apps 0.0.1-beta.9 → 0.0.1-beta.91

package/types/apps/src/implementation/ui-serving.d.ts

@@ -1,18 +1,35 @@
-import { Effect } from "effect";
-import { HttpServerRequest, HttpServerResponse } from "effect/unstable/http";
-import { UiForbidden, type AppUiAsset } from "../contracts/ui.js";
-/** Render an authorized deployment with a host-owned deployment watcher. */
+import { Effect, Option, Stream } from "effect";
+import { HttpServerRequest, HttpServerResponse } from "effect/http";
+import { UiFailed, UiForbidden, type AppUiAsset, type AppUiRange, type AppUiStoredFile, type UiAccountNotice } from "../contracts/ui.js";
+/**
+ * Render an authorized deployment with a host-owned deployment watcher. Account problems that stop
+ * the app replace its document with a page that links to their fix; others add a dismissible card.
+ */
 export declare const appDocument: <E, R>(options: {
     readonly deployment: string;
-    readonly profile?: string | undefined;
-    readonly expectedProfileRevision?: number | undefined;
+    /** The account IDs the page runs with, by requirement. */
+    readonly accountIds?: Readonly<Record<string, readonly string[]>> | undefined;
     readonly origin: string;
+    readonly accounts?: UiAccountNotice | undefined;
     readonly asset: (path: string) => Effect.Effect<AppUiAsset | undefined, E, R>;
-}) => Effect.Effect<HttpServerResponse.HttpServerResponse, UiForbidden | E, HttpServerRequest.HttpServerRequest | R>;
+}) => Effect.Effect<HttpServerResponse.HttpServerResponse, UiFailed | UiForbidden | E, HttpServerRequest.HttpServerRequest | R>;
+/**
+ * A deployment's public file, read from the host's store. The deployment lists it, so bytes that
+ * are gone are a storage fault, never a missing page.
+ */
+export declare const storedAppFile: <E1, E2>(stored: {
+    readonly contentType: string;
+    readonly size: number;
+    readonly etag: string;
+}, read: (range: AppUiRange | undefined) => Effect.Effect<Option.Option<{
+    readonly body: Stream.Stream<Uint8Array, E1>;
+}>, E2>) => AppUiStoredFile;
+/** The file a URL path names: each segment percent-decoded, or none when one does not decode. */
+export declare const assetPath: (path: string) => Option.Option<string>;
 /** Serve an asset only after the host has checked current access and file existence.
  * Asset URLs name their deployment, so their bytes never change: the browser keeps them for a year
  * and does not ask again. Shared proxies never store them. Revoking access stops every new request
  * and all app data, while bytes a browser already downloaded stay in its cache.
- * HTML remains an uncached host-rendered entry point.
+ * HTML remains an uncached host-rendered entry point; other HTML files are served as they are.
  */
-export declare const appAsset: (asset: AppUiAsset | undefined, build: string, path: string) => Effect.Effect<HttpServerResponse.HttpServerResponse, never, HttpServerRequest.HttpServerRequest>;
+export declare const appAsset: (asset: AppUiAsset | undefined, build: string, path: string) => Effect.Effect<HttpServerResponse.HttpServerResponse, UiFailed, HttpServerRequest.HttpServerRequest>;

package/types/apps/src/implementation/ui-watch.d.ts

@@ -1,2 +1,2 @@
 /** Dependency-free browser source served by each host after app authorization. */
-export declare const appWatchScript: string;
+export declare const appWatchScript = "\"use strict\";(()=>{var s=()=>{let i=document.getElementById(\"executor-context\")?.textContent;if(!i)return;let n=JSON.parse(i);if(typeof n!=\"object\"||n===null||!(\"deployment\"in n))return;let r=n.deployment;if(typeof r!=\"string\"||r.length===0)return;let t=new EventSource(\"/_executor/version\"),l=!1,o=()=>{l||(l=!0,t.close(),location.reload())};t.addEventListener(\"version\",d=>{let e=JSON.parse(d.data);typeof e==\"object\"&&e!==null&&\"deployment\"in e&&(e.deployment===null||typeof e.deployment==\"string\")&&e.deployment!==r&&o()}),t.addEventListener(\"revoked\",o),window.addEventListener(\"executor:deployment-changed\",o),window.addEventListener(\"pagehide\",()=>t.close(),{once:!0}),window.addEventListener(\"pageshow\",d=>{d.persisted&&o()})};s();})();";

package/types/apps/src/implementation/upstream-error.d.ts

@@ -0,0 +1,7 @@
+import { UpstreamError } from "../contracts/failure.js";
+/** Whether `bounded` shortened this message, so it may end partway through a secret. */
+export declare const isShortenedUpstream: (message: string) => boolean;
+/** The error a JSON error body states, if it uses a nested error object or OAuth's format. */
+export declare const bodyUpstreamError: (json: unknown) => UpstreamError | undefined;
+/** The `error` and `error_description` of a Bearer challenge (RFC 6750, section 3). */
+export declare const challengeUpstreamError: (header: string | undefined) => UpstreamError | undefined;

