apps 0.0.1-beta.1 → 0.0.1-beta.100

package/types/apps/src/contracts/skills.d.ts

@@ -1,5 +1,6 @@
 /** Portable Agent Skills returned by an app factory or loaded from published files. */
 import { Schema } from "effect";
+import { ApiError } from "../../../utils/src/api-error.js";
 /** Canonical resource path within one skill. */
 export declare const SkillFilePath: Schema.NonEmptyString;
 /** UTF-8 text resource. Reading a resource never executes it. */
@@ -40,13 +41,25 @@ export declare const AppSkillSource: Schema.Struct<{
     readonly "allowed-tools": Schema.optionalKey<Schema.String>;
 }>;
 export type AppSkillSource = typeof AppSkillSource.Type;
-declare const SkillDefinitionInvalid_base: Schema.Class<SkillDefinitionInvalid, Schema.TaggedStruct<"SkillDefinitionInvalid", {
+/** Invalid selected skill files fail the load. Errors identify the file without disclosing its contents. */
+export declare const SkillDefinitionInvalid: Schema.Class<{
+    readonly file: string;
+    readonly reason: "metadata" | "files" | "directory" | "missing-document" | "frontmatter" | "name-mismatch";
+} & ApiError & {
+    readonly _tag: "SkillDefinitionInvalid";
+}, Omit<Schema.TaggedStruct<"SkillDefinitionInvalid", {
     readonly file: Schema.NonEmptyString;
     readonly reason: Schema.Literals<readonly ["files", "directory", "missing-document", "frontmatter", "metadata", "name-mismatch"]>;
-}>, import("effect/Cause").YieldableError>;
-/** Invalid selected skill files fail the load. Errors identify the file without disclosing its contents. */
-export declare class SkillDefinitionInvalid extends SkillDefinitionInvalid_base {
-}
+} & {
+    readonly message: typeof import("../../../utils/src/api-error.js").MessageField;
+}>, "~type.make.in"> & {
+    readonly "~type.make.in": {
+        readonly reason: "metadata" | "files" | "directory" | "missing-document" | "frontmatter" | "name-mismatch";
+        readonly file: string;
+        readonly _tag?: "SkillDefinitionInvalid";
+    };
+}, ApiError>;
+export type SkillDefinitionInvalid = typeof SkillDefinitionInvalid.Type;
 /** One evaluated catalog cannot contain ambiguous names. */
 export declare const AppSkills: Schema.$Array<Schema.Struct<{
     readonly files: Schema.$Array<Schema.Struct<{
@@ -66,11 +79,16 @@ declare const SkillLoadFailed_base: Schema.Class<SkillLoadFailed, Schema.TaggedS
     readonly reason: Schema.Literals<readonly ["source", "request", "rate_limited", "document", "limit", "changed", "encoding"]>;
     readonly message: Schema.optional<Schema.String>;
     readonly status: Schema.optional<Schema.Int>;
+    readonly missing: Schema.optional<Schema.Literals<readonly ["repository", "ref"]>>;
 }>, import("effect/Cause").YieldableError>;
 /**
  * A skill loader failure shown to people. `message` is the explanation they read; write it for
  * them and never include URLs, tokens or response bodies. `reason` selects the title and whether
  * a retry can help. Custom loaders throw this error to get the same presentation as built-ins.
+ * With `source`, `missing` names what the service's answer points to as missing: the `repository`,
+ * or the branch or tag (`ref`). It may be missing, or not readable with the request's credentials.
+ * Without it, the source's settings or the paths it lists are not valid.
+ * These fields choose the explanation; they never show that the failure lies outside Executor.
