apps 0.0.1-beta.8 → 0.0.1-beta.81

package/js/react.js

@@ -2,11 +2,10 @@ import {
   AsyncResult_exports,
   AtomRegistry_exports,
   queryCommitted
-} from "./chunk-M3B3DE4K.js";
-import "./chunk-PJJ24GU7.js";
+} from "./chunk-74YVXBKY.js";
 import {
   Option_exports
-} from "./chunk-CDL5PM2Q.js";
+} from "./chunk-IFJU5SYQ.js";
 import "./chunk-CZ7CSFO4.js";
 
 // src/react.ts

package/js/skills/effect.js

@@ -1,9 +1,12 @@
 import {
   folderSkillsEffect,
   skillFromFiles
-} from "../chunk-IPI4MFSN.js";
-import "../chunk-JU7VHODU.js";
-import "../chunk-CDL5PM2Q.js";
+} from "../chunk-XBG7HHXC.js";
+import "../chunk-H72MEDMN.js";
+import "../chunk-5FHWNLCI.js";
+import "../chunk-TUMGL2OC.js";
+import "../chunk-EOPQ727L.js";
+import "../chunk-IFJU5SYQ.js";
 import "../chunk-CZ7CSFO4.js";
 export {
   folderSkillsEffect,

package/js/skills.js

@@ -1,15 +1,27 @@
 import {
-  catalogCache
-} from "./chunk-RFVIONFX.js";
-import "./chunk-NKLWZJLE.js";
+  catalogCache,
+  catalogScope
+} from "./chunk-TE25A7D6.js";
+import "./chunk-PL5KOEZD.js";
+import {
+  failOnNetworkRefusal
+} from "./chunk-I6Q7ZPKJ.js";
 import {
   folderSkillsEffect,
   skillFromFiles
-} from "./chunk-IPI4MFSN.js";
+} from "./chunk-XBG7HHXC.js";
+import {
+  accountProviderError,
+  fromPromise,
+  httpProviderError,
+  method,
+  toPromise
+} from "./chunk-W6XCQAXP.js";
 import {
-  httpProviderError
-} from "./chunk-MKWZPDR6.js";
-import "./chunk-R3EV5FTO.js";
+  NetworkRefused,
+  ProviderError,
+  networkRefusalStatus
+} from "./chunk-Q4IZAUIF.js";
 import {
   AppSkillMetadata,
   AppSkillSource,
@@ -19,24 +31,29 @@ import {
   SkillLoadFailed,
   SkillServiceName,
   skillLoadLimits
-} from "./chunk-JU7VHODU.js";
+} from "./chunk-H72MEDMN.js";
+import {
+  wrap
+} from "./chunk-KGCTYL2S.js";
+import "./chunk-QWQM3CLH.js";
 import {
   FetchHttpClient_exports
-} from "./chunk-57RKNWL2.js";
+} from "./chunk-PD6I2SDG.js";
+import "./chunk-5FHWNLCI.js";
+import "./chunk-H2CJWXA3.js";
+import "./chunk-TUMGL2OC.js";
 import {
   HttpBody_exports,
   HttpClient_exports
-} from "./chunk-UK573G7W.js";
-import {
-  wrap
-} from "./chunk-5T57N25Q.js";
-import "./chunk-27F7W2LG.js";
+} from "./chunk-EOPQ727L.js";
 import {
+  Base64_exports,
   Effect_exports,
+  Hex_exports,
   Ref_exports,
   Schema_exports,
   Stream_exports
-} from "./chunk-CDL5PM2Q.js";
+} from "./chunk-IFJU5SYQ.js";
 import "./chunk-CZ7CSFO4.js";
 
 // src/implementation/inflate.ts
@@ -592,13 +609,15 @@ var describe = (service, { reason, status }) => {
 };
 var withService = (service) => (effect) => service === void 0 || !Schema_exports.is(SkillServiceName)(service) ? effect : effect.pipe(
   Effect_exports.mapError(
-    (error) => !error.message ? new SkillLoadFailed({
+    (error) => Schema_exports.is(SkillLoadFailed)(error) && !error.message ? new SkillLoadFailed({
       reason: error.reason,
       message: describe(service, error),
-      ...error.status === void 0 ? {} : { status: error.status }
+      ...error.status === void 0 ? {} : { status: error.status },
+      ...error.missing === void 0 ? {} : { missing: error.missing }
     }) : error
   )
 );
+var loaderFailure = (error, otherwise) => Schema_exports.is(SkillLoadFailed)(error) || Schema_exports.is(NetworkRefused)(error) ? error : otherwise();
 var parse = (schema, input) => Schema_exports.decodeUnknownEffect(schema)(input).pipe(Effect_exports.mapError(() => failed("document")));
 var resourcePath = (path) => {
   if (!Schema_exports.is(SkillFilePath)(path)) return false;
@@ -614,23 +633,31 @@ var resourcePath = (path) => {
 var pathUrl = (base, path) => new URL(path.split("/").map(encodeURIComponent).join("/"), base).href;
 var reader = (transport) => Effect_exports.gen(function* () {
   const budget = yield* Ref_exports.make(0);
-  const fetchBytes = (url, post) => Effect_exports.gen(function* () {
+  const fetchBytes = (url, request = {}) => Effect_exports.gen(function* () {
     const parsed = yield* Effect_exports.try({
       try: () => new URL(url),
       catch: () => failed("source")
     });
     if (!["https:", "http:"].includes(parsed.protocol) || parsed.username || parsed.password || parsed.hash)
       return yield* failed("source");
