apps 0.0.1-beta.0

package/js/chunk-Q2FD5IBM.js

@@ -0,0 +1,899 @@
+import {
+  authorDatabase,
+  isApp,
+  toEffectApp,
+  toPromise,
+  unavailableStorage
+} from "./chunk-X3YBZCJW.js";
+import {
+  nativeOperation
+} from "./chunk-C24KEZXR.js";
+import {
+  DeclaredProvider,
+  DeclaredRequirements,
+  HostAccountsInvalid,
+  HostDeclarationInvalid,
+  HostError,
+  HostEvaluationFailed,
+  HostInputInvalid,
+  HostOperationFailed,
+  HostOperationNotFound,
+  HostOutputInvalid,
+  HostRequest,
+  HostRequestInvalid,
+  HostToolApprovalRequired,
+  HostToolBlocked,
+  HostToolNotFound,
+  HostToolPolicyFailed,
+  HostedTool,
+  HostedWebhook,
+  ManualWebhookSetup,
+  OperationToolPrefixes,
+  ResolvedAccounts,
+  ToolResultObservation,
+  TrustedToolApproval,
+  WebhookResponseData,
+  defaultWebhookTransportLimits
+} from "./chunk-22WRQZT7.js";
+import {
+  ElicitationFailed,
+  ElicitationResponse,
+  FormElicitation,
+  HostedWorkflow,
+  ManyAccounts,
+  NonRetryableError,
+  WorkflowDuration,
+  WorkflowFailure,
+  WorkflowName,
+  WorkflowReplay,
+  WorkflowStepOptions,
+  WorkflowValue,
+  approvalElicitation,
+  workflowDurationMillis
+} from "./chunk-HP7E42X6.js";
+import {
+  captureTelemetry,
+  invocationFetch
+} from "./chunk-OWD2YICM.js";
+import {
+  importedJsonSchema,
+  jsonSchemaDecoder
+} from "./chunk-BPEFS4YF.js";
+import {
+  JsonObject,
+  JsonValue
+} from "./chunk-36DNRFZQ.js";
+import {
+  Cause_exports,
+  Effect_exports,
+  Encoding_exports,
+  Match_exports,
+  Option_exports,
+  Redacted_exports,
+  Schema_exports,
+  Stream_exports
+} from "./chunk-2OTCEKL2.js";
+
+// src/implementation/elicitation.ts
+var prepareElicitation = (input) => Effect_exports.gen(function* () {
+  const request = yield* Schema_exports.decodeUnknownEffect(FormElicitation)(input, {
+    onExcessProperty: "error"
+  }).pipe(Effect_exports.mapError(() => new ElicitationFailed({ reason: "invalid-request" })));
+  const content = yield* jsonSchemaDecoder(request.requestedSchema).pipe(
+    Effect_exports.mapError(() => new ElicitationFailed({ reason: "invalid-request" }))
+  );
+  const respond = (input2) => Effect_exports.gen(function* () {
+    const response = yield* Schema_exports.decodeUnknownEffect(ElicitationResponse)(input2).pipe(
+      Effect_exports.catchTag(
+        "SchemaError",
+        () => Effect_exports.fail(new ElicitationFailed({ reason: "invalid-response" }))
+      )
+    );
+    if (response.action === "accept") {
+      const fields = response.content === void 0 ? {} : response.content;
+      yield* Schema_exports.decodeUnknownEffect(content)(fields).pipe(
+        Effect_exports.mapError(() => new ElicitationFailed({ reason: "invalid-response" }))
+      );
+      return { ...response, content: fields };
+    }
+    return response;
+  });
+  return { request, respond };
+});
+var makeElicit = (handler, signal) => toPromise(
+  (input) => Effect_exports.gen(function* () {
+    if (handler === void 0) return yield* new ElicitationFailed({ reason: "unavailable" });
+    const form = yield* prepareElicitation(input);
+    return yield* handler(form.request, signal).pipe(Effect_exports.flatMap(form.respond));
+  }),
+  signal
+);
+
+// src/contracts/approval.ts
+var ApprovalDecision = Schema_exports.Literals(["approved", "denied", "user-approval"]);
+
+// src/implementation/workflow-context.ts
+var workflowSafe = (work) => work.pipe(
+  Effect_exports.catchCause((cause) => {
+    if (Cause_exports.hasInterrupts(cause)) return Effect_exports.interrupt;
+    const error = Cause_exports.squash(cause);
+    if (Schema_exports.is(WorkflowFailure)(error)) return Effect_exports.fail(error);
+    return Effect_exports.fail(
+      new WorkflowFailure({
+        reason: "execution",
+        retryable: !(error instanceof NonRetryableError)
+      })
+    );
+  })
+);
+var makeWorkflowContext = (execution, definition, fresh, signal) => Effect_exports.gen(function* () {
+  const services = yield* Effect_exports.context();
+  const counts = /* @__PURE__ */ new Map();
+  const identify = (kind, name) => Effect_exports.gen(function* () {
+    yield* Schema_exports.decodeUnknownEffect(WorkflowName)(name).pipe(
+      Effect_exports.mapError(() => new WorkflowFailure({ reason: "input", retryable: false }))
+    );
+    const key = JSON.stringify([kind, name]);
+    const count = (counts.get(key) ?? 0) + 1;
+    counts.set(key, count);
+    const digest = yield* Effect_exports.tryPromise({
+      try: () => crypto.subtle.digest(
+        "SHA-256",
+        new TextEncoder().encode(JSON.stringify([execution.runId, kind, name, count]))
+      ),
+      catch: () => new WorkflowFailure({ reason: "execution", retryable: false })
+    });
+    return Array.from(
+      new Uint8Array(digest),
