apps 0.0.1-beta.15 → 0.0.1-beta.17

package/js/{chunk-RFVIONFX.js → chunk-4EMWIFFJ.js}

@@ -3,7 +3,7 @@ import {
 } from "./chunk-R3EV5FTO.js";
 import {
   wrap
-} from "./chunk-5T57N25Q.js";
+} from "./chunk-4QQ62BVS.js";
 import {
   JsonObject
 } from "./chunk-27F7W2LG.js";

package/js/{chunk-5T57N25Q.js → chunk-4QQ62BVS.js}

@@ -1145,6 +1145,25 @@ function object(fields) {
   ) : Schema_exports.Struct(Object.fromEntries(entries));
   return { ...wrap(decoder, false), fields: Object.freeze({ ...fields }) };
 }
+var Exposure = /* @__PURE__ */ Symbol("apps.FieldExposure");
+var exposureOf = (schema) => Exposure in schema && (schema[Exposure] === "plain" || schema[Exposure] === "raw") ? schema[Exposure] : void 0;
+var expose = (schema, exposure) => (
+  // SAFETY: the copy keeps every member of S, and `optional` and `default` keep the marking.
+  {
+    ...schema,
+    [Exposure]: exposure,
+    optional: () => expose(schema.optional(), exposure),
+    default: (value) => expose(schema.default(value), exposure)
+  }
+);
+var plain = (schema) => expose(schema, "plain");
+var raw = (schema) => expose(schema, "raw");
+var fieldExposure = (fields) => Object.fromEntries(
+  Object.entries(fields).flatMap(([name, field]) => {
+    const exposure = exposureOf(field);
+    return exposure === void 0 ? [] : [[name, exposure]];
+  })
+);
 var ImportedJsonSchema = /* @__PURE__ */ Symbol("apps.JsonSchemaDocument");
 var importedJsonSchema = (decoder) => ImportedJsonSchema in decoder ? decoder[ImportedJsonSchema] : void 0;
 var withJsonSchemaDocument = (decoder, document) => Object.assign(decoder, { [ImportedJsonSchema]: document });
@@ -1412,6 +1431,9 @@ export {
   literal,
   array,
   object,
+  plain,
+  raw,
+  fieldExposure,
   importedJsonSchema,
   once,
   withLazyJsonSchemaDocument,

package/js/{chunk-YHLXXXKH.js → chunk-7H44SOSX.js}

@@ -1,9 +1,9 @@
 import {
   prepareElicitation
-} from "./chunk-JAKBOQ5T.js";
+} from "./chunk-ZKISLYWM.js";
 import {
   fromPromise
-} from "./chunk-SWXGYMUW.js";
+} from "./chunk-NMKHTJOQ.js";
 import {
   ElicitationFailed,
   McpError,
@@ -15,11 +15,11 @@ import {
   defaultElicitationLimits,
   defaultMcpClientLimits,
   mcpSdkTimerCeilingMs
-} from "./chunk-CL3O2NIN.js";
+} from "./chunk-VXWY44LE.js";
 import {
   compileJsonSchemaDecoder,
   jsonSchemaDecoder
-} from "./chunk-5T57N25Q.js";
+} from "./chunk-4QQ62BVS.js";
 import {
   JsonObject
 } from "./chunk-27F7W2LG.js";

package/js/{chunk-H34RQANV.js → chunk-F2IASQK2.js}

@@ -4,7 +4,7 @@ import {
 import {
   joinPath,
   mergeMeta
-} from "./chunk-SWXGYMUW.js";
+} from "./chunk-NMKHTJOQ.js";
 import {
   parseProviderError
 } from "./chunk-MKWZPDR6.js";
@@ -17,7 +17,7 @@ import {
   HostedToolSummary,
   McpError,
   maxFailureMessageLength
-} from "./chunk-CL3O2NIN.js";
+} from "./chunk-VXWY44LE.js";
 import {
   AppDatabaseError
 } from "./chunk-N7YDVXYJ.js";
@@ -27,7 +27,7 @@ import {
 } from "./chunk-JU7VHODU.js";
 import {
   jsonSchemaDocument
-} from "./chunk-5T57N25Q.js";
+} from "./chunk-4QQ62BVS.js";
 import {
   AppStorageError,
   AppStorageUnavailable

package/js/{chunk-4J3IQXFD.js → chunk-HQY4UTYX.js}

@@ -1,11 +1,11 @@
 import {
   fixedRouter
-} from "./chunk-H34RQANV.js";
+} from "./chunk-F2IASQK2.js";
 import {
   nativeOperation,
   operationDeclaration,
   routerDeclaration
-} from "./chunk-SWXGYMUW.js";
+} from "./chunk-NMKHTJOQ.js";
 
