apps 0.0.1-beta.13 → 0.0.1-beta.15

package/js/{chunk-QS6CAHKC.js → chunk-4J3IQXFD.js}

@@ -1,11 +1,11 @@
 import {
   fixedRouter
-} from "./chunk-S73JGVR5.js";
+} from "./chunk-H34RQANV.js";
 import {
   nativeOperation,
   operationDeclaration,
   routerDeclaration
-} from "./chunk-YPKG2QO5.js";
+} from "./chunk-SWXGYMUW.js";
 
 // src/implementation/protocol-operations.ts
 var protocolOperations = (operations, kinds = {}) => {

package/js/{chunk-6HSH75OI.js → chunk-CL3O2NIN.js}

@@ -1884,6 +1884,8 @@ var OAuth2Config = Schema_exports.Union([
   Schema_exports.Struct({
     ...oauthOptions,
     discover: HttpUrl,
+    /** Fetch this exact metadata document and verify its issuer against discovery. */
+    authorizationServerMetadataUrl: Schema_exports.optionalKey(HttpUrl),
     authorizationUrl: Schema_exports.optionalKey(Schema_exports.Never),
     tokenUrl: Schema_exports.optionalKey(Schema_exports.Never),
     revocationUrl: Schema_exports.optionalKey(Schema_exports.Never),
@@ -1898,11 +1900,14 @@ var OAuth2Config = Schema_exports.Union([
     scopes: Schema_exports.Array(Schema_exports.String),
     /** RFC 8414 issuer identifier. Declared issuers are checked against the callback's `iss`. */
     issuer: Schema_exports.optionalKey(HttpUrl),
-    discover: Schema_exports.optionalKey(Schema_exports.Never)
+    discover: Schema_exports.optionalKey(Schema_exports.Never),
+    authorizationServerMetadataUrl: Schema_exports.optionalKey(Schema_exports.Never)
   }).check(declaredAuthorizationQuery),
   Schema_exports.Struct({
     grant: Schema_exports.Literal("client_credentials"),
     discover: HttpUrl,
+    /** Fetch this exact metadata document and verify its issuer against discovery. */
+    authorizationServerMetadataUrl: Schema_exports.optionalKey(HttpUrl),
     authorizationUrl: Schema_exports.optionalKey(Schema_exports.Never),
     tokenUrl: Schema_exports.optionalKey(Schema_exports.Never),
     revocationUrl: Schema_exports.optionalKey(Schema_exports.Never),
@@ -1920,7 +1925,8 @@ var OAuth2Config = Schema_exports.Union([
     tokenEndpointAuthMethod: OAuthSecretClientAuth,
     resource: Schema_exports.optionalKey(Schema_exports.NullOr(HttpUrl)),
     authorizationUrl: Schema_exports.optionalKey(Schema_exports.Never),
-    discover: Schema_exports.optionalKey(Schema_exports.Never)
+    discover: Schema_exports.optionalKey(Schema_exports.Never),
+    authorizationServerMetadataUrl: Schema_exports.optionalKey(Schema_exports.Never)
   })
 ]);
 var OAuth2AccessToken = Schema_exports.Struct({ access_token: Schema_exports.String });
@@ -1948,7 +1954,129 @@ var ManyAccounts = class extends Data_exports.TaggedClass("many") {
 };
 
