apps 0.0.1-beta.6 → 0.0.1-beta.60

package/js/{chunk-KUMBKVJD.js → chunk-KLYSEHUD.js}

@@ -1,9 +1,9 @@
 import {
   appSignInCallbackPath
-} from "./chunk-VFZKSM3T.js";
+} from "./chunk-JPEUKEV4.js";
 import {
   HttpServerResponse_exports
-} from "./chunk-UK573G7W.js";
+} from "./chunk-EOPQ727L.js";
 
 // src/implementation/ui-auth.ts
 var appPrivateHeaders = {

package/js/chunk-MRV45IXB.js

@@ -0,0 +1,340 @@
+import {
+  adaptMcpTools,
+  answeredError,
+  mcpClient,
+  mcpJsonSchemaValidator
+} from "./chunk-CWW7QWP4.js";
+import {
+  failOnNetworkRefusal
+} from "./chunk-NS3DEHVA.js";
+import {
+  accountProviderError,
+  bodyUpstreamError,
+  httpProviderError,
+  providerErrorDetail
+} from "./chunk-T53665H5.js";
+import {
+  McpCredentialsUnverified,
+  McpError,
+  McpHealthInput,
+  McpToolsOptions,
+  defaultMcpClientLimits,
+  mcpHealthReserveMs
+} from "./chunk-TLWLJ7PD.js";
+import {
+  NetworkRefused,
+  ProviderError
+} from "./chunk-MWKHKOTL.js";
+import {
+  captureTelemetry,
+  owned
+} from "./chunk-FFSO3J76.js";
+import {
+  FetchHttpClient_exports
+} from "./chunk-PD6I2SDG.js";
+import {
+  HttpClientRequest_exports,
+  HttpClient_exports
+} from "./chunk-EOPQ727L.js";
+import {
+  Clock_exports,
+  Deferred_exports,
+  Effect_exports,
+  Match_exports,
+  Option_exports,
+  Predicate_exports,
+  Redacted_exports,
+  Ref_exports,
+  Schema_exports,
+  Stream_exports
+} from "./chunk-IFJU5SYQ.js";
+
+// src/implementation/mcp.ts
+import { UnauthorizedError } from "@modelcontextprotocol/sdk/client/auth.js";
+import { Client } from "@modelcontextprotocol/sdk/client/index.js";
+import {
+  ErrorCode,
+  McpError as ProtocolError,
+  ToolListChangedNotificationSchema
+} from "@modelcontextprotocol/sdk/types.js";
+import { SSEClientTransport, SseError } from "@modelcontextprotocol/sdk/client/sse.js";
+import {
+  StreamableHTTPClientTransport,
+  StreamableHTTPError
+} from "@modelcontextprotocol/sdk/client/streamableHttp.js";
+var unreadable = (error) => error instanceof SyntaxError || error instanceof Error && Predicate_exports.hasProperty(error, "issues") && Array.isArray(error.issues);
+var failure = (phase, error) => {
+  if (Schema_exports.is(ProviderError)(error) || Schema_exports.is(McpError)(error) || Schema_exports.is(NetworkRefused)(error))
+    return error;
+  const code = error instanceof UnauthorizedError ? 401 : error instanceof StreamableHTTPError || error instanceof SseError ? error.code : void 0;
+  if (code !== void 0 && code >= 300 && code <= 599)
+    return httpProviderError(code) ?? new McpError({ phase, reason: "request", status: code });
+  const upstream = answeredError(error);
+  return new McpError({
+    phase,
+    reason: code !== void 0 || unreadable(error) ? "invalid_response" : error instanceof ProtocolError && error.code === ErrorCode.RequestTimeout ? "timeout" : "request",
+    ...upstream === void 0 ? {} : { upstream }
+  });
+};
+var errorBodyLimits = { maxBytes: 65536, readTimeoutMs: 2e3 };
+var errorBody = (response) => Effect_exports.gen(function* () {
+  const json = /^application\/(?:[\w.-]+\+)?json$/i.test(
+    response.headers["content-type"]?.split(";")[0]?.trim() ?? ""
+  );
+  const length = response.headers["content-length"];
+  if (!json || length !== void 0 && Number(length) > errorBodyLimits.maxBytes)
+    return { body: Stream_exports.toReadableStream(response.stream), upstream: void 0 };
+  const unreadable2 = new McpError({ phase: "transport", reason: "invalid_response" });
+  const read = yield* response.stream.pipe(
+    Stream_exports.mapError(() => unreadable2),
+    Stream_exports.limitBytes(errorBodyLimits.maxBytes, () => Stream_exports.fail(unreadable2)),
+    Stream_exports.decodeText,
+    Stream_exports.mkString,
+    Effect_exports.timeout(errorBodyLimits.readTimeoutMs),
+    Effect_exports.option
+  );
+  if (Option_exports.isNone(read)) return { body: null, upstream: void 0 };
