apps 0.0.1-beta.6 → 0.0.1-beta.61

package/js/{chunk-B3EOZTK3.js → chunk-TLWLJ7PD.js}

@@ -1,24 +1,25 @@
-import {
-  DatabaseFieldReserved,
-  DatabaseLimitExceeded,
-  DatabaseSchema
-} from "./chunk-N7YDVXYJ.js";
 import {
   CacheCommand,
   CacheReply,
-  ProviderError
-} from "./chunk-R3EV5FTO.js";
+  FailureDetail,
+  FailureMessage,
+  FailureName,
+  ProviderError,
+  UpstreamError
+} from "./chunk-MWKHKOTL.js";
 import {
   AppSkillName,
-  AppSkills,
-  SkillLoadFailed
-} from "./chunk-JU7VHODU.js";
+  AppSkills
+} from "./chunk-H72MEDMN.js";
+import {
+  RecordedMessage
+} from "./chunk-5FHWNLCI.js";
 import {
   AccountId,
   HttpUrl,
   JsonObject as JsonObject2,
   JsonValue
-} from "./chunk-27F7W2LG.js";
+} from "./chunk-H2CJWXA3.js";
 import {
   Any,
   ArraySchema,
@@ -54,13 +55,13 @@ import {
   declare,
   decode,
   decodeTo,
-  empty2 as empty,
+  empty,
   flatMap,
   fromUndefinedOr,
   isBetween,
   isSchema,
   isStream,
-  make6 as make,
+  make2 as make,
   merge,
   optional,
   optionalKey,
@@ -69,127 +70,23 @@ import {
   symbol3 as symbol,
   sync2 as sync,
   tag,
+  toType,
   transformOptional,
   withConstructorDefault,
   withDefault
-} from "./chunk-CDL5PM2Q.js";
-
-// src/contracts/router.ts
-var reservedRouterKeys = /* @__PURE__ */ new Set([
-  "__proto__",
-  "constructor",
-  "prototype"
-]);
-var RouterKey = Schema_exports.String.check(
-  Schema_exports.isPattern(/^[A-Za-z_][A-Za-z0-9_-]{0,99}$/),
-  Schema_exports.makeFilter((key) => !reservedRouterKeys.has(key))
-);
-var RouterIcon = Schema_exports.Struct({
-  src: Schema_exports.NonEmptyString,
-  mimeType: Schema_exports.optionalKey(Schema_exports.String),
-  sizes: Schema_exports.optionalKey(Schema_exports.Array(Schema_exports.String)),
-  theme: Schema_exports.optionalKey(Schema_exports.Literals(["light", "dark"]))
-});
-var RouterMeta = Schema_exports.Struct({
-  title: Schema_exports.optionalKey(Schema_exports.String),
-  description: Schema_exports.optionalKey(Schema_exports.String),
-  instructions: Schema_exports.optionalKey(Schema_exports.String),
-  icons: Schema_exports.optionalKey(Schema_exports.Array(RouterIcon)),
-  tags: Schema_exports.optionalKey(Schema_exports.Record(Schema_exports.NonEmptyString, Schema_exports.String))
-});
-
-// src/contracts/tools.ts
-var ToolAnnotations = Schema_exports.Struct({
-  title: Schema_exports.optionalKey(Schema_exports.String),
-  readOnlyHint: Schema_exports.optionalKey(Schema_exports.Boolean),
-  destructiveHint: Schema_exports.optionalKey(Schema_exports.Boolean),
-  idempotentHint: Schema_exports.optionalKey(Schema_exports.Boolean),
-  openWorldHint: Schema_exports.optionalKey(Schema_exports.Boolean)
-});
-
-// src/contracts/mcp.ts
-var McpClientLimits = Schema_exports.Struct({
-  timeoutMs: Schema_exports.Int.check(Schema_exports.isGreaterThan(0)),
-  maxTimeoutMs: Schema_exports.Int.check(Schema_exports.isGreaterThan(0)),
-  maxTools: Schema_exports.Int.check(Schema_exports.isGreaterThan(0)),
-  maxPaginationCursors: Schema_exports.Int.check(Schema_exports.isGreaterThan(0)),
-  cleanupTimeoutMs: Schema_exports.Int.check(Schema_exports.isGreaterThan(0))
-});
-var defaultMcpClientLimits = McpClientLimits.make({
-  timeoutMs: 3e4,
-  maxTimeoutMs: 3e5,
-  maxTools: 5e4,
-  maxPaginationCursors: 1e3,
-  cleanupTimeoutMs: 1e3
-});
-var mcpSdkTimerCeilingMs = 2147483647;
-var McpToolsOptions = Schema_exports.Struct({
-  url: HttpUrl,
-  accountId: Schema_exports.optional(AccountId),
-  headers: Schema_exports.optional(Schema_exports.Record(Schema_exports.String, Schema_exports.String)),
-  signal: Schema_exports.optional(Schema_exports.instanceOf(AbortSignal)),
-  timeoutMs: Schema_exports.optional(
-    Schema_exports.Number.check(
-      Schema_exports.isInt(),
-      Schema_exports.isBetween({ minimum: 1, maximum: defaultMcpClientLimits.maxTimeoutMs })
-    )
-  )
-});
-var McpToolResult = Schema_exports.Struct({
-  content: Schema_exports.Array(JsonObject2),
-  structuredContent: Schema_exports.optional(JsonObject2),
-  isError: Schema_exports.optional(Schema_exports.Boolean),
-  _meta: Schema_exports.optional(JsonObject2)
-});
-var McpToolMetadata = Schema_exports.Struct({
-  name: Schema_exports.String,
-  title: Schema_exports.optional(Schema_exports.String),
-  description: Schema_exports.optional(Schema_exports.String),
-  inputSchema: JsonObject2,
-  outputSchema: Schema_exports.optional(JsonObject2),
-  annotations: Schema_exports.optional(ToolAnnotations),
-  _meta: Schema_exports.optional(JsonObject2)
-});
-var McpServerHeader = Schema_exports.Struct({
-  name: Schema_exports.optionalKey(Schema_exports.String),
-  title: Schema_exports.optionalKey(Schema_exports.String),
-  version: Schema_exports.optionalKey(Schema_exports.String),
-  description: Schema_exports.optionalKey(Schema_exports.String),
-  websiteUrl: Schema_exports.optionalKey(Schema_exports.String),
-  icons: Schema_exports.optionalKey(Schema_exports.Array(RouterIcon)),
-  instructions: Schema_exports.optionalKey(Schema_exports.String)
-});
-var McpError = class extends Schema_exports.TaggedError()("McpError", {
-  phase: Schema_exports.Literals(["connect", "discover", "call", "schema", "transport"]),
-  reason: Schema_exports.Literals([
-    "request",
-    "unauthorized",
-    "invalid_response",
-    "timeout",
-    "invalid_input"
-  ]),
-  status: Schema_exports.optional(Schema_exports.Number)
-}) {
-};
-var ProcessConfig = Schema_exports.Struct({
-  command: Schema_exports.NonEmptyString,
-  args: Schema_exports.Array(Schema_exports.String),
-  cwd: Schema_exports.optional(Schema_exports.String),
-  env: Schema_exports.Record(Schema_exports.String, Schema_exports.String),
-  timeoutMs: Schema_exports.Int.check(
-    Schema_exports.isBetween({ minimum: 1, maximum: defaultMcpClientLimits.maxTimeoutMs })
-  )
-});
+} from "./chunk-IFJU5SYQ.js";
 
 // src/contracts/api-response-error.ts
+var maxApiErrorInstructionsLength = 4096;
 var ApiErrorRecovery = Schema_exports.Struct({
   action: Schema_exports.NonEmptyString.check(Schema_exports.isMaxLength(1024)),
-  instructions: Schema_exports.NonEmptyString.check(Schema_exports.isMaxLength(4096))
+  instructions: Schema_exports.NonEmptyString.check(Schema_exports.isMaxLength(maxApiErrorInstructionsLength))
 });
+var maxApiErrorMessageLength = 4096;
 var ApiErrorResponse = Schema_exports.Struct({
   code: Schema_exports.NonEmptyString.check(Schema_exports.isMaxLength(128)),
   status: Schema_exports.Int.check(Schema_exports.isBetween({ minimum: 400, maximum: 599 })),
-  message: Schema_exports.NonEmptyString.check(Schema_exports.isMaxLength(4096)),
+  message: Schema_exports.NonEmptyString.check(Schema_exports.isMaxLength(maxApiErrorMessageLength)),
   recovery: Schema_exports.optionalKey(ApiErrorRecovery)
 });
 var OpenapiResponseError = class extends Schema_exports.TaggedError()(
@@ -206,19 +103,6 @@ var defaultOpenapiErrorLimits = OpenapiErrorLimits.make({
   readTimeoutMs: 2e3
 });
 
-// src/contracts/failure.ts
-var maxFailureMessageLength = 2048;
-var FailureSource = Schema_exports.Literals(["app", "storage", "service"]);
-var FailureName = Schema_exports.String.check(Schema_exports.isMaxLength(128));
-var FailureCode = Schema_exports.String.check(Schema_exports.isMaxLength(128));
-var FailureMessage = Schema_exports.String.check(Schema_exports.isMaxLength(maxFailureMessageLength));
-var FailureDetail = {
-  source: Schema_exports.optionalKey(FailureSource),
-  errorName: Schema_exports.optionalKey(FailureName),
-  code: Schema_exports.optionalKey(FailureCode),
-  message: Schema_exports.optionalKey(FailureMessage)
-};
-
 // src/contracts/workflows.ts
 var WorkflowRunId = Schema_exports.NonEmptyString.pipe(Schema_exports.brand("wfr"));
 var WorkflowName = Schema_exports.NonEmptyString.check(Schema_exports.isMaxLength(200));
@@ -283,6 +167,13 @@ var WorkflowFailure = class extends Schema_exports.TaggedError()("WorkflowFailur
   ]),
   retryable: Schema_exports.Boolean
 }) {
+  /**
+   * The step name and error detail are the app's. Its run's owner reads them; telemetry records
+   * only the reason, however the failure was built or decoded.
+   */
+  get [RecordedMessage]() {
+    return this.step === void 0 && this.errorName === void 0 && !this.message ? void 0 : `The workflow failed (${this.reason}); the app's error is not recorded`;
+  }
 };
 var NonRetryableError = class extends Error {
   name = "NonRetryableError";
@@ -389,7 +280,178 @@ var WorkflowControlCommand = Schema_exports.Union([
   Schema_exports.Struct({ operation: Schema_exports.Literal("terminate"), run: WorkflowRunId })
 ]);
 
-// ../../node_modules/.bun/effect@https+++pkg.pr.new+Effect-TS+effect+effect@c7d1ffff31a3e2ae0b0b+a654a55b752bdb24/node_modules/effect/dist/unstable/rpc/RpcSchema.js
+// ../app-data/src/contracts/database.ts
+var DataName = Schema_exports.String.check(
+  Schema_exports.makeFilter((value) => /^[A-Za-z][A-Za-z0-9_]*$/.test(value) && value.length <= 128)
+);
+var Scalar = Schema_exports.Union([Schema_exports.String, Schema_exports.Finite, Schema_exports.Boolean]);
+var Field = Schema_exports.Struct({
+  kind: Schema_exports.Literals(["string", "number", "boolean", "id", "userId"]),
+  optional: Schema_exports.optional(Schema_exports.Boolean),
+  default: Schema_exports.optional(Scalar),
+  references: Schema_exports.optional(DataName)
+});
+var Index = Schema_exports.Struct({ name: DataName, fields: Schema_exports.NonEmptyArray(DataName) });
+var Table = Schema_exports.Struct({
+  fields: Schema_exports.Record(DataName, Field),
+  indexes: Schema_exports.Array(Index)
+});
+var DatabaseSchema = Schema_exports.Record(DataName, Table);
+var Row = Schema_exports.Record(Schema_exports.String, Scalar);
+var RowMetadata = Schema_exports.Struct({
+  id: Schema_exports.NonEmptyString,
+  createdAt: Schema_exports.String,
+  updatedAt: Schema_exports.String
+});
+var Patch = Schema_exports.Record(DataName, Schema_exports.NullOr(Scalar));
+var RangeClause = Schema_exports.Struct({
+  field: DataName,
+  op: Schema_exports.Literals(["eq", "gt", "gte", "lt", "lte"]),
+  value: Schema_exports.NullOr(Scalar)
+});
+var QueryPlan = Schema_exports.Struct({
+  table: DataName,
+  index: DataName,
+  order: Schema_exports.Literals(["asc", "desc"]),
+  clauses: Schema_exports.Array(RangeClause)
+});
+var QueryTerminal = Schema_exports.Union([
+  Schema_exports.Struct({ kind: Schema_exports.Literal("collect") }),
+  Schema_exports.Struct({ kind: Schema_exports.Literal("count") }),
+  Schema_exports.Struct({ kind: Schema_exports.Literal("first") }),
+  Schema_exports.Struct({
+    kind: Schema_exports.Literal("take"),
+    count: Schema_exports.Int.check(Schema_exports.isGreaterThanOrEqualTo(0))
+  }),
+  Schema_exports.Struct({
+    kind: Schema_exports.Literal("paginate"),
+    cursor: Schema_exports.NullOr(Schema_exports.String),
+    numItems: Schema_exports.Int.check(Schema_exports.isGreaterThan(0))
+  })
+]);
+var DatabaseOperation = Schema_exports.Union([
+  Schema_exports.Struct({ kind: Schema_exports.Literal("get"), table: DataName, id: Schema_exports.NonEmptyString }),
+  Schema_exports.Struct({ kind: Schema_exports.Literal("insert"), table: DataName, value: Patch }),
+  Schema_exports.Struct({
+    kind: Schema_exports.Literal("update"),
+    table: DataName,
+    id: Schema_exports.NonEmptyString,
+    patch: Patch
+  }),
+  Schema_exports.Struct({ kind: Schema_exports.Literal("delete"), table: DataName, id: Schema_exports.NonEmptyString }),
+  Schema_exports.Struct({ kind: Schema_exports.Literal("query"), plan: QueryPlan, terminal: QueryTerminal })
+]);
+var PaginationResult = Schema_exports.Struct({
+  page: Schema_exports.Array(Row),
+  continueCursor: Schema_exports.NullOr(Schema_exports.String),
+  isDone: Schema_exports.Boolean
+});
+var OperationResult = Schema_exports.Union([
+  Row,
+  Schema_exports.Array(Row),
+  PaginationResult,
+  Schema_exports.Boolean,
+  Schema_exports.Finite,
+  Schema_exports.Null
+]);
+var AppDatabaseError = class extends Schema_exports.TaggedError()("AppDatabaseError", {
+  reason: Schema_exports.Literals([
+    "schema",
+    "schema_changed",
+    "table",
+    "index",
+    "range",
+    "value",
+    "readonly",
+    "cursor",
+    "limit",
+    "closed",
+    "storage",
+    "replay"
+  ])
+}) {
+};
+var DatabaseLimits = Schema_exports.Struct({
+  rowsRead: Schema_exports.Int.check(Schema_exports.isGreaterThan(0)),
+  rowsReturned: Schema_exports.Int.check(Schema_exports.isGreaterThan(0)),
+  bytesRead: Schema_exports.Int.check(Schema_exports.isGreaterThan(0)),
+  writes: Schema_exports.Int.check(Schema_exports.isGreaterThan(0)),
+  scanCalls: Schema_exports.Int.check(Schema_exports.isGreaterThan(0)),
+  directGets: Schema_exports.Int.check(Schema_exports.isGreaterThan(0)),
+  valueBytes: Schema_exports.Int.check(Schema_exports.isGreaterThan(0)),
+  indexBytes: Schema_exports.Int.check(Schema_exports.isGreaterThan(0))
+});
+var defaultDatabaseLimits = {
+  rowsRead: 5e3,
+  rowsReturned: 1e3,
+  bytesRead: 4 * 1024 * 1024,
+  writes: 1e3,
+  scanCalls: 100,
+  directGets: 1e3,
+  valueBytes: 64 * 1024,
+  indexBytes: 2048
+};
+var DatabaseLimit = Schema_exports.Literals([
+  "scanCalls",
+  "directGets",
+  "rowsRead",
+  "rowsReturned",
+  "pageSize",
+  "bytesRead",
+  "writes",
+  "valueBytes"
+]);
+var count = (value) => value.toLocaleString("en-US");
+var limitMessages = {
+  scanCalls: (maximum, requested) => `This invocation made ${count(requested)} index queries; the limit is ${count(maximum)}. Each first(), take(), collect(), count() or paginate() call on withIndex(...) counts once. Read related rows with one take() or paginate() over a shared index prefix instead of one first() per item, use get(id) for known IDs, or split the work across workflow steps.`,
+  directGets: (maximum, requested) => `This invocation made ${count(requested)} get(id) calls, including those made by update and delete; the limit is ${count(maximum)}. Split the work across workflow steps or mutations.`,
+  rowsRead: (maximum, requested) => `This invocation read ${count(requested)} rows; the limit is ${count(maximum)}. Read fewer rows per call, through an index or a LIMIT, or split the work across calls or workflow steps.`,
+  rowsReturned: (maximum, requested) => `This invocation returned ${count(requested)} rows; the limit is ${count(maximum)}. collect() fails rather than truncating. Page with paginate() across calls or workflow steps.`,
+  pageSize: (maximum, requested) => `One call asked for ${count(requested)} rows; take(n) and paginate({ numItems }) accept at most ${count(maximum)}. Page with paginate() across calls or workflow steps.`,
+  bytesRead: (maximum, requested) => `This invocation read ${count(requested)} bytes; the limit is ${count(maximum)}. Read fewer or smaller rows per call, or page with paginate() across calls or workflow steps.`,
+  writes: (maximum, requested) => `This invocation wrote ${count(requested)} rows; the limit is ${count(maximum)}. Split large ingests into batches, one batch per mutation or workflow step.`,
+  valueBytes: (maximum, requested) => `A row encodes to ${count(requested)} bytes; each row may use at most ${count(maximum)}. Store large content outside the row or split it across rows.`
+};
+var DatabaseLimitExceeded = class extends Schema_exports.TaggedError()(
+  "DatabaseLimitExceeded",
+  {
+    limit: DatabaseLimit,
+    maximum: Schema_exports.Int,
+    requested: Schema_exports.Int
+  }
+) {
+  get message() {
+    return limitMessages[this.limit](this.maximum, this.requested);
+  }
+};
+var reservedFieldNames = ["id", "createdAt", "updatedAt"];
+var DatabaseFieldReserved = class extends Schema_exports.TaggedError()(
+  "DatabaseFieldReserved",
+  {
+    table: Schema_exports.String,
+    field: Schema_exports.Literals(reservedFieldNames)
+  }
+) {
+  get message() {
+    return `Table "${this.table}" declares "${this.field}", which is reserved: the host adds id, createdAt and updatedAt to every row. Rename the field, or use the row's own ${this.field}.`;
+  }
+};
+var DatabaseRuntimeLimits = Schema_exports.Struct({
+  maxCursorChars: Schema_exports.Int.check(Schema_exports.isGreaterThan(0)),
+  connectionCacheCapacity: Schema_exports.Int.check(Schema_exports.isGreaterThan(0)),
+  connectionCacheTtlMs: Schema_exports.Int.check(Schema_exports.isGreaterThan(0))
+});
+var defaultDatabaseRuntimeLimits = DatabaseRuntimeLimits.make({
+  maxCursorChars: 8192,
+  connectionCacheCapacity: 64,
+  connectionCacheTtlMs: 5 * 60 * 1e3
+});
+
+// src/contracts/sql.ts
+var reservedTablePrefix = "_executor_";
+var migrationsDirectory = "migrations";
+
+// ../../node_modules/.bun/effect@4.0.1/node_modules/effect/dist/rpc/RpcSchema.js
 var StreamSchemaTypeId = "~effect/rpc/RpcSchema/StreamSchema";
 var schema = /* @__PURE__ */ declare(isStream);
 function Stream(success, error) {
@@ -400,7 +462,7 @@ function Stream(success, error) {
   });
 }
 
