apps 0.0.1-beta.67 → 0.0.1-beta.69

package/js/{chunk-5NQDJMLY.js → chunk-3R3KFCDU.js}

@@ -2,17 +2,21 @@ import {
   declaredOperations,
   nativeOperation,
   nativeRouter
-} from "./chunk-X36WUWBJ.js";
+} from "./chunk-ZEJ3IKEC.js";
 import {
   fromPromise,
   method
-} from "./chunk-K2VZ3O27.js";
+} from "./chunk-ZR7QAG67.js";
 import {
   EmittedEvent,
   EventName,
+  Placement,
   ScheduleTiming,
-  defaultEventLimits
-} from "./chunk-TLWLJ7PD.js";
+  defaultEventLimits,
+  normalizePlacements,
+  placementFields,
+  renderPlacement
+} from "./chunk-JW5LYSER.js";
 import {
   decoderOf,
   isSchema,
@@ -24,6 +28,7 @@ import {
 } from "./chunk-H2CJWXA3.js";
 import {
   Effect_exports,
+  Result_exports,
   Schema_exports
 } from "./chunk-IFJU5SYQ.js";
 
@@ -45,6 +50,153 @@ var ResponseDecodeError = class extends Schema_exports.TaggedError()(
   }
 };
 
+// src/implementation/placement.ts
+var misuse = (name) => `${name} is a credential placement, not a string. Build placement values with t\`...\`, such as t\`Bearer \${token}\`, instead of an untagged template literal or string concatenation.`;
+var NotAString = class {
+  #described;
+  constructor(described) {
+    this.#described = described;
+  }
+  [Symbol.toPrimitive]() {
+    throw new TypeError(misuse(this.#described));
+  }
+  toString() {
+    throw new TypeError(misuse(this.#described));
+  }
+  toJSON() {
+    throw new TypeError(misuse(this.#described));
+  }
+};
+var FieldRef = class extends NotAString {
+  field;
+  constructor(field) {
+    super(`The field reference ${JSON.stringify(field)}`);
+    this.field = field;
+  }
+};
+var PlacementValue = class extends NotAString {
+  parts;
+  constructor(parts) {
+    super("A t`...` value");
+    this.parts = parts;
+  }
+};
+var partsOf = (input) => {
+  if (typeof input === "string") return input === "" ? [] : [input];
+  if (input instanceof FieldRef) return [{ field: input.field }];
+  if (input instanceof PlacementValue) return input.parts;
+  throw new TypeError(
+    `A credential placement interpolates text, a field reference, t\`...\` or base64(...), not ${typeof input}.`
+  );
+};
+var joined = (parts) => parts.reduce((all, part) => {
+  const last = all.at(-1);
+  if (typeof part === "string" && typeof last === "string") all[all.length - 1] = last + part;
+  else all.push(part);
+  return all;
+}, []);
+var t = (strings, ...values) => new PlacementValue(
+  joined(
+    strings.flatMap((text, index) => [
+      ...partsOf(text),
+      ...index < values.length ? partsOf(values[index]) : []
+    ])
+  )
+);
+var base64 = (value2) => {
+  const inner = partsOf(value2).map((part) => {
+    if (typeof part === "object" && "base64" in part)
+      throw new TypeError("base64(...) cannot contain another base64(...).");
+    return part;
+  });
+  if (inner.length === 0) throw new TypeError("base64(...) needs a value.");
+  return new PlacementValue([{ base64: inner }]);
+};
+var value = (input) => {
+  const parts = partsOf(input);
+  if (parts.length === 0) throw new TypeError("A credential placement needs a value.");
+  return joined(parts);
+};
+var header = (name, input) => ({
+  in: "header",
+  name: name.toLowerCase(),
+  value: value(input)
+});
+var query = (name, input) => ({
+  in: "query",
+  name,
+  value: value(input)
+});
+var bearer = (token) => header("authorization", t`Bearer ${token}`);
+var basic = (user, password) => header("authorization", t`Basic ${base64(t`${user}:${password}`)}`);
+var declarePlacements = (method2, names, exposure, request) => {
+  const declared = new Set(names);
+  const refs = new Proxy(Object.fromEntries(names.map((name) => [name, new FieldRef(name)])), {
+    get: (target, key) => {
+      if (typeof key === "string" && !declared.has(key))
+        throw new TypeError(
+          `The ${method2} request references "${key}", which is not one of its fields: ${names.join(", ")}.`
+        );
