apps 0.0.1-beta.3 → 0.0.1-beta.30

package/js/{chunk-MYYEW3RA.js → chunk-BSRU52RU.js}

@@ -1,26 +1,30 @@
 import {
+  DatabaseFieldReserved,
+  DatabaseLimitExceeded,
   DatabaseSchema
-} from "./chunk-BMOIAIVR.js";
+} from "./chunk-M2KEEOIQ.js";
 import {
   CacheCommand,
-  CacheReply
-} from "./chunk-LGIYBDWA.js";
+  CacheReply,
+  FailureCode,
+  FailureDetail,
+  FailureMessage,
+  FailureName,
+  FailureSource,
+  ProviderError,
+  UpstreamError
+} from "./chunk-BRGF7VFN.js";
 import {
+  AppSkillName,
   AppSkills,
   SkillLoadFailed
-} from "./chunk-YEJOQEII.js";
-import {
-  OpenapiResponseError
-} from "./chunk-SWPD52J7.js";
-import {
-  ProviderError
-} from "./chunk-W7D7WVSY.js";
+} from "./chunk-MYCVMDWI.js";
 import {
   AccountId,
   HttpUrl,
   JsonObject as JsonObject2,
   JsonValue
-} from "./chunk-SATWJKN6.js";
+} from "./chunk-PWF2DRJ3.js";
 import {
   Any,
   ArraySchema,
@@ -74,7 +78,31 @@ import {
   transformOptional,
   withConstructorDefault,
   withDefault
-} from "./chunk-FW5HBOIK.js";
+} from "./chunk-NXTXZ635.js";
+
+// src/contracts/router.ts
+var reservedRouterKeys = /* @__PURE__ */ new Set([
+  "__proto__",
+  "constructor",
+  "prototype"
+]);
+var RouterKey = Schema_exports.String.check(
+  Schema_exports.isPattern(/^[A-Za-z_][A-Za-z0-9_-]{0,99}$/),
+  Schema_exports.makeFilter((key) => !reservedRouterKeys.has(key))
+);
+var RouterIcon = Schema_exports.Struct({
+  src: Schema_exports.NonEmptyString,
+  mimeType: Schema_exports.optionalKey(Schema_exports.String),
+  sizes: Schema_exports.optionalKey(Schema_exports.Array(Schema_exports.String)),
+  theme: Schema_exports.optionalKey(Schema_exports.Literals(["light", "dark"]))
+});
+var RouterMeta = Schema_exports.Struct({
+  title: Schema_exports.optionalKey(Schema_exports.String),
+  description: Schema_exports.optionalKey(Schema_exports.String),
+  instructions: Schema_exports.optionalKey(Schema_exports.String),
+  icons: Schema_exports.optionalKey(Schema_exports.Array(RouterIcon)),
+  tags: Schema_exports.optionalKey(Schema_exports.Record(Schema_exports.NonEmptyString, Schema_exports.String))
+});
 
 // src/contracts/tools.ts
 var ToolAnnotations = Schema_exports.Struct({
@@ -113,11 +141,17 @@ var McpToolsOptions = Schema_exports.Struct({
     )
   )
 });
+var McpHealthInput = Schema_exports.Struct({
+  ...McpToolsOptions.fields,
+  headers: Schema_exports.Record(Schema_exports.String, Schema_exports.String),
+  deadline: Schema_exports.optional(Schema_exports.Finite)
+});
+var mcpHealthReserveMs = 2 * defaultMcpClientLimits.cleanupTimeoutMs + 250;
 var McpToolResult = Schema_exports.Struct({
   content: Schema_exports.Array(JsonObject2),
-  structuredContent: Schema_exports.optional(JsonObject2),
-  isError: Schema_exports.optional(Schema_exports.Boolean),
-  _meta: Schema_exports.optional(JsonObject2)
+  structuredContent: Schema_exports.optionalKey(JsonObject2),
+  isError: Schema_exports.optionalKey(Schema_exports.Boolean),
+  _meta: Schema_exports.optionalKey(JsonObject2)
 });
 var McpToolMetadata = Schema_exports.Struct({
   name: Schema_exports.String,
@@ -128,6 +162,15 @@ var McpToolMetadata = Schema_exports.Struct({
   annotations: Schema_exports.optional(ToolAnnotations),
   _meta: Schema_exports.optional(JsonObject2)
 });
+var McpServerHeader = Schema_exports.Struct({
+  name: Schema_exports.optionalKey(Schema_exports.String),
+  title: Schema_exports.optionalKey(Schema_exports.String),
+  version: Schema_exports.optionalKey(Schema_exports.String),
+  description: Schema_exports.optionalKey(Schema_exports.String),
+  websiteUrl: Schema_exports.optionalKey(Schema_exports.String),
+  icons: Schema_exports.optionalKey(Schema_exports.Array(RouterIcon)),
+  instructions: Schema_exports.optionalKey(Schema_exports.String)
+});
 var McpError = class extends Schema_exports.TaggedError()("McpError", {
   phase: Schema_exports.Literals(["connect", "discover", "call", "schema", "transport"]),
   reason: Schema_exports.Literals([
@@ -137,9 +180,15 @@ var McpError = class extends Schema_exports.TaggedError()("McpError", {
     "timeout",
     "invalid_input"
   ]),
-  status: Schema_exports.optional(Schema_exports.Number)
+  status: Schema_exports.optional(Schema_exports.Number),
+  upstream: Schema_exports.optional(UpstreamError)
 }) {
 };
+var McpCredentialsUnverified = class extends Schema_exports.TaggedError()(
+  "McpCredentialsUnverified",
+  { anonymous: Schema_exports.Union([Schema_exports.Literal("answered"), McpError, ProviderError]) }
+) {
+};
 var ProcessConfig = Schema_exports.Struct({
   command: Schema_exports.NonEmptyString,
   args: Schema_exports.Array(Schema_exports.String),
@@ -150,6 +199,115 @@ var ProcessConfig = Schema_exports.Struct({
   )
 });
 
+// src/contracts/api-response-error.ts
+var maxApiErrorInstructionsLength = 4096;
+var ApiErrorRecovery = Schema_exports.Struct({
+  action: Schema_exports.NonEmptyString.check(Schema_exports.isMaxLength(1024)),
+  instructions: Schema_exports.NonEmptyString.check(Schema_exports.isMaxLength(maxApiErrorInstructionsLength))
+});
+var maxApiErrorMessageLength = 4096;
+var ApiErrorResponse = Schema_exports.Struct({
+  code: Schema_exports.NonEmptyString.check(Schema_exports.isMaxLength(128)),
+  status: Schema_exports.Int.check(Schema_exports.isBetween({ minimum: 400, maximum: 599 })),
+  message: Schema_exports.NonEmptyString.check(Schema_exports.isMaxLength(maxApiErrorMessageLength)),
+  recovery: Schema_exports.optionalKey(ApiErrorRecovery)
+});
+var OpenapiResponseError = class extends Schema_exports.TaggedError()(
+  "OpenapiResponseError",
+  ApiErrorResponse.fields
+) {
+};
+var OpenapiErrorLimits = Schema_exports.Struct({
+  maxBodyBytes: Schema_exports.Int.check(Schema_exports.isGreaterThan(0)),
+  readTimeoutMs: Schema_exports.Int.check(Schema_exports.isGreaterThan(0))
+});
+var defaultOpenapiErrorLimits = OpenapiErrorLimits.make({
+  maxBodyBytes: 65536,
+  readTimeoutMs: 2e3
+});
+
+// src/contracts/network.ts
+var NetworkRefusal = Schema_exports.Union([
+  Schema_exports.Struct({ reason: Schema_exports.Literal("private_address") }),
+  Schema_exports.Struct({
+    reason: Schema_exports.Literal("credential_host"),
