@dual-os/sdk 0.0.0-stage → 0.8.0-next.0

package/dist/DualRuntime.js

@@ -0,0 +1,311 @@
+import { __exportAll } from "./_virtual/_rolldown/runtime.js";
+import { BuilderCollisionError } from "./DefinitionError.js";
+import { ActionHandlerError, RetryableActionHandlerError } from "./Action.js";
+import { makeBinding } from "./AuthMethodBinding.js";
+import { decodeSetup, executeJson, prepare, prepareOAuth2Tokens, refreshUnknown, resolve, resolveDecoded } from "./AuthMethodExecution.js";
+import { ConnectionIdNotAllowedError, ConnectionReauthorizationRequiredError, ConnectionRequiredError, ConnectionResolverStoreError, ConnectionSelectionRequiredError, InvalidConnectionIdError, InvalidResolvedConnectionError } from "./ConnectionResolver.js";
+import { indexGroups } from "./internal/handler-context.js";
+import { Service as Service$1, layer } from "./AgentChannelRuntime.js";
+import { RuntimeConfig, registryId } from "./AiProvider.js";
+import { resolveAction } from "./internal/dual/actions.js";
+import { resolveRuntimeTrigger } from "./internal/dual/triggers.js";
+import { TriggerNotFoundError } from "./DualRegistry.js";
+import { authRuntimeContext } from "./internal/auth-execution.js";
+import { ActionHandlerNotFoundError, ActionNotFoundError, FieldIssue, InvalidActionInputError, InvalidActionOutputError, invokeResolvedAction, invokeResolvedActionJson } from "./internal/dual/invoke.js";
+import { activate, deactivate, parse, poll, verify } from "./Trigger.js";
+import "./DualRuntime.js";
+import { Array, Context, Effect, Function, Layer, Predicate, Result, Schema, pipe } from "effect";
+import { Url } from "effect/http";
+//#region src/DualRuntime.ts
+/**
+* Dual action invocation, trigger lifecycle, and auth runtime.
+*
+* @since 0.0.0
+*/
+var DualRuntime_exports = /* @__PURE__ */ __exportAll({
+	ActionHandlerError: () => ActionHandlerError,
+	ActionHandlerNotFoundError: () => ActionHandlerNotFoundError,
+	ActionNotFoundError: () => ActionNotFoundError,
+	AiProviderRuntimeNotConfiguredError: () => AiProviderRuntimeNotConfiguredError,
+	AuthMethodNotFoundError: () => AuthMethodNotFoundError,
+	ConnectionIdNotAllowedError: () => ConnectionIdNotAllowedError,
+	ConnectionReauthorizationRequiredError: () => ConnectionReauthorizationRequiredError,
+	ConnectionRequiredError: () => ConnectionRequiredError,
+	ConnectionResolverStoreError: () => ConnectionResolverStoreError,
+	ConnectionSelectionRequiredError: () => ConnectionSelectionRequiredError,
+	DualRuntime: () => DualRuntime_exports,
+	FieldIssue: () => FieldIssue,
+	InvalidActionInputError: () => InvalidActionInputError,
+	InvalidActionOutputError: () => InvalidActionOutputError,
+	InvalidConnectionIdError: () => InvalidConnectionIdError,
+	InvalidResolvedConnectionError: () => InvalidResolvedConnectionError,
+	RetryableActionHandlerError: () => RetryableActionHandlerError,
+	SandboxAccessNotDeclaredError: () => SandboxAccessNotDeclaredError,
+	SandboxRequestNotAllowedError: () => SandboxRequestNotAllowedError,
+	Service: () => Service,
+	fromPlugin: () => fromPlugin,
+	install: () => install,
+	invoke: () => invoke,
+	make: () => make,
+	toLayer: () => toLayer,
+	withPlugin: () => withPlugin,
+	withPlugins: () => withPlugins
+});
+/**
+* Install one plugin release.
+*
+* @since 0.7.0
+* @category constructors
+*/
+const install = (plugin, version) => ({
+	plugin,
+	version
+});
+/**
+* The runtime of one plugin release, as the plugin's own process runs it. `version` defaults to
+* `0.0.0` for tests that do not need the package version.
+*
+* @since 0.7.0
+* @category constructors
+*/
+const fromPlugin = (plugin, version = "0.0.0") => ({
+	aiProviders: [],
+	identifier: plugin.identifier,
+	layer: plugin.layer,
+	plugins: [install(plugin, version)]
+});
+/**
+* An app runtime without plugins, for {@link withPlugin} and {@link withPlugins} to fill.
+*
+* @since 0.7.0
+* @category constructors
+*/
+const make = (identifier) => ({
+	aiProviders: [],
+	identifier,
+	layer: Layer.empty,
+	plugins: []
+});
+function addPlugins(app, entries) {
+	const seen = new Set(Array.map(app.plugins, (installation) => installation.plugin.identifier));
+	for (const [plugin] of entries) {
+		if (seen.has(plugin.identifier)) throw new BuilderCollisionError({
+			childKind: "plugin",
+			existingChildKind: "plugin",
+			identifier: plugin.identifier,
+			ownerIdentifier: app.identifier,
+			ownerKind: "dual"
+		});
+		seen.add(plugin.identifier);
+	}
+	return {
+		...app,
+		layer: Array.reduce(entries, app.layer, (layer, [plugin]) => Layer.provideMerge(layer, plugin.layer)),
+		plugins: [...app.plugins, ...Array.map(entries, ([plugin, version]) => install(plugin, version))]
+	};
+}
+/**
+* Add one plugin release: the plugin and its package version.
+*
+* @since 0.7.0
+* @category combinators
+*/
+const withPlugin = Function.dual(3, (app, plugin, version) => addPlugins(app, [[plugin, version]]));
+/**
+* Add several plugin releases in one step, which keeps a large app's inferred type compact.
+*
+* @since 0.7.0
+* @category combinators
+*/
+const withPlugins = Function.dual(2, addPlugins);
+const pluginOf = (app, identifier) => app.plugins.find((installation) => installation.plugin.identifier === identifier)?.plugin;
+/**
+* Invoke an action directly in-process.
+*
+* The invocation boundary resolves an action by canonical machine id, validates
+* unknown input against the resolved runtime schema, runs the handler, and
+* returns a standard success envelope. This mirrors the server trusted invoke
+* boundary: runtime schema validation is authoritative.
+*
+* @since 0.0.0
+* @category execution
+*/
+const failInvokeActionNotFound = (actionId) => Effect.fail(new ActionNotFoundError({ actionId }));
+const invokeRaw = (app, request, json = false) => {
+	const resolved = resolveAction(app.plugins, request.actionId, request.actionVersion);
+	if (resolved === void 0 || request.pluginKey !== void 0 && resolved.providerId !== request.pluginKey) return failInvokeActionNotFound(request.actionId);
+	return (json ? invokeResolvedActionJson : invokeResolvedAction)(resolved.providerId, resolved.actionId, resolved.pluginVersion, resolved.action, resolved.authMethods, request);
+};
+const invoke = (app, request) => invokeRaw(app, request).pipe(Effect.provide(app.layer));
+var AuthMethodNotFoundError = class extends Schema.TaggedError()("AuthMethodNotFoundError", {
+	authMethodId: Schema.String,
+	providerId: Schema.String
+}) {};
+var AiProviderRuntimeNotConfiguredError = class extends Schema.TaggedError()("AiProviderRuntimeNotConfiguredError", { providerId: Schema.String }) {};
+/** Raised when a provider declares no sandbox access. */
+var SandboxAccessNotDeclaredError = class extends Schema.TaggedError()("SandboxAccessNotDeclaredError", { providerId: Schema.String }) {};
+/** Raised when the Connection may not be sent with a sandbox request: another origin, or a request the provider refuses. */
+var SandboxRequestNotAllowedError = class extends Schema.TaggedError()("SandboxRequestNotAllowedError", {
+	origin: Schema.String,
+	path: Schema.String,
+	providerId: Schema.String
+}) {};
+/**
+* Effect service provided by {@link toLayer}.
+*
+* @since 0.0.0
+* @category services
+*/
+var Service = class extends Context.Service()("@dual-os/sdk/Dual/Service") {};
+/**
+* Turn an {@link App} into a runtime Effect service layer.