+      return Reflect.get(target, key);
+    }
+  });
+  const returned = request(refs);
+  const placements = Array.isArray(returned) ? returned : [returned];
+  if (placements.length === 0) throw new TypeError(`The ${method2} request declares no placements.`);
+  if (!placements.every(Schema_exports.is(Placement)))
+    throw new TypeError(
+      `The ${method2} request must return header(...) or query(...) placements, or an array of them.`
+    );
+  for (const placement of placements) {
+    const fields = placementFields(placement);
+    for (const field of fields) {
+      if (!declared.has(field))
+        throw new TypeError(
+          `The ${method2} request references "${field}", which is not one of its fields: ${names.join(", ")}.`
+        );
+      if (exposure?.[field] === "raw")
+        throw new TypeError(
+          `The ${method2} request references the raw() field "${field}". App code reads raw fields as real values, so they are never placed; remove raw() or the reference.`
+        );
+    }
+    if (![...fields].some((field) => exposure?.[field] === void 0))
+      throw new TypeError(
+        `The ${method2} request's ${placement.in} ${placement.name} references no secret field. A placement places a secret: reference a field that is not plain() or raw().`
+      );
+  }
+  return normalizePlacements(placements);
+};
+var undeclared = (method2) => `The ${method2} account declares no request. Declare where its credentials go with request, such as request: ({ token }) => bearer(token), to use headers() and url().`;
+var withPlacements = (account, placements) => {
+  const fields = typeof account.fields === "object" && account.fields !== null ? account.fields : {};
+  const render = (placement) => Result_exports.getOrThrowWith(
+    renderPlacement(placement, fields),
+    (error) => new TypeError(error.message)
+  );
+  const declared = () => {
+    if (placements === void 0 || placements.length === 0)
+      throw new TypeError(undeclared(account.method));
+    return placements;
+  };
+  return Object.defineProperties(account, {
+    headers: {
+      enumerable: false,
+      value: () => Object.fromEntries(
+        declared().filter((placement) => placement.in === "header").map((placement) => [placement.name, render(placement)])
+      )
+    },
+    url: {
+      enumerable: false,
+      value: (input) => {
+        const url = new URL(input);
+        for (const placement of declared())
+          if (placement.in === "query") url.searchParams.set(placement.name, render(placement));
+        return url.href;
+      }
+    }
+  });
+};
+
 // src/implementation/workflows.ts
 var NativeWorkflow = /* @__PURE__ */ Symbol("apps.Workflow");
 var workflow = (options, run) => ({
@@ -56,9 +208,9 @@ var workflow = (options, run) => ({
     run: (context, input) => fromPromise(run, "workflow")(context, input)
   }
 });
-var nativeWorkflow = (value) => {
-  if (typeof value !== "object" || value === null || !(NativeWorkflow in value)) return void 0;
-  return value[NativeWorkflow];
+var nativeWorkflow = (value2) => {
+  if (typeof value2 !== "object" || value2 === null || !(NativeWorkflow in value2)) return void 0;
+  return value2[NativeWorkflow];
 };
 
 // src/implementation/events.ts
@@ -68,7 +220,7 @@ var isScalarSchema = (document) => {
   const type = document.type;
   if (typeof type === "string") return scalarTypes.has(type);
   const choices = Array.isArray(document.enum) ? document.enum : "const" in document ? [document.const] : void 0;
-  return choices !== void 0 && choices.length > 0 && choices.every((value) => ["string", "number", "boolean"].includes(typeof value));
+  return choices !== void 0 && choices.length > 0 && choices.every((value2) => ["string", "number", "boolean"].includes(typeof value2));
 };
 var event = (options) => {
   const filters = options.filters ?? {};
@@ -144,7 +296,7 @@ var makeEmitter = (input) => ({
 
