apps 0.0.1-beta.0 → 0.0.1-beta.1

package/js/{chunk-Q2FD5IBM.js → chunk-KOXMLKTM.js}

@@ -1,16 +1,29 @@
 import {
+  folderSkillsEffect
+} from "./chunk-ZTFQHGEB.js";
+import {
+  CacheEntry,
+  CacheError,
   authorDatabase,
+  cacheLimits,
   isApp,
   toEffectApp,
-  toPromise,
   unavailableStorage
-} from "./chunk-X3YBZCJW.js";
+} from "./chunk-RBAC33PQ.js";
+import {
+  fromPromise,
+  nativeOperation,
+  toPromise
+} from "./chunk-PZ36XMXW.js";
 import {
-  nativeOperation
-} from "./chunk-C24KEZXR.js";
+  parseProviderError
+} from "./chunk-ZJWDMTE3.js";
 import {
   DeclaredProvider,
   DeclaredRequirements,
+  ElicitationFailed,
+  ElicitationResponse,
+  FormElicitation,
   HostAccountsInvalid,
   HostDeclarationInvalid,
   HostError,
@@ -26,22 +39,19 @@ import {
   HostToolNotFound,
   HostToolPolicyFailed,
   HostedTool,
+  HostedToolSummary,
   HostedWebhook,
+  HostedWorkflow,
+  InvocationDeadline,
   ManualWebhookSetup,
+  ManyAccounts,
+  McpError,
+  NonRetryableError,
   OperationToolPrefixes,
   ResolvedAccounts,
   ToolResultObservation,
   TrustedToolApproval,
   WebhookResponseData,
-  defaultWebhookTransportLimits
-} from "./chunk-22WRQZT7.js";
-import {
-  ElicitationFailed,
-  ElicitationResponse,
-  FormElicitation,
-  HostedWorkflow,
-  ManyAccounts,
-  NonRetryableError,
   WorkflowDuration,
   WorkflowFailure,
   WorkflowName,
@@ -49,30 +59,44 @@ import {
   WorkflowStepOptions,
   WorkflowValue,
   approvalElicitation,
+  defaultWebhookTransportLimits,
+  maxInputProblems,
   workflowDurationMillis
-} from "./chunk-HP7E42X6.js";
+} from "./chunk-IHQ4ML7K.js";
+import {
+  AppSkills,
+  SkillFile,
+  SkillLoadFailed
+} from "./chunk-YEJOQEII.js";
+import {
+  OpenapiResponseError
+} from "./chunk-SWPD52J7.js";
 import {
   captureTelemetry,
   invocationFetch
-} from "./chunk-OWD2YICM.js";
+} from "./chunk-ZCAMUXSG.js";
 import {
+  decoderOf,
   importedJsonSchema,
   jsonSchemaDecoder
-} from "./chunk-BPEFS4YF.js";
+} from "./chunk-2HHMABB6.js";
 import {
   JsonObject,
   JsonValue
-} from "./chunk-36DNRFZQ.js";
+} from "./chunk-SATWJKN6.js";
 import {
   Cause_exports,
+  Clock_exports,
+  Duration_exports,
   Effect_exports,
   Encoding_exports,
   Match_exports,
   Option_exports,
   Redacted_exports,
+  SchemaIssue_exports,
   Schema_exports,
   Stream_exports
-} from "./chunk-2OTCEKL2.js";
+} from "./chunk-FW5HBOIK.js";
 
 // src/implementation/elicitation.ts
 var prepareElicitation = (input) => Effect_exports.gen(function* () {
@@ -156,7 +180,11 @@ var makeWorkflowContext = (execution, definition, fresh, signal) => Effect_expor
       Effect_exports.timeout(timeout),
       Effect_exports.catchTag(
         "TimeoutError",
-        () => Effect_exports.fail(new WorkflowFailure({ reason: "execution", retryable: true }))
+        () => (
+          // Both the capability deadline and the native engine deadline describe
+          // the same cancellation, regardless of which timer fires first.
