apps 0.0.1-beta.0 → 0.0.1-beta.10

package/types/apps/src/implementation/ui-auth.d.ts

@@ -1,5 +1,6 @@
-/** Trusted bootstrap documents run before authored UI and never contain product credentials. */
+/** Host responses around app sign-in. They carry no script and never contain product credentials. */
 import { HttpServerResponse } from "effect/unstable/http";
+import { type AppSignInId } from "../contracts/ui-auth.js";
 /** Private app responses must not leak authentication URLs through caches or referrers. */
 export declare const appPrivateHeaders: {
     "cache-control": string;
@@ -7,7 +8,12 @@ export declare const appPrivateHeaders: {
     "x-content-type-options": string;
     "content-security-policy": string;
 };
-/** Serve only a fixed host script while authentication runs; the original URL remains available to that script. */
-export declare const appSignInPage: () => HttpServerResponse.HttpServerResponse;
-/** Preserve deep links, erase callback proofs before any request, and let the host set HttpOnly cookies. */
-export declare const appSignInScript: () => HttpServerResponse.HttpServerResponse;
+/** Every sign-in hop is a server redirect, so the browser paints nothing until the app itself. */
+export declare const appRedirect: (url: string) => HttpServerResponse.HttpServerResponse;
+/**
+ * The callback URL carries the code in its query. It exists only as a redirect `Location`, never as
+ * a rendered document, and redeeming it also requires the attempt's HttpOnly cookie.
+ */
+export declare const appSignInCallback: (origin: string, request: AppSignInId, code: string) => string;
+/** A failed callback explains itself without script; reopening the app URL starts a new attempt. */
+export declare const appSignInFailed: () => HttpServerResponse.HttpServerResponse;

package/types/apps/src/implementation/ui-serving.d.ts

@@ -9,8 +9,10 @@ export declare const appDocument: <E, R>(options: {
     readonly origin: string;
     readonly asset: (path: string) => Effect.Effect<AppUiAsset | undefined, E, R>;
 }) => Effect.Effect<HttpServerResponse.HttpServerResponse, UiForbidden | E, HttpServerRequest.HttpServerRequest | R>;
-/** Revalidate immutable assets only after the host has checked current access and file existence.
- * Browsers may retain bytes, but neither browsers nor shared proxies may reuse them without authorization.
+/** Serve an asset only after the host has checked current access and file existence.
+ * Asset URLs name their deployment, so their bytes never change: the browser keeps them for a year
+ * and does not ask again. Shared proxies never store them. Revoking access stops every new request
+ * and all app data, while bytes a browser already downloaded stay in its cache.
  * HTML remains an uncached host-rendered entry point.
  */
 export declare const appAsset: (asset: AppUiAsset | undefined, build: string, path: string) => Effect.Effect<HttpServerResponse.HttpServerResponse, never, HttpServerRequest.HttpServerRequest>;

package/types/apps/src/implementation/webhooks.d.ts

@@ -26,4 +26,4 @@ export declare const dispatchWebhook: <Context extends {
         readonly [x: string]: string;
     };
     readonly body: string;
-}, HostDeclarationInvalid | HostOperationNotFound | HostOperationFailed | HostInputInvalid | HostOutputInvalid, never>;
+}, HostOperationNotFound | HostInputInvalid | HostOutputInvalid | HostDeclarationInvalid | HostOperationFailed, never>;

