apps 0.0.1-beta.3 → 0.0.1-beta.30

package/types/apps/src/implementation/schema.d.ts

@@ -1,7 +1,8 @@
 /** Author schema facade. Internals use the native decoder retained by each value. */
 import { Effect, Schema as EffectSchema } from "effect";
-import { ValidationError, type JsonObject } from "../contracts/schema.js";
+import { JsonObject, ValidationError } from "../contracts/schema.js";
 import type { Field } from "../../../app-data/src/contracts/database.js";
+import type { FieldExposure } from "../contracts/provider.js";
 declare const StorageField: unique symbol;
 declare const Decoder: unique symbol;
 /** An author-facing value schema. Effect is never required in author code. */
@@ -59,6 +60,44 @@ export declare function literal<const T extends string | number | boolean | null
 export declare const array: <T>(item: Schema<T, boolean>) => Schema<readonly T[]>;
 /** Parse declared fields and omit undeclared fields. */
 export declare function object<const F extends Fields>(fields: F): ObjectSchema<F>;
+declare const Exposure: unique symbol;
+/** A schema marked with how app code sees the field in a provider that declares hosts. */
+export type Exposed<S, E extends FieldExposure = FieldExposure> = S & {
+    readonly [Exposure]: E;
+};
+/** The marking of one account field, if any. */
+export declare const exposureOf: (schema: Schema<unknown, boolean>) => FieldExposure | undefined;
+/**
+ * A field that is not secret, such as a subdomain or region. App code reads its real value and
+ * the connect form shows it.
+ */
+export declare const plain: <S extends Schema<unknown, boolean>>(schema: S) => Exposed<S, "plain">;
+/**
+ * A secret field that app code reads as its real value, for request signing and similar uses.
+ * The connect form warns that the app can read it. Prefer an unmarked field, which app code
+ * receives as a handle that only reaches the provider's declared hosts.
+ */
+export declare const raw: <S extends Schema<unknown, boolean>>(schema: S) => Exposed<S, "raw">;
+/** Marked fields of an account object, by name. */
+export declare const fieldExposure: (fields: Fields) => Readonly<Record<string, FieldExposure>>;
+declare const Secret: unique symbol;
+/**
+ * A secret account value. In a provider that declares hosts it is a handle, which the host's
+ * outbound network replaces with the real value only on requests to those hosts. Pass it to
+ * clients and headers as an ordinary string; do not decode or transform it.
+ */
+export type SecretString = string & {
+    readonly [Secret]: true;
+};
+type Sealed<T> = T extends string ? SecretString : T;
+/** Account fields as app code receives them: unmarked string fields are secret. */
+export type SecretFields<F extends Fields> = {
+    readonly [Key in keyof ObjectValue<F>]: Key extends keyof F ? F[Key] extends Exposed<unknown> ? ObjectValue<F>[Key] : Sealed<ObjectValue<F>[Key]> : ObjectValue<F>[Key];
+};
+/** An account object without declared fields, such as a default OAuth projection. */
+export type SecretObject<T> = {
+    readonly [Key in keyof T]: Sealed<T[Key]>;
+};
 declare const ImportedJsonSchema: unique symbol;
 /** Read the original document for an imported decoder without a lossy schema round trip. */
 export declare const importedJsonSchema: (decoder: EffectSchema.Decoder<unknown>) => unknown | undefined;
@@ -81,6 +120,14 @@ export declare const compileJsonSchemaDecoder: (document: JsonObject) => Effect.
     };
 }, ValidationError, never>;
 export declare const lazyJsonSchemaDecoder: (document: () => JsonObject) => Effect.Effect<EffectSchema.declareConstructor<EffectSchema.Json, EffectSchema.Json, readonly [], EffectSchema.Json>, never, never>;
+/**
+ * A lazy decoder and the compilation it decodes with. Running `compile` first lets a caller
+ * reject an unsupported schema before a side effect whose result the decoder will check.
+ */
+export declare const preparedJsonSchemaDecoder: (document: JsonObject) => {
+    decoder: EffectSchema.declareConstructor<EffectSchema.Json, EffectSchema.Json, readonly [], EffectSchema.Json>;
+    compile: Effect.Effect<EffectSchema.Decoder<EffectSchema.Json, never>, ValidationError, never>;
+};
 /** Preserve the JSON document; compile its validator only when a value is first decoded. */
 export declare const jsonSchemaDecoder: (input: unknown) => Effect.Effect<EffectSchema.declareConstructor<EffectSchema.Json, EffectSchema.Json, readonly [], EffectSchema.Json>, ValidationError, never>;
 /** Import JSON metadata now; unsupported schemas and invalid values fail when parsed. */
@@ -91,4 +138,8 @@ export declare const storageFieldOf: (schema: Schema<unknown, boolean>) => Field
 export declare const id: (table: string) => Schema<string>;
 /** A host user identifier, stored as a string without imposing a product auth model. */
 export declare const userId: () => Schema<string>;
+/** Render a decoder as a JSON Schema document, keeping an imported upstream document as-is. */
+export declare const jsonSchemaDocument: (decoder: EffectSchema.Decoder<unknown>) => Effect.Effect<{
+    readonly [x: string]: EffectSchema.Json;
+}, EffectSchema.SchemaError, never>;
 export {};