 // src/contracts/protocol-version.ts
-var frameworkProtocol = 5;
+var frameworkProtocol = 6;
+
+// src/contracts/protocols/oauth.ts
+var OAuthClientAuth2 = Schema_exports.Literals([
+  "none",
+  "client_secret_post",
+  "client_secret_basic",
+  "client_secret_basic_raw"
+]);
+var OAuthSecretClientAuth2 = Schema_exports.Literals([
+  "client_secret_post",
+  "client_secret_basic",
+  "client_secret_basic_raw"
+]);
+var reservedAuthorizationParams2 = [
+  "response_type",
+  "client_id",
+  "redirect_uri",
+  "state",
+  "scope",
+  "code_challenge",
+  "code_challenge_method",
+  "nonce",
+  "resource",
+  "request",
+  "request_uri"
+];
+var reserved2 = new Set(reservedAuthorizationParams2);
+var OAuthAuthorizationParams2 = Schema_exports.Record(Schema_exports.String, Schema_exports.String).check(
+  Schema_exports.makeFilter((params) => Object.keys(params).every((key) => !reserved2.has(key)), {
+    message: "Authorization parameters cannot replace protocol parameters such as state or scope."
+  })
+);
+var declaredAuthorizationQuery2 = Schema_exports.makeFilter(
+  (config) => {
+    const keys = [...new URL(config.authorizationUrl).searchParams.keys()];
+    const owned = keys.filter((key) => reserved2.has(key));
+    if (owned.length > 0)
+      return {
+        path: ["authorizationUrl"],
+        issue: `authorizationUrl cannot set protocol parameters: ${owned.join(", ")}.`
+      };
+    const repeated = keys.filter((key) => Object.hasOwn(config.authorizationParams ?? {}, key));
+    if (repeated.length > 0)
+      return {
+        path: ["authorizationParams"],
+        issue: `Declare each parameter once; authorizationUrl already sets: ${repeated.join(", ")}.`
+      };
+    return void 0;
+  }
+);
+var OAuthTokenRequestFormat2 = Schema_exports.Literals(["form", "json"]);
+var OAuthTokenResponse2 = Schema_exports.Struct({
+  path: Schema_exports.String.check(Schema_exports.isPattern(/^[^.]+(\.[^.]+)*$/))
+});
+var tokenRequestOptions2 = {
+  /** Joins requested scopes; Linear wants `","`. Defaults to RFC 6749's space. */
+  scopeSeparator: Schema_exports.optionalKey(Schema_exports.String.check(Schema_exports.isMinLength(1))),
+  /** Encoding of token requests. Defaults to `"form"`; Atlassian, ClickUp and Notion need `"json"`. */
+  tokenRequestFormat: Schema_exports.optionalKey(OAuthTokenRequestFormat2)
+};
+var oauthOptions2 = {
+  ...tokenRequestOptions2,
+  /**
+   * Read the grant from this nested member of the token response when the top-level response has
+   * no access token or no scope. Slack's user tokens use `{ path: "authed_user" }`.
+   */
+  tokenResponse: Schema_exports.optionalKey(OAuthTokenResponse2),
+  grant: Schema_exports.optionalKey(Schema_exports.Literal("authorization_code")),
+  /**
+   * Service-defined authorization request parameters, such as Google's
+   * `{ access_type: "offline", prompt: "consent" }`. Host-owned protocol parameters
+   * (`state`, `scope`, `redirect_uri`, PKCE and the others in `reservedAuthorizationParams`)
+   * are rejected. A discovered endpoint's own query parameter of the same name is replaced.
+   */
+  authorizationParams: Schema_exports.optionalKey(OAuthAuthorizationParams2),
+  tokenEndpointAuthMethod: Schema_exports.optionalKey(OAuthClientAuth2),
+  /** Omitted uses discovery; null explicitly suppresses the resource parameter. */
+  resource: Schema_exports.optionalKey(Schema_exports.NullOr(HttpUrl))
+};
+var OAuth2Config2 = Schema_exports.Union([
+  Schema_exports.Struct({
+    ...oauthOptions2,
+    discover: HttpUrl,
+    authorizationUrl: Schema_exports.optionalKey(Schema_exports.Never),
+    tokenUrl: Schema_exports.optionalKey(Schema_exports.Never),
+    revocationUrl: Schema_exports.optionalKey(Schema_exports.Never),
+    scopes: Schema_exports.optionalKey(Schema_exports.Array(Schema_exports.String))
+  }),
+  Schema_exports.Struct({
+    ...oauthOptions2,
+    /** Its query is kept; it cannot set protocol parameters or repeat `authorizationParams`. */
+    authorizationUrl: HttpUrl,
+    tokenUrl: HttpUrl,
+    revocationUrl: Schema_exports.optionalKey(HttpUrl),
+    scopes: Schema_exports.Array(Schema_exports.String),
+    /** RFC 8414 issuer identifier. Declared issuers are checked against the callback's `iss`. */
+    issuer: Schema_exports.optionalKey(HttpUrl),
+    discover: Schema_exports.optionalKey(Schema_exports.Never)
+  }).check(declaredAuthorizationQuery2),
+  Schema_exports.Struct({
+    grant: Schema_exports.Literal("client_credentials"),
+    discover: HttpUrl,
+    authorizationUrl: Schema_exports.optionalKey(Schema_exports.Never),
+    tokenUrl: Schema_exports.optionalKey(Schema_exports.Never),
+    revocationUrl: Schema_exports.optionalKey(Schema_exports.Never),
+    scopes: Schema_exports.optionalKey(Schema_exports.Array(Schema_exports.String)),
+    ...tokenRequestOptions2,
+    tokenEndpointAuthMethod: OAuthSecretClientAuth2,
+    resource: Schema_exports.optionalKey(Schema_exports.NullOr(HttpUrl))
+  }),
+  Schema_exports.Struct({
+    grant: Schema_exports.Literal("client_credentials"),
+    tokenUrl: HttpUrl,
+    revocationUrl: Schema_exports.optionalKey(HttpUrl),
+    scopes: Schema_exports.Array(Schema_exports.String),
+    ...tokenRequestOptions2,
+    tokenEndpointAuthMethod: OAuthSecretClientAuth2,
+    resource: Schema_exports.optionalKey(Schema_exports.NullOr(HttpUrl)),
+    authorizationUrl: Schema_exports.optionalKey(Schema_exports.Never),
+    discover: Schema_exports.optionalKey(Schema_exports.Never)
+  })
+]);
 