  */
 export declare class SkillLoadFailed extends SkillLoadFailed_base {
 }
@@ -80,6 +98,8 @@ export declare const skillLoadLimits: {
     readonly fileBytes: 2000000;
     readonly totalBytes: 20000000;
     readonly concurrency: 8;
+    /** The request that checks whether a kept catalog's publication changed. */
+    readonly checkMillis: 5000;
 };
 /** Invocation-owned transport and cancellation, supplied by the app context. */
 export interface SkillTransport {
@@ -90,19 +110,45 @@ export interface SkillTransport {
 export interface SkillReaderOptions extends SkillTransport {
     readonly service: string;
 }
-/** A public GitHub repository and an optional immutable commit, tag or branch. */
-export interface GitHubSkillsOptions extends SkillTransport {
-    readonly repo: string;
-    readonly path?: string;
-    readonly ref?: string;
+/**
+ * Catalog reuse shared by remote skill loaders. Pass `ctx.cache` to keep the loaded catalog;
+ * without it every read fetches the source again. Unlike an MCP tool catalog, a skill catalog
+ * past `freshFor` is not served while it refreshes: the read first asks the source whether its
+ * publication changed, so agents never read skills that a refresh replaces moments later.
+ */
+export interface SkillCacheOptions {
+    readonly cache?: import("./cache.js").AppCache;
+    /** Reuse the catalog without asking the source for this duration. Defaults to five minutes. */
+    readonly freshFor?: import("effect").Duration.Input;
     /**
-     * Pass `ctx.cache` to keep each commit's skill file list. Content at a commit never changes,
-     * so later reads of the same commit skip the tree fetch. The ref is still resolved each read.
+     * Keep the catalog this long after `freshFor`. A read then confirms it with one request and
+     * loads the files again only when the publication changed. Defaults to one day.
      */
-    readonly cache?: import("./cache.js").AppCache;
+    readonly staleFor?: import("effect").Duration.Input;
 }
+/**
+ * Whose access reads the repository. A public repository needs neither field. A private one takes
+ * a GitHub account and its token, sent on every request of this read. The token comes only with
+ * its account, so the catalog is cached in that account's scope and failures name the account.
+ */
+export type GitHubSkillsAccount = import("./cache.js").AccountCredential<{
+    /**
+     * The account's token or its handle, such as `account.fields.token`. Its provider declares
+     * hosts `github.com` and `raw.githubusercontent.com`, so app code never holds the value.
+     */
+    readonly token: string;
+}>;
+/**
+ * A GitHub repository and an optional immutable commit, tag or branch. With a cache, a branch or
+ * tag is resolved again once the catalog is past `freshFor`, and each commit's file list is kept.
+ */
+export type GitHubSkillsOptions = SkillTransport & SkillCacheOptions & GitHubSkillsAccount & {
+    readonly repo: string;
+    readonly path?: string;
+    readonly ref?: string;
+};
 /** A published directory index, including its listed skill documents and text references. */
-export interface WellKnownSkillsOptions extends SkillTransport {
+export interface WellKnownSkillsOptions extends SkillTransport, SkillCacheOptions {
     readonly url: string;
 }
 /** A folder in the deployed package; omitted path selects skills/. No host filesystem access. */

package/types/apps/src/contracts/sql.d.ts

@@ -0,0 +1,63 @@
+/**
+ * App-owned SQLite. An app with migrations in `migrations/` reads and writes its own database with
+ * plain SQL. The author API mirrors Cloudflare's `SqlStorage`, so tools built for Durable Object
+ * SQLite fit it.
+ */
+/** A value SQLite stores or returns. */
+export type SqlValue = string | number | null | ArrayBuffer;
+/** One result row, keyed by column name. */
+export type SqlRow = Record<string, SqlValue>;
+/** The rows of one statement, already read, and what the statement read and wrote. */
+export interface SqlCursor<Row extends SqlRow = SqlRow> extends Iterable<Row> {
+    readonly columnNames: readonly string[];
+    readonly rowsRead: number;
+    readonly rowsWritten: number;
+    toArray(): Row[];
+    /** The only row. Throws unless the statement returned exactly one. */
+    one(): Row;
+}
+/**
+ * Read-only SQL. Query tools receive this. A query runs in a transaction that is always rolled
+ * back, so nothing it changes commits; one that changes rows fails.