+    /** The provider of the credential handle the request carried. */
+    provider: Schema_exports.String,
+    /** The hosts that provider's credentials may reach; empty when it declares none. */
+    allowedHosts: Schema_exports.Array(Schema_exports.String)
+  }),
+  Schema_exports.Struct({ reason: Schema_exports.Literal("credential_app") }),
+  Schema_exports.Struct({
+    reason: Schema_exports.Literal("credential_expired"),
+    /** The provider of the expired credential handle. */
+    provider: Schema_exports.String
+  })
+]);
+var NetworkRefused = class extends Schema_exports.TaggedError()("NetworkRefused", {
+  /** The refused destination, with its port when the URL names one. */
+  host: Schema_exports.String,
+  refusal: NetworkRefusal
+}) {
+  get message() {
+    const refusal = this.refusal;
+    switch (refusal.reason) {
+      case "private_address":
+        return `Executor refused a request to ${this.host}: apps on this instance can reach only public addresses, and ${this.host} is a private, loopback or internal address. The request was not sent.`;
+      case "credential_host":
+        return refusal.allowedHosts.length === 0 ? `Executor refused this request: ${refusal.provider} credentials cannot be sent to ${this.host}: the provider declares no hosts.` : `Executor refused this request: ${refusal.provider} credentials cannot be sent to ${this.host}. The provider allows: ${refusal.allowedHosts.join(", ")}.`;
+      case "credential_app":
+        return "Executor refused this request: it carries a credential handle that is not valid for this app. Use the account fields this invocation received.";
+      case "credential_expired":
+        return `Executor refused this request: it carries an expired ${refusal.provider} credential handle. Use the account fields this invocation received.`;
+    }
+  }
+};
+var networkRefusalStatus = 421;
+var networkRefusalHeader = "x-executor-refused";
+var NetworkRefusedHeader = Schema_exports.StringFromUriComponent.pipe(
+  Schema_exports.decodeTo(Schema_exports.fromJsonString(NetworkRefused))
+);
+var encodeRefusal = Schema_exports.encodeSync(NetworkRefused);
+var encodeRefusalHeader = Schema_exports.encodeSync(NetworkRefusedHeader);
+var networkRefusalResponse = (refused) => new Response(JSON.stringify({ ...encodeRefusal(refused), message: refused.message }), {
+  status: networkRefusalStatus,
+  statusText: "Refused by Executor",
+  headers: {
+    "content-type": "application/json; charset=utf-8",
+    [networkRefusalHeader]: encodeRefusalHeader(refused)
+  }
+});
+var RestrictedFetchOption = Schema_exports.Literals(["redirect", "cache", "integrity"]);
+var supportedFetchOptions = {
+  redirect: ["follow", "manual"],
+  cache: ["no-store", "no-cache"],
+  integrity: [""]
+};
+var FetchOptionUnsupported = class extends Schema_exports.TaggedError()(
+  "FetchOptionUnsupported",
+  {
+    option: RestrictedFetchOption,
+    value: Schema_exports.String,
+    supported: Schema_exports.Array(Schema_exports.String)
+  }
+) {
+  get message() {
+    const supported = this.supported.map((value) => JSON.stringify(value)).join(" or ");
+    return `fetch option ${this.option}: ${JSON.stringify(this.value)} is not supported by Executor's app runtime. Use ${supported}, or omit ${this.option}.${this.advice}`;
+  }
+  /** What to do instead, when the standard value has an equivalent the runtime supports. */
+  get advice() {
+    switch (this.option) {
+      case "redirect":
+        return this.value === "error" ? ` To reject redirects, send redirect: "manual" and treat a 3xx response as the error.` : "";
+      case "cache":
+        return "";
+      case "integrity":
+        return " To check a digest, read the body and hash it with crypto.subtle.digest.";
+    }
+  }
+};
+
 // src/contracts/workflows.ts
 var WorkflowRunId = Schema_exports.NonEmptyString.pipe(Schema_exports.brand("wfr"));
 var WorkflowName = Schema_exports.NonEmptyString.check(Schema_exports.isMaxLength(200));
@@ -191,7 +349,14 @@ var WorkflowStepOptions = Schema_exports.Struct({
   ),
   timeout: Schema_exports.optionalKey(WorkflowDuration)
 });
+var WorkflowFailureDetail = {
+  step: Schema_exports.optionalKey(Schema_exports.String.check(Schema_exports.isMaxLength(200))),
+  errorName: Schema_exports.optionalKey(FailureName),
+  message: Schema_exports.optionalKey(FailureMessage)
+};
+var WorkflowRunFailure = Schema_exports.Struct(WorkflowFailureDetail);
 var WorkflowFailure = class extends Schema_exports.TaggedError()("WorkflowFailure", {
+  ...WorkflowFailureDetail,
   reason: Schema_exports.Literals([
     "unavailable",
     "not_found",
@@ -239,7 +404,9 @@ var WorkflowRun = Schema_exports.Union([
   Schema_exports.Struct({
     ...runFields,
     status: Schema_exports.Literal("errored"),
-    error: WorkflowFailure.fields.reason
+    error: WorkflowFailure.fields.reason,
+    /** The failing step and the app's own error, when the run recorded them. */
+    failure: Schema_exports.optionalKey(WorkflowRunFailure)
   }),
   Schema_exports.Struct({ ...runFields, status: Schema_exports.Literal("terminated") })
 ]);
@@ -1736,7 +1903,7 @@ var OAuthSecretClientAuth = Schema_exports.Literals([
   "client_secret_basic",
   "client_secret_basic_raw"
 ]);
-var reservedAuthorizationParams = /* @__PURE__ */ new Set([
+var reservedAuthorizationParams = [
   "response_type",
   "client_id",
   "redirect_uri",
@@ -1748,17 +1915,55 @@ var reservedAuthorizationParams = /* @__PURE__ */ new Set([
   "resource",
   "request",
   "request_uri"
-]);
+];
+var reserved = new Set(reservedAuthorizationParams);
 var OAuthAuthorizationParams = Schema_exports.Record(Schema_exports.String, Schema_exports.String).check(
-  Schema_exports.makeFilter(
-    (params) => Object.keys(params).every((key) => !reservedAuthorizationParams.has(key)),
-    {
-      message: "Authorization parameters cannot replace protocol parameters such as state or scope."
-    }
-  )
+  Schema_exports.makeFilter((params) => Object.keys(params).every((key) => !reserved.has(key)), {
+    message: "Authorization parameters cannot replace protocol parameters such as state or scope."