 // src/contracts/schedules.ts
 var minimumIntervalMilliseconds = 6e4;
@@ -2011,22 +2139,22 @@ var DeclaredAuthMethod = Schema_exports.Union([
   Schema_exports.Struct({ type: Schema_exports.Literal("secrets"), label: Schema_exports.String, fields: JsonObject2 }),
   Schema_exports.Struct({
     type: Schema_exports.Literal("oauth2"),
-    ...OAuth2Config.members[0].fields,
+    ...OAuth2Config2.members[0].fields,
     response: JsonObject2
   }),
   Schema_exports.Struct({
     type: Schema_exports.Literal("oauth2"),
-    ...OAuth2Config.members[1].fields,
+    ...OAuth2Config2.members[1].fields,
     response: JsonObject2
   }),
   Schema_exports.Struct({
     type: Schema_exports.Literal("oauth2"),
-    ...OAuth2Config.members[2].fields,
+    ...OAuth2Config2.members[2].fields,
     response: JsonObject2
   }),
   Schema_exports.Struct({
     type: Schema_exports.Literal("oauth2"),
-    ...OAuth2Config.members[3].fields,
+    ...OAuth2Config2.members[3].fields,
     response: JsonObject2
   })
 ]);
@@ -2499,6 +2627,67 @@ var protocol5 = {
   }
 };
 
+// src/contracts/protocols/6.ts
+var DeclaredAuthMethod2 = Schema_exports.Union([
+  Schema_exports.Struct({ type: Schema_exports.Literal("secrets"), label: Schema_exports.String, fields: JsonObject2 }),
+  Schema_exports.Struct({
+    type: Schema_exports.Literal("oauth2"),
+    ...OAuth2Config.members[0].fields,
+    response: JsonObject2
+  }),
+  Schema_exports.Struct({
+    type: Schema_exports.Literal("oauth2"),
+    ...OAuth2Config.members[1].fields,
+    response: JsonObject2
+  }),
+  Schema_exports.Struct({
+    type: Schema_exports.Literal("oauth2"),
+    ...OAuth2Config.members[2].fields,
+    response: JsonObject2
+  }),
+  Schema_exports.Struct({
+    type: Schema_exports.Literal("oauth2"),
+    ...OAuth2Config.members[3].fields,
+    response: JsonObject2
+  })
+]);
+var DeclaredProvider2 = Schema_exports.Struct({
+  name: Schema_exports.NonEmptyString,
+  auth: Schema_exports.Record(Schema_exports.NonEmptyString, DeclaredAuthMethod2)
+});
+var DeclaredRequirements3 = Schema_exports.Struct({
+  ...DeclaredRequirements2.fields,
+  accounts: Schema_exports.Record(
+    Schema_exports.NonEmptyString,
+    Schema_exports.Struct({
+      definition: DeclaredProvider2,
+      cardinality: Schema_exports.Literals(["one", "many"]),
+      health: Schema_exports.optionalKey(Schema_exports.Literal(true))
+    })
+  )
+});
+var ResolvedAccount2 = Schema_exports.Struct({
+  ...ResolvedAccount.fields,
+  provider: DeclaredProvider2
+});
+var ResolvedAccounts2 = Schema_exports.Record(
+  Schema_exports.NonEmptyString,
+  Schema_exports.Union([ResolvedAccount2, Schema_exports.Array(ResolvedAccount2)])
+);
+var HostInvocation4 = Schema_exports.Struct({
+  ...HostInvocation3.fields,
+  accounts: ResolvedAccounts2
+});
+var protocol6 = {
+  version: 6,
+  schemas: {
+    ...protocol5.schemas,
+    requirements: DeclaredRequirements3,
+    accounts: ResolvedAccounts2,
+    invocation: HostInvocation4
+  }
+};
+
 // src/contracts/host.ts
 var skillsCommand = (sources) => sources ? { operation: "skills", sources: true } : { operation: "skills" };
 var skillCatalog = (response) => Schema_exports.is(SkillSources2)(response) ? response : { skills: response };
@@ -2634,10 +2823,6 @@ export {
   CalendarSchedule,
   ScheduleTiming,
   OperationSchedule,
-  DeclaredAuthMethod,
-  DeclaredProvider,
-  ResolvedAccount,
-  ResolvedAccounts,
   TrustedToolApproval,
   InvocationDeadline,
   HostRequestInvalid,
@@ -2669,11 +2854,16 @@ export {
   HostError3 as HostError,
   HostResponse3 as HostResponse,
   protocol4,
-  DeclaredRequirements2 as DeclaredRequirements,
   AccountCheckCommand,
   HostRequest3 as HostRequest,
-  HostInvocation3 as HostInvocation,
   protocol5,
+  DeclaredAuthMethod2 as DeclaredAuthMethod,
+  DeclaredProvider2 as DeclaredProvider,
+  DeclaredRequirements3 as DeclaredRequirements,
+  ResolvedAccount2 as ResolvedAccount,
+  ResolvedAccounts2 as ResolvedAccounts,
+  HostInvocation4 as HostInvocation,
+  protocol6,
   skillsCommand,
   skillCatalog,
   inspectCommand,

