apps 0.0.1-beta.0 → 0.0.1-beta.1

package/js/{chunk-HP7E42X6.js → chunk-IHQ4ML7K.js}

@@ -1,13 +1,28 @@
 import {
+  DatabaseSchema
+} from "./chunk-BMOIAIVR.js";
+import {
+  AppSkills,
+  SkillLoadFailed
+} from "./chunk-YEJOQEII.js";
+import {
+  OpenapiResponseError
+} from "./chunk-SWPD52J7.js";
+import {
+  ProviderError
+} from "./chunk-W7D7WVSY.js";
+import {
+  AccountId,
   HttpUrl,
   JsonObject as JsonObject2,
   JsonValue
-} from "./chunk-36DNRFZQ.js";
+} from "./chunk-SATWJKN6.js";
 import {
   Any,
   ArraySchema,
   Boolean,
   Class2 as Class,
+  Context_exports,
   Cron_exports,
   Data_exports,
   Defect,
@@ -55,77 +70,242 @@ import {
   transformOptional,
   withConstructorDefault,
   withDefault
-} from "./chunk-2OTCEKL2.js";
+} from "./chunk-FW5HBOIK.js";
 
-// src/contracts/provider.ts
-var SecretsMethod = class extends Data_exports.TaggedClass(
-  "secrets"
-) {
+// src/contracts/tools.ts
+var ToolAnnotations = Schema_exports.Struct({
+  title: Schema_exports.optionalKey(Schema_exports.String),
+  readOnlyHint: Schema_exports.optionalKey(Schema_exports.Boolean),
+  destructiveHint: Schema_exports.optionalKey(Schema_exports.Boolean),
+  idempotentHint: Schema_exports.optionalKey(Schema_exports.Boolean),
+  openWorldHint: Schema_exports.optionalKey(Schema_exports.Boolean)
+});
+
+// src/contracts/mcp.ts
+var McpClientLimits = Schema_exports.Struct({
+  timeoutMs: Schema_exports.Int.check(Schema_exports.isGreaterThan(0)),
+  maxTimeoutMs: Schema_exports.Int.check(Schema_exports.isGreaterThan(0)),
+  maxTools: Schema_exports.Int.check(Schema_exports.isGreaterThan(0)),
+  maxPaginationCursors: Schema_exports.Int.check(Schema_exports.isGreaterThan(0)),
+  cleanupTimeoutMs: Schema_exports.Int.check(Schema_exports.isGreaterThan(0))
+});
+var defaultMcpClientLimits = McpClientLimits.make({
+  timeoutMs: 3e4,
+  maxTimeoutMs: 3e5,
+  maxTools: 5e4,
+  maxPaginationCursors: 1e3,
+  cleanupTimeoutMs: 1e3
+});
+var mcpSdkTimerCeilingMs = 2147483647;
+var McpToolsOptions = Schema_exports.Struct({
+  url: HttpUrl,
+  accountId: Schema_exports.optional(AccountId),
+  headers: Schema_exports.optional(Schema_exports.Record(Schema_exports.String, Schema_exports.String)),
+  signal: Schema_exports.optional(Schema_exports.instanceOf(AbortSignal)),
+  timeoutMs: Schema_exports.optional(
+    Schema_exports.Number.check(
+      Schema_exports.isInt(),
+      Schema_exports.isBetween({ minimum: 1, maximum: defaultMcpClientLimits.maxTimeoutMs })
+    )
+  )
+});
+var McpToolResult = Schema_exports.Struct({
+  content: Schema_exports.Array(JsonObject2),
+  structuredContent: Schema_exports.optional(JsonObject2),
+  isError: Schema_exports.optional(Schema_exports.Boolean),
+  _meta: Schema_exports.optional(JsonObject2)
+});
+var McpToolMetadata = Schema_exports.Struct({
+  name: Schema_exports.String,
+  title: Schema_exports.optional(Schema_exports.String),
+  description: Schema_exports.optional(Schema_exports.String),
+  inputSchema: JsonObject2,
+  outputSchema: Schema_exports.optional(JsonObject2),
+  annotations: Schema_exports.optional(ToolAnnotations),
+  _meta: Schema_exports.optional(JsonObject2)
+});
+var McpError = class extends Schema_exports.TaggedError()("McpError", {
+  phase: Schema_exports.Literals(["connect", "discover", "call", "schema", "transport"]),
+  reason: Schema_exports.Literals([
+    "request",
+    "unauthorized",
+    "invalid_response",
+    "timeout",
+    "invalid_input"
+  ]),
+  status: Schema_exports.optional(Schema_exports.Number)
+}) {
 };
-var OAuthClientAuth = Schema_exports.Literals([
-  "none",
-  "client_secret_post",
-  "client_secret_basic",
-  "client_secret_basic_raw"
+var ProcessConfig = Schema_exports.Struct({
+  command: Schema_exports.NonEmptyString,
+  args: Schema_exports.Array(Schema_exports.String),
+  cwd: Schema_exports.optional(Schema_exports.String),
+  env: Schema_exports.Record(Schema_exports.String, Schema_exports.String),
+  timeoutMs: Schema_exports.Int.check(
+    Schema_exports.isBetween({ minimum: 1, maximum: defaultMcpClientLimits.maxTimeoutMs })
+  )
+});
+
+// src/contracts/workflows.ts
+var WorkflowRunId = Schema_exports.NonEmptyString.pipe(Schema_exports.brand("wfr"));
+var WorkflowName = Schema_exports.NonEmptyString.check(Schema_exports.isMaxLength(200));
+var durationUnits = {
+  millisecond: 1,
+  milliseconds: 1,
+  second: 1e3,
+  seconds: 1e3,
+  minute: 6e4,
+  minutes: 6e4,
+  hour: 36e5,
+  hours: 36e5,
+  day: 864e5,
+  days: 864e5,
+  week: 6048e5,
+  weeks: 6048e5
+};
+var workflowDurationMillis = (value) => {
+  if (typeof value === "number") return Number.isFinite(value) && value >= 0 ? value : void 0;
+  const match = /^(\d+(?:\.\d+)?) (milliseconds?|seconds?|minutes?|hours?|days?|weeks?)$/.exec(
+    value
+  );
+  const unit = match?.[2] === void 0 ? void 0 : durationUnits[match[2]];
+  if (unit === void 0) return void 0;
+  const result = Number(match?.[1]) * unit;
+  return Number.isFinite(result) ? result : void 0;
+};
+var WorkflowDuration = Schema_exports.Union([
+  Schema_exports.Finite.check(Schema_exports.isGreaterThanOrEqualTo(0)),
+  Schema_exports.NonEmptyString
+]).check(Schema_exports.makeFilter((value) => workflowDurationMillis(value) !== void 0));
+var WorkflowStepOptions = Schema_exports.Struct({
+  retries: Schema_exports.optionalKey(
+    Schema_exports.Struct({
+      limit: Schema_exports.Int.check(Schema_exports.isGreaterThanOrEqualTo(0)),
