apps 0.0.1-beta.27 → 0.0.1-beta.28

package/js/{chunk-3TEX4ZND.js → chunk-GLIAMV2R.js}

@@ -3,6 +3,7 @@ import {
 } from "./chunk-VUVBMNKC.js";
 import {
   accountSecrets,
+  appInvocationFetch,
   boundFailureMessage,
   describeFailure,
   failureDetail,
@@ -10,7 +11,7 @@ import {
   parseMcpError,
   readCatalog,
   routerSkills
-} from "./chunk-7AZNPMQH.js";
+} from "./chunk-JN3PEGMW.js";
 import {
   folderSkillsEffect
 } from "./chunk-TSLG2WPA.js";
@@ -20,7 +21,7 @@ import {
   isApp,
   toEffectApp,
   unavailableStorage
-} from "./chunk-T2UFJKZR.js";
+} from "./chunk-VF3X26ZO.js";
 import {
   parseDatabaseSchema
 } from "./chunk-XBQTJP76.js";
@@ -30,7 +31,7 @@ import {
   locate,
   nativeOperation,
   toPromise
-} from "./chunk-TX2XCAL6.js";
+} from "./chunk-GQ7GCZ4J.js";
 import {
   accountProviderError,
   httpProviderError,
@@ -82,7 +83,7 @@ import {
   defaultWebhookTransportLimits,
   maxInputProblems,
   workflowDurationMillis
-} from "./chunk-7R5JY5H7.js";
+} from "./chunk-TE2HPDZG.js";
 import {
   CacheError
 } from "./chunk-BRGF7VFN.js";
@@ -92,8 +93,7 @@ import {
   SkillLoadFailed
 } from "./chunk-NSBRV4FJ.js";
 import {
-  captureTelemetry,
-  invocationFetch
+  captureTelemetry
 } from "./chunk-YXKXKGN6.js";
 import {
   decoderOf,
@@ -505,7 +505,7 @@ var authorCache = (host, accounts, signal, deadline) => {
       ...options.staleFor === void 0 ? {} : { staleFor: options.staleFor },
       load: Effect_exports.acquireUseRelease(
         Effect_exports.sync(() => new AbortController()),
-        (controller) => invocationFetch(controller.signal).pipe(
+        (controller) => appInvocationFetch(controller.signal).pipe(
           Effect_exports.flatMap(
             (fetch) => fromPromise(options.load)({
               fetch,
@@ -865,7 +865,7 @@ function dispatch(app, request, context, signal) {
         ),
         workflows: workflowReads,
         signal: invocationSignal,
-        fetch: yield* invocationFetch(fetching.signal),
+        fetch: yield* appInvocationFetch(fetching.signal),
         elicit: makeElicit(delivery, invocationSignal)
       };
       const definition = yield* evaluationSafe(native.evaluate(bound), secrets).pipe(
@@ -942,7 +942,7 @@ function dispatch(app, request, context, signal) {
                   signal2
                 ),
                 files,
-                fetch: yield* invocationFetch(signal2),
+                fetch: yield* appInvocationFetch(signal2),
                 signal: signal2,
                 runId: execution.runId,
                 stepId,
@@ -1080,7 +1080,7 @@ function dispatch(app, request, context, signal) {
         transactionOpen = db !== void 0;
         const output = yield* Effect_exports.gen(function* () {
           running = yield* captureTelemetry;
-          const fetch = yield* invocationFetch(fetching.signal);
+          const fetch = yield* appInvocationFetch(fetching.signal);
           return yield* tool.run(
             {
               ...bound,
@@ -1175,7 +1175,7 @@ function checkAccount(slots, declared, requirement, context, signal, deadline) {
       () => Effect_exports.gen(function* () {
         return yield* health.run({
           account,
-          fetch: yield* invocationFetch(signal),
+          fetch: yield* appInvocationFetch(signal),
           signal,
           ...deadline === void 0 ? {} : { deadline }
         });

