apps 0.0.1-beta.16 → 0.0.1-beta.18

package/js/{chunk-RFVIONFX.js → chunk-4EMWIFFJ.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-R3EV5FTO.js";
 import {
   wrap
-} from "./chunk-5T57N25Q.js";
+} from "./chunk-4QQ62BVS.js";
 import {
   JsonObject
 } from "./chunk-27F7W2LG.js";

package/js/{chunk-5T57N25Q.js → chunk-4QQ62BVS.js}

@@ -1145,6 +1145,25 @@ function object(fields) {
   ) : Schema_exports.Struct(Object.fromEntries(entries));
   return { ...wrap(decoder, false), fields: Object.freeze({ ...fields }) };
 }
+var Exposure = /* @__PURE__ */ Symbol("apps.FieldExposure");
+var exposureOf = (schema) => Exposure in schema && (schema[Exposure] === "plain" || schema[Exposure] === "raw") ? schema[Exposure] : void 0;
+var expose = (schema, exposure) => (
+  // SAFETY: the copy keeps every member of S, and `optional` and `default` keep the marking.
+  {
+    ...schema,
+    [Exposure]: exposure,
+    optional: () => expose(schema.optional(), exposure),
+    default: (value) => expose(schema.default(value), exposure)
+  }
+);
+var plain = (schema) => expose(schema, "plain");
+var raw = (schema) => expose(schema, "raw");
+var fieldExposure = (fields) => Object.fromEntries(
+  Object.entries(fields).flatMap(([name, field]) => {
+    const exposure = exposureOf(field);
+    return exposure === void 0 ? [] : [[name, exposure]];
+  })
+);
 var ImportedJsonSchema = /* @__PURE__ */ Symbol("apps.JsonSchemaDocument");
 var importedJsonSchema = (decoder) => ImportedJsonSchema in decoder ? decoder[ImportedJsonSchema] : void 0;
 var withJsonSchemaDocument = (decoder, document) => Object.assign(decoder, { [ImportedJsonSchema]: document });
@@ -1412,6 +1431,9 @@ export {
   literal,
   array,
   object,
+  plain,
+  raw,
+  fieldExposure,
   importedJsonSchema,
   once,
   withLazyJsonSchemaDocument,

package/js/{chunk-QAXLPXKL.js → chunk-7H44SOSX.js}

@@ -1,9 +1,9 @@
 import {
   prepareElicitation
-} from "./chunk-ZBGV4RN4.js";
+} from "./chunk-ZKISLYWM.js";
 import {
   fromPromise
-} from "./chunk-TEFD5OBS.js";
+} from "./chunk-NMKHTJOQ.js";
 import {
   ElicitationFailed,
   McpError,
@@ -15,11 +15,11 @@ import {
   defaultElicitationLimits,
   defaultMcpClientLimits,
   mcpSdkTimerCeilingMs
-} from "./chunk-CL3O2NIN.js";
+} from "./chunk-VXWY44LE.js";
 import {
   compileJsonSchemaDecoder,
   jsonSchemaDecoder
-} from "./chunk-5T57N25Q.js";
+} from "./chunk-4QQ62BVS.js";
 import {
   JsonObject
 } from "./chunk-27F7W2LG.js";

package/js/{chunk-CIUZ3HSV.js → chunk-F2IASQK2.js}

@@ -4,7 +4,7 @@ import {
 import {
   joinPath,
   mergeMeta
-} from "./chunk-TEFD5OBS.js";
+} from "./chunk-NMKHTJOQ.js";
 import {
   parseProviderError
 } from "./chunk-MKWZPDR6.js";
@@ -17,7 +17,7 @@ import {
   HostedToolSummary,
   McpError,
   maxFailureMessageLength
-} from "./chunk-CL3O2NIN.js";
+} from "./chunk-VXWY44LE.js";
 import {
   AppDatabaseError
 } from "./chunk-N7YDVXYJ.js";
@@ -27,7 +27,7 @@ import {
 } from "./chunk-JU7VHODU.js";
 import {
   jsonSchemaDocument
-} from "./chunk-5T57N25Q.js";
+} from "./chunk-4QQ62BVS.js";
 import {
   AppStorageError,
   AppStorageUnavailable

package/js/{chunk-L2QHGLWF.js → chunk-HQY4UTYX.js}

@@ -1,11 +1,11 @@
 import {
   fixedRouter
-} from "./chunk-CIUZ3HSV.js";
+} from "./chunk-F2IASQK2.js";
 import {
   nativeOperation,
   operationDeclaration,
   routerDeclaration
-} from "./chunk-TEFD5OBS.js";
+} from "./chunk-NMKHTJOQ.js";
 
