apps 0.0.1-beta.8 → 0.0.1-beta.81

package/js/index.js

@@ -1,27 +1,34 @@
 import {
   ResponseDecodeError,
   ResponseStatusError,
+  base64,
+  basic,
+  bearer,
+  declarePlacements,
   defineApp,
-  defineDatabase,
-  table,
+  event,
+  header,
+  query,
+  t,
   workflow
-} from "./chunk-YXQHV65J.js";
-import "./chunk-ZQINWV4W.js";
+} from "./chunk-5WGONRKQ.js";
 import {
   dynamicRouter,
-  fromPromise,
   mutation,
   nativeOperation,
   nativeRouter,
   operationDeclaration,
-  query,
+  query as query2,
   router,
   routerDeclaration,
-  withApproval
-} from "./chunk-Z5M2LQOZ.js";
+  toolAnnotations,
+  withApproval,
+  withApprovals
+} from "./chunk-OY47QPQY.js";
 import {
-  accountProviderError
-} from "./chunk-MKWZPDR6.js";
+  accountProviderError,
+  fromPromise
+} from "./chunk-W6XCQAXP.js";
 import {
   CalendarSchedule,
   ElicitationFailed,
@@ -36,19 +43,21 @@ import {
   ScheduleTiming,
   SecretsMethod,
   WorkflowFailure
-} from "./chunk-WLE7WX2U.js";
-import "./chunk-N7YDVXYJ.js";
+} from "./chunk-NG56RPCA.js";
 import {
   CacheError,
+  FetchOptionUnsupported,
+  NetworkRefused,
   ProviderError
-} from "./chunk-R3EV5FTO.js";
-import "./chunk-JU7VHODU.js";
+} from "./chunk-Q4IZAUIF.js";
+import "./chunk-H72MEDMN.js";
 import {
   array,
   boolean,
   decoderOf,
-  id,
+  fieldExposure,
   importedJsonSchema,
+  isSchema,
   json,
   jsonSchema,
   literal,
@@ -57,22 +66,27 @@ import {
   object,
   once,
   parse,
+  plain,
+  raw,
   record,
   string,
-  userId,
   withLazyJsonSchemaDocument,
   wrap
-} from "./chunk-5T57N25Q.js";
-import "./chunk-PZB6T6KU.js";
+} from "./chunk-KGCTYL2S.js";
+import "./chunk-QWQM3CLH.js";
+import "./chunk-PD6I2SDG.js";
+import "./chunk-5FHWNLCI.js";
 import {
   JsonObject,
   JsonValue,
   ValidationError
-} from "./chunk-27F7W2LG.js";
+} from "./chunk-H2CJWXA3.js";
+import "./chunk-TUMGL2OC.js";
+import "./chunk-EOPQ727L.js";
 import {
   Effect_exports,
   Schema_exports
-} from "./chunk-CDL5PM2Q.js";
+} from "./chunk-IFJU5SYQ.js";
 import "./chunk-CZ7CSFO4.js";
 
 // src/implementation/http.ts
@@ -86,27 +100,43 @@ var decodeJson = (response, schema) => Effect_exports.gen(function* () {
 
 // src/implementation/provider.ts
 var secrets = (options) => new SecretsMethod(options);
-var oauth2 = (config, response) => parse(OAuth2Config, config).pipe(Effect_exports.map((config2) => new OAuth2Method({ config: config2, response })));
+var oauth2 = (config, response, exposure, request) => parse(OAuth2Config, config).pipe(
+  Effect_exports.map(
+    (config2) => new OAuth2Method({
+      config: config2,
+      response,
+      ...exposure === void 0 ? {} : { exposure },
+      ...request === void 0 ? {} : { request }
+    })
+  )
+);
 var defineProvider = ({
   health,
   ...options
 }) => {
+  const placed = Object.entries(options.auth).filter(([, method]) => method.request !== void 0);
+  if (options.hosts === void 0 && placed.length > 0)
+    throw new TypeError(
+      `Provider "${options.name}" declares a request for ${placed.map(([name]) => name).join(", ")} but no hosts. Declare the hosts its credentials may be sent to.`
+    );
   if (health === void 0) return new Provider(options);
-  const run = fromPromise(health);
+  const run = fromPromise(health, "check");
   return new Provider({ ...options, health: { run } });
 };
 
