apps 0.0.1-beta.4 → 0.0.1-beta.40

package/js/{chunk-3M2MEDNL.js → chunk-OTCLXFLL.js}

@@ -1,26 +1,27 @@
-import {
-  DatabaseSchema
-} from "./chunk-BMOIAIVR.js";
 import {
   CacheCommand,
-  CacheReply
-} from "./chunk-LGIYBDWA.js";
-import {
-  AppSkills,
-  SkillLoadFailed
-} from "./chunk-YEJOQEII.js";
+  CacheReply,
+  FailureCode,
+  FailureDetail,
+  FailureMessage,
+  FailureName,
+  FailureSource,
+  ProviderError,
+  UpstreamError
+} from "./chunk-P7MGDPFD.js";
 import {
-  OpenapiResponseError
-} from "./chunk-SWPD52J7.js";
+  AppSkillName,
+  AppSkills
+} from "./chunk-UOZMSUJ2.js";
 import {
-  ProviderError
-} from "./chunk-W7D7WVSY.js";
+  RecordedMessage
+} from "./chunk-KAQD3DTI.js";
 import {
   AccountId,
   HttpUrl,
   JsonObject as JsonObject2,
   JsonValue
-} from "./chunk-SATWJKN6.js";
+} from "./chunk-YQ35E7KS.js";
 import {
   Any,
   ArraySchema,
@@ -56,13 +57,13 @@ import {
   declare,
   decode,
   decodeTo,
-  empty2 as empty,
+  empty,
   flatMap,
   fromUndefinedOr,
   isBetween,
   isSchema,
   isStream,
-  make6 as make,
+  make2 as make,
   merge,
   optional,
   optionalKey,
@@ -71,83 +72,37 @@ import {
   symbol3 as symbol,
   sync2 as sync,
   tag,
+  toType,
   transformOptional,
   withConstructorDefault,
   withDefault
-} from "./chunk-FW5HBOIK.js";
-
-// src/contracts/tools.ts
-var ToolAnnotations = Schema_exports.Struct({
-  title: Schema_exports.optionalKey(Schema_exports.String),
-  readOnlyHint: Schema_exports.optionalKey(Schema_exports.Boolean),
-  destructiveHint: Schema_exports.optionalKey(Schema_exports.Boolean),
-  idempotentHint: Schema_exports.optionalKey(Schema_exports.Boolean),
-  openWorldHint: Schema_exports.optionalKey(Schema_exports.Boolean)
-});
+} from "./chunk-MXDKXAY4.js";
 
-// src/contracts/mcp.ts
-var McpClientLimits = Schema_exports.Struct({
-  timeoutMs: Schema_exports.Int.check(Schema_exports.isGreaterThan(0)),
-  maxTimeoutMs: Schema_exports.Int.check(Schema_exports.isGreaterThan(0)),
-  maxTools: Schema_exports.Int.check(Schema_exports.isGreaterThan(0)),
-  maxPaginationCursors: Schema_exports.Int.check(Schema_exports.isGreaterThan(0)),
-  cleanupTimeoutMs: Schema_exports.Int.check(Schema_exports.isGreaterThan(0))
-});
-var defaultMcpClientLimits = McpClientLimits.make({
-  timeoutMs: 3e4,
-  maxTimeoutMs: 3e5,
-  maxTools: 5e4,
-  maxPaginationCursors: 1e3,
-  cleanupTimeoutMs: 1e3
-});
-var mcpSdkTimerCeilingMs = 2147483647;
-var McpToolsOptions = Schema_exports.Struct({
-  url: HttpUrl,
-  accountId: Schema_exports.optional(AccountId),
-  headers: Schema_exports.optional(Schema_exports.Record(Schema_exports.String, Schema_exports.String)),
-  signal: Schema_exports.optional(Schema_exports.instanceOf(AbortSignal)),
-  timeoutMs: Schema_exports.optional(
-    Schema_exports.Number.check(
-      Schema_exports.isInt(),
-      Schema_exports.isBetween({ minimum: 1, maximum: defaultMcpClientLimits.maxTimeoutMs })
-    )
-  )
-});
-var McpToolResult = Schema_exports.Struct({
-  content: Schema_exports.Array(JsonObject2),
-  structuredContent: Schema_exports.optional(JsonObject2),
-  isError: Schema_exports.optional(Schema_exports.Boolean),
-  _meta: Schema_exports.optional(JsonObject2)
+// src/contracts/api-response-error.ts
+var maxApiErrorInstructionsLength = 4096;
+var ApiErrorRecovery = Schema_exports.Struct({
+  action: Schema_exports.NonEmptyString.check(Schema_exports.isMaxLength(1024)),
+  instructions: Schema_exports.NonEmptyString.check(Schema_exports.isMaxLength(maxApiErrorInstructionsLength))
 });
-var McpToolMetadata = Schema_exports.Struct({
-  name: Schema_exports.String,
-  title: Schema_exports.optional(Schema_exports.String),
-  description: Schema_exports.optional(Schema_exports.String),
-  inputSchema: JsonObject2,
-  outputSchema: Schema_exports.optional(JsonObject2),
-  annotations: Schema_exports.optional(ToolAnnotations),
-  _meta: Schema_exports.optional(JsonObject2)
+var maxApiErrorMessageLength = 4096;
+var ApiErrorResponse = Schema_exports.Struct({
+  code: Schema_exports.NonEmptyString.check(Schema_exports.isMaxLength(128)),
+  status: Schema_exports.Int.check(Schema_exports.isBetween({ minimum: 400, maximum: 599 })),
+  message: Schema_exports.NonEmptyString.check(Schema_exports.isMaxLength(maxApiErrorMessageLength)),
+  recovery: Schema_exports.optionalKey(ApiErrorRecovery)
 });
-var McpError = class extends Schema_exports.TaggedError()("McpError", {
-  phase: Schema_exports.Literals(["connect", "discover", "call", "schema", "transport"]),
-  reason: Schema_exports.Literals([
-    "request",
-    "unauthorized",
-    "invalid_response",
-    "timeout",
-    "invalid_input"
-  ]),
-  status: Schema_exports.optional(Schema_exports.Number)
-}) {
+var OpenapiResponseError = class extends Schema_exports.TaggedError()(
+  "OpenapiResponseError",
+  ApiErrorResponse.fields
+) {
 };
-var ProcessConfig = Schema_exports.Struct({
-  command: Schema_exports.NonEmptyString,
-  args: Schema_exports.Array(Schema_exports.String),
-  cwd: Schema_exports.optional(Schema_exports.String),
-  env: Schema_exports.Record(Schema_exports.String, Schema_exports.String),
-  timeoutMs: Schema_exports.Int.check(
-    Schema_exports.isBetween({ minimum: 1, maximum: defaultMcpClientLimits.maxTimeoutMs })
-  )
+var OpenapiErrorLimits = Schema_exports.Struct({
+  maxBodyBytes: Schema_exports.Int.check(Schema_exports.isGreaterThan(0)),
+  readTimeoutMs: Schema_exports.Int.check(Schema_exports.isGreaterThan(0))
+});
+var defaultOpenapiErrorLimits = OpenapiErrorLimits.make({
+  maxBodyBytes: 65536,
+  readTimeoutMs: 2e3
 });
 
 // src/contracts/workflows.ts
@@ -191,7 +146,14 @@ var WorkflowStepOptions = Schema_exports.Struct({
   ),
   timeout: Schema_exports.optionalKey(WorkflowDuration)
 });
+var WorkflowFailureDetail = {
+  step: Schema_exports.optionalKey(Schema_exports.String.check(Schema_exports.isMaxLength(200))),
+  errorName: Schema_exports.optionalKey(FailureName),
+  message: Schema_exports.optionalKey(FailureMessage)
+};
+var WorkflowRunFailure = Schema_exports.Struct(WorkflowFailureDetail);
 var WorkflowFailure = class extends Schema_exports.TaggedError()("WorkflowFailure", {
+  ...WorkflowFailureDetail,
   reason: Schema_exports.Literals([
     "unavailable",
     "not_found",
@@ -207,6 +169,13 @@ var WorkflowFailure = class extends Schema_exports.TaggedError()("WorkflowFailur
   ]),
   retryable: Schema_exports.Boolean
 }) {
+  /**
+   * The step name and error detail are the app's. Its run's owner reads them; telemetry records
+   * only the reason, however the failure was built or decoded.
