apps 0.0.1-beta.10 → 0.0.1-beta.12

package/js/{chunk-Z5M2LQOZ.js → chunk-GPFVWWDZ.js}

@@ -3,7 +3,7 @@ import {
   RouterKey,
   RouterMeta,
   reservedRouterKeys
-} from "./chunk-WLE7WX2U.js";
+} from "./chunk-KRSCJDTW.js";
 import {
   decoderOf
 } from "./chunk-5T57N25Q.js";

package/js/{chunk-WLE7WX2U.js → chunk-KRSCJDTW.js}

@@ -1814,7 +1814,7 @@ var OAuthSecretClientAuth = Schema_exports.Literals([
   "client_secret_basic",
   "client_secret_basic_raw"
 ]);
-var reservedAuthorizationParams = /* @__PURE__ */ new Set([
+var reservedAuthorizationParams = [
   "response_type",
   "client_id",
   "redirect_uri",
@@ -1826,17 +1826,39 @@ var reservedAuthorizationParams = /* @__PURE__ */ new Set([
   "resource",
   "request",
   "request_uri"
-]);
+];
+var reserved = new Set(reservedAuthorizationParams);
 var OAuthAuthorizationParams = Schema_exports.Record(Schema_exports.String, Schema_exports.String).check(
-  Schema_exports.makeFilter(
-    (params) => Object.keys(params).every((key) => !reservedAuthorizationParams.has(key)),
-    {
-      message: "Authorization parameters cannot replace protocol parameters such as state or scope."
-    }
-  )
+  Schema_exports.makeFilter((params) => Object.keys(params).every((key) => !reserved.has(key)), {
+    message: "Authorization parameters cannot replace protocol parameters such as state or scope."
+  })
+);
+var declaredAuthorizationQuery = Schema_exports.makeFilter(
+  (config) => {
+    const keys = [...new URL(config.authorizationUrl).searchParams.keys()];
+    const owned = keys.filter((key) => reserved.has(key));
+    if (owned.length > 0)
+      return {
+        path: ["authorizationUrl"],
+        issue: `authorizationUrl cannot set protocol parameters: ${owned.join(", ")}.`
+      };
+    const repeated = keys.filter((key) => Object.hasOwn(config.authorizationParams ?? {}, key));
+    if (repeated.length > 0)
+      return {
+        path: ["authorizationParams"],
+        issue: `Declare each parameter once; authorizationUrl already sets: ${repeated.join(", ")}.`
+      };
+    return void 0;
+  }
 );
 var oauthOptions = {
   grant: Schema_exports.optionalKey(Schema_exports.Literal("authorization_code")),
+  /**
+   * Service-defined authorization request parameters, such as Google's
+   * `{ access_type: "offline", prompt: "consent" }`. Host-owned protocol parameters
+   * (`state`, `scope`, `redirect_uri`, PKCE and the others in `reservedAuthorizationParams`)
+   * are rejected. A discovered endpoint's own query parameter of the same name is replaced.
+   */
   authorizationParams: Schema_exports.optionalKey(OAuthAuthorizationParams),
   tokenEndpointAuthMethod: Schema_exports.optionalKey(OAuthClientAuth),
   /** Omitted uses discovery; null explicitly suppresses the resource parameter. */
@@ -1853,6 +1875,7 @@ var OAuth2Config = Schema_exports.Union([
   }),
   Schema_exports.Struct({
     ...oauthOptions,
+    /** Its query is kept; it cannot set protocol parameters or repeat `authorizationParams`. */
     authorizationUrl: HttpUrl,
     tokenUrl: HttpUrl,
     revocationUrl: Schema_exports.optionalKey(HttpUrl),
@@ -1860,7 +1883,7 @@ var OAuth2Config = Schema_exports.Union([
     /** RFC 8414 issuer identifier. Declared issuers are checked against the callback's `iss`. */
     issuer: Schema_exports.optionalKey(HttpUrl),
     discover: Schema_exports.optionalKey(Schema_exports.Never)
-  }),
+  }).check(declaredAuthorizationQuery),
   Schema_exports.Struct({
     grant: Schema_exports.Literal("client_credentials"),
     discover: HttpUrl,

