apps 0.0.1-beta.36 → 0.0.1-beta.38

package/types/apps/src/contracts/protocols/4.d.ts

@@ -313,7 +313,7 @@ export declare class HostKindMismatch extends HostKindMismatch_base {
  * Safe error envelope. Author failures carry only their name and bounded message with account
  * secrets replaced; no source, account fields, stack or cause value is serialized.
  */
-export declare const HostError: Schema.Union<readonly [typeof import("../api-response-error.js").OpenapiResponseError, typeof ProviderError, typeof McpError, typeof SkillLoadFailed, typeof import("../workflows.js").WorkflowFailure, typeof import("./1.js").HostRequestInvalid, typeof import("./1.js").HostAccountsInvalid, typeof HostDeclarationInvalid, typeof HostEvaluationFailed, typeof import("./1.js").HostOperationNotFound, typeof import("./3.js").HostOperationFailed, typeof import("../../../../app-data/src/index.js").DatabaseLimitExceeded, typeof import("../../../../app-data/src/index.js").DatabaseFieldReserved, typeof import("./1.js").HostToolNotFound, typeof import("./1.js").HostInputInvalid, typeof import("./1.js").HostOutputInvalid, typeof import("./1.js").HostToolBlocked, typeof import("./1.js").HostToolApprovalRequired, typeof import("./1.js").HostToolPolicyFailed, typeof import("../elicitation.js").ElicitationFailed, typeof HostKindMismatch]>;
+export declare const HostError: Schema.Union<readonly [typeof import("../api-response-error.js").OpenapiResponseError, typeof ProviderError, typeof McpError, typeof SkillLoadFailed, typeof import("../workflows.js").WorkflowFailure, typeof import("./1.js").HostRequestInvalid, typeof import("./1.js").HostAccountsInvalid, typeof HostDeclarationInvalid, typeof HostEvaluationFailed, typeof import("./1.js").HostOperationNotFound, typeof import("./3.js").HostOperationFailed, typeof import("../../../../app-data/src/contracts/database.js").DatabaseLimitExceeded, typeof import("../../../../app-data/src/contracts/database.js").DatabaseFieldReserved, typeof import("./1.js").HostToolNotFound, typeof import("./1.js").HostInputInvalid, typeof import("./1.js").HostOutputInvalid, typeof import("./1.js").HostToolBlocked, typeof import("./1.js").HostToolApprovalRequired, typeof import("./1.js").HostToolPolicyFailed, typeof import("../elicitation.js").ElicitationFailed, typeof HostKindMismatch]>;
 /** Expected host failures. */
 export type HostError = typeof HostError.Type;
 /** Portable response envelope; callers parse the success value for their operation. */
@@ -323,7 +323,7 @@ export declare const HostResponse: Schema.Union<readonly [Schema.Struct<{
     readonly toolError: Schema.optionalKey<Schema.Literal<true>>;
 }>, Schema.Struct<{
     readonly ok: Schema.Literal<false>;
-    readonly error: Schema.Union<readonly [typeof import("../api-response-error.js").OpenapiResponseError, typeof ProviderError, typeof McpError, typeof SkillLoadFailed, typeof import("../workflows.js").WorkflowFailure, typeof import("./1.js").HostRequestInvalid, typeof import("./1.js").HostAccountsInvalid, typeof HostDeclarationInvalid, typeof HostEvaluationFailed, typeof import("./1.js").HostOperationNotFound, typeof import("./3.js").HostOperationFailed, typeof import("../../../../app-data/src/index.js").DatabaseLimitExceeded, typeof import("../../../../app-data/src/index.js").DatabaseFieldReserved, typeof import("./1.js").HostToolNotFound, typeof import("./1.js").HostInputInvalid, typeof import("./1.js").HostOutputInvalid, typeof import("./1.js").HostToolBlocked, typeof import("./1.js").HostToolApprovalRequired, typeof import("./1.js").HostToolPolicyFailed, typeof import("../elicitation.js").ElicitationFailed, typeof HostKindMismatch]>;
+    readonly error: Schema.Union<readonly [typeof import("../api-response-error.js").OpenapiResponseError, typeof ProviderError, typeof McpError, typeof SkillLoadFailed, typeof import("../workflows.js").WorkflowFailure, typeof import("./1.js").HostRequestInvalid, typeof import("./1.js").HostAccountsInvalid, typeof HostDeclarationInvalid, typeof HostEvaluationFailed, typeof import("./1.js").HostOperationNotFound, typeof import("./3.js").HostOperationFailed, typeof import("../../../../app-data/src/contracts/database.js").DatabaseLimitExceeded, typeof import("../../../../app-data/src/contracts/database.js").DatabaseFieldReserved, typeof import("./1.js").HostToolNotFound, typeof import("./1.js").HostInputInvalid, typeof import("./1.js").HostOutputInvalid, typeof import("./1.js").HostToolBlocked, typeof import("./1.js").HostToolApprovalRequired, typeof import("./1.js").HostToolPolicyFailed, typeof import("../elicitation.js").ElicitationFailed, typeof HostKindMismatch]>;
 }>]>;
 /** Parsed response envelope. */
 export type HostResponse = typeof HostResponse.Type;
@@ -949,7 +949,7 @@ export declare const protocol4: {
             readonly toolError: Schema.optionalKey<Schema.Literal<true>>;
         }>, Schema.Struct<{
             readonly ok: Schema.Literal<false>;
-            readonly error: Schema.Union<readonly [typeof import("../api-response-error.js").OpenapiResponseError, typeof ProviderError, typeof McpError, typeof SkillLoadFailed, typeof import("../workflows.js").WorkflowFailure, typeof import("./1.js").HostRequestInvalid, typeof import("./1.js").HostAccountsInvalid, typeof HostDeclarationInvalid, typeof HostEvaluationFailed, typeof import("./1.js").HostOperationNotFound, typeof import("./3.js").HostOperationFailed, typeof import("../../../../app-data/src/index.js").DatabaseLimitExceeded, typeof import("../../../../app-data/src/index.js").DatabaseFieldReserved, typeof import("./1.js").HostToolNotFound, typeof import("./1.js").HostInputInvalid, typeof import("./1.js").HostOutputInvalid, typeof import("./1.js").HostToolBlocked, typeof import("./1.js").HostToolApprovalRequired, typeof import("./1.js").HostToolPolicyFailed, typeof import("../elicitation.js").ElicitationFailed, typeof HostKindMismatch]>;
+            readonly error: Schema.Union<readonly [typeof import("../api-response-error.js").OpenapiResponseError, typeof ProviderError, typeof McpError, typeof SkillLoadFailed, typeof import("../workflows.js").WorkflowFailure, typeof import("./1.js").HostRequestInvalid, typeof import("./1.js").HostAccountsInvalid, typeof HostDeclarationInvalid, typeof HostEvaluationFailed, typeof import("./1.js").HostOperationNotFound, typeof import("./3.js").HostOperationFailed, typeof import("../../../../app-data/src/contracts/database.js").DatabaseLimitExceeded, typeof import("../../../../app-data/src/contracts/database.js").DatabaseFieldReserved, typeof import("./1.js").HostToolNotFound, typeof import("./1.js").HostInputInvalid, typeof import("./1.js").HostOutputInvalid, typeof import("./1.js").HostToolBlocked, typeof import("./1.js").HostToolApprovalRequired, typeof import("./1.js").HostToolPolicyFailed, typeof import("../elicitation.js").ElicitationFailed, typeof HostKindMismatch]>;
         }>]>;
         readonly requirements: Schema.Struct<{
             readonly capabilities: Schema.optionalKey<Schema.Struct<{