+ */
+export interface SqlReader {
+    exec<Row extends SqlRow = SqlRow>(query: string, ...bindings: SqlValue[]): SqlCursor<Row>;
+}
+/** SQL inside one transaction. */
+export type SqlTransaction = SqlReader;
+/**
+ * Writable SQL. Outside a transaction every statement commits on its own. `transaction` runs its
+ * callback synchronously in one SQLite transaction, so no transaction can stay open while the app
+ * waits on anything else; throwing rolls it back. Apps call outside services between transactions.
+ */
+export interface Sql extends SqlReader {
+    transaction<T>(work: (tx: SqlTransaction) => Synchronous<T>): T;
+}
+/** A transaction callback's result: a Promise means the callback awaited, which is refused. */
+export type Synchronous<T> = T extends PromiseLike<unknown> ? never : T;
+/** The Durable Object storage a data facet hands its app. App code never receives it. */
+export interface AppSqlStorage {
+    readonly sql: {
+        exec(query: string, ...bindings: SqlValue[]): {
+            readonly columnNames: string[];
+            readonly rowsRead: number;
+            readonly rowsWritten: number;
+            toArray(): Record<string, SqlValue>[];
+        };
+    };
+    transactionSync<T>(work: () => T): T;
+}
+/**
+ * Tables Executor keeps in an app's database: applied migrations, workflow step receipts, and
+ * `_executor_legacy_rows (table_name, id, body)`, the rows of the document API apps used before
+ * SQL, with JSON bodies (empty for apps that never stored any). Apps should only read them; a
+ * changed migration history fails the next deploy.
+ */
+export declare const reservedTablePrefix = "_executor_";
+/** Where an app keeps its migrations: `0001_create_notes.sql`, applied in number order. */
+export declare const migrationsDirectory = "migrations";
+/**
+ * The most values one statement may bind. Durable Object SQLite sets `SQLITE_LIMIT_VARIABLE_NUMBER`
+ * to 100 on every host; `ctx.sql` checks it first so the error names the limit.
+ */
+export declare const sqlBindingsLimit = 100;

package/types/apps/src/contracts/ui-auth.d.ts

@@ -1,7 +1,5 @@
 /** Browser authentication protocol. Identity and session storage belong to the host. */
 import { Schema } from "effect";
-import { HttpApi, HttpApiEndpoint, HttpApiGroup } from "effect/unstable/httpapi";
-import { UiFailed, UiForbidden, UiUnauthorized } from "./ui.js";
 /** Opaque correlation ID; possession alone does not authorize an app session. */
 export declare const AppSignInId: Schema.brand<Schema.String, "AppSignInId">;
 export type AppSignInId = typeof AppSignInId.Type;
@@ -10,19 +8,13 @@ export declare const AppSignInCode: Schema.RedactedFromValue<Schema.String>;
 /** A path on the current app origin, including its query and fragment; never a redirect to another host or host-owned route. */
 export declare const AppReturnPath: Schema.brand<Schema.String, "AppReturnPath">;
 export type AppReturnPath = typeof AppReturnPath.Type;
-/** The trusted callback exchanges an authorization code bound to a browser attempt. */
+/** Callback query on the app origin. The code is single-use and works only with its attempt's cookie. */
 export declare const AppSignInCallback: Schema.Struct<{
     readonly request: Schema.brand<Schema.String, "AppSignInId">;
     readonly code: Schema.RedactedFromValue<Schema.String>;
 }>;
-/** Host-owned endpoints on every app origin, independent of the product's login mechanism. */
-export declare const AppSignInApi: HttpApi.HttpApi<"app-sign-in", HttpApiGroup.HttpApiGroup<"appSignIn", HttpApiEndpoint.HttpApiEndpoint<"start", "POST", "/_executor/auth/start", never, never, Schema.toCodecJson<Schema.Struct<{