+          Effect_exports.fail(new WorkflowFailure({ reason: "engine", retryable: true }))
+        )
       )
     );
   };
@@ -253,6 +281,23 @@ var makeWorkflowContext = (execution, definition, fresh, signal) => Effect_expor
   return { runId: execution.runId, step };
 });
 
+// src/implementation/input-problems.ts
+var leafHook = (issue) => SchemaIssue_exports.hasInput(issue) ? "Invalid value" : SchemaIssue_exports.defaultLeafHook(issue);
+var checkHook = (issue) => SchemaIssue_exports.hasInput(issue) || SchemaIssue_exports.hasInput(issue.issue) ? SchemaIssue_exports.defaultCheckHook(issue) ?? "Invalid value" : SchemaIssue_exports.defaultCheckHook(issue);
+var format = SchemaIssue_exports.makeFormatterStandardSchemaV1({ leafHook, checkHook });
+var segment = (key) => typeof key === "number" ? `[${key}]` : typeof key === "string" && /^[A-Za-z_$][\w$-]{0,63}$/.test(key) ? `.${key}` : "[key]";
+var inputInvalid = (error) => {
+  if (!Schema_exports.isSchemaError(error)) return new HostInputInvalid();
+  const problems = format(error.issue).issues.slice(0, maxInputProblems).map(({ path, message }) => {
+    const location = (path ?? []).map((key) => segment(typeof key === "object" ? key.key : key));
+    return `${location.length === 0 ? "input" : `input${location.join("")}`}: ${message}`.slice(
+      0,
+      512
+    );
+  });
+  return new HostInputInvalid({ problems });
+};
+
 // src/implementation/webhooks.ts
 var safe = (work, error) => Effect_exports.suspend(work).pipe(
   Effect_exports.catchCause(
@@ -407,6 +452,204 @@ var dispatchWebhook = (definition, command, context, accounts) => Effect_exports
   );
 });
 
+// ../app-cache/src/index.ts
+var canonical = (value) => {
+  if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
+  if (value !== null && typeof value === "object")
+    return `{${Object.entries(value).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([key, item]) => `${JSON.stringify(key)}:${canonical(item)}`).join(",")}}`;
+  return JSON.stringify(value);
+};
+var cacheKey = (key) => Effect_exports.gen(function* () {
+  const parsed = yield* Schema_exports.decodeUnknownEffect(Schema_exports.Json)(key).pipe(
+    Effect_exports.mapError(() => new CacheError({ reason: "invalid" }))
+  );
+  const bytes = new TextEncoder().encode(canonical(parsed));
+  if (bytes.byteLength > cacheLimits.keyBytes)
+    return yield* new CacheError({ reason: "capacity" });
+  const hash = yield* Effect_exports.tryPromise({
+    try: () => crypto.subtle.digest("SHA-256", bytes),
+    catch: () => new CacheError({ reason: "invalid" })
+  });
+  return [...new Uint8Array(hash)].map((byte) => byte.toString(16).padStart(2, "0")).join("");
+});
+var makeCache = (transport, background, scope = "shared") => {
+  const keyOf = (key) => cacheKey([scope, key]);
+  const readKeys = (keys) => transport({ operation: "read", keys }).pipe(
+    Effect_exports.flatMap(Schema_exports.decodeUnknownEffect(Schema_exports.Array(Schema_exports.NullOr(CacheEntry)))),
+    Effect_exports.mapError(() => new CacheError({ reason: "storage" }))
+  );
+  const durations = (freshFor, staleFor = 0) => Effect_exports.try({
+    try: () => {
+      const fresh = Duration_exports.toMillis(Duration_exports.fromInputUnsafe(freshFor));
+      const stale = Duration_exports.toMillis(Duration_exports.fromInputUnsafe(staleFor));
+      if (![fresh, stale].every((value) => Number.isFinite(value) && value >= 0) || fresh + stale > cacheLimits.retentionMs)
+        throw new CacheError({ reason: "invalid" });
+      return { fresh, stale };
+    },
+    catch: () => new CacheError({ reason: "invalid" })
+  });
+  const get = (options, refresh) => Effect_exports.gen(function* () {
+    const key = yield* keyOf(options.key);
+    const { fresh, stale } = yield* durations(options.freshFor, options.staleFor);
+    const decode = (value) => Schema_exports.decodeUnknownEffect(options.schema)(value);
+    const load = (lease) => Effect_exports.gen(function* () {
+      const value = yield* options.load.pipe(Effect_exports.flatMap(decode));