package/types/apps/src/contracts/protocols/5.d.ts

@@ -918,7 +918,7 @@ export declare const protocol5: {
             readonly toolError: Schema.optionalKey<Schema.Literal<true>>;
         }>, Schema.Struct<{
             readonly ok: Schema.Literal<false>;
-            readonly error: Schema.Union<readonly [typeof import("../api-response-error.js").OpenapiResponseError, typeof import("./1.js").ProviderError, typeof import("./1.js").McpError, typeof import("./1.js").SkillLoadFailed, typeof import("../workflows.js").WorkflowFailure, typeof import("./1.js").HostRequestInvalid, typeof import("./1.js").HostAccountsInvalid, typeof import("./3.js").HostDeclarationInvalid, typeof import("./3.js").HostEvaluationFailed, typeof import("./1.js").HostOperationNotFound, typeof import("./3.js").HostOperationFailed, typeof import("../../../../app-data/src/index.js").DatabaseLimitExceeded, typeof import("../../../../app-data/src/index.js").DatabaseFieldReserved, typeof import("./1.js").HostToolNotFound, typeof import("./1.js").HostInputInvalid, typeof import("./1.js").HostOutputInvalid, typeof import("./1.js").HostToolBlocked, typeof import("./1.js").HostToolApprovalRequired, typeof import("./1.js").HostToolPolicyFailed, typeof import("../elicitation.js").ElicitationFailed, typeof import("./4.js").HostKindMismatch]>;
+            readonly error: Schema.Union<readonly [typeof import("../api-response-error.js").OpenapiResponseError, typeof import("./1.js").ProviderError, typeof import("./1.js").McpError, typeof import("./1.js").SkillLoadFailed, typeof import("../workflows.js").WorkflowFailure, typeof import("./1.js").HostRequestInvalid, typeof import("./1.js").HostAccountsInvalid, typeof import("./3.js").HostDeclarationInvalid, typeof import("./3.js").HostEvaluationFailed, typeof import("./1.js").HostOperationNotFound, typeof import("./3.js").HostOperationFailed, typeof import("../../../../app-data/src/contracts/database.js").DatabaseLimitExceeded, typeof import("../../../../app-data/src/contracts/database.js").DatabaseFieldReserved, typeof import("./1.js").HostToolNotFound, typeof import("./1.js").HostInputInvalid, typeof import("./1.js").HostOutputInvalid, typeof import("./1.js").HostToolBlocked, typeof import("./1.js").HostToolApprovalRequired, typeof import("./1.js").HostToolPolicyFailed, typeof import("../elicitation.js").ElicitationFailed, typeof import("./4.js").HostKindMismatch]>;
         }>]>;
         readonly catalog: Schema.Struct<{
             readonly tools: Schema.$Array<Schema.Struct<{

