apps 0.0.1-beta.32 → 0.0.1-beta.34

package/js/skills.js

@@ -1,15 +1,24 @@
 import {
-  catalogCache
-} from "./chunk-BGALSHLT.js";
-import "./chunk-AYM2FUI5.js";
+  catalogCache,
+  catalogScope
+} from "./chunk-UKMIHP2G.js";
+import "./chunk-Q7Q5JTRW.js";
+import {
+  failOnNetworkRefusal
+} from "./chunk-EPUWF4ZG.js";
 import {
   folderSkillsEffect,
   skillFromFiles
 } from "./chunk-OX233L7N.js";
 import {
+  accountProviderError,
   httpProviderError
-} from "./chunk-4OKYLVU4.js";
-import "./chunk-5DLG2FVN.js";
+} from "./chunk-IU6OK5G2.js";
+import {
+  NetworkRefused,
+  ProviderError,
+  networkRefusalStatus
+} from "./chunk-DXGWKNTQ.js";
 import {
   AppSkillMetadata,
   AppSkillSource,
@@ -20,12 +29,13 @@ import {
   SkillServiceName,
   skillLoadLimits
 } from "./chunk-HW3DPBZR.js";
+import "./chunk-ETLILMHY.js";
 import {
   FetchHttpClient_exports
 } from "./chunk-MFHUR5SB.js";
 import {
   wrap
-} from "./chunk-NPGRURDG.js";
+} from "./chunk-O3OAFU7Q.js";
 import "./chunk-FBBXFFFJ.js";
 import "./chunk-QYM4STZW.js";
 import {
@@ -34,6 +44,7 @@ import {
 } from "./chunk-CJY5X26R.js";
 import {
   Effect_exports,
+  Encoding_exports,
   Ref_exports,
   Schema_exports,
   Stream_exports
@@ -600,6 +611,11 @@ var withService = (service) => (effect) => service === void 0 || !Schema_exports
     }) : error
   )
 );
+var refusedRequest = (refused) => new SkillLoadFailed({
+  reason: "source",
+  status: networkRefusalStatus,
+  message: refused.message.slice(0, 500)
+});
 var parse = (schema, input) => Schema_exports.decodeUnknownEffect(schema)(input).pipe(Effect_exports.mapError(() => failed("document")));
 var resourcePath = (path) => {
   if (!Schema_exports.is(SkillFilePath)(path)) return false;
@@ -615,23 +631,31 @@ var resourcePath = (path) => {
 var pathUrl = (base, path) => new URL(path.split("/").map(encodeURIComponent).join("/"), base).href;
 var reader = (transport) => Effect_exports.gen(function* () {
   const budget = yield* Ref_exports.make(0);
-  const fetchBytes = (url, post) => Effect_exports.gen(function* () {
+  const fetchBytes = (url, request = {}) => Effect_exports.gen(function* () {
     const parsed = yield* Effect_exports.try({
       try: () => new URL(url),
       catch: () => failed("source")
     });
     if (!["https:", "http:"].includes(parsed.protocol) || parsed.username || parsed.password || parsed.hash)
       return yield* failed("source");
+    const refused = request.refused ?? refusedRequest;
     const client = HttpClient_exports.withScope(yield* HttpClient_exports.HttpClient);
     const headers = {
       "User-Agent": "executor-skills",
       Accept: "application/json, text/plain",
-      "Cache-Control": "no-cache"
+      "Cache-Control": "no-cache",
+      ...request.headers
     };
-    const response = yield* (post === void 0 ? client.get(parsed, { headers }) : client.post(parsed, {
-      headers: { ...headers, ...post.headers },
-      body: HttpBody_exports.uint8Array(post.body, post.headers["Content-Type"])
-    })).pipe(Effect_exports.mapError(() => failed("request")));
+    const response = yield* (request.body === void 0 ? client.get(parsed, { headers }) : client.post(parsed, {
+      headers,
+      body: HttpBody_exports.uint8Array(request.body, request.headers?.["Content-Type"])
+    })).pipe(
+      // `ctx.fetch` rejects a request Executor's app network refused.
