apps 0.0.1-beta.26 → 0.0.1-beta.28

package/js/{chunk-3YN4UDPB.js → chunk-PTUZSCEV.js}

@@ -1,9 +1,9 @@
 import {
   appSignInCallbackPath
-} from "./chunk-SUY33XAY.js";
+} from "./chunk-WQ5MVBTP.js";
 import {
   HttpServerResponse_exports
-} from "./chunk-OBXHLFGQ.js";
+} from "./chunk-B5YJQU45.js";
 
 // src/implementation/ui-auth.ts
 var appPrivateHeaders = {

package/js/{chunk-KKGRSXUK.js → chunk-PWF2DRJ3.js}

@@ -1,6 +1,6 @@
 import {
   Schema_exports
-} from "./chunk-DM5U7G7V.js";
+} from "./chunk-NXTXZ635.js";
 
 // src/contracts/schema.ts
 var JsonValue = Schema_exports.Json;

package/js/{chunk-2TP7C25K.js → chunk-SDLIDQXG.js}

@@ -19,10 +19,10 @@ import {
   text,
   uint8Array,
   urlParams
-} from "./chunk-OBXHLFGQ.js";
+} from "./chunk-B5YJQU45.js";
 import {
   JsonValue
-} from "./chunk-KKGRSXUK.js";
+} from "./chunk-PWF2DRJ3.js";
 import {
   Cause,
   Defect,
@@ -118,7 +118,7 @@ import {
   transformEffect,
   transformPull,
   void_2 as void_
-} from "./chunk-DM5U7G7V.js";
+} from "./chunk-NXTXZ635.js";
 import {
   __export
 } from "./chunk-CZ7CSFO4.js";

package/js/{chunk-VGEPL4BV.js → chunk-TE2HPDZG.js}

@@ -2,7 +2,7 @@ import {
   DatabaseFieldReserved,
   DatabaseLimitExceeded,
   DatabaseSchema
-} from "./chunk-GH6PY5BQ.js";
+} from "./chunk-M2KEEOIQ.js";
 import {
   CacheCommand,
   CacheReply,
@@ -13,18 +13,18 @@ import {
   FailureSource,
   ProviderError,
   UpstreamError
-} from "./chunk-T7WRQJUF.js";
+} from "./chunk-BRGF7VFN.js";
 import {
   AppSkillName,
   AppSkills,
   SkillLoadFailed
-} from "./chunk-TACLXEAE.js";
+} from "./chunk-NSBRV4FJ.js";
 import {
   AccountId,
   HttpUrl,
   JsonObject as JsonObject2,
   JsonValue
-} from "./chunk-KKGRSXUK.js";
+} from "./chunk-PWF2DRJ3.js";
 import {
   Any,
   ArraySchema,
@@ -78,7 +78,7 @@ import {
   transformOptional,
   withConstructorDefault,
   withDefault
-} from "./chunk-DM5U7G7V.js";
+} from "./chunk-NXTXZ635.js";
 
 // src/contracts/router.ts
 var reservedRouterKeys = /* @__PURE__ */ new Set([
@@ -141,6 +141,12 @@ var McpToolsOptions = Schema_exports.Struct({
     )
   )
 });
+var McpHealthInput = Schema_exports.Struct({
+  ...McpToolsOptions.fields,
+  headers: Schema_exports.Record(Schema_exports.String, Schema_exports.String),
+  deadline: Schema_exports.optional(Schema_exports.Finite)
+});
+var mcpHealthReserveMs = 2 * defaultMcpClientLimits.cleanupTimeoutMs + 250;
 var McpToolResult = Schema_exports.Struct({
   content: Schema_exports.Array(JsonObject2),
   structuredContent: Schema_exports.optionalKey(JsonObject2),
@@ -178,6 +184,11 @@ var McpError = class extends Schema_exports.TaggedError()("McpError", {
   upstream: Schema_exports.optional(UpstreamError)
 }) {
 };
+var McpCredentialsUnverified = class extends Schema_exports.TaggedError()(
+  "McpCredentialsUnverified",
+  { anonymous: Schema_exports.Union([Schema_exports.Literal("answered"), McpError, ProviderError]) }
+) {
+};
 var ProcessConfig = Schema_exports.Struct({
   command: Schema_exports.NonEmptyString,
   args: Schema_exports.Array(Schema_exports.String),
@@ -215,6 +226,88 @@ var defaultOpenapiErrorLimits = OpenapiErrorLimits.make({
   readTimeoutMs: 2e3
 });
 
