apps 0.0.1-beta.68 → 0.0.1-beta.69

package/js/{chunk-M3IIZDHH.js → chunk-JW5LYSER.js}

@@ -6,7 +6,7 @@ import {
   FailureName,
   ProviderError,
   UpstreamError
-} from "./chunk-4733J7FG.js";
+} from "./chunk-7LMU3ER3.js";
 import {
   AppSkillName,
   AppSkills
@@ -23,6 +23,7 @@ import {
 import {
   Any,
   ArraySchema,
+  Base64_exports,
   Boolean,
   Class2 as Class,
   Context_exports,
@@ -2028,6 +2029,63 @@ var EmittedEvents = Schema_exports.Array(EmittedEvent).check(
   Schema_exports.isMaxLength(defaultEventLimits.maxEventsPerInvocation)
 );
 
+// src/contracts/placement.ts
+var PlacementField = Schema_exports.Struct({ field: Schema_exports.NonEmptyString });
+var PlacementText = Schema_exports.Union([Schema_exports.String, PlacementField]);
+var PlacementBase64 = Schema_exports.Struct({
+  base64: Schema_exports.Array(PlacementText).check(Schema_exports.isMinLength(1))
+});
+var PlacementPart = Schema_exports.Union([Schema_exports.String, PlacementField, PlacementBase64]);
+var template = Schema_exports.Array(PlacementPart).check(Schema_exports.isMinLength(1));
+var PlacementHeaderName = Schema_exports.String.check(
+  Schema_exports.isPattern(/^[!#$%&'*+.^_`|~0-9a-z-]+$/u)
+);
+var Placement = Schema_exports.Union([
+  Schema_exports.Struct({ in: Schema_exports.Literal("header"), name: PlacementHeaderName, value: template }),
+  Schema_exports.Struct({ in: Schema_exports.Literal("query"), name: Schema_exports.NonEmptyString, value: template })
+]);
+var Placements = Schema_exports.Array(Placement);
+var isPlacementField = (part) => typeof part === "object" && "field" in part;
+var placementFields = (placement) => new Set(
+  placement.value.flatMap(
+    (part) => typeof part === "string" ? [] : isPlacementField(part) ? [part.field] : part.base64.flatMap((text) => typeof text === "string" ? [] : [text.field])
+  )
+);
+var canonical = Schema_exports.encodeSync(Schema_exports.fromJsonString(Placement));
+var placementKey = (placement) => canonical(placement);
+var normalizePlacements = (placements) => [...new Map(placements.map((placement) => [placementKey(placement), placement])).entries()].sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([, placement]) => placement);
+var PlacementFieldMissing = class extends Schema_exports.TaggedError()(
+  "PlacementFieldMissing",
+  { field: Schema_exports.String }
+) {
+  get message() {
+    return `The credential placement references the account field "${this.field}", which has no string value.`;
+  }
+};
+var renderPlacement = (placement, fields) => {
+  const text = (parts) => {
+    let rendered2 = "";
+    for (const part of parts) {
+      if (typeof part === "string") {
+        rendered2 += part;
+        continue;
+      }
+      const value = Object.hasOwn(fields, part.field) ? fields[part.field] : void 0;
+      if (typeof value !== "string")
+        return Result_exports.fail(new PlacementFieldMissing({ field: part.field }));
+      rendered2 += value;
+    }
+    return Result_exports.succeed(rendered2);
+  };
+  let rendered = "";
+  for (const part of placement.value) {
+    const value = typeof part === "string" || isPlacementField(part) ? text([part]) : Result_exports.map(text(part.base64), (inner) => Base64_exports.encode(inner));
+    if (Result_exports.isFailure(value)) return value;
+    rendered += value.success;
+  }
+  return Result_exports.succeed(rendered);
+};
+
 // src/contracts/provider.ts
 var SecretsMethod = class extends Data_exports.TaggedClass(
   "secrets"
@@ -2184,7 +2242,7 @@ var ManyAccounts = class extends Data_exports.TaggedClass("many") {
 };
 
 // src/contracts/protocol-version.ts
-var frameworkProtocol = 11;
+var frameworkProtocol = 12;
 
