apps 0.0.1-beta.89 → 0.0.1-beta.90

package/js/{chunk-NQW2E44U.js → chunk-6XQLA5NC.js}

@@ -1,12 +1,3 @@
-import {
-  CacheCommand,
-  CacheReply,
-  FailureDetail,
-  FailureMessage,
-  FailureName,
-  ProviderError,
-  UpstreamError
-} from "./chunk-F2G534HD.js";
 import {
   AppSkillName,
   AppSkills
@@ -77,6 +68,52 @@ import {
   withDefault
 } from "./chunk-IFJU5SYQ.js";
 
+// src/contracts/failure.ts
+var maxFailureMessageLength = 2048;
+var FailureSource = Schema_exports.Literals(["app", "storage", "service"]);
+var FailureName = Schema_exports.String.check(Schema_exports.isMaxLength(128));
+var FailureCode = Schema_exports.String.check(Schema_exports.isMaxLength(128));
+var FailureMessage = Schema_exports.String.check(Schema_exports.isMaxLength(maxFailureMessageLength));
+var maxFailureFields = 8;
+var maxFailureFieldLength = 256;
+var FailureFieldName = Schema_exports.String.check(
+  Schema_exports.isPattern(/^[A-Za-z_$][A-Za-z0-9_$]{0,63}$/)
+);
+var FailureFieldValue = Schema_exports.Union([
+  Schema_exports.String.check(Schema_exports.isMaxLength(maxFailureFieldLength)),
+  Schema_exports.Finite,
+  Schema_exports.Boolean
+]);
+var FailureFields = Schema_exports.Record(FailureFieldName, FailureFieldValue).check(
+  Schema_exports.isMaxProperties(maxFailureFields)
+);
+var FailureDetail = {
+  source: Schema_exports.optionalKey(FailureSource),
+  errorName: Schema_exports.optionalKey(FailureName),
+  code: Schema_exports.optionalKey(FailureCode),
+  message: Schema_exports.optionalKey(FailureMessage),
+  fields: Schema_exports.optionalKey(FailureFields)
+};
+var maxUpstreamMessageLength = 1024;
+var UpstreamError = Schema_exports.Struct({
+  code: Schema_exports.Union([
+    Schema_exports.Int,
+    Schema_exports.String.check(Schema_exports.isMinLength(1), Schema_exports.isMaxLength(128))
+  ]),
+  message: Schema_exports.optionalKey(Schema_exports.String.check(Schema_exports.isMaxLength(maxUpstreamMessageLength)))
+});
+var FailurePhase = Schema_exports.Literals(["connect", "discover", "call"]);
+
+// src/contracts/provider-error.ts
+var ProviderError = class extends Schema_exports.TaggedError()("ProviderError", {
+  reason: Schema_exports.Literals(["unauthorized", "forbidden", "rate_limited", "unavailable", "rejected"]),
+  status: Schema_exports.optional(Schema_exports.Int.check(Schema_exports.isBetween({ minimum: 100, maximum: 599 }))),
+  accountId: Schema_exports.optional(AccountId),
+  phase: Schema_exports.optional(FailurePhase),
+  upstream: Schema_exports.optional(UpstreamError)
+}) {
+};
+
 // src/contracts/api-response-error.ts
 var maxApiErrorInstructionsLength = 4096;
 var ApiErrorRecovery = Schema_exports.Struct({
@@ -104,6 +141,111 @@ var defaultOpenapiErrorLimits = OpenapiErrorLimits.make({
   readTimeoutMs: 2e3
 });
 