+// src/contracts/network.ts
+var NetworkRefusal = Schema_exports.Union([
+  Schema_exports.Struct({ reason: Schema_exports.Literal("private_address") }),
+  Schema_exports.Struct({
+    reason: Schema_exports.Literal("credential_host"),
+    /** The provider of the credential handle the request carried. */
+    provider: Schema_exports.String,
+    /** The hosts that provider's credentials may reach; empty when it declares none. */
+    allowedHosts: Schema_exports.Array(Schema_exports.String)
+  }),
+  Schema_exports.Struct({ reason: Schema_exports.Literal("credential_app") }),
+  Schema_exports.Struct({
+    reason: Schema_exports.Literal("credential_expired"),
+    /** The provider of the expired credential handle. */
+    provider: Schema_exports.String
+  })
+]);
+var NetworkRefused = class extends Schema_exports.TaggedError()("NetworkRefused", {
+  /** The refused destination, with its port when the URL names one. */
+  host: Schema_exports.String,
+  refusal: NetworkRefusal
+}) {
+  get message() {
+    const refusal = this.refusal;
+    switch (refusal.reason) {
+      case "private_address":
+        return `Executor refused a request to ${this.host}: apps on this instance can reach only public addresses, and ${this.host} is a private, loopback or internal address. The request was not sent.`;
+      case "credential_host":
+        return refusal.allowedHosts.length === 0 ? `Executor refused this request: ${refusal.provider} credentials cannot be sent to ${this.host}: the provider declares no hosts.` : `Executor refused this request: ${refusal.provider} credentials cannot be sent to ${this.host}. The provider allows: ${refusal.allowedHosts.join(", ")}.`;
+      case "credential_app":
+        return "Executor refused this request: it carries a credential handle that is not valid for this app. Use the account fields this invocation received.";
+      case "credential_expired":
+        return `Executor refused this request: it carries an expired ${refusal.provider} credential handle. Use the account fields this invocation received.`;
+    }
+  }
+};
+var networkRefusalStatus = 421;
+var networkRefusalHeader = "x-executor-refused";
+var NetworkRefusedHeader = Schema_exports.StringFromUriComponent.pipe(
+  Schema_exports.decodeTo(Schema_exports.fromJsonString(NetworkRefused))
+);
+var encodeRefusal = Schema_exports.encodeSync(NetworkRefused);
+var encodeRefusalHeader = Schema_exports.encodeSync(NetworkRefusedHeader);
+var networkRefusalResponse = (refused) => new Response(JSON.stringify({ ...encodeRefusal(refused), message: refused.message }), {
+  status: networkRefusalStatus,
+  statusText: "Refused by Executor",
+  headers: {
+    "content-type": "application/json; charset=utf-8",
+    [networkRefusalHeader]: encodeRefusalHeader(refused)
+  }
+});
+var RestrictedFetchOption = Schema_exports.Literals(["redirect", "cache", "integrity"]);
+var supportedFetchOptions = {
+  redirect: ["follow", "manual"],
+  cache: ["no-store", "no-cache"],
+  integrity: [""]
+};
+var FetchOptionUnsupported = class extends Schema_exports.TaggedError()(
+  "FetchOptionUnsupported",
+  {
+    option: RestrictedFetchOption,
+    value: Schema_exports.String,
+    supported: Schema_exports.Array(Schema_exports.String)
+  }
+) {
+  get message() {
+    const supported = this.supported.map((value) => JSON.stringify(value)).join(" or ");
+    return `fetch option ${this.option}: ${JSON.stringify(this.value)} is not supported by Executor's app runtime. Use ${supported}, or omit ${this.option}.${this.advice}`;
+  }
+  /** What to do instead, when the standard value has an equivalent the runtime supports. */
+  get advice() {
+    switch (this.option) {
+      case "redirect":
+        return this.value === "error" ? ` To reject redirects, send redirect: "manual" and treat a 3xx response as the error.` : "";
+      case "cache":
+        return "";
+      case "integrity":
+        return " To check a digest, read the body and hash it with crypto.subtle.digest.";
+    }
+  }
+};
+
 // src/contracts/workflows.ts
 var WorkflowRunId = Schema_exports.NonEmptyString.pipe(Schema_exports.brand("wfr"));
 var WorkflowName = Schema_exports.NonEmptyString.check(Schema_exports.isMaxLength(200));
@@ -2924,6 +3017,15 @@ var ToolResultObservation = Context_exports.Reference(
 );
 