package/types/apps/src/contracts/protocols/6.d.ts

@@ -1364,7 +1364,7 @@ export declare const protocol6: {
             readonly toolError: Schema.optionalKey<Schema.Literal<true>>;
         }>, Schema.Struct<{
             readonly ok: Schema.Literal<false>;
-            readonly error: Schema.Union<readonly [typeof import("../api-response-error.js").OpenapiResponseError, typeof import("./1.js").ProviderError, typeof import("./1.js").McpError, typeof import("./1.js").SkillLoadFailed, typeof import("../workflows.js").WorkflowFailure, typeof import("./1.js").HostRequestInvalid, typeof import("./1.js").HostAccountsInvalid, typeof import("./3.js").HostDeclarationInvalid, typeof import("./3.js").HostEvaluationFailed, typeof import("./1.js").HostOperationNotFound, typeof import("./3.js").HostOperationFailed, typeof import("../../../../app-data/src/index.js").DatabaseLimitExceeded, typeof import("../../../../app-data/src/index.js").DatabaseFieldReserved, typeof import("./1.js").HostToolNotFound, typeof import("./1.js").HostInputInvalid, typeof import("./1.js").HostOutputInvalid, typeof import("./1.js").HostToolBlocked, typeof import("./1.js").HostToolApprovalRequired, typeof import("./1.js").HostToolPolicyFailed, typeof import("../elicitation.js").ElicitationFailed, typeof import("./4.js").HostKindMismatch]>;
+            readonly error: Schema.Union<readonly [typeof import("../api-response-error.js").OpenapiResponseError, typeof import("./1.js").ProviderError, typeof import("./1.js").McpError, typeof import("./1.js").SkillLoadFailed, typeof import("../workflows.js").WorkflowFailure, typeof import("./1.js").HostRequestInvalid, typeof import("./1.js").HostAccountsInvalid, typeof import("./3.js").HostDeclarationInvalid, typeof import("./3.js").HostEvaluationFailed, typeof import("./1.js").HostOperationNotFound, typeof import("./3.js").HostOperationFailed, typeof import("../../../../app-data/src/contracts/database.js").DatabaseLimitExceeded, typeof import("../../../../app-data/src/contracts/database.js").DatabaseFieldReserved, typeof import("./1.js").HostToolNotFound, typeof import("./1.js").HostInputInvalid, typeof import("./1.js").HostOutputInvalid, typeof import("./1.js").HostToolBlocked, typeof import("./1.js").HostToolApprovalRequired, typeof import("./1.js").HostToolPolicyFailed, typeof import("../elicitation.js").ElicitationFailed, typeof import("./4.js").HostKindMismatch]>;
         }>]>;
         readonly catalog: Schema.Struct<{
             readonly tools: Schema.$Array<Schema.Struct<{

package/types/apps/src/contracts/protocols/7.d.ts

@@ -1528,7 +1528,7 @@ export declare const protocol7: {
             readonly toolError: Schema.optionalKey<Schema.Literal<true>>;
         }>, Schema.Struct<{
             readonly ok: Schema.Literal<false>;
-            readonly error: Schema.Union<readonly [typeof import("../api-response-error.js").OpenapiResponseError, typeof import("./1.js").ProviderError, typeof import("./1.js").McpError, typeof import("./1.js").SkillLoadFailed, typeof import("../workflows.js").WorkflowFailure, typeof import("./1.js").HostRequestInvalid, typeof import("./1.js").HostAccountsInvalid, typeof import("./3.js").HostDeclarationInvalid, typeof import("./3.js").HostEvaluationFailed, typeof import("./1.js").HostOperationNotFound, typeof import("./3.js").HostOperationFailed, typeof import("../../../../app-data/src/index.js").DatabaseLimitExceeded, typeof import("../../../../app-data/src/index.js").DatabaseFieldReserved, typeof import("./1.js").HostToolNotFound, typeof import("./1.js").HostInputInvalid, typeof import("./1.js").HostOutputInvalid, typeof import("./1.js").HostToolBlocked, typeof import("./1.js").HostToolApprovalRequired, typeof import("./1.js").HostToolPolicyFailed, typeof import("../elicitation.js").ElicitationFailed, typeof import("./4.js").HostKindMismatch]>;
+            readonly error: Schema.Union<readonly [typeof import("../api-response-error.js").OpenapiResponseError, typeof import("./1.js").ProviderError, typeof import("./1.js").McpError, typeof import("./1.js").SkillLoadFailed, typeof import("../workflows.js").WorkflowFailure, typeof import("./1.js").HostRequestInvalid, typeof import("./1.js").HostAccountsInvalid, typeof import("./3.js").HostDeclarationInvalid, typeof import("./3.js").HostEvaluationFailed, typeof import("./1.js").HostOperationNotFound, typeof import("./3.js").HostOperationFailed, typeof import("../../../../app-data/src/contracts/database.js").DatabaseLimitExceeded, typeof import("../../../../app-data/src/contracts/database.js").DatabaseFieldReserved, typeof import("./1.js").HostToolNotFound, typeof import("./1.js").HostInputInvalid, typeof import("./1.js").HostOutputInvalid, typeof import("./1.js").HostToolBlocked, typeof import("./1.js").HostToolApprovalRequired, typeof import("./1.js").HostToolPolicyFailed, typeof import("../elicitation.js").ElicitationFailed, typeof import("./4.js").HostKindMismatch]>;
         }>]>;
         readonly catalog: Schema.Struct<{
             readonly tools: Schema.$Array<Schema.Struct<{