+// src/contracts/network.ts
+var NetworkRefusal = Schema_exports.Union([
+  Schema_exports.Struct({ reason: Schema_exports.Literal("private_address") }),
+  Schema_exports.Struct({
+    reason: Schema_exports.Literal("credential_host"),
+    /** The provider of the credential handle the request carried. */
+    provider: Schema_exports.String,
+    /** The hosts that provider's credentials may reach; empty when it declares none. */
+    allowedHosts: Schema_exports.Array(Schema_exports.String)
+  }),
+  Schema_exports.Struct({ reason: Schema_exports.Literal("credential_app") }),
+  Schema_exports.Struct({
+    reason: Schema_exports.Literal("credential_expired"),
+    /** The provider of the expired credential handle. */
+    provider: Schema_exports.String
+  }),
+  Schema_exports.Struct({
+    reason: Schema_exports.Literal("credential_placement"),
+    /** The provider of the misplaced credential handle. */
+    provider: Schema_exports.String,
+    /** Where the handle was found, such as `body` or `header x-note`. */
+    location: Schema_exports.String
+  }),
+  Schema_exports.Struct({
+    reason: Schema_exports.Literal("credential_transport"),
+    /** The provider of the credential handle the request carried. */
+    provider: Schema_exports.String
+  }),
+  Schema_exports.Struct({
+    reason: Schema_exports.Literal("credential_method"),
+    /** The refused HTTP method. */
+    method: Schema_exports.String
+  })
+]);
+var NetworkRefused = class extends Schema_exports.TaggedError()("NetworkRefused", {
+  /** The refused destination, with its port when the URL names one. */
+  host: Schema_exports.String,
+  refusal: NetworkRefusal
+}) {
+  get message() {
+    const refusal = this.refusal;
+    switch (refusal.reason) {
+      case "private_address":
+        return `Executor refused a request to ${this.host}: apps on this instance can reach only public addresses, and ${this.host} is a private, loopback or internal address. The request was not sent.`;
+      case "credential_host":
+        return refusal.allowedHosts.length === 0 ? `Executor refused this request: ${refusal.provider} credentials cannot be sent to ${this.host}: the provider declares no hosts.` : `Executor refused this request: ${refusal.provider} credentials cannot be sent to ${this.host}. The provider allows: ${refusal.allowedHosts.join(", ")}.`;
+      case "credential_app":
+        return "Executor refused this request: it carries a credential handle that is not valid for this app. Use the account fields this invocation received.";
+      case "credential_expired":
+        return `Executor refused this request: it carries an expired ${refusal.provider} credential handle. Use the account fields this invocation received.`;
+      case "credential_placement":
+        return `Executor refused this request: it carries a ${refusal.provider} credential handle in the ${refusal.location}, where the provider does not place it. Send credentials only as the provider's request declares, for example with the account's headers() and url().`;
+      case "credential_transport":
+        return `Executor refused this request: ${refusal.provider} credentials are sent only over HTTPS, and ${this.host} was requested over plain HTTP.`;
+      case "credential_method":
+        return `Executor refused this request: credential handles are never sent with ${refusal.method}, which asks the service to echo the request back.`;
+    }
+  }
+};
+var networkRefusalStatus = 421;
+var networkRefusalHeader = "x-executor-refused";
+var NetworkRefusedHeader = Schema_exports.StringFromUriComponent.pipe(
+  Schema_exports.decodeTo(Schema_exports.fromJsonString(NetworkRefused))
+);
+var encodeRefusal = Schema_exports.encodeSync(NetworkRefused);
+var encodeRefusalHeader = Schema_exports.encodeSync(NetworkRefusedHeader);
+var networkRefusalResponse = (refused) => new Response(JSON.stringify({ ...encodeRefusal(refused), message: refused.message }), {
+  status: networkRefusalStatus,
+  statusText: "Refused by Executor",
+  headers: {
+    "content-type": "application/json; charset=utf-8",
+    [networkRefusalHeader]: encodeRefusalHeader(refused)
+  }
+});
+var RestrictedFetchOption = Schema_exports.Literals(["redirect", "cache", "integrity"]);
+var supportedFetchOptions = {
+  redirect: ["follow", "manual"],
+  cache: ["no-store", "no-cache"],
+  integrity: [""]
+};
+var FetchOptionUnsupported = class extends Schema_exports.TaggedError()(
+  "FetchOptionUnsupported",
+  {
+    option: RestrictedFetchOption,
+    value: Schema_exports.String,
+    supported: Schema_exports.Array(Schema_exports.String)
+  }
+) {
+  get message() {
+    const supported = this.supported.map((value) => JSON.stringify(value)).join(" or ");
+    return `fetch option ${this.option}: ${JSON.stringify(this.value)} is not supported by Executor's app runtime. Use ${supported}, or omit ${this.option}.${this.advice}`;
+  }
+  /** What to do instead, when the standard value has an equivalent the runtime supports. */
+  get advice() {
+    switch (this.option) {
+      case "redirect":
+        return this.value === "error" ? ` To reject redirects, send redirect: "manual" and treat a 3xx response as the error.` : "";
+      case "cache":
+        return "";
+      case "integrity":
+        return " To check a digest, read the body and hash it with crypto.subtle.digest.";
+    }
+  }
+};
+
 // src/contracts/workflows.ts
 var WorkflowRunId = Schema_exports.NonEmptyString.pipe(Schema_exports.brand("wfr"));
 var WorkflowName = Schema_exports.NonEmptyString.check(Schema_exports.isMaxLength(200));
@@ -191,7 +333,6 @@ var HostedWorkflow = Schema_exports.Struct({
   outputSchema: Schema_exports.optionalKey(JsonObject2)
 });
 var runFields = {
-  profile: Schema_exports.optionalKey(Schema_exports.NonEmptyString),
   id: WorkflowRunId,
   app: Schema_exports.NonEmptyString,
   deployment: Schema_exports.NonEmptyString,
@@ -2344,7 +2485,7 @@ var ManyAccounts = class extends Data_exports.TaggedClass("many") {
 };
 
