization_code">>;
-    readonly authorizationParams: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
-    readonly tokenEndpointAuthMethod: Schema.optionalKey<Schema.Literals<readonly ["none", "client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>>;
-    readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
-    readonly type: Schema.Literal<"oauth2">;
-}>, Schema.Struct<{
-    readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
-    readonly authorizationUrl: Schema.String;
-    readonly tokenUrl: Schema.String;
-    readonly revocationUrl: Schema.optionalKey<Schema.String>;
-    readonly scopes: Schema.$Array<Schema.String>;
-    readonly issuer: Schema.optionalKey<Schema.String>;
-    readonly discover: Schema.optionalKey<Schema.Never>;
-    readonly grant: Schema.optionalKey<Schema.Literal<"authorization_code">>;
-    readonly authorizationParams: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
-    readonly tokenEndpointAuthMethod: Schema.optionalKey<Schema.Literals<readonly ["none", "client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>>;
-    readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
-    readonly type: Schema.Literal<"oauth2">;
-}>, Schema.Struct<{
-    readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
-    readonly grant: Schema.Literal<"client_credentials">;
-    readonly discover: Schema.String;
-    readonly authorizationUrl: Schema.optionalKey<Schema.Never>;
-    readonly tokenUrl: Schema.optionalKey<Schema.Never>;
-    readonly revocationUrl: Schema.optionalKey<Schema.Never>;
-    readonly scopes: Schema.optionalKey<Schema.$Array<Schema.String>>;
-    readonly tokenEndpointAuthMethod: Schema.Literals<readonly ["client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>;
-    readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
-    readonly type: Schema.Literal<"oauth2">;
-}>, Schema.Struct<{
-    readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
-    readonly grant: Schema.Literal<"client_credentials">;
-    readonly tokenUrl: Schema.String;
-    readonly revocationUrl: Schema.optionalKey<Schema.String>;
-    readonly scopes: Schema.$Array<Schema.String>;
-    readonly tokenEndpointAuthMethod: Schema.Literals<readonly ["client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>;
-    readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
-    readonly authorizationUrl: Schema.optionalKey<Schema.Never>;
-    readonly discover: Schema.optionalKey<Schema.Never>;
-    readonly type: Schema.Literal<"oauth2">;
-}>]>;
-/** Serializable declaration of a provider's named authentication methods. */
-export declare const DeclaredProvider: Schema.Struct<{
-    readonly name: Schema.NonEmptyString;
-    readonly auth: Schema.$Record<Schema.NonEmptyString, Schema.Union<readonly [Schema.Struct<{
-        readonly type: Schema.Literal<"secrets">;
-        readonly label: Schema.String;
-        readonly fields: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
-    }>, Schema.Struct<{
-        readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
-        readonly discover: Schema.String;
-        readonly authorizationUrl: Schema.optionalKey<Schema.Never>;
-        readonly tokenUrl: Schema.optionalKey<Schema.Never>;
-        readonly revocationUrl: Schema.optionalKey<Schema.Never>;
-        readonly scopes: Schema.optionalKey<Schema.$Array<Schema.String>>;
-        readonly grant: Schema.optionalKey<Schema.Literal<"authorization_code">>;
-        readonly authorizationParams: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
-        readonly tokenEndpointAuthMethod: Schema.optionalKey<Schema.Literals<readonly ["none", "client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>>;
-        readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
-        readonly type: Schema.Literal<"oauth2">;
-    }>, Schema.Struct<{
-        readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
-        readonly authorizationUrl: Schema.String;
-        readonly tokenUrl: Schema.String;
-        readonly revocationUrl: Schema.optionalKey<Schema.String>;
-        readonly scopes: Schema.$Array<Schema.String>;
-        readonly issuer: Schema.optionalKey<Schema.String>;
-        readonly discover: Schema.optionalKey<Schema.Never>;
-        readonly grant: Schema.optionalKey<Schema.Literal<"authorization_code">>;
-        readonly authorizationParams: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
-        readonly tokenEndpointAuthMethod: Schema.optionalKey<Schema.Literals<readonly ["none", "client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>>;
-        readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
-        readonly type: Schema.Literal<"oauth2">;
-    }>, Schema.Struct<{
-        readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
-        readonly grant: Schema.Literal<"client_credentials">;
-        readonly discover: Schema.String;
-        readonly authorizationUrl: Schema.optionalKey<Schema.Never>;
-        readonly tokenUrl: Schema.optionalKey<Schema.Never>;
-        readonly revocationUrl: Schema.optionalKey<Schema.Never>;
-        readonly scopes: Schema.optionalKey<Schema.$Array<Schema.String>>;
-        readonly tokenEndpointAuthMethod: Schema.Literals<readonly ["client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>;
-        readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
-        readonly type: Schema.Literal<"oauth2">;
-    }>, Schema.Struct<{
-        readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
-        readonly grant: Schema.Literal<"client_credentials">;
-        readonly tokenUrl: Schema.String;
-        readonly revocationUrl: Schema.optionalKey<Schema.String>;
-        readonly scopes: Schema.$Array<Schema.String>;
-        readonly tokenEndpointAuthMethod: Schema.Literals<readonly ["client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>;
-        readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
-        readonly authorizationUrl: Schema.optionalKey<Schema.Never>;
-        readonly discover: Schema.optionalKey<Schema.Never>;
-        readonly type: Schema.Literal<"oauth2">;
-    }>]>>;
-}>;
-/** Credential-free provider declaration; content matching remains host policy. */
-export type DeclaredProvider = typeof DeclaredProvider.Type;
-/** Account slots available without binding accounts or evaluating the app factory. */
-export declare const DeclaredRequirements: Schema.Struct<{
-    /** Protocol support of this retained framework build, not an author-declared requirement. */
-    readonly capabilities: Schema.optionalKey<Schema.Struct<{
-        readonly skills: Schema.Literal<true>;
-        /** Accepts inspect detail and tools. Earlier builds reject both as excess fields. */
-        readonly toolIndex: Schema.optionalKey<Schema.Literal<true>>;
-        /** Accepts skills sources and reports whether the catalog includes a live loader. */
-        readonly skillSources: Schema.optionalKey<Schema.Literal<true>>;
-        /** Accepts scheduled inspection. Earlier builds reject it as an excess field. */
-        readonly scheduledTools: Schema.optionalKey<Schema.Literal<true>>;
-    }>>;
-    readonly database: Schema.optionalKey<Schema.$Record<Schema.String, Schema.Struct<{
-        readonly fields: Schema.$Record<Schema.String, Schema.Struct<{
-            readonly kind: Schema.Literals<readonly ["string", "number", "boolean", "id", "userId"]>;
-            readonly optional: Schema.optional<Schema.Boolean>;
-            readonly default: Schema.optional<Schema.Union<readonly [Schema.String, Schema.Finite, Schema.Boolean]>>;
-            readonly references: Schema.optional<Schema.String>;
-        }>>;
-        readonly indexes: Schema.$Array<Schema.Struct<{
-            readonly name: Schema.String;
-            readonly fields: Schema.NonEmptyArray<Schema.String>;
-        }>>;
-    }>>>;
-    readonly accounts: Schema.$Record<Schema.NonEmptyString, Schema.Struct<{
-        readonly definition: Schema.Struct<{
-            readonly name: Schema.NonEmptyString;
-            readonly auth: Schema.$Record<Schema.NonEmptyString, Schema.Union<readonly [Schema.Struct<{
-                readonly type: Schema.Literal<"secrets">;
-                readonly label: Schema.String;
-                readonly fields: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
-            }>, Schema.Struct<{
-                readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
-                readonly discover: Schema.String;
-                readonly authorizationUrl: Schema.optionalKey<Schema.Never>;
-                readonly tokenUrl: Schema.optionalKey<Schema.Never>;
-                readonly revocationUrl: Schema.optionalKey<Schema.Never>;
-                readonly scopes: Schema.optionalKey<Schema.$Array<Schema.String>>;
-                readonly grant: Schema.optionalKey<Schema.Literal<"authorization_code">>;
-                readonly authorizationParams: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
-                readonly tokenEndpointAuthMethod: Schema.optionalKey<Schema.Literals<readonly ["none", "client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>>;
-                readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
-                readonly type: Schema.Literal<"oauth2">;
-            }>, Schema.Struct<{
-                readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
-                readonly authorizationUrl: Schema.String;
-                readonly tokenUrl: Schema.String;
-                readonly revocationUrl: Schema.optionalKey<Schema.String>;
-                readonly scopes: Schema.$Array<Schema.String>;
-                readonly issuer: Schema.optionalKey<Schema.String>;
-                readonly discover: Schema.optionalKey<Schema.Never>;
-                readonly grant: Schema.optionalKey<Schema.Literal<"authorization_code">>;
-                readonly authorizationParams: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
-                readonly tokenEndpointAuthMethod: Schema.optionalKey<Schema.Literals<readonly ["none", "client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>>;
-                readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
-                readonly type: Schema.Literal<"oauth2">;
-            }>, Schema.Struct<{
-                readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
-                readonly grant: Schema.Literal<"client_credentials">;
-                readonly discover: Schema.String;
-                readonly authorizationUrl: Schema.optionalKey<Schema.Never>;
-                readonly tokenUrl: Schema.optionalKey<Schema.Never>;
-                readonly revocationUrl: Schema.optionalKey<Schema.Never>;
-                readonly scopes: Schema.optionalKey<Schema.$Array<Schema.String>>;
-                readonly tokenEndpointAuthMethod: Schema.Literals<readonly ["client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>;
-                readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
-                readonly type: Schema.Literal<"oauth2">;
-            }>, Schema.Struct<{
-                readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
-                readonly grant: Schema.Literal<"client_credentials">;
-                readonly tokenUrl: Schema.String;
-                readonly revocationUrl: Schema.optionalKey<Schema.String>;
-                readonly scopes: Schema.$Array<Schema.String>;
-                readonly tokenEndpointAuthMethod: Schema.Literals<readonly ["client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>;
-                readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
-                readonly authorizationUrl: Schema.optionalKey<Schema.Never>;
-                readonly discover: Schema.optionalKey<Schema.Never>;
-                readonly type: Schema.Literal<"oauth2">;
-            }>]>>;
-        }>;
-        readonly cardinality: Schema.Literals<readonly ["one", "many"]>;
-    }>>;
-}>;
-/** Parsed declared account requirements. */
-export type DeclaredRequirements = typeof DeclaredRequirements.Type;
-/** Host-resolved credentials for one stable saved account. Never a request DTO. */
-export declare const ResolvedAccount: Schema.Struct<{
+export { OAuthAuthorizationParams, OAuthClientAuth, OAuthSecretClientAuth, OAuthTokenRequestFormat, OAuthTokenResponse, reservedAuthorizationParams, type ReservedAuthorizationParam, } from "./provider.js";
+/**
+ * The host protocol this framework speaks and its wire schemas, from `protocols/current.ts`. The
+ * released protocol modules are frozen records that host adapters read.