package/types/apps/src/contracts/sql.d.ts

@@ -0,0 +1,58 @@
+/**
+ * App-owned SQLite. An app with migrations in `migrations/` reads and writes its own database with
+ * plain SQL. The author API mirrors Cloudflare's `SqlStorage`, so tools built for Durable Object
+ * SQLite fit it.
+ */
+/** A value SQLite stores or returns. */
+export type SqlValue = string | number | null | ArrayBuffer;
+/** One result row, keyed by column name. */
+export type SqlRow = Record<string, SqlValue>;
+/** The rows of one statement, already read, and what the statement read and wrote. */
+export interface SqlCursor<Row extends SqlRow = SqlRow> extends Iterable<Row> {
+    readonly columnNames: readonly string[];
+    readonly rowsRead: number;
+    readonly rowsWritten: number;
+    toArray(): Row[];
+    /** The only row. Throws unless the statement returned exactly one. */
+    one(): Row;
+}
+/**
+ * Read-only SQL. Query tools receive this. A query runs in a transaction that is always rolled
+ * back, so nothing it changes commits; one that changes rows fails.
+ */
+export interface SqlReader {
+    exec<Row extends SqlRow = SqlRow>(query: string, ...bindings: SqlValue[]): SqlCursor<Row>;
+}
+/** SQL inside one transaction. */
+export type SqlTransaction = SqlReader;
+/**
+ * Writable SQL. Outside a transaction every statement commits on its own. `transaction` runs its
+ * callback synchronously in one SQLite transaction, so no transaction can stay open while the app
+ * waits on anything else; throwing rolls it back. Apps call outside services between transactions.
+ */
+export interface Sql extends SqlReader {
+    transaction<T>(work: (tx: SqlTransaction) => Synchronous<T>): T;
+}
+/** A transaction callback's result: a Promise means the callback awaited, which is refused. */
+export type Synchronous<T> = T extends PromiseLike<unknown> ? never : T;
+/** The Durable Object storage a data facet hands its app. App code never receives it. */
+export interface AppSqlStorage {
+    readonly sql: {
+        exec(query: string, ...bindings: SqlValue[]): {
+            readonly columnNames: string[];
+            readonly rowsRead: number;
+            readonly rowsWritten: number;
+            toArray(): Record<string, SqlValue>[];
+        };
+    };
+    transactionSync<T>(work: () => T): T;
+}
+/**
+ * Tables Executor keeps in an app's database: applied migrations, workflow step receipts, and
+ * `_executor_legacy_rows (table_name, id, body)`, the rows of the document API apps used before
+ * SQL, with JSON bodies (empty for apps that never stored any). Apps should only read them; a
+ * changed migration history fails the next deploy.
+ */
+export declare const reservedTablePrefix = "_executor_";
+/** Where an app keeps its migrations: `0001_create_notes.sql`, applied in number order. */
+export declare const migrationsDirectory = "migrations";

package/types/apps/src/contracts/workflows.d.ts

@@ -1,5 +1,6 @@
 /** Portable workflow declarations, run views and durable execution capabilities. */
 import { Schema, type Effect } from "effect";
+import { RecordedMessage } from "../../../utils/src/recorded-message.js";
 import { JsonValue } from "./schema.js";
 import type { AppContext, AppRequirements, QueryContext, MutationContext } from "./context.js";
 import type { Operation } from "../implementation/operations.js";
@@ -49,6 +50,11 @@ declare const WorkflowFailure_base: Schema.Class<WorkflowFailure, Schema.TaggedS
 }>, import("effect/Cause").YieldableError>;
 /** Failures cross host boundaries as reason codes plus the app's own bounded error detail. */
 export declare class WorkflowFailure extends WorkflowFailure_base {
+    /**
+     * The step name and error detail are the app's. Its run's owner reads them; telemetry records
+     * only the reason, however the failure was built or decoded.
+     */
+    get [RecordedMessage](): string | undefined;
 }
 /** Explicitly stop retrying an authored step. Its message is reported like any step error. */
 export declare class NonRetryableError extends Error {

package/types/apps/src/facet.d.ts

@@ -1,5 +1,4 @@
-/** Native workerd SQLite capability; used only by the generated data facet, never browser bundles. */
-import * as Sqlite from "@effect/sql-sqlite-do/SqliteClient";
-import type { AppStorage } from "./contracts/storage.js";
-/** Bind one facet's raw storage at the runtime edge. Each operation owns its native SQL scope. */
-export declare const facetStorage: (storage: NonNullable<Sqlite.SqliteClientConfig["storage"]>) => AppStorage;
+/** The data facet's storage capability; used only by the generated data facet, never browser bundles. */
+import type { AppSqlStorage } from "./contracts/sql.js";
+/** Bind one facet's storage at the runtime edge. App code receives `ctx.sql` over it, never the storage. */
+export declare const facetStorage: (storage: AppSqlStorage) => AppSqlStorage;

package/types/apps/src/implementation/openapi-compile.d.ts

@@ -25,11 +25,10 @@ export declare const compileOpenApiDocument: (entry: OpenApiImport, inputDocumen
 }) => Effect.Effect<{
     operations: {
         readonly description: string;
-        readonly name: string;
         readonly request: {
             readonly parameters: readonly {
                 readonly name: string;
-                readonly in: "query" | "path" | "querystring" | "header" | "cookie";
+                readonly in: "path" | "query" | "querystring" | "header" | "cookie";
                 readonly required?: boolean;
                 readonly schema?: {
                     readonly [x: string]: Schema.Json;
@@ -65,6 +64,7 @@ export declare const compileOpenApiDocument: (entry: OpenApiImport, inputDocumen
             };
         };
         readonly path: string;
+        readonly name: string;
         readonly input: {
             readonly [x: string]: Schema.Json;
         };