+      delay: WorkflowDuration,
+      backoff: Schema_exports.optionalKey(Schema_exports.Literals(["constant", "linear", "exponential"]))
+    })
+  ),
+  timeout: Schema_exports.optionalKey(WorkflowDuration)
+});
+var WorkflowFailure = class extends Schema_exports.TaggedError()("WorkflowFailure", {
+  reason: Schema_exports.Literals([
+    "unavailable",
+    "not_found",
+    "input",
+    "output",
+    "operation",
+    "approval",
+    "credentials",
+    "terminated",
+    "execution",
+    "conflict",
+    "engine"
+  ]),
+  retryable: Schema_exports.Boolean
+}) {
+};
+var NonRetryableError = class extends Error {
+  name = "NonRetryableError";
+};
+var WorkflowValue = JsonValue.check(
+  Schema_exports.makeFilter(
+    (value) => new TextEncoder().encode(JSON.stringify(value)).byteLength <= 1024 * 1024
+  )
+);
+var HostedWorkflow = Schema_exports.Struct({
+  name: WorkflowName,
+  description: Schema_exports.optionalKey(Schema_exports.String),
+  inputSchema: JsonObject2,
+  outputSchema: Schema_exports.optionalKey(JsonObject2)
+});
+var runFields = {
+  profile: Schema_exports.optionalKey(Schema_exports.NonEmptyString),
+  id: WorkflowRunId,
+  app: Schema_exports.NonEmptyString,
+  deployment: Schema_exports.NonEmptyString,
+  workflow: WorkflowName,
+  createdAt: Schema_exports.String
+};
+var WorkflowRun = Schema_exports.Union([
+  Schema_exports.Struct({
+    ...runFields,
+    status: Schema_exports.Literals(["queued", "running", "waiting", "paused", "waitingForPause"])
+  }),
+  Schema_exports.Struct({ ...runFields, status: Schema_exports.Literal("complete"), output: WorkflowValue }),
+  Schema_exports.Struct({
+    ...runFields,
+    status: Schema_exports.Literal("errored"),
+    error: WorkflowFailure.fields.reason
+  }),
+  Schema_exports.Struct({ ...runFields, status: Schema_exports.Literal("terminated") })
 ]);
-var OAuthSecretClientAuth = Schema_exports.Literals([
-  "client_secret_post",
-  "client_secret_basic",
-  "client_secret_basic_raw"
+var WorkflowRunPage = Schema_exports.Struct({
+  items: Schema_exports.Array(WorkflowRun),
+  next: Schema_exports.optionalKey(WorkflowRunId)
+});
+var WorkflowReplay = Schema_exports.Struct({
+  key: Schema_exports.NonEmptyString,
+  fingerprint: Schema_exports.NonEmptyString
+});
+var WorkflowCommand = Schema_exports.Union([
+  Schema_exports.Struct({ operation: Schema_exports.Literal("workflows") }),
+  Schema_exports.Struct({
+    operation: Schema_exports.Literal("workflow-validate"),
+    name: WorkflowName,
+    input: JsonValue
+  }),
+  Schema_exports.Struct({
+    operation: Schema_exports.Literal("workflow-run"),
+    name: WorkflowName,
+    input: JsonValue
+  })
 ]);
-var oauthOptions = {
-  grant: Schema_exports.optionalKey(Schema_exports.Literal("authorization_code")),
-  tokenEndpointAuthMethod: Schema_exports.optionalKey(OAuthClientAuth),
-  /** Omitted uses discovery; null explicitly suppresses the resource parameter. */
-  resource: Schema_exports.optionalKey(Schema_exports.NullOr(HttpUrl))
-};
-var OAuth2Config = Schema_exports.Union([
+var WorkflowRpcCommand = Schema_exports.Union([
   Schema_exports.Struct({
-    ...oauthOptions,
-    discover: HttpUrl,
-    authorizationUrl: Schema_exports.optionalKey(Schema_exports.Never),
-    tokenUrl: Schema_exports.optionalKey(Schema_exports.Never),
-    scopes: Schema_exports.optionalKey(Schema_exports.Array(Schema_exports.String))
+    operation: Schema_exports.Literal("do"),
+    name: WorkflowName,
+    options: WorkflowStepOptions
   }),
   Schema_exports.Struct({
-    ...oauthOptions,
-    authorizationUrl: HttpUrl,
-    tokenUrl: HttpUrl,
-    scopes: Schema_exports.Array(Schema_exports.String),
-    discover: Schema_exports.optionalKey(Schema_exports.Never)
+    operation: Schema_exports.Literal("sleep"),
+    name: WorkflowName,
+    duration: WorkflowDuration
   }),
   Schema_exports.Struct({
-    grant: Schema_exports.Literal("client_credentials"),
-    discover: HttpUrl,
-    authorizationUrl: Schema_exports.optionalKey(Schema_exports.Never),
-    tokenUrl: Schema_exports.optionalKey(Schema_exports.Never),
-    scopes: Schema_exports.optionalKey(Schema_exports.Array(Schema_exports.String)),
-    tokenEndpointAuthMethod: OAuthSecretClientAuth,
-    resource: Schema_exports.optionalKey(Schema_exports.NullOr(HttpUrl))
+    operation: Schema_exports.Literal("until"),
+    name: WorkflowName,
+    timestamp: Schema_exports.Finite
   }),
+  Schema_exports.Struct({ operation: Schema_exports.Literal("context") }),
   Schema_exports.Struct({
-    grant: Schema_exports.Literal("client_credentials"),
-    tokenUrl: HttpUrl,
-    scopes: Schema_exports.Array(Schema_exports.String),
-    tokenEndpointAuthMethod: OAuthSecretClientAuth,
-    resource: Schema_exports.optionalKey(Schema_exports.NullOr(HttpUrl)),
-    authorizationUrl: Schema_exports.optionalKey(Schema_exports.Never),
-    discover: Schema_exports.optionalKey(Schema_exports.Never)
+    operation: Schema_exports.Literal("invoke"),
+    kind: Schema_exports.Literals(["query", "mutation"]),
+    name: Schema_exports.NonEmptyString,
+    input: JsonValue,
+    stepId: Schema_exports.NonEmptyString,
+    timeout: Schema_exports.Finite.check(Schema_exports.isGreaterThanOrEqualTo(0))
   })
 ]);
-var OAuth2AccessToken = Schema_exports.Struct({ access_token: Schema_exports.String });