 // src/implementation/account-router.ts
-var inputDocument = (operation) => {
-  const imported = importedJsonSchema(operation.input);
+var decoderDocument = (decoder) => {
+  const imported = importedJsonSchema(decoder);
   if (imported !== void 0) return Schema_exports.decodeUnknownSync(JsonObject)(imported);
-  const document = Schema_exports.toJsonSchemaDocument(operation.input);
+  const document = Schema_exports.toJsonSchemaDocument(decoder);
   return Schema_exports.decodeUnknownSync(JsonObject)({ ...document.schema, $defs: document.definitions });
 };
 var declaresOutput = (operation) => {
+  if (operation.output !== void 0) return true;
   const property = Object.getOwnPropertyDescriptor(operation, "outputSchema");
   return property !== void 0 && (property.get !== void 0 || property.value !== void 0);
 };
+var outputDocument = (operation) => operation.output === void 0 ? operation.outputSchema : decoderDocument(operation.output);
 var combineOperation = (accounts) => {
   const variants = [...accounts.values()];
   const first = variants[0];
@@ -129,7 +159,10 @@ var combineOperation = (accounts) => {
       type: "object",
       properties: {
         accountId: { type: "string", const: accountId },
-        input: nestJsonSchema(inputDocument(operation), `#/anyOf/${index}/properties/input`)
+        input: nestJsonSchema(
+          decoderDocument(operation.input),
+          `#/anyOf/${index}/properties/input`
+        )
       },
       required: ["accountId", "input"]
     }))
@@ -159,9 +192,10 @@ var combineOperation = (accounts) => {
   });
   if (variants.every(declaresOutput)) {
     const outputSchema = once(() => ({
-      anyOf: variants.flatMap(
-        (operation) => operation.outputSchema === void 0 ? [] : [operation.outputSchema]
-      ).map((output, index) => nestJsonSchema(output, `#/anyOf/${index}`))
+      anyOf: variants.flatMap((operation) => {
+        const output = outputDocument(operation);
+        return output === void 0 ? [] : [output];
+      }).map((output, index) => nestJsonSchema(output, `#/anyOf/${index}`))
     }));
     const native2 = nativeOperation(declaration2);
     if (native2 !== void 0)
@@ -218,7 +252,7 @@ var combineDynamic = (sources) => {
       );
       for (const tool of tools) {
         const variants = groups.get(tool.name) ?? [];
-        if (variants.some(([id2]) => id2 === accountId))
+        if (variants.some(([id]) => id === accountId))
           return yield* Effect_exports.die(new Error("Duplicate source operation"));
         variants.push([accountId, tool]);
         groups.set(tool.name, variants);
@@ -307,7 +341,7 @@ var accountRouter = (accounts, discover, options) => Effect_exports.runPromise(
     const routers = /* @__PURE__ */ new Map();
     for (const account of accounts) {
       const declaration2 = yield* Effect_exports.tryPromise({
-        try: () => discover(account),
+        try: async () => discover(account),
         catch: (error) => accountProviderError(error, account.id)
       });
       if (routers.has(account.id))
@@ -327,7 +361,7 @@ var accountRouter = (accounts, discover, options) => Effect_exports.runPromise(
 
 // src/implementation/dynamic-skills.ts
 var dynamicSkills = (source) => ({
-  list: fromPromise(async () => source.list())
+  list: fromPromise(async () => source.list(), "skills")
 });
 
 // src/contracts/app.ts
@@ -366,29 +400,74 @@ var cron = (calendar, operation, input) => declaration(
 );
 