package/types/apps/src/implementation/schema.d.ts

@@ -1,13 +1,10 @@
 /** Author schema facade. Internals use the native decoder retained by each value. */
 import { Effect, Schema as EffectSchema } from "effect";
 import { JsonObject, ValidationError } from "../contracts/schema.js";
-import type { Field } from "../../../app-data/src/contracts/database.js";
 import type { FieldExposure } from "../contracts/provider.js";
-declare const StorageField: unique symbol;
 declare const Decoder: unique symbol;
 /** An author-facing value schema. Effect is never required in author code. */
 export interface Schema<T, Optional extends boolean = false> {
-    readonly [StorageField]?: Field;
     readonly [Decoder]: EffectSchema.Decoder<T>;
     readonly optionalValue: Optional;
     /** Parse an unknown value; invalid input throws a safe ValidationError. */
@@ -46,7 +43,7 @@ export declare const schemaArgument: <S extends Schema<unknown, boolean>>(value:
 /** Decode within an Effect program. Invalid input is omitted from the failure. */
 export declare const parse: <T>(decoder: EffectSchema.Decoder<T>, input: unknown) => Effect.Effect<T, ValidationError>;
 /** Present a native decoder through the synchronous author API. */
-export declare function wrap<T, Optional extends boolean>(decoder: EffectSchema.Decoder<T>, optionalValue: Optional, field?: Field): Schema<T, Optional>;
+export declare function wrap<T, Optional extends boolean>(decoder: EffectSchema.Decoder<T>, optionalValue: Optional): Schema<T, Optional>;
 /** A string, optionally with a minimum length. No coercion. */
 export declare function string(options?: {
     readonly minLength?: number;
@@ -165,12 +162,6 @@ export declare const preparedJsonSchemaDecoder: (document: JsonObject) => {
 export declare const jsonSchemaDecoder: (input: unknown) => Effect.Effect<EffectSchema.declareConstructor<EffectSchema.Json, EffectSchema.Json, readonly [], EffectSchema.Json>, ValidationError, never>;
 /** Import JSON metadata now; unsupported schemas and invalid values fail when parsed. */
 export declare const jsonSchema: (input: unknown) => Schema<EffectSchema.Json>;
-/** Database declaration retained by primitive constructors; nested payload schemas are not database fields. */
-export declare const storageFieldOf: (schema: Schema<unknown, boolean>) => Field | undefined;
-/** A row reference records the target table; existence is not a foreign-key constraint. */
-export declare const id: (table: string) => Schema<string>;
-/** A host user identifier, stored as a string without imposing a product auth model. */
-export declare const userId: () => Schema<string>;
 /** Render a decoder as a JSON Schema document, keeping an imported upstream document as-is. */
 export declare const jsonSchemaDocument: (decoder: EffectSchema.Decoder<unknown>) => Effect.Effect<{
     readonly [x: string]: EffectSchema.Json;

package/types/apps/src/implementation/sql.d.ts

@@ -0,0 +1,66 @@
+/**
+ * `ctx.sql` over a data facet's SQLite storage, and the deploy-time migrator.
+ *
+ * Every statement runs inside a synchronous SQLite transaction: alone, or inside the author's
+ * `transaction`. Nothing here can wait on another call, so no lock or transaction outlives the
+ * statement that needs it. What a statement may do is decided by SQLite, not by reading the SQL:
+ * a query runs in a transaction that is always rolled back.
+ */
+import { Effect, Schema } from "effect";
+import { type AppSqlStorage, type Sql, type SqlReader } from "../contracts/sql.js";
+import type { SkillFile } from "../contracts/skills.js";
+export declare const noDatabase: Sql;
+/** A workflow step mutation's identity, from the host's replay record. */
+export interface StepReplay {
+    readonly key: string;
+    readonly fingerprint: string;
+}
+/**
+ * One invocation's SQL. Once the invocation ends or `signal` aborts, every statement is refused, so
+ * code still running after a timeout or cancellation cannot write late.
+ */
+export declare const authorSql: (storage: AppSqlStorage, options: {
+    readonly signal: AbortSignal;
+    readonly step?: StepReplay;
+}) => {
+    reader: SqlReader;
+    writer: Sql;
+    close: () => void;
+};
+declare const MigrationFileInvalid_base: Schema.Class<MigrationFileInvalid, Schema.TaggedStruct<"MigrationFileInvalid", {
+    readonly path: Schema.String;
+    readonly reason: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/** A file in `migrations/` that is not a migration the host can order. */
+export declare class MigrationFileInvalid extends MigrationFileInvalid_base {
+    get message(): string;
+}
+declare const MigrationHistoryChanged_base: Schema.Class<MigrationHistoryChanged, Schema.TaggedStruct<"MigrationHistoryChanged", {
+    readonly reason: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/** The build's migrations no longer start with the ones already applied to the database. */
+export declare class MigrationHistoryChanged extends MigrationHistoryChanged_base {
+    get message(): string;
+}
+declare const MigrationFailed_base: Schema.Class<MigrationFailed, Schema.TaggedStruct<"MigrationFailed", {
+    readonly path: Schema.String;
+    readonly reason: Schema.String;
+}>, import("effect/Cause").YieldableError>;
+/** SQLite rejected a migration. Every migration of the deploy rolled back. */
+export declare class MigrationFailed extends MigrationFailed_base {
+    get message(): string;
+}
+/** Whether a build's files give the app a database: any `.sql` file in `migrations/`. */
+export declare const hasMigrations: (files: readonly {
+    readonly path: string;
+}[]) => boolean;
+/**
+ * Apply the build's pending migrations and report which ran. Every pending migration runs in one
+ * transaction, so a failing one leaves the database exactly as the active deployment knows it. The
+ * migrations already applied must still be the build's first ones, byte for byte.
+ */
+export declare const migrate: (storage: AppSqlStorage, files: readonly SkillFile[]) => Effect.Effect<{
+    readonly id: number;
+    readonly name: string;
+}[], MigrationFileInvalid | MigrationHistoryChanged | MigrationFailed, never>;
+export {};