-var OAuth2Method = class extends Data_exports.TaggedClass(
-  "oauth2"
-) {
-};
-var Provider = class extends Data_exports.Class {
-  /** Declare zero or more accounts from this provider without performing I/O. */
-  many() {
-    return new ManyAccounts({ provider: this });
-  }
-};
-var ManyAccounts = class extends Data_exports.TaggedClass("many") {
-};
+var WorkflowRpcResult = Schema_exports.Union([
+  Schema_exports.Struct({ ok: Schema_exports.Literal(true), value: JsonValue }),
+  Schema_exports.Struct({ ok: Schema_exports.Literal(false), error: WorkflowFailure })
+]);
+var WorkflowControlCommand = Schema_exports.Union([
+  Schema_exports.Struct({
+    operation: Schema_exports.Literal("start"),
+    workflow: WorkflowName,
+    input: WorkflowValue,
+    key: Schema_exports.optionalKey(Schema_exports.NonEmptyString.check(Schema_exports.isMaxLength(128)))
+  }),
+  Schema_exports.Struct({ operation: Schema_exports.Literal("get"), run: WorkflowRunId }),
+  Schema_exports.Struct({
+    operation: Schema_exports.Literal("list"),
+    workflow: Schema_exports.optionalKey(WorkflowName),
+    cursor: Schema_exports.optionalKey(WorkflowRunId),
+    limit: Schema_exports.optionalKey(Schema_exports.Int.check(Schema_exports.isBetween({ minimum: 1, maximum: 100 })))
+  }),
+  Schema_exports.Struct({ operation: Schema_exports.Literal("terminate"), run: WorkflowRunId })
+]);
 
 // src/contracts/schedules.ts
 var minimumIntervalMilliseconds = 6e4;
@@ -162,7 +342,7 @@ var OperationSchedule = Schema_exports.Struct({
   input: JsonValue
 });
 
-// ../../node_modules/.bun/effect@https+++pkg.pr.new+Effect-TS+effect+effect@c7d1ffff31a3e2ae0b0b0796b742bddeb797269d/node_modules/effect/dist/unstable/rpc/RpcSchema.js
+// ../../node_modules/.bun/effect@https+++pkg.pr.new+Effect-TS+effect+effect@c7d1ffff31a3e2ae0b0b+a654a55b752bdb24/node_modules/effect/dist/unstable/rpc/RpcSchema.js
 var StreamSchemaTypeId = "~effect/rpc/RpcSchema/StreamSchema";
 var schema = /* @__PURE__ */ declare(isStream);
 function Stream(success, error) {
@@ -173,7 +353,7 @@ function Stream(success, error) {
   });
 }
 
-// ../../node_modules/.bun/effect@https+++pkg.pr.new+Effect-TS+effect+effect@c7d1ffff31a3e2ae0b0b0796b742bddeb797269d/node_modules/effect/dist/unstable/rpc/Rpc.js
+// ../../node_modules/.bun/effect@https+++pkg.pr.new+Effect-TS+effect+effect@c7d1ffff31a3e2ae0b0b+a654a55b752bdb24/node_modules/effect/dist/unstable/rpc/Rpc.js
 var TypeId = "~effect/rpc/Rpc";
 var Proto = {
   [TypeId]: TypeId,
@@ -291,7 +471,7 @@ var make2 = (tag2, options) => {
   });
 };
 
-// ../../node_modules/.bun/effect@https+++pkg.pr.new+Effect-TS+effect+effect@c7d1ffff31a3e2ae0b0b0796b742bddeb797269d/node_modules/effect/dist/unstable/ai/McpSchema.js
+// ../../node_modules/.bun/effect@https+++pkg.pr.new+Effect-TS+effect+effect@c7d1ffff31a3e2ae0b0b+a654a55b752bdb24/node_modules/effect/dist/unstable/ai/McpSchema.js
 var optionalWithDefault = (schema2, defaultValue) => {
   const effect = sync(defaultValue);
   return optionalKey(schema2).pipe(decode({
@@ -561,7 +741,7 @@ var InternalError = class _InternalError extends (/* @__PURE__ */ Error2("effect
     message: "Not implemented"
   });
 };
-var McpError = /* @__PURE__ */ Union([ParseError, InvalidRequest, MethodNotFound, InvalidParams, InternalError, McpErrorBase]);
+var McpError2 = /* @__PURE__ */ Union([ParseError, InvalidRequest, MethodNotFound, InvalidParams, InternalError, McpErrorBase]);
 var InitializeResult = class extends (/* @__PURE__ */ Opaque()(/* @__PURE__ */ Struct({
   ...ResultMeta.fields,
   /**
@@ -584,7 +764,7 @@ var InitializeResult = class extends (/* @__PURE__ */ Opaque()(/* @__PURE__ */ S
 };
 var Initialize = class extends (/* @__PURE__ */ make2("initialize", {
   success: InitializeResult,
-  error: McpError,
+  error: McpError2,
   payload: {
     ...RequestMeta.fields,
     /**
@@ -783,7 +963,7 @@ var ReadResourceResult = class extends (/* @__PURE__ */ Opaque()(/* @__PURE__ */
 };
 var ReadResource = class extends (/* @__PURE__ */ make2("resources/read", {
   success: ReadResourceResult,
-  error: McpError,
+  error: McpError2,
   payload: {
     ...RequestMeta.fields,
     /**
@@ -796,7 +976,7 @@ var ReadResource = class extends (/* @__PURE__ */ make2("resources/read", {
 };
 var Subscribe = class extends (/* @__PURE__ */ make2("resources/subscribe", {
   success: /* @__PURE__ */ Struct({}),
-  error: McpError,
+  error: McpError2,
   payload: {
     ...RequestMeta.fields,
     /**
@@ -809,7 +989,7 @@ var Subscribe = class extends (/* @__PURE__ */ make2("resources/subscribe", {
 };
 var Unsubscribe = class extends (/* @__PURE__ */ make2("resources/unsubscribe", {
   success: /* @__PURE__ */ Struct({}),
-  error: McpError,
+  error: McpError2,
   payload: {
     ...RequestMeta.fields,
     /**
@@ -953,7 +1133,7 @@ var GetPromptResult = class extends (/* @__PURE__ */ Class("@effect/ai/McpSchema
 };
 var GetPrompt = class extends (/* @__PURE__ */ make2("prompts/get", {
   success: GetPromptResult,
-  error: McpError,
+  error: McpError2,
   payload: {
     ...RequestMeta.fields,
     /**
@@ -968,7 +1148,7 @@ var GetPrompt = class extends (/* @__PURE__ */ make2("prompts/get", {
   }
 })) {
 };
-var ToolAnnotations = class extends (/* @__PURE__ */ Opaque()(/* @__PURE__ */ Struct({
+var ToolAnnotations2 = class extends (/* @__PURE__ */ Opaque()(/* @__PURE__ */ Struct({
   /**
    * A human-readable title for the tool.