+      const json = yield* Schema_exports.decodeUnknownEffect(Schema_exports.Json)(value).pipe(
+        Effect_exports.mapError(() => new CacheError({ reason: "invalid" }))
+      );
+      const now = yield* Clock_exports.currentTimeMillis;
+      const published = yield* transport({
+        operation: "publish",
+        key,
+        lease,
+        entry: {
+          value: json,
+          version: crypto.randomUUID(),
+          freshUntil: now + fresh,
+          staleUntil: now + fresh + stale
+        }
+      });
+      if (published !== true) return yield* new CacheError({ reason: "unavailable" });
+      return value;
+    }).pipe(
+      Effect_exports.withSpan("app.cache.load"),
+      Effect_exports.timeout(cacheLimits.loadTimeoutMs),
+      Effect_exports.ensuring(
+        transport({ operation: "release", key, lease }).pipe(Effect_exports.catch(() => Effect_exports.void))
+      )
+    );
+    const deadline = (yield* Clock_exports.currentTimeMillis) + cacheLimits.leaseMs;
+    let initialVersion;
+    while (true) {
+      const entry = (yield* readKeys([key]))[0] ?? null;
+      const now = yield* Clock_exports.currentTimeMillis;
+      if (initialVersion === void 0) initialVersion = entry?.version ?? null;
+      const refreshed = refresh && entry !== null && entry.version !== initialVersion;
+      if (entry !== null && (refreshed || !refresh && now < entry.freshUntil)) {
+        yield* Effect_exports.annotateCurrentSpan("cache.result", "fresh");
+        return yield* decode(entry.value);
+      }
+      const lease = yield* transport({
+        operation: "claim",
+        key,
+        version: entry?.version ?? null
+      }).pipe(Effect_exports.flatMap(Schema_exports.decodeUnknownEffect(Schema_exports.NullOr(Schema_exports.String))));
+      if (!refresh && entry !== null && now < entry.staleUntil) {
+        yield* Effect_exports.annotateCurrentSpan("cache.result", "stale");
+        if (lease !== null) yield* background(load(lease).pipe(Effect_exports.asVoid));
+        return yield* decode(entry.value);
+      }
+      if (lease !== null) {
+        yield* Effect_exports.annotateCurrentSpan("cache.result", "miss");
+        return yield* load(lease);
+      }
+      if (now >= deadline) return yield* new CacheError({ reason: "timeout" });
+      yield* Effect_exports.sleep("100 millis");
+    }
+  }).pipe(Effect_exports.withSpan("app.cache.get"));
+  return {
+    /** Read arbitrary retained JSON entries without initiating a refresh. Missing and null are distinct. */
+    read: (keys) => Effect_exports.forEach(keys, keyOf).pipe(Effect_exports.flatMap(readKeys)),
+    /** Publish bounded immutable parts before publishing the manifest that references them. */
+    write: (entries, retention) => Effect_exports.gen(function* () {
+      const { fresh } = yield* durations(retention);
+      const now = yield* Clock_exports.currentTimeMillis;
+      const values = yield* Effect_exports.forEach(
+        entries,
+        ({ key, value }) => Effect_exports.gen(function* () {
+          return {
+            key: yield* keyOf(key),
+            entry: {
+              value,
+              version: crypto.randomUUID(),
+              freshUntil: now + fresh,
+              staleUntil: now + fresh
+            }
+          };
+        })
+      );
+      yield* transport({ operation: "write", entries: values });
+    }),
+    /** Revoke retained data and any loader's right to publish its in-flight result. */
+    invalidate: (key) => keyOf(key).pipe(
+      Effect_exports.flatMap((key2) => transport({ operation: "invalidate", key: key2 })),
+      Effect_exports.asVoid
+    ),
+    /** Read fresh data, refresh stale data in the background, or wait for the lease owner. */
+    get: (options) => get(options, false),
+    /** Force one awaited refresh without removing the retained value. Concurrent refreshes share a load. */
+    revalidate: (options) => get(options, true)
+  };
+};
+
+// src/implementation/cache.ts