+ */
+export { frameworkProtocol } from "./protocol-version.js";
+export { protocol1 } from "./protocols/1.js";
+export { protocol2 } from "./protocols/2.js";
+export { protocol3 } from "./protocols/3.js";
+export { protocol4 } from "./protocols/4.js";
+export { protocol5 } from "./protocols/5.js";
+export { protocol6 } from "./protocols/6.js";
+export { protocol7 } from "./protocols/7.js";
+export { protocol8 } from "./protocols/8.js";
+export { protocol9 } from "./protocols/9.js";
+export { protocol10 } from "./protocols/10.js";
+export { protocol11 } from "./protocols/11.js";
+export { protocol12 } from "./protocols/12.js";
+export { current as protocol13, AccountCheckCommand, CredentialHost, MigrateCommand, MigrateResult, } from "./protocols/current.js";
+export { AccountCheckResult, AccountInfo } from "./provider.js";
+import { HostAccountsInvalid, HostDeclarationInvalid, HostEvaluationFailed, HostInputInvalid, HostKindMismatch, HostOperationFailed, HostOperationNotFound, HostOutputInvalid, HostRequestInvalid, HostToolApprovalRequired, HostToolBlocked, HostToolNotFound, HostToolPolicyFailed, McpError, SkillLoadFailed, SkillSources, type InvocationDeadline, ResolvedAccounts, type SkillCatalogResponse, type TrustedToolApproval } from "./protocols/current.js";
+export { DeclaredRequirements, HostRequest } from "./protocols/current.js";
+/**
+ * The MCP and skill loader failures as they cross the host boundary. Apps throw the author-facing
+ * classes from `apps/mcp` and `apps/skills`.
+ */
+export { McpError, SkillLoadFailed } from "./protocols/current.js";
+export { DeclaredAuthMethod, DeclaredProvider, DeclaredAccountSlot, DeclaredAccountSlots, ResolvedAccount, ResolvedAccounts, ResolvedAccountSlots, TrustedToolApproval, InvocationDeadline, HostedTool, HostedToolSummary, HostRouterError, HostedRouter, HostedCatalog, HostedCatalogSummary, HostedSharedCatalog, HostedSharedTool, SharedSchemaKey, SkillSources, SkillCatalogResponse, HostRequestInvalid, HostAccountsInvalid, HostDeclarationInvalid, HostEvaluationFailed, HostOperationNotFound, HostOperationFailed, HostToolNotFound, HostKindMismatch, InputProblem, maxInputProblems, HostInputInvalid, HostToolBlocked, HostToolApprovalRequired, HostToolPolicyFailed, HostOutputInvalid, HostError, HostResponse, HostInvocation, } from "./protocols/current.js";
+/** Raw host inputs; the host boundary parses and redacts these immediately. */
+export type ResolvedAccountsInput = typeof ResolvedAccounts.Encoded;
+/**
+ * An account as the host sends it to the runner. `managed` marks a credential issued to the
+ * instance operator's own OAuth client: the runner seals every one of its strings, whatever the
+ * method exposes, so that only the operator's placement can send it. The runner removes the mark;
+ * a bundle reads a `ResolvedAccount`. Not part of any host protocol.
+ */
+export declare const HostAccount: Schema.Struct<{
+    readonly managed: Schema.optionalKey<Schema.Literal<true>>;
     readonly id: Schema.brand<Schema.String, "acc">;
     readonly provider: Schema.Struct<{
         readonly name: Schema.NonEmptyString;
         readonly auth: Schema.$Record<Schema.NonEmptyString, Schema.Union<readonly [Schema.Struct<{
+            readonly plain: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+            readonly raw: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+            readonly request: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+                readonly in: Schema.Literal<"header">;
+                readonly name: Schema.String;
+                readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                    readonly field: Schema.NonEmptyString;
+                }>, Schema.Struct<{
+                    readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>]>>;
+                }>]>>;
+            }>, Schema.Struct<{
+                readonly in: Schema.Literal<"query">;
+                readonly name: Schema.NonEmptyString;
+                readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                    readonly field: Schema.NonEmptyString;
+                }>, Schema.Struct<{
+                    readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>]>>;
+                }>]>>;
+            }>]>>>;
             readonly type: Schema.Literal<"secrets">;
             readonly label: Schema.String;
             readonly fields: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
         }>, Schema.Struct<{
+            readonly plain: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+            readonly raw: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+            readonly request: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+                readonly in: Schema.Literal<"header">;
+                readonly name: Schema.String;
+                readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                    readonly field: Schema.NonEmptyString;
+                }>, Schema.Struct<{
+                    readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>]>>;
+                }>]>>;
+            }>, Schema.Struct<{
+                readonly in: Schema.Literal<"query">;
+                readonly name: Schema.NonEmptyString;
+                readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                    readonly field: Schema.NonEmptyString;
+                }>, Schema.Struct<{
+                    readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>]>>;
+                }>]>>;
+            }>]>>>;
             readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
             readonly discover: Schema.String;
+            readonly authorizationServerMetadataUrl: Schema.optionalKey<Schema.String>;
             readonly authorizationUrl: Schema.optionalKey<Schema.Never>;
             readonly tokenUrl: Schema.optionalKey<Schema.Never>;
             readonly revocationUrl: Schema.optionalKey<Schema.Never>;
             readonly scopes: Schema.optionalKey<Schema.$Array<Schema.String>>;
+            readonly tokenResponse: Schema.optionalKey<Schema.Struct<{
+                readonly path: Schema.String;
+            }>>;
             readonly grant: Schema.optionalKey<Schema.Literal<"authorization_code">>;
             readonly authorizationParams: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
             readonly tokenEndpointAuthMethod: Schema.optionalKey<Schema.Literals<readonly ["none", "client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>>;
             readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+            readonly scopeSeparator: Schema.optionalKey<Schema.String>;
+            readonly tokenRequestFormat: Schema.optionalKey<Schema.Literals<readonly ["form", "json"]>>;
             readonly type: Schema.Literal<"oauth2">;
         }>, Schema.Struct<{
+            readonly plain: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+            readonly raw: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+            readonly request: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+                readonly in: Schema.Literal<"header">;
+                readonly name: Schema.String;
+                readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                    readonly field: Schema.NonEmptyString;
+                }>, Schema.Struct<{
+                    readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>]>>;
+                }>]>>;
+            }>, Schema.Struct<{
+                readonly in: Schema.Literal<"query">;
+                readonly name: Schema.NonEmptyString;
+                readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                    readonly field: Schema.NonEmptyString;
+                }>, Schema.Struct<{
+                    readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>]>>;
+                }>]>>;
+            }>]>>>;
             readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
             readonly authorizationUrl: Schema.String;
             readonly tokenUrl: Schema.String;
@@ -244,62 +163,197 @@ export declare const ResolvedAccount: Schema.Struct<{
             readonly scopes: Schema.$Array<Schema.String>;
             readonly issuer: Schema.optionalKey<Schema.String>;
             readonly discover: Schema.optionalKey<Schema.Never>;
+            readonly authorizationServerMetadataUrl: Schema.optionalKey<Schema.Never>;
+            readonly tokenResponse: Schema.optionalKey<Schema.Struct<{
+                readonly path: Schema.String;
+            }>>;
             readonly grant: Schema.optionalKey<Schema.Literal<"authorization_code">>;
             readonly authorizationParams: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
             readonly tokenEndpointAuthMethod: Schema.optionalKey<Schema.Literals<readonly ["none", "client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>>;
             readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+            readonly scopeSeparator: Schema.optionalKey<Schema.String>;
+            readonly tokenRequestFormat: Schema.optionalKey<Schema.Literals<readonly ["form", "json"]>>;
             readonly type: Schema.Literal<"oauth2">;
         }>, Schema.Struct<{
+            readonly plain: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+            readonly raw: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+            readonly request: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+                readonly in: Schema.Literal<"header">;
+                readonly name: Schema.String;
+                readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                    readonly field: Schema.NonEmptyString;
+                }>, Schema.Struct<{
+                    readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>]>>;
+                }>]>>;
+            }>, Schema.Struct<{
+                readonly in: Schema.Literal<"query">;
+                readonly name: Schema.NonEmptyString;
+                readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                    readonly field: Schema.NonEmptyString;
+                }>, Schema.Struct<{
+                    readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>]>>;
+                }>]>>;
+            }>]>>>;
             readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+            readonly tokenEndpointAuthMethod: Schema.Literals<readonly ["client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>;
+            readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+            readonly scopeSeparator: Schema.optionalKey<Schema.String>;
+            readonly tokenRequestFormat: Schema.optionalKey<Schema.Literals<readonly ["form", "json"]>>;
             readonly grant: Schema.Literal<"client_credentials">;
             readonly discover: Schema.String;
+            readonly authorizationServerMetadataUrl: Schema.optionalKey<Schema.String>;
             readonly authorizationUrl: Schema.optionalKey<Schema.Never>;
             readonly tokenUrl: Schema.optionalKey<Schema.Never>;
             readonly revocationUrl: Schema.optionalKey<Schema.Never>;
             readonly scopes: Schema.optionalKey<Schema.$Array<Schema.String>>;
-            readonly tokenEndpointAuthMethod: Schema.Literals<readonly ["client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>;
-            readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
             readonly type: Schema.Literal<"oauth2">;
         }>, Schema.Struct<{
+            readonly plain: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+            readonly raw: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+            readonly request: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+                readonly in: Schema.Literal<"header">;
+                readonly name: Schema.String;
+                readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                    readonly field: Schema.NonEmptyString;
+                }>, Schema.Struct<{
+                    readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>]>>;
+                }>]>>;
+            }>, Schema.Struct<{
+                readonly in: Schema.Literal<"query">;
+                readonly name: Schema.NonEmptyString;
+                readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                    readonly field: Schema.NonEmptyString;
+                }>, Schema.Struct<{
+                    readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>]>>;
+                }>]>>;
+            }>]>>>;
             readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
-            readonly grant: Schema.Literal<"client_credentials">;
-            readonly tokenUrl: Schema.String;
-            readonly revocationUrl: Schema.optionalKey<Schema.String>;
-            readonly scopes: Schema.$Array<Schema.String>;
             readonly tokenEndpointAuthMethod: Schema.Literals<readonly ["client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>;
             readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
             readonly authorizationUrl: Schema.optionalKey<Schema.Never>;
             readonly discover: Schema.optionalKey<Schema.Never>;
+            readonly authorizationServerMetadataUrl: Schema.optionalKey<Schema.Never>;
+            readonly scopeSeparator: Schema.optionalKey<Schema.String>;
+            readonly tokenRequestFormat: Schema.optionalKey<Schema.Literals<readonly ["form", "json"]>>;
+            readonly grant: Schema.Literal<"client_credentials">;
+            readonly tokenUrl: Schema.String;
+            readonly revocationUrl: Schema.optionalKey<Schema.String>;
+            readonly scopes: Schema.$Array<Schema.String>;
             readonly type: Schema.Literal<"oauth2">;
         }>]>>;
+        readonly hosts: Schema.optionalKey<Schema.$Array<Schema.String>>;
     }>;
     readonly method: Schema.NonEmptyString;
+    readonly generation: Schema.optionalKey<Schema.Int>;
     readonly fields: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
 }>;
-/** Parsed host account binding. */
-export type ResolvedAccount = typeof ResolvedAccount.Type;
-/** Full saved selection resolved by the trusted caller; [] differs from a missing slot. */
-export declare const ResolvedAccounts: Schema.$Record<Schema.NonEmptyString, Schema.Union<readonly [Schema.Struct<{
+export type HostAccount = typeof HostAccount.Type;
+/** One scope's accounts as the host sends them to the runner; see `HostAccount`. */
+export declare const HostAccountSlots: Schema.$Record<Schema.NonEmptyString, Schema.Union<readonly [Schema.Struct<{
+    readonly managed: Schema.optionalKey<Schema.Literal<true>>;
     readonly id: Schema.brand<Schema.String, "acc">;
     readonly provider: Schema.Struct<{
         readonly name: Schema.NonEmptyString;
         readonly auth: Schema.$Record<Schema.NonEmptyString, Schema.Union<readonly [Schema.Struct<{
+            readonly plain: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+            readonly raw: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+            readonly request: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+                readonly in: Schema.Literal<"header">;
+                readonly name: Schema.String;
+                readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                    readonly field: Schema.NonEmptyString;
+                }>, Schema.Struct<{