package/types/apps/src/implementation/skills.d.ts

@@ -13,8 +13,8 @@ export declare const reader: (transport: SkillTransport) => Effect.Effect<{
     json: (url: string) => Effect.Effect<unknown, SkillLoadFailed, never>;
 }, never, never>;
 export declare const githubSkillsEffect: (options: GitHubSkillsOptions) => Effect.Effect<readonly {
-    readonly name: string;
     readonly description: string;
+    readonly name: string;
     readonly files: readonly {
         readonly path: string;
         readonly content: string;
@@ -28,8 +28,8 @@ export declare const githubSkillsEffect: (options: GitHubSkillsOptions) => Effec
 }[], SkillLoadFailed, never>;
 /** Fetch all indexed files and reject a publication whose index changes during the read. */
 export declare const wellKnownSkillsEffect: (options: WellKnownSkillsOptions) => Effect.Effect<readonly {
-    readonly name: string;
     readonly description: string;
+    readonly name: string;
     readonly files: readonly {
         readonly path: string;
         readonly content: string;

package/types/apps/src/implementation/storage.d.ts

@@ -1,10 +1,12 @@
-import { type DatabaseSession } from "../../../app-data/src/index.js";
+import { type DatabaseSession, type reservedFieldNames } from "../../../app-data/src/index.js";
+type ReservedFieldName = (typeof reservedFieldNames)[number];
 import { type AppStorage } from "../contracts/storage.js";
 import type { DatabaseDefinition, Database, Table, Tables } from "../contracts/storage.js";
 import { type Fields } from "./schema.js";
 export type { DatabaseDefinition, Database, DatabaseReader, Table, Tables, RowOf, } from "../contracts/storage.js";
-/** Declare scalar columns using the same schemas as operation inputs. */
-export declare const table: <const F extends Fields>(fields: F) => Table<F>;
+/** Declare scalar columns using the same schemas as operation inputs. The host adds `id`,
+ * `createdAt` and `updatedAt` to every row, so tables cannot declare those names. */
+export declare const table: <const F extends Fields & { readonly [K in ReservedFieldName]?: never; }>(fields: F) => Table<F>;
 /** Build a fresh Promise database facade for one authorized invocation. */
 export declare const authorDatabase: <T extends Tables>(tables: T, session: DatabaseSession, signal: AbortSignal, writable: boolean) => Database<T>;
 /** Declare storage independently of handlers; the host binds each invocation's database. */

package/types/apps/src/implementation/ui-account-notice.d.ts

@@ -0,0 +1,9 @@
+/** Host-rendered account notices; no authored app code or provider responses enter them. */
+import type { UiAccountNotice, UiAccountProblem } from "../contracts/ui.js";
+/** Missing, removed, incompatible, or rejected accounts stop the app; other failed checks are advisory. */
+export declare const accountProblemBlocks: (problem: UiAccountProblem) => boolean;
+export declare const accountProblemText: (problem: UiAccountProblem) => string;
+/** Full page shown instead of the app while an account problem stops it from working. */
+export declare const accountBlockedPage: (notice: UiAccountNotice) => string;
+/** Inline card for advisory problems; the app still loads underneath. */
+export declare const accountNoticeBootstrap: (notice: UiAccountNotice) => string;

package/types/apps/src/implementation/ui-client.d.ts

@@ -1,4 +1,4 @@
-import { Atom } from "effect/unstable/reactivity";
+import { AsyncResult, Atom } from "effect/unstable/reactivity";
 import { type OperationReference } from "../contracts/live.js";
 import { type Schema } from "./schema.js";
 /** A scoped page client. Host-injected context carries only the deployment, never credentials. */
@@ -12,5 +12,5 @@ export declare const createAppClient: () => {
     /** Create a callable mutation with optional withOptimisticUpdate projections over mounted queries. */
     mutation: <Input, Output>(reference: OperationReference<Input, Output, "mutation">, output: Schema<NoInfer<Output>, boolean>) => import("../client.js").AppMutation<Input, Output>;
     /** Share a live query across mounts and reconcile optimistic changes against fresh server reads. */
-    queryAtom: <Input, Output>(reference: OperationReference<Input, Output, "query">, input: NoInfer<Input>, output: Schema<NoInfer<Output>, boolean>) => Atom.Atom<import("effect/unstable/reactivity/AsyncResult").AsyncResult<Output, unknown>>;
+    queryAtom: <Input, Output>(reference: OperationReference<Input, Output, "query">, input: NoInfer<Input>, output: Schema<NoInfer<Output>, boolean>) => Atom.Atom<AsyncResult.AsyncResult<Output, unknown>>;
 };

package/types/apps/src/implementation/ui-document.d.ts

@@ -0,0 +1,5 @@
+/**
+ * Retained files sit at the deployment's asset root. Resolving path-relative resource URLs there,
+ * instead of with `<base>`, leaves the document base as the page URL for links, history and forms.
+ */
+export declare const deploymentDocument: (html: string, deployment: string) => string;