 // src/contracts/protocols/oauth.ts
 var HttpUrl2 = Schema_exports.String.check(
@@ -3799,7 +3857,14 @@ var exposure2 = {
   /** Not secret: app code reads the real value and forms show it. */
   plain: Schema_exports.optionalKey(Schema_exports.Array(Schema_exports.NonEmptyString)),
   /** Secret, but app code reads the real value, for signing and similar uses. */
-  raw: Schema_exports.optionalKey(Schema_exports.Array(Schema_exports.NonEmptyString))
+  raw: Schema_exports.optionalKey(Schema_exports.Array(Schema_exports.NonEmptyString)),
+  /**
+   * The only places the outbound network substitutes this method's secret fields: whole header
+   * values and query parameters, each an exact template. Part of the provider's identity. In an
+   * invocation, an account's provider carries the placements granted to that account, which can
+   * be narrower than the app's declaration.
+   */
+  request: Schema_exports.optionalKey(Placements)
 };
 var DeclaredAuthMethod4 = Schema_exports.Union([
   Schema_exports.Struct({
@@ -4120,6 +4185,14 @@ var current = {
 };
 
 // src/contracts/host.ts
+var HostAccount = Schema_exports.Struct({
+  ...ResolvedAccount4.fields,
+  managed: Schema_exports.optionalKey(Schema_exports.Literal(true))
+});
+var HostAccounts = Schema_exports.Record(
+  Schema_exports.NonEmptyString,
+  Schema_exports.Union([HostAccount, Schema_exports.Array(HostAccount)])
+);
 var skillsCommand = (sources) => sources ? { operation: "skills", sources: true } : { operation: "skills" };
 var skillCatalog = (response) => Schema_exports.is(SkillSources3)(response) ? response : { skills: response };
 var inspectCommand = (tools, scheduled) => ({
@@ -4191,6 +4264,7 @@ export {
   SecretsMethod,
   OAuthClientAuth,
   OAuthSecretClientAuth,
+  OAuthAuthorizationParams,
   OAuthTokenRequestFormat,
   OAuthTokenResponse,
   OAuth2Config,
@@ -4200,6 +4274,19 @@ export {
   AccountCheckResult,
   Provider,
   ManyAccounts,
+  PlacementField,
+  PlacementText,
+  PlacementBase64,
+  PlacementPart,
+  PlacementHeaderName,
+  Placement,
+  Placements,
+  isPlacementField,
+  placementFields,
+  placementKey,
+  normalizePlacements,
+  PlacementFieldMissing,
+  renderPlacement,
   maxApiErrorInstructionsLength,
   ApiErrorRecovery,
   maxApiErrorMessageLength,
@@ -4328,6 +4415,8 @@ export {
   HostResponse6 as HostResponse,
   HostInvocation7 as HostInvocation,
   current,
+  HostAccount,
+  HostAccounts,
   skillsCommand,
   skillCatalog,
   inspectCommand,

package/js/{chunk-UD4RXDWG.js → chunk-MHB7IFG7.js}

@@ -5,7 +5,7 @@ import {
   networkRefusalHeader,
   networkRefusalStatus,
   supportedFetchOptions
-} from "./chunk-4733J7FG.js";
+} from "./chunk-7LMU3ER3.js";
 import {
   invocationFetch
 } from "./chunk-3CVQ3VPP.js";

package/js/{chunk-C47A664A.js → chunk-RUP4JMKO.js}

@@ -3,7 +3,7 @@ import {
   CacheEntry,
   CacheError,
   cacheLimits
-} from "./chunk-4733J7FG.js";
+} from "./chunk-7LMU3ER3.js";
 import {
   Clock_exports,
   Duration_exports,

package/js/{chunk-2KVS7XBO.js → chunk-ZEJ3IKEC.js}

@@ -1,12 +1,12 @@
 import {
   fromPromise
-} from "./chunk-JGLXI6SU.js";
+} from "./chunk-ZR7QAG67.js";
 import {
   HostedTool,
   RouterKey,
   RouterMeta,
   reservedRouterKeys
-} from "./chunk-M3IIZDHH.js";
+} from "./chunk-JW5LYSER.js";
 import {
   decoderOf,
   schemaArgument