 // src/implementation/app.ts
 var InternalApp = /* @__PURE__ */ Symbol("apps.App");
-var isApp = (value) => typeof value === "object" && value !== null && InternalApp in value;
+var isApp = (value2) => typeof value2 === "object" && value2 !== null && InternalApp in value2;
 var toEffectApp = (app) => app[InternalApp];
 function rejectCatalogs(definition) {
   if ("queries" in definition || "mutations" in definition)
@@ -180,8 +332,8 @@ function adaptDefinition(definition) {
   };
   const workflows = definition.workflows === void 0 ? {} : {
     workflows: Object.fromEntries(
-      Object.entries(definition.workflows).map(([name, value]) => {
-        const declared2 = nativeWorkflow(value);
+      Object.entries(definition.workflows).map(([name, value2]) => {
+        const declared2 = nativeWorkflow(value2);
         if (declared2 === void 0) throw new Error("Invalid workflow declaration");
         return [name, declared2];
       })
@@ -244,7 +396,7 @@ var defineApp = (requirements, definition) => {
   const native = {
     accounts: requirements.accounts,
     ...events === void 0 ? {} : { events },
-    evaluate: (context) => factory(context).pipe(Effect_exports.map((value) => adaptDefinition(value)))
+    evaluate: (context) => factory(context).pipe(Effect_exports.map((value2) => adaptDefinition(value2)))
   };
   return {
     [InternalApp]: native,
@@ -256,6 +408,14 @@ var defineApp = (requirements, definition) => {
 export {
   ResponseStatusError,
   ResponseDecodeError,
+  t,
+  base64,
+  header,
+  query,
+  bearer,
+  basic,
+  declarePlacements,
+  withPlacements,
   workflow,
   event,
   declaredEvents,

package/js/{chunk-MWKHKOTL.js → chunk-7LMU3ER3.js}

@@ -66,6 +66,23 @@ var NetworkRefusal = Schema_exports.Union([
     reason: Schema_exports.Literal("credential_expired"),
     /** The provider of the expired credential handle. */
     provider: Schema_exports.String
+  }),
+  Schema_exports.Struct({
+    reason: Schema_exports.Literal("credential_placement"),
+    /** The provider of the misplaced credential handle. */
+    provider: Schema_exports.String,
+    /** Where the handle was found, such as `body` or `header x-note`. */
+    location: Schema_exports.String
+  }),
+  Schema_exports.Struct({
+    reason: Schema_exports.Literal("credential_transport"),
+    /** The provider of the credential handle the request carried. */
+    provider: Schema_exports.String
+  }),
+  Schema_exports.Struct({
+    reason: Schema_exports.Literal("credential_method"),
+    /** The refused HTTP method. */
+    method: Schema_exports.String
   })
 ]);
 var NetworkRefused = class extends Schema_exports.TaggedError()("NetworkRefused", {
@@ -84,6 +101,12 @@ var NetworkRefused = class extends Schema_exports.TaggedError()("NetworkRefused"
         return "Executor refused this request: it carries a credential handle that is not valid for this app. Use the account fields this invocation received.";
       case "credential_expired":
         return `Executor refused this request: it carries an expired ${refusal.provider} credential handle. Use the account fields this invocation received.`;
+      case "credential_placement":
+        return `Executor refused this request: it carries a ${refusal.provider} credential handle in the ${refusal.location}, where the provider does not place it. Send credentials only as the provider's request declares, for example with the account's headers() and url().`;
+      case "credential_transport":
+        return `Executor refused this request: ${refusal.provider} credentials are sent only over HTTPS, and ${this.host} was requested over plain HTTP.`;
+      case "credential_method":
+        return `Executor refused this request: credential handles are never sent with ${refusal.method}, which asks the service to echo the request back.`;
     }
   }
 };
@@ -135,7 +158,18 @@ var FetchOptionUnsupported = class extends Schema_exports.TaggedError()(
 