package/js/{chunk-TX2XCAL6.js → chunk-GQ7GCZ4J.js}

@@ -3,7 +3,7 @@ import {
   RouterKey,
   RouterMeta,
   reservedRouterKeys
-} from "./chunk-7R5JY5H7.js";
+} from "./chunk-TE2HPDZG.js";
 import {
   decoderOf
 } from "./chunk-YML53Z7H.js";

package/js/{chunk-7AZNPMQH.js → chunk-JN3PEGMW.js}

@@ -4,7 +4,7 @@ import {
 import {
   joinPath,
   mergeMeta
-} from "./chunk-TX2XCAL6.js";
+} from "./chunk-GQ7GCZ4J.js";
 import {
   isShortenedUpstream,
   parseProviderError,
@@ -12,14 +12,21 @@ import {
 } from "./chunk-KQCMHI3K.js";
 import {
   ApiErrorResponse,
+  FetchOptionUnsupported,
   HostDeclarationInvalid,
   HostEvaluationFailed,
   HostedRouter,
   HostedTool,
   HostedToolSummary,
   McpCredentialsUnverified,
-  McpError
-} from "./chunk-7R5JY5H7.js";
+  McpError,
+  NetworkRefused,
+  NetworkRefusedHeader,
+  RestrictedFetchOption,
+  networkRefusalHeader,
+  networkRefusalStatus,
+  supportedFetchOptions
+} from "./chunk-TE2HPDZG.js";
 import {
   AppDatabaseError
 } from "./chunk-M2KEEOIQ.js";
@@ -36,6 +43,9 @@ import {
   SkillLoadFailed,
   skillFormatLimits
 } from "./chunk-NSBRV4FJ.js";
+import {
+  invocationFetch
+} from "./chunk-YXKXKGN6.js";
 import {
   jsonSchemaDocument
 } from "./chunk-YML53Z7H.js";
@@ -252,6 +262,35 @@ var OpenapiCompileError = class extends Schema_exports.TaggedError()(
   }
 };
 
+// src/implementation/network.ts
+var refusalHeader = (status, header) => status === networkRefusalStatus && header !== null && header !== void 0 ? header : void 0;
+var failOnNetworkRefusal = (response) => {
+  const header = refusalHeader(response.status, response.headers[networkRefusalHeader]);
+  return header === void 0 ? Effect_exports.void : Schema_exports.decodeUnknownEffect(NetworkRefusedHeader)(header).pipe(
+    Effect_exports.orDie,
+    Effect_exports.flatMap(Effect_exports.fail)
+  );
+};
+var unsupportedOption = (init) => {
+  for (const option of RestrictedFetchOption.literals) {
+    const value = init?.[option];
+    const supported = supportedFetchOptions[option];
+    if (value !== void 0 && !supported.includes(value))
+      return new FetchOptionUnsupported({ option, value: String(value), supported });
+  }
+  return void 0;
+};
+var appFetch = (fetch) => async (input, init) => {
+  const unsupported = unsupportedOption(init);
+  if (unsupported !== void 0) throw unsupported;
+  const response = await fetch(input, init);
+  const header = refusalHeader(response.status, response.headers.get(networkRefusalHeader));
+  if (header === void 0) return response;
+  await response.body?.cancel();
+  throw Schema_exports.decodeUnknownSync(NetworkRefusedHeader)(header);
+};
+var appInvocationFetch = (signal) => invocationFetch(signal).pipe(Effect_exports.map(appFetch));
+
 // src/implementation/failure-detail.ts
 var storageMessages = {
   schema: "The app's database schema is invalid.",
@@ -437,6 +476,20 @@ var failureDetail = (error, secrets) => {
       code: error.code,
       message: boundFailureMessage(error.message, secrets)
     };
+  if (Schema_exports.is(NetworkRefused)(error))
+    return {
+      source: "app",
+      errorName: "NetworkRefused",
+      code: error.refusal.reason,
+      message: boundFailureMessage(error.message, secrets)
+    };
+  if (Schema_exports.is(FetchOptionUnsupported)(error))
+    return {
+      source: "app",
+      errorName: "FetchOptionUnsupported",
+      code: error.option,
+      message: boundFailureMessage(error.message, secrets)
+    };
   if (error instanceof Error) {
     const code = ownCode(error, secrets);
     const fields = ownFields(error, code, secrets);
@@ -714,6 +767,8 @@ export {
   parseMcpError,
   describeFailure,
   failureDetail,
+  failOnNetworkRefusal,
+  appInvocationFetch,
   operationDescription,
   fixedRouter,
   readCatalog,