+*
+* @since 0.0.0
+* @category layers
+*/
+const toLayer = (app) => {
+	const fullAuthMethodId = (providerId, method) => `${providerId}/${method.identifier}`;
+	const findAuthMethod = (providerId, authMethodId) => {
+		const method = (pluginOf(app, providerId) ?? app.aiProviders.find((candidate) => registryId(candidate.identifier) === providerId))?.authMethods.find((candidate) => candidate.identifier === authMethodId || fullAuthMethodId(providerId, candidate) === authMethodId);
+		return method === void 0 ? Effect.fail(new AuthMethodNotFoundError({
+			authMethodId,
+			providerId
+		})) : Effect.succeed(method);
+	};
+	return Layer.effect(Service, Effect.gen(function* () {
+		const channels = yield* Service$1;
+		const context = yield* Effect.context();
+		const appContext = indexGroups(context);
+		const provideRuntimeContext = (effect) => effect.pipe(Effect.updateContext((input) => Context.merge(appContext, input)));
+		const runWithCapturedAppContext = (effect) => provideRuntimeContext(effect);
+		const getAuthMethod = (request) => findAuthMethod(request.providerId, request.authMethodId);
+		const getTrigger = (request) => {
+			const resolved = resolveRuntimeTrigger(app.plugins, request.triggerId, request.triggerVersion);
+			return resolved === void 0 || request.pluginKey !== void 0 && resolved.providerId !== request.pluginKey ? Effect.fail(new TriggerNotFoundError({ triggerId: request.triggerId })) : Effect.succeed(resolved);
+		};
+		const triggerLifecycleRequest = (request) => ({
+			config: request.config,
+			...request.state === void 0 ? {} : { state: request.state },
+			...request.connectionId === void 0 ? {} : { connectionId: request.connectionId },
+			...request.context === void 0 ? {} : { context: request.context }
+		});
+		const webhookActivationRequest = (request) => ({
+			...triggerLifecycleRequest(request),
+			webhookUrl: request.webhookUrl
+		});
+		const webhookTriggerLifecycleRequest = (request) => ({
+			...webhookActivationRequest(request),
+			request: Predicate.isString(request.request.rawBody) ? {
+				...request.request,
+				rawBody: new TextEncoder().encode(request.request.rawBody)
+			} : request.request
+		});
+		const activateTrigger = (request) => runWithCapturedAppContext(Effect.gen(function* () {
+			const entry = yield* getTrigger(request);
+			return yield* activate(entry, webhookActivationRequest(request));
+		}));
+		const deactivateTrigger = (request) => runWithCapturedAppContext(Effect.gen(function* () {
+			const entry = yield* getTrigger(request);
+			return yield* deactivate(entry, webhookActivationRequest(request));
+		}));
+		const verifyTrigger = (request) => runWithCapturedAppContext(Effect.gen(function* () {
+			const entry = yield* getTrigger(request);
+			return yield* verify(entry, webhookTriggerLifecycleRequest(request));
+		}));
+		const parseTrigger = (request) => runWithCapturedAppContext(Effect.gen(function* () {
+			const entry = yield* getTrigger(request);
+			return yield* parse(entry, webhookTriggerLifecycleRequest(request));
+		}));
+		const pollTrigger = (request) => runWithCapturedAppContext(Effect.gen(function* () {
+			const entry = yield* getTrigger(request);
+			return yield* poll(entry, triggerLifecycleRequest(request));
+		}));
+		const decodeAuthMethodSetup = (request) => runWithCapturedAppContext(getAuthMethod(request).pipe(Effect.flatMap((method) => {
+			if (request.encoding === "json" && method.setup !== void 0) return Schema.decodeUnknownEffect(Schema.toCodecJson(method.setup))(request.setup);
+			return decodeSetup(method, request.setup);
+		})));
+		const withAuthMethodSetup = (request, execute) => runWithCapturedAppContext(getAuthMethod(request).pipe(Effect.flatMap((method) => decodeSetup(method, request.setup).pipe(Effect.flatMap((setup) => execute(method, setup))))));
+		const prepareAuthMethod = (request) => withAuthMethodSetup(request, (method, setup) => prepare(method, request.input, { setup }));
+		const prepareOAuth2Tokens$1 = (request) => withAuthMethodSetup(request, (method, setup) => prepareOAuth2Tokens(method, request.tokens, { setup }));
+		const refreshAuthMethod = (request) => runWithCapturedAppContext(getAuthMethod(request).pipe(Effect.flatMap((method) => decodeSetup(method, request.setup).pipe(Effect.flatMap((setup) => refreshUnknown(method, request.material, {
+			minValidityMs: request.minValidityMs,
+			now: request.now,
+			reason: request.reason,
+			setup
+		}))))));
+		const resolveAuthMethod = (request) => runWithCapturedAppContext(Effect.gen(function* () {
+			const method = yield* getAuthMethod(request);
+			const setup = yield* decodeAuthMethodSetup(request);
+			const value = request.encoding === "json" ? yield* resolveDecoded(method, yield* Schema.decodeUnknownEffect(Schema.toCodecJson(method.material))(request.material), { setup }) : yield* resolve(method, request.material, { setup });
+			return makeBinding({
+				connectionId: void 0,
+				method,
+				providerId: request.providerId,
+				value
+			});
+		}));
+		const resolveAiModelConfig = (request) => runWithCapturedAppContext(Effect.gen(function* () {
+			const provider = app.aiProviders.find((candidate) => registryId(candidate.identifier) === request.providerId);
+			if (provider?.resolveRuntimeConfig === void 0) return yield* new AiProviderRuntimeNotConfiguredError({ providerId: request.providerId });
+			const binding = yield* resolveAuthMethod(request);
+			const resolveRuntimeConfig = provider.resolveRuntimeConfig;
+			return yield* Schema.decodeUnknownEffect(RuntimeConfig)(resolveRuntimeConfig({
+				binding,
+				model: request.model
+			}));
+		}));
+		const resolveSandboxAccess = (request) => runWithCapturedAppContext(Effect.gen(function* () {
+			const access = pluginOf(app, request.providerId)?.sandboxAccess;
+			if (access === void 0) return yield* new SandboxAccessNotDeclaredError({ providerId: request.providerId });
+			const context = authRuntimeContext(yield* resolveAuthMethod(request));
+			const origins = Array.map(access.origins(context), (origin) => Result.getOrUndefined(Url.fromString(origin))?.origin ?? origin);
+			const authorize = (outgoing) => {
+				const url = Result.getOrUndefined(Url.fromString(outgoing.url));
+				const refused = new SandboxRequestNotAllowedError({
+					origin: url?.origin ?? outgoing.url,
+					path: url?.pathname ?? "",
+					providerId: request.providerId
+				});
+				if (url === void 0 || !origins.includes(url.origin)) return Effect.fail(refused);
+				return Effect.fromOption(access.authorize(outgoing, context), () => refused);
+			};
+			return {
+				authorize,
+				origins
+			};
+		}));
+		return Service.of({
+			activateTrigger,
+			checkAccessAgentChannel: channels.checkAccess,
+			deactivateTrigger,
+			decodeAgentChannelDefinitionSettings: channels.decodeDefinitionSettings,
+			decodeAgentChannelDeploymentSettings: channels.decodeDeploymentSettings,
+			decodeAuthMethodSetup,
+			executeAgentChannel: channels.execute,
+			executeAuthJson: (request) => runWithCapturedAppContext(pipe(getAuthMethod(request), Effect.flatMap((method) => executeJson(method, request)))),
+			getAgentChannel: channels.get,
+			getAuthMethod,
+			invoke: (request) => runWithCapturedAppContext(invokeRaw(app, request)),
+			invokeJson: (request) => runWithCapturedAppContext(Effect.gen(function* () {
+				const result = yield* invokeRaw(app, request, true);
+				return {
+					...result,
+					data: yield* Schema.decodeUnknownEffect(Schema.Json)(result.data)
+				};
+			})),
+			parseTrigger,
+			pollTrigger,
+			prepareAuthMethod,
+			prepareOAuth2Tokens: prepareOAuth2Tokens$1,
+			refreshAuthMethod,
+			resolveAiModelConfig,
+			resolveAuthMethod,
+			resolveSandboxAccess,
+			verifyTrigger
+		});
+	})).pipe(Layer.provide(layer(app.plugins.map((installation) => installation.plugin))), Layer.provide(app.layer));
+};
+//#endregion
+export { ActionHandlerError, ActionHandlerNotFoundError, ActionNotFoundError, AiProviderRuntimeNotConfiguredError, AuthMethodNotFoundError, ConnectionIdNotAllowedError, ConnectionReauthorizationRequiredError, ConnectionRequiredError, ConnectionResolverStoreError, ConnectionSelectionRequiredError, DualRuntime_exports as DualRuntime, DualRuntime_exports, FieldIssue, InvalidActionInputError, InvalidActionOutputError, InvalidConnectionIdError, InvalidResolvedConnectionError, RetryableActionHandlerError, SandboxAccessNotDeclaredError, SandboxRequestNotAllowedError, Service, fromPlugin, install, invoke, make, toLayer, withPlugin, withPlugins };
+
+//# sourceMappingURL=DualRuntime.js.map