package/js/{chunk-JGLXI6SU.js → chunk-ZR7QAG67.js}

@@ -1,7 +1,7 @@
 import {
   ProviderError,
   maxUpstreamMessageLength
-} from "./chunk-4733J7FG.js";
+} from "./chunk-7LMU3ER3.js";
 import {
   owned
 } from "./chunk-3CVQ3VPP.js";

package/js/contracts.js

@@ -24,7 +24,9 @@ import {
   EventLimits,
   EventName,
   FormElicitation,
+  HostAccount,
   HostAccountCheckError,
+  HostAccounts,
   HostAccountsInvalid,
   HostCallError,
   HostDataError,
@@ -66,12 +68,21 @@ import {
   MigrateCommand,
   MigrateResult,
   NonRetryableError,
+  OAuthAuthorizationParams,
   OAuthClientAuth,
   OAuthSecretClientAuth,
   OAuthTokenRequestFormat,
   OAuthTokenResponse,
   OpenapiResponseError,
   OperationSchedule,
+  Placement,
+  PlacementBase64,
+  PlacementField,
+  PlacementFieldMissing,
+  PlacementHeaderName,
+  PlacementPart,
+  PlacementText,
+  Placements,
   ResolvedAccount,
   ResolvedAccounts,
   RouterIcon,
@@ -111,10 +122,14 @@ import {
   frameworkProtocol,
   indexCommand,
   inspectCommand,
+  isPlacementField,
   maxApiErrorInstructionsLength,
   maxApiErrorMessageLength,
   maxInputProblems,
   minimumIntervalMilliseconds,
+  normalizePlacements,
+  placementFields,
+  placementKey,
   protocol1,
   protocol10,
   protocol2,
@@ -125,11 +140,12 @@ import {
   protocol7,
   protocol8,
   protocol9,
+  renderPlacement,
   selectTools,
   skillCatalog,
   skillsCommand,
   workflowDurationMillis
-} from "./chunk-M3IIZDHH.js";
+} from "./chunk-JW5LYSER.js";
 import {
   FailureCode,
   FailureDetail,
@@ -152,7 +168,7 @@ import {
   networkRefusalHeader,
   networkRefusalResponse,
   networkRefusalStatus
-} from "./chunk-4733J7FG.js";
+} from "./chunk-7LMU3ER3.js";
 import {
   AppSkillMetadata,
   AppSkillName,
@@ -215,7 +231,9 @@ export {
   FailureSource,
   FetchOptionUnsupported,
   FormElicitation,
+  HostAccount,
   HostAccountCheckError,
+  HostAccounts,
   HostAccountsInvalid,
   HostCallError,
   HostDataError,
@@ -260,12 +278,21 @@ export {
   NetworkRefusal,
   NetworkRefused,
   NonRetryableError,
+  OAuthAuthorizationParams,
   OAuthClientAuth,
   OAuthSecretClientAuth,
   OAuthTokenRequestFormat,
   OAuthTokenResponse,
   OpenapiResponseError,
   OperationSchedule,
+  Placement,
+  PlacementBase64,
+  PlacementField,
+  PlacementFieldMissing,
+  PlacementHeaderName,
+  PlacementPart,
+  PlacementText,
+  Placements,
   ProviderError,
   ResolvedAccount,
   ResolvedAccounts,
@@ -310,6 +337,7 @@ export {
   frameworkProtocol,
   indexCommand,
   inspectCommand,
+  isPlacementField,
   maxApiErrorInstructionsLength,
   maxApiErrorMessageLength,
   maxFailureFieldLength,
@@ -321,6 +349,9 @@ export {
   networkRefusalHeader,
   networkRefusalResponse,
   networkRefusalStatus,
+  normalizePlacements,
+  placementFields,
+  placementKey,
   protocol1,
   protocol10,
   current as protocol11,
@@ -332,6 +363,7 @@ export {
   protocol7,
   protocol8,
   protocol9,
+  renderPlacement,
   selectTools,
   skillCatalog,
   skillFormatLimits,