 // src/implementation/protocol-operations.ts
 var protocolOperations = (operations, kinds = {}) => {

package/js/{chunk-S2HMUOAV.js → chunk-MAF4BRQF.js}

@@ -2,7 +2,7 @@ import {
   adaptMcpTools,
   mcpClient,
   mcpJsonSchemaValidator
-} from "./chunk-QAXLPXKL.js";
+} from "./chunk-7H44SOSX.js";
 import {
   accountProviderError,
   httpProviderError
@@ -11,7 +11,7 @@ import {
   McpError,
   McpToolsOptions,
   defaultMcpClientLimits
-} from "./chunk-CL3O2NIN.js";
+} from "./chunk-VXWY44LE.js";
 import {
   ProviderError
 } from "./chunk-R3EV5FTO.js";

package/js/{chunk-TEFD5OBS.js → chunk-NMKHTJOQ.js}

@@ -3,10 +3,10 @@ import {
   RouterKey,
   RouterMeta,
   reservedRouterKeys
-} from "./chunk-CL3O2NIN.js";
+} from "./chunk-VXWY44LE.js";
 import {
   decoderOf
-} from "./chunk-5T57N25Q.js";
+} from "./chunk-4QQ62BVS.js";
 import {
   Effect_exports,
   Schema_exports

package/js/{chunk-CL3O2NIN.js → chunk-VXWY44LE.js}

@@ -1954,7 +1954,7 @@ var ManyAccounts = class extends Data_exports.TaggedClass("many") {
 };
 
 // src/contracts/protocol-version.ts
-var frameworkProtocol = 6;
+var frameworkProtocol = 7;
 
 // src/contracts/protocols/oauth.ts
 var OAuthClientAuth2 = Schema_exports.Literals([
@@ -2688,6 +2688,88 @@ var protocol6 = {
   }
 };
 
