apps 0.0.1-beta.68 → 0.0.1-beta.69

package/js/{chunk-L7ZC6JR4.js → chunk-3R3KFCDU.js}

@@ -2,17 +2,21 @@ import {
   declaredOperations,
   nativeOperation,
   nativeRouter
-} from "./chunk-2KVS7XBO.js";
+} from "./chunk-ZEJ3IKEC.js";
 import {
   fromPromise,
   method
-} from "./chunk-JGLXI6SU.js";
+} from "./chunk-ZR7QAG67.js";
 import {
   EmittedEvent,
   EventName,
+  Placement,
   ScheduleTiming,
-  defaultEventLimits
-} from "./chunk-M3IIZDHH.js";
+  defaultEventLimits,
+  normalizePlacements,
+  placementFields,
+  renderPlacement
+} from "./chunk-JW5LYSER.js";
 import {
   decoderOf,
   isSchema,
@@ -24,6 +28,7 @@ import {
 } from "./chunk-H2CJWXA3.js";
 import {
   Effect_exports,
+  Result_exports,
   Schema_exports
 } from "./chunk-IFJU5SYQ.js";
 
@@ -45,6 +50,153 @@ var ResponseDecodeError = class extends Schema_exports.TaggedError()(
   }
 };
 
+// src/implementation/placement.ts
+var misuse = (name) => `${name} is a credential placement, not a string. Build placement values with t\`...\`, such as t\`Bearer \${token}\`, instead of an untagged template literal or string concatenation.`;
+var NotAString = class {
+  #described;
+  constructor(described) {
+    this.#described = described;
+  }
+  [Symbol.toPrimitive]() {
+    throw new TypeError(misuse(this.#described));
+  }
+  toString() {
+    throw new TypeError(misuse(this.#described));
+  }
+  toJSON() {
+    throw new TypeError(misuse(this.#described));
+  }
+};
+var FieldRef = class extends NotAString {
+  field;
+  constructor(field) {
+    super(`The field reference ${JSON.stringify(field)}`);
+    this.field = field;
+  }
+};
+var PlacementValue = class extends NotAString {
+  parts;
+  constructor(parts) {
+    super("A t`...` value");
+    this.parts = parts;
+  }
+};
+var partsOf = (input) => {
+  if (typeof input === "string") return input === "" ? [] : [input];
+  if (input instanceof FieldRef) return [{ field: input.field }];
+  if (input instanceof PlacementValue) return input.parts;
+  throw new TypeError(
+    `A credential placement interpolates text, a field reference, t\`...\` or base64(...), not ${typeof input}.`
+  );
+};
+var joined = (parts) => parts.reduce((all, part) => {
+  const last = all.at(-1);
+  if (typeof part === "string" && typeof last === "string") all[all.length - 1] = last + part;
+  else all.push(part);
+  return all;
+}, []);
+var t = (strings, ...values) => new PlacementValue(
+  joined(
+    strings.flatMap((text, index) => [
+      ...partsOf(text),
+      ...index < values.length ? partsOf(values[index]) : []
+    ])
+  )
+);
+var base64 = (value2) => {
+  const inner = partsOf(value2).map((part) => {
+    if (typeof part === "object" && "base64" in part)
+      throw new TypeError("base64(...) cannot contain another base64(...).");
+    return part;
+  });
+  if (inner.length === 0) throw new TypeError("base64(...) needs a value.");
+  return new PlacementValue([{ base64: inner }]);
+};
+var value = (input) => {
+  const parts = partsOf(input);
+  if (parts.length === 0) throw new TypeError("A credential placement needs a value.");
+  return joined(parts);
+};
+var header = (name, input) => ({
+  in: "header",
+  name: name.toLowerCase(),
+  value: value(input)
+});
+var query = (name, input) => ({
+  in: "query",
+  name,
+  value: value(input)
+});
+var bearer = (token) => header("authorization", t`Bearer ${token}`);
+var basic = (user, password) => header("authorization", t`Basic ${base64(t`${user}:${password}`)}`);
+var declarePlacements = (method2, names, exposure, request) => {
+  const declared = new Set(names);
+  const refs = new Proxy(Object.fromEntries(names.map((name) => [name, new FieldRef(name)])), {
+    get: (target, key) => {
+      if (typeof key === "string" && !declared.has(key))
+        throw new TypeError(
+          `The ${method2} request references "${key}", which is not one of its fields: ${names.join(", ")}.`
+        );