-// ../../node_modules/.bun/effect@https+++pkg.pr.new+Effect-TS+effect+effect@c7d1ffff31a3e2ae0b0b+a654a55b752bdb24/node_modules/effect/dist/unstable/rpc/Rpc.js
+// ../../node_modules/.bun/effect@4.0.1/node_modules/effect/dist/rpc/Rpc.js
 var TypeId = "~effect/rpc/Rpc";
 var Proto = {
   [TypeId]: TypeId,
@@ -518,7 +580,7 @@ var make2 = (tag2, options) => {
   });
 };
 
-// ../../node_modules/.bun/effect@https+++pkg.pr.new+Effect-TS+effect+effect@c7d1ffff31a3e2ae0b0b+a654a55b752bdb24/node_modules/effect/dist/unstable/ai/McpSchema.js
+// ../../node_modules/.bun/effect@4.0.1/node_modules/effect/dist/ai/McpSchema.js
 var optionalWithDefault = (schema2, defaultValue) => {
   const effect = sync(defaultValue);
   return optionalKey(schema2).pipe(decode({
@@ -526,7 +588,7 @@ var optionalWithDefault = (schema2, defaultValue) => {
     encode: passthrough()
   }), withConstructorDefault(effect));
 };
-var optional2 = (schema2) => optionalKey(schema2).pipe(decodeTo(optional(schema2), {
+var optional2 = (schema2) => optionalKey(schema2).pipe(decodeTo(toType(optional(schema2)), {
   decode: passthrough(),
   encode: transformOptional(flatMap(fromUndefinedOr))
 }));
@@ -788,7 +850,7 @@ var InternalError = class _InternalError extends (/* @__PURE__ */ Error2("effect
     message: "Not implemented"
   });
 };
-var McpError2 = /* @__PURE__ */ Union([ParseError, InvalidRequest, MethodNotFound, InvalidParams, InternalError, McpErrorBase]);
+var McpError = /* @__PURE__ */ Union([ParseError, InvalidRequest, MethodNotFound, InvalidParams, InternalError, McpErrorBase]);
 var InitializeResult = class extends (/* @__PURE__ */ Opaque()(/* @__PURE__ */ Struct({
   ...ResultMeta.fields,
   /**
@@ -811,7 +873,7 @@ var InitializeResult = class extends (/* @__PURE__ */ Opaque()(/* @__PURE__ */ S
 };
 var Initialize = class extends (/* @__PURE__ */ make2("initialize", {
   success: InitializeResult,
-  error: McpError2,
+  error: McpError,
   payload: {
     ...RequestMeta.fields,
     /**
@@ -1010,7 +1072,7 @@ var ReadResourceResult = class extends (/* @__PURE__ */ Opaque()(/* @__PURE__ */
 };
 var ReadResource = class extends (/* @__PURE__ */ make2("resources/read", {
   success: ReadResourceResult,
-  error: McpError2,
+  error: McpError,
   payload: {
     ...RequestMeta.fields,
     /**
@@ -1023,7 +1085,7 @@ var ReadResource = class extends (/* @__PURE__ */ make2("resources/read", {
 };
 var Subscribe = class extends (/* @__PURE__ */ make2("resources/subscribe", {
   success: /* @__PURE__ */ Struct({}),
-  error: McpError2,
+  error: McpError,
   payload: {
     ...RequestMeta.fields,
     /**
@@ -1036,7 +1098,7 @@ var Subscribe = class extends (/* @__PURE__ */ make2("resources/subscribe", {
 };
 var Unsubscribe = class extends (/* @__PURE__ */ make2("resources/unsubscribe", {
   success: /* @__PURE__ */ Struct({}),
-  error: McpError2,
+  error: McpError,
   payload: {
     ...RequestMeta.fields,
     /**
@@ -1180,7 +1242,7 @@ var GetPromptResult = class extends (/* @__PURE__ */ Class("@effect/ai/McpSchema
 };
 var GetPrompt = class extends (/* @__PURE__ */ make2("prompts/get", {
   success: GetPromptResult,
-  error: McpError2,
+  error: McpError,
   payload: {
     ...RequestMeta.fields,
     /**
@@ -1195,7 +1257,7 @@ var GetPrompt = class extends (/* @__PURE__ */ make2("prompts/get", {
   }
 })) {
 };
-var ToolAnnotations2 = class extends (/* @__PURE__ */ Opaque()(/* @__PURE__ */ Struct({
+var ToolAnnotations = class extends (/* @__PURE__ */ Opaque()(/* @__PURE__ */ Struct({
   /**
    * A human-readable title for the tool.
    */
@@ -1264,7 +1326,7 @@ var Tool = class extends (/* @__PURE__ */ Class("@effect/ai/McpSchema/Tool")({
   /**
    * Optional additional tool information.
    */
-  annotations: /* @__PURE__ */ optional2(ToolAnnotations2),
+  annotations: /* @__PURE__ */ optional2(ToolAnnotations),
   /**
    * Icons that clients can display for this tool.
    */
@@ -1300,7 +1362,7 @@ var CallToolResult = class extends (/* @__PURE__ */ Class("@effect/ai/McpSchema/
 };
 var CallTool = class extends (/* @__PURE__ */ make2("tools/call", {
   success: CallToolResult,
-  error: McpError2,
+  error: McpError,
   payload: {
     ...RequestMeta.fields,
     name: String,
@@ -1320,7 +1382,7 @@ var SetLevel = class extends (/* @__PURE__ */ make2("logging/setLevel", {
     level: LoggingLevel
   },
   success: /* @__PURE__ */ Struct({}),
-  error: McpError2
+  error: McpError
 })) {
 };
 var LoggingMessageNotification = class extends (/* @__PURE__ */ make2("notifications/message", {
@@ -1466,7 +1528,7 @@ var CreateMessageResult = class extends (/* @__PURE__ */ Class("@effect/ai/McpSc
 };
 var CreateMessage = class extends (/* @__PURE__ */ make2("sampling/createMessage", {
   success: CreateMessageResult,
-  error: McpError2,
+  error: McpError,
   payload: {
     messages: /* @__PURE__ */ ArraySchema(SamplingMessage),
     /**
@@ -1529,6 +1591,7 @@ var CompleteResult = class _CompleteResult extends (/* @__PURE__ */ Opaque()(/*
   /**
    * Empty completion result used when a completion request has no values.
    *
+   * @stability unstable
    * @since 4.0.0
    */
   static empty = /* @__PURE__ */ _CompleteResult.make({
@@ -1677,7 +1740,7 @@ var ElicitDeclineResult = class extends (/* @__PURE__ */ Class("@effect/ai/McpSc
 var ElicitResult = /* @__PURE__ */ Union([ElicitAcceptResult, ElicitDeclineResult]);
 var Elicit = class extends (/* @__PURE__ */ make2("elicitation/create", {
   success: ElicitResult,
-  error: McpError2,
+  error: McpError,
   payload: ElicitRequestParams
 })) {
 };
@@ -1743,40 +1806,160 @@ ${JSON.stringify(input, null, 2)}`,
   requestedSchema: { type: "object", properties: {} }
 });
 
-// src/contracts/webhook-protocol.ts
-var WebhookTransportLimits = Schema_exports.Struct({
-  maxBodyBytes: Schema_exports.Int.check(Schema_exports.isGreaterThan(0))
+// src/contracts/router.ts
+var reservedRouterKeys = /* @__PURE__ */ new Set([
+  "__proto__",
+  "constructor",
+  "prototype"
+]);
+var RouterKey = Schema_exports.String.check(
+  Schema_exports.isPattern(/^[A-Za-z_][A-Za-z0-9_-]{0,99}$/u),
+  Schema_exports.makeFilter((key) => !reservedRouterKeys.has(key))
+);
+var RouterIcon = Schema_exports.Struct({
+  src: Schema_exports.NonEmptyString,
+  mimeType: Schema_exports.optionalKey(Schema_exports.String),
+  sizes: Schema_exports.optionalKey(Schema_exports.Array(Schema_exports.String)),
+  theme: Schema_exports.optionalKey(Schema_exports.Literals(["light", "dark"]))
 });
-var defaultWebhookTransportLimits = WebhookTransportLimits.make({
-  maxBodyBytes: 1024 * 1024
+var RouterMeta = Schema_exports.Struct({
+  title: Schema_exports.optionalKey(Schema_exports.String),
+  description: Schema_exports.optionalKey(Schema_exports.String),
+  instructions: Schema_exports.optionalKey(Schema_exports.String),
+  icons: Schema_exports.optionalKey(Schema_exports.Array(RouterIcon)),
+  tags: Schema_exports.optionalKey(Schema_exports.Record(Schema_exports.NonEmptyString, Schema_exports.String))
 });
-var encodedBodyChars = 4 * Math.ceil(defaultWebhookTransportLimits.maxBodyBytes / 3);
-var WebhookRequestData = Schema_exports.Struct({
+
+// src/contracts/tools.ts
+var ToolAnnotations2 = Schema_exports.Struct({
+  title: Schema_exports.optionalKey(Schema_exports.String),
+  readOnlyHint: Schema_exports.optionalKey(Schema_exports.Boolean),
+  destructiveHint: Schema_exports.optionalKey(Schema_exports.Boolean),
+  idempotentHint: Schema_exports.optionalKey(Schema_exports.Boolean),
+  openWorldHint: Schema_exports.optionalKey(Schema_exports.Boolean)
+});
+
+// src/contracts/mcp.ts
+var McpClientLimits = Schema_exports.Struct({
+  timeoutMs: Schema_exports.Int.check(Schema_exports.isGreaterThan(0)),
+  maxTimeoutMs: Schema_exports.Int.check(Schema_exports.isGreaterThan(0)),
+  maxTools: Schema_exports.Int.check(Schema_exports.isGreaterThan(0)),
+  maxPaginationCursors: Schema_exports.Int.check(Schema_exports.isGreaterThan(0)),
+  cleanupTimeoutMs: Schema_exports.Int.check(Schema_exports.isGreaterThan(0))
+});
+var defaultMcpClientLimits = McpClientLimits.make({
+  timeoutMs: 3e4,
+  maxTimeoutMs: 3e5,
+  maxTools: 5e4,
+  maxPaginationCursors: 1e3,
+  cleanupTimeoutMs: 1e3
+});
+var mcpSdkTimerCeilingMs = 2147483647;
+var McpToolsOptions = Schema_exports.Struct({
   url: HttpUrl,
-  method: Schema_exports.Literals(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"]),
-  headers: Schema_exports.Record(Schema_exports.String, Schema_exports.String),
-  body: Schema_exports.String.check(Schema_exports.isMaxLength(encodedBodyChars))
+  accountId: Schema_exports.optional(AccountId),
+  headers: Schema_exports.optional(Schema_exports.Record(Schema_exports.String, Schema_exports.String)),
+  signal: Schema_exports.optional(Schema_exports.instanceOf(AbortSignal)),
+  timeoutMs: Schema_exports.optional(
+    Schema_exports.Number.check(
+      Schema_exports.isInt(),
+      Schema_exports.isBetween({ minimum: 1, maximum: defaultMcpClientLimits.maxTimeoutMs })
+    )
+  )
 });
-var WebhookResponseData = Schema_exports.Struct({
-  status: Schema_exports.Int.check(Schema_exports.isBetween({ minimum: 200, maximum: 599 })),
+var McpHealthInput = Schema_exports.Struct({
+  ...McpToolsOptions.fields,
   headers: Schema_exports.Record(Schema_exports.String, Schema_exports.String),
-  body: Schema_exports.String.check(Schema_exports.isMaxLength(encodedBodyChars))
+  deadline: Schema_exports.optional(Schema_exports.Finite)
 });
-var ManualWebhookSetup = Schema_exports.Struct({
-  instructions: Schema_exports.NonEmptyString,
-  signingSecret: Schema_exports.Literals(["executor", "provider"])
+var mcpHealthReserveMs = 2 * defaultMcpClientLimits.cleanupTimeoutMs + 250;
+var McpToolResult = Schema_exports.Struct({
+  content: Schema_exports.Array(JsonObject2),
+  structuredContent: Schema_exports.optionalKey(JsonObject2),
+  isError: Schema_exports.optionalKey(Schema_exports.Boolean),
+  _meta: Schema_exports.optionalKey(JsonObject2)
 });
-var ManualWebhookDescriptor = Schema_exports.Struct({
-  ...ManualWebhookSetup.fields,
-  stateSchema: JsonObject2
+var McpToolMetadata = Schema_exports.Struct({
+  name: Schema_exports.String,
+  title: Schema_exports.optional(Schema_exports.String),
+  description: Schema_exports.optional(Schema_exports.String),
+  inputSchema: JsonObject2,
+  outputSchema: Schema_exports.optional(JsonObject2),
+  annotations: Schema_exports.optional(ToolAnnotations2),
+  _meta: Schema_exports.optional(JsonObject2)
 });
-var HostedWebhook = Schema_exports.Struct({
-  name: Schema_exports.NonEmptyString,
-  account: Schema_exports.NonEmptyString,
-  configSchema: JsonObject2,
-  setup: Schema_exports.optionalKey(ManualWebhookDescriptor)
+var McpServerHeader = Schema_exports.Struct({
+  name: Schema_exports.optionalKey(Schema_exports.String),
+  title: Schema_exports.optionalKey(Schema_exports.String),
+  version: Schema_exports.optionalKey(Schema_exports.String),
+  description: Schema_exports.optionalKey(Schema_exports.String),
+  websiteUrl: Schema_exports.optionalKey(Schema_exports.String),
+  icons: Schema_exports.optionalKey(Schema_exports.Array(RouterIcon)),
+  instructions: Schema_exports.optionalKey(Schema_exports.String)
 });
-var identity = {
+var McpError2 = class extends Schema_exports.TaggedError()("McpError", {
+  phase: Schema_exports.Literals(["connect", "discover", "call", "schema", "transport"]),
+  reason: Schema_exports.Literals([
+    "request",
+    "unauthorized",
+    "invalid_response",
+    "timeout",
+    "invalid_input"
+  ]),
+  status: Schema_exports.optional(Schema_exports.Number),
+  upstream: Schema_exports.optional(UpstreamError),
+  session: Schema_exports.optional(Schema_exports.Literal(true))
+}) {
+};
+var McpCredentialsUnverified = class extends Schema_exports.TaggedError()(
+  "McpCredentialsUnverified",
+  { anonymous: Schema_exports.Union([Schema_exports.Literal("answered"), McpError2, ProviderError]) }
+) {
+};
+var ProcessConfig = Schema_exports.Struct({
+  command: Schema_exports.NonEmptyString,
+  args: Schema_exports.Array(Schema_exports.String),
+  cwd: Schema_exports.optional(Schema_exports.String),
+  env: Schema_exports.Record(Schema_exports.String, Schema_exports.String),
+  timeoutMs: Schema_exports.Int.check(
+    Schema_exports.isBetween({ minimum: 1, maximum: defaultMcpClientLimits.maxTimeoutMs })
+  )
+});
+
+// src/contracts/webhook-protocol.ts
+var WebhookTransportLimits = Schema_exports.Struct({
+  maxBodyBytes: Schema_exports.Int.check(Schema_exports.isGreaterThan(0))
+});
+var defaultWebhookTransportLimits = WebhookTransportLimits.make({
+  maxBodyBytes: 1024 * 1024
+});
+var encodedBodyChars = 4 * Math.ceil(defaultWebhookTransportLimits.maxBodyBytes / 3);
+var WebhookRequestData = Schema_exports.Struct({
+  url: HttpUrl,
+  method: Schema_exports.Literals(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"]),
+  headers: Schema_exports.Record(Schema_exports.String, Schema_exports.String),
+  body: Schema_exports.String.check(Schema_exports.isMaxLength(encodedBodyChars))
+});
+var WebhookResponseData = Schema_exports.Struct({
+  status: Schema_exports.Int.check(Schema_exports.isBetween({ minimum: 200, maximum: 599 })),
+  headers: Schema_exports.Record(Schema_exports.String, Schema_exports.String),
+  body: Schema_exports.String.check(Schema_exports.isMaxLength(encodedBodyChars))
+});
+var ManualWebhookSetup = Schema_exports.Struct({
+  instructions: Schema_exports.NonEmptyString,
+  signingSecret: Schema_exports.Literals(["executor", "provider"])
+});
+var ManualWebhookDescriptor = Schema_exports.Struct({
+  ...ManualWebhookSetup.fields,
+  stateSchema: JsonObject2
+});
+var HostedWebhook = Schema_exports.Struct({
+  name: Schema_exports.NonEmptyString,
+  account: Schema_exports.NonEmptyString,
+  configSchema: JsonObject2,
+  setup: Schema_exports.optionalKey(ManualWebhookDescriptor)
+});
+var identity = {
   name: Schema_exports.NonEmptyString,
   subscriptionId: Schema_exports.NonEmptyString,
   sourceAccount: AccountId,
@@ -1798,6 +1981,52 @@ var WebhookCommand = Schema_exports.Union([
   })
 ]);
 
