apps 0.0.1-beta.26 → 0.0.1-beta.28

package/js/{chunk-AAAMPT6F.js → chunk-65SZ23BK.js}

@@ -3,7 +3,7 @@ import {
   invalidate,
   layer,
   mutation
-} from "./chunk-XBG3M64K.js";
+} from "./chunk-6JBTHTI5.js";
 import {
   Boolean,
   Cause,
@@ -158,7 +158,7 @@ import {
   void_2,
   whileLoop,
   zipRight
-} from "./chunk-DM5U7G7V.js";
+} from "./chunk-NXTXZ635.js";
 import {
   __export
 } from "./chunk-CZ7CSFO4.js";

package/js/{chunk-XBG3M64K.js → chunk-6JBTHTI5.js}

@@ -58,7 +58,7 @@ import {
   useSpan,
   void_2 as void_,
   withFiber
-} from "./chunk-DM5U7G7V.js";
+} from "./chunk-NXTXZ635.js";
 
 // ../../node_modules/.bun/effect@https+++pkg.pr.new+Effect-TS+effect+effect@c7d1ffff31a3e2ae0b0b+a654a55b752bdb24/node_modules/effect/dist/unstable/reactivity/Reactivity.js
 var TypeId = "~effect/reactivity/Reactivity";

package/js/{chunk-OBXHLFGQ.js → chunk-B5YJQU45.js}

@@ -211,7 +211,7 @@ import {
   withFiber,
   withParentSpan,
   zero2 as zero
-} from "./chunk-DM5U7G7V.js";
+} from "./chunk-NXTXZ635.js";
 import {
   __export
 } from "./chunk-CZ7CSFO4.js";

package/js/{chunk-T7WRQJUF.js → chunk-BRGF7VFN.js}

@@ -1,9 +1,9 @@
 import {
   AccountId
-} from "./chunk-KKGRSXUK.js";
+} from "./chunk-PWF2DRJ3.js";
 import {
   Schema_exports
-} from "./chunk-DM5U7G7V.js";
+} from "./chunk-NXTXZ635.js";
 
 // src/contracts/failure.ts
 var maxFailureMessageLength = 2048;

package/js/{chunk-HQKIPKM5.js → chunk-BTJMXW4I.js}

@@ -1,6 +1,6 @@
 import {
   Schema_exports
-} from "./chunk-DM5U7G7V.js";
+} from "./chunk-NXTXZ635.js";
 
 // src/contracts/storage.ts
 var StorageName = Schema_exports.NonEmptyString.check(Schema_exports.isMaxLength(200));

package/js/{chunk-BTRBOOTD.js → chunk-GLIAMV2R.js}

@@ -1,8 +1,9 @@
 import {
   makeCache
-} from "./chunk-ZVMZWXVF.js";
+} from "./chunk-VUVBMNKC.js";
 import {
   accountSecrets,
+  appInvocationFetch,
   boundFailureMessage,
   describeFailure,
   failureDetail,
@@ -10,32 +11,32 @@ import {
   parseMcpError,
   readCatalog,
   routerSkills
-} from "./chunk-EXDR4HVM.js";
+} from "./chunk-JN3PEGMW.js";
 import {
   folderSkillsEffect
-} from "./chunk-PC5RHPUP.js";
+} from "./chunk-TSLG2WPA.js";
 import {
   ResponseStatusError,
   authorDatabase,
   isApp,
   toEffectApp,
   unavailableStorage
-} from "./chunk-NXO2GN2T.js";
+} from "./chunk-VF3X26ZO.js";
 import {
   parseDatabaseSchema
-} from "./chunk-LPN4ONWW.js";
+} from "./chunk-XBQTJP76.js";
 import {
   declaredOperations,
   fromPromise,
   locate,
   nativeOperation,
   toPromise
-} from "./chunk-WPKXOTKM.js";
+} from "./chunk-GQ7GCZ4J.js";
 import {
   accountProviderError,
   httpProviderError,
   parseProviderError
-} from "./chunk-DAIW2WM3.js";
+} from "./chunk-KQCMHI3K.js";
 import {
   AccountCheckResult,
   DeclaredProvider,
@@ -82,29 +83,28 @@ import {
   defaultWebhookTransportLimits,
   maxInputProblems,
   workflowDurationMillis
-} from "./chunk-VGEPL4BV.js";
+} from "./chunk-TE2HPDZG.js";
 import {
   CacheError
-} from "./chunk-T7WRQJUF.js";
+} from "./chunk-BRGF7VFN.js";
 import {
   AppSkills,
   SkillFile,
   SkillLoadFailed
-} from "./chunk-TACLXEAE.js";
+} from "./chunk-NSBRV4FJ.js";
 import {
-  captureTelemetry,
-  invocationFetch
-} from "./chunk-DUEZ2XCO.js";
+  captureTelemetry
+} from "./chunk-YXKXKGN6.js";
 import {
   decoderOf,
   importedJsonSchema,
   jsonSchemaDecoder,
   jsonSchemaDocument
-} from "./chunk-IE6W5RNN.js";
+} from "./chunk-YML53Z7H.js";
 import {
   JsonObject,
   JsonValue
-} from "./chunk-KKGRSXUK.js";
+} from "./chunk-PWF2DRJ3.js";
 import {
   Cause_exports,
   Clock_exports,
@@ -116,7 +116,7 @@ import {
   SchemaIssue_exports,
   Schema_exports,
   Stream_exports
-} from "./chunk-DM5U7G7V.js";
+} from "./chunk-NXTXZ635.js";
 