+                    readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>]>>;
+                }>]>>;
+            }>, Schema.Struct<{
+                readonly in: Schema.Literal<"query">;
+                readonly name: Schema.NonEmptyString;
+                readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                    readonly field: Schema.NonEmptyString;
+                }>, Schema.Struct<{
+                    readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>]>>;
+                }>]>>;
+            }>]>>>;
             readonly type: Schema.Literal<"secrets">;
             readonly label: Schema.String;
             readonly fields: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
         }>, Schema.Struct<{
+            readonly plain: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+            readonly raw: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+            readonly request: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+                readonly in: Schema.Literal<"header">;
+                readonly name: Schema.String;
+                readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                    readonly field: Schema.NonEmptyString;
+                }>, Schema.Struct<{
+                    readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>]>>;
+                }>]>>;
+            }>, Schema.Struct<{
+                readonly in: Schema.Literal<"query">;
+                readonly name: Schema.NonEmptyString;
+                readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                    readonly field: Schema.NonEmptyString;
+                }>, Schema.Struct<{
+                    readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>]>>;
+                }>]>>;
+            }>]>>>;
             readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
             readonly discover: Schema.String;
+            readonly authorizationServerMetadataUrl: Schema.optionalKey<Schema.String>;
             readonly authorizationUrl: Schema.optionalKey<Schema.Never>;
             readonly tokenUrl: Schema.optionalKey<Schema.Never>;
             readonly revocationUrl: Schema.optionalKey<Schema.Never>;
             readonly scopes: Schema.optionalKey<Schema.$Array<Schema.String>>;
+            readonly tokenResponse: Schema.optionalKey<Schema.Struct<{
+                readonly path: Schema.String;
+            }>>;
             readonly grant: Schema.optionalKey<Schema.Literal<"authorization_code">>;
             readonly authorizationParams: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
             readonly tokenEndpointAuthMethod: Schema.optionalKey<Schema.Literals<readonly ["none", "client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>>;
             readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+            readonly scopeSeparator: Schema.optionalKey<Schema.String>;
+            readonly tokenRequestFormat: Schema.optionalKey<Schema.Literals<readonly ["form", "json"]>>;
             readonly type: Schema.Literal<"oauth2">;
         }>, Schema.Struct<{
+            readonly plain: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+            readonly raw: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+            readonly request: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+                readonly in: Schema.Literal<"header">;
+                readonly name: Schema.String;
+                readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                    readonly field: Schema.NonEmptyString;
+                }>, Schema.Struct<{
+                    readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>]>>;
+                }>]>>;
+            }>, Schema.Struct<{
+                readonly in: Schema.Literal<"query">;
+                readonly name: Schema.NonEmptyString;
+                readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                    readonly field: Schema.NonEmptyString;
+                }>, Schema.Struct<{
+                    readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>]>>;
+                }>]>>;
+            }>]>>>;
             readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
             readonly authorizationUrl: Schema.String;
             readonly tokenUrl: Schema.String;
@@ -307,58 +361,194 @@ export declare const ResolvedAccounts: Schema.$Record<Schema.NonEmptyString, Sch
             readonly scopes: Schema.$Array<Schema.String>;
             readonly issuer: Schema.optionalKey<Schema.String>;
             readonly discover: Schema.optionalKey<Schema.Never>;
+            readonly authorizationServerMetadataUrl: Schema.optionalKey<Schema.Never>;
+            readonly tokenResponse: Schema.optionalKey<Schema.Struct<{
+                readonly path: Schema.String;
+            }>>;
             readonly grant: Schema.optionalKey<Schema.Literal<"authorization_code">>;
             readonly authorizationParams: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
             readonly tokenEndpointAuthMethod: Schema.optionalKey<Schema.Literals<readonly ["none", "client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>>;
             readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+            readonly scopeSeparator: Schema.optionalKey<Schema.String>;
+            readonly tokenRequestFormat: Schema.optionalKey<Schema.Literals<readonly ["form", "json"]>>;
             readonly type: Schema.Literal<"oauth2">;
         }>, Schema.Struct<{
+            readonly plain: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+            readonly raw: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+            readonly request: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+                readonly in: Schema.Literal<"header">;
+                readonly name: Schema.String;
+                readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                    readonly field: Schema.NonEmptyString;
+                }>, Schema.Struct<{
+                    readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>]>>;
+                }>]>>;
+            }>, Schema.Struct<{
+                readonly in: Schema.Literal<"query">;
+                readonly name: Schema.NonEmptyString;
+                readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                    readonly field: Schema.NonEmptyString;
+                }>, Schema.Struct<{
+                    readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>]>>;
+                }>]>>;
+            }>]>>>;
             readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+            readonly tokenEndpointAuthMethod: Schema.Literals<readonly ["client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>;
+            readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+            readonly scopeSeparator: Schema.optionalKey<Schema.String>;
+            readonly tokenRequestFormat: Schema.optionalKey<Schema.Literals<readonly ["form", "json"]>>;
             readonly grant: Schema.Literal<"client_credentials">;
             readonly discover: Schema.String;
+            readonly authorizationServerMetadataUrl: Schema.optionalKey<Schema.String>;
             readonly authorizationUrl: Schema.optionalKey<Schema.Never>;
             readonly tokenUrl: Schema.optionalKey<Schema.Never>;
             readonly revocationUrl: Schema.optionalKey<Schema.Never>;
             readonly scopes: Schema.optionalKey<Schema.$Array<Schema.String>>;
-            readonly tokenEndpointAuthMethod: Schema.Literals<readonly ["client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>;
-            readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
             readonly type: Schema.Literal<"oauth2">;
         }>, Schema.Struct<{
+            readonly plain: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+            readonly raw: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+            readonly request: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+                readonly in: Schema.Literal<"header">;
+                readonly name: Schema.String;
+                readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                    readonly field: Schema.NonEmptyString;
+                }>, Schema.Struct<{
+                    readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>]>>;
+                }>]>>;
+            }>, Schema.Struct<{
+                readonly in: Schema.Literal<"query">;
+                readonly name: Schema.NonEmptyString;
+                readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                    readonly field: Schema.NonEmptyString;
+                }>, Schema.Struct<{
+                    readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>]>>;
+                }>]>>;
+            }>]>>>;
             readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
-            readonly grant: Schema.Literal<"client_credentials">;
-            readonly tokenUrl: Schema.String;
-            readonly revocationUrl: Schema.optionalKey<Schema.String>;
-            readonly scopes: Schema.$Array<Schema.String>;
             readonly tokenEndpointAuthMethod: Schema.Literals<readonly ["client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>;
             readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
             readonly authorizationUrl: Schema.optionalKey<Schema.Never>;
             readonly discover: Schema.optionalKey<Schema.Never>;
+            readonly authorizationServerMetadataUrl: Schema.optionalKey<Schema.Never>;
+            readonly scopeSeparator: Schema.optionalKey<Schema.String>;
+            readonly tokenRequestFormat: Schema.optionalKey<Schema.Literals<readonly ["form", "json"]>>;
+            readonly grant: Schema.Literal<"client_credentials">;
+            readonly tokenUrl: Schema.String;
+            readonly revocationUrl: Schema.optionalKey<Schema.String>;
+            readonly scopes: Schema.$Array<Schema.String>;
             readonly type: Schema.Literal<"oauth2">;
         }>]>>;
+        readonly hosts: Schema.optionalKey<Schema.$Array<Schema.String>>;
     }>;
     readonly method: Schema.NonEmptyString;
+    readonly generation: Schema.optionalKey<Schema.Int>;
     readonly fields: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
 }>, Schema.$Array<Schema.Struct<{
+    readonly managed: Schema.optionalKey<Schema.Literal<true>>;
     readonly id: Schema.brand<Schema.String, "acc">;
     readonly provider: Schema.Struct<{
         readonly name: Schema.NonEmptyString;
         readonly auth: Schema.$Record<Schema.NonEmptyString, Schema.Union<readonly [Schema.Struct<{
+            readonly plain: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+            readonly raw: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+            readonly request: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+                readonly in: Schema.Literal<"header">;
+                readonly name: Schema.String;
+                readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                    readonly field: Schema.NonEmptyString;
+                }>, Schema.Struct<{
+                    readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>]>>;
+                }>]>>;
+            }>, Schema.Struct<{
+                readonly in: Schema.Literal<"query">;
+                readonly name: Schema.NonEmptyString;
+                readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                    readonly field: Schema.NonEmptyString;
+                }>, Schema.Struct<{
+                    readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>]>>;
+                }>]>>;
+            }>]>>>;
             readonly type: Schema.Literal<"secrets">;
             readonly label: Schema.String;
             readonly fields: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
         }>, Schema.Struct<{
+            readonly plain: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+            readonly raw: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+            readonly request: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+                readonly in: Schema.Literal<"header">;
+                readonly name: Schema.String;
+                readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                    readonly field: Schema.NonEmptyString;
+                }>, Schema.Struct<{
+                    readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>]>>;
+                }>]>>;
+            }>, Schema.Struct<{
+                readonly in: Schema.Literal<"query">;
+                readonly name: Schema.NonEmptyString;
+                readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                    readonly field: Schema.NonEmptyString;
+                }>, Schema.Struct<{
+                    readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>]>>;
+                }>]>>;
+            }>]>>>;
             readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
             readonly discover: Schema.String;
+            readonly authorizationServerMetadataUrl: Schema.optionalKey<Schema.String>;
             readonly authorizationUrl: Schema.optionalKey<Schema.Never>;
             readonly tokenUrl: Schema.optionalKey<Schema.Never>;
             readonly revocationUrl: Schema.optionalKey<Schema.Never>;
             readonly scopes: Schema.optionalKey<Schema.$Array<Schema.String>>;
+            readonly tokenResponse: Schema.optionalKey<Schema.Struct<{
+                readonly path: Schema.String;
+            }>>;
             readonly grant: Schema.optionalKey<Schema.Literal<"authorization_code">>;
             readonly authorizationParams: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
             readonly tokenEndpointAuthMethod: Schema.optionalKey<Schema.Literals<readonly ["none", "client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>>;
             readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+            readonly scopeSeparator: Schema.optionalKey<Schema.String>;
+            readonly tokenRequestFormat: Schema.optionalKey<Schema.Literals<readonly ["form", "json"]>>;
             readonly type: Schema.Literal<"oauth2">;
         }>, Schema.Struct<{
+            readonly plain: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+            readonly raw: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+            readonly request: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+                readonly in: Schema.Literal<"header">;
+                readonly name: Schema.String;
+                readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                    readonly field: Schema.NonEmptyString;
+                }>, Schema.Struct<{
+                    readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>]>>;
+                }>]>>;
+            }>, Schema.Struct<{
+                readonly in: Schema.Literal<"query">;
+                readonly name: Schema.NonEmptyString;
+                readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                    readonly field: Schema.NonEmptyString;
+                }>, Schema.Struct<{
+                    readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>]>>;
+                }>]>>;
+            }>]>>>;
             readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