package/types/apps/src/implementation/webhooks.d.ts

@@ -1,13 +1,21 @@
 /** Native webhook dispatch. The author verifies signatures before parsing or performing side effects. */
 import { Effect, Schema } from "effect";
-import type { AppDefinition } from "../contracts/app.js";
-import { HostDeclarationInvalid, HostInputInvalid, HostOperationFailed, HostOperationNotFound, HostOutputInvalid, type ResolvedAccounts } from "../contracts/host.js";
+import type { AppDefinition, ScopedSlots } from "../contracts/app.js";
+import { HostDeclarationInvalid, HostInputInvalid, HostOperationFailed, HostOperationNotFound, HostAccountsInvalid, HostOutputInvalid } from "../contracts/host.js";
 import { type WebhookCommand } from "../contracts/webhook-protocol.js";
-/** Run one hook with freshly bound context. No credentials or raw failures enter the response envelope. */
+type ScopeAccounts = {
+    readonly accounts: Readonly<Record<string, unknown>>;
+};
+/**
+ * Run one hook with freshly bound context. No credentials or raw failures enter the response
+ * envelope. An app-account hook runs without a caller: its context has no `user`, whatever the
+ * invocation bound.
+ */
 export declare const dispatchWebhook: <Context extends {
     readonly signal?: AbortSignal;
-    readonly accounts: Readonly<Record<string, unknown>>;
-}>(definition: AppDefinition<Context>, command: WebhookCommand, context: Context, accounts: ResolvedAccounts) => Effect.Effect<Schema.Json | {
+    readonly app: ScopeAccounts;
+    readonly user?: ScopeAccounts;
+}>(definition: AppDefinition<Context>, command: WebhookCommand, context: Context, slots: ScopedSlots) => Effect.Effect<Schema.Json | {
     readonly name: string;
     readonly account: string;
     readonly configSchema: {
@@ -26,4 +34,5 @@ export declare const dispatchWebhook: <Context extends {
         readonly [x: string]: string;
     };
     readonly body: string;
-}, HostOperationNotFound | HostInputInvalid | HostOutputInvalid | HostDeclarationInvalid | HostOperationFailed, never>;
+}, HostDeclarationInvalid | HostAccountsInvalid | HostOperationNotFound | HostOperationFailed | HostInputInvalid | HostOutputInvalid, never>;
+export {};

package/types/apps/src/implementation/workflow-context.d.ts

@@ -1,7 +1,10 @@
 /** Author-facing step methods delegate persistence to the host's durable engine. */
 import { Effect } from "effect";
-import type { AppDefinition } from "../contracts/app.js";
-import { WorkflowFailure, type WorkflowContext, type WorkflowExecution, type WorkflowStepContext } from "../contracts/workflows.js";
+import type { AccountScope, AppDefinition } from "../contracts/app.js";
+import type { AppRequirements } from "../contracts/context.js";
+import { WorkflowFailure, type WorkflowContext, type WorkflowExecution, type WorkflowStepContext as AuthorStepContext } from "../contracts/workflows.js";
+/** A step's context as the host builds it: a run without a caller has no `user`. */
+type WorkflowStepContext = AuthorStepContext<AppRequirements, AccountScope> & Partial<Pick<AuthorStepContext, "user">>;
 /**
  * Preserve typed failures and cancellation. Other errors keep their name and bounded message,
  * with the given account secrets replaced.
@@ -14,3 +17,4 @@ fresh: (stepId: string, signal: AbortSignal) => Effect.Effect<{
     readonly context: WorkflowStepContext;
     readonly secrets: readonly string[];
 }, WorkflowFailure>, signal: AbortSignal) => Effect.Effect<WorkflowContext>;
+export {};

package/types/apps/src/implementation/workflows.d.ts

@@ -1,23 +1,30 @@
 /** Ordinary async workflow declarations, adapted once into native Effect handlers. */
-import { type Schema as EffectSchema } from "effect";
+import type { Schema as EffectSchema } from "effect";
 import type { AppWorkflow, WorkflowContext } from "../contracts/workflows.js";
+import type { AppRequirements } from "../contracts/context.js";
+import type { AccountScope } from "../contracts/app.js";
 import { type Schema } from "./schema.js";
 declare const NativeWorkflow: unique symbol;
+/**
+ * The context any workflow may declare: either scope, so a run started without a caller, such as
+ * by an app schedule, declares `WorkflowContext<typeof requirements, "app">`.
+ */
+export type AnyWorkflowContext = WorkflowContext<AppRequirements, AccountScope>;
 declare const HandlerContext: unique symbol;
 /** A workflow declaration retains input/output inference and required context compatibility. */
-export interface Workflow<Input, Output, Context extends WorkflowContext = WorkflowContext> {
+export interface Workflow<Input, Output, Context extends AnyWorkflowContext = WorkflowContext> {
     readonly [HandlerContext]?: (context: Context) => void;
     readonly [NativeWorkflow]: AppWorkflow<Input, Output>;
 }
 /** Composition view erases input only after retaining its runtime decoder. */
-export interface WorkflowDeclaration<Context extends WorkflowContext> {
+export interface WorkflowDeclaration<Context extends AnyWorkflowContext> {
     readonly [HandlerContext]?: (context: Context) => void;
     readonly [NativeWorkflow]: Omit<AppWorkflow<never>, "input"> & {
         readonly input: EffectSchema.Decoder<unknown>;
     };
 }
 /** Declare durable orchestration without starting a run or performing I/O. */
-export declare const workflow: <Input, Output, Context extends WorkflowContext = WorkflowContext>(options: {
+export declare const workflow: <Input, Output, Context extends AnyWorkflowContext = WorkflowContext>(options: {
     readonly input: Schema<Input, boolean>;
     readonly output?: Schema<Output, boolean>;
     readonly description?: string;