+   */
+  get [RecordedMessage]() {
+    return this.step === void 0 && this.errorName === void 0 && !this.message ? void 0 : `The workflow failed (${this.reason}); the app's error is not recorded`;
+  }
 };
 var NonRetryableError = class extends Error {
   name = "NonRetryableError";
@@ -239,7 +208,9 @@ var WorkflowRun = Schema_exports.Union([
   Schema_exports.Struct({
     ...runFields,
     status: Schema_exports.Literal("errored"),
-    error: WorkflowFailure.fields.reason
+    error: WorkflowFailure.fields.reason,
+    /** The failing step and the app's own error, when the run recorded them. */
+    failure: Schema_exports.optionalKey(WorkflowRunFailure)
   }),
   Schema_exports.Struct({ ...runFields, status: Schema_exports.Literal("terminated") })
 ]);
@@ -311,7 +282,178 @@ var WorkflowControlCommand = Schema_exports.Union([
   Schema_exports.Struct({ operation: Schema_exports.Literal("terminate"), run: WorkflowRunId })
 ]);
 
-// ../../node_modules/.bun/effect@https+++pkg.pr.new+Effect-TS+effect+effect@c7d1ffff31a3e2ae0b0b+a654a55b752bdb24/node_modules/effect/dist/unstable/rpc/RpcSchema.js
+// ../app-data/src/contracts/database.ts
+var DataName = Schema_exports.String.check(
+  Schema_exports.makeFilter((value) => /^[A-Za-z][A-Za-z0-9_]*$/.test(value) && value.length <= 128)
+);
+var Scalar = Schema_exports.Union([Schema_exports.String, Schema_exports.Finite, Schema_exports.Boolean]);
+var Field = Schema_exports.Struct({
+  kind: Schema_exports.Literals(["string", "number", "boolean", "id", "userId"]),
+  optional: Schema_exports.optional(Schema_exports.Boolean),
+  default: Schema_exports.optional(Scalar),
+  references: Schema_exports.optional(DataName)
+});
+var Index = Schema_exports.Struct({ name: DataName, fields: Schema_exports.NonEmptyArray(DataName) });
+var Table = Schema_exports.Struct({
+  fields: Schema_exports.Record(DataName, Field),
+  indexes: Schema_exports.Array(Index)
+});
+var DatabaseSchema = Schema_exports.Record(DataName, Table);
+var Row = Schema_exports.Record(Schema_exports.String, Scalar);
+var RowMetadata = Schema_exports.Struct({
+  id: Schema_exports.NonEmptyString,
+  createdAt: Schema_exports.String,
+  updatedAt: Schema_exports.String
+});
+var Patch = Schema_exports.Record(DataName, Schema_exports.NullOr(Scalar));
+var RangeClause = Schema_exports.Struct({
+  field: DataName,
+  op: Schema_exports.Literals(["eq", "gt", "gte", "lt", "lte"]),
+  value: Schema_exports.NullOr(Scalar)
+});
+var QueryPlan = Schema_exports.Struct({
+  table: DataName,
+  index: DataName,
+  order: Schema_exports.Literals(["asc", "desc"]),
+  clauses: Schema_exports.Array(RangeClause)
+});
+var QueryTerminal = Schema_exports.Union([
+  Schema_exports.Struct({ kind: Schema_exports.Literal("collect") }),
+  Schema_exports.Struct({ kind: Schema_exports.Literal("count") }),
+  Schema_exports.Struct({ kind: Schema_exports.Literal("first") }),
+  Schema_exports.Struct({
+    kind: Schema_exports.Literal("take"),
+    count: Schema_exports.Int.check(Schema_exports.isGreaterThanOrEqualTo(0))
+  }),
+  Schema_exports.Struct({
+    kind: Schema_exports.Literal("paginate"),
+    cursor: Schema_exports.NullOr(Schema_exports.String),
+    numItems: Schema_exports.Int.check(Schema_exports.isGreaterThan(0))
+  })
+]);
+var DatabaseOperation = Schema_exports.Union([
+  Schema_exports.Struct({ kind: Schema_exports.Literal("get"), table: DataName, id: Schema_exports.NonEmptyString }),
+  Schema_exports.Struct({ kind: Schema_exports.Literal("insert"), table: DataName, value: Patch }),
+  Schema_exports.Struct({
+    kind: Schema_exports.Literal("update"),
+    table: DataName,
+    id: Schema_exports.NonEmptyString,
+    patch: Patch
+  }),
+  Schema_exports.Struct({ kind: Schema_exports.Literal("delete"), table: DataName, id: Schema_exports.NonEmptyString }),
+  Schema_exports.Struct({ kind: Schema_exports.Literal("query"), plan: QueryPlan, terminal: QueryTerminal })
+]);
+var PaginationResult = Schema_exports.Struct({
+  page: Schema_exports.Array(Row),
+  continueCursor: Schema_exports.NullOr(Schema_exports.String),
+  isDone: Schema_exports.Boolean
+});
+var OperationResult = Schema_exports.Union([
+  Row,
+  Schema_exports.Array(Row),
+  PaginationResult,
+  Schema_exports.Boolean,
+  Schema_exports.Finite,
+  Schema_exports.Null
+]);
+var AppDatabaseError = class extends Schema_exports.TaggedError()("AppDatabaseError", {
+  reason: Schema_exports.Literals([
+    "schema",
+    "schema_changed",
+    "table",
+    "index",
+    "range",
+    "value",
+    "readonly",
+    "cursor",
+    "limit",
+    "closed",
+    "storage",
+    "replay"
+  ])
+}) {
+};
+var DatabaseLimits = Schema_exports.Struct({
+  rowsRead: Schema_exports.Int.check(Schema_exports.isGreaterThan(0)),
+  rowsReturned: Schema_exports.Int.check(Schema_exports.isGreaterThan(0)),
+  bytesRead: Schema_exports.Int.check(Schema_exports.isGreaterThan(0)),
+  writes: Schema_exports.Int.check(Schema_exports.isGreaterThan(0)),
+  scanCalls: Schema_exports.Int.check(Schema_exports.isGreaterThan(0)),
+  directGets: Schema_exports.Int.check(Schema_exports.isGreaterThan(0)),
+  valueBytes: Schema_exports.Int.check(Schema_exports.isGreaterThan(0)),
+  indexBytes: Schema_exports.Int.check(Schema_exports.isGreaterThan(0))
+});
+var defaultDatabaseLimits = {
+  rowsRead: 5e3,
+  rowsReturned: 1e3,
+  bytesRead: 4 * 1024 * 1024,
+  writes: 1e3,
+  scanCalls: 100,
+  directGets: 1e3,
+  valueBytes: 64 * 1024,
+  indexBytes: 2048
+};
+var DatabaseLimit = Schema_exports.Literals([
+  "scanCalls",
+  "directGets",
+  "rowsRead",
+  "rowsReturned",
+  "pageSize",
+  "bytesRead",
+  "writes",
+  "valueBytes"
+]);
+var count = (value) => value.toLocaleString("en-US");
+var limitMessages = {
+  scanCalls: (maximum, requested) => `This invocation made ${count(requested)} index queries; the limit is ${count(maximum)}. Each first(), take(), collect(), count() or paginate() call on withIndex(...) counts once. Read related rows with one take() or paginate() over a shared index prefix instead of one first() per item, use get(id) for known IDs, or split the work across workflow steps.`,
+  directGets: (maximum, requested) => `This invocation made ${count(requested)} get(id) calls, including those made by update and delete; the limit is ${count(maximum)}. Split the work across workflow steps or mutations.`,
+  rowsRead: (maximum, requested) => `This invocation read ${count(requested)} rows; the limit is ${count(maximum)}. Read fewer rows per call, through an index or a LIMIT, or split the work across calls or workflow steps.`,
+  rowsReturned: (maximum, requested) => `This invocation returned ${count(requested)} rows; the limit is ${count(maximum)}. collect() fails rather than truncating. Page with paginate() across calls or workflow steps.`,
+  pageSize: (maximum, requested) => `One call asked for ${count(requested)} rows; take(n) and paginate({ numItems }) accept at most ${count(maximum)}. Page with paginate() across calls or workflow steps.`,
+  bytesRead: (maximum, requested) => `This invocation read ${count(requested)} bytes; the limit is ${count(maximum)}. Read fewer or smaller rows per call, or page with paginate() across calls or workflow steps.`,
+  writes: (maximum, requested) => `This invocation wrote ${count(requested)} rows; the limit is ${count(maximum)}. Split large ingests into batches, one batch per mutation or workflow step.`,
+  valueBytes: (maximum, requested) => `A row encodes to ${count(requested)} bytes; each row may use at most ${count(maximum)}. Store large content outside the row or split it across rows.`
+};
+var DatabaseLimitExceeded = class extends Schema_exports.TaggedError()(
+  "DatabaseLimitExceeded",
+  {
+    limit: DatabaseLimit,
+    maximum: Schema_exports.Int,
+    requested: Schema_exports.Int
+  }
+) {
+  get message() {
+    return limitMessages[this.limit](this.maximum, this.requested);
+  }
+};
+var reservedFieldNames = ["id", "createdAt", "updatedAt"];
+var DatabaseFieldReserved = class extends Schema_exports.TaggedError()(
+  "DatabaseFieldReserved",
+  {
+    table: Schema_exports.String,
+    field: Schema_exports.Literals(reservedFieldNames)
+  }
+) {
+  get message() {
+    return `Table "${this.table}" declares "${this.field}", which is reserved: the host adds id, createdAt and updatedAt to every row. Rename the field, or use the row's own ${this.field}.`;
+  }
+};
+var DatabaseRuntimeLimits = Schema_exports.Struct({
+  maxCursorChars: Schema_exports.Int.check(Schema_exports.isGreaterThan(0)),
+  connectionCacheCapacity: Schema_exports.Int.check(Schema_exports.isGreaterThan(0)),
+  connectionCacheTtlMs: Schema_exports.Int.check(Schema_exports.isGreaterThan(0))
+});
+var defaultDatabaseRuntimeLimits = DatabaseRuntimeLimits.make({
+  maxCursorChars: 8192,
+  connectionCacheCapacity: 64,
+  connectionCacheTtlMs: 5 * 60 * 1e3
+});
+
+// src/contracts/sql.ts
+var reservedTablePrefix = "_executor_";
+var migrationsDirectory = "migrations";
+
+// ../../node_modules/.bun/effect@4.0.1/node_modules/effect/dist/rpc/RpcSchema.js
 var StreamSchemaTypeId = "~effect/rpc/RpcSchema/StreamSchema";
 var schema = /* @__PURE__ */ declare(isStream);
 function Stream(success, error) {
@@ -322,7 +464,7 @@ function Stream(success, error) {
   });
 }
 
-// ../../node_modules/.bun/effect@https+++pkg.pr.new+Effect-TS+effect+effect@c7d1ffff31a3e2ae0b0b+a654a55b752bdb24/node_modules/effect/dist/unstable/rpc/Rpc.js
+// ../../node_modules/.bun/effect@4.0.1/node_modules/effect/dist/rpc/Rpc.js
 var TypeId = "~effect/rpc/Rpc";
 var Proto = {
   [TypeId]: TypeId,
@@ -440,7 +582,7 @@ var make2 = (tag2, options) => {
   });
 };
 
-// ../../node_modules/.bun/effect@https+++pkg.pr.new+Effect-TS+effect+effect@c7d1ffff31a3e2ae0b0b+a654a55b752bdb24/node_modules/effect/dist/unstable/ai/McpSchema.js
+// ../../node_modules/.bun/effect@4.0.1/node_modules/effect/dist/ai/McpSchema.js
 var optionalWithDefault = (schema2, defaultValue) => {
   const effect = sync(defaultValue);
   return optionalKey(schema2).pipe(decode({
@@ -448,7 +590,7 @@ var optionalWithDefault = (schema2, defaultValue) => {
     encode: passthrough()
   }), withConstructorDefault(effect));
 };
-var optional2 = (schema2) => optionalKey(schema2).pipe(decodeTo(optional(schema2), {
+var optional2 = (schema2) => optionalKey(schema2).pipe(decodeTo(toType(optional(schema2)), {
   decode: passthrough(),
   encode: transformOptional(flatMap(fromUndefinedOr))
 }));
@@ -710,7 +852,7 @@ var InternalError = class _InternalError extends (/* @__PURE__ */ Error2("effect
     message: "Not implemented"
   });
 };
-var McpError2 = /* @__PURE__ */ Union([ParseError, InvalidRequest, MethodNotFound, InvalidParams, InternalError, McpErrorBase]);
+var McpError = /* @__PURE__ */ Union([ParseError, InvalidRequest, MethodNotFound, InvalidParams, InternalError, McpErrorBase]);
 var InitializeResult = class extends (/* @__PURE__ */ Opaque()(/* @__PURE__ */ Struct({
   ...ResultMeta.fields,
   /**
@@ -733,7 +875,7 @@ var InitializeResult = class extends (/* @__PURE__ */ Opaque()(/* @__PURE__ */ S
 };
 var Initialize = class extends (/* @__PURE__ */ make2("initialize", {
   success: InitializeResult,
-  error: McpError2,
+  error: McpError,
   payload: {
     ...RequestMeta.fields,
     /**
@@ -932,7 +1074,7 @@ var ReadResourceResult = class extends (/* @__PURE__ */ Opaque()(/* @__PURE__ */
 };
 var ReadResource = class extends (/* @__PURE__ */ make2("resources/read", {
   success: ReadResourceResult,
-  error: McpError2,
+  error: McpError,
   payload: {
     ...RequestMeta.fields,
     /**
@@ -945,7 +1087,7 @@ var ReadResource = class extends (/* @__PURE__ */ make2("resources/read", {
 };
 var Subscribe = class extends (/* @__PURE__ */ make2("resources/subscribe", {
   success: /* @__PURE__ */ Struct({}),
-  error: McpError2,
+  error: McpError,
   payload: {
     ...RequestMeta.fields,
     /**
@@ -958,7 +1100,7 @@ var Subscribe = class extends (/* @__PURE__ */ make2("resources/subscribe", {
 };
 var Unsubscribe = class extends (/* @__PURE__ */ make2("resources/unsubscribe", {
   success: /* @__PURE__ */ Struct({}),
-  error: McpError2,
+  error: McpError,
   payload: {
     ...RequestMeta.fields,
     /**
@@ -1102,7 +1244,7 @@ var GetPromptResult = class extends (/* @__PURE__ */ Class("@effect/ai/McpSchema
 };
 var GetPrompt = class extends (/* @__PURE__ */ make2("prompts/get", {
   success: GetPromptResult,
-  error: McpError2,
+  error: McpError,
   payload: {
     ...RequestMeta.fields,
     /**
@@ -1117,7 +1259,7 @@ var GetPrompt = class extends (/* @__PURE__ */ make2("prompts/get", {
   }
 })) {
 };
-var ToolAnnotations2 = class extends (/* @__PURE__ */ Opaque()(/* @__PURE__ */ Struct({
+var ToolAnnotations = class extends (/* @__PURE__ */ Opaque()(/* @__PURE__ */ Struct({
   /**
    * A human-readable title for the tool.
