apps 0.0.1-beta.54 → 0.0.1-beta.55

package/types/apps/src/contracts/protocols/oauth-6.d.ts

@@ -0,0 +1,74 @@
+/**
+ * OAuth declarations frozen for host protocols 6 onward: `./oauth.ts`'s with an explicit
+ * authorization-server metadata URL on discovery. The module imports only `effect` and
+ * `./oauth.ts`, so no change elsewhere in the repository can alter it.
+ */
+import { Schema } from "effect";
+/**
+ * OAuth endpoints and protocol choices. Omitted grant means authorization code; clients remain
+ * host-owned. Declared endpoints may name an RFC 7009 `revocationUrl`; discovery reads the
+ * server's `revocation_endpoint` metadata instead.
+ */
+export declare const OAuth2Config: Schema.Union<readonly [Schema.Struct<{
+    readonly discover: Schema.String;
+    /** Fetch this exact metadata document and verify its issuer against discovery. */
+    readonly authorizationServerMetadataUrl: Schema.optionalKey<Schema.String>;
+    readonly authorizationUrl: Schema.optionalKey<Schema.Never>;
+    readonly tokenUrl: Schema.optionalKey<Schema.Never>;
+    readonly revocationUrl: Schema.optionalKey<Schema.Never>;
+    readonly scopes: Schema.optionalKey<Schema.$Array<Schema.String>>;
+    readonly tokenResponse: Schema.optionalKey<Schema.Struct<{
+        readonly path: Schema.String;
+    }>>;
+    readonly grant: Schema.optionalKey<Schema.Literal<"authorization_code">>;
+    readonly authorizationParams: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
+    readonly tokenEndpointAuthMethod: Schema.optionalKey<Schema.Literals<readonly ["none", "client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>>;
+    readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+    readonly scopeSeparator: Schema.optionalKey<Schema.String>;
+    readonly tokenRequestFormat: Schema.optionalKey<Schema.Literals<readonly ["form", "json"]>>;
+}>, Schema.Struct<{
+    /** Its query is kept; it cannot set protocol parameters or repeat `authorizationParams`. */
+    readonly authorizationUrl: Schema.String;
+    readonly tokenUrl: Schema.String;
+    readonly revocationUrl: Schema.optionalKey<Schema.String>;
+    readonly scopes: Schema.$Array<Schema.String>;
+    /** RFC 8414 issuer identifier. Declared issuers are checked against the callback's `iss`. */
+    readonly issuer: Schema.optionalKey<Schema.String>;
+    readonly discover: Schema.optionalKey<Schema.Never>;
+    readonly authorizationServerMetadataUrl: Schema.optionalKey<Schema.Never>;
+    readonly tokenResponse: Schema.optionalKey<Schema.Struct<{
+        readonly path: Schema.String;
+    }>>;
+    readonly grant: Schema.optionalKey<Schema.Literal<"authorization_code">>;
+    readonly authorizationParams: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
+    readonly tokenEndpointAuthMethod: Schema.optionalKey<Schema.Literals<readonly ["none", "client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>>;
+    readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+    readonly scopeSeparator: Schema.optionalKey<Schema.String>;
+    readonly tokenRequestFormat: Schema.optionalKey<Schema.Literals<readonly ["form", "json"]>>;
+}>, Schema.Struct<{
+    readonly tokenEndpointAuthMethod: Schema.Literals<readonly ["client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>;
+    readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+    readonly scopeSeparator: Schema.optionalKey<Schema.String>;
+    readonly tokenRequestFormat: Schema.optionalKey<Schema.Literals<readonly ["form", "json"]>>;
+    readonly grant: Schema.Literal<"client_credentials">;
+    readonly discover: Schema.String;
+    /** Fetch this exact metadata document and verify its issuer against discovery. */
+    readonly authorizationServerMetadataUrl: Schema.optionalKey<Schema.String>;
+    readonly authorizationUrl: Schema.optionalKey<Schema.Never>;
+    readonly tokenUrl: Schema.optionalKey<Schema.Never>;
+    readonly revocationUrl: Schema.optionalKey<Schema.Never>;
+    readonly scopes: Schema.optionalKey<Schema.$Array<Schema.String>>;
+}>, Schema.Struct<{
+    readonly tokenEndpointAuthMethod: Schema.Literals<readonly ["client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>;
+    readonly resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+    readonly authorizationUrl: Schema.optionalKey<Schema.Never>;
+    readonly discover: Schema.optionalKey<Schema.Never>;
+    readonly authorizationServerMetadataUrl: Schema.optionalKey<Schema.Never>;
+    readonly scopeSeparator: Schema.optionalKey<Schema.String>;
+    readonly tokenRequestFormat: Schema.optionalKey<Schema.Literals<readonly ["form", "json"]>>;
+    readonly grant: Schema.Literal<"client_credentials">;
+    readonly tokenUrl: Schema.String;
+    readonly revocationUrl: Schema.optionalKey<Schema.String>;
+    readonly scopes: Schema.$Array<Schema.String>;
+}>]>;
+export type OAuth2Config = typeof OAuth2Config.Type;