+// src/contracts/events.ts
+var EventName = Schema_exports.String.check(
+  Schema_exports.isPattern(/^[a-z][a-z0-9_]*(?:\.[a-z][a-z0-9_]*)*$/u),
+  Schema_exports.isMaxLength(64)
+);
+var EventFilterValue = Schema_exports.Union([Schema_exports.String, Schema_exports.Finite, Schema_exports.Boolean]);
+var EventLimits = Schema_exports.Struct({
+  /** An occurrence's `data`, leaving room under a 256 KiB delivery for its envelope. */
+  maxDataBytes: Schema_exports.Int.check(Schema_exports.isGreaterThan(0)),
+  maxEventsPerInvocation: Schema_exports.Int.check(Schema_exports.isGreaterThan(0)),
+  maxDescriptionLength: Schema_exports.Int.check(Schema_exports.isGreaterThan(0)),
+  maxIdLength: Schema_exports.Int.check(Schema_exports.isGreaterThan(0))
+});
+var defaultEventLimits = EventLimits.make({
+  maxDataBytes: 250 * 1024,
+  maxEventsPerInvocation: 100,
+  maxDescriptionLength: 1e3,
+  maxIdLength: 200
+});
+var DeclaredEvent = Schema_exports.Struct({
+  description: Schema_exports.String.check(
+    Schema_exports.isMinLength(1),
+    Schema_exports.isMaxLength(defaultEventLimits.maxDescriptionLength)
+  ),
+  /** An object of scalar fields. Subscribers may name any of them to narrow an event. */
+  filters: JsonObject2,
+  /** The shape of each occurrence's `data`. */
+  payload: JsonObject2
+});
+var DeclaredEvents = Schema_exports.Record(EventName, DeclaredEvent);
+var EmittedEvent = Schema_exports.Struct({
+  name: EventName,
+  id: Schema_exports.String.check(
+    Schema_exports.isMinLength(1),
+    Schema_exports.isMaxLength(defaultEventLimits.maxIdLength)
+  ),
+  /** Milliseconds since the epoch when the event happened. */
+  occurredAt: Schema_exports.Int.check(Schema_exports.isGreaterThanOrEqualTo(0)),
+  data: JsonValue,
+  filters: Schema_exports.Record(Schema_exports.String, EventFilterValue),
+  account: Schema_exports.NullOr(AccountId)
+});
+var EmittedEvents = Schema_exports.Array(EmittedEvent).check(
+  Schema_exports.isMaxLength(defaultEventLimits.maxEventsPerInvocation)
+);
+
 // src/contracts/provider.ts
 var SecretsMethod = class extends Data_exports.TaggedClass(
   "secrets"
@@ -1814,7 +2043,7 @@ var OAuthSecretClientAuth = Schema_exports.Literals([
   "client_secret_basic",
   "client_secret_basic_raw"
 ]);
-var reservedAuthorizationParams = /* @__PURE__ */ new Set([
+var reservedAuthorizationParams = [
   "response_type",
   "client_id",
   "redirect_uri",
@@ -1826,17 +2055,55 @@ var reservedAuthorizationParams = /* @__PURE__ */ new Set([
   "resource",
   "request",
   "request_uri"
-]);
+];
+var reserved = new Set(reservedAuthorizationParams);
 var OAuthAuthorizationParams = Schema_exports.Record(Schema_exports.String, Schema_exports.String).check(
-  Schema_exports.makeFilter(
-    (params) => Object.keys(params).every((key) => !reservedAuthorizationParams.has(key)),
-    {
-      message: "Authorization parameters cannot replace protocol parameters such as state or scope."
-    }
-  )
+  Schema_exports.makeFilter((params) => Object.keys(params).every((key) => !reserved.has(key)), {
+    message: "Authorization parameters cannot replace protocol parameters such as state or scope."
+  })
+);
+var declaredAuthorizationQuery = Schema_exports.makeFilter(
+  (config) => {
+    const keys = [...new URL(config.authorizationUrl).searchParams.keys()];
+    const owned = keys.filter((key) => reserved.has(key));
+    if (owned.length > 0)
+      return {
+        path: ["authorizationUrl"],
+        issue: `authorizationUrl cannot set protocol parameters: ${owned.join(", ")}.`
+      };
+    const repeated = keys.filter((key) => Object.hasOwn(config.authorizationParams ?? {}, key));
+    if (repeated.length > 0)
+      return {
+        path: ["authorizationParams"],
+        issue: `Declare each parameter once; authorizationUrl already sets: ${repeated.join(", ")}.`
+      };
+    return void 0;
+  }
 );
+var OAuthTokenRequestFormat = Schema_exports.Literals(["form", "json"]);
+var OAuthTokenResponse = Schema_exports.Struct({
+  path: Schema_exports.String.check(Schema_exports.isPattern(/^[^.]+(\.[^.]+)*$/))
+});
+var tokenRequestOptions = {
+  /** Joins requested scopes; Linear wants `","`. Defaults to RFC 6749's space. */
+  scopeSeparator: Schema_exports.optionalKey(Schema_exports.String.check(Schema_exports.isMinLength(1))),
+  /** Encoding of token requests. Defaults to `"form"`; Atlassian, ClickUp and Notion need `"json"`. */
+  tokenRequestFormat: Schema_exports.optionalKey(OAuthTokenRequestFormat)
+};
 var oauthOptions = {
+  ...tokenRequestOptions,
+  /**
+   * Read the grant from this nested member of the token response when the top-level response has
+   * no access token or no scope. Slack's user tokens use `{ path: "authed_user" }`.
+   */
+  tokenResponse: Schema_exports.optionalKey(OAuthTokenResponse),
   grant: Schema_exports.optionalKey(Schema_exports.Literal("authorization_code")),
+  /**
+   * Service-defined authorization request parameters, such as Google's
+   * `{ access_type: "offline", prompt: "consent" }`. Host-owned protocol parameters
+   * (`state`, `scope`, `redirect_uri`, PKCE and the others in `reservedAuthorizationParams`)
+   * are rejected. A discovered endpoint's own query parameter of the same name is replaced.
+   */
   authorizationParams: Schema_exports.optionalKey(OAuthAuthorizationParams),
   tokenEndpointAuthMethod: Schema_exports.optionalKey(OAuthClientAuth),
   /** Omitted uses discovery; null explicitly suppresses the resource parameter. */
@@ -1846,6 +2113,8 @@ var OAuth2Config = Schema_exports.Union([
   Schema_exports.Struct({
     ...oauthOptions,
     discover: HttpUrl,
+    /** Fetch this exact metadata document and verify its issuer against discovery. */
+    authorizationServerMetadataUrl: Schema_exports.optionalKey(HttpUrl),
     authorizationUrl: Schema_exports.optionalKey(Schema_exports.Never),
     tokenUrl: Schema_exports.optionalKey(Schema_exports.Never),
     revocationUrl: Schema_exports.optionalKey(Schema_exports.Never),
@@ -1853,21 +2122,26 @@ var OAuth2Config = Schema_exports.Union([
   }),
   Schema_exports.Struct({
     ...oauthOptions,
+    /** Its query is kept; it cannot set protocol parameters or repeat `authorizationParams`. */
     authorizationUrl: HttpUrl,
     tokenUrl: HttpUrl,
     revocationUrl: Schema_exports.optionalKey(HttpUrl),
     scopes: Schema_exports.Array(Schema_exports.String),
     /** RFC 8414 issuer identifier. Declared issuers are checked against the callback's `iss`. */
     issuer: Schema_exports.optionalKey(HttpUrl),
-    discover: Schema_exports.optionalKey(Schema_exports.Never)
-  }),
+    discover: Schema_exports.optionalKey(Schema_exports.Never),
+    authorizationServerMetadataUrl: Schema_exports.optionalKey(Schema_exports.Never)
+  }).check(declaredAuthorizationQuery),
   Schema_exports.Struct({
     grant: Schema_exports.Literal("client_credentials"),
     discover: HttpUrl,
+    /** Fetch this exact metadata document and verify its issuer against discovery. */
+    authorizationServerMetadataUrl: Schema_exports.optionalKey(HttpUrl),
     authorizationUrl: Schema_exports.optionalKey(Schema_exports.Never),
     tokenUrl: Schema_exports.optionalKey(Schema_exports.Never),
     revocationUrl: Schema_exports.optionalKey(Schema_exports.Never),
     scopes: Schema_exports.optionalKey(Schema_exports.Array(Schema_exports.String)),
+    ...tokenRequestOptions,
     tokenEndpointAuthMethod: OAuthSecretClientAuth,
     resource: Schema_exports.optionalKey(Schema_exports.NullOr(HttpUrl))
   }),
@@ -1876,10 +2150,12 @@ var OAuth2Config = Schema_exports.Union([
     tokenUrl: HttpUrl,
     revocationUrl: Schema_exports.optionalKey(HttpUrl),
     scopes: Schema_exports.Array(Schema_exports.String),
+    ...tokenRequestOptions,
     tokenEndpointAuthMethod: OAuthSecretClientAuth,
     resource: Schema_exports.optionalKey(Schema_exports.NullOr(HttpUrl)),
     authorizationUrl: Schema_exports.optionalKey(Schema_exports.Never),
-    discover: Schema_exports.optionalKey(Schema_exports.Never)
+    discover: Schema_exports.optionalKey(Schema_exports.Never),
+    authorizationServerMetadataUrl: Schema_exports.optionalKey(Schema_exports.Never)
   })
 ]);
 var OAuth2AccessToken = Schema_exports.Struct({ access_token: Schema_exports.String });
@@ -1887,6 +2163,16 @@ var OAuth2Method = class extends Data_exports.TaggedClass(
   "oauth2"
 ) {
 };
+var displayText = Schema_exports.String.check(Schema_exports.isMinLength(1), Schema_exports.isMaxLength(255));
+var AccountInfo = Schema_exports.Struct({
+  externalId: Schema_exports.optionalKey(displayText),
+  displayName: Schema_exports.optionalKey(displayText),
+  username: Schema_exports.optionalKey(displayText),
+  email: Schema_exports.optionalKey(displayText),
+  avatarUrl: Schema_exports.optionalKey(HttpUrl),
+  profileUrl: Schema_exports.optionalKey(HttpUrl)
+});
+var AccountCheckResult = Schema_exports.Struct({ accountInfo: Schema_exports.optionalKey(AccountInfo) });
 var Provider = class extends Data_exports.Class {
   /** Declare zero or more accounts from this provider without performing I/O. */
   many() {
@@ -1897,17 +2183,263 @@ var ManyAccounts = class extends Data_exports.TaggedClass("many") {
 };
 
 // src/contracts/protocol-version.ts
-var frameworkProtocol = 4;
+var frameworkProtocol = 11;
 