 // src/implementation/elicitation.ts
 var prepareElicitation = (input) => Effect_exports.gen(function* () {
@@ -505,7 +505,7 @@ var authorCache = (host, accounts, signal, deadline) => {
       ...options.staleFor === void 0 ? {} : { staleFor: options.staleFor },
       load: Effect_exports.acquireUseRelease(
         Effect_exports.sync(() => new AbortController()),
-        (controller) => invocationFetch(controller.signal).pipe(
+        (controller) => appInvocationFetch(controller.signal).pipe(
           Effect_exports.flatMap(
             (fetch) => fromPromise(options.load)({
               fetch,
@@ -805,7 +805,8 @@ function dispatch(app, request, context, signal) {
           declared,
           request.requirement,
           context,
-          invocationSignal
+          invocationSignal,
+          deadline
         ).pipe(withinDeadline);
       let running;
       let transactionOpen = false;
@@ -864,7 +865,7 @@ function dispatch(app, request, context, signal) {
         ),
         workflows: workflowReads,
         signal: invocationSignal,
-        fetch: yield* invocationFetch(fetching.signal),
+        fetch: yield* appInvocationFetch(fetching.signal),
         elicit: makeElicit(delivery, invocationSignal)
       };
       const definition = yield* evaluationSafe(native.evaluate(bound), secrets).pipe(
@@ -941,7 +942,7 @@ function dispatch(app, request, context, signal) {
                   signal2
                 ),
                 files,
-                fetch: yield* invocationFetch(signal2),
+                fetch: yield* appInvocationFetch(signal2),
                 signal: signal2,
                 runId: execution.runId,
                 stepId,
@@ -1079,7 +1080,7 @@ function dispatch(app, request, context, signal) {
         transactionOpen = db !== void 0;
         const output = yield* Effect_exports.gen(function* () {
           running = yield* captureTelemetry;
-          const fetch = yield* invocationFetch(fetching.signal);
+          const fetch = yield* appInvocationFetch(fetching.signal);
           return yield* tool.run(
             {
               ...bound,
@@ -1155,7 +1156,7 @@ function dispatch(app, request, context, signal) {
     })
   );
 }
-function checkAccount(slots, declared, requirement, context, signal) {
+function checkAccount(slots, declared, requirement, context, signal, deadline) {
   return Effect_exports.gen(function* () {
     const selection = Object.hasOwn(slots, requirement) ? slots[requirement] : void 0;
     const slot = Object.hasOwn(declared.accounts, requirement) ? declared.accounts[requirement] : void 0;
@@ -1172,7 +1173,12 @@ function checkAccount(slots, declared, requirement, context, signal) {
     if (account === void 0 || !("id" in account)) return yield* new HostAccountsInvalid();
     const result = yield* Effect_exports.suspend(
       () => Effect_exports.gen(function* () {
-        return yield* health.run({ account, fetch: yield* invocationFetch(signal), signal });
+        return yield* health.run({
+          account,
+          fetch: yield* appInvocationFetch(signal),
+          signal,
+          ...deadline === void 0 ? {} : { deadline }
+        });
       })
     ).pipe(
       Effect_exports.catchCause((cause) => {

