apps 0.0.1-beta.89 → 0.0.1-beta.90

package/js/{chunk-6FUJH3T4.js → chunk-7PHHWYV4.js}

@@ -1,17 +1,18 @@
 import {
   appInvocationFetch
-} from "./chunk-5ZVAYXLT.js";
+} from "./chunk-YRGL4QEF.js";
 import {
   fromPromise,
   method,
   toPromise
-} from "./chunk-BZFFXNWA.js";
+} from "./chunk-I5C7FD5Z.js";
 import {
   CacheAcquired,
   CacheEntry,
   CacheError,
-  cacheLimits
-} from "./chunk-F2G534HD.js";
+  cacheLimits,
+  scopedSlots
+} from "./chunk-6XQLA5NC.js";
 import {
   decoderOf
 } from "./chunk-GQ33QSNB.js";
@@ -301,7 +302,7 @@ var authorCache = (host, accounts, signal, telemetry, deadline) => {
       write: service("write", cache.write),
       invalidate: service("invalidate", cache.invalidate),
       forAccount: (account) => {
-        const bound = Object.values(accounts).flatMap((value) => Array.isArray(value) ? value : [value]).find((value) => value.id === account.id);
+        const bound = scopedSlots(accounts).flatMap(([, value]) => Array.isArray(value) ? value : [value]).find((value) => value.id === account.id);
         if (bound === void 0) throw new CacheError({ reason: "invalid" });
         return scoped(
           { account: bound.id, method: bound.method, generation: bound.generation },

package/js/{chunk-7Z3NUCTP.js → chunk-DADXWWRZ.js}

@@ -2,11 +2,11 @@ import {
   declaredOperations,
   nativeOperation,
   nativeRouter
-} from "./chunk-GLXEYET6.js";
+} from "./chunk-YWFUWTUJ.js";
 import {
   fromPromise,
   method
-} from "./chunk-BZFFXNWA.js";
+} from "./chunk-I5C7FD5Z.js";
 import {
   EmittedEvent,
   EventName,
@@ -17,7 +17,7 @@ import {
   normalizePlacements,
   placementFields,
   renderPlacement
-} from "./chunk-NQW2E44U.js";
+} from "./chunk-6XQLA5NC.js";
 import {
   decoderOf,
   isSchema,
@@ -271,8 +271,8 @@ var makeEmitter = (input) => ({
     const filters = Schema_exports.decodeUnknownSync(Schema_exports.Struct(declared.filters))(
       options.filters ?? {}
     );
-    const account = options.account ?? input.sourceAccount ?? (input.accounts.length === 1 ? input.accounts[0] : void 0) ?? null;
-    if (account === null && input.accounts.length > 1)
+    const account = options.account ?? input.sourceAccount ?? (input.attributable.length === 1 ? input.attributable[0] : void 0) ?? null;
+    if (account === null && input.attributable.length > 1)
       throw new TypeError(
         "This invocation has several accounts; name the one the event came from with { account }"
       );
@@ -361,9 +361,12 @@ function adaptDefinition(definition) {
         );
         if (match === void 0)
           throw new Error("A schedule must reference a mutation in this app's tools");
+        if (schedule.scope === "app" && match.operation.approval !== void 0)
+          throw new Error("An app schedule must reference a mutation without an approval");
         return [
           name,
           {
+            ...schedule.scope === "app" ? { scope: "app" } : {},
             timing: Schema_exports.decodeUnknownSync(ScheduleTiming)(schedule.timing),
             input: Schema_exports.decodeUnknownSync(JsonValue)(schedule.input),
             tool: match.name
@@ -380,7 +383,22 @@ function adaptDefinition(definition) {
     ...schedules
   };
 }
+function scopedSlots(requirements) {
+  if ("accounts" in requirements)
+    throw new TypeError(
+      "Declare account requirements by scope: user: { accounts } for each caller's accounts, app: { accounts } for the app's own"
+    );
+  const app = requirements.app?.accounts ?? {};
+  const user = requirements.user?.accounts ?? {};
+  for (const name of Object.keys(app))
+    if (Object.hasOwn(user, name))
+      throw new TypeError(
+        `The requirement ${JSON.stringify(name)} is declared as both an app and a user account; name them differently`
+      );
+  return { app, user };
+}
 var defineApp = (requirements, definition) => {
+  const accounts = scopedSlots(requirements);
   if (typeof definition !== "function") rejectCatalogs(definition);
   const evaluate = typeof definition === "function" ? definition : async () => definition;
   const factory = fromPromise(evaluate, "factory");
@@ -398,7 +416,7 @@ var defineApp = (requirements, definition) => {
   if (iconsProblem !== void 0)
     throw new TypeError(`The app's icons are invalid: ${iconsProblem}`);
   const native = {
-    accounts: requirements.accounts,
+    accounts,
     ...events === void 0 ? {} : { events },
     ...requirements.icons === void 0 || requirements.icons.length === 0 ? {} : { icons: requirements.icons },
     evaluate: (context) => factory(context).pipe(Effect_exports.map((value2) => adaptDefinition(value2)))