 // src/contracts/protocol-version.ts
-var frameworkProtocol = 12;
+var frameworkProtocol = 13;
 
 // src/contracts/protocols/oauth.ts
 var HttpUrl2 = Schema_exports.String.check(
@@ -2497,7 +2638,7 @@ var CacheEntry = Schema_exports.Struct({
   freshUntil: Time,
   staleUntil: Time
 });
-var CacheCommand2 = Schema_exports.Union([
+var CacheCommand = Schema_exports.Union([
   Schema_exports.Struct({ operation: Schema_exports.Literal("read"), keys: Schema_exports.Array(Key) }),
   Schema_exports.Struct({
     operation: Schema_exports.Literal("acquire"),
@@ -2527,7 +2668,7 @@ var CacheCommand2 = Schema_exports.Union([
   }),
   Schema_exports.Struct({ operation: Schema_exports.Literal("invalidate"), key: Key })
 ]);
-var CacheReply2 = Schema_exports.Union([
+var CacheReply = Schema_exports.Union([
   Schema_exports.Struct({ ok: Schema_exports.Literal(true), value: Schema_exports.Json }),
   Schema_exports.Struct({ ok: Schema_exports.Literal(false), error: CacheError })
 ]);
@@ -3099,8 +3240,8 @@ var protocol1 = {
     workflowStep: WorkflowRpcCommand2,
     workflowStepReply: WorkflowRpcResult2,
     workflowControl: WorkflowControlCommand2,
-    cacheCommand: CacheCommand2,
-    cacheReply: CacheReply2
+    cacheCommand: CacheCommand,
+    cacheReply: CacheReply
   }
 };
 
@@ -3117,11 +3258,11 @@ var protocol2 = {
 };
 