-    readonly returnTo: Schema.brand<Schema.String, "AppReturnPath">;
-}>>, never, Schema.toCodecJson<Schema.Struct<{
-    readonly url: Schema.String;
-}>>, Schema.toCodecJson<typeof UiForbidden | typeof UiFailed>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"complete", "POST", "/_executor/auth/complete", never, never, Schema.toCodecJson<Schema.Struct<{
-    readonly request: Schema.brand<Schema.String, "AppSignInId">;
-    readonly code: Schema.RedactedFromValue<Schema.String>;
-}>>, never, Schema.toCodecJson<Schema.Struct<{
-    readonly returnTo: Schema.brand<Schema.String, "AppReturnPath">;
-}>>, Schema.toCodecJson<typeof UiUnauthorized | typeof UiForbidden | typeof UiFailed>, never, never>, false>>;
+/** Host-owned callback path on every app origin. */
+export declare const appSignInCallbackPath = "/_executor/auth/callback";
+/** Why the product could not authorize an attempt; the dashboard explains it without retrying. */
+export declare const AppSignInFailure: Schema.Literals<readonly ["ended", "forbidden", "unavailable"]>;
+export type AppSignInFailure = typeof AppSignInFailure.Type;

package/types/apps/src/contracts/ui.d.ts

@@ -1,24 +1,58 @@
 /** Browser-to-host operations bind identity and authentication outside authored app code. */
-import { Schema } from "effect";
-import { HttpApi, HttpApiEndpoint, HttpApiGroup, HttpApiSchema } from "effect/unstable/httpapi";
-/** Non-secret page context injected by the serving host. */
-export declare const UiContext: Schema.Struct<{
-    readonly deployment: Schema.NonEmptyString;
-    readonly profile: Schema.optional<Schema.NonEmptyString>;
-    readonly expectedProfileRevision: Schema.optional<Schema.Int>;
+import { Schema, type Effect, type Stream } from "effect";
+import { HttpApi, HttpApiEndpoint, HttpApiGroup, HttpApiSchema } from "effect/http-api";
+import { withLegacyKeys } from "../../../utils/src/legacy-keys.js";
+export declare const UiContext: withLegacyKeys<Schema.Struct<{
+    readonly version: Schema.NonEmptyString;
+    readonly accounts: Schema.optional<Schema.$Record<Schema.NonEmptyString, Schema.$Array<Schema.NonEmptyString>>>;
+}>, {
+    readonly version: "deployment";
 }>;
+/** A problem with one of the page's accounts, from stored state. Labels are the owner's own names. */
+export type UiAccountProblem = {
+    readonly provider: string;
+    readonly reason: "missing" | "removed" | "incompatible";
+} | {
+    readonly provider: string;
+    readonly account: string;
+    readonly reason: "credentials_rejected" | "forbidden" | "upstream_unavailable" | "check_failed";
+};
+/** Account problems found when the page opened, with dashboard links that resolve them. */
+export interface UiAccountNotice {
+    readonly app: string;
+    readonly problems: readonly UiAccountProblem[];
+    /** The app's accounts in the dashboard. */
+    readonly fix: string;
+}
 /** Retained browser bytes. Hosts authorize access before reading or rendering them. */
-export interface AppUiAsset {
+export interface AppUiFile {
     readonly body: Uint8Array;
     readonly contentType: string;
 }
-/** Requests name an operation on this app and the page's deployment, never another app or account. */
-export declare const UiOperation: Schema.Struct<{
+/** One byte range of a stored file, already within its size. */
+export interface AppUiRange {
+    readonly offset: number;
+    readonly length: number;
+}
+/**
+ * A public file the version's source served from `ui/public/`, which the host copied to its
+ * own store. `etag` names its exact bytes. Hosts authorize access before reading it.