             readonly authorizationUrl: Schema.String;
             readonly tokenUrl: Schema.String;
@@ -366,50 +556,893 @@ export declare const ResolvedAccounts: Schema.$Record<Schema.NonEmptyString, Sch
             readonly scopes: Schema.$Array<Schema.String>;
             readonly issuer: Schema.optionalKey<Schema.String>;
             readonly discover: Schema.optionalKey<Schema.Never>;
+            readonly authorizationServerMetadataUrl: Schema.optionalKey<Schema.Never>;
+            readonly tokenResponse: Schema.optionalKey<Schema.Struct<{
+                readonly path: Schema.String;
+            }>>;
             readonly grant: Schema.optionalKey<Schema.Literal<"authorization_code">>;
             readonly authorizationParams: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
             readonly tokenEndpointAuthMethod: Schema.optionalKey<Schema.Literals<readonly ["none", "client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>>;
             readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+            readonly scopeSeparator: Schema.optionalKey<Schema.String>;
+            readonly tokenRequestFormat: Schema.optionalKey<Schema.Literals<readonly ["form", "json"]>>;
             readonly type: Schema.Literal<"oauth2">;
         }>, Schema.Struct<{
+            readonly plain: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+            readonly raw: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+            readonly request: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+                readonly in: Schema.Literal<"header">;
+                readonly name: Schema.String;
+                readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                    readonly field: Schema.NonEmptyString;
+                }>, Schema.Struct<{
+                    readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>]>>;
+                }>]>>;
+            }>, Schema.Struct<{
+                readonly in: Schema.Literal<"query">;
+                readonly name: Schema.NonEmptyString;
+                readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                    readonly field: Schema.NonEmptyString;
+                }>, Schema.Struct<{
+                    readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>]>>;
+                }>]>>;
+            }>]>>>;
             readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+            readonly tokenEndpointAuthMethod: Schema.Literals<readonly ["client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>;
+            readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+            readonly scopeSeparator: Schema.optionalKey<Schema.String>;
+            readonly tokenRequestFormat: Schema.optionalKey<Schema.Literals<readonly ["form", "json"]>>;
             readonly grant: Schema.Literal<"client_credentials">;
             readonly discover: Schema.String;
+            readonly authorizationServerMetadataUrl: Schema.optionalKey<Schema.String>;
             readonly authorizationUrl: Schema.optionalKey<Schema.Never>;
             readonly tokenUrl: Schema.optionalKey<Schema.Never>;
             readonly revocationUrl: Schema.optionalKey<Schema.Never>;
             readonly scopes: Schema.optionalKey<Schema.$Array<Schema.String>>;
-            readonly tokenEndpointAuthMethod: Schema.Literals<readonly ["client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>;
-            readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
             readonly type: Schema.Literal<"oauth2">;
         }>, Schema.Struct<{
+            readonly plain: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+            readonly raw: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+            readonly request: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+                readonly in: Schema.Literal<"header">;
+                readonly name: Schema.String;
+                readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                    readonly field: Schema.NonEmptyString;
+                }>, Schema.Struct<{
+                    readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>]>>;
+                }>]>>;
+            }>, Schema.Struct<{
+                readonly in: Schema.Literal<"query">;
+                readonly name: Schema.NonEmptyString;
+                readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                    readonly field: Schema.NonEmptyString;
+                }>, Schema.Struct<{
+                    readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>]>>;
+                }>]>>;
+            }>]>>>;
             readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
-            readonly grant: Schema.Literal<"client_credentials">;
-            readonly tokenUrl: Schema.String;
-            readonly revocationUrl: Schema.optionalKey<Schema.String>;
-            readonly scopes: Schema.$Array<Schema.String>;
             readonly tokenEndpointAuthMethod: Schema.Literals<readonly ["client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>;
             readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
             readonly authorizationUrl: Schema.optionalKey<Schema.Never>;
             readonly discover: Schema.optionalKey<Schema.Never>;
+            readonly authorizationServerMetadataUrl: Schema.optionalKey<Schema.Never>;
+            readonly scopeSeparator: Schema.optionalKey<Schema.String>;
+            readonly tokenRequestFormat: Schema.optionalKey<Schema.Literals<readonly ["form", "json"]>>;
+            readonly grant: Schema.Literal<"client_credentials">;
+            readonly tokenUrl: Schema.String;
+            readonly revocationUrl: Schema.optionalKey<Schema.String>;
+            readonly scopes: Schema.$Array<Schema.String>;
             readonly type: Schema.Literal<"oauth2">;
         }>]>>;
+        readonly hosts: Schema.optionalKey<Schema.$Array<Schema.String>>;
     }>;
     readonly method: Schema.NonEmptyString;
+    readonly generation: Schema.optionalKey<Schema.Int>;
     readonly fields: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
 }>>]>>;
-/** Raw host inputs; the host boundary parses and redacts these immediately. */
-export type ResolvedAccountsInput = typeof ResolvedAccounts.Encoded;
-/** Parsed host selections, kept redacted until native account binding. */
-export type ResolvedAccounts = typeof ResolvedAccounts.Type;
-/** Trusted approval for one decoded call. Never accepted in public command JSON. */
-export declare const TrustedToolApproval: Schema.Struct<{
-    readonly tool: Schema.NonEmptyString;
-    readonly input: Schema.Codec<Schema.Json, Schema.Json, never, never>;
+export type HostAccountSlots = typeof HostAccountSlots.Type;
+/**
+ * An invocation's accounts by scope as the host sends them to the runner; see `HostAccount`.
+ * `user` is absent for work without a caller, as in `ResolvedAccounts`.
+ */
+export declare const HostAccounts: Schema.Struct<{
+    readonly app: Schema.$Record<Schema.NonEmptyString, Schema.Union<readonly [Schema.Struct<{
+        readonly managed: Schema.optionalKey<Schema.Literal<true>>;
+        readonly id: Schema.brand<Schema.String, "acc">;
+        readonly provider: Schema.Struct<{
+            readonly name: Schema.NonEmptyString;
+            readonly auth: Schema.$Record<Schema.NonEmptyString, Schema.Union<readonly [Schema.Struct<{
+                readonly plain: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly raw: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly request: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+                    readonly in: Schema.Literal<"header">;
+                    readonly name: Schema.String;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>, Schema.Struct<{
+                    readonly in: Schema.Literal<"query">;
+                    readonly name: Schema.NonEmptyString;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>]>>>;
+                readonly type: Schema.Literal<"secrets">;
+                readonly label: Schema.String;
+                readonly fields: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+            }>, Schema.Struct<{
+                readonly plain: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly raw: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly request: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+                    readonly in: Schema.Literal<"header">;
+                    readonly name: Schema.String;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>, Schema.Struct<{
+                    readonly in: Schema.Literal<"query">;
+                    readonly name: Schema.NonEmptyString;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>]>>>;
+                readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+                readonly discover: Schema.String;
+                readonly authorizationServerMetadataUrl: Schema.optionalKey<Schema.String>;
+                readonly authorizationUrl: Schema.optionalKey<Schema.Never>;
+                readonly tokenUrl: Schema.optionalKey<Schema.Never>;
+                readonly revocationUrl: Schema.optionalKey<Schema.Never>;
+                readonly scopes: Schema.optionalKey<Schema.$Array<Schema.String>>;
+                readonly tokenResponse: Schema.optionalKey<Schema.Struct<{
+                    readonly path: Schema.String;
+                }>>;
+                readonly grant: Schema.optionalKey<Schema.Literal<"authorization_code">>;
+                readonly authorizationParams: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
+                readonly tokenEndpointAuthMethod: Schema.optionalKey<Schema.Literals<readonly ["none", "client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>>;
+                readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+                readonly scopeSeparator: Schema.optionalKey<Schema.String>;
+                readonly tokenRequestFormat: Schema.optionalKey<Schema.Literals<readonly ["form", "json"]>>;
+                readonly type: Schema.Literal<"oauth2">;
+            }>, Schema.Struct<{
+                readonly plain: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly raw: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly request: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+                    readonly in: Schema.Literal<"header">;
+                    readonly name: Schema.String;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>, Schema.Struct<{
+                    readonly in: Schema.Literal<"query">;
+                    readonly name: Schema.NonEmptyString;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>]>>>;
+                readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+                readonly authorizationUrl: Schema.String;
+                readonly tokenUrl: Schema.String;
+                readonly revocationUrl: Schema.optionalKey<Schema.String>;
+                readonly scopes: Schema.$Array<Schema.String>;
+                readonly issuer: Schema.optionalKey<Schema.String>;
+                readonly discover: Schema.optionalKey<Schema.Never>;
+                readonly authorizationServerMetadataUrl: Schema.optionalKey<Schema.Never>;
+                readonly tokenResponse: Schema.optionalKey<Schema.Struct<{
+                    readonly path: Schema.String;
+                }>>;
+                readonly grant: Schema.optionalKey<Schema.Literal<"authorization_code">>;
+                readonly authorizationParams: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
+                readonly tokenEndpointAuthMethod: Schema.optionalKey<Schema.Literals<readonly ["none", "client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>>;
+                readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+                readonly scopeSeparator: Schema.optionalKey<Schema.String>;
+                readonly tokenRequestFormat: Schema.optionalKey<Schema.Literals<readonly ["form", "json"]>>;
+                readonly type: Schema.Literal<"oauth2">;
+            }>, Schema.Struct<{
+                readonly plain: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly raw: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly request: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+                    readonly in: Schema.Literal<"header">;
+                    readonly name: Schema.String;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>, Schema.Struct<{
+                    readonly in: Schema.Literal<"query">;
+                    readonly name: Schema.NonEmptyString;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>]>>>;
+                readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+                readonly tokenEndpointAuthMethod: Schema.Literals<readonly ["client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>;
+                readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+                readonly scopeSeparator: Schema.optionalKey<Schema.String>;
+                readonly tokenRequestFormat: Schema.optionalKey<Schema.Literals<readonly ["form", "json"]>>;
+                readonly grant: Schema.Literal<"client_credentials">;
+                readonly discover: Schema.String;
+                readonly authorizationServerMetadataUrl: Schema.optionalKey<Schema.String>;
+                readonly authorizationUrl: Schema.optionalKey<Schema.Never>;
+                readonly tokenUrl: Schema.optionalKey<Schema.Never>;
+                readonly revocationUrl: Schema.optionalKey<Schema.Never>;
+                readonly scopes: Schema.optionalKey<Schema.$Array<Schema.String>>;
+                readonly type: Schema.Literal<"oauth2">;
+            }>, Schema.Struct<{
+                readonly plain: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly raw: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly request: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+                    readonly in: Schema.Literal<"header">;
+                    readonly name: Schema.String;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>, Schema.Struct<{
+                    readonly in: Schema.Literal<"query">;
+                    readonly name: Schema.NonEmptyString;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>]>>>;
+                readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+                readonly tokenEndpointAuthMethod: Schema.Literals<readonly ["client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>;
+                readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+                readonly authorizationUrl: Schema.optionalKey<Schema.Never>;
+                readonly discover: Schema.optionalKey<Schema.Never>;
+                readonly authorizationServerMetadataUrl: Schema.optionalKey<Schema.Never>;
+                readonly scopeSeparator: Schema.optionalKey<Schema.String>;
+                readonly tokenRequestFormat: Schema.optionalKey<Schema.Literals<readonly ["form", "json"]>>;
+                readonly grant: Schema.Literal<"client_credentials">;
+                readonly tokenUrl: Schema.String;
+                readonly revocationUrl: Schema.optionalKey<Schema.String>;
+                readonly scopes: Schema.$Array<Schema.String>;
+                readonly type: Schema.Literal<"oauth2">;
+            }>]>>;
+            readonly hosts: Schema.optionalKey<Schema.$Array<Schema.String>>;