+    const refusal = request.refused ?? ((refused) => refused);
     const client = HttpClient_exports.withScope(yield* HttpClient_exports.HttpClient);
     const headers = {
       "User-Agent": "executor-skills",
       Accept: "application/json, text/plain",
-      "Cache-Control": "no-cache"
+      "Cache-Control": "no-cache",
+      ...request.headers
     };
-    const response = yield* (post === void 0 ? client.get(parsed, { headers }) : client.post(parsed, {
-      headers: { ...headers, ...post.headers },
-      body: HttpBody_exports.uint8Array(post.body, post.headers["Content-Type"])
-    })).pipe(Effect_exports.mapError(() => failed("request")));
+    const response = yield* (request.body === void 0 ? client.get(parsed, { headers }) : client.post(parsed, {
+      headers,
+      body: HttpBody_exports.uint8Array(request.body, request.headers?.["Content-Type"])
+    })).pipe(
+      // `ctx.fetch` rejects with a network refusal; any other failed request got no answer.
+      Effect_exports.mapError(
+        (error) => Schema_exports.is(NetworkRefused)(error.cause) ? refusal(error.cause) : failed("request")
+      )
+    );
+    yield* failOnNetworkRefusal(response).pipe(Effect_exports.mapError(refusal));
     if (response.status < 200 || response.status >= 300)
       return yield* rejected(response.status, response.headers);
     const chunks = [];
@@ -660,7 +687,7 @@ var reader = (transport) => Effect_exports.gen(function* () {
     Effect_exports.provideService(FetchHttpClient_exports.RequestInit, { redirect: "manual" }),
     Effect_exports.provideService(FetchHttpClient_exports.Fetch, transport.fetch ?? globalThis.fetch)
   );
-  const read = (url) => fetchBytes(url).pipe(
+  const read = (url, request = {}) => fetchBytes(url, request).pipe(
     Effect_exports.flatMap(
       (result) => Effect_exports.try({
         try: () => new TextDecoder("utf-8", { fatal: true }).decode(result),
@@ -675,39 +702,68 @@ var unreadable = () => new SkillLoadFailed({
   reason: "request",
   message: "GitHub returned a git response Executor could not read."
 });
-var git = (run) => Effect_exports.tryPromise({
-  try: async () => run(),
-  catch: (error) => error instanceof InflateLimitExceeded ? failed("limit") : unreadable()
-});
-var resolveCommit = (remote, repo, ref) => Effect_exports.gen(function* () {
+var git = (run) => (
+  // oxlint-disable-next-line executor/authored-code-through-adapter -- this module's git parsing
+  Effect_exports.tryPromise({
+    try: async () => run(),
+    catch: (error) => error instanceof InflateLimitExceeded ? failed("limit") : unreadable()
+  })
+);
+var githubHosts = ["github.com", "raw.githubusercontent.com"];
+var githubRequests = (remote, repo, token) => {
+  const refused = (host) => (refusal) => refusal.refusal.reason === "credential_host" ? new SkillLoadFailed({
+    reason: "source",
+    status: networkRefusalStatus,
+    message: `A request with the GitHub token to ${host} was refused because the account's provider does not declare that host. The provider must declare hosts ${githubHosts.join(" and ")}; reconnect an account connected with other hosts.`
+  }) : refusal;
+  const upload = (body) => remote.fetchBytes(`https://${githubHosts[0]}/${repo}.git/git-upload-pack`, {
+    body,
+    headers: {
+      ...gitRequestHeaders,
+      ...token === void 0 ? {} : { Authorization: `Basic ${Base64_exports.encode(`x-access-token:${token}`)}` }
+    },
+    refused: refused(githubHosts[0])
+  });
+  const file = (commit, path) => remote.read(pathUrl(`https://${githubHosts[1]}/${repo}/${commit}/`, path), {
+    ...token === void 0 ? {} : { headers: { Authorization: `token ${token}` } },
+    refused: refused(githubHosts[1])
+  });
+  return { repo, authenticated: token !== void 0, upload, file };
+};
+var resolveCommit = (github, ref) => Effect_exports.gen(function* () {
+  const { repo } = github;
   if (ref !== void 0 && /^[a-f0-9]{40}$/.test(ref)) return ref;
   const names = refCandidates(ref);
-  const response = yield* remote.fetchBytes(`https://github.com/${repo}.git/git-upload-pack`, {
-    body: lsRefsRequest(names),
-    headers: gitRequestHeaders
-  }).pipe(
-    // GitHub asks for credentials when a repository is missing or private.
