apps 0.0.1-beta.9 → 0.0.1-beta.91

package/types/apps/src/contracts/host.d.ts

@@ -1,11 +1,10 @@
 export * from "./skills.js";
-import { SkillLoadFailed, type SkillFile } from "./skills.js";
+import { type SkillFile } from "./skills.js";
 import { ProviderError } from "./provider-error.js";
-import { McpError } from "./mcp.js";
 import { OpenapiResponseError } from "./api-response-error.js";
-export { ApiErrorResponse, OpenapiResponseError } from "./api-response-error.js";
+export { ApiErrorResponse, maxApiErrorInstructionsLength, maxApiErrorMessageLength, OpenapiResponseError, } from "./api-response-error.js";
 export { ProviderError } from "./provider-error.js";
-export { McpError } from "./mcp.js";
+export { FetchOptionUnsupported, NetworkRefusal, NetworkRefused, networkRefusalHeader, networkRefusalResponse, networkRefusalStatus, } from "./network.js";
 import { WorkflowFailure, type WorkflowExecution, type WorkflowReplay, type WorkflowHostControls } from "./workflows.js";
 export * from "./workflows.js";
 export * from "./failure.js";
@@ -13,31 +12,1437 @@ import { DatabaseFieldReserved, DatabaseLimitExceeded } from "../../../app-data/
 export { DatabaseFieldReserved, DatabaseLimitExceeded } from "../../../app-data/src/contracts/database.js";
 /** Portable framework dispatch contracts. Requests never carry account bindings. */
 import { Context, Schema, type Effect, type Redacted } from "effect";
-import type { AppStorage } from "./storage.js";
+import type { AppSqlStorage } from "./sql.js";
 import type { InvocationTelemetry } from "../../../telemetry/src/index.js";
-export { AppStorageError, AppStorageUnavailable, StorageName, type AppStorage } from "./storage.js";
+export { type AppSqlStorage, type Sql, type SqlCursor, type SqlReader, type SqlRow, type SqlValue, } from "./sql.js";
 import { ElicitationFailed, type ElicitationHandler } from "./elicitation.js";
-export { ElicitationLimits, defaultElicitationLimits, FormElicitation, ElicitationResponse, ElicitationReply, ElicitationFailed, type ElicitationHandler, ApprovalElicitation, ApprovalResponse, approvalElicitation, } from "./elicitation.js";
+export { ElicitationLimits, defaultElicitationLimits, FormElicitation, ElicitationResponse, ElicitationReply, ElicitationFailed, type ElicitationHandler, ApprovalElicitation, ApprovalResponse, approvalElicitation, exactApprovalElicitation, } from "./elicitation.js";
 export { McpClientLimits, defaultMcpClientLimits } from "./mcp.js";
 export * from "./webhook-protocol.js";
+export * from "./events.js";
+export { AppIcon, AppIcons, appIconLimits } from "./icons.js";
+export * from "./placement.js";
 export { AccountId, HttpUrl } from "./schema.js";
-export { OAuthClientAuth, OAuthSecretClientAuth } from "./provider.js";
+export { OAuthAuthorizationParams, OAuthClientAuth, OAuthSecretClientAuth, OAuthTokenRequestFormat, OAuthTokenResponse, reservedAuthorizationParams, type ReservedAuthorizationParam, } from "./provider.js";
 /**
- * The host protocol this framework speaks and its wire schemas. A later protocol replaces this
- * re-export; released protocol modules stay unchanged for host adapters.
+ * The host protocol this framework speaks and its wire schemas, from `protocols/current.ts`. The
+ * released protocol modules are frozen records that host adapters read.
  */
 export { frameworkProtocol } from "./protocol-version.js";
 export { protocol1 } from "./protocols/1.js";
 export { protocol2 } from "./protocols/2.js";
 export { protocol3 } from "./protocols/3.js";
 export { protocol4 } from "./protocols/4.js";
-export { protocol5, AccountCheckCommand } from "./protocols/5.js";
+export { protocol5 } from "./protocols/5.js";
+export { protocol6 } from "./protocols/6.js";
+export { protocol7 } from "./protocols/7.js";
+export { protocol8 } from "./protocols/8.js";
+export { protocol9 } from "./protocols/9.js";
+export { protocol10 } from "./protocols/10.js";
+export { protocol11 } from "./protocols/11.js";
+export { protocol12 } from "./protocols/12.js";
+export { current as protocol13, AccountCheckCommand, CredentialHost, MigrateCommand, MigrateResult, } from "./protocols/current.js";
 export { AccountCheckResult, AccountInfo } from "./provider.js";
-import { HostAccountsInvalid, HostDeclarationInvalid, HostEvaluationFailed, HostInputInvalid, HostKindMismatch, HostOperationFailed, HostOperationNotFound, HostOutputInvalid, HostRequestInvalid, HostToolApprovalRequired, HostToolBlocked, HostToolNotFound, HostToolPolicyFailed, SkillSources, type InvocationDeadline, ResolvedAccounts, type SkillCatalogResponse, type TrustedToolApproval } from "./protocols/5.js";
-export { DeclaredRequirements, HostRequest } from "./protocols/5.js";
-export { DeclaredAuthMethod, DeclaredProvider, ResolvedAccount, ResolvedAccounts, TrustedToolApproval, InvocationDeadline, HostedTool, HostedToolSummary, HostRouterError, HostedRouter, HostedCatalog, HostedCatalogSummary, SkillSources, SkillCatalogResponse, HostRequestInvalid, HostAccountsInvalid, HostDeclarationInvalid, HostEvaluationFailed, HostOperationNotFound, HostOperationFailed, HostToolNotFound, HostKindMismatch, InputProblem, maxInputProblems, HostInputInvalid, HostToolBlocked, HostToolApprovalRequired, HostToolPolicyFailed, HostOutputInvalid, HostError, HostResponse, HostInvocation, } from "./protocols/5.js";
+import { HostAccountsInvalid, HostDeclarationInvalid, HostEvaluationFailed, HostInputInvalid, HostKindMismatch, HostOperationFailed, HostOperationNotFound, HostOutputInvalid, HostRequestInvalid, HostToolApprovalRequired, HostToolBlocked, HostToolNotFound, HostToolPolicyFailed, McpError, SkillLoadFailed, SkillSources, type InvocationDeadline, ResolvedAccounts, type SkillCatalogResponse, type TrustedToolApproval } from "./protocols/current.js";
+export { DeclaredRequirements, HostRequest } from "./protocols/current.js";
+/**
+ * The MCP and skill loader failures as they cross the host boundary. Apps throw the author-facing
+ * classes from `apps/mcp` and `apps/skills`.
+ */
+export { McpError, SkillLoadFailed } from "./protocols/current.js";
+export { DeclaredAuthMethod, DeclaredProvider, DeclaredAccountSlot, DeclaredAccountSlots, ResolvedAccount, ResolvedAccounts, ResolvedAccountSlots, TrustedToolApproval, InvocationDeadline, HostedTool, HostedToolSummary, HostRouterError, HostedRouter, HostedCatalog, HostedCatalogSummary, SkillSources, SkillCatalogResponse, HostRequestInvalid, HostAccountsInvalid, HostDeclarationInvalid, HostEvaluationFailed, HostOperationNotFound, HostOperationFailed, HostToolNotFound, HostKindMismatch, InputProblem, maxInputProblems, HostInputInvalid, HostToolBlocked, HostToolApprovalRequired, HostToolPolicyFailed, HostOutputInvalid, HostError, HostResponse, HostInvocation, } from "./protocols/current.js";
 /** Raw host inputs; the host boundary parses and redacts these immediately. */
 export type ResolvedAccountsInput = typeof ResolvedAccounts.Encoded;
+/**
+ * An account as the host sends it to the runner. `managed` marks a credential issued to the
+ * instance operator's own OAuth client: the runner seals every one of its strings, whatever the
+ * method exposes, so that only the operator's placement can send it. The runner removes the mark;
+ * a bundle reads a `ResolvedAccount`. Not part of any host protocol.