 export {
+  NetworkRefusal,
+  NetworkRefused,
+  networkRefusalStatus,
+  networkRefusalHeader,
+  NetworkRefusedHeader,
+  networkRefusalResponse,
+  RestrictedFetchOption,
+  supportedFetchOptions,
+  FetchOptionUnsupported,
   SecretsMethod,
   OAuthClientAuth,
   OAuthSecretClientAuth,
@@ -2945,10 +3047,13 @@ export {
   defaultMcpClientLimits,
   mcpSdkTimerCeilingMs,
   McpToolsOptions,
+  McpHealthInput,
+  mcpHealthReserveMs,
   McpToolResult,
   McpToolMetadata,
   McpServerHeader,
   McpError,
+  McpCredentialsUnverified,
   ProcessConfig,
   maxApiErrorInstructionsLength,
   ApiErrorRecovery,

package/js/{chunk-PC5RHPUP.js → chunk-TSLG2WPA.js}

@@ -5,11 +5,11 @@ import {
   SkillDefinitionInvalid,
   SkillFile,
   SkillFilePath
-} from "./chunk-TACLXEAE.js";
+} from "./chunk-NSBRV4FJ.js";
 import {
   Effect_exports,
   Schema_exports
-} from "./chunk-DM5U7G7V.js";
+} from "./chunk-NXTXZ635.js";
 
 // src/implementation/skill-files.ts
 var skillFromFiles = (input, source = {}) => Effect_exports.gen(function* () {

package/js/{chunk-KNJAOYV4.js → chunk-V2I3MMPM.js}

@@ -4,7 +4,7 @@ import {
   fromWeb,
   layerMergedContext,
   make2 as make
-} from "./chunk-OBXHLFGQ.js";
+} from "./chunk-B5YJQU45.js";
 import {
   Reference,
   Service,
@@ -17,7 +17,7 @@ import {
   succeed4 as succeed,
   toReadableStreamEffect,
   tryPromise
-} from "./chunk-DM5U7G7V.js";
+} from "./chunk-NXTXZ635.js";
 import {
   __export
 } from "./chunk-CZ7CSFO4.js";

package/js/{chunk-NXO2GN2T.js → chunk-VF3X26ZO.js}

@@ -1,33 +1,33 @@
 import {
   promiseTable
-} from "./chunk-LPN4ONWW.js";
+} from "./chunk-XBQTJP76.js";
 import {
   declaredOperations,
   fromPromise,
   nativeOperation,
   nativeRouter
-} from "./chunk-WPKXOTKM.js";
+} from "./chunk-GQ7GCZ4J.js";
 import {
   ScheduleTiming
-} from "./chunk-VGEPL4BV.js";
+} from "./chunk-TE2HPDZG.js";
 import {
   DatabaseSchema
-} from "./chunk-GH6PY5BQ.js";
+} from "./chunk-M2KEEOIQ.js";
 import {
   decoderOf,
   isSchema,
   storageFieldOf
-} from "./chunk-IE6W5RNN.js";
+} from "./chunk-YML53Z7H.js";
 import {
   AppStorageUnavailable
-} from "./chunk-HQKIPKM5.js";
+} from "./chunk-BTJMXW4I.js";
 import {
   JsonValue
-} from "./chunk-KKGRSXUK.js";
+} from "./chunk-PWF2DRJ3.js";
 import {
   Effect_exports,
   Schema_exports
-} from "./chunk-DM5U7G7V.js";
+} from "./chunk-NXTXZ635.js";
 