package/js/{chunk-WPKXOTKM.js → chunk-GQ7GCZ4J.js}

@@ -3,14 +3,14 @@ import {
   RouterKey,
   RouterMeta,
   reservedRouterKeys
-} from "./chunk-VGEPL4BV.js";
+} from "./chunk-TE2HPDZG.js";
 import {
   decoderOf
-} from "./chunk-IE6W5RNN.js";
+} from "./chunk-YML53Z7H.js";
 import {
   Effect_exports,
   Schema_exports
-} from "./chunk-DM5U7G7V.js";
+} from "./chunk-NXTXZ635.js";
 
 // src/implementation/authoring.ts
 var NativeCallback = /* @__PURE__ */ Symbol("apps.NativeCallback");

package/js/{chunk-EXDR4HVM.js → chunk-JN3PEGMW.js}

@@ -1,27 +1,35 @@
 import {
   skillFromFiles
-} from "./chunk-PC5RHPUP.js";
+} from "./chunk-TSLG2WPA.js";
 import {
   joinPath,
   mergeMeta
-} from "./chunk-WPKXOTKM.js";
+} from "./chunk-GQ7GCZ4J.js";
 import {
   isShortenedUpstream,
   parseProviderError,
   providerError
-} from "./chunk-DAIW2WM3.js";
+} from "./chunk-KQCMHI3K.js";
 import {
   ApiErrorResponse,
+  FetchOptionUnsupported,
   HostDeclarationInvalid,
   HostEvaluationFailed,
   HostedRouter,
   HostedTool,
   HostedToolSummary,
-  McpError
-} from "./chunk-VGEPL4BV.js";
+  McpCredentialsUnverified,
+  McpError,
+  NetworkRefused,
+  NetworkRefusedHeader,
+  RestrictedFetchOption,
+  networkRefusalHeader,
+  networkRefusalStatus,
+  supportedFetchOptions
+} from "./chunk-TE2HPDZG.js";
 import {
   AppDatabaseError
-} from "./chunk-GH6PY5BQ.js";
+} from "./chunk-M2KEEOIQ.js";
 import {
   CacheError,
   FailureCode,
@@ -30,32 +38,36 @@ import {
   maxFailureFields,
   maxFailureMessageLength,
   maxUpstreamMessageLength
-} from "./chunk-T7WRQJUF.js";
+} from "./chunk-BRGF7VFN.js";
 import {
   SkillLoadFailed,
   skillFormatLimits
-} from "./chunk-TACLXEAE.js";
+} from "./chunk-NSBRV4FJ.js";
+import {
+  invocationFetch
+} from "./chunk-YXKXKGN6.js";
 import {
   jsonSchemaDocument
-} from "./chunk-IE6W5RNN.js";
+} from "./chunk-YML53Z7H.js";
 import {
   AppStorageError,
   AppStorageUnavailable
-} from "./chunk-HQKIPKM5.js";
+} from "./chunk-BTJMXW4I.js";
 import {
   AccountId,
   HttpUrl,
   JsonObject
-} from "./chunk-KKGRSXUK.js";
+} from "./chunk-PWF2DRJ3.js";
 import {
   Cause_exports,
   Effect_exports,
+  Match_exports,
   Option_exports,
   Predicate_exports,
   Redacted_exports,
   Result_exports,
   Schema_exports
-} from "./chunk-DM5U7G7V.js";
+} from "./chunk-NXTXZ635.js";
 
 // src/contracts/openapi.ts
 var OpenapiErrorResponse = Schema_exports.Struct({
@@ -250,6 +262,35 @@ var OpenapiCompileError = class extends Schema_exports.TaggedError()(
   }
 };
 