+ */
+export declare const HostAccount: Schema.Struct<{
+    readonly managed: Schema.optionalKey<Schema.Literal<true>>;
+    readonly id: Schema.brand<Schema.String, "acc">;
+    readonly provider: Schema.Struct<{
+        readonly name: Schema.NonEmptyString;
+        readonly auth: Schema.$Record<Schema.NonEmptyString, Schema.Union<readonly [Schema.Struct<{
+            readonly plain: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+            readonly raw: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+            readonly request: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+                readonly in: Schema.Literal<"header">;
+                readonly name: Schema.String;
+                readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                    readonly field: Schema.NonEmptyString;
+                }>, Schema.Struct<{
+                    readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>]>>;
+                }>]>>;
+            }>, Schema.Struct<{
+                readonly in: Schema.Literal<"query">;
+                readonly name: Schema.NonEmptyString;
+                readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                    readonly field: Schema.NonEmptyString;
+                }>, Schema.Struct<{
+                    readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>]>>;
+                }>]>>;
+            }>]>>>;
+            readonly type: Schema.Literal<"secrets">;
+            readonly label: Schema.String;
+            readonly fields: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+        }>, Schema.Struct<{
+            readonly plain: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+            readonly raw: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+            readonly request: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+                readonly in: Schema.Literal<"header">;
+                readonly name: Schema.String;
+                readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                    readonly field: Schema.NonEmptyString;
+                }>, Schema.Struct<{
+                    readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>]>>;
+                }>]>>;
+            }>, Schema.Struct<{
+                readonly in: Schema.Literal<"query">;
+                readonly name: Schema.NonEmptyString;
+                readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                    readonly field: Schema.NonEmptyString;
+                }>, Schema.Struct<{
+                    readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>]>>;
+                }>]>>;
+            }>]>>>;
+            readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+            readonly discover: Schema.String;
+            readonly authorizationServerMetadataUrl: Schema.optionalKey<Schema.String>;
+            readonly authorizationUrl: Schema.optionalKey<Schema.Never>;
+            readonly tokenUrl: Schema.optionalKey<Schema.Never>;
+            readonly revocationUrl: Schema.optionalKey<Schema.Never>;
+            readonly scopes: Schema.optionalKey<Schema.$Array<Schema.String>>;
+            readonly tokenResponse: Schema.optionalKey<Schema.Struct<{
+                readonly path: Schema.String;
+            }>>;
+            readonly grant: Schema.optionalKey<Schema.Literal<"authorization_code">>;
+            readonly authorizationParams: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
+            readonly tokenEndpointAuthMethod: Schema.optionalKey<Schema.Literals<readonly ["none", "client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>>;
+            readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+            readonly scopeSeparator: Schema.optionalKey<Schema.String>;
+            readonly tokenRequestFormat: Schema.optionalKey<Schema.Literals<readonly ["form", "json"]>>;
+            readonly type: Schema.Literal<"oauth2">;
+        }>, Schema.Struct<{
+            readonly plain: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+            readonly raw: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+            readonly request: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+                readonly in: Schema.Literal<"header">;
+                readonly name: Schema.String;
+                readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                    readonly field: Schema.NonEmptyString;
+                }>, Schema.Struct<{
+                    readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>]>>;
+                }>]>>;
+            }>, Schema.Struct<{
+                readonly in: Schema.Literal<"query">;
+                readonly name: Schema.NonEmptyString;
+                readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                    readonly field: Schema.NonEmptyString;
+                }>, Schema.Struct<{
+                    readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>]>>;
+                }>]>>;
+            }>]>>>;
+            readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+            readonly authorizationUrl: Schema.String;
+            readonly tokenUrl: Schema.String;
+            readonly revocationUrl: Schema.optionalKey<Schema.String>;
+            readonly scopes: Schema.$Array<Schema.String>;
+            readonly issuer: Schema.optionalKey<Schema.String>;
+            readonly discover: Schema.optionalKey<Schema.Never>;
+            readonly authorizationServerMetadataUrl: Schema.optionalKey<Schema.Never>;
+            readonly tokenResponse: Schema.optionalKey<Schema.Struct<{
+                readonly path: Schema.String;
+            }>>;
+            readonly grant: Schema.optionalKey<Schema.Literal<"authorization_code">>;
+            readonly authorizationParams: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
+            readonly tokenEndpointAuthMethod: Schema.optionalKey<Schema.Literals<readonly ["none", "client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>>;
+            readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+            readonly scopeSeparator: Schema.optionalKey<Schema.String>;
+            readonly tokenRequestFormat: Schema.optionalKey<Schema.Literals<readonly ["form", "json"]>>;
+            readonly type: Schema.Literal<"oauth2">;
+        }>, Schema.Struct<{
+            readonly plain: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+            readonly raw: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+            readonly request: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+                readonly in: Schema.Literal<"header">;
+                readonly name: Schema.String;
+                readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                    readonly field: Schema.NonEmptyString;
+                }>, Schema.Struct<{
+                    readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>]>>;
+                }>]>>;
+            }>, Schema.Struct<{
+                readonly in: Schema.Literal<"query">;
+                readonly name: Schema.NonEmptyString;
+                readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                    readonly field: Schema.NonEmptyString;
+                }>, Schema.Struct<{
+                    readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>]>>;
+                }>]>>;
+            }>]>>>;
+            readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+            readonly tokenEndpointAuthMethod: Schema.Literals<readonly ["client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>;
+            readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+            readonly scopeSeparator: Schema.optionalKey<Schema.String>;
+            readonly tokenRequestFormat: Schema.optionalKey<Schema.Literals<readonly ["form", "json"]>>;
+            readonly grant: Schema.Literal<"client_credentials">;
+            readonly discover: Schema.String;
+            readonly authorizationServerMetadataUrl: Schema.optionalKey<Schema.String>;
+            readonly authorizationUrl: Schema.optionalKey<Schema.Never>;
+            readonly tokenUrl: Schema.optionalKey<Schema.Never>;
+            readonly revocationUrl: Schema.optionalKey<Schema.Never>;
+            readonly scopes: Schema.optionalKey<Schema.$Array<Schema.String>>;
+            readonly type: Schema.Literal<"oauth2">;
+        }>, Schema.Struct<{
+            readonly plain: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+            readonly raw: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+            readonly request: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+                readonly in: Schema.Literal<"header">;
+                readonly name: Schema.String;
+                readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                    readonly field: Schema.NonEmptyString;
+                }>, Schema.Struct<{
+                    readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>]>>;
+                }>]>>;
+            }>, Schema.Struct<{
+                readonly in: Schema.Literal<"query">;
+                readonly name: Schema.NonEmptyString;
+                readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                    readonly field: Schema.NonEmptyString;
+                }>, Schema.Struct<{
+                    readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>]>>;
+                }>]>>;
+            }>]>>>;
+            readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+            readonly tokenEndpointAuthMethod: Schema.Literals<readonly ["client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>;
+            readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+            readonly authorizationUrl: Schema.optionalKey<Schema.Never>;
+            readonly discover: Schema.optionalKey<Schema.Never>;
+            readonly authorizationServerMetadataUrl: Schema.optionalKey<Schema.Never>;
+            readonly scopeSeparator: Schema.optionalKey<Schema.String>;
+            readonly tokenRequestFormat: Schema.optionalKey<Schema.Literals<readonly ["form", "json"]>>;
+            readonly grant: Schema.Literal<"client_credentials">;
+            readonly tokenUrl: Schema.String;
+            readonly revocationUrl: Schema.optionalKey<Schema.String>;
+            readonly scopes: Schema.$Array<Schema.String>;
+            readonly type: Schema.Literal<"oauth2">;
+        }>]>>;
+        readonly hosts: Schema.optionalKey<Schema.$Array<Schema.String>>;
+    }>;
+    readonly method: Schema.NonEmptyString;
+    readonly generation: Schema.optionalKey<Schema.Int>;
+    readonly fields: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+}>;
+export type HostAccount = typeof HostAccount.Type;
+/** One scope's accounts as the host sends them to the runner; see `HostAccount`. */