package/types/apps/src/implementation/workflow-context.d.ts

@@ -2,7 +2,15 @@
 import { Effect } from "effect";
 import type { AppDefinition } from "../contracts/app.js";
 import { WorkflowFailure, type WorkflowContext, type WorkflowExecution, type WorkflowStepContext } from "../contracts/workflows.js";
-/** Preserve typed failures and cancellation; authored exception text never leaves the app. */
-export declare const workflowSafe: <A>(work: Effect.Effect<A, unknown>) => Effect.Effect<A, WorkflowFailure>;
+/**
+ * Preserve typed failures and cancellation. Other errors keep their name and bounded message,
+ * with the given account secrets replaced.
+ */
+export declare const workflowSafe: <A>(work: Effect.Effect<A, unknown>, secrets: readonly string[]) => Effect.Effect<A, WorkflowFailure>;
 /** Construct one replay's Promise context. Step callbacks acquire fresh capabilities per actual attempt. */
-export declare const makeWorkflowContext: (execution: WorkflowExecution, definition: Pick<AppDefinition<never>, "queries" | "mutations">, fresh: (stepId: string, signal: AbortSignal) => Effect.Effect<WorkflowStepContext, WorkflowFailure>, signal: AbortSignal) => Effect.Effect<WorkflowContext>;
+export declare const makeWorkflowContext: (execution: WorkflowExecution, definition: Pick<AppDefinition<never>, "tools">, 
+/** A step attempt's context, and the raw account secrets its failures must not reveal. */
+fresh: (stepId: string, signal: AbortSignal) => Effect.Effect<{
+    readonly context: WorkflowStepContext;
+    readonly secrets: readonly string[];
+}, WorkflowFailure>, signal: AbortSignal) => Effect.Effect<WorkflowContext>;

package/types/apps/src/index.d.ts

@@ -1,3 +1,6 @@
+export { ProviderError } from "./contracts/provider-error.js";
+export type { AppCache, CacheLoadContext, CacheGetOptions } from "./contracts/cache.js";
+export { CacheError } from "../../app-cache/src/contracts/cache.js";
 /**
  * Public author API. Native contracts live in contracts/; this boundary
  * exposes ordinary declarations, schema helpers and Promise operations.
@@ -11,9 +14,13 @@ import { type PromiseMethods } from "./implementation/authoring.js";
 import { type Fields, type Infer, type ObjectSchema, type Schema } from "./implementation/schema.js";
 export { type JsonObject, type JsonValue, ValidationError } from "./contracts/schema.js";
 export { type Fields, type Infer, type ObjectSchema, type ObjectValue, type Schema, array, boolean, json, jsonSchema, literal, number, object, record, string, } from "./implementation/schema.js";
-export { type AccountOf, type AuthMethod, type AuthMethodData, type AuthMethods, type ManyAccounts, type OAuth2Config, type Provider, } from "./contracts/provider.js";
-export { defineProvider } from "./implementation/provider.js";
-export { accountOperations } from "./implementation/account-operations.js";
+export { type AccountCheckContext, type AccountCheckResult, type AccountInfo, type AccountOf, type AuthMethod, type AuthMethodData, type AuthMethods, type ManyAccounts, type OAuth2Config, type Provider, } from "./contracts/provider.js";
+export { defineProvider, type ProviderOptions } from "./implementation/provider.js";
+export { accountRouter } from "./implementation/account-router.js";
+export { router, dynamicRouter, type RouterDeclaration, type RouterChild, type RouterOptions, } from "./implementation/router.js";
+export type { RouterIcon } from "./contracts/router.js";
+export { dynamicSkills } from "./implementation/dynamic-skills.js";
+export type { HostedTool as OperationDescription } from "./contracts/host.js";
 /** A secrets declaration inferred from an author schema. */
 export type SecretsMethod<Shape extends ObjectSchema<Fields>> = NativeSecretsMethod<EffectSchema.Decoder<Infer<Shape>>>;
 /** An OAuth declaration inferred from its author-facing response schema. */
@@ -56,3 +63,4 @@ export type { OperationContext } from "./contracts/operations.js";
 export { workflow, type Workflow, type WorkflowDeclaration } from "./implementation/workflows.js";
 export { NonRetryableError, WorkflowFailure, type WorkflowContext, type WorkflowStepContext, type WorkflowStep, type WorkflowStepOptions, type WorkflowDuration, type WorkflowReads, type WorkflowControls, } from "./contracts/workflows.js";
 export { interval, cron, type ScheduleDeclaration } from "./implementation/schedules.js";
+export type { AppSkillSource as Skill, SkillFile } from "./contracts/skills.js";