+  })
+);
+var declaredAuthorizationQuery = Schema_exports.makeFilter(
+  (config) => {
+    const keys = [...new URL(config.authorizationUrl).searchParams.keys()];
+    const owned = keys.filter((key) => reserved.has(key));
+    if (owned.length > 0)
+      return {
+        path: ["authorizationUrl"],
+        issue: `authorizationUrl cannot set protocol parameters: ${owned.join(", ")}.`
+      };
+    const repeated = keys.filter((key) => Object.hasOwn(config.authorizationParams ?? {}, key));
+    if (repeated.length > 0)
+      return {
+        path: ["authorizationParams"],
+        issue: `Declare each parameter once; authorizationUrl already sets: ${repeated.join(", ")}.`
+      };
+    return void 0;
+  }
 );
+var OAuthTokenRequestFormat = Schema_exports.Literals(["form", "json"]);
+var OAuthTokenResponse = Schema_exports.Struct({
+  path: Schema_exports.String.check(Schema_exports.isPattern(/^[^.]+(\.[^.]+)*$/))
+});
+var tokenRequestOptions = {
+  /** Joins requested scopes; Linear wants `","`. Defaults to RFC 6749's space. */
+  scopeSeparator: Schema_exports.optionalKey(Schema_exports.String.check(Schema_exports.isMinLength(1))),
+  /** Encoding of token requests. Defaults to `"form"`; Atlassian, ClickUp and Notion need `"json"`. */
+  tokenRequestFormat: Schema_exports.optionalKey(OAuthTokenRequestFormat)
+};
 var oauthOptions = {
+  ...tokenRequestOptions,
+  /**
+   * Read the grant from this nested member of the token response when the top-level response has
+   * no access token or no scope. Slack's user tokens use `{ path: "authed_user" }`.
+   */
+  tokenResponse: Schema_exports.optionalKey(OAuthTokenResponse),
   grant: Schema_exports.optionalKey(Schema_exports.Literal("authorization_code")),
+  /**
+   * Service-defined authorization request parameters, such as Google's
+   * `{ access_type: "offline", prompt: "consent" }`. Host-owned protocol parameters
+   * (`state`, `scope`, `redirect_uri`, PKCE and the others in `reservedAuthorizationParams`)
+   * are rejected. A discovered endpoint's own query parameter of the same name is replaced.
+   */
   authorizationParams: Schema_exports.optionalKey(OAuthAuthorizationParams),
   tokenEndpointAuthMethod: Schema_exports.optionalKey(OAuthClientAuth),
   /** Omitted uses discovery; null explicitly suppresses the resource parameter. */
@@ -1768,6 +1973,8 @@ var OAuth2Config = Schema_exports.Union([
   Schema_exports.Struct({
     ...oauthOptions,
     discover: HttpUrl,
+    /** Fetch this exact metadata document and verify its issuer against discovery. */
+    authorizationServerMetadataUrl: Schema_exports.optionalKey(HttpUrl),
     authorizationUrl: Schema_exports.optionalKey(Schema_exports.Never),
     tokenUrl: Schema_exports.optionalKey(Schema_exports.Never),
     revocationUrl: Schema_exports.optionalKey(Schema_exports.Never),
@@ -1775,21 +1982,26 @@ var OAuth2Config = Schema_exports.Union([
   }),
   Schema_exports.Struct({
     ...oauthOptions,
+    /** Its query is kept; it cannot set protocol parameters or repeat `authorizationParams`. */
     authorizationUrl: HttpUrl,
     tokenUrl: HttpUrl,
     revocationUrl: Schema_exports.optionalKey(HttpUrl),
     scopes: Schema_exports.Array(Schema_exports.String),
     /** RFC 8414 issuer identifier. Declared issuers are checked against the callback's `iss`. */
     issuer: Schema_exports.optionalKey(HttpUrl),
-    discover: Schema_exports.optionalKey(Schema_exports.Never)
-  }),
+    discover: Schema_exports.optionalKey(Schema_exports.Never),
+    authorizationServerMetadataUrl: Schema_exports.optionalKey(Schema_exports.Never)
+  }).check(declaredAuthorizationQuery),
   Schema_exports.Struct({
     grant: Schema_exports.Literal("client_credentials"),
     discover: HttpUrl,
+    /** Fetch this exact metadata document and verify its issuer against discovery. */
+    authorizationServerMetadataUrl: Schema_exports.optionalKey(HttpUrl),
     authorizationUrl: Schema_exports.optionalKey(Schema_exports.Never),
     tokenUrl: Schema_exports.optionalKey(Schema_exports.Never),
     revocationUrl: Schema_exports.optionalKey(Schema_exports.Never),
     scopes: Schema_exports.optionalKey(Schema_exports.Array(Schema_exports.String)),
+    ...tokenRequestOptions,
     tokenEndpointAuthMethod: OAuthSecretClientAuth,
     resource: Schema_exports.optionalKey(Schema_exports.NullOr(HttpUrl))
   }),
@@ -1798,10 +2010,12 @@ var OAuth2Config = Schema_exports.Union([
     tokenUrl: HttpUrl,
     revocationUrl: Schema_exports.optionalKey(HttpUrl),
     scopes: Schema_exports.Array(Schema_exports.String),
+    ...tokenRequestOptions,
     tokenEndpointAuthMethod: OAuthSecretClientAuth,
     resource: Schema_exports.optionalKey(Schema_exports.NullOr(HttpUrl)),
     authorizationUrl: Schema_exports.optionalKey(Schema_exports.Never),
-    discover: Schema_exports.optionalKey(Schema_exports.Never)
+    discover: Schema_exports.optionalKey(Schema_exports.Never),
+    authorizationServerMetadataUrl: Schema_exports.optionalKey(Schema_exports.Never)
   })
 ]);
 var OAuth2AccessToken = Schema_exports.Struct({ access_token: Schema_exports.String });
@@ -1809,6 +2023,16 @@ var OAuth2Method = class extends Data_exports.TaggedClass(
   "oauth2"
 ) {
 };
+var displayText = Schema_exports.String.check(Schema_exports.isMinLength(1), Schema_exports.isMaxLength(255));
+var AccountInfo = Schema_exports.Struct({
+  externalId: Schema_exports.optionalKey(displayText),
+  displayName: Schema_exports.optionalKey(displayText),
+  username: Schema_exports.optionalKey(displayText),
+  email: Schema_exports.optionalKey(displayText),
+  avatarUrl: Schema_exports.optionalKey(HttpUrl),
+  profileUrl: Schema_exports.optionalKey(HttpUrl)
+});
+var AccountCheckResult = Schema_exports.Struct({ accountInfo: Schema_exports.optionalKey(AccountInfo) });
 var Provider = class extends Data_exports.Class {
   /** Declare zero or more accounts from this provider without performing I/O. */
   many() {
@@ -1819,7 +2043,129 @@ var ManyAccounts = class extends Data_exports.TaggedClass("many") {
 };
 
 // src/contracts/protocol-version.ts
-var frameworkProtocol = 1;
+var frameworkProtocol = 8;
+
+// src/contracts/protocols/oauth.ts
+var OAuthClientAuth2 = Schema_exports.Literals([
+  "none",
+  "client_secret_post",
+  "client_secret_basic",
+  "client_secret_basic_raw"
+]);
+var OAuthSecretClientAuth2 = Schema_exports.Literals([
+  "client_secret_post",
+  "client_secret_basic",
+  "client_secret_basic_raw"
+]);
+var reservedAuthorizationParams2 = [
+  "response_type",
+  "client_id",
+  "redirect_uri",
+  "state",
+  "scope",
+  "code_challenge",
+  "code_challenge_method",
+  "nonce",
+  "resource",
+  "request",
+  "request_uri"
+];
+var reserved2 = new Set(reservedAuthorizationParams2);
+var OAuthAuthorizationParams2 = Schema_exports.Record(Schema_exports.String, Schema_exports.String).check(
+  Schema_exports.makeFilter((params) => Object.keys(params).every((key) => !reserved2.has(key)), {
+    message: "Authorization parameters cannot replace protocol parameters such as state or scope."