+export declare const HostAccountSlots: Schema.$Record<Schema.NonEmptyString, Schema.Union<readonly [Schema.Struct<{
+    readonly managed: Schema.optionalKey<Schema.Literal<true>>;
+    readonly id: Schema.brand<Schema.String, "acc">;
+    readonly provider: Schema.Struct<{
+        readonly name: Schema.NonEmptyString;
+        readonly auth: Schema.$Record<Schema.NonEmptyString, Schema.Union<readonly [Schema.Struct<{
+            readonly plain: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+            readonly raw: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+            readonly request: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+                readonly in: Schema.Literal<"header">;
+                readonly name: Schema.String;
+                readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                    readonly field: Schema.NonEmptyString;
+                }>, Schema.Struct<{
+                    readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>]>>;
+                }>]>>;
+            }>, Schema.Struct<{
+                readonly in: Schema.Literal<"query">;
+                readonly name: Schema.NonEmptyString;
+                readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                    readonly field: Schema.NonEmptyString;
+                }>, Schema.Struct<{
+                    readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>]>>;
+                }>]>>;
+            }>]>>>;
+            readonly type: Schema.Literal<"secrets">;
+            readonly label: Schema.String;
+            readonly fields: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+        }>, Schema.Struct<{
+            readonly plain: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+            readonly raw: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+            readonly request: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+                readonly in: Schema.Literal<"header">;
+                readonly name: Schema.String;
+                readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                    readonly field: Schema.NonEmptyString;
+                }>, Schema.Struct<{
+                    readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>]>>;
+                }>]>>;
+            }>, Schema.Struct<{
+                readonly in: Schema.Literal<"query">;
+                readonly name: Schema.NonEmptyString;
+                readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                    readonly field: Schema.NonEmptyString;
+                }>, Schema.Struct<{
+                    readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>]>>;
+                }>]>>;
+            }>]>>>;
+            readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+            readonly discover: Schema.String;
+            readonly authorizationServerMetadataUrl: Schema.optionalKey<Schema.String>;
+            readonly authorizationUrl: Schema.optionalKey<Schema.Never>;
+            readonly tokenUrl: Schema.optionalKey<Schema.Never>;
+            readonly revocationUrl: Schema.optionalKey<Schema.Never>;
+            readonly scopes: Schema.optionalKey<Schema.$Array<Schema.String>>;
+            readonly tokenResponse: Schema.optionalKey<Schema.Struct<{
+                readonly path: Schema.String;
+            }>>;
+            readonly grant: Schema.optionalKey<Schema.Literal<"authorization_code">>;
+            readonly authorizationParams: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
+            readonly tokenEndpointAuthMethod: Schema.optionalKey<Schema.Literals<readonly ["none", "client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>>;
+            readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+            readonly scopeSeparator: Schema.optionalKey<Schema.String>;
+            readonly tokenRequestFormat: Schema.optionalKey<Schema.Literals<readonly ["form", "json"]>>;
+            readonly type: Schema.Literal<"oauth2">;
+        }>, Schema.Struct<{
+            readonly plain: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+            readonly raw: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+            readonly request: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+                readonly in: Schema.Literal<"header">;
+                readonly name: Schema.String;
+                readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                    readonly field: Schema.NonEmptyString;
+                }>, Schema.Struct<{
+                    readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>]>>;
+                }>]>>;
+            }>, Schema.Struct<{
+                readonly in: Schema.Literal<"query">;
+                readonly name: Schema.NonEmptyString;
+                readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                    readonly field: Schema.NonEmptyString;
+                }>, Schema.Struct<{
+                    readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>]>>;
+                }>]>>;
+            }>]>>>;
+            readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+            readonly authorizationUrl: Schema.String;
+            readonly tokenUrl: Schema.String;
+            readonly revocationUrl: Schema.optionalKey<Schema.String>;
+            readonly scopes: Schema.$Array<Schema.String>;
+            readonly issuer: Schema.optionalKey<Schema.String>;
+            readonly discover: Schema.optionalKey<Schema.Never>;
+            readonly authorizationServerMetadataUrl: Schema.optionalKey<Schema.Never>;
+            readonly tokenResponse: Schema.optionalKey<Schema.Struct<{
+                readonly path: Schema.String;
+            }>>;
+            readonly grant: Schema.optionalKey<Schema.Literal<"authorization_code">>;
+            readonly authorizationParams: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
+            readonly tokenEndpointAuthMethod: Schema.optionalKey<Schema.Literals<readonly ["none", "client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>>;
+            readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+            readonly scopeSeparator: Schema.optionalKey<Schema.String>;
+            readonly tokenRequestFormat: Schema.optionalKey<Schema.Literals<readonly ["form", "json"]>>;
+            readonly type: Schema.Literal<"oauth2">;
+        }>, Schema.Struct<{
+            readonly plain: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+            readonly raw: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+            readonly request: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+                readonly in: Schema.Literal<"header">;
+                readonly name: Schema.String;
+                readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                    readonly field: Schema.NonEmptyString;
+                }>, Schema.Struct<{
+                    readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>]>>;
+                }>]>>;
+            }>, Schema.Struct<{
+                readonly in: Schema.Literal<"query">;
+                readonly name: Schema.NonEmptyString;
+                readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                    readonly field: Schema.NonEmptyString;
+                }>, Schema.Struct<{
+                    readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>]>>;
+                }>]>>;
+            }>]>>>;
+            readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+            readonly tokenEndpointAuthMethod: Schema.Literals<readonly ["client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>;
+            readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+            readonly scopeSeparator: Schema.optionalKey<Schema.String>;
+            readonly tokenRequestFormat: Schema.optionalKey<Schema.Literals<readonly ["form", "json"]>>;
+            readonly grant: Schema.Literal<"client_credentials">;
+            readonly discover: Schema.String;
+            readonly authorizationServerMetadataUrl: Schema.optionalKey<Schema.String>;
+            readonly authorizationUrl: Schema.optionalKey<Schema.Never>;
+            readonly tokenUrl: Schema.optionalKey<Schema.Never>;
+            readonly revocationUrl: Schema.optionalKey<Schema.Never>;
+            readonly scopes: Schema.optionalKey<Schema.$Array<Schema.String>>;
+            readonly type: Schema.Literal<"oauth2">;
+        }>, Schema.Struct<{
+            readonly plain: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+            readonly raw: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+            readonly request: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+                readonly in: Schema.Literal<"header">;
+                readonly name: Schema.String;
+                readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                    readonly field: Schema.NonEmptyString;
+                }>, Schema.Struct<{
+                    readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>]>>;
+                }>]>>;
+            }>, Schema.Struct<{
+                readonly in: Schema.Literal<"query">;
+                readonly name: Schema.NonEmptyString;
+                readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                    readonly field: Schema.NonEmptyString;
+                }>, Schema.Struct<{
+                    readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>]>>;
+                }>]>>;
+            }>]>>>;
+            readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+            readonly tokenEndpointAuthMethod: Schema.Literals<readonly ["client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>;
+            readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+            readonly authorizationUrl: Schema.optionalKey<Schema.Never>;
+            readonly discover: Schema.optionalKey<Schema.Never>;
+            readonly authorizationServerMetadataUrl: Schema.optionalKey<Schema.Never>;
+            readonly scopeSeparator: Schema.optionalKey<Schema.String>;
+            readonly tokenRequestFormat: Schema.optionalKey<Schema.Literals<readonly ["form", "json"]>>;
+            readonly grant: Schema.Literal<"client_credentials">;
+            readonly tokenUrl: Schema.String;
+            readonly revocationUrl: Schema.optionalKey<Schema.String>;
+            readonly scopes: Schema.$Array<Schema.String>;
+            readonly type: Schema.Literal<"oauth2">;
+        }>]>>;
+        readonly hosts: Schema.optionalKey<Schema.$Array<Schema.String>>;
+    }>;
+    readonly method: Schema.NonEmptyString;
+    readonly generation: Schema.optionalKey<Schema.Int>;
+    readonly fields: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+}>, Schema.$Array<Schema.Struct<{
