@vibesdotdev/client 0.1.0 → 1.0.0-rc.2

package/dist/tools/api-request/api-request.contract.js

@@ -0,0 +1,110 @@
+import * as z from 'zod/v4';
+import { redactedExcerpt, redactCredentials } from '@vibesdotdev/shared/utils';
+import { readClientValue, readClientFields, JsonValueSchema } from "../../lib/client/internal/client-values.js";
+import { apiRequestInputSchema } from "./schemas/index.js";
+import { CapabilityError, CaughtFailureSchema, isCapabilityError } from '@vibesdotdev/kernel';
+const FORBIDDEN_AUTH_HEADERS = new Set([
+    'authorization',
+    'proxy-authorization',
+    'cookie',
+    'set-cookie',
+    'x-api-key',
+    'x-auth-token'
+]);
+export class ApiRequestContractError extends CapabilityError {
+    contractCode;
+    constructor(contractCode, message, options) {
+        super(redactedExcerpt(message), contractCode === 'UNKNOWN_APP' ? 'NOT_FOUND' : contractCode.startsWith('NO_AUTH') ? 'AUTH_REQUIRED' : 'INVALID_INPUT', { reason: contractCode.toLowerCase().replaceAll('_', '-'), cause: options?.cause });
+        this.contractCode = contractCode;
+        this.name = 'ApiRequestContractError';
+    }
+}
+function assertSafeHeaders(headers) {
+    for (const name of Object.keys(headers ?? {})) {
+        if (FORBIDDEN_AUTH_HEADERS.has(name.trim().toLowerCase())) {
+            throw new ApiRequestContractError('AUTH_HEADER_FORBIDDEN', `Header "${name}" is managed by the authenticated API client and cannot be supplied to api-request.`);
+        }
+    }
+}
+async function resolveDeclaredServiceOrigin(app, runtime) {
+    try {
+        const selected = runtime.hasKind('infra/service')
+            ? await runtime.query('infra/service').withId(app).select()
+            : undefined;
+        if (!selected) {
+            throw new CapabilityError('Service is not declared in this runtime.', 'NOT_FOUND', {
+                reason: 'service-undeclared',
+                details: { serviceId: app }
+            });
+        }
+        return await selected.impl.origin();
+    }
+    catch (error) {
+        if (!(error instanceof Error && isCapabilityError(error) && error.reason === 'service-undeclared'))
+            throw error;
+        throw new ApiRequestContractError('UNKNOWN_APP', `Unknown vibes app "${app}" — no infra/service declares it in the configured service environment.`, { cause: error });
+    }
+}
+export async function resolveApiRequestTarget(input, runtime) {
+    input = readClientValue(apiRequestInputSchema, input, 'api-request-input-invalid');
+    const app = input.app?.trim();
+    if (!app) {
+        throw new ApiRequestContractError('APP_REQUIRED', 'api-request requires an explicit app id naming a declared infra/service.');
+    }
+    assertSafeHeaders(input.headers);
+    const origin = await resolveDeclaredServiceOrigin(app, runtime);
+    let configured;
+    let target;
+    try {
+        configured = new URL(origin);
+        target = new URL(input.path, `${origin}/`);
+    }
+    catch (cause) {
+        throw new ApiRequestContractError('INVALID_APP_ORIGIN', `The configured origin for vibes app "${app}" is not a valid URL.`, { cause });
+    }
+    if (configured.protocol !== 'http:' && configured.protocol !== 'https:') {
+        throw new ApiRequestContractError('INVALID_APP_ORIGIN', `The configured origin for vibes app "${app}" must use HTTP or HTTPS.`);
+    }
+    const configuredOrigin = configured.origin;
+    if (!input.path.startsWith('/') ||
+        input.path.startsWith('//') ||
+        target.origin !== configuredOrigin) {
+        throw new ApiRequestContractError('INVALID_PATH', 'api-request path must begin with one slash and cannot override the configured app origin.');
+    }
+    return {
+        app,
+        origin: configuredOrigin,
+        url: target.toString()
+    };
+}
+export function apiRequestErrorOutput(error) {
+    const failure = CaughtFailureSchema.parse(error);
+    return readClientFields(() => {
+        const status = readClientValue(z.object({ status: z.number().int().optional() }), failure, 'api-request-failure-unreadable').status;
+        return { status: 'error', error: {
+                message: failure instanceof Error ? redactedExcerpt(failure.message, { maxChars: 2000 }) : 'The API request failed.',
+                code: failure instanceof ApiRequestContractError ? failure.contractCode : failure instanceof CapabilityError && failure.reason === 'no-auth-client' ? 'NO_AUTH_CLIENT' : 'API_REQUEST_FAILED', status
+            } };
+    }, 'api-request-failure-unreadable');
+}
+/** Apply the shared credential redactor before emitting a tool result. */
+export function apiRequestSuccessOutput(response) {
+    const value = readClientValue(JsonValueSchema, response, 'api-request-response-invalid');
+    return { status: 'success', response: redactApiResponse(value) };
+}
+function redactApiResponse(value) {
+    if (value === null)
+        return null;
+    if (Array.isArray(value))
+        return value.map(redactApiResponse);
+    const string = z.string().safeParse(value);
+    if (string.success)
+        return redactCredentials(string.data);
+    const record = z.record(z.string(), JsonValueSchema).safeParse(value);
+    if (!record.success)
+        return value;
+    return Object.fromEntries(Object.entries(record.data).map(([key, entry]) => [key,
+        redactCredentials(`${key}=credential-value`) !== `${key}=credential-value`
+            ? '[redacted]' : redactApiResponse(entry)]));
+}
+//# sourceMappingURL=api-request.contract.js.map