+// src/contracts/protocols/7.ts
+var CredentialHost = Schema_exports.String.check(
+  Schema_exports.isPattern(
+    /^(\*\.)?[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*(?::[0-9]{1,5})?$/
+  )
+);
+var exposure = {
+  /** Not secret: app code reads the real value and forms show it. */
+  plain: Schema_exports.optionalKey(Schema_exports.Array(Schema_exports.NonEmptyString)),
+  /** Secret, but app code reads the real value, for signing and similar uses. */
+  raw: Schema_exports.optionalKey(Schema_exports.Array(Schema_exports.NonEmptyString))
+};
+var DeclaredAuthMethod3 = Schema_exports.Union([
+  Schema_exports.Struct({
+    type: Schema_exports.Literal("secrets"),
+    label: Schema_exports.String,
+    fields: JsonObject2,
+    ...exposure
+  }),
+  Schema_exports.Struct({
+    type: Schema_exports.Literal("oauth2"),
+    ...OAuth2Config.members[0].fields,
+    response: JsonObject2,
+    ...exposure
+  }),
+  Schema_exports.Struct({
+    type: Schema_exports.Literal("oauth2"),
+    ...OAuth2Config.members[1].fields,
+    response: JsonObject2,
+    ...exposure
+  }),
+  Schema_exports.Struct({
+    type: Schema_exports.Literal("oauth2"),
+    ...OAuth2Config.members[2].fields,
+    response: JsonObject2,
+    ...exposure
+  }),
+  Schema_exports.Struct({
+    type: Schema_exports.Literal("oauth2"),
+    ...OAuth2Config.members[3].fields,
+    response: JsonObject2,
+    ...exposure
+  })
+]);
+var DeclaredProvider3 = Schema_exports.Struct({
+  name: Schema_exports.NonEmptyString,
+  auth: Schema_exports.Record(Schema_exports.NonEmptyString, DeclaredAuthMethod3),
+  hosts: Schema_exports.optionalKey(Schema_exports.Array(CredentialHost))
+});
+var DeclaredRequirements4 = Schema_exports.Struct({
+  ...DeclaredRequirements3.fields,
+  accounts: Schema_exports.Record(
+    Schema_exports.NonEmptyString,
+    Schema_exports.Struct({
+      definition: DeclaredProvider3,
+      cardinality: Schema_exports.Literals(["one", "many"]),
+      health: Schema_exports.optionalKey(Schema_exports.Literal(true))
+    })
+  )
+});
+var ResolvedAccount3 = Schema_exports.Struct({
+  ...ResolvedAccount2.fields,
+  provider: DeclaredProvider3
+});
+var ResolvedAccounts3 = Schema_exports.Record(
+  Schema_exports.NonEmptyString,
+  Schema_exports.Union([ResolvedAccount3, Schema_exports.Array(ResolvedAccount3)])
+);
+var HostInvocation5 = Schema_exports.Struct({
+  ...HostInvocation4.fields,
+  accounts: ResolvedAccounts3
+});
+var protocol7 = {
+  version: 7,
+  schemas: {
+    ...protocol6.schemas,
+    requirements: DeclaredRequirements4,
+    accounts: ResolvedAccounts3,
+    invocation: HostInvocation5
+  }
+};
+
 // src/contracts/host.ts
 var skillsCommand = (sources) => sources ? { operation: "skills", sources: true } : { operation: "skills" };
 var skillCatalog = (response) => Schema_exports.is(SkillSources2)(response) ? response : { skills: response };
@@ -2857,13 +2939,15 @@ export {
   AccountCheckCommand,
   HostRequest3 as HostRequest,
   protocol5,
-  DeclaredAuthMethod2 as DeclaredAuthMethod,
-  DeclaredProvider2 as DeclaredProvider,
-  DeclaredRequirements3 as DeclaredRequirements,
-  ResolvedAccount2 as ResolvedAccount,
-  ResolvedAccounts2 as ResolvedAccounts,
-  HostInvocation4 as HostInvocation,
   protocol6,
+  CredentialHost,
+  DeclaredAuthMethod3 as DeclaredAuthMethod,
+  DeclaredProvider3 as DeclaredProvider,
+  DeclaredRequirements4 as DeclaredRequirements,
+  ResolvedAccount3 as ResolvedAccount,
+  ResolvedAccounts3 as ResolvedAccounts,
+  HostInvocation5 as HostInvocation,
+  protocol7,
   skillsCommand,
   skillCatalog,
   inspectCommand,

package/js/{chunk-TXFDBLWA.js → chunk-XNCYIB4D.js}

@@ -6,10 +6,10 @@ import {
   fromPromise,
   nativeOperation,
   nativeRouter
-} from "./chunk-TEFD5OBS.js";
+} from "./chunk-NMKHTJOQ.js";
 import {
   ScheduleTiming
-} from "./chunk-CL3O2NIN.js";
+} from "./chunk-VXWY44LE.js";
 import {
   DatabaseSchema
 } from "./chunk-N7YDVXYJ.js";
@@ -17,7 +17,7 @@ import {
   decoderOf,
   isSchema,
   storageFieldOf
-} from "./chunk-5T57N25Q.js";
+} from "./chunk-4QQ62BVS.js";
 import {
   AppStorageUnavailable
 } from "./chunk-PZB6T6KU.js";