+  const parsed = Schema_exports.decodeUnknownOption(Schema_exports.fromJsonString(Schema_exports.Json))(read.value);
+  return {
+    body: read.value,
+    upstream: Option_exports.isSome(parsed) ? bodyUpstreamError(parsed.value) : void 0
+  };
+});
+var transportFetch = (connection, telemetry, rejected, answered) => (url, init) => Effect_exports.runPromiseWith(telemetry.context)(
+  Effect_exports.gen(function* () {
+    const target = yield* Effect_exports.try({
+      try: () => new URL(url),
+      catch: () => new McpError({ phase: "transport", reason: "invalid_response" })
+    });
+    if (connection.url.username || connection.url.password)
+      return yield* new McpError({ phase: "transport", reason: "invalid_input" });
+    if (target.origin !== connection.url.origin || target.username || target.password)
+      return yield* new McpError({ phase: "transport", reason: "invalid_response" });
+    const request = yield* Effect_exports.try({
+      try: () => {
+        const headers = new Headers(Redacted_exports.value(connection.headers));
+        new Headers(init?.headers).forEach((value, name) => headers.set(name, value));
+        return HttpClientRequest_exports.fromWeb(new Request(target, { ...init, headers }));
+      },
+      // The provider's headers cannot form an HTTP request, such as a name with a space.
+      catch: () => new McpError({ phase: "transport", reason: "invalid_input" })
+    });
+    const client = yield* HttpClient_exports.HttpClient;
+    const response = yield* client.execute(request);
+    yield* failOnNetworkRefusal(response).pipe(
+      Effect_exports.tapError((refused) => Deferred_exports.fail(rejected, refused))
+    );
+    if (response.status < 400)
+      return new Response(
+        [204, 205, 304].includes(response.status) ? null : Stream_exports.toReadableStream(response.stream),
+        {
+          status: response.status,
+          headers: response.headers
+        }
+      );
+    const { body, upstream } = yield* errorBody(response);
+    const provider = httpProviderError(response.status, response.headers);
+    if (provider !== void 0) {
+      const refused = providerErrorDetail(provider, { upstream });
+      yield* Deferred_exports.fail(rejected, refused);
+      return yield* refused;
+    }
+    const session = new Headers(init?.headers).has("mcp-session-id");
+    yield* Ref_exports.update(
+      answered,
+      (responses) => new Map(responses).set(response.status, { upstream, session })
+    );
+    return new Response(body, { status: response.status, headers: response.headers });
+  }).pipe(
+    Effect_exports.provide(FetchHttpClient_exports.layer),
+    Effect_exports.provideService(FetchHttpClient_exports.RequestInit, { redirect: "manual" }),
+    Effect_exports.provideService(
+      FetchHttpClient_exports.Fetch,
+      (url2, options) => globalThis.fetch(url2, {
+        ...options,
+        signal: AbortSignal.any([
+          ...options?.signal ? [options.signal] : [],
+          ...init?.signal ? [init.signal] : []
+        ])
+      })
+    ),
+    Effect_exports.mapError((error) => failure("transport", error))
+  ),
+  init?.signal ? { signal: init.signal } : {}
+);
+var explain = (error, phase, responses) => {
+  if (Schema_exports.is(ProviderError)(error)) return providerErrorDetail(error, { phase });
+  if (!Schema_exports.is(McpError)(error) || error.status === void 0) return error;
+  const response = responses.get(error.status);
+  if (response === void 0 || (error.upstream !== void 0 || response.upstream === void 0) && !response.session)
+    return error;
+  const upstream = error.upstream ?? response.upstream;
+  return new McpError({
+    phase: error.phase,
+    reason: error.reason,
+    status: error.status,
+    ...upstream === void 0 ? {} : { upstream },
+    ...response.session ? { session: true } : {}
+  });
+};
+var explained = (phase, answered) => (error) => Ref_exports.get(answered).pipe(