package/types/apps/src/implementation/ui-errors.d.ts

@@ -1,2 +1,2 @@
 /** Inline host script: no app dependencies, credentials, or authored HTML enter its source. */
-export declare const appFailureBootstrap: string;
+export declare const appFailureBootstrap = "<script>\"use strict\";(()=>{var D=()=>{let d,w=Date.now(),m=0,g=0,f=new Map,A=/^(?:chrome|moz|safari-web)-extension:/,R=new Set([\"Error\",\"TypeError\",\"ReferenceError\",\"SyntaxError\",\"RangeError\",\"URIError\",\"EvalError\",\"AggregateError\"]),x=(e,t=0,i=0)=>{let r=[];if(!URL.canParse(e))return r;let a=new URL(e);return a.origin!==location.origin||!a.pathname.startsWith(\"/_executor/assets/\")||!a.pathname.endsWith(\".js\")||(r.push({key:\"code.file.path\",value:{stringValue:a.pathname}}),Number.isSafeInteger(t)&&t>0&&r.push({key:\"code.line.number\",value:{intValue:String(t)}}),Number.isSafeInteger(i)&&i>0&&r.push({key:\"code.column.number\",value:{intValue:String(i)}})),r},E=(e,t,i=[])=>{let r=Date.now();r-w>=6e4&&(w=r,m=0,f.clear());let a=`${e}:${t.slice(0,2e3)}`,b=f.get(a);if(b!==void 0&&r-b<1e3||m>=20){g++;return}f.set(a,r),m++,i.push({key:\"executor.ui.failure.suppressed\",value:{intValue:String(g)}}),g=0;let h=Array.from(crypto.getRandomValues(new Uint8Array(16)),s=>s.toString(16).padStart(2,\"0\")).join(\"\"),S=`${Date.now()}000000`,n,u=\"Sending error report\\u2026\",k=()=>{if(d?.open)return;let s=document.createElement(\"div\"),V=s.attachShadow({mode:\"open\"}),o=document.createElement(\"dialog\");d=o,o.setAttribute(\"aria-labelledby\",\"executor-failure-title\");let y=document.createElement(\"h2\");y.id=\"executor-failure-title\",y.textContent=e===\"script\"?\"This app could not load\":\"This app stopped working\";let C=document.createElement(\"p\");C.textContent=e===\"script\"?\"A file needed by this page did not load. Reload the page to try again.\":\"The app encountered an unexpected error. Reload the page to try again.\";let L=document.createElement(\"p\");L.textContent=\"Copy any unsaved work before reloading.\";let T=document.createElement(\"details\"),v=document.createElement(\"summary\");v.textContent=\"Error details\";let c=document.createElement(\"textarea\");c.readOnly=!0,c.rows=10,c.cols=36,c.setAttribute(\"aria-label\",\"Error details\"),c.value=`${t.slice(0,12e3)}\n\nDiagnostic ID: ${h}`,T.append(v,c),n=document.createElement(\"p\"),n.setAttribute(\"role\",\"status\"),n.textContent=u;let l=document.createElement(\"button\");l.type=\"button\",l.textContent=\"Reload page\",l.addEventListener(\"click\",()=>location.reload());let p=document.createElement(\"button\");p.type=\"button\",p.textContent=\"Close\",p.addEventListener(\"click\",()=>o.close()),o.addEventListener(\"close\",()=>{d===o&&(d=void 0),s.remove()}),o.append(y,C,L,T,n,l,p),V.append(o),document.documentElement.append(s),o.showModal()};document.readyState===\"loading\"?document.addEventListener(\"DOMContentLoaded\",k,{once:!0}):k(),fetch(\"/_executor/api/telemetry/traces\",{method:\"POST\",headers:{\"content-type\":\"application/json\"},credentials:\"same-origin\",keepalive:!0,body:JSON.stringify({resourceSpans:[{scopeSpans:[{spans:[{traceId:h,spanId:h.slice(0,16),name:\"ui.app.failure\",kind:1,startTimeUnixNano:S,endTimeUnixNano:S,status:{code:2},attributes:[{key:\"executor.ui.failure.kind\",value:{stringValue:e}},...i]}]}]}]})}).then(s=>{u=s.ok?\"Error report sent.\":\"Could not send the error report. You can copy the error details.\",n&&(n.textContent=u)},()=>{u=\"Could not send the error report. You can copy the error details.\",n&&(n.textContent=u)})};window.addEventListener(\"error\",e=>{if(e instanceof ErrorEvent){if(A.test(e.filename))return;let t=x(e.filename,e.lineno,e.colno);e.error instanceof Error&&R.has(e.error.name)&&t.push({key:\"exception.type\",value:{stringValue:e.error.name}}),E(\"runtime\",e.error instanceof Error?e.error.stack??e.message:e.message,t)}else e.target instanceof HTMLScriptElement&&E(\"script\",`Could not load script: ${e.target.src}`,x(e.target.src))},!0),window.addEventListener(\"unhandledrejection\",e=>{let t=e.reason;E(\"rejection\",t instanceof Error?t.stack??t.message:\"An app operation failed without handling its error.\")})};D();})();</script>";