    */
@@ -1186,7 +1328,7 @@ var Tool = class extends (/* @__PURE__ */ Class("@effect/ai/McpSchema/Tool")({
   /**
    * Optional additional tool information.
    */
-  annotations: /* @__PURE__ */ optional2(ToolAnnotations2),
+  annotations: /* @__PURE__ */ optional2(ToolAnnotations),
   /**
    * Icons that clients can display for this tool.
    */
@@ -1222,7 +1364,7 @@ var CallToolResult = class extends (/* @__PURE__ */ Class("@effect/ai/McpSchema/
 };
 var CallTool = class extends (/* @__PURE__ */ make2("tools/call", {
   success: CallToolResult,
-  error: McpError2,
+  error: McpError,
   payload: {
     ...RequestMeta.fields,
     name: String,
@@ -1242,7 +1384,7 @@ var SetLevel = class extends (/* @__PURE__ */ make2("logging/setLevel", {
     level: LoggingLevel
   },
   success: /* @__PURE__ */ Struct({}),
-  error: McpError2
+  error: McpError
 })) {
 };
 var LoggingMessageNotification = class extends (/* @__PURE__ */ make2("notifications/message", {
@@ -1388,7 +1530,7 @@ var CreateMessageResult = class extends (/* @__PURE__ */ Class("@effect/ai/McpSc
 };
 var CreateMessage = class extends (/* @__PURE__ */ make2("sampling/createMessage", {
   success: CreateMessageResult,
-  error: McpError2,
+  error: McpError,
   payload: {
     messages: /* @__PURE__ */ ArraySchema(SamplingMessage),
     /**
@@ -1451,6 +1593,7 @@ var CompleteResult = class _CompleteResult extends (/* @__PURE__ */ Opaque()(/*
   /**
    * Empty completion result used when a completion request has no values.
    *
+   * @stability unstable
    * @since 4.0.0
    */
   static empty = /* @__PURE__ */ _CompleteResult.make({
@@ -1599,7 +1742,7 @@ var ElicitDeclineResult = class extends (/* @__PURE__ */ Class("@effect/ai/McpSc
 var ElicitResult = /* @__PURE__ */ Union([ElicitAcceptResult, ElicitDeclineResult]);
 var Elicit = class extends (/* @__PURE__ */ make2("elicitation/create", {
   success: ElicitResult,
-  error: McpError2,
+  error: McpError,
   payload: ElicitRequestParams
 })) {
 };
@@ -1665,6 +1808,126 @@ ${JSON.stringify(input, null, 2)}`,
   requestedSchema: { type: "object", properties: {} }
 });
 
+// src/contracts/router.ts
+var reservedRouterKeys = /* @__PURE__ */ new Set([
+  "__proto__",
+  "constructor",
+  "prototype"
+]);
+var RouterKey = Schema_exports.String.check(
+  Schema_exports.isPattern(/^[A-Za-z_][A-Za-z0-9_-]{0,99}$/u),
+  Schema_exports.makeFilter((key) => !reservedRouterKeys.has(key))
+);
+var RouterIcon = Schema_exports.Struct({
+  src: Schema_exports.NonEmptyString,
+  mimeType: Schema_exports.optionalKey(Schema_exports.String),
+  sizes: Schema_exports.optionalKey(Schema_exports.Array(Schema_exports.String)),
+  theme: Schema_exports.optionalKey(Schema_exports.Literals(["light", "dark"]))
+});
+var RouterMeta = Schema_exports.Struct({
+  title: Schema_exports.optionalKey(Schema_exports.String),
+  description: Schema_exports.optionalKey(Schema_exports.String),
+  instructions: Schema_exports.optionalKey(Schema_exports.String),
+  icons: Schema_exports.optionalKey(Schema_exports.Array(RouterIcon)),
+  tags: Schema_exports.optionalKey(Schema_exports.Record(Schema_exports.NonEmptyString, Schema_exports.String))
+});
+
+// src/contracts/tools.ts
+var ToolAnnotations2 = Schema_exports.Struct({
+  title: Schema_exports.optionalKey(Schema_exports.String),
+  readOnlyHint: Schema_exports.optionalKey(Schema_exports.Boolean),
+  destructiveHint: Schema_exports.optionalKey(Schema_exports.Boolean),
+  idempotentHint: Schema_exports.optionalKey(Schema_exports.Boolean),
+  openWorldHint: Schema_exports.optionalKey(Schema_exports.Boolean)
+});
+
+// src/contracts/mcp.ts
+var McpClientLimits = Schema_exports.Struct({
+  timeoutMs: Schema_exports.Int.check(Schema_exports.isGreaterThan(0)),
+  maxTimeoutMs: Schema_exports.Int.check(Schema_exports.isGreaterThan(0)),
+  maxTools: Schema_exports.Int.check(Schema_exports.isGreaterThan(0)),
+  maxPaginationCursors: Schema_exports.Int.check(Schema_exports.isGreaterThan(0)),
+  cleanupTimeoutMs: Schema_exports.Int.check(Schema_exports.isGreaterThan(0))
+});
+var defaultMcpClientLimits = McpClientLimits.make({
+  timeoutMs: 3e4,
+  maxTimeoutMs: 3e5,
+  maxTools: 5e4,
+  maxPaginationCursors: 1e3,
+  cleanupTimeoutMs: 1e3
+});
+var mcpSdkTimerCeilingMs = 2147483647;
+var McpToolsOptions = Schema_exports.Struct({
+  url: HttpUrl,
+  accountId: Schema_exports.optional(AccountId),
+  headers: Schema_exports.optional(Schema_exports.Record(Schema_exports.String, Schema_exports.String)),
+  signal: Schema_exports.optional(Schema_exports.instanceOf(AbortSignal)),
+  timeoutMs: Schema_exports.optional(
+    Schema_exports.Number.check(
+      Schema_exports.isInt(),
+      Schema_exports.isBetween({ minimum: 1, maximum: defaultMcpClientLimits.maxTimeoutMs })
+    )
+  )
+});
+var McpHealthInput = Schema_exports.Struct({
+  ...McpToolsOptions.fields,
+  headers: Schema_exports.Record(Schema_exports.String, Schema_exports.String),
+  deadline: Schema_exports.optional(Schema_exports.Finite)
+});
+var mcpHealthReserveMs = 2 * defaultMcpClientLimits.cleanupTimeoutMs + 250;
+var McpToolResult = Schema_exports.Struct({
+  content: Schema_exports.Array(JsonObject2),
+  structuredContent: Schema_exports.optionalKey(JsonObject2),
+  isError: Schema_exports.optionalKey(Schema_exports.Boolean),
+  _meta: Schema_exports.optionalKey(JsonObject2)
+});
+var McpToolMetadata = Schema_exports.Struct({
+  name: Schema_exports.String,
+  title: Schema_exports.optional(Schema_exports.String),
+  description: Schema_exports.optional(Schema_exports.String),
+  inputSchema: JsonObject2,
+  outputSchema: Schema_exports.optional(JsonObject2),
+  annotations: Schema_exports.optional(ToolAnnotations2),
+  _meta: Schema_exports.optional(JsonObject2)
+});
+var McpServerHeader = Schema_exports.Struct({
+  name: Schema_exports.optionalKey(Schema_exports.String),
+  title: Schema_exports.optionalKey(Schema_exports.String),
+  version: Schema_exports.optionalKey(Schema_exports.String),
+  description: Schema_exports.optionalKey(Schema_exports.String),
+  websiteUrl: Schema_exports.optionalKey(Schema_exports.String),
+  icons: Schema_exports.optionalKey(Schema_exports.Array(RouterIcon)),
+  instructions: Schema_exports.optionalKey(Schema_exports.String)
+});
+var McpError2 = class extends Schema_exports.TaggedError()("McpError", {
+  phase: Schema_exports.Literals(["connect", "discover", "call", "schema", "transport"]),
+  reason: Schema_exports.Literals([
+    "request",
+    "unauthorized",
+    "invalid_response",
+    "timeout",
+    "invalid_input"
+  ]),
+  status: Schema_exports.optional(Schema_exports.Number),
+  upstream: Schema_exports.optional(UpstreamError),
+  session: Schema_exports.optional(Schema_exports.Literal(true))
+}) {
+};
+var McpCredentialsUnverified = class extends Schema_exports.TaggedError()(
+  "McpCredentialsUnverified",
+  { anonymous: Schema_exports.Union([Schema_exports.Literal("answered"), McpError2, ProviderError]) }
+) {
+};
+var ProcessConfig = Schema_exports.Struct({
+  command: Schema_exports.NonEmptyString,
+  args: Schema_exports.Array(Schema_exports.String),
+  cwd: Schema_exports.optional(Schema_exports.String),
+  env: Schema_exports.Record(Schema_exports.String, Schema_exports.String),
+  timeoutMs: Schema_exports.Int.check(
+    Schema_exports.isBetween({ minimum: 1, maximum: defaultMcpClientLimits.maxTimeoutMs })
+  )
+});
+
 // src/contracts/webhook-protocol.ts
 var WebhookTransportLimits = Schema_exports.Struct({
   maxBodyBytes: Schema_exports.Int.check(Schema_exports.isGreaterThan(0))
@@ -1736,7 +1999,7 @@ var OAuthSecretClientAuth = Schema_exports.Literals([
   "client_secret_basic",
   "client_secret_basic_raw"
 ]);
-var reservedAuthorizationParams = /* @__PURE__ */ new Set([
+var reservedAuthorizationParams = [
   "response_type",
   "client_id",
   "redirect_uri",
@@ -1748,17 +2011,55 @@ var reservedAuthorizationParams = /* @__PURE__ */ new Set([
   "resource",
   "request",
   "request_uri"
-]);
+];
+var reserved = new Set(reservedAuthorizationParams);
 var OAuthAuthorizationParams = Schema_exports.Record(Schema_exports.String, Schema_exports.String).check(
-  Schema_exports.makeFilter(
-    (params) => Object.keys(params).every((key) => !reservedAuthorizationParams.has(key)),
-    {
-      message: "Authorization parameters cannot replace protocol parameters such as state or scope."