+  })
+);
+var declaredAuthorizationQuery2 = Schema_exports.makeFilter(
+  (config) => {
+    const keys = [...new URL(config.authorizationUrl).searchParams.keys()];
+    const owned = keys.filter((key) => reserved2.has(key));
+    if (owned.length > 0)
+      return {
+        path: ["authorizationUrl"],
+        issue: `authorizationUrl cannot set protocol parameters: ${owned.join(", ")}.`
+      };
+    const repeated = keys.filter((key) => Object.hasOwn(config.authorizationParams ?? {}, key));
+    if (repeated.length > 0)
+      return {
+        path: ["authorizationParams"],
+        issue: `Declare each parameter once; authorizationUrl already sets: ${repeated.join(", ")}.`
+      };
+    return void 0;
+  }
+);
+var OAuthTokenRequestFormat2 = Schema_exports.Literals(["form", "json"]);
+var OAuthTokenResponse2 = Schema_exports.Struct({
+  path: Schema_exports.String.check(Schema_exports.isPattern(/^[^.]+(\.[^.]+)*$/))
+});
+var tokenRequestOptions2 = {
+  /** Joins requested scopes; Linear wants `","`. Defaults to RFC 6749's space. */
+  scopeSeparator: Schema_exports.optionalKey(Schema_exports.String.check(Schema_exports.isMinLength(1))),
+  /** Encoding of token requests. Defaults to `"form"`; Atlassian, ClickUp and Notion need `"json"`. */
+  tokenRequestFormat: Schema_exports.optionalKey(OAuthTokenRequestFormat2)
+};
+var oauthOptions2 = {
+  ...tokenRequestOptions2,
+  /**
+   * Read the grant from this nested member of the token response when the top-level response has
+   * no access token or no scope. Slack's user tokens use `{ path: "authed_user" }`.
+   */
+  tokenResponse: Schema_exports.optionalKey(OAuthTokenResponse2),
+  grant: Schema_exports.optionalKey(Schema_exports.Literal("authorization_code")),
+  /**
+   * Service-defined authorization request parameters, such as Google's
+   * `{ access_type: "offline", prompt: "consent" }`. Host-owned protocol parameters
+   * (`state`, `scope`, `redirect_uri`, PKCE and the others in `reservedAuthorizationParams`)
+   * are rejected. A discovered endpoint's own query parameter of the same name is replaced.
+   */
+  authorizationParams: Schema_exports.optionalKey(OAuthAuthorizationParams2),
+  tokenEndpointAuthMethod: Schema_exports.optionalKey(OAuthClientAuth2),
+  /** Omitted uses discovery; null explicitly suppresses the resource parameter. */
+  resource: Schema_exports.optionalKey(Schema_exports.NullOr(HttpUrl))
+};
+var OAuth2Config2 = Schema_exports.Union([
+  Schema_exports.Struct({
+    ...oauthOptions2,
+    discover: HttpUrl,
+    authorizationUrl: Schema_exports.optionalKey(Schema_exports.Never),
+    tokenUrl: Schema_exports.optionalKey(Schema_exports.Never),
+    revocationUrl: Schema_exports.optionalKey(Schema_exports.Never),
+    scopes: Schema_exports.optionalKey(Schema_exports.Array(Schema_exports.String))
+  }),
+  Schema_exports.Struct({
+    ...oauthOptions2,
+    /** Its query is kept; it cannot set protocol parameters or repeat `authorizationParams`. */
+    authorizationUrl: HttpUrl,
+    tokenUrl: HttpUrl,
+    revocationUrl: Schema_exports.optionalKey(HttpUrl),
+    scopes: Schema_exports.Array(Schema_exports.String),
+    /** RFC 8414 issuer identifier. Declared issuers are checked against the callback's `iss`. */
+    issuer: Schema_exports.optionalKey(HttpUrl),
+    discover: Schema_exports.optionalKey(Schema_exports.Never)
+  }).check(declaredAuthorizationQuery2),
+  Schema_exports.Struct({
+    grant: Schema_exports.Literal("client_credentials"),
+    discover: HttpUrl,
+    authorizationUrl: Schema_exports.optionalKey(Schema_exports.Never),
+    tokenUrl: Schema_exports.optionalKey(Schema_exports.Never),
+    revocationUrl: Schema_exports.optionalKey(Schema_exports.Never),
+    scopes: Schema_exports.optionalKey(Schema_exports.Array(Schema_exports.String)),
+    ...tokenRequestOptions2,
+    tokenEndpointAuthMethod: OAuthSecretClientAuth2,
+    resource: Schema_exports.optionalKey(Schema_exports.NullOr(HttpUrl))
+  }),
+  Schema_exports.Struct({
+    grant: Schema_exports.Literal("client_credentials"),
+    tokenUrl: HttpUrl,
+    revocationUrl: Schema_exports.optionalKey(HttpUrl),
+    scopes: Schema_exports.Array(Schema_exports.String),
+    ...tokenRequestOptions2,
+    tokenEndpointAuthMethod: OAuthSecretClientAuth2,
+    resource: Schema_exports.optionalKey(Schema_exports.NullOr(HttpUrl)),
+    authorizationUrl: Schema_exports.optionalKey(Schema_exports.Never),
+    discover: Schema_exports.optionalKey(Schema_exports.Never)
+  })
+]);
 
 // src/contracts/schedules.ts
 var minimumIntervalMilliseconds = 6e4;
@@ -1857,26 +2203,65 @@ var OperationSchedule = Schema_exports.Struct({
 });
 
 // src/contracts/protocols/1.ts
+var ProviderError2 = class extends Schema_exports.TaggedError()("ProviderError", {
+  reason: Schema_exports.Literals(["unauthorized", "forbidden", "rate_limited", "unavailable", "rejected"]),
+  status: Schema_exports.optional(Schema_exports.Int.check(Schema_exports.isBetween({ minimum: 100, maximum: 599 }))),
+  accountId: Schema_exports.optional(AccountId)
+}) {
+};
+var McpError3 = class extends Schema_exports.TaggedError()("McpError", {
+  phase: Schema_exports.Literals(["connect", "discover", "call", "schema", "transport"]),
+  reason: Schema_exports.Literals([
+    "request",
+    "unauthorized",
+    "invalid_response",
+    "timeout",
+    "invalid_input"
+  ]),
+  status: Schema_exports.optional(Schema_exports.Number)
+}) {
+};
+var WorkflowFailure2 = class extends Schema_exports.TaggedError()("WorkflowFailure", {
+  reason: Schema_exports.Literals([
+    "unavailable",
+    "not_found",
+    "input",
+    "output",
+    "operation",
+    "approval",
+    "credentials",
+    "terminated",
+    "execution",
+    "conflict",
+    "engine"
+  ]),
+  retryable: Schema_exports.Boolean
+}) {
+};
+var WorkflowRpcResult2 = Schema_exports.Union([
+  Schema_exports.Struct({ ok: Schema_exports.Literal(true), value: JsonValue }),
+  Schema_exports.Struct({ ok: Schema_exports.Literal(false), error: WorkflowFailure2 })
+]);
 var DeclaredAuthMethod = Schema_exports.Union([
   Schema_exports.Struct({ type: Schema_exports.Literal("secrets"), label: Schema_exports.String, fields: JsonObject2 }),
   Schema_exports.Struct({
     type: Schema_exports.Literal("oauth2"),
-    ...OAuth2Config.members[0].fields,
+    ...OAuth2Config2.members[0].fields,