+  Effect_exports.flatMap((responses) => Effect_exports.fail(explain(error, phase, responses)))
+);
+function withClient(connection, mode, use, changed) {
+  const attempt = (kind) => Effect_exports.scoped(
+    Effect_exports.gen(function* () {
+      const telemetry = yield* captureTelemetry;
+      const rejected = yield* Deferred_exports.make();
+      const answered = yield* Ref_exports.make(/* @__PURE__ */ new Map());
+      const pending = /* @__PURE__ */ new Set();
+      const { client, transport } = yield* Effect_exports.acquireRelease(
+        Effect_exports.sync(() => {
+          const fetch = transportFetch(connection, telemetry, rejected, answered);
+          const client2 = new Client(
+            { name: "executor-apps", version: "0.1.0" },
+            {
+              jsonSchemaValidator: mcpJsonSchemaValidator,
+              capabilities: mode === "call" ? { elicitation: { form: {} } } : {}
+            }
+          );
+          if (changed !== void 0) {
+            client2.setNotificationHandler(ToolListChangedNotificationSchema, () => {
+              const task = Effect_exports.runPromiseWith(telemetry.context)(
+                changed.pipe(
+                  Effect_exports.timeout("5 seconds"),
+                  Effect_exports.catchCause(() => Effect_exports.logWarning("MCP catalog invalidation failed"))
+                )
+              );
+              pending.add(task);
+              return task.finally(() => pending.delete(task));
+            });
+          }
+          return {
+            client: client2,
+            transport: kind === "http" ? new StreamableHTTPClientTransport(connection.url, {
+              fetch,
+              reconnectionOptions: {
+                maxRetries: 0,
+                initialReconnectionDelay: 1e3,
+                maxReconnectionDelay: 1e3,
+                reconnectionDelayGrowFactor: 1
+              }
+            }) : new SSEClientTransport(connection.url, { fetch })
+          };
+        }),
+        ({ client: client2, transport: transport2 }) => Effect_exports.gen(function* () {
+          client2.removeNotificationHandler("notifications/tools/list_changed");
+          yield* Effect_exports.promise(async () => {
+            await Promise.allSettled(pending);
+          });
+          if (transport2 instanceof StreamableHTTPClientTransport && transport2.sessionId !== void 0) {
+            yield* Effect_exports.tryPromise(() => transport2.terminateSession()).pipe(
+              Effect_exports.timeout(defaultMcpClientLimits.cleanupTimeoutMs),
+              Effect_exports.ignore
+            );
+          }
+          yield* Effect_exports.tryPromise(() => client2.close()).pipe(
+            Effect_exports.timeout(defaultMcpClientLimits.cleanupTimeoutMs),
+            Effect_exports.ignore
+          );
+        }).pipe(owned("upstream", "provider.mcp.close"))
+      );
+      const wire = transport;
+      yield* Effect_exports.tryPromise({
+        try: (signal) => client.connect(wire, { signal, timeout: connection.timeoutMs }),
+        catch: (error) => failure("connect", error)
+      }).pipe(
+        Effect_exports.raceFirst(Deferred_exports.await(rejected)),
+        Effect_exports.catch(explained("connect", answered)),
+        Effect_exports.timeout(connection.timeoutMs),
+        owned("upstream", "provider.mcp.connect")
+      );
+      return yield* use(client).pipe(
+        Effect_exports.raceFirst(Deferred_exports.await(rejected)),
+        Effect_exports.catch(explained(mode, answered))
+      );
+    })
+  ).pipe(
+    owned("upstream", "provider.mcp.session", {
+      attributes: {
+        "mcp.transport": kind,
+        "mcp.operation": mode,
+        "server.address": connection.url.hostname
+      }
+    })
+  );
+  return attempt("http").pipe(
+    // Fallback is only for negotiation. Tool calls are never automatically replayed.