-    }
-  )
+  Schema_exports.makeFilter((params) => Object.keys(params).every((key) => !reserved.has(key)), {
+    message: "Authorization parameters cannot replace protocol parameters such as state or scope."
+  })
+);
+var declaredAuthorizationQuery = Schema_exports.makeFilter(
+  (config) => {
+    const keys = [...new URL(config.authorizationUrl).searchParams.keys()];
+    const owned = keys.filter((key) => reserved.has(key));
+    if (owned.length > 0)
+      return {
+        path: ["authorizationUrl"],
+        issue: `authorizationUrl cannot set protocol parameters: ${owned.join(", ")}.`
+      };
+    const repeated = keys.filter((key) => Object.hasOwn(config.authorizationParams ?? {}, key));
+    if (repeated.length > 0)
+      return {
+        path: ["authorizationParams"],
+        issue: `Declare each parameter once; authorizationUrl already sets: ${repeated.join(", ")}.`
+      };
+    return void 0;
+  }
 );
+var OAuthTokenRequestFormat = Schema_exports.Literals(["form", "json"]);
+var OAuthTokenResponse = Schema_exports.Struct({
+  path: Schema_exports.String.check(Schema_exports.isPattern(/^[^.]+(\.[^.]+)*$/))
+});
+var tokenRequestOptions = {
+  /** Joins requested scopes; Linear wants `","`. Defaults to RFC 6749's space. */
+  scopeSeparator: Schema_exports.optionalKey(Schema_exports.String.check(Schema_exports.isMinLength(1))),
+  /** Encoding of token requests. Defaults to `"form"`; Atlassian, ClickUp and Notion need `"json"`. */
+  tokenRequestFormat: Schema_exports.optionalKey(OAuthTokenRequestFormat)
+};
 var oauthOptions = {
+  ...tokenRequestOptions,
+  /**
+   * Read the grant from this nested member of the token response when the top-level response has
+   * no access token or no scope. Slack's user tokens use `{ path: "authed_user" }`.
+   */
+  tokenResponse: Schema_exports.optionalKey(OAuthTokenResponse),
   grant: Schema_exports.optionalKey(Schema_exports.Literal("authorization_code")),
+  /**
+   * Service-defined authorization request parameters, such as Google's
+   * `{ access_type: "offline", prompt: "consent" }`. Host-owned protocol parameters
+   * (`state`, `scope`, `redirect_uri`, PKCE and the others in `reservedAuthorizationParams`)
+   * are rejected. A discovered endpoint's own query parameter of the same name is replaced.
+   */
   authorizationParams: Schema_exports.optionalKey(OAuthAuthorizationParams),
   tokenEndpointAuthMethod: Schema_exports.optionalKey(OAuthClientAuth),
   /** Omitted uses discovery; null explicitly suppresses the resource parameter. */
@@ -1768,6 +2069,8 @@ var OAuth2Config = Schema_exports.Union([
   Schema_exports.Struct({
     ...oauthOptions,
     discover: HttpUrl,
+    /** Fetch this exact metadata document and verify its issuer against discovery. */
+    authorizationServerMetadataUrl: Schema_exports.optionalKey(HttpUrl),
     authorizationUrl: Schema_exports.optionalKey(Schema_exports.Never),
     tokenUrl: Schema_exports.optionalKey(Schema_exports.Never),
     revocationUrl: Schema_exports.optionalKey(Schema_exports.Never),
@@ -1775,21 +2078,26 @@ var OAuth2Config = Schema_exports.Union([
   }),
   Schema_exports.Struct({
     ...oauthOptions,
+    /** Its query is kept; it cannot set protocol parameters or repeat `authorizationParams`. */
     authorizationUrl: HttpUrl,
     tokenUrl: HttpUrl,
     revocationUrl: Schema_exports.optionalKey(HttpUrl),
     scopes: Schema_exports.Array(Schema_exports.String),
     /** RFC 8414 issuer identifier. Declared issuers are checked against the callback's `iss`. */
     issuer: Schema_exports.optionalKey(HttpUrl),
-    discover: Schema_exports.optionalKey(Schema_exports.Never)
-  }),
+    discover: Schema_exports.optionalKey(Schema_exports.Never),
+    authorizationServerMetadataUrl: Schema_exports.optionalKey(Schema_exports.Never)
+  }).check(declaredAuthorizationQuery),
   Schema_exports.Struct({
     grant: Schema_exports.Literal("client_credentials"),
     discover: HttpUrl,
+    /** Fetch this exact metadata document and verify its issuer against discovery. */
+    authorizationServerMetadataUrl: Schema_exports.optionalKey(HttpUrl),
     authorizationUrl: Schema_exports.optionalKey(Schema_exports.Never),
     tokenUrl: Schema_exports.optionalKey(Schema_exports.Never),
     revocationUrl: Schema_exports.optionalKey(Schema_exports.Never),
     scopes: Schema_exports.optionalKey(Schema_exports.Array(Schema_exports.String)),
+    ...tokenRequestOptions,
     tokenEndpointAuthMethod: OAuthSecretClientAuth,
     resource: Schema_exports.optionalKey(Schema_exports.NullOr(HttpUrl))
   }),
@@ -1798,10 +2106,12 @@ var OAuth2Config = Schema_exports.Union([
     tokenUrl: HttpUrl,
     revocationUrl: Schema_exports.optionalKey(HttpUrl),
     scopes: Schema_exports.Array(Schema_exports.String),
+    ...tokenRequestOptions,
     tokenEndpointAuthMethod: OAuthSecretClientAuth,
     resource: Schema_exports.optionalKey(Schema_exports.NullOr(HttpUrl)),
     authorizationUrl: Schema_exports.optionalKey(Schema_exports.Never),
-    discover: Schema_exports.optionalKey(Schema_exports.Never)
+    discover: Schema_exports.optionalKey(Schema_exports.Never),
+    authorizationServerMetadataUrl: Schema_exports.optionalKey(Schema_exports.Never)
   })
 ]);
 var OAuth2AccessToken = Schema_exports.Struct({ access_token: Schema_exports.String });
@@ -1809,6 +2119,16 @@ var OAuth2Method = class extends Data_exports.TaggedClass(
   "oauth2"
 ) {
 };
+var displayText = Schema_exports.String.check(Schema_exports.isMinLength(1), Schema_exports.isMaxLength(255));
+var AccountInfo = Schema_exports.Struct({
+  externalId: Schema_exports.optionalKey(displayText),
+  displayName: Schema_exports.optionalKey(displayText),
+  username: Schema_exports.optionalKey(displayText),
+  email: Schema_exports.optionalKey(displayText),
+  avatarUrl: Schema_exports.optionalKey(HttpUrl),
+  profileUrl: Schema_exports.optionalKey(HttpUrl)
+});
+var AccountCheckResult = Schema_exports.Struct({ accountInfo: Schema_exports.optionalKey(AccountInfo) });
 var Provider = class extends Data_exports.Class {
   /** Declare zero or more accounts from this provider without performing I/O. */
   many() {
@@ -1819,64 +2139,239 @@ var ManyAccounts = class extends Data_exports.TaggedClass("many") {
 };
 
 // src/contracts/protocol-version.ts
-var frameworkProtocol = 2;
+var frameworkProtocol = 10;
 
-// src/contracts/schedules.ts
-var minimumIntervalMilliseconds = 6e4;
-var count = Schema_exports.Int.check(Schema_exports.isGreaterThan(0));
-var absent = Schema_exports.optionalKey(Schema_exports.Never);
-var Interval = Schema_exports.Union([
-  Schema_exports.Struct({ seconds: count, minutes: absent, hours: absent }),
-  Schema_exports.Struct({ seconds: absent, minutes: count, hours: absent }),
-  Schema_exports.Struct({ seconds: absent, minutes: absent, hours: count })
+// src/contracts/protocols/oauth.ts
+var OAuthClientAuth2 = Schema_exports.Literals([
+  "none",
+  "client_secret_post",
+  "client_secret_basic",
+  "client_secret_basic_raw"
 ]);
-var CalendarSchedule = Schema_exports.Struct({
-  expression: Schema_exports.NonEmptyString,
-  timezone: Schema_exports.NonEmptyString
-}).check(
-  Schema_exports.makeFilter(
-    (value) => value.expression.trim().split(/\s+/).length === 5 && Result_exports.isSuccess(Cron_exports.parse(value.expression, value.timezone))
-  )
-);
-var ScheduleTiming = Schema_exports.Union([
-  Schema_exports.Struct({
-    kind: Schema_exports.Literal("interval"),
-    milliseconds: Schema_exports.Int.check(
-      Schema_exports.makeFilter((value) => value >= minimumIntervalMilliseconds, {
-        message: "Schedule intervals must be at least 60 seconds"
-      }),
-      Schema_exports.isLessThanOrEqualTo(Number.MAX_SAFE_INTEGER)
-    )
-  }),
-  Schema_exports.Struct({ kind: Schema_exports.Literal("cron"), calendar: CalendarSchedule })
+var OAuthSecretClientAuth2 = Schema_exports.Literals([
+  "client_secret_post",
+  "client_secret_basic",
+  "client_secret_basic_raw"
 ]);
-var OperationSchedule = Schema_exports.Struct({
-  name: Schema_exports.NonEmptyString,
-  timing: ScheduleTiming,
-  input: JsonValue
+var reservedAuthorizationParams2 = [
+  "response_type",
+  "client_id",
+  "redirect_uri",
+  "state",
+  "scope",
+  "code_challenge",
+  "code_challenge_method",
+  "nonce",
+  "resource",
+  "request",
+  "request_uri"
+];
+var reserved2 = new Set(reservedAuthorizationParams2);
+var OAuthAuthorizationParams2 = Schema_exports.Record(Schema_exports.String, Schema_exports.String).check(
+  Schema_exports.makeFilter((params) => Object.keys(params).every((key) => !reserved2.has(key)), {
+    message: "Authorization parameters cannot replace protocol parameters such as state or scope."