+        }>;
+        readonly method: Schema.NonEmptyString;
+        readonly generation: Schema.optionalKey<Schema.Int>;
+        readonly fields: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+    }>, Schema.$Array<Schema.Struct<{
+        readonly managed: Schema.optionalKey<Schema.Literal<true>>;
+        readonly id: Schema.brand<Schema.String, "acc">;
+        readonly provider: Schema.Struct<{
+            readonly name: Schema.NonEmptyString;
+            readonly auth: Schema.$Record<Schema.NonEmptyString, Schema.Union<readonly [Schema.Struct<{
+                readonly plain: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly raw: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly request: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+                    readonly in: Schema.Literal<"header">;
+                    readonly name: Schema.String;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>, Schema.Struct<{
+                    readonly in: Schema.Literal<"query">;
+                    readonly name: Schema.NonEmptyString;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>]>>>;
+                readonly type: Schema.Literal<"secrets">;
+                readonly label: Schema.String;
+                readonly fields: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+            }>, Schema.Struct<{
+                readonly plain: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly raw: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly request: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+                    readonly in: Schema.Literal<"header">;
+                    readonly name: Schema.String;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>, Schema.Struct<{
+                    readonly in: Schema.Literal<"query">;
+                    readonly name: Schema.NonEmptyString;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>]>>>;
+                readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+                readonly discover: Schema.String;
+                readonly authorizationServerMetadataUrl: Schema.optionalKey<Schema.String>;
+                readonly authorizationUrl: Schema.optionalKey<Schema.Never>;
+                readonly tokenUrl: Schema.optionalKey<Schema.Never>;
+                readonly revocationUrl: Schema.optionalKey<Schema.Never>;
+                readonly scopes: Schema.optionalKey<Schema.$Array<Schema.String>>;
+                readonly tokenResponse: Schema.optionalKey<Schema.Struct<{
+                    readonly path: Schema.String;
+                }>>;
+                readonly grant: Schema.optionalKey<Schema.Literal<"authorization_code">>;
+                readonly authorizationParams: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
+                readonly tokenEndpointAuthMethod: Schema.optionalKey<Schema.Literals<readonly ["none", "client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>>;
+                readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+                readonly scopeSeparator: Schema.optionalKey<Schema.String>;
+                readonly tokenRequestFormat: Schema.optionalKey<Schema.Literals<readonly ["form", "json"]>>;
+                readonly type: Schema.Literal<"oauth2">;
+            }>, Schema.Struct<{
+                readonly plain: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly raw: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly request: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+                    readonly in: Schema.Literal<"header">;
+                    readonly name: Schema.String;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>, Schema.Struct<{
+                    readonly in: Schema.Literal<"query">;
+                    readonly name: Schema.NonEmptyString;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>]>>>;
+                readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+                readonly authorizationUrl: Schema.String;
+                readonly tokenUrl: Schema.String;
+                readonly revocationUrl: Schema.optionalKey<Schema.String>;
+                readonly scopes: Schema.$Array<Schema.String>;
+                readonly issuer: Schema.optionalKey<Schema.String>;
+                readonly discover: Schema.optionalKey<Schema.Never>;
+                readonly authorizationServerMetadataUrl: Schema.optionalKey<Schema.Never>;
+                readonly tokenResponse: Schema.optionalKey<Schema.Struct<{
+                    readonly path: Schema.String;
+                }>>;
+                readonly grant: Schema.optionalKey<Schema.Literal<"authorization_code">>;
+                readonly authorizationParams: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
+                readonly tokenEndpointAuthMethod: Schema.optionalKey<Schema.Literals<readonly ["none", "client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>>;
+                readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+                readonly scopeSeparator: Schema.optionalKey<Schema.String>;
+                readonly tokenRequestFormat: Schema.optionalKey<Schema.Literals<readonly ["form", "json"]>>;
+                readonly type: Schema.Literal<"oauth2">;
+            }>, Schema.Struct<{
+                readonly plain: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly raw: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly request: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+                    readonly in: Schema.Literal<"header">;
+                    readonly name: Schema.String;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>, Schema.Struct<{
+                    readonly in: Schema.Literal<"query">;
+                    readonly name: Schema.NonEmptyString;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>]>>>;
+                readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+                readonly tokenEndpointAuthMethod: Schema.Literals<readonly ["client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>;
+                readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+                readonly scopeSeparator: Schema.optionalKey<Schema.String>;
+                readonly tokenRequestFormat: Schema.optionalKey<Schema.Literals<readonly ["form", "json"]>>;
+                readonly grant: Schema.Literal<"client_credentials">;
+                readonly discover: Schema.String;
+                readonly authorizationServerMetadataUrl: Schema.optionalKey<Schema.String>;
+                readonly authorizationUrl: Schema.optionalKey<Schema.Never>;
+                readonly tokenUrl: Schema.optionalKey<Schema.Never>;
+                readonly revocationUrl: Schema.optionalKey<Schema.Never>;
+                readonly scopes: Schema.optionalKey<Schema.$Array<Schema.String>>;
+                readonly type: Schema.Literal<"oauth2">;
+            }>, Schema.Struct<{
+                readonly plain: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly raw: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly request: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+                    readonly in: Schema.Literal<"header">;
+                    readonly name: Schema.String;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>, Schema.Struct<{
+                    readonly in: Schema.Literal<"query">;
+                    readonly name: Schema.NonEmptyString;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>]>>>;
+                readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+                readonly tokenEndpointAuthMethod: Schema.Literals<readonly ["client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>;
+                readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+                readonly authorizationUrl: Schema.optionalKey<Schema.Never>;
+                readonly discover: Schema.optionalKey<Schema.Never>;
+                readonly authorizationServerMetadataUrl: Schema.optionalKey<Schema.Never>;
+                readonly scopeSeparator: Schema.optionalKey<Schema.String>;
+                readonly tokenRequestFormat: Schema.optionalKey<Schema.Literals<readonly ["form", "json"]>>;
+                readonly grant: Schema.Literal<"client_credentials">;
+                readonly tokenUrl: Schema.String;
+                readonly revocationUrl: Schema.optionalKey<Schema.String>;
+                readonly scopes: Schema.$Array<Schema.String>;
+                readonly type: Schema.Literal<"oauth2">;
+            }>]>>;
+            readonly hosts: Schema.optionalKey<Schema.$Array<Schema.String>>;
+        }>;
+        readonly method: Schema.NonEmptyString;
+        readonly generation: Schema.optionalKey<Schema.Int>;
+        readonly fields: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+    }>>]>>;
+    readonly user: Schema.optionalKey<Schema.$Record<Schema.NonEmptyString, Schema.Union<readonly [Schema.Struct<{
+        readonly managed: Schema.optionalKey<Schema.Literal<true>>;
+        readonly id: Schema.brand<Schema.String, "acc">;
+        readonly provider: Schema.Struct<{
+            readonly name: Schema.NonEmptyString;
+            readonly auth: Schema.$Record<Schema.NonEmptyString, Schema.Union<readonly [Schema.Struct<{
+                readonly plain: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly raw: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly request: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+                    readonly in: Schema.Literal<"header">;
+                    readonly name: Schema.String;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>, Schema.Struct<{
+                    readonly in: Schema.Literal<"query">;
+                    readonly name: Schema.NonEmptyString;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>]>>>;
+                readonly type: Schema.Literal<"secrets">;
+                readonly label: Schema.String;
+                readonly fields: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+            }>, Schema.Struct<{
+                readonly plain: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly raw: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly request: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+                    readonly in: Schema.Literal<"header">;
+                    readonly name: Schema.String;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>, Schema.Struct<{
+                    readonly in: Schema.Literal<"query">;
+                    readonly name: Schema.NonEmptyString;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>]>>>;
+                readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+                readonly discover: Schema.String;
+                readonly authorizationServerMetadataUrl: Schema.optionalKey<Schema.String>;
+                readonly authorizationUrl: Schema.optionalKey<Schema.Never>;
+                readonly tokenUrl: Schema.optionalKey<Schema.Never>;
+                readonly revocationUrl: Schema.optionalKey<Schema.Never>;
+                readonly scopes: Schema.optionalKey<Schema.$Array<Schema.String>>;
+                readonly tokenResponse: Schema.optionalKey<Schema.Struct<{
+                    readonly path: Schema.String;
+                }>>;
+                readonly grant: Schema.optionalKey<Schema.Literal<"authorization_code">>;
+                readonly authorizationParams: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
+                readonly tokenEndpointAuthMethod: Schema.optionalKey<Schema.Literals<readonly ["none", "client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>>;
+                readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+                readonly scopeSeparator: Schema.optionalKey<Schema.String>;
+                readonly tokenRequestFormat: Schema.optionalKey<Schema.Literals<readonly ["form", "json"]>>;
+                readonly type: Schema.Literal<"oauth2">;
+            }>, Schema.Struct<{
+                readonly plain: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly raw: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly request: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+                    readonly in: Schema.Literal<"header">;
+                    readonly name: Schema.String;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>, Schema.Struct<{
+                    readonly in: Schema.Literal<"query">;
+                    readonly name: Schema.NonEmptyString;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>]>>>;
+                readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+                readonly authorizationUrl: Schema.String;
+                readonly tokenUrl: Schema.String;
+                readonly revocationUrl: Schema.optionalKey<Schema.String>;
+                readonly scopes: Schema.$Array<Schema.String>;
+                readonly issuer: Schema.optionalKey<Schema.String>;
+                readonly discover: Schema.optionalKey<Schema.Never>;
+                readonly authorizationServerMetadataUrl: Schema.optionalKey<Schema.Never>;
+                readonly tokenResponse: Schema.optionalKey<Schema.Struct<{
+                    readonly path: Schema.String;
+                }>>;
+                readonly grant: Schema.optionalKey<Schema.Literal<"authorization_code">>;
+                readonly authorizationParams: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
+                readonly tokenEndpointAuthMethod: Schema.optionalKey<Schema.Literals<readonly ["none", "client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>>;
+                readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+                readonly scopeSeparator: Schema.optionalKey<Schema.String>;
+                readonly tokenRequestFormat: Schema.optionalKey<Schema.Literals<readonly ["form", "json"]>>;
+                readonly type: Schema.Literal<"oauth2">;
+            }>, Schema.Struct<{
+                readonly plain: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly raw: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly request: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+                    readonly in: Schema.Literal<"header">;
+                    readonly name: Schema.String;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>, Schema.Struct<{
+                    readonly in: Schema.Literal<"query">;
+                    readonly name: Schema.NonEmptyString;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>]>>>;
+                readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+                readonly tokenEndpointAuthMethod: Schema.Literals<readonly ["client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>;
+                readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+                readonly scopeSeparator: Schema.optionalKey<Schema.String>;
+                readonly tokenRequestFormat: Schema.optionalKey<Schema.Literals<readonly ["form", "json"]>>;
+                readonly grant: Schema.Literal<"client_credentials">;
+                readonly discover: Schema.String;
+                readonly authorizationServerMetadataUrl: Schema.optionalKey<Schema.String>;
+                readonly authorizationUrl: Schema.optionalKey<Schema.Never>;
+                readonly tokenUrl: Schema.optionalKey<Schema.Never>;
+                readonly revocationUrl: Schema.optionalKey<Schema.Never>;