 // src/contracts/http.ts
 var ResponseStatusError = class extends Schema_exports.TaggedError()(

package/js/{chunk-4CMJD7AB.js → chunk-VIQQ52V7.js}

@@ -1,12 +1,12 @@
 import {
   prepareElicitation
-} from "./chunk-BTRBOOTD.js";
+} from "./chunk-GLIAMV2R.js";
 import {
   fromPromise
-} from "./chunk-WPKXOTKM.js";
+} from "./chunk-GQ7GCZ4J.js";
 import {
   bodyUpstreamError
-} from "./chunk-DAIW2WM3.js";
+} from "./chunk-KQCMHI3K.js";
 import {
   ElicitationFailed,
   McpError,
@@ -18,15 +18,15 @@ import {
   defaultElicitationLimits,
   defaultMcpClientLimits,
   mcpSdkTimerCeilingMs
-} from "./chunk-VGEPL4BV.js";
+} from "./chunk-TE2HPDZG.js";
 import {
   jsonSchemaDecoder,
   nestJsonSchema,
   preparedJsonSchemaDecoder
-} from "./chunk-IE6W5RNN.js";
+} from "./chunk-YML53Z7H.js";
 import {
   JsonObject
-} from "./chunk-KKGRSXUK.js";
+} from "./chunk-PWF2DRJ3.js";
 import {
   Clock_exports,
   Deferred_exports,
@@ -35,7 +35,7 @@ import {
   Option_exports,
   Queue_exports,
   Schema_exports
-} from "./chunk-DM5U7G7V.js";
+} from "./chunk-NXTXZ635.js";
 
 // src/implementation/mcp-tools.ts
 var resultFields = {
@@ -353,10 +353,26 @@ function mcpClient(withClient, timeoutMs, failure) {
       };
     })
   ).pipe(Effect_exports.withSpan("provider.mcp.discover"));
+  const check = withClient(
+    "discover",
+    (client) => Effect_exports.tryPromise({
+      try: (signal) => client.request({ method: "tools/list", params: {} }, ListToolsResultSchema, {
+        signal,
+        timeout: timeoutMs
+      }),
+      catch: (error) => failure("discover", error)
+    }).pipe(
+      Effect_exports.asVoid,
+      Effect_exports.withSpan("provider.mcp.request", {
+        kind: "client",
+        attributes: { "rpc.system.name": "jsonrpc", "rpc.method": "tools/list" }
+      })
+    )
+  ).pipe(Effect_exports.withSpan("provider.mcp.check"));
   const call = (name, input, context) => withClient("call", (client) => mcpCall(client, name, input, context, timeoutMs, failure)).pipe(
     Effect_exports.withSpan("provider.mcp.call", { attributes: { "mcp.tool.name": name } })
   );
-  return { list, call };
+  return { list, check, call };
 }
 
 export {

package/js/{chunk-ZVMZWXVF.js → chunk-VUVBMNKC.js}

@@ -3,14 +3,14 @@ import {
   CacheEntry,
   CacheError,
   cacheLimits
-} from "./chunk-T7WRQJUF.js";
+} from "./chunk-BRGF7VFN.js";
 import {
   Clock_exports,
   Duration_exports,
   Effect_exports,
   Exit_exports,
   Schema_exports
-} from "./chunk-DM5U7G7V.js";
+} from "./chunk-NXTXZ635.js";
 
 // ../app-cache/src/index.ts
 var canonical = (value) => {

package/js/{chunk-SUY33XAY.js → chunk-WQ5MVBTP.js}

@@ -1,6 +1,6 @@
 import {
   Schema_exports
-} from "./chunk-DM5U7G7V.js";
+} from "./chunk-NXTXZ635.js";
 