+    Effect_exports.catch(
+      (error) => Schema_exports.is(McpError)(error) && error.phase === "connect" && (error.status === 404 || error.status === 405) ? attempt("sse") : Effect_exports.fail(error)
+    ),
+    (operation) => mode === "discover" ? operation.pipe(Effect_exports.timeout(connection.timeoutMs)) : operation,
+    Effect_exports.catchTag(
+      "TimeoutError",
+      () => Effect_exports.fail(new McpError({ phase: "transport", reason: "timeout" }))
+    )
+  );
+}
+var mcpClientEffect = (input, changed) => Effect_exports.gen(function* () {
+  const options = yield* Schema_exports.decodeUnknownEffect(McpToolsOptions)(input).pipe(
+    Effect_exports.mapError(() => new McpError({ phase: "connect", reason: "invalid_input" }))
+  );
+  const url = new URL(options.url);
+  if (url.username || url.password || url.hash)
+    return yield* new McpError({ phase: "connect", reason: "invalid_input" });
+  const connection = {
+    url,
+    headers: Redacted_exports.make({ ...options.headers }),
+    timeoutMs: options.timeoutMs ?? defaultMcpClientLimits.timeoutMs
+  };
+  return mcpClient(
+    (mode, use) => withClient(connection, mode, use, changed).pipe(
+      Effect_exports.mapError(
+        (error) => options.accountId === void 0 ? error : accountProviderError(error, options.accountId)
+      )
+    ),
+    connection.timeoutMs,
+    failure
+  );
+});
+var refusesCredentials = (error) => Schema_exports.is(ProviderError)(error) && Match_exports.value(error.reason).pipe(
+  Match_exports.whenOr("unauthorized", "forbidden", "rejected", () => true),
+  Match_exports.whenOr("rate_limited", "unavailable", () => false),
+  Match_exports.exhaustive
+);
+var mcpHealthEffect = (check, options) => Effect_exports.gen(function* () {
+  const { deadline, timeoutMs, ...parsed } = yield* Schema_exports.decodeUnknownEffect(McpHealthInput)({
+    ...options,
+    accountId: check.account.id,
+    signal: check.signal,
+    deadline: check.deadline
+  }).pipe(Effect_exports.mapError(() => new McpError({ phase: "connect", reason: "invalid_input" })));
+  const end = Math.min(
+    (yield* Clock_exports.currentTimeMillis) + (timeoutMs ?? defaultMcpClientLimits.timeoutMs),
+    deadline === void 0 ? Number.POSITIVE_INFINITY : deadline - mcpHealthReserveMs
+  );
+  const remaining = Effect_exports.flatMap(
+    Clock_exports.currentTimeMillis,
+    (now) => end - now >= 1 ? Effect_exports.succeed(Math.floor(end - now)) : Effect_exports.fail(new McpError({ phase: "transport", reason: "timeout" }))
+  );
+  yield* (yield* mcpClientEffect({ ...parsed, timeoutMs: yield* remaining })).check;
+  return yield* remaining.pipe(
+    Effect_exports.flatMap(
+      (timeoutMs2) => mcpClientEffect({ url: parsed.url, signal: parsed.signal, timeoutMs: timeoutMs2 })
+    ),
+    Effect_exports.flatMap((anonymous) => anonymous.check),
+    Effect_exports.matchEffect({
+      onSuccess: () => Effect_exports.fail(new McpCredentialsUnverified({ anonymous: "answered" })),
+      // Executor's network refused the attempt, so the server never answered it.