+                readonly scopes: Schema.optionalKey<Schema.$Array<Schema.String>>;
+                readonly type: Schema.Literal<"oauth2">;
+            }>, Schema.Struct<{
+                readonly plain: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly raw: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly request: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+                    readonly in: Schema.Literal<"header">;
+                    readonly name: Schema.String;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>, Schema.Struct<{
+                    readonly in: Schema.Literal<"query">;
+                    readonly name: Schema.NonEmptyString;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>]>>>;
+                readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+                readonly tokenEndpointAuthMethod: Schema.Literals<readonly ["client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>;
+                readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+                readonly authorizationUrl: Schema.optionalKey<Schema.Never>;
+                readonly discover: Schema.optionalKey<Schema.Never>;
+                readonly authorizationServerMetadataUrl: Schema.optionalKey<Schema.Never>;
+                readonly scopeSeparator: Schema.optionalKey<Schema.String>;
+                readonly tokenRequestFormat: Schema.optionalKey<Schema.Literals<readonly ["form", "json"]>>;
+                readonly grant: Schema.Literal<"client_credentials">;
+                readonly tokenUrl: Schema.String;
+                readonly revocationUrl: Schema.optionalKey<Schema.String>;
+                readonly scopes: Schema.$Array<Schema.String>;
+                readonly type: Schema.Literal<"oauth2">;
+            }>]>>;
+            readonly hosts: Schema.optionalKey<Schema.$Array<Schema.String>>;
+        }>;
+        readonly method: Schema.NonEmptyString;
+        readonly generation: Schema.optionalKey<Schema.Int>;
+        readonly fields: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+    }>, Schema.$Array<Schema.Struct<{
+        readonly managed: Schema.optionalKey<Schema.Literal<true>>;
+        readonly id: Schema.brand<Schema.String, "acc">;
+        readonly provider: Schema.Struct<{
+            readonly name: Schema.NonEmptyString;
+            readonly auth: Schema.$Record<Schema.NonEmptyString, Schema.Union<readonly [Schema.Struct<{
+                readonly plain: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly raw: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly request: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+                    readonly in: Schema.Literal<"header">;
+                    readonly name: Schema.String;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>, Schema.Struct<{
+                    readonly in: Schema.Literal<"query">;
+                    readonly name: Schema.NonEmptyString;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>]>>>;
+                readonly type: Schema.Literal<"secrets">;
+                readonly label: Schema.String;
+                readonly fields: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+            }>, Schema.Struct<{
+                readonly plain: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly raw: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly request: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+                    readonly in: Schema.Literal<"header">;
+                    readonly name: Schema.String;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>, Schema.Struct<{
+                    readonly in: Schema.Literal<"query">;
+                    readonly name: Schema.NonEmptyString;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>]>>>;
+                readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+                readonly discover: Schema.String;
+                readonly authorizationServerMetadataUrl: Schema.optionalKey<Schema.String>;
+                readonly authorizationUrl: Schema.optionalKey<Schema.Never>;
+                readonly tokenUrl: Schema.optionalKey<Schema.Never>;
+                readonly revocationUrl: Schema.optionalKey<Schema.Never>;
+                readonly scopes: Schema.optionalKey<Schema.$Array<Schema.String>>;
+                readonly tokenResponse: Schema.optionalKey<Schema.Struct<{
+                    readonly path: Schema.String;
+                }>>;
+                readonly grant: Schema.optionalKey<Schema.Literal<"authorization_code">>;
+                readonly authorizationParams: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
+                readonly tokenEndpointAuthMethod: Schema.optionalKey<Schema.Literals<readonly ["none", "client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>>;
+                readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+                readonly scopeSeparator: Schema.optionalKey<Schema.String>;
+                readonly tokenRequestFormat: Schema.optionalKey<Schema.Literals<readonly ["form", "json"]>>;
+                readonly type: Schema.Literal<"oauth2">;
+            }>, Schema.Struct<{
+                readonly plain: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly raw: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly request: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+                    readonly in: Schema.Literal<"header">;
+                    readonly name: Schema.String;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>, Schema.Struct<{
+                    readonly in: Schema.Literal<"query">;
+                    readonly name: Schema.NonEmptyString;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>]>>>;
+                readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+                readonly authorizationUrl: Schema.String;
+                readonly tokenUrl: Schema.String;
+                readonly revocationUrl: Schema.optionalKey<Schema.String>;
+                readonly scopes: Schema.$Array<Schema.String>;
+                readonly issuer: Schema.optionalKey<Schema.String>;
+                readonly discover: Schema.optionalKey<Schema.Never>;
+                readonly authorizationServerMetadataUrl: Schema.optionalKey<Schema.Never>;
+                readonly tokenResponse: Schema.optionalKey<Schema.Struct<{
+                    readonly path: Schema.String;
+                }>>;
+                readonly grant: Schema.optionalKey<Schema.Literal<"authorization_code">>;
+                readonly authorizationParams: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
+                readonly tokenEndpointAuthMethod: Schema.optionalKey<Schema.Literals<readonly ["none", "client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>>;
+                readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+                readonly scopeSeparator: Schema.optionalKey<Schema.String>;
+                readonly tokenRequestFormat: Schema.optionalKey<Schema.Literals<readonly ["form", "json"]>>;
+                readonly type: Schema.Literal<"oauth2">;
+            }>, Schema.Struct<{
+                readonly plain: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly raw: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly request: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+                    readonly in: Schema.Literal<"header">;
+                    readonly name: Schema.String;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>, Schema.Struct<{
+                    readonly in: Schema.Literal<"query">;
+                    readonly name: Schema.NonEmptyString;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>]>>>;
+                readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+                readonly tokenEndpointAuthMethod: Schema.Literals<readonly ["client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>;
+                readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+                readonly scopeSeparator: Schema.optionalKey<Schema.String>;
+                readonly tokenRequestFormat: Schema.optionalKey<Schema.Literals<readonly ["form", "json"]>>;
+                readonly grant: Schema.Literal<"client_credentials">;
+                readonly discover: Schema.String;
+                readonly authorizationServerMetadataUrl: Schema.optionalKey<Schema.String>;
+                readonly authorizationUrl: Schema.optionalKey<Schema.Never>;
+                readonly tokenUrl: Schema.optionalKey<Schema.Never>;
+                readonly revocationUrl: Schema.optionalKey<Schema.Never>;
+                readonly scopes: Schema.optionalKey<Schema.$Array<Schema.String>>;
+                readonly type: Schema.Literal<"oauth2">;
+            }>, Schema.Struct<{
+                readonly plain: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly raw: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly request: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+                    readonly in: Schema.Literal<"header">;
+                    readonly name: Schema.String;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>, Schema.Struct<{
+                    readonly in: Schema.Literal<"query">;
+                    readonly name: Schema.NonEmptyString;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>]>>>;
+                readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+                readonly tokenEndpointAuthMethod: Schema.Literals<readonly ["client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>;
+                readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+                readonly authorizationUrl: Schema.optionalKey<Schema.Never>;
+                readonly discover: Schema.optionalKey<Schema.Never>;
+                readonly authorizationServerMetadataUrl: Schema.optionalKey<Schema.Never>;
+                readonly scopeSeparator: Schema.optionalKey<Schema.String>;
+                readonly tokenRequestFormat: Schema.optionalKey<Schema.Literals<readonly ["form", "json"]>>;
+                readonly grant: Schema.Literal<"client_credentials">;
+                readonly tokenUrl: Schema.String;
+                readonly revocationUrl: Schema.optionalKey<Schema.String>;
+                readonly scopes: Schema.$Array<Schema.String>;
+                readonly type: Schema.Literal<"oauth2">;
+            }>]>>;
+            readonly hosts: Schema.optionalKey<Schema.$Array<Schema.String>>;
+        }>;
+        readonly method: Schema.NonEmptyString;
+        readonly generation: Schema.optionalKey<Schema.Int>;
+        readonly fields: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+    }>>]>>>;
 }>;
-export type TrustedToolApproval = typeof TrustedToolApproval.Type;
-/** Absolute Unix time in milliseconds; remote hosts enforce it inside the operation transaction. */
-export declare const InvocationDeadline: Schema.Finite;
+export type HostAccounts = typeof HostAccounts.Type;
+/** Each requirement's accounts across both scopes; requirement names are unique across them. */
+export declare const scopedSlots: <Slot>(accounts: {
+    readonly app: Readonly<Record<string, Slot>>;
+    readonly user?: Readonly<Record<string, Slot>>;
+}) => ReadonlyArray<readonly [string, Slot]>;
 /** Trusted invocation context, supplied separately from the Request. */
 export interface HostContext {
     /** Trusted host deadline; never accepted in public operation JSON. */
@@ -426,91 +1459,11 @@ export interface HostContext {
     /** Trusted in-process tracing capability; never decoded from a public request. */
     readonly telemetry?: InvocationTelemetry;
     readonly approval?: TrustedToolApproval;
-    readonly storage?: AppStorage;
-    readonly accounts: Redacted.Redacted<ResolvedAccounts>;
+    /** The data facet's SQLite storage, for apps that declare `sql`. Never exposed to app code. */
+    readonly storage?: AppSqlStorage;
+    /** The invocation's accounts as the host resolved them; see `HostAccount`. */
+    readonly accounts: Redacted.Redacted<HostAccounts>;
 }
-/** Serializable live tool metadata; executable callbacks never cross this boundary. */
-export declare const HostedTool: Schema.Struct<{
-    readonly schedules: Schema.optionalKey<Schema.$Array<Schema.Struct<{
-        readonly name: Schema.NonEmptyString;
-        readonly timing: Schema.Union<readonly [Schema.Struct<{
-            readonly kind: Schema.Literal<"interval">;
-            readonly milliseconds: Schema.Int;
-        }>, Schema.Struct<{
-            readonly kind: Schema.Literal<"cron">;
-            readonly calendar: Schema.Struct<{
-                readonly expression: Schema.NonEmptyString;
-                readonly timezone: Schema.NonEmptyString;
-            }>;
-        }>]>;
-        readonly input: Schema.Codec<Schema.Json, Schema.Json, never, never>;
-    }>>>;
-    readonly name: Schema.NonEmptyString;
-    readonly description: Schema.String;
-    readonly inputSchema: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
-    readonly readOnly: Schema.optionalKey<Schema.Boolean>;
-    readonly title: Schema.optionalKey<Schema.String>;
-    readonly outputSchema: Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
-    readonly annotations: Schema.optionalKey<Schema.Struct<{
-        readonly title: Schema.optionalKey<Schema.String>;
-        readonly readOnlyHint: Schema.optionalKey<Schema.Boolean>;
-        readonly destructiveHint: Schema.optionalKey<Schema.Boolean>;
-        readonly idempotentHint: Schema.optionalKey<Schema.Boolean>;
-        readonly openWorldHint: Schema.optionalKey<Schema.Boolean>;
-    }>>;
-    readonly _meta: Schema.optionalKey<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
-}>;
-/** Parsed live tool description. */
-export type HostedTool = typeof HostedTool.Type;
-/** Catalog entry without schemas. Browsing lists these and reads one full tool on selection. */
-export declare const HostedToolSummary: Schema.Struct<{
-    readonly schedules: Schema.optionalKey<Schema.$Array<Schema.Struct<{
-        readonly name: Schema.NonEmptyString;
-        readonly timing: Schema.Union<readonly [Schema.Struct<{
-            readonly kind: Schema.Literal<"interval">;
-            readonly milliseconds: Schema.Int;
-        }>, Schema.Struct<{
-            readonly kind: Schema.Literal<"cron">;
-            readonly calendar: Schema.Struct<{
-                readonly expression: Schema.NonEmptyString;
-                readonly timezone: Schema.NonEmptyString;
-            }>;
-        }>]>;
-        readonly input: Schema.Codec<Schema.Json, Schema.Json, never, never>;
-    }>>>;
-    readonly name: Schema.NonEmptyString;
-    readonly description: Schema.String;
-    readonly readOnly: Schema.optionalKey<Schema.Boolean>;
-    readonly title: Schema.optionalKey<Schema.String>;
-    readonly annotations: Schema.optionalKey<Schema.Struct<{
-        readonly title: Schema.optionalKey<Schema.String>;
-        readonly readOnlyHint: Schema.optionalKey<Schema.Boolean>;
-        readonly destructiveHint: Schema.optionalKey<Schema.Boolean>;
-        readonly idempotentHint: Schema.optionalKey<Schema.Boolean>;
-        readonly openWorldHint: Schema.optionalKey<Schema.Boolean>;
-    }>>;
-}>;
-export type HostedToolSummary = typeof HostedToolSummary.Type;
-/**
- * A skill catalog and whether any of it came from `dynamicSkills`. Without a live loader the
- * catalog is determined by the build and its evaluation inputs; with one it reflects a publisher.