package/types/apps/src/mcp-stdio.d.ts

@@ -1,8 +1,5 @@
 import type { ProcessConfig } from "./contracts/mcp.js";
 import { type OperationKinds } from "./implementation/protocol-operations.js";
 export { McpError, type McpToolContext, type ProcessConfig } from "./contracts/mcp.js";
-/** Discover an account's tools; each discovery and call owns and closes its subprocess. */
-export declare const stdioOperations: (config: ProcessConfig, signal?: AbortSignal, kinds?: OperationKinds) => Promise<{
-    queries: Record<string, import("./index.js").Operation<import("effect/Schema").Json, unknown, "query", import("./index.js").OperationContext>>;
-    mutations: Record<string, import("./index.js").Operation<import("effect/Schema").Json, unknown, "mutation", import("./index.js").OperationContext>>;
-}>;
+/** Discover an account's tools as a router; each discovery and call owns and closes its subprocess. */
+export declare const stdioRouter: (config: ProcessConfig, signal?: AbortSignal, kinds?: OperationKinds) => Promise<import("./index.js").RouterDeclaration<unknown, unknown>>;

package/types/apps/src/mcp.d.ts

@@ -1,10 +1,11 @@
 /** HTTP MCP helpers. Requires the optional @modelcontextprotocol/sdk peer. */
-import { type OperationKinds } from "./implementation/protocol-operations.js";
-import type { McpToolsOptions } from "./contracts/mcp.js";
+import type { OperationKinds } from "./implementation/protocol-operations.js";
+import { type McpCatalogOptions } from "./implementation/mcp-catalog.js";
+export type { McpCatalogOptions } from "./implementation/mcp-catalog.js";
 export { McpError, type McpToolContext, type McpToolsOptions, type McpToolResult, } from "./contracts/mcp.js";
-/** Discover operations for the selected account. Kinds override uncertain upstream read-only hints. */
-export declare const mcpOperations: (options: McpToolsOptions, kinds?: OperationKinds) => Promise<{
-    queries: Record<string, import("./index.js").Operation<import("effect/Schema").Json, unknown, "query", import("./index.js").OperationContext>>;
-    mutations: Record<string, import("./index.js").Operation<import("effect/Schema").Json, unknown, "mutation", import("./index.js").OperationContext>>;
-}>;
+/**
+ * A router over a server's tools for the selected account. Its title, description and
+ * instructions come from the server. Kinds override uncertain upstream read-only hints.
+ */
+export declare const mcpRouter: (options: McpCatalogOptions, kinds?: OperationKinds) => Promise<import("./index.js").RouterDeclaration<unknown, unknown>>;
 export type { OperationKinds } from "./implementation/protocol-operations.js";

package/types/apps/src/openapi.d.ts

@@ -1,10 +1,12 @@
 /** OpenAPI helpers over normalized operation metadata; no optional dependency is needed. */
 import { type OperationKinds } from "./implementation/protocol-operations.js";
 import type { OpenapiToolsOptions } from "./contracts/openapi.js";
-export { OpenapiError, type OpenapiToolsOptions, type OpenapiOperation, type CredentialBinding, type RequestParameter, } from "./contracts/openapi.js";
-/** Discover operations for the selected account. Kinds override uncertain upstream read-only hints. */
-export declare const openapiOperations: (options: OpenapiToolsOptions, kinds?: OperationKinds) => Promise<{
-    queries: Record<string, import("./index.js").Operation<import("effect/Schema").Json, unknown, "query", import("./index.js").OperationContext>>;
-    mutations: Record<string, import("./index.js").Operation<import("effect/Schema").Json, unknown, "mutation", import("./index.js").OperationContext>>;
-}>;
+export { OpenapiError, isOpenapiTextMedia, openapiBinaryResultSchema, OpenapiErrorResponse, type OpenapiToolsOptions, type OpenapiOperation, type CredentialBinding, OpenapiParameter, OpenapiRequestBody, openapiMediaKind, } from "./contracts/openapi.js";
+/**
+ * Discover a document's operations as a router for the selected account. Kinds override uncertain
+ * upstream read-only hints. Mount it under a key, or override its metadata with `router(...)`.
+ */
+export declare const openapiRouter: (options: OpenapiToolsOptions, kinds?: OperationKinds) => Promise<import("./index.js").RouterDeclaration<unknown, unknown>>;
 export type { OperationKinds } from "./implementation/protocol-operations.js";
+export * from "./contracts/openapi-compile.js";
+export { liveOpenapiRouter, type OpenapiSourceOptions } from "./implementation/openapi-source.js";