+ */
+export interface AppUiStoredFile {
+    readonly contentType: string;
+    readonly size: number;
+    readonly etag: string;
+    readonly read: (range: AppUiRange | undefined) => Effect.Effect<Stream.Stream<Uint8Array, UiFailed>, UiFailed>;
+}
+export type AppUiAsset = AppUiFile | AppUiStoredFile;
+/** Requests name an operation on this app and the page's version, never another app or account. */
+export declare const UiOperation: withLegacyKeys<Schema.Struct<{
     readonly name: Schema.NonEmptyString;
     readonly input: Schema.Codec<Schema.Json, Schema.Json, never, never>;
-    readonly deployment: Schema.NonEmptyString;
-    readonly profile: Schema.optional<Schema.NonEmptyString>;
-    readonly expectedProfileRevision: Schema.optional<Schema.Int>;
+    readonly version: Schema.NonEmptyString;
+    readonly accounts: Schema.optional<Schema.$Record<Schema.NonEmptyString, Schema.$Array<Schema.NonEmptyString>>>;
+}>, {
+    readonly version: "deployment";
 }>;
 declare const UiUnauthorized_base: Schema.Class<UiUnauthorized, Schema.TaggedStruct<"UiUnauthorized", {}>, import("effect/Cause").YieldableError>;
 /** The app session is absent or its parent login was revoked. */
@@ -28,9 +62,12 @@ declare const UiForbidden_base: Schema.Class<UiForbidden, Schema.TaggedStruct<"U
 /** The request did not originate from the configured app. */
 export declare class UiForbidden extends UiForbidden_base {
 }
-declare const UiDeploymentChanged_base: Schema.Class<UiDeploymentChanged, Schema.TaggedStruct<"UiDeploymentChanged", {}>, import("effect/Cause").YieldableError>;
-/** The page should reload before starting another operation. */
-export declare class UiDeploymentChanged extends UiDeploymentChanged_base {
+declare const UiVersionChanged_base: Schema.Class<UiVersionChanged, Schema.TaggedStruct<"UiDeploymentChanged", {}>, import("effect/Cause").YieldableError>;
+/**
+ * The page should reload before starting another operation. The tag keeps its former name: pages
+ * built with earlier framework releases reload on it.
+ */
+export declare class UiVersionChanged extends UiVersionChanged_base {
 }
 declare const UiFailed_base: Schema.Class<UiFailed, Schema.TaggedStruct<"UiFailed", {
     readonly reason: Schema.Literals<readonly ["unavailable", "operation_failed", "account_required"]>;
@@ -50,24 +87,27 @@ export declare const UiSnapshot: Schema.Union<readonly [Schema.Struct<{
     readonly type: Schema.Literal<"heartbeat">;
 }>]>;
 /** Portable serving contract; the host authenticates and resolves the configured app. */
-export declare const AppUiApi: HttpApi.HttpApi<"app-ui", HttpApiGroup.HttpApiGroup<"ui", HttpApiEndpoint.HttpApiEndpoint<"query", "POST", "/_executor/api/query", never, never, Schema.toCodecJson<Schema.Struct<{
+export declare const AppUiApi: HttpApi.HttpApi<"app-ui", HttpApiGroup.HttpApiGroup<"ui", HttpApiEndpoint.HttpApiEndpoint<"query", "POST", "/_executor/api/query", never, never, Schema.toCodecJson<withLegacyKeys<Schema.Struct<{
     readonly name: Schema.NonEmptyString;
     readonly input: Schema.Codec<Schema.Json, Schema.Json, never, never>;
-    readonly deployment: Schema.NonEmptyString;
-    readonly profile: Schema.optional<Schema.NonEmptyString>;
-    readonly expectedProfileRevision: Schema.optional<Schema.Int>;
-}>>, never, Schema.toCodecJson<Schema.Codec<Schema.Json, Schema.Json, never, never>>, Schema.toCodecJson<typeof UiUnauthorized | typeof UiForbidden | typeof UiDeploymentChanged | typeof UiFailed>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"mutate", "POST", "/_executor/api/mutate", never, never, Schema.toCodecJson<Schema.Struct<{