package/js/{chunk-BZFFXNWA.js → chunk-I5C7FD5Z.js}

@@ -1,7 +1,7 @@
 import {
   ProviderError,
   maxUpstreamMessageLength
-} from "./chunk-F2G534HD.js";
+} from "./chunk-6XQLA5NC.js";
 import {
   owned
 } from "./chunk-QWQM3CLH.js";

package/js/{chunk-EKZLPXHK.js → chunk-KUCCHNVY.js}

@@ -1,14 +1,14 @@
 import {
   getWithReads
-} from "./chunk-6FUJH3T4.js";
+} from "./chunk-7PHHWYV4.js";
 import {
   fromPromise,
   method,
   toPromise
-} from "./chunk-BZFFXNWA.js";
+} from "./chunk-I5C7FD5Z.js";
 import {
   CacheError
-} from "./chunk-F2G534HD.js";
+} from "./chunk-6XQLA5NC.js";
 import {
   wrap
 } from "./chunk-GQ33QSNB.js";

package/js/{chunk-ZK7JDZJS.js → chunk-PYQLOLOC.js}

@@ -1,11 +1,11 @@
 import {
   fixedRouter
-} from "./chunk-I46RIOKQ.js";
+} from "./chunk-5MDA7MKL.js";
 import {
   nativeOperation,
   operationDeclaration,
   routerDeclaration
-} from "./chunk-GLXEYET6.js";
+} from "./chunk-YWFUWTUJ.js";
 
 // src/implementation/protocol-operations.ts
 var protocolOperations = (operations, kinds = {}) => {

package/js/{chunk-ELSILABS.js → chunk-WMD4NHXZ.js}

@@ -1,7 +1,7 @@
 import {
   authorCache,
   unavailableCache
-} from "./chunk-6FUJH3T4.js";
+} from "./chunk-7PHHWYV4.js";
 import {
   accountSecrets,
   boundFailureMessage,
@@ -12,10 +12,10 @@ import {
   parseSkillLoadFailed,
   readCatalog,
   routerSkills
-} from "./chunk-I46RIOKQ.js";
+} from "./chunk-5MDA7MKL.js";
 import {
   appInvocationFetch
-} from "./chunk-5ZVAYXLT.js";
+} from "./chunk-YRGL4QEF.js";
 import {
   folderSkillsEffect
 } from "./chunk-XBG7HHXC.js";
@@ -26,12 +26,12 @@ import {
   makeEmitter,
   toEffectApp,
   withPlacements
-} from "./chunk-7Z3NUCTP.js";
+} from "./chunk-DADXWWRZ.js";
 import {
   declaredOperations,
   locate,
   nativeOperation
-} from "./chunk-GLXEYET6.js";
+} from "./chunk-YWFUWTUJ.js";
 import {
   accountProviderError,
   appCode,
@@ -39,7 +39,7 @@ import {
   httpProviderError,
   parseProviderError,
   toPromise
-} from "./chunk-BZFFXNWA.js";
+} from "./chunk-I5C7FD5Z.js";
 import {
   AccountCheckResult,
   DeclaredProvider,
@@ -91,7 +91,7 @@ import {
   reservedTablePrefix,
   sqlBindingsLimit,
   workflowDurationMillis
-} from "./chunk-NQW2E44U.js";
+} from "./chunk-6XQLA5NC.js";
 import {
   AppSkills,
   SkillFile
@@ -514,19 +514,25 @@ var inputInvalid = (error, input) => {
 };
 