    */
@@ -1037,7 +1217,7 @@ var Tool = class extends (/* @__PURE__ */ Class("@effect/ai/McpSchema/Tool")({
   /**
    * Optional additional tool information.
    */
-  annotations: /* @__PURE__ */ optional2(ToolAnnotations),
+  annotations: /* @__PURE__ */ optional2(ToolAnnotations2),
   /**
    * Icons that clients can display for this tool.
    */
@@ -1073,7 +1253,7 @@ var CallToolResult = class extends (/* @__PURE__ */ Class("@effect/ai/McpSchema/
 };
 var CallTool = class extends (/* @__PURE__ */ make2("tools/call", {
   success: CallToolResult,
-  error: McpError,
+  error: McpError2,
   payload: {
     ...RequestMeta.fields,
     name: String,
@@ -1093,7 +1273,7 @@ var SetLevel = class extends (/* @__PURE__ */ make2("logging/setLevel", {
     level: LoggingLevel
   },
   success: /* @__PURE__ */ Struct({}),
-  error: McpError
+  error: McpError2
 })) {
 };
 var LoggingMessageNotification = class extends (/* @__PURE__ */ make2("notifications/message", {
@@ -1239,7 +1419,7 @@ var CreateMessageResult = class extends (/* @__PURE__ */ Class("@effect/ai/McpSc
 };
 var CreateMessage = class extends (/* @__PURE__ */ make2("sampling/createMessage", {
   success: CreateMessageResult,
-  error: McpError,
+  error: McpError2,
   payload: {
     messages: /* @__PURE__ */ ArraySchema(SamplingMessage),
     /**
@@ -1450,7 +1630,7 @@ var ElicitDeclineResult = class extends (/* @__PURE__ */ Class("@effect/ai/McpSc
 var ElicitResult = /* @__PURE__ */ Union([ElicitAcceptResult, ElicitDeclineResult]);
 var Elicit = class extends (/* @__PURE__ */ make2("elicitation/create", {
   success: ElicitResult,
-  error: McpError,
+  error: McpError2,
   payload: ElicitRequestParams
 })) {
 };
@@ -1516,165 +1696,403 @@ ${JSON.stringify(input, null, 2)}`,
   requestedSchema: { type: "object", properties: {} }
 });
 
-// src/contracts/workflows.ts
-var WorkflowRunId = Schema_exports.NonEmptyString.pipe(Schema_exports.brand("wfr"));
-var WorkflowName = Schema_exports.NonEmptyString.check(Schema_exports.isMaxLength(200));
-var durationUnits = {
-  millisecond: 1,
-  milliseconds: 1,
-  second: 1e3,
-  seconds: 1e3,
-  minute: 6e4,
-  minutes: 6e4,
-  hour: 36e5,
-  hours: 36e5,
-  day: 864e5,
-  days: 864e5,
-  week: 6048e5,
-  weeks: 6048e5
-};
-var workflowDurationMillis = (value) => {
-  if (typeof value === "number") return Number.isFinite(value) && value >= 0 ? value : void 0;
-  const match = /^(\d+(?:\.\d+)?) (milliseconds?|seconds?|minutes?|hours?|days?|weeks?)$/.exec(
-    value
-  );
-  const unit = match?.[2] === void 0 ? void 0 : durationUnits[match[2]];
-  if (unit === void 0) return void 0;
-  const result = Number(match?.[1]) * unit;
-  return Number.isFinite(result) ? result : void 0;
-};
-var WorkflowDuration = Schema_exports.Union([
-  Schema_exports.Finite.check(Schema_exports.isGreaterThanOrEqualTo(0)),
-  Schema_exports.NonEmptyString
-]).check(Schema_exports.makeFilter((value) => workflowDurationMillis(value) !== void 0));
-var WorkflowStepOptions = Schema_exports.Struct({
-  retries: Schema_exports.optionalKey(
-    Schema_exports.Struct({
-      limit: Schema_exports.Int.check(Schema_exports.isGreaterThanOrEqualTo(0)),
-      delay: WorkflowDuration,
-      backoff: Schema_exports.optionalKey(Schema_exports.Literals(["constant", "linear", "exponential"]))
-    })
-  ),
-  timeout: Schema_exports.optionalKey(WorkflowDuration)
+// src/contracts/webhook-protocol.ts
+var WebhookTransportLimits = Schema_exports.Struct({
+  maxBodyBytes: Schema_exports.Int.check(Schema_exports.isGreaterThan(0))
 });
-var WorkflowFailure = class extends Schema_exports.TaggedError()("WorkflowFailure", {
-  reason: Schema_exports.Literals([
-    "unavailable",