+  })
+);
+var declaredAuthorizationQuery2 = Schema_exports.makeFilter(
+  (config) => {
+    const keys = [...new URL(config.authorizationUrl).searchParams.keys()];
+    const owned = keys.filter((key) => reserved2.has(key));
+    if (owned.length > 0)
+      return {
+        path: ["authorizationUrl"],
+        issue: `authorizationUrl cannot set protocol parameters: ${owned.join(", ")}.`
+      };
+    const repeated = keys.filter((key) => Object.hasOwn(config.authorizationParams ?? {}, key));
+    if (repeated.length > 0)
+      return {
+        path: ["authorizationParams"],
+        issue: `Declare each parameter once; authorizationUrl already sets: ${repeated.join(", ")}.`
+      };
+    return void 0;
+  }
+);
+var OAuthTokenRequestFormat2 = Schema_exports.Literals(["form", "json"]);
+var OAuthTokenResponse2 = Schema_exports.Struct({
+  path: Schema_exports.String.check(Schema_exports.isPattern(/^[^.]+(\.[^.]+)*$/))
+});
+var tokenRequestOptions2 = {
+  /** Joins requested scopes; Linear wants `","`. Defaults to RFC 6749's space. */
+  scopeSeparator: Schema_exports.optionalKey(Schema_exports.String.check(Schema_exports.isMinLength(1))),
+  /** Encoding of token requests. Defaults to `"form"`; Atlassian, ClickUp and Notion need `"json"`. */
+  tokenRequestFormat: Schema_exports.optionalKey(OAuthTokenRequestFormat2)
+};
+var oauthOptions2 = {
+  ...tokenRequestOptions2,
+  /**
+   * Read the grant from this nested member of the token response when the top-level response has
+   * no access token or no scope. Slack's user tokens use `{ path: "authed_user" }`.
+   */
+  tokenResponse: Schema_exports.optionalKey(OAuthTokenResponse2),
+  grant: Schema_exports.optionalKey(Schema_exports.Literal("authorization_code")),
+  /**
+   * Service-defined authorization request parameters, such as Google's
+   * `{ access_type: "offline", prompt: "consent" }`. Host-owned protocol parameters
+   * (`state`, `scope`, `redirect_uri`, PKCE and the others in `reservedAuthorizationParams`)
+   * are rejected. A discovered endpoint's own query parameter of the same name is replaced.
+   */
+  authorizationParams: Schema_exports.optionalKey(OAuthAuthorizationParams2),
+  tokenEndpointAuthMethod: Schema_exports.optionalKey(OAuthClientAuth2),
+  /** Omitted uses discovery; null explicitly suppresses the resource parameter. */
+  resource: Schema_exports.optionalKey(Schema_exports.NullOr(HttpUrl))
+};
+var OAuth2Config2 = Schema_exports.Union([
+  Schema_exports.Struct({
+    ...oauthOptions2,
+    discover: HttpUrl,
+    authorizationUrl: Schema_exports.optionalKey(Schema_exports.Never),
+    tokenUrl: Schema_exports.optionalKey(Schema_exports.Never),
+    revocationUrl: Schema_exports.optionalKey(Schema_exports.Never),
+    scopes: Schema_exports.optionalKey(Schema_exports.Array(Schema_exports.String))
+  }),
+  Schema_exports.Struct({
+    ...oauthOptions2,
+    /** Its query is kept; it cannot set protocol parameters or repeat `authorizationParams`. */
+    authorizationUrl: HttpUrl,
+    tokenUrl: HttpUrl,
+    revocationUrl: Schema_exports.optionalKey(HttpUrl),
+    scopes: Schema_exports.Array(Schema_exports.String),
+    /** RFC 8414 issuer identifier. Declared issuers are checked against the callback's `iss`. */
+    issuer: Schema_exports.optionalKey(HttpUrl),
+    discover: Schema_exports.optionalKey(Schema_exports.Never)
+  }).check(declaredAuthorizationQuery2),
+  Schema_exports.Struct({
+    grant: Schema_exports.Literal("client_credentials"),
+    discover: HttpUrl,
+    authorizationUrl: Schema_exports.optionalKey(Schema_exports.Never),
+    tokenUrl: Schema_exports.optionalKey(Schema_exports.Never),
+    revocationUrl: Schema_exports.optionalKey(Schema_exports.Never),
+    scopes: Schema_exports.optionalKey(Schema_exports.Array(Schema_exports.String)),
+    ...tokenRequestOptions2,
+    tokenEndpointAuthMethod: OAuthSecretClientAuth2,
+    resource: Schema_exports.optionalKey(Schema_exports.NullOr(HttpUrl))
+  }),
+  Schema_exports.Struct({
+    grant: Schema_exports.Literal("client_credentials"),
+    tokenUrl: HttpUrl,
+    revocationUrl: Schema_exports.optionalKey(HttpUrl),
+    scopes: Schema_exports.Array(Schema_exports.String),
+    ...tokenRequestOptions2,
+    tokenEndpointAuthMethod: OAuthSecretClientAuth2,
+    resource: Schema_exports.optionalKey(Schema_exports.NullOr(HttpUrl)),
+    authorizationUrl: Schema_exports.optionalKey(Schema_exports.Never),
+    discover: Schema_exports.optionalKey(Schema_exports.Never)
+  })
+]);
+
+// src/contracts/schedules.ts
+var minimumIntervalMilliseconds = 6e4;
+var count2 = Schema_exports.Int.check(Schema_exports.isGreaterThan(0));
+var absent = Schema_exports.optionalKey(Schema_exports.Never);
+var Interval = Schema_exports.Union([
+  Schema_exports.Struct({ seconds: count2, minutes: absent, hours: absent }),
+  Schema_exports.Struct({ seconds: absent, minutes: count2, hours: absent }),
+  Schema_exports.Struct({ seconds: absent, minutes: absent, hours: count2 })
+]);
+var CalendarSchedule = Schema_exports.Struct({
+  expression: Schema_exports.NonEmptyString,
+  timezone: Schema_exports.NonEmptyString
+}).check(
+  Schema_exports.makeFilter(
+    (value) => value.expression.trim().split(/\s+/).length === 5 && Result_exports.isSuccess(Cron_exports.parse(value.expression, value.timezone))
+  )
+);
+var ScheduleTiming = Schema_exports.Union([
+  Schema_exports.Struct({
+    kind: Schema_exports.Literal("interval"),
+    milliseconds: Schema_exports.Int.check(
+      Schema_exports.makeFilter((value) => value >= minimumIntervalMilliseconds, {
+        message: "Schedule intervals must be at least 60 seconds"
+      }),
+      Schema_exports.isLessThanOrEqualTo(Number.MAX_SAFE_INTEGER)
+    )
+  }),
+  Schema_exports.Struct({ kind: Schema_exports.Literal("cron"), calendar: CalendarSchedule })
+]);
+var OperationSchedule = Schema_exports.Struct({
+  name: Schema_exports.NonEmptyString,
+  timing: ScheduleTiming,
+  input: JsonValue
 });
 
 // src/contracts/protocols/1.ts
+var ProviderError2 = class extends Schema_exports.TaggedError()("ProviderError", {
+  reason: Schema_exports.Literals(["unauthorized", "forbidden", "rate_limited", "unavailable", "rejected"]),
+  status: Schema_exports.optional(Schema_exports.Int.check(Schema_exports.isBetween({ minimum: 100, maximum: 599 }))),
+  accountId: Schema_exports.optional(AccountId)
+}) {
+};
+var McpError3 = class extends Schema_exports.TaggedError()("McpError", {
+  phase: Schema_exports.Literals(["connect", "discover", "call", "schema", "transport"]),
+  reason: Schema_exports.Literals([
+    "request",
+    "unauthorized",
+    "invalid_response",
+    "timeout",
+    "invalid_input"
+  ]),
+  status: Schema_exports.optional(Schema_exports.Number)
+}) {
+};
+var SkillLoadFailed = class extends Schema_exports.TaggedError()("SkillLoadFailed", {
+  reason: Schema_exports.Literals([
+    "source",
+    "request",
+    "rate_limited",
+    "document",
+    "limit",
+    "changed",
+    "encoding"
+  ]),
+  message: Schema_exports.optional(Schema_exports.String.check(Schema_exports.isMaxLength(500))),
+  status: Schema_exports.optional(Schema_exports.Int.check(Schema_exports.isBetween({ minimum: 100, maximum: 599 })))
+}) {
+};
+var WorkflowFailure2 = class extends Schema_exports.TaggedError()("WorkflowFailure", {
+  reason: Schema_exports.Literals([
+    "unavailable",
+    "not_found",
+    "input",
+    "output",
+    "operation",
+    "approval",
+    "credentials",
+    "terminated",
+    "execution",
+    "conflict",
+    "engine"
+  ]),
+  retryable: Schema_exports.Boolean
+}) {
+};
+var WorkflowRpcResult2 = Schema_exports.Union([
+  Schema_exports.Struct({ ok: Schema_exports.Literal(true), value: JsonValue }),
+  Schema_exports.Struct({ ok: Schema_exports.Literal(false), error: WorkflowFailure2 })
+]);
 var DeclaredAuthMethod = Schema_exports.Union([
   Schema_exports.Struct({ type: Schema_exports.Literal("secrets"), label: Schema_exports.String, fields: JsonObject2 }),
   Schema_exports.Struct({
     type: Schema_exports.Literal("oauth2"),
-    ...OAuth2Config.members[0].fields,
+    ...OAuth2Config2.members[0].fields,
     response: JsonObject2
   }),
   Schema_exports.Struct({
     type: Schema_exports.Literal("oauth2"),
-    ...OAuth2Config.members[1].fields,
+    ...OAuth2Config2.members[1].fields,
     response: JsonObject2
   }),
   Schema_exports.Struct({
     type: Schema_exports.Literal("oauth2"),
-    ...OAuth2Config.members[2].fields,
+    ...OAuth2Config2.members[2].fields,
     response: JsonObject2
   }),
   Schema_exports.Struct({
     type: Schema_exports.Literal("oauth2"),
-    ...OAuth2Config.members[3].fields,
+    ...OAuth2Config2.members[3].fields,
     response: JsonObject2
   })
 ]);
@@ -1931,7 +2426,7 @@ var HostedTool = Schema_exports.Struct({
   readOnly: Schema_exports.optionalKey(Schema_exports.Boolean),
   title: Schema_exports.optionalKey(Schema_exports.String),
   outputSchema: Schema_exports.optionalKey(JsonObject2),
-  annotations: Schema_exports.optionalKey(ToolAnnotations),
+  annotations: Schema_exports.optionalKey(ToolAnnotations2),
   _meta: Schema_exports.optionalKey(JsonObject2)
 });