package/dist/DualRuntime.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"DualRuntime.js","names":["Func","AiProvider.registryId","AgentChannelRuntime.Service","Trigger.activate","Trigger.deactivate","Trigger.verify","Trigger.parse","Trigger.poll","AuthMethodExecution.decodeSetup","AuthMethodExecution.prepare","prepareOAuth2Tokens","AuthMethodExecution.prepareOAuth2Tokens","AuthMethodExecution.refreshUnknown","AuthMethodExecution.resolveDecoded","AuthMethodExecution.resolve","AuthMethodBinding.makeBinding","AiProvider.RuntimeConfig","AuthMethodExecution.executeJson","AgentChannelRuntime.layer"],"sources":["../src/DualRuntime.ts"],"sourcesContent":["/**\n * Dual action invocation, trigger lifecycle, and auth runtime.\n *\n * @since 0.0.0\n */\nimport {\n  Array,\n  Context,\n  Effect,\n  Function as Func,\n  Layer,\n  Predicate,\n  Result,\n  Schema,\n  pipe,\n} from \"effect\";\n\nimport { type HttpClientRequest, Url } from \"effect/http\";\n\nimport {\n  ActionHandlerError,\n  RetryableActionHandlerError,\n  type ActionHandlerFailure,\n} from \"./Action.ts\";\nimport * as AgentChannelRuntime from \"./AgentChannelRuntime.ts\";\nimport * as AiProvider from \"./AiProvider.ts\";\nimport type * as AuthMethod from \"./AuthMethod.ts\";\nimport * as AuthMethodBinding from \"./AuthMethodBinding.ts\";\nimport * as AuthMethodExecution from \"./AuthMethodExecution.ts\";\nimport {\n  ConnectionIdNotAllowedError,\n  ConnectionReauthorizationRequiredError,\n  ConnectionRequiredError,\n  ConnectionSelectionRequiredError,\n  ConnectionResolverStoreError,\n  InvalidConnectionIdError,\n  InvalidResolvedConnectionError,\n  type ConnectionResolutionContext,\n} from \"./ConnectionResolver.ts\";\nimport { BuilderCollisionError } from \"./DefinitionError.ts\";\nimport { TriggerNotFoundError } from \"./DualRegistry.ts\";\nimport { authRuntimeContext } from \"./internal/auth-execution.ts\";\nimport { resolveAction, type PluginActions } from \"./internal/dual/actions.ts\";\nimport {\n  ActionNotFoundError,\n  FieldIssue,\n  InvalidActionInputError,\n  InvalidActionOutputError,\n  ActionHandlerNotFoundError,\n  type InvokeError,\n  type InvokeMeta,\n  type InvokeRequest,\n  type InvokeRequirementsFor,\n  type InvokeSuccess,\n  type PluginRequirements,\n  invokeResolvedAction,\n  invokeResolvedActionJson,\n} from \"./internal/dual/invoke.ts\";\nimport { resolveRuntimeTrigger } from \"./internal/dual/triggers.ts\";\nimport { indexGroups } from \"./internal/handler-context.ts\";\nimport type * as Plugin from \"./Plugin.ts\";\nimport * as Trigger from \"./Trigger.ts\";\n\n/**\n * One installed plugin release.\n *\n * @since 0.7.0\n * @category models\n */\nexport interface PluginInstallation<P extends Plugin.Any = Plugin.Any> {\n  readonly plugin: P;\n  /** The plugin's package version. */\n  readonly version: string;\n}\n\n/**\n * The plugin releases and AI providers one runtime executes, with the services their handlers need.\n *\n * @since 0.7.0\n * @category models\n */\nexport interface App<\n  out P extends Plugin.Any = Plugin.Any,\n  LayerOutput = never,\n  out LayerError = never,\n  out LayerRequirements = never,\n  out AiProviders extends readonly AiProvider.Any[] = readonly AiProvider.Any[],\n> {\n  readonly identifier: string;\n  readonly aiProviders: AiProviders;\n  readonly plugins: readonly PluginInstallation<P>[];\n  readonly layer: Layer.Layer<LayerOutput, LayerError, LayerRequirements>;\n}\n\n/**\n * Constraint type for working with any {@link App}.\n *\n * @since 0.7.0\n * @category type-level\n */\nexport interface AnyApp extends App<Plugin.Any, never, any, any, readonly AiProvider.Any[]> {}\n\n/**\n * Install one plugin release.\n *\n * @since 0.7.0\n * @category constructors\n */\nexport const install = <P extends Plugin.Any>(\n  plugin: P,\n  version: string,\n): PluginInstallation<P> => ({ plugin, version });\n\n/**\n * The runtime of one plugin release, as the plugin's own process runs it. `version` defaults to\n * `0.0.0` for tests that do not need the package version.\n *\n * @since 0.7.0\n * @category constructors\n */\nexport const fromPlugin = <const P extends Plugin.Any>(\n  plugin: P,\n  version = \"0.0.0\",\n): App<\n  P,\n  Plugin.LayerOutput<readonly [P]>,\n  Plugin.LayerError<readonly [P]>,\n  Plugin.LayerRequirements<readonly [P]>,\n  readonly []\n> =>\n  ({\n    aiProviders: [],\n    identifier: plugin.identifier,\n    layer: plugin.layer,\n    plugins: [install(plugin, version)],\n  }) as never;\n\n/**\n * An app runtime without plugins, for {@link withPlugin} and {@link withPlugins} to fill.\n *\n * @since 0.7.0\n * @category constructors\n */\nexport const make = (identifier: string): App<never, never, never, never, readonly []> => ({\n  aiProviders: [],\n  identifier,\n  layer: Layer.empty,\n  plugins: [],\n});\n\ntype AppPlugin<A extends AnyApp> = A extends App<infer P, any, any, any, any> ? P : never;\ntype AppLayerOutput<A extends AnyApp> =\n  A extends App<any, infer Output, any, any, any> ? Output : never;\ntype AppLayerError<A extends AnyApp> =\n  A extends App<any, any, infer Error, any, any> ? Error : never;\ntype AppLayerRequirements<A extends AnyApp> =\n  A extends App<any, any, any, infer Requirements, any> ? Requirements : never;\n\n/**\n * Result of adding a plugin release to an app runtime. A named interface keeps declaration emit\n * from expanding every plugin and layer member at large call sites.\n *\n * @since 0.7.0\n * @category type-level\n */\nexport interface WithPlugin<Self extends AnyApp, Added extends Plugin.Any> extends App<\n  AppPlugin<Self> | Added,\n  AppLayerOutput<Self> | Plugin.LayerOutput<readonly [Added]>,\n  AppLayerError<Self> | Plugin.LayerError<readonly [Added]>,\n  | Plugin.LayerRequirements<readonly [Added]>\n  | Exclude<AppLayerRequirements<Self>, Plugin.LayerOutput<readonly [Added]>>,\n  Self[\"aiProviders\"]\n  // oxlint-disable-next-line typescript/no-empty-object-type -- TypeScript declaration emit expands a type alias at every app call site (TS7056).\n> {}\n\n// Match the runtime's left-to-right provideMerge fold: later plugins can\n// satisfy earlier requirements, but earlier outputs cannot satisfy later ones.\ntype BulkLayerRequirements<\n  Added extends readonly Plugin.Any[],\n  Requirements,\n> = number extends Added[\"length\"]\n  ? Requirements | Layer.Services<Added[number][\"layer\"]>\n  : Added extends readonly [\n        infer Head extends Plugin.Any,\n        ...infer Tail extends readonly Plugin.Any[],\n      ]\n    ? BulkLayerRequirements<\n        Tail,\n        Layer.Services<Head[\"layer\"]> | Exclude<Requirements, Layer.Success<Head[\"layer\"]>>\n      >\n    : Requirements;\n\n/**\n * Result of adding several plugin releases to an app runtime in one step.\n *\n * @since 0.7.0\n * @category type-level\n */\nexport interface WithPlugins<Self extends AnyApp, Added extends readonly Plugin.Any[]> extends App<\n  AppPlugin<Self> | Added[number],\n  AppLayerOutput<Self> | Layer.Success<Added[number][\"layer\"]>,\n  AppLayerError<Self> | Layer.Error<Added[number][\"layer\"]>,\n  BulkLayerRequirements<Added, AppLayerRequirements<Self>>,\n  Self[\"aiProviders\"]\n  // oxlint-disable-next-line typescript/no-empty-object-type -- TypeScript declaration emit expands a type alias at every app call site (TS7056).\n> {}\n\n/** A plugin and the package version of its release. */\ntype PluginEntry = readonly [plugin: Plugin.Any, version: string];\n\ntype PluginsOf<Entries extends readonly PluginEntry[]> = {\n  readonly [K in keyof Entries]: Entries[K][0];\n};\n\nfunction addPlugins(app: AnyApp, entries: readonly PluginEntry[]): AnyApp {\n  const seen = new Set(Array.map(app.plugins, installation => installation.plugin.identifier));\n  for (const [plugin] of entries) {\n    if (seen.has(plugin.identifier)) {\n      throw new BuilderCollisionError({\n        childKind: \"plugin\",\n        existingChildKind: \"plugin\",\n        identifier: plugin.identifier,\n        ownerIdentifier: app.identifier,\n        ownerKind: \"dual\",\n      });\n    }\n    seen.add(plugin.identifier);\n  }\n  return {\n    ...app,\n    layer: Array.reduce(entries, app.layer, (layer, [plugin]) =>\n      Layer.provideMerge(layer, plugin.layer),\n    ),\n    plugins: [\n      ...app.plugins,\n      ...Array.map(entries, ([plugin, version]) => install(plugin, version)),\n    ],\n  };\n}\n\n/**\n * Add one plugin release: the plugin and its package version.\n *\n * @since 0.7.0\n * @category combinators\n */\nexport const withPlugin: {\n  <const P extends Plugin.Any>(\n    plugin: P,\n    version: string,\n  ): <Self extends AnyApp>(app: Self) => WithPlugin<Self, P>;\n  <Self extends AnyApp, const P extends Plugin.Any>(\n    app: Self,\n    plugin: P,\n    version: string,\n  ): WithPlugin<Self, P>;\n} = Func.dual(3, (app: AnyApp, plugin: Plugin.Any, version: string) =>\n  addPlugins(app, [[plugin, version]]),\n);\n\n/**\n * Add several plugin releases in one step, which keeps a large app's inferred type compact.\n *\n * @since 0.7.0\n * @category combinators\n */\nexport const withPlugins: {\n  <const E extends readonly PluginEntry[]>(\n    entries: E,\n  ): <Self extends AnyApp>(app: Self) => WithPlugins<Self, PluginsOf<E>>;\n  <Self extends AnyApp, const E extends readonly PluginEntry[]>(\n    app: Self,\n    entries: E,\n  ): WithPlugins<Self, PluginsOf<E>>;\n} = Func.dual(2, addPlugins);\n\nconst pluginOf = (app: AnyApp, identifier: string): Plugin.Any | undefined =>\n  app.plugins.find(installation => installation.plugin.identifier === identifier)?.plugin;\n\n/**\n * Request payload accepted by {@link invoke}.