-    "not_found",
-    "input",
-    "output",
-    "operation",
-    "approval",
-    "credentials",
-    "terminated",
-    "execution",
-    "conflict",
-    "engine"
-  ]),
-  retryable: Schema_exports.Boolean
-}) {
-};
-var NonRetryableError = class extends Error {
-  name = "NonRetryableError";
+var defaultWebhookTransportLimits = WebhookTransportLimits.make({
+  maxBodyBytes: 1024 * 1024
+});
+var encodedBodyChars = 4 * Math.ceil(defaultWebhookTransportLimits.maxBodyBytes / 3);
+var WebhookRequestData = Schema_exports.Struct({
+  url: HttpUrl,
+  method: Schema_exports.Literals(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"]),
+  headers: Schema_exports.Record(Schema_exports.String, Schema_exports.String),
+  body: Schema_exports.String.check(Schema_exports.isMaxLength(encodedBodyChars))
+});
+var WebhookResponseData = Schema_exports.Struct({
+  status: Schema_exports.Int.check(Schema_exports.isBetween({ minimum: 200, maximum: 599 })),
+  headers: Schema_exports.Record(Schema_exports.String, Schema_exports.String),
+  body: Schema_exports.String.check(Schema_exports.isMaxLength(encodedBodyChars))
+});
+var ManualWebhookSetup = Schema_exports.Struct({
+  instructions: Schema_exports.NonEmptyString,
+  signingSecret: Schema_exports.Literals(["executor", "provider"])
+});
+var ManualWebhookDescriptor = Schema_exports.Struct({
+  ...ManualWebhookSetup.fields,
+  stateSchema: JsonObject2
+});
+var HostedWebhook = Schema_exports.Struct({
+  name: Schema_exports.NonEmptyString,
+  account: Schema_exports.NonEmptyString,
+  configSchema: JsonObject2,
+  setup: Schema_exports.optionalKey(ManualWebhookDescriptor)
+});
+var identity = {
+  name: Schema_exports.NonEmptyString,
+  subscriptionId: Schema_exports.NonEmptyString,
+  sourceAccount: AccountId,
+  callbackUrl: HttpUrl,
+  secret: Schema_exports.String,
+  config: JsonValue
+};
+var WebhookCommand = Schema_exports.Union([
+  Schema_exports.Struct({ operation: Schema_exports.Literal("webhooks") }),
+  Schema_exports.Struct({ operation: Schema_exports.Literal("webhook-validate"), ...identity }),
+  Schema_exports.Struct({ operation: Schema_exports.Literal("webhook-complete"), ...identity, state: JsonValue }),
+  Schema_exports.Struct({ operation: Schema_exports.Literal("webhook-register"), ...identity }),
+  Schema_exports.Struct({ operation: Schema_exports.Literal("webhook-unregister"), ...identity, state: JsonValue }),
+  Schema_exports.Struct({
+    operation: Schema_exports.Literal("webhook-handle"),
+    ...identity,
+    state: JsonValue,
+    request: WebhookRequestData
+  })
+]);
+
+// src/contracts/provider.ts
+var SecretsMethod = class extends Data_exports.TaggedClass(
+  "secrets"
+) {
 };
-var WorkflowValue = JsonValue.check(
+var OAuthClientAuth = Schema_exports.Literals([
+  "none",
+  "client_secret_post",
+  "client_secret_basic",
+  "client_secret_basic_raw"
+]);
+var OAuthSecretClientAuth = Schema_exports.Literals([
+  "client_secret_post",
+  "client_secret_basic",
+  "client_secret_basic_raw"
+]);
+var reservedAuthorizationParams = /* @__PURE__ */ new Set([
+  "response_type",
+  "client_id",
+  "redirect_uri",
+  "state",
+  "scope",
+  "code_challenge",
+  "code_challenge_method",
+  "nonce",
+  "resource",
+  "request",
+  "request_uri"
+]);
+var OAuthAuthorizationParams = Schema_exports.Record(Schema_exports.String, Schema_exports.String).check(
   Schema_exports.makeFilter(
-    (value) => new TextEncoder().encode(JSON.stringify(value)).byteLength <= 1024 * 1024
+    (params) => Object.keys(params).every((key) => !reservedAuthorizationParams.has(key)),
+    {
+      message: "Authorization parameters cannot replace protocol parameters such as state or scope."