 var HostedToolSummary = HostedTool.mapFields(
@@ -2038,10 +2533,10 @@ var HostOutputInvalid = class extends Schema_exports.TaggedError()(
 };
 var HostError = Schema_exports.Union([
   OpenapiResponseError,
-  ProviderError,
-  McpError,
+  ProviderError2,
+  McpError3,
   SkillLoadFailed,
-  WorkflowFailure,
+  WorkflowFailure2,
   HostRequestInvalid,
   HostAccountsInvalid,
   HostDeclarationInvalid,
@@ -2085,7 +2580,7 @@ var protocol1 = {
     elicitationRequest: FormElicitation,
     elicitationReply: ElicitationReply,
     workflowStep: WorkflowRpcCommand,
-    workflowStepReply: WorkflowRpcResult,
+    workflowStepReply: WorkflowRpcResult2,
     workflowControl: WorkflowControlCommand,
     cacheCommand: CacheCommand,
     cacheReply: CacheReply
@@ -2104,8 +2599,603 @@ var protocol2 = {
   schemas: { ...protocol1.schemas, skills: SkillCatalogResponse2 }
 };
 
-// src/contracts/operations.ts
-var OperationToolPrefixes = { query: "queries.", mutate: "mutations." };
+// src/contracts/protocols/3.ts
+var FailureDetail2 = {
+  source: Schema_exports.optionalKey(FailureSource),
+  errorName: Schema_exports.optionalKey(FailureName),
+  code: Schema_exports.optionalKey(FailureCode),
+  message: Schema_exports.optionalKey(FailureMessage)
+};
+var HostDeclarationInvalid2 = class extends Schema_exports.TaggedError()(
+  "HostDeclarationInvalid",
+  FailureDetail2
+) {
+};
+var HostEvaluationFailed2 = class extends Schema_exports.TaggedError()(
+  "HostEvaluationFailed",
+  FailureDetail2
+) {
+};
+var HostOperationFailed2 = class extends Schema_exports.TaggedError()(
+  "HostOperationFailed",
+  FailureDetail2
+) {
+};
+var HostError2 = Schema_exports.Union([
+  OpenapiResponseError,
+  ProviderError2,
+  McpError3,
+  SkillLoadFailed,
+  WorkflowFailure,
+  HostRequestInvalid,
+  HostAccountsInvalid,
+  HostDeclarationInvalid2,
+  HostEvaluationFailed2,
+  HostOperationNotFound,
+  HostOperationFailed2,
+  DatabaseLimitExceeded,
+  DatabaseFieldReserved,
+  HostToolNotFound,
+  HostInputInvalid,
+  HostOutputInvalid,
+  HostToolBlocked,
+  HostToolApprovalRequired,
+  HostToolPolicyFailed,
+  ElicitationFailed
+]);
+var HostResponse2 = Schema_exports.Union([
+  Schema_exports.Struct({
+    ok: Schema_exports.Literal(true),
+    value: JsonValue,
+    toolError: Schema_exports.optionalKey(Schema_exports.Literal(true))
+  }),
+  Schema_exports.Struct({ ok: Schema_exports.Literal(false), error: HostError2 })
+]);
+var protocol3 = {
+  version: 3,
+  schemas: {
+    invocation: HostInvocation,
+    request: HostRequest,
+    response: HostResponse2,
+    requirements: DeclaredRequirements,
+    tools: Schema_exports.Array(HostedTool),
+    toolSummaries: Schema_exports.Array(HostedToolSummary),
+    skills: SkillCatalogResponse2,
+    elicitationRequest: FormElicitation,
+    elicitationReply: ElicitationReply,
+    workflowStep: WorkflowRpcCommand,
+    workflowStepReply: WorkflowRpcResult,
+    workflowControl: WorkflowControlCommand,
+    cacheCommand: CacheCommand,
+    cacheReply: CacheReply
+  }
+};
+
+// src/contracts/protocols/4.ts
+var HostedTool2 = Schema_exports.Struct({
+  schedules: Schema_exports.optionalKey(Schema_exports.Array(OperationSchedule)),
+  name: Schema_exports.NonEmptyString,
+  router: Schema_exports.optionalKey(Schema_exports.NonEmptyString),
+  tags: Schema_exports.optionalKey(Schema_exports.Array(Schema_exports.NonEmptyString)),
+  description: Schema_exports.String,
+  inputSchema: JsonObject2,
+  readOnly: Schema_exports.optionalKey(Schema_exports.Boolean),
+  title: Schema_exports.optionalKey(Schema_exports.String),
+  outputSchema: Schema_exports.optionalKey(JsonObject2),
+  annotations: Schema_exports.optionalKey(ToolAnnotations2),
+  _meta: Schema_exports.optionalKey(JsonObject2)
+});
+var HostedToolSummary2 = HostedTool2.mapFields(
+  ({ inputSchema: _input, outputSchema: _output, _meta, ...fields }) => fields
+);
+var HostRouterError = Schema_exports.Union([
+  ProviderError2,
+  McpError3,
+  SkillLoadFailed,
+  HostDeclarationInvalid2,
+  HostEvaluationFailed2
+]);
+var HostedRouter = Schema_exports.Struct({
+  path: Schema_exports.String,
+  title: Schema_exports.optionalKey(Schema_exports.String),
+  description: Schema_exports.optionalKey(Schema_exports.String),
+  icons: Schema_exports.optionalKey(Schema_exports.Array(RouterIcon)),
+  tags: Schema_exports.optionalKey(Schema_exports.Record(Schema_exports.NonEmptyString, Schema_exports.String)),
+  skill: Schema_exports.optionalKey(AppSkillName),
+  error: Schema_exports.optionalKey(HostRouterError)
+});
+var HostedCatalog = Schema_exports.Struct({
+  tools: Schema_exports.Array(HostedTool2),
+  routers: Schema_exports.Array(HostedRouter)
+});
+var HostedCatalogSummary = Schema_exports.Struct({
+  tools: Schema_exports.Array(HostedToolSummary2),
+  routers: Schema_exports.Array(HostedRouter)
+});
+var ToolKind = Schema_exports.Literals(["query", "mutation"]);
+var HostRequest2 = Schema_exports.Union([
+  WorkflowCommand,
+  WebhookCommand,
+  Schema_exports.Struct({ operation: Schema_exports.Literal("requirements") }),
+  Schema_exports.Struct({
+    operation: Schema_exports.Literal("inspect"),
+    /** Omit schemas. Only builds that declare the toolIndex capability accept this. */
+    detail: Schema_exports.optionalKey(Schema_exports.Literal("summary")),
+    /** Describe only these tools. Only builds that declare the toolIndex capability accept this. */
+    tools: Schema_exports.optionalKey(Schema_exports.Array(Schema_exports.NonEmptyString)),
+    /**
+     * Describe only declared operations that have schedules, without dynamic tool discovery.
+     * Only builds that declare the scheduledTools capability accept this.
+     */
+    scheduled: Schema_exports.optionalKey(Schema_exports.Literal(true))
+  }),
+  Schema_exports.Struct({
+    operation: Schema_exports.Literal("skills"),
+    /** Answer with SkillSources. Only builds that declare the skillSources capability accept this. */
+    sources: Schema_exports.optionalKey(Schema_exports.Literal(true))
+  }),
+  Schema_exports.Struct({
+    operation: Schema_exports.Literal("query"),
+    name: Schema_exports.NonEmptyString,
+    input: JsonValue
+  }),
+  Schema_exports.Struct({
+    operation: Schema_exports.Literal("mutate"),
+    name: Schema_exports.NonEmptyString,
+    input: JsonValue
+  }),
+  Schema_exports.Struct({
+    operation: Schema_exports.Literal("call"),
+    tool: Schema_exports.NonEmptyString,
+    /**
+     * The caller's claim; the bundle rejects a call whose tool has the other kind. The host omits
+     * it for a tool its catalog does not list, and then opens storage for writing.
+     */
+    kind: Schema_exports.optionalKey(ToolKind),
+    input: JsonValue
+  })
+]);
+var HostKindMismatch = class extends Schema_exports.TaggedError()("HostKindMismatch", {
+  tool: Schema_exports.NonEmptyString,
+  requested: ToolKind,
+  actual: ToolKind
+}) {
+};
+var HostError3 = Schema_exports.Union([...HostError2.members, HostKindMismatch]);
+var HostResponse3 = Schema_exports.Union([
+  Schema_exports.Struct({
+    ok: Schema_exports.Literal(true),
+    value: JsonValue,
+    toolError: Schema_exports.optionalKey(Schema_exports.Literal(true))
+  }),
+  Schema_exports.Struct({ ok: Schema_exports.Literal(false), error: HostError3 })
+]);
+var HostInvocation2 = Schema_exports.Struct({
+  command: HostRequest2,
+  accounts: ResolvedAccounts,
+  approval: Schema_exports.optionalKey(TrustedToolApproval),
+  replay: Schema_exports.optionalKey(WorkflowReplay),
+  deadline: Schema_exports.optionalKey(InvocationDeadline),
+  workflowRun: Schema_exports.optionalKey(WorkflowRunId)
+});
+var protocol4 = {
+  version: 4,
+  schemas: {
+    invocation: HostInvocation2,
+    request: HostRequest2,
+    response: HostResponse3,
+    requirements: DeclaredRequirements,
+    catalog: HostedCatalog,
+    catalogSummary: HostedCatalogSummary,
+    skills: SkillCatalogResponse2,
+    elicitationRequest: FormElicitation,
+    elicitationReply: ElicitationReply,
+    workflowStep: WorkflowRpcCommand,
+    workflowStepReply: WorkflowRpcResult,
+    workflowControl: WorkflowControlCommand,
+    cacheCommand: CacheCommand,
+    cacheReply: CacheReply
+  }
+};
+
+// src/contracts/protocols/5.ts
+var DeclaredRequirements2 = Schema_exports.Struct({
+  /** Protocol support of this retained framework build, not an author-declared requirement. */
+  capabilities: Schema_exports.optionalKey(
+    Schema_exports.Struct({
+      skills: Schema_exports.Literal(true),
+      toolIndex: Schema_exports.optionalKey(Schema_exports.Literal(true)),
+      skillSources: Schema_exports.optionalKey(Schema_exports.Literal(true)),
+      scheduledTools: Schema_exports.optionalKey(Schema_exports.Literal(true))
+    })
+  ),
+  database: Schema_exports.optionalKey(DatabaseSchema),
+  accounts: Schema_exports.Record(
+    Schema_exports.NonEmptyString,
+    Schema_exports.Struct({
+      definition: DeclaredProvider,
+      cardinality: Schema_exports.Literals(["one", "many"]),
+      /**
+       * The slot's provider defines an account check. Kept beside the definition, not in it, so
+       * adding or editing a check never changes the provider's identity.