+// src/implementation/network.ts
+var refusalHeader = (status, header) => status === networkRefusalStatus && header !== null && header !== void 0 ? header : void 0;
+var failOnNetworkRefusal = (response) => {
+  const header = refusalHeader(response.status, response.headers[networkRefusalHeader]);
+  return header === void 0 ? Effect_exports.void : Schema_exports.decodeUnknownEffect(NetworkRefusedHeader)(header).pipe(
+    Effect_exports.orDie,
+    Effect_exports.flatMap(Effect_exports.fail)
+  );
+};
+var unsupportedOption = (init) => {
+  for (const option of RestrictedFetchOption.literals) {
+    const value = init?.[option];
+    const supported = supportedFetchOptions[option];
+    if (value !== void 0 && !supported.includes(value))
+      return new FetchOptionUnsupported({ option, value: String(value), supported });
+  }
+  return void 0;
+};
+var appFetch = (fetch) => async (input, init) => {
+  const unsupported = unsupportedOption(init);
+  if (unsupported !== void 0) throw unsupported;
+  const response = await fetch(input, init);
+  const header = refusalHeader(response.status, response.headers.get(networkRefusalHeader));
+  if (header === void 0) return response;
+  await response.body?.cancel();
+  throw Schema_exports.decodeUnknownSync(NetworkRefusedHeader)(header);
+};
+var appInvocationFetch = (signal) => invocationFetch(signal).pipe(Effect_exports.map(appFetch));
+
 // src/implementation/failure-detail.ts
 var storageMessages = {
   schema: "The app's database schema is invalid.",
@@ -272,6 +313,32 @@ var cacheMessages = {
   storage: "The app cache failed to complete the operation.",
   timeout: "The app cache did not respond in time."
 };
+var mcpStages = {
+  connect: "connecting",
+  transport: "connecting",
+  discover: "listing its tools",
+  schema: "reading a tool's schema",
+  call: "calling a tool"
+};
+var mcpMessage = ({ phase, reason, status }) => {
+  const stage = mcpStages[phase];
+  return Match_exports.value(reason).pipe(
+    Match_exports.when("timeout", () => `The MCP server did not respond in time while ${stage}.`),
+    Match_exports.when("unauthorized", () => `The MCP server rejected the credentials while ${stage}.`),
+    Match_exports.when(
+      "invalid_response",
+      () => `The MCP server returned a response Executor could not use while ${stage}, such as an unreadable message or an address on another origin.`
+    ),
+    Match_exports.when("invalid_input", () => "The MCP server URL or connection settings are invalid."),
+    // Only a transport failure has no answer from the server; a JSON-RPC error is an answer.
+    Match_exports.when(
+      "request",
+      () => status !== void 0 ? `The MCP server answered HTTP ${status} while ${stage}.` : phase === "transport" ? `Executor could not reach the MCP server while ${stage}.` : `The request to the MCP server failed while ${stage}.`
+    ),
+    Match_exports.exhaustive
+  );
+};
+var unverifiedMessage = ({ anonymous }) => anonymous === "answered" ? "This MCP server answers without credentials, so Executor can't check this account. A refused key will show up when a tool is called." : `The MCP server accepted the credentials, but the same check without them failed, so Executor can't tell whether it requires them. ${Schema_exports.is(McpError)(anonymous) ? mcpMessage(anonymous) : anonymous.status === void 0 ? "The MCP server could not answer the request." : `The MCP server answered HTTP ${anonymous.status}.`}`;
 var minimumSecretLength = 6;
 var secretValues = (value, found) => {
   if (typeof value === "string") {
@@ -388,6 +455,20 @@ var failureDetail = (error, secrets) => {
       code: error.reason,
       message: error.reason === "request" ? error.status === void 0 ? "The API request failed before a response arrived." : `The API responded with HTTP ${error.status}, which its OpenAPI document does not declare as an error with a message.` : error.reason === "invalid_input" ? "The input could not be encoded as a request for this API operation." : "The API's OpenAPI definition for this operation is invalid."
     };
+  if (Schema_exports.is(McpError)(error))
+    return {
+      source: "service",
+      errorName: "McpError",
+      code: error.reason,
+      message: mcpMessage(error)
+    };
+  if (Schema_exports.is(McpCredentialsUnverified)(error))
+    return {
+      source: "service",
+      errorName: "McpCredentialsUnverified",
+      code: error.anonymous === "answered" ? "anonymous_access" : error.anonymous.reason,
+      message: unverifiedMessage(error)
+    };
   if (Schema_exports.is(OpenapiCompileError)(error))
     return {
       source: "app",
@@ -395,6 +476,20 @@ var failureDetail = (error, secrets) => {
       code: error.code,
       message: boundFailureMessage(error.message, secrets)
     };
+  if (Schema_exports.is(NetworkRefused)(error))
+    return {
+      source: "app",
+      errorName: "NetworkRefused",
+      code: error.refusal.reason,
+      message: boundFailureMessage(error.message, secrets)
+    };
+  if (Schema_exports.is(FetchOptionUnsupported)(error))
+    return {
+      source: "app",
+      errorName: "FetchOptionUnsupported",
+      code: error.option,
+      message: boundFailureMessage(error.message, secrets)
+    };
   if (error instanceof Error) {
     const code = ownCode(error, secrets);
     const fields = ownFields(error, code, secrets);
@@ -672,6 +767,8 @@ export {
   parseMcpError,
   describeFailure,
   failureDetail,
+  failOnNetworkRefusal,
+  appInvocationFetch,
   operationDescription,
   fixedRouter,
   readCatalog,