 // ../app-cache/src/contracts/cache.ts
 var CacheError = class extends Schema_exports.TaggedError()("CacheError", {
-  reason: Schema_exports.Literals(["unavailable", "storage", "invalid", "capacity", "timeout"])
+  reason: Schema_exports.Literals(["unavailable", "storage", "invalid", "capacity", "timeout"]),
+  /** Which of `cacheLimits` the request exceeded, when one did. */
+  limit: Schema_exports.optionalKey(
+    Schema_exports.Literals([
+      "keyBytes",
+      "entryBytes",
+      "batchBytes",
+      "batchEntries",
+      "totalBytes",
+      "totalEntries"
+    ])
+  )
 }) {
 };
 var cacheLimits = {

package/js/{chunk-WFPDJ4R3.js → chunk-CXDAEGXB.js}

@@ -1,10 +1,10 @@
 import {
   prepareElicitation
-} from "./chunk-524HNOCY.js";
+} from "./chunk-DZN5TQ53.js";
 import {
   bodyUpstreamError,
   fromPromise
-} from "./chunk-K2VZ3O27.js";
+} from "./chunk-ZR7QAG67.js";
 import {
   ElicitationFailed,
   McpError,
@@ -16,7 +16,7 @@ import {
   defaultElicitationLimits,
   defaultMcpClientLimits,
   mcpSdkTimerCeilingMs
-} from "./chunk-TLWLJ7PD.js";
+} from "./chunk-JW5LYSER.js";
 import {
   jsonSchemaDecoder,
   nestJsonSchema,

package/js/{chunk-ZA6YCHLZ.js → chunk-CY4MT7PI.js}

@@ -3,16 +3,16 @@ import {
   answeredError,
   mcpClient,
   mcpJsonSchemaValidator
-} from "./chunk-WFPDJ4R3.js";
+} from "./chunk-CXDAEGXB.js";
 import {
   failOnNetworkRefusal
-} from "./chunk-T3FPHPJJ.js";
+} from "./chunk-MHB7IFG7.js";
 import {
   accountProviderError,
   bodyUpstreamError,
   httpProviderError,
   providerErrorDetail
-} from "./chunk-K2VZ3O27.js";
+} from "./chunk-ZR7QAG67.js";
 import {
   McpCredentialsUnverified,
   McpError,
@@ -20,11 +20,11 @@ import {
   McpToolsOptions,
   defaultMcpClientLimits,
   mcpHealthReserveMs
-} from "./chunk-TLWLJ7PD.js";
+} from "./chunk-JW5LYSER.js";
 import {
   NetworkRefused,
   ProviderError
-} from "./chunk-MWKHKOTL.js";
+} from "./chunk-7LMU3ER3.js";
 import {
   captureTelemetry,
   owned