package/js/{chunk-ZBGV4RN4.js → chunk-ZKISLYWM.js}

@@ -8,7 +8,7 @@ import {
   failureDetail,
   readCatalog,
   routerSkills
-} from "./chunk-CIUZ3HSV.js";
+} from "./chunk-F2IASQK2.js";
 import {
   folderSkillsEffect
 } from "./chunk-IPI4MFSN.js";
@@ -18,7 +18,7 @@ import {
   isApp,
   toEffectApp,
   unavailableStorage
-} from "./chunk-TXFDBLWA.js";
+} from "./chunk-XNCYIB4D.js";
 import {
   parseDatabaseSchema
 } from "./chunk-ZQINWV4W.js";
@@ -28,7 +28,7 @@ import {
   locate,
   nativeOperation,
   toPromise
-} from "./chunk-TEFD5OBS.js";
+} from "./chunk-NMKHTJOQ.js";
 import {
   accountProviderError,
   httpProviderError,
@@ -81,7 +81,7 @@ import {
   defaultWebhookTransportLimits,
   maxInputProblems,
   workflowDurationMillis
-} from "./chunk-CL3O2NIN.js";
+} from "./chunk-VXWY44LE.js";
 import {
   CacheError
 } from "./chunk-R3EV5FTO.js";
@@ -99,7 +99,7 @@ import {
   importedJsonSchema,
   jsonSchemaDecoder,
   jsonSchemaDocument
-} from "./chunk-5T57N25Q.js";
+} from "./chunk-4QQ62BVS.js";
 import {
   JsonObject,
   JsonValue
@@ -594,6 +594,12 @@ var declarationSafe = (work, summary) => Effect_exports.suspend(work).pipe(
     (cause) => Cause_exports.hasInterrupts(cause) ? Effect_exports.interrupt : Effect_exports.fail(declarationInvalid(summary, Cause_exports.squash(cause)))
   )
 );
+function declaredExposure(exposure) {
+  const named = (kind) => Object.entries(exposure ?? {}).filter(([, value]) => value === kind).map(([field]) => field).sort();
+  const plain = named("plain");
+  const raw = named("raw");
+  return { ...plain.length === 0 ? {} : { plain }, ...raw.length === 0 ? {} : { raw } };
+}
 function providerDeclaration(provider) {
   return declarationSafe(
     () => Effect_exports.gen(function* () {
@@ -604,21 +610,25 @@ function providerDeclaration(provider) {
             auth.set(name, {
               type: "secrets",
               label: method.label,
-              fields: yield* jsonSchemaDocument(method.fields)
+              fields: yield* jsonSchemaDocument(method.fields),
+              ...declaredExposure(method.exposure)
             });
             break;
           case "oauth2":
             auth.set(name, {
               type: "oauth2",
               ...method.config,
-              response: yield* jsonSchemaDocument(method.response)
+              response: yield* jsonSchemaDocument(method.response),
+              ...declaredExposure(method.exposure)
             });
             break;
         }
       }
       return yield* Schema_exports.decodeUnknownEffect(DeclaredProvider)({
         name: provider.name,
-        auth: Object.fromEntries(auth)
+        auth: Object.fromEntries(auth),
+        // Order and repetition carry no meaning, so neither changes the provider's identity.
+        ...provider.hosts === void 0 ? {} : { hosts: [...new Set(provider.hosts)].sort() }
       });
     }),
     `Account provider "${provider.name}" has an invalid declaration`
@@ -653,6 +663,9 @@ function canonical(value) {
   }
   return JSON.stringify(value);
 }
+function withoutHosts({ hosts: _hosts, ...provider }) {
+  return provider;
+}
 function bindAccounts(slots, declarations, context) {
   return safe2(
     () => Effect_exports.gen(function* () {
@@ -678,7 +691,7 @@ function bindAccounts(slots, declarations, context) {
         for (const account of accounts) {
           if (ids.has(account.id)) return yield* Effect_exports.fail(new HostAccountsInvalid());
           ids.add(account.id);
-          if (canonical(account.provider) !== canonical(requirement.definition) || !Object.hasOwn(provider.auth, account.method))
+          if (canonical(withoutHosts(account.provider)) !== canonical(withoutHosts(requirement.definition)) || !Object.hasOwn(provider.auth, account.method))
             return yield* Effect_exports.fail(new HostAccountsInvalid());
           const method = provider.auth[account.method];
           if (method === void 0) return yield* Effect_exports.fail(new HostAccountsInvalid());

package/js/client.js

@@ -27,7 +27,7 @@ import {
 } from "./chunk-UK573G7W.js";
 import {
   decoderOf
-} from "./chunk-5T57N25Q.js";
+} from "./chunk-4QQ62BVS.js";
 import {
   StorageName
 } from "./chunk-PZB6T6KU.js";

package/js/contracts.js

@@ -6,6 +6,7 @@ import {
   ApprovalElicitation,
   ApprovalResponse,
   CalendarSchedule,
+  CredentialHost,
   DeclaredAuthMethod,
   DeclaredProvider,
   DeclaredRequirements,
@@ -108,11 +109,12 @@ import {
   protocol4,
   protocol5,
   protocol6,
+  protocol7,
   selectTools,
   skillCatalog,
   skillsCommand,
   workflowDurationMillis
-} from "./chunk-CL3O2NIN.js";
+} from "./chunk-VXWY44LE.js";
 import {
   DatabaseFieldReserved,
   DatabaseLimitExceeded
@@ -159,6 +161,7 @@ export {
   ApprovalElicitation,
   ApprovalResponse,
   CalendarSchedule,
+  CredentialHost,
   DatabaseFieldReserved,
   DatabaseLimitExceeded,
   DeclaredAuthMethod,
@@ -271,6 +274,7 @@ export {
   protocol4,
   protocol5,
   protocol6,
+  protocol7,
   selectTools,
   skillCatalog,
   skillFormatLimits,