package/js/{chunk-DAIW2WM3.js → chunk-KQCMHI3K.js}

@@ -1,14 +1,14 @@
 import {
   ProviderError,
   maxUpstreamMessageLength
-} from "./chunk-T7WRQJUF.js";
+} from "./chunk-BRGF7VFN.js";
 import {
   AccountId
-} from "./chunk-KKGRSXUK.js";
+} from "./chunk-PWF2DRJ3.js";
 import {
   Option_exports,
   Schema_exports
-} from "./chunk-DM5U7G7V.js";
+} from "./chunk-NXTXZ635.js";
 
 // src/implementation/upstream-error.ts
 var ErrorToken = Schema_exports.String.check(Schema_exports.isPattern(/^[A-Za-z0-9._-]{1,128}$/));

package/js/{chunk-HIYRKEWP.js → chunk-L76NWXM5.js}

@@ -3,40 +3,50 @@ import {
   answeredError,
   mcpClient,
   mcpJsonSchemaValidator
-} from "./chunk-4CMJD7AB.js";
+} from "./chunk-VIQQ52V7.js";
+import {
+  failOnNetworkRefusal
+} from "./chunk-JN3PEGMW.js";
 import {
   accountProviderError,
   bodyUpstreamError,
   httpProviderError,
   providerErrorDetail
-} from "./chunk-DAIW2WM3.js";
+} from "./chunk-KQCMHI3K.js";
 import {
+  McpCredentialsUnverified,
   McpError,
+  McpHealthInput,
   McpToolsOptions,
-  defaultMcpClientLimits
-} from "./chunk-VGEPL4BV.js";
+  NetworkRefused,
+  defaultMcpClientLimits,
+  mcpHealthReserveMs
+} from "./chunk-TE2HPDZG.js";
 import {
   ProviderError
-} from "./chunk-T7WRQJUF.js";
+} from "./chunk-BRGF7VFN.js";
 import {
   captureTelemetry
-} from "./chunk-DUEZ2XCO.js";
+} from "./chunk-YXKXKGN6.js";
 import {
   FetchHttpClient_exports
-} from "./chunk-KNJAOYV4.js";
+} from "./chunk-V2I3MMPM.js";
 import {
   HttpClientRequest_exports,
   HttpClient_exports
-} from "./chunk-OBXHLFGQ.js";
+} from "./chunk-B5YJQU45.js";
 import {
+  Clock_exports,
   Deferred_exports,
   Effect_exports,
+  Match_exports,
   Option_exports,
+  Predicate_exports,
   Redacted_exports,
   Ref_exports,
   Schema_exports,
   Stream_exports
-} from "./chunk-DM5U7G7V.js";
+} from "./chunk-NXTXZ635.js";
 