package/js/{chunk-HIJW4LWC.js → chunk-L76NWXM5.js}

@@ -3,7 +3,10 @@ import {
   answeredError,
   mcpClient,
   mcpJsonSchemaValidator
-} from "./chunk-AHI26TO6.js";
+} from "./chunk-VIQQ52V7.js";
+import {
+  failOnNetworkRefusal
+} from "./chunk-JN3PEGMW.js";
 import {
   accountProviderError,
   bodyUpstreamError,
@@ -15,9 +18,10 @@ import {
   McpError,
   McpHealthInput,
   McpToolsOptions,
+  NetworkRefused,
   defaultMcpClientLimits,
   mcpHealthReserveMs
-} from "./chunk-7R5JY5H7.js";
+} from "./chunk-TE2HPDZG.js";
 import {
   ProviderError
 } from "./chunk-BRGF7VFN.js";
@@ -59,7 +63,8 @@ import {
 } from "@modelcontextprotocol/sdk/client/streamableHttp.js";
 var unreadable = (error) => error instanceof SyntaxError || error instanceof Error && Predicate_exports.hasProperty(error, "issues") && Array.isArray(error.issues);
 var failure = (phase, error) => {
-  if (Schema_exports.is(ProviderError)(error) || Schema_exports.is(McpError)(error)) return error;
+  if (Schema_exports.is(ProviderError)(error) || Schema_exports.is(McpError)(error) || Schema_exports.is(NetworkRefused)(error))
+    return error;
   const code = error instanceof UnauthorizedError ? 401 : error instanceof StreamableHTTPError || error instanceof SseError ? error.code : void 0;
   if (code !== void 0 && code >= 300 && code <= 599)
     return httpProviderError(code) ?? new McpError({ phase, reason: "request", status: code });
@@ -115,6 +120,9 @@ var transportFetch = (connection, telemetry, rejected, answered) => (url, init)
     });
     const client = yield* HttpClient_exports.HttpClient;
     const response = yield* client.execute(request);
+    yield* failOnNetworkRefusal(response).pipe(
+      Effect_exports.tapError((refused) => Deferred_exports.fail(rejected, refused))
+    );
     if (response.status < 400)
       return new Response(
         [204, 205, 304].includes(response.status) ? null : Stream_exports.toReadableStream(response.stream),
@@ -308,7 +316,8 @@ var mcpHealthEffect = (check, options) => Effect_exports.gen(function* () {
     Effect_exports.flatMap((anonymous) => anonymous.check),
     Effect_exports.matchEffect({
       onSuccess: () => Effect_exports.fail(new McpCredentialsUnverified({ anonymous: "answered" })),
-      onFailure: (error) => refusesCredentials(error) ? Effect_exports.void : Effect_exports.fail(new McpCredentialsUnverified({ anonymous: error }))
+      // Executor's network refused the attempt, so the server never answered it.
+      onFailure: (error) => Schema_exports.is(NetworkRefused)(error) ? Effect_exports.fail(error) : refusesCredentials(error) ? Effect_exports.void : Effect_exports.fail(new McpCredentialsUnverified({ anonymous: error }))
     }),
     Effect_exports.withSpan("provider.mcp.anonymous")
   );

package/js/{chunk-4OD7PHQL.js → chunk-MWCLJQRI.js}

@@ -1,11 +1,11 @@
 import {
   fixedRouter
-} from "./chunk-7AZNPMQH.js";
+} from "./chunk-JN3PEGMW.js";
 import {
   nativeOperation,
   operationDeclaration,
   routerDeclaration
-} from "./chunk-TX2XCAL6.js";
+} from "./chunk-GQ7GCZ4J.js";
 
 // src/implementation/protocol-operations.ts
 var protocolOperations = (operations, kinds = {}) => {

package/js/{chunk-7R5JY5H7.js → chunk-TE2HPDZG.js}

@@ -226,6 +226,88 @@ var defaultOpenapiErrorLimits = OpenapiErrorLimits.make({
   readTimeoutMs: 2e3
 });
 