+var unavailableCache = {
+  transport: () => Effect_exports.fail(new CacheError({ reason: "unavailable" })),
+  background: () => Effect_exports.die(new Error("Cache background runner is unavailable"))
+};
+var authorCache = (host, accounts, signal) => {
+  const scoped = (scope, callerSignal = signal) => {
+    const cache = makeCache(host.transport, host.background, scope);
+    const load = (method, options) => cache[method]({
+      key: options.key,
+      schema: decoderOf(options.schema),
+      freshFor: options.freshFor,
+      ...options.staleFor === void 0 ? {} : { staleFor: options.staleFor },
+      load: Effect_exports.acquireUseRelease(
+        Effect_exports.sync(() => new AbortController()),
+        (controller) => invocationFetch(controller.signal).pipe(
+          Effect_exports.flatMap(
+            (fetch) => fromPromise(options.load)({
+              fetch,
+              signal: controller.signal,
+              cache: scoped(scope, controller.signal)
+            })
+          )
+        ),
+        (controller) => Effect_exports.sync(() => controller.abort())
+      )
+    });
+    return {
+      get: toPromise((options) => load("get", options), callerSignal),
+      revalidate: toPromise(
+        (options) => load("revalidate", options),
+        callerSignal
+      ),
+      read: toPromise(
+        (key, schema) => cache.read([key]).pipe(
+          Effect_exports.flatMap((entries) => {
+            const entry = entries[0];
+            return entry === void 0 || entry === null ? Effect_exports.succeed(void 0) : Schema_exports.decodeUnknownEffect(decoderOf(schema))(entry.value);
+          })
+        ),
+        callerSignal
+      ),
+      readMany: toPromise(
+        (keys, schema) => cache.read(keys).pipe(
+          Effect_exports.flatMap(
+            (entries) => Effect_exports.forEach(
+              entries,
+              (entry) => entry === null ? Effect_exports.succeed(void 0) : Schema_exports.decodeUnknownEffect(decoderOf(schema))(entry.value)
+            )
+          )
+        ),
+        callerSignal
+      ),
+      write: toPromise(cache.write, callerSignal),
+      invalidate: toPromise(cache.invalidate, callerSignal),
+      forAccount: (account) => {
+        const bound = Object.values(accounts).flatMap((value) => Array.isArray(value) ? value : [value]).find((value) => value.id === account.id);
+        if (bound === void 0) throw new CacheError({ reason: "invalid" });
+        return scoped(
+          { account: bound.id, method: bound.method, fields: bound.fields },
+          callerSignal
+        );
+      }
+    };
+  };
+  return scoped("shared");
+};
+
 // src/implementation/host.ts
 function safe2(work, failure) {
   return Effect_exports.suspend(work).pipe(
@@ -415,6 +658,18 @@ function safe2(work, failure) {
     )
   );
 }
+var evaluationSafe = (work) => work.pipe(
+  Effect_exports.catchCause((cause) => {
+    if (Cause_exports.hasInterrupts(cause)) return Effect_exports.interrupt;
+    const error = Cause_exports.squash(cause);
+    const provider = parseProviderError(error);
+    const skills = parseSkillLoadFailed(error);
+    const mcp = parseMcpError(error);
+    return Effect_exports.fail(
+      Option_exports.isSome(provider) ? provider.value : Option_exports.isSome(skills) ? skills.value : Option_exports.isSome(mcp) ? mcp.value : new HostEvaluationFailed()
+    );
+  })
+);
 function jsonSchema(decoder) {
   const imported = importedJsonSchema(decoder);
   if (imported !== void 0) return Schema_exports.decodeUnknownEffect(JsonObject)(imported);
@@ -468,14 +723,15 @@ function requirements(slots, database) {
     }
     return yield* Schema_exports.decodeUnknownEffect(DeclaredRequirements)({
       accounts: Object.fromEntries(accounts),
+      capabilities: { skills: true, toolIndex: true, skillSources: true, scheduledTools: true },
       ...database === void 0 ? {} : { database }
     }).pipe(Effect_exports.mapError(() => new HostDeclarationInvalid()));
   });
 }