package/js/{chunk-EPT3ZP52.js → chunk-S6YVNPFS.js}

@@ -2,7 +2,7 @@ import {
   adaptMcpTools,
   mcpClient,
   mcpJsonSchemaValidator
-} from "./chunk-CRDWFA74.js";
+} from "./chunk-Y32GRPVD.js";
 import {
   accountProviderError,
   httpProviderError
@@ -11,7 +11,7 @@ import {
   McpError,
   McpToolsOptions,
   defaultMcpClientLimits
-} from "./chunk-WLE7WX2U.js";
+} from "./chunk-KRSCJDTW.js";
 import {
   ProviderError
 } from "./chunk-R3EV5FTO.js";

package/js/{chunk-YXQHV65J.js → chunk-TYVDBQSI.js}

@@ -6,10 +6,10 @@ import {
   fromPromise,
   nativeOperation,
   nativeRouter
-} from "./chunk-Z5M2LQOZ.js";
+} from "./chunk-GPFVWWDZ.js";
 import {
   ScheduleTiming
-} from "./chunk-WLE7WX2U.js";
+} from "./chunk-KRSCJDTW.js";
 import {
   DatabaseSchema
 } from "./chunk-N7YDVXYJ.js";

package/js/{chunk-72JNVHPK.js → chunk-WVVV4TX2.js}

@@ -1,11 +1,11 @@
 import {
   fixedRouter
-} from "./chunk-FL2QR3XW.js";
+} from "./chunk-Z2QY3YTF.js";
 import {
   nativeOperation,
   operationDeclaration,
   routerDeclaration
-} from "./chunk-Z5M2LQOZ.js";
+} from "./chunk-GPFVWWDZ.js";
 
 // src/implementation/protocol-operations.ts
 var protocolOperations = (operations, kinds = {}) => {

package/js/{chunk-CRDWFA74.js → chunk-Y32GRPVD.js}

@@ -1,9 +1,9 @@
 import {
   prepareElicitation
-} from "./chunk-V5KNQVCT.js";
+} from "./chunk-YQNLXHHM.js";
 import {
   fromPromise
-} from "./chunk-Z5M2LQOZ.js";
+} from "./chunk-GPFVWWDZ.js";
 import {
   ElicitationFailed,
   McpError,
@@ -15,7 +15,7 @@ import {
   defaultElicitationLimits,
   defaultMcpClientLimits,
   mcpSdkTimerCeilingMs
-} from "./chunk-WLE7WX2U.js";
+} from "./chunk-KRSCJDTW.js";
 import {
   compileJsonSchemaDecoder,
   jsonSchemaDecoder

package/js/{chunk-V5KNQVCT.js → chunk-YQNLXHHM.js}

@@ -8,7 +8,7 @@ import {
   failureDetail,
   readCatalog,
   routerSkills
-} from "./chunk-FL2QR3XW.js";
+} from "./chunk-Z2QY3YTF.js";
 import {
   folderSkillsEffect
 } from "./chunk-IPI4MFSN.js";
@@ -18,7 +18,7 @@ import {
   isApp,
   toEffectApp,
   unavailableStorage
-} from "./chunk-YXQHV65J.js";
+} from "./chunk-TYVDBQSI.js";
 import {
   parseDatabaseSchema
 } from "./chunk-ZQINWV4W.js";
@@ -28,7 +28,7 @@ import {
   locate,
   nativeOperation,
   toPromise
-} from "./chunk-Z5M2LQOZ.js";
+} from "./chunk-GPFVWWDZ.js";
 import {
   accountProviderError,
   httpProviderError,
@@ -81,7 +81,7 @@ import {
   defaultWebhookTransportLimits,
   maxInputProblems,
   workflowDurationMillis
-} from "./chunk-WLE7WX2U.js";
+} from "./chunk-KRSCJDTW.js";
 import {
   CacheError
 } from "./chunk-R3EV5FTO.js";
@@ -1166,7 +1166,7 @@ function checkAccount(slots, declared, requirement, context, signal) {
         const status = Schema_exports.decodeUnknownOption(ResponseStatusError)(error);
         const classified = Option_exports.isSome(status) ? Option_exports.fromNullishOr(httpProviderError(status.value.status)) : parseProviderError(error);
         return Effect_exports.fail(
-          Option_exports.isSome(classified) ? accountProviderError(classified.value, account.id) : new HostOperationFailed()
+          Option_exports.isSome(classified) ? accountProviderError(classified.value, account.id) : new HostOperationFailed(failureDetail(error, accountSecrets(context.accounts)))
         );
       }),
       Effect_exports.withSpan("app.account.check")