package/types/apps/src/index.d.ts

@@ -1,4 +1,5 @@
 export { ProviderError } from "./contracts/provider-error.js";
+export { FetchOptionUnsupported, NetworkRefused } from "./contracts/network.js";
 export type { AppCache, CacheLoadContext, CacheGetOptions } from "./contracts/cache.js";
 export { CacheError } from "../../app-cache/src/contracts/cache.js";
 /**
@@ -6,49 +7,92 @@ export { CacheError } from "../../app-cache/src/contracts/cache.js";
  * exposes ordinary declarations, schema helpers and Promise operations.
  */
 import { type Schema as EffectSchema } from "effect";
-import type { WebhookContext } from "./contracts/context.js";
+import type { AppRequirements, WebhookContext } from "./contracts/context.js";
+import type { AccountScope } from "./contracts/app.js";
 import { type JsonResponse as NativeResponse } from "./contracts/http.js";
-import { type OAuth2Config, type OAuth2Method as NativeOAuth2Method, type SecretsMethod as NativeSecretsMethod } from "./contracts/provider.js";
+import { type OAuth2Config as NativeOAuth2Config, type OAuth2Method as NativeOAuth2Method, type ReservedAuthorizationParam, type SecretsMethod as NativeSecretsMethod } from "./contracts/provider.js";
 import type { Webhook as NativeWebhook } from "./contracts/webhooks.js";
 import { type PromiseMethods } from "./implementation/authoring.js";
-import { type Fields, type Infer, type ObjectSchema, type Schema } from "./implementation/schema.js";
-export { type JsonObject, type JsonValue, ValidationError } from "./contracts/schema.js";
-export { type Fields, type Infer, type ObjectSchema, type ObjectValue, type Schema, array, boolean, json, jsonSchema, literal, number, object, record, string, } from "./implementation/schema.js";
-export { type AccountCheckContext, type AccountCheckResult, type AccountInfo, type AccountOf, type AuthMethod, type AuthMethodData, type AuthMethods, type ManyAccounts, type OAuth2Config, type Provider, } from "./contracts/provider.js";
+import { type PlacementInput, type RequestPlacements } from "./implementation/placement.js";
+import type { Placement } from "./contracts/placement.js";
+import type { QueryContext as NativeQueryContext } from "./contracts/context.js";
+import { query as operationQuery, type AnyContext, type OperationOptions } from "./implementation/operations.js";
+import { type Fields, type Infer, type ObjectSchema, type Schema, type SecretFields, type SecretObject } from "./implementation/schema.js";
+export { DeclarationInvalid, type DeclarationIssue, type JsonObject, type JsonValue, ValidationError, } from "./contracts/schema.js";
+export { type Fields, type Infer, type ObjectSchema, type ObjectValue, type Schema, array, boolean, json, jsonSchema, literal, number, object, record, string, plain, raw, type SecretString, } from "./implementation/schema.js";
+export { type AccountCheckContext, type AccountCheckResult, type AccountInfo, type AccountOf, type AuthMethod, type AuthMethodData, type AuthMethods, type ManyAccounts, type Provider, type ReservedAuthorizationParam, } from "./contracts/provider.js";
 export { defineProvider, type ProviderOptions } from "./implementation/provider.js";
+export { base64, basic, bearer, header, t, type FieldRef, type FieldRefs, type PlacementInput, type PlacementValue, type RequestPlacements, } from "./implementation/placement.js";
+export type { Placement };
+export type { AccountRequest } from "./contracts/provider.js";
 export { accountRouter } from "./implementation/account-router.js";
-export { router, dynamicRouter, type RouterDeclaration, type RouterChild, type RouterOptions, } from "./implementation/router.js";
+export { router, dynamicRouter, withApprovals, renameTools, type OperationChild, type OperationDeclaration, type RouterDeclaration, type RouterChild, type RouterOptions, } from "./implementation/router.js";
 export type { RouterIcon } from "./contracts/router.js";
+export type { AppIcon } from "./contracts/icons.js";
 export { dynamicSkills } from "./implementation/dynamic-skills.js";
 export type { HostedTool as OperationDescription } from "./contracts/host.js";
+/** Account fields as app code receives them from a method declared with this schema. */
+type AccountFields<S> = S extends ObjectSchema<infer F> ? SecretFields<F> : SecretObject<Infer<S>>;
 /** A secrets declaration inferred from an author schema. */
-export type SecretsMethod<Shape extends ObjectSchema<Fields>> = NativeSecretsMethod<EffectSchema.Decoder<Infer<Shape>>>;
+export type SecretsMethod<Shape extends ObjectSchema<Fields>> = NativeSecretsMethod<EffectSchema.Decoder<AccountFields<Shape>>>;
 /** An OAuth declaration inferred from its author-facing response schema. */
-export type OAuth2Method<Response extends Schema<unknown, boolean>> = NativeOAuth2Method<EffectSchema.Decoder<Infer<Response>>>;
+export type OAuth2Method<Response extends Schema<unknown, boolean>> = NativeOAuth2Method<EffectSchema.Decoder<AccountFields<Response>>>;
+/** The names of an object schema's fields, which a method's `request` can reference. */
+type FieldNameOf<S> = S extends ObjectSchema<infer F> ? keyof F & string : never;
 /** Default OAuth fields visible to app code. Host-only grants and clients stay private. */
 export declare const OAuth2AccessToken: Schema<{
     readonly access_token: string;
 }, false>;
-/** Declare a secrets method without requiring an Effect schema from the author. */
+/**
+ * OAuth options as authors write them. `authorizationParams` naming a host-owned protocol
+ * parameter such as `state` or `scope` is a type error as well as a declaration failure.
+ */
+export type OAuth2Config = WithoutReservedParams<NativeOAuth2Config>;
+type WithoutReservedParams<Config> = Config extends unknown ? "authorizationParams" extends keyof Config ? Config & {