+      onFailure: (error) => Schema_exports.is(NetworkRefused)(error) ? Effect_exports.fail(error) : refusesCredentials(error) ? Effect_exports.void : Effect_exports.fail(new McpCredentialsUnverified({ anonymous: error }))
+    }),
+    owned("upstream", "provider.mcp.anonymous")
+  );
+}).pipe(owned("upstream", "provider.mcp.health"));
+var mcpToolsEffect = (input) => mcpClientEffect(input).pipe(Effect_exports.flatMap(adaptMcpTools));
+
+export {
+  mcpClientEffect,
+  mcpHealthEffect,
+  mcpToolsEffect
+};

package/js/chunk-MWKHKOTL.js

@@ -0,0 +1,240 @@
+import {
+  AccountId
+} from "./chunk-H2CJWXA3.js";
+import {
+  Schema_exports
+} from "./chunk-IFJU5SYQ.js";
+
+// src/contracts/failure.ts
+var maxFailureMessageLength = 2048;
+var FailureSource = Schema_exports.Literals(["app", "storage", "service"]);
+var FailureName = Schema_exports.String.check(Schema_exports.isMaxLength(128));
+var FailureCode = Schema_exports.String.check(Schema_exports.isMaxLength(128));
+var FailureMessage = Schema_exports.String.check(Schema_exports.isMaxLength(maxFailureMessageLength));
+var maxFailureFields = 8;
+var maxFailureFieldLength = 256;
+var FailureFieldName = Schema_exports.String.check(
+  Schema_exports.isPattern(/^[A-Za-z_$][A-Za-z0-9_$]{0,63}$/)
+);
+var FailureFieldValue = Schema_exports.Union([
+  Schema_exports.String.check(Schema_exports.isMaxLength(maxFailureFieldLength)),
+  Schema_exports.Finite,
+  Schema_exports.Boolean
+]);
+var FailureFields = Schema_exports.Record(FailureFieldName, FailureFieldValue).check(
+  Schema_exports.isMaxProperties(maxFailureFields)
+);
+var FailureDetail = {
+  source: Schema_exports.optionalKey(FailureSource),
+  errorName: Schema_exports.optionalKey(FailureName),
+  code: Schema_exports.optionalKey(FailureCode),
+  message: Schema_exports.optionalKey(FailureMessage),
+  fields: Schema_exports.optionalKey(FailureFields)
+};
+var maxUpstreamMessageLength = 1024;
+var UpstreamError = Schema_exports.Struct({
+  code: Schema_exports.Union([
+    Schema_exports.Int,
+    Schema_exports.String.check(Schema_exports.isMinLength(1), Schema_exports.isMaxLength(128))
+  ]),
+  message: Schema_exports.optionalKey(Schema_exports.String.check(Schema_exports.isMaxLength(maxUpstreamMessageLength)))
+});
+var FailurePhase = Schema_exports.Literals(["connect", "discover", "call"]);
+
+// src/contracts/provider-error.ts
+var ProviderError = class extends Schema_exports.TaggedError()("ProviderError", {
+  reason: Schema_exports.Literals(["unauthorized", "forbidden", "rate_limited", "unavailable", "rejected"]),
+  status: Schema_exports.optional(Schema_exports.Int.check(Schema_exports.isBetween({ minimum: 100, maximum: 599 }))),
+  accountId: Schema_exports.optional(AccountId),
+  phase: Schema_exports.optional(FailurePhase),
+  upstream: Schema_exports.optional(UpstreamError)
+}) {
+};
+
+// src/contracts/network.ts
+var NetworkRefusal = Schema_exports.Union([
+  Schema_exports.Struct({ reason: Schema_exports.Literal("private_address") }),
+  Schema_exports.Struct({
+    reason: Schema_exports.Literal("credential_host"),
+    /** The provider of the credential handle the request carried. */
+    provider: Schema_exports.String,
+    /** The hosts that provider's credentials may reach; empty when it declares none. */
+    allowedHosts: Schema_exports.Array(Schema_exports.String)
+  }),
+  Schema_exports.Struct({ reason: Schema_exports.Literal("credential_app") }),
+  Schema_exports.Struct({
+    reason: Schema_exports.Literal("credential_expired"),
+    /** The provider of the expired credential handle. */
+    provider: Schema_exports.String
+  })
+]);
+var NetworkRefused = class extends Schema_exports.TaggedError()("NetworkRefused", {
+  /** The refused destination, with its port when the URL names one. */