+      (byte) => byte.toString(16).padStart(2, "0")
+    ).join("");
+  });
+  const attempt = (options, work) => {
+    const timeout = workflowDurationMillis(options.timeout ?? "10 minutes");
+    if (timeout === void 0)
+      return Effect_exports.fail(new WorkflowFailure({ reason: "input", retryable: false }));
+    return work.pipe(
+      Effect_exports.timeout(timeout),
+      Effect_exports.catchTag(
+        "TimeoutError",
+        () => Effect_exports.fail(new WorkflowFailure({ reason: "execution", retryable: true }))
+      )
+    );
+  };
+  const runStep = (name, options, callback) => Effect_exports.gen(function* () {
+    const stepId = yield* identify("do", name);
+    const parsed = yield* Schema_exports.decodeUnknownEffect(WorkflowStepOptions)(options).pipe(
+      Effect_exports.mapError(() => new WorkflowFailure({ reason: "input", retryable: false }))
+    );
+    return yield* execution.driver.do(
+      `do:${name.slice(0, 100)}:${stepId}`,
+      parsed,
+      () => attempt(
+        parsed,
+        Effect_exports.scoped(
+          Effect_exports.gen(function* () {
+            const controller = yield* Effect_exports.acquireRelease(
+              Effect_exports.sync(() => new AbortController()),
+              (controller2) => Effect_exports.sync(() => controller2.abort())
+            );
+            const ctx = yield* fresh(stepId, AbortSignal.any([signal, controller.signal]));
+            const result = yield* workflowSafe(
+              Effect_exports.tryPromise({ try: () => callback(ctx), catch: (error) => error })
+            );
+            return yield* Schema_exports.decodeUnknownEffect(WorkflowValue)(result).pipe(
+              Effect_exports.mapError(
+                () => new WorkflowFailure({ reason: "output", retryable: false })
+              )
+            );
+          })
+        ).pipe(Effect_exports.provideContext(services))
+      )
+    );
+  });
+  const operationStep = (kind, name, operation, input, options) => Effect_exports.gen(function* () {
+    const target = nativeOperation(operation);
+    const catalog = kind === "query" ? definition.queries : definition.mutations;
+    const match = Object.entries(catalog ?? {}).find(
+      ([, value]) => value === target && value.kind === kind
+    );
+    if (target === void 0 || match === void 0)
+      return yield* new WorkflowFailure({ reason: "operation", retryable: false });
+    const args = yield* Schema_exports.decodeUnknownEffect(JsonValue)(input).pipe(
+      Effect_exports.mapError(() => new WorkflowFailure({ reason: "input", retryable: false }))
+    );
+    const parsed = yield* Schema_exports.decodeUnknownEffect(WorkflowStepOptions)(options).pipe(
+      Effect_exports.mapError(() => new WorkflowFailure({ reason: "input", retryable: false }))
+    );
+    const stepId = yield* identify(kind, name);
+    const timeout = workflowDurationMillis(parsed.timeout ?? "10 minutes");
+    if (timeout === void 0)
+      return yield* new WorkflowFailure({ reason: "input", retryable: false });
+    return yield* execution.driver.do(
+      `${kind}:${name.slice(0, 100)}:${stepId}`,
+      parsed,
+      () => attempt(
+        parsed,
+        execution.invoke({ kind, name: match[0], input: args, stepId, timeout }).pipe(Effect_exports.provideContext(services))
+      )
+    );
+  });
+  const invoke = (effect) => toPromise(() => effect.pipe(Effect_exports.provideContext(services)), signal)();
+  const step = {
+    do: (name, options, run) => {
+      const callback = typeof options === "function" ? options : run;
+      if (callback === void 0)
+        return Promise.reject(new WorkflowFailure({ reason: "input", retryable: false }));
+      return invoke(runStep(name, typeof options === "function" ? {} : options, callback));
+    },
+    runQuery: (name, operation, input, options = {}) => invoke(operationStep("query", name, operation, input, options)),
+    runMutation: (name, operation, input, options = {}) => invoke(operationStep("mutation", name, operation, input, options)),
+    sleep: (name, duration) => invoke(
+      Schema_exports.decodeUnknownEffect(WorkflowDuration)(duration).pipe(
+        Effect_exports.mapError(() => new WorkflowFailure({ reason: "input", retryable: false })),
+        Effect_exports.flatMap(
+          (parsed) => identify("sleep", name).pipe(
+            Effect_exports.flatMap(
+              (id) => execution.driver.sleep(`sleep:${name.slice(0, 100)}:${id}`, parsed)
+            )
+          )
+        )
+      )
+    ),
+    sleepUntil: (name, timestamp) => invoke(
+      identify("until", name).pipe(
+        Effect_exports.flatMap(
+          (id) => execution.driver.sleepUntil(
+            `until:${name.slice(0, 100)}:${id}`,
+            timestamp instanceof Date ? timestamp.getTime() : timestamp