package/js/{chunk-G4FT53I7.js → chunk-GKHJITGG.js}

@@ -2,7 +2,7 @@ import {
   adaptMcpTools,
   mcpClient,
   mcpJsonSchemaValidator
-} from "./chunk-TG6DOCRO.js";
+} from "./chunk-YHLXXXKH.js";
 import {
   accountProviderError,
   httpProviderError
@@ -11,7 +11,7 @@ import {
   McpError,
   McpToolsOptions,
   defaultMcpClientLimits
-} from "./chunk-6HSH75OI.js";
+} from "./chunk-CL3O2NIN.js";
 import {
   ProviderError
 } from "./chunk-R3EV5FTO.js";

package/js/{chunk-S73JGVR5.js → chunk-H34RQANV.js}

@@ -4,7 +4,7 @@ import {
 import {
   joinPath,
   mergeMeta
-} from "./chunk-YPKG2QO5.js";
+} from "./chunk-SWXGYMUW.js";
 import {
   parseProviderError
 } from "./chunk-MKWZPDR6.js";
@@ -17,7 +17,7 @@ import {
   HostedToolSummary,
   McpError,
   maxFailureMessageLength
-} from "./chunk-6HSH75OI.js";
+} from "./chunk-CL3O2NIN.js";
 import {
   AppDatabaseError
 } from "./chunk-N7YDVXYJ.js";

package/js/{chunk-4DWF4ZWI.js → chunk-JAKBOQ5T.js}

@@ -8,7 +8,7 @@ import {
   failureDetail,
   readCatalog,
   routerSkills
-} from "./chunk-S73JGVR5.js";
+} from "./chunk-H34RQANV.js";
 import {
   folderSkillsEffect
 } from "./chunk-IPI4MFSN.js";
@@ -18,7 +18,7 @@ import {
   isApp,
   toEffectApp,
   unavailableStorage
-} from "./chunk-4ASNKGCV.js";
+} from "./chunk-O5G3NDEO.js";
 import {
   parseDatabaseSchema
 } from "./chunk-ZQINWV4W.js";
@@ -28,7 +28,7 @@ import {
   locate,
   nativeOperation,
   toPromise
-} from "./chunk-YPKG2QO5.js";
+} from "./chunk-SWXGYMUW.js";
 import {
   accountProviderError,
   httpProviderError,
@@ -81,7 +81,7 @@ import {
   defaultWebhookTransportLimits,
   maxInputProblems,
   workflowDurationMillis
-} from "./chunk-6HSH75OI.js";
+} from "./chunk-CL3O2NIN.js";
 import {
   CacheError
 } from "./chunk-R3EV5FTO.js";

package/js/{chunk-4ASNKGCV.js → chunk-O5G3NDEO.js}

@@ -6,10 +6,10 @@ import {
   fromPromise,
   nativeOperation,
   nativeRouter
-} from "./chunk-YPKG2QO5.js";
+} from "./chunk-SWXGYMUW.js";
 import {
   ScheduleTiming
-} from "./chunk-6HSH75OI.js";
+} from "./chunk-CL3O2NIN.js";
 import {
   DatabaseSchema
 } from "./chunk-N7YDVXYJ.js";