+    readonly authorizationParams?: {
+        readonly [Key in ReservedAuthorizationParam]?: never;
+    };
+} : Config : never;
+/**
+ * Declare a secrets method without requiring an Effect schema from the author. `request` says
+ * where its secret fields may be sent, such as `({ token }) => bearer(token)`; it runs once, here.
+ */
 export declare const secrets: <const F extends Fields>(options: {
     readonly label: string;
     readonly fields: ObjectSchema<F>;
+    readonly request?: RequestPlacements<keyof F & string>;
 }) => SecretsMethod<ObjectSchema<F>>;
-/** Declare OAuth discovery/endpoints and an optional app-visible response projection. */
-export declare function oauth2(options: OAuth2Config): OAuth2Method<typeof OAuth2AccessToken>;
+/**
+ * Declare OAuth discovery/endpoints and an optional app-visible response projection.
+ * `authorizationParams` adds service-defined sign-in parameters; a declared `authorizationUrl`
+ * keeps its own query. Neither can set host-owned parameters, and each parameter appears once.
+ * `request` says where the projected secret fields may be sent, such as
+ * `({ access_token }) => bearer(access_token)`; it runs once, here.
+ */
+export declare function oauth2(options: OAuth2Config & {
+    readonly request?: RequestPlacements<"access_token">;
+}): OAuth2Method<typeof OAuth2AccessToken>;
 export declare function oauth2<Response extends Schema<unknown, boolean>>(options: OAuth2Config & {
     readonly response: Response;
+    readonly request?: RequestPlacements<FieldNameOf<Response>>;
 }): OAuth2Method<Response>;
-export type { AccountSlots } from "./contracts/app.js";
-export type { AppRequirements, AppContext, QueryContext, MutationContext, WebhookContext, } from "./contracts/context.js";
+export type { AccountScope, AccountSlots, WebhookAccount } from "./contracts/app.js";
+export type { AnyScopeMutationContext, AppRequirements, AppContext, QueryContext, MutationContext, WebhookContext, } from "./contracts/context.js";
 export { type App, type AppDefinition, defineApp } from "./implementation/app.js";
+export { event, type EventDeclaration, type EventEmitter } from "./implementation/events.js";
+export type { EmitOptions } from "./contracts/events.js";
 export type { Approval, ApprovalContext, ApprovalDecision } from "./approval.js";
 type AuthorWebhook<Member, Config, State> = Member extends object ? Omit<PromiseMethods<Member>, "config" | "state"> & {
     readonly config: Config;
     readonly state: State;
 } : never;
 /** Author lifecycle methods use async functions and share native decoded context/state types. */
-export type Webhook<Context extends WebhookContext, Config extends Schema<unknown, boolean>, State extends Schema<unknown, boolean>> = AuthorWebhook<NativeWebhook<Context, EffectSchema.Decoder<Infer<Config>>, EffectSchema.Decoder<Infer<State>>>, Config, State>;
+/**
+ * A webhook's context names its source account's scope: one with `user` serves a user requirement
+ * (`account: { user: "x" }`), one of the `"app"` scope an app requirement (`account: { app: "x" }`)
+ * and runs without a caller.
+ */
+export type Webhook<Context extends WebhookContext<AppRequirements, AccountScope>, Config extends Schema<unknown, boolean>, State extends Schema<unknown, boolean>> = AuthorWebhook<NativeWebhook<Context, EffectSchema.Decoder<Infer<Config>>, EffectSchema.Decoder<Infer<State>>>, Config, State>;
 export { ResponseDecodeError, ResponseStatusError } from "./contracts/http.js";
 /** Native fetch-compatible response accepted at the author boundary. */
 export type JsonResponse = PromiseMethods<NativeResponse>;
@@ -56,11 +100,16 @@ export type JsonResponse = PromiseMethods<NativeResponse>;
 export declare const decodeJson: <T>(response: JsonResponse, schema: Schema<T, boolean>) => Promise<T>;
 export { NotImplemented } from "./contracts/app.js";
 export { ElicitationFailed, type FormElicitation, type ElicitationResponse, type Elicit, } from "./contracts/elicitation.js";
-export { table, defineDatabase, type Table, type DatabaseReader, type Database, type DatabaseDefinition, } from "./implementation/storage.js";
-export { id, userId } from "./implementation/schema.js";
-export { query, mutation, withApproval, type Operation, type OperationOptions, } from "./implementation/operations.js";
+export type { Sql, SqlCursor, SqlReader, SqlRow, SqlTransaction, SqlValue, } from "./contracts/sql.js";
+/**
+ * `query(options, run)` declares a read operation. `query(name, value)` inside a method's
+ * `request` places a credential in a query parameter, such as `query("key", key)`.
+ */
+export declare function query(name: string, value: PlacementInput): Placement;
+export declare function query<Input, Output, Context extends AnyContext = NativeQueryContext>(options: OperationOptions<Input, Output>, run: (context: Context, input: Input) => Promise<Output>): ReturnType<typeof operationQuery<Input, Output, Context>>;
+export { mutation, withApproval, toolAnnotations, type Approved, type Operation, type OperationOptions, } from "./implementation/operations.js";
 export type { OperationContext } from "./contracts/operations.js";
 export { workflow, type Workflow, type WorkflowDeclaration } from "./implementation/workflows.js";
 export { NonRetryableError, WorkflowFailure, type WorkflowContext, type WorkflowStepContext, type WorkflowStep, type WorkflowStepOptions, type WorkflowDuration, type WorkflowReads, type WorkflowControls, } from "./contracts/workflows.js";
-export { interval, cron, type ScheduleDeclaration } from "./implementation/schedules.js";
+export { appCron, appInterval, userCron, userInterval, type ScheduleDeclaration, } from "./implementation/schedules.js";
 export type { AppSkillSource as Skill, SkillFile } from "./contracts/skills.js";