package/types/apps/src/implementation/ui-serving.d.ts

@@ -1,16 +1,22 @@
 import { Effect } from "effect";
 import { HttpServerRequest, HttpServerResponse } from "effect/unstable/http";
-import { UiForbidden, type AppUiAsset } from "../contracts/ui.js";
-/** Render an authorized deployment with a host-owned deployment watcher. */
+import { UiForbidden, type AppUiAsset, type UiAccountNotice } from "../contracts/ui.js";
+/**
+ * Render an authorized deployment with a host-owned deployment watcher. Account problems that stop
+ * the app replace its document with a page that links to their fix; others add a dismissible card.
+ */
 export declare const appDocument: <E, R>(options: {
     readonly deployment: string;
     readonly profile?: string | undefined;
     readonly expectedProfileRevision?: number | undefined;
     readonly origin: string;
+    readonly accounts?: UiAccountNotice | undefined;
     readonly asset: (path: string) => Effect.Effect<AppUiAsset | undefined, E, R>;
 }) => Effect.Effect<HttpServerResponse.HttpServerResponse, UiForbidden | E, HttpServerRequest.HttpServerRequest | R>;
-/** Revalidate immutable assets only after the host has checked current access and file existence.
- * Browsers may retain bytes, but neither browsers nor shared proxies may reuse them without authorization.
+/** Serve an asset only after the host has checked current access and file existence.
+ * Asset URLs name their deployment, so their bytes never change: the browser keeps them for a year
+ * and does not ask again. Shared proxies never store them. Revoking access stops every new request
+ * and all app data, while bytes a browser already downloaded stay in its cache.
  * HTML remains an uncached host-rendered entry point.
  */
 export declare const appAsset: (asset: AppUiAsset | undefined, build: string, path: string) => Effect.Effect<HttpServerResponse.HttpServerResponse, never, HttpServerRequest.HttpServerRequest>;

package/types/apps/src/implementation/ui-watch.d.ts

@@ -1,2 +1,2 @@
 /** Dependency-free browser source served by each host after app authorization. */
-export declare const appWatchScript: string;
+export declare const appWatchScript = "\"use strict\";(()=>{var s=()=>{let i=document.getElementById(\"executor-context\")?.textContent;if(!i)return;let n=JSON.parse(i);if(typeof n!=\"object\"||n===null||!(\"deployment\"in n))return;let r=n.deployment;if(typeof r!=\"string\"||r.length===0)return;let t=new EventSource(\"/_executor/version\"),l=!1,o=()=>{l||(l=!0,t.close(),location.reload())};t.addEventListener(\"version\",d=>{let e=JSON.parse(d.data);typeof e==\"object\"&&e!==null&&\"deployment\"in e&&(e.deployment===null||typeof e.deployment==\"string\")&&e.deployment!==r&&o()}),t.addEventListener(\"revoked\",o),window.addEventListener(\"executor:deployment-changed\",o),window.addEventListener(\"pagehide\",()=>t.close(),{once:!0}),window.addEventListener(\"pageshow\",d=>{d.persisted&&o()})};s();})();";

package/types/apps/src/implementation/upstream-error.d.ts

@@ -0,0 +1,7 @@
+import { UpstreamError } from "../contracts/failure.js";
+/** Whether `bounded` shortened this message, so it may end partway through a secret. */
+export declare const isShortenedUpstream: (message: string) => boolean;
+/** The error a JSON error body states, if it uses JSON-RPC's or OAuth's error format. */
+export declare const bodyUpstreamError: (json: unknown) => UpstreamError | undefined;
+/** The `error` and `error_description` of a Bearer challenge (RFC 6750, section 3). */
+export declare const challengeUpstreamError: (header: string | undefined) => UpstreamError | undefined;

package/types/apps/src/implementation/webhooks.d.ts

@@ -26,4 +26,4 @@ export declare const dispatchWebhook: <Context extends {
         readonly [x: string]: string;
     };
     readonly body: string;
-}, HostDeclarationInvalid | HostOperationNotFound | HostOperationFailed | HostInputInvalid | HostOutputInvalid, never>;
+}, HostOperationNotFound | HostInputInvalid | HostOutputInvalid | HostDeclarationInvalid | HostOperationFailed, never>;

package/types/apps/src/implementation/workflow-context.d.ts

@@ -2,7 +2,15 @@
 import { Effect } from "effect";
 import type { AppDefinition } from "../contracts/app.js";
 import { WorkflowFailure, type WorkflowContext, type WorkflowExecution, type WorkflowStepContext } from "../contracts/workflows.js";
-/** Preserve typed failures and cancellation; authored exception text never leaves the app. */
-export declare const workflowSafe: <A>(work: Effect.Effect<A, unknown>) => Effect.Effect<A, WorkflowFailure>;
+/**
+ * Preserve typed failures and cancellation. Other errors keep their name and bounded message,
+ * with the given account secrets replaced.
+ */
+export declare const workflowSafe: <A>(work: Effect.Effect<A, unknown>, secrets: readonly string[]) => Effect.Effect<A, WorkflowFailure>;
 /** Construct one replay's Promise context. Step callbacks acquire fresh capabilities per actual attempt. */
-export declare const makeWorkflowContext: (execution: WorkflowExecution, definition: Pick<AppDefinition<never>, "queries" | "mutations">, fresh: (stepId: string, signal: AbortSignal) => Effect.Effect<WorkflowStepContext, WorkflowFailure>, signal: AbortSignal) => Effect.Effect<WorkflowContext>;
+export declare const makeWorkflowContext: (execution: WorkflowExecution, definition: Pick<AppDefinition<never>, "tools">, 
+/** A step attempt's context, and the raw account secrets its failures must not reveal. */
+fresh: (stepId: string, signal: AbortSignal) => Effect.Effect<{
+    readonly context: WorkflowStepContext;
+    readonly secrets: readonly string[];
+}, WorkflowFailure>, signal: AbortSignal) => Effect.Effect<WorkflowContext>;