package/js/{chunk-FL2QR3XW.js → chunk-Z2QY3YTF.js}

@@ -4,7 +4,7 @@ import {
 import {
   joinPath,
   mergeMeta
-} from "./chunk-Z5M2LQOZ.js";
+} from "./chunk-GPFVWWDZ.js";
 import {
   parseProviderError
 } from "./chunk-MKWZPDR6.js";
@@ -17,7 +17,7 @@ import {
   HostedToolSummary,
   McpError,
   maxFailureMessageLength
-} from "./chunk-WLE7WX2U.js";
+} from "./chunk-KRSCJDTW.js";
 import {
   AppDatabaseError
 } from "./chunk-N7YDVXYJ.js";

package/js/contracts.js

@@ -109,7 +109,7 @@ import {
   skillCatalog,
   skillsCommand,
   workflowDurationMillis
-} from "./chunk-WLE7WX2U.js";
+} from "./chunk-KRSCJDTW.js";
 import {
   DatabaseFieldReserved,
   DatabaseLimitExceeded

package/js/effect.js

@@ -3,17 +3,17 @@ import {
   ApprovalDecision,
   createAppHandler,
   prepareElicitation
-} from "./chunk-V5KNQVCT.js";
+} from "./chunk-YQNLXHHM.js";
 import "./chunk-NKLWZJLE.js";
-import "./chunk-FL2QR3XW.js";
+import "./chunk-Z2QY3YTF.js";
 import "./chunk-IPI4MFSN.js";
-import "./chunk-YXQHV65J.js";
+import "./chunk-TYVDBQSI.js";
 import "./chunk-ZQINWV4W.js";
-import "./chunk-Z5M2LQOZ.js";
+import "./chunk-GPFVWWDZ.js";
 import "./chunk-MKWZPDR6.js";
 import {
   ToolAnnotations
-} from "./chunk-WLE7WX2U.js";
+} from "./chunk-KRSCJDTW.js";
 import "./chunk-N7YDVXYJ.js";
 import "./chunk-R3EV5FTO.js";
 import "./chunk-JU7VHODU.js";

package/js/graphql.js

@@ -3,26 +3,26 @@ import {
 } from "./chunk-RFVIONFX.js";
 import {
   protocolOperations
-} from "./chunk-72JNVHPK.js";
+} from "./chunk-WVVV4TX2.js";
 import "./chunk-BCSNKUAC.js";
-import "./chunk-V5KNQVCT.js";
+import "./chunk-YQNLXHHM.js";
 import {
   cacheKey
 } from "./chunk-NKLWZJLE.js";
-import "./chunk-FL2QR3XW.js";
+import "./chunk-Z2QY3YTF.js";
 import "./chunk-IPI4MFSN.js";
-import "./chunk-YXQHV65J.js";
+import "./chunk-TYVDBQSI.js";
 import "./chunk-ZQINWV4W.js";
 import {
   nativeOperation,
   routerDeclaration
-} from "./chunk-Z5M2LQOZ.js";
+} from "./chunk-GPFVWWDZ.js";
 import {
   accountProviderError,
   graphqlProviderError,
   httpProviderError
 } from "./chunk-MKWZPDR6.js";
-import "./chunk-WLE7WX2U.js";
+import "./chunk-KRSCJDTW.js";
 import "./chunk-N7YDVXYJ.js";
 import {
   ProviderError