+// src/contracts/network.ts
+var NetworkRefusal = Schema_exports.Union([
+  Schema_exports.Struct({ reason: Schema_exports.Literal("private_address") }),
+  Schema_exports.Struct({
+    reason: Schema_exports.Literal("credential_host"),
+    /** The provider of the credential handle the request carried. */
+    provider: Schema_exports.String,
+    /** The hosts that provider's credentials may reach; empty when it declares none. */
+    allowedHosts: Schema_exports.Array(Schema_exports.String)
+  }),
+  Schema_exports.Struct({ reason: Schema_exports.Literal("credential_app") }),
+  Schema_exports.Struct({
+    reason: Schema_exports.Literal("credential_expired"),
+    /** The provider of the expired credential handle. */
+    provider: Schema_exports.String
+  })
+]);
+var NetworkRefused = class extends Schema_exports.TaggedError()("NetworkRefused", {
+  /** The refused destination, with its port when the URL names one. */
+  host: Schema_exports.String,
+  refusal: NetworkRefusal
+}) {
+  get message() {
+    const refusal = this.refusal;
+    switch (refusal.reason) {
+      case "private_address":
+        return `Executor refused a request to ${this.host}: apps on this instance can reach only public addresses, and ${this.host} is a private, loopback or internal address. The request was not sent.`;
+      case "credential_host":
+        return refusal.allowedHosts.length === 0 ? `Executor refused this request: ${refusal.provider} credentials cannot be sent to ${this.host}: the provider declares no hosts.` : `Executor refused this request: ${refusal.provider} credentials cannot be sent to ${this.host}. The provider allows: ${refusal.allowedHosts.join(", ")}.`;
+      case "credential_app":
+        return "Executor refused this request: it carries a credential handle that is not valid for this app. Use the account fields this invocation received.";
+      case "credential_expired":
+        return `Executor refused this request: it carries an expired ${refusal.provider} credential handle. Use the account fields this invocation received.`;
+    }
+  }
+};
+var networkRefusalStatus = 421;
+var networkRefusalHeader = "x-executor-refused";
+var NetworkRefusedHeader = Schema_exports.StringFromUriComponent.pipe(
+  Schema_exports.decodeTo(Schema_exports.fromJsonString(NetworkRefused))
+);
+var encodeRefusal = Schema_exports.encodeSync(NetworkRefused);
+var encodeRefusalHeader = Schema_exports.encodeSync(NetworkRefusedHeader);
+var networkRefusalResponse = (refused) => new Response(JSON.stringify({ ...encodeRefusal(refused), message: refused.message }), {
+  status: networkRefusalStatus,
+  statusText: "Refused by Executor",
+  headers: {
+    "content-type": "application/json; charset=utf-8",
+    [networkRefusalHeader]: encodeRefusalHeader(refused)
+  }
+});
+var RestrictedFetchOption = Schema_exports.Literals(["redirect", "cache", "integrity"]);
+var supportedFetchOptions = {
+  redirect: ["follow", "manual"],
+  cache: ["no-store", "no-cache"],
+  integrity: [""]
+};
+var FetchOptionUnsupported = class extends Schema_exports.TaggedError()(
+  "FetchOptionUnsupported",
+  {
+    option: RestrictedFetchOption,
+    value: Schema_exports.String,
+    supported: Schema_exports.Array(Schema_exports.String)
+  }
+) {
+  get message() {
+    const supported = this.supported.map((value) => JSON.stringify(value)).join(" or ");
+    return `fetch option ${this.option}: ${JSON.stringify(this.value)} is not supported by Executor's app runtime. Use ${supported}, or omit ${this.option}.${this.advice}`;
+  }
+  /** What to do instead, when the standard value has an equivalent the runtime supports. */
+  get advice() {
+    switch (this.option) {
+      case "redirect":
+        return this.value === "error" ? ` To reject redirects, send redirect: "manual" and treat a 3xx response as the error.` : "";
+      case "cache":
+        return "";
+      case "integrity":
+        return " To check a digest, read the body and hash it with crypto.subtle.digest.";
+    }
+  }
+};
+
 // src/contracts/workflows.ts
 var WorkflowRunId = Schema_exports.NonEmptyString.pipe(Schema_exports.brand("wfr"));
 var WorkflowName = Schema_exports.NonEmptyString.check(Schema_exports.isMaxLength(200));
@@ -2935,6 +3017,15 @@ var ToolResultObservation = Context_exports.Reference(
 );
 