+      Effect_exports.mapError(
+        (error) => Schema_exports.is(NetworkRefused)(error.cause) ? refused(error.cause) : failed("request")
+      )
+    );
+    yield* failOnNetworkRefusal(response).pipe(Effect_exports.mapError(refused));
     if (response.status < 200 || response.status >= 300)
       return yield* rejected(response.status, response.headers);
     const chunks = [];
@@ -661,7 +685,7 @@ var reader = (transport) => Effect_exports.gen(function* () {
     Effect_exports.provideService(FetchHttpClient_exports.RequestInit, { redirect: "manual" }),
     Effect_exports.provideService(FetchHttpClient_exports.Fetch, transport.fetch ?? globalThis.fetch)
   );
-  const read = (url) => fetchBytes(url).pipe(
+  const read = (url, request = {}) => fetchBytes(url, request).pipe(
     Effect_exports.flatMap(
       (result) => Effect_exports.try({
         try: () => new TextDecoder("utf-8", { fatal: true }).decode(result),
@@ -680,21 +704,40 @@ var git = (run) => Effect_exports.tryPromise({
   try: async () => run(),
   catch: (error) => error instanceof InflateLimitExceeded ? failed("limit") : unreadable()
 });
-var resolveCommit = (remote, repo, ref) => Effect_exports.gen(function* () {
+var githubHosts = ["github.com", "raw.githubusercontent.com"];
+var githubRequests = (remote, repo, token) => {
+  const refused = (host) => (refusal) => refusal.refusal.reason === "credential_host" ? new SkillLoadFailed({
+    reason: "source",
+    status: networkRefusalStatus,
+    message: `Executor did not send the GitHub token to ${host}. The account's provider must declare hosts ${githubHosts.join(" and ")}; reconnect an account connected with other hosts.`
+  }) : refusedRequest(refusal);
+  const upload = (body) => remote.fetchBytes(`https://${githubHosts[0]}/${repo}.git/git-upload-pack`, {
+    body,
+    headers: {
+      ...gitRequestHeaders,
+      ...token === void 0 ? {} : { Authorization: `Basic ${Encoding_exports.encodeBase64(`x-access-token:${token}`)}` }
+    },
+    refused: refused(githubHosts[0])
+  });
+  const file = (commit, path) => remote.read(pathUrl(`https://${githubHosts[1]}/${repo}/${commit}/`, path), {
+    ...token === void 0 ? {} : { headers: { Authorization: `token ${token}` } },
+    refused: refused(githubHosts[1])
+  });
+  return { repo, authenticated: token !== void 0, upload, file };
+};
+var resolveCommit = (github, ref) => Effect_exports.gen(function* () {
+  const { repo } = github;
   if (ref !== void 0 && /^[a-f0-9]{40}$/.test(ref)) return ref;
   const names = refCandidates(ref);
-  const response = yield* remote.fetchBytes(`https://github.com/${repo}.git/git-upload-pack`, {
-    body: lsRefsRequest(names),
-    headers: gitRequestHeaders
-  }).pipe(
-    // GitHub asks for credentials when a repository is missing or private.
-    Effect_exports.mapError(
-      (error) => error.status === 401 || error.status === 404 ? new SkillLoadFailed({
+  const response = yield* github.upload(lsRefsRequest(names)).pipe(
+    Effect_exports.mapError((error) => {
+      const hidden = error.reason === "request" && (error.status === 404 || error.status === 401 && !github.authenticated);
+      return hidden ? new SkillLoadFailed({
         reason: "source",
-        message: `GitHub has no public repository named ${repo}.`,
+        message: github.authenticated ? `GitHub has no repository named ${repo} that the account's token can read.` : `GitHub has no public repository named ${repo}. To read a private repository, pass a GitHub account and its token.`,
         status: error.status
-      }) : error
-    )
+      }) : error;
+    })
   );
   const refs = yield* git(() => parseLsRefs(response));
   const commit = names.map((name) => refs.get(name)).find((sha) => sha !== void 0);
@@ -705,10 +748,7 @@ var resolveCommit = (remote, repo, ref) => Effect_exports.gen(function* () {
     });
   return commit;
 });
-var listFiles = (remote, repo, commit, path) => remote.fetchBytes(`https://github.com/${repo}.git/git-upload-pack`, {
-  body: treeFetchRequest(commit),
-  headers: gitRequestHeaders
-}).pipe(
+var listFiles = (github, commit, path) => github.upload(treeFetchRequest(commit)).pipe(
   Effect_exports.flatMap(
     (response) => git(
       () => parseTreeFetch(response, commit, path, { objectBytes: skillLoadLimits.fileBytes })
@@ -721,8 +761,8 @@ var SkillDirectories = Schema_exports.Array(
     files: Schema_exports.Array(Schema_exports.Struct({ path: Schema_exports.String, mode: Schema_exports.String }))
   })
 );
-var skillDirectories = (remote, repo, commit, path) => Effect_exports.gen(function* () {
-  const files = yield* listFiles(remote, repo, commit, path);
+var skillDirectories = (github, commit, path) => Effect_exports.gen(function* () {
+  const files = yield* listFiles(github, commit, path);
   const documents = files.filter(
     (file) => file.path === "SKILL.md" || file.path.endsWith("/SKILL.md")
   );
@@ -734,15 +774,21 @@ var skillDirectories = (remote, repo, commit, path) => Effect_exports.gen(functi
     return yield* failed("limit");
   return directories;
 });
-var cachedSkillDirectories = (cache, transport, repo, commit, path) => Effect_exports.tryPromise({
+var cachedSkillDirectories = (cache, transport, options, commit) => Effect_exports.tryPromise({
   try: () => cache.get({
-    key: ["apps/githubSkills/directories", 1, repo, commit, path ?? null],
+    key: ["apps/githubSkills/directories", 1, options.repo, commit, options.path ?? null],
     schema: wrap(SkillDirectories, false),
     freshFor: "7 days",
     load: (context) => Effect_exports.runPromise(
-      // Keep the author's fetch, as every other read in this load does.