package/js/host.js

@@ -1,12 +1,12 @@
 import {
   createAppHandler
-} from "./chunk-V5KNQVCT.js";
+} from "./chunk-YQNLXHHM.js";
 import "./chunk-NKLWZJLE.js";
-import "./chunk-FL2QR3XW.js";
+import "./chunk-Z2QY3YTF.js";
 import "./chunk-IPI4MFSN.js";
-import "./chunk-YXQHV65J.js";
+import "./chunk-TYVDBQSI.js";
 import "./chunk-ZQINWV4W.js";
-import "./chunk-Z5M2LQOZ.js";
+import "./chunk-GPFVWWDZ.js";
 import "./chunk-MKWZPDR6.js";
 import {
   ElicitationFailed,
@@ -21,7 +21,7 @@ import {
   WorkflowRun,
   WorkflowRunId,
   WorkflowRunPage
-} from "./chunk-WLE7WX2U.js";
+} from "./chunk-KRSCJDTW.js";
 import "./chunk-N7YDVXYJ.js";
 import {
   CacheCommand,

package/js/index.js

@@ -5,7 +5,7 @@ import {
   defineDatabase,
   table,
   workflow
-} from "./chunk-YXQHV65J.js";
+} from "./chunk-TYVDBQSI.js";
 import "./chunk-ZQINWV4W.js";
 import {
   dynamicRouter,
@@ -18,7 +18,7 @@ import {
   router,
   routerDeclaration,
   withApproval
-} from "./chunk-Z5M2LQOZ.js";
+} from "./chunk-GPFVWWDZ.js";
 import {
   accountProviderError
 } from "./chunk-MKWZPDR6.js";
@@ -36,7 +36,7 @@ import {
   ScheduleTiming,
   SecretsMethod,
   WorkflowFailure
-} from "./chunk-WLE7WX2U.js";
+} from "./chunk-KRSCJDTW.js";
 import "./chunk-N7YDVXYJ.js";
 import {
   CacheError,

package/js/mcp/effect.js

@@ -1,18 +1,18 @@
 import {
   mcpClientEffect,
   mcpToolsEffect
-} from "../chunk-EPT3ZP52.js";
-import "../chunk-CRDWFA74.js";
+} from "../chunk-S6YVNPFS.js";
+import "../chunk-Y32GRPVD.js";
 import "../chunk-BCSNKUAC.js";
-import "../chunk-V5KNQVCT.js";
+import "../chunk-YQNLXHHM.js";
 import "../chunk-NKLWZJLE.js";
-import "../chunk-FL2QR3XW.js";
+import "../chunk-Z2QY3YTF.js";
 import "../chunk-IPI4MFSN.js";
-import "../chunk-YXQHV65J.js";
+import "../chunk-TYVDBQSI.js";
 import "../chunk-ZQINWV4W.js";
-import "../chunk-Z5M2LQOZ.js";
+import "../chunk-GPFVWWDZ.js";
 import "../chunk-MKWZPDR6.js";
-import "../chunk-WLE7WX2U.js";
+import "../chunk-KRSCJDTW.js";
 import "../chunk-N7YDVXYJ.js";
 import "../chunk-R3EV5FTO.js";
 import "../chunk-JU7VHODU.js";