package/types/apps/src/index.d.ts

@@ -73,8 +73,7 @@ export type JsonResponse = PromiseMethods<NativeResponse>;
 export declare const decodeJson: <T>(response: JsonResponse, schema: Schema<T, boolean>) => Promise<T>;
 export { NotImplemented } from "./contracts/app.js";
 export { ElicitationFailed, type FormElicitation, type ElicitationResponse, type Elicit, } from "./contracts/elicitation.js";
-export { table, defineDatabase, type Table, type DatabaseReader, type Database, type DatabaseDefinition, } from "./implementation/storage.js";
-export { id, userId } from "./implementation/schema.js";
+export type { Sql, SqlCursor, SqlReader, SqlRow, SqlTransaction, SqlValue, } from "./contracts/sql.js";
 export { query, mutation, withApproval, toolAnnotations, type Operation, type OperationOptions, } from "./implementation/operations.js";
 export type { OperationContext } from "./contracts/operations.js";
 export { workflow, type Workflow, type WorkflowDeclaration } from "./implementation/workflows.js";

package/types/telemetry/src/app-records.d.ts

@@ -0,0 +1,42 @@
+/**
+ * What the host keeps of the spans and logs an app isolate returns.
+ *
+ * Those records come from whatever framework the app's build bundles, and the app's own code runs
+ * in the same isolate: it can throw any text, name its errors and codes, and rewrite every record
+ * before the isolate returns it. So the host does not filter the records it receives. It builds
+ * new ones from a closed vocabulary: the framework's span names, attributes whose values are
+ * closed sets, counts and status codes, and each exception's kind. Ids, parents and timings are
+ * kept. Everything else, including events other than exceptions, links, status and exception
+ * messages, stacks and log bodies, is dropped or replaced with a fixed sentence.
+ *
+ * The vocabulary is the framework's (`packages/apps`, `app-cache`, `app-data`): host request
+ * operations, failure sources and reasons, MCP and cache attributes. A name or value outside it is
+ * recorded as `unrecognized` or not at all. `bun run check` (`scripts/check-app-telemetry.ts`)
+ * fails when the framework names a span or sets an attribute key this vocabulary does not know.
+ */
+import type { Schema } from "effect";
+type Json = Schema.Json;
+type JsonObject = {
+    readonly [key: string]: Json;
+};
+/** What an exception message, stack or log body from an app isolate records instead. */
+export declare const appText = "Text from the app is not recorded";
+/** The framework's span names, and the libraries' spans it runs. */
+export declare const appSpanNames: ReadonlySet<string>;
+export declare const appSpanAttributeKeys: ReadonlySet<string>;
+/**
+ * Attributes the framework sets whose values the app chooses, such as its tool names, so the host
+ * drops them. `scripts/check-app-telemetry.ts` fails on a framework attribute in neither set.
+ */
+export declare const droppedAppAttributeKeys: ReadonlySet<string>;
+/** The span the host records for one an app isolate returned, or nothing without its timings. */
+export declare const appSpan: (span: JsonObject & {
+    readonly traceId: string;
+    readonly spanId: string;
+}) => JsonObject | undefined;
+/** The log record the host records for one an app isolate returned. */
+export declare const appLog: (log: JsonObject & {
+    readonly traceId?: string | undefined;
+    readonly spanId?: string | undefined;
+}) => JsonObject;
+export {};

package/types/telemetry/src/recorded-failure.d.ts

@@ -0,0 +1,20 @@
+/**
+ * Failures as Executor's telemetry records them. An error whose message can carry an app's own
+ * text declares a fixed sentence instead (see `RecordedMessage`); traces and error reports record
+ * that sentence with the error's name. The error itself, and what its caller receives, are
+ * unchanged.
+ */
+import { Cause } from "effect";
+/**
+ * The error a trace or error report records in place of `error`. Its stack is generated here and
+ * names no frames: the error's own stack begins with its message, which can span lines that look
+ * like frames, so none of its text is kept. Traces still show where it failed through the
+ * operation's own spans, which Effect appends to a recorded stack.
+ */
+export declare const recordedError: (error: unknown) => unknown;
+/**
+ * A failure's cause as traces record it. A defect is recorded the same way when it is an error that
+ * declares a recorded message, such as a workflow failure a host turned into a defect; other
+ * defects and interruptions are unchanged. Each reason keeps its annotations, which locate it.
+ */
+export declare const recordedCause: <E>(cause: Cause.Cause<E>) => Cause.Cause<unknown>;