package/js/effect.js

@@ -3,18 +3,18 @@ import {
   ApprovalDecision,
   createAppHandler,
   prepareElicitation
-} from "./chunk-6JN66722.js";
-import "./chunk-C47A664A.js";
-import "./chunk-XUG423KM.js";
-import "./chunk-UD4RXDWG.js";
+} from "./chunk-DZN5TQ53.js";
+import "./chunk-RUP4JMKO.js";
+import "./chunk-FZB6D6ZD.js";
+import "./chunk-MHB7IFG7.js";
 import "./chunk-XBG7HHXC.js";
-import "./chunk-L7ZC6JR4.js";
-import "./chunk-2KVS7XBO.js";
-import "./chunk-JGLXI6SU.js";
+import "./chunk-3R3KFCDU.js";
+import "./chunk-ZEJ3IKEC.js";
+import "./chunk-ZR7QAG67.js";
 import {
   ToolAnnotations
-} from "./chunk-M3IIZDHH.js";
-import "./chunk-4733J7FG.js";
+} from "./chunk-JW5LYSER.js";
+import "./chunk-7LMU3ER3.js";
 import "./chunk-H72MEDMN.js";
 import {
   compileJsonSchemaDecoder,

package/js/graphql.js

@@ -1,35 +1,35 @@
 import {
   catalogCache,
   catalogScope
-} from "./chunk-YAOYLBKS.js";
+} from "./chunk-ECCWT5GJ.js";
 import {
   protocolOperations
-} from "./chunk-6MJUPGMI.js";
+} from "./chunk-GJSNQSR7.js";
 import "./chunk-BCSNKUAC.js";
-import "./chunk-6JN66722.js";
+import "./chunk-DZN5TQ53.js";
 import {
   cacheKey
-} from "./chunk-C47A664A.js";
-import "./chunk-XUG423KM.js";
+} from "./chunk-RUP4JMKO.js";
+import "./chunk-FZB6D6ZD.js";
 import {
   failOnNetworkRefusal
-} from "./chunk-UD4RXDWG.js";
+} from "./chunk-MHB7IFG7.js";
 import "./chunk-XBG7HHXC.js";
-import "./chunk-L7ZC6JR4.js";
+import "./chunk-3R3KFCDU.js";
 import {
   nativeOperation,
   routerDeclaration
-} from "./chunk-2KVS7XBO.js";
+} from "./chunk-ZEJ3IKEC.js";
 import {
   accountProviderError,
   graphqlProviderError,
   httpProviderError
-} from "./chunk-JGLXI6SU.js";
-import "./chunk-M3IIZDHH.js";
+} from "./chunk-ZR7QAG67.js";
+import "./chunk-JW5LYSER.js";
 import {
   NetworkRefused,
   ProviderError
-} from "./chunk-4733J7FG.js";
+} from "./chunk-7LMU3ER3.js";
 import "./chunk-H72MEDMN.js";
 import {
   jsonSchemaDecoder

package/js/host.js

@@ -1,13 +1,13 @@
 import {
   createAppHandler
-} from "./chunk-6JN66722.js";
-import "./chunk-C47A664A.js";
-import "./chunk-XUG423KM.js";
-import "./chunk-UD4RXDWG.js";
+} from "./chunk-DZN5TQ53.js";
+import "./chunk-RUP4JMKO.js";
+import "./chunk-FZB6D6ZD.js";
+import "./chunk-MHB7IFG7.js";
 import "./chunk-XBG7HHXC.js";
-import "./chunk-L7ZC6JR4.js";
-import "./chunk-2KVS7XBO.js";
-import "./chunk-JGLXI6SU.js";
+import "./chunk-3R3KFCDU.js";
+import "./chunk-ZEJ3IKEC.js";
+import "./chunk-ZR7QAG67.js";
 import {
   ElicitationFailed,
   ElicitationReply,
@@ -22,12 +22,12 @@ import {
   WorkflowRun,
   WorkflowRunId,
   WorkflowRunPage
-} from "./chunk-M3IIZDHH.js";
+} from "./chunk-JW5LYSER.js";
 import {
   CacheCommand,
   CacheError,
   CacheReply
-} from "./chunk-4733J7FG.js";
+} from "./chunk-7LMU3ER3.js";
 import "./chunk-H72MEDMN.js";
 import "./chunk-KGCTYL2S.js";
 import {