+    readonly managed: Schema.optionalKey<Schema.Literal<true>>;
+    readonly id: Schema.brand<Schema.String, "acc">;
+    readonly provider: Schema.Struct<{
+        readonly name: Schema.NonEmptyString;
+        readonly auth: Schema.$Record<Schema.NonEmptyString, Schema.Union<readonly [Schema.Struct<{
+            readonly plain: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+            readonly raw: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+            readonly request: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+                readonly in: Schema.Literal<"header">;
+                readonly name: Schema.String;
+                readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                    readonly field: Schema.NonEmptyString;
+                }>, Schema.Struct<{
+                    readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>]>>;
+                }>]>>;
+            }>, Schema.Struct<{
+                readonly in: Schema.Literal<"query">;
+                readonly name: Schema.NonEmptyString;
+                readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                    readonly field: Schema.NonEmptyString;
+                }>, Schema.Struct<{
+                    readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>]>>;
+                }>]>>;
+            }>]>>>;
+            readonly type: Schema.Literal<"secrets">;
+            readonly label: Schema.String;
+            readonly fields: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+        }>, Schema.Struct<{
+            readonly plain: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+            readonly raw: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+            readonly request: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+                readonly in: Schema.Literal<"header">;
+                readonly name: Schema.String;
+                readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                    readonly field: Schema.NonEmptyString;
+                }>, Schema.Struct<{
+                    readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>]>>;
+                }>]>>;
+            }>, Schema.Struct<{
+                readonly in: Schema.Literal<"query">;
+                readonly name: Schema.NonEmptyString;
+                readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                    readonly field: Schema.NonEmptyString;
+                }>, Schema.Struct<{
+                    readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>]>>;
+                }>]>>;
+            }>]>>>;
+            readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+            readonly discover: Schema.String;
+            readonly authorizationServerMetadataUrl: Schema.optionalKey<Schema.String>;
+            readonly authorizationUrl: Schema.optionalKey<Schema.Never>;
+            readonly tokenUrl: Schema.optionalKey<Schema.Never>;
+            readonly revocationUrl: Schema.optionalKey<Schema.Never>;
+            readonly scopes: Schema.optionalKey<Schema.$Array<Schema.String>>;
+            readonly tokenResponse: Schema.optionalKey<Schema.Struct<{
+                readonly path: Schema.String;
+            }>>;
+            readonly grant: Schema.optionalKey<Schema.Literal<"authorization_code">>;
+            readonly authorizationParams: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
+            readonly tokenEndpointAuthMethod: Schema.optionalKey<Schema.Literals<readonly ["none", "client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>>;
+            readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+            readonly scopeSeparator: Schema.optionalKey<Schema.String>;
+            readonly tokenRequestFormat: Schema.optionalKey<Schema.Literals<readonly ["form", "json"]>>;
+            readonly type: Schema.Literal<"oauth2">;
+        }>, Schema.Struct<{
+            readonly plain: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+            readonly raw: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+            readonly request: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+                readonly in: Schema.Literal<"header">;
+                readonly name: Schema.String;
+                readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                    readonly field: Schema.NonEmptyString;
+                }>, Schema.Struct<{
+                    readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>]>>;
+                }>]>>;
+            }>, Schema.Struct<{
+                readonly in: Schema.Literal<"query">;
+                readonly name: Schema.NonEmptyString;
+                readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                    readonly field: Schema.NonEmptyString;
+                }>, Schema.Struct<{
+                    readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>]>>;
+                }>]>>;
+            }>]>>>;
+            readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+            readonly authorizationUrl: Schema.String;
+            readonly tokenUrl: Schema.String;
+            readonly revocationUrl: Schema.optionalKey<Schema.String>;
+            readonly scopes: Schema.$Array<Schema.String>;
+            readonly issuer: Schema.optionalKey<Schema.String>;
+            readonly discover: Schema.optionalKey<Schema.Never>;
+            readonly authorizationServerMetadataUrl: Schema.optionalKey<Schema.Never>;
+            readonly tokenResponse: Schema.optionalKey<Schema.Struct<{
+                readonly path: Schema.String;
+            }>>;
+            readonly grant: Schema.optionalKey<Schema.Literal<"authorization_code">>;
+            readonly authorizationParams: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
+            readonly tokenEndpointAuthMethod: Schema.optionalKey<Schema.Literals<readonly ["none", "client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>>;
+            readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+            readonly scopeSeparator: Schema.optionalKey<Schema.String>;
+            readonly tokenRequestFormat: Schema.optionalKey<Schema.Literals<readonly ["form", "json"]>>;
+            readonly type: Schema.Literal<"oauth2">;
+        }>, Schema.Struct<{
+            readonly plain: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+            readonly raw: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+            readonly request: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+                readonly in: Schema.Literal<"header">;
+                readonly name: Schema.String;
+                readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                    readonly field: Schema.NonEmptyString;
+                }>, Schema.Struct<{
+                    readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>]>>;
+                }>]>>;
+            }>, Schema.Struct<{
+                readonly in: Schema.Literal<"query">;
+                readonly name: Schema.NonEmptyString;
+                readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                    readonly field: Schema.NonEmptyString;
+                }>, Schema.Struct<{
+                    readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>]>>;
+                }>]>>;
+            }>]>>>;
+            readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+            readonly tokenEndpointAuthMethod: Schema.Literals<readonly ["client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>;
+            readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+            readonly scopeSeparator: Schema.optionalKey<Schema.String>;
+            readonly tokenRequestFormat: Schema.optionalKey<Schema.Literals<readonly ["form", "json"]>>;
+            readonly grant: Schema.Literal<"client_credentials">;
+            readonly discover: Schema.String;
+            readonly authorizationServerMetadataUrl: Schema.optionalKey<Schema.String>;
+            readonly authorizationUrl: Schema.optionalKey<Schema.Never>;
+            readonly tokenUrl: Schema.optionalKey<Schema.Never>;
+            readonly revocationUrl: Schema.optionalKey<Schema.Never>;
+            readonly scopes: Schema.optionalKey<Schema.$Array<Schema.String>>;
+            readonly type: Schema.Literal<"oauth2">;
+        }>, Schema.Struct<{
+            readonly plain: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+            readonly raw: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+            readonly request: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+                readonly in: Schema.Literal<"header">;
+                readonly name: Schema.String;
+                readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                    readonly field: Schema.NonEmptyString;
+                }>, Schema.Struct<{
+                    readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>]>>;
+                }>]>>;
+            }>, Schema.Struct<{
+                readonly in: Schema.Literal<"query">;
+                readonly name: Schema.NonEmptyString;
+                readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                    readonly field: Schema.NonEmptyString;
+                }>, Schema.Struct<{
+                    readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>]>>;
+                }>]>>;
+            }>]>>>;
+            readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+            readonly tokenEndpointAuthMethod: Schema.Literals<readonly ["client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>;
+            readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+            readonly authorizationUrl: Schema.optionalKey<Schema.Never>;
+            readonly discover: Schema.optionalKey<Schema.Never>;
+            readonly authorizationServerMetadataUrl: Schema.optionalKey<Schema.Never>;
+            readonly scopeSeparator: Schema.optionalKey<Schema.String>;
+            readonly tokenRequestFormat: Schema.optionalKey<Schema.Literals<readonly ["form", "json"]>>;
+            readonly grant: Schema.Literal<"client_credentials">;
+            readonly tokenUrl: Schema.String;
+            readonly revocationUrl: Schema.optionalKey<Schema.String>;
+            readonly scopes: Schema.$Array<Schema.String>;
+            readonly type: Schema.Literal<"oauth2">;
+        }>]>>;
+        readonly hosts: Schema.optionalKey<Schema.$Array<Schema.String>>;
+    }>;
+    readonly method: Schema.NonEmptyString;
+    readonly generation: Schema.optionalKey<Schema.Int>;
+    readonly fields: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+}>>]>>;
+export type HostAccountSlots = typeof HostAccountSlots.Type;
+/**
+ * An invocation's accounts by scope as the host sends them to the runner; see `HostAccount`.