 // src/index.ts
+var isFields = (value) => typeof value === "object" && value !== null && Object.values(value).every(isSchema);
+var accountDecoder = (schema) => (
+  // SAFETY: the brand exists only in types; secret values are strings at runtime.
+  decoderOf(schema)
+);
+var exposureOf = (schema) => {
+  const marked = "fields" in schema && isFields(schema.fields) ? fieldExposure(schema.fields) : {};
+  return Object.keys(marked).length === 0 ? {} : { exposure: marked };
+};
+var fieldNames = (schema) => "fields" in schema && isFields(schema.fields) ? Object.keys(schema.fields) : schema === OAuth2AccessToken2 ? ["access_token"] : [];
+var placementsOf = (method, schema, request) => request === void 0 ? {} : {
+  request: declarePlacements(
+    method,
+    fieldNames(schema),
+    exposureOf(schema).exposure,
+    request
+  )
+};
 var OAuth2AccessToken2 = wrap(OAuth2AccessToken, false);
-var secrets2 = (options) => secrets({ label: options.label, fields: decoderOf(options.fields) });
+var secrets2 = (options) => secrets({
+  label: options.label,
+  fields: accountDecoder(options.fields),
+  ...exposureOf(options.fields),
+  // SAFETY: the callback receives references named by the schema's own keys.
+  ...placementsOf(
+    `"${options.label}"`,
+    options.fields,
+    options.request
+  )
+});
 function oauth22(options) {
-  const { response = OAuth2AccessToken2, ...config } = options;
-  return Effect_exports.runSync(oauth2(config, decoderOf(response)));
+  const { response = OAuth2AccessToken2, request, ...config } = options;
+  return Effect_exports.runSync(
+    oauth2(
+      config,
+      accountDecoder(response),
+      exposureOf(response).exposure,
+      // SAFETY: the callback receives references named by the response projection's own keys.
+      placementsOf("OAuth", response, request).request
+    )
+  );
 }
 var decodeJson2 = (response, schema) => {
   const native = {
     status: response.status,
-    json: () => Effect_exports.tryPromise({
-      try: () => response.json(),
-      catch: (error) => error
-    }).pipe(
-      Effect_exports.catch(
-        (error) => error instanceof SyntaxError ? Effect_exports.fail(new ResponseDecodeError()) : Effect_exports.die(error)
+    json: () => (
+      // oxlint-disable-next-line executor/authored-code-through-adapter -- a Response the app passes from its own code
+      Effect_exports.tryPromise({
+        try: () => response.json(),
+        catch: (error) => error
+      }).pipe(
+        Effect_exports.catch(
+          (error) => error instanceof SyntaxError ? Effect_exports.fail(new ResponseDecodeError()) : Effect_exports.die(error)
+        )
       )
     )
   };
   return Effect_exports.runPromise(decodeJson(native, decoderOf(schema)));
 };
+function query3(first, second) {
+  if (typeof first === "string") return query(first, second);
+  return query2(...[first, second]);
+}
 export {
   CacheError,
   ElicitationFailed,
+  FetchOptionUnsupported,
+  NetworkRefused,
   NonRetryableError,
   NotImplemented,
   OAuth2AccessToken2 as OAuth2AccessToken,
@@ -399,15 +478,18 @@ export {
   WorkflowFailure,
   accountRouter,
   array,
+  base64,
+  basic,
+  bearer,
   boolean,
   cron,
   decodeJson2 as decodeJson,
   defineApp,
-  defineDatabase,
   defineProvider,
   dynamicRouter,
   dynamicSkills,
-  id,
+  event,
+  header,
   interval,
   json,
   jsonSchema,
@@ -416,13 +498,16 @@ export {
   number,
   oauth22 as oauth2,
   object,
-  query,
+  plain,
+  query3 as query,
+  raw,
   record,
   router,
   secrets2 as secrets,
   string,
-  table,
-  userId,
+  t,
+  toolAnnotations,
   withApproval,
+  withApprovals,
   workflow
 };

package/js/mcp/effect.js

@@ -1,30 +1,32 @@
 import {
   mcpClientEffect,
+  mcpHealthEffect,
   mcpToolsEffect
-} from "../chunk-OCYUEU47.js";
-import "../chunk-CMYUWAX7.js";
+} from "../chunk-WCGAO3X5.js";
+import "../chunk-YQUG4CES.js";
 import "../chunk-BCSNKUAC.js";
-import "../chunk-UESPOTUI.js";
-import "../chunk-NKLWZJLE.js";
-import "../chunk-FL2QR3XW.js";
-import "../chunk-IPI4MFSN.js";
-import "../chunk-YXQHV65J.js";
-import "../chunk-ZQINWV4W.js";
-import "../chunk-Z5M2LQOZ.js";
-import "../chunk-MKWZPDR6.js";
-import "../chunk-WLE7WX2U.js";
-import "../chunk-N7YDVXYJ.js";
-import "../chunk-R3EV5FTO.js";
-import "../chunk-JU7VHODU.js";
-import "../chunk-RJDDBDSN.js";
-import "../chunk-57RKNWL2.js";
-import "../chunk-UK573G7W.js";
-import "../chunk-5T57N25Q.js";
-import "../chunk-PZB6T6KU.js";
-import "../chunk-27F7W2LG.js";
-import "../chunk-CDL5PM2Q.js";
+import "../chunk-Z2SWTZCF.js";
+import "../chunk-PL5KOEZD.js";
+import "../chunk-HJG4RBYM.js";
+import "../chunk-I6Q7ZPKJ.js";
+import "../chunk-XBG7HHXC.js";
+import "../chunk-5WGONRKQ.js";
+import "../chunk-OY47QPQY.js";
+import "../chunk-W6XCQAXP.js";
+import "../chunk-NG56RPCA.js";
+import "../chunk-Q4IZAUIF.js";
+import "../chunk-H72MEDMN.js";
+import "../chunk-KGCTYL2S.js";
+import "../chunk-QWQM3CLH.js";
+import "../chunk-PD6I2SDG.js";
+import "../chunk-5FHWNLCI.js";
+import "../chunk-H2CJWXA3.js";
+import "../chunk-TUMGL2OC.js";
+import "../chunk-EOPQ727L.js";
+import "../chunk-IFJU5SYQ.js";
 import "../chunk-CZ7CSFO4.js";
 export {
   mcpClientEffect,
+  mcpHealthEffect,
   mcpToolsEffect
 };