\n *\n * @since 0.0.0\n * @category models\n */\nexport type { InvokeRequest };\n\n/**\n * Metadata returned alongside successful invocation data.\n *\n * @since 0.0.0\n * @category models\n */\nexport type { InvokeMeta };\n\n/**\n * Successful invocation envelope returned by {@link invoke}.\n *\n * @since 0.0.0\n * @category models\n */\nexport type { InvokeSuccess };\n\n/**\n * Structured field-level validation issue surfaced by {@link InvalidActionInputError}.\n *\n * @since 0.0.0\n * @category models\n */\nexport { FieldIssue };\n\n/**\n * Raised when an invocation references an unknown action id.\n *\n * @since 0.0.0\n * @category errors\n */\nexport { ActionNotFoundError };\n\n/**\n * @since 0.0.0\n * @category errors\n */\n\n/**\n * Raised when invocation input fails schema validation.\n *\n * @since 0.0.0\n * @category errors\n */\nexport { InvalidActionInputError };\n\n/**\n * Raised when action handler output fails schema validation.\n *\n * @since 0.0.0\n * @category errors\n */\nexport { InvalidActionOutputError };\n\n/**\n * Raised when the runtime action handler service is missing.\n *\n * @since 0.0.0\n * @category errors\n */\nexport { ActionHandlerNotFoundError };\n\n/**\n * Non-retryable failure reported by a trusted action handler.\n *\n * @since 0.0.0\n * @category errors\n */\nexport { ActionHandlerError };\n\n/**\n * Retryable failure reported by a trusted action handler.\n *\n * @since 0.0.0\n * @category errors\n */\nexport { RetryableActionHandlerError };\n\n/**\n * Stable trusted action handler failure contract.\n *\n * @since 0.0.0\n * @category errors\n */\nexport type { ActionHandlerFailure };\n\n/**\n * Raised when an action does not accept a connection but a connectionId was still provided.\n *\n * @since 0.0.0\n * @category errors\n */\nexport { ConnectionIdNotAllowedError };\n\n/**\n * Raised when invocation requires a connection and no compatible binding is available.\n *\n * @since 0.0.0\n * @category errors\n */\nexport { ConnectionRequiredError };\n\n/**\n * Raised when several compatible connection bindings exist and the caller must choose one.\n *\n * @since 0.0.0\n * @category errors\n */\nexport { ConnectionSelectionRequiredError };\n\n/**\n * Raised when the provider refuses a connection's stored grant and the user must sign in again.\n *\n * @since 0.0.0\n * @category errors\n */\nexport { ConnectionReauthorizationRequiredError };\n\n/**\n * Raised when the host connection store is unavailable.\n *\n * @since 0.0.0\n * @category errors\n */\nexport { ConnectionResolverStoreError };\n\n/**\n * Raised when a connectionId does not resolve to a compatible binding.\n *\n * @since 0.0.0\n * @category errors\n */\nexport { InvalidConnectionIdError };\n\n/**\n * Raised when a resolved connection binding does not satisfy its auth method schema.\n *\n * @since 0.0.0\n * @category errors\n */\nexport { InvalidResolvedConnectionError };\n\n/**\n * Structured SDK-owned invocation failures.\n *\n * @since 0.0.0\n * @category errors\n */\nexport type { InvokeError };\nexport type { InvokeRequirementsFor };\n\n/**\n * Invoke an action directly in-process.\n *\n * The invocation boundary resolves an action by canonical machine id, validates\n * unknown input against the resolved runtime schema, runs the handler, and\n * returns a standard success envelope. This mirrors the server trusted invoke\n * boundary: runtime schema validation is authoritative.\n *\n * @since 0.0.0\n * @category execution\n */\nconst failInvokeActionNotFound = (\n  actionId: string,\n): Effect.Effect<InvokeSuccess, ActionNotFoundError> =>\n  Effect.fail(new ActionNotFoundError({ actionId }));\n\nconst invokeRaw = <\n  const P extends Plugin.Any,\n  LayerOutput,\n  LayerError,\n  LayerRequirements,\n  const AiProviders extends readonly AiProvider.Any[],\n>(\n  app: App<P, LayerOutput, LayerError, LayerRequirements, AiProviders>,\n  request: InvokeRequest,\n  json = false,\n): Effect.Effect<InvokeSuccess, InvokeError, RuntimeRequirementsFor<P>> => {\n  const resolved = resolveAction(app.plugins, request.actionId, request.actionVersion);\n\n  if (\n    resolved === undefined ||\n    (request.pluginKey !== undefined && resolved.providerId !== request.pluginKey)\n  ) {\n    return failInvokeActionNotFound(request.actionId);\n  }\n\n  // The runtime entry is resolved from erased plugin trees, so the precise\n  // per-action requirement union in the return annotation cannot be recovered\n  // here; the annotation is the contract, the cast is the boundary.\n  return (json ? invokeResolvedActionJson : invokeResolvedAction)(\n    resolved.providerId,\n    resolved.actionId,\n    resolved.pluginVersion,\n    resolved.action,\n    resolved.authMethods,\n    request,\n  ) as never;\n};\n\nexport const invoke = <\n  const P extends Plugin.Any,\n  LayerOutput,\n  LayerError,\n  LayerRequirements,\n  const AiProviders extends readonly AiProvider.Any[],\n>(\n  app: App<P, LayerOutput, LayerError, LayerRequirements, AiProviders>,\n  request: InvokeRequest,\n): Effect.Effect<\n  InvokeSuccess,\n  InvokeError | LayerError,\n  LayerRequirements | Exclude<RuntimeRequirementsFor<P>, LayerOutput>\n> => invokeRaw(app, request).pipe(Effect.provide(app.layer));\n\n/**\n * Runtime-first invocation request accepted by {@link Service}.\n *\n * @since 0.0.0\n * @category models\n */\nexport type RuntimeInvokeRequest = InvokeRequest;\n\n/**\n * Runtime-first trigger lifecycle request accepted by {@link Service}.\n *\n * @since 0.0.0\n * @category models\n */\nexport interface RuntimeTriggerLifecycleRequest {\n  readonly triggerId: string;\n  readonly pluginKey?: string;\n  /** The exact plugin release the caller pinned; another installed release does not run. */\n  readonly triggerVersion?: string | undefined;\n  readonly config: unknown;\n  readonly state?: unknown | undefined;\n  readonly connectionId?: string | undefined;\n  readonly context?: ConnectionResolutionContext | undefined;\n}\n\nexport interface RuntimeWebhookActivationRequest extends RuntimeTriggerLifecycleRequest {\n  readonly webhookUrl: string;\n}\n\nexport interface RuntimeWebhookTriggerLifecycleRequest extends RuntimeWebhookActivationRequest {\n  readonly request: Trigger.WebhookRequest;\n}\n\nexport interface AuthMethodRequest {\n  readonly providerId: string;\n  readonly authMethodId: string;\n}\n\nexport interface DecodeAuthMethodSetupRequest extends AuthMethodRequest {\n  readonly encoding?: \"json\";\n  readonly setup: unknown;\n}\n\nexport interface PrepareAuthMethodRequest extends AuthMethodRequest {\n  readonly input: unknown;\n  readonly setup: unknown;\n}\n\nexport interface PrepareOAuth2TokensRequest extends AuthMethodRequest {\n  readonly tokens: AuthMethod.OAuth2TokenResponse;\n  readonly setup: unknown;\n}\n\nexport interface RefreshAuthMethodRequest extends AuthMethodRequest {\n  readonly material: unknown;\n  readonly setup: unknown;\n  readonly now: number;\n  readonly minValidityMs: number;\n  readonly reason: AuthMethod.RefreshReason;\n}\n\nexport interface ResolveAuthMethodRequest extends AuthMethodRequest {\n  /** `json` when the material and setup arrive in their canonical JSON encoding, as in the sandbox. */\n  readonly encoding?: \"json\";\n  readonly material: unknown;\n  readonly setup: unknown;\n}\n\nexport interface ResolveAiModelConfigRequest extends ResolveAuthMethodRequest {\n  readonly model: AiProvider.RuntimeModel;\n}\n\nexport class AuthMethodNotFoundError extends Schema.TaggedError<AuthMethodNotFoundError>()(\n  \"AuthMethodNotFoundError\",\n  { authMethodId: Schema.String, providerId: Schema.String },\n) {}\n\nexport type AuthMethodExecutionError =\n  | AuthMethodNotFoundError\n  | Schema.SchemaError\n  | AuthMethod.ExpectedOAuth2MethodError\n  | AuthMethod.OAuth2RefreshTokenUnavailableError\n  | AuthMethod.AuthMethodHookError;\n\nexport class AiProviderRuntimeNotConfiguredError extends Schema.TaggedError<AiProviderRuntimeNotConfiguredError>()(\n  \"AiProviderRuntimeNotConfiguredError\",\n  { providerId: Schema.String },\n) {}\n\nexport type AiModelConfigError = AuthMethodExecutionError | AiProviderRuntimeNotConfiguredError;\n\n/** Raised when a provider declares no sandbox access. */\nexport class SandboxAccessNotDeclaredError extends Schema.TaggedError<SandboxAccessNotDeclaredError>()(\n  \"SandboxAccessNotDeclaredError\",\n  { providerId: Schema.String },\n) {}\n\n/** Raised when the Connection may not be sent with a sandbox request: another origin, or a request the provider refuses. */\nexport class SandboxRequestNotAllowedError extends Schema.TaggedError<SandboxRequestNotAllowedError>()(\n  \"SandboxRequestNotAllowedError\",\n  { origin: Schema.String, path: Schema.String, providerId: Schema.String },\n) {}\n\nexport type SandboxAccessError = AuthMethodExecutionError | SandboxAccessNotDeclaredError;\n\n/** One Connection's sandbox access: where its credential may go, and how a request gets it. */\nexport interface ResolvedSandboxAccess {\n  readonly origins: readonly string[];\n  readonly authorize: (\n    request: HttpClientRequest.HttpClientRequest,\n  ) => Effect.Effect<HttpClientRequest.HttpClientRequest, SandboxRequestNotAllowedError>;\n}\n\n/**\n * Runtime service materialized from an {@link App}.