 // src/implementation/webhooks.ts
+var withoutUser = ({
+  user: _user,
+  ...context
+}) => context;
 var safe = (work, error) => Effect_exports.suspend(work).pipe(
   Effect_exports.catchCause(
     (cause) => Cause_exports.hasInterrupts(cause) ? Effect_exports.interrupt : Effect_exports.fail(error)
   )
 );
-var dispatchWebhook = (definition, command, context, accounts) => Effect_exports.gen(function* () {
+var sourceRequirement = (account) => "app" in account ? { scope: "app", name: account.app } : { scope: "user", name: account.user };
+var dispatchWebhook = (definition, command, context, slots) => Effect_exports.gen(function* () {
   const hooks = definition.webhooks ?? {};
   if (command.operation === "webhooks") {
     return yield* Effect_exports.forEach(
       Object.entries(hooks),
       ([name, hook2]) => safe(
         () => Effect_exports.gen(function* () {
-          if (!Object.hasOwn(accounts, hook2.account))
+          const source2 = sourceRequirement(hook2.account);
+          if (!Object.hasOwn(slots[source2.scope], source2.name))
             return yield* new HostDeclarationInvalid();
           const describe = (schema) => {
             const imported = importedJsonSchema(schema);
@@ -546,7 +552,7 @@ var dispatchWebhook = (definition, command, context, accounts) => Effect_exports
           };
           return yield* Schema_exports.decodeUnknownEffect(HostedWebhook)({
             name,
-            account: hook2.account,
+            account: source2.name,
             configSchema,
             ...setup === void 0 ? {} : { setup }
           });
@@ -557,14 +563,15 @@ var dispatchWebhook = (definition, command, context, accounts) => Effect_exports
   }
   const hook = Object.hasOwn(hooks, command.name) ? hooks[command.name] : void 0;
   if (hook === void 0) return yield* new HostOperationNotFound();
-  const selected = accounts[hook.account];
-  const source = Array.isArray(selected) ? selected.find((account2) => account2.id === command.sourceAccount) : selected;
-  if (source === void 0 || source.id !== command.sourceAccount)
-    return yield* new HostInputInvalid();
-  const bound = context.accounts[hook.account];
-  const account = Array.isArray(bound) ? bound.find(
-    (value) => typeof value === "object" && value !== null && "id" in value && value.id === source.id
-  ) : bound;
+  const source = sourceRequirement(hook.account);
+  const scope = source.scope === "app" ? context.app : context.user;
+  if (scope === void 0) return yield* new HostAccountsInvalid();
+  const bound = Object.hasOwn(scope.accounts, source.name) ? scope.accounts[source.name] : void 0;
+  const account = (Array.isArray(bound) ? bound : [bound]).find(
+    (value) => typeof value === "object" && value !== null && "id" in value && value.id === command.sourceAccount
+  );
+  if (account === void 0) return yield* new HostInputInvalid();
+  const hookContext = source.scope === "app" ? withoutUser(context) : context;
   const config = yield* safe(
     () => Schema_exports.decodeUnknownEffect(hook.config)(command.config),
     new HostInputInvalid()
@@ -581,7 +588,7 @@ var dispatchWebhook = (definition, command, context, accounts) => Effect_exports
     callbackUrl: command.callbackUrl,
     secret: command.secret
   };
-  const invoke = (callback, value) => safe(() => callback(context, value), new HostOperationFailed());
+  const invoke = (callback, value) => safe(() => callback(hookContext, value), new HostOperationFailed());
   if (command.operation === "webhook-complete") {
     if (hook.setup === void 0) return yield* new HostInputInvalid();
     return yield* safe(
@@ -1153,7 +1160,7 @@ function providerDeclaration(provider) {
     `Account provider "${provider.name}" has an invalid declaration`
   );
 }
-function requirements(slots, sql, events, icons) {
+function declaredSlots(slots) {
   return Effect_exports.gen(function* () {
     const accounts = /* @__PURE__ */ new Map();
     for (const [slot, selection] of Object.entries(slots)) {
@@ -1164,8 +1171,13 @@ function requirements(slots, sql, events, icons) {
         ...provider.health === void 0 ? {} : { health: true }
       });
     }
+    return Object.fromEntries(accounts);
+  });
+}
+function requirements(slots, sql, events, icons) {
+  return Effect_exports.gen(function* () {
     return yield* Schema_exports.decodeUnknownEffect(DeclaredRequirements)({
-      accounts: Object.fromEntries(accounts),
+      accounts: { app: yield* declaredSlots(slots.app), user: yield* declaredSlots(slots.user) },
       capabilities: { skills: true, toolIndex: true, skillSources: true, scheduledTools: true },
       ...sql ? { sql: true } : {},