-// src/contracts/schedules.ts
-var minimumIntervalMilliseconds = 6e4;
-var count = Schema_exports.Int.check(Schema_exports.isGreaterThan(0));
-var absent = Schema_exports.optionalKey(Schema_exports.Never);
-var Interval = Schema_exports.Union([
-  Schema_exports.Struct({ seconds: count, minutes: absent, hours: absent }),
-  Schema_exports.Struct({ seconds: absent, minutes: count, hours: absent }),
-  Schema_exports.Struct({ seconds: absent, minutes: absent, hours: count })
+// src/contracts/protocols/oauth.ts
+var HttpUrl2 = Schema_exports.String.check(
+  Schema_exports.makeFilter((value) => {
+    try {
+      const url = new URL(value);
+      return url.protocol === "https:" || url.protocol === "http:";
+    } catch {
+      return false;
+    }
+  })
+);
+var OAuthClientAuth2 = Schema_exports.Literals([
+  "none",
+  "client_secret_post",
+  "client_secret_basic",
+  "client_secret_basic_raw"
+]);
+var OAuthSecretClientAuth2 = Schema_exports.Literals([
+  "client_secret_post",
+  "client_secret_basic",
+  "client_secret_basic_raw"
+]);
+var reservedAuthorizationParams2 = [
+  "response_type",
+  "client_id",
+  "redirect_uri",
+  "state",
+  "scope",
+  "code_challenge",
+  "code_challenge_method",
+  "nonce",
+  "resource",
+  "request",
+  "request_uri"
+];
+var reserved2 = new Set(reservedAuthorizationParams2);
+var OAuthAuthorizationParams2 = Schema_exports.Record(Schema_exports.String, Schema_exports.String).check(
+  Schema_exports.makeFilter((params) => Object.keys(params).every((key) => !reserved2.has(key)), {
+    message: "Authorization parameters cannot replace protocol parameters such as state or scope."
+  })
+);
+var declaredAuthorizationQuery2 = Schema_exports.makeFilter(
+  (config) => {
+    const keys = [...new URL(config.authorizationUrl).searchParams.keys()];
+    const owned = keys.filter((key) => reserved2.has(key));
+    if (owned.length > 0)
+      return {
+        path: ["authorizationUrl"],
+        issue: `authorizationUrl cannot set protocol parameters: ${owned.join(", ")}.`
+      };
+    const repeated = keys.filter((key) => Object.hasOwn(config.authorizationParams ?? {}, key));
+    if (repeated.length > 0)
+      return {
+        path: ["authorizationParams"],
+        issue: `Declare each parameter once; authorizationUrl already sets: ${repeated.join(", ")}.`
+      };
+    return void 0;
+  }
+);
+var OAuthTokenRequestFormat2 = Schema_exports.Literals(["form", "json"]);
+var OAuthTokenResponse2 = Schema_exports.Struct({
+  path: Schema_exports.String.check(Schema_exports.isPattern(/^[^.]+(\.[^.]+)*$/))
+});
+var tokenRequestOptions2 = {
+  /** Joins requested scopes; Linear wants `","`. Defaults to RFC 6749's space. */
+  scopeSeparator: Schema_exports.optionalKey(Schema_exports.String.check(Schema_exports.isMinLength(1))),
+  /** Encoding of token requests. Defaults to `"form"`; Atlassian, ClickUp and Notion need `"json"`. */
+  tokenRequestFormat: Schema_exports.optionalKey(OAuthTokenRequestFormat2)
+};
+var oauthOptions2 = {
+  ...tokenRequestOptions2,
+  /**
+   * Read the grant from this nested member of the token response when the top-level response has
+   * no access token or no scope. Slack's user tokens use `{ path: "authed_user" }`.
+   */
+  tokenResponse: Schema_exports.optionalKey(OAuthTokenResponse2),
+  grant: Schema_exports.optionalKey(Schema_exports.Literal("authorization_code")),
+  /**
+   * Service-defined authorization request parameters, such as Google's
+   * `{ access_type: "offline", prompt: "consent" }`. Host-owned protocol parameters
+   * (`state`, `scope`, `redirect_uri`, PKCE and the others in `reservedAuthorizationParams`)
+   * are rejected. A discovered endpoint's own query parameter of the same name is replaced.
+   */
+  authorizationParams: Schema_exports.optionalKey(OAuthAuthorizationParams2),
+  tokenEndpointAuthMethod: Schema_exports.optionalKey(OAuthClientAuth2),
+  /** Omitted uses discovery; null explicitly suppresses the resource parameter. */
+  resource: Schema_exports.optionalKey(Schema_exports.NullOr(HttpUrl2))
+};
+var OAuth2Config2 = Schema_exports.Union([
+  Schema_exports.Struct({
+    ...oauthOptions2,
+    discover: HttpUrl2,
+    authorizationUrl: Schema_exports.optionalKey(Schema_exports.Never),
+    tokenUrl: Schema_exports.optionalKey(Schema_exports.Never),
+    revocationUrl: Schema_exports.optionalKey(Schema_exports.Never),
+    scopes: Schema_exports.optionalKey(Schema_exports.Array(Schema_exports.String))
+  }),
+  Schema_exports.Struct({
+    ...oauthOptions2,
+    /** Its query is kept; it cannot set protocol parameters or repeat `authorizationParams`. */
+    authorizationUrl: HttpUrl2,
+    tokenUrl: HttpUrl2,
+    revocationUrl: Schema_exports.optionalKey(HttpUrl2),
+    scopes: Schema_exports.Array(Schema_exports.String),
+    /** RFC 8414 issuer identifier. Declared issuers are checked against the callback's `iss`. */
+    issuer: Schema_exports.optionalKey(HttpUrl2),
+    discover: Schema_exports.optionalKey(Schema_exports.Never)
+  }).check(declaredAuthorizationQuery2),
+  Schema_exports.Struct({
+    grant: Schema_exports.Literal("client_credentials"),
+    discover: HttpUrl2,
+    authorizationUrl: Schema_exports.optionalKey(Schema_exports.Never),
+    tokenUrl: Schema_exports.optionalKey(Schema_exports.Never),
+    revocationUrl: Schema_exports.optionalKey(Schema_exports.Never),
+    scopes: Schema_exports.optionalKey(Schema_exports.Array(Schema_exports.String)),
+    ...tokenRequestOptions2,
+    tokenEndpointAuthMethod: OAuthSecretClientAuth2,
+    resource: Schema_exports.optionalKey(Schema_exports.NullOr(HttpUrl2))
+  }),
+  Schema_exports.Struct({
+    grant: Schema_exports.Literal("client_credentials"),
+    tokenUrl: HttpUrl2,
+    revocationUrl: Schema_exports.optionalKey(HttpUrl2),
+    scopes: Schema_exports.Array(Schema_exports.String),
+    ...tokenRequestOptions2,
+    tokenEndpointAuthMethod: OAuthSecretClientAuth2,
+    resource: Schema_exports.optionalKey(Schema_exports.NullOr(HttpUrl2)),
+    authorizationUrl: Schema_exports.optionalKey(Schema_exports.Never),
+    discover: Schema_exports.optionalKey(Schema_exports.Never)
+  })
+]);
+
+// src/contracts/protocols/1.ts
+var JsonValue2 = Schema_exports.Json;
+var JsonObject3 = Schema_exports.Record(Schema_exports.String, JsonValue2);
+var AccountId2 = Schema_exports.String.pipe(
+  Schema_exports.check(Schema_exports.isStartingWith("acc_"), Schema_exports.isMinLength(5)),
+  Schema_exports.brand("acc")
+);
+var CacheError = class extends Schema_exports.TaggedError()("CacheError", {
+  reason: Schema_exports.Literals(["unavailable", "storage", "invalid", "capacity", "timeout"])
+}) {
+};
+var Key = Schema_exports.String.check(Schema_exports.isPattern(/^[a-f0-9]{64}$/));
+var Time = Schema_exports.Finite.check(Schema_exports.isGreaterThanOrEqualTo(0));
+var CacheEntry = Schema_exports.Struct({
+  value: Schema_exports.Json,
+  version: Schema_exports.String,
+  freshUntil: Time,
+  staleUntil: Time
+});
+var CacheCommand2 = Schema_exports.Union([
+  Schema_exports.Struct({ operation: Schema_exports.Literal("read"), keys: Schema_exports.Array(Key) }),
+  Schema_exports.Struct({
+    operation: Schema_exports.Literal("acquire"),
+    key: Key,
+    /** Claim even a fresh entry, as an explicit refresh does. */
+    refresh: Schema_exports.Boolean,
+    /** Claim only while the entry still has this version. Absent accepts the current one. */
+    version: Schema_exports.optionalKey(Schema_exports.NullOr(Schema_exports.String))
+  }),
+  Schema_exports.Struct({
+    operation: Schema_exports.Literal("claim"),
+    key: Key,
+    version: Schema_exports.NullOr(Schema_exports.String)
+  }),
+  Schema_exports.Struct({
+    operation: Schema_exports.Literal("publish"),
+    key: Key,
+    lease: Schema_exports.String,
+    entry: CacheEntry
+  }),
+  Schema_exports.Struct({ operation: Schema_exports.Literal("release"), key: Key, lease: Schema_exports.String }),
+  /** Extend a lease its holder still owns. Replies false once the lease lapsed or was replaced. */
+  Schema_exports.Struct({ operation: Schema_exports.Literal("renew"), key: Key, lease: Schema_exports.String }),
+  Schema_exports.Struct({
+    operation: Schema_exports.Literal("write"),
+    entries: Schema_exports.Array(Schema_exports.Struct({ key: Key, entry: CacheEntry }))
+  }),
+  Schema_exports.Struct({ operation: Schema_exports.Literal("invalidate"), key: Key })
+]);
+var CacheReply2 = Schema_exports.Union([
+  Schema_exports.Struct({ ok: Schema_exports.Literal(true), value: Schema_exports.Json }),
+  Schema_exports.Struct({ ok: Schema_exports.Literal(false), error: CacheError })
+]);
+var DataName2 = Schema_exports.String.check(
+  Schema_exports.makeFilter((value) => /^[A-Za-z][A-Za-z0-9_]*$/.test(value) && value.length <= 128)
+);
+var Scalar2 = Schema_exports.Union([Schema_exports.String, Schema_exports.Finite, Schema_exports.Boolean]);
+var Field2 = Schema_exports.Struct({
+  kind: Schema_exports.Literals(["string", "number", "boolean", "id", "userId"]),
+  optional: Schema_exports.optional(Schema_exports.Boolean),
+  default: Schema_exports.optional(Scalar2),
+  references: Schema_exports.optional(DataName2)
+});
+var Index2 = Schema_exports.Struct({ name: DataName2, fields: Schema_exports.NonEmptyArray(DataName2) });
+var Table2 = Schema_exports.Struct({
+  fields: Schema_exports.Record(DataName2, Field2),
+  indexes: Schema_exports.Array(Index2)
+});
+var DatabaseSchema2 = Schema_exports.Record(DataName2, Table2);
+var maxApiErrorInstructionsLength2 = 4096;
+var ApiErrorRecovery2 = Schema_exports.Struct({
+  action: Schema_exports.NonEmptyString.check(Schema_exports.isMaxLength(1024)),
+  instructions: Schema_exports.NonEmptyString.check(Schema_exports.isMaxLength(maxApiErrorInstructionsLength2))
+});
+var maxApiErrorMessageLength2 = 4096;
+var ApiErrorResponse2 = Schema_exports.Struct({
+  code: Schema_exports.NonEmptyString.check(Schema_exports.isMaxLength(128)),
+  status: Schema_exports.Int.check(Schema_exports.isBetween({ minimum: 400, maximum: 599 })),
+  message: Schema_exports.NonEmptyString.check(Schema_exports.isMaxLength(maxApiErrorMessageLength2)),
+  recovery: Schema_exports.optionalKey(ApiErrorRecovery2)
+});
+var OpenapiResponseError2 = class extends Schema_exports.TaggedError()(
+  "OpenapiResponseError",
+  ApiErrorResponse2.fields
+) {
+};
+var FormElicitation2 = Schema_exports.Struct({
+  ...ElicitRequestFormParams.fields,
+  mode: Schema_exports.Literal("form"),
+  requestedSchema: Schema_exports.toEncoded(ElicitRequestFormParams.fields.requestedSchema),
+  _meta: Schema_exports.optional(JsonObject3)
+});
+var ElicitationResponse2 = Schema_exports.Union([
+  Schema_exports.Struct({ ...ElicitAcceptResult.fields, _meta: Schema_exports.optional(JsonObject3) }),
+  Schema_exports.Struct({ ...ElicitDeclineResult.fields, _meta: Schema_exports.optional(JsonObject3) })
+]);
+var ElicitationFailed2 = class extends Schema_exports.TaggedError()(
+  "ElicitationFailed",
+  {
+    reason: Schema_exports.Literals([
+      "unavailable",
+      "transaction",
+      "invalid-request",
+      "invalid-response",
+      "transport",
+      "expired",
+      "forbidden"
+    ])
+  }
+) {
+};
+var ElicitationReply2 = Schema_exports.Union([
+  Schema_exports.Struct({ ok: Schema_exports.Literal(true), response: ElicitationResponse2 }),
+  Schema_exports.Struct({ ok: Schema_exports.Literal(false), error: ElicitationFailed2 })
 ]);
+var ApprovalElicitation2 = Schema_exports.Struct({
+  ...FormElicitation2.fields,
+  requestedSchema: Schema_exports.Struct({
+    type: Schema_exports.Literal("object"),
+    properties: Schema_exports.Record(Schema_exports.String, Schema_exports.Never)
+  })
+});
+var minimumIntervalMilliseconds = 6e4;
 var CalendarSchedule = Schema_exports.Struct({
   expression: Schema_exports.NonEmptyString,
   timezone: Schema_exports.NonEmptyString
@@ -1931,62 +2463,282 @@ var ScheduleTiming = Schema_exports.Union([
 var OperationSchedule = Schema_exports.Struct({
   name: Schema_exports.NonEmptyString,
   timing: ScheduleTiming,
-  input: JsonValue
+  input: JsonValue2
 });
-
-// src/contracts/protocols/1.ts
-var WorkflowFailure2 = class extends Schema_exports.TaggedError()("WorkflowFailure", {
-  reason: Schema_exports.Literals([
-    "unavailable",
-    "not_found",
-    "input",
-    "output",
-    "operation",
-    "approval",
-    "credentials",
-    "terminated",
-    "execution",
-    "conflict",
-    "engine"
-  ]),
-  retryable: Schema_exports.Boolean
-}) {
+var SkillFilePath = Schema_exports.NonEmptyString.check(
+  Schema_exports.makeFilter(
+    (path) => !path.startsWith("/") && !path.includes("\\") && !path.includes("\0") && path.split("/").every((part) => part !== "" && part !== "." && part !== "..")
+  )
+);
+var SkillFile = Schema_exports.Struct({ path: SkillFilePath, content: Schema_exports.String });
+var skillFormatLimits = {
+  nameCharacters: 64,
+  descriptionCharacters: 1024,
+  compatibilityCharacters: 500
 };
-var WorkflowRpcResult2 = Schema_exports.Union([
-  Schema_exports.Struct({ ok: Schema_exports.Literal(true), value: JsonValue }),
-  Schema_exports.Struct({ ok: Schema_exports.Literal(false), error: WorkflowFailure2 })
-]);
-var DeclaredAuthMethod = Schema_exports.Union([
-  Schema_exports.Struct({ type: Schema_exports.Literal("secrets"), label: Schema_exports.String, fields: JsonObject2 }),
-  Schema_exports.Struct({
-    type: Schema_exports.Literal("oauth2"),
-    ...OAuth2Config.members[0].fields,
-    response: JsonObject2
-  }),
-  Schema_exports.Struct({
-    type: Schema_exports.Literal("oauth2"),
-    ...OAuth2Config.members[1].fields,
-    response: JsonObject2
-  }),
-  Schema_exports.Struct({
-    type: Schema_exports.Literal("oauth2"),
-    ...OAuth2Config.members[2].fields,
-    response: JsonObject2
-  }),
-  Schema_exports.Struct({
-    type: Schema_exports.Literal("oauth2"),
-    ...OAuth2Config.members[3].fields,
-    response: JsonObject2
-  })
-]);
-var DeclaredProvider = Schema_exports.Struct({
-  name: Schema_exports.NonEmptyString,
-  auth: Schema_exports.Record(Schema_exports.NonEmptyString, DeclaredAuthMethod)
+var AppSkillName2 = Schema_exports.NonEmptyString.check(
+  Schema_exports.makeFilter(
+    (value) => value === value.toLowerCase() && /^[\p{L}\p{N}]+(?:-[\p{L}\p{N}]+)*$/u.test(value) && [...value].length <= skillFormatLimits.nameCharacters
+  )
+);
+var AppSkillMetadata = Schema_exports.Struct({
+  name: AppSkillName2,
+  description: Schema_exports.String.check(
+    Schema_exports.makeFilter(
+      (value) => value.trim().length > 0 && [...value].length <= skillFormatLimits.descriptionCharacters
+    )
+  ),
+  license: Schema_exports.optionalKey(Schema_exports.String),
+  compatibility: Schema_exports.optionalKey(
+    Schema_exports.String.check(
+      Schema_exports.makeFilter(
+        (value) => value.trim().length > 0 && [...value].length <= skillFormatLimits.compatibilityCharacters
+      )
+    )
+  ),
+  metadata: Schema_exports.optionalKey(Schema_exports.Record(Schema_exports.String, Schema_exports.String)),
+  "allowed-tools": Schema_exports.optionalKey(Schema_exports.String)
 });
-var DeclaredRequirements = Schema_exports.Struct({
-  /** Protocol support of this retained framework build, not an author-declared requirement. */
-  capabilities: Schema_exports.optionalKey(
-    Schema_exports.Struct({
+var AppSkillSource = Schema_exports.Struct({
+  ...AppSkillMetadata.fields,
+  files: Schema_exports.Array(SkillFile).check(
+    Schema_exports.makeFilter(
+      (files) => files.some((file) => file.path === "SKILL.md") && new Set(files.map((file) => file.path)).size === files.length
+    )
+  )
+});
+var AppSkills2 = Schema_exports.Array(AppSkillSource).check(
+  Schema_exports.makeFilter((skills) => new Set(skills.map((skill) => skill.name)).size === skills.length)
+);
+var ToolAnnotations3 = Schema_exports.Struct({
+  title: Schema_exports.optionalKey(Schema_exports.String),
+  readOnlyHint: Schema_exports.optionalKey(Schema_exports.Boolean),
+  destructiveHint: Schema_exports.optionalKey(Schema_exports.Boolean),
+  idempotentHint: Schema_exports.optionalKey(Schema_exports.Boolean),
+  openWorldHint: Schema_exports.optionalKey(Schema_exports.Boolean)
+});
+var WebhookTransportLimits2 = Schema_exports.Struct({
+  maxBodyBytes: Schema_exports.Int.check(Schema_exports.isGreaterThan(0))
+});
+var defaultWebhookTransportLimits2 = WebhookTransportLimits2.make({
+  maxBodyBytes: 1024 * 1024
+});
+var encodedBodyChars2 = 4 * Math.ceil(defaultWebhookTransportLimits2.maxBodyBytes / 3);
+var WebhookRequestData2 = Schema_exports.Struct({
+  url: HttpUrl2,
+  method: Schema_exports.Literals(["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"]),
+  headers: Schema_exports.Record(Schema_exports.String, Schema_exports.String),
+  body: Schema_exports.String.check(Schema_exports.isMaxLength(encodedBodyChars2))
+});
+var identity2 = {
+  name: Schema_exports.NonEmptyString,
+  subscriptionId: Schema_exports.NonEmptyString,
+  sourceAccount: AccountId2,
+  callbackUrl: HttpUrl2,
+  secret: Schema_exports.String,
+  config: JsonValue2
+};
+var WebhookCommand2 = Schema_exports.Union([
+  Schema_exports.Struct({ operation: Schema_exports.Literal("webhooks") }),
+  Schema_exports.Struct({ operation: Schema_exports.Literal("webhook-validate"), ...identity2 }),
+  Schema_exports.Struct({ operation: Schema_exports.Literal("webhook-complete"), ...identity2, state: JsonValue2 }),
+  Schema_exports.Struct({ operation: Schema_exports.Literal("webhook-register"), ...identity2 }),
+  Schema_exports.Struct({ operation: Schema_exports.Literal("webhook-unregister"), ...identity2, state: JsonValue2 }),
+  Schema_exports.Struct({
+    operation: Schema_exports.Literal("webhook-handle"),
+    ...identity2,
+    state: JsonValue2,
+    request: WebhookRequestData2
+  })
+]);
+var WorkflowRunId2 = Schema_exports.NonEmptyString.pipe(Schema_exports.brand("wfr"));
+var WorkflowName2 = Schema_exports.NonEmptyString.check(Schema_exports.isMaxLength(200));
+var durationUnits2 = {
+  millisecond: 1,
+  milliseconds: 1,
+  second: 1e3,
+  seconds: 1e3,
+  minute: 6e4,
+  minutes: 6e4,
+  hour: 36e5,
+  hours: 36e5,
+  day: 864e5,
+  days: 864e5,
+  week: 6048e5,
+  weeks: 6048e5
+};
+var workflowDurationMillis2 = (value) => {
+  if (typeof value === "number") return Number.isFinite(value) && value >= 0 ? value : void 0;
+  const match = /^(\d+(?:\.\d+)?) (milliseconds?|seconds?|minutes?|hours?|days?|weeks?)$/.exec(
+    value
+  );
+  const unit = match?.[2] === void 0 ? void 0 : durationUnits2[match[2]];
+  if (unit === void 0) return void 0;
+  const result = Number(match?.[1]) * unit;
+  return Number.isFinite(result) ? result : void 0;
+};
+var WorkflowDuration2 = Schema_exports.Union([
+  Schema_exports.Finite.check(Schema_exports.isGreaterThanOrEqualTo(0)),
+  Schema_exports.NonEmptyString
+]).check(Schema_exports.makeFilter((value) => workflowDurationMillis2(value) !== void 0));
+var WorkflowStepOptions2 = Schema_exports.Struct({
+  retries: Schema_exports.optionalKey(
+    Schema_exports.Struct({
+      limit: Schema_exports.Int.check(Schema_exports.isGreaterThanOrEqualTo(0)),
+      delay: WorkflowDuration2,
+      backoff: Schema_exports.optionalKey(Schema_exports.Literals(["constant", "linear", "exponential"]))
+    })
+  ),
+  timeout: Schema_exports.optionalKey(WorkflowDuration2)
+});
+var WorkflowValue2 = JsonValue2.check(
+  Schema_exports.makeFilter(
+    (value) => new TextEncoder().encode(JSON.stringify(value)).byteLength <= 1024 * 1024
+  )
+);
+var WorkflowReplay2 = Schema_exports.Struct({
+  key: Schema_exports.NonEmptyString,
+  fingerprint: Schema_exports.NonEmptyString
+});
+var WorkflowCommand2 = Schema_exports.Union([
+  Schema_exports.Struct({ operation: Schema_exports.Literal("workflows") }),
+  Schema_exports.Struct({
+    operation: Schema_exports.Literal("workflow-validate"),
+    name: WorkflowName2,
+    input: JsonValue2
+  }),
+  Schema_exports.Struct({
+    operation: Schema_exports.Literal("workflow-run"),
+    name: WorkflowName2,
+    input: JsonValue2
+  })
+]);
+var WorkflowRpcCommand2 = Schema_exports.Union([
+  Schema_exports.Struct({
+    operation: Schema_exports.Literal("do"),
+    name: WorkflowName2,
+    options: WorkflowStepOptions2
+  }),
+  Schema_exports.Struct({
+    operation: Schema_exports.Literal("sleep"),
+    name: WorkflowName2,
+    duration: WorkflowDuration2
+  }),
+  Schema_exports.Struct({
+    operation: Schema_exports.Literal("until"),
+    name: WorkflowName2,
+    timestamp: Schema_exports.Finite
+  }),
+  Schema_exports.Struct({ operation: Schema_exports.Literal("context") }),
+  Schema_exports.Struct({
+    operation: Schema_exports.Literal("invoke"),
+    kind: Schema_exports.Literals(["query", "mutation"]),
+    name: Schema_exports.NonEmptyString,
+    input: JsonValue2,
+    stepId: Schema_exports.NonEmptyString,
+    timeout: Schema_exports.Finite.check(Schema_exports.isGreaterThanOrEqualTo(0))
+  })
+]);
+var WorkflowControlCommand2 = Schema_exports.Union([
+  Schema_exports.Struct({
+    operation: Schema_exports.Literal("start"),
+    workflow: WorkflowName2,
+    input: WorkflowValue2,
+    key: Schema_exports.optionalKey(Schema_exports.NonEmptyString.check(Schema_exports.isMaxLength(128)))
+  }),
+  Schema_exports.Struct({ operation: Schema_exports.Literal("get"), run: WorkflowRunId2 }),
+  Schema_exports.Struct({
+    operation: Schema_exports.Literal("list"),
+    workflow: Schema_exports.optionalKey(WorkflowName2),
+    cursor: Schema_exports.optionalKey(WorkflowRunId2),
+    limit: Schema_exports.optionalKey(Schema_exports.Int.check(Schema_exports.isBetween({ minimum: 1, maximum: 100 })))
+  }),
+  Schema_exports.Struct({ operation: Schema_exports.Literal("terminate"), run: WorkflowRunId2 })
+]);
+var ProviderError2 = class extends Schema_exports.TaggedError()("ProviderError", {
+  reason: Schema_exports.Literals(["unauthorized", "forbidden", "rate_limited", "unavailable", "rejected"]),
+  status: Schema_exports.optional(Schema_exports.Int.check(Schema_exports.isBetween({ minimum: 100, maximum: 599 }))),
+  accountId: Schema_exports.optional(AccountId2)
+}) {
+};
+var McpError3 = class extends Schema_exports.TaggedError()("McpError", {
+  phase: Schema_exports.Literals(["connect", "discover", "call", "schema", "transport"]),
+  reason: Schema_exports.Literals([
+    "request",
+    "unauthorized",
+    "invalid_response",
+    "timeout",
+    "invalid_input"
+  ]),
+  status: Schema_exports.optional(Schema_exports.Number)
+}) {
+};
+var SkillLoadFailed = class extends Schema_exports.TaggedError()("SkillLoadFailed", {
+  reason: Schema_exports.Literals([
+    "source",
+    "request",
+    "rate_limited",
+    "document",
+    "limit",
+    "changed",
+    "encoding"
+  ]),
+  message: Schema_exports.optional(Schema_exports.String.check(Schema_exports.isMaxLength(500))),
+  status: Schema_exports.optional(Schema_exports.Int.check(Schema_exports.isBetween({ minimum: 100, maximum: 599 })))
+}) {
+};
+var WorkflowFailure2 = class extends Schema_exports.TaggedError()("WorkflowFailure", {
+  reason: Schema_exports.Literals([
+    "unavailable",
+    "not_found",
+    "input",
+    "output",
+    "operation",
+    "approval",
+    "credentials",
+    "terminated",
+    "execution",
+    "conflict",
+    "engine"
+  ]),
+  retryable: Schema_exports.Boolean
+}) {
+};
+var WorkflowRpcResult2 = Schema_exports.Union([
+  Schema_exports.Struct({ ok: Schema_exports.Literal(true), value: JsonValue2 }),
+  Schema_exports.Struct({ ok: Schema_exports.Literal(false), error: WorkflowFailure2 })
+]);
+var DeclaredAuthMethod = Schema_exports.Union([
+  Schema_exports.Struct({ type: Schema_exports.Literal("secrets"), label: Schema_exports.String, fields: JsonObject3 }),
+  Schema_exports.Struct({
+    type: Schema_exports.Literal("oauth2"),
+    ...OAuth2Config2.members[0].fields,
+    response: JsonObject3
+  }),
+  Schema_exports.Struct({
+    type: Schema_exports.Literal("oauth2"),
+    ...OAuth2Config2.members[1].fields,
+    response: JsonObject3
+  }),
+  Schema_exports.Struct({
+    type: Schema_exports.Literal("oauth2"),
+    ...OAuth2Config2.members[2].fields,
+    response: JsonObject3
+  }),
+  Schema_exports.Struct({
+    type: Schema_exports.Literal("oauth2"),
+    ...OAuth2Config2.members[3].fields,
+    response: JsonObject3
+  })
+]);
+var DeclaredProvider = Schema_exports.Struct({
+  name: Schema_exports.NonEmptyString,
+  auth: Schema_exports.Record(Schema_exports.NonEmptyString, DeclaredAuthMethod)
+});
+var DeclaredRequirements = Schema_exports.Struct({
+  /** Protocol support of this retained framework build, not an author-declared requirement. */
+  capabilities: Schema_exports.optionalKey(
+    Schema_exports.Struct({
       skills: Schema_exports.Literal(true),
       /** Accepts inspect detail and tools. Earlier builds reject both as excess fields. */
       toolIndex: Schema_exports.optionalKey(Schema_exports.Literal(true)),
@@ -1996,7 +2748,7 @@ var DeclaredRequirements = Schema_exports.Struct({
       scheduledTools: Schema_exports.optionalKey(Schema_exports.Literal(true))
     })
   ),
-  database: Schema_exports.optionalKey(DatabaseSchema),
+  database: Schema_exports.optionalKey(DatabaseSchema2),
   accounts: Schema_exports.Record(
     Schema_exports.NonEmptyString,
     Schema_exports.Struct({
@@ -2006,7 +2758,7 @@ var DeclaredRequirements = Schema_exports.Struct({
   )
 });
 var ResolvedAccount = Schema_exports.Struct({
-  id: AccountId,
+  id: AccountId2,
   provider: DeclaredProvider,
   method: Schema_exports.NonEmptyString,
   /**
@@ -2014,33 +2766,33 @@ var ResolvedAccount = Schema_exports.Struct({
    * send it since credential generations; `apps@0.0.1-beta.0` and `beta.1` ignore it.
    */
   generation: Schema_exports.optionalKey(Schema_exports.Int),
-  fields: JsonObject2
+  fields: JsonObject3
 });
 var ResolvedAccounts = Schema_exports.Record(
   Schema_exports.NonEmptyString,
   Schema_exports.Union([ResolvedAccount, Schema_exports.Array(ResolvedAccount)])
 );
-var TrustedToolApproval = Schema_exports.Struct({ tool: Schema_exports.NonEmptyString, input: JsonValue });
+var TrustedToolApproval = Schema_exports.Struct({ tool: Schema_exports.NonEmptyString, input: JsonValue2 });
 var InvocationDeadline = Schema_exports.Finite.check(Schema_exports.isGreaterThanOrEqualTo(0));
 var HostedTool = Schema_exports.Struct({
   schedules: Schema_exports.optionalKey(Schema_exports.Array(OperationSchedule)),
   name: Schema_exports.NonEmptyString,
   description: Schema_exports.String,
-  inputSchema: JsonObject2,
+  inputSchema: JsonObject3,
   readOnly: Schema_exports.optionalKey(Schema_exports.Boolean),
   title: Schema_exports.optionalKey(Schema_exports.String),
-  outputSchema: Schema_exports.optionalKey(JsonObject2),
-  annotations: Schema_exports.optionalKey(ToolAnnotations),
-  _meta: Schema_exports.optionalKey(JsonObject2)
+  outputSchema: Schema_exports.optionalKey(JsonObject3),
+  annotations: Schema_exports.optionalKey(ToolAnnotations3),
+  _meta: Schema_exports.optionalKey(JsonObject3)
 });
 var HostedToolSummary = HostedTool.mapFields(
   ({ inputSchema: _input, outputSchema: _output, _meta, ...fields }) => fields
 );
-var SkillSources = Schema_exports.Struct({ skills: AppSkills, dynamic: Schema_exports.Boolean });
-var SkillCatalogResponse = Schema_exports.Union([SkillSources, AppSkills]);
+var SkillSources = Schema_exports.Struct({ skills: AppSkills2, dynamic: Schema_exports.Boolean });
+var SkillCatalogResponse = Schema_exports.Union([SkillSources, AppSkills2]);
 var HostRequest = Schema_exports.Union([
-  WorkflowCommand,
-  WebhookCommand,
+  WorkflowCommand2,
+  WebhookCommand2,
   Schema_exports.Struct({ operation: Schema_exports.Literal("requirements") }),
   Schema_exports.Struct({
     operation: Schema_exports.Literal("inspect"),
@@ -2062,17 +2814,17 @@ var HostRequest = Schema_exports.Union([
   Schema_exports.Struct({
     operation: Schema_exports.Literal("query"),
     name: Schema_exports.NonEmptyString,
-    input: JsonValue
+    input: JsonValue2
   }),
   Schema_exports.Struct({
     operation: Schema_exports.Literal("mutate"),
     name: Schema_exports.NonEmptyString,
-    input: JsonValue
+    input: JsonValue2
   }),
   Schema_exports.Struct({
     operation: Schema_exports.Literal("call"),
     tool: Schema_exports.NonEmptyString,
-    input: JsonValue
+    input: JsonValue2
   })
 ]);
 var HostRequestInvalid = class extends Schema_exports.TaggedError()(
@@ -2122,7 +2874,7 @@ var HostToolBlocked = class extends Schema_exports.TaggedError()("HostToolBlocke
 };
 var HostToolApprovalRequired = class extends Schema_exports.TaggedError()(
   "HostToolApprovalRequired",
-  { input: JsonValue, elicitation: ApprovalElicitation }
+  { input: JsonValue2, elicitation: ApprovalElicitation2 }
 ) {
 };
 var HostToolPolicyFailed = class extends Schema_exports.TaggedError()(
@@ -2136,9 +2888,9 @@ var HostOutputInvalid = class extends Schema_exports.TaggedError()(
 ) {
 };
 var HostError = Schema_exports.Union([
-  OpenapiResponseError,
-  ProviderError,
-  McpError,
+  OpenapiResponseError2,
+  ProviderError2,
+  McpError3,
   SkillLoadFailed,
   WorkflowFailure2,
   HostRequestInvalid,
@@ -2153,12 +2905,12 @@ var HostError = Schema_exports.Union([
   HostToolBlocked,
   HostToolApprovalRequired,
   HostToolPolicyFailed,
-  ElicitationFailed
+  ElicitationFailed2
 ]);
 var HostResponse = Schema_exports.Union([
   Schema_exports.Struct({
     ok: Schema_exports.Literal(true),
-    value: JsonValue,
+    value: JsonValue2,
     toolError: Schema_exports.optionalKey(Schema_exports.Literal(true))
   }),
   Schema_exports.Struct({ ok: Schema_exports.Literal(false), error: HostError })
@@ -2167,9 +2919,9 @@ var HostInvocation = Schema_exports.Struct({
   command: HostRequest,
   accounts: ResolvedAccounts,
   approval: Schema_exports.optionalKey(TrustedToolApproval),
-  replay: Schema_exports.optionalKey(WorkflowReplay),
+  replay: Schema_exports.optionalKey(WorkflowReplay2),
   deadline: Schema_exports.optionalKey(InvocationDeadline),
-  workflowRun: Schema_exports.optionalKey(WorkflowRunId)
+  workflowRun: Schema_exports.optionalKey(WorkflowRunId2)
 });
 var protocol1 = {
   version: 1,
@@ -2181,97 +2933,964 @@ var protocol1 = {
     tools: Schema_exports.Array(HostedTool),
     toolSummaries: Schema_exports.Array(HostedToolSummary),
     skills: SkillCatalogResponse,
-    elicitationRequest: FormElicitation,
-    elicitationReply: ElicitationReply,
-    workflowStep: WorkflowRpcCommand,
+    elicitationRequest: FormElicitation2,
+    elicitationReply: ElicitationReply2,
+    workflowStep: WorkflowRpcCommand2,
     workflowStepReply: WorkflowRpcResult2,
-    workflowControl: WorkflowControlCommand,
-    cacheCommand: CacheCommand,
-    cacheReply: CacheReply
+    workflowControl: WorkflowControlCommand2,
+    cacheCommand: CacheCommand2,
+    cacheReply: CacheReply2
   }
 };
 