+    }
   )
 );
-var HostedWorkflow = Schema_exports.Struct({
-  name: WorkflowName,
-  description: Schema_exports.optionalKey(Schema_exports.String),
-  inputSchema: JsonObject2,
-  outputSchema: Schema_exports.optionalKey(JsonObject2)
-});
-var runFields = {
-  profile: Schema_exports.optionalKey(Schema_exports.NonEmptyString),
-  id: WorkflowRunId,
-  app: Schema_exports.NonEmptyString,
-  deployment: Schema_exports.NonEmptyString,
-  workflow: WorkflowName,
-  createdAt: Schema_exports.String
+var oauthOptions = {
+  grant: Schema_exports.optionalKey(Schema_exports.Literal("authorization_code")),
+  authorizationParams: Schema_exports.optionalKey(OAuthAuthorizationParams),
+  tokenEndpointAuthMethod: Schema_exports.optionalKey(OAuthClientAuth),
+  /** Omitted uses discovery; null explicitly suppresses the resource parameter. */
+  resource: Schema_exports.optionalKey(Schema_exports.NullOr(HttpUrl))
 };
-var WorkflowRun = Schema_exports.Union([
+var OAuth2Config = Schema_exports.Union([
   Schema_exports.Struct({
-    ...runFields,
-    status: Schema_exports.Literals(["queued", "running", "waiting", "paused", "waitingForPause"])
+    ...oauthOptions,
+    discover: HttpUrl,
+    authorizationUrl: Schema_exports.optionalKey(Schema_exports.Never),
+    tokenUrl: Schema_exports.optionalKey(Schema_exports.Never),
+    revocationUrl: Schema_exports.optionalKey(Schema_exports.Never),
+    scopes: Schema_exports.optionalKey(Schema_exports.Array(Schema_exports.String))
   }),
-  Schema_exports.Struct({ ...runFields, status: Schema_exports.Literal("complete"), output: WorkflowValue }),
   Schema_exports.Struct({
-    ...runFields,
-    status: Schema_exports.Literal("errored"),
-    error: WorkflowFailure.fields.reason
+    ...oauthOptions,
+    authorizationUrl: HttpUrl,
+    tokenUrl: HttpUrl,
+    revocationUrl: Schema_exports.optionalKey(HttpUrl),
+    scopes: Schema_exports.Array(Schema_exports.String),
+    /** RFC 8414 issuer identifier. Declared issuers are checked against the callback's `iss`. */
+    issuer: Schema_exports.optionalKey(HttpUrl),
+    discover: Schema_exports.optionalKey(Schema_exports.Never)
   }),
-  Schema_exports.Struct({ ...runFields, status: Schema_exports.Literal("terminated") })
+  Schema_exports.Struct({
+    grant: Schema_exports.Literal("client_credentials"),
+    discover: HttpUrl,
+    authorizationUrl: Schema_exports.optionalKey(Schema_exports.Never),
+    tokenUrl: Schema_exports.optionalKey(Schema_exports.Never),
+    revocationUrl: Schema_exports.optionalKey(Schema_exports.Never),
+    scopes: Schema_exports.optionalKey(Schema_exports.Array(Schema_exports.String)),
+    tokenEndpointAuthMethod: OAuthSecretClientAuth,
+    resource: Schema_exports.optionalKey(Schema_exports.NullOr(HttpUrl))
+  }),
+  Schema_exports.Struct({
+    grant: Schema_exports.Literal("client_credentials"),
+    tokenUrl: HttpUrl,
+    revocationUrl: Schema_exports.optionalKey(HttpUrl),
+    scopes: Schema_exports.Array(Schema_exports.String),
+    tokenEndpointAuthMethod: OAuthSecretClientAuth,
+    resource: Schema_exports.optionalKey(Schema_exports.NullOr(HttpUrl)),
+    authorizationUrl: Schema_exports.optionalKey(Schema_exports.Never),
+    discover: Schema_exports.optionalKey(Schema_exports.Never)
+  })
 ]);
-var WorkflowRunPage = Schema_exports.Struct({
-  items: Schema_exports.Array(WorkflowRun),
-  next: Schema_exports.optionalKey(WorkflowRunId)
-});
-var WorkflowReplay = Schema_exports.Struct({
-  key: Schema_exports.NonEmptyString,
-  fingerprint: Schema_exports.NonEmptyString
-});
-var WorkflowCommand = Schema_exports.Union([
-  Schema_exports.Struct({ operation: Schema_exports.Literal("workflows") }),
+var OAuth2AccessToken = Schema_exports.Struct({ access_token: Schema_exports.String });
+var OAuth2Method = class extends Data_exports.TaggedClass(
+  "oauth2"
+) {
+};
+var Provider = class extends Data_exports.Class {
+  /** Declare zero or more accounts from this provider without performing I/O. */
+  many() {
+    return new ManyAccounts({ provider: this });
+  }
+};
+var ManyAccounts = class extends Data_exports.TaggedClass("many") {
+};
+
+// src/contracts/operations.ts
+var OperationToolPrefixes = { query: "queries.", mutate: "mutations." };
+
+// src/contracts/host.ts
+var DeclaredAuthMethod = Schema_exports.Union([
+  Schema_exports.Struct({ type: Schema_exports.Literal("secrets"), label: Schema_exports.String, fields: JsonObject2 }),
   Schema_exports.Struct({
-    operation: Schema_exports.Literal("workflow-validate"),
-    name: WorkflowName,
-    input: JsonValue
+    type: Schema_exports.Literal("oauth2"),
+    ...OAuth2Config.members[0].fields,
+    response: JsonObject2
   }),
   Schema_exports.Struct({
-    operation: Schema_exports.Literal("workflow-run"),
-    name: WorkflowName,
-    input: JsonValue
+    type: Schema_exports.Literal("oauth2"),
+    ...OAuth2Config.members[1].fields,
+    response: JsonObject2
+  }),
+  Schema_exports.Struct({
+    type: Schema_exports.Literal("oauth2"),
+    ...OAuth2Config.members[2].fields,
+    response: JsonObject2
+  }),
+  Schema_exports.Struct({
+    type: Schema_exports.Literal("oauth2"),
+    ...OAuth2Config.members[3].fields,
+    response: JsonObject2
   })
 ]);
-var WorkflowRpcCommand = Schema_exports.Union([
+var DeclaredProvider = Schema_exports.Struct({
+  name: Schema_exports.NonEmptyString,
+  auth: Schema_exports.Record(Schema_exports.NonEmptyString, DeclaredAuthMethod)
+});
+var DeclaredRequirements = Schema_exports.Struct({
+  /** Protocol support of this retained framework build, not an author-declared requirement. */
+  capabilities: Schema_exports.optionalKey(