+      return Reflect.get(target, key);
+    }
+  });
+  const returned = request(refs);
+  const placements = Array.isArray(returned) ? returned : [returned];
+  if (placements.length === 0) throw new TypeError(`The ${method2} request declares no placements.`);
+  if (!placements.every(Schema_exports.is(Placement)))
+    throw new TypeError(
+      `The ${method2} request must return header(...) or query(...) placements, or an array of them.`
+    );
+  for (const placement of placements) {
+    const fields = placementFields(placement);
+    for (const field of fields) {
+      if (!declared.has(field))
+        throw new TypeError(
+          `The ${method2} request references "${field}", which is not one of its fields: ${names.join(", ")}.`
+        );
+      if (exposure?.[field] === "raw")
+        throw new TypeError(
+          `The ${method2} request references the raw() field "${field}". App code reads raw fields as real values, so they are never placed; remove raw() or the reference.`
+        );
+    }
+    if (![...fields].some((field) => exposure?.[field] === void 0))
+      throw new TypeError(
+        `The ${method2} request's ${placement.in} ${placement.name} references no secret field. A placement places a secret: reference a field that is not plain() or raw().`
+      );
+  }
+  return normalizePlacements(placements);
+};
+var undeclared = (method2) => `The ${method2} account declares no request. Declare where its credentials go with request, such as request: ({ token }) => bearer(token), to use headers() and url().`;
+var withPlacements = (account, placements) => {
+  const fields = typeof account.fields === "object" && account.fields !== null ? account.fields : {};
+  const render = (placement) => Result_exports.getOrThrowWith(
+    renderPlacement(placement, fields),
+    (error) => new TypeError(error.message)
+  );
+  const declared = () => {
+    if (placements === void 0 || placements.length === 0)
+      throw new TypeError(undeclared(account.method));
+    return placements;
+  };
+  return Object.defineProperties(account, {
+    headers: {
+      enumerable: false,
+      value: () => Object.fromEntries(
+        declared().filter((placement) => placement.in === "header").map((placement) => [placement.name, render(placement)])
+      )
+    },
+    url: {
+      enumerable: false,
+      value: (input) => {
+        const url = new URL(input);
+        for (const placement of declared())
+          if (placement.in === "query") url.searchParams.set(placement.name, render(placement));
+        return url.href;
+      }
+    }
+  });
+};
+
 // src/implementation/workflows.ts
 var NativeWorkflow = /* @__PURE__ */ Symbol("apps.Workflow");
 var workflow = (options, run) => ({
@@ -56,9 +208,9 @@ var workflow = (options, run) => ({
     run: (context, input) => fromPromise(run, "workflow")(context, input)
   }
 });
-var nativeWorkflow = (value) => {
-  if (typeof value !== "object" || value === null || !(NativeWorkflow in value)) return void 0;
-  return value[NativeWorkflow];
+var nativeWorkflow = (value2) => {
+  if (typeof value2 !== "object" || value2 === null || !(NativeWorkflow in value2)) return void 0;
+  return value2[NativeWorkflow];
 };
 
 // src/implementation/events.ts
@@ -68,7 +220,7 @@ var isScalarSchema = (document) => {
   const type = document.type;
   if (typeof type === "string") return scalarTypes.has(type);
   const choices = Array.isArray(document.enum) ? document.enum : "const" in document ? [document.const] : void 0;
-  return choices !== void 0 && choices.length > 0 && choices.every((value) => ["string", "number", "boolean"].includes(typeof value));
+  return choices !== void 0 && choices.length > 0 && choices.every((value2) => ["string", "number", "boolean"].includes(typeof value2));
 };
 var event = (options) => {
   const filters = options.filters ?? {};
@@ -144,7 +296,7 @@ var makeEmitter = (input) => ({
 