package/js/mcp/stdio.js

@@ -2,23 +2,23 @@ import {
   adaptMcpTools,
   mcpClient,
   mcpJsonSchemaValidator
-} from "../chunk-CRDWFA74.js";
+} from "../chunk-Y32GRPVD.js";
 import {
   protocolRouter
-} from "../chunk-72JNVHPK.js";
+} from "../chunk-WVVV4TX2.js";
 import "../chunk-BCSNKUAC.js";
-import "../chunk-V5KNQVCT.js";
+import "../chunk-YQNLXHHM.js";
 import "../chunk-NKLWZJLE.js";
-import "../chunk-FL2QR3XW.js";
+import "../chunk-Z2QY3YTF.js";
 import "../chunk-IPI4MFSN.js";
-import "../chunk-YXQHV65J.js";
+import "../chunk-TYVDBQSI.js";
 import "../chunk-ZQINWV4W.js";
-import "../chunk-Z5M2LQOZ.js";
+import "../chunk-GPFVWWDZ.js";
 import "../chunk-MKWZPDR6.js";
 import {
   McpError,
   ProcessConfig
-} from "../chunk-WLE7WX2U.js";
+} from "../chunk-KRSCJDTW.js";
 import "../chunk-N7YDVXYJ.js";
 import "../chunk-R3EV5FTO.js";
 import "../chunk-JU7VHODU.js";

package/js/mcp.js

@@ -1,35 +1,35 @@
 import {
   mcpClientEffect
-} from "./chunk-EPT3ZP52.js";
+} from "./chunk-S6YVNPFS.js";
 import {
   catalogCache
 } from "./chunk-RFVIONFX.js";
 import {
   adaptMcpTool
-} from "./chunk-CRDWFA74.js";
+} from "./chunk-Y32GRPVD.js";
 import {
   protocolOperations
-} from "./chunk-72JNVHPK.js";
+} from "./chunk-WVVV4TX2.js";
 import "./chunk-BCSNKUAC.js";
-import "./chunk-V5KNQVCT.js";
+import "./chunk-YQNLXHHM.js";
 import {
   cacheKey
 } from "./chunk-NKLWZJLE.js";
-import "./chunk-FL2QR3XW.js";
+import "./chunk-Z2QY3YTF.js";
 import "./chunk-IPI4MFSN.js";
-import "./chunk-YXQHV65J.js";
+import "./chunk-TYVDBQSI.js";
 import "./chunk-ZQINWV4W.js";
 import {
   nativeOperation,
   routerDeclaration
-} from "./chunk-Z5M2LQOZ.js";
+} from "./chunk-GPFVWWDZ.js";
 import "./chunk-MKWZPDR6.js";
 import {
   McpError,
   McpServerHeader,
   McpToolMetadata,
   McpToolsOptions
-} from "./chunk-WLE7WX2U.js";
+} from "./chunk-KRSCJDTW.js";
 import "./chunk-N7YDVXYJ.js";
 import "./chunk-R3EV5FTO.js";
 import "./chunk-JU7VHODU.js";

package/js/openapi.js

@@ -4,7 +4,7 @@ import {
 import {
   protocolOperations,
   protocolRouter
-} from "./chunk-72JNVHPK.js";
+} from "./chunk-WVVV4TX2.js";
 import {
   OpenapiError,
   OpenapiErrorResponse,
@@ -17,14 +17,14 @@ import {
   isOpenapiTextMedia,
   openapiBinaryResultSchema,
   openapiMediaKind
-} from "./chunk-FL2QR3XW.js";
+} from "./chunk-Z2QY3YTF.js";
 import "./chunk-IPI4MFSN.js";
 import {
   fromPromise,
   nativeOperation,
   routerDeclaration,
   toPromise
-} from "./chunk-Z5M2LQOZ.js";
+} from "./chunk-GPFVWWDZ.js";
 import {
   accountProviderError,
   httpProviderError
@@ -35,7 +35,7 @@ import {
   OpenapiResponseError,
   RouterMeta,
   defaultOpenapiErrorLimits
-} from "./chunk-WLE7WX2U.js";
+} from "./chunk-KRSCJDTW.js";
 import "./chunk-N7YDVXYJ.js";
 import {
   ProviderError

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "apps",
-  "version": "0.0.1-beta.10",
+  "version": "0.0.1-beta.12",
   "description": "TypeScript apps with typed tools, accounts, storage, and UI.",
   "type": "module",
   "sideEffects": false,