+          )
+        )
+      )
+    )
+  };
+  return { runId: execution.runId, step };
+});
+
+// src/implementation/webhooks.ts
+var safe = (work, error) => Effect_exports.suspend(work).pipe(
+  Effect_exports.catchCause(
+    (cause) => Cause_exports.hasInterrupts(cause) ? Effect_exports.interrupt : Effect_exports.fail(error)
+  )
+);
+var dispatchWebhook = (definition, command, context, accounts) => Effect_exports.gen(function* () {
+  const hooks = definition.webhooks ?? {};
+  if (command.operation === "webhooks") {
+    return yield* Effect_exports.forEach(
+      Object.entries(hooks),
+      ([name, hook2]) => safe(
+        () => Effect_exports.gen(function* () {
+          if (!Object.hasOwn(accounts, hook2.account))
+            return yield* new HostDeclarationInvalid();
+          const describe = (schema) => {
+            const imported = importedJsonSchema(schema);
+            if (imported !== void 0) return Schema_exports.decodeUnknownEffect(JsonObject)(imported);
+            const document = Schema_exports.toJsonSchemaDocument(schema);
+            return Schema_exports.decodeUnknownEffect(JsonObject)({
+              ...document.schema,
+              $defs: document.definitions
+            });
+          };
+          const configSchema = yield* describe(hook2.config);
+          if (hook2.setup === void 0 ? hook2.register === void 0 || hook2.unregister === void 0 : hook2.register !== void 0 || hook2.unregister !== void 0)
+            return yield* new HostDeclarationInvalid();
+          const setup = hook2.setup === void 0 ? void 0 : {
+            ...yield* Schema_exports.decodeUnknownEffect(ManualWebhookSetup)(hook2.setup),
+            stateSchema: yield* describe(hook2.state)
+          };
+          return yield* Schema_exports.decodeUnknownEffect(HostedWebhook)({
+            name,
+            account: hook2.account,
+            configSchema,
+            ...setup === void 0 ? {} : { setup }
+          });
+        }),
+        new HostDeclarationInvalid()
+      )
+    );
+  }
+  const hook = Object.hasOwn(hooks, command.name) ? hooks[command.name] : void 0;
+  if (hook === void 0) return yield* new HostOperationNotFound();
+  const selected = accounts[hook.account];
+  const source = Array.isArray(selected) ? selected.find((account2) => account2.id === command.sourceAccount) : selected;
+  if (source === void 0 || source.id !== command.sourceAccount)
+    return yield* new HostInputInvalid();
+  const bound = context.accounts[hook.account];
+  const account = Array.isArray(bound) ? bound.find(
+    (value) => typeof value === "object" && value !== null && "id" in value && value.id === source.id
+  ) : bound;
+  const config = yield* safe(
+    () => Schema_exports.decodeUnknownEffect(hook.config)(command.config),
+    new HostInputInvalid()
+  );
+  if (command.operation === "webhook-validate")
+    return yield* safe(
+      () => Schema_exports.decodeUnknownEffect(JsonValue)(config),
+      new HostInputInvalid()
+    );
+  const input = {
+    config,
+    subscriptionId: command.subscriptionId,
+    account,
+    callbackUrl: command.callbackUrl,
+    secret: command.secret
+  };
+  const invoke = (callback, value) => safe(() => callback(context, value), new HostOperationFailed());
+  if (command.operation === "webhook-complete") {
+    if (hook.setup === void 0) return yield* new HostInputInvalid();
+    return yield* safe(
+      () => Schema_exports.decodeUnknownEffect(hook.state)(command.state).pipe(
+        Effect_exports.flatMap(Schema_exports.decodeUnknownEffect(JsonValue))
+      ),
+      new HostInputInvalid()
+    );
+  }
+  if (command.operation === "webhook-register") {
+    if (hook.register === void 0 || hook.setup !== void 0)
+      return yield* new HostOperationFailed();
+    const state2 = yield* invoke(hook.register, input);
+    return yield* safe(
+      () => Schema_exports.decodeUnknownEffect(hook.state)(state2).pipe(
+        Effect_exports.flatMap(Schema_exports.decodeUnknownEffect(JsonValue))
+      ),
+      new HostOutputInvalid()
+    );
+  }
+  const state = command.state === null ? null : yield* safe(
+    () => Schema_exports.decodeUnknownEffect(hook.state)(command.state),
+    new HostInputInvalid()
+  );
+  if (command.operation === "webhook-unregister") {
+    if (hook.unregister === void 0 || hook.setup !== void 0)
+      return yield* new HostOperationFailed();
+    yield* invoke(hook.unregister, { ...input, state });
+    return null;
+  }
+  const body = yield* Effect_exports.fromResult(Encoding_exports.decodeBase64(command.request.body)).pipe(
+    Effect_exports.mapError(() => new HostInputInvalid())
+  );
+  if (body.byteLength > defaultWebhookTransportLimits.maxBodyBytes)