package/dist/tools/api-request/api-request.contract.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-request.contract.js","sourceRoot":"","sources":["../../../src/tools/api-request/api-request.contract.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC/E,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,eAAe,EAAkB,MAAM,4CAA4C,CAAC;AAChI,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,iBAAiB,EAA6C,MAAM,qBAAqB,CAAC;AAGzI,MAAM,sBAAsB,GAAG,IAAI,GAAG,CAAC;IACtC,eAAe;IACf,qBAAqB;IACrB,QAAQ;IACR,YAAY;IACZ,WAAW;IACX,cAAc;CACd,CAAC,CAAC;AAEH,MAAM,OAAO,uBAAwB,SAAQ,eAAe;IAEjD;IADV,YACU,YAAoB,EAC7B,OAAe,EACf,OAAsB;QAEtB,KAAK,CAAC,eAAe,CAAC,OAAO,CAAC,EAAE,YAAY,KAAK,aAAa,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,YAAY,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,eAAe,CAAC,CAAC,CAAC,eAAe,EAAE,EAAE,MAAM,EAAE,YAAY,CAAC,WAAW,EAAE,CAAC,UAAU,CAAC,GAAG,EAAE,GAAG,CAAC,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC,CAAC;QAJlO,iBAAY,GAAZ,YAAY,CAAQ;QAK7B,IAAI,CAAC,IAAI,GAAG,yBAAyB,CAAC;IACvC,CAAC;CACD;AAQD,SAAS,iBAAiB,CAAC,OAA2C;IACrE,KAAK,MAAM,IAAI,IAAI,MAAM,CAAC,IAAI,CAAC,OAAO,IAAI,EAAE,CAAC,EAAE,CAAC;QAC/C,IAAI,sBAAsB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC,EAAE,CAAC;YAC3D,MAAM,IAAI,uBAAuB,CAChC,uBAAuB,EACvB,WAAW,IAAI,qFAAqF,CACpG,CAAC;QACH,CAAC;IACF,CAAC;AACF,CAAC;AAWD,KAAK,UAAU,4BAA4B,CAAC,GAAW,EAAE,OAAqB;IAC7E,IAAI,CAAC;QACJ,MAAM,QAAQ,GAAG,OAAO,CAAC,OAAO,CAAC,eAAe,CAAC;YAChD,CAAC,CAAC,MAAM,OAAO,CAAC,KAAK,CAAiD,eAAe,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,MAAM,EAAE;YAC3G,CAAC,CAAC,SAAS,CAAC;QACb,IAAI,CAAC,QAAQ,EAAE,CAAC;YACf,MAAM,IAAI,eAAe,CAAC,0CAA0C,EAAE,WAAW,EAAE;gBAClF,MAAM,EAAE,oBAAoB;gBAC5B,OAAO,EAAE,EAAE,SAAS,EAAE,GAAG,EAAE;aAC3B,CAAC,CAAC;QACJ,CAAC;QACD,OAAO,MAAM,QAAQ,CAAC,IAAI,CAAC,MAAM,EAAE,CAAC;IACrC,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,IAAI,CAAC,CAAC,KAAK,YAAY,KAAK,IAAI,iBAAiB,CAAC,KAAK,CAAC,IAAI,KAAK,CAAC,MAAM,KAAK,oBAAoB,CAAC;YAAE,MAAM,KAAK,CAAC;QAChH,MAAM,IAAI,uBAAuB,CAChC,aAAa,EACb,sBAAsB,GAAG,yEAAyE,EAClG,EAAE,KAAK,EAAE,KAAK,EAAE,CAChB,CAAC;IACH,CAAC;AACF,CAAC;AAED,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC5C,KAAsB,EACtB,OAAqB;IAErB,KAAK,GAAG,eAAe,CAAC,qBAAqB,EAAE,KAAK,EAAE,2BAA2B,CAAC,CAAC;IACnF,MAAM,GAAG,GAAG,KAAK,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IAC9B,IAAI,CAAC,GAAG,EAAE,CAAC;QACV,MAAM,IAAI,uBAAuB,CAChC,cAAc,EACd,0EAA0E,CAC1E,CAAC;IACH,CAAC;IAED,iBAAiB,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC;IAEjC,MAAM,MAAM,GAAG,MAAM,4BAA4B,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;IAEhE,IAAI,UAAe,CAAC;IACpB,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACJ,UAAU,GAAG,IAAI,GAAG,CAAC,MAAM,CAAC,CAAC;QAC7B,MAAM,GAAG,IAAI,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,GAAG,MAAM,GAAG,CAAC,CAAC;IAC5C,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,uBAAuB,CAChC,oBAAoB,EACpB,wCAAwC,GAAG,uBAAuB,EAClE,EAAE,KAAK,EAAE,CACT,CAAC;IACH,CAAC;IAED,IAAI,UAAU,CAAC,QAAQ,KAAK,OAAO,IAAI,UAAU,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACzE,MAAM,IAAI,uBAAuB,CAChC,oBAAoB,EACpB,wCAAwC,GAAG,2BAA2B,CACtE,CAAC;IACH,CAAC;IAED,MAAM,gBAAgB,GAAG,UAAU,CAAC,MAAM,CAAC;IAC3C,IACC,CAAC,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC;QAC3B,KAAK,CAAC,IAAI,CAAC,UAAU,CAAC,IAAI,CAAC;QAC3B,MAAM,CAAC,MAAM,KAAK,gBAAgB,EACjC,CAAC;QACF,MAAM,IAAI,uBAAuB,CAChC,cAAc,EACd,2FAA2F,CAC3F,CAAC;IACH,CAAC;IAED,OAAO;QACN,GAAG;QACH,MAAM,EAAE,gBAAgB;QACxB,GAAG,EAAE,MAAM,CAAC,QAAQ,EAAE;KACtB,CAAC;AACH,CAAC;AAED,MAAM,UAAU,qBAAqB,CAAC,KAAc;IACnD,MAAM,OAAO,GAAG,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;IACjD,OAAO,gBAAgB,CAAC,GAAG,EAAE;QAC5B,MAAM,MAAM,GAAG,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,OAAO,EAAE,gCAAgC,CAAC,CAAC,MAAM,CAAC;QACpI,OAAO,EAAE,MAAM,EAAE,OAAgB,EAAE,KAAK,EAAE;gBACzC,OAAO,EAAE,OAAO,YAAY,KAAK,CAAC,CAAC,CAAC,eAAe,CAAC,OAAO,CAAC,OAAO,EAAE,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,CAAC,CAAC,yBAAyB;gBACpH,IAAI,EAAE,OAAO,YAAY,uBAAuB,CAAC,CAAC,CAAC,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,OAAO,YAAY,eAAe,IAAI,OAAO,CAAC,MAAM,KAAK,gBAAgB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,oBAAoB,EAAE,MAAM;aACrM,EAAE,CAAC;IACL,CAAC,EAAE,gCAAgC,CAAC,CAAC;AACtC,CAAC;AACD,0EAA0E;AAC1E,MAAM,UAAU,uBAAuB,CAAC,QAAmB;IAC1D,MAAM,KAAK,GAAG,eAAe,CAAC,eAAe,EAAE,QAAQ,EAAE,8BAA8B,CAAC,CAAC;IACzF,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,QAAQ,EAAE,iBAAiB,CAAC,KAAK,CAAC,EAAE,CAAC;AAClE,CAAC;AAED,SAAS,iBAAiB,CAAC,KAAgB;IAC1C,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,IAAI,CAAC;IAChC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,OAAO,KAAK,CAAC,GAAG,CAAC,iBAAiB,CAAC,CAAC;IAC9D,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,MAAM,CAAC,OAAO;QAAE,OAAO,iBAAiB,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAC1D,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IACtE,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,KAAK,CAAC;IAClC,OAAO,MAAM,CAAC,WAAW,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,EAAE,KAAK,CAAC,EAAE,EAAE,CAAC,CAAC,GAAG;QAC/E,iBAAiB,CAAC,GAAG,GAAG,mBAAmB,CAAC,KAAK,GAAG,GAAG,mBAAmB;YACzE,CAAC,CAAC,YAAY,CAAC,CAAC,CAAC,iBAAiB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC;AAChD,CAAC"}