 export {
+  NetworkRefusal,
+  NetworkRefused,
+  networkRefusalStatus,
+  networkRefusalHeader,
+  NetworkRefusedHeader,
+  networkRefusalResponse,
+  RestrictedFetchOption,
+  supportedFetchOptions,
+  FetchOptionUnsupported,
   SecretsMethod,
   OAuthClientAuth,
   OAuthSecretClientAuth,

package/js/{chunk-T2UFJKZR.js → chunk-VF3X26ZO.js}

@@ -6,10 +6,10 @@ import {
   fromPromise,
   nativeOperation,
   nativeRouter
-} from "./chunk-TX2XCAL6.js";
+} from "./chunk-GQ7GCZ4J.js";
 import {
   ScheduleTiming
-} from "./chunk-7R5JY5H7.js";
+} from "./chunk-TE2HPDZG.js";
 import {
   DatabaseSchema
 } from "./chunk-M2KEEOIQ.js";

package/js/{chunk-AHI26TO6.js → chunk-VIQQ52V7.js}

@@ -1,9 +1,9 @@
 import {
   prepareElicitation
-} from "./chunk-3TEX4ZND.js";
+} from "./chunk-GLIAMV2R.js";
 import {
   fromPromise
-} from "./chunk-TX2XCAL6.js";
+} from "./chunk-GQ7GCZ4J.js";
 import {
   bodyUpstreamError
 } from "./chunk-KQCMHI3K.js";
@@ -18,7 +18,7 @@ import {
   defaultElicitationLimits,
   defaultMcpClientLimits,
   mcpSdkTimerCeilingMs
-} from "./chunk-7R5JY5H7.js";
+} from "./chunk-TE2HPDZG.js";
 import {
   jsonSchemaDecoder,
   nestJsonSchema,

package/js/contracts.js

@@ -14,6 +14,7 @@ import {
   ElicitationLimits,
   ElicitationReply,
   ElicitationResponse,
+  FetchOptionUnsupported,
   FormElicitation,
   HostAccountCheckError,
   HostAccountsInvalid,
@@ -52,6 +53,8 @@ import {
   ManualWebhookSetup,
   McpClientLimits,
   McpError,
+  NetworkRefusal,
+  NetworkRefused,
   NonRetryableError,
   OAuthClientAuth,
   OAuthSecretClientAuth,
@@ -99,6 +102,9 @@ import {
   maxApiErrorMessageLength,
   maxInputProblems,
   minimumIntervalMilliseconds,
+  networkRefusalHeader,
+  networkRefusalResponse,
+  networkRefusalStatus,
   protocol1,
   protocol2,
   protocol3,
@@ -111,7 +117,7 @@ import {
   skillCatalog,
   skillsCommand,
   workflowDurationMillis
-} from "./chunk-7R5JY5H7.js";
+} from "./chunk-TE2HPDZG.js";
 import {
   DatabaseFieldReserved,
   DatabaseLimitExceeded
@@ -191,6 +197,7 @@ export {
   FailureName,
   FailurePhase,
   FailureSource,
+  FetchOptionUnsupported,
   FormElicitation,
   HostAccountCheckError,
   HostAccountsInvalid,
@@ -230,6 +237,8 @@ export {
   ManualWebhookSetup,
   McpClientLimits,
   McpError,
+  NetworkRefusal,
+  NetworkRefused,
   NonRetryableError,
   OAuthClientAuth,
   OAuthSecretClientAuth,
@@ -289,6 +298,9 @@ export {
   maxInputProblems,
   maxUpstreamMessageLength,
   minimumIntervalMilliseconds,
+  networkRefusalHeader,
+  networkRefusalResponse,
+  networkRefusalStatus,
   protocol1,
   protocol2,
   protocol3,