+ * `user` is absent for work without a caller, as in `ResolvedAccounts`.
+ */
+export declare const HostAccounts: Schema.Struct<{
+    readonly app: Schema.$Record<Schema.NonEmptyString, Schema.Union<readonly [Schema.Struct<{
+        readonly managed: Schema.optionalKey<Schema.Literal<true>>;
+        readonly id: Schema.brand<Schema.String, "acc">;
+        readonly provider: Schema.Struct<{
+            readonly name: Schema.NonEmptyString;
+            readonly auth: Schema.$Record<Schema.NonEmptyString, Schema.Union<readonly [Schema.Struct<{
+                readonly plain: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly raw: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly request: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+                    readonly in: Schema.Literal<"header">;
+                    readonly name: Schema.String;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>, Schema.Struct<{
+                    readonly in: Schema.Literal<"query">;
+                    readonly name: Schema.NonEmptyString;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>]>>>;
+                readonly type: Schema.Literal<"secrets">;
+                readonly label: Schema.String;
+                readonly fields: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+            }>, Schema.Struct<{
+                readonly plain: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly raw: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly request: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+                    readonly in: Schema.Literal<"header">;
+                    readonly name: Schema.String;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>, Schema.Struct<{
+                    readonly in: Schema.Literal<"query">;
+                    readonly name: Schema.NonEmptyString;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>]>>>;
+                readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+                readonly discover: Schema.String;
+                readonly authorizationServerMetadataUrl: Schema.optionalKey<Schema.String>;
+                readonly authorizationUrl: Schema.optionalKey<Schema.Never>;
+                readonly tokenUrl: Schema.optionalKey<Schema.Never>;
+                readonly revocationUrl: Schema.optionalKey<Schema.Never>;
+                readonly scopes: Schema.optionalKey<Schema.$Array<Schema.String>>;
+                readonly tokenResponse: Schema.optionalKey<Schema.Struct<{
+                    readonly path: Schema.String;
+                }>>;
+                readonly grant: Schema.optionalKey<Schema.Literal<"authorization_code">>;
+                readonly authorizationParams: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
+                readonly tokenEndpointAuthMethod: Schema.optionalKey<Schema.Literals<readonly ["none", "client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>>;
+                readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+                readonly scopeSeparator: Schema.optionalKey<Schema.String>;
+                readonly tokenRequestFormat: Schema.optionalKey<Schema.Literals<readonly ["form", "json"]>>;
+                readonly type: Schema.Literal<"oauth2">;
+            }>, Schema.Struct<{
+                readonly plain: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly raw: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly request: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+                    readonly in: Schema.Literal<"header">;
+                    readonly name: Schema.String;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>, Schema.Struct<{
+                    readonly in: Schema.Literal<"query">;
+                    readonly name: Schema.NonEmptyString;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>]>>>;
+                readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+                readonly authorizationUrl: Schema.String;
+                readonly tokenUrl: Schema.String;
+                readonly revocationUrl: Schema.optionalKey<Schema.String>;
+                readonly scopes: Schema.$Array<Schema.String>;
+                readonly issuer: Schema.optionalKey<Schema.String>;
+                readonly discover: Schema.optionalKey<Schema.Never>;
+                readonly authorizationServerMetadataUrl: Schema.optionalKey<Schema.Never>;
+                readonly tokenResponse: Schema.optionalKey<Schema.Struct<{
+                    readonly path: Schema.String;
+                }>>;
+                readonly grant: Schema.optionalKey<Schema.Literal<"authorization_code">>;
+                readonly authorizationParams: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
+                readonly tokenEndpointAuthMethod: Schema.optionalKey<Schema.Literals<readonly ["none", "client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>>;
+                readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+                readonly scopeSeparator: Schema.optionalKey<Schema.String>;
+                readonly tokenRequestFormat: Schema.optionalKey<Schema.Literals<readonly ["form", "json"]>>;
+                readonly type: Schema.Literal<"oauth2">;
+            }>, Schema.Struct<{
+                readonly plain: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly raw: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly request: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+                    readonly in: Schema.Literal<"header">;
+                    readonly name: Schema.String;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>, Schema.Struct<{
+                    readonly in: Schema.Literal<"query">;
+                    readonly name: Schema.NonEmptyString;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>]>>>;
+                readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+                readonly tokenEndpointAuthMethod: Schema.Literals<readonly ["client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>;
+                readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+                readonly scopeSeparator: Schema.optionalKey<Schema.String>;
+                readonly tokenRequestFormat: Schema.optionalKey<Schema.Literals<readonly ["form", "json"]>>;
+                readonly grant: Schema.Literal<"client_credentials">;
+                readonly discover: Schema.String;
+                readonly authorizationServerMetadataUrl: Schema.optionalKey<Schema.String>;
+                readonly authorizationUrl: Schema.optionalKey<Schema.Never>;
+                readonly tokenUrl: Schema.optionalKey<Schema.Never>;
+                readonly revocationUrl: Schema.optionalKey<Schema.Never>;
+                readonly scopes: Schema.optionalKey<Schema.$Array<Schema.String>>;
+                readonly type: Schema.Literal<"oauth2">;
+            }>, Schema.Struct<{
+                readonly plain: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly raw: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly request: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+                    readonly in: Schema.Literal<"header">;
+                    readonly name: Schema.String;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>, Schema.Struct<{
+                    readonly in: Schema.Literal<"query">;
+                    readonly name: Schema.NonEmptyString;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>]>>>;
+                readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+                readonly tokenEndpointAuthMethod: Schema.Literals<readonly ["client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>;
+                readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+                readonly authorizationUrl: Schema.optionalKey<Schema.Never>;
+                readonly discover: Schema.optionalKey<Schema.Never>;
+                readonly authorizationServerMetadataUrl: Schema.optionalKey<Schema.Never>;
+                readonly scopeSeparator: Schema.optionalKey<Schema.String>;
+                readonly tokenRequestFormat: Schema.optionalKey<Schema.Literals<readonly ["form", "json"]>>;
+                readonly grant: Schema.Literal<"client_credentials">;
+                readonly tokenUrl: Schema.String;
+                readonly revocationUrl: Schema.optionalKey<Schema.String>;
+                readonly scopes: Schema.$Array<Schema.String>;
+                readonly type: Schema.Literal<"oauth2">;
+            }>]>>;
+            readonly hosts: Schema.optionalKey<Schema.$Array<Schema.String>>;
+        }>;
+        readonly method: Schema.NonEmptyString;
+        readonly generation: Schema.optionalKey<Schema.Int>;
+        readonly fields: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+    }>, Schema.$Array<Schema.Struct<{
+        readonly managed: Schema.optionalKey<Schema.Literal<true>>;
+        readonly id: Schema.brand<Schema.String, "acc">;
+        readonly provider: Schema.Struct<{
+            readonly name: Schema.NonEmptyString;
+            readonly auth: Schema.$Record<Schema.NonEmptyString, Schema.Union<readonly [Schema.Struct<{
+                readonly plain: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly raw: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly request: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+                    readonly in: Schema.Literal<"header">;
+                    readonly name: Schema.String;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>, Schema.Struct<{
+                    readonly in: Schema.Literal<"query">;
+                    readonly name: Schema.NonEmptyString;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>]>>>;
+                readonly type: Schema.Literal<"secrets">;