 // src/implementation/app.ts
 var InternalApp = /* @__PURE__ */ Symbol("apps.App");
-var isApp = (value) => typeof value === "object" && value !== null && InternalApp in value;
+var isApp = (value2) => typeof value2 === "object" && value2 !== null && InternalApp in value2;
 var toEffectApp = (app) => app[InternalApp];
 function rejectCatalogs(definition) {
   if ("queries" in definition || "mutations" in definition)
@@ -180,8 +332,8 @@ function adaptDefinition(definition) {
   };
   const workflows = definition.workflows === void 0 ? {} : {
     workflows: Object.fromEntries(
-      Object.entries(definition.workflows).map(([name, value]) => {
-        const declared2 = nativeWorkflow(value);
+      Object.entries(definition.workflows).map(([name, value2]) => {
+        const declared2 = nativeWorkflow(value2);
         if (declared2 === void 0) throw new Error("Invalid workflow declaration");
         return [name, declared2];
       })
@@ -244,7 +396,7 @@ var defineApp = (requirements, definition) => {
   const native = {
     accounts: requirements.accounts,
     ...events === void 0 ? {} : { events },
-    evaluate: (context) => factory(context).pipe(Effect_exports.map((value) => adaptDefinition(value)))
+    evaluate: (context) => factory(context).pipe(Effect_exports.map((value2) => adaptDefinition(value2)))
   };
   return {
     [InternalApp]: native,
@@ -256,6 +408,14 @@ var defineApp = (requirements, definition) => {
 export {
   ResponseStatusError,
   ResponseDecodeError,
+  t,
+  base64,
+  header,
+  query,
+  bearer,
+  basic,
+  declarePlacements,
+  withPlacements,
   workflow,
   event,
   declaredEvents,

package/js/{chunk-4733J7FG.js → chunk-7LMU3ER3.js}

@@ -66,6 +66,23 @@ var NetworkRefusal = Schema_exports.Union([
     reason: Schema_exports.Literal("credential_expired"),
     /** The provider of the expired credential handle. */
     provider: Schema_exports.String
+  }),
+  Schema_exports.Struct({
+    reason: Schema_exports.Literal("credential_placement"),
+    /** The provider of the misplaced credential handle. */
+    provider: Schema_exports.String,
+    /** Where the handle was found, such as `body` or `header x-note`. */
+    location: Schema_exports.String
+  }),
+  Schema_exports.Struct({
+    reason: Schema_exports.Literal("credential_transport"),
+    /** The provider of the credential handle the request carried. */
+    provider: Schema_exports.String
+  }),
+  Schema_exports.Struct({
+    reason: Schema_exports.Literal("credential_method"),
+    /** The refused HTTP method. */
+    method: Schema_exports.String
   })
 ]);
 var NetworkRefused = class extends Schema_exports.TaggedError()("NetworkRefused", {
@@ -84,6 +101,12 @@ var NetworkRefused = class extends Schema_exports.TaggedError()("NetworkRefused"
         return "Executor refused this request: it carries a credential handle that is not valid for this app. Use the account fields this invocation received.";
       case "credential_expired":
         return `Executor refused this request: it carries an expired ${refusal.provider} credential handle. Use the account fields this invocation received.`;
+      case "credential_placement":
+        return `Executor refused this request: it carries a ${refusal.provider} credential handle in the ${refusal.location}, where the provider does not place it. Send credentials only as the provider's request declares, for example with the account's headers() and url().`;
+      case "credential_transport":
+        return `Executor refused this request: ${refusal.provider} credentials are sent only over HTTPS, and ${this.host} was requested over plain HTTP.`;
+      case "credential_method":
+        return `Executor refused this request: credential handles are never sent with ${refusal.method}, which asks the service to echo the request back.`;
     }
   }
 };

package/js/{chunk-ACJPBBNH.js → chunk-CXDAEGXB.js}

@@ -1,10 +1,10 @@
 import {
   prepareElicitation
-} from "./chunk-6JN66722.js";
+} from "./chunk-DZN5TQ53.js";
 import {
   bodyUpstreamError,
   fromPromise
-} from "./chunk-JGLXI6SU.js";
+} from "./chunk-ZR7QAG67.js";
 import {
   ElicitationFailed,
   McpError,
@@ -16,7 +16,7 @@ import {
   defaultElicitationLimits,
   defaultMcpClientLimits,
   mcpSdkTimerCeilingMs
-} from "./chunk-M3IIZDHH.js";
+} from "./chunk-JW5LYSER.js";
 import {
   jsonSchemaDecoder,
   nestJsonSchema,