+    Schema_exports.Struct({
+      skills: Schema_exports.Literal(true),
+      /** Accepts inspect detail and tools. Earlier builds reject both as excess fields. */
+      toolIndex: Schema_exports.optionalKey(Schema_exports.Literal(true)),
+      /** Accepts skills sources and reports whether the catalog includes a live loader. */
+      skillSources: Schema_exports.optionalKey(Schema_exports.Literal(true)),
+      /** Accepts scheduled inspection. Earlier builds reject it as an excess field. */
+      scheduledTools: Schema_exports.optionalKey(Schema_exports.Literal(true))
+    })
+  ),
+  database: Schema_exports.optionalKey(DatabaseSchema),
+  accounts: Schema_exports.Record(
+    Schema_exports.NonEmptyString,
+    Schema_exports.Struct({
+      definition: DeclaredProvider,
+      cardinality: Schema_exports.Literals(["one", "many"])
+    })
+  )
+});
+var ResolvedAccount = Schema_exports.Struct({
+  id: AccountId,
+  provider: DeclaredProvider,
+  method: Schema_exports.NonEmptyString,
+  fields: JsonObject2
+});
+var ResolvedAccounts = Schema_exports.Record(
+  Schema_exports.NonEmptyString,
+  Schema_exports.Union([ResolvedAccount, Schema_exports.Array(ResolvedAccount)])
+);
+var TrustedToolApproval = Schema_exports.Struct({ tool: Schema_exports.NonEmptyString, input: JsonValue });
+var InvocationDeadline = Schema_exports.Finite.check(Schema_exports.isGreaterThanOrEqualTo(0));
+var HostedTool = Schema_exports.Struct({
+  schedules: Schema_exports.optionalKey(Schema_exports.Array(OperationSchedule)),
+  name: Schema_exports.NonEmptyString,
+  description: Schema_exports.String,
+  inputSchema: JsonObject2,
+  readOnly: Schema_exports.optionalKey(Schema_exports.Boolean),
+  title: Schema_exports.optionalKey(Schema_exports.String),
+  outputSchema: Schema_exports.optionalKey(JsonObject2),
+  annotations: Schema_exports.optionalKey(ToolAnnotations),
+  _meta: Schema_exports.optionalKey(JsonObject2)
+});
+var HostedToolSummary = HostedTool.mapFields(
+  ({ inputSchema: _input, outputSchema: _output, _meta, ...fields }) => fields
+);
+var SkillSources = Schema_exports.Struct({ skills: AppSkills, dynamic: Schema_exports.Boolean });
+var skillsCommand = (sources) => sources ? { operation: "skills", sources: true } : { operation: "skills" };
+var SkillCatalogResponse = Schema_exports.Union([SkillSources, AppSkills]);
+var skillCatalog = (response) => Schema_exports.is(SkillSources)(response) ? response : { skills: response };
+var inspectCommand = (tools, scheduled) => ({
+  operation: "inspect",
+  ...tools === void 0 ? {} : { tools: [...tools] },
+  ...scheduled === void 0 ? {} : { scheduled }
+});
+var indexCommand = { operation: "inspect", detail: "summary" };
+var selectTools = (tools) => (all) => tools === void 0 ? all : all.filter((tool) => tools.includes(tool.name));
+var HostRequest = Schema_exports.Union([
+  WorkflowCommand,
+  WebhookCommand,
+  Schema_exports.Struct({ operation: Schema_exports.Literal("requirements") }),
   Schema_exports.Struct({
-    operation: Schema_exports.Literal("do"),
-    name: WorkflowName,
-    options: WorkflowStepOptions
+    operation: Schema_exports.Literal("inspect"),
+    /** Omit schemas. Only builds that declare the toolIndex capability accept this. */
+    detail: Schema_exports.optionalKey(Schema_exports.Literal("summary")),
+    /** Describe only these tools. Only builds that declare the toolIndex capability accept this. */
+    tools: Schema_exports.optionalKey(Schema_exports.Array(Schema_exports.NonEmptyString)),
+    /**
+     * Describe only declared operations that have schedules, without dynamic tool discovery.
+     * Only builds that declare the scheduledTools capability accept this.
+     */
+    scheduled: Schema_exports.optionalKey(Schema_exports.Literal(true))
   }),
   Schema_exports.Struct({
-    operation: Schema_exports.Literal("sleep"),
-    name: WorkflowName,
-    duration: WorkflowDuration
+    operation: Schema_exports.Literal("skills"),
+    /** Answer with SkillSources. Only builds that declare the skillSources capability accept this. */
+    sources: Schema_exports.optionalKey(Schema_exports.Literal(true))
   }),
   Schema_exports.Struct({
-    operation: Schema_exports.Literal("until"),
-    name: WorkflowName,
-    timestamp: Schema_exports.Finite
+    operation: Schema_exports.Literal("query"),
+    name: Schema_exports.NonEmptyString,
+    input: JsonValue
   }),
-  Schema_exports.Struct({ operation: Schema_exports.Literal("context") }),
   Schema_exports.Struct({
-    operation: Schema_exports.Literal("invoke"),
-    kind: Schema_exports.Literals(["query", "mutation"]),
+    operation: Schema_exports.Literal("mutate"),
     name: Schema_exports.NonEmptyString,
-    input: JsonValue,
-    stepId: Schema_exports.NonEmptyString,
-    timeout: Schema_exports.Finite.check(Schema_exports.isGreaterThanOrEqualTo(0))
+    input: JsonValue
+  }),
+  Schema_exports.Struct({
+    operation: Schema_exports.Literal("call"),
+    tool: Schema_exports.NonEmptyString,
+    input: JsonValue
   })
 ]);
-var WorkflowRpcResult = Schema_exports.Union([
-  Schema_exports.Struct({ ok: Schema_exports.Literal(true), value: JsonValue }),
-  Schema_exports.Struct({ ok: Schema_exports.Literal(false), error: WorkflowFailure })
+var HostRequestInvalid = class extends Schema_exports.TaggedError()(
+  "HostRequestInvalid",
+  {}
+) {
+};
+var HostAccountsInvalid = class extends Schema_exports.TaggedError()(
+  "HostAccountsInvalid",
+  {}
+) {
+};
+var HostDeclarationInvalid = class extends Schema_exports.TaggedError()(
+  "HostDeclarationInvalid",
+  {}
+) {
+};
+var HostEvaluationFailed = class extends Schema_exports.TaggedError()(