package/js/{chunk-524HNOCY.js → chunk-DZN5TQ53.js}

@@ -1,6 +1,6 @@
 import {
   makeCache
-} from "./chunk-AQU56EPI.js";
+} from "./chunk-RUP4JMKO.js";
 import {
   accountSecrets,
   boundFailureMessage,
@@ -11,10 +11,10 @@ import {
   parseSkillLoadFailed,
   readCatalog,
   routerSkills
-} from "./chunk-5EOB55ID.js";
+} from "./chunk-FZB6D6ZD.js";
 import {
   appInvocationFetch
-} from "./chunk-T3FPHPJJ.js";
+} from "./chunk-MHB7IFG7.js";
 import {
   folderSkillsEffect
 } from "./chunk-XBG7HHXC.js";
@@ -23,13 +23,14 @@ import {
   declaredEvents,
   isApp,
   makeEmitter,
-  toEffectApp
-} from "./chunk-5NQDJMLY.js";
+  toEffectApp,
+  withPlacements
+} from "./chunk-3R3KFCDU.js";
 import {
   declaredOperations,
   locate,
   nativeOperation
-} from "./chunk-X36WUWBJ.js";
+} from "./chunk-ZEJ3IKEC.js";
 import {
   accountProviderError,
   appCode,
@@ -38,7 +39,7 @@ import {
   method,
   parseProviderError,
   toPromise
-} from "./chunk-K2VZ3O27.js";
+} from "./chunk-ZR7QAG67.js";
 import {
   AccountCheckResult,
   DeclaredProvider,
@@ -86,12 +87,14 @@ import {
   defaultWebhookTransportLimits,
   maxInputProblems,
   migrationsDirectory,
+  normalizePlacements,
   reservedTablePrefix,
+  sqlBindingsLimit,
   workflowDurationMillis
-} from "./chunk-TLWLJ7PD.js";
+} from "./chunk-JW5LYSER.js";
 import {
   CacheError
-} from "./chunk-MWKHKOTL.js";
+} from "./chunk-7LMU3ER3.js";
 import {
   AppSkills,
   SkillFile
@@ -748,6 +751,12 @@ var authorSql = (storage, options) => {
   };
   const runStatement = (query, bindings, mode) => {
     live();
+    if (bindings.length > sqlBindingsLimit)
+      throw refuse(
+        new Error(
+          `A statement can bind at most ${sqlBindingsLimit} values, but this one binds ${bindings.length}. Pass a long list as one JSON array and read it with json_each(?), or split the work into batches.`
+        )
+      );
     if (mode === "write") {
       const statement = () => {
         const cursor = materialize(storage.sql.exec(query, ...bindings));
@@ -920,6 +929,47 @@ var sha256 = (text) => (
     )
   )
 );
+var statementsOf = (script) => {
+  let end = 0;
+  let index = 0;
+  while (index < script.length) {
+    const char = script[index];
+    const next = script[index + 1];
+    if (char === "-" && next === "-") {
+      const newline = script.indexOf("\n", index);
+      index = newline === -1 ? script.length : newline + 1;
+      continue;
+    }
+    if (char === "/" && next === "*") {
+      const close = script.indexOf("*/", index + 2);
+      index = close === -1 ? script.length : close + 2;
+      continue;
+    }
+    const closing = char === "'" || char === '"' || char === "`" ? char : char === "[" ? "]" : void 0;
+    if (closing !== void 0) {
+      let after = index + 1;
+      while (true) {
+        const found = script.indexOf(closing, after);
+        if (found === -1) {
+          after = script.length;
+          break;
+        }
+        if (closing !== "]" && script[found + 1] === closing) {
+          after = found + 2;
+          continue;
+        }
+        after = found + 1;
+        break;
+      }
+      index = after;
+      end = index;
+      continue;
+    }
+    index += 1;
+    if (char !== void 0 && !/\s/u.test(char)) end = index;
+  }
+  return script.slice(0, end);
+};
 var hasMigrations = (files) => files.some(
   (file) => file.path.startsWith(`${migrationsDirectory}/`) && file.path.endsWith(".sql")
 );
@@ -990,8 +1040,9 @@ var migrate = (storage, files) => Effect_exports.gen(function* () {
       const pending = migrations.slice(history.length);