 // src/implementation/protocol-operations.ts
 var protocolOperations = (operations, kinds = {}) => {

package/js/{chunk-GKHJITGG.js → chunk-MAF4BRQF.js}

@@ -2,7 +2,7 @@ import {
   adaptMcpTools,
   mcpClient,
   mcpJsonSchemaValidator
-} from "./chunk-YHLXXXKH.js";
+} from "./chunk-7H44SOSX.js";
 import {
   accountProviderError,
   httpProviderError
@@ -11,7 +11,7 @@ import {
   McpError,
   McpToolsOptions,
   defaultMcpClientLimits
-} from "./chunk-CL3O2NIN.js";
+} from "./chunk-VXWY44LE.js";
 import {
   ProviderError
 } from "./chunk-R3EV5FTO.js";

package/js/{chunk-SWXGYMUW.js → chunk-NMKHTJOQ.js}

@@ -3,10 +3,10 @@ import {
   RouterKey,
   RouterMeta,
   reservedRouterKeys
-} from "./chunk-CL3O2NIN.js";
+} from "./chunk-VXWY44LE.js";
 import {
   decoderOf
-} from "./chunk-5T57N25Q.js";
+} from "./chunk-4QQ62BVS.js";
 import {
   Effect_exports,
   Schema_exports
@@ -68,13 +68,18 @@ var operationOptions = (options) => {
     }
   };
 };
+var approvedOperation = (operation, approval) => {
+  const copy = Object.defineProperties({}, Object.getOwnPropertyDescriptors(operation));
+  return Object.defineProperty(copy, "approval", {
+    enumerable: true,
+    value: (context) => Effect_exports.tryPromise({ try: async () => approval(context), catch: (error) => error })
+  });
+};
 var withApproval = (operation, approval) => ({
   ...operation,
-  [NativeOperation]: {
-    ...operation[NativeOperation],
-    approval: (context) => Effect_exports.tryPromise({ try: async () => approval(context), catch: (error) => error })
-  }
+  [NativeOperation]: approvedOperation(operation[NativeOperation], approval)
 });
+var toolAnnotations = (operation) => nativeOperation(operation)?.annotations;
 var make = (kind, options, run) => operationDeclaration({
   ...operationOptions(options),
   kind,
@@ -189,6 +194,44 @@ var declaredOperations = (root, path = "") => Object.entries(root?.children ?? {
       return [];
   }
 });
+var withApprovals = (source, policy) => {
+  const native = nativeRouter(source);
+  if (native === void 0) throw new Error("withApprovals expects a router");
+  const operation = (node, name) => {
+    const approval = policy(operationDeclaration(node), name);
+    return approval === void 0 ? node : approvedOperation(node, approval);
+  };
+  const child = (node, name) => {
+    switch (node.kind) {
+      case "query":
+      case "mutation":
+        return operation(node, name);
+      case "router":
+      case "dynamic":
+        return walk(node, name);
+    }
+  };
+  const walk = (node, path) => node.kind === "dynamic" ? {
+    ...node,
+    resolve: (name) => node.resolve(name).pipe(
+      Effect_exports.flatMap(
+        (resolved) => resolved === void 0 ? Effect_exports.succeed(void 0) : Effect_exports.try({
+          try: () => operation(resolved, joinPath(path, name)),
+          catch: (error) => error
+        })
+      )
+    )
+  } : {
+    ...node,
+    children: Object.fromEntries(
+      Object.entries(node.children).map(([key, value]) => [
+        key,
+        child(value, joinPath(path, key))
+      ])
+    )
+  };
+  return routerDeclaration(walk(native, ""));
+};
 