package/types/apps/src/index.d.ts

@@ -1,4 +1,5 @@
 export { ProviderError } from "./contracts/provider-error.js";
+export { FetchOptionUnsupported, NetworkRefused } from "./contracts/network.js";
 export type { AppCache, CacheLoadContext, CacheGetOptions } from "./contracts/cache.js";
 export { CacheError } from "../../app-cache/src/contracts/cache.js";
 /**
@@ -8,32 +9,49 @@ export { CacheError } from "../../app-cache/src/contracts/cache.js";
 import { type Schema as EffectSchema } from "effect";
 import type { WebhookContext } from "./contracts/context.js";
 import { type JsonResponse as NativeResponse } from "./contracts/http.js";
-import { type OAuth2Config, type OAuth2Method as NativeOAuth2Method, type SecretsMethod as NativeSecretsMethod } from "./contracts/provider.js";
+import { type OAuth2Config as NativeOAuth2Config, type OAuth2Method as NativeOAuth2Method, type ReservedAuthorizationParam, type SecretsMethod as NativeSecretsMethod } from "./contracts/provider.js";
 import type { Webhook as NativeWebhook } from "./contracts/webhooks.js";
 import { type PromiseMethods } from "./implementation/authoring.js";
-import { type Fields, type Infer, type ObjectSchema, type Schema } from "./implementation/schema.js";
+import { type Fields, type Infer, type ObjectSchema, type Schema, type SecretFields, type SecretObject } from "./implementation/schema.js";
 export { type JsonObject, type JsonValue, ValidationError } from "./contracts/schema.js";
-export { type Fields, type Infer, type ObjectSchema, type ObjectValue, type Schema, array, boolean, json, jsonSchema, literal, number, object, record, string, } from "./implementation/schema.js";
-export { type AccountOf, type AuthMethod, type AuthMethodData, type AuthMethods, type ManyAccounts, type OAuth2Config, type Provider, } from "./contracts/provider.js";
-export { defineProvider } from "./implementation/provider.js";
-export { accountOperations } from "./implementation/account-operations.js";
-export { dynamicTools } from "./implementation/dynamic-tools.js";
+export { type Fields, type Infer, type ObjectSchema, type ObjectValue, type Schema, array, boolean, json, jsonSchema, literal, number, object, record, string, plain, raw, type SecretString, } from "./implementation/schema.js";
+export { type AccountCheckContext, type AccountCheckResult, type AccountInfo, type AccountOf, type AuthMethod, type AuthMethodData, type AuthMethods, type ManyAccounts, type Provider, type ReservedAuthorizationParam, } from "./contracts/provider.js";
+export { defineProvider, type ProviderOptions } from "./implementation/provider.js";
+export { accountRouter } from "./implementation/account-router.js";
+export { router, dynamicRouter, withApprovals, type RouterDeclaration, type RouterChild, type RouterOptions, } from "./implementation/router.js";
+export type { RouterIcon } from "./contracts/router.js";
 export { dynamicSkills } from "./implementation/dynamic-skills.js";
 export type { HostedTool as OperationDescription } from "./contracts/host.js";
+/** Account fields as app code receives them from a method declared with this schema. */
+type AccountFields<S> = S extends ObjectSchema<infer F> ? SecretFields<F> : SecretObject<Infer<S>>;
 /** A secrets declaration inferred from an author schema. */
-export type SecretsMethod<Shape extends ObjectSchema<Fields>> = NativeSecretsMethod<EffectSchema.Decoder<Infer<Shape>>>;
+export type SecretsMethod<Shape extends ObjectSchema<Fields>> = NativeSecretsMethod<EffectSchema.Decoder<AccountFields<Shape>>>;
 /** An OAuth declaration inferred from its author-facing response schema. */
-export type OAuth2Method<Response extends Schema<unknown, boolean>> = NativeOAuth2Method<EffectSchema.Decoder<Infer<Response>>>;
+export type OAuth2Method<Response extends Schema<unknown, boolean>> = NativeOAuth2Method<EffectSchema.Decoder<AccountFields<Response>>>;
 /** Default OAuth fields visible to app code. Host-only grants and clients stay private. */
 export declare const OAuth2AccessToken: Schema<{
     readonly access_token: string;
 }, false>;
+/**
+ * OAuth options as authors write them. `authorizationParams` naming a host-owned protocol
+ * parameter such as `state` or `scope` is a type error as well as a declaration failure.
+ */
+export type OAuth2Config = WithoutReservedParams<NativeOAuth2Config>;
+type WithoutReservedParams<Config> = Config extends unknown ? "authorizationParams" extends keyof Config ? Config & {
+    readonly authorizationParams?: {
+        readonly [Key in ReservedAuthorizationParam]?: never;
+    };
+} : Config : never;
 /** Declare a secrets method without requiring an Effect schema from the author. */
 export declare const secrets: <const F extends Fields>(options: {
     readonly label: string;
     readonly fields: ObjectSchema<F>;
 }) => SecretsMethod<ObjectSchema<F>>;
-/** Declare OAuth discovery/endpoints and an optional app-visible response projection. */
+/**
+ * Declare OAuth discovery/endpoints and an optional app-visible response projection.
+ * `authorizationParams` adds service-defined sign-in parameters; a declared `authorizationUrl`
+ * keeps its own query. Neither can set host-owned parameters, and each parameter appears once.
+ */
 export declare function oauth2(options: OAuth2Config): OAuth2Method<typeof OAuth2AccessToken>;
 export declare function oauth2<Response extends Schema<unknown, boolean>>(options: OAuth2Config & {
     readonly response: Response;
@@ -57,7 +75,7 @@ export { NotImplemented } from "./contracts/app.js";
 export { ElicitationFailed, type FormElicitation, type ElicitationResponse, type Elicit, } from "./contracts/elicitation.js";
 export { table, defineDatabase, type Table, type DatabaseReader, type Database, type DatabaseDefinition, } from "./implementation/storage.js";
 export { id, userId } from "./implementation/schema.js";
-export { query, mutation, withApproval, type Operation, type OperationOptions, } from "./implementation/operations.js";
+export { query, mutation, withApproval, toolAnnotations, type Operation, type OperationOptions, } from "./implementation/operations.js";
 export type { OperationContext } from "./contracts/operations.js";
 export { workflow, type Workflow, type WorkflowDeclaration } from "./implementation/workflows.js";
 export { NonRetryableError, WorkflowFailure, type WorkflowContext, type WorkflowStepContext, type WorkflowStep, type WorkflowStepOptions, type WorkflowDuration, type WorkflowReads, type WorkflowControls, } from "./contracts/workflows.js";