\n *\n * @since 0.0.0\n * @category services\n */\nexport interface RuntimeService {\n  readonly executeAuthJson: (\n    request: AuthMethodExecution.JsonRequest,\n  ) => Effect.Effect<unknown, AuthMethodExecutionError>;\n  readonly invokeJson: (\n    request: RuntimeInvokeRequest,\n  ) => Effect.Effect<InvokeSuccess<string, Schema.Json>, InvokeError | Schema.SchemaError>;\n  readonly decodeAgentChannelDefinitionSettings: AgentChannelRuntime.Interface[\"decodeDefinitionSettings\"];\n  readonly decodeAgentChannelDeploymentSettings: AgentChannelRuntime.Interface[\"decodeDeploymentSettings\"];\n  readonly getAgentChannel: AgentChannelRuntime.Interface[\"get\"];\n  readonly checkAccessAgentChannel: AgentChannelRuntime.Interface[\"checkAccess\"];\n  readonly executeAgentChannel: AgentChannelRuntime.Interface[\"execute\"];\n  readonly invoke: (request: RuntimeInvokeRequest) => Effect.Effect<InvokeSuccess, InvokeError>;\n  readonly activateTrigger: (\n    request: RuntimeWebhookActivationRequest,\n  ) => Effect.Effect<Trigger.ActivateSuccess, unknown>;\n  readonly deactivateTrigger: (\n    request: RuntimeWebhookActivationRequest,\n  ) => Effect.Effect<Trigger.DeactivateSuccess, unknown>;\n  readonly verifyTrigger: (\n    request: RuntimeWebhookTriggerLifecycleRequest,\n  ) => Effect.Effect<Trigger.VerifySuccess, unknown>;\n  readonly parseTrigger: (\n    request: RuntimeWebhookTriggerLifecycleRequest,\n  ) => Effect.Effect<Trigger.EmittedEventsSuccess<string, \"parse\">, unknown>;\n  readonly pollTrigger: (\n    request: RuntimeTriggerLifecycleRequest,\n  ) => Effect.Effect<Trigger.EmittedEventsSuccess<string, \"poll\">, unknown>;\n  readonly getAuthMethod: (\n    request: AuthMethodRequest,\n  ) => Effect.Effect<AuthMethod.Any, AuthMethodNotFoundError>;\n  // TODO(live-schema-validation): expose live action/trigger schema decoders by capability version.\n  // Server authoring/runtime must validate against SDK declarations, not JSON Schema projections.\n  readonly decodeAuthMethodSetup: (\n    request: DecodeAuthMethodSetupRequest,\n  ) => Effect.Effect<unknown, AuthMethodExecutionError>;\n  readonly prepareAuthMethod: (\n    request: PrepareAuthMethodRequest,\n  ) => Effect.Effect<unknown, AuthMethodExecutionError>;\n  readonly prepareOAuth2Tokens: (\n    request: PrepareOAuth2TokensRequest,\n  ) => Effect.Effect<unknown, AuthMethodExecutionError>;\n  readonly refreshAuthMethod: (\n    request: RefreshAuthMethodRequest,\n  ) => Effect.Effect<unknown | undefined, AuthMethodExecutionError>;\n  readonly resolveAuthMethod: (\n    request: ResolveAuthMethodRequest,\n  ) => Effect.Effect<AuthMethodBinding.Binding, AuthMethodExecutionError>;\n  readonly resolveAiModelConfig: (\n    request: ResolveAiModelConfigRequest,\n  ) => Effect.Effect<AiProvider.RuntimeConfig, AiModelConfigError>;\n  readonly resolveSandboxAccess: (\n    request: ResolveAuthMethodRequest,\n  ) => Effect.Effect<ResolvedSandboxAccess, SandboxAccessError>;\n}\n\n/**\n * Effect service provided by {@link toLayer}.\n *\n * @since 0.0.0\n * @category services\n */\nexport class Service extends Context.Service<Service, RuntimeService>()(\n  \"@dual-os/sdk/Dual/Service\",\n) {}\n\nexport type RuntimeRequirementsFor<P extends Plugin.Any> =\n  | AgentChannelRuntime.Requirements<P>\n  | (P extends Plugin.Any ? PluginRequirements<P, PluginActions<P>> : never);\n\ntype AuthProvider = Plugin.Any | AiProvider.Any;\n\ntype AuthMethodFor<Providers extends AuthProvider> = Providers[\"authMethods\"][number];\n\ntype AuthMethodSetupDecodeRequirements<Method extends AuthMethod.Any> =\n  AuthMethod.SetupSchema<Method> extends Schema.Top\n    ? Schema.Codec.DecodingServices<AuthMethod.SetupSchema<Method>>\n    : never;\n\ntype AuthMethodInputDecodeRequirements<Method extends AuthMethod.Any> =\n  AuthMethod.InputSchema<Method> extends Schema.Top\n    ? Schema.Codec.DecodingServices<AuthMethod.InputSchema<Method>>\n    : never;\n\ntype AuthMethodExecutionRequirementsFor<Providers extends AuthProvider> =\n  AuthMethodFor<Providers> extends infer Method\n    ? Method extends AuthMethod.Any\n      ?\n          | AuthMethod.Requirements<Method>\n          | AuthMethodSetupDecodeRequirements<Method>\n          | AuthMethodInputDecodeRequirements<Method>\n          | Schema.Codec.DecodingServices<AuthMethod.MaterialSchema<Method>>\n          | Schema.Codec.DecodingServices<AuthMethod.ValueSchema<Method>>\n          | Schema.Codec.EncodingServices<AuthMethod.MaterialSchema<Method>>\n          | Schema.Codec.EncodingServices<AuthMethod.ValueSchema<Method>>\n          | (AuthMethod.SetupSchema<Method> extends Schema.Top\n              ? Schema.Codec.EncodingServices<AuthMethod.SetupSchema<Method>>\n              : never)\n      : never\n    : never;\n\n/**\n * Requirements still needed by {@link toLayer} for an app.\n *\n * Hosts (the server, a worker, a test harness) never know an app's concrete\n * implementations: they talk to it exclusively through the generic\n * {@link Service} layer. App-specific dependencies — a plugin's API client, an\n * auth hook's token service — are discharged where they are known, at the\n * plugin or app definition (the `Exclude<..., LayerOutput>` below cancels\n * them). Only what the definition did not discharge surfaces here,\n * generically, and the host entrypoint forces it to `never` before anything\n * runs.\n *\n * @since 0.0.0\n * @category type-level\n */\nexport type ToLayerRequirements<A extends AnyApp> =\n  A extends App<\n    infer P extends Plugin.Any,\n    infer LayerOutput,\n    any,\n    infer LayerRequirements,\n    infer AiProviders extends readonly AiProvider.Any[]\n  >\n    ?\n        | LayerRequirements\n        | Exclude<RuntimeRequirementsFor<P>, LayerOutput>\n        | Exclude<AuthMethodExecutionRequirementsFor<P | AiProviders[number]>, LayerOutput>\n    : never;\n\n/**\n * Layer-construction errors surfaced by {@link toLayer} for an app.\n *\n * @since 0.0.0\n * @category type-level\n */\nexport type ToLayerError<A extends AnyApp> =\n  A extends App<any, any, infer LayerError, any, any> ? LayerError : never;\n\n/**\n * Turn an {@link App} into a runtime Effect service layer.\n *\n * @since 0.0.0\n * @category layers\n */\nexport const toLayer = <\n  const P extends Plugin.Any,\n  LayerOutput,\n  LayerError,\n  LayerRequirements,\n  const AiProviders extends readonly AiProvider.Any[],\n>(\n  app: App<P, LayerOutput, LayerError, LayerRequirements, AiProviders>,\n): Layer.Layer<\n  Service,\n  LayerError,\n  | LayerRequirements\n  | Exclude<RuntimeRequirementsFor<P>, LayerOutput>\n  | Exclude<AuthMethodExecutionRequirementsFor<P | AiProviders[number]>, LayerOutput>\n> => {\n  const fullAuthMethodId = (providerId: string, method: AuthMethod.Any): string =>\n    `${providerId}/${method.identifier}`;\n\n  const findAuthMethod = (\n    providerId: string,\n    authMethodId: string,\n  ): Effect.Effect<AuthMethod.Any, AuthMethodNotFoundError> => {\n    const provider =\n      pluginOf(app, providerId) ??\n      app.aiProviders.find(candidate => AiProvider.registryId(candidate.identifier) === providerId);\n    const method = provider?.authMethods.find(\n      candidate =>\n        candidate.identifier === authMethodId ||\n        fullAuthMethodId(providerId, candidate) === authMethodId,\n    );\n\n    return method === undefined\n      ? Effect.fail(new AuthMethodNotFoundError({ authMethodId, providerId }))\n      : Effect.succeed(method);\n  };\n\n  const serviceLayer = Layer.effect(\n    Service,\n    Effect.gen(function* () {\n      const channels = yield* AgentChannelRuntime.Service;\n      const context = yield* Effect.context<\n        RuntimeRequirementsFor<P> | AuthMethodExecutionRequirementsFor<P | AiProviders[number]>\n      >();\n\n      const appContext = indexGroups(context);\n\n      const provideRuntimeContext = <A, E, R>(effect: Effect.Effect<A, E, R>) =>\n        effect.pipe(Effect.updateContext(input => Context.merge(appContext, input)));\n\n      // Requirements are satisfied by the context captured at layer build time;\n      // the cast erases them so service methods expose closed effects.