 export {
   fromPromise,
@@ -196,6 +239,7 @@ export {
   operationDeclaration,
   nativeOperation,
   withApproval,
+  toolAnnotations,
   query,
   mutation,
   routerDeclaration,
@@ -205,5 +249,6 @@ export {
   dynamicRouter,
   joinPath,
   locate,
-  declaredOperations
+  declaredOperations,
+  withApprovals
 };

package/js/{chunk-CL3O2NIN.js → chunk-VXWY44LE.js}

@@ -1954,7 +1954,7 @@ var ManyAccounts = class extends Data_exports.TaggedClass("many") {
 };
 
 // src/contracts/protocol-version.ts
-var frameworkProtocol = 6;
+var frameworkProtocol = 7;
 
 // src/contracts/protocols/oauth.ts
 var OAuthClientAuth2 = Schema_exports.Literals([
@@ -2688,6 +2688,88 @@ var protocol6 = {
   }
 };
 
+// src/contracts/protocols/7.ts
+var CredentialHost = Schema_exports.String.check(
+  Schema_exports.isPattern(
+    /^(\*\.)?[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*(?::[0-9]{1,5})?$/
+  )
+);
+var exposure = {
+  /** Not secret: app code reads the real value and forms show it. */
+  plain: Schema_exports.optionalKey(Schema_exports.Array(Schema_exports.NonEmptyString)),
+  /** Secret, but app code reads the real value, for signing and similar uses. */
+  raw: Schema_exports.optionalKey(Schema_exports.Array(Schema_exports.NonEmptyString))
+};
+var DeclaredAuthMethod3 = Schema_exports.Union([
+  Schema_exports.Struct({
+    type: Schema_exports.Literal("secrets"),
+    label: Schema_exports.String,
+    fields: JsonObject2,
+    ...exposure
+  }),
+  Schema_exports.Struct({
+    type: Schema_exports.Literal("oauth2"),
+    ...OAuth2Config.members[0].fields,
+    response: JsonObject2,
+    ...exposure
+  }),
+  Schema_exports.Struct({
+    type: Schema_exports.Literal("oauth2"),
+    ...OAuth2Config.members[1].fields,
+    response: JsonObject2,
+    ...exposure
+  }),
+  Schema_exports.Struct({
+    type: Schema_exports.Literal("oauth2"),
+    ...OAuth2Config.members[2].fields,
+    response: JsonObject2,
+    ...exposure
+  }),
+  Schema_exports.Struct({
+    type: Schema_exports.Literal("oauth2"),
+    ...OAuth2Config.members[3].fields,
+    response: JsonObject2,
+    ...exposure
+  })
+]);
+var DeclaredProvider3 = Schema_exports.Struct({
+  name: Schema_exports.NonEmptyString,
+  auth: Schema_exports.Record(Schema_exports.NonEmptyString, DeclaredAuthMethod3),
+  hosts: Schema_exports.optionalKey(Schema_exports.Array(CredentialHost))
+});
+var DeclaredRequirements4 = Schema_exports.Struct({
+  ...DeclaredRequirements3.fields,
+  accounts: Schema_exports.Record(
+    Schema_exports.NonEmptyString,
+    Schema_exports.Struct({
+      definition: DeclaredProvider3,
+      cardinality: Schema_exports.Literals(["one", "many"]),
+      health: Schema_exports.optionalKey(Schema_exports.Literal(true))
+    })
+  )
+});
+var ResolvedAccount3 = Schema_exports.Struct({
+  ...ResolvedAccount2.fields,
+  provider: DeclaredProvider3
+});
+var ResolvedAccounts3 = Schema_exports.Record(
+  Schema_exports.NonEmptyString,
+  Schema_exports.Union([ResolvedAccount3, Schema_exports.Array(ResolvedAccount3)])
+);
+var HostInvocation5 = Schema_exports.Struct({
+  ...HostInvocation4.fields,
+  accounts: ResolvedAccounts3
+});
+var protocol7 = {
+  version: 7,
+  schemas: {
+    ...protocol6.schemas,
+    requirements: DeclaredRequirements4,
+    accounts: ResolvedAccounts3,
+    invocation: HostInvocation5
+  }
+};
+
 // src/contracts/host.ts
 var skillsCommand = (sources) => sources ? { operation: "skills", sources: true } : { operation: "skills" };
 var skillCatalog = (response) => Schema_exports.is(SkillSources2)(response) ? response : { skills: response };
@@ -2857,13 +2939,15 @@ export {
   AccountCheckCommand,
   HostRequest3 as HostRequest,
   protocol5,
-  DeclaredAuthMethod2 as DeclaredAuthMethod,
-  DeclaredProvider2 as DeclaredProvider,
-  DeclaredRequirements3 as DeclaredRequirements,
-  ResolvedAccount2 as ResolvedAccount,
-  ResolvedAccounts2 as ResolvedAccounts,
-  HostInvocation4 as HostInvocation,
   protocol6,
+  CredentialHost,
+  DeclaredAuthMethod3 as DeclaredAuthMethod,
+  DeclaredProvider3 as DeclaredProvider,
+  DeclaredRequirements4 as DeclaredRequirements,
+  ResolvedAccount3 as ResolvedAccount,
+  ResolvedAccounts3 as ResolvedAccounts,
+  HostInvocation5 as HostInvocation,
+  protocol7,
   skillsCommand,
   skillCatalog,
   inspectCommand,