     response: JsonObject2
   }),
   Schema_exports.Struct({
     type: Schema_exports.Literal("oauth2"),
-    ...OAuth2Config.members[1].fields,
+    ...OAuth2Config2.members[1].fields,
     response: JsonObject2
   }),
   Schema_exports.Struct({
     type: Schema_exports.Literal("oauth2"),
-    ...OAuth2Config.members[2].fields,
+    ...OAuth2Config2.members[2].fields,
     response: JsonObject2
   }),
   Schema_exports.Struct({
     type: Schema_exports.Literal("oauth2"),
-    ...OAuth2Config.members[3].fields,
+    ...OAuth2Config2.members[3].fields,
     response: JsonObject2
   })
 ]);
@@ -2038,10 +2423,10 @@ var HostOutputInvalid = class extends Schema_exports.TaggedError()(
 };
 var HostError = Schema_exports.Union([
   OpenapiResponseError,
-  ProviderError,
-  McpError,
+  ProviderError2,
+  McpError3,
   SkillLoadFailed,
-  WorkflowFailure,
+  WorkflowFailure2,
   HostRequestInvalid,
   HostAccountsInvalid,
   HostDeclarationInvalid,
@@ -2085,6 +2470,217 @@ var protocol1 = {
     elicitationRequest: FormElicitation,
     elicitationReply: ElicitationReply,
     workflowStep: WorkflowRpcCommand,
+    workflowStepReply: WorkflowRpcResult2,
+    workflowControl: WorkflowControlCommand,
+    cacheCommand: CacheCommand,
+    cacheReply: CacheReply
+  }
+};
+
+// src/contracts/protocols/2.ts
+var SkillSources2 = Schema_exports.Struct({
+  skills: AppSkills,
+  dynamic: Schema_exports.Boolean,
+  cached: Schema_exports.optionalKey(Schema_exports.Boolean)
+});
+var SkillCatalogResponse2 = Schema_exports.Union([SkillSources2, AppSkills]);
+var protocol2 = {
+  version: 2,
+  schemas: { ...protocol1.schemas, skills: SkillCatalogResponse2 }
+};
+
+// src/contracts/protocols/3.ts
+var FailureDetail2 = {
+  source: Schema_exports.optionalKey(FailureSource),
+  errorName: Schema_exports.optionalKey(FailureName),
+  code: Schema_exports.optionalKey(FailureCode),
+  message: Schema_exports.optionalKey(FailureMessage)
+};
+var HostDeclarationInvalid2 = class extends Schema_exports.TaggedError()(
+  "HostDeclarationInvalid",
+  FailureDetail2
+) {
+};
+var HostEvaluationFailed2 = class extends Schema_exports.TaggedError()(
+  "HostEvaluationFailed",
+  FailureDetail2
+) {
+};
+var HostOperationFailed2 = class extends Schema_exports.TaggedError()(
+  "HostOperationFailed",
+  FailureDetail2
+) {
+};
+var HostError2 = Schema_exports.Union([
+  OpenapiResponseError,
+  ProviderError2,
+  McpError3,
+  SkillLoadFailed,
+  WorkflowFailure,
+  HostRequestInvalid,
+  HostAccountsInvalid,
+  HostDeclarationInvalid2,
+  HostEvaluationFailed2,
+  HostOperationNotFound,
+  HostOperationFailed2,
+  DatabaseLimitExceeded,
+  DatabaseFieldReserved,
+  HostToolNotFound,
+  HostInputInvalid,
+  HostOutputInvalid,
+  HostToolBlocked,
+  HostToolApprovalRequired,
+  HostToolPolicyFailed,
+  ElicitationFailed
+]);
+var HostResponse2 = Schema_exports.Union([
+  Schema_exports.Struct({
+    ok: Schema_exports.Literal(true),
+    value: JsonValue,
+    toolError: Schema_exports.optionalKey(Schema_exports.Literal(true))
+  }),
+  Schema_exports.Struct({ ok: Schema_exports.Literal(false), error: HostError2 })
+]);
+var protocol3 = {
+  version: 3,
+  schemas: {
+    invocation: HostInvocation,
+    request: HostRequest,
+    response: HostResponse2,
+    requirements: DeclaredRequirements,
+    tools: Schema_exports.Array(HostedTool),
+    toolSummaries: Schema_exports.Array(HostedToolSummary),
+    skills: SkillCatalogResponse2,
+    elicitationRequest: FormElicitation,
+    elicitationReply: ElicitationReply,
+    workflowStep: WorkflowRpcCommand,
+    workflowStepReply: WorkflowRpcResult,
+    workflowControl: WorkflowControlCommand,
+    cacheCommand: CacheCommand,
+    cacheReply: CacheReply
+  }
+};
+
+// src/contracts/protocols/4.ts
+var HostedTool2 = Schema_exports.Struct({
+  schedules: Schema_exports.optionalKey(Schema_exports.Array(OperationSchedule)),
+  name: Schema_exports.NonEmptyString,
+  router: Schema_exports.optionalKey(Schema_exports.NonEmptyString),
+  tags: Schema_exports.optionalKey(Schema_exports.Array(Schema_exports.NonEmptyString)),
+  description: Schema_exports.String,
+  inputSchema: JsonObject2,
+  readOnly: Schema_exports.optionalKey(Schema_exports.Boolean),
+  title: Schema_exports.optionalKey(Schema_exports.String),
+  outputSchema: Schema_exports.optionalKey(JsonObject2),
+  annotations: Schema_exports.optionalKey(ToolAnnotations),
+  _meta: Schema_exports.optionalKey(JsonObject2)
+});
+var HostedToolSummary2 = HostedTool2.mapFields(
+  ({ inputSchema: _input, outputSchema: _output, _meta, ...fields }) => fields
+);
+var HostRouterError = Schema_exports.Union([
+  ProviderError2,
+  McpError3,
+  SkillLoadFailed,
+  HostDeclarationInvalid2,
+  HostEvaluationFailed2
+]);
+var HostedRouter = Schema_exports.Struct({
+  path: Schema_exports.String,
+  title: Schema_exports.optionalKey(Schema_exports.String),
+  description: Schema_exports.optionalKey(Schema_exports.String),
+  icons: Schema_exports.optionalKey(Schema_exports.Array(RouterIcon)),
+  tags: Schema_exports.optionalKey(Schema_exports.Record(Schema_exports.NonEmptyString, Schema_exports.String)),
+  skill: Schema_exports.optionalKey(AppSkillName),
+  error: Schema_exports.optionalKey(HostRouterError)
+});
+var HostedCatalog = Schema_exports.Struct({
+  tools: Schema_exports.Array(HostedTool2),
+  routers: Schema_exports.Array(HostedRouter)
+});
+var HostedCatalogSummary = Schema_exports.Struct({
+  tools: Schema_exports.Array(HostedToolSummary2),
+  routers: Schema_exports.Array(HostedRouter)
+});
+var ToolKind = Schema_exports.Literals(["query", "mutation"]);
+var HostRequest2 = Schema_exports.Union([
+  WorkflowCommand,
+  WebhookCommand,
+  Schema_exports.Struct({ operation: Schema_exports.Literal("requirements") }),
+  Schema_exports.Struct({
+    operation: Schema_exports.Literal("inspect"),
+    /** Omit schemas. Only builds that declare the toolIndex capability accept this. */
+    detail: Schema_exports.optionalKey(Schema_exports.Literal("summary")),
+    /** Describe only these tools. Only builds that declare the toolIndex capability accept this. */
+    tools: Schema_exports.optionalKey(Schema_exports.Array(Schema_exports.NonEmptyString)),
+    /**
+     * Describe only declared operations that have schedules, without dynamic tool discovery.