+       */
+      health: Schema_exports.optionalKey(Schema_exports.Literal(true))
+    })
+  )
+});
+var AccountCheckCommand = Schema_exports.Struct({
+  operation: Schema_exports.Literal("account-check"),
+  requirement: Schema_exports.NonEmptyString
+});
+var HostRequest3 = Schema_exports.Union([
+  ...protocol4.schemas.request.members,
+  AccountCheckCommand
+]);
+var HostInvocation3 = Schema_exports.Struct({
+  command: HostRequest3,
+  accounts: ResolvedAccounts,
+  approval: Schema_exports.optionalKey(TrustedToolApproval),
+  replay: Schema_exports.optionalKey(WorkflowReplay),
+  deadline: Schema_exports.optionalKey(InvocationDeadline),
+  workflowRun: Schema_exports.optionalKey(WorkflowRunId)
+});
+var protocol5 = {
+  version: 5,
+  schemas: {
+    ...protocol4.schemas,
+    invocation: HostInvocation3,
+    request: HostRequest3,
+    requirements: DeclaredRequirements2,
+    accountCheck: AccountCheckResult
+  }
+};
+
+// src/contracts/protocols/6.ts
+var DeclaredAuthMethod2 = Schema_exports.Union([
+  Schema_exports.Struct({ type: Schema_exports.Literal("secrets"), label: Schema_exports.String, fields: JsonObject2 }),
+  Schema_exports.Struct({
+    type: Schema_exports.Literal("oauth2"),
+    ...OAuth2Config.members[0].fields,
+    response: JsonObject2
+  }),
+  Schema_exports.Struct({
+    type: Schema_exports.Literal("oauth2"),
+    ...OAuth2Config.members[1].fields,
+    response: JsonObject2
+  }),
+  Schema_exports.Struct({
+    type: Schema_exports.Literal("oauth2"),
+    ...OAuth2Config.members[2].fields,
+    response: JsonObject2
+  }),
+  Schema_exports.Struct({
+    type: Schema_exports.Literal("oauth2"),
+    ...OAuth2Config.members[3].fields,
+    response: JsonObject2
+  })
+]);
+var DeclaredProvider2 = Schema_exports.Struct({
+  name: Schema_exports.NonEmptyString,
+  auth: Schema_exports.Record(Schema_exports.NonEmptyString, DeclaredAuthMethod2)
+});
+var DeclaredRequirements3 = Schema_exports.Struct({
+  ...DeclaredRequirements2.fields,
+  accounts: Schema_exports.Record(
+    Schema_exports.NonEmptyString,
+    Schema_exports.Struct({
+      definition: DeclaredProvider2,
+      cardinality: Schema_exports.Literals(["one", "many"]),
+      health: Schema_exports.optionalKey(Schema_exports.Literal(true))
+    })
+  )
+});
+var ResolvedAccount2 = Schema_exports.Struct({
+  ...ResolvedAccount.fields,
+  provider: DeclaredProvider2
+});
+var ResolvedAccounts2 = Schema_exports.Record(
+  Schema_exports.NonEmptyString,
+  Schema_exports.Union([ResolvedAccount2, Schema_exports.Array(ResolvedAccount2)])
+);
+var HostInvocation4 = Schema_exports.Struct({
+  ...HostInvocation3.fields,
+  accounts: ResolvedAccounts2
+});
+var protocol6 = {
+  version: 6,
+  schemas: {
+    ...protocol5.schemas,
+    requirements: DeclaredRequirements3,
+    accounts: ResolvedAccounts2,
+    invocation: HostInvocation4
+  }
+};
+
+// src/contracts/protocols/7.ts
+var CredentialHost = Schema_exports.String.check(
+  Schema_exports.isPattern(
+    /^(\*\.)?[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*(?::[0-9]{1,5})?$/
+  )
+);
+var exposure = {
+  /** Not secret: app code reads the real value and forms show it. */
+  plain: Schema_exports.optionalKey(Schema_exports.Array(Schema_exports.NonEmptyString)),
+  /** Secret, but app code reads the real value, for signing and similar uses. */
+  raw: Schema_exports.optionalKey(Schema_exports.Array(Schema_exports.NonEmptyString))
+};
+var DeclaredAuthMethod3 = Schema_exports.Union([
+  Schema_exports.Struct({
+    type: Schema_exports.Literal("secrets"),
+    label: Schema_exports.String,
+    fields: JsonObject2,
+    ...exposure
+  }),
+  Schema_exports.Struct({
+    type: Schema_exports.Literal("oauth2"),
+    ...OAuth2Config.members[0].fields,
+    response: JsonObject2,
+    ...exposure
+  }),
+  Schema_exports.Struct({
+    type: Schema_exports.Literal("oauth2"),
+    ...OAuth2Config.members[1].fields,
+    response: JsonObject2,
+    ...exposure
+  }),
+  Schema_exports.Struct({
+    type: Schema_exports.Literal("oauth2"),
+    ...OAuth2Config.members[2].fields,
+    response: JsonObject2,
+    ...exposure
+  }),
+  Schema_exports.Struct({
+    type: Schema_exports.Literal("oauth2"),
+    ...OAuth2Config.members[3].fields,
+    response: JsonObject2,
+    ...exposure
+  })
+]);
+var DeclaredProvider3 = Schema_exports.Struct({
+  name: Schema_exports.NonEmptyString,
+  auth: Schema_exports.Record(Schema_exports.NonEmptyString, DeclaredAuthMethod3),
+  hosts: Schema_exports.optionalKey(Schema_exports.Array(CredentialHost))
+});
+var DeclaredRequirements4 = Schema_exports.Struct({
+  ...DeclaredRequirements3.fields,
+  accounts: Schema_exports.Record(
+    Schema_exports.NonEmptyString,
+    Schema_exports.Struct({
+      definition: DeclaredProvider3,
+      cardinality: Schema_exports.Literals(["one", "many"]),
+      health: Schema_exports.optionalKey(Schema_exports.Literal(true))
+    })
+  )
+});
+var ResolvedAccount3 = Schema_exports.Struct({
+  ...ResolvedAccount2.fields,
+  provider: DeclaredProvider3
+});
+var ResolvedAccounts3 = Schema_exports.Record(
+  Schema_exports.NonEmptyString,
+  Schema_exports.Union([ResolvedAccount3, Schema_exports.Array(ResolvedAccount3)])
+);
+var HostInvocation5 = Schema_exports.Struct({
+  ...HostInvocation4.fields,
+  accounts: ResolvedAccounts3
+});
+var protocol7 = {
+  version: 7,
+  schemas: {
+    ...protocol6.schemas,
+    requirements: DeclaredRequirements4,
+    accounts: ResolvedAccounts3,
+    invocation: HostInvocation5
+  }
+};
+
+// src/contracts/protocols/8.ts
+var McpError4 = class extends Schema_exports.TaggedError()("McpError", {
+  phase: Schema_exports.Literals(["connect", "discover", "call", "schema", "transport"]),
+  reason: Schema_exports.Literals([
+    "request",
+    "unauthorized",
+    "invalid_response",
+    "timeout",
+    "invalid_input"
+  ]),
+  status: Schema_exports.optional(Schema_exports.Number),
+  upstream: Schema_exports.optional(UpstreamError)
+}) {
+};
+var HostDeclarationInvalid3 = class extends Schema_exports.TaggedError()(
+  "HostDeclarationInvalid",
+  FailureDetail
+) {
+};
+var HostEvaluationFailed3 = class extends Schema_exports.TaggedError()(
+  "HostEvaluationFailed",
+  FailureDetail
+) {
+};
+var HostOperationFailed3 = class extends Schema_exports.TaggedError()(
+  "HostOperationFailed",
+  FailureDetail
+) {
+};
+var HostRouterError2 = Schema_exports.Union([
+  ProviderError,
+  McpError4,
+  SkillLoadFailed,
+  HostDeclarationInvalid3,
+  HostEvaluationFailed3
+]);
+var HostedRouter2 = Schema_exports.Struct({
+  ...HostedRouter.fields,
+  error: Schema_exports.optionalKey(HostRouterError2)
+});
+var HostedCatalog2 = Schema_exports.Struct({
+  ...HostedCatalog.fields,
+  routers: Schema_exports.Array(HostedRouter2)
+});
+var HostedCatalogSummary2 = Schema_exports.Struct({
+  ...HostedCatalogSummary.fields,
+  routers: Schema_exports.Array(HostedRouter2)
+});
+var HostError4 = Schema_exports.Union([
+  OpenapiResponseError,
+  ProviderError,
+  McpError4,
+  SkillLoadFailed,
+  WorkflowFailure,
+  HostRequestInvalid,
+  HostAccountsInvalid,
+  HostDeclarationInvalid3,
+  HostEvaluationFailed3,
+  HostOperationNotFound,
+  HostOperationFailed3,
+  DatabaseLimitExceeded,
+  DatabaseFieldReserved,
+  HostToolNotFound,
+  HostInputInvalid,
+  HostOutputInvalid,
+  HostToolBlocked,
+  HostToolApprovalRequired,
+  HostToolPolicyFailed,
+  ElicitationFailed,
+  HostKindMismatch
+]);
+var HostResponse4 = Schema_exports.Union([
+  Schema_exports.Struct({
+    ok: Schema_exports.Literal(true),
+    value: JsonValue,
+    toolError: Schema_exports.optionalKey(Schema_exports.Literal(true))
+  }),
+  Schema_exports.Struct({ ok: Schema_exports.Literal(false), error: HostError4 })
+]);
+var protocol8 = {
+  version: 8,
+  schemas: {
+    ...protocol7.schemas,
+    response: HostResponse4,
+    catalog: HostedCatalog2,
+    catalogSummary: HostedCatalogSummary2
+  }
+};
+
+// src/contracts/protocols/9.ts
+var McpError5 = class extends Schema_exports.TaggedError()("McpError", {
+  phase: Schema_exports.Literals(["connect", "discover", "call", "schema", "transport"]),
+  reason: Schema_exports.Literals([
+    "request",
+    "unauthorized",
+    "invalid_response",
+    "timeout",
+    "invalid_input"
+  ]),
+  status: Schema_exports.optional(Schema_exports.Number),
+  upstream: Schema_exports.optional(UpstreamError),
+  session: Schema_exports.optional(Schema_exports.Literal(true))
+}) {
+};
+var SkillLoadFailed2 = class extends Schema_exports.TaggedError()("SkillLoadFailed", {