+  host: Schema_exports.String,
+  refusal: NetworkRefusal
+}) {
+  get message() {
+    const refusal = this.refusal;
+    switch (refusal.reason) {
+      case "private_address":
+        return `Executor refused a request to ${this.host}: apps on this instance can reach only public addresses, and ${this.host} is a private, loopback or internal address. The request was not sent.`;
+      case "credential_host":
+        return refusal.allowedHosts.length === 0 ? `Executor refused this request: ${refusal.provider} credentials cannot be sent to ${this.host}: the provider declares no hosts.` : `Executor refused this request: ${refusal.provider} credentials cannot be sent to ${this.host}. The provider allows: ${refusal.allowedHosts.join(", ")}.`;
+      case "credential_app":
+        return "Executor refused this request: it carries a credential handle that is not valid for this app. Use the account fields this invocation received.";
+      case "credential_expired":
+        return `Executor refused this request: it carries an expired ${refusal.provider} credential handle. Use the account fields this invocation received.`;
+    }
+  }
+};
+var networkRefusalStatus = 421;
+var networkRefusalHeader = "x-executor-refused";
+var NetworkRefusedHeader = Schema_exports.StringFromUriComponent.pipe(
+  Schema_exports.decodeTo(Schema_exports.fromJsonString(NetworkRefused))
+);
+var encodeRefusal = Schema_exports.encodeSync(NetworkRefused);
+var encodeRefusalHeader = Schema_exports.encodeSync(NetworkRefusedHeader);
+var networkRefusalResponse = (refused) => new Response(JSON.stringify({ ...encodeRefusal(refused), message: refused.message }), {
+  status: networkRefusalStatus,
+  statusText: "Refused by Executor",
+  headers: {
+    "content-type": "application/json; charset=utf-8",
+    [networkRefusalHeader]: encodeRefusalHeader(refused)
+  }
+});
+var RestrictedFetchOption = Schema_exports.Literals(["redirect", "cache", "integrity"]);
+var supportedFetchOptions = {
+  redirect: ["follow", "manual"],
+  cache: ["no-store", "no-cache"],
+  integrity: [""]
+};
+var FetchOptionUnsupported = class extends Schema_exports.TaggedError()(
+  "FetchOptionUnsupported",
+  {
+    option: RestrictedFetchOption,
+    value: Schema_exports.String,
+    supported: Schema_exports.Array(Schema_exports.String)
+  }
+) {
+  get message() {
+    const supported = this.supported.map((value) => JSON.stringify(value)).join(" or ");
+    return `fetch option ${this.option}: ${JSON.stringify(this.value)} is not supported by Executor's app runtime. Use ${supported}, or omit ${this.option}.${this.advice}`;
+  }
+  /** What to do instead, when the standard value has an equivalent the runtime supports. */
+  get advice() {
+    switch (this.option) {
+      case "redirect":
+        return this.value === "error" ? ` To reject redirects, send redirect: "manual" and treat a 3xx response as the error.` : "";
+      case "cache":
+        return "";
+      case "integrity":
+        return " To check a digest, read the body and hash it with crypto.subtle.digest.";
+    }
+  }
+};
+
+// ../app-cache/src/contracts/cache.ts
+var CacheError = class extends Schema_exports.TaggedError()("CacheError", {
+  reason: Schema_exports.Literals(["unavailable", "storage", "invalid", "capacity", "timeout"])
+}) {
+};
+var cacheLimits = {
+  keyBytes: 8192,
+  entryBytes: 2e6,
+  batchBytes: 8e6,
+  batchEntries: 128,
+  totalBytes: 128e6,
+  totalEntries: 1e5,
+  retentionMs: 7 * 24 * 60 * 60 * 1e3,
+  loadTimeoutMs: 9e4,
+  /**
+   * A loader's lease lapses this long after its host last renewed it. Hosts renew every
+   * `renewMs` while the invocation that claimed it runs, so a stalled or lost holder frees the
+   * key well inside an MCP execute budget.