package/dist/tools/api-request/api-request.descriptor.d.ts

@@ -23,23 +23,30 @@ declare const _default: {
                 GET: "GET";
                 POST: "POST";
                 PUT: "PUT";
-                DELETE: "DELETE";
                 PATCH: "PATCH";
+                DELETE: "DELETE";
             }>;
             path: import("zod/v4").ZodString;
-            query: import("zod/v4").ZodOptional<import("zod/v4").ZodRecord<import("zod/v4").ZodString, import("zod/v4").ZodAny>>;
-            body: import("zod/v4").ZodOptional<import("zod/v4").ZodAny>;
+            query: import("zod/v4").ZodOptional<import("zod/v4").ZodRecord<import("zod/v4").ZodString, import("zod/v4").ZodOptional<import("zod/v4").ZodUnion<readonly [import("zod/v4").ZodString, import("zod/v4").ZodNumber, import("zod/v4").ZodBoolean, import("zod/v4").ZodArray<import("zod/v4").ZodString>]>>>>;
+            body: import("zod/v4").ZodOptional<import("zod/v4").ZodType<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue, import("zod/v4/core").$ZodTypeInternals<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue>>>;
             headers: import("zod/v4").ZodOptional<import("zod/v4").ZodRecord<import("zod/v4").ZodString, import("zod/v4").ZodString>>;
+            app: import("zod/v4").ZodOptional<import("zod/v4").ZodString>;
         }, import("zod/v4/core").$strip>;
         output: import("zod/v4").ZodObject<{
             status: import("zod/v4").ZodEnum<{
                 error: "error";
                 success: "success";
             }>;
-            response: import("zod/v4").ZodOptional<import("zod/v4").ZodUnknown>;
+            response: import("zod/v4").ZodOptional<import("zod/v4").ZodType<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue, import("zod/v4/core").$ZodTypeInternals<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue>>>;
             error: import("zod/v4").ZodOptional<import("zod/v4").ZodObject<{
                 message: import("zod/v4").ZodString;
+                failure: import("zod/v4").ZodOptional<import("zod/v4").ZodObject<{
+                    name: import("zod/v4").ZodString;
+                    code: import("zod/v4").ZodOptional<import("zod/v4").ZodString>;
+                    reason: import("zod/v4").ZodOptional<import("zod/v4").ZodString>;
+                }, import("zod/v4/core").$strip>>;
                 code: import("zod/v4").ZodOptional<import("zod/v4").ZodString>;
+                status: import("zod/v4").ZodOptional<import("zod/v4").ZodNumber>;
             }, import("zod/v4/core").$strip>>;
         }, import("zod/v4/core").$strip>;
     };

package/dist/tools/api-request/api-request.descriptor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-request.descriptor.d.ts","sourceRoot":"","sources":["../../../src/tools/api-request/api-request.descriptor.ts"],"names":[],"mappings":"AAAA;;;;GAIG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAKH,wBAkBG"}
+{"version":3,"file":"api-request.descriptor.d.ts","sourceRoot":"","sources":["../../../src/tools/api-request/api-request.descriptor.ts"],"names":[],"mappings":"AAAA;;;;GAIG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAKH,wBAsBG"}

package/dist/tools/api-request/api-request.descriptor.js

@@ -3,16 +3,19 @@
  *
  * Metadata for the api-request tool. Safe to import anywhere.
  */
-import { createRuntimeAsset } from '@vibesdotdev/runtime/factory';
+import { createRuntimeAsset } from '@vibesdotdev/kernel/factory';
 import { apiRequestInputSchema, apiRequestOutputSchema } from "./schemas/index.js";
 export default createRuntimeAsset({
     kind: 'tools/tool',
     id: 'api-request',
     name: 'API Request',
-    description: 'Make an authenticated API request to any Vibes endpoint.',
-    mcpDescription: 'Make authenticated API request to Vibes endpoints. Ex: {method:"GET",path:"/api/health"}.',
-    hardware: ['consumer'],
-    purpose: ['direct', 'worker', 'mcp', 'agent'],
+    description: 'Make an authenticated API request to an explicitly named Vibes app.',
+    mcpDescription: 'Vibes API request. app is required via the infra/service catalog; auth/cookie headers are rejected. Ex: {app:"account",method:"GET",path:"/api/profile"}.',
+    hardware: ['consumer', 'cloud'],
+    // MCP adapters do not yet thread verified caller auth into ToolCallContext.
+    // Keep the tool out of MCP discovery until that surface owns the contract;
+    // direct/worker/agent surfaces fail closed on explicit auth context.
+    purpose: ['direct', 'worker', 'agent'],
     category: 'execution',
     subcategory: 'api-request',
     tags: ['api', 'network'],

package/dist/tools/api-request/api-request.descriptor.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-request.descriptor.js","sourceRoot":"","sources":["../../../src/tools/api-request/api-request.descriptor.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,8BAA8B,CAAC;AAClE,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAEnF,eAAe,kBAAkB,CAAC;IACjC,IAAI,EAAE,YAAY;IAClB,EAAE,EAAE,aAAa;IACjB,IAAI,EAAE,aAAa;IACnB,WAAW,EAAE,0DAA0D;IACvE,cAAc,EAAE,2FAA2F;IAC3G,QAAQ,EAAE,CAAC,UAAU,CAAC;IACtB,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,KAAK,EAAE,OAAO,CAAC;IAC7C,QAAQ,EAAE,WAAW;IACrB,WAAW,EAAE,aAAa;IAC1B,IAAI,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC;IACxB,MAAM,EAAE,OAAO;IACf,gBAAgB,EAAE,IAAI;IACtB,WAAW,EAAE,CAAC,kBAAkB,CAAC;IACjC,OAAO,EAAE;QACR,KAAK,EAAE,qBAAqB;QAC5B,MAAM,EAAE,sBAAsB;KAC9B;CACD,CAAC,CAAC"}
+{"version":3,"file":"api-request.descriptor.js","sourceRoot":"","sources":["../../../src/tools/api-request/api-request.descriptor.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,EAAE,kBAAkB,EAAE,MAAM,6BAA6B,CAAC;AACjE,OAAO,EAAE,qBAAqB,EAAE,sBAAsB,EAAE,MAAM,oBAAoB,CAAC;AAEnF,eAAe,kBAAkB,CAAC;IACjC,IAAI,EAAE,YAAY;IAClB,EAAE,EAAE,aAAa;IACjB,IAAI,EAAE,aAAa;IACnB,WAAW,EAAE,qEAAqE;IAClF,cAAc,EACb,2JAA2J;IAC5J,QAAQ,EAAE,CAAC,UAAU,EAAE,OAAO,CAAC;IAC/B,4EAA4E;IAC5E,2EAA2E;IAC3E,qEAAqE;IACrE,OAAO,EAAE,CAAC,QAAQ,EAAE,QAAQ,EAAE,OAAO,CAAC;IACtC,QAAQ,EAAE,WAAW;IACrB,WAAW,EAAE,aAAa;IAC1B,IAAI,EAAE,CAAC,KAAK,EAAE,SAAS,CAAC;IACxB,MAAM,EAAE,OAAO;IACf,gBAAgB,EAAE,IAAI;IACtB,WAAW,EAAE,CAAC,kBAAkB,CAAC;IACjC,OAAO,EAAE;QACR,KAAK,EAAE,qBAAqB;QAC5B,MAAM,EAAE,sBAAsB;KAC9B;CACD,CAAC,CAAC"}

package/dist/tools/api-request/api-request.impl.cloud.d.ts

@@ -0,0 +1,15 @@
+/**
+ * api-request Tool Implementation (Cloud)
+ *
+ * Resolves the requested app through the declared infra/service catalog and
+ * forwards only caller-scoped authentication supplied by the tool execution
+ * context. Cloud execution fails closed when the surface did not provide a
+ * JWT or cookie.
+ */
+import type { VibesRuntime, ToolCallContext } from '@vibesdotdev/kernel';
+import type { ApiRequestInput, ApiRequestOutput } from './schemas/index.ts';
+declare const _default: {
+    execute(input: ApiRequestInput, runtime: VibesRuntime, ctx: ToolCallContext): Promise<ApiRequestOutput>;
+};
+export default _default;
+//# sourceMappingURL=api-request.impl.cloud.d.ts.map