- */
-export declare const SkillSources: Schema.Struct<{
-    readonly skills: Schema.$Array<Schema.Struct<{
-        readonly files: Schema.$Array<Schema.Struct<{
-            readonly path: Schema.NonEmptyString;
-            readonly content: Schema.String;
-        }>>;
-        readonly name: Schema.NonEmptyString;
-        readonly description: Schema.String;
-        readonly license: Schema.optionalKey<Schema.String>;
-        readonly compatibility: Schema.optionalKey<Schema.String>;
-        readonly metadata: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
-        readonly "allowed-tools": Schema.optionalKey<Schema.String>;
-    }>>;
-    readonly dynamic: Schema.Boolean;
-}>;
-export type SkillSources = typeof SkillSources.Type;
 /** Skill commands. Send sources only to builds that declare skillSources. */
 export declare const skillsCommand: (sources: boolean) => {
     readonly operation: "skills";
@@ -519,43 +1472,23 @@ export declare const skillsCommand: (sources: boolean) => {
     readonly operation: "skills";
     readonly sources?: never;
 };
-/** Either response shape; `dynamic` is unknown for builds that predate skillSources. */
-export declare const SkillCatalogResponse: Schema.Union<readonly [Schema.Struct<{
-    readonly skills: Schema.$Array<Schema.Struct<{
-        readonly files: Schema.$Array<Schema.Struct<{
-            readonly path: Schema.NonEmptyString;
-            readonly content: Schema.String;
-        }>>;
-        readonly name: Schema.NonEmptyString;
-        readonly description: Schema.String;
-        readonly license: Schema.optionalKey<Schema.String>;
-        readonly compatibility: Schema.optionalKey<Schema.String>;
-        readonly metadata: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
-        readonly "allowed-tools": Schema.optionalKey<Schema.String>;
-    }>>;
-    readonly dynamic: Schema.Boolean;
-}>, Schema.$Array<Schema.Struct<{
-    readonly files: Schema.$Array<Schema.Struct<{
-        readonly path: Schema.NonEmptyString;
-        readonly content: Schema.String;
-    }>>;
-    readonly name: Schema.NonEmptyString;
-    readonly description: Schema.String;
-    readonly license: Schema.optionalKey<Schema.String>;
-    readonly compatibility: Schema.optionalKey<Schema.String>;
-    readonly metadata: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
-    readonly "allowed-tools": Schema.optionalKey<Schema.String>;
-}>>]>;
 export interface SkillCatalog {
     readonly skills: SkillSources["skills"];
     readonly dynamic?: boolean;
+    readonly cached?: boolean;
 }
 export declare const skillCatalog: (response: typeof SkillCatalogResponse.Type) => SkillCatalog;
 /**
- * Inspection commands. Send detail or tools only to builds that declare toolIndex,
- * and scheduled only to builds that declare scheduledTools.
+ * Inspection commands. Send detail or tools only to builds that declare toolIndex, scheduled
+ * only to builds that declare scheduledTools, and definitions only to builds that declare
+ * sharedDefinitions: they answer it with a `HostedSharedCatalog`.
  */
-export declare const inspectCommand: (tools?: readonly string[], scheduled?: true) => {
+export declare const inspectCommand: (options: {
+    readonly tools?: readonly string[] | undefined;
+    readonly scheduled?: true | undefined;
+    readonly definitions?: "shared" | undefined;
+}) => {
+    definitions?: "shared";
     scheduled?: true;
     tools?: string[];
     operation: "inspect";
@@ -564,198 +1497,56 @@ export declare const indexCommand: {
     readonly operation: "inspect";
     readonly detail: "summary";
 };
+export { restoreSharedCatalog } from "./shared-catalog.js";
 /** Keep only the requested tools from an inspection that may have described every tool. */
 export declare const selectTools: (tools?: readonly string[]) => <A extends {
-    readonly name: string;
-}>(all: readonly A[]) => readonly A[];
-/** Framework-owned dispatch, independent of app-authored HTTP routing. */
-export declare const HostRequest: Schema.Union<readonly [Schema.Union<readonly [Schema.Struct<{
-    readonly operation: Schema.Literal<"workflows">;
-}>, Schema.Struct<{
-    readonly operation: Schema.Literal<"workflow-validate">;
-    readonly name: Schema.NonEmptyString;
-    readonly input: Schema.Codec<Schema.Json, Schema.Json, never, never>;
-}>, Schema.Struct<{
-    readonly operation: Schema.Literal<"workflow-run">;
-    readonly name: Schema.NonEmptyString;
-    readonly input: Schema.Codec<Schema.Json, Schema.Json, never, never>;
-}>]>, Schema.Union<readonly [Schema.Struct<{
-    readonly operation: Schema.Literal<"webhooks">;
-}>, Schema.Struct<{
-    readonly name: Schema.NonEmptyString;
-    readonly subscriptionId: Schema.NonEmptyString;
-    readonly sourceAccount: Schema.brand<Schema.String, "acc">;
-    readonly callbackUrl: Schema.String;
-    readonly secret: Schema.String;
-    readonly config: Schema.Codec<Schema.Json, Schema.Json, never, never>;
-    readonly operation: Schema.Literal<"webhook-validate">;
-}>, Schema.Struct<{
-    readonly state: Schema.Codec<Schema.Json, Schema.Json, never, never>;
-    readonly name: Schema.NonEmptyString;
-    readonly subscriptionId: Schema.NonEmptyString;
-    readonly sourceAccount: Schema.brand<Schema.String, "acc">;
-    readonly callbackUrl: Schema.String;
-    readonly secret: Schema.String;
-    readonly config: Schema.Codec<Schema.Json, Schema.Json, never, never>;
-    readonly operation: Schema.Literal<"webhook-complete">;
-}>, Schema.Struct<{
-    readonly name: Schema.NonEmptyString;
-    readonly subscriptionId: Schema.NonEmptyString;
-    readonly sourceAccount: Schema.brand<Schema.String, "acc">;
-    readonly callbackUrl: Schema.String;
-    readonly secret: Schema.String;
-    readonly config: Schema.Codec<Schema.Json, Schema.Json, never, never>;
-    readonly operation: Schema.Literal<"webhook-register">;
-}>, Schema.Struct<{
-    readonly state: Schema.Codec<Schema.Json, Schema.Json, never, never>;
-    readonly name: Schema.NonEmptyString;
-    readonly subscriptionId: Schema.NonEmptyString;
-    readonly sourceAccount: Schema.brand<Schema.String, "acc">;
-    readonly callbackUrl: Schema.String;
-    readonly secret: Schema.String;
-    readonly config: Schema.Codec<Schema.Json, Schema.Json, never, never>;
-    readonly operation: Schema.Literal<"webhook-unregister">;
-}>, Schema.Struct<{
-    readonly state: Schema.Codec<Schema.Json, Schema.Json, never, never>;
-    readonly request: Schema.Struct<{
-        readonly url: Schema.String;
-        readonly method: Schema.Literals<readonly ["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"]>;
-        readonly headers: Schema.$Record<Schema.String, Schema.String>;
-        readonly body: Schema.String;
-    }>;
-    readonly name: Schema.NonEmptyString;
-    readonly subscriptionId: Schema.NonEmptyString;
-    readonly sourceAccount: Schema.brand<Schema.String, "acc">;
-    readonly callbackUrl: Schema.String;
-    readonly secret: Schema.String;
-    readonly config: Schema.Codec<Schema.Json, Schema.Json, never, never>;
-    readonly operation: Schema.Literal<"webhook-handle">;
-}>]>, Schema.Struct<{
-    readonly operation: Schema.Literal<"requirements">;
-}>, Schema.Struct<{
-    readonly operation: Schema.Literal<"inspect">;
-    /** Omit schemas. Only builds that declare the toolIndex capability accept this. */
-    readonly detail: Schema.optionalKey<Schema.Literal<"summary">>;
-    /** Describe only these tools. Only builds that declare the toolIndex capability accept this. */
-    readonly tools: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
-    /**
-     * Describe only declared operations that have schedules, without dynamic tool discovery.
-     * Only builds that declare the scheduledTools capability accept this.