+     * Only builds that declare the scheduledTools capability accept this.
+     */
+    scheduled: Schema_exports.optionalKey(Schema_exports.Literal(true))
+  }),
+  Schema_exports.Struct({
+    operation: Schema_exports.Literal("skills"),
+    /** Answer with SkillSources. Only builds that declare the skillSources capability accept this. */
+    sources: Schema_exports.optionalKey(Schema_exports.Literal(true))
+  }),
+  Schema_exports.Struct({
+    operation: Schema_exports.Literal("query"),
+    name: Schema_exports.NonEmptyString,
+    input: JsonValue
+  }),
+  Schema_exports.Struct({
+    operation: Schema_exports.Literal("mutate"),
+    name: Schema_exports.NonEmptyString,
+    input: JsonValue
+  }),
+  Schema_exports.Struct({
+    operation: Schema_exports.Literal("call"),
+    tool: Schema_exports.NonEmptyString,
+    /**
+     * The caller's claim; the bundle rejects a call whose tool has the other kind. The host omits
+     * it for a tool its catalog does not list, and then opens storage for writing.
+     */
+    kind: Schema_exports.optionalKey(ToolKind),
+    input: JsonValue
+  })
+]);
+var HostKindMismatch = class extends Schema_exports.TaggedError()("HostKindMismatch", {
+  tool: Schema_exports.NonEmptyString,
+  requested: ToolKind,
+  actual: ToolKind
+}) {
+};
+var HostError3 = Schema_exports.Union([...HostError2.members, HostKindMismatch]);
+var HostResponse3 = Schema_exports.Union([
+  Schema_exports.Struct({
+    ok: Schema_exports.Literal(true),
+    value: JsonValue,
+    toolError: Schema_exports.optionalKey(Schema_exports.Literal(true))
+  }),
+  Schema_exports.Struct({ ok: Schema_exports.Literal(false), error: HostError3 })
+]);
+var HostInvocation2 = Schema_exports.Struct({
+  command: HostRequest2,
+  accounts: ResolvedAccounts,
+  approval: Schema_exports.optionalKey(TrustedToolApproval),
+  replay: Schema_exports.optionalKey(WorkflowReplay),
+  deadline: Schema_exports.optionalKey(InvocationDeadline),
+  workflowRun: Schema_exports.optionalKey(WorkflowRunId)
+});
+var protocol4 = {
+  version: 4,
+  schemas: {
+    invocation: HostInvocation2,
+    request: HostRequest2,
+    response: HostResponse3,
+    requirements: DeclaredRequirements,
+    catalog: HostedCatalog,
+    catalogSummary: HostedCatalogSummary,
+    skills: SkillCatalogResponse2,
+    elicitationRequest: FormElicitation,
+    elicitationReply: ElicitationReply,
+    workflowStep: WorkflowRpcCommand,
     workflowStepReply: WorkflowRpcResult,
     workflowControl: WorkflowControlCommand,
     cacheCommand: CacheCommand,
@@ -2092,28 +2688,300 @@ var protocol1 = {
   }
 };
 
-// src/contracts/operations.ts
-var OperationToolPrefixes = { query: "queries.", mutate: "mutations." };
+// src/contracts/protocols/5.ts
+var DeclaredRequirements2 = Schema_exports.Struct({
+  /** Protocol support of this retained framework build, not an author-declared requirement. */
+  capabilities: Schema_exports.optionalKey(
+    Schema_exports.Struct({
+      skills: Schema_exports.Literal(true),
+      toolIndex: Schema_exports.optionalKey(Schema_exports.Literal(true)),
+      skillSources: Schema_exports.optionalKey(Schema_exports.Literal(true)),
+      scheduledTools: Schema_exports.optionalKey(Schema_exports.Literal(true))
+    })
+  ),
+  database: Schema_exports.optionalKey(DatabaseSchema),
+  accounts: Schema_exports.Record(
+    Schema_exports.NonEmptyString,
+    Schema_exports.Struct({
+      definition: DeclaredProvider,
+      cardinality: Schema_exports.Literals(["one", "many"]),
+      /**
+       * The slot's provider defines an account check. Kept beside the definition, not in it, so
+       * adding or editing a check never changes the provider's identity.