package/dist/tools/api-request/api-request.impl.cloud.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-request.impl.cloud.d.ts","sourceRoot":"","sources":["../../../src/tools/api-request/api-request.impl.cloud.ts"],"names":[],"mappings":"AAGA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAUzE,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;;mBAqDnE,eAAe,WACb,YAAY,OAChB,eAAe,GAClB,OAAO,CAAC,gBAAgB,CAAC;;AAL7B,wBA4BE"}

package/dist/tools/api-request/api-request.impl.cloud.js

@@ -0,0 +1,75 @@
+import { valueFreeFailure, CaughtFailureSchema } from '@vibesdotdev/kernel';
+import { JsonValueSchema, readClientValue } from "../../lib/client/internal/client-values.js";
+import { apiRequestInputSchema } from "./schemas/index.js";
+import * as z from 'zod/v4';
+import { vibesApiClient } from "../../factory.js";
+import { ApiRequestContractError, apiRequestErrorOutput, apiRequestSuccessOutput, resolveApiRequestTarget } from "./api-request.contract.js";
+function nonEmptyMetadataString(ctx, key) {
+    const value = readClientValue(z.object({ metadata: z.record(z.string(), JsonValueSchema).optional() }), ctx, 'api-request-context-unreadable').metadata?.[key];
+    const parsed = z.string().safeParse(value);
+    if (!parsed.success)
+        return null;
+    const trimmed = parsed.data.trim();
+    return trimmed.length > 0 ? trimmed : null;
+}
+const FORWARDABLE_AUTH_COOKIES = new Set([
+    '__Secure-better-auth.session_token',
+    'better-auth.session_token'
+]);
+/**
+ * Extract only the canonical Better Auth session cookie. Tool metadata may
+ * carry the caller's complete host Cookie header; forwarding that verbatim to
+ * a sibling app would leak unrelated host-only cookies across trust domains.
+ */
+function resolveForwardableAuthCookie(rawCookie) {
+    for (const part of rawCookie.split(';')) {
+        const separator = part.indexOf('=');
+        if (separator <= 0)
+            continue;
+        const name = part.slice(0, separator).trim();
+        const value = part.slice(separator + 1).trim();
+        if (FORWARDABLE_AUTH_COOKIES.has(name) && value.length > 0 && !/[\r\n]/.test(value)) {
+            return `${name}=${value}`;
+        }
+    }
+    return null;
+}
+function resolveCallerAuth(ctx) {
+    const jwt = nonEmptyMetadataString(ctx, 'jwt');
+    if (jwt) {
+        return { auth: { type: 'bearer', credentials: jwt } };
+    }
+    const cookie = nonEmptyMetadataString(ctx, 'cookie');
+    if (cookie) {
+        const authCookie = resolveForwardableAuthCookie(cookie);
+        if (authCookie)
+            return { headers: { Cookie: authCookie } };
+    }
+    throw new ApiRequestContractError('NO_AUTH_CONTEXT', 'Cloud api-request requires caller-scoped JWT or a canonical Better Auth session cookie from the execution surface.');
+}
+export default {
+    async execute(input, runtime, ctx) {
+        try {
+            input = readClientValue(apiRequestInputSchema, input, 'api-request-input-invalid');
+            const target = await resolveApiRequestTarget(input, runtime);
+            const apiClient = vibesApiClient({
+                id: `api-request:${target.app}`,
+                baseUrl: target.origin,
+                runtime,
+                ...resolveCallerAuth(ctx)
+            });
+            const response = await apiClient.request(target.url, {
+                method: input.method,
+                query: input.query ?? {},
+                body: input.body ?? undefined,
+                headers: input.headers ?? {}
+            });
+            return apiRequestSuccessOutput(response);
+        }
+        catch (error) {
+            const projected = apiRequestErrorOutput(error);
+            return { status: 'error', error: { ...projected.error, failure: valueFreeFailure(CaughtFailureSchema.parse(error)) } };
+        }
+    }
+};
+//# sourceMappingURL=api-request.impl.cloud.js.map

package/dist/tools/api-request/api-request.impl.cloud.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-request.impl.cloud.js","sourceRoot":"","sources":["../../../src/tools/api-request/api-request.impl.cloud.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC5E,OAAO,EAAE,eAAe,EAAE,eAAe,EAAkB,MAAM,4CAA4C,CAAC;AAC9G,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAW3D,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,OAAO,EAAE,cAAc,EAAE,MAAM,kBAAkB,CAAC;AAClD,OAAO,EACN,uBAAuB,EACvB,qBAAqB,EACrB,uBAAuB,EACvB,uBAAuB,EACvB,MAAM,2BAA2B,CAAC;AAGnC,SAAS,sBAAsB,CAAC,GAAoB,EAAE,GAAW;IAChE,MAAM,KAAK,GAAG,eAAe,CAAC,CAAC,CAAC,MAAM,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC,QAAQ,EAAE,EAAE,CAAC,EAAE,GAAG,EAAE,gCAAgC,CAAC,CAAC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;IAC/J,MAAM,MAAM,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC3C,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IACjC,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;IACnC,OAAO,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC;AAC5C,CAAC;AAED,MAAM,wBAAwB,GAAG,IAAI,GAAG,CAAC;IACxC,oCAAoC;IACpC,2BAA2B;CAC3B,CAAC,CAAC;AAEH;;;;GAIG;AACH,SAAS,4BAA4B,CAAC,SAAiB;IACtD,KAAK,MAAM,IAAI,IAAI,SAAS,CAAC,KAAK,CAAC,GAAG,CAAC,EAAE,CAAC;QACzC,MAAM,SAAS,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACpC,IAAI,SAAS,IAAI,CAAC;YAAE,SAAS;QAC7B,MAAM,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,CAAC,CAAC,IAAI,EAAE,CAAC;QAC7C,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,GAAG,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QAC/C,IAAI,wBAAwB,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,KAAK,CAAC,MAAM,GAAG,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC;YACrF,OAAO,GAAG,IAAI,IAAI,KAAK,EAAE,CAAC;QAC3B,CAAC;IACF,CAAC;IACD,OAAO,IAAI,CAAC;AACb,CAAC;AAED,SAAS,iBAAiB,CAAC,GAAoB;IAC9C,MAAM,GAAG,GAAG,sBAAsB,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC;IAC/C,IAAI,GAAG,EAAE,CAAC;QACT,OAAO,EAAE,IAAI,EAAE,EAAE,IAAI,EAAE,QAAQ,EAAE,WAAW,EAAE,GAAG,EAAE,EAAE,CAAC;IACvD,CAAC;IAED,MAAM,MAAM,GAAG,sBAAsB,CAAC,GAAG,EAAE,QAAQ,CAAC,CAAC;IACrD,IAAI,MAAM,EAAE,CAAC;QACZ,MAAM,UAAU,GAAG,4BAA4B,CAAC,MAAM,CAAC,CAAC;QACxD,IAAI,UAAU;YAAE,OAAO,EAAE,OAAO,EAAE,EAAE,MAAM,EAAE,UAAU,EAAE,EAAE,CAAC;IAC5D,CAAC;IAED,MAAM,IAAI,uBAAuB,CAChC,iBAAiB,EACjB,oHAAoH,CACpH,CAAC;AACH,CAAC;AAED,eAAe;IACd,KAAK,CAAC,OAAO,CACZ,KAAsB,EACtB,OAAqB,EACrB,GAAoB;QAEpB,IAAI,CAAC;YACJ,KAAK,GAAG,eAAe,CAAC,qBAAqB,EAAE,KAAK,EAAE,2BAA2B,CAAC,CAAC;YACnF,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAC7D,MAAM,SAAS,GAAG,cAAc,CAAC;gBAChC,EAAE,EAAE,eAAe,MAAM,CAAC,GAAG,EAAE;gBAC/B,OAAO,EAAE,MAAM,CAAC,MAAM;gBACtB,OAAO;gBACP,GAAG,iBAAiB,CAAC,GAAG,CAAC;aACzB,CAAC,CAAC;YACH,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,OAAO,CAAY,MAAM,CAAC,GAAG,EAAE;gBAC/D,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,EAAE;gBACxB,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,SAAS;gBAC7B,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,EAAE;aAC5B,CAAC,CAAC;YAEH,OAAO,uBAAuB,CAAC,QAAQ,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,SAAS,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;YAC/C,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,GAAG,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,gBAAgB,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QACxH,CAAC;IACF,CAAC;CACD,CAAC"}