package/types/apps/src/skills.d.ts

@@ -0,0 +1,75 @@
+import { type FolderSkillsOptions, type GitHubSkillsOptions, type SkillReaderOptions, type WellKnownSkillsOptions, type SkillFile } from "./contracts/skills.js";
+export { SkillLoadFailed, SkillDefinitionInvalid, SkillServiceName, type SkillReaderOptions, type FolderSkillsOptions, type AppSkillSource as Skill, type SkillFile, type GitHubSkillsOptions, type SkillCacheOptions, type WellKnownSkillsOptions, } from "./contracts/skills.js";
+/**
+ * Fetch a public GitHub skill collection from one resolved commit. Pass `cache: ctx.cache` to reuse
+ * the catalog; without it, mutable refs resolve again on each call.
+ */
+export declare const githubSkills: (options: GitHubSkillsOptions) => Promise<readonly {
+    readonly name: string;
+    readonly description: string;
+    readonly files: readonly {
+        readonly path: string;
+        readonly content: string;
+    }[];
+    readonly license?: string;
+    readonly compatibility?: string;
+    readonly metadata?: {
+        readonly [x: string]: string;
+    };
+    readonly "allowed-tools"?: string;
+}[]>;
+/** Fetch a published skill index and its text files. Pass `cache: ctx.cache` to reuse the catalog. */
+export declare const wellKnownSkills: (options: WellKnownSkillsOptions) => Promise<readonly {
+    readonly name: string;
+    readonly description: string;
+    readonly files: readonly {
+        readonly path: string;
+        readonly content: string;
+    }[];
+    readonly license?: string;
+    readonly compatibility?: string;
+    readonly metadata?: {
+        readonly [x: string]: string;
+    };
+    readonly "allowed-tools"?: string;
+}[]>;
+/** Parse a bundled standard skill directory into an app capability. */
+export declare const fileSkill: (files: readonly SkillFile[]) => Promise<{
+    readonly name: string;
+    readonly description: string;
+    readonly files: readonly {
+        readonly path: string;
+        readonly content: string;
+    }[];
+    readonly license?: string;
+    readonly compatibility?: string;
+    readonly metadata?: {
+        readonly [x: string]: string;
+    };
+    readonly "allowed-tools"?: string;
+}>;
+/** Read skill directories from ctx.files. Omitted path selects skills/; missing folders return []. */
+export declare const folderSkills: (options: FolderSkillsOptions) => Promise<readonly {
+    readonly name: string;
+    readonly description: string;
+    readonly files: readonly {
+        readonly path: string;
+        readonly content: string;
+    }[];
+    readonly license?: string;
+    readonly compatibility?: string;
+    readonly metadata?: {
+        readonly [x: string]: string;
+    };
+    readonly "allowed-tools"?: string;
+}[]>;
+/**
+ * Read files for a custom remote skill loader, such as one for GitLab. Reads share one byte
+ * budget and reject with the same safe SkillLoadFailed errors as githubSkills, naming `service`.
+ */
+export declare const skillReader: (options: SkillReaderOptions) => {
+    /** Fetch one UTF-8 text file. */
+    text: (url: string) => Promise<string>;
+    /** Fetch and parse one JSON document. */
+    json: (url: string) => Promise<unknown>;
+};

package/types/apps/src/ui-auth.d.ts

@@ -1,3 +1,3 @@
-/** Host-only app authentication protocol and bootstrap; products supply identity and session lifecycle. */
+/** Host-only app authentication protocol; products supply identity and session lifecycle. */
 export * from "./contracts/ui-auth.js";
-export { appPrivateHeaders, appSignInPage, appSignInScript } from "./implementation/ui-auth.js";
+export { appPrivateHeaders, appRedirect, appSignInCallback, appSignInFailed, } from "./implementation/ui-auth.js";

package/types/telemetry/src/browser-operations.d.ts

@@ -1,8 +1,11 @@
 /** Correlate transport and decoded outcomes without exporting response bodies or errors. */
 import { Effect, Schema, Tracer } from "effect";
 import { HttpClient, HttpClientError } from "effect/unstable/http";
-/** A random document identity. It is never an authentication or user identifier. */
-export declare const browserPageId: () => string;
+/**
+ * A random identity for the current browser document. It is never an authentication or user
+ * identifier. Server renders have no document, so they get none instead of sharing one per isolate.
+ */
+export declare const browserPageId: () => string | undefined;
 /** Safe event shared with the host's error reporter and product analytics. */
 export declare const BrowserOperationFailure: Schema.Struct<{
     readonly error_type: Schema.Literals<readonly ["BrowserDecodeFailed", "BrowserTransportFailed", "BrowserOperationFailed"]>;