+       */
+      health: Schema_exports.optionalKey(Schema_exports.Literal(true))
+    })
+  )
+});
+var AccountCheckCommand = Schema_exports.Struct({
+  operation: Schema_exports.Literal("account-check"),
+  requirement: Schema_exports.NonEmptyString
+});
+var HostRequest3 = Schema_exports.Union([
+  ...protocol4.schemas.request.members,
+  AccountCheckCommand
+]);
+var HostInvocation3 = Schema_exports.Struct({
+  command: HostRequest3,
+  accounts: ResolvedAccounts,
+  approval: Schema_exports.optionalKey(TrustedToolApproval),
+  replay: Schema_exports.optionalKey(WorkflowReplay),
+  deadline: Schema_exports.optionalKey(InvocationDeadline),
+  workflowRun: Schema_exports.optionalKey(WorkflowRunId)
+});
+var protocol5 = {
+  version: 5,
+  schemas: {
+    ...protocol4.schemas,
+    invocation: HostInvocation3,
+    request: HostRequest3,
+    requirements: DeclaredRequirements2,
+    accountCheck: AccountCheckResult
+  }
+};
+
+// src/contracts/protocols/6.ts
+var DeclaredAuthMethod2 = Schema_exports.Union([
+  Schema_exports.Struct({ type: Schema_exports.Literal("secrets"), label: Schema_exports.String, fields: JsonObject2 }),
+  Schema_exports.Struct({
+    type: Schema_exports.Literal("oauth2"),
+    ...OAuth2Config.members[0].fields,
+    response: JsonObject2
+  }),
+  Schema_exports.Struct({
+    type: Schema_exports.Literal("oauth2"),
+    ...OAuth2Config.members[1].fields,
+    response: JsonObject2
+  }),
+  Schema_exports.Struct({
+    type: Schema_exports.Literal("oauth2"),
+    ...OAuth2Config.members[2].fields,
+    response: JsonObject2
+  }),
+  Schema_exports.Struct({
+    type: Schema_exports.Literal("oauth2"),
+    ...OAuth2Config.members[3].fields,
+    response: JsonObject2
+  })
+]);
+var DeclaredProvider2 = Schema_exports.Struct({
+  name: Schema_exports.NonEmptyString,
+  auth: Schema_exports.Record(Schema_exports.NonEmptyString, DeclaredAuthMethod2)
+});
+var DeclaredRequirements3 = Schema_exports.Struct({
+  ...DeclaredRequirements2.fields,
+  accounts: Schema_exports.Record(
+    Schema_exports.NonEmptyString,
+    Schema_exports.Struct({
+      definition: DeclaredProvider2,
+      cardinality: Schema_exports.Literals(["one", "many"]),
+      health: Schema_exports.optionalKey(Schema_exports.Literal(true))
+    })
+  )
+});
+var ResolvedAccount2 = Schema_exports.Struct({
+  ...ResolvedAccount.fields,
+  provider: DeclaredProvider2
+});
+var ResolvedAccounts2 = Schema_exports.Record(
+  Schema_exports.NonEmptyString,
+  Schema_exports.Union([ResolvedAccount2, Schema_exports.Array(ResolvedAccount2)])
+);
+var HostInvocation4 = Schema_exports.Struct({
+  ...HostInvocation3.fields,
+  accounts: ResolvedAccounts2
+});
+var protocol6 = {
+  version: 6,
+  schemas: {
+    ...protocol5.schemas,
+    requirements: DeclaredRequirements3,
+    accounts: ResolvedAccounts2,
+    invocation: HostInvocation4
+  }
+};
+
+// src/contracts/protocols/7.ts
+var CredentialHost = Schema_exports.String.check(
+  Schema_exports.isPattern(
+    /^(\*\.)?[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*(?::[0-9]{1,5})?$/
+  )
+);
+var exposure = {
+  /** Not secret: app code reads the real value and forms show it. */
+  plain: Schema_exports.optionalKey(Schema_exports.Array(Schema_exports.NonEmptyString)),
+  /** Secret, but app code reads the real value, for signing and similar uses. */
+  raw: Schema_exports.optionalKey(Schema_exports.Array(Schema_exports.NonEmptyString))
+};
+var DeclaredAuthMethod3 = Schema_exports.Union([
+  Schema_exports.Struct({
+    type: Schema_exports.Literal("secrets"),
+    label: Schema_exports.String,
+    fields: JsonObject2,
+    ...exposure
+  }),
+  Schema_exports.Struct({
+    type: Schema_exports.Literal("oauth2"),
+    ...OAuth2Config.members[0].fields,
+    response: JsonObject2,
+    ...exposure
+  }),
+  Schema_exports.Struct({
+    type: Schema_exports.Literal("oauth2"),
+    ...OAuth2Config.members[1].fields,
+    response: JsonObject2,
+    ...exposure
+  }),
+  Schema_exports.Struct({
+    type: Schema_exports.Literal("oauth2"),
+    ...OAuth2Config.members[2].fields,
+    response: JsonObject2,
+    ...exposure
+  }),
+  Schema_exports.Struct({
+    type: Schema_exports.Literal("oauth2"),
+    ...OAuth2Config.members[3].fields,
+    response: JsonObject2,
+    ...exposure
+  })
+]);
+var DeclaredProvider3 = Schema_exports.Struct({
+  name: Schema_exports.NonEmptyString,
+  auth: Schema_exports.Record(Schema_exports.NonEmptyString, DeclaredAuthMethod3),
+  hosts: Schema_exports.optionalKey(Schema_exports.Array(CredentialHost))
+});
+var DeclaredRequirements4 = Schema_exports.Struct({
+  ...DeclaredRequirements3.fields,
+  accounts: Schema_exports.Record(
+    Schema_exports.NonEmptyString,
+    Schema_exports.Struct({
+      definition: DeclaredProvider3,
+      cardinality: Schema_exports.Literals(["one", "many"]),
+      health: Schema_exports.optionalKey(Schema_exports.Literal(true))
+    })
+  )
+});
+var ResolvedAccount3 = Schema_exports.Struct({
+  ...ResolvedAccount2.fields,
+  provider: DeclaredProvider3
+});
+var ResolvedAccounts3 = Schema_exports.Record(
+  Schema_exports.NonEmptyString,
+  Schema_exports.Union([ResolvedAccount3, Schema_exports.Array(ResolvedAccount3)])
+);
+var HostInvocation5 = Schema_exports.Struct({
+  ...HostInvocation4.fields,
+  accounts: ResolvedAccounts3
+});
+var protocol7 = {
+  version: 7,
+  schemas: {
+    ...protocol6.schemas,
+    requirements: DeclaredRequirements4,
+    accounts: ResolvedAccounts3,
+    invocation: HostInvocation5
+  }
+};
+
+// src/contracts/protocols/8.ts
+var HostDeclarationInvalid3 = class extends Schema_exports.TaggedError()(
+  "HostDeclarationInvalid",
+  FailureDetail
+) {
+};
+var HostEvaluationFailed3 = class extends Schema_exports.TaggedError()(
+  "HostEvaluationFailed",
+  FailureDetail
+) {
+};
+var HostOperationFailed3 = class extends Schema_exports.TaggedError()(
+  "HostOperationFailed",
+  FailureDetail
+) {
+};
+var HostRouterError2 = Schema_exports.Union([
+  ProviderError,
+  McpError,
+  SkillLoadFailed,
+  HostDeclarationInvalid3,
+  HostEvaluationFailed3
+]);
+var HostedRouter2 = Schema_exports.Struct({
+  ...HostedRouter.fields,
+  error: Schema_exports.optionalKey(HostRouterError2)
+});
+var HostedCatalog2 = Schema_exports.Struct({
+  ...HostedCatalog.fields,
+  routers: Schema_exports.Array(HostedRouter2)
+});
+var HostedCatalogSummary2 = Schema_exports.Struct({
+  ...HostedCatalogSummary.fields,