 // src/contracts/protocols/2.ts
 var SkillSources2 = Schema_exports.Struct({
-  skills: AppSkills,
+  skills: AppSkills2,
   dynamic: Schema_exports.Boolean,
   cached: Schema_exports.optionalKey(Schema_exports.Boolean)
 });
-var SkillCatalogResponse2 = Schema_exports.Union([SkillSources2, AppSkills]);
+var SkillCatalogResponse2 = Schema_exports.Union([SkillSources2, AppSkills2]);
 var protocol2 = {
   version: 2,
   schemas: { ...protocol1.schemas, skills: SkillCatalogResponse2 }
 };
 
 // src/contracts/protocols/3.ts
+var maxFailureMessageLength = 2048;
+var FailureSource = Schema_exports.Literals(["app", "storage", "service"]);
+var FailureName2 = Schema_exports.String.check(Schema_exports.isMaxLength(128));
+var FailureCode = Schema_exports.String.check(Schema_exports.isMaxLength(128));
+var FailureMessage2 = Schema_exports.String.check(Schema_exports.isMaxLength(maxFailureMessageLength));
+var WorkflowFailureDetail2 = {
+  step: Schema_exports.optionalKey(Schema_exports.String.check(Schema_exports.isMaxLength(200))),
+  errorName: Schema_exports.optionalKey(FailureName2),
+  message: Schema_exports.optionalKey(FailureMessage2)
+};
+var WorkflowFailure3 = class extends Schema_exports.TaggedError()("WorkflowFailure", {
+  ...WorkflowFailureDetail2,
+  reason: Schema_exports.Literals([
+    "unavailable",
+    "not_found",
+    "input",
+    "output",
+    "operation",
+    "approval",
+    "credentials",
+    "terminated",
+    "execution",
+    "conflict",
+    "engine"
+  ]),
+  retryable: Schema_exports.Boolean
+}) {
+};
+var WorkflowRpcResult3 = Schema_exports.Union([
+  Schema_exports.Struct({ ok: Schema_exports.Literal(true), value: JsonValue2 }),
+  Schema_exports.Struct({ ok: Schema_exports.Literal(false), error: WorkflowFailure3 })
+]);
+var DatabaseLimit2 = Schema_exports.Literals([
+  "scanCalls",
+  "directGets",
+  "rowsRead",
+  "rowsReturned",
+  "pageSize",
+  "bytesRead",
+  "writes",
+  "valueBytes"
+]);
+var DatabaseLimitExceeded2 = class extends Schema_exports.TaggedError()(
+  "DatabaseLimitExceeded",
+  {
+    limit: DatabaseLimit2,
+    maximum: Schema_exports.Int,
+    requested: Schema_exports.Int
+  }
+) {
+};
+var reservedFieldNames2 = ["id", "createdAt", "updatedAt"];
+var DatabaseFieldReserved2 = class extends Schema_exports.TaggedError()(
+  "DatabaseFieldReserved",
+  {
+    table: Schema_exports.String,
+    field: Schema_exports.Literals(reservedFieldNames2)
+  }
+) {
+};
+var FailureDetail2 = {
+  source: Schema_exports.optionalKey(FailureSource),
+  errorName: Schema_exports.optionalKey(FailureName2),
+  code: Schema_exports.optionalKey(FailureCode),
+  message: Schema_exports.optionalKey(FailureMessage2)
+};
 var HostDeclarationInvalid2 = class extends Schema_exports.TaggedError()(
   "HostDeclarationInvalid",
-  FailureDetail
+  FailureDetail2
 ) {
 };
 var HostEvaluationFailed2 = class extends Schema_exports.TaggedError()(
   "HostEvaluationFailed",
-  FailureDetail
+  FailureDetail2
 ) {
 };
 var HostOperationFailed2 = class extends Schema_exports.TaggedError()(
   "HostOperationFailed",
-  FailureDetail
+  FailureDetail2
 ) {
 };
-var HostError2 = Schema_exports.Union([
-  OpenapiResponseError,
-  ProviderError,
-  McpError,
-  SkillLoadFailed,
-  WorkflowFailure,
-  HostRequestInvalid,
-  HostAccountsInvalid,
-  HostDeclarationInvalid2,
-  HostEvaluationFailed2,
-  HostOperationNotFound,
-  HostOperationFailed2,
-  DatabaseLimitExceeded,
-  DatabaseFieldReserved,
-  HostToolNotFound,
-  HostInputInvalid,
-  HostOutputInvalid,
-  HostToolBlocked,
-  HostToolApprovalRequired,
-  HostToolPolicyFailed,
-  ElicitationFailed
-]);
-var HostResponse2 = Schema_exports.Union([
+var HostError2 = Schema_exports.Union([
+  OpenapiResponseError2,
+  ProviderError2,
+  McpError3,
+  SkillLoadFailed,
+  WorkflowFailure3,
+  HostRequestInvalid,
+  HostAccountsInvalid,
+  HostDeclarationInvalid2,
+  HostEvaluationFailed2,
+  HostOperationNotFound,
+  HostOperationFailed2,
+  DatabaseLimitExceeded2,
+  DatabaseFieldReserved2,
+  HostToolNotFound,
+  HostInputInvalid,
+  HostOutputInvalid,
+  HostToolBlocked,
+  HostToolApprovalRequired,
+  HostToolPolicyFailed,
+  ElicitationFailed2
+]);
+var HostResponse2 = Schema_exports.Union([
+  Schema_exports.Struct({
+    ok: Schema_exports.Literal(true),
+    value: JsonValue2,
+    toolError: Schema_exports.optionalKey(Schema_exports.Literal(true))
+  }),
+  Schema_exports.Struct({ ok: Schema_exports.Literal(false), error: HostError2 })
+]);
+var protocol3 = {
+  version: 3,
+  schemas: {
+    invocation: HostInvocation,
+    request: HostRequest,
+    response: HostResponse2,
+    requirements: DeclaredRequirements,
+    tools: protocol1.schemas.tools,
+    toolSummaries: protocol1.schemas.toolSummaries,
+    skills: SkillCatalogResponse2,
+    elicitationRequest: FormElicitation2,
+    elicitationReply: ElicitationReply2,
+    workflowStep: WorkflowRpcCommand2,
+    workflowStepReply: WorkflowRpcResult3,
+    workflowControl: WorkflowControlCommand2,
+    cacheCommand: CacheCommand2,
+    cacheReply: CacheReply2
+  }
+};
+
+// src/contracts/protocols/4.ts
+var RouterIcon2 = Schema_exports.Struct({
+  src: Schema_exports.NonEmptyString,
+  mimeType: Schema_exports.optionalKey(Schema_exports.String),
+  sizes: Schema_exports.optionalKey(Schema_exports.Array(Schema_exports.String)),
+  theme: Schema_exports.optionalKey(Schema_exports.Literals(["light", "dark"]))
+});
+var HostedTool2 = Schema_exports.Struct({
+  schedules: Schema_exports.optionalKey(Schema_exports.Array(OperationSchedule)),
+  name: Schema_exports.NonEmptyString,
+  router: Schema_exports.optionalKey(Schema_exports.NonEmptyString),
+  tags: Schema_exports.optionalKey(Schema_exports.Array(Schema_exports.NonEmptyString)),
+  description: Schema_exports.String,
+  inputSchema: JsonObject3,
+  readOnly: Schema_exports.optionalKey(Schema_exports.Boolean),
+  title: Schema_exports.optionalKey(Schema_exports.String),
+  outputSchema: Schema_exports.optionalKey(JsonObject3),
+  annotations: Schema_exports.optionalKey(ToolAnnotations3),
+  _meta: Schema_exports.optionalKey(JsonObject3)
+});
+var HostedToolSummary2 = HostedTool2.mapFields(
+  ({ inputSchema: _input, outputSchema: _output, _meta, ...fields }) => fields
+);
+var HostRouterError = Schema_exports.Union([
+  ProviderError2,
+  McpError3,
+  SkillLoadFailed,
+  HostDeclarationInvalid2,
+  HostEvaluationFailed2
+]);
+var HostedRouter = Schema_exports.Struct({
+  path: Schema_exports.String,
+  title: Schema_exports.optionalKey(Schema_exports.String),
+  description: Schema_exports.optionalKey(Schema_exports.String),
+  icons: Schema_exports.optionalKey(Schema_exports.Array(RouterIcon2)),
+  tags: Schema_exports.optionalKey(Schema_exports.Record(Schema_exports.NonEmptyString, Schema_exports.String)),
+  skill: Schema_exports.optionalKey(AppSkillName2),
+  error: Schema_exports.optionalKey(HostRouterError)
+});
+var HostedCatalog = Schema_exports.Struct({
+  tools: Schema_exports.Array(HostedTool2),
+  routers: Schema_exports.Array(HostedRouter)
+});
+var HostedCatalogSummary = Schema_exports.Struct({
+  tools: Schema_exports.Array(HostedToolSummary2),
+  routers: Schema_exports.Array(HostedRouter)
+});
+var ToolKind = Schema_exports.Literals(["query", "mutation"]);
+var HostRequest2 = Schema_exports.Union([
+  WorkflowCommand2,
+  WebhookCommand2,
+  Schema_exports.Struct({ operation: Schema_exports.Literal("requirements") }),
+  Schema_exports.Struct({
+    operation: Schema_exports.Literal("inspect"),
+    /** Omit schemas. Only builds that declare the toolIndex capability accept this. */
+    detail: Schema_exports.optionalKey(Schema_exports.Literal("summary")),
+    /** Describe only these tools. Only builds that declare the toolIndex capability accept this. */
+    tools: Schema_exports.optionalKey(Schema_exports.Array(Schema_exports.NonEmptyString)),
+    /**
+     * Describe only declared operations that have schedules, without dynamic tool discovery.
+     * Only builds that declare the scheduledTools capability accept this.
+     */
+    scheduled: Schema_exports.optionalKey(Schema_exports.Literal(true))
+  }),
+  Schema_exports.Struct({
+    operation: Schema_exports.Literal("skills"),
+    /** Answer with SkillSources. Only builds that declare the skillSources capability accept this. */
+    sources: Schema_exports.optionalKey(Schema_exports.Literal(true))
+  }),
+  Schema_exports.Struct({
+    operation: Schema_exports.Literal("query"),
+    name: Schema_exports.NonEmptyString,
+    input: JsonValue2
+  }),
+  Schema_exports.Struct({
+    operation: Schema_exports.Literal("mutate"),
+    name: Schema_exports.NonEmptyString,
+    input: JsonValue2
+  }),
+  Schema_exports.Struct({
+    operation: Schema_exports.Literal("call"),
+    tool: Schema_exports.NonEmptyString,
+    /**
+     * The caller's claim; the bundle rejects a call whose tool has the other kind. The host omits
+     * it for a tool its catalog does not list, and then opens storage for writing.
+     */
+    kind: Schema_exports.optionalKey(ToolKind),
+    input: JsonValue2
+  })
+]);
+var HostKindMismatch = class extends Schema_exports.TaggedError()("HostKindMismatch", {
+  tool: Schema_exports.NonEmptyString,
+  requested: ToolKind,
+  actual: ToolKind
+}) {
+};
+var HostError3 = Schema_exports.Union([...HostError2.members, HostKindMismatch]);
+var HostResponse3 = Schema_exports.Union([
+  Schema_exports.Struct({
+    ok: Schema_exports.Literal(true),
+    value: JsonValue2,
+    toolError: Schema_exports.optionalKey(Schema_exports.Literal(true))
+  }),
+  Schema_exports.Struct({ ok: Schema_exports.Literal(false), error: HostError3 })
+]);
+var HostInvocation2 = Schema_exports.Struct({
+  command: HostRequest2,
+  accounts: ResolvedAccounts,
+  approval: Schema_exports.optionalKey(TrustedToolApproval),
+  replay: Schema_exports.optionalKey(WorkflowReplay2),
+  deadline: Schema_exports.optionalKey(InvocationDeadline),
+  workflowRun: Schema_exports.optionalKey(WorkflowRunId2)
+});
+var protocol4 = {
+  version: 4,
+  schemas: {
+    invocation: HostInvocation2,
+    request: HostRequest2,
+    response: HostResponse3,
+    requirements: protocol3.schemas.requirements,
+    catalog: HostedCatalog,
+    catalogSummary: HostedCatalogSummary,
+    skills: protocol3.schemas.skills,
+    elicitationRequest: protocol3.schemas.elicitationRequest,
+    elicitationReply: protocol3.schemas.elicitationReply,
+    workflowStep: protocol3.schemas.workflowStep,
+    workflowStepReply: protocol3.schemas.workflowStepReply,
+    workflowControl: protocol3.schemas.workflowControl,
+    cacheCommand: protocol3.schemas.cacheCommand,
+    cacheReply: protocol3.schemas.cacheReply
+  }
+};
+
+// src/contracts/protocols/5.ts
+var displayText2 = Schema_exports.String.check(Schema_exports.isMinLength(1), Schema_exports.isMaxLength(255));
+var AccountInfo2 = Schema_exports.Struct({
+  externalId: Schema_exports.optionalKey(displayText2),
+  displayName: Schema_exports.optionalKey(displayText2),
+  username: Schema_exports.optionalKey(displayText2),
+  email: Schema_exports.optionalKey(displayText2),
+  avatarUrl: Schema_exports.optionalKey(HttpUrl2),
+  profileUrl: Schema_exports.optionalKey(HttpUrl2)
+});
+var AccountCheckResult2 = Schema_exports.Struct({ accountInfo: Schema_exports.optionalKey(AccountInfo2) });
+var DeclaredRequirements2 = Schema_exports.Struct({
+  /** Protocol support of this retained framework build, not an author-declared requirement. */
+  capabilities: Schema_exports.optionalKey(
+    Schema_exports.Struct({
+      skills: Schema_exports.Literal(true),
+      toolIndex: Schema_exports.optionalKey(Schema_exports.Literal(true)),
+      skillSources: Schema_exports.optionalKey(Schema_exports.Literal(true)),
+      scheduledTools: Schema_exports.optionalKey(Schema_exports.Literal(true))
+    })
+  ),
+  database: Schema_exports.optionalKey(DatabaseSchema2),
+  accounts: Schema_exports.Record(
+    Schema_exports.NonEmptyString,
+    Schema_exports.Struct({
+      definition: DeclaredProvider,
+      cardinality: Schema_exports.Literals(["one", "many"]),
+      /**
+       * The slot's provider defines an account check. Kept beside the definition, not in it, so
+       * adding or editing a check never changes the provider's identity.
+       */
+      health: Schema_exports.optionalKey(Schema_exports.Literal(true))
+    })
+  )
+});
+var AccountCheckCommand = Schema_exports.Struct({
+  operation: Schema_exports.Literal("account-check"),
+  requirement: Schema_exports.NonEmptyString
+});
+var HostRequest3 = Schema_exports.Union([
+  ...protocol4.schemas.request.members,
+  AccountCheckCommand
+]);
+var HostInvocation3 = Schema_exports.Struct({
+  command: HostRequest3,
+  accounts: ResolvedAccounts,
+  approval: Schema_exports.optionalKey(TrustedToolApproval),
+  replay: Schema_exports.optionalKey(WorkflowReplay2),
+  deadline: Schema_exports.optionalKey(InvocationDeadline),
+  workflowRun: Schema_exports.optionalKey(WorkflowRunId2)
+});
+var protocol5 = {
+  version: 5,
+  schemas: {
+    ...protocol4.schemas,
+    invocation: HostInvocation3,
+    request: HostRequest3,
+    requirements: DeclaredRequirements2,
+    accountCheck: AccountCheckResult2
+  }
+};
+
+// src/contracts/protocols/oauth-6.ts
+var OAuth2Config3 = Schema_exports.Union([
+  Schema_exports.Struct({
+    ...oauthOptions2,
+    discover: HttpUrl2,
+    /** Fetch this exact metadata document and verify its issuer against discovery. */
+    authorizationServerMetadataUrl: Schema_exports.optionalKey(HttpUrl2),
+    authorizationUrl: Schema_exports.optionalKey(Schema_exports.Never),
+    tokenUrl: Schema_exports.optionalKey(Schema_exports.Never),
+    revocationUrl: Schema_exports.optionalKey(Schema_exports.Never),
+    scopes: Schema_exports.optionalKey(Schema_exports.Array(Schema_exports.String))
+  }),
+  Schema_exports.Struct({
+    ...oauthOptions2,
+    /** Its query is kept; it cannot set protocol parameters or repeat `authorizationParams`. */
+    authorizationUrl: HttpUrl2,
+    tokenUrl: HttpUrl2,
+    revocationUrl: Schema_exports.optionalKey(HttpUrl2),
+    scopes: Schema_exports.Array(Schema_exports.String),
+    /** RFC 8414 issuer identifier. Declared issuers are checked against the callback's `iss`. */
+    issuer: Schema_exports.optionalKey(HttpUrl2),
+    discover: Schema_exports.optionalKey(Schema_exports.Never),
+    authorizationServerMetadataUrl: Schema_exports.optionalKey(Schema_exports.Never)
+  }).check(declaredAuthorizationQuery2),
+  Schema_exports.Struct({
+    grant: Schema_exports.Literal("client_credentials"),
+    discover: HttpUrl2,
+    /** Fetch this exact metadata document and verify its issuer against discovery. */
+    authorizationServerMetadataUrl: Schema_exports.optionalKey(HttpUrl2),
+    authorizationUrl: Schema_exports.optionalKey(Schema_exports.Never),
+    tokenUrl: Schema_exports.optionalKey(Schema_exports.Never),
+    revocationUrl: Schema_exports.optionalKey(Schema_exports.Never),
+    scopes: Schema_exports.optionalKey(Schema_exports.Array(Schema_exports.String)),
+    ...tokenRequestOptions2,
+    tokenEndpointAuthMethod: OAuthSecretClientAuth2,
+    resource: Schema_exports.optionalKey(Schema_exports.NullOr(HttpUrl2))
+  }),
+  Schema_exports.Struct({
+    grant: Schema_exports.Literal("client_credentials"),
+    tokenUrl: HttpUrl2,
+    revocationUrl: Schema_exports.optionalKey(HttpUrl2),
+    scopes: Schema_exports.Array(Schema_exports.String),
+    ...tokenRequestOptions2,
+    tokenEndpointAuthMethod: OAuthSecretClientAuth2,
+    resource: Schema_exports.optionalKey(Schema_exports.NullOr(HttpUrl2)),
+    authorizationUrl: Schema_exports.optionalKey(Schema_exports.Never),
+    discover: Schema_exports.optionalKey(Schema_exports.Never),
+    authorizationServerMetadataUrl: Schema_exports.optionalKey(Schema_exports.Never)
+  })
+]);
+
+// src/contracts/protocols/6.ts
+var DeclaredAuthMethod2 = Schema_exports.Union([
+  Schema_exports.Struct({ type: Schema_exports.Literal("secrets"), label: Schema_exports.String, fields: JsonObject3 }),
+  Schema_exports.Struct({
+    type: Schema_exports.Literal("oauth2"),
+    ...OAuth2Config3.members[0].fields,
+    response: JsonObject3
+  }),
+  Schema_exports.Struct({
+    type: Schema_exports.Literal("oauth2"),
+    ...OAuth2Config3.members[1].fields,
+    response: JsonObject3
+  }),
+  Schema_exports.Struct({
+    type: Schema_exports.Literal("oauth2"),
+    ...OAuth2Config3.members[2].fields,
+    response: JsonObject3
+  }),
+  Schema_exports.Struct({
+    type: Schema_exports.Literal("oauth2"),
+    ...OAuth2Config3.members[3].fields,
+    response: JsonObject3
+  })
+]);
+var DeclaredProvider2 = Schema_exports.Struct({
+  name: Schema_exports.NonEmptyString,
+  auth: Schema_exports.Record(Schema_exports.NonEmptyString, DeclaredAuthMethod2)
+});
+var DeclaredRequirements3 = Schema_exports.Struct({
+  ...DeclaredRequirements2.fields,
+  accounts: Schema_exports.Record(
+    Schema_exports.NonEmptyString,
+    Schema_exports.Struct({
+      definition: DeclaredProvider2,
+      cardinality: Schema_exports.Literals(["one", "many"]),
+      health: Schema_exports.optionalKey(Schema_exports.Literal(true))
+    })
+  )
+});
+var ResolvedAccount2 = Schema_exports.Struct({
+  ...ResolvedAccount.fields,
+  provider: DeclaredProvider2
+});
+var ResolvedAccounts2 = Schema_exports.Record(
+  Schema_exports.NonEmptyString,
+  Schema_exports.Union([ResolvedAccount2, Schema_exports.Array(ResolvedAccount2)])
+);
+var HostInvocation4 = Schema_exports.Struct({
+  ...HostInvocation3.fields,
+  accounts: ResolvedAccounts2
+});
+var protocol6 = {
+  version: 6,
+  schemas: {
+    ...protocol5.schemas,
+    requirements: DeclaredRequirements3,
+    accounts: ResolvedAccounts2,
+    invocation: HostInvocation4
+  }
+};
+
+// src/contracts/protocols/7.ts
+var CredentialHost = Schema_exports.String.check(
+  Schema_exports.isPattern(
+    /^(\*\.)?[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*(?::[0-9]{1,5})?$/
+  )
+);
+var exposure = {
+  /** Not secret: app code reads the real value and forms show it. */
+  plain: Schema_exports.optionalKey(Schema_exports.Array(Schema_exports.NonEmptyString)),
+  /** Secret, but app code reads the real value, for signing and similar uses. */
+  raw: Schema_exports.optionalKey(Schema_exports.Array(Schema_exports.NonEmptyString))
+};
+var DeclaredAuthMethod3 = Schema_exports.Union([
+  Schema_exports.Struct({
+    type: Schema_exports.Literal("secrets"),
+    label: Schema_exports.String,
+    fields: JsonObject3,
+    ...exposure
+  }),
+  Schema_exports.Struct({
+    type: Schema_exports.Literal("oauth2"),
+    ...OAuth2Config3.members[0].fields,
+    response: JsonObject3,
+    ...exposure
+  }),
+  Schema_exports.Struct({
+    type: Schema_exports.Literal("oauth2"),
+    ...OAuth2Config3.members[1].fields,
+    response: JsonObject3,
+    ...exposure
+  }),
+  Schema_exports.Struct({
+    type: Schema_exports.Literal("oauth2"),
+    ...OAuth2Config3.members[2].fields,
+    response: JsonObject3,
+    ...exposure
+  }),
+  Schema_exports.Struct({
+    type: Schema_exports.Literal("oauth2"),
+    ...OAuth2Config3.members[3].fields,
+    response: JsonObject3,
+    ...exposure
+  })
+]);
+var DeclaredProvider3 = Schema_exports.Struct({
+  name: Schema_exports.NonEmptyString,
+  auth: Schema_exports.Record(Schema_exports.NonEmptyString, DeclaredAuthMethod3),
+  hosts: Schema_exports.optionalKey(Schema_exports.Array(CredentialHost))
+});
+var DeclaredRequirements4 = Schema_exports.Struct({
+  ...DeclaredRequirements3.fields,
+  accounts: Schema_exports.Record(
+    Schema_exports.NonEmptyString,
+    Schema_exports.Struct({
+      definition: DeclaredProvider3,
+      cardinality: Schema_exports.Literals(["one", "many"]),
+      health: Schema_exports.optionalKey(Schema_exports.Literal(true))
+    })
+  )
+});
+var ResolvedAccount3 = Schema_exports.Struct({
+  ...ResolvedAccount2.fields,
+  provider: DeclaredProvider3
+});
+var ResolvedAccounts3 = Schema_exports.Record(
+  Schema_exports.NonEmptyString,
+  Schema_exports.Union([ResolvedAccount3, Schema_exports.Array(ResolvedAccount3)])
+);
+var HostInvocation5 = Schema_exports.Struct({
+  ...HostInvocation4.fields,
+  accounts: ResolvedAccounts3
+});
+var protocol7 = {
+  version: 7,
+  schemas: {
+    ...protocol6.schemas,
+    requirements: DeclaredRequirements4,
+    accounts: ResolvedAccounts3,
+    invocation: HostInvocation5
+  }
+};
+
+// src/contracts/protocols/8.ts
+var maxFailureFields = 8;
+var maxFailureFieldLength = 256;
+var FailureFieldName = Schema_exports.String.check(
+  Schema_exports.isPattern(/^[A-Za-z_$][A-Za-z0-9_$]{0,63}$/)
+);
+var FailureFieldValue = Schema_exports.Union([
+  Schema_exports.String.check(Schema_exports.isMaxLength(maxFailureFieldLength)),
+  Schema_exports.Finite,
+  Schema_exports.Boolean
+]);
+var FailureFields = Schema_exports.Record(FailureFieldName, FailureFieldValue).check(
+  Schema_exports.isMaxProperties(maxFailureFields)
+);
+var FailureDetail3 = {
+  source: Schema_exports.optionalKey(FailureSource),
+  errorName: Schema_exports.optionalKey(FailureName2),
+  code: Schema_exports.optionalKey(FailureCode),
+  message: Schema_exports.optionalKey(FailureMessage2),
+  fields: Schema_exports.optionalKey(FailureFields)
+};
+var maxUpstreamMessageLength = 1024;
+var UpstreamError2 = Schema_exports.Struct({
+  code: Schema_exports.Union([
+    Schema_exports.Int,
+    Schema_exports.String.check(Schema_exports.isMinLength(1), Schema_exports.isMaxLength(128))
+  ]),
+  message: Schema_exports.optionalKey(Schema_exports.String.check(Schema_exports.isMaxLength(maxUpstreamMessageLength)))
+});
+var FailurePhase = Schema_exports.Literals(["connect", "discover", "call"]);
+var ProviderError3 = class extends Schema_exports.TaggedError()("ProviderError", {
+  reason: Schema_exports.Literals(["unauthorized", "forbidden", "rate_limited", "unavailable", "rejected"]),
+  status: Schema_exports.optional(Schema_exports.Int.check(Schema_exports.isBetween({ minimum: 100, maximum: 599 }))),
+  accountId: Schema_exports.optional(AccountId2),
+  phase: Schema_exports.optional(FailurePhase),
+  upstream: Schema_exports.optional(UpstreamError2)
+}) {
+};
+var McpError4 = class extends Schema_exports.TaggedError()("McpError", {
+  phase: Schema_exports.Literals(["connect", "discover", "call", "schema", "transport"]),
+  reason: Schema_exports.Literals([
+    "request",
+    "unauthorized",
+    "invalid_response",
+    "timeout",