package/types/apps/src/contracts/protocols/oauth.d.ts

@@ -1,5 +1,11 @@
-/** OAuth declarations frozen for host protocols 1 through 5. */
+/**
+ * OAuth declarations frozen for host protocols 1 through 5. The module imports only `effect`, so
+ * no change elsewhere in the repository can alter it. `./oauth-6.ts` holds the declaration later
+ * protocols use.
+ */
 import { Schema } from "effect";
+/** Absolute HTTP(S) URL; local HTTP hosts are supported. */
+export declare const HttpUrl: Schema.String;
 /** How an OAuth client authenticates at the token endpoint; raw Basic is an explicit provider compatibility option. */
 export declare const OAuthClientAuth: Schema.Literals<readonly ["none", "client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>;
 export type OAuthClientAuth = typeof OAuthClientAuth.Type;
@@ -14,6 +20,14 @@ export type ReservedAuthorizationParam = (typeof reservedAuthorizationParams)[nu
  * lets services define their own; the protocol and security parameters stay host-owned.
  */
 export declare const OAuthAuthorizationParams: Schema.$Record<Schema.String, Schema.String>;
+/**
+ * A declared `authorizationUrl` may carry its own query (RFC 6749 §3.1 keeps it). Each parameter
+ * is declared once, in the URL or in `authorizationParams`, and never names a host-owned one.
+ */
+export declare const declaredAuthorizationQuery: import("effect/SchemaAST").Filter<{
+    readonly authorizationUrl: string;
+    readonly authorizationParams?: Readonly<Record<string, string>>;
+}>;
 /** How the token endpoint reads requests. RFC 6749 uses a form; some services want JSON. */
 export declare const OAuthTokenRequestFormat: Schema.Literals<readonly ["form", "json"]>;
 export type OAuthTokenRequestFormat = typeof OAuthTokenRequestFormat.Type;
@@ -25,6 +39,37 @@ export declare const OAuthTokenResponse: Schema.Struct<{
     readonly path: Schema.String;
 }>;
 export type OAuthTokenResponse = typeof OAuthTokenResponse.Type;
+/** Options for services that differ from RFC 6749 in how they read requests. */
+export declare const tokenRequestOptions: {
+    /** Joins requested scopes; Linear wants `","`. Defaults to RFC 6749's space. */
+    scopeSeparator: Schema.optionalKey<Schema.String>;
+    /** Encoding of token requests. Defaults to `"form"`; Atlassian, ClickUp and Notion need `"json"`. */
+    tokenRequestFormat: Schema.optionalKey<Schema.Literals<readonly ["form", "json"]>>;
+};
+export declare const oauthOptions: {
+    /**
+     * Read the grant from this nested member of the token response when the top-level response has
+     * no access token or no scope. Slack's user tokens use `{ path: "authed_user" }`.
+     */
+    tokenResponse: Schema.optionalKey<Schema.Struct<{
+        readonly path: Schema.String;
+    }>>;
+    grant: Schema.optionalKey<Schema.Literal<"authorization_code">>;
+    /**
+     * Service-defined authorization request parameters, such as Google's
+     * `{ access_type: "offline", prompt: "consent" }`. Host-owned protocol parameters
+     * (`state`, `scope`, `redirect_uri`, PKCE and the others in `reservedAuthorizationParams`)
+     * are rejected. A discovered endpoint's own query parameter of the same name is replaced.
+     */
+    authorizationParams: Schema.optionalKey<Schema.$Record<Schema.String, Schema.String>>;
+    tokenEndpointAuthMethod: Schema.optionalKey<Schema.Literals<readonly ["none", "client_secret_post", "client_secret_basic", "client_secret_basic_raw"]>>;
+    /** Omitted uses discovery; null explicitly suppresses the resource parameter. */
+    resource: Schema.optionalKey<Schema.NullOr<Schema.String>>;
+    /** Joins requested scopes; Linear wants `","`. Defaults to RFC 6749's space. */
+    scopeSeparator: Schema.optionalKey<Schema.String>;
+    /** Encoding of token requests. Defaults to `"form"`; Atlassian, ClickUp and Notion need `"json"`. */
+    tokenRequestFormat: Schema.optionalKey<Schema.Literals<readonly ["form", "json"]>>;
+};
 /**
  * OAuth endpoints and protocol choices. Omitted grant means authorization code; clients remain
  * host-owned. Declared endpoints may name an RFC 7009 `revocationUrl`; discovery reads the

package/types/apps/src/implementation/router-catalog.d.ts

@@ -188,7 +188,7 @@ export declare const readCatalog: (root: AppRouter | DynamicRouter | undefined,
     routers: {
         readonly path: string;
         readonly description?: string;
-        readonly error?: import("../index.js").ProviderError | HostDeclarationInvalid | HostEvaluationFailed | import("../contracts/host.js").McpError | import("../contracts/host.js").SkillLoadFailed;
+        readonly error?: import("../index.js").ProviderError | import("../contracts/host.js").McpError | import("../contracts/host.js").SkillLoadFailed | HostDeclarationInvalid | HostEvaluationFailed;
         readonly title?: string;
         readonly tags?: {
             readonly [x: string]: string;
@@ -201,7 +201,7 @@ export declare const readCatalog: (root: AppRouter | DynamicRouter | undefined,
         }[];
         readonly skill?: string;
     }[];
-}, import("../index.js").ProviderError | HostDeclarationInvalid | HostEvaluationFailed | import("../contracts/host.js").McpError | import("../contracts/host.js").SkillLoadFailed, never>;
+}, import("../index.js").ProviderError | import("../contracts/host.js").McpError | import("../contracts/host.js").SkillLoadFailed | HostDeclarationInvalid | HostEvaluationFailed, never>;
 /**
  * One skill for each router with instructions. Skills and tools fail independently: a dynamic
  * router whose metadata cannot be read, including the root, contributes no skill and does not

package/types/apps/src/implementation/webhooks.d.ts

@@ -26,4 +26,4 @@ export declare const dispatchWebhook: <Context extends {
         readonly [x: string]: string;
     };
     readonly body: string;
-}, HostOperationNotFound | HostInputInvalid | HostOutputInvalid | HostDeclarationInvalid | HostOperationFailed, never>;
+}, HostDeclarationInvalid | HostOperationNotFound | HostOperationFailed | HostInputInvalid | HostOutputInvalid, never>;