\n      const runWithCapturedAppContext = <A, E>(\n        effect: Effect.Effect<A, E, unknown>,\n      ): Effect.Effect<A, E> => provideRuntimeContext(effect) as never;\n\n      const getAuthMethod = (request: AuthMethodRequest) =>\n        findAuthMethod(request.providerId, request.authMethodId);\n\n      const getTrigger = (request: RuntimeTriggerLifecycleRequest) => {\n        const resolved = resolveRuntimeTrigger(\n          app.plugins,\n          request.triggerId,\n          request.triggerVersion,\n        );\n        return resolved === undefined ||\n          (request.pluginKey !== undefined && resolved.providerId !== request.pluginKey)\n          ? Effect.fail(new TriggerNotFoundError({ triggerId: request.triggerId }))\n          : Effect.succeed(resolved);\n      };\n\n      const triggerLifecycleRequest = (\n        request: RuntimeTriggerLifecycleRequest,\n      ): Trigger.LifecycleRequest => ({\n        config: request.config,\n        ...(request.state === undefined ? {} : { state: request.state }),\n        ...(request.connectionId === undefined ? {} : { connectionId: request.connectionId }),\n        ...(request.context === undefined ? {} : { context: request.context }),\n      });\n\n      const webhookActivationRequest = (\n        request: RuntimeWebhookActivationRequest,\n      ): Trigger.WebhookActivationRequest => ({\n        ...triggerLifecycleRequest(request),\n        webhookUrl: request.webhookUrl,\n      });\n\n      // A host can pass the raw body as text; handlers verify signatures over its bytes.\n      const webhookTriggerLifecycleRequest = (\n        request: RuntimeWebhookTriggerLifecycleRequest,\n      ): Trigger.WebhookExecutionRequest => ({\n        ...webhookActivationRequest(request),\n        request: Predicate.isString(request.request.rawBody)\n          ? { ...request.request, rawBody: new TextEncoder().encode(request.request.rawBody) }\n          : request.request,\n      });\n\n      const activateTrigger = (request: RuntimeWebhookActivationRequest) =>\n        runWithCapturedAppContext(\n          Effect.gen(function* () {\n            const entry = yield* getTrigger(request);\n            return yield* Trigger.activate(entry, webhookActivationRequest(request));\n          }),\n        );\n\n      const deactivateTrigger = (request: RuntimeWebhookActivationRequest) =>\n        runWithCapturedAppContext(\n          Effect.gen(function* () {\n            const entry = yield* getTrigger(request);\n            return yield* Trigger.deactivate(entry, webhookActivationRequest(request));\n          }),\n        );\n\n      const verifyTrigger = (request: RuntimeWebhookTriggerLifecycleRequest) =>\n        runWithCapturedAppContext(\n          Effect.gen(function* () {\n            const entry = yield* getTrigger(request);\n            return yield* Trigger.verify(entry, webhookTriggerLifecycleRequest(request));\n          }),\n        );\n\n      const parseTrigger = (request: RuntimeWebhookTriggerLifecycleRequest) =>\n        runWithCapturedAppContext(\n          Effect.gen(function* () {\n            const entry = yield* getTrigger(request);\n            return yield* Trigger.parse(entry, webhookTriggerLifecycleRequest(request));\n          }),\n        );\n\n      const pollTrigger = (request: RuntimeTriggerLifecycleRequest) =>\n        runWithCapturedAppContext(\n          Effect.gen(function* () {\n            const entry = yield* getTrigger(request);\n            return yield* Trigger.poll(entry, triggerLifecycleRequest(request));\n          }),\n        );\n\n      const decodeAuthMethodSetup = (request: DecodeAuthMethodSetupRequest) =>\n        runWithCapturedAppContext(\n          getAuthMethod(request).pipe(\n            Effect.flatMap(method => {\n              if (request.encoding === \"json\" && method.setup !== undefined) {\n                return Schema.decodeUnknownEffect(Schema.toCodecJson(method.setup))(request.setup);\n              }\n              return AuthMethodExecution.decodeSetup(method, request.setup);\n            }),\n          ),\n        );\n\n      const withAuthMethodSetup = <A, E, R>(\n        request: DecodeAuthMethodSetupRequest,\n        execute: (\n          method: AuthMethod.Any,\n          setup: AuthMethod.Setup<AuthMethod.Any>,\n        ) => Effect.Effect<A, E, R>,\n      ) =>\n        runWithCapturedAppContext(\n          getAuthMethod(request).pipe(\n            Effect.flatMap(method =>\n              AuthMethodExecution.decodeSetup(method, request.setup).pipe(\n                Effect.flatMap(setup => execute(method, setup)),\n              ),\n            ),\n          ),\n        );\n\n      const prepareAuthMethod = (request: PrepareAuthMethodRequest) =>\n        withAuthMethodSetup(request, (method, setup) =>\n          AuthMethodExecution.prepare(method, request.input, { setup }),\n        );\n\n      const prepareOAuth2Tokens = (request: PrepareOAuth2TokensRequest) =>\n        withAuthMethodSetup(request, (method, setup) =>\n          AuthMethodExecution.prepareOAuth2Tokens(method, request.tokens, { setup }),\n        );\n\n      const refreshAuthMethod = (request: RefreshAuthMethodRequest) =>\n        runWithCapturedAppContext(\n          getAuthMethod(request).pipe(\n            Effect.flatMap(method =>\n              AuthMethodExecution.decodeSetup(method, request.setup).pipe(\n                Effect.flatMap(setup =>\n                  AuthMethodExecution.refreshUnknown(method, request.material, {\n                    minValidityMs: request.minValidityMs,\n                    now: request.now,\n                    reason: request.reason,\n                    setup,\n                  }),\n                ),\n              ),\n            ),\n          ),\n        );\n\n      const resolveAuthMethod = (request: ResolveAuthMethodRequest) =>\n        runWithCapturedAppContext(\n          Effect.gen(function* () {\n            const method = yield* getAuthMethod(request);\n            const setup = yield* decodeAuthMethodSetup(request);\n            const value =\n              request.encoding === \"json\"\n                ? yield* AuthMethodExecution.resolveDecoded(\n                    method,\n                    yield* Schema.decodeUnknownEffect(Schema.toCodecJson(method.material))(\n                      request.material,\n                    ),\n                    { setup },\n                  )\n                : yield* AuthMethodExecution.resolve(method, request.material, { setup });\n            return AuthMethodBinding.makeBinding({\n              connectionId: undefined,\n              method,\n              providerId: request.providerId,\n              value,\n            });\n          }),\n        );\n\n      const resolveAiModelConfig = (request: ResolveAiModelConfigRequest) =>\n        runWithCapturedAppContext(\n          Effect.gen(function* () {\n            const provider = app.aiProviders.find(\n              candidate => AiProvider.registryId(candidate.identifier) === request.providerId,\n            );\n            if (provider?.resolveRuntimeConfig === undefined) {\n              return yield* new AiProviderRuntimeNotConfiguredError({\n                providerId: request.providerId,\n              });\n            }\n            const binding = yield* resolveAuthMethod(request);\n            // SAFETY: the resolver belongs to this provider and the binding was\n            // resolved from the same provider's declared auth-method list.\n            const resolveRuntimeConfig =\n              provider.resolveRuntimeConfig as AiProvider.RuntimeConfigResolver<\n                readonly AuthMethod.Any[]\n              >;\n            return yield* Schema.decodeUnknownEffect(AiProvider.RuntimeConfig)(\n              resolveRuntimeConfig({ binding, model: request.model }),\n            );\n          }),\n        );\n\n      const resolveSandboxAccess = (request: ResolveAuthMethodRequest) =>\n        runWithCapturedAppContext(\n          Effect.gen(function* () {\n            const access = pluginOf(app, request.providerId)?.sandboxAccess;\n            if (access === undefined) {\n              return yield* new SandboxAccessNotDeclaredError({ providerId: request.providerId });\n            }\n            const context = authRuntimeContext(yield* resolveAuthMethod(request));\n            // Declared origins compare as URL origins, so `https://GHES.example:443` matches requests.