package/js/effect.js

@@ -3,17 +3,17 @@ import {
   ApprovalDecision,
   createAppHandler,
   prepareElicitation
-} from "./chunk-3TEX4ZND.js";
+} from "./chunk-GLIAMV2R.js";
 import "./chunk-VUVBMNKC.js";
-import "./chunk-7AZNPMQH.js";
+import "./chunk-JN3PEGMW.js";
 import "./chunk-TSLG2WPA.js";
-import "./chunk-T2UFJKZR.js";
+import "./chunk-VF3X26ZO.js";
 import "./chunk-XBQTJP76.js";
-import "./chunk-TX2XCAL6.js";
+import "./chunk-GQ7GCZ4J.js";
 import "./chunk-KQCMHI3K.js";
 import {
   ToolAnnotations
-} from "./chunk-7R5JY5H7.js";
+} from "./chunk-TE2HPDZG.js";
 import "./chunk-M2KEEOIQ.js";
 import "./chunk-BRGF7VFN.js";
 import "./chunk-NSBRV4FJ.js";

package/js/graphql.js

@@ -4,26 +4,30 @@ import {
 } from "./chunk-ZZOCEUTB.js";
 import {
   protocolOperations
-} from "./chunk-4OD7PHQL.js";
+} from "./chunk-MWCLJQRI.js";
 import "./chunk-BCSNKUAC.js";
-import "./chunk-3TEX4ZND.js";
+import "./chunk-GLIAMV2R.js";
 import {
   cacheKey
 } from "./chunk-VUVBMNKC.js";
-import "./chunk-7AZNPMQH.js";
+import {
+  failOnNetworkRefusal
+} from "./chunk-JN3PEGMW.js";
 import "./chunk-TSLG2WPA.js";
-import "./chunk-T2UFJKZR.js";
+import "./chunk-VF3X26ZO.js";
 import "./chunk-XBQTJP76.js";
 import {
   nativeOperation,
   routerDeclaration
-} from "./chunk-TX2XCAL6.js";
+} from "./chunk-GQ7GCZ4J.js";
 import {
   accountProviderError,
   graphqlProviderError,
   httpProviderError
 } from "./chunk-KQCMHI3K.js";
-import "./chunk-7R5JY5H7.js";
+import {
+  NetworkRefused
+} from "./chunk-TE2HPDZG.js";
 import "./chunk-M2KEEOIQ.js";
 import {
   ProviderError
@@ -269,6 +273,7 @@ var graphqlClientEffect = (input) => Effect_exports.gen(function* () {
           HttpClientRequest_exports.bodyJsonUnsafe({ query, variables })
         )
       );
+      yield* failOnNetworkRefusal(response);
       if (response.status < 200 || response.status >= 300)
         return yield* httpProviderError(response.status, response.headers) ?? new GraphqlError({ phase, reason: "request", status: response.status });
       const result = yield* response.json.pipe(
@@ -297,13 +302,13 @@ var graphqlClientEffect = (input) => Effect_exports.gen(function* () {
       orElse: () => Effect_exports.fail(new GraphqlError({ phase, reason: "timeout" }))
     }),
     Effect_exports.mapError(
-      (error) => error instanceof ProviderError && options.accountId !== void 0 ? accountProviderError(error, options.accountId) : error instanceof GraphqlError || error instanceof ProviderError ? error : new GraphqlError({ phase, reason: "request" })
+      (error) => error instanceof ProviderError && options.accountId !== void 0 ? accountProviderError(error, options.accountId) : error instanceof GraphqlError || error instanceof ProviderError || error instanceof NetworkRefused ? error : new GraphqlError({ phase, reason: "request" })
     )
   );
   const discover = request("discover", getIntrospectionQuery()).pipe(
     Effect_exports.flatMap(Schema_exports.decodeUnknownEffect(GraphqlIntrospection)),
     Effect_exports.mapError(
-      (error) => error instanceof GraphqlError || error instanceof ProviderError ? error : new GraphqlError({ phase: "discover", reason: "invalid_response" })
+      (error) => error instanceof GraphqlError || error instanceof ProviderError || error instanceof NetworkRefused ? error : new GraphqlError({ phase: "discover", reason: "invalid_response" })
     )
   );
   return { request, discover };