package/dist/tools/api-request/api-request.impl.consumer.d.ts

@@ -1,10 +1,12 @@
 /**
  * api-request Tool Implementation (Consumer)
  *
- * Consumer-scoped implementation for making authenticated API requests.
- * Resolves the `api/client` runtime kind and delegates to its `.request()`.
+ * Resolves the requested app through the declared infra/service catalog, then
+ * sends the absolute target URL through the explicitly registered auth API
+ * client. The auth client owns the consumer credential provider; api-request
+ * never reads or accepts credentials itself.
  */
-import type { VibesRuntime, ToolCallContext } from '@vibesdotdev/runtime';
+import { type VibesRuntime, type ToolCallContext } from '@vibesdotdev/kernel';
 import type { ApiRequestInput, ApiRequestOutput } from './schemas/index.ts';
 declare const _default: {
     execute(input: ApiRequestInput, runtime: VibesRuntime, _ctx: ToolCallContext): Promise<ApiRequestOutput>;

package/dist/tools/api-request/api-request.impl.consumer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"api-request.impl.consumer.d.ts","sourceRoot":"","sources":["../../../src/tools/api-request/api-request.impl.consumer.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,KAAK,EAAE,YAAY,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAE1E,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;;mBAqBnE,eAAe,WACb,YAAY,QACf,eAAe,GACnB,OAAO,CAAC,gBAAgB,CAAC;;AAL7B,wBAqCE"}
+{"version":3,"file":"api-request.impl.consumer.d.ts","sourceRoot":"","sources":["../../../src/tools/api-request/api-request.impl.consumer.ts"],"names":[],"mappings":"AAGA;;;;;;;GAOG;AAEH,OAAO,EAAmB,KAAK,YAAY,EAAE,KAAK,eAAe,EAAE,MAAM,qBAAqB,CAAC;AAS/F,OAAO,KAAK,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;;mBAoBnE,eAAe,WACb,YAAY,QACf,eAAe,GACnB,OAAO,CAAC,gBAAgB,CAAC;;AAL7B,wBAuBE"}

package/dist/tools/api-request/api-request.impl.consumer.js

@@ -1,50 +1,44 @@
+import { valueFreeFailure, CaughtFailureSchema } from '@vibesdotdev/kernel';
+import { readClientValue } from "../../lib/client/internal/client-values.js";
+import { apiRequestInputSchema } from "./schemas/index.js";
 /**
  * api-request Tool Implementation (Consumer)
  *
- * Consumer-scoped implementation for making authenticated API requests.
- * Resolves the `api/client` runtime kind and delegates to its `.request()`.
+ * Resolves the requested app through the declared infra/service catalog, then
+ * sends the absolute target URL through the explicitly registered auth API
+ * client. The auth client owns the consumer credential provider; api-request
+ * never reads or accepts credentials itself.
  */
-async function resolveApiClient(runtime) {
+import { CapabilityError } from '@vibesdotdev/kernel';
+import { getVibesClient } from '@vibesdotdev/kernel/client';
+import { apiRequestErrorOutput, apiRequestSuccessOutput, resolveApiRequestTarget } from "./api-request.contract.js";
+async function resolveAuthenticatedApiClient(runtime) {
     try {
-        const apiClient = (await runtime.query('api/client').resolve());
-        if (apiClient) {
-            return apiClient;
-        }
+        const client = await getVibesClient('client', runtime);
+        const apiClient = await client.resolve('auth');
+        return apiClient;
     }
-    catch {
-        // Query failed, fall through
+    catch (cause) {
+        throw new CapabilityError('The authenticated auth API client is not available in this runtime.', 'AUTH_REQUIRED', { reason: 'no-auth-client', cause });
     }
-    throw new Error('API client not available in runtime context. Ensure api/client kind is registered.');
 }
 export default {
     async execute(input, runtime, _ctx) {
-        const method = input.method;
-        const path = input.path;
-        const query = input.query ?? {};
-        const body = input.body ?? undefined;
-        const headers = input.headers ?? {};
         try {
-            const apiClient = await resolveApiClient(runtime);
-            const response = await apiClient.request(path, {
-                method,
-                query,
-                body,
-                headers
+            input = readClientValue(apiRequestInputSchema, input, 'api-request-input-invalid');
+            const target = await resolveApiRequestTarget(input, runtime);
+            const apiClient = await resolveAuthenticatedApiClient(runtime);
+            const response = await apiClient.request(target.url, {
+                method: input.method,
+                query: input.query ?? {},
+                body: input.body ?? undefined,
+                headers: input.headers ?? {}
             });
-            return {
-                status: 'success',
-                response
-            };
+            return apiRequestSuccessOutput(response);
         }
         catch (error) {
-            const message = error instanceof Error ? error.message : String(error);
-            return {
-                status: 'error',
-                error: {
-                    message,
-                    code: 'API_REQUEST_FAILED'
-                }
-            };
+            const projected = apiRequestErrorOutput(error);
+            return { status: 'error', error: { ...projected.error, failure: valueFreeFailure(CaughtFailureSchema.parse(error)) } };
         }
     }
 };