+    return yield* new HostInputInvalid();
+  const request = yield* safe(
+    () => Effect_exports.sync(
+      () => new Request(command.request.url, {
+        method: command.request.method,
+        headers: command.request.headers,
+        ...context.signal === void 0 ? {} : { signal: context.signal },
+        ...command.request.method === "GET" || command.request.method === "HEAD" ? {} : { body: Uint8Array.from(body) }
+      })
+    ),
+    new HostInputInvalid()
+  );
+  const response = yield* invoke(hook.handle, { ...input, state, request });
+  if (!(response instanceof Response)) return yield* new HostOutputInvalid();
+  const chunks = [];
+  let size = 0;
+  const stream = response.body;
+  if (stream !== null)
+    yield* Stream_exports.fromReadableStream({
+      evaluate: () => stream,
+      onError: () => new HostOutputInvalid()
+    }).pipe(
+      Stream_exports.runForEach(
+        (chunk) => Effect_exports.gen(function* () {
+          size += chunk.byteLength;
+          if (size > defaultWebhookTransportLimits.maxBodyBytes)
+            return yield* new HostOutputInvalid();
+          chunks.push(chunk);
+        })
+      )
+    );
+  const bytes = new Uint8Array(size);
+  let offset = 0;
+  for (const chunk of chunks) {
+    bytes.set(chunk, offset);
+    offset += chunk.byteLength;
+  }
+  const headers = {};
+  response.headers.forEach((value, name) => {
+    headers[name] = value;
+  });
+  return yield* safe(
+    () => Schema_exports.decodeUnknownEffect(WebhookResponseData)({
+      status: response.status,
+      headers,
+      body: Encoding_exports.encodeBase64(new Uint8Array(bytes))
+    }),
+    new HostOutputInvalid()
+  );
+});
+
+// src/implementation/host.ts
+function safe2(work, failure) {
+  return Effect_exports.suspend(work).pipe(
+    Effect_exports.catchCause(
+      (cause) => Cause_exports.hasInterrupts(cause) ? Effect_exports.interrupt : Effect_exports.fail(failure)
+    )
+  );
+}
+function jsonSchema(decoder) {
+  const imported = importedJsonSchema(decoder);
+  if (imported !== void 0) return Schema_exports.decodeUnknownEffect(JsonObject)(imported);
+  const document = Schema_exports.toJsonSchemaDocument(decoder);
+  return Schema_exports.decodeUnknownEffect(JsonObject)({
+    ...document.schema,
+    $defs: document.definitions,
+    $schema: "https://json-schema.org/draft/2020-12/schema"
+  });
+}
+function providerDeclaration(provider) {
+  return safe2(
+    () => Effect_exports.gen(function* () {
+      const auth = /* @__PURE__ */ new Map();
+      for (const [name, method] of Object.entries(provider.auth)) {
+        switch (method._tag) {
+          case "secrets":
+            auth.set(name, {
+              type: "secrets",
+              label: method.label,
+              fields: yield* jsonSchema(method.fields)
+            });
+            break;
+          case "oauth2":
+            auth.set(name, {
+              type: "oauth2",
+              ...method.config,
+              response: yield* jsonSchema(method.response)
+            });
+            break;
+        }
+      }
+      return yield* Schema_exports.decodeUnknownEffect(DeclaredProvider)({
+        name: provider.name,
+        auth: Object.fromEntries(auth)
+      });
+    }),
+    new HostDeclarationInvalid()
+  );
+}
+function requirements(slots, database) {
+  return Effect_exports.gen(function* () {
+    const accounts = /* @__PURE__ */ new Map();
+    for (const [slot, selection] of Object.entries(slots)) {
+      accounts.set(slot, {
+        cardinality: selection instanceof ManyAccounts ? "many" : "one",
+        definition: yield* providerDeclaration(
+          selection instanceof ManyAccounts ? selection.provider : selection
+        )
+      });
+    }
+    return yield* Schema_exports.decodeUnknownEffect(DeclaredRequirements)({
+      accounts: Object.fromEntries(accounts),
+      ...database === void 0 ? {} : { database }
+    }).pipe(Effect_exports.mapError(() => new HostDeclarationInvalid()));
+  });
+}
+function canonical(value) {
+  if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
+  if (value !== null && typeof value === "object") {
+    return `{${Object.entries(value).sort(([a], [b]) => a.localeCompare(b)).map(([key, item]) => `${JSON.stringify(key)}:${canonical(item)}`).join(",")}}`;
+  }
+  return JSON.stringify(value);
+}
+function bindAccounts(slots, declarations, context) {
+  return safe2(
+    () => Effect_exports.gen(function* () {
+      const selected = yield* Schema_exports.decodeUnknownEffect(ResolvedAccounts)(
+        Redacted_exports.value(context.accounts)
+      );
+      if (Object.keys(selected).some((slot) => !Object.hasOwn(slots, slot))) {
+        return yield* Effect_exports.fail(new HostAccountsInvalid());
+      }