package/js/effect.js

@@ -3,17 +3,17 @@ import {
   ApprovalDecision,
   createAppHandler,
   prepareElicitation
-} from "./chunk-ZBGV4RN4.js";
+} from "./chunk-ZKISLYWM.js";
 import "./chunk-NKLWZJLE.js";
-import "./chunk-CIUZ3HSV.js";
+import "./chunk-F2IASQK2.js";
 import "./chunk-IPI4MFSN.js";
-import "./chunk-TXFDBLWA.js";
+import "./chunk-XNCYIB4D.js";
 import "./chunk-ZQINWV4W.js";
-import "./chunk-TEFD5OBS.js";
+import "./chunk-NMKHTJOQ.js";
 import "./chunk-MKWZPDR6.js";
 import {
   ToolAnnotations
-} from "./chunk-CL3O2NIN.js";
+} from "./chunk-VXWY44LE.js";
 import "./chunk-N7YDVXYJ.js";
 import "./chunk-R3EV5FTO.js";
 import "./chunk-JU7VHODU.js";
@@ -25,7 +25,7 @@ import {
   decoderOf,
   jsonSchemaDecoder,
   wrap
-} from "./chunk-5T57N25Q.js";
+} from "./chunk-4QQ62BVS.js";
 import "./chunk-PZB6T6KU.js";
 import {
   HttpUrl,

package/js/graphql.js

@@ -1,28 +1,28 @@
 import {
   catalogCache
-} from "./chunk-RFVIONFX.js";
+} from "./chunk-4EMWIFFJ.js";
 import {
   protocolOperations
-} from "./chunk-L2QHGLWF.js";
+} from "./chunk-HQY4UTYX.js";
 import "./chunk-BCSNKUAC.js";
-import "./chunk-ZBGV4RN4.js";
+import "./chunk-ZKISLYWM.js";
 import {
   cacheKey
 } from "./chunk-NKLWZJLE.js";
-import "./chunk-CIUZ3HSV.js";
+import "./chunk-F2IASQK2.js";
 import "./chunk-IPI4MFSN.js";
-import "./chunk-TXFDBLWA.js";
+import "./chunk-XNCYIB4D.js";
 import "./chunk-ZQINWV4W.js";
 import {
   nativeOperation,
   routerDeclaration
-} from "./chunk-TEFD5OBS.js";
+} from "./chunk-NMKHTJOQ.js";
 import {
   accountProviderError,
   graphqlProviderError,
   httpProviderError
 } from "./chunk-MKWZPDR6.js";
-import "./chunk-CL3O2NIN.js";
+import "./chunk-VXWY44LE.js";
 import "./chunk-N7YDVXYJ.js";
 import {
   ProviderError
@@ -38,7 +38,7 @@ import {
 } from "./chunk-UK573G7W.js";
 import {
   jsonSchemaDecoder
-} from "./chunk-5T57N25Q.js";
+} from "./chunk-4QQ62BVS.js";
 import "./chunk-PZB6T6KU.js";
 import {
   AccountId,

package/js/host.js

@@ -1,12 +1,12 @@
 import {
   createAppHandler
-} from "./chunk-ZBGV4RN4.js";
+} from "./chunk-ZKISLYWM.js";
 import "./chunk-NKLWZJLE.js";
-import "./chunk-CIUZ3HSV.js";
+import "./chunk-F2IASQK2.js";
 import "./chunk-IPI4MFSN.js";
-import "./chunk-TXFDBLWA.js";
+import "./chunk-XNCYIB4D.js";
 import "./chunk-ZQINWV4W.js";
-import "./chunk-TEFD5OBS.js";
+import "./chunk-NMKHTJOQ.js";
 import "./chunk-MKWZPDR6.js";
 import {
   ElicitationFailed,
@@ -21,7 +21,7 @@ import {
   WorkflowRun,
   WorkflowRunId,
   WorkflowRunPage
-} from "./chunk-CL3O2NIN.js";
+} from "./chunk-VXWY44LE.js";
 import "./chunk-N7YDVXYJ.js";
 import {
   CacheCommand,
@@ -35,7 +35,7 @@ import {
 } from "./chunk-ODEIDRGW.js";
 import "./chunk-57RKNWL2.js";
 import "./chunk-UK573G7W.js";
-import "./chunk-5T57N25Q.js";
+import "./chunk-4QQ62BVS.js";
 import "./chunk-PZB6T6KU.js";
 import "./chunk-27F7W2LG.js";
 import {