+    "invalid_input"
+  ]),
+  status: Schema_exports.optional(Schema_exports.Number),
+  upstream: Schema_exports.optional(UpstreamError2)
+}) {
+};
+var HostDeclarationInvalid3 = class extends Schema_exports.TaggedError()(
+  "HostDeclarationInvalid",
+  FailureDetail3
+) {
+};
+var HostEvaluationFailed3 = class extends Schema_exports.TaggedError()(
+  "HostEvaluationFailed",
+  FailureDetail3
+) {
+};
+var HostOperationFailed3 = class extends Schema_exports.TaggedError()(
+  "HostOperationFailed",
+  FailureDetail3
+) {
+};
+var HostRouterError2 = Schema_exports.Union([
+  ProviderError3,
+  McpError4,
+  SkillLoadFailed,
+  HostDeclarationInvalid3,
+  HostEvaluationFailed3
+]);
+var HostedRouter2 = Schema_exports.Struct({
+  ...HostedRouter.fields,
+  error: Schema_exports.optionalKey(HostRouterError2)
+});
+var HostedCatalog2 = Schema_exports.Struct({
+  ...HostedCatalog.fields,
+  routers: Schema_exports.Array(HostedRouter2)
+});
+var HostedCatalogSummary2 = Schema_exports.Struct({
+  ...HostedCatalogSummary.fields,
+  routers: Schema_exports.Array(HostedRouter2)
+});
+var HostError4 = Schema_exports.Union([
+  OpenapiResponseError2,
+  ProviderError3,
+  McpError4,
+  SkillLoadFailed,
+  WorkflowFailure3,
+  HostRequestInvalid,
+  HostAccountsInvalid,
+  HostDeclarationInvalid3,
+  HostEvaluationFailed3,
+  HostOperationNotFound,
+  HostOperationFailed3,
+  DatabaseLimitExceeded2,
+  DatabaseFieldReserved2,
+  HostToolNotFound,
+  HostInputInvalid,
+  HostOutputInvalid,
+  HostToolBlocked,
+  HostToolApprovalRequired,
+  HostToolPolicyFailed,
+  ElicitationFailed2,
+  HostKindMismatch
+]);
+var HostResponse4 = Schema_exports.Union([
+  Schema_exports.Struct({
+    ok: Schema_exports.Literal(true),
+    value: JsonValue2,
+    toolError: Schema_exports.optionalKey(Schema_exports.Literal(true))
+  }),
+  Schema_exports.Struct({ ok: Schema_exports.Literal(false), error: HostError4 })
+]);
+var protocol8 = {
+  version: 8,
+  schemas: {
+    ...protocol7.schemas,
+    response: HostResponse4,
+    catalog: HostedCatalog2,
+    catalogSummary: HostedCatalogSummary2
+  }
+};
+
+// src/contracts/protocols/9.ts
+var McpError5 = class extends Schema_exports.TaggedError()("McpError", {
+  phase: Schema_exports.Literals(["connect", "discover", "call", "schema", "transport"]),
+  reason: Schema_exports.Literals([
+    "request",
+    "unauthorized",
+    "invalid_response",
+    "timeout",
+    "invalid_input"
+  ]),
+  status: Schema_exports.optional(Schema_exports.Number),
+  upstream: Schema_exports.optional(UpstreamError2),
+  session: Schema_exports.optional(Schema_exports.Literal(true))
+}) {
+};
+var SkillLoadFailed2 = class extends Schema_exports.TaggedError()("SkillLoadFailed", {
+  reason: Schema_exports.Literals([
+    "source",
+    "request",
+    "rate_limited",
+    "document",
+    "limit",
+    "changed",
+    "encoding"
+  ]),
+  message: Schema_exports.optional(Schema_exports.String.check(Schema_exports.isMaxLength(500))),
+  status: Schema_exports.optional(Schema_exports.Int.check(Schema_exports.isBetween({ minimum: 100, maximum: 599 }))),
+  missing: Schema_exports.optional(Schema_exports.Literals(["repository", "ref"]))
+}) {
+};
+var HostRouterError3 = Schema_exports.Union([
+  ProviderError3,
+  McpError5,
+  SkillLoadFailed2,
+  HostDeclarationInvalid3,
+  HostEvaluationFailed3
+]);
+var HostedRouter3 = Schema_exports.Struct({
+  ...HostedRouter2.fields,
+  error: Schema_exports.optionalKey(HostRouterError3)
+});
+var HostedCatalog3 = Schema_exports.Struct({
+  ...HostedCatalog2.fields,
+  routers: Schema_exports.Array(HostedRouter3)
+});
+var HostedCatalogSummary3 = Schema_exports.Struct({
+  ...HostedCatalogSummary2.fields,
+  routers: Schema_exports.Array(HostedRouter3)
+});
+var HostError5 = Schema_exports.Union([
+  OpenapiResponseError2,
+  ProviderError3,
+  McpError5,
+  SkillLoadFailed2,
+  WorkflowFailure3,
+  HostRequestInvalid,
+  HostAccountsInvalid,
+  HostDeclarationInvalid3,
+  HostEvaluationFailed3,
+  HostOperationNotFound,
+  HostOperationFailed3,
+  DatabaseLimitExceeded2,
+  DatabaseFieldReserved2,
+  HostToolNotFound,
+  HostInputInvalid,
+  HostOutputInvalid,
+  HostToolBlocked,
+  HostToolApprovalRequired,
+  HostToolPolicyFailed,
+  ElicitationFailed2,
+  HostKindMismatch
+]);
+var HostResponse5 = Schema_exports.Union([
+  Schema_exports.Struct({
+    ok: Schema_exports.Literal(true),
+    value: JsonValue2,
+    toolError: Schema_exports.optionalKey(Schema_exports.Literal(true))
+  }),
+  Schema_exports.Struct({ ok: Schema_exports.Literal(false), error: HostError5 })
+]);
+var protocol9 = {
+  version: 9,
+  schemas: {
+    ...protocol8.schemas,
+    response: HostResponse5,
+    catalog: HostedCatalog3,
+    catalogSummary: HostedCatalogSummary3
+  }
+};
+
+// src/contracts/protocols/10.ts
+var DeclaredRequirements5 = Schema_exports.Struct({
+  ...DeclaredRequirements4.fields,
+  sql: Schema_exports.optionalKey(Schema_exports.Literal(true))
+});
+var MigrateCommand = Schema_exports.Struct({ operation: Schema_exports.Literal("migrate") });
+var MigrateResult = Schema_exports.Array(
+  Schema_exports.Struct({ id: Schema_exports.Int, name: Schema_exports.NonEmptyString })
+);
+var HostRequest4 = Schema_exports.Union([...HostRequest3.members, MigrateCommand]);
+var HostInvocation6 = Schema_exports.Struct({
+  ...HostInvocation5.fields,
+  command: HostRequest4
+});
+var protocol10 = {
+  version: 10,
+  schemas: {
+    ...protocol9.schemas,
+    request: HostRequest4,
+    requirements: DeclaredRequirements5,
+    invocation: HostInvocation6,
+    migrate: MigrateResult
+  }
+};
+
+// src/contracts/schedules.ts
+var minimumIntervalMilliseconds2 = 6e4;
+var count2 = Schema_exports.Int.check(Schema_exports.isGreaterThan(0));
+var absent = Schema_exports.optionalKey(Schema_exports.Never);
+var Interval = Schema_exports.Union([
+  Schema_exports.Struct({ seconds: count2, minutes: absent, hours: absent }),
+  Schema_exports.Struct({ seconds: absent, minutes: count2, hours: absent }),
+  Schema_exports.Struct({ seconds: absent, minutes: absent, hours: count2 })
+]);
+var CalendarSchedule2 = Schema_exports.Struct({
+  expression: Schema_exports.NonEmptyString,
+  timezone: Schema_exports.NonEmptyString
+}).check(
+  Schema_exports.makeFilter(
+    (value) => value.expression.trim().split(/\s+/).length === 5 && Result_exports.isSuccess(Cron_exports.parse(value.expression, value.timezone))
+  )
+);
+var ScheduleTiming2 = Schema_exports.Union([
+  Schema_exports.Struct({
+    kind: Schema_exports.Literal("interval"),
+    milliseconds: Schema_exports.Int.check(
+      Schema_exports.makeFilter((value) => value >= minimumIntervalMilliseconds2, {
+        message: "Schedule intervals must be at least 60 seconds"
+      }),
+      Schema_exports.isLessThanOrEqualTo(Number.MAX_SAFE_INTEGER)
+    )
+  }),
+  Schema_exports.Struct({ kind: Schema_exports.Literal("cron"), calendar: CalendarSchedule2 })
+]);
+var OperationSchedule2 = Schema_exports.Struct({
+  name: Schema_exports.NonEmptyString,
+  timing: ScheduleTiming2,
+  input: JsonValue
+});
+
+// src/contracts/protocols/current.ts
+var McpError6 = class extends Schema_exports.TaggedError()("McpError", {
+  phase: Schema_exports.Literals(["connect", "discover", "call", "schema", "transport"]),
+  reason: Schema_exports.Literals([
+    "request",
+    "unauthorized",
+    "invalid_response",
+    "timeout",
+    "invalid_input"
+  ]),
+  status: Schema_exports.optional(Schema_exports.Number),
+  /** The JSON-RPC error the server stated. */
+  upstream: Schema_exports.optional(UpstreamError),
+  /**
+   * The refused request carried the session ID the server issued at initialization, so a 404 reads
+   * as a session the server may have lost. Chooses the explanation only; the host never decides from
+   * it whose side a failure is on.
+   */
+  session: Schema_exports.optional(Schema_exports.Literal(true))
+}) {
+};
+var SkillLoadFailed3 = class extends Schema_exports.TaggedError()("SkillLoadFailed", {
+  reason: Schema_exports.Literals([
+    "source",
+    "request",
+    "rate_limited",
+    "document",
+    "limit",
+    "changed",
+    "encoding"
+  ]),
+  message: Schema_exports.optional(Schema_exports.String.check(Schema_exports.isMaxLength(500))),
+  status: Schema_exports.optional(Schema_exports.Int.check(Schema_exports.isBetween({ minimum: 100, maximum: 599 }))),
+  /** What the service's answer points to as missing: the repository, or the branch or tag. */
+  missing: Schema_exports.optional(Schema_exports.Literals(["repository", "ref"]))
+}) {
+};
+var CredentialHost2 = Schema_exports.String.check(
+  Schema_exports.isPattern(
+    /^(\*\.)?[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*(?::[0-9]{1,5})?$/
+  )
+);
+var exposure2 = {
+  /** Not secret: app code reads the real value and forms show it. */
+  plain: Schema_exports.optionalKey(Schema_exports.Array(Schema_exports.NonEmptyString)),
+  /** Secret, but app code reads the real value, for signing and similar uses. */
+  raw: Schema_exports.optionalKey(Schema_exports.Array(Schema_exports.NonEmptyString))
+};
+var DeclaredAuthMethod4 = Schema_exports.Union([
   Schema_exports.Struct({
-    ok: Schema_exports.Literal(true),
-    value: JsonValue,
-    toolError: Schema_exports.optionalKey(Schema_exports.Literal(true))
+    type: Schema_exports.Literal("secrets"),
+    label: Schema_exports.String,
+    fields: JsonObject2,
+    ...exposure2
   }),
-  Schema_exports.Struct({ ok: Schema_exports.Literal(false), error: HostError2 })
+  Schema_exports.Struct({
+    type: Schema_exports.Literal("oauth2"),
+    ...OAuth2Config.members[0].fields,
+    response: JsonObject2,
+    ...exposure2
+  }),
+  Schema_exports.Struct({
+    type: Schema_exports.Literal("oauth2"),
+    ...OAuth2Config.members[1].fields,
+    response: JsonObject2,
+    ...exposure2
+  }),
+  Schema_exports.Struct({
+    type: Schema_exports.Literal("oauth2"),
+    ...OAuth2Config.members[2].fields,
+    response: JsonObject2,
+    ...exposure2
+  }),
+  Schema_exports.Struct({
+    type: Schema_exports.Literal("oauth2"),
+    ...OAuth2Config.members[3].fields,
+    response: JsonObject2,
+    ...exposure2
+  })
 ]);
-var protocol3 = {
-  version: 3,
-  schemas: {
-    invocation: HostInvocation,
-    request: HostRequest,
-    response: HostResponse2,
-    requirements: DeclaredRequirements,
-    tools: Schema_exports.Array(HostedTool),
-    toolSummaries: Schema_exports.Array(HostedToolSummary),
-    skills: SkillCatalogResponse2,
-    elicitationRequest: FormElicitation,
-    elicitationReply: ElicitationReply,
-    workflowStep: WorkflowRpcCommand,
-    workflowStepReply: WorkflowRpcResult,
-    workflowControl: WorkflowControlCommand,
-    cacheCommand: CacheCommand,
-    cacheReply: CacheReply
-  }
-};
-
-// src/contracts/protocols/4.ts
-var HostedTool2 = Schema_exports.Struct({
-  schedules: Schema_exports.optionalKey(Schema_exports.Array(OperationSchedule)),
+var DeclaredProvider4 = Schema_exports.Struct({
+  name: Schema_exports.NonEmptyString,
+  auth: Schema_exports.Record(Schema_exports.NonEmptyString, DeclaredAuthMethod4),
+  hosts: Schema_exports.optionalKey(Schema_exports.Array(CredentialHost2))
+});
+var DeclaredRequirements6 = Schema_exports.Struct({
+  /** Protocol support of this retained framework build, not an author-declared requirement. */
+  capabilities: Schema_exports.optionalKey(
+    Schema_exports.Struct({
+      skills: Schema_exports.Literal(true),
+      /** Accepts inspect detail and tools. Earlier builds reject both as excess fields. */
+      toolIndex: Schema_exports.optionalKey(Schema_exports.Literal(true)),
+      /** Accepts skills sources and reports whether the catalog includes a live loader. */
+      skillSources: Schema_exports.optionalKey(Schema_exports.Literal(true)),
+      /** Accepts scheduled inspection. Earlier builds reject it as an excess field. */
+      scheduledTools: Schema_exports.optionalKey(Schema_exports.Literal(true))
+    })
+  ),
+  /**
+   * The document database an app of protocol 9 or earlier declared. Apps of this protocol declare
+   * `sql` instead; the field remains so requirements read from older retained builds keep their meaning.
+   */
+  database: Schema_exports.optionalKey(DatabaseSchema),
+  accounts: Schema_exports.Record(
+    Schema_exports.NonEmptyString,
+    Schema_exports.Struct({
+      definition: DeclaredProvider4,
+      cardinality: Schema_exports.Literals(["one", "many"]),
+      /**
+       * The slot's provider defines an account check. Kept beside the definition, not in it, so
+       * adding or editing a check never changes the provider's identity.
+       */
+      health: Schema_exports.optionalKey(Schema_exports.Literal(true))
+    })
+  ),
+  /** The build has SQL files in `migrations/` and owns a raw SQLite database. */
+  sql: Schema_exports.optionalKey(Schema_exports.Literal(true)),
+  /** The events the app declares, so a host lists them without evaluating the app. */
+  events: Schema_exports.optionalKey(DeclaredEvents)
+});
+var ResolvedAccount4 = Schema_exports.Struct({
+  id: AccountId,
+  provider: DeclaredProvider4,
+  method: Schema_exports.NonEmptyString,
+  /**
+   * Changes when the account is reconnected or its credentials replaced, not on renewal. Hosts
+   * send it since credential generations; `apps@0.0.1-beta.0` and `beta.1` ignore it.
+   */
+  generation: Schema_exports.optionalKey(Schema_exports.Int),
+  fields: JsonObject2
+});
+var ResolvedAccounts4 = Schema_exports.Record(
+  Schema_exports.NonEmptyString,
+  Schema_exports.Union([ResolvedAccount4, Schema_exports.Array(ResolvedAccount4)])
+);
+var TrustedToolApproval2 = Schema_exports.Struct({ tool: Schema_exports.NonEmptyString, input: JsonValue });
+var InvocationDeadline2 = Schema_exports.Finite.check(Schema_exports.isGreaterThanOrEqualTo(0));
+var HostedTool3 = Schema_exports.Struct({
+  schedules: Schema_exports.optionalKey(Schema_exports.Array(OperationSchedule2)),
   name: Schema_exports.NonEmptyString,
   router: Schema_exports.optionalKey(Schema_exports.NonEmptyString),
   tags: Schema_exports.optionalKey(Schema_exports.Array(Schema_exports.NonEmptyString)),
@@ -2280,38 +3899,62 @@ var HostedTool2 = Schema_exports.Struct({
   readOnly: Schema_exports.optionalKey(Schema_exports.Boolean),
   title: Schema_exports.optionalKey(Schema_exports.String),
   outputSchema: Schema_exports.optionalKey(JsonObject2),
-  annotations: Schema_exports.optionalKey(ToolAnnotations),
+  annotations: Schema_exports.optionalKey(ToolAnnotations2),
   _meta: Schema_exports.optionalKey(JsonObject2)
 });
-var HostedToolSummary2 = HostedTool2.mapFields(
+var HostedToolSummary3 = HostedTool3.mapFields(
   ({ inputSchema: _input, outputSchema: _output, _meta, ...fields }) => fields
 );
-var HostRouterError = Schema_exports.Union([
+var HostDeclarationInvalid4 = class extends Schema_exports.TaggedError()(
+  "HostDeclarationInvalid",
+  FailureDetail
+) {
+};
+var HostEvaluationFailed4 = class extends Schema_exports.TaggedError()(
+  "HostEvaluationFailed",
+  FailureDetail
+) {
+};
+var HostRouterError4 = Schema_exports.Union([
   ProviderError,
-  McpError,
-  SkillLoadFailed,
-  HostDeclarationInvalid2,
-  HostEvaluationFailed2
+  McpError6,
+  SkillLoadFailed3,
+  HostDeclarationInvalid4,
+  HostEvaluationFailed4
 ]);
-var HostedRouter = Schema_exports.Struct({
+var HostedRouter4 = Schema_exports.Struct({
   path: Schema_exports.String,
   title: Schema_exports.optionalKey(Schema_exports.String),
   description: Schema_exports.optionalKey(Schema_exports.String),
   icons: Schema_exports.optionalKey(Schema_exports.Array(RouterIcon)),
   tags: Schema_exports.optionalKey(Schema_exports.Record(Schema_exports.NonEmptyString, Schema_exports.String)),
   skill: Schema_exports.optionalKey(AppSkillName),
-  error: Schema_exports.optionalKey(HostRouterError)
+  error: Schema_exports.optionalKey(HostRouterError4)
 });
-var HostedCatalog = Schema_exports.Struct({
-  tools: Schema_exports.Array(HostedTool2),
-  routers: Schema_exports.Array(HostedRouter)
+var HostedCatalog4 = Schema_exports.Struct({
+  tools: Schema_exports.Array(HostedTool3),
+  routers: Schema_exports.Array(HostedRouter4)
 });
-var HostedCatalogSummary = Schema_exports.Struct({
-  tools: Schema_exports.Array(HostedToolSummary2),
-  routers: Schema_exports.Array(HostedRouter)
+var HostedCatalogSummary4 = Schema_exports.Struct({
+  tools: Schema_exports.Array(HostedToolSummary3),
+  routers: Schema_exports.Array(HostedRouter4)
 });
-var ToolKind = Schema_exports.Literals(["query", "mutation"]);
-var HostRequest2 = Schema_exports.Union([
+var SkillSources3 = Schema_exports.Struct({
+  skills: AppSkills,
+  dynamic: Schema_exports.Boolean,
+  cached: Schema_exports.optionalKey(Schema_exports.Boolean)
+});
+var SkillCatalogResponse3 = Schema_exports.Union([SkillSources3, AppSkills]);
+var ToolKind2 = Schema_exports.Literals(["query", "mutation"]);
+var AccountCheckCommand2 = Schema_exports.Struct({
+  operation: Schema_exports.Literal("account-check"),
+  requirement: Schema_exports.NonEmptyString
+});
+var MigrateCommand2 = Schema_exports.Struct({ operation: Schema_exports.Literal("migrate") });
+var MigrateResult2 = Schema_exports.Array(
+  Schema_exports.Struct({ id: Schema_exports.Int, name: Schema_exports.NonEmptyString })
+);
+var HostRequest5 = Schema_exports.Union([
   WorkflowCommand,
   WebhookCommand,
   Schema_exports.Struct({ operation: Schema_exports.Literal("requirements") }),
@@ -2349,56 +3992,135 @@ var HostRequest2 = Schema_exports.Union([
      * The caller's claim; the bundle rejects a call whose tool has the other kind. The host omits
      * it for a tool its catalog does not list, and then opens storage for writing.
      */
-    kind: Schema_exports.optionalKey(ToolKind),
+    kind: Schema_exports.optionalKey(ToolKind2),
     input: JsonValue
-  })
+  }),
+  AccountCheckCommand2,
+  MigrateCommand2
 ]);
-var HostKindMismatch = class extends Schema_exports.TaggedError()("HostKindMismatch", {
+var HostRequestInvalid2 = class extends Schema_exports.TaggedError()(
+  "HostRequestInvalid",
+  {}
+) {
+};
+var HostAccountsInvalid2 = class extends Schema_exports.TaggedError()(
+  "HostAccountsInvalid",
+  {}
+) {
+};
+var HostOperationNotFound2 = class extends Schema_exports.TaggedError()(
+  "HostOperationNotFound",
+  {}
+) {
+};
+var HostOperationFailed4 = class extends Schema_exports.TaggedError()(
+  "HostOperationFailed",
+  FailureDetail
+) {
+};
+var HostToolNotFound2 = class extends Schema_exports.TaggedError()(
+  "HostToolNotFound",
+  {}
+) {
+};
+var HostKindMismatch2 = class extends Schema_exports.TaggedError()("HostKindMismatch", {
   tool: Schema_exports.NonEmptyString,
-  requested: ToolKind,
-  actual: ToolKind
+  requested: ToolKind2,
+  actual: ToolKind2
 }) {
 };
-var HostError3 = Schema_exports.Union([...HostError2.members, HostKindMismatch]);
-var HostResponse3 = Schema_exports.Union([
+var InputProblem2 = Schema_exports.String.check(Schema_exports.isMaxLength(512));
+var maxInputProblems2 = 10;
+var HostInputInvalid2 = class extends Schema_exports.TaggedError()("HostInputInvalid", {
+  problems: Schema_exports.optionalKey(
+    Schema_exports.Array(InputProblem2).check(Schema_exports.isMaxLength(maxInputProblems2))
+  )
+}) {
+};
+var HostToolBlocked2 = class extends Schema_exports.TaggedError()("HostToolBlocked", {}) {
+};
+var HostToolApprovalRequired2 = class extends Schema_exports.TaggedError()(
+  "HostToolApprovalRequired",
+  { input: JsonValue, elicitation: ApprovalElicitation }
+) {
+};
+var HostToolPolicyFailed2 = class extends Schema_exports.TaggedError()(
+  "HostToolPolicyFailed",
+  {}
+) {
+};
+var HostOutputInvalid2 = class extends Schema_exports.TaggedError()(
+  "HostOutputInvalid",
+  {}
+) {
+};
+var HostError6 = Schema_exports.Union([
+  OpenapiResponseError,
+  ProviderError,
+  McpError6,
+  SkillLoadFailed3,
+  WorkflowFailure,
+  HostRequestInvalid2,
+  HostAccountsInvalid2,
+  HostDeclarationInvalid4,
+  HostEvaluationFailed4,
+  HostOperationNotFound2,
+  HostOperationFailed4,
+  DatabaseLimitExceeded,
+  DatabaseFieldReserved,
+  HostToolNotFound2,
+  HostInputInvalid2,
+  HostOutputInvalid2,
+  HostToolBlocked2,
+  HostToolApprovalRequired2,
+  HostToolPolicyFailed2,
+  ElicitationFailed,
+  HostKindMismatch2
+]);
+var HostResponse6 = Schema_exports.Union([
   Schema_exports.Struct({
     ok: Schema_exports.Literal(true),
     value: JsonValue,
-    toolError: Schema_exports.optionalKey(Schema_exports.Literal(true))
+    toolError: Schema_exports.optionalKey(Schema_exports.Literal(true)),
+    /** The occurrences this invocation emitted, kept only because it succeeded. */
+    events: Schema_exports.optionalKey(EmittedEvents)
   }),
-  Schema_exports.Struct({ ok: Schema_exports.Literal(false), error: HostError3 })
+  Schema_exports.Struct({ ok: Schema_exports.Literal(false), error: HostError6 })
 ]);
-var HostInvocation2 = Schema_exports.Struct({
-  command: HostRequest2,
-  accounts: ResolvedAccounts,
-  approval: Schema_exports.optionalKey(TrustedToolApproval),
+var HostInvocation7 = Schema_exports.Struct({
+  command: HostRequest5,
+  accounts: ResolvedAccounts4,
+  approval: Schema_exports.optionalKey(TrustedToolApproval2),
   replay: Schema_exports.optionalKey(WorkflowReplay),
-  deadline: Schema_exports.optionalKey(InvocationDeadline),
+  deadline: Schema_exports.optionalKey(InvocationDeadline2),
   workflowRun: Schema_exports.optionalKey(WorkflowRunId)
 });
-var protocol4 = {
-  version: 4,
+var current = {
+  version: frameworkProtocol,
   schemas: {
-    invocation: HostInvocation2,
-    request: HostRequest2,
-    response: HostResponse3,
-    requirements: DeclaredRequirements,
-    catalog: HostedCatalog,
-    catalogSummary: HostedCatalogSummary,
-    skills: SkillCatalogResponse2,
+    invocation: HostInvocation7,
+    request: HostRequest5,
+    response: HostResponse6,
+    requirements: DeclaredRequirements6,
+    catalog: HostedCatalog4,
+    catalogSummary: HostedCatalogSummary4,
+    skills: SkillCatalogResponse3,
     elicitationRequest: FormElicitation,
     elicitationReply: ElicitationReply,
     workflowStep: WorkflowRpcCommand,
     workflowStepReply: WorkflowRpcResult,
     workflowControl: WorkflowControlCommand,
     cacheCommand: CacheCommand,
-    cacheReply: CacheReply
+    cacheReply: CacheReply,
+    accountCheck: AccountCheckResult,
+    accounts: ResolvedAccounts4,
+    migrate: MigrateResult2
   }
 };
 