-    Effect_exports.mapError(
-      (error) => error.status === 401 || error.status === 404 ? new SkillLoadFailed({
-        reason: "source",
-        message: `GitHub has no public repository named ${repo}.`,
-        status: error.status
-      }) : error
-    )
+  const response = yield* github.upload(lsRefsRequest(names)).pipe(
+    Effect_exports.mapError((error) => {
+      if (!Schema_exports.is(SkillLoadFailed)(error) || error.reason !== "request") return error;
+      if (!github.authenticated && (error.status === 404 || error.status === 401))
+        return new SkillLoadFailed({
+          reason: "source",
+          message: `Reading GitHub repository ${repo} without credentials returned HTTP ${error.status}: it may not exist, or it may be private. To read a private repository, pass a GitHub account and its token.`,
+          status: error.status,
+          missing: "repository"
+        });
+      if (github.authenticated && error.status === 404)
+        return new SkillLoadFailed({
+          reason: "request",
+          message: `GitHub repository ${repo} is not available with the account's token (HTTP 404). Check the repository name and that the token can read it.`,
+          status: error.status
+        });
+      return error;
+    })
   );
   const refs = yield* git(() => parseLsRefs(response));
   const commit = names.map((name) => refs.get(name)).find((sha) => sha !== void 0);
   if (commit === void 0)
     return yield* new SkillLoadFailed({
       reason: "source",
-      message: `GitHub repository ${repo} has no branch or tag named ${ref}.`
+      message: `The refs read from GitHub repository ${repo} include no branch or tag named ${ref}.`,
+      missing: "ref"
     });
   return commit;
 });
-var listFiles = (remote, repo, commit, path) => remote.fetchBytes(`https://github.com/${repo}.git/git-upload-pack`, {
-  body: treeFetchRequest(commit),
-  headers: gitRequestHeaders
-}).pipe(
+var listFiles = (github, commit, path) => github.upload(treeFetchRequest(commit)).pipe(
   Effect_exports.flatMap(
     (response) => git(
       () => parseTreeFetch(response, commit, path, { objectBytes: skillLoadLimits.fileBytes })
@@ -720,8 +776,8 @@ var SkillDirectories = Schema_exports.Array(
     files: Schema_exports.Array(Schema_exports.Struct({ path: Schema_exports.String, mode: Schema_exports.String }))
   })
 );
-var skillDirectories = (remote, repo, commit, path) => Effect_exports.gen(function* () {
-  const files = yield* listFiles(remote, repo, commit, path);
+var skillDirectories = (github, commit, path) => Effect_exports.gen(function* () {
+  const files = yield* listFiles(github, commit, path);
   const documents = files.filter(
     (file) => file.path === "SKILL.md" || file.path.endsWith("/SKILL.md")
   );
@@ -733,55 +789,122 @@ var skillDirectories = (remote, repo, commit, path) => Effect_exports.gen(functi
     return yield* failed("limit");
   return directories;
 });
-var cachedSkillDirectories = (cache, transport, repo, commit, path) => Effect_exports.tryPromise({
-  try: () => cache.get({
-    key: ["apps/githubSkills/directories", 1, repo, commit, path ?? null],
-    schema: wrap(SkillDirectories, false),
-    freshFor: "7 days",
-    load: (context) => Effect_exports.runPromise(
-      // Keep the author's fetch, as every other read in this load does.