+   */
+  leaseMs: 15e3,
+  renewMs: 5e3,
+  /** The longest a caller waits on another loader before loading for itself without publishing. */
+  waitMs: 1e4,
+  /** Bound for one command to a host store; a lost reply fails instead of holding its caller. */
+  commandTimeoutMs: 1e4
+};
+var Key = Schema_exports.String.check(Schema_exports.isPattern(/^[a-f0-9]{64}$/));
+var Time = Schema_exports.Finite.check(Schema_exports.isGreaterThanOrEqualTo(0));
+var CacheEntry = Schema_exports.Struct({
+  value: Schema_exports.Json,
+  version: Schema_exports.String,
+  freshUntil: Time,
+  staleUntil: Time
+});
+var CacheAcquired = Schema_exports.Struct({
+  entry: Schema_exports.NullOr(CacheEntry),
+  lease: Schema_exports.NullOr(Schema_exports.String)
+});
+var CacheCommand = Schema_exports.Union([
+  Schema_exports.Struct({ operation: Schema_exports.Literal("read"), keys: Schema_exports.Array(Key) }),
+  Schema_exports.Struct({
+    operation: Schema_exports.Literal("acquire"),
+    key: Key,
+    /** Claim even a fresh entry, as an explicit refresh does. */
+    refresh: Schema_exports.Boolean,
+    /** Claim only while the entry still has this version. Absent accepts the current one. */
+    version: Schema_exports.optionalKey(Schema_exports.NullOr(Schema_exports.String))
+  }),
+  Schema_exports.Struct({
+    operation: Schema_exports.Literal("claim"),
+    key: Key,
+    version: Schema_exports.NullOr(Schema_exports.String)
+  }),
+  Schema_exports.Struct({
+    operation: Schema_exports.Literal("publish"),
+    key: Key,
+    lease: Schema_exports.String,
+    entry: CacheEntry
+  }),
+  Schema_exports.Struct({ operation: Schema_exports.Literal("release"), key: Key, lease: Schema_exports.String }),
+  /** Extend a lease its holder still owns. Replies false once the lease lapsed or was replaced. */
+  Schema_exports.Struct({ operation: Schema_exports.Literal("renew"), key: Key, lease: Schema_exports.String }),
+  Schema_exports.Struct({
+    operation: Schema_exports.Literal("write"),
+    entries: Schema_exports.Array(Schema_exports.Struct({ key: Key, entry: CacheEntry }))
+  }),
+  Schema_exports.Struct({ operation: Schema_exports.Literal("invalidate"), key: Key })
+]);
+var CacheReply = Schema_exports.Union([
+  Schema_exports.Struct({ ok: Schema_exports.Literal(true), value: Schema_exports.Json }),
+  Schema_exports.Struct({ ok: Schema_exports.Literal(false), error: CacheError })
+]);
+
+export {
+  maxFailureMessageLength,
+  FailureSource,
+  FailureName,
+  FailureCode,
+  FailureMessage,
+  maxFailureFields,
+  maxFailureFieldLength,
+  FailureFieldName,
+  FailureFieldValue,
+  FailureFields,
+  FailureDetail,
+  maxUpstreamMessageLength,
+  UpstreamError,
+  FailurePhase,
+  ProviderError,
+  NetworkRefusal,
+  NetworkRefused,
+  networkRefusalStatus,
+  networkRefusalHeader,
+  NetworkRefusedHeader,
+  networkRefusalResponse,
+  RestrictedFetchOption,
+  supportedFetchOptions,
+  FetchOptionUnsupported,
+  CacheError,
+  cacheLimits,
+  CacheEntry,
+  CacheAcquired,
+  CacheCommand,
+  CacheReply
+};