package/types/telemetry/src/config.d.ts

@@ -1,5 +1,7 @@
 /** Telemetry configuration is parsed at composition roots; headers remain redacted. */
 import { Config, Context, Effect, Schema } from "effect";
+/** Bound each collector request, including its acknowledgement; exporter retries retain the batch. */
+export declare const telemetryRequestTimeout: "5 seconds";
 /** One private exporter target. Endpoints are complete signal URLs. */
 export declare const TelemetryTarget: Schema.Struct<{
     readonly url: Schema.String;

package/js/chunk-22WRQZT7.js

@@ -1,389 +0,0 @@
-import {
-  ApprovalElicitation,
-  ElicitationFailed,
-  OAuth2Config,
-  OperationSchedule,
-  WorkflowCommand,
-  WorkflowFailure
-} from "./chunk-HP7E42X6.js";
-import {
-  DatabaseSchema
-} from "./chunk-7JXHF5IF.js";
-import {
-  AccountId,
-  HttpUrl,
-  JsonObject,
-  JsonValue
-} from "./chunk-36DNRFZQ.js";
-import {
-  Context_exports,
-  Schema_exports
-} from "./chunk-2OTCEKL2.js";
-
-// src/contracts/tools.ts
-var ToolAnnotations = Schema_exports.Struct({
-  title: Schema_exports.optionalKey(Schema_exports.String),
-  readOnlyHint: Schema_exports.optionalKey(Schema_exports.Boolean),
-  destructiveHint: Schema_exports.optionalKey(Schema_exports.Boolean),
-  idempotentHint: Schema_exports.optionalKey(Schema_exports.Boolean),
-  openWorldHint: Schema_exports.optionalKey(Schema_exports.Boolean)
-});
-
-// src/contracts/mcp.ts
-var McpClientLimits = Schema_exports.Struct({
-  timeoutMs: Schema_exports.Int.check(Schema_exports.isGreaterThan(0)),
-  maxTimeoutMs: Schema_exports.Int.check(Schema_exports.isGreaterThan(0)),
-  maxTools: Schema_exports.Int.check(Schema_exports.isGreaterThan(0)),
-  maxPaginationCursors: Schema_exports.Int.check(Schema_exports.isGreaterThan(0)),
-  cleanupTimeoutMs: Schema_exports.Int.check(Schema_exports.isGreaterThan(0))
-});
-var defaultMcpClientLimits = McpClientLimits.make({
-  timeoutMs: 3e4,
-  maxTimeoutMs: 3e5,
-  maxTools: 5e4,
-  maxPaginationCursors: 1e3,
-  cleanupTimeoutMs: 1e3
-});
-var mcpSdkTimerCeilingMs = 2147483647;
-var McpToolsOptions = Schema_exports.Struct({
-  url: HttpUrl,
-  headers: Schema_exports.optional(Schema_exports.Record(Schema_exports.String, Schema_exports.String)),
-  signal: Schema_exports.optional(Schema_exports.instanceOf(AbortSignal)),
-  timeoutMs: Schema_exports.optional(
-    Schema_exports.Number.check(
-      Schema_exports.isInt(),
-      Schema_exports.isBetween({ minimum: 1, maximum: defaultMcpClientLimits.maxTimeoutMs })
-    )
-  )
-});
-var McpToolResult = Schema_exports.Struct({
-  content: Schema_exports.Array(JsonObject),
-  structuredContent: Schema_exports.optional(JsonObject),
-  isError: Schema_exports.optional(Schema_exports.Boolean),
-  _meta: Schema_exports.optional(JsonObject)
-});
-var McpToolMetadata = Schema_exports.Struct({
-  name: Schema_exports.String,
-  title: Schema_exports.optional(Schema_exports.String),
-  description: Schema_exports.optional(Schema_exports.String),
-  inputSchema: JsonObject,
-  outputSchema: Schema_exports.optional(JsonObject),
-  annotations: Schema_exports.optional(ToolAnnotations),
-  _meta: Schema_exports.optional(JsonObject)
-});
-var McpError = class extends Schema_exports.TaggedError()("McpError", {
-  phase: Schema_exports.Literals(["connect", "discover", "call", "schema", "transport"]),