-function canonical(value) {
-  if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
+function canonical2(value) {
+  if (Array.isArray(value)) return `[${value.map(canonical2).join(",")}]`;
   if (value !== null && typeof value === "object") {
-    return `{${Object.entries(value).sort(([a], [b]) => a.localeCompare(b)).map(([key, item]) => `${JSON.stringify(key)}:${canonical(item)}`).join(",")}}`;
+    return `{${Object.entries(value).sort(([a], [b]) => a.localeCompare(b)).map(([key, item]) => `${JSON.stringify(key)}:${canonical2(item)}`).join(",")}}`;
   }
   return JSON.stringify(value);
 }
@@ -504,7 +760,7 @@ function bindAccounts(slots, declarations, context) {
         for (const account of accounts) {
           if (ids.has(account.id)) return yield* Effect_exports.fail(new HostAccountsInvalid());
           ids.add(account.id);
-          if (canonical(account.provider) !== canonical(requirement.definition) || !Object.hasOwn(provider.auth, account.method))
+          if (canonical2(account.provider) !== canonical2(requirement.definition) || !Object.hasOwn(provider.auth, account.method))
             return yield* Effect_exports.fail(new HostAccountsInvalid());
           const method = provider.auth[account.method];
           if (method === void 0) return yield* Effect_exports.fail(new HostAccountsInvalid());
@@ -541,6 +797,26 @@ function dispatch(app, request, context, signal) {
         (controller) => Effect_exports.sync(() => controller.abort())
       );
       const invocationSignal = AbortSignal.any([signal, lifetime.signal]);
+      const deadline = context.deadline === void 0 ? void 0 : yield* safe2(
+        () => Schema_exports.decodeUnknownEffect(InvocationDeadline)(context.deadline),
+        new HostInputInvalid()
+      );
+      const withinDeadline = (work) => Effect_exports.gen(function* () {
+        if (deadline === void 0) return yield* work;
+        const remaining = deadline - (yield* Clock_exports.currentTimeMillis);
+        if (remaining <= 0)
+          return yield* new WorkflowFailure({ reason: "engine", retryable: true });
+        const result = yield* work.pipe(
+          Effect_exports.timeout(remaining),
+          Effect_exports.catchTag(
+            "TimeoutError",
+            () => Effect_exports.fail(new WorkflowFailure({ reason: "engine", retryable: true }))
+          )
+        );
+        if ((yield* Clock_exports.currentTimeMillis) >= deadline)
+          return yield* new WorkflowFailure({ reason: "engine", retryable: true });
+        return result;
+      });
       let running;
       let transactionOpen = false;
       const delivery = (request2, signal2) => Effect_exports.suspend(
@@ -572,7 +848,16 @@ function dispatch(app, request, context, signal) {
         get: workflowControls.get,
         list: workflowControls.list
       };
+      const files = yield* Schema_exports.decodeUnknownEffect(Schema_exports.Array(SkillFile))(
+        context.files ?? []
+      ).pipe(Effect_exports.mapError(() => new HostDeclarationInvalid()));
       const bound = {
+        cache: authorCache(
+          context.cache ?? unavailableCache,
+          Redacted_exports.value(context.accounts),
+          invocationSignal
+        ),
+        files,
         ...yield* bindAccounts(native.accounts, declared, context).pipe(
           Effect_exports.withSpan("app.accounts.bind")
         ),
@@ -581,10 +866,22 @@ function dispatch(app, request, context, signal) {
         fetch: yield* invocationFetch(invocationSignal),
         elicit: makeElicit(delivery, invocationSignal)
       };
-      const definition = yield* safe2(
-        () => native.evaluate(bound).pipe(Effect_exports.withSpan("app.evaluate")),
-        new HostEvaluationFailed()
+      const definition = yield* evaluationSafe(native.evaluate(bound)).pipe(
+        Effect_exports.withSpan("app.evaluate")
       );
+      if (request.operation === "skills") {
+        const declared2 = definition.skills ?? (yield* folderSkillsEffect({ files }).pipe(