\n            const origins = Array.map(\n              access.origins(context),\n              origin => Result.getOrUndefined(Url.fromString(origin))?.origin ?? origin,\n            );\n            const authorize = (outgoing: HttpClientRequest.HttpClientRequest) => {\n              const url = Result.getOrUndefined(Url.fromString(outgoing.url));\n              const refused = new SandboxRequestNotAllowedError({\n                origin: url?.origin ?? outgoing.url,\n                path: url?.pathname ?? \"\",\n                providerId: request.providerId,\n              });\n              if (url === undefined || !origins.includes(url.origin)) return Effect.fail(refused);\n              return Effect.fromOption(access.authorize(outgoing, context), () => refused);\n            };\n            return { authorize, origins } satisfies ResolvedSandboxAccess;\n          }),\n        );\n\n      return Service.of({\n        activateTrigger,\n        checkAccessAgentChannel: channels.checkAccess,\n        deactivateTrigger,\n        decodeAgentChannelDefinitionSettings: channels.decodeDefinitionSettings,\n        decodeAgentChannelDeploymentSettings: channels.decodeDeploymentSettings,\n        decodeAuthMethodSetup,\n        executeAgentChannel: channels.execute,\n        executeAuthJson: request =>\n          runWithCapturedAppContext(\n            pipe(\n              getAuthMethod(request),\n              Effect.flatMap(method => AuthMethodExecution.executeJson(method, request)),\n            ),\n          ),\n        getAgentChannel: channels.get,\n        getAuthMethod,\n        invoke: request => runWithCapturedAppContext(invokeRaw(app, request)),\n        invokeJson: request =>\n          runWithCapturedAppContext(\n            Effect.gen(function* () {\n              const result = yield* invokeRaw(app, request, true);\n              return {\n                ...result,\n                data: yield* Schema.decodeUnknownEffect(Schema.Json)(result.data),\n              };\n            }),\n          ),\n        parseTrigger,\n        pollTrigger,\n        prepareAuthMethod,\n        prepareOAuth2Tokens,\n        refreshAuthMethod,\n        resolveAiModelConfig,\n        resolveAuthMethod,\n        resolveSandboxAccess,\n        verifyTrigger,\n      });\n    }),\n  );\n\n  return serviceLayer.pipe(\n    Layer.provide(AgentChannelRuntime.layer(app.plugins.map(installation => installation.plugin))),\n    Layer.provide(app.layer),\n  );\n};\n\nexport * as DualRuntime from \"./DualRuntime.ts\";\n"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AA4GA,MAAa,WACX,QACA,aAC2B;CAAE;CAAQ;AAAQ;;;;;;;;AAS/C,MAAa,cACX,QACA,UAAU,aAQT;CACC,aAAa,CAAC;CACd,YAAY,OAAO;CACnB,OAAO,OAAO;CACd,SAAS,CAAC,QAAQ,QAAQ,OAAO,CAAC;AACpC;;;;;;;AAQF,MAAa,QAAQ,gBAAsE;CACzF,aAAa,CAAC;CACd;CACA,OAAO,MAAM;CACb,SAAS,CAAC;AACZ;AAkEA,SAAS,WAAW,KAAa,SAAyC;CACxE,MAAM,OAAO,IAAI,IAAI,MAAM,IAAI,IAAI,UAAS,iBAAgB,aAAa,OAAO,UAAU,CAAC;CAC3F,KAAK,MAAM,CAAC,WAAW,SAAS;EAC9B,IAAI,KAAK,IAAI,OAAO,UAAU,GAC5B,MAAM,IAAI,sBAAsB;GAC9B,WAAW;GACX,mBAAmB;GACnB,YAAY,OAAO;GACnB,iBAAiB,IAAI;GACrB,WAAW;EACb,CAAC;EAEH,KAAK,IAAI,OAAO,UAAU;CAC5B;CACA,OAAO;EACL,GAAG;EACH,OAAO,MAAM,OAAO,SAAS,IAAI,QAAQ,OAAO,CAAC,YAC/C,MAAM,aAAa,OAAO,OAAO,KAAK,CACxC;EACA,SAAS,CACP,GAAG,IAAI,SACP,GAAG,MAAM,IAAI,UAAU,CAAC,QAAQ,aAAa,QAAQ,QAAQ,OAAO,CAAC,CACvE;CACF;AACF;;;;;;;AAQA,MAAa,aAUTA,SAAK,KAAK,IAAI,KAAa,QAAoB,YACjD,WAAW,KAAK,CAAC,CAAC,QAAQ,OAAO,CAAC,CAAC,CACrC;;;;;;;AAQA,MAAa,cAQTA,SAAK,KAAK,GAAG,UAAU;AAE3B,MAAM,YAAY,KAAa,eAC7B,IAAI,QAAQ,MAAK,iBAAgB,aAAa,OAAO,eAAe,UAAU,CAAC,EAAE;;;;;;;;;;;;AA2KnF,MAAM,4BACJ,aAEA,OAAO,KAAK,IAAI,oBAAoB,EAAE,SAAS,CAAC,CAAC;AAEnD,MAAM,aAOJ,KACA,SACA,OAAO,UACkE;CACzE,MAAM,WAAW,cAAc,IAAI,SAAS,QAAQ,UAAU,QAAQ,aAAa;CAEnF,IACE,aAAa,KAAA,KACZ,QAAQ,cAAc,KAAA,KAAa,SAAS,eAAe,QAAQ,WAEpE,OAAO,yBAAyB,QAAQ,QAAQ;CAMlD,QAAQ,OAAO,2BAA2B,qBAAA,CACxC,SAAS,YACT,SAAS,UACT,SAAS,eACT,SAAS,QACT,SAAS,aACT,OACF;AACF;AAEA,MAAa,UAOX,KACA,YAKG,UAAU,KAAK,OAAO,CAAC,CAAC,KAAK,OAAO,QAAQ,IAAI,KAAK,CAAC;AA0E3D,IAAa,0BAAb,cAA6C,OAAO,YAAqC,CAAC,CACxF,2BACA;CAAE,cAAc,OAAO;CAAQ,YAAY,OAAO;AAAO,CAC3D,CAAC,CAAC,CAAC;AASH,IAAa,sCAAb,cAAyD,OAAO,YAAiD,CAAC,CAChH,uCACA,EAAE,YAAY,OAAO,OAAO,CAC9B,CAAC,CAAC,CAAC;;AAKH,IAAa,gCAAb,cAAmD,OAAO,YAA2C,CAAC,CACpG,iCACA,EAAE,YAAY,OAAO,OAAO,CAC9B,CAAC,CAAC,CAAC;;AAGH,IAAa,gCAAb,cAAmD,OAAO,YAA2C,CAAC,CACpG,iCACA;CAAE,QAAQ,OAAO;CAAQ,MAAM,OAAO;CAAQ,YAAY,OAAO;AAAO,CAC1E,CAAC,CAAC,CAAC;;;;;;;AAgFH,IAAa,UAAb,cAA6B,QAAQ,QAAiC,CAAC,CACrE,2BACF,CAAC,CAAC,CAAC;;;;;;;AAiFH,MAAa,WAOX,QAOG;CACH,MAAM,oBAAoB,YAAoB,WAC5C,GAAG,WAAW,GAAG,OAAO;CAE1B,MAAM,kBACJ,YACA,iBAC2D;EAI3D,MAAM,UAFJ,SAAS,KAAK,UAAU,KACxB,IAAI,YAAY,MAAK,cAAaC,WAAsB,UAAU,UAAU,MAAM,UAAU,EAAA,EACrE,YAAY,MACnC,cACE,UAAU,eAAe,gBACzB,iBAAiB,YAAY,SAAS,MAAM,YAChD;EAEA,OAAO,WAAW,KAAA,IACd,OAAO,KAAK,IAAI,wBAAwB;GAAE;GAAc;EAAW,CAAC,CAAC,IACrE,OAAO,QAAQ,MAAM;CAC3B;CAmRA,OAjRqB,MAAM,OACzB,SACA,OAAO,IAAI,aAAa;EACtB,MAAM,WAAW,OAAOC;EACxB,MAAM,UAAU,OAAO,OAAO,QAE5B;EAEF,MAAM,aAAa,YAAY,OAAO;EAEtC,MAAM,yBAAkC,WACtC,OAAO,KAAK,OAAO,eAAc,UAAS,QAAQ,MAAM,YAAY,KAAK,CAAC,CAAC;EAI7E,MAAM,6BACJ,WACwB,sBAAsB,MAAM;EAEtD,MAAM,iBAAiB,YACrB,eAAe,QAAQ,YAAY,QAAQ,YAAY;EAEzD,MAAM,cAAc,YAA4C;GAC9D,MAAM,WAAW,sBACf,IAAI,SACJ,QAAQ,WACR,QAAQ,cACV;GACA,OAAO,aAAa,KAAA,KACjB,QAAQ,cAAc,KAAA,KAAa,SAAS,eAAe,QAAQ,YAClE,OAAO,KAAK,IAAI,qBAAqB,EAAE,WAAW,QAAQ,UAAU,CAAC,CAAC,IACtE,OAAO,QAAQ,QAAQ;EAC7B;EAEA,MAAM,2BACJ,aAC8B;GAC9B,QAAQ,QAAQ;GAChB,GAAI,QAAQ,UAAU,KAAA,IAAY,CAAC,IAAI,EAAE,OAAO,QAAQ,MAAM;GAC9D,GAAI,QAAQ,iBAAiB,KAAA,IAAY,CAAC,IAAI,EAAE,cAAc,QAAQ,aAAa;GACnF,GAAI,QAAQ,YAAY,KAAA,IAAY,CAAC,IAAI,EAAE,SAAS,QAAQ,QAAQ;EACtE;EAEA,MAAM,4BACJ,aACsC;GACtC,GAAG,wBAAwB,OAAO;GAClC,YAAY,QAAQ;EACtB;EAGA,MAAM,kCACJ,aACqC;GACrC,GAAG,yBAAyB,OAAO;GACnC,SAAS,UAAU,SAAS,QAAQ,QAAQ,OAAO,IAC/C;IAAE,GAAG,QAAQ;IAAS,SAAS,IAAI,YAAY,CAAC,CAAC,OAAO,QAAQ,QAAQ,OAAO;GAAE,IACjF,QAAQ;EACd;EAEA,MAAM,mBAAmB,YACvB,0BACE,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,OAAO,WAAW,OAAO;GACvC,OAAO,OAAOC,SAAiB,OAAO,yBAAyB,OAAO,CAAC;EACzE,CAAC,CACH;EAEF,MAAM,qBAAqB,YACzB,0BACE,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,OAAO,WAAW,OAAO;GACvC,OAAO,OAAOC,WAAmB,OAAO,yBAAyB,OAAO,CAAC;EAC3E,CAAC,CACH;EAEF,MAAM,iBAAiB,YACrB,0BACE,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,OAAO,WAAW,OAAO;GACvC,OAAO,OAAOC,OAAe,OAAO,+BAA+B,OAAO,CAAC;EAC7E,CAAC,CACH;EAEF,MAAM,gBAAgB,YACpB,0BACE,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,OAAO,WAAW,OAAO;GACvC,OAAO,OAAOC,MAAc,OAAO,+BAA+B,OAAO,CAAC;EAC5E,CAAC,CACH;EAEF,MAAM,eAAe,YACnB,0BACE,OAAO,IAAI,aAAa;GACtB,MAAM,QAAQ,OAAO,WAAW,OAAO;GACvC,OAAO,OAAOC,KAAa,OAAO,wBAAwB,OAAO,CAAC;EACpE,CAAC,CACH;EAEF,MAAM,yBAAyB,YAC7B,0BACE,cAAc,OAAO,CAAC,CAAC,KACrB,OAAO,SAAQ,WAAU;GACvB,IAAI,QAAQ,aAAa,UAAU,OAAO,UAAU,KAAA,GAClD,OAAO,OAAO,oBAAoB,OAAO,YAAY,OAAO,KAAK,CAAC,CAAC,CAAC,QAAQ,KAAK;GAEnF,OAAOC,YAAgC,QAAQ,QAAQ,KAAK;EAC9D,CAAC,CACH,CACF;EAEF,MAAM,uBACJ,SACA,YAKA,0BACE,cAAc,OAAO,CAAC,CAAC,KACrB,OAAO,SAAQ,WACbA,YAAgC,QAAQ,QAAQ,KAAK,CAAC,CAAC,KACrD,OAAO,SAAQ,UAAS,QAAQ,QAAQ,KAAK,CAAC,CAChD,CACF,CACF,CACF;EAEF,MAAM,qBAAqB,YACzB,oBAAoB,UAAU,QAAQ,UACpCC,QAA4B,QAAQ,QAAQ,OAAO,EAAE,MAAM,CAAC,CAC9D;EAEF,MAAMC,yBAAuB,YAC3B,oBAAoB,UAAU,QAAQ,UACpCC,oBAAwC,QAAQ,QAAQ,QAAQ,EAAE,MAAM,CAAC,CAC3E;EAEF,MAAM,qBAAqB,YACzB,0BACE,cAAc,OAAO,CAAC,CAAC,KACrB,OAAO,SAAQ,WACbH,YAAgC,QAAQ,QAAQ,KAAK,CAAC,CAAC,KACrD,OAAO,SAAQ,UACbI,eAAmC,QAAQ,QAAQ,UAAU;GAC3D,eAAe,QAAQ;GACvB,KAAK,QAAQ;GACb,QAAQ,QAAQ;GAChB;EACF,CAAC,CACH,CACF,CACF,CACF,CACF;EAEF,MAAM,qBAAqB,YACzB,0BACE,OAAO,IAAI,aAAa;GACtB,MAAM,SAAS,OAAO,cAAc,OAAO;GAC3C,MAAM,QAAQ,OAAO,sBAAsB,OAAO;GAClD,MAAM,QACJ,QAAQ,aAAa,SACjB,OAAOC,eACL,QACA,OAAO,OAAO,oBAAoB,OAAO,YAAY,OAAO,QAAQ,CAAC,CAAC,CACpE,QAAQ,QACV,GACA,EAAE,MAAM,CACV,IACA,OAAOC,QAA4B,QAAQ,QAAQ,UAAU,EAAE,MAAM,CAAC;GAC5E,OAAOC,YAA8B;IACnC,cAAc,KAAA;IACd;IACA,YAAY,QAAQ;IACpB;GACF,CAAC;EACH,CAAC,CACH;EAEF,MAAM,wBAAwB,YAC5B,0BACE,OAAO,IAAI,aAAa;GACtB,MAAM,WAAW,IAAI,YAAY,MAC/B,cAAad,WAAsB,UAAU,UAAU,MAAM,QAAQ,UACvE;GACA,IAAI,UAAU,yBAAyB,KAAA,GACrC,OAAO,OAAO,IAAI,oCAAoC,EACpD,YAAY,QAAQ,WACtB,CAAC;GAEH,MAAM,UAAU,OAAO,kBAAkB,OAAO;GAGhD,MAAM,uBACJ,SAAS;GAGX,OAAO,OAAO,OAAO,oBAAoBe,aAAwB,CAAC,CAChE,qBAAqB;IAAE;IAAS,OAAO,QAAQ;GAAM,CAAC,CACxD;EACF,CAAC,CACH;EAEF,MAAM,wBAAwB,YAC5B,0BACE,OAAO,IAAI,aAAa;GACtB,MAAM,SAAS,SAAS,KAAK,QAAQ,UAAU,CAAC,EAAE;GAClD,IAAI,WAAW,KAAA,GACb,OAAO,OAAO,IAAI,8BAA8B,EAAE,YAAY,QAAQ,WAAW,CAAC;GAEpF,MAAM,UAAU,mBAAmB,OAAO,kBAAkB,OAAO,CAAC;GAEpE,MAAM,UAAU,MAAM,IACpB,OAAO,QAAQ,OAAO,IACtB,WAAU,OAAO,eAAe,IAAI,WAAW,MAAM,CAAC,CAAC,EAAE,UAAU,MACrE;GACA,MAAM,aAAa,aAAkD;IACnE,MAAM,MAAM,OAAO,eAAe,IAAI,WAAW,SAAS,GAAG,CAAC;IAC9D,MAAM,UAAU,IAAI,8BAA8B;KAChD,QAAQ,KAAK,UAAU,SAAS;KAChC,MAAM,KAAK,YAAY;KACvB,YAAY,QAAQ;IACtB,CAAC;IACD,IAAI,QAAQ,KAAA,KAAa,CAAC,QAAQ,SAAS,IAAI,MAAM,GAAG,OAAO,OAAO,KAAK,OAAO;IAClF,OAAO,OAAO,WAAW,OAAO,UAAU,UAAU,OAAO,SAAS,OAAO;GAC7E;GACA,OAAO;IAAE;IAAW;GAAQ;EAC9B,CAAC,CACH;EAEF,OAAO,QAAQ,GAAG;GAChB;GACA,yBAAyB,SAAS;GAClC;GACA,sCAAsC,SAAS;GAC/C,sCAAsC,SAAS;GAC/C;GACA,qBAAqB,SAAS;GAC9B,kBAAiB,YACf,0BACE,KACE,cAAc,OAAO,GACrB,OAAO,SAAQ,WAAUC,YAAgC,QAAQ,OAAO,CAAC,CAC3E,CACF;GACF,iBAAiB,SAAS;GAC1B;GACA,SAAQ,YAAW,0BAA0B,UAAU,KAAK,OAAO,CAAC;GACpE,aAAY,YACV,0BACE,OAAO,IAAI,aAAa;IACtB,MAAM,SAAS,OAAO,UAAU,KAAK,SAAS,IAAI;IAClD,OAAO;KACL,GAAG;KACH,MAAM,OAAO,OAAO,oBAAoB,OAAO,IAAI,CAAC,CAAC,OAAO,IAAI;IAClE;GACF,CAAC,CACH;GACF;GACA;GACA;GACA,qBAAA;GACA;GACA;GACA;GACA;GACA;EACF,CAAC;CACH,CAAC,CAGe,CAAC,CAAC,KAClB,MAAM,QAAQC,MAA0B,IAAI,QAAQ,KAAI,iBAAgB,aAAa,MAAM,CAAC,CAAC,GAC7F,MAAM,QAAQ,IAAI,KAAK,CACzB;AACF"}

package/dist/Files.d.ts

@@ -0,0 +1,80 @@
+import "./Files.js";
+import { Context, Effect, Schema } from "effect";
+declare namespace Files_d_exports {
+  export { File, FileError, Files_d_exports as Files, Service, read, write };
+}
+/**
+ * A file stored by the host. Action inputs and outputs carry this reference, never the bytes.