+      const bound = /* @__PURE__ */ new Map();
+      for (const [slot, selection] of Object.entries(slots)) {
+        const requirement = declarations.accounts[slot];
+        const supplied = Object.hasOwn(selected, slot) ? selected[slot] : void 0;
+        if (requirement === void 0 || supplied === void 0)
+          return yield* Effect_exports.fail(new HostAccountsInvalid());
+        const provider = selection instanceof ManyAccounts ? selection.provider : selection;
+        const many = selection instanceof ManyAccounts;
+        if (many !== Array.isArray(supplied))
+          return yield* Effect_exports.fail(new HostAccountsInvalid());
+        const accounts = Array.isArray(supplied) ? supplied : [supplied];
+        const ids = /* @__PURE__ */ new Set();
+        const values = [];
+        for (const account of accounts) {
+          if (ids.has(account.id)) return yield* Effect_exports.fail(new HostAccountsInvalid());
+          ids.add(account.id);
+          if (canonical(account.provider) !== canonical(requirement.definition) || !Object.hasOwn(provider.auth, account.method))
+            return yield* Effect_exports.fail(new HostAccountsInvalid());
+          const method = provider.auth[account.method];
+          if (method === void 0) return yield* Effect_exports.fail(new HostAccountsInvalid());
+          const fields = yield* Schema_exports.decodeUnknownEffect(
+            method._tag === "secrets" ? method.fields : method.response
+          )(account.fields);
+          values.push({ id: account.id, method: account.method, fields });
+        }
+        if (many) bound.set(slot, values);
+        else {
+          const account = values[0];
+          if (account === void 0) return yield* Effect_exports.fail(new HostAccountsInvalid());
+          bound.set(slot, account);
+        }
+      }
+      return { accounts: Object.fromEntries(bound) };
+    }),
+    new HostAccountsInvalid()
+  );
+}
+function dispatch(app, request, context, signal) {
+  return Effect_exports.scoped(
+    Effect_exports.gen(function* () {
+      if (!isApp(app)) return yield* Effect_exports.fail(new HostDeclarationInvalid());
+      const native = toEffectApp(app);
+      const declared = yield* requirements(native.accounts, native.database?.schema);
+      if (request.operation === "requirements")
+        return yield* safe2(
+          () => Schema_exports.decodeUnknownEffect(JsonValue)(declared),
+          new HostDeclarationInvalid()
+        );
+      const lifetime = yield* Effect_exports.acquireRelease(
+        Effect_exports.sync(() => new AbortController()),
+        (controller) => Effect_exports.sync(() => controller.abort())
+      );
+      const invocationSignal = AbortSignal.any([signal, lifetime.signal]);
+      let running;
+      let transactionOpen = false;
+      const delivery = (request2, signal2) => Effect_exports.suspend(
+        () => transactionOpen ? Effect_exports.fail(new ElicitationFailed({ reason: "transaction" })) : running !== void 0 && context.elicitation !== void 0 ? context.elicitation(request2, signal2).pipe(
+          Effect_exports.withSpan("app.tool.elicitation"),
+          Effect_exports.provideContext(running.context)
+        ) : Effect_exports.fail(new ElicitationFailed({ reason: "unavailable" }))
+      );
+      const unavailableWorkflow = () => Effect_exports.fail(new WorkflowFailure({ reason: "unavailable", retryable: false }));
+      const workflowControls = {
+        start: toPromise(
+          (input2) => context.workflowControls === void 0 ? unavailableWorkflow() : context.workflowControls.start(input2),
+          invocationSignal
+        ),
+        get: toPromise(
+          (input2) => context.workflowControls === void 0 ? unavailableWorkflow() : context.workflowControls.get(input2),
+          invocationSignal
+        ),
+        list: toPromise(
+          (input2) => context.workflowControls === void 0 ? unavailableWorkflow() : context.workflowControls.list(input2),
+          invocationSignal
+        ),
+        terminate: toPromise(
+          (input2) => context.workflowControls === void 0 ? unavailableWorkflow() : context.workflowControls.terminate(input2),
+          invocationSignal
+        )
+      };
+      const workflowReads = {
+        get: workflowControls.get,
+        list: workflowControls.list
+      };
+      const bound = {
+        ...yield* bindAccounts(native.accounts, declared, context).pipe(
+          Effect_exports.withSpan("app.accounts.bind")
+        ),
+        workflows: workflowReads,
+        signal: invocationSignal,
+        fetch: yield* invocationFetch(invocationSignal),
+        elicit: makeElicit(delivery, invocationSignal)
+      };
+      const definition = yield* safe2(
+        () => native.evaluate(bound).pipe(Effect_exports.withSpan("app.evaluate")),