package/types/apps/src/mcp.d.ts

@@ -1,11 +1,30 @@
 /** HTTP MCP helpers. Requires the optional @modelcontextprotocol/sdk peer. */
 import type { OperationKinds } from "./implementation/protocol-operations.js";
+import type { McpHealthOptions } from "./contracts/mcp.js";
+import type { AccountCheckContext, AuthMethods } from "./contracts/provider.js";
 import { type McpCatalogOptions } from "./implementation/mcp-catalog.js";
 export type { McpCatalogOptions } from "./implementation/mcp-catalog.js";
-export { McpError, type McpToolContext, type McpToolsOptions, type McpToolResult, } from "./contracts/mcp.js";
+export { McpCredentialsUnverified, McpError, type McpHealthOptions, type McpToolContext, type McpToolsOptions, type McpToolResult, } from "./contracts/mcp.js";
 /**
  * A router over a server's tools for the selected account. Its title, description and
  * instructions come from the server. Kinds override uncertain upstream read-only hints.
  */
 export declare const mcpRouter: (options: McpCatalogOptions, kinds?: OperationKinds) => Promise<import("./index.js").RouterDeclaration<unknown, unknown>>;
+/**
+ * A provider `health` check for an MCP server. Pass the check context `health` receives, then the
+ * server's `url` and the `headers` that send the account's credentials:
+ * `health: (check) => mcpHealth(check, { url, headers: headers(check.account) })`.
+ *
+ * It connects with those headers, initializes, and reads the first page of tools, then does the
+ * same without any headers. No tool runs. The check passes only when the server accepts the account
+ * and refuses the attempt without credentials. A refused account throws `ProviderError`, as HTTP
+ * helpers do. An unreachable or unusable server throws `McpError`, and a request Executor's network
+ * refuses throws `NetworkRefused`. A server that also answers without credentials, or whose answer
+ * to that attempt is not a refusal, throws `McpCredentialsUnverified`. Each of these errors means
+ * the check could not verify the account, and the account form explains why. Send credentials only
+ * in `headers`; the attempt without them uses the same `url`. The check context's `signal` cancels
+ * both attempts, and they share one budget that ends early enough before its `deadline` to report a
+ * server that did not answer in time. `timeoutMs` can only shorten that budget.
+ */
+export declare const mcpHealth: <Auth extends AuthMethods>(check: AccountCheckContext<Auth>, options: McpHealthOptions) => Promise<void>;
 export type { OperationKinds } from "./implementation/protocol-operations.js";

package/types/apps/src/openapi.d.ts

@@ -9,4 +9,9 @@ export { OpenapiError, isOpenapiTextMedia, openapiBinaryResultSchema, OpenapiErr
 export declare const openapiRouter: (options: OpenapiToolsOptions, kinds?: OperationKinds) => Promise<import("./index.js").RouterDeclaration<unknown, unknown>>;
 export type { OperationKinds } from "./implementation/protocol-operations.js";
 export * from "./contracts/openapi-compile.js";
-export { liveOpenapiRouter, type OpenapiSourceOptions } from "./implementation/openapi-source.js";
+/**
+ * The names `liveOpenapiRouter` gives a document's operations, from each operation's
+ * operationId, first tag, method and path alone. It reads no document and compiles nothing.
+ */
+export { planOperationNames, type OperationNameInput } from "./implementation/openapi-names.js";
+export { liveOpenapiRouter, openapiToolNames, type OpenapiSourceOptions, type OpenapiToolNamesOptions, } from "./implementation/openapi-source.js";

package/types/apps/src/react.d.ts

@@ -1,4 +1,4 @@
-import { AsyncResult, type Atom } from "effect/unstable/reactivity";
+import { AsyncResult, type Atom } from "effect/reactivity";
 /** Subscribe for the component lifetime. Each mount owns and disposes its registry, including StrictMode remounts. */
 export declare const useAppQuery: <A, E>(atom: Atom.Atom<AsyncResult.AsyncResult<A, E>>) => {
     data: A | undefined;