 // src/contracts/ui-auth.ts
 var AppSignInId = Schema_exports.String.check(Schema_exports.isPattern(/^[a-f0-9]{64}$/)).pipe(

package/js/{chunk-LPN4ONWW.js → chunk-XBQTJP76.js}

@@ -12,7 +12,7 @@ import {
   defaultDatabaseLimits,
   defaultDatabaseRuntimeLimits,
   reservedFieldNames
-} from "./chunk-GH6PY5BQ.js";
+} from "./chunk-M2KEEOIQ.js";
 import {
   Cause_exports,
   Clock_exports,
@@ -20,7 +20,7 @@ import {
   Encoding_exports,
   Schema_exports,
   Semaphore_exports
-} from "./chunk-DM5U7G7V.js";
+} from "./chunk-NXTXZ635.js";
 
 // ../app-data/src/implementation/schema.ts
 var metadata = new Set(reservedFieldNames);

package/js/{chunk-IE6W5RNN.js → chunk-YML53Z7H.js}

@@ -1,7 +1,7 @@
 import {
   JsonObject,
   ValidationError
-} from "./chunk-KKGRSXUK.js";
+} from "./chunk-PWF2DRJ3.js";
 import {
   Cause_exports,
   Effect_exports,
@@ -10,7 +10,7 @@ import {
   SchemaIssue_exports,
   SchemaParser_exports,
   Schema_exports
-} from "./chunk-DM5U7G7V.js";
+} from "./chunk-NXTXZ635.js";
 
 // ../../node_modules/.bun/@cfworker+json-schema@4.1.1/node_modules/@cfworker/json-schema/dist/esm/deep-compare-strict.js
 function deepCompareStrict(a, b) {

package/js/{chunk-DUEZ2XCO.js → chunk-YXKXKGN6.js}

@@ -1,6 +1,6 @@
 import {
   FetchHttpClient_exports
-} from "./chunk-KNJAOYV4.js";
+} from "./chunk-V2I3MMPM.js";
 import {
   HttpBody_exports,
   HttpClient,
@@ -18,7 +18,7 @@ import {
   setBody,
   transformResponse,
   uint8Array
-} from "./chunk-OBXHLFGQ.js";
+} from "./chunk-B5YJQU45.js";
 import {
   Array as Array2,
   Boolean2 as Boolean,
@@ -125,7 +125,7 @@ import {
   withDefault2 as withDefault,
   withTracerEnabled,
   zero
-} from "./chunk-DM5U7G7V.js";
+} from "./chunk-NXTXZ635.js";
 import {
   __export
 } from "./chunk-CZ7CSFO4.js";

package/js/{chunk-XIRAIB3P.js → chunk-ZZOCEUTB.js}

@@ -1,17 +1,17 @@
 import {
   CacheError
-} from "./chunk-T7WRQJUF.js";
+} from "./chunk-BRGF7VFN.js";
 import {
   wrap
-} from "./chunk-IE6W5RNN.js";
+} from "./chunk-YML53Z7H.js";
 import {
   JsonObject
-} from "./chunk-KKGRSXUK.js";
+} from "./chunk-PWF2DRJ3.js";
 import {
   Duration_exports,
   Effect_exports,
   Schema_exports
-} from "./chunk-DM5U7G7V.js";
+} from "./chunk-NXTXZ635.js";
 
 // src/implementation/catalog-cache.ts
 var catalogScope = (options, invalid) => {

package/js/client.js

@@ -4,36 +4,36 @@ import {
   UiContext,
   UiDeploymentChanged,
   UiFailed
-} from "./chunk-2TP7C25K.js";
+} from "./chunk-SDLIDQXG.js";
 import {
   AsyncResult_exports,
   AtomRegistry_exports,
   Atom_exports,
   queryResult
-} from "./chunk-AAAMPT6F.js";
-import "./chunk-XBG3M64K.js";
+} from "./chunk-65SZ23BK.js";
+import "./chunk-6JBTHTI5.js";
 import {
   OtlpExporter_exports,
   externalTrace,
   pendingSpan,
   telemetryLayer,
   traceLinks
-} from "./chunk-DUEZ2XCO.js";
+} from "./chunk-YXKXKGN6.js";
 import {
   FetchHttpClient_exports
-} from "./chunk-KNJAOYV4.js";
+} from "./chunk-V2I3MMPM.js";
 import {
   HttpClientError_exports
-} from "./chunk-OBXHLFGQ.js";
+} from "./chunk-B5YJQU45.js";
 import {
   decoderOf
-} from "./chunk-IE6W5RNN.js";
+} from "./chunk-YML53Z7H.js";
 import {
   StorageName
-} from "./chunk-HQKIPKM5.js";
+} from "./chunk-BTJMXW4I.js";
 import {
   JsonValue
-} from "./chunk-KKGRSXUK.js";
+} from "./chunk-PWF2DRJ3.js";
 import {
   Cause_exports,
   Clock_exports,
@@ -52,7 +52,7 @@ import {
   Semaphore_exports,
   Stream_exports,
   Tracer_exports
-} from "./chunk-DM5U7G7V.js";
+} from "./chunk-NXTXZ635.js";
 import "./chunk-CZ7CSFO4.js";
 