+    readonly version: Schema.NonEmptyString;
+    readonly accounts: Schema.optional<Schema.$Record<Schema.NonEmptyString, Schema.$Array<Schema.NonEmptyString>>>;
+}>, {
+    readonly version: "deployment";
+}>>, never, Schema.toCodecJson<Schema.Codec<Schema.Json, Schema.Json, never, never>>, Schema.toCodecJson<typeof UiUnauthorized | typeof UiForbidden | typeof UiVersionChanged | typeof UiFailed>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"mutate", "POST", "/_executor/api/mutate", never, never, Schema.toCodecJson<withLegacyKeys<Schema.Struct<{
     readonly name: Schema.NonEmptyString;
     readonly input: Schema.Codec<Schema.Json, Schema.Json, never, never>;
-    readonly deployment: Schema.NonEmptyString;
-    readonly profile: Schema.optional<Schema.NonEmptyString>;
-    readonly expectedProfileRevision: Schema.optional<Schema.Int>;
-}>>, never, Schema.toCodecJson<Schema.Codec<Schema.Json, Schema.Json, never, never>>, Schema.toCodecJson<typeof UiUnauthorized | typeof UiForbidden | typeof UiDeploymentChanged | typeof UiFailed>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"subscribe", "POST", "/_executor/api/subscribe", never, never, Schema.toCodecJson<Schema.Struct<{
+    readonly version: Schema.NonEmptyString;
+    readonly accounts: Schema.optional<Schema.$Record<Schema.NonEmptyString, Schema.$Array<Schema.NonEmptyString>>>;
+}>, {
+    readonly version: "deployment";
+}>>, never, Schema.toCodecJson<Schema.Codec<Schema.Json, Schema.Json, never, never>>, Schema.toCodecJson<typeof UiUnauthorized | typeof UiForbidden | typeof UiVersionChanged | typeof UiFailed>, never, never> | HttpApiEndpoint.HttpApiEndpoint<"subscribe", "POST", "/_executor/api/subscribe", never, never, Schema.toCodecJson<withLegacyKeys<Schema.Struct<{
     readonly name: Schema.NonEmptyString;
     readonly input: Schema.Codec<Schema.Json, Schema.Json, never, never>;
-    readonly deployment: Schema.NonEmptyString;
-    readonly profile: Schema.optional<Schema.NonEmptyString>;
-    readonly expectedProfileRevision: Schema.optional<Schema.Int>;
+    readonly version: Schema.NonEmptyString;
+    readonly accounts: Schema.optional<Schema.$Record<Schema.NonEmptyString, Schema.$Array<Schema.NonEmptyString>>>;
+}>, {
+    readonly version: "deployment";
 }>>, never, HttpApiSchema.StreamSse<HttpApiSchema.SseEventFromData<Schema.Union<readonly [Schema.Struct<{
     readonly type: Schema.Literal<"snapshot">;
     readonly value: Schema.Codec<Schema.Json, Schema.Json, never, never>;
@@ -77,7 +117,7 @@ export declare const AppUiApi: HttpApi.HttpApi<"app-ui", HttpApiGroup.HttpApiGro
     readonly error: typeof UiFailed;
 }>, Schema.Struct<{
     readonly type: Schema.Literal<"heartbeat">;
-}>]>>, Schema.Union<readonly [typeof UiUnauthorized, typeof UiForbidden, typeof UiDeploymentChanged, typeof UiFailed]>, {
+}>]>>, Schema.Union<readonly [typeof UiUnauthorized, typeof UiForbidden, typeof UiVersionChanged, typeof UiFailed]>, {
     readonly value: Schema.Json;
     readonly type: "snapshot";
     readonly trace?: unknown;
@@ -86,5 +126,5 @@ export declare const AppUiApi: HttpApi.HttpApi<"app-ui", HttpApiGroup.HttpApiGro
     readonly error: UiFailed;
 } | {
     readonly type: "heartbeat";
-}>, Schema.toCodecJson<typeof UiUnauthorized | typeof UiForbidden | typeof UiDeploymentChanged | typeof UiFailed>, never, never>, false>>;