-  reason: Schema_exports.Literals([
-    "request",
-    "unauthorized",
-    "invalid_response",
-    "timeout",
-    "invalid_input"
-  ]),
-  status: Schema_exports.optional(Schema_exports.Number)
-}) {
-};
-var ProcessConfig = Schema_exports.Struct({
-  command: Schema_exports.NonEmptyString,
-  args: Schema_exports.Array(Schema_exports.String),
-  cwd: Schema_exports.optional(Schema_exports.String),
-  env: Schema_exports.Record(Schema_exports.String, Schema_exports.String),
-  timeoutMs: Schema_exports.Int.check(
-    Schema_exports.isBetween({ minimum: 1, maximum: defaultMcpClientLimits.maxTimeoutMs })
-  )
-});
-
-// src/contracts/webhook-protocol.ts
-var WebhookTransportLimits = Schema_exports.Struct({
-  maxBodyBytes: Schema_exports.Int.check(Schema_exports.isGreaterThan(0))
-});
-var defaultWebhookTransportLimits = WebhookTransportLimits.make({
-  maxBodyBytes: 1024 * 1024
-});
-var encodedBodyChars = 4 * Math.ceil(defaultWebhookTransportLimits.maxBodyBytes / 3);
-var WebhookRequestData = Schema_exports.Struct({
-  url: HttpUrl,
-  method: Schema_exports.Literals(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"]),
-  headers: Schema_exports.Record(Schema_exports.String, Schema_exports.String),
-  body: Schema_exports.String.check(Schema_exports.isMaxLength(encodedBodyChars))
-});
-var WebhookResponseData = Schema_exports.Struct({
-  status: Schema_exports.Int.check(Schema_exports.isBetween({ minimum: 200, maximum: 599 })),
-  headers: Schema_exports.Record(Schema_exports.String, Schema_exports.String),
-  body: Schema_exports.String.check(Schema_exports.isMaxLength(encodedBodyChars))
-});
-var ManualWebhookSetup = Schema_exports.Struct({
-  instructions: Schema_exports.NonEmptyString,
-  signingSecret: Schema_exports.Literals(["executor", "provider"])
-});
-var ManualWebhookDescriptor = Schema_exports.Struct({
-  ...ManualWebhookSetup.fields,
-  stateSchema: JsonObject
-});
-var HostedWebhook = Schema_exports.Struct({
-  name: Schema_exports.NonEmptyString,
-  account: Schema_exports.NonEmptyString,
-  configSchema: JsonObject,
-  setup: Schema_exports.optionalKey(ManualWebhookDescriptor)
-});
-var identity = {
-  name: Schema_exports.NonEmptyString,
-  subscriptionId: Schema_exports.NonEmptyString,
-  sourceAccount: AccountId,
-  callbackUrl: HttpUrl,
-  secret: Schema_exports.String,
-  config: JsonValue
-};
-var WebhookCommand = Schema_exports.Union([
-  Schema_exports.Struct({ operation: Schema_exports.Literal("webhooks") }),
-  Schema_exports.Struct({ operation: Schema_exports.Literal("webhook-validate"), ...identity }),
-  Schema_exports.Struct({ operation: Schema_exports.Literal("webhook-complete"), ...identity, state: JsonValue }),
-  Schema_exports.Struct({ operation: Schema_exports.Literal("webhook-register"), ...identity }),
-  Schema_exports.Struct({ operation: Schema_exports.Literal("webhook-unregister"), ...identity, state: JsonValue }),
-  Schema_exports.Struct({
-    operation: Schema_exports.Literal("webhook-handle"),
-    ...identity,
-    state: JsonValue,
-    request: WebhookRequestData
-  })
-]);
-
-// src/contracts/operations.ts
-var OperationToolPrefixes = { query: "queries.", mutate: "mutations." };
-
-// src/contracts/host.ts
-var DeclaredAuthMethod = Schema_exports.Union([