package/js/{chunk-O5G3NDEO.js → chunk-XNCYIB4D.js}

@@ -6,10 +6,10 @@ import {
   fromPromise,
   nativeOperation,
   nativeRouter
-} from "./chunk-SWXGYMUW.js";
+} from "./chunk-NMKHTJOQ.js";
 import {
   ScheduleTiming
-} from "./chunk-CL3O2NIN.js";
+} from "./chunk-VXWY44LE.js";
 import {
   DatabaseSchema
 } from "./chunk-N7YDVXYJ.js";
@@ -17,7 +17,7 @@ import {
   decoderOf,
   isSchema,
   storageFieldOf
-} from "./chunk-5T57N25Q.js";
+} from "./chunk-4QQ62BVS.js";
 import {
   AppStorageUnavailable
 } from "./chunk-PZB6T6KU.js";

package/js/{chunk-JAKBOQ5T.js → chunk-ZKISLYWM.js}

@@ -8,7 +8,7 @@ import {
   failureDetail,
   readCatalog,
   routerSkills
-} from "./chunk-H34RQANV.js";
+} from "./chunk-F2IASQK2.js";
 import {
   folderSkillsEffect
 } from "./chunk-IPI4MFSN.js";
@@ -18,7 +18,7 @@ import {
   isApp,
   toEffectApp,
   unavailableStorage
-} from "./chunk-O5G3NDEO.js";
+} from "./chunk-XNCYIB4D.js";
 import {
   parseDatabaseSchema
 } from "./chunk-ZQINWV4W.js";
@@ -28,7 +28,7 @@ import {
   locate,
   nativeOperation,
   toPromise
-} from "./chunk-SWXGYMUW.js";
+} from "./chunk-NMKHTJOQ.js";
 import {
   accountProviderError,
   httpProviderError,
@@ -81,7 +81,7 @@ import {
   defaultWebhookTransportLimits,
   maxInputProblems,
   workflowDurationMillis
-} from "./chunk-CL3O2NIN.js";
+} from "./chunk-VXWY44LE.js";
 import {
   CacheError
 } from "./chunk-R3EV5FTO.js";
@@ -99,7 +99,7 @@ import {
   importedJsonSchema,
   jsonSchemaDecoder,
   jsonSchemaDocument
-} from "./chunk-5T57N25Q.js";
+} from "./chunk-4QQ62BVS.js";
 import {
   JsonObject,
   JsonValue
@@ -594,6 +594,12 @@ var declarationSafe = (work, summary) => Effect_exports.suspend(work).pipe(
     (cause) => Cause_exports.hasInterrupts(cause) ? Effect_exports.interrupt : Effect_exports.fail(declarationInvalid(summary, Cause_exports.squash(cause)))
   )
 );
+function declaredExposure(exposure) {
+  const named = (kind) => Object.entries(exposure ?? {}).filter(([, value]) => value === kind).map(([field]) => field).sort();
+  const plain = named("plain");
+  const raw = named("raw");
+  return { ...plain.length === 0 ? {} : { plain }, ...raw.length === 0 ? {} : { raw } };
+}
 function providerDeclaration(provider) {
   return declarationSafe(
     () => Effect_exports.gen(function* () {
@@ -604,21 +610,25 @@ function providerDeclaration(provider) {
             auth.set(name, {
               type: "secrets",
               label: method.label,
-              fields: yield* jsonSchemaDocument(method.fields)
+              fields: yield* jsonSchemaDocument(method.fields),
+              ...declaredExposure(method.exposure)
             });
             break;
           case "oauth2":
             auth.set(name, {
               type: "oauth2",
               ...method.config,