       ...events === void 0 || Object.keys(events).length === 0 ? {} : {
@@ -1200,55 +1212,65 @@ function withoutGrants({ hosts: _hosts, ...provider }) {
     )
   };
 }
+function bindScope(slots, declarations, selected) {
+  return Effect_exports.gen(function* () {
+    if (Object.keys(selected).some((slot) => !Object.hasOwn(slots, slot))) {
+      return yield* Effect_exports.fail(new HostAccountsInvalid());
+    }
+    const bound = /* @__PURE__ */ new Map();
+    for (const [slot, selection] of Object.entries(slots)) {
+      const requirement = Object.hasOwn(declarations, slot) ? declarations[slot] : void 0;
+      const supplied = Object.hasOwn(selected, slot) ? selected[slot] : void 0;
+      if (requirement === void 0 || supplied === void 0)
+        return yield* Effect_exports.fail(new HostAccountsInvalid());
+      const provider = selection instanceof ManyAccounts ? selection.provider : selection;
+      const many = selection instanceof ManyAccounts;
+      if (many !== Array.isArray(supplied)) return yield* Effect_exports.fail(new HostAccountsInvalid());
+      const accounts = Array.isArray(supplied) ? supplied : [supplied];
+      const ids = /* @__PURE__ */ new Set();
+      const values = [];
+      for (const account of accounts) {
+        if (ids.has(account.id)) return yield* Effect_exports.fail(new HostAccountsInvalid());
+        ids.add(account.id);
+        if (canonical(withoutGrants(account.provider)) !== canonical(withoutGrants(requirement.definition)) || !Object.hasOwn(provider.auth, account.method))
+          return yield* Effect_exports.fail(new HostAccountsInvalid());
+        const method = provider.auth[account.method];
+        if (method === void 0) return yield* Effect_exports.fail(new HostAccountsInvalid());
+        const fields = yield* Schema_exports.decodeUnknownEffect(
+          method._tag === "secrets" ? method.fields : method.response
+        )(account.fields);
+        const granted = Object.hasOwn(account.provider.auth, account.method) ? account.provider.auth[account.method]?.request : void 0;
+        values.push(withPlacements({ id: account.id, method: account.method, fields }, granted));
+      }
+      if (many) bound.set(slot, values);
+      else {
+        const account = values[0];
+        if (account === void 0) return yield* Effect_exports.fail(new HostAccountsInvalid());
+        bound.set(slot, account);
+      }
+    }
+    return Object.fromEntries(bound);
+  });
+}
 function bindAccounts(slots, declarations, context) {
   return safe2(
     () => Effect_exports.gen(function* () {
       const selected = yield* Schema_exports.decodeUnknownEffect(ResolvedAccounts)(
         Redacted_exports.value(context.accounts)
       );
-      if (Object.keys(selected).some((slot) => !Object.hasOwn(slots, slot))) {
-        return yield* Effect_exports.fail(new HostAccountsInvalid());
-      }
-      const bound = /* @__PURE__ */ new Map();
-      for (const [slot, selection] of Object.entries(slots)) {
-        const requirement = declarations.accounts[slot];
-        const supplied = Object.hasOwn(selected, slot) ? selected[slot] : void 0;
-        if (requirement === void 0 || supplied === void 0)
-          return yield* Effect_exports.fail(new HostAccountsInvalid());
-        const provider = selection instanceof ManyAccounts ? selection.provider : selection;
-        const many = selection instanceof ManyAccounts;
-        if (many !== Array.isArray(supplied))
-          return yield* Effect_exports.fail(new HostAccountsInvalid());
-        const accounts = Array.isArray(supplied) ? supplied : [supplied];
-        const ids = /* @__PURE__ */ new Set();
-        const values = [];
-        for (const account of accounts) {
-          if (ids.has(account.id)) return yield* Effect_exports.fail(new HostAccountsInvalid());
-          ids.add(account.id);
-          if (canonical(withoutGrants(account.provider)) !== canonical(withoutGrants(requirement.definition)) || !Object.hasOwn(provider.auth, account.method))
-            return yield* Effect_exports.fail(new HostAccountsInvalid());
-          const method = provider.auth[account.method];
-          if (method === void 0) return yield* Effect_exports.fail(new HostAccountsInvalid());
-          const fields = yield* Schema_exports.decodeUnknownEffect(
-            method._tag === "secrets" ? method.fields : method.response
-          )(account.fields);
-          const granted = Object.hasOwn(account.provider.auth, account.method) ? account.provider.auth[account.method]?.request : void 0;
-          values.push(
-            withPlacements({ id: account.id, method: account.method, fields }, granted)
-          );
-        }
