@tailorkit/app 0.1.0-beta.25 → 0.1.0-beta.26

package/dist/builder.js

@@ -219,7 +219,7 @@ async function readAppMigrations(directory, optional = false) {
 // src/server/bundle.ts
 var runtimeManifest = {
   apiVersion: 1,
-  requires: ["database", "actions", "database-relations"]
+  requires: ["database", "actions", "database-relations", "tools"]
 };
 
 // src/builder/schema-check.ts

package/dist/{chunk-LIPODQ7B.js → chunk-4PGMCBMJ.js}

@@ -10,6 +10,13 @@ import { RPCLink } from "@orpc/client/websocket";
 
 // src/client/session.ts
 var APP_SESSION_RENEWAL_MS = 6e4;
+function freezeIdentity(value) {
+  if (value && typeof value === "object" && !Object.isFrozen(value)) {
+    for (const child of Object.values(value)) freezeIdentity(child);
+    Object.freeze(value);
+  }
+  return value;
+}
 function sessionRenewalDelay(session) {
   return Math.max(500, session.expiresAt - Date.now() - APP_SESSION_RENEWAL_MS);
 }
@@ -21,7 +28,7 @@ function createSessionProvider(options) {
   let cached;
   let pending;
   return (input) => {
-    if (!input.refresh && cached && cached.expiresAt > Date.now() + APP_SESSION_RENEWAL_MS) {
+    if (options.subjectId !== void 0 && !input.refresh && cached && cached.subjectId === options.subjectId && cached.expiresAt > Date.now() + APP_SESSION_RENEWAL_MS) {
       return Promise.resolve(cached);
     }
     pending ??= (async () => {
@@ -44,7 +51,16 @@ function createSessionProvider(options) {
       if (typeof value.token !== "string" || typeof value.expiresAt !== "number" || typeof value.url !== "string") {
         throw new AppError("UNAVAILABLE", "Invalid app session");
       }
-      cached = { token: value.token, expiresAt: value.expiresAt, url: value.url };
+      if (options.subjectId !== void 0 && value.subjectId !== options.subjectId)
+        throw new AppError("UNAUTHORIZED", "Authenticated principal changed");
+      cached = {
+        ...value.toolUrl !== void 0 ? { toolUrl: value.toolUrl } : {},
+        ...value.identity !== void 0 ? { identity: freezeIdentity(value.identity) } : {},
+        token: value.token,
+        expiresAt: value.expiresAt,
+        url: value.url,
+        ...value.subjectId !== void 0 ? { subjectId: value.subjectId } : {}
+      };
       return cached;
     })().finally(() => {
       pending = void 0;

package/dist/{chunk-O3M4EOCQ.js → chunk-S3KZ3Z2U.js}

@@ -1,8 +1,9 @@
 import {
   createClient,
   reference
-} from "./chunk-LIPODQ7B.js";
+} from "./chunk-4PGMCBMJ.js";
 import {
+  AppError,
   appError
 } from "./chunk-IJBQ77AH.js";
 
@@ -424,6 +425,30 @@ function createFileClient(options) {
   };
 }
 
+// src/client/tools.ts
+function callTool(kind, path, input) {
+  const bridge = globalThis.__tailorkitTools;
+  if (!bridge) return Promise.reject(new AppError("UNAVAILABLE", "Tool bridge unavailable"));
+  if (kind === "client") return bridge.client(path, input);
+  return bridge.session(path).then((session) => executeServerTool(session, path, input));
+}
+async function executeServerTool(session, path, input, request = globalThis.fetch, signal) {
+  const response = await request(session.url, {
+    method: "POST",
+    redirect: "error",
+    credentials: "omit",
+    signal,
+    headers: { authorization: `Bearer ${session.token}`, "content-type": "application/json" },
+    body: JSON.stringify({ path, input, requestId: crypto.randomUUID() })
+  });
+  if (!response.ok)
+    throw new AppError(
+      response.status === 401 ? "UNAUTHORIZED" : response.status === 400 ? "BAD_REQUEST" : "UNAVAILABLE",
+      "Tool call failed"
+    );
+  return (await response.json()).output;
+}
+
 export {
   defineView,
   createRemoteComponent,
@@ -433,5 +458,6 @@ export {
   useAction,
   defineRoute,
   Route,
-  createFileClient
+  createFileClient,
+  callTool
 };

package/dist/client/session.d.ts

@@ -1,4 +1,8 @@
+import type { Identity } from "../server/functions";
 export interface Session {
+    toolUrl?: string;
+    identity?: Identity;
+    subjectId?: string;
     token: string;
     expiresAt: number;
     url: string;
@@ -8,6 +12,8 @@ export declare function sessionRenewalDelay(session: Session): number;
 export declare function createSessionProvider(options: {
     baseUrl: string | URL;
     appId: string;
+    /** Product principal used solely to partition the host credential cache. */
+    subjectId?: string;
     fetch?: typeof fetch;
 }): (input: {
     refresh: boolean;