package/types/apps/src/skills.d.ts

@@ -1,12 +1,13 @@
 import { type FolderSkillsOptions, type GitHubSkillsOptions, type SkillReaderOptions, type WellKnownSkillsOptions, type SkillFile } from "./contracts/skills.js";
-export { SkillLoadFailed, SkillDefinitionInvalid, SkillServiceName, type SkillReaderOptions, type FolderSkillsOptions, type AppSkillSource as Skill, type SkillFile, type GitHubSkillsOptions, type SkillCacheOptions, type WellKnownSkillsOptions, } from "./contracts/skills.js";
+export { SkillLoadFailed, SkillDefinitionInvalid, SkillServiceName, type SkillReaderOptions, type FolderSkillsOptions, type AppSkillSource as Skill, type SkillFile, type GitHubSkillsAccount, type GitHubSkillsOptions, type SkillCacheOptions, type WellKnownSkillsOptions, } from "./contracts/skills.js";
 /**
- * Fetch a public GitHub skill collection from one resolved commit. Pass `cache: ctx.cache` to reuse
- * the catalog; without it, mutable refs resolve again on each call.
+ * Fetch a GitHub skill collection from one resolved commit. A private repository takes `account`
+ * and its `token`. Pass `cache: ctx.cache` to reuse the catalog; without it, mutable refs resolve
+ * again on each call.
  */
 export declare const githubSkills: (options: GitHubSkillsOptions) => Promise<readonly {
-    readonly name: string;
     readonly description: string;
+    readonly name: string;
     readonly files: readonly {
         readonly path: string;
         readonly content: string;
@@ -20,8 +21,8 @@ export declare const githubSkills: (options: GitHubSkillsOptions) => Promise<rea
 }[]>;
 /** Fetch a published skill index and its text files. Pass `cache: ctx.cache` to reuse the catalog. */
 export declare const wellKnownSkills: (options: WellKnownSkillsOptions) => Promise<readonly {
-    readonly name: string;
     readonly description: string;
+    readonly name: string;
     readonly files: readonly {
         readonly path: string;
         readonly content: string;
@@ -35,8 +36,8 @@ export declare const wellKnownSkills: (options: WellKnownSkillsOptions) => Promi
 }[]>;
 /** Parse a bundled standard skill directory into an app capability. */
 export declare const fileSkill: (files: readonly SkillFile[]) => Promise<{
-    readonly name: string;
     readonly description: string;
+    readonly name: string;
     readonly files: readonly {
         readonly path: string;
         readonly content: string;
@@ -50,8 +51,8 @@ export declare const fileSkill: (files: readonly SkillFile[]) => Promise<{
 }>;
 /** Read skill directories from ctx.files. Omitted path selects skills/; missing folders return []. */
 export declare const folderSkills: (options: FolderSkillsOptions) => Promise<readonly {
-    readonly name: string;
     readonly description: string;
+    readonly name: string;
     readonly files: readonly {
         readonly path: string;
         readonly content: string;
@@ -65,7 +66,8 @@ export declare const folderSkills: (options: FolderSkillsOptions) => Promise<rea
 }[]>;
 /**
  * Read files for a custom remote skill loader, such as one for GitLab. Reads share one byte
- * budget and reject with the same safe SkillLoadFailed errors as githubSkills, naming `service`.
+ * budget and reject with the same safe SkillLoadFailed errors as githubSkills, naming `service`,
+ * or with `NetworkRefused` when Executor's network refuses a request.
  */
 export declare const skillReader: (options: SkillReaderOptions) => {
     /** Fetch one UTF-8 text file. */

package/types/apps/src/ui-serving.d.ts

@@ -1,3 +1,3 @@
 /** Host-only rendering utilities; the host supplies authorized retained assets. */
-export { appDocument, appAsset } from "./implementation/ui-serving.js";
+export { appDocument, appAsset, assetPath, storedAppFile } from "./implementation/ui-serving.js";
 export { appWatchScript } from "./implementation/ui-watch.js";

package/types/telemetry/src/app-records.d.ts

@@ -0,0 +1,42 @@
+/**
+ * What the host keeps of the spans and logs an app isolate returns.
+ *
+ * Those records come from whatever framework the app's build bundles, and the app's own code runs
+ * in the same isolate: it can throw any text, name its errors and codes, and rewrite every record
+ * before the isolate returns it. So the host does not filter the records it receives. It builds
+ * new ones from a closed vocabulary: the framework's span names, attributes whose values are
+ * closed sets, counts and status codes, and each exception's kind. Ids, parents and timings are
+ * kept. Everything else, including events other than exceptions, links, status and exception
+ * messages, stacks and log bodies, is dropped or replaced with a fixed sentence.
+ *
+ * The vocabulary is the framework's (`packages/apps`, `app-cache`, `app-data`): host request
+ * operations, failure sources and reasons, MCP and cache attributes. A name or value outside it is
+ * recorded as `unrecognized` or not at all. `bun run check` (`scripts/check-app-telemetry.ts`)
+ * fails when the framework names a span or sets an attribute key this vocabulary does not know.
+ */
+import type { Schema } from "effect";
+type Json = Schema.Json;
+type JsonObject = {
+    readonly [key: string]: Json;
+};
+/** What an exception message, stack or log body from an app isolate records instead. */
+export declare const appText = "Text from the app is not recorded";
+/** The framework's span names, and the libraries' spans it runs. */
+export declare const appSpanNames: ReadonlySet<string>;
+export declare const appSpanAttributeKeys: ReadonlySet<string>;
+/**
+ * Attributes the framework sets whose values the app chooses, such as its tool names, so the host
+ * drops them. `scripts/check-app-telemetry.ts` fails on a framework attribute in neither set.
+ */
+export declare const droppedAppAttributeKeys: ReadonlySet<string>;
+/** The span the host records for one an app isolate returned, or nothing without its timings. */
+export declare const appSpan: (span: JsonObject & {
+    readonly traceId: string;
+    readonly spanId: string;
+}) => JsonObject | undefined;
+/** The log record the host records for one an app isolate returned. */
+export declare const appLog: (log: JsonObject & {
+    readonly traceId?: string | undefined;
+    readonly spanId?: string | undefined;
+}) => JsonObject;
+export {};