package/dist/tools/api-request/api-request.impl.consumer.js.map

@@ -1 +1 @@
-{"version":3,"file":"api-request.impl.consumer.js","sourceRoot":"","sources":["../../../src/tools/api-request/api-request.impl.consumer.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAMH,KAAK,UAAU,gBAAgB,CAAC,OAAqB;IACpD,IAAI,CAAC;QACJ,MAAM,SAAS,GAAG,CAAC,MAAM,OAAO,CAAC,KAAK,CAAC,YAAY,CAAC,CAAC,OAAO,EAAE,CAElD,CAAC;QACb,IAAI,SAAS,EAAE,CAAC;YACf,OAAO,SAAS,CAAC;QAClB,CAAC;IACF,CAAC;IAAC,MAAM,CAAC;QACR,6BAA6B;IAC9B,CAAC;IAED,MAAM,IAAI,KAAK,CACd,oFAAoF,CACpF,CAAC;AACH,CAAC;AAED,eAAe;IACd,KAAK,CAAC,OAAO,CACZ,KAAsB,EACtB,OAAqB,EACrB,IAAqB;QAErB,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM,CAAC;QAC5B,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,CAAC;QACxB,MAAM,KAAK,GAAG,KAAK,CAAC,KAAK,IAAI,EAAE,CAAC;QAChC,MAAM,IAAI,GAAG,KAAK,CAAC,IAAI,IAAI,SAAS,CAAC;QACrC,MAAM,OAAO,GAAG,KAAK,CAAC,OAAO,IAAI,EAAE,CAAC;QAEpC,IAAI,CAAC;YACJ,MAAM,SAAS,GAAG,MAAM,gBAAgB,CAAC,OAAO,CAAC,CAAC;YAElD,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,IAAI,EAAE;gBAC9C,MAAM;gBACN,KAAK;gBACL,IAAI;gBACJ,OAAO;aACP,CAAC,CAAC;YAEH,OAAO;gBACN,MAAM,EAAE,SAAS;gBACjB,QAAQ;aACR,CAAC;QACH,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,OAAO,GAAG,KAAK,YAAY,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YACvE,OAAO;gBACN,MAAM,EAAE,OAAO;gBACf,KAAK,EAAE;oBACN,OAAO;oBACP,IAAI,EAAE,oBAAoB;iBAC1B;aACD,CAAC;QACH,CAAC;IACF,CAAC;CACD,CAAC"}
+{"version":3,"file":"api-request.impl.consumer.js","sourceRoot":"","sources":["../../../src/tools/api-request/api-request.impl.consumer.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,gBAAgB,EAAE,mBAAmB,EAAE,MAAM,qBAAqB,CAAC;AAC5E,OAAO,EAAE,eAAe,EAAkB,MAAM,4CAA4C,CAAC;AAC7F,OAAO,EAAE,qBAAqB,EAAE,MAAM,oBAAoB,CAAC;AAC3D;;;;;;;GAOG;AAEH,OAAO,EAAE,eAAe,EAA2C,MAAM,qBAAqB,CAAC;AAC/F,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAG5D,OAAO,EACN,qBAAqB,EACrB,uBAAuB,EACvB,uBAAuB,EACvB,MAAM,2BAA2B,CAAC;AAGnC,KAAK,UAAU,6BAA6B,CAC3C,OAAqB;IAErB,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,MAAM,cAAc,CAAmB,QAAQ,EAAE,OAAO,CAAC,CAAC;QACzE,MAAM,SAAS,GAAG,MAAM,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;QAC/C,OAAO,SAAS,CAAC;IAClB,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAChB,MAAM,IAAI,eAAe,CACxB,qEAAqE,EAAE,eAAe,EACtF,EAAE,MAAM,EAAE,gBAAgB,EAAE,KAAK,EAAE,CACnC,CAAC;IACH,CAAC;AAEF,CAAC;AAED,eAAe;IACd,KAAK,CAAC,OAAO,CACZ,KAAsB,EACtB,OAAqB,EACrB,IAAqB;QAErB,IAAI,CAAC;YACJ,KAAK,GAAG,eAAe,CAAC,qBAAqB,EAAE,KAAK,EAAE,2BAA2B,CAAC,CAAC;YACnF,MAAM,MAAM,GAAG,MAAM,uBAAuB,CAAC,KAAK,EAAE,OAAO,CAAC,CAAC;YAC7D,MAAM,SAAS,GAAG,MAAM,6BAA6B,CAAC,OAAO,CAAC,CAAC;YAC/D,MAAM,QAAQ,GAAG,MAAM,SAAS,CAAC,OAAO,CAAY,MAAM,CAAC,GAAG,EAAE;gBAC/D,MAAM,EAAE,KAAK,CAAC,MAAM;gBACpB,KAAK,EAAE,KAAK,CAAC,KAAK,IAAI,EAAE;gBACxB,IAAI,EAAE,KAAK,CAAC,IAAI,IAAI,SAAS;gBAC7B,OAAO,EAAE,KAAK,CAAC,OAAO,IAAI,EAAE;aAC5B,CAAC,CAAC;YAEH,OAAO,uBAAuB,CAAC,QAAQ,CAAC,CAAC;QAC1C,CAAC;QAAC,OAAO,KAAK,EAAE,CAAC;YAChB,MAAM,SAAS,GAAG,qBAAqB,CAAC,KAAK,CAAC,CAAC;YAC/C,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,EAAE,GAAG,SAAS,CAAC,KAAK,EAAE,OAAO,EAAE,gBAAgB,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC;QACxH,CAAC;IACF,CAAC;CACD,CAAC"}

package/dist/tools/api-request/api-request.view.d.ts

@@ -0,0 +1,29 @@
+import { type ValueFreeFailure } from '@vibesdotdev/kernel';
+/** Shared method, app-scoped URL, status and redacted body projection. */
+import * as z from 'zod/v4';
+export declare const API_REQUEST_BODY_EXCERPT_MAX = 240;
+export interface ApiRequestCardModel {
+    method: string;
+    url: string;
+    statusLabel: string;
+    httpStatus: number | null;
+    bodyExcerpt: string;
+    title: string;
+    failed: boolean;
+    failure?: ValueFreeFailure;
+}
+declare const CardBoundarySchema: z.ZodUnknown;
+type CardValue = z.input<typeof CardBoundarySchema>;
+declare const RecordSchema: z.ZodRecord<z.ZodString, z.ZodType<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue, z.core.$ZodTypeInternals<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue>>>;
+export declare function rec(value: CardValue): z.infer<typeof RecordSchema> | {
+    failure: ValueFreeFailure;
+} | null;
+export declare function excerptBody(value: CardValue, maxLength?: number): string;
+export declare function apiRequestCardModel(options: {
+    input?: CardValue;
+    args?: CardValue;
+    output?: CardValue;
+    error?: string | null;
+}): ApiRequestCardModel;
+export {};
+//# sourceMappingURL=api-request.view.d.ts.map

package/dist/tools/api-request/api-request.view.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-request.view.d.ts","sourceRoot":"","sources":["../../../src/tools/api-request/api-request.view.ts"],"names":[],"mappings":"AAAA,OAAO,EAA0D,KAAK,gBAAgB,EAAE,MAAM,qBAAqB,CAAC;AACpH,0EAA0E;AAC1E,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAG5B,eAAO,MAAM,4BAA4B,MAAM,CAAC;AAChD,MAAM,WAAW,mBAAmB;IAAG,MAAM,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,WAAW,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,OAAO,CAAC;IAAC,OAAO,CAAC,EAAE,gBAAgB,CAAC;CAAE;AACtM,QAAA,MAAM,kBAAkB,cAAc,CAAC;AACvC,KAAK,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,kBAAkB,CAAC,CAAC;AACpD,QAAA,MAAM,YAAY,2QAAwC,CAAC;AAG3D,wBAAgB,GAAG,CAAC,KAAK,EAAE,SAAS,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,YAAY,CAAC,GAAG;IAAE,OAAO,EAAE,gBAAgB,CAAA;CAAE,GAAG,IAAI,CAGzG;AACD,wBAAgB,WAAW,CAAC,KAAK,EAAE,SAAS,EAAE,SAAS,SAA+B,GAAG,MAAM,CAQ9F;AAWD,wBAAgB,mBAAmB,CAAC,OAAO,EAAE;IAAE,KAAK,CAAC,EAAE,SAAS,CAAC;IAAC,IAAI,CAAC,EAAE,SAAS,CAAC;IAAC,MAAM,CAAC,EAAE,SAAS,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GAAG,mBAAmB,CAapJ"}