-        if (many) bound.set(slot, values);
-        else {
-          const account = values[0];
-          if (account === void 0) return yield* Effect_exports.fail(new HostAccountsInvalid());
-          bound.set(slot, account);
-        }
-      }
-      return { accounts: Object.fromEntries(bound) };
+      const app = yield* bindScope(slots.app, declarations.accounts.app, selected.app);
+      if (selected.user === void 0) return { app: { accounts: app } };
+      const user = yield* bindScope(slots.user, declarations.accounts.user, selected.user);
+      return { app: { accounts: app }, user: { accounts: user } };
     }),
     new HostAccountsInvalid()
   );
 }
+var userAccountIds = (bound) => Object.values(bound.user?.accounts ?? {}).flatMap(
+  (selected) => (Array.isArray(selected) ? selected : [selected]).map(
+    (account) => account.id
+  )
+);
 var fetchLifetime = (signal, background) => Effect_exports.acquireRelease(
   Effect_exports.sync(() => {
     const controller = new AbortController();
@@ -1451,14 +1473,19 @@ function dispatch(app, request, context, signal, emitted) {
         fetch: yield* appInvocationFetch(fetching.signal),
         elicit: makeElicit(delivery, invocationSignal, telemetry.context)
       };
-      const accountIds = Object.values(bound.accounts).flatMap(
-        (selected) => (Array.isArray(selected) ? selected : [selected]).map(
-          (account) => account.id
-        )
-      );
+      const attributable = userAccountIds(bound);
+      const accountIds = [
+        ...Object.values(bound.app.accounts).flatMap(
+          (selected) => (Array.isArray(selected) ? selected : [selected]).map(
+            (account) => account.id
+          )
+        ),
+        ...attributable
+      ];
       const emitter = (sourceAccount) => makeEmitter({
         events: native.events ?? {},
         accounts: accountIds,
+        attributable,
         ...sourceAccount === void 0 ? {} : { sourceAccount },
         emitted
       });
@@ -1592,14 +1619,15 @@ function dispatch(app, request, context, signal, emitted) {
           {
             files,
             cache: bound.cache,
-            accounts: bound.accounts,
+            app: bound.app,
+            ...bound.user === void 0 ? {} : { user: bound.user },
             workflows: workflowControls,
             signal: bound.signal,
             fetch: bound.fetch,
             sql: session2.writer,
             events: emitter("sourceAccount" in request ? request.sourceAccount : void 0)
           },
-          Redacted_exports.value(context.accounts)
+          native.accounts
         );
       }
       const toolName = request.operation === "call" ? request.tool : request.name;
@@ -1724,16 +1752,28 @@ function dispatch(app, request, context, signal, emitted) {
 }
 function checkAccount(slots, declared, requirement, context, signal, deadline) {
   return Effect_exports.gen(function* () {
-    const selection = Object.hasOwn(slots, requirement) ? slots[requirement] : void 0;
-    const slot = Object.hasOwn(declared.accounts, requirement) ? declared.accounts[requirement] : void 0;
+    const scope = Object.hasOwn(slots.app, requirement) ? "app" : Object.hasOwn(slots.user, requirement) ? "user" : void 0;
+    if (scope === void 0) return yield* new HostAccountsInvalid();
+    const selection = slots[scope][requirement];
+    const slot = Object.hasOwn(declared.accounts[scope], requirement) ? declared.accounts[scope][requirement] : void 0;
     if (selection === void 0 || slot === void 0) return yield* new HostAccountsInvalid();
     const provider = selection instanceof ManyAccounts ? selection.provider : selection;
     const health = provider.health;
     if (health === void 0) return yield* new HostOperationNotFound();
-    const { accounts } = yield* bindAccounts(
-      { [requirement]: provider },
-      { accounts: { [requirement]: { ...slot, cardinality: "one" } } },
-      context
+    const accounts = yield* safe2(
+      () => Effect_exports.gen(function* () {
+        const selected = yield* Schema_exports.decodeUnknownEffect(ResolvedAccounts)(
+          Redacted_exports.value(context.accounts)
+        );
+        const supplied = selected[scope];
+        if (supplied === void 0) return yield* new HostAccountsInvalid();
+        return yield* bindScope(
+          { [requirement]: provider },
+          { [requirement]: { ...slot, cardinality: "one" } },
+          supplied
+        );
+      }),
+      new HostAccountsInvalid()
     ).pipe(Effect_exports.withSpan("app.accounts.bind"));
     const account = accounts[requirement];
     if (account === void 0 || !("id" in account)) return yield* new HostAccountsInvalid();