 // src/contracts/live.ts

package/js/contracts.js

@@ -14,6 +14,7 @@ import {
   ElicitationLimits,
   ElicitationReply,
   ElicitationResponse,
+  FetchOptionUnsupported,
   FormElicitation,
   HostAccountCheckError,
   HostAccountsInvalid,
@@ -52,6 +53,8 @@ import {
   ManualWebhookSetup,
   McpClientLimits,
   McpError,
+  NetworkRefusal,
+  NetworkRefused,
   NonRetryableError,
   OAuthClientAuth,
   OAuthSecretClientAuth,
@@ -99,6 +102,9 @@ import {
   maxApiErrorMessageLength,
   maxInputProblems,
   minimumIntervalMilliseconds,
+  networkRefusalHeader,
+  networkRefusalResponse,
+  networkRefusalStatus,
   protocol1,
   protocol2,
   protocol3,
@@ -111,11 +117,11 @@ import {
   skillCatalog,
   skillsCommand,
   workflowDurationMillis
-} from "./chunk-VGEPL4BV.js";
+} from "./chunk-TE2HPDZG.js";
 import {
   DatabaseFieldReserved,
   DatabaseLimitExceeded
-} from "./chunk-GH6PY5BQ.js";
+} from "./chunk-M2KEEOIQ.js";
 import {
   FailureCode,
   FailureDetail,
@@ -132,7 +138,7 @@ import {
   maxFailureFields,
   maxFailureMessageLength,
   maxUpstreamMessageLength
-} from "./chunk-T7WRQJUF.js";
+} from "./chunk-BRGF7VFN.js";
 import {
   AppSkillMetadata,
   AppSkillName,
@@ -145,17 +151,17 @@ import {
   SkillServiceName,
   skillFormatLimits,
   skillLoadLimits
-} from "./chunk-TACLXEAE.js";
+} from "./chunk-NSBRV4FJ.js";
 import {
   AppStorageError,
   AppStorageUnavailable,
   StorageName
-} from "./chunk-HQKIPKM5.js";
+} from "./chunk-BTJMXW4I.js";
 import {
   AccountId,
   HttpUrl
-} from "./chunk-KKGRSXUK.js";
-import "./chunk-DM5U7G7V.js";
+} from "./chunk-PWF2DRJ3.js";
+import "./chunk-NXTXZ635.js";
 import "./chunk-CZ7CSFO4.js";
 export {
   AccountCheckCommand,
@@ -191,6 +197,7 @@ export {
   FailureName,
   FailurePhase,
   FailureSource,
+  FetchOptionUnsupported,
   FormElicitation,
   HostAccountCheckError,
   HostAccountsInvalid,
@@ -230,6 +237,8 @@ export {
   ManualWebhookSetup,
   McpClientLimits,
   McpError,
+  NetworkRefusal,
+  NetworkRefused,
   NonRetryableError,
   OAuthClientAuth,
   OAuthSecretClientAuth,
@@ -289,6 +298,9 @@ export {
   maxInputProblems,
   maxUpstreamMessageLength,
   minimumIntervalMilliseconds,
+  networkRefusalHeader,
+  networkRefusalResponse,
+  networkRefusalStatus,
   protocol1,
   protocol2,
   protocol3,