+}>, Schema.toCodecJson<typeof UiUnauthorized | typeof UiForbidden | typeof UiVersionChanged | typeof UiFailed>, never, never>, false>>;
 export {};

package/types/apps/src/contracts/webhooks.d.ts

@@ -1,17 +1,34 @@
 /** Account-bound webhook lifecycle. Register and unregister must be idempotent for subscriptionId. */
 import type { Effect, Schema } from "effect";
 import type { ManualWebhookSetup } from "./webhook-protocol.js";
-import type { AccountSlots, BoundContext } from "./app.js";
-type SourceAccount<Context extends Pick<BoundContext<AccountSlots>, "accounts" | "fetch" | "signal">> = keyof Context["accounts"] & string;
-type SelectedAccount<Context extends Pick<BoundContext<AccountSlots>, "accounts" | "fetch" | "signal">> = {
-    [Slot in keyof Context["accounts"]]: Context["accounts"][Slot] extends readonly (infer Account)[] ? Account : Context["accounts"][Slot];
-}[keyof Context["accounts"]];
+import type { AccountScope, BoundContext, ScopedSlots } from "./app.js";
+/** What every webhook context provides; a context with `user` serves user-account webhooks. */
+type HookContext = Pick<BoundContext<ScopedSlots, AccountScope>, "app" | "fetch" | "signal">;
+/**
+ * The accounts of the webhook's scope. A context with `user` names a user requirement; one of the
+ * `"app"` scope, which has no `user`, an app requirement.
+ */
+type ScopeAccounts<Context extends HookContext> = Context extends {
+    readonly user: {
+        readonly accounts: infer Accounts;
+    };
+} ? Accounts : Context["app"]["accounts"];
+type SourceAccount<Context extends HookContext> = Context extends {
+    readonly user: unknown;
+} ? {
+    readonly user: keyof ScopeAccounts<Context> & string;
+} : {
+    readonly app: keyof ScopeAccounts<Context> & string;
+};
+type SelectedAccount<Context extends HookContext> = {
+    [Slot in keyof ScopeAccounts<Context>]: ScopeAccounts<Context>[Slot] extends readonly (infer Account)[] ? Account : ScopeAccounts<Context>[Slot];
+}[keyof ScopeAccounts<Context>];
 /**
  * Registration, delivery and cleanup share the selected accounts.
  * The host stores account IDs and parsed state, never credentials.
  * Register runs when enabling a subscription, not on every app evaluation.
  */
-interface WebhookLifecycle<Context extends Pick<BoundContext<AccountSlots>, "accounts" | "fetch" | "signal">, Config extends Schema.Decoder<unknown>, State extends Schema.Decoder<unknown>, Error = unknown> {
+interface WebhookLifecycle<Context extends HookContext, Config extends Schema.Decoder<unknown>, State extends Schema.Decoder<unknown>, Error = unknown> {
     readonly account: SourceAccount<Context>;
     readonly config: Config;
     readonly state: State;
@@ -43,7 +60,7 @@ interface WebhookLifecycle<Context extends Pick<BoundContext<AccountSlots>, "acc
     }) => Effect.Effect<void, Error>;
 }
 /** Manual subscriptions collect the state schema in a private browser form instead of invoking provider APIs. */
-export type Webhook<Context extends Pick<BoundContext<AccountSlots>, "accounts" | "fetch" | "signal">, Config extends Schema.Decoder<unknown>, State extends Schema.Decoder<unknown>, Error = unknown> = (WebhookLifecycle<Context, Config, State, Error> & {
+export type Webhook<Context extends HookContext, Config extends Schema.Decoder<unknown>, State extends Schema.Decoder<unknown>, Error = unknown> = (WebhookLifecycle<Context, Config, State, Error> & {
     readonly setup?: never;
 }) | (Omit<WebhookLifecycle<Context, Config, State, Error>, "register" | "unregister"> & {
     readonly setup: typeof ManualWebhookSetup.Type;