+        new HostEvaluationFailed()
+      );
+      if (request.operation === "workflows") {
+        return yield* Effect_exports.forEach(
+          Object.entries(definition.workflows ?? {}),
+          ([name2, entry]) => safe2(
+            () => Effect_exports.gen(function* () {
+              return yield* Schema_exports.decodeUnknownEffect(HostedWorkflow)({
+                name: name2,
+                ...entry.description === void 0 ? {} : { description: entry.description },
+                inputSchema: yield* jsonSchema(entry.input),
+                ...entry.output === void 0 ? {} : { outputSchema: yield* jsonSchema(entry.output) }
+              });
+            }),
+            new HostDeclarationInvalid()
+          )
+        );
+      }
+      if (request.operation === "workflow-validate" || request.operation === "workflow-run") {
+        const entry = definition.workflows !== void 0 && Object.hasOwn(definition.workflows, request.name) ? definition.workflows[request.name] : void 0;
+        if (entry === void 0)
+          return yield* new WorkflowFailure({ reason: "not_found", retryable: false });
+        const input2 = yield* safe2(
+          () => Schema_exports.decodeUnknownEffect(entry.input)(request.input),
+          new WorkflowFailure({ reason: "input", retryable: false })
+        );
+        if (request.operation === "workflow-validate")
+          return yield* safe2(
+            () => Schema_exports.decodeUnknownEffect(WorkflowValue)(input2),
+            new WorkflowFailure({ reason: "input", retryable: false })
+          );
+        const execution = context.workflow;
+        if (execution === void 0)
+          return yield* new WorkflowFailure({ reason: "unavailable", retryable: false });
+        const workflowContext = yield* makeWorkflowContext(
+          execution,
+          definition,
+          (stepId, signal2) => Effect_exports.gen(function* () {
+            const current = yield* execution.resolve();
+            const accounts = yield* safe2(
+              () => bindAccounts(native.accounts, declared, current),
+              new WorkflowFailure({ reason: "credentials", retryable: false })
+            );
+            return {
+              ...accounts,
+              fetch: yield* invocationFetch(signal2),
+              signal: signal2,
+              runId: execution.runId,
+              stepId,
+              idempotencyKey: stepId
+            };
+          }),
+          invocationSignal
+        );
+        const output = yield* workflowSafe(entry.run(workflowContext, input2));
+        const outputSchema = entry.output;
+        const decoded = outputSchema === void 0 ? output : yield* safe2(
+          () => Schema_exports.decodeUnknownEffect(outputSchema)(output),
+          new WorkflowFailure({ reason: "output", retryable: false })
+        );
+        return yield* safe2(
+          () => Schema_exports.decodeUnknownEffect(WorkflowValue)(decoded),
+          new WorkflowFailure({ reason: "output", retryable: false })
+        );
+      }
+      if (request.operation === "inspect") {
+        const metadata = [];
+        for (const [prefix, readOnly, catalog2] of [
+          [OperationToolPrefixes.query, true, definition.queries],
+          [OperationToolPrefixes.mutate, false, definition.mutations]
+        ]) {
+          for (const [name2, operation] of Object.entries(catalog2 ?? {})) {
+            metadata.push(
+              yield* safe2(
+                () => Effect_exports.gen(function* () {
+                  return yield* Schema_exports.decodeUnknownEffect(HostedTool)({
+                    name: `${prefix}${name2}`,
+                    schedules: Object.entries(definition.schedules ?? {}).filter(([, schedule]) => schedule.tool === `${prefix}${name2}`).map(([name3, { tool: _tool, ...schedule }]) => ({ name: name3, ...schedule })),
+                    description: operation.description ?? `${readOnly ? "Query" : "Mutate"} ${name2}`,
+                    ...operation.title === void 0 ? {} : { title: operation.title },
+                    inputSchema: yield* jsonSchema(operation.input),
+                    ...operation.output === void 0 ? operation.outputSchema === void 0 ? {} : { outputSchema: operation.outputSchema } : { outputSchema: yield* jsonSchema(operation.output) },
+                    readOnly,
+                    annotations: { ...operation.annotations, readOnlyHint: readOnly },
+                    ...operation._meta === void 0 ? {} : { _meta: operation._meta }
+                  });
+                }),
+                new HostDeclarationInvalid()
+              )
+            );
+          }
+        }
+        return metadata;
+      }