+var cachedSkillDirectories = (cache, transport, options, commit) => fromPromise(
+  method(cache, "get"),
+  "cache"
+)({
+  key: ["apps/githubSkills/directories", 1, options.repo, commit, options.path ?? null],
+  schema: wrap(SkillDirectories, false),
+  freshFor: "7 days",
+  // Executor's own loader: the app's cache runs it natively, so only its requests are upstream.
+  load: toPromise(
+    (context) => (
+      // Keep the author's fetch and this read's token, as every other request in it does.
       reader({ fetch: transport.fetch, signal: context.signal }).pipe(
-        Effect_exports.flatMap((remote) => skillDirectories(remote, repo, commit, path))
-      ),
-      { signal: context.signal }
+        Effect_exports.flatMap(
+          (remote) => skillDirectories(
+            githubRequests(remote, options.repo, options.token),
+            commit,
+            options.path
+          )
+        )
+      )
+    ),
+    // A cache may call the loader as a Promise; its own signal cancels that load.
+    (context) => context.signal
+  )
+}).pipe(
+  Effect_exports.mapError(
+    (error) => loaderFailure(
+      error,
+      () => new SkillLoadFailed({
+        reason: "request",
+        message: "Executor could not read or update the app cache for skills."
+      })
     )
-  }),
-  catch: (error) => Schema_exports.is(SkillLoadFailed)(error) ? error : new SkillLoadFailed({
-    reason: "request",
-    message: "Executor could not read or update the app cache for skills."
+  )
+);
+var digest = (value) => (
+  // oxlint-disable-next-line executor/authored-code-through-adapter -- Web Crypto
+  Effect_exports.promise(
+    () => crypto.subtle.digest("SHA-256", new TextEncoder().encode(JSON.stringify(value)))
+  ).pipe(Effect_exports.map((bytes) => Hex_exports.encode(new Uint8Array(bytes))))
+);
+var checked = (request) => request.pipe(
+  Effect_exports.timeoutOrElse({
+    duration: skillLoadLimits.checkMillis,
+    orElse: () => Effect_exports.fail(failed("request"))
   })
-});
-var cachedCatalog = (options, prefix, load) => options.cache === void 0 ? load(options, void 0) : catalogCache({
+);
+var cachedCatalog = (options, prefix, publication) => options.cache === void 0 ? publication(options, void 0).pipe(Effect_exports.flatMap((source) => source.load)) : catalogCache({
   cache: options.cache,
   ...options.freshFor === void 0 ? {} : { freshFor: options.freshFor },
   ...options.staleFor === void 0 ? {} : { staleFor: options.staleFor },
+  stale: "revalidate",
   prefix,
   schema: AppSkillSource,
   summary: { schema: AppSkillMetadata, of: ({ files: _files, ...metadata }) => metadata },
-  load: (context) => (context === void 0 ? load(options, options.cache) : load({ fetch: options.fetch, signal: context.signal }, context.cache)).pipe(Effect_exports.map((tools) => ({ tools })))
+  load: (context, kept) => Effect_exports.gen(function* () {
+    const source = yield* context === void 0 ? publication(options, options.cache) : publication({ fetch: options.fetch, signal: context.signal }, context.cache);
+    if (source.id === void 0) return { tools: yield* source.load };
+    const previous = kept === void 0 ? void 0 : yield* kept;
+    const tools = previous?.header?.["publication"] === source.id ? yield* previous.tools : yield* source.load;
+    return { tools, header: { publication: source.id } };
+  })
 }).pipe(
   Effect_exports.flatMap((catalog) => catalog.list()),
   Effect_exports.mapError(
-    (error) => Schema_exports.is(SkillLoadFailed)(error) ? error : new SkillLoadFailed({
-      reason: "request",
-      message: "Executor could not read or update the app cache for skills."
-    })
+    (error) => loaderFailure(
+      error,
+      () => new SkillLoadFailed({
+        reason: "request",
+        message: "Executor could not read or update the app cache for skills."
+      })
+    )
   )
 );
+var GitHubToken = Schema_exports.String.check(Schema_exports.isPattern(/^[\x21-\x7e]+$/u));
+var scopeMessages = {
+  "missing-account": "A GitHub token needs its account. Pass account: ctx.accounts.<slot> with it.",
+  "unselected-account": "The GitHub account is not one of this app's selected accounts."
+};
+var githubCache = (options) => options.account !== void 0 && !Schema_exports.is(GitHubToken)(options.token) ? Effect_exports.fail(
+  new SkillLoadFailed({
+    reason: "source",
+    message: "The GitHub account was passed without a valid token."