package/js/{chunk-JJH3MBAM.js → chunk-YNJ5CZMJ.js}

@@ -14,8 +14,9 @@ import {
 // src/contracts/ui.ts
 var UiContext = Schema_exports.Struct({
   deployment: Schema_exports.NonEmptyString,
-  profile: Schema_exports.optional(Schema_exports.NonEmptyString),
-  expectedProfileRevision: Schema_exports.optional(Schema_exports.Int)
+  accounts: Schema_exports.optional(
+    Schema_exports.Record(Schema_exports.NonEmptyString, Schema_exports.Array(Schema_exports.NonEmptyString))
+  )
 });
 var UiOperation = Schema_exports.Struct({
   ...UiContext.fields,

package/js/{chunk-5ZVAYXLT.js → chunk-YRGL4QEF.js}

@@ -5,7 +5,7 @@ import {
   networkRefusalHeader,
   networkRefusalStatus,
   supportedFetchOptions
-} from "./chunk-F2G534HD.js";
+} from "./chunk-6XQLA5NC.js";
 import {
   invocationFetch
 } from "./chunk-QWQM3CLH.js";

package/js/{chunk-GLXEYET6.js → chunk-YWFUWTUJ.js}

@@ -1,12 +1,12 @@
 import {
   fromPromise
-} from "./chunk-BZFFXNWA.js";
+} from "./chunk-I5C7FD5Z.js";
 import {
   HostedTool,
   RouterKey,
   RouterMeta,
   reservedRouterKeys
-} from "./chunk-NQW2E44U.js";
+} from "./chunk-6XQLA5NC.js";
 import {
   decoderOf,
   schemaArgument
@@ -47,10 +47,13 @@ var approvedOperation = (operation, approval) => {
     value: (context) => fromPromise(async () => approval(context), "approval")()
   });
 };
-var withApproval = (operation, approval) => ({
-  ...operation,
-  [NativeOperation]: approvedOperation(operation[NativeOperation], approval)
-});
+var withApproval = (operation, approval) => (
+  // SAFETY: `Approved` is a type-only mark; the native operation now carries the approval.
+  {
+    ...operation,
+    [NativeOperation]: approvedOperation(operation[NativeOperation], approval)
+  }
+);
 var toolAnnotations = (operation) => nativeOperation(operation)?.annotations;
 var make = (kind, options, run) => operationDeclaration({
   ...operationOptions({ ...options, input: schemaArgument(options.input, `The ${kind} input`) }),
@@ -62,7 +65,9 @@ var make = (kind, options, run) => operationDeclaration({
   run: (context, input) => fromPromise(run, "handler")(context, input)
 });
 var query = (options, run) => make("query", options, run);
-var mutation = (options, run) => make("mutation", options, run);
+function mutation(options, run) {
+  return make("mutation", options, run);
+}
 
 // src/implementation/router.ts
 var routerDeclaration = (node) => ({

package/js/client.js

@@ -3,7 +3,7 @@ import {
   UiContext,
   UiDeploymentChanged,
   UiFailed
-} from "./chunk-JJH3MBAM.js";
+} from "./chunk-YNJ5CZMJ.js";
 import {
   AsyncResult_exports,
   AtomRegistry_exports,