package/js/index.js

@@ -1,27 +1,34 @@
 import {
   ResponseDecodeError,
   ResponseStatusError,
+  base64,
+  basic,
+  bearer,
+  declarePlacements,
   defineApp,
   event,
+  header,
+  query,
+  t,
   workflow
-} from "./chunk-L7ZC6JR4.js";
+} from "./chunk-3R3KFCDU.js";
 import {
   dynamicRouter,
   mutation,
   nativeOperation,
   nativeRouter,
   operationDeclaration,
-  query,
+  query as query2,
   router,
   routerDeclaration,
   toolAnnotations,
   withApproval,
   withApprovals
-} from "./chunk-2KVS7XBO.js";
+} from "./chunk-ZEJ3IKEC.js";
 import {
   accountProviderError,
   fromPromise
-} from "./chunk-JGLXI6SU.js";
+} from "./chunk-ZR7QAG67.js";
 import {
   CalendarSchedule,
   ElicitationFailed,
@@ -36,13 +43,13 @@ import {
   ScheduleTiming,
   SecretsMethod,
   WorkflowFailure
-} from "./chunk-M3IIZDHH.js";
+} from "./chunk-JW5LYSER.js";
 import {
   CacheError,
   FetchOptionUnsupported,
   NetworkRefused,
   ProviderError
-} from "./chunk-4733J7FG.js";
+} from "./chunk-7LMU3ER3.js";
 import "./chunk-H72MEDMN.js";
 import {
   array,
@@ -93,15 +100,25 @@ var decodeJson = (response, schema) => Effect_exports.gen(function* () {
 
 // src/implementation/provider.ts
 var secrets = (options) => new SecretsMethod(options);
-var oauth2 = (config, response, exposure) => parse(OAuth2Config, config).pipe(
+var oauth2 = (config, response, exposure, request) => parse(OAuth2Config, config).pipe(
   Effect_exports.map(
-    (config2) => new OAuth2Method({ config: config2, response, ...exposure === void 0 ? {} : { exposure } })
+    (config2) => new OAuth2Method({
+      config: config2,
+      response,
+      ...exposure === void 0 ? {} : { exposure },
+      ...request === void 0 ? {} : { request }
+    })
   )
 );
 var defineProvider = ({
   health,
   ...options
 }) => {
+  const placed = Object.entries(options.auth).filter(([, method]) => method.request !== void 0);
+  if (options.hosts === void 0 && placed.length > 0)
+    throw new TypeError(
+      `Provider "${options.name}" declares a request for ${placed.map(([name]) => name).join(", ")} but no hosts. Declare the hosts its credentials may be sent to.`
+    );
   if (health === void 0) return new Provider(options);
   const run = fromPromise(health, "check");
   return new Provider({ ...options, health: { run } });
@@ -392,16 +409,37 @@ var exposureOf = (schema) => {
   const marked = "fields" in schema && isFields(schema.fields) ? fieldExposure(schema.fields) : {};
   return Object.keys(marked).length === 0 ? {} : { exposure: marked };
 };
+var fieldNames = (schema) => "fields" in schema && isFields(schema.fields) ? Object.keys(schema.fields) : schema === OAuth2AccessToken2 ? ["access_token"] : [];
+var placementsOf = (method, schema, request) => request === void 0 ? {} : {
+  request: declarePlacements(
+    method,
+    fieldNames(schema),
+    exposureOf(schema).exposure,
+    request
+  )
+};
 var OAuth2AccessToken2 = wrap(OAuth2AccessToken, false);
 var secrets2 = (options) => secrets({
   label: options.label,
   fields: accountDecoder(options.fields),
-  ...exposureOf(options.fields)
+  ...exposureOf(options.fields),
+  // SAFETY: the callback receives references named by the schema's own keys.
+  ...placementsOf(
+    `"${options.label}"`,
+    options.fields,
+    options.request
+  )
 });
 function oauth22(options) {
-  const { response = OAuth2AccessToken2, ...config } = options;
+  const { response = OAuth2AccessToken2, request, ...config } = options;
   return Effect_exports.runSync(
-    oauth2(config, accountDecoder(response), exposureOf(response).exposure)
+    oauth2(
+      config,
+      accountDecoder(response),
+      exposureOf(response).exposure,
+      // SAFETY: the callback receives references named by the response projection's own keys.
+      placementsOf("OAuth", response, request).request
+    )
   );
 }
 var decodeJson2 = (response, schema) => {
@@ -421,6 +459,10 @@ var decodeJson2 = (response, schema) => {
   };
   return Effect_exports.runPromise(decodeJson(native, decoderOf(schema)));
 };
+function query3(first, second) {
+  if (typeof first === "string") return query(first, second);
+  return query2(...[first, second]);
+}
 export {
   CacheError,
   ElicitationFailed,
@@ -436,6 +478,9 @@ export {
   WorkflowFailure,
   accountRouter,
   array,
+  base64,
+  basic,
+  bearer,
   boolean,
   cron,
   decodeJson2 as decodeJson,
@@ -444,6 +489,7 @@ export {
   dynamicRouter,
   dynamicSkills,
   event,
+  header,
   interval,
   json,
   jsonSchema,
@@ -453,12 +499,13 @@ export {
   oauth22 as oauth2,
   object,
   plain,
-  query,
+  query3 as query,
   raw,
   record,
   router,
   secrets2 as secrets,
   string,
+  t,
   toolAnnotations,
   withApproval,
   withApprovals,