+  })
+) : catalogScope(
+  options,
+  options.token,
+  (problem) => new SkillLoadFailed({ reason: "source", message: scopeMessages[problem] })
+);
+var attributed = (account) => (error) => account !== void 0 && Schema_exports.is(SkillLoadFailed)(error) && error.reason === "request" && (error.status === 401 || error.status === 403) ? accountProviderError(
+  new ProviderError({
+    reason: error.status === 401 ? "unauthorized" : "rejected",
+    status: error.status
+  }),
+  account.id
+) : error;
 var githubSkillsEffect = (options) => Effect_exports.gen(function* () {
   if (!/^[A-Za-z0-9_.-]+\/[A-Za-z0-9_.-]+$/.test(options.repo) || options.path !== void 0 && !resourcePath(options.path))
     return yield* failed("source");
+  const cache = yield* githubCache(options);
   return yield* cachedCatalog(
-    options,
+    cache === void 0 ? options : { ...options, cache },
     ["apps/githubSkills/catalog", 1, options.repo, options.ref ?? null, options.path ?? null],
-    (transport, cache) => githubCatalog(options, transport, cache)
+    (transport, cache2) => githubPublication(options, transport, cache2)
   );
-}).pipe(withService("GitHub"));
-var githubCatalog = (options, transport, cache) => Effect_exports.gen(function* () {
-  const remote = yield* reader(transport);
-  const commit = yield* resolveCommit(remote, options.repo, options.ref);
-  const resources = yield* cache === void 0 ? skillDirectories(remote, options.repo, commit, options.path) : cachedSkillDirectories(cache, transport, options.repo, commit, options.path);
-  const base = `https://raw.githubusercontent.com/${options.repo}/${commit}/`;
+}).pipe(withService("GitHub"), Effect_exports.mapError(attributed(options.account)));
+var githubPublication = (options, transport, cache) => Effect_exports.gen(function* () {
+  const github = githubRequests(yield* reader(transport), options.repo, options.token);
+  const commit = yield* checked(resolveCommit(github, options.ref));
+  return {
+    id: commit,
+    load: githubCatalog(options, github, commit, transport, cache)
+  };
+});
+var githubCatalog = (options, github, commit, transport, cache) => Effect_exports.gen(function* () {
+  const resources = yield* cache === void 0 ? skillDirectories(github, commit, options.path) : cachedSkillDirectories(cache, transport, options, commit);
   const skills = yield* Effect_exports.forEach(
     resources,
     ({ directory, files }) => Effect_exports.gen(function* () {
@@ -791,7 +914,7 @@ var githubCatalog = (options, transport, cache) => Effect_exports.gen(function*
           const path = file.path.slice(directory.length);
           if (!resourcePath(file.path) || !resourcePath(path) || file.mode === "120000")
             return yield* failed("source");
-          return { path, content: yield* remote.read(pathUrl(base, file.path)) };
+          return { path, content: yield* github.file(commit, file.path) };
         }),
         { concurrency: skillLoadLimits.concurrency }
       );
@@ -825,13 +948,17 @@ var wellKnownSkillsEffect = (options) => Effect_exports.gen(function* () {
   return yield* cachedCatalog(
     options,
     ["apps/wellKnownSkills/catalog", 1, url.href],
-    (transport) => wellKnownCatalog(url, transport)
+    (transport) => wellKnownPublication(url, transport)
   );
 }).pipe(withService(URL.canParse(options.url) ? new URL(options.url).hostname : void 0));
-var wellKnownCatalog = (url, transport) => Effect_exports.gen(function* () {
+var wellKnownPublication = (url, transport) => Effect_exports.gen(function* () {
   const remote = yield* reader(transport);
-  const first = yield* remote.read(url.href);
+  const first = yield* checked(remote.read(url.href));
   const index = yield* parse(Schema_exports.fromJsonString(Index), first);
+  const id = index.skills.every((skill) => skill.version !== void 0) ? yield* digest(index.skills.map(({ name, version, files }) => [name, version, files])) : void 0;
+  return { id, load: wellKnownCatalog(url, remote, first, index) };
+});
+var wellKnownCatalog = (url, remote, first, index) => Effect_exports.gen(function* () {
   if (index.skills.reduce((count, skill) => count + skill.files.length, 0) > skillLoadLimits.files)
     return yield* failed("limit");
   const skills = yield* Effect_exports.forEach(