package/types/utils/src/api-error.d.ts

@@ -23,6 +23,11 @@ type Definition<Tag extends string, Fields extends Schema.Struct.Fields> = Heade
      * record, so it never includes credentials, upstream response text or submitted values.
      */
     readonly message: string | ((fields: Schema.Struct.Type<Fields>) => string);
+    /**
+     * What traces and error reports record instead of `message`, when the message quotes an app's
+     * own error or a service's stated error for its caller. Only fixed text and typed fields.
+     */
+    readonly recorded?: (fields: Schema.Struct.Type<Fields>) => string;
 };
 type ErrorFields<Tag extends string, Fields extends Schema.Struct.Fields> = Omit<Schema.TaggedStruct<Tag, Fields & {
     readonly message: typeof MessageField;

package/types/utils/src/recorded-message.d.ts

@@ -0,0 +1,15 @@
+/**
+ * What traces and error reports record for an error in place of its message. An error declares
+ * one when its message can carry text from outside Executor: an app's own error or output, or an
+ * error a service stated through an app. That text still reaches the caller the error is for;
+ * Executor's telemetry records only this fixed sentence, beside the error's name.
+ */
+export declare const RecordedMessage: unique symbol;
+/** The fixed sentence an error declares for telemetry, if it declares one. */
+export declare const recordedMessage: (error: unknown) => string | undefined;
+/**
+ * Declare a recorded message on one error that Executor did not define the text of, such as an
+ * error decoded from an app's reply. An error class's own declaration is kept. The error's fields
+ * and wire encoding are unchanged.
+ */
+export declare const recordAs: <E>(error: E, message: string) => E;