       const appliedAt = (/* @__PURE__ */ new Date()).toISOString();
       for (const [offset, migration] of pending.entries()) {
+        const statements = statementsOf(migration.content);
         try {
-          storage.sql.exec(migration.content);
+          if (statements !== "") storage.sql.exec(statements);
         } catch (error) {
           throw new MigrationFailed({
             path: migration.path,
@@ -1142,6 +1193,9 @@ function declaredExposure(exposure) {
   const raw = named("raw");
   return { ...plain.length === 0 ? {} : { plain }, ...raw.length === 0 ? {} : { raw } };
 }
+function declaredPlacements(request) {
+  return request === void 0 || request.length === 0 ? {} : { request: normalizePlacements(request) };
+}
 function providerDeclaration(provider) {
   return declarationSafe(
     () => Effect_exports.gen(function* () {
@@ -1153,7 +1207,8 @@ function providerDeclaration(provider) {
               type: "secrets",
               label: method2.label,
               fields: yield* jsonSchemaDocument(method2.fields),
-              ...declaredExposure(method2.exposure)
+              ...declaredExposure(method2.exposure),
+              ...declaredPlacements(method2.request)
             });
             break;
           case "oauth2":
@@ -1161,7 +1216,8 @@ function providerDeclaration(provider) {
               type: "oauth2",
               ...method2.config,
               response: yield* jsonSchemaDocument(method2.response),
-              ...declaredExposure(method2.exposure)
+              ...declaredExposure(method2.exposure),
+              ...declaredPlacements(method2.request)
             });
             break;
         }
@@ -1211,8 +1267,16 @@ function canonical(value) {
   }
   return JSON.stringify(value);
 }
-function withoutHosts({ hosts: _hosts, ...provider }) {
-  return provider;
+function withoutGrants({ hosts: _hosts, ...provider }) {
+  return {
+    ...provider,
+    auth: Object.fromEntries(
+      Object.entries(provider.auth).map(([name, { request: _request, ...method2 }]) => [
+        name,
+        method2
+      ])
+    )
+  };
 }
 function bindAccounts(slots, declarations, context) {
   return safe2(
@@ -1239,14 +1303,17 @@ function bindAccounts(slots, declarations, context) {
         for (const account of accounts) {
           if (ids.has(account.id)) return yield* Effect_exports.fail(new HostAccountsInvalid());
           ids.add(account.id);
-          if (canonical(withoutHosts(account.provider)) !== canonical(withoutHosts(requirement.definition)) || !Object.hasOwn(provider.auth, account.method))
+          if (canonical(withoutGrants(account.provider)) !== canonical(withoutGrants(requirement.definition)) || !Object.hasOwn(provider.auth, account.method))
             return yield* Effect_exports.fail(new HostAccountsInvalid());
           const method2 = provider.auth[account.method];
           if (method2 === void 0) return yield* Effect_exports.fail(new HostAccountsInvalid());
           const fields = yield* Schema_exports.decodeUnknownEffect(
             method2._tag === "secrets" ? method2.fields : method2.response
           )(account.fields);
-          values.push({ id: account.id, method: account.method, fields });
+          const granted = Object.hasOwn(account.provider.auth, account.method) ? account.provider.auth[account.method]?.request : void 0;
+          values.push(
+            withPlacements({ id: account.id, method: account.method, fields }, granted)
+          );
         }
         if (many) bound.set(slot, values);
         else {