+      if (request.operation === "webhook-complete" || request.operation === "webhook-validate" || request.operation === "webhooks" || request.operation === "webhook-register" || request.operation === "webhook-handle" || request.operation === "webhook-unregister") {
+        const executeWebhook = (db) => dispatchWebhook(
+          definition,
+          request,
+          {
+            accounts: bound.accounts,
+            workflows: workflowControls,
+            signal: bound.signal,
+            fetch: bound.fetch,
+            ...db === void 0 || native.database === void 0 ? {} : {
+              db: authorDatabase(native.database.tables, db, invocationSignal, true)
+            }
+          },
+          Redacted_exports.value(context.accounts)
+        );
+        if (native.database === void 0 || !["webhook-register", "webhook-handle", "webhook-unregister"].includes(request.operation))
+          return yield* executeWebhook();
+        const storage2 = context.storage ?? unavailableStorage;
+        return yield* storage2.mutate(native.database.schema, executeWebhook).pipe(
+          Effect_exports.catchTags({
+            AppDatabaseError: () => Effect_exports.fail(new HostOperationFailed()),
+            AppStorageUnavailable: () => Effect_exports.fail(new HostOperationFailed()),
+            AppStorageError: () => Effect_exports.fail(new HostOperationFailed())
+          })
+        );
+      }
+      const kind = request.operation === "call" ? request.tool.startsWith(OperationToolPrefixes.query) ? "query" : request.tool.startsWith(OperationToolPrefixes.mutate) ? "mutate" : void 0 : request.operation;
+      if (kind === void 0) return yield* new HostToolNotFound();
+      const name = request.operation === "call" ? request.tool.slice(OperationToolPrefixes[kind].length) : request.name;
+      const toolName = `${OperationToolPrefixes[kind]}${name}`;
+      const catalog = kind === "query" ? definition.queries : definition.mutations;
+      const tool = catalog !== void 0 && Object.hasOwn(catalog, name) ? catalog[name] : void 0;
+      if (tool === void 0)
+        return yield* request.operation === "call" ? new HostToolNotFound() : new HostOperationNotFound();
+      const input = yield* safe2(
+        () => Schema_exports.decodeUnknownEffect(tool.input)(request.input),
+        new HostInputInvalid()
+      );
+      if (context.approval !== void 0) {
+        const approved = yield* safe2(
+          () => Schema_exports.decodeUnknownEffect(TrustedToolApproval)(context.approval),
+          new HostInputInvalid()
+        );
+        const decoded = yield* safe2(
+          () => Schema_exports.decodeUnknownEffect(JsonValue)(input),
+          new HostInputInvalid()
+        );
+        if (approved.tool !== toolName || !Schema_exports.toEquivalence(JsonValue)(approved.input, decoded)) {
+          return yield* new HostInputInvalid();
+        }
+      } else if (tool.approval !== void 0) {
+        const approval = tool.approval;
+        const decision = yield* safe2(
+          () => approval({ toolName, toolInput: input, signal: invocationSignal }).pipe(
+            Effect_exports.withSpan("app.tool.approval", {
+              attributes: { "executor.tool.name": toolName }
+            }),
+            Effect_exports.flatMap(Schema_exports.decodeUnknownEffect(ApprovalDecision))
+          ),
+          new HostToolPolicyFailed()
+        );
+        yield* Match_exports.value(decision).pipe(
+          Match_exports.when("approved", () => Effect_exports.void),
+          Match_exports.when("denied", () => Effect_exports.fail(new HostToolBlocked())),
+          Match_exports.when(
+            "user-approval",
+            () => safe2(() => Schema_exports.decodeUnknownEffect(JsonValue)(input), new HostInputInvalid()).pipe(
+              Effect_exports.flatMap(
+                (input2) => Effect_exports.fail(
+                  new HostToolApprovalRequired({
+                    input: input2,
+                    elicitation: approvalElicitation(toolName, input2)
+                  })
+                )
+              )
+            )
+          ),
+          Match_exports.exhaustive
+        );
+      }
+      const execute = (db) => Effect_exports.gen(function* () {
+        transactionOpen = db !== void 0;
+        const output = yield* Effect_exports.gen(function* () {
+          running = yield* captureTelemetry;
+          const fetch = yield* invocationFetch(invocationSignal);
+          return yield* tool.run(
+            {
+              ...bound,
+              fetch,
+              workflows: kind === "mutate" ? workflowControls : workflowReads,
+              ...db === void 0 || native.database === void 0 ? {} : {
+                db: authorDatabase(
+                  native.database.tables,