+          Effect_exports.mapError(() => new HostDeclarationInvalid())
+        ));
+        const source2 = definition.dynamicSkills;
+        const dynamic = source2 === void 0 ? [] : yield* evaluationSafe(Effect_exports.suspend(source2.list)).pipe(
+          Effect_exports.withSpan("app.skills.load")
+        );
+        const skills = yield* Schema_exports.decodeUnknownEffect(AppSkills)([...declared2, ...dynamic]).pipe(
+          Effect_exports.mapError(() => new HostDeclarationInvalid())
+        );
+        return request.sources === true ? { skills, dynamic: source2 !== void 0 } : skills;
+      }
       if (request.operation === "workflows") {
         return yield* Effect_exports.forEach(
           Object.entries(definition.workflows ?? {}),
@@ -628,6 +925,12 @@ function dispatch(app, request, context, signal) {
             );
             return {
               ...accounts,
+              cache: authorCache(
+                context.cache ?? unavailableCache,
+                Redacted_exports.value(current.accounts),
+                signal2
+              ),
+              files,
               fetch: yield* invocationFetch(signal2),
               signal: signal2,
               runId: execution.runId,
@@ -649,24 +952,34 @@ function dispatch(app, request, context, signal) {
         );
       }
       if (request.operation === "inspect") {
+        const summary = request.detail === "summary";
+        const wanted = request.tools === void 0 ? void 0 : new Set(request.tools);
         const metadata = [];
         for (const [prefix, readOnly, catalog2] of [
           [OperationToolPrefixes.query, true, definition.queries],
           [OperationToolPrefixes.mutate, false, definition.mutations]
         ]) {
           for (const [name2, operation] of Object.entries(catalog2 ?? {})) {
+            if (wanted !== void 0 && !wanted.has(`${prefix}${name2}`)) continue;
+            const schedules = Object.entries(definition.schedules ?? {}).filter(([, schedule]) => schedule.tool === `${prefix}${name2}`).map(([name3, { tool: _tool, ...schedule }]) => ({ name: name3, ...schedule }));
+            if (request.scheduled === true && schedules.length === 0) continue;
             metadata.push(
               yield* safe2(
                 () => Effect_exports.gen(function* () {
-                  return yield* Schema_exports.decodeUnknownEffect(HostedTool)({
+                  const fields = {
                     name: `${prefix}${name2}`,
-                    schedules: Object.entries(definition.schedules ?? {}).filter(([, schedule]) => schedule.tool === `${prefix}${name2}`).map(([name3, { tool: _tool, ...schedule }]) => ({ name: name3, ...schedule })),
+                    schedules,
                     description: operation.description ?? `${readOnly ? "Query" : "Mutate"} ${name2}`,
                     ...operation.title === void 0 ? {} : { title: operation.title },
+                    readOnly,
+                    annotations: { ...operation.annotations, readOnlyHint: readOnly }
+                  };
+                  if (summary)
+                    return yield* Schema_exports.decodeUnknownEffect(HostedToolSummary)(fields);
+                  return yield* Schema_exports.decodeUnknownEffect(HostedTool)({
+                    ...fields,
                     inputSchema: yield* jsonSchema(operation.input),
                     ...operation.output === void 0 ? operation.outputSchema === void 0 ? {} : { outputSchema: operation.outputSchema } : { outputSchema: yield* jsonSchema(operation.output) },
-                    readOnly,
-                    annotations: { ...operation.annotations, readOnlyHint: readOnly },
                     ...operation._meta === void 0 ? {} : { _meta: operation._meta }
                   });
                 }),
@@ -675,6 +988,43 @@ function dispatch(app, request, context, signal) {
             );
           }
         }
+        const dynamic = request.scheduled === true ? void 0 : definition.dynamicTools;