+                readonly label: Schema.String;
+                readonly fields: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+            }>, Schema.Struct<{
+                readonly plain: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly raw: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly request: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+                    readonly in: Schema.Literal<"header">;
+                    readonly name: Schema.String;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>, Schema.Struct<{
+                    readonly in: Schema.Literal<"query">;
+                    readonly name: Schema.NonEmptyString;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>]>>>;
+                readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+                readonly discover: Schema.String;
+                readonly authorizationServerMetadataUrl: Schema.optionalKey<Schema.String>;
+                readonly authorizationUrl: Schema.optionalKey<Schema.Never>;
+                readonly tokenUrl: Schema.optionalKey<Schema.Never>;
+                readonly revocationUrl: Schema.optionalKey<Schema.Never>;
+                readonly scopes: Schema.optionalKey<Schema.$Array<Schema.String>>;
+                readonly tokenResponse: Schema.optionalKey<Schema.Struct<{
+                    readonly path: Schema.String;
+                }>>;
+                readonly grant: Schema.optionalKey<Schema.Literal<"authorization_code">>;
+                readonly authorizationParams: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
+                readonly tokenEndpointAuthMethod: Schema.optionalKey<Schema.Literals<readonly ["none", "client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>>;
+                readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+                readonly scopeSeparator: Schema.optionalKey<Schema.String>;
+                readonly tokenRequestFormat: Schema.optionalKey<Schema.Literals<readonly ["form", "json"]>>;
+                readonly type: Schema.Literal<"oauth2">;
+            }>, Schema.Struct<{
+                readonly plain: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly raw: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly request: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+                    readonly in: Schema.Literal<"header">;
+                    readonly name: Schema.String;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>, Schema.Struct<{
+                    readonly in: Schema.Literal<"query">;
+                    readonly name: Schema.NonEmptyString;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>]>>>;
+                readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+                readonly authorizationUrl: Schema.String;
+                readonly tokenUrl: Schema.String;
+                readonly revocationUrl: Schema.optionalKey<Schema.String>;
+                readonly scopes: Schema.$Array<Schema.String>;
+                readonly issuer: Schema.optionalKey<Schema.String>;
+                readonly discover: Schema.optionalKey<Schema.Never>;
+                readonly authorizationServerMetadataUrl: Schema.optionalKey<Schema.Never>;
+                readonly tokenResponse: Schema.optionalKey<Schema.Struct<{
+                    readonly path: Schema.String;
+                }>>;
+                readonly grant: Schema.optionalKey<Schema.Literal<"authorization_code">>;
+                readonly authorizationParams: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
+                readonly tokenEndpointAuthMethod: Schema.optionalKey<Schema.Literals<readonly ["none", "client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>>;
+                readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+                readonly scopeSeparator: Schema.optionalKey<Schema.String>;
+                readonly tokenRequestFormat: Schema.optionalKey<Schema.Literals<readonly ["form", "json"]>>;
+                readonly type: Schema.Literal<"oauth2">;
+            }>, Schema.Struct<{
+                readonly plain: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly raw: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly request: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+                    readonly in: Schema.Literal<"header">;
+                    readonly name: Schema.String;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>, Schema.Struct<{
+                    readonly in: Schema.Literal<"query">;
+                    readonly name: Schema.NonEmptyString;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>]>>>;
+                readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+                readonly tokenEndpointAuthMethod: Schema.Literals<readonly ["client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>;
+                readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+                readonly scopeSeparator: Schema.optionalKey<Schema.String>;
+                readonly tokenRequestFormat: Schema.optionalKey<Schema.Literals<readonly ["form", "json"]>>;
+                readonly grant: Schema.Literal<"client_credentials">;
+                readonly discover: Schema.String;
+                readonly authorizationServerMetadataUrl: Schema.optionalKey<Schema.String>;
+                readonly authorizationUrl: Schema.optionalKey<Schema.Never>;
+                readonly tokenUrl: Schema.optionalKey<Schema.Never>;
+                readonly revocationUrl: Schema.optionalKey<Schema.Never>;
+                readonly scopes: Schema.optionalKey<Schema.$Array<Schema.String>>;
+                readonly type: Schema.Literal<"oauth2">;
+            }>, Schema.Struct<{
+                readonly plain: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly raw: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly request: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+                    readonly in: Schema.Literal<"header">;
+                    readonly name: Schema.String;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>, Schema.Struct<{
+                    readonly in: Schema.Literal<"query">;
+                    readonly name: Schema.NonEmptyString;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>]>>>;
+                readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+                readonly tokenEndpointAuthMethod: Schema.Literals<readonly ["client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>;
+                readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+                readonly authorizationUrl: Schema.optionalKey<Schema.Never>;
+                readonly discover: Schema.optionalKey<Schema.Never>;
+                readonly authorizationServerMetadataUrl: Schema.optionalKey<Schema.Never>;
+                readonly scopeSeparator: Schema.optionalKey<Schema.String>;
+                readonly tokenRequestFormat: Schema.optionalKey<Schema.Literals<readonly ["form", "json"]>>;
+                readonly grant: Schema.Literal<"client_credentials">;
+                readonly tokenUrl: Schema.String;
+                readonly revocationUrl: Schema.optionalKey<Schema.String>;
+                readonly scopes: Schema.$Array<Schema.String>;
+                readonly type: Schema.Literal<"oauth2">;
+            }>]>>;
+            readonly hosts: Schema.optionalKey<Schema.$Array<Schema.String>>;
+        }>;
+        readonly method: Schema.NonEmptyString;
+        readonly generation: Schema.optionalKey<Schema.Int>;
+        readonly fields: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+    }>>]>>;
+    readonly user: Schema.optionalKey<Schema.$Record<Schema.NonEmptyString, Schema.Union<readonly [Schema.Struct<{
+        readonly managed: Schema.optionalKey<Schema.Literal<true>>;
+        readonly id: Schema.brand<Schema.String, "acc">;
+        readonly provider: Schema.Struct<{
+            readonly name: Schema.NonEmptyString;
+            readonly auth: Schema.$Record<Schema.NonEmptyString, Schema.Union<readonly [Schema.Struct<{
+                readonly plain: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly raw: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly request: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+                    readonly in: Schema.Literal<"header">;
+                    readonly name: Schema.String;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>, Schema.Struct<{
+                    readonly in: Schema.Literal<"query">;
+                    readonly name: Schema.NonEmptyString;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>]>>>;
+                readonly type: Schema.Literal<"secrets">;
+                readonly label: Schema.String;
+                readonly fields: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+            }>, Schema.Struct<{
+                readonly plain: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly raw: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly request: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+                    readonly in: Schema.Literal<"header">;
+                    readonly name: Schema.String;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>, Schema.Struct<{
+                    readonly in: Schema.Literal<"query">;
+                    readonly name: Schema.NonEmptyString;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>]>>>;
+                readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+                readonly discover: Schema.String;
+                readonly authorizationServerMetadataUrl: Schema.optionalKey<Schema.String>;
+                readonly authorizationUrl: Schema.optionalKey<Schema.Never>;
+                readonly tokenUrl: Schema.optionalKey<Schema.Never>;