package/types/telemetry/src/browser-operations.d.ts

@@ -1,6 +1,6 @@
 /** Correlate transport and decoded outcomes without exporting response bodies or errors. */
 import { Effect, Schema, Tracer } from "effect";
-import { HttpClient, HttpClientError } from "effect/unstable/http";
+import { HttpClient, HttpClientError } from "effect/http";
 /**
  * A random identity for the current browser document. It is never an authentication or user
  * identifier. Server renders have no document, so they get none instead of sharing one per isolate.
@@ -8,7 +8,7 @@ import { HttpClient, HttpClientError } from "effect/unstable/http";
 export declare const browserPageId: () => string | undefined;
 /** Safe event shared with the host's error reporter and product analytics. */
 export declare const BrowserOperationFailure: Schema.Struct<{
-    readonly error_type: Schema.Literals<readonly ["BrowserDecodeFailed", "BrowserTransportFailed", "BrowserOperationFailed"]>;
+    readonly error_type: Schema.Literals<readonly ["BrowserDecodeFailed", "BrowserConnectionFailed", "BrowserTransportFailed", "BrowserOperationFailed"]>;
     readonly trace_id: Schema.String;
     readonly span_id: Schema.String;
     readonly page_id: Schema.String;

package/types/telemetry/src/browser.d.ts

@@ -1,11 +1,16 @@
 /** Browser-owned Effect telemetry, shared by Promise calls and Atom runtimes. */
 import { Context, Effect, Layer, ManagedRuntime } from "effect";
-import { OtlpExporter } from "effect/unstable/observability";
-import { Atom } from "effect/unstable/reactivity";
+import { OtlpExporter } from "effect/observability";
+import { Atom } from "effect/reactivity";
 import type { TelemetryConfig } from "./config.js";
 declare const BrowserTelemetry_base: Context.ServiceClass<BrowserTelemetry, "executor/BrowserTelemetry", {
+    /**
+     * `load` names the document's initial route without a span: hydration resolves no route
+     * change, and first load is measured by the vitals. `start` opens a `ui.navigation` span
+     * that the router's next `end` closes or the next `start` interrupts.
+     */
     readonly navigation: (event: {
-        readonly type: "start";
+        readonly type: "load" | "start";
         readonly path: string;
     } | {
         readonly type: "end";

package/types/telemetry/src/config.d.ts

@@ -33,8 +33,8 @@ export declare const TelemetryConfig: Schema.Struct<{
 export type TelemetryConfig = typeof TelemetryConfig.Type;
 /** Host-only destinations; never copied into an app's invocation telemetry capability. */
 export declare const CurrentTelemetryConfig: Context.Reference<{
-    readonly version: string;
     readonly service: string;
+    readonly version: string;
     readonly environment: string;
     readonly clock?: "system" | "cloudflare-io" | undefined;
     readonly traces?: {
@@ -59,8 +59,8 @@ export declare const CurrentTelemetryConfig: Context.Reference<{
 } | undefined>;
 /** Read OTLP endpoints uniformly for all signals; development chooses which signals to configure. */
 export declare const telemetryConfig: (service: string) => Effect.Effect<{
-    readonly version: string;
     readonly service: string;
+    readonly version: string;
     readonly environment: string;
     readonly clock?: "system" | "cloudflare-io" | undefined;
     readonly traces?: {

package/types/telemetry/src/index.d.ts

@@ -5,5 +5,6 @@ export { captureTelemetry, traceHeaders, withRemoteSpan, invocationFetch, type I
 export { collectTelemetry, forwardTelemetry, makeTelemetryForwarder, TelemetryBatch, } from "./relay.js";
 export { TraceContext, currentTraceContext, externalTrace, traceLinks } from "./trace-context.js";
 export { pendingSpan } from "./pending-span.js";
+export { makeOwnershipAccounting, measuredSpan, owned, ownedBy, ownerAttribute, type Owner, type SpanMeasure, } from "./ownership.js";
 export { recordWorkerMeasurements } from "./measurements.js";
-export { allowlistedSpans, httpSpanAttributeAllowlist, spanAttributeAllowed, } from "./span-attributes.js";
+export { allowlistedSpans, httpSpanAttributeAllowlist, recordRoute, routeTemplates, spanAttributeAllowed, } from "./span-attributes.js";

package/types/telemetry/src/layer.d.ts

@@ -1,7 +1,13 @@
 /** Portable Effect exporters. The host owns scope and export lifetime. */
-import { Layer, Logger } from "effect";
+import { type Duration, Layer, Logger } from "effect";
 import { type TelemetryConfig } from "./config.js";
-/** Build one tracer per runtime. Event mode defers export until Worker scope finalization. */
-export declare const telemetryLayer: (config: TelemetryConfig, lifetime?: "process" | "event", logger?: Logger.Logger<unknown, void>) => Layer.Layer<import("effect/unstable/observability/OtlpExporter").Flusher, never, never>;
+/** How long each signal's final flush may take when the scope closes. */
+export type ShutdownTimeouts = Partial<Record<"traces" | "logs" | "metrics", Duration.Input>>;
+/**
+ * Build one tracer per runtime. Event mode defers export until Worker scope finalization.
+ * A signal's final flush gets three seconds unless `shutdownTimeouts` names its own bound; only
+ * the host that owns a destination knows it answers faster.
+ */
+export declare const telemetryLayer: (config: TelemetryConfig, lifetime?: "process" | "event", logger?: Logger.Logger<unknown, void>, shutdownTimeouts?: ShutdownTimeouts) => Layer.Layer<import("effect/observability/OtlpExporter").Flusher, never, never>;
 /** Node/local entry points resolve telemetry once and share it for their process lifetime. */
-export declare const telemetryFromConfig: (service: string) => Layer.Layer<import("effect/unstable/observability/OtlpExporter").Flusher, import("effect/Schema").SchemaError | import("effect/Config").ConfigError, never>;
+export declare const telemetryFromConfig: (service: string) => Layer.Layer<import("effect/observability/OtlpExporter").Flusher, import("effect/Schema").SchemaError | import("effect/Config").ConfigError, never>;