-     */
-    readonly scheduled: Schema.optionalKey<Schema.Literal<true>>;
-}>, Schema.Struct<{
-    readonly operation: Schema.Literal<"skills">;
-    /** Answer with SkillSources. Only builds that declare the skillSources capability accept this. */
-    readonly sources: Schema.optionalKey<Schema.Literal<true>>;
-}>, Schema.Struct<{
-    readonly operation: Schema.Literal<"query">;
-    readonly name: Schema.NonEmptyString;
-    readonly input: Schema.Codec<Schema.Json, Schema.Json, never, never>;
-}>, Schema.Struct<{
-    readonly operation: Schema.Literal<"mutate">;
-    readonly name: Schema.NonEmptyString;
-    readonly input: Schema.Codec<Schema.Json, Schema.Json, never, never>;
-}>, Schema.Struct<{
-    readonly operation: Schema.Literal<"call">;
-    readonly tool: Schema.NonEmptyString;
-    readonly input: Schema.Codec<Schema.Json, Schema.Json, never, never>;
-}>]>;
-/** Parsed portable dispatch request. */
-export type HostRequest = typeof HostRequest.Type;
-declare const HostRequestInvalid_base: Schema.Class<HostRequestInvalid, Schema.TaggedStruct<"HostRequestInvalid", {}>, import("effect/Cause").YieldableError>;
-/** The dispatch request did not match the protocol. */
-export declare class HostRequestInvalid extends HostRequestInvalid_base {
-}
-declare const HostAccountsInvalid_base: Schema.Class<HostAccountsInvalid, Schema.TaggedStruct<"HostAccountsInvalid", {}>, import("effect/Cause").YieldableError>;
-/** Host-supplied accounts did not satisfy the declared slots or native method schemas. */
-export declare class HostAccountsInvalid extends HostAccountsInvalid_base {
-}
-declare const HostDeclarationInvalid_base: Schema.Class<HostDeclarationInvalid, Schema.TaggedStruct<"HostDeclarationInvalid", {}>, import("effect/Cause").YieldableError>;
-/** The module or declared capability shape could not be hosted. */
-export declare class HostDeclarationInvalid extends HostDeclarationInvalid_base {
-}
-declare const HostEvaluationFailed_base: Schema.Class<HostEvaluationFailed, Schema.TaggedStruct<"HostEvaluationFailed", {}>, import("effect/Cause").YieldableError>;
-/** Fresh app evaluation failed before calling a tool. */
-export declare class HostEvaluationFailed extends HostEvaluationFailed_base {
-}
-declare const HostOperationNotFound_base: Schema.Class<HostOperationNotFound, Schema.TaggedStruct<"HostOperationNotFound", {}>, import("effect/Cause").YieldableError>;
-/** No query or mutation matched the requested name. */
-export declare class HostOperationNotFound extends HostOperationNotFound_base {
-}
-declare const HostOperationFailed_base: Schema.Class<HostOperationFailed, Schema.TaggedStruct<"HostOperationFailed", {}>, import("effect/Cause").YieldableError>;
-/** An app operation failed. Raw author failures remain private. */
-export declare class HostOperationFailed extends HostOperationFailed_base {
-}
-declare const HostToolNotFound_base: Schema.Class<HostToolNotFound, Schema.TaggedStruct<"HostToolNotFound", {}>, import("effect/Cause").YieldableError>;
-/** The freshly evaluated catalog did not contain the requested tool. */
-export declare class HostToolNotFound extends HostToolNotFound_base {
-}
-/** One failing input location and its expected shape; never the supplied value. */
-export declare const InputProblem: Schema.String;
-/** Input decoding reports at most this many problems. */
-export declare const maxInputProblems = 10;
-declare const HostInputInvalid_base: Schema.Class<HostInputInvalid, Schema.TaggedStruct<"HostInputInvalid", {
-    readonly problems: Schema.optionalKey<Schema.$Array<Schema.String>>;
-}>, import("effect/Cause").YieldableError>;
-/** Native input decoding failed; supplied values are omitted. Builds before problems were reported send none. */
-export declare class HostInputInvalid extends HostInputInvalid_base {
-}
-declare const HostToolBlocked_base: Schema.Class<HostToolBlocked, Schema.TaggedStruct<"HostToolBlocked", {}>, import("effect/Cause").YieldableError>;
-/** The tool's approval policy blocked this call before its tool body ran. */
-export declare class HostToolBlocked extends HostToolBlocked_base {
-}
-declare const HostToolApprovalRequired_base: Schema.Class<HostToolApprovalRequired, Schema.TaggedStruct<"HostToolApprovalRequired", {
-    readonly input: Schema.Codec<Schema.Json, Schema.Json, never, never>;
-    readonly elicitation: Schema.Struct<{
-        readonly requestedSchema: Schema.Struct<{
-            readonly type: Schema.Literal<"object">;
-            readonly properties: Schema.$Record<Schema.String, Schema.Never>;
-        }>;
-        readonly mode: Schema.Literal<"form">;
-        readonly _meta: Schema.optional<Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>>;
-        readonly message: Schema.String;
-    }>;
-}>, import("effect/Cause").YieldableError>;
-/** Policy elicitation plus decoded input. No tool body ran; the host owns delivery and resumption. */
-export declare class HostToolApprovalRequired extends HostToolApprovalRequired_base {
-}
-declare const HostToolPolicyFailed_base: Schema.Class<HostToolPolicyFailed, Schema.TaggedStruct<"HostToolPolicyFailed", {}>, import("effect/Cause").YieldableError>;
-/** The tool's approval policy failed or returned an invalid decision. Author failures remain private. */
-export declare class HostToolPolicyFailed extends HostToolPolicyFailed_base {
-}
-declare const HostOutputInvalid_base: Schema.Class<HostOutputInvalid, Schema.TaggedStruct<"HostOutputInvalid", {}>, import("effect/Cause").YieldableError>;
-/** A tool result was not JSON; the result is never included in the error. */
-export declare class HostOutputInvalid extends HostOutputInvalid_base {
-}
-/** Declaration reads do not bind accounts or evaluate the app factory. */
-export declare const HostRequirementsError: Schema.Union<readonly [typeof HostRequestInvalid, typeof HostDeclarationInvalid]>;
+    readonly tools: readonly {
+        readonly name: string;
+    }[];
+}>(catalog: A) => A;
+/** Declaration reads do not bind accounts or evaluate the app factory. A named declaration
+ * problem is reported so the deploy can explain it. */
+export declare const HostRequirementsError: Schema.Union<readonly [typeof HostRequestInvalid, typeof HostDeclarationInvalid, typeof DatabaseFieldReserved]>;
 /** Inspection can fail while binding accounts or evaluating the live definition. */
 export declare const HostInspectError: Schema.Union<readonly [typeof ProviderError, typeof McpError, typeof SkillLoadFailed, typeof HostRequestInvalid, typeof HostDeclarationInvalid, typeof HostAccountsInvalid, typeof HostEvaluationFailed]>;
 /** Tool invocation adds lookup, input, execution and output failures to inspection. */
-export declare const HostCallError: Schema.Union<readonly [typeof OpenapiResponseError, typeof WorkflowFailure, Schema.Union<readonly [typeof ProviderError, typeof McpError, typeof SkillLoadFailed, typeof HostRequestInvalid, typeof HostDeclarationInvalid, typeof HostAccountsInvalid, typeof HostEvaluationFailed]>, typeof HostToolNotFound, typeof HostOperationNotFound, typeof HostOperationFailed, typeof HostInputInvalid, typeof HostOutputInvalid, typeof HostToolBlocked, typeof HostToolApprovalRequired, typeof HostToolPolicyFailed, typeof ElicitationFailed]>;
+export declare const HostCallError: Schema.Union<readonly [typeof OpenapiResponseError, typeof WorkflowFailure, Schema.Union<readonly [typeof ProviderError, typeof McpError, typeof SkillLoadFailed, typeof HostRequestInvalid, typeof HostDeclarationInvalid, typeof HostAccountsInvalid, typeof HostEvaluationFailed]>, typeof HostToolNotFound, typeof HostOperationNotFound, typeof HostKindMismatch, typeof HostOperationFailed, typeof DatabaseLimitExceeded, typeof HostInputInvalid, typeof HostOutputInvalid, typeof HostToolBlocked, typeof HostToolApprovalRequired, typeof HostToolPolicyFailed, typeof ElicitationFailed]>;
+/**
+ * An account check binds one account and runs the provider's check without evaluating the app.
+ * Timeouts arrive as WorkflowFailure from the shared deadline guard.
+ */
+export declare const HostAccountCheckError: Schema.Union<readonly [typeof ProviderError, typeof WorkflowFailure, typeof HostRequestInvalid, typeof HostDeclarationInvalid, typeof HostAccountsInvalid, typeof HostOperationNotFound, typeof HostOperationFailed, typeof HostOutputInvalid]>;
 /** Queries, mutations and agent calls use the same operation failures. */
-export declare const HostDataError: Schema.Union<readonly [typeof OpenapiResponseError, typeof WorkflowFailure, Schema.Union<readonly [typeof ProviderError, typeof McpError, typeof SkillLoadFailed, typeof HostRequestInvalid, typeof HostDeclarationInvalid, typeof HostAccountsInvalid, typeof HostEvaluationFailed]>, typeof HostToolNotFound, typeof HostOperationNotFound, typeof HostOperationFailed, typeof HostInputInvalid, typeof HostOutputInvalid, typeof HostToolBlocked, typeof HostToolApprovalRequired, typeof HostToolPolicyFailed, typeof ElicitationFailed]>;
-/** Safe error envelope; no author exception, source, account fields or stack is serialized. */
-export declare const HostError: Schema.Union<readonly [typeof OpenapiResponseError, typeof ProviderError, typeof McpError, typeof SkillLoadFailed, typeof WorkflowFailure, typeof HostRequestInvalid, typeof HostAccountsInvalid, typeof HostDeclarationInvalid, typeof HostEvaluationFailed, typeof HostOperationNotFound, typeof HostOperationFailed, typeof HostToolNotFound, typeof HostInputInvalid, typeof HostOutputInvalid, typeof HostToolBlocked, typeof HostToolApprovalRequired, typeof HostToolPolicyFailed, typeof ElicitationFailed]>;
-/** Expected host failures. */
-export type HostError = typeof HostError.Type;
+export declare const HostDataError: Schema.Union<readonly [typeof OpenapiResponseError, typeof WorkflowFailure, Schema.Union<readonly [typeof ProviderError, typeof McpError, typeof SkillLoadFailed, typeof HostRequestInvalid, typeof HostDeclarationInvalid, typeof HostAccountsInvalid, typeof HostEvaluationFailed]>, typeof HostToolNotFound, typeof HostOperationNotFound, typeof HostKindMismatch, typeof HostOperationFailed, typeof DatabaseLimitExceeded, typeof HostInputInvalid, typeof HostOutputInvalid, typeof HostToolBlocked, typeof HostToolApprovalRequired, typeof HostToolPolicyFailed, typeof ElicitationFailed]>;
 /** Invocation-owned outcome sink. Framework adapters report semantic failures
  * independently of successful JSON transport; customer output is never inspected. */
 export declare const ToolResultObservation: Context.Reference<{
     readonly failed: () => void;
 }>;
-/** Portable response envelope; callers parse the success value for their operation. */
-export declare const HostResponse: Schema.Union<readonly [Schema.Struct<{
-    readonly ok: Schema.Literal<true>;
-    readonly value: Schema.Codec<Schema.Json, Schema.Json, never, never>;
-    readonly toolError: Schema.optionalKey<Schema.Literal<true>>;
-}>, Schema.Struct<{
-    readonly ok: Schema.Literal<false>;
-    readonly error: Schema.Union<readonly [typeof OpenapiResponseError, typeof ProviderError, typeof McpError, typeof SkillLoadFailed, typeof WorkflowFailure, typeof HostRequestInvalid, typeof HostAccountsInvalid, typeof HostDeclarationInvalid, typeof HostEvaluationFailed, typeof HostOperationNotFound, typeof HostOperationFailed, typeof HostToolNotFound, typeof HostInputInvalid, typeof HostOutputInvalid, typeof HostToolBlocked, typeof HostToolApprovalRequired, typeof HostToolPolicyFailed, typeof ElicitationFailed]>;
-}>]>;
-/** Parsed response envelope. */
-export type HostResponse = typeof HostResponse.Type;
+/**
+ * One tool invocation's own timing, on the isolate's clock: how long it ran, and how much of that
+ * it waited on upstream providers, waited on elicitation answers and ran the app's authored code.
+ * Each instant counts once, so the rest is Executor's own time. The isolated handler returns it
+ * beside the result so the host can add the other isolates' parts.
+ */
+export declare const InvocationTiming: Schema.Struct<{
+    readonly elapsedMs: Schema.Finite;
+    readonly upstreamMs: Schema.Finite;
+    readonly elicitationMs: Schema.Finite;
+    readonly authoredMs: Schema.Finite;
+    /** Waiting on another call that holds the lease to load a cache entry this call needs. */
+    readonly leaseMs: Schema.optionalKey<Schema.Finite>;
+    /**
+     * How long background work, such as a stale cache entry's refresh, ran within the invocation.
+     * It runs beside the invocation, so it is not part of the division above.
+     */
+    readonly backgroundMs: Schema.optionalKey<Schema.Finite>;
+}>;
+export type InvocationTiming = typeof InvocationTiming.Type;
+/** Receives the invocation's timing once it is over; hosts that do not return it ignore it. */
+export declare const InvocationTimingSink: Context.Reference<(timing: InvocationTiming) => void>;
 /** Native handler; context comes from host authority, never from request content. */
 export type AppHandler = (request: Request, context: HostContext) => Effect.Effect<Response>;
-export { OperationToolPrefixes, type AppOperation, type OperationContext } from "./operations.js";
+export { type AppOperation, type OperationContext } from "./operations.js";
+export { RouterIcon, RouterKey, RouterMeta, type AppNode, type AppRouter, type DynamicRouter, } from "./router.js";
 export * from "./schedules.js";