+        if (dynamic !== void 0 && (wanted === void 0 || metadata.length < wanted.size)) {
+          const declared2 = new Set(metadata.map((tool2) => tool2.name));
+          const discover = () => {
+            if (summary && dynamic.summaries !== void 0) return dynamic.summaries();
+            if (wanted !== void 0 && dynamic.describe !== void 0) {
+              const describe = dynamic.describe;
+              return Effect_exports.forEach(
+                [...wanted].filter((name2) => !declared2.has(name2)),
+                (name2) => describe(name2),
+                { concurrency: "unbounded" }
+              ).pipe(Effect_exports.map((tools) => tools.filter((tool2) => tool2 !== void 0)));
+            }
+            return dynamic.list();
+          };
+          const discovered = yield* evaluationSafe(discover()).pipe(
+            Effect_exports.flatMap(
+              (value) => safe2(
+                () => summary ? Schema_exports.decodeUnknownEffect(Schema_exports.Array(HostedToolSummary))(value) : Schema_exports.decodeUnknownEffect(Schema_exports.Array(HostedTool))(value),
+                new HostDeclarationInvalid()
+              )
+            )
+          );
+          const names = new Set(declared2);
+          for (const tool2 of discovered) {
+            const readOnly = tool2.name.startsWith(OperationToolPrefixes.query);
+            if (!readOnly && !tool2.name.startsWith(OperationToolPrefixes.mutate) || tool2.name === OperationToolPrefixes.query || tool2.name === OperationToolPrefixes.mutate || names.has(tool2.name))
+              return yield* new HostDeclarationInvalid();
+            names.add(tool2.name);
+            if (wanted !== void 0 && !wanted.has(tool2.name)) continue;
+            metadata.push({
+              ...tool2,
+              readOnly,
+              annotations: { ...tool2.annotations, readOnlyHint: readOnly }
+            });
+          }
+        }
         return metadata;
       }
       if (request.operation === "webhook-complete" || request.operation === "webhook-validate" || request.operation === "webhooks" || request.operation === "webhook-register" || request.operation === "webhook-handle" || request.operation === "webhook-unregister") {
@@ -682,6 +1032,8 @@ function dispatch(app, request, context, signal) {
           definition,
           request,
           {
+            files,
+            cache: bound.cache,
             accounts: bound.accounts,
             workflows: workflowControls,
             signal: bound.signal,
@@ -708,12 +1060,20 @@ function dispatch(app, request, context, signal) {
       const name = request.operation === "call" ? request.tool.slice(OperationToolPrefixes[kind].length) : request.name;
       const toolName = `${OperationToolPrefixes[kind]}${name}`;
       const catalog = kind === "query" ? definition.queries : definition.mutations;
-      const tool = catalog !== void 0 && Object.hasOwn(catalog, name) ? catalog[name] : void 0;
+      const declaredTool = catalog !== void 0 && Object.hasOwn(catalog, name) ? catalog[name] : void 0;
+      const source = definition.dynamicTools;
+      const resolvedTool = source === void 0 || declaredTool !== void 0 ? void 0 : yield* evaluationSafe(source.resolve(toolName));
+      const tool = declaredTool ?? resolvedTool;
+      if (tool !== void 0 && tool.kind !== (kind === "query" ? "query" : "mutation"))
+        return yield* new HostDeclarationInvalid();
       if (tool === void 0)
         return yield* request.operation === "call" ? new HostToolNotFound() : new HostOperationNotFound();
-      const input = yield* safe2(
-        () => Schema_exports.decodeUnknownEffect(tool.input)(request.input),
-        new HostInputInvalid()
+      const input = yield* Effect_exports.suspend(
+        () => Schema_exports.decodeUnknownEffect(tool.input)(request.input)
+      ).pipe(
+        Effect_exports.catchCause(
+          (cause) => Cause_exports.hasInterrupts(cause) ? Effect_exports.interrupt : Effect_exports.fail(inputInvalid(Cause_exports.squash(cause)))