 // src/contracts/host.ts
 var skillsCommand = (sources) => sources ? { operation: "skills", sources: true } : { operation: "skills" };
-var skillCatalog = (response) => Schema_exports.is(SkillSources2)(response) ? response : { skills: response };
+var skillCatalog = (response) => Schema_exports.is(SkillSources3)(response) ? response : { skills: response };
 var inspectCommand = (tools, scheduled) => ({
   operation: "inspect",
   ...tools === void 0 ? {} : { tools: [...tools] },
@@ -2407,75 +4129,82 @@ var inspectCommand = (tools, scheduled) => ({
 var indexCommand = { operation: "inspect", detail: "summary" };
 var selectTools = (tools) => (catalog) => tools === void 0 ? catalog : { ...catalog, tools: catalog.tools.filter((tool) => tools.includes(tool.name)) };
 var HostRequirementsError = Schema_exports.Union([
-  HostRequestInvalid,
-  HostDeclarationInvalid2,
+  HostRequestInvalid2,
+  HostDeclarationInvalid4,
   DatabaseFieldReserved
 ]);
 var HostInspectError = Schema_exports.Union([
   ProviderError,
-  McpError,
-  SkillLoadFailed,
-  HostRequestInvalid,
-  HostDeclarationInvalid2,
-  HostAccountsInvalid,
-  HostEvaluationFailed2
+  McpError6,
+  SkillLoadFailed3,
+  HostRequestInvalid2,
+  HostDeclarationInvalid4,
+  HostAccountsInvalid2,
+  HostEvaluationFailed4
 ]);
 var HostCallError = Schema_exports.Union([
   OpenapiResponseError,
   WorkflowFailure,
   HostInspectError,
-  HostToolNotFound,
-  HostOperationNotFound,
-  HostKindMismatch,
-  HostOperationFailed2,
+  HostToolNotFound2,
+  HostOperationNotFound2,
+  HostKindMismatch2,
+  HostOperationFailed4,
   DatabaseLimitExceeded,
-  HostInputInvalid,
-  HostOutputInvalid,
-  HostToolBlocked,
-  HostToolApprovalRequired,
-  HostToolPolicyFailed,
+  HostInputInvalid2,
+  HostOutputInvalid2,
+  HostToolBlocked2,
+  HostToolApprovalRequired2,
+  HostToolPolicyFailed2,
   ElicitationFailed
 ]);
+var HostAccountCheckError = Schema_exports.Union([
+  ProviderError,
+  WorkflowFailure,
+  HostRequestInvalid2,
+  HostDeclarationInvalid4,
+  HostAccountsInvalid2,
+  HostOperationNotFound2,
+  HostOperationFailed4,
+  HostOutputInvalid2
+]);
 var HostDataError = HostCallError;
 var ToolResultObservation = Context_exports.Reference(
   "apps/ToolResultObservation",
   { defaultValue: () => ({ failed: () => {
   } }) }
 );
+var InvocationTiming = Schema_exports.Struct({
+  elapsedMs: Schema_exports.Finite,
+  upstreamMs: Schema_exports.Finite,
+  elicitationMs: Schema_exports.Finite,
+  authoredMs: Schema_exports.Finite
+});
+var InvocationTimingSink = Context_exports.Reference(
+  "apps/InvocationTimingSink",
+  { defaultValue: () => () => {
+  } }
+);
 