package/types/apps/src/mcp-stdio.d.ts

@@ -1,8 +1,5 @@
 import type { ProcessConfig } from "./contracts/mcp.js";
 import { type OperationKinds } from "./implementation/protocol-operations.js";
 export { McpError, type McpToolContext, type ProcessConfig } from "./contracts/mcp.js";
-/** Discover an account's tools; each discovery and call owns and closes its subprocess. */
-export declare const stdioOperations: (config: ProcessConfig, signal?: AbortSignal, kinds?: OperationKinds) => Promise<{
-    queries: Record<string, import("./index.js").Operation<import("effect/Schema").Json, unknown, "query", import("./index.js").OperationContext>>;
-    mutations: Record<string, import("./index.js").Operation<import("effect/Schema").Json, unknown, "mutation", import("./index.js").OperationContext>>;
-}>;
+/** Discover an account's tools as a router; each discovery and call owns and closes its subprocess. */
+export declare const stdioRouter: (config: ProcessConfig, signal?: AbortSignal, kinds?: OperationKinds) => Promise<import("./index.js").RouterDeclaration<unknown, unknown>>;

package/types/apps/src/mcp.d.ts

@@ -1,10 +1,30 @@
 /** HTTP MCP helpers. Requires the optional @modelcontextprotocol/sdk peer. */
 import type { OperationKinds } from "./implementation/protocol-operations.js";
+import type { McpHealthOptions } from "./contracts/mcp.js";
+import type { AccountCheckContext, AuthMethods } from "./contracts/provider.js";
 import { type McpCatalogOptions } from "./implementation/mcp-catalog.js";
 export type { McpCatalogOptions } from "./implementation/mcp-catalog.js";
-export { McpError, type McpToolContext, type McpToolsOptions, type McpToolResult, } from "./contracts/mcp.js";
-/** Discover operations for the selected account. Kinds override uncertain upstream read-only hints. */
-export declare const mcpOperations: (options: McpCatalogOptions, kinds?: OperationKinds) => Promise<{
-    dynamicTools: import("./contracts/dynamic-tools.js").DynamicTools;
-}>;
+export { McpCredentialsUnverified, McpError, type McpHealthOptions, type McpToolContext, type McpToolsOptions, type McpToolResult, } from "./contracts/mcp.js";
+/**
+ * A router over a server's tools for the selected account. Its title, description and
+ * instructions come from the server. Kinds override uncertain upstream read-only hints.
+ */
+export declare const mcpRouter: (options: McpCatalogOptions, kinds?: OperationKinds) => Promise<import("./index.js").RouterDeclaration<unknown, unknown>>;
+/**
+ * A provider `health` check for an MCP server. Pass the check context `health` receives, then the
+ * server's `url` and the `headers` that send the account's credentials:
+ * `health: (check) => mcpHealth(check, { url, headers: headers(check.account) })`.
+ *
+ * It connects with those headers, initializes, and reads the first page of tools, then does the
+ * same without any headers. No tool runs. The check passes only when the server accepts the account
+ * and refuses the attempt without credentials. A refused account throws `ProviderError`, as HTTP
+ * helpers do. An unreachable or unusable server throws `McpError`, and a request Executor's network
+ * refuses throws `NetworkRefused`. A server that also answers without credentials, or whose answer
+ * to that attempt is not a refusal, throws `McpCredentialsUnverified`. Each of these errors means
+ * the check could not verify the account, and the account form explains why. Send credentials only
+ * in `headers`; the attempt without them uses the same `url`. The check context's `signal` cancels
+ * both attempts, and they share one budget that ends early enough before its `deadline` to report a
+ * server that did not answer in time. `timeoutMs` can only shorten that budget.
+ */
+export declare const mcpHealth: <Auth extends AuthMethods>(check: AccountCheckContext<Auth>, options: McpHealthOptions) => Promise<void>;
 export type { OperationKinds } from "./implementation/protocol-operations.js";