 // src/implementation/mcp.ts
 import { UnauthorizedError } from "@modelcontextprotocol/sdk/client/auth.js";
@@ -51,16 +61,17 @@ import {
   StreamableHTTPClientTransport,
   StreamableHTTPError
 } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+var unreadable = (error) => error instanceof SyntaxError || error instanceof Error && Predicate_exports.hasProperty(error, "issues") && Array.isArray(error.issues);
 var failure = (phase, error) => {
-  if (Schema_exports.is(ProviderError)(error) || Schema_exports.is(McpError)(error)) return error;
-  const status = error instanceof UnauthorizedError ? 401 : error instanceof StreamableHTTPError || error instanceof SseError ? error.code : void 0;
-  const provider = status === void 0 ? void 0 : httpProviderError(status);
-  if (provider !== void 0) return provider;
+  if (Schema_exports.is(ProviderError)(error) || Schema_exports.is(McpError)(error) || Schema_exports.is(NetworkRefused)(error))
+    return error;
+  const code = error instanceof UnauthorizedError ? 401 : error instanceof StreamableHTTPError || error instanceof SseError ? error.code : void 0;
+  if (code !== void 0 && code >= 300 && code <= 599)
+    return httpProviderError(code) ?? new McpError({ phase, reason: "request", status: code });
   const upstream = answeredError(error);
   return new McpError({
     phase,
-    reason: error instanceof ProtocolError && error.code === ErrorCode.RequestTimeout ? "timeout" : "request",
-    ...status === void 0 ? {} : { status },
+    reason: code !== void 0 || unreadable(error) ? "invalid_response" : error instanceof ProtocolError && error.code === ErrorCode.RequestTimeout ? "timeout" : "request",
     ...upstream === void 0 ? {} : { upstream }
   });
 };
@@ -72,10 +83,10 @@ var errorBody = (response) => Effect_exports.gen(function* () {
   const length = response.headers["content-length"];
   if (!json || length !== void 0 && Number(length) > errorBodyLimits.maxBytes)
     return { body: Stream_exports.toReadableStream(response.stream), upstream: void 0 };
-  const unreadable = new McpError({ phase: "transport", reason: "invalid_response" });
+  const unreadable2 = new McpError({ phase: "transport", reason: "invalid_response" });
   const read = yield* response.stream.pipe(
-    Stream_exports.mapError(() => unreadable),
-    Stream_exports.limitBytes(errorBodyLimits.maxBytes, () => Stream_exports.fail(unreadable)),
+    Stream_exports.mapError(() => unreadable2),
+    Stream_exports.limitBytes(errorBodyLimits.maxBytes, () => Stream_exports.fail(unreadable2)),
     Stream_exports.decodeText,
     Stream_exports.mkString,
     Effect_exports.timeout(errorBodyLimits.readTimeoutMs),
@@ -98,14 +109,20 @@ var transportFetch = (connection, telemetry, rejected, answered) => (url, init)
       return yield* new McpError({ phase: "transport", reason: "invalid_input" });
     if (target.origin !== connection.url.origin || target.username || target.password)
       return yield* new McpError({ phase: "transport", reason: "invalid_response" });
-    const headers = new Headers(Redacted_exports.value(connection.headers));
-    new Headers(init?.headers).forEach((value, name) => headers.set(name, value));
     const request = yield* Effect_exports.try({
-      try: () => HttpClientRequest_exports.fromWeb(new Request(target, { ...init, headers })),
-      catch: () => failure("transport", void 0)
+      try: () => {
+        const headers = new Headers(Redacted_exports.value(connection.headers));
+        new Headers(init?.headers).forEach((value, name) => headers.set(name, value));
+        return HttpClientRequest_exports.fromWeb(new Request(target, { ...init, headers }));
+      },
+      // The provider's headers cannot form an HTTP request, such as a name with a space.
+      catch: () => new McpError({ phase: "transport", reason: "invalid_input" })
     });
     const client = yield* HttpClient_exports.HttpClient;
     const response = yield* client.execute(request);
+    yield* failOnNetworkRefusal(response).pipe(
+      Effect_exports.tapError((refused) => Deferred_exports.fail(rejected, refused))
+    );
     if (response.status < 400)
       return new Response(
         [204, 205, 304].includes(response.status) ? null : Stream_exports.toReadableStream(response.stream),
@@ -271,9 +288,44 @@ var mcpClientEffect = (input, changed) => Effect_exports.gen(function* () {
     failure
   );
 });
+var refusesCredentials = (error) => Schema_exports.is(ProviderError)(error) && Match_exports.value(error.reason).pipe(
+  Match_exports.whenOr("unauthorized", "forbidden", "rejected", () => true),
+  Match_exports.whenOr("rate_limited", "unavailable", () => false),
+  Match_exports.exhaustive
+);
+var mcpHealthEffect = (check, options) => Effect_exports.gen(function* () {
+  const { deadline, timeoutMs, ...parsed } = yield* Schema_exports.decodeUnknownEffect(McpHealthInput)({
+    ...options,
+    accountId: check.account.id,
+    signal: check.signal,
+    deadline: check.deadline
+  }).pipe(Effect_exports.mapError(() => new McpError({ phase: "connect", reason: "invalid_input" })));
+  const end = Math.min(
+    (yield* Clock_exports.currentTimeMillis) + (timeoutMs ?? defaultMcpClientLimits.timeoutMs),
+    deadline === void 0 ? Number.POSITIVE_INFINITY : deadline - mcpHealthReserveMs
+  );
+  const remaining = Effect_exports.flatMap(
+    Clock_exports.currentTimeMillis,
+    (now) => end - now >= 1 ? Effect_exports.succeed(Math.floor(end - now)) : Effect_exports.fail(new McpError({ phase: "transport", reason: "timeout" }))
+  );
+  yield* (yield* mcpClientEffect({ ...parsed, timeoutMs: yield* remaining })).check;
+  return yield* remaining.pipe(
+    Effect_exports.flatMap(
+      (timeoutMs2) => mcpClientEffect({ url: parsed.url, signal: parsed.signal, timeoutMs: timeoutMs2 })
+    ),
+    Effect_exports.flatMap((anonymous) => anonymous.check),
+    Effect_exports.matchEffect({
+      onSuccess: () => Effect_exports.fail(new McpCredentialsUnverified({ anonymous: "answered" })),
+      // Executor's network refused the attempt, so the server never answered it.
+      onFailure: (error) => Schema_exports.is(NetworkRefused)(error) ? Effect_exports.fail(error) : refusesCredentials(error) ? Effect_exports.void : Effect_exports.fail(new McpCredentialsUnverified({ anonymous: error }))
+    }),
+    Effect_exports.withSpan("provider.mcp.anonymous")
+  );
+}).pipe(Effect_exports.withSpan("provider.mcp.health"));
 var mcpToolsEffect = (input) => mcpClientEffect(input).pipe(Effect_exports.flatMap(adaptMcpTools));
 