+        )
       );
       if (context.approval !== void 0) {
         const approved = yield* safe2(
@@ -779,9 +1139,6 @@ function dispatch(app, request, context, signal) {
             input
           );
         }).pipe(
-          Effect_exports.withSpan("app.operation.execute", {
-            attributes: { "executor.tool.name": toolName, "executor.operation": kind }
-          }),
           Effect_exports.ensuring(
             Effect_exports.sync(() => {
               running = void 0;
@@ -789,10 +1146,21 @@ function dispatch(app, request, context, signal) {
           ),
           Effect_exports.catchCause((cause) => {
             if (Cause_exports.hasInterrupts(cause)) return Effect_exports.interrupt;
-            const failure = Schema_exports.decodeUnknownOption(ElicitationFailed)(Cause_exports.squash(cause));
+            const error = Cause_exports.squash(cause);
+            const provider = parseProviderError(error);
+            const response = Schema_exports.decodeUnknownOption(OpenapiResponseError)(error);
+            const failure = Schema_exports.decodeUnknownOption(ElicitationFailed)(error);
             return Effect_exports.fail(
-              Option_exports.isSome(failure) ? failure.value : new HostOperationFailed()
+              Option_exports.isSome(provider) ? provider.value : Option_exports.isSome(response) ? new OpenapiResponseError({
+                code: response.value.code,
+                status: response.value.status,
+                message: response.value.message,
+                ...response.value.recovery === void 0 ? {} : { recovery: response.value.recovery }
+              }) : Option_exports.isSome(failure) ? failure.value : new HostOperationFailed()
             );
+          }),
+          Effect_exports.withSpan("app.operation.execute", {
+            attributes: { "executor.tool.name": toolName, "executor.operation": kind }
           })
         );
         const outputSchema = tool.output;
@@ -810,11 +1178,13 @@ function dispatch(app, request, context, signal) {
         new HostInputInvalid()
       );
       if (replay !== void 0 && kind !== "mutate") return yield* new HostInputInvalid();
-      if (native.database === void 0) return yield* execute();
+      if (native.database === void 0) return yield* withinDeadline(execute());
       const storage = context.storage ?? unavailableStorage;
       return yield* storage[kind === "query" ? "read" : "mutate"](
         native.database.schema,
-        (db) => replay === void 0 ? execute(db) : db.once(replay.key, replay.fingerprint, () => execute(db))
+        (db) => withinDeadline(
+          replay === void 0 ? execute(db) : db.once(replay.key, replay.fingerprint, () => execute(db))
+        )
       ).pipe(
         Effect_exports.catchTags({
           AppDatabaseError: () => Effect_exports.fail(new HostOperationFailed()),
@@ -825,8 +1195,26 @@ function dispatch(app, request, context, signal) {
     })
   );
 }
+var parseSkillLoadFailed = (error) => Schema_exports.decodeUnknownOption(SkillLoadFailed)(error).pipe(
+  Option_exports.map(
+    ({ reason, message, status }) => new SkillLoadFailed({
+      reason,
+      ...message ? { message } : {},
+      ...status === void 0 ? {} : { status }
+    })
+  )
+);
+var parseMcpError = (error) => Schema_exports.decodeUnknownOption(McpError)(error).pipe(
+  Option_exports.map(
+    ({ phase, reason, status }) => new McpError({ phase, reason, ...status === void 0 ? {} : { status } })
+  )
+);
 var errorStatus = Match_exports.type().pipe(
   Match_exports.tagsExhaustive({
+    ProviderError: () => 502,
+    McpError: () => 502,
+    SkillLoadFailed: () => 502,
+    OpenapiResponseError: () => 502,
     WorkflowFailure: () => 422,
     HostRequestInvalid: () => 400,
     HostAccountsInvalid: () => 422,
@@ -895,5 +1283,6 @@ var createAppHandler = (app) => (request, context) => Effect_exports.gen(functio
 export {
   prepareElicitation,
   ApprovalDecision,
+  cacheKey,
   createAppHandler
 };