package/dist/client/tools.d.ts

@@ -0,0 +1,10 @@
+import type { Session } from "./session";
+export interface ToolBridge {
+    client(path: string, input: unknown): Promise<unknown>;
+    session(path: string): Promise<Session>;
+}
+export interface TailorKitServerTools {
+}
+/** Generated callers delegate only transport; host/server declarations validate both directions. */
+export declare function callTool(kind: "client" | "server", path: string, input?: unknown): Promise<unknown>;
+export declare function executeServerTool(session: Session, path: string, input: unknown, request?: typeof fetch, signal?: AbortSignal): Promise<unknown>;

package/dist/client-connection.js

@@ -2,7 +2,7 @@ import {
   createClient,
   createSessionProvider,
   reference
-} from "./chunk-LIPODQ7B.js";
+} from "./chunk-4PGMCBMJ.js";
 import {
   AppError
 } from "./chunk-IJBQ77AH.js";

package/dist/client.d.ts

@@ -7,3 +7,5 @@ export { createApi } from "./client/reference";
 export type { Client, Session, Reference, References } from "./client/connection";
 export { AppError, appError } from "./errors";
 export type { ErrorCode } from "./errors";
+export { callTool } from "./client/tools";
+export type { TailorKitServerTools, ToolBridge } from "./client/tools";

package/dist/client.js

@@ -1,6 +1,7 @@
 import {
   ClientProvider,
   Route,
+  callTool,
   createFileClient,
   createRemoteComponent,
   defineRoute,
@@ -8,13 +9,13 @@ import {
   useAction,
   useMutation,
   useQuery
-} from "./chunk-O3M4EOCQ.js";
+} from "./chunk-S3KZ3Z2U.js";
 import {
   createApi,
   createClient,
   createSessionProvider,
   reference
-} from "./chunk-LIPODQ7B.js";
+} from "./chunk-4PGMCBMJ.js";
 import {
   AppError,
   appError
@@ -24,6 +25,7 @@ export {
   ClientProvider,
   Route,
   appError,
+  callTool,
   createApi,
   createClient,
   createFileClient,

package/dist/index.js

@@ -1,6 +1,7 @@
 import {
   ClientProvider,
   Route,
+  callTool,
   createFileClient,
   createRemoteComponent,
   defineRoute,
@@ -8,13 +9,13 @@ import {
   useAction,
   useMutation,
   useQuery
-} from "./chunk-O3M4EOCQ.js";
+} from "./chunk-S3KZ3Z2U.js";
 import {
   createApi,
   createClient,
   createSessionProvider,
   reference
-} from "./chunk-LIPODQ7B.js";
+} from "./chunk-4PGMCBMJ.js";
 import {
   action,
   and,
@@ -56,6 +57,7 @@ export {
   appError,
   asc,
   boolean,
+  callTool,
   count,
   createApi,
   createClient,

package/dist/server/bundle.d.ts

@@ -13,5 +13,5 @@ export interface ApplicationModule {
 /** Emitted by this SDK's builder; breaking interface changes increment apiVersion. */
 export declare const runtimeManifest: {
     readonly apiVersion: 1;
-    readonly requires: readonly ["database", "actions", "database-relations"];
+    readonly requires: readonly ["database", "actions", "database-relations", "tools"];
 };

package/dist/server/functions.d.ts

@@ -1,9 +1,15 @@
+import type { TailorKitServerTools } from "../client/tools";
 import type { z } from "zod";
 import type { AnyRelations, EmptyRelations } from "drizzle-orm/relations";
 import type { DatabaseDefinition } from "../database/definition";
 import type { QueryDatabase, MutationDatabase } from "../database/types";
 export interface Identity {
-    readonly userId: string;
+    readonly subjectId?: string;
+    readonly scope: {
+        name: string;
+        value: Record<string, unknown>;
+    };
+    readonly toolUrl: string;
     readonly projectId: string;
     readonly appId: string;
     readonly installationId: string;
@@ -32,6 +38,9 @@ export type FunctionCalls<F, K extends "query" | "mutation"> = {
 };
 export interface ActionContext<F extends Functions = Record<never, never>> {
     readonly identity: Identity;
+    readonly tools: TailorKitServerTools;
+    readonly requestId: string;
+    readonly scope: Identity["scope"];
     readonly signal: AbortSignal;
     readonly queries: FunctionCalls<F, "query">;
     readonly mutations: FunctionCalls<F, "mutation">;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@tailorkit/app",
-  "version": "0.1.0-beta.25",
+  "version": "0.1.0-beta.26",
   "license": "Apache-2.0",
   "repository": {
     "type": "git",