-  Schema_exports.Struct({ type: Schema_exports.Literal("secrets"), label: Schema_exports.String, fields: JsonObject }),
-  Schema_exports.Struct({
-    type: Schema_exports.Literal("oauth2"),
-    ...OAuth2Config.members[0].fields,
-    response: JsonObject
-  }),
-  Schema_exports.Struct({
-    type: Schema_exports.Literal("oauth2"),
-    ...OAuth2Config.members[1].fields,
-    response: JsonObject
-  }),
-  Schema_exports.Struct({
-    type: Schema_exports.Literal("oauth2"),
-    ...OAuth2Config.members[2].fields,
-    response: JsonObject
-  }),
-  Schema_exports.Struct({
-    type: Schema_exports.Literal("oauth2"),
-    ...OAuth2Config.members[3].fields,
-    response: JsonObject
-  })
-]);
-var DeclaredProvider = Schema_exports.Struct({
-  name: Schema_exports.NonEmptyString,
-  auth: Schema_exports.Record(Schema_exports.NonEmptyString, DeclaredAuthMethod)
-});
-var DeclaredRequirements = Schema_exports.Struct({
-  database: Schema_exports.optionalKey(DatabaseSchema),
-  accounts: Schema_exports.Record(
-    Schema_exports.NonEmptyString,
-    Schema_exports.Struct({
-      definition: DeclaredProvider,
-      cardinality: Schema_exports.Literals(["one", "many"])
-    })
-  )
-});
-var ResolvedAccount = Schema_exports.Struct({
-  id: AccountId,
-  provider: DeclaredProvider,
-  method: Schema_exports.NonEmptyString,
-  fields: JsonObject
-});
-var ResolvedAccounts = Schema_exports.Record(
-  Schema_exports.NonEmptyString,
-  Schema_exports.Union([ResolvedAccount, Schema_exports.Array(ResolvedAccount)])
-);
-var TrustedToolApproval = Schema_exports.Struct({ tool: Schema_exports.NonEmptyString, input: JsonValue });
-var HostedTool = Schema_exports.Struct({
-  schedules: Schema_exports.optionalKey(Schema_exports.Array(OperationSchedule)),
-  name: Schema_exports.NonEmptyString,
-  description: Schema_exports.String,
-  inputSchema: JsonObject,
-  readOnly: Schema_exports.optionalKey(Schema_exports.Boolean),
-  title: Schema_exports.optionalKey(Schema_exports.String),
-  outputSchema: Schema_exports.optionalKey(JsonObject),
-  annotations: Schema_exports.optionalKey(ToolAnnotations),
-  _meta: Schema_exports.optionalKey(JsonObject)
-});
-var HostRequest = Schema_exports.Union([
-  WorkflowCommand,
-  WebhookCommand,
-  Schema_exports.Struct({ operation: Schema_exports.Literal("requirements") }),
-  Schema_exports.Struct({ operation: Schema_exports.Literal("inspect") }),
-  Schema_exports.Struct({
-    operation: Schema_exports.Literal("query"),
-    name: Schema_exports.NonEmptyString,
-    input: JsonValue
-  }),
-  Schema_exports.Struct({
-    operation: Schema_exports.Literal("mutate"),
-    name: Schema_exports.NonEmptyString,
-    input: JsonValue
-  }),
-  Schema_exports.Struct({
-    operation: Schema_exports.Literal("call"),
-    tool: Schema_exports.NonEmptyString,
-    input: JsonValue
-  })
-]);
-var HostRequestInvalid = class extends Schema_exports.TaggedError()(
-  "HostRequestInvalid",
-  {}
-) {
-};
-var HostAccountsInvalid = class extends Schema_exports.TaggedError()(
-  "HostAccountsInvalid",
-  {}
-) {
-};
-var HostDeclarationInvalid = class extends Schema_exports.TaggedError()(
-  "HostDeclarationInvalid",
-  {}
-) {
-};
-var HostEvaluationFailed = class extends Schema_exports.TaggedError()(
-  "HostEvaluationFailed",
-  {}
-) {
-};