package/types/apps/src/openapi.d.ts

@@ -2,11 +2,11 @@
 import { type OperationKinds } from "./implementation/protocol-operations.js";
 import type { OpenapiToolsOptions } from "./contracts/openapi.js";
 export { OpenapiError, isOpenapiTextMedia, openapiBinaryResultSchema, OpenapiErrorResponse, type OpenapiToolsOptions, type OpenapiOperation, type CredentialBinding, OpenapiParameter, OpenapiRequestBody, openapiMediaKind, } from "./contracts/openapi.js";
-/** Discover operations for the selected account. Kinds override uncertain upstream read-only hints. */
-export declare const openapiOperations: (options: OpenapiToolsOptions, kinds?: OperationKinds) => Promise<{
-    queries: Record<string, import("./index.js").Operation<import("effect/Schema").Json, unknown, "query", import("./index.js").OperationContext>>;
-    mutations: Record<string, import("./index.js").Operation<import("effect/Schema").Json, unknown, "mutation", import("./index.js").OperationContext>>;
-}>;
+/**
+ * Discover a document's operations as a router for the selected account. Kinds override uncertain
+ * upstream read-only hints. Mount it under a key, or override its metadata with `router(...)`.
+ */
+export declare const openapiRouter: (options: OpenapiToolsOptions, kinds?: OperationKinds) => Promise<import("./index.js").RouterDeclaration<unknown, unknown>>;
 export type { OperationKinds } from "./implementation/protocol-operations.js";
 export * from "./contracts/openapi-compile.js";
-export { liveOpenapiOperations, type OpenapiSourceOptions, } from "./implementation/openapi-source.js";
+export { liveOpenapiRouter, type OpenapiSourceOptions } from "./implementation/openapi-source.js";

package/types/apps/src/skills.d.ts

@@ -5,8 +5,8 @@ export { SkillLoadFailed, SkillDefinitionInvalid, SkillServiceName, type SkillRe
  * the catalog; without it, mutable refs resolve again on each call.
  */
 export declare const githubSkills: (options: GitHubSkillsOptions) => Promise<readonly {
-    readonly name: string;
     readonly description: string;
+    readonly name: string;
     readonly files: readonly {
         readonly path: string;
         readonly content: string;
@@ -20,8 +20,8 @@ export declare const githubSkills: (options: GitHubSkillsOptions) => Promise<rea
 }[]>;
 /** Fetch a published skill index and its text files. Pass `cache: ctx.cache` to reuse the catalog. */
 export declare const wellKnownSkills: (options: WellKnownSkillsOptions) => Promise<readonly {
-    readonly name: string;
     readonly description: string;
+    readonly name: string;
     readonly files: readonly {
         readonly path: string;
         readonly content: string;
@@ -35,8 +35,8 @@ export declare const wellKnownSkills: (options: WellKnownSkillsOptions) => Promi
 }[]>;
 /** Parse a bundled standard skill directory into an app capability. */
 export declare const fileSkill: (files: readonly SkillFile[]) => Promise<{
-    readonly name: string;
     readonly description: string;
+    readonly name: string;
     readonly files: readonly {
         readonly path: string;
         readonly content: string;
@@ -50,8 +50,8 @@ export declare const fileSkill: (files: readonly SkillFile[]) => Promise<{
 }>;
 /** Read skill directories from ctx.files. Omitted path selects skills/; missing folders return []. */
 export declare const folderSkills: (options: FolderSkillsOptions) => Promise<readonly {
-    readonly name: string;
     readonly description: string;
+    readonly name: string;
     readonly files: readonly {
         readonly path: string;
         readonly content: string;

package/types/telemetry/src/browser-operations.d.ts

@@ -1,8 +1,11 @@
 /** Correlate transport and decoded outcomes without exporting response bodies or errors. */
 import { Effect, Schema, Tracer } from "effect";
 import { HttpClient, HttpClientError } from "effect/unstable/http";
-/** A random document identity. It is never an authentication or user identifier. */
-export declare const browserPageId: () => string;
+/**
+ * A random identity for the current browser document. It is never an authentication or user
+ * identifier. Server renders have no document, so they get none instead of sharing one per isolate.
+ */
+export declare const browserPageId: () => string | undefined;
 /** Safe event shared with the host's error reporter and product analytics. */
 export declare const BrowserOperationFailure: Schema.Struct<{
     readonly error_type: Schema.Literals<readonly ["BrowserDecodeFailed", "BrowserTransportFailed", "BrowserOperationFailed"]>;

package/types/telemetry/src/config.d.ts

@@ -33,8 +33,8 @@ export declare const TelemetryConfig: Schema.Struct<{
 export type TelemetryConfig = typeof TelemetryConfig.Type;
 /** Host-only destinations; never copied into an app's invocation telemetry capability. */
 export declare const CurrentTelemetryConfig: Context.Reference<{
-    readonly version: string;
     readonly service: string;
+    readonly version: string;
     readonly environment: string;
     readonly clock?: "system" | "cloudflare-io" | undefined;
     readonly traces?: {
@@ -59,8 +59,8 @@ export declare const CurrentTelemetryConfig: Context.Reference<{
 } | undefined>;
 /** Read OTLP endpoints uniformly for all signals; development chooses which signals to configure. */
 export declare const telemetryConfig: (service: string) => Effect.Effect<{
-    readonly version: string;
     readonly service: string;
+    readonly version: string;
     readonly environment: string;
     readonly clock?: "system" | "cloudflare-io" | undefined;
     readonly traces?: {