 // src/contracts/protocols/3.ts
-var maxFailureMessageLength = 2048;
-var FailureSource = Schema_exports.Literals(["app", "storage", "service"]);
+var maxFailureMessageLength2 = 2048;
+var FailureSource2 = Schema_exports.Literals(["app", "storage", "service"]);
 var FailureName2 = Schema_exports.String.check(Schema_exports.isMaxLength(128));
-var FailureCode = Schema_exports.String.check(Schema_exports.isMaxLength(128));
-var FailureMessage2 = Schema_exports.String.check(Schema_exports.isMaxLength(maxFailureMessageLength));
+var FailureCode2 = Schema_exports.String.check(Schema_exports.isMaxLength(128));
+var FailureMessage2 = Schema_exports.String.check(Schema_exports.isMaxLength(maxFailureMessageLength2));
 var WorkflowFailureDetail2 = {
   step: Schema_exports.optionalKey(Schema_exports.String.check(Schema_exports.isMaxLength(200))),
   errorName: Schema_exports.optionalKey(FailureName2),
@@ -3178,9 +3319,9 @@ var DatabaseFieldReserved2 = class extends Schema_exports.TaggedError()(
 ) {
 };
 var FailureDetail2 = {
-  source: Schema_exports.optionalKey(FailureSource),
+  source: Schema_exports.optionalKey(FailureSource2),
   errorName: Schema_exports.optionalKey(FailureName2),
-  code: Schema_exports.optionalKey(FailureCode),
+  code: Schema_exports.optionalKey(FailureCode2),
   message: Schema_exports.optionalKey(FailureMessage2)
 };
 var HostDeclarationInvalid2 = class extends Schema_exports.TaggedError()(
@@ -3243,8 +3384,8 @@ var protocol3 = {
     workflowStep: WorkflowRpcCommand2,
     workflowStepReply: WorkflowRpcResult3,
     workflowControl: WorkflowControlCommand2,
-    cacheCommand: CacheCommand2,
-    cacheReply: CacheReply2
+    cacheCommand: CacheCommand,
+    cacheReply: CacheReply
   }
 };
 
@@ -3638,40 +3779,40 @@ var protocol7 = {
 };
 
 // src/contracts/protocols/8.ts
-var maxFailureFields = 8;
-var maxFailureFieldLength = 256;
-var FailureFieldName = Schema_exports.String.check(
+var maxFailureFields2 = 8;
+var maxFailureFieldLength2 = 256;
+var FailureFieldName2 = Schema_exports.String.check(
   Schema_exports.isPattern(/^[A-Za-z_$][A-Za-z0-9_$]{0,63}$/)
 );
-var FailureFieldValue = Schema_exports.Union([
-  Schema_exports.String.check(Schema_exports.isMaxLength(maxFailureFieldLength)),
+var FailureFieldValue2 = Schema_exports.Union([
+  Schema_exports.String.check(Schema_exports.isMaxLength(maxFailureFieldLength2)),
   Schema_exports.Finite,
   Schema_exports.Boolean
 ]);
-var FailureFields = Schema_exports.Record(FailureFieldName, FailureFieldValue).check(
-  Schema_exports.isMaxProperties(maxFailureFields)
+var FailureFields2 = Schema_exports.Record(FailureFieldName2, FailureFieldValue2).check(
+  Schema_exports.isMaxProperties(maxFailureFields2)
 );
 var FailureDetail3 = {
-  source: Schema_exports.optionalKey(FailureSource),
+  source: Schema_exports.optionalKey(FailureSource2),
   errorName: Schema_exports.optionalKey(FailureName2),
-  code: Schema_exports.optionalKey(FailureCode),
+  code: Schema_exports.optionalKey(FailureCode2),
   message: Schema_exports.optionalKey(FailureMessage2),
-  fields: Schema_exports.optionalKey(FailureFields)
+  fields: Schema_exports.optionalKey(FailureFields2)
 };
-var maxUpstreamMessageLength = 1024;
+var maxUpstreamMessageLength2 = 1024;
 var UpstreamError2 = Schema_exports.Struct({
   code: Schema_exports.Union([
     Schema_exports.Int,
     Schema_exports.String.check(Schema_exports.isMinLength(1), Schema_exports.isMaxLength(128))
   ]),
-  message: Schema_exports.optionalKey(Schema_exports.String.check(Schema_exports.isMaxLength(maxUpstreamMessageLength)))
+  message: Schema_exports.optionalKey(Schema_exports.String.check(Schema_exports.isMaxLength(maxUpstreamMessageLength2)))
 });
-var FailurePhase = Schema_exports.Literals(["connect", "discover", "call"]);
+var FailurePhase2 = Schema_exports.Literals(["connect", "discover", "call"]);
 var ProviderError3 = class extends Schema_exports.TaggedError()("ProviderError", {
   reason: Schema_exports.Literals(["unauthorized", "forbidden", "rate_limited", "unavailable", "rejected"]),
   status: Schema_exports.optional(Schema_exports.Int.check(Schema_exports.isBetween({ minimum: 100, maximum: 599 }))),
   accountId: Schema_exports.optional(AccountId2),
-  phase: Schema_exports.optional(FailurePhase),
+  phase: Schema_exports.optional(FailurePhase2),
   upstream: Schema_exports.optional(UpstreamError2)
 }) {
 };
@@ -3878,6 +4019,308 @@ var protocol10 = {
   }
 };
 