+ *
+ * @since 0.1.0
+ * @category schemas
+ */
+export type File = typeof File.Type;
+export declare const File: Schema.Struct<{
+  readonly _tag: Schema.tag<"File">;
+  readonly contentType: Schema.String;
+  readonly id: Schema.NonEmptyString;
+  readonly name: Schema.String;
+  readonly sizeBytes: Schema.Natural;
+}>;
+declare const FileError_base: Schema.Class<FileError, Schema.TaggedStruct<"FileError", {
+  readonly cause: Schema.optionalKey<Schema.Redacted<Schema.Unknown>>;
+  readonly message: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/**
+ * A file the host could not read or keep. The message is safe for callers; an optional cause
+ * retains the host failure in memory for trusted diagnostics. Wrap causes with Redacted.make
+ * without a provider-derived label. JSON schema encoding of a cause is intentionally refused.
+ *
+ * @since 0.1.0
+ * @category errors
+ */
+export declare class FileError extends FileError_base {}
+declare const Service_base: Context.ServiceClass<Service, "@dual-os/sdk/Files/Service", {
+  readonly read: (file: File) => Effect.Effect<Uint8Array, FileError>;
+  readonly write: (file: {
+    bytes: Uint8Array;
+    name: string;
+    contentType?: string | null | undefined;
+  }) => Effect.Effect<File, FileError>;
+}>;
+/**
+ * Reads and stores files for the caller of an action: a workflow run, or the person in a chat.
+ *
+ * @since 0.1.0
+ * @category services
+ */
+export declare class Service extends Service_base {}
+/**
+ * Reads a file's bytes through the caller's file service.
+ *
+ * @since 0.1.0
+ * @category files
+ */
+export declare const read: (file: {
+  readonly _tag: "File";
+  readonly contentType: string;
+  readonly id: string;
+  readonly name: string;
+  readonly sizeBytes: number;
+}) => Effect.Effect<Uint8Array<ArrayBufferLike>, FileError, never>;
+/**
+ * Stores bytes as a new file of the caller and returns its reference.
+ *
+ * @since 0.1.0
+ * @category files
+ */
+export declare const write: (file: {
+  bytes: Uint8Array;
+  name: string;
+  contentType?: string | null | undefined;
+}) => Effect.Effect<{
+  readonly _tag: "File";
+  readonly contentType: string;
+  readonly id: string;
+  readonly name: string;
+  readonly sizeBytes: number;
+}, FileError, never>;
+//#endregion
+export { Files_d_exports as Files, Files_d_exports };
+//# sourceMappingURL=Files.d.ts.map

package/dist/Files.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"Files.d.ts","names":[],"sources":["../src/Files.ts"],"mappings":";;;;;;;;;;;YAcY,cAAc,KAAK;qBAClB,MAAI,OAAA;;;;;;;;;;;;;;;;;;;qBAiBJ,kBAAkB;;WAcZ,OAAC,MAAM,SAAS,OAAO,OAAO,YAAY;WACzC,QAAC;IACf,OAAO;IACP;IAEA;QACI,OAAO,OAAO,MAAM;;;;;;;;qBATjB,gBAAgB;;;;;;;qBA6BhB,OAAI;;;;;;MAEf,OAAA,OAAA,WAAA,kBAAA;;;;;;;qBAQW,QAAK;EAlCL,OAAA;EACD;EAEQ;;;;;;;GAmClB"}

package/dist/Files.js

@@ -0,0 +1,66 @@
+import { __exportAll } from "./_virtual/_rolldown/runtime.js";
+import "./Files.js";
+import { Context, Effect, Schema, pipe } from "effect";
+//#region src/Files.ts
+/**
+* Files that actions take and return: a small reference in action data, with the bytes kept by the
+* host and read or written through the host's file service.
+*
+* @since 0.1.0
+*/
+var Files_exports = /* @__PURE__ */ __exportAll({
+	File: () => File,
+	FileError: () => FileError,
+	Files: () => Files_exports,
+	Service: () => Service,
+	read: () => read,
+	write: () => write
+});
+const File = Schema.TaggedStruct("File", {
+	contentType: Schema.String,
+	id: Schema.NonEmptyString,
+	name: Schema.String,
+	sizeBytes: Schema.Natural
+}).annotate({ description: "A file: pass the reference a file input or an earlier step returned." });
+/**
+* A file the host could not read or keep. The message is safe for callers; an optional cause
+* retains the host failure in memory for trusted diagnostics. Wrap causes with Redacted.make
+* without a provider-derived label. JSON schema encoding of a cause is intentionally refused.
+*
+* @since 0.1.0
+* @category errors
+*/
+var FileError = class extends Schema.TaggedError()("FileError", {
+	cause: Schema.optionalKey(Schema.Redacted(Schema.Unknown, { disallowJsonEncode: true })),
+	message: Schema.String
+}) {};
+/**
+* Reads and stores files for the caller of an action: a workflow run, or the person in a chat.
+*
+* @since 0.1.0
+* @category services
+*/
+var Service = class extends Context.Service()("@dual-os/sdk/Files/Service") {};
+const service = pipe(Effect.serviceOption(Service), Effect.flatMap(Effect.fromOption(() => FileError.make({ message: "Files are only available when Dual calls the action" }))));
+/**
+* Reads a file's bytes through the caller's file service.
+*
+* @since 0.1.0
+* @category files
+*/
+const read = Effect.fnUntraced(function* (file) {
+	return yield* (yield* service).read(file);
+});
+/**
+* Stores bytes as a new file of the caller and returns its reference.
+*
+* @since 0.1.0
+* @category files
+*/
+const write = Effect.fnUntraced(function* (file) {
+	return yield* (yield* service).write(file);
+});
+//#endregion
+export { File, FileError, Files_exports as Files, Files_exports, Service, read, write };
+
+//# sourceMappingURL=Files.js.map

package/dist/Files.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"Files.js","names":[],"sources":["../src/Files.ts"],"sourcesContent":["/**\n * Files that actions take and return: a small reference in action data, with the bytes kept by the\n * host and read or written through the host's file service.\n *\n * @since 0.1.0\n */\nimport { Context, Effect, Schema, pipe } from \"effect\";\n\n/**\n * A file stored by the host. Action inputs and outputs carry this reference, never the bytes.\n *\n * @since 0.1.0\n * @category schemas\n */\nexport type File = typeof File.Type;\nexport const File = Schema.TaggedStruct(\"File\", {\n  contentType: Schema.String,\n  id: Schema.NonEmptyString,\n  name: Schema.String,\n  sizeBytes: Schema.Natural,\n}).annotate({\n  description: \"A file: pass the reference a file input or an earlier step returned.\",\n});\n\n/**\n * A file the host could not read or keep. The message is safe for callers; an optional cause\n * retains the host failure in memory for trusted diagnostics. Wrap causes with Redacted.make\n * without a provider-derived label. JSON schema encoding of a cause is intentionally refused.\n *\n * @since 0.1.0\n * @category errors\n */\nexport class FileError extends Schema.TaggedError<FileError>()(\"FileError\", {\n  cause: Schema.optionalKey(Schema.Redacted(Schema.Unknown, { disallowJsonEncode: true })),\n  message: Schema.String,\n}) {}\n\n/**\n * Reads and stores files for the caller of an action: a workflow run, or the person in a chat.\n *\n * @since 0.1.0\n * @category services\n */\nexport class Service extends Context.Service<\n  Service,\n  {\n    readonly read: (file: File) => Effect.Effect<Uint8Array, FileError>;\n    readonly write: (file: {\n      bytes: Uint8Array;\n      name: string;\n      // oxlint-disable-next-line typescript/no-restricted-types -- Hosts and existing callers may explicitly supply an absent content type.\n      contentType?: string | null | undefined;\n    }) => Effect.Effect<File, FileError>;\n  }\n>()(\"@dual-os/sdk/Files/Service\") {}\n\n// Dual provides the service to each action call, so an action declares no requirement for it.\nconst service = pipe(\n  Effect.serviceOption(Service),\n  Effect.flatMap(\n    Effect.fromOption(() =>\n      FileError.make({ message: \"Files are only available when Dual calls the action\" }),\n    ),\n  ),\n);\n\n/**\n * Reads a file's bytes through the caller's file service.\n *\n * @since 0.1.0\n * @category files\n */\nexport const read = Effect.fnUntraced(function* (file: File) {\n  return yield* (yield* service).read(file);\n});\n\n/**\n * Stores bytes as a new file of the caller and returns its reference.\n *\n * @since 0.1.0\n * @category files\n */\nexport const write = Effect.fnUntraced(function* (\n  file: Parameters<Service[\"Service\"][\"write\"]>[0],\n) {\n  return yield* (yield* service).write(file);\n});\n\nexport * as Files from \"./Files.ts\";\n"],"mappings":";;;;;;;;;;;;;;;;;;AAeA,MAAa,OAAO,OAAO,aAAa,QAAQ;CAC9C,aAAa,OAAO;CACpB,IAAI,OAAO;CACX,MAAM,OAAO;CACb,WAAW,OAAO;AACpB,CAAC,CAAC,CAAC,SAAS,EACV,aAAa,uEACf,CAAC;;;;;;;;;AAUD,IAAa,YAAb,cAA+B,OAAO,YAAuB,CAAC,CAAC,aAAa;CAC1E,OAAO,OAAO,YAAY,OAAO,SAAS,OAAO,SAAS,EAAE,oBAAoB,KAAK,CAAC,CAAC;CACvF,SAAS,OAAO;AAClB,CAAC,CAAC,CAAC,CAAC;;;;;;;AAQJ,IAAa,UAAb,cAA6B,QAAQ,QAWnC,CAAC,CAAC,4BAA4B,CAAC,CAAC,CAAC;AAGnC,MAAM,UAAU,KACd,OAAO,cAAc,OAAO,GAC5B,OAAO,QACL,OAAO,iBACL,UAAU,KAAK,EAAE,SAAS,sDAAsD,CAAC,CACnF,CACF,CACF;;;;;;;AAQA,MAAa,OAAO,OAAO,WAAW,WAAW,MAAY;CAC3D,OAAO,QAAQ,OAAO,QAAA,CAAS,KAAK,IAAI;AAC1C,CAAC;;;;;;;AAQD,MAAa,QAAQ,OAAO,WAAW,WACrC,MACA;CACA,OAAO,QAAQ,OAAO,QAAA,CAAS,MAAM,IAAI;AAC3C,CAAC"}