+                  db,
+                  invocationSignal,
+                  kind === "mutate"
+                )
+              }
+            },
+            input
+          );
+        }).pipe(
+          Effect_exports.withSpan("app.operation.execute", {
+            attributes: { "executor.tool.name": toolName, "executor.operation": kind }
+          }),
+          Effect_exports.ensuring(
+            Effect_exports.sync(() => {
+              running = void 0;
+            })
+          ),
+          Effect_exports.catchCause((cause) => {
+            if (Cause_exports.hasInterrupts(cause)) return Effect_exports.interrupt;
+            const failure = Schema_exports.decodeUnknownOption(ElicitationFailed)(Cause_exports.squash(cause));
+            return Effect_exports.fail(
+              Option_exports.isSome(failure) ? failure.value : new HostOperationFailed()
+            );
+          })
+        );
+        const outputSchema = tool.output;
+        const decoded = outputSchema === void 0 ? output : yield* safe2(
+          () => Schema_exports.decodeUnknownEffect(outputSchema)(output),
+          new HostOutputInvalid()
+        );
+        return yield* safe2(
+          () => Schema_exports.decodeUnknownEffect(JsonValue)(decoded),
+          new HostOutputInvalid()
+        );
+      });
+      const replay = context.replay === void 0 ? void 0 : yield* safe2(
+        () => Schema_exports.decodeUnknownEffect(WorkflowReplay)(context.replay),
+        new HostInputInvalid()
+      );
+      if (replay !== void 0 && kind !== "mutate") return yield* new HostInputInvalid();
+      if (native.database === void 0) return yield* execute();
+      const storage = context.storage ?? unavailableStorage;
+      return yield* storage[kind === "query" ? "read" : "mutate"](
+        native.database.schema,
+        (db) => replay === void 0 ? execute(db) : db.once(replay.key, replay.fingerprint, () => execute(db))
+      ).pipe(
+        Effect_exports.catchTags({
+          AppDatabaseError: () => Effect_exports.fail(new HostOperationFailed()),
+          AppStorageUnavailable: () => Effect_exports.fail(new HostOperationFailed()),
+          AppStorageError: () => Effect_exports.fail(new HostOperationFailed())
+        })
+      );
+    })
+  );
+}
+var errorStatus = Match_exports.type().pipe(
+  Match_exports.tagsExhaustive({
+    WorkflowFailure: () => 422,
+    HostRequestInvalid: () => 400,
+    HostAccountsInvalid: () => 422,
+    HostInputInvalid: () => 422,
+    HostOperationNotFound: () => 404,
+    HostToolNotFound: () => 404,
+    HostToolBlocked: () => 403,
+    HostToolApprovalRequired: () => 409,
+    HostToolPolicyFailed: () => 500,
+    HostOperationFailed: () => 500,
+    HostDeclarationInvalid: () => 500,
+    HostEvaluationFailed: () => 500,
+    HostOutputInvalid: () => 500,
+    ElicitationFailed: () => 422
+  })
+);
+var createAppHandler = (app) => (request, context) => Effect_exports.gen(function* () {
+  if (request.method !== "POST") return yield* Effect_exports.fail(new HostRequestInvalid());
+  const input = yield* Effect_exports.tryPromise({
+    try: () => request.json(),
+    catch: () => new HostRequestInvalid()
+  });
+  const command = yield* Schema_exports.decodeUnknownEffect(HostRequest)(input, {
+    onExcessProperty: "error"
+  }).pipe(Effect_exports.mapError(() => new HostRequestInvalid()));
+  yield* Effect_exports.annotateCurrentSpan({
+    "executor.operation": command.operation,
+    ...command.operation === "call" ? { "executor.tool.name": command.tool } : {}
+  });
+  let toolError = false;
+  const value = yield* dispatch(app, command, context, request.signal).pipe(
+    Effect_exports.provideService(ToolResultObservation, {
+      failed: () => {
+        toolError = true;
+      }
+    }),
+    Effect_exports.withSpan(`app.${command.operation}`)
+  );
+  if (toolError)
+    yield* Effect_exports.annotateCurrentSpan({
+      "executor.outcome": "failed",
+      "error.type": "McpToolError"
+    });
+  return Response.json({ ok: true, value, ...toolError ? { toolError: true } : {} });
+}).pipe(
+  Effect_exports.catch(
+    (error) => Schema_exports.encodeEffect(HostError)(error).pipe(
+      Effect_exports.map(
+        (encoded) => Response.json({ ok: false, error: encoded }, { status: errorStatus(error) })
+      ),
+      Effect_exports.orDie
+    )
+  ),
+  Effect_exports.catchCause(
+    (cause) => Cause_exports.hasInterrupts(cause) ? Effect_exports.interrupt : Effect_exports.logError(cause).pipe(
+      Effect_exports.as(
+        Response.json(
+          { ok: false, error: { _tag: "HostDeclarationInvalid" } },
+          { status: 500 }
+        )
+      )
+    )
+  )
+);
+
+export {
+  prepareElicitation,
+  ApprovalDecision,
+  createAppHandler
+};