+  "HostEvaluationFailed",
+  {}
+) {
+};
+var HostOperationNotFound = class extends Schema_exports.TaggedError()(
+  "HostOperationNotFound",
+  {}
+) {
+};
+var HostOperationFailed = class extends Schema_exports.TaggedError()(
+  "HostOperationFailed",
+  {}
+) {
+};
+var HostToolNotFound = class extends Schema_exports.TaggedError()(
+  "HostToolNotFound",
+  {}
+) {
+};
+var InputProblem = Schema_exports.String.check(Schema_exports.isMaxLength(512));
+var maxInputProblems = 10;
+var HostInputInvalid = class extends Schema_exports.TaggedError()("HostInputInvalid", {
+  problems: Schema_exports.optionalKey(
+    Schema_exports.Array(InputProblem).check(Schema_exports.isMaxLength(maxInputProblems))
+  )
+}) {
+};
+var HostToolBlocked = class extends Schema_exports.TaggedError()("HostToolBlocked", {}) {
+};
+var HostToolApprovalRequired = class extends Schema_exports.TaggedError()(
+  "HostToolApprovalRequired",
+  { input: JsonValue, elicitation: ApprovalElicitation }
+) {
+};
+var HostToolPolicyFailed = class extends Schema_exports.TaggedError()(
+  "HostToolPolicyFailed",
+  {}
+) {
+};
+var HostOutputInvalid = class extends Schema_exports.TaggedError()(
+  "HostOutputInvalid",
+  {}
+) {
+};
+var HostRequirementsError = Schema_exports.Union([HostRequestInvalid, HostDeclarationInvalid]);
+var HostInspectError = Schema_exports.Union([
+  ProviderError,
+  McpError,
+  SkillLoadFailed,
+  HostRequestInvalid,
+  HostDeclarationInvalid,
+  HostAccountsInvalid,
+  HostEvaluationFailed
 ]);
-var WorkflowControlCommand = Schema_exports.Union([
-  Schema_exports.Struct({
-    operation: Schema_exports.Literal("start"),
-    workflow: WorkflowName,
-    input: WorkflowValue,
-    key: Schema_exports.optionalKey(Schema_exports.NonEmptyString.check(Schema_exports.isMaxLength(128)))
-  }),
-  Schema_exports.Struct({ operation: Schema_exports.Literal("get"), run: WorkflowRunId }),
+var HostCallError = Schema_exports.Union([
+  OpenapiResponseError,
+  WorkflowFailure,
+  HostInspectError,
+  HostToolNotFound,
+  HostOperationNotFound,
+  HostOperationFailed,
+  HostInputInvalid,
+  HostOutputInvalid,
+  HostToolBlocked,
+  HostToolApprovalRequired,
+  HostToolPolicyFailed,
+  ElicitationFailed
+]);
+var HostDataError = HostCallError;
+var HostError = Schema_exports.Union([
+  OpenapiResponseError,
+  ProviderError,
+  McpError,
+  SkillLoadFailed,
+  WorkflowFailure,
+  HostRequestInvalid,
+  HostAccountsInvalid,
+  HostDeclarationInvalid,
+  HostEvaluationFailed,
+  HostOperationNotFound,
+  HostOperationFailed,
+  HostToolNotFound,
+  HostInputInvalid,
+  HostOutputInvalid,
+  HostToolBlocked,
+  HostToolApprovalRequired,
+  HostToolPolicyFailed,
+  ElicitationFailed
+]);
+var ToolResultObservation = Context_exports.Reference(
+  "apps/ToolResultObservation",
+  { defaultValue: () => ({ failed: () => {
+  } }) }
+);
+var HostResponse = Schema_exports.Union([
   Schema_exports.Struct({
-    operation: Schema_exports.Literal("list"),
-    workflow: Schema_exports.optionalKey(WorkflowName),
-    cursor: Schema_exports.optionalKey(WorkflowRunId),
-    limit: Schema_exports.optionalKey(Schema_exports.Int.check(Schema_exports.isBetween({ minimum: 1, maximum: 100 })))
+    ok: Schema_exports.Literal(true),
+    value: JsonValue,
+    toolError: Schema_exports.optionalKey(Schema_exports.Literal(true))
   }),
-  Schema_exports.Struct({ operation: Schema_exports.Literal("terminate"), run: WorkflowRunId })
+  Schema_exports.Struct({ ok: Schema_exports.Literal(false), error: HostError })
 ]);
 
 export {
@@ -1686,20 +2104,15 @@ export {
   OAuth2Method,
   Provider,
   ManyAccounts,
-  minimumIntervalMilliseconds,
-  Interval,
-  CalendarSchedule,
-  ScheduleTiming,
-  OperationSchedule,
-  ElicitationLimits,
-  defaultElicitationLimits,
-  FormElicitation,
-  ElicitationResponse,
-  ElicitationFailed,
-  ElicitationReply,
-  ApprovalElicitation,
-  ApprovalResponse,
-  approvalElicitation,
+  ToolAnnotations,
+  McpClientLimits,
+  defaultMcpClientLimits,
+  mcpSdkTimerCeilingMs,
+  McpToolsOptions,
+  McpToolResult,
+  McpToolMetadata,
+  McpError,
+  ProcessConfig,
   WorkflowRunId,
   WorkflowName,
   workflowDurationMillis,
@@ -1715,5 +2128,66 @@ export {
   WorkflowCommand,
   WorkflowRpcCommand,
   WorkflowRpcResult,
-  WorkflowControlCommand
+  WorkflowControlCommand,
+  minimumIntervalMilliseconds,
+  Interval,
+  CalendarSchedule,
+  ScheduleTiming,
+  OperationSchedule,
+  ElicitationLimits,
+  defaultElicitationLimits,
+  FormElicitation,
+  ElicitationResponse,
+  ElicitationFailed,
+  ElicitationReply,
+  ApprovalElicitation,
+  ApprovalResponse,
+  approvalElicitation,
+  WebhookTransportLimits,
+  defaultWebhookTransportLimits,
+  WebhookRequestData,
+  WebhookResponseData,
+  ManualWebhookSetup,
+  ManualWebhookDescriptor,
+  HostedWebhook,
+  WebhookCommand,
+  OperationToolPrefixes,
+  DeclaredAuthMethod,
+  DeclaredProvider,
+  DeclaredRequirements,
+  ResolvedAccount,
+  ResolvedAccounts,
+  TrustedToolApproval,
+  InvocationDeadline,
+  HostedTool,
+  HostedToolSummary,
+  SkillSources,
+  skillsCommand,
+  SkillCatalogResponse,
+  skillCatalog,
+  inspectCommand,
+  indexCommand,
+  selectTools,
+  HostRequest,
+  HostRequestInvalid,
+  HostAccountsInvalid,
+  HostDeclarationInvalid,
+  HostEvaluationFailed,
+  HostOperationNotFound,
+  HostOperationFailed,
+  HostToolNotFound,
+  InputProblem,
+  maxInputProblems,
+  HostInputInvalid,
+  HostToolBlocked,
+  HostToolApprovalRequired,
+  HostToolPolicyFailed,
+  HostOutputInvalid,
+  HostRequirementsError,
+  HostInspectError,
+  HostCallError,
+  HostDataError,
+  HostError,
+  ToolResultObservation,
+  HostResponse
 };