package/js/host.js

@@ -1,12 +1,12 @@
 import {
   createAppHandler
-} from "./chunk-3TEX4ZND.js";
+} from "./chunk-GLIAMV2R.js";
 import "./chunk-VUVBMNKC.js";
-import "./chunk-7AZNPMQH.js";
+import "./chunk-JN3PEGMW.js";
 import "./chunk-TSLG2WPA.js";
-import "./chunk-T2UFJKZR.js";
+import "./chunk-VF3X26ZO.js";
 import "./chunk-XBQTJP76.js";
-import "./chunk-TX2XCAL6.js";
+import "./chunk-GQ7GCZ4J.js";
 import "./chunk-KQCMHI3K.js";
 import {
   ElicitationFailed,
@@ -21,7 +21,7 @@ import {
   WorkflowRun,
   WorkflowRunId,
   WorkflowRunPage
-} from "./chunk-7R5JY5H7.js";
+} from "./chunk-TE2HPDZG.js";
 import "./chunk-M2KEEOIQ.js";
 import {
   CacheCommand,

package/js/index.js

@@ -5,7 +5,7 @@ import {
   defineDatabase,
   table,
   workflow
-} from "./chunk-T2UFJKZR.js";
+} from "./chunk-VF3X26ZO.js";
 import "./chunk-XBQTJP76.js";
 import {
   dynamicRouter,
@@ -20,16 +20,18 @@ import {
   toolAnnotations,
   withApproval,
   withApprovals
-} from "./chunk-TX2XCAL6.js";
+} from "./chunk-GQ7GCZ4J.js";
 import {
   accountProviderError
 } from "./chunk-KQCMHI3K.js";
 import {
   CalendarSchedule,
   ElicitationFailed,
+  FetchOptionUnsupported,
   HostedTool,
   HostedToolSummary,
   Interval,
+  NetworkRefused,
   NonRetryableError,
   OAuth2AccessToken,
   OAuth2Config,
@@ -38,7 +40,7 @@ import {
   ScheduleTiming,
   SecretsMethod,
   WorkflowFailure
-} from "./chunk-7R5JY5H7.js";
+} from "./chunk-TE2HPDZG.js";
 import "./chunk-M2KEEOIQ.js";
 import {
   CacheError,
@@ -420,6 +422,8 @@ var decodeJson2 = (response, schema) => {
 export {
   CacheError,
   ElicitationFailed,
+  FetchOptionUnsupported,
+  NetworkRefused,
   NonRetryableError,
   NotImplemented,
   OAuth2AccessToken2 as OAuth2AccessToken,

package/js/mcp/effect.js

@@ -2,18 +2,18 @@ import {
   mcpClientEffect,
   mcpHealthEffect,
   mcpToolsEffect
-} from "../chunk-HIJW4LWC.js";
-import "../chunk-AHI26TO6.js";
+} from "../chunk-L76NWXM5.js";
+import "../chunk-VIQQ52V7.js";
 import "../chunk-BCSNKUAC.js";
-import "../chunk-3TEX4ZND.js";
+import "../chunk-GLIAMV2R.js";
 import "../chunk-VUVBMNKC.js";
-import "../chunk-7AZNPMQH.js";
+import "../chunk-JN3PEGMW.js";
 import "../chunk-TSLG2WPA.js";
-import "../chunk-T2UFJKZR.js";
+import "../chunk-VF3X26ZO.js";
 import "../chunk-XBQTJP76.js";
-import "../chunk-TX2XCAL6.js";
+import "../chunk-GQ7GCZ4J.js";
 import "../chunk-KQCMHI3K.js";
-import "../chunk-7R5JY5H7.js";
+import "../chunk-TE2HPDZG.js";
 import "../chunk-M2KEEOIQ.js";
 import "../chunk-BRGF7VFN.js";
 import "../chunk-NSBRV4FJ.js";