package/js/{chunk-3K5SX2M6.js → chunk-CY4MT7PI.js}

@@ -3,16 +3,16 @@ import {
   answeredError,
   mcpClient,
   mcpJsonSchemaValidator
-} from "./chunk-ACJPBBNH.js";
+} from "./chunk-CXDAEGXB.js";
 import {
   failOnNetworkRefusal
-} from "./chunk-UD4RXDWG.js";
+} from "./chunk-MHB7IFG7.js";
 import {
   accountProviderError,
   bodyUpstreamError,
   httpProviderError,
   providerErrorDetail
-} from "./chunk-JGLXI6SU.js";
+} from "./chunk-ZR7QAG67.js";
 import {
   McpCredentialsUnverified,
   McpError,
@@ -20,11 +20,11 @@ import {
   McpToolsOptions,
   defaultMcpClientLimits,
   mcpHealthReserveMs
-} from "./chunk-M3IIZDHH.js";
+} from "./chunk-JW5LYSER.js";
 import {
   NetworkRefused,
   ProviderError
-} from "./chunk-4733J7FG.js";
+} from "./chunk-7LMU3ER3.js";
 import {
   captureTelemetry,
   owned

package/js/{chunk-6JN66722.js → chunk-DZN5TQ53.js}

@@ -1,6 +1,6 @@
 import {
   makeCache
-} from "./chunk-C47A664A.js";
+} from "./chunk-RUP4JMKO.js";
 import {
   accountSecrets,
   boundFailureMessage,
@@ -11,10 +11,10 @@ import {
   parseSkillLoadFailed,
   readCatalog,
   routerSkills
-} from "./chunk-XUG423KM.js";
+} from "./chunk-FZB6D6ZD.js";
 import {
   appInvocationFetch
-} from "./chunk-UD4RXDWG.js";
+} from "./chunk-MHB7IFG7.js";
 import {
   folderSkillsEffect
 } from "./chunk-XBG7HHXC.js";
@@ -23,13 +23,14 @@ import {
   declaredEvents,
   isApp,
   makeEmitter,
-  toEffectApp
-} from "./chunk-L7ZC6JR4.js";
+  toEffectApp,
+  withPlacements
+} from "./chunk-3R3KFCDU.js";
 import {
   declaredOperations,
   locate,
   nativeOperation
-} from "./chunk-2KVS7XBO.js";
+} from "./chunk-ZEJ3IKEC.js";
 import {
   accountProviderError,
   appCode,
@@ -38,7 +39,7 @@ import {
   method,
   parseProviderError,
   toPromise
-} from "./chunk-JGLXI6SU.js";
+} from "./chunk-ZR7QAG67.js";
 import {
   AccountCheckResult,
   DeclaredProvider,
@@ -86,13 +87,14 @@ import {
   defaultWebhookTransportLimits,
   maxInputProblems,
   migrationsDirectory,
+  normalizePlacements,
   reservedTablePrefix,
   sqlBindingsLimit,
   workflowDurationMillis
-} from "./chunk-M3IIZDHH.js";
+} from "./chunk-JW5LYSER.js";
 import {
   CacheError
-} from "./chunk-4733J7FG.js";
+} from "./chunk-7LMU3ER3.js";
 import {
   AppSkills,
   SkillFile
@@ -1191,6 +1193,9 @@ function declaredExposure(exposure) {
   const raw = named("raw");
   return { ...plain.length === 0 ? {} : { plain }, ...raw.length === 0 ? {} : { raw } };
 }
+function declaredPlacements(request) {
+  return request === void 0 || request.length === 0 ? {} : { request: normalizePlacements(request) };
+}
 function providerDeclaration(provider) {
   return declarationSafe(
     () => Effect_exports.gen(function* () {
@@ -1202,7 +1207,8 @@ function providerDeclaration(provider) {
               type: "secrets",
               label: method2.label,
               fields: yield* jsonSchemaDocument(method2.fields),
-              ...declaredExposure(method2.exposure)
+              ...declaredExposure(method2.exposure),
+              ...declaredPlacements(method2.request)
             });
             break;
           case "oauth2":
@@ -1210,7 +1216,8 @@ function providerDeclaration(provider) {
               type: "oauth2",
               ...method2.config,
               response: yield* jsonSchemaDocument(method2.response),
-              ...declaredExposure(method2.exposure)
+              ...declaredExposure(method2.exposure),
+              ...declaredPlacements(method2.request)
             });
             break;
         }
@@ -1260,8 +1267,16 @@ function canonical(value) {
   }
   return JSON.stringify(value);
 }
-function withoutHosts({ hosts: _hosts, ...provider }) {
-  return provider;
+function withoutGrants({ hosts: _hosts, ...provider }) {
+  return {
+    ...provider,
+    auth: Object.fromEntries(
+      Object.entries(provider.auth).map(([name, { request: _request, ...method2 }]) => [
+        name,
+        method2
+      ])
+    )
+  };
 }
 function bindAccounts(slots, declarations, context) {
   return safe2(
@@ -1288,14 +1303,17 @@ function bindAccounts(slots, declarations, context) {
         for (const account of accounts) {
           if (ids.has(account.id)) return yield* Effect_exports.fail(new HostAccountsInvalid());
           ids.add(account.id);
-          if (canonical(withoutHosts(account.provider)) !== canonical(withoutHosts(requirement.definition)) || !Object.hasOwn(provider.auth, account.method))
+          if (canonical(withoutGrants(account.provider)) !== canonical(withoutGrants(requirement.definition)) || !Object.hasOwn(provider.auth, account.method))
             return yield* Effect_exports.fail(new HostAccountsInvalid());
           const method2 = provider.auth[account.method];
           if (method2 === void 0) return yield* Effect_exports.fail(new HostAccountsInvalid());
           const fields = yield* Schema_exports.decodeUnknownEffect(
             method2._tag === "secrets" ? method2.fields : method2.response
           )(account.fields);
-          values.push({ id: account.id, method: account.method, fields });
+          const granted = Object.hasOwn(account.provider.auth, account.method) ? account.provider.auth[account.method]?.request : void 0;
+          values.push(
+            withPlacements({ id: account.id, method: account.method, fields }, granted)
+          );
         }
         if (many) bound.set(slot, values);
         else {