package/dist/tools/api-request/api-request.view.js

@@ -0,0 +1,62 @@
+import { CapabilityError, CaughtFailureSchema, valueFreeFailure } from '@vibesdotdev/kernel';
+/** Shared method, app-scoped URL, status and redacted body projection. */
+import * as z from 'zod/v4';
+import { redactedExcerpt, redactCredentials } from '@vibesdotdev/shared/utils';
+import { JsonValueSchema, QuerySchema, readClientValue } from "../../lib/client/internal/client-values.js";
+export const API_REQUEST_BODY_EXCERPT_MAX = 240;
+const CardBoundarySchema = z.unknown();
+const RecordSchema = z.record(z.string(), JsonValueSchema);
+const InputSchema = z.object({ method: z.string().optional().catch(undefined), path: z.string().optional().catch(undefined), app: z.string().optional().catch(undefined), query: QuerySchema.optional().catch(undefined) });
+const OutputSchema = z.object({ status: z.enum(['success', 'error']).optional().catch(undefined), response: JsonValueSchema.optional().catch(undefined), error: z.object({ message: z.string().optional(), status: z.number().int().optional() }).optional().catch(undefined) });
+export function rec(value) {
+    try {
+        return RecordSchema.safeParse(value).data ?? null;
+    }
+    catch (error) {
+        return { failure: valueFreeFailure(CaughtFailureSchema.parse(error)) };
+    }
+}
+export function excerptBody(value, maxLength = API_REQUEST_BODY_EXCERPT_MAX) {
+    if (value === undefined || value === null)
+        return '';
+    try {
+        const parsed = readClientValue(JsonValueSchema, value, 'api-card-value-invalid');
+        const text = z.string().safeParse(parsed);
+        const normalized = redactedExcerpt(text.success ? text.data : JSON.stringify(parsed), { maxChars: Math.max(maxLength, 1) + 1 }).replace(/\s+/g, ' ').trim();
+        return normalized.length <= maxLength ? normalized : maxLength <= 1 ? '…' : `${normalized.slice(0, maxLength - 1).trimEnd()}…`;
+    }
+    catch (error) {
+        throw new CapabilityError('The API card body could not be read.', 'INVALID_INPUT', { reason: 'api-card-value-unreadable', cause: valueFreeFailure(CaughtFailureSchema.parse(error)) });
+    }
+}
+function formatQuery(query) {
+    const params = new URLSearchParams();
+    for (const [key, value] of Object.entries(query ?? {})) {
+        if (value === undefined)
+            continue;
+        if (Array.isArray(value))
+            value.forEach(item => params.append(key, item));
+        else
+            params.set(key, String(value));
+    }
+    const encoded = params.toString();
+    return encoded ? `?${encoded}` : '';
+}
+export function apiRequestCardModel(options) {
+    try {
+        const input = InputSchema.safeParse(options.input ?? options.args).data;
+        const output = OutputSchema.safeParse(options.output).data;
+        const method = input?.method?.toUpperCase() ?? '', path = input?.path ?? '', app = input?.app ?? '';
+        const url = redactCredentials(`${app && path ? `${app}:` : ''}${path}${formatQuery(input?.query)}`);
+        const httpStatus = output?.error?.status ?? null, outcome = output?.status;
+        const failed = Boolean(options.error) || outcome === 'error' || (httpStatus !== null && httpStatus >= 400);
+        const statusLabel = httpStatus !== null ? String(httpStatus) : outcome ?? '';
+        const bodyExcerpt = excerptBody(failed ? output?.error?.message ?? options.error ?? output?.response : output?.response);
+        const title = redactCredentials([method, path].filter(Boolean).join(' ') || 'API request');
+        return { method, url, statusLabel, httpStatus, bodyExcerpt, title, failed };
+    }
+    catch (error) {
+        return { method: '', url: '', statusLabel: 'error', httpStatus: null, bodyExcerpt: '[unreadable]', title: 'API request', failed: true, failure: valueFreeFailure(CaughtFailureSchema.parse(error)) };
+    }
+}
+//# sourceMappingURL=api-request.view.js.map

package/dist/tools/api-request/api-request.view.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"api-request.view.js","sourceRoot":"","sources":["../../../src/tools/api-request/api-request.view.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,eAAe,EAAE,mBAAmB,EAAE,gBAAgB,EAAyB,MAAM,qBAAqB,CAAC;AACpH,0EAA0E;AAC1E,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAC5B,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,MAAM,2BAA2B,CAAC;AAC/E,OAAO,EAAE,eAAe,EAAE,WAAW,EAAE,eAAe,EAAE,MAAM,4CAA4C,CAAC;AAC3G,MAAM,CAAC,MAAM,4BAA4B,GAAG,GAAG,CAAC;AAEhD,MAAM,kBAAkB,GAAG,CAAC,CAAC,OAAO,EAAE,CAAC;AAEvC,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,EAAE,eAAe,CAAC,CAAC;AAC3D,MAAM,WAAW,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,GAAG,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,WAAW,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;AAC5N,MAAM,YAAY,GAAG,CAAC,CAAC,MAAM,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,QAAQ,EAAE,eAAe,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,KAAK,EAAE,CAAC,CAAC,MAAM,CAAC,EAAE,OAAO,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,QAAQ,EAAE,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,GAAG,EAAE,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,QAAQ,EAAE,CAAC,KAAK,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;AACjR,MAAM,UAAU,GAAG,CAAC,KAAgB;IACnC,IAAI,CAAC;QAAC,OAAO,YAAY,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC,IAAI,IAAI,IAAI,CAAC;IAAC,CAAC;IAC1D,OAAO,KAAK,EAAE,CAAC;QAAC,OAAO,EAAE,OAAO,EAAE,gBAAgB,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;IAAC,CAAC;AAC1F,CAAC;AACD,MAAM,UAAU,WAAW,CAAC,KAAgB,EAAE,SAAS,GAAG,4BAA4B;IACrF,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,EAAE,CAAC;IACrD,IAAI,CAAC;QACJ,MAAM,MAAM,GAAG,eAAe,CAAC,eAAe,EAAE,KAAK,EAAE,wBAAwB,CAAC,CAAC;QACjF,MAAM,IAAI,GAAG,CAAC,CAAC,MAAM,EAAE,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAC1C,MAAM,UAAU,GAAG,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,EAAE,EAAE,QAAQ,EAAE,IAAI,CAAC,GAAG,CAAC,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC,IAAI,EAAE,CAAC;QAC5J,OAAO,UAAU,CAAC,MAAM,IAAI,SAAS,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,SAAS,IAAI,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,GAAG,UAAU,CAAC,KAAK,CAAC,CAAC,EAAE,SAAS,GAAG,CAAC,CAAC,CAAC,OAAO,EAAE,GAAG,CAAC;IAChI,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,MAAM,IAAI,eAAe,CAAC,sCAAsC,EAAE,eAAe,EAAE,EAAE,MAAM,EAAE,2BAA2B,EAAE,KAAK,EAAE,gBAAgB,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC;IAAC,CAAC;AAC5M,CAAC;AACD,SAAS,WAAW,CAAC,KAA8C;IAClE,MAAM,MAAM,GAAG,IAAI,eAAe,EAAE,CAAC;IACrC,KAAK,MAAM,CAAC,GAAG,EAAE,KAAK,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAAC,EAAE,CAAC;QACxD,IAAI,KAAK,KAAK,SAAS;YAAE,SAAS;QAClC,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;YAAE,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,EAAE,CAAC,MAAM,CAAC,MAAM,CAAC,GAAG,EAAE,IAAI,CAAC,CAAC,CAAC;;YACrE,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,KAAK,CAAC,CAAC,CAAC;IACrC,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,QAAQ,EAAE,CAAC;IAClC,OAAO,OAAO,CAAC,CAAC,CAAC,IAAI,OAAO,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;AACrC,CAAC;AACD,MAAM,UAAU,mBAAmB,CAAC,OAA2F;IAC9H,IAAI,CAAC;QACJ,MAAM,KAAK,GAAG,WAAW,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,IAAI,OAAO,CAAC,IAAI,CAAC,CAAC,IAAI,CAAC;QACxE,MAAM,MAAM,GAAG,YAAY,CAAC,SAAS,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;QAC3D,MAAM,MAAM,GAAG,KAAK,EAAE,MAAM,EAAE,WAAW,EAAE,IAAI,EAAE,EAAE,IAAI,GAAG,KAAK,EAAE,IAAI,IAAI,EAAE,EAAE,GAAG,GAAG,KAAK,EAAE,GAAG,IAAI,EAAE,CAAC;QACpG,MAAM,GAAG,GAAG,iBAAiB,CAAC,GAAG,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,GAAG,GAAG,GAAG,CAAC,CAAC,CAAC,EAAE,GAAG,IAAI,GAAG,WAAW,CAAC,KAAK,EAAE,KAAK,CAAC,EAAE,CAAC,CAAC;QACpG,MAAM,UAAU,GAAG,MAAM,EAAE,KAAK,EAAE,MAAM,IAAI,IAAI,EAAE,OAAO,GAAG,MAAM,EAAE,MAAM,CAAC;QAC3E,MAAM,MAAM,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,OAAO,KAAK,OAAO,IAAI,CAAC,UAAU,KAAK,IAAI,IAAI,UAAU,IAAI,GAAG,CAAC,CAAC;QAC3G,MAAM,WAAW,GAAG,UAAU,KAAK,IAAI,CAAC,CAAC,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,CAAC,OAAO,IAAI,EAAE,CAAC;QAC7E,MAAM,WAAW,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC,CAAC,MAAM,EAAE,KAAK,EAAE,OAAO,IAAI,OAAO,CAAC,KAAK,IAAI,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;QACzH,MAAM,KAAK,GAAG,iBAAiB,CAAC,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,aAAa,CAAC,CAAC;QAC3F,OAAO,EAAE,MAAM,EAAE,GAAG,EAAE,WAAW,EAAE,UAAU,EAAE,WAAW,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC;IAC7E,CAAC;IAAC,OAAO,KAAK,EAAE,CAAC;QAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,WAAW,EAAE,OAAO,EAAE,UAAU,EAAE,IAAI,EAAE,WAAW,EAAE,cAAc,EAAE,KAAK,EAAE,aAAa,EAAE,MAAM,EAAE,IAAI,EAAE,OAAO,EAAE,gBAAgB,CAAC,mBAAmB,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC;IAAC,CAAC;AAC1N,CAAC"}