+// src/contracts/protocols/11.ts
+var EventName2 = Schema_exports.String.check(
+  Schema_exports.isPattern(/^[a-z][a-z0-9_]*(?:\.[a-z][a-z0-9_]*)*$/u),
+  Schema_exports.isMaxLength(64)
+);
+var EventFilterValue2 = Schema_exports.Union([Schema_exports.String, Schema_exports.Finite, Schema_exports.Boolean]);
+var DeclaredEvent2 = Schema_exports.Struct({
+  description: Schema_exports.String.check(Schema_exports.isMinLength(1), Schema_exports.isMaxLength(1e3)),
+  filters: JsonObject3,
+  payload: JsonObject3
+});
+var DeclaredEvents2 = Schema_exports.Record(EventName2, DeclaredEvent2);
+var EmittedEvent2 = Schema_exports.Struct({
+  name: EventName2,
+  id: Schema_exports.String.check(Schema_exports.isMinLength(1), Schema_exports.isMaxLength(200)),
+  occurredAt: Schema_exports.Int.check(Schema_exports.isGreaterThanOrEqualTo(0)),
+  data: JsonValue2,
+  filters: Schema_exports.Record(Schema_exports.String, EventFilterValue2),
+  account: Schema_exports.NullOr(AccountId2)
+});
+var EmittedEvents2 = Schema_exports.Array(EmittedEvent2).check(Schema_exports.isMaxLength(100));
+var DeclaredRequirements6 = Schema_exports.Struct({
+  ...DeclaredRequirements5.fields,
+  events: Schema_exports.optionalKey(DeclaredEvents2)
+});
+var HostResponse6 = Schema_exports.Union([
+  Schema_exports.Struct({
+    ok: Schema_exports.Literal(true),
+    value: JsonValue2,
+    toolError: Schema_exports.optionalKey(Schema_exports.Literal(true)),
+    events: Schema_exports.optionalKey(EmittedEvents2)
+  }),
+  Schema_exports.Struct({ ok: Schema_exports.Literal(false), error: HostError5 })
+]);
+var CacheError2 = class extends Schema_exports.TaggedError()("CacheError", {
+  reason: Schema_exports.Literals(["unavailable", "storage", "invalid", "capacity", "timeout"]),
+  limit: Schema_exports.optionalKey(
+    Schema_exports.Literals([
+      "keyBytes",
+      "entryBytes",
+      "batchBytes",
+      "batchEntries",
+      "totalBytes",
+      "totalEntries"
+    ])
+  )
+}) {
+};
+var CacheReply2 = Schema_exports.Union([
+  Schema_exports.Struct({ ok: Schema_exports.Literal(true), value: Schema_exports.Json }),
+  Schema_exports.Struct({ ok: Schema_exports.Literal(false), error: CacheError2 })
+]);
+var protocol11 = {
+  version: 11,
+  schemas: {
+    ...protocol10.schemas,
+    requirements: DeclaredRequirements6,
+    response: HostResponse6,
+    cacheReply: CacheReply2
+  }
+};
+
+// src/contracts/protocols/12.ts
+var PlacementField2 = Schema_exports.Struct({ field: Schema_exports.NonEmptyString });
+var PlacementText2 = Schema_exports.Union([Schema_exports.String, PlacementField2]);
+var PlacementBase642 = Schema_exports.Struct({
+  base64: Schema_exports.Array(PlacementText2).check(Schema_exports.isMinLength(1))