package/js/mcp/effect.js

@@ -2,19 +2,19 @@ import {
   mcpClientEffect,
   mcpHealthEffect,
   mcpToolsEffect
-} from "../chunk-3K5SX2M6.js";
-import "../chunk-ACJPBBNH.js";
+} from "../chunk-CY4MT7PI.js";
+import "../chunk-CXDAEGXB.js";
 import "../chunk-BCSNKUAC.js";
-import "../chunk-6JN66722.js";
-import "../chunk-C47A664A.js";
-import "../chunk-XUG423KM.js";
-import "../chunk-UD4RXDWG.js";
+import "../chunk-DZN5TQ53.js";
+import "../chunk-RUP4JMKO.js";
+import "../chunk-FZB6D6ZD.js";
+import "../chunk-MHB7IFG7.js";
 import "../chunk-XBG7HHXC.js";
-import "../chunk-L7ZC6JR4.js";
-import "../chunk-2KVS7XBO.js";
-import "../chunk-JGLXI6SU.js";
-import "../chunk-M3IIZDHH.js";
-import "../chunk-4733J7FG.js";
+import "../chunk-3R3KFCDU.js";
+import "../chunk-ZEJ3IKEC.js";
+import "../chunk-ZR7QAG67.js";
+import "../chunk-JW5LYSER.js";
+import "../chunk-7LMU3ER3.js";
 import "../chunk-H72MEDMN.js";
 import "../chunk-KGCTYL2S.js";
 import "../chunk-3CVQ3VPP.js";

package/js/mcp/stdio.js

@@ -3,24 +3,24 @@ import {
   answeredError,
   mcpClient,
   mcpJsonSchemaValidator
-} from "../chunk-ACJPBBNH.js";
+} from "../chunk-CXDAEGXB.js";
 import {
   protocolRouter
-} from "../chunk-6MJUPGMI.js";
+} from "../chunk-GJSNQSR7.js";
 import "../chunk-BCSNKUAC.js";
-import "../chunk-6JN66722.js";
-import "../chunk-C47A664A.js";
-import "../chunk-XUG423KM.js";
-import "../chunk-UD4RXDWG.js";
+import "../chunk-DZN5TQ53.js";
+import "../chunk-RUP4JMKO.js";
+import "../chunk-FZB6D6ZD.js";
+import "../chunk-MHB7IFG7.js";
 import "../chunk-XBG7HHXC.js";
-import "../chunk-L7ZC6JR4.js";
-import "../chunk-2KVS7XBO.js";
-import "../chunk-JGLXI6SU.js";
+import "../chunk-3R3KFCDU.js";
+import "../chunk-ZEJ3IKEC.js";
+import "../chunk-ZR7QAG67.js";
 import {
   McpError,
   ProcessConfig
-} from "../chunk-M3IIZDHH.js";
-import "../chunk-4733J7FG.js";
+} from "../chunk-JW5LYSER.js";
+import "../chunk-7LMU3ER3.js";
 import "../chunk-H72MEDMN.js";
 import "../chunk-KGCTYL2S.js";
 import {