+  routers: Schema_exports.Array(HostedRouter2)
+});
+var HostError4 = Schema_exports.Union([
+  OpenapiResponseError,
+  ProviderError,
+  McpError,
+  SkillLoadFailed,
+  WorkflowFailure,
+  HostRequestInvalid,
+  HostAccountsInvalid,
+  HostDeclarationInvalid3,
+  HostEvaluationFailed3,
+  HostOperationNotFound,
+  HostOperationFailed3,
+  DatabaseLimitExceeded,
+  DatabaseFieldReserved,
+  HostToolNotFound,
+  HostInputInvalid,
+  HostOutputInvalid,
+  HostToolBlocked,
+  HostToolApprovalRequired,
+  HostToolPolicyFailed,
+  ElicitationFailed,
+  HostKindMismatch
+]);
+var HostResponse4 = Schema_exports.Union([
+  Schema_exports.Struct({
+    ok: Schema_exports.Literal(true),
+    value: JsonValue,
+    toolError: Schema_exports.optionalKey(Schema_exports.Literal(true))
+  }),
+  Schema_exports.Struct({ ok: Schema_exports.Literal(false), error: HostError4 })
+]);
+var protocol8 = {
+  version: 8,
+  schemas: {
+    ...protocol7.schemas,
+    response: HostResponse4,
+    catalog: HostedCatalog2,
+    catalogSummary: HostedCatalogSummary2
+  }
+};
 
 // src/contracts/host.ts
 var skillsCommand = (sources) => sources ? { operation: "skills", sources: true } : { operation: "skills" };
-var skillCatalog = (response) => Schema_exports.is(SkillSources)(response) ? response : { skills: response };
+var skillCatalog = (response) => Schema_exports.is(SkillSources2)(response) ? response : { skills: response };
 var inspectCommand = (tools, scheduled) => ({
   operation: "inspect",
   ...tools === void 0 ? {} : { tools: [...tools] },
   ...scheduled === void 0 ? {} : { scheduled }
 });
 var indexCommand = { operation: "inspect", detail: "summary" };
-var selectTools = (tools) => (all) => tools === void 0 ? all : all.filter((tool) => tools.includes(tool.name));
-var HostRequirementsError = Schema_exports.Union([HostRequestInvalid, HostDeclarationInvalid]);
+var selectTools = (tools) => (catalog) => tools === void 0 ? catalog : { ...catalog, tools: catalog.tools.filter((tool) => tools.includes(tool.name)) };
+var HostRequirementsError = Schema_exports.Union([
+  HostRequestInvalid,
+  HostDeclarationInvalid3,
+  DatabaseFieldReserved
+]);
 var HostInspectError = Schema_exports.Union([
   ProviderError,
   McpError,
   SkillLoadFailed,
   HostRequestInvalid,
-  HostDeclarationInvalid,
+  HostDeclarationInvalid3,
   HostAccountsInvalid,
-  HostEvaluationFailed
+  HostEvaluationFailed3
 ]);
 var HostCallError = Schema_exports.Union([
   OpenapiResponseError,
@@ -2121,7 +2989,9 @@ var HostCallError = Schema_exports.Union([
   HostInspectError,
   HostToolNotFound,
   HostOperationNotFound,
-  HostOperationFailed,
+  HostKindMismatch,
+  HostOperationFailed3,
+  DatabaseLimitExceeded,
   HostInputInvalid,
   HostOutputInvalid,
   HostToolBlocked,
@@ -2129,6 +2999,16 @@ var HostCallError = Schema_exports.Union([
   HostToolPolicyFailed,
   ElicitationFailed
 ]);
+var HostAccountCheckError = Schema_exports.Union([
+  ProviderError,
+  WorkflowFailure,
+  HostRequestInvalid,
+  HostDeclarationInvalid3,
+  HostAccountsInvalid,
+  HostOperationNotFound,
+  HostOperationFailed3,
+  HostOutputInvalid
+]);
 var HostDataError = HostCallError;
 var ToolResultObservation = Context_exports.Reference(
   "apps/ToolResultObservation",
@@ -2137,28 +3017,57 @@ var ToolResultObservation = Context_exports.Reference(
 );
 
 export {
+  NetworkRefusal,
+  NetworkRefused,
+  networkRefusalStatus,
+  networkRefusalHeader,
+  NetworkRefusedHeader,
+  networkRefusalResponse,
+  RestrictedFetchOption,
+  supportedFetchOptions,
+  FetchOptionUnsupported,
   SecretsMethod,
   OAuthClientAuth,
   OAuthSecretClientAuth,
+  OAuthTokenRequestFormat,
+  OAuthTokenResponse,
   OAuth2Config,
   OAuth2AccessToken,
   OAuth2Method,
+  AccountInfo,
+  AccountCheckResult,
   Provider,
   ManyAccounts,
+  reservedRouterKeys,
+  RouterKey,
+  RouterIcon,
+  RouterMeta,
   ToolAnnotations,
   McpClientLimits,
   defaultMcpClientLimits,
   mcpSdkTimerCeilingMs,
   McpToolsOptions,
+  McpHealthInput,
+  mcpHealthReserveMs,
   McpToolResult,
   McpToolMetadata,
+  McpServerHeader,
   McpError,
+  McpCredentialsUnverified,
   ProcessConfig,
+  maxApiErrorInstructionsLength,
+  ApiErrorRecovery,
+  maxApiErrorMessageLength,
+  ApiErrorResponse,
+  OpenapiResponseError,
+  defaultOpenapiErrorLimits,
   WorkflowRunId,
   WorkflowName,
   workflowDurationMillis,
   WorkflowDuration,
   WorkflowStepOptions,
+  WorkflowFailureDetail,
+  WorkflowRunFailure,
   WorkflowFailure,
   NonRetryableError,
   WorkflowValue,
@@ -2193,24 +3102,11 @@ export {
   CalendarSchedule,
   ScheduleTiming,
   OperationSchedule,
-  DeclaredAuthMethod,
-  DeclaredProvider,
-  DeclaredRequirements,
-  ResolvedAccount,
-  ResolvedAccounts,
   TrustedToolApproval,
   InvocationDeadline,
-  HostedTool,
-  HostedToolSummary,
-  SkillSources,
-  SkillCatalogResponse,
-  HostRequest,
   HostRequestInvalid,
   HostAccountsInvalid,
-  HostDeclarationInvalid,
-  HostEvaluationFailed,
   HostOperationNotFound,
-  HostOperationFailed,
   HostToolNotFound,
   InputProblem,
   maxInputProblems,
@@ -2219,11 +3115,37 @@ export {
   HostToolApprovalRequired,
   HostToolPolicyFailed,
   HostOutputInvalid,
-  HostError,
-  HostResponse,
-  HostInvocation,
   protocol1,
-  OperationToolPrefixes,
+  SkillSources2 as SkillSources,
+  SkillCatalogResponse2 as SkillCatalogResponse,
+  protocol2,
+  protocol3,
+  HostedTool2 as HostedTool,
+  HostedToolSummary2 as HostedToolSummary,
+  HostKindMismatch,
+  protocol4,
+  AccountCheckCommand,
+  HostRequest3 as HostRequest,
+  protocol5,
+  protocol6,
+  CredentialHost,
+  DeclaredAuthMethod3 as DeclaredAuthMethod,
+  DeclaredProvider3 as DeclaredProvider,
+  DeclaredRequirements4 as DeclaredRequirements,
+  ResolvedAccount3 as ResolvedAccount,
+  ResolvedAccounts3 as ResolvedAccounts,
+  HostInvocation5 as HostInvocation,
+  protocol7,
+  HostDeclarationInvalid3 as HostDeclarationInvalid,
+  HostEvaluationFailed3 as HostEvaluationFailed,
+  HostOperationFailed3 as HostOperationFailed,
+  HostRouterError2 as HostRouterError,
+  HostedRouter2 as HostedRouter,
+  HostedCatalog2 as HostedCatalog,
+  HostedCatalogSummary2 as HostedCatalogSummary,
+  HostError4 as HostError,
+  HostResponse4 as HostResponse,
+  protocol8,
   skillsCommand,
   skillCatalog,
   inspectCommand,
@@ -2232,6 +3154,7 @@ export {
   HostRequirementsError,
   HostInspectError,
   HostCallError,
+  HostAccountCheckError,
   HostDataError,
   ToolResultObservation
 };