+  reason: Schema_exports.Literals([
+    "source",
+    "request",
+    "rate_limited",
+    "document",
+    "limit",
+    "changed",
+    "encoding"
+  ]),
+  message: Schema_exports.optional(Schema_exports.String.check(Schema_exports.isMaxLength(500))),
+  status: Schema_exports.optional(Schema_exports.Int.check(Schema_exports.isBetween({ minimum: 100, maximum: 599 }))),
+  missing: Schema_exports.optional(Schema_exports.Literals(["repository", "ref"]))
+}) {
+};
+var HostRouterError3 = Schema_exports.Union([
+  ProviderError,
+  McpError5,
+  SkillLoadFailed2,
+  HostDeclarationInvalid3,
+  HostEvaluationFailed3
+]);
+var HostedRouter3 = Schema_exports.Struct({
+  ...HostedRouter2.fields,
+  error: Schema_exports.optionalKey(HostRouterError3)
+});
+var HostedCatalog3 = Schema_exports.Struct({
+  ...HostedCatalog2.fields,
+  routers: Schema_exports.Array(HostedRouter3)
+});
+var HostedCatalogSummary3 = Schema_exports.Struct({
+  ...HostedCatalogSummary2.fields,
+  routers: Schema_exports.Array(HostedRouter3)
+});
+var HostError5 = Schema_exports.Union([
+  OpenapiResponseError,
+  ProviderError,
+  McpError5,
+  SkillLoadFailed2,
+  WorkflowFailure,
+  HostRequestInvalid,
+  HostAccountsInvalid,
+  HostDeclarationInvalid3,
+  HostEvaluationFailed3,
+  HostOperationNotFound,
+  HostOperationFailed3,
+  DatabaseLimitExceeded,
+  DatabaseFieldReserved,
+  HostToolNotFound,
+  HostInputInvalid,
+  HostOutputInvalid,
+  HostToolBlocked,
+  HostToolApprovalRequired,
+  HostToolPolicyFailed,
+  ElicitationFailed,
+  HostKindMismatch
+]);
+var HostResponse5 = Schema_exports.Union([
+  Schema_exports.Struct({
+    ok: Schema_exports.Literal(true),
+    value: JsonValue,
+    toolError: Schema_exports.optionalKey(Schema_exports.Literal(true))
+  }),
+  Schema_exports.Struct({ ok: Schema_exports.Literal(false), error: HostError5 })
+]);
+var protocol9 = {
+  version: 9,
+  schemas: {
+    ...protocol8.schemas,
+    response: HostResponse5,
+    catalog: HostedCatalog3,
+    catalogSummary: HostedCatalogSummary3
+  }
+};
+
+// src/contracts/protocols/10.ts
+var DeclaredRequirements5 = Schema_exports.Struct({
+  ...DeclaredRequirements4.fields,
+  sql: Schema_exports.optionalKey(Schema_exports.Literal(true))
+});
+var MigrateCommand = Schema_exports.Struct({ operation: Schema_exports.Literal("migrate") });
+var MigrateResult = Schema_exports.Array(
+  Schema_exports.Struct({ id: Schema_exports.Int, name: Schema_exports.NonEmptyString })
+);
+var HostRequest4 = Schema_exports.Union([...HostRequest3.members, MigrateCommand]);
+var HostInvocation6 = Schema_exports.Struct({
+  ...HostInvocation5.fields,
+  command: HostRequest4
+});
+var protocol10 = {
+  version: 10,
+  schemas: {
+    ...protocol9.schemas,
+    request: HostRequest4,
+    requirements: DeclaredRequirements5,
+    invocation: HostInvocation6,
+    migrate: MigrateResult
+  }
+};
 
 // src/contracts/host.ts
 var skillsCommand = (sources) => sources ? { operation: "skills", sources: true } : { operation: "skills" };
@@ -2116,16 +3206,20 @@ var inspectCommand = (tools, scheduled) => ({
   ...scheduled === void 0 ? {} : { scheduled }
 });
 var indexCommand = { operation: "inspect", detail: "summary" };
-var selectTools = (tools) => (all) => tools === void 0 ? all : all.filter((tool) => tools.includes(tool.name));
-var HostRequirementsError = Schema_exports.Union([HostRequestInvalid, HostDeclarationInvalid]);
+var selectTools = (tools) => (catalog) => tools === void 0 ? catalog : { ...catalog, tools: catalog.tools.filter((tool) => tools.includes(tool.name)) };
+var HostRequirementsError = Schema_exports.Union([
+  HostRequestInvalid,
+  HostDeclarationInvalid3,
+  DatabaseFieldReserved
+]);
 var HostInspectError = Schema_exports.Union([
   ProviderError,
-  McpError,
-  SkillLoadFailed,
+  McpError5,
+  SkillLoadFailed2,
   HostRequestInvalid,
-  HostDeclarationInvalid,
+  HostDeclarationInvalid3,
   HostAccountsInvalid,
-  HostEvaluationFailed
+  HostEvaluationFailed3
 ]);
 var HostCallError = Schema_exports.Union([
   OpenapiResponseError,
@@ -2133,7 +3227,9 @@ var HostCallError = Schema_exports.Union([
   HostInspectError,
   HostToolNotFound,
   HostOperationNotFound,
-  HostOperationFailed,
+  HostKindMismatch,
+  HostOperationFailed3,
+  DatabaseLimitExceeded,
   HostInputInvalid,
   HostOutputInvalid,
   HostToolBlocked,
@@ -2141,6 +3237,16 @@ var HostCallError = Schema_exports.Union([
   HostToolPolicyFailed,
   ElicitationFailed
 ]);
+var HostAccountCheckError = Schema_exports.Union([
+  ProviderError,
+  WorkflowFailure,
+  HostRequestInvalid,
+  HostDeclarationInvalid3,
+  HostAccountsInvalid,
+  HostOperationNotFound,
+  HostOperationFailed3,
+  HostOutputInvalid
+]);
 var HostDataError = HostCallError;
 var ToolResultObservation = Context_exports.Reference(
   "apps/ToolResultObservation",
@@ -2152,25 +3258,28 @@ export {
   SecretsMethod,
   OAuthClientAuth,
   OAuthSecretClientAuth,
+  OAuthTokenRequestFormat,
+  OAuthTokenResponse,
   OAuth2Config,
   OAuth2AccessToken,
   OAuth2Method,
+  AccountInfo,
+  AccountCheckResult,
   Provider,
   ManyAccounts,
-  ToolAnnotations,
-  McpClientLimits,
-  defaultMcpClientLimits,
-  mcpSdkTimerCeilingMs,
-  McpToolsOptions,
-  McpToolResult,
-  McpToolMetadata,
-  McpError,
-  ProcessConfig,
+  maxApiErrorInstructionsLength,
+  ApiErrorRecovery,
+  maxApiErrorMessageLength,
+  ApiErrorResponse,
+  OpenapiResponseError,
+  defaultOpenapiErrorLimits,
   WorkflowRunId,
   WorkflowName,
   workflowDurationMillis,
   WorkflowDuration,
   WorkflowStepOptions,
+  WorkflowFailureDetail,
+  WorkflowRunFailure,
   WorkflowFailure,
   NonRetryableError,
   WorkflowValue,
@@ -2182,6 +3291,10 @@ export {
   WorkflowRpcCommand,
   WorkflowRpcResult,
   WorkflowControlCommand,
+  DatabaseLimitExceeded,
+  DatabaseFieldReserved,
+  reservedTablePrefix,
+  migrationsDirectory,
   ElicitationLimits,
   defaultElicitationLimits,
   FormElicitation,
@@ -2191,6 +3304,23 @@ export {
   ApprovalElicitation,
   ApprovalResponse,
   approvalElicitation,
+  reservedRouterKeys,
+  RouterKey,
+  RouterIcon,
+  RouterMeta,
+  ToolAnnotations2 as ToolAnnotations,
+  McpClientLimits,
+  defaultMcpClientLimits,
+  mcpSdkTimerCeilingMs,
+  McpToolsOptions,
+  McpHealthInput,
+  mcpHealthReserveMs,
+  McpToolResult,
+  McpToolMetadata,
+  McpServerHeader,
+  McpError2 as McpError,
+  McpCredentialsUnverified,
+  ProcessConfig,
   WebhookTransportLimits,
   defaultWebhookTransportLimits,
   WebhookRequestData,
@@ -2205,22 +3335,11 @@ export {
   CalendarSchedule,
   ScheduleTiming,
   OperationSchedule,
-  DeclaredAuthMethod,
-  DeclaredProvider,
-  DeclaredRequirements,
-  ResolvedAccount,
-  ResolvedAccounts,
   TrustedToolApproval,
   InvocationDeadline,
-  HostedTool,
-  HostedToolSummary,
-  HostRequest,
   HostRequestInvalid,
   HostAccountsInvalid,
-  HostDeclarationInvalid,
-  HostEvaluationFailed,
   HostOperationNotFound,
-  HostOperationFailed,
   HostToolNotFound,
   InputProblem,
   maxInputProblems,
@@ -2229,14 +3348,43 @@ export {
   HostToolApprovalRequired,
   HostToolPolicyFailed,
   HostOutputInvalid,
-  HostError,
-  HostResponse,
-  HostInvocation,
   protocol1,
   SkillSources2 as SkillSources,
   SkillCatalogResponse2 as SkillCatalogResponse,
   protocol2,
-  OperationToolPrefixes,
+  protocol3,
+  HostedTool2 as HostedTool,
+  HostedToolSummary2 as HostedToolSummary,
+  HostKindMismatch,
+  protocol4,
+  AccountCheckCommand,
+  protocol5,
+  protocol6,
+  CredentialHost,
+  DeclaredAuthMethod3 as DeclaredAuthMethod,
+  DeclaredProvider3 as DeclaredProvider,
+  ResolvedAccount3 as ResolvedAccount,
+  ResolvedAccounts3 as ResolvedAccounts,
+  protocol7,
+  HostDeclarationInvalid3 as HostDeclarationInvalid,
+  HostEvaluationFailed3 as HostEvaluationFailed,
+  HostOperationFailed3 as HostOperationFailed,
+  protocol8,
+  McpError5 as McpError2,
+  SkillLoadFailed2 as SkillLoadFailed,
+  HostRouterError3 as HostRouterError,
+  HostedRouter3 as HostedRouter,
+  HostedCatalog3 as HostedCatalog,
+  HostedCatalogSummary3 as HostedCatalogSummary,
+  HostError5 as HostError,
+  HostResponse5 as HostResponse,
+  protocol9,
+  DeclaredRequirements5 as DeclaredRequirements,
+  MigrateCommand,
+  MigrateResult,
+  HostRequest4 as HostRequest,
+  HostInvocation6 as HostInvocation,
+  protocol10,
   skillsCommand,
   skillCatalog,
   inspectCommand,
@@ -2245,6 +3393,7 @@ export {
   HostRequirementsError,
   HostInspectError,
   HostCallError,
+  HostAccountCheckError,
   HostDataError,
   ToolResultObservation
 };