package/types/utils/src/api-error.d.ts

@@ -0,0 +1,48 @@
+import { Schema, type Cause } from "effect";
+import "effect/unstable/httpapi";
+/**
+ * Encode the class's `message` getter as a required wire string. Decoding validates the field,
+ * then omits it, so the class derives its own message from the parsed payload and a supplied
+ * value never replaces it.
+ */
+export declare const MessageField: Schema.decodeTo<Schema.optionalKey<Schema.String>, Schema.String, never, never>;
+/** An expected API error whose response states its cause in a `message` derived from its fields. */
+export interface ApiError extends Cause.YieldableError {
+    readonly _tag: string;
+}
+type Header<Tag extends string> = {
+    readonly tag: Tag;
+    readonly status: number;
+};
+type Definition<Tag extends string, Fields extends Schema.Struct.Fields> = Header<Tag> & {
+    readonly fields: Fields & {
+        readonly [Key in "_tag" | "message"]?: never;
+    };
+    /**
+     * The cause, stated for API and agent callers. It is also the error's `message`, which traces
+     * record, so it never includes credentials, upstream response text or submitted values.
+     */
+    readonly message: string | ((fields: Schema.Struct.Type<Fields>) => string);
+};
+type ErrorFields<Tag extends string, Fields extends Schema.Struct.Fields> = Omit<Schema.TaggedStruct<Tag, Fields & {
+    readonly message: typeof MessageField;
+}>, "~type.make.in"> & {
+    readonly "~type.make.in": Schema.TaggedStruct<Tag, Fields>["~type.make.in"];
+};
+type ErrorClass<Tag extends string, Fields extends Schema.Struct.Fields> = Schema.Class<Schema.Struct.Type<Fields> & ApiError & {
+    readonly _tag: Tag;
+}, ErrorFields<Tag, Fields>, ApiError>;
+/** Define an error with no payload and a fixed message. Its tag is its public error code. */
+declare function define<const Tag extends string>(definition: Header<Tag> & {
+    readonly message: string;
+}): ErrorClass<Tag, {}>;
+/** Define an error whose message can depend on its parsed fields. */
+declare function define<const Tag extends string, const Fields extends Schema.Struct.Fields>(definition: Definition<Tag, Fields>): ErrorClass<Tag, Fields>;
+/**
+ * Define the schema, constructor and API message of an expected error together. Errors that need
+ * a user-facing title and recovery use `UserFacingError`, which carries the same message field.
+ */
+export declare const ApiError: {
+    define: typeof define;
+};
+export {};

package/js/chunk-PYUYJRSK.js

@@ -1,93 +0,0 @@
-import {
-  decoderOf
-} from "./chunk-WFSQXYUT.js";
-import {
-  Effect_exports
-} from "./chunk-FW5HBOIK.js";
-
-// src/implementation/authoring.ts
-var NativeCallback = /* @__PURE__ */ Symbol("apps.NativeCallback");
-var fromPromise = (callback) => (...args) => {
-  if (NativeCallback in callback) {
-    const native = callback[NativeCallback];
-    return native(...args);
-  }
-  return Effect_exports.tryPromise({ try: () => callback(...args), catch: (error) => error });
-};
-var toPromise = (operation, signal) => {
-  const native = (...args) => Effect_exports.suspend(() => {
-    if (signal === void 0) return operation(...args);
-    if (signal.aborted) return Effect_exports.interrupt;
-    const cancelled = Effect_exports.callback((resume) => {
-      if (signal.aborted) {
-        resume(Effect_exports.interrupt);
-        return;
-      }
-      const abort = () => resume(Effect_exports.interrupt);
-      signal.addEventListener("abort", abort, { once: true });
-      return Effect_exports.sync(() => signal.removeEventListener("abort", abort));
-    });
-    return Effect_exports.raceFirst(
-      cancelled,
-      Effect_exports.suspend(() => operation(...args))
-    );
-  });
-  return Object.assign((...args) => Effect_exports.runPromise(native(...args)), {
-    [NativeCallback]: native
-  });
-};
-
-// src/implementation/operations.ts
-var NativeOperation = /* @__PURE__ */ Symbol("apps.Operation");
-var operationDeclaration = (operation) => ({
-  kind: operation.kind,
-  [NativeOperation]: operation
-});
-var nativeOperation = (value) => {
-  if (typeof value !== "object" || value === null || !(NativeOperation in value)) return void 0;
-  return value[NativeOperation];
-};
-var operationOptions = (options) => {
-  const approval = options.approval;
-  return {
-    ...options.description === void 0 ? {} : { description: options.description },
-    ...options.title === void 0 ? {} : { title: options.title },
-    ...options.annotations === void 0 ? {} : { annotations: options.annotations },
-    ...options._meta === void 0 ? {} : { _meta: options._meta },
-    input: decoderOf(options.input),
-    ...approval === void 0 ? {} : {
-      approval: (context) => Effect_exports.tryPromise({ try: async () => approval(context), catch: (error) => error })
-    }
-  };
-};
-var withApproval = (operation, approval) => ({
-  ...operation,
-  [NativeOperation]: {
-    ...operation[NativeOperation],
-    approval: (context) => Effect_exports.tryPromise({ try: async () => approval(context), catch: (error) => error })
-  }
-});
-var make = (kind, options, run) => operationDeclaration({
-  ...operationOptions(options),
-  kind,
-  // The host always validates JSON serialization, even without a stronger output declaration.
-  ...options.output === void 0 ? {} : { output: decoderOf(options.output) },
-  run: (context, input) => Effect_exports.tryPromise({
-    // SAFETY: defineApp checks the handler context against its requirements.
-    // The host validates account bindings and creates the matching storage facade.
-    try: () => run(context, input),
-    catch: (error) => error
-  })
-});
-var query = (options, run) => make("query", options, run);
-var mutation = (options, run) => make("mutation", options, run);
-
-export {
-  fromPromise,
-  toPromise,
-  operationDeclaration,
-  nativeOperation,
-  withApproval,
-  query,
-  mutation
-};