package/types/telemetry/src/measurements.d.ts

@@ -3,6 +3,6 @@ import { Effect } from "effect";
 /** Classify URLs into a fixed set before attaching attributes; raw paths and query strings are never labels. */
 export declare const recordResponseReady: (path: string | undefined, method: string, status: number, milliseconds: number) => Effect.Effect<void, never, never>;
 /** Fixed failure metadata goes to both local/native logs and the metric registry, even when the remote exporter is down. */
-export declare const recordExportFailure: (path: string, reason?: "transport" | "interrupted" | "partial-success" | "capacity" | "acknowledgement", records?: number) => Effect.Effect<void, never, never>;
+export declare const recordExportFailure: (path: string, reason: "transport" | "interrupted" | "partial-success" | "capacity" | "acknowledgement" | "timeout" | "relay" | "shutdown", records?: number) => Effect.Effect<void, never, never>;
 /** Record provider-owned invocation totals separately from response-ready timing. */
 export declare const recordWorkerMeasurements: (worker: string, outcome: string, cpu: number, wall: number) => Effect.Effect<void, never, never>;

package/types/telemetry/src/ownership.d.ts

@@ -0,0 +1,60 @@
+/**
+ * Who a span's work belongs to, and how a measured span's time divides among them. A span that
+ * starts work for someone other than its caller declares the owner with `ownedBy`; any other span
+ * works for whoever its parent works for. Each instant then belongs to the innermost boundary in
+ * progress, so Executor's work inside an upstream session stays Executor's, and an app's callback
+ * inside Executor's cache stays the app's. Background work is the exception: everything inside it
+ * is background, and it runs beside its caller rather than inside it. It takes no instant from the
+ * caller's window; how long it ran within the window is reported beside the division.
+ *
+ * Workers clocks advance only on I/O, so durations are comparable within one isolate and not across
+ * isolates: each isolate measures its own part, and the spans that already bracket the work define
+ * it, so the accounting and the trace agree.
+ */
+import { Context, Effect, Tracer } from "effect";
+/**
+ * Executor's own work; the app's authored code; waiting on an upstream provider; waiting on a
+ * person's answer; waiting on another call that holds the lease to load a cache entry; or work
+ * handed to the background, such as refreshing a stale cache entry, that no caller waits on.
+ */
+export type Owner = "executor" | "app" | "upstream" | "person" | "lease" | "background";
+/** The attribute that shows a boundary's owner in the trace; the telemetry tracer sets it. */
+export declare const ownerAttribute = "executor.owner";
+/** The owner a span declared when it started, if it is an ownership boundary. */
+export declare const declaredOwner: (annotations: Context.Context<never>) => Owner | undefined;
+/**
+ * Options for a span whose work belongs to `owner`. Every ownership boundary uses them, at the point
+ * the work starts: provider requests and sessions are the upstream's, Executor's services called by
+ * an app are Executor's, an app's callbacks are the app's, and waiting for an answer is the person's.
+ */
+export declare const ownedBy: (owner: Owner, options?: Tracer.SpanOptionsNoTrace) => Tracer.SpanOptionsNoTrace;
+/** Run `effect` in span `name`, owned by `owner`. */
+export declare const owned: (owner: Owner, name: string, options?: Tracer.SpanOptionsNoTrace) => <A, E, R>(effect: Effect.Effect<A, E, R>) => Effect.Effect<A, E, Exclude<R, Tracer.ParentSpan>>;
+/** What a measured span does with its work and its end. */
+export interface SpanMeasure {
+    /** Wraps the work inside the span, for example to observe the spans it opens. */
+    readonly around?: <A, E, R>(effect: Effect.Effect<A, E, R>) => Effect.Effect<A, E, R>;
+    /** Receives the span's end, before the span ends, to record what it measured on it. */
+    readonly end: (end: bigint, span: Tracer.Span) => void;
+}
+/**
+ * Run `effect` in span `name`, measured by `measure` from the span's own start to its own end, so
+ * the span's duration and the measurement share both boundaries.
+ */
+export declare const measuredSpan: (name: string, options: Tracer.SpanOptionsNoTrace, measure: (start: bigint) => SpanMeasure) => <A, E, R>(effect: Effect.Effect<A, E, R>) => Effect.Effect<A, E, Exclude<R, Tracer.ParentSpan>>;
+/**
+ * Divide a window that starts at `origin`, whose own work is `owner`'s, among owners. At each
+ * instant, the work in progress is the innermost span of each branch: a span with no child still
+ * open. Its owner takes the instant. With nothing open inside the window, `owner` takes it. Spans
+ * are counted as they open and end, in constant time each, and only spans still open are kept.
+ * `background` is not part of the division: it is how long background work was in progress.
+ */
+export declare const makeOwnershipAccounting: (origin: bigint, owner: Owner) => {
+    /** Run `effect` with the spans it opens observed, including spans it hands to later work. */
+    observe: <A, E, R>(effect: Effect.Effect<A, E, R>) => Effect.Effect<A, E, R>;
+    /**
+     * Close the window at `end` and return its milliseconds by owner, each instant counted once.
+     * Spans still open count up to `end`; spans that open or end afterwards are ignored.
+     */
+    read: (end: bigint) => Readonly<Record<Owner, number>>;
+};