package/js/index.js

@@ -5,7 +5,7 @@ import {
   defineDatabase,
   table,
   workflow
-} from "./chunk-TXFDBLWA.js";
+} from "./chunk-XNCYIB4D.js";
 import "./chunk-ZQINWV4W.js";
 import {
   dynamicRouter,
@@ -20,7 +20,7 @@ import {
   toolAnnotations,
   withApproval,
   withApprovals
-} from "./chunk-TEFD5OBS.js";
+} from "./chunk-NMKHTJOQ.js";
 import {
   accountProviderError
 } from "./chunk-MKWZPDR6.js";
@@ -38,7 +38,7 @@ import {
   ScheduleTiming,
   SecretsMethod,
   WorkflowFailure
-} from "./chunk-CL3O2NIN.js";
+} from "./chunk-VXWY44LE.js";
 import "./chunk-N7YDVXYJ.js";
 import {
   CacheError,
@@ -49,8 +49,10 @@ import {
   array,
   boolean,
   decoderOf,
+  fieldExposure,
   id,
   importedJsonSchema,
+  isSchema,
   json,
   jsonSchema,
   literal,
@@ -59,12 +61,14 @@ import {
   object,
   once,
   parse,
+  plain,
+  raw,
   record,
   string,
   userId,
   withLazyJsonSchemaDocument,
   wrap
-} from "./chunk-5T57N25Q.js";
+} from "./chunk-4QQ62BVS.js";
 import "./chunk-PZB6T6KU.js";
 import {
   JsonObject,
@@ -88,7 +92,11 @@ var decodeJson = (response, schema) => Effect_exports.gen(function* () {
 
 // src/implementation/provider.ts
 var secrets = (options) => new SecretsMethod(options);
-var oauth2 = (config, response) => parse(OAuth2Config, config).pipe(Effect_exports.map((config2) => new OAuth2Method({ config: config2, response })));
+var oauth2 = (config, response, exposure) => parse(OAuth2Config, config).pipe(
+  Effect_exports.map(
+    (config2) => new OAuth2Method({ config: config2, response, ...exposure === void 0 ? {} : { exposure } })
+  )
+);
 var defineProvider = ({
   health,
   ...options
@@ -368,11 +376,26 @@ var cron = (calendar, operation, input) => declaration(
 );
 
 // src/index.ts
+var isFields = (value) => typeof value === "object" && value !== null && Object.values(value).every(isSchema);
+var accountDecoder = (schema) => (
+  // SAFETY: the brand exists only in types; secret values are strings at runtime.
+  decoderOf(schema)
+);
+var exposureOf = (schema) => {
+  const marked = "fields" in schema && isFields(schema.fields) ? fieldExposure(schema.fields) : {};
+  return Object.keys(marked).length === 0 ? {} : { exposure: marked };
+};
 var OAuth2AccessToken2 = wrap(OAuth2AccessToken, false);
-var secrets2 = (options) => secrets({ label: options.label, fields: decoderOf(options.fields) });
+var secrets2 = (options) => secrets({
+  label: options.label,
+  fields: accountDecoder(options.fields),
+  ...exposureOf(options.fields)
+});
 function oauth22(options) {
   const { response = OAuth2AccessToken2, ...config } = options;
-  return Effect_exports.runSync(oauth2(config, decoderOf(response)));
+  return Effect_exports.runSync(
+    oauth2(config, accountDecoder(response), exposureOf(response).exposure)
+  );
 }
 var decodeJson2 = (response, schema) => {
   const native = {
@@ -418,7 +441,9 @@ export {
   number,
   oauth22 as oauth2,
   object,
+  plain,
   query,
+  raw,
   record,
   router,
   secrets2 as secrets,