+                readonly revocationUrl: Schema.optionalKey<Schema.Never>;
+                readonly scopes: Schema.optionalKey<Schema.$Array<Schema.String>>;
+                readonly tokenResponse: Schema.optionalKey<Schema.Struct<{
+                    readonly path: Schema.String;
+                }>>;
+                readonly grant: Schema.optionalKey<Schema.Literal<"authorization_code">>;
+                readonly authorizationParams: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
+                readonly tokenEndpointAuthMethod: Schema.optionalKey<Schema.Literals<readonly ["none", "client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>>;
+                readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+                readonly scopeSeparator: Schema.optionalKey<Schema.String>;
+                readonly tokenRequestFormat: Schema.optionalKey<Schema.Literals<readonly ["form", "json"]>>;
+                readonly type: Schema.Literal<"oauth2">;
+            }>, Schema.Struct<{
+                readonly plain: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly raw: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly request: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+                    readonly in: Schema.Literal<"header">;
+                    readonly name: Schema.String;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>, Schema.Struct<{
+                    readonly in: Schema.Literal<"query">;
+                    readonly name: Schema.NonEmptyString;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>]>>>;
+                readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+                readonly authorizationUrl: Schema.String;
+                readonly tokenUrl: Schema.String;
+                readonly revocationUrl: Schema.optionalKey<Schema.String>;
+                readonly scopes: Schema.$Array<Schema.String>;
+                readonly issuer: Schema.optionalKey<Schema.String>;
+                readonly discover: Schema.optionalKey<Schema.Never>;
+                readonly authorizationServerMetadataUrl: Schema.optionalKey<Schema.Never>;
+                readonly tokenResponse: Schema.optionalKey<Schema.Struct<{
+                    readonly path: Schema.String;
+                }>>;
+                readonly grant: Schema.optionalKey<Schema.Literal<"authorization_code">>;
+                readonly authorizationParams: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
+                readonly tokenEndpointAuthMethod: Schema.optionalKey<Schema.Literals<readonly ["none", "client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>>;
+                readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+                readonly scopeSeparator: Schema.optionalKey<Schema.String>;
+                readonly tokenRequestFormat: Schema.optionalKey<Schema.Literals<readonly ["form", "json"]>>;
+                readonly type: Schema.Literal<"oauth2">;
+            }>, Schema.Struct<{
+                readonly plain: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly raw: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly request: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+                    readonly in: Schema.Literal<"header">;
+                    readonly name: Schema.String;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>, Schema.Struct<{
+                    readonly in: Schema.Literal<"query">;
+                    readonly name: Schema.NonEmptyString;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>]>>>;
+                readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+                readonly tokenEndpointAuthMethod: Schema.Literals<readonly ["client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>;
+                readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+                readonly scopeSeparator: Schema.optionalKey<Schema.String>;
+                readonly tokenRequestFormat: Schema.optionalKey<Schema.Literals<readonly ["form", "json"]>>;
+                readonly grant: Schema.Literal<"client_credentials">;
+                readonly discover: Schema.String;
+                readonly authorizationServerMetadataUrl: Schema.optionalKey<Schema.String>;
+                readonly authorizationUrl: Schema.optionalKey<Schema.Never>;
+                readonly tokenUrl: Schema.optionalKey<Schema.Never>;
+                readonly revocationUrl: Schema.optionalKey<Schema.Never>;
+                readonly scopes: Schema.optionalKey<Schema.$Array<Schema.String>>;
+                readonly type: Schema.Literal<"oauth2">;
+            }>, Schema.Struct<{
+                readonly plain: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly raw: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly request: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+                    readonly in: Schema.Literal<"header">;
+                    readonly name: Schema.String;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>, Schema.Struct<{
+                    readonly in: Schema.Literal<"query">;
+                    readonly name: Schema.NonEmptyString;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>]>>>;
+                readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+                readonly tokenEndpointAuthMethod: Schema.Literals<readonly ["client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>;
+                readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+                readonly authorizationUrl: Schema.optionalKey<Schema.Never>;
+                readonly discover: Schema.optionalKey<Schema.Never>;
+                readonly authorizationServerMetadataUrl: Schema.optionalKey<Schema.Never>;
+                readonly scopeSeparator: Schema.optionalKey<Schema.String>;
+                readonly tokenRequestFormat: Schema.optionalKey<Schema.Literals<readonly ["form", "json"]>>;
+                readonly grant: Schema.Literal<"client_credentials">;
+                readonly tokenUrl: Schema.String;
+                readonly revocationUrl: Schema.optionalKey<Schema.String>;
+                readonly scopes: Schema.$Array<Schema.String>;
+                readonly type: Schema.Literal<"oauth2">;
+            }>]>>;
+            readonly hosts: Schema.optionalKey<Schema.$Array<Schema.String>>;
+        }>;
+        readonly method: Schema.NonEmptyString;
+        readonly generation: Schema.optionalKey<Schema.Int>;
+        readonly fields: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+    }>, Schema.$Array<Schema.Struct<{
+        readonly managed: Schema.optionalKey<Schema.Literal<true>>;
+        readonly id: Schema.brand<Schema.String, "acc">;
+        readonly provider: Schema.Struct<{
+            readonly name: Schema.NonEmptyString;
+            readonly auth: Schema.$Record<Schema.NonEmptyString, Schema.Union<readonly [Schema.Struct<{
+                readonly plain: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly raw: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly request: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+                    readonly in: Schema.Literal<"header">;
+                    readonly name: Schema.String;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>, Schema.Struct<{
+                    readonly in: Schema.Literal<"query">;
+                    readonly name: Schema.NonEmptyString;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>]>>>;
+                readonly type: Schema.Literal<"secrets">;
+                readonly label: Schema.String;
+                readonly fields: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+            }>, Schema.Struct<{
+                readonly plain: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly raw: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly request: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+                    readonly in: Schema.Literal<"header">;
+                    readonly name: Schema.String;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>, Schema.Struct<{
+                    readonly in: Schema.Literal<"query">;
+                    readonly name: Schema.NonEmptyString;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>]>>>;
+                readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+                readonly discover: Schema.String;
+                readonly authorizationServerMetadataUrl: Schema.optionalKey<Schema.String>;
+                readonly authorizationUrl: Schema.optionalKey<Schema.Never>;
+                readonly tokenUrl: Schema.optionalKey<Schema.Never>;
+                readonly revocationUrl: Schema.optionalKey<Schema.Never>;
+                readonly scopes: Schema.optionalKey<Schema.$Array<Schema.String>>;
+                readonly tokenResponse: Schema.optionalKey<Schema.Struct<{
+                    readonly path: Schema.String;
+                }>>;
+                readonly grant: Schema.optionalKey<Schema.Literal<"authorization_code">>;
+                readonly authorizationParams: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
+                readonly tokenEndpointAuthMethod: Schema.optionalKey<Schema.Literals<readonly ["none", "client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>>;
+                readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+                readonly scopeSeparator: Schema.optionalKey<Schema.String>;
+                readonly tokenRequestFormat: Schema.optionalKey<Schema.Literals<readonly ["form", "json"]>>;
+                readonly type: Schema.Literal<"oauth2">;
+            }>, Schema.Struct<{