 export {
   mcpClientEffect,
+  mcpHealthEffect,
   mcpToolsEffect
 };

package/js/{chunk-GH6PY5BQ.js → chunk-M2KEEOIQ.js}

@@ -1,6 +1,6 @@
 import {
   Schema_exports
-} from "./chunk-DM5U7G7V.js";
+} from "./chunk-NXTXZ635.js";
 
 // ../app-data/src/contracts/database.ts
 var DataName = Schema_exports.String.check(

package/js/{chunk-OI7OI2U3.js → chunk-MWCLJQRI.js}

@@ -1,11 +1,11 @@
 import {
   fixedRouter
-} from "./chunk-EXDR4HVM.js";
+} from "./chunk-JN3PEGMW.js";
 import {
   nativeOperation,
   operationDeclaration,
   routerDeclaration
-} from "./chunk-WPKXOTKM.js";
+} from "./chunk-GQ7GCZ4J.js";
 
 // src/implementation/protocol-operations.ts
 var protocolOperations = (operations, kinds = {}) => {

package/js/{chunk-TACLXEAE.js → chunk-NSBRV4FJ.js}

@@ -1,6 +1,6 @@
 import {
   Schema_exports
-} from "./chunk-DM5U7G7V.js";
+} from "./chunk-NXTXZ635.js";
 
 // src/contracts/skills.ts
 var SkillFilePath = Schema_exports.NonEmptyString.check(