-              response: yield* jsonSchemaDocument(method.response)
+              response: yield* jsonSchemaDocument(method.response),
+              ...declaredExposure(method.exposure)
             });
             break;
         }
       }
       return yield* Schema_exports.decodeUnknownEffect(DeclaredProvider)({
         name: provider.name,
-        auth: Object.fromEntries(auth)
+        auth: Object.fromEntries(auth),
+        // Order and repetition carry no meaning, so neither changes the provider's identity.
+        ...provider.hosts === void 0 ? {} : { hosts: [...new Set(provider.hosts)].sort() }
       });
     }),
     `Account provider "${provider.name}" has an invalid declaration`
@@ -653,6 +663,9 @@ function canonical(value) {
   }
   return JSON.stringify(value);
 }
+function withoutHosts({ hosts: _hosts, ...provider }) {
+  return provider;
+}
 function bindAccounts(slots, declarations, context) {
   return safe2(
     () => Effect_exports.gen(function* () {
@@ -678,7 +691,7 @@ function bindAccounts(slots, declarations, context) {
         for (const account of accounts) {
           if (ids.has(account.id)) return yield* Effect_exports.fail(new HostAccountsInvalid());
           ids.add(account.id);
-          if (canonical(account.provider) !== canonical(requirement.definition) || !Object.hasOwn(provider.auth, account.method))
+          if (canonical(withoutHosts(account.provider)) !== canonical(withoutHosts(requirement.definition)) || !Object.hasOwn(provider.auth, account.method))
             return yield* Effect_exports.fail(new HostAccountsInvalid());
           const method = provider.auth[account.method];
           if (method === void 0) return yield* Effect_exports.fail(new HostAccountsInvalid());

package/js/client.js

@@ -27,7 +27,7 @@ import {
 } from "./chunk-UK573G7W.js";
 import {
   decoderOf
-} from "./chunk-5T57N25Q.js";
+} from "./chunk-4QQ62BVS.js";
 import {
   StorageName
 } from "./chunk-PZB6T6KU.js";

package/js/contracts.js

@@ -6,6 +6,7 @@ import {
   ApprovalElicitation,
   ApprovalResponse,
   CalendarSchedule,
+  CredentialHost,
   DeclaredAuthMethod,
   DeclaredProvider,
   DeclaredRequirements,
@@ -108,11 +109,12 @@ import {
   protocol4,
   protocol5,
   protocol6,
+  protocol7,
   selectTools,
   skillCatalog,
   skillsCommand,
   workflowDurationMillis
-} from "./chunk-CL3O2NIN.js";
+} from "./chunk-VXWY44LE.js";
 import {
   DatabaseFieldReserved,
   DatabaseLimitExceeded
@@ -159,6 +161,7 @@ export {
   ApprovalElicitation,
   ApprovalResponse,
   CalendarSchedule,
+  CredentialHost,
   DatabaseFieldReserved,
   DatabaseLimitExceeded,
   DeclaredAuthMethod,
@@ -271,6 +274,7 @@ export {
   protocol4,
   protocol5,
   protocol6,
+  protocol7,
   selectTools,
   skillCatalog,
   skillFormatLimits,