+                readonly plain: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly raw: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly request: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+                    readonly in: Schema.Literal<"header">;
+                    readonly name: Schema.String;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>, Schema.Struct<{
+                    readonly in: Schema.Literal<"query">;
+                    readonly name: Schema.NonEmptyString;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>]>>>;
+                readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+                readonly authorizationUrl: Schema.String;
+                readonly tokenUrl: Schema.String;
+                readonly revocationUrl: Schema.optionalKey<Schema.String>;
+                readonly scopes: Schema.$Array<Schema.String>;
+                readonly issuer: Schema.optionalKey<Schema.String>;
+                readonly discover: Schema.optionalKey<Schema.Never>;
+                readonly authorizationServerMetadataUrl: Schema.optionalKey<Schema.Never>;
+                readonly tokenResponse: Schema.optionalKey<Schema.Struct<{
+                    readonly path: Schema.String;
+                }>>;
+                readonly grant: Schema.optionalKey<Schema.Literal<"authorization_code">>;
+                readonly authorizationParams: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
+                readonly tokenEndpointAuthMethod: Schema.optionalKey<Schema.Literals<readonly ["none", "client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>>;
+                readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+                readonly scopeSeparator: Schema.optionalKey<Schema.String>;
+                readonly tokenRequestFormat: Schema.optionalKey<Schema.Literals<readonly ["form", "json"]>>;
+                readonly type: Schema.Literal<"oauth2">;
+            }>, Schema.Struct<{
+                readonly plain: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly raw: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly request: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+                    readonly in: Schema.Literal<"header">;
+                    readonly name: Schema.String;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>, Schema.Struct<{
+                    readonly in: Schema.Literal<"query">;
+                    readonly name: Schema.NonEmptyString;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>]>>>;
+                readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+                readonly tokenEndpointAuthMethod: Schema.Literals<readonly ["client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>;
+                readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+                readonly scopeSeparator: Schema.optionalKey<Schema.String>;
+                readonly tokenRequestFormat: Schema.optionalKey<Schema.Literals<readonly ["form", "json"]>>;
+                readonly grant: Schema.Literal<"client_credentials">;
+                readonly discover: Schema.String;
+                readonly authorizationServerMetadataUrl: Schema.optionalKey<Schema.String>;
+                readonly authorizationUrl: Schema.optionalKey<Schema.Never>;
+                readonly tokenUrl: Schema.optionalKey<Schema.Never>;
+                readonly revocationUrl: Schema.optionalKey<Schema.Never>;
+                readonly scopes: Schema.optionalKey<Schema.$Array<Schema.String>>;
+                readonly type: Schema.Literal<"oauth2">;
+            }>, Schema.Struct<{
+                readonly plain: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly raw: Schema.optionalKey<Schema.$Array<Schema.NonEmptyString>>;
+                readonly request: Schema.optionalKey<Schema.$Array<Schema.Union<readonly [Schema.Struct<{
+                    readonly in: Schema.Literal<"header">;
+                    readonly name: Schema.String;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>, Schema.Struct<{
+                    readonly in: Schema.Literal<"query">;
+                    readonly name: Schema.NonEmptyString;
+                    readonly value: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                        readonly field: Schema.NonEmptyString;
+                    }>, Schema.Struct<{
+                        readonly base64: Schema.$Array<Schema.Union<readonly [Schema.String, Schema.Struct<{
+                            readonly field: Schema.NonEmptyString;
+                        }>]>>;
+                    }>]>>;
+                }>]>>>;
+                readonly response: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+                readonly tokenEndpointAuthMethod: Schema.Literals<readonly ["client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>;
+                readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+                readonly authorizationUrl: Schema.optionalKey<Schema.Never>;
+                readonly discover: Schema.optionalKey<Schema.Never>;
+                readonly authorizationServerMetadataUrl: Schema.optionalKey<Schema.Never>;
+                readonly scopeSeparator: Schema.optionalKey<Schema.String>;
+                readonly tokenRequestFormat: Schema.optionalKey<Schema.Literals<readonly ["form", "json"]>>;
+                readonly grant: Schema.Literal<"client_credentials">;
+                readonly tokenUrl: Schema.String;
+                readonly revocationUrl: Schema.optionalKey<Schema.String>;
+                readonly scopes: Schema.$Array<Schema.String>;
+                readonly type: Schema.Literal<"oauth2">;
+            }>]>>;
+            readonly hosts: Schema.optionalKey<Schema.$Array<Schema.String>>;
+        }>;
+        readonly method: Schema.NonEmptyString;
+        readonly generation: Schema.optionalKey<Schema.Int>;
+        readonly fields: Schema.$Record<Schema.String, Schema.Codec<Schema.Json, Schema.Json, never, never>>;
+    }>>]>>>;
+}>;
+export type HostAccounts = typeof HostAccounts.Type;
+/** Each requirement's accounts across both scopes; requirement names are unique across them. */
+export declare const scopedSlots: <Slot>(accounts: {
+    readonly app: Readonly<Record<string, Slot>>;
+    readonly user?: Readonly<Record<string, Slot>>;
+}) => ReadonlyArray<readonly [string, Slot]>;
 /** Trusted invocation context, supplied separately from the Request. */
 export interface HostContext {
     /** Trusted host deadline; never accepted in public operation JSON. */
@@ -54,8 +1459,10 @@ export interface HostContext {
     /** Trusted in-process tracing capability; never decoded from a public request. */
     readonly telemetry?: InvocationTelemetry;
     readonly approval?: TrustedToolApproval;
-    readonly storage?: AppStorage;
-    readonly accounts: Redacted.Redacted<ResolvedAccounts>;
+    /** The data facet's SQLite storage, for apps that declare `sql`. Never exposed to app code. */
+    readonly storage?: AppSqlStorage;
+    /** The invocation's accounts as the host resolved them; see `HostAccount`. */
+    readonly accounts: Redacted.Redacted<HostAccounts>;
 }
 /** Skill commands. Send sources only to builds that declare skillSources. */
 export declare const skillsCommand: (sources: boolean) => {
@@ -91,7 +1498,7 @@ export declare const selectTools: (tools?: readonly string[]) => <A extends {
     }[];
 }>(catalog: A) => A;
 /** Declaration reads do not bind accounts or evaluate the app factory. A named declaration
- * problem, such as a reserved database field, is reported so the deploy can explain it. */
+ * problem is reported so the deploy can explain it. */
 export declare const HostRequirementsError: Schema.Union<readonly [typeof HostRequestInvalid, typeof HostDeclarationInvalid, typeof DatabaseFieldReserved]>;
 /** Inspection can fail while binding accounts or evaluating the live definition. */
 export declare const HostInspectError: Schema.Union<readonly [typeof ProviderError, typeof McpError, typeof SkillLoadFailed, typeof HostRequestInvalid, typeof HostDeclarationInvalid, typeof HostAccountsInvalid, typeof HostEvaluationFailed]>;
@@ -109,6 +1516,28 @@ export declare const HostDataError: Schema.Union<readonly [typeof OpenapiRespons
 export declare const ToolResultObservation: Context.Reference<{
     readonly failed: () => void;
 }>;
+/**
+ * One tool invocation's own timing, on the isolate's clock: how long it ran, and how much of that
+ * it waited on upstream providers, waited on elicitation answers and ran the app's authored code.
+ * Each instant counts once, so the rest is Executor's own time. The isolated handler returns it
+ * beside the result so the host can add the other isolates' parts.
+ */
+export declare const InvocationTiming: Schema.Struct<{
+    readonly elapsedMs: Schema.Finite;
+    readonly upstreamMs: Schema.Finite;
+    readonly elicitationMs: Schema.Finite;
+    readonly authoredMs: Schema.Finite;
+    /** Waiting on another call that holds the lease to load a cache entry this call needs. */
+    readonly leaseMs: Schema.optionalKey<Schema.Finite>;
+    /**
+     * How long background work, such as a stale cache entry's refresh, ran within the invocation.
+     * It runs beside the invocation, so it is not part of the division above.
+     */
+    readonly backgroundMs: Schema.optionalKey<Schema.Finite>;
+}>;
+export type InvocationTiming = typeof InvocationTiming.Type;
+/** Receives the invocation's timing once it is over; hosts that do not return it ignore it. */
+export declare const InvocationTimingSink: Context.Reference<(timing: InvocationTiming) => void>;
 /** Native handler; context comes from host authority, never from request content. */
 export type AppHandler = (request: Request, context: HostContext) => Effect.Effect<Response>;
 export { type AppOperation, type OperationContext } from "./operations.js";