-var HostOperationNotFound = class extends Schema_exports.TaggedError()(
-  "HostOperationNotFound",
-  {}
-) {
-};
-var HostOperationFailed = class extends Schema_exports.TaggedError()(
-  "HostOperationFailed",
-  {}
-) {
-};
-var HostToolNotFound = class extends Schema_exports.TaggedError()(
-  "HostToolNotFound",
-  {}
-) {
-};
-var HostInputInvalid = class extends Schema_exports.TaggedError()(
-  "HostInputInvalid",
-  {}
-) {
-};
-var HostToolBlocked = class extends Schema_exports.TaggedError()("HostToolBlocked", {}) {
-};
-var HostToolApprovalRequired = class extends Schema_exports.TaggedError()(
-  "HostToolApprovalRequired",
-  { input: JsonValue, elicitation: ApprovalElicitation }
-) {
-};
-var HostToolPolicyFailed = class extends Schema_exports.TaggedError()(
-  "HostToolPolicyFailed",
-  {}
-) {
-};
-var HostOutputInvalid = class extends Schema_exports.TaggedError()(
-  "HostOutputInvalid",
-  {}
-) {
-};
-var HostRequirementsError = Schema_exports.Union([HostRequestInvalid, HostDeclarationInvalid]);
-var HostInspectError = Schema_exports.Union([
-  HostRequestInvalid,
-  HostDeclarationInvalid,
-  HostAccountsInvalid,
-  HostEvaluationFailed
-]);
-var HostCallError = Schema_exports.Union([
-  WorkflowFailure,
-  HostInspectError,
-  HostToolNotFound,
-  HostOperationNotFound,
-  HostOperationFailed,
-  HostInputInvalid,
-  HostOutputInvalid,
-  HostToolBlocked,
-  HostToolApprovalRequired,
-  HostToolPolicyFailed,
-  ElicitationFailed
-]);
-var HostDataError = HostCallError;
-var HostError = Schema_exports.Union([
-  WorkflowFailure,
-  HostRequestInvalid,
-  HostAccountsInvalid,
-  HostDeclarationInvalid,
-  HostEvaluationFailed,
-  HostOperationNotFound,
-  HostOperationFailed,
-  HostToolNotFound,
-  HostInputInvalid,
-  HostOutputInvalid,
-  HostToolBlocked,
-  HostToolApprovalRequired,
-  HostToolPolicyFailed,
-  ElicitationFailed
-]);
-var ToolResultObservation = Context_exports.Reference(
-  "apps/ToolResultObservation",
-  { defaultValue: () => ({ failed: () => {
-  } }) }
-);
-var HostResponse = Schema_exports.Union([
-  Schema_exports.Struct({
-    ok: Schema_exports.Literal(true),
-    value: JsonValue,
-    toolError: Schema_exports.optionalKey(Schema_exports.Literal(true))
-  }),
-  Schema_exports.Struct({ ok: Schema_exports.Literal(false), error: HostError })
-]);
-
-export {
-  ToolAnnotations,
-  McpClientLimits,
-  defaultMcpClientLimits,
-  mcpSdkTimerCeilingMs,
-  McpToolsOptions,
-  McpToolResult,
-  McpToolMetadata,
-  McpError,
-  ProcessConfig,
-  WebhookTransportLimits,
-  defaultWebhookTransportLimits,
-  WebhookRequestData,
-  WebhookResponseData,
-  ManualWebhookSetup,
-  ManualWebhookDescriptor,
-  HostedWebhook,
-  WebhookCommand,
-  OperationToolPrefixes,
-  DeclaredAuthMethod,
-  DeclaredProvider,
-  DeclaredRequirements,
-  ResolvedAccount,
-  ResolvedAccounts,
-  TrustedToolApproval,
-  HostedTool,
-  HostRequest,
-  HostRequestInvalid,
-  HostAccountsInvalid,
-  HostDeclarationInvalid,
-  HostEvaluationFailed,
-  HostOperationNotFound,
-  HostOperationFailed,
-  HostToolNotFound,
-  HostInputInvalid,
-  HostToolBlocked,
-  HostToolApprovalRequired,
-  HostToolPolicyFailed,
-  HostOutputInvalid,
-  HostRequirementsError,
-  HostInspectError,
-  HostCallError,
-  HostDataError,
-  HostError,
-  ToolResultObservation,
-  HostResponse
-};