 export {
   SecretsMethod,
   OAuthClientAuth,
   OAuthSecretClientAuth,
+  OAuthTokenRequestFormat,
+  OAuthTokenResponse,
   OAuth2Config,
   OAuth2AccessToken,
   OAuth2Method,
+  AccountInfo,
+  AccountCheckResult,
   Provider,
   ManyAccounts,
-  reservedRouterKeys,
-  RouterKey,
-  RouterIcon,
-  RouterMeta,
-  ToolAnnotations,
-  McpClientLimits,
-  defaultMcpClientLimits,
-  mcpSdkTimerCeilingMs,
-  McpToolsOptions,
-  McpToolResult,
-  McpToolMetadata,
-  McpServerHeader,
-  McpError,
-  ProcessConfig,
+  maxApiErrorInstructionsLength,
   ApiErrorRecovery,
+  maxApiErrorMessageLength,
   ApiErrorResponse,
   OpenapiResponseError,
   defaultOpenapiErrorLimits,
-  maxFailureMessageLength,
-  FailureSource,
-  FailureName,
-  FailureCode,
-  FailureMessage,
-  FailureDetail,
   WorkflowRunId,
   WorkflowName,
   workflowDurationMillis,
@@ -2494,6 +4223,10 @@ export {
   WorkflowRpcCommand,
   WorkflowRpcResult,
   WorkflowControlCommand,
+  DatabaseLimitExceeded,
+  DatabaseFieldReserved,
+  reservedTablePrefix,
+  migrationsDirectory,
   ElicitationLimits,
   defaultElicitationLimits,
   FormElicitation,
@@ -2503,6 +4236,23 @@ export {
   ApprovalElicitation,
   ApprovalResponse,
   approvalElicitation,
+  reservedRouterKeys,
+  RouterKey,
+  RouterIcon,
+  RouterMeta,
+  ToolAnnotations2 as ToolAnnotations,
+  McpClientLimits,
+  defaultMcpClientLimits,
+  mcpSdkTimerCeilingMs,
+  McpToolsOptions,
+  McpHealthInput,
+  mcpHealthReserveMs,
+  McpToolResult,
+  McpToolMetadata,
+  McpServerHeader,
+  McpError2 as McpError,
+  McpCredentialsUnverified,
+  ProcessConfig,
   WebhookTransportLimits,
   defaultWebhookTransportLimits,
   WebhookRequestData,
@@ -2511,50 +4261,71 @@ export {
   ManualWebhookDescriptor,
   HostedWebhook,
   WebhookCommand,
+  EventName,
+  EventFilterValue,
+  EventLimits,
+  defaultEventLimits,
+  DeclaredEvent,
+  DeclaredEvents,
+  EmittedEvent,
+  EmittedEvents,
   frameworkProtocol,
-  minimumIntervalMilliseconds,
-  Interval,
-  CalendarSchedule,
-  ScheduleTiming,
-  OperationSchedule,
-  DeclaredAuthMethod,
-  DeclaredProvider,
-  DeclaredRequirements,
-  ResolvedAccount,
-  ResolvedAccounts,
-  TrustedToolApproval,
-  InvocationDeadline,
-  HostRequestInvalid,
-  HostAccountsInvalid,
-  HostOperationNotFound,
-  HostToolNotFound,
-  InputProblem,
-  maxInputProblems,
-  HostInputInvalid,
-  HostToolBlocked,
-  HostToolApprovalRequired,
-  HostToolPolicyFailed,
-  HostOutputInvalid,
   protocol1,
-  SkillSources2 as SkillSources,
-  SkillCatalogResponse2 as SkillCatalogResponse,
   protocol2,
-  HostDeclarationInvalid2 as HostDeclarationInvalid,
-  HostEvaluationFailed2 as HostEvaluationFailed,
-  HostOperationFailed2 as HostOperationFailed,
   protocol3,
-  HostedTool2 as HostedTool,
-  HostedToolSummary2 as HostedToolSummary,
-  HostRouterError,
-  HostedRouter,
-  HostedCatalog,
-  HostedCatalogSummary,
-  HostRequest2 as HostRequest,
-  HostKindMismatch,
-  HostError3 as HostError,
-  HostResponse3 as HostResponse,
-  HostInvocation2 as HostInvocation,
   protocol4,
+  protocol5,
+  protocol6,
+  protocol7,
+  protocol8,
+  protocol9,
+  protocol10,
+  minimumIntervalMilliseconds2 as minimumIntervalMilliseconds,
+  Interval,
+  CalendarSchedule2 as CalendarSchedule,
+  ScheduleTiming2 as ScheduleTiming,
+  OperationSchedule2 as OperationSchedule,
+  McpError6 as McpError2,
+  SkillLoadFailed3 as SkillLoadFailed,
+  CredentialHost2 as CredentialHost,
+  DeclaredAuthMethod4 as DeclaredAuthMethod,
+  DeclaredProvider4 as DeclaredProvider,
+  DeclaredRequirements6 as DeclaredRequirements,
+  ResolvedAccount4 as ResolvedAccount,
+  ResolvedAccounts4 as ResolvedAccounts,
+  TrustedToolApproval2 as TrustedToolApproval,
+  InvocationDeadline2 as InvocationDeadline,
+  HostedTool3 as HostedTool,
+  HostedToolSummary3 as HostedToolSummary,
+  HostDeclarationInvalid4 as HostDeclarationInvalid,
+  HostEvaluationFailed4 as HostEvaluationFailed,
+  HostRouterError4 as HostRouterError,
+  HostedRouter4 as HostedRouter,
+  HostedCatalog4 as HostedCatalog,
+  HostedCatalogSummary4 as HostedCatalogSummary,
+  SkillSources3 as SkillSources,
+  SkillCatalogResponse3 as SkillCatalogResponse,
+  AccountCheckCommand2 as AccountCheckCommand,
+  MigrateCommand2 as MigrateCommand,
+  MigrateResult2 as MigrateResult,
+  HostRequest5 as HostRequest,
+  HostRequestInvalid2 as HostRequestInvalid,
+  HostAccountsInvalid2 as HostAccountsInvalid,
+  HostOperationNotFound2 as HostOperationNotFound,
+  HostOperationFailed4 as HostOperationFailed,
+  HostToolNotFound2 as HostToolNotFound,
+  HostKindMismatch2 as HostKindMismatch,
+  InputProblem2 as InputProblem,
+  maxInputProblems2 as maxInputProblems,
+  HostInputInvalid2 as HostInputInvalid,
+  HostToolBlocked2 as HostToolBlocked,
+  HostToolApprovalRequired2 as HostToolApprovalRequired,
+  HostToolPolicyFailed2 as HostToolPolicyFailed,
+  HostOutputInvalid2 as HostOutputInvalid,
+  HostError6 as HostError,
+  HostResponse6 as HostResponse,
+  HostInvocation7 as HostInvocation,
+  current,
   skillsCommand,
   skillCatalog,
   inspectCommand,
@@ -2563,6 +4334,9 @@ export {
   HostRequirementsError,
   HostInspectError,
   HostCallError,
+  HostAccountCheckError,
   HostDataError,
-  ToolResultObservation
+  ToolResultObservation,
+  InvocationTiming,
+  InvocationTimingSink
 };