package/js/effect.js

@@ -3,17 +3,17 @@ import {
   ApprovalDecision,
   createAppHandler,
   prepareElicitation
-} from "./chunk-JAKBOQ5T.js";
+} from "./chunk-ZKISLYWM.js";
 import "./chunk-NKLWZJLE.js";
-import "./chunk-H34RQANV.js";
+import "./chunk-F2IASQK2.js";
 import "./chunk-IPI4MFSN.js";
-import "./chunk-O5G3NDEO.js";
+import "./chunk-XNCYIB4D.js";
 import "./chunk-ZQINWV4W.js";
-import "./chunk-SWXGYMUW.js";
+import "./chunk-NMKHTJOQ.js";
 import "./chunk-MKWZPDR6.js";
 import {
   ToolAnnotations
-} from "./chunk-CL3O2NIN.js";
+} from "./chunk-VXWY44LE.js";
 import "./chunk-N7YDVXYJ.js";
 import "./chunk-R3EV5FTO.js";
 import "./chunk-JU7VHODU.js";
@@ -25,7 +25,7 @@ import {
   decoderOf,
   jsonSchemaDecoder,
   wrap
-} from "./chunk-5T57N25Q.js";
+} from "./chunk-4QQ62BVS.js";
 import "./chunk-PZB6T6KU.js";
 import {
   HttpUrl,

package/js/graphql.js

@@ -1,28 +1,28 @@
 import {
   catalogCache
-} from "./chunk-RFVIONFX.js";
+} from "./chunk-4EMWIFFJ.js";
 import {
   protocolOperations
-} from "./chunk-4J3IQXFD.js";
+} from "./chunk-HQY4UTYX.js";
 import "./chunk-BCSNKUAC.js";
-import "./chunk-JAKBOQ5T.js";
+import "./chunk-ZKISLYWM.js";
 import {
   cacheKey
 } from "./chunk-NKLWZJLE.js";
-import "./chunk-H34RQANV.js";
+import "./chunk-F2IASQK2.js";
 import "./chunk-IPI4MFSN.js";
-import "./chunk-O5G3NDEO.js";
+import "./chunk-XNCYIB4D.js";
 import "./chunk-ZQINWV4W.js";
 import {
   nativeOperation,
   routerDeclaration
-} from "./chunk-SWXGYMUW.js";
+} from "./chunk-NMKHTJOQ.js";
 import {
   accountProviderError,
   graphqlProviderError,
   httpProviderError
 } from "./chunk-MKWZPDR6.js";
-import "./chunk-CL3O2NIN.js";
+import "./chunk-VXWY44LE.js";
 import "./chunk-N7YDVXYJ.js";
 import {
   ProviderError
@@ -38,7 +38,7 @@ import {
 } from "./chunk-UK573G7W.js";
 import {
   jsonSchemaDecoder
-} from "./chunk-5T57N25Q.js";
+} from "./chunk-4QQ62BVS.js";
 import "./chunk-PZB6T6KU.js";
 import {
   AccountId,

package/js/host.js

@@ -1,12 +1,12 @@
 import {
   createAppHandler
-} from "./chunk-JAKBOQ5T.js";
+} from "./chunk-ZKISLYWM.js";
 import "./chunk-NKLWZJLE.js";
-import "./chunk-H34RQANV.js";
+import "./chunk-F2IASQK2.js";
 import "./chunk-IPI4MFSN.js";
-import "./chunk-O5G3NDEO.js";
+import "./chunk-XNCYIB4D.js";
 import "./chunk-ZQINWV4W.js";
-import "./chunk-SWXGYMUW.js";
+import "./chunk-NMKHTJOQ.js";
 import "./chunk-MKWZPDR6.js";
 import {
   ElicitationFailed,
@@ -21,7 +21,7 @@ import {
   WorkflowRun,
   WorkflowRunId,
   WorkflowRunPage
-} from "./chunk-CL3O2NIN.js";
+} from "./chunk-VXWY44LE.js";
 import "./chunk-N7YDVXYJ.js";
 import {
   CacheCommand,
@@ -35,7 +35,7 @@ import {
 } from "./chunk-ODEIDRGW.js";
 import "./chunk-57RKNWL2.js";
 import "./chunk-UK573G7W.js";
-import "./chunk-5T57N25Q.js";
+import "./chunk-4QQ62BVS.js";
 import "./chunk-PZB6T6KU.js";
 import "./chunk-27F7W2LG.js";
 import {