package/js/chunk-73AV3JVU.js

@@ -1,186 +0,0 @@
-import {
-  Schema_exports
-} from "./chunk-IJQ5LE74.js";
-
-// ../app-data/src/contracts/database.ts
-var DataName = Schema_exports.String.check(
-  Schema_exports.makeFilter((value) => /^[A-Za-z][A-Za-z0-9_]*$/.test(value) && value.length <= 128)
-);
-var Scalar = Schema_exports.Union([Schema_exports.String, Schema_exports.Finite, Schema_exports.Boolean]);
-var Field = Schema_exports.Struct({
-  kind: Schema_exports.Literals(["string", "number", "boolean", "id", "userId"]),
-  optional: Schema_exports.optional(Schema_exports.Boolean),
-  default: Schema_exports.optional(Scalar),
-  references: Schema_exports.optional(DataName)
-});
-var Index = Schema_exports.Struct({ name: DataName, fields: Schema_exports.NonEmptyArray(DataName) });
-var Table = Schema_exports.Struct({
-  fields: Schema_exports.Record(DataName, Field),
-  indexes: Schema_exports.Array(Index)
-});
-var DatabaseSchema = Schema_exports.Record(DataName, Table);
-var Row = Schema_exports.Record(Schema_exports.String, Scalar);
-var RowMetadata = Schema_exports.Struct({
-  id: Schema_exports.NonEmptyString,
-  createdAt: Schema_exports.String,
-  updatedAt: Schema_exports.String
-});
-var Patch = Schema_exports.Record(DataName, Schema_exports.NullOr(Scalar));
-var RangeClause = Schema_exports.Struct({
-  field: DataName,
-  op: Schema_exports.Literals(["eq", "gt", "gte", "lt", "lte"]),
-  value: Schema_exports.NullOr(Scalar)
-});
-var QueryPlan = Schema_exports.Struct({
-  table: DataName,
-  index: DataName,
-  order: Schema_exports.Literals(["asc", "desc"]),
-  clauses: Schema_exports.Array(RangeClause)
-});
-var QueryTerminal = Schema_exports.Union([
-  Schema_exports.Struct({ kind: Schema_exports.Literal("collect") }),
-  Schema_exports.Struct({ kind: Schema_exports.Literal("count") }),
-  Schema_exports.Struct({ kind: Schema_exports.Literal("first") }),
-  Schema_exports.Struct({
-    kind: Schema_exports.Literal("take"),
-    count: Schema_exports.Int.check(Schema_exports.isGreaterThanOrEqualTo(0))
-  }),
-  Schema_exports.Struct({
-    kind: Schema_exports.Literal("paginate"),
-    cursor: Schema_exports.NullOr(Schema_exports.String),
-    numItems: Schema_exports.Int.check(Schema_exports.isGreaterThan(0))
-  })
-]);
-var DatabaseOperation = Schema_exports.Union([
-  Schema_exports.Struct({ kind: Schema_exports.Literal("get"), table: DataName, id: Schema_exports.NonEmptyString }),
-  Schema_exports.Struct({ kind: Schema_exports.Literal("insert"), table: DataName, value: Patch }),
-  Schema_exports.Struct({
-    kind: Schema_exports.Literal("update"),
-    table: DataName,
-    id: Schema_exports.NonEmptyString,
-    patch: Patch
-  }),
-  Schema_exports.Struct({ kind: Schema_exports.Literal("delete"), table: DataName, id: Schema_exports.NonEmptyString }),
-  Schema_exports.Struct({ kind: Schema_exports.Literal("query"), plan: QueryPlan, terminal: QueryTerminal })
-]);
-var PaginationResult = Schema_exports.Struct({
-  page: Schema_exports.Array(Row),
-  continueCursor: Schema_exports.NullOr(Schema_exports.String),
-  isDone: Schema_exports.Boolean
-});
-var OperationResult = Schema_exports.Union([
-  Row,
-  Schema_exports.Array(Row),
-  PaginationResult,
-  Schema_exports.Boolean,
-  Schema_exports.Finite,
-  Schema_exports.Null
-]);
-var AppDatabaseError = class extends Schema_exports.TaggedError()("AppDatabaseError", {
-  reason: Schema_exports.Literals([
-    "schema",
-    "schema_changed",
-    "table",
-    "index",
-    "range",
-    "value",
-    "readonly",
-    "cursor",
-    "limit",
-    "closed",
-    "storage",
-    "replay"
-  ])
-}) {
-};
-var DatabaseLimits = Schema_exports.Struct({
-  rowsRead: Schema_exports.Int.check(Schema_exports.isGreaterThan(0)),
-  rowsReturned: Schema_exports.Int.check(Schema_exports.isGreaterThan(0)),
-  bytesRead: Schema_exports.Int.check(Schema_exports.isGreaterThan(0)),
-  writes: Schema_exports.Int.check(Schema_exports.isGreaterThan(0)),
-  scanCalls: Schema_exports.Int.check(Schema_exports.isGreaterThan(0)),
-  directGets: Schema_exports.Int.check(Schema_exports.isGreaterThan(0)),
-  valueBytes: Schema_exports.Int.check(Schema_exports.isGreaterThan(0)),
-  indexBytes: Schema_exports.Int.check(Schema_exports.isGreaterThan(0))
-});
-var defaultDatabaseLimits = {
-  rowsRead: 5e3,
-  rowsReturned: 1e3,
-  bytesRead: 4 * 1024 * 1024,
-  writes: 1e3,
-  scanCalls: 100,
-  directGets: 1e3,
-  valueBytes: 64 * 1024,
-  indexBytes: 2048
-};
-var DatabaseLimit = Schema_exports.Literals([
-  "scanCalls",
-  "directGets",
-  "rowsRead",
-  "rowsReturned",
-  "pageSize",
-  "bytesRead",
-  "writes",
-  "valueBytes"
-]);
-var count = (value) => value.toLocaleString("en-US");
-var limitMessages = {
-  scanCalls: (maximum, requested) => `This invocation made ${count(requested)} index queries; the limit is ${count(maximum)}. Each first(), take(), collect(), count() or paginate() call on withIndex(...) counts once. Read related rows with one take() or paginate() over a shared index prefix instead of one first() per item, use get(id) for known IDs, or split the work across workflow steps.`,
-  directGets: (maximum, requested) => `This invocation made ${count(requested)} get(id) calls, including those made by update and delete; the limit is ${count(maximum)}. Split the work across workflow steps or mutations.`,
-  rowsRead: (maximum, requested) => `This invocation scanned ${count(requested)} rows; the limit is ${count(maximum)}. Narrow the index range, or page with paginate() across calls or workflow steps.`,
-  rowsReturned: (maximum, requested) => `This invocation returned ${count(requested)} rows; the limit is ${count(maximum)}. collect() fails rather than truncating. Page with paginate() across calls or workflow steps.`,
-  pageSize: (maximum, requested) => `One call asked for ${count(requested)} rows; take(n) and paginate({ numItems }) accept at most ${count(maximum)}. Page with paginate() across calls or workflow steps.`,
-  bytesRead: (maximum, requested) => `This invocation read ${count(requested)} bytes; the limit is ${count(maximum)}. Read fewer or smaller rows per call, or page with paginate() across calls or workflow steps.`,
-  writes: (maximum, requested) => `This mutation made ${count(requested)} writes; the limit is ${count(maximum)}. Split large ingests into batches, one batch per mutation or workflow step.`,
-  valueBytes: (maximum, requested) => `A row encodes to ${count(requested)} bytes; each row may use at most ${count(maximum)}. Store large content outside the row or split it across rows.`
-};
-var DatabaseLimitExceeded = class extends Schema_exports.TaggedError()(
-  "DatabaseLimitExceeded",
-  {
-    limit: DatabaseLimit,
-    maximum: Schema_exports.Int,
-    requested: Schema_exports.Int
-  }
-) {
-  get message() {
-    return limitMessages[this.limit](this.maximum, this.requested);
-  }
-};
-var reservedFieldNames = ["id", "createdAt", "updatedAt"];
-var DatabaseFieldReserved = class extends Schema_exports.TaggedError()(
-  "DatabaseFieldReserved",
-  {
-    table: Schema_exports.String,
-    field: Schema_exports.Literals(reservedFieldNames)
-  }
-) {
-  get message() {
-    return `Table "${this.table}" declares "${this.field}", which is reserved: the host adds id, createdAt and updatedAt to every row. Rename the field, or use the row's own ${this.field}.`;
-  }
-};
-var DatabaseRuntimeLimits = Schema_exports.Struct({
-  maxCursorChars: Schema_exports.Int.check(Schema_exports.isGreaterThan(0)),
-  connectionCacheCapacity: Schema_exports.Int.check(Schema_exports.isGreaterThan(0)),
-  connectionCacheTtlMs: Schema_exports.Int.check(Schema_exports.isGreaterThan(0))
-});
-var defaultDatabaseRuntimeLimits = DatabaseRuntimeLimits.make({
-  maxCursorChars: 8192,
-  connectionCacheCapacity: 64,
-  connectionCacheTtlMs: 5 * 60 * 1e3
-});
-
-export {
-  DatabaseSchema,
-  Row,
-  RowMetadata,
-  RangeClause,
-  DatabaseOperation,
-  PaginationResult,
-  AppDatabaseError,
-  DatabaseLimits,
-  defaultDatabaseLimits,
-  DatabaseLimitExceeded,
-  reservedFieldNames,
-  DatabaseFieldReserved,
-  defaultDatabaseRuntimeLimits
-};