package/dist/tools/api-request/schemas/index.d.ts

@@ -7,25 +7,32 @@ import * as z from 'zod/v4';
 export declare const apiRequestInputSchema: z.ZodObject<{
     method: z.ZodEnum<{
         GET: "GET";
-        DELETE: "DELETE";
         POST: "POST";
         PUT: "PUT";
         PATCH: "PATCH";
+        DELETE: "DELETE";
     }>;
     path: z.ZodString;
-    query: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
-    body: z.ZodOptional<z.ZodAny>;
+    query: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodOptional<z.ZodUnion<readonly [z.ZodString, z.ZodNumber, z.ZodBoolean, z.ZodArray<z.ZodString>]>>>>;
+    body: z.ZodOptional<z.ZodType<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue, z.core.$ZodTypeInternals<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue>>>;
     headers: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+    app: z.ZodOptional<z.ZodString>;
 }, z.core.$strip>;
 export declare const apiRequestOutputSchema: z.ZodObject<{
     status: z.ZodEnum<{
-        success: "success";
         error: "error";
+        success: "success";
     }>;
-    response: z.ZodOptional<z.ZodUnknown>;
+    response: z.ZodOptional<z.ZodType<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue, z.core.$ZodTypeInternals<import("@vibesdotdev/kernel/bootstrap").JsonValue, import("@vibesdotdev/kernel/bootstrap").JsonValue>>>;
     error: z.ZodOptional<z.ZodObject<{
         message: z.ZodString;
+        failure: z.ZodOptional<z.ZodObject<{
+            name: z.ZodString;
+            code: z.ZodOptional<z.ZodString>;
+            reason: z.ZodOptional<z.ZodString>;
+        }, z.core.$strip>>;
         code: z.ZodOptional<z.ZodString>;
+        status: z.ZodOptional<z.ZodNumber>;
     }, z.core.$strip>>;
 }, z.core.$strip>;
 export type ApiRequestInput = z.infer<typeof apiRequestInputSchema>;

package/dist/tools/api-request/schemas/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/tools/api-request/schemas/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAE5B,eAAO,MAAM,qBAAqB;;;;;;;;;;;;iBAMhC,CAAC;AAEH,eAAO,MAAM,sBAAsB;;;;;;;;;;iBASjC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../../src/tools/api-request/schemas/index.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAEH,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC;AAG5B,eAAO,MAAM,qBAAqB;;;;;;;;;;;;;iBAwBhC,CAAC;AAEH,eAAO,MAAM,sBAAsB;;;;;;;;;;;;;;;;iBAWjC,CAAC;AAEH,MAAM,MAAM,eAAe,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,qBAAqB,CAAC,CAAC;AACpE,MAAM,MAAM,gBAAgB,GAAG,CAAC,CAAC,KAAK,CAAC,OAAO,sBAAsB,CAAC,CAAC"}

package/dist/tools/api-request/schemas/index.js

@@ -4,20 +4,38 @@
  * Input/output schemas for the api-request tool.
  */
 import * as z from 'zod/v4';
+import { JsonValueSchema } from "../../../lib/client/internal/client-values.js";
 export const apiRequestInputSchema = z.object({
     method: z.enum(['GET', 'POST', 'PUT', 'PATCH', 'DELETE']),
-    path: z.string().min(1),
-    query: z.record(z.string(), z.any()).optional(),
-    body: z.any().optional(),
-    headers: z.record(z.string(), z.string()).optional()
+    path: z
+        .string()
+        .min(1)
+        .refine((path) => path.startsWith('/') && !path.startsWith('//'), {
+        message: 'Path must begin with one slash and cannot override the app origin.'
+    }),
+    query: z
+        .record(z.string(), z.union([z.string(), z.number(), z.boolean(), z.array(z.string())]).optional())
+        .optional(),
+    body: JsonValueSchema.optional(),
+    headers: z.record(z.string(), z.string()).optional(),
+    /**
+     * Target vibes app id (e.g. `account`, `platform`, `knowledge`, `ai`). The
+     * implementation requires this value and resolves it from the declared
+     * infra/service catalog for the configured service environment. It remains
+     * schema-optional so omission returns the stable APP_REQUIRED tool error
+     * instead of a generic validation failure.
+     */
+    app: z.string().min(1).optional()
 });
 export const apiRequestOutputSchema = z.object({
     status: z.enum(['success', 'error']),
-    response: z.unknown().optional(),
+    response: JsonValueSchema.optional(),
     error: z
         .object({
         message: z.string(),
-        code: z.string().optional()
+        failure: z.object({ name: z.string(), code: z.string().optional(), reason: z.string().optional() }).optional(),
+        code: z.string().optional(),
+        status: z.number().int().optional()
     })
         .optional()
 });