+      // Keep the author's fetch and this read's token, as every other request in it does.
       reader({ fetch: transport.fetch, signal: context.signal }).pipe(
-        Effect_exports.flatMap((remote) => skillDirectories(remote, repo, commit, path))
+        Effect_exports.flatMap(
+          (remote) => skillDirectories(
+            githubRequests(remote, options.repo, options.token),
+            commit,
+            options.path
+          )
+        )
       ),
       { signal: context.signal }
     )
@@ -769,20 +815,42 @@ var cachedCatalog = (options, prefix, load) => options.cache === void 0 ? load(o
     })
   )
 );
+var GitHubToken = Schema_exports.String.check(Schema_exports.isPattern(/^[\x21-\x7e]+$/));
+var scopeMessages = {
+  "missing-account": "A GitHub token needs its account. Pass account: ctx.accounts.<slot> with it.",
+  "unselected-account": "The GitHub account is not one of this app's selected accounts."
+};
+var githubCache = (options) => options.account !== void 0 && !Schema_exports.is(GitHubToken)(options.token) ? Effect_exports.fail(
+  new SkillLoadFailed({
+    reason: "source",
+    message: "The GitHub account was passed without a valid token."
+  })
+) : catalogScope(
+  options,
+  options.token,
+  (problem) => new SkillLoadFailed({ reason: "source", message: scopeMessages[problem] })
+);
+var attributed = (account) => (error) => account !== void 0 && error.reason === "request" && (error.status === 401 || error.status === 403) ? accountProviderError(
+  new ProviderError({
+    reason: error.status === 401 ? "unauthorized" : "rejected",
+    status: error.status
+  }),
+  account.id
+) : error;
 var githubSkillsEffect = (options) => Effect_exports.gen(function* () {
   if (!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(options.repo) || options.path !== void 0 && !resourcePath(options.path))
     return yield* failed("source");
+  const cache = yield* githubCache(options);
   return yield* cachedCatalog(
-    options,
+    cache === void 0 ? options : { ...options, cache },
     ["apps/githubSkills/catalog", 1, options.repo, options.ref ?? null, options.path ?? null],
-    (transport, cache) => githubCatalog(options, transport, cache)
+    (transport, cache2) => githubCatalog(options, transport, cache2)
   );
-}).pipe(withService("GitHub"));
+}).pipe(withService("GitHub"), Effect_exports.mapError(attributed(options.account)));
 var githubCatalog = (options, transport, cache) => Effect_exports.gen(function* () {
-  const remote = yield* reader(transport);
-  const commit = yield* resolveCommit(remote, options.repo, options.ref);
-  const resources = yield* cache === void 0 ? skillDirectories(remote, options.repo, commit, options.path) : cachedSkillDirectories(cache, transport, options.repo, commit, options.path);
-  const base = `https://raw.githubusercontent.com/${options.repo}/${commit}/`;
+  const github = githubRequests(yield* reader(transport), options.repo, options.token);
+  const commit = yield* resolveCommit(github, options.ref);
+  const resources = yield* cache === void 0 ? skillDirectories(github, commit, options.path) : cachedSkillDirectories(cache, transport, options, commit);
   const skills = yield* Effect_exports.forEach(
     resources,
     ({ directory, files }) => Effect_exports.gen(function* () {
@@ -792,7 +860,7 @@ var githubCatalog = (options, transport, cache) => Effect_exports.gen(function*
           const path = file.path.slice(directory.length);
           if (!resourcePath(file.path) || !resourcePath(path) || file.mode === "120000")
             return yield* failed("source");
-          return { path, content: yield* remote.read(pathUrl(base, file.path)) };
+          return { path, content: yield* github.file(commit, file.path) };
         }),
         { concurrency: skillLoadLimits.concurrency }
       );

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "apps",
-  "version": "0.0.1-beta.32",
+  "version": "0.0.1-beta.34",
   "description": "TypeScript apps with typed tools, accounts, storage, and UI.",
   "type": "module",
   "sideEffects": false,