package/js/mcp/stdio.js

@@ -1,37 +1,40 @@
 import {
   adaptMcpTools,
+  answeredError,
   mcpClient,
   mcpJsonSchemaValidator
-} from "../chunk-CMYUWAX7.js";
+} from "../chunk-YQUG4CES.js";
 import {
   protocolRouter
-} from "../chunk-72JNVHPK.js";
+} from "../chunk-4NFSABEA.js";
 import "../chunk-BCSNKUAC.js";
-import "../chunk-UESPOTUI.js";
-import "../chunk-NKLWZJLE.js";
-import "../chunk-FL2QR3XW.js";
-import "../chunk-IPI4MFSN.js";
-import "../chunk-YXQHV65J.js";
-import "../chunk-ZQINWV4W.js";
-import "../chunk-Z5M2LQOZ.js";
-import "../chunk-MKWZPDR6.js";
+import "../chunk-Z2SWTZCF.js";
+import "../chunk-PL5KOEZD.js";
+import "../chunk-HJG4RBYM.js";
+import "../chunk-I6Q7ZPKJ.js";
+import "../chunk-XBG7HHXC.js";
+import "../chunk-5WGONRKQ.js";
+import "../chunk-OY47QPQY.js";
+import "../chunk-W6XCQAXP.js";
 import {
   McpError,
   ProcessConfig
-} from "../chunk-WLE7WX2U.js";
-import "../chunk-N7YDVXYJ.js";
-import "../chunk-R3EV5FTO.js";
-import "../chunk-JU7VHODU.js";
-import "../chunk-RJDDBDSN.js";
-import "../chunk-57RKNWL2.js";
-import "../chunk-UK573G7W.js";
-import "../chunk-5T57N25Q.js";
-import "../chunk-PZB6T6KU.js";
-import "../chunk-27F7W2LG.js";
+} from "../chunk-NG56RPCA.js";
+import "../chunk-Q4IZAUIF.js";
+import "../chunk-H72MEDMN.js";
+import "../chunk-KGCTYL2S.js";
+import {
+  owned
+} from "../chunk-QWQM3CLH.js";
+import "../chunk-PD6I2SDG.js";
+import "../chunk-5FHWNLCI.js";
+import "../chunk-H2CJWXA3.js";
+import "../chunk-TUMGL2OC.js";
+import "../chunk-EOPQ727L.js";
 import {
   Effect_exports,
   Schema_exports
-} from "../chunk-CDL5PM2Q.js";
+} from "../chunk-IFJU5SYQ.js";
 import "../chunk-CZ7CSFO4.js";
 
 // src/implementation/mcp-stdio.ts
@@ -59,10 +62,14 @@ var OwnedTransport = class extends StdioClientTransport {
     })();
   }
 };
-var failure = (phase, error) => new McpError({
-  phase,
-  reason: error instanceof ProtocolError && error.code === ErrorCode.RequestTimeout ? "timeout" : "request"
-});
+var failure = (phase, error) => {
+  const upstream = answeredError(error);
+  return new McpError({
+    phase,
+    reason: error instanceof ProtocolError && error.code === ErrorCode.RequestTimeout ? "timeout" : "request",
+    ...upstream === void 0 ? {} : { upstream }
+  });
+};
 function withClient(config, mode, use) {
   return Effect_exports.scoped(
     Effect_exports.gen(function* () {
@@ -83,22 +90,25 @@ function withClient(config, mode, use) {
             stderr: "ignore"
           })
         })),
-        ({ client: client2, transport: transport2 }) => Effect_exports.tryPromise(async () => {
-          try {
-            await client2.close();
-          } finally {
-            await transport2.close();
-          }
-        }).pipe(Effect_exports.withSpan("provider.mcp.close"), Effect_exports.orDie)
+        ({ client: client2, transport: transport2 }) => (
+          // oxlint-disable-next-line executor/authored-code-through-adapter -- MCP SDK
+          Effect_exports.tryPromise(async () => {
+            try {
+              await client2.close();
+            } finally {
+              await transport2.close();
+            }
+          }).pipe(owned("upstream", "provider.mcp.close"), Effect_exports.orDie)
+        )
       );
       yield* Effect_exports.tryPromise({
         try: (signal) => client.connect(transport, { signal, timeout: config.timeoutMs }),
         catch: (error) => failure("connect", error)
-      }).pipe(Effect_exports.timeout(config.timeoutMs), Effect_exports.withSpan("provider.mcp.connect"));
+      }).pipe(Effect_exports.timeout(config.timeoutMs), owned("upstream", "provider.mcp.connect"));
       return yield* use(client);
     })
   ).pipe(
-    Effect_exports.withSpan("provider.mcp.session", {
+    owned("upstream", "provider.mcp.session", {
       attributes: { "mcp.transport": "stdio", "mcp.operation": mode }
     }),
     (operation) => mode === "discover" ? operation.pipe(Effect_exports.timeout(config.timeoutMs)) : operation,