package/js/{chunk-AZIV4XRH.js → chunk-ECCWT5GJ.js}

@@ -2,10 +2,10 @@ import {
   fromPromise,
   method,
   toPromise
-} from "./chunk-K2VZ3O27.js";
+} from "./chunk-ZR7QAG67.js";
 import {
   CacheError
-} from "./chunk-MWKHKOTL.js";
+} from "./chunk-7LMU3ER3.js";
 import {
   wrap
 } from "./chunk-KGCTYL2S.js";

package/js/{chunk-5EOB55ID.js → chunk-FZB6D6ZD.js}

@@ -4,12 +4,12 @@ import {
 import {
   joinPath,
   mergeMeta
-} from "./chunk-X36WUWBJ.js";
+} from "./chunk-ZEJ3IKEC.js";
 import {
   isShortenedUpstream,
   parseProviderError,
   providerError
-} from "./chunk-K2VZ3O27.js";
+} from "./chunk-ZR7QAG67.js";
 import {
   ApiErrorResponse,
   HostDeclarationInvalid,
@@ -21,18 +21,19 @@ import {
   McpError,
   McpError2,
   SkillLoadFailed as SkillLoadFailed2
-} from "./chunk-TLWLJ7PD.js";
+} from "./chunk-JW5LYSER.js";
 import {
   CacheError,
   FailureCode,
   FailureFieldName,
   FetchOptionUnsupported,
   NetworkRefused,
+  cacheLimits,
   maxFailureFieldLength,
   maxFailureFields,
   maxFailureMessageLength,
   maxUpstreamMessageLength
-} from "./chunk-MWKHKOTL.js";
+} from "./chunk-7LMU3ER3.js";
 import {
   SkillLoadFailed,
   skillFormatLimits
@@ -238,7 +239,7 @@ var compileMessage = (error) => {
     if (group === void 0) groups.set(key, { first: operation, count: 1 });
     else group.count++;
   }
-  const example = ({ first, count }) => `${first.method} ${first.path}${count > 1 ? ` and ${count - 1} more` : ""}`;
+  const example = ({ first, count: count2 }) => `${first.method} ${first.path}${count2 > 1 ? ` and ${count2 - 1} more` : ""}`;
   const [only, ...others] = groups.values();
   if (only !== void 0 && others.length === 0 && only.first.code === error.code && only.first.reason === error.reason)
     return `${error.reason} Left out: ${example(only)}.`;
@@ -293,6 +294,15 @@ var cacheMessages = {
   storage: "The app cache failed to complete the operation.",
   timeout: "The app cache did not respond in time."
 };
+var count = (value) => value.toLocaleString("en-US");
+var cacheLimitMessages = {
+  keyBytes: `A cache key exceeded the app cache's limit of ${count(cacheLimits.keyBytes)} bytes per key.`,
+  entryBytes: `A cache value exceeded the app cache's limit of ${count(cacheLimits.entryBytes)} bytes per entry.`,
+  batchBytes: `A cache read or write exceeded the app cache's limit of ${count(cacheLimits.batchBytes)} bytes per batch.`,
+  batchEntries: `A cache read or write exceeded the app cache's limit of ${count(cacheLimits.batchEntries)} entries per batch.`,
+  totalBytes: `The app cache is full: it holds at most ${count(cacheLimits.totalBytes)} bytes.`,
+  totalEntries: `The app cache is full: it holds at most ${count(cacheLimits.totalEntries)} entries.`
+};
 var mcpStages = {
   connect: "connecting",
   transport: "connecting",
@@ -393,18 +403,18 @@ var ownCode = (error, secrets) => Predicate_exports.hasProperty(error, "code") &
 var reservedFields = /* @__PURE__ */ new Set(["name", "message", "stack", "cause", "_tag"]);
 var ownFields = (error, code, secrets) => {
   const fields = {};
-  let count = 0;
+  let count2 = 0;
   for (const [key, value] of Object.entries(error)) {
-    if (count === maxFailureFields) break;
+    if (count2 === maxFailureFields) break;
     if (reservedFields.has(key) || key === "code" && code !== void 0) continue;
     if (!Schema_exports.is(FailureFieldName)(key)) continue;
     if (typeof value === "string") fields[key] = boundText(value, secrets, maxFailureFieldLength);
     else if (typeof value === "boolean" || typeof value === "number" && Number.isFinite(value))
       fields[key] = value;
     else continue;
-    count++;
+    count2++;
   }
-  return count === 0 ? void 0 : fields;
+  return count2 === 0 ? void 0 : fields;
 };
 var ownMessage = (error) => {
   const cause = error.cause;
@@ -429,7 +439,7 @@ var failureDetail = (error, secrets) => {
       source: "storage",
       errorName: "CacheError",
       code: error.reason,
-      message: cacheMessages[error.reason]
+      message: error.limit === void 0 ? cacheMessages[error.reason] : cacheLimitMessages[error.limit]
     };
   if (Schema_exports.is(OpenapiError)(error))
     return {

package/js/{chunk-6RH2UYRB.js → chunk-GJSNQSR7.js}

@@ -1,11 +1,11 @@
 import {
   fixedRouter
-} from "./chunk-5EOB55ID.js";
+} from "./chunk-FZB6D6ZD.js";
 import {
   nativeOperation,
   operationDeclaration,
   routerDeclaration
-} from "./chunk-X36WUWBJ.js";
+} from "./chunk-ZEJ3IKEC.js";
 
 // src/implementation/protocol-operations.ts
 var protocolOperations = (operations, kinds = {}) => {