package/js/{chunk-YAOYLBKS.js → chunk-ECCWT5GJ.js}

@@ -2,10 +2,10 @@ import {
   fromPromise,
   method,
   toPromise
-} from "./chunk-JGLXI6SU.js";
+} from "./chunk-ZR7QAG67.js";
 import {
   CacheError
-} from "./chunk-4733J7FG.js";
+} from "./chunk-7LMU3ER3.js";
 import {
   wrap
 } from "./chunk-KGCTYL2S.js";

package/js/{chunk-XUG423KM.js → chunk-FZB6D6ZD.js}

@@ -4,12 +4,12 @@ import {
 import {
   joinPath,
   mergeMeta
-} from "./chunk-2KVS7XBO.js";
+} from "./chunk-ZEJ3IKEC.js";
 import {
   isShortenedUpstream,
   parseProviderError,
   providerError
-} from "./chunk-JGLXI6SU.js";
+} from "./chunk-ZR7QAG67.js";
 import {
   ApiErrorResponse,
   HostDeclarationInvalid,
@@ -21,7 +21,7 @@ import {
   McpError,
   McpError2,
   SkillLoadFailed as SkillLoadFailed2
-} from "./chunk-M3IIZDHH.js";
+} from "./chunk-JW5LYSER.js";
 import {
   CacheError,
   FailureCode,
@@ -33,7 +33,7 @@ import {
   maxFailureFields,
   maxFailureMessageLength,
   maxUpstreamMessageLength
-} from "./chunk-4733J7FG.js";
+} from "./chunk-7LMU3ER3.js";
 import {
   SkillLoadFailed,
   skillFormatLimits

package/js/{chunk-6MJUPGMI.js → chunk-GJSNQSR7.js}

@@ -1,11 +1,11 @@
 import {
   fixedRouter
-} from "./chunk-XUG423KM.js";
+} from "./chunk-FZB6D6ZD.js";
 import {
   nativeOperation,
   operationDeclaration,
   routerDeclaration
-} from "./chunk-2KVS7XBO.js";
+} from "./chunk-ZEJ3IKEC.js";
 
 // src/implementation/protocol-operations.ts
 var protocolOperations = (operations, kinds = {}) => {