+});
+var PlacementPart2 = Schema_exports.Union([Schema_exports.String, PlacementField2, PlacementBase642]);
+var template2 = Schema_exports.Array(PlacementPart2).check(Schema_exports.isMinLength(1));
+var PlacementHeaderName2 = Schema_exports.String.check(
+  Schema_exports.isPattern(/^[!#$%&'*+.^_`|~0-9a-z-]+$/u)
+);
+var Placement2 = Schema_exports.Union([
+  Schema_exports.Struct({ in: Schema_exports.Literal("header"), name: PlacementHeaderName2, value: template2 }),
+  Schema_exports.Struct({ in: Schema_exports.Literal("query"), name: Schema_exports.NonEmptyString, value: template2 })
+]);
+var Placements2 = Schema_exports.Array(Placement2);
+var exposure2 = {
+  plain: Schema_exports.optionalKey(Schema_exports.Array(Schema_exports.NonEmptyString)),
+  raw: Schema_exports.optionalKey(Schema_exports.Array(Schema_exports.NonEmptyString)),
+  request: Schema_exports.optionalKey(Placements2)
+};
+var DeclaredAuthMethod4 = Schema_exports.Union([
+  Schema_exports.Struct({
+    type: Schema_exports.Literal("secrets"),
+    label: Schema_exports.String,
+    fields: JsonObject3,
+    ...exposure2
+  }),
+  Schema_exports.Struct({
+    type: Schema_exports.Literal("oauth2"),
+    ...OAuth2Config3.members[0].fields,
+    response: JsonObject3,
+    ...exposure2
+  }),
+  Schema_exports.Struct({
+    type: Schema_exports.Literal("oauth2"),
+    ...OAuth2Config3.members[1].fields,
+    response: JsonObject3,
+    ...exposure2
+  }),
+  Schema_exports.Struct({
+    type: Schema_exports.Literal("oauth2"),
+    ...OAuth2Config3.members[2].fields,
+    response: JsonObject3,
+    ...exposure2
+  }),
+  Schema_exports.Struct({
+    type: Schema_exports.Literal("oauth2"),
+    ...OAuth2Config3.members[3].fields,
+    response: JsonObject3,
+    ...exposure2
+  })
+]);
+var DeclaredProvider4 = Schema_exports.Struct({
+  name: Schema_exports.NonEmptyString,
+  auth: Schema_exports.Record(Schema_exports.NonEmptyString, DeclaredAuthMethod4),
+  hosts: Schema_exports.optionalKey(Schema_exports.Array(CredentialHost))
+});
+var iconCharacters = 32 * 1024;
+var AppIcon2 = Schema_exports.Struct({
+  ...RouterIcon2.fields,
+  src: Schema_exports.String.check(
+    Schema_exports.isPattern(
+      /^(?:data:image\/(?:svg\+xml|png|webp|jpeg);base64,[A-Za-z0-9+/]*={0,2}|https:\/\/\S+)$/u
+    ),
+    Schema_exports.isMaxLength(iconCharacters)
+  )
+});
+var AppIcons2 = Schema_exports.Array(AppIcon2).check(
+  Schema_exports.isMaxLength(8),
+  Schema_exports.makeFilter((icons) => JSON.stringify(icons).length <= iconCharacters, {
+    message: `An app's icons total at most ${iconCharacters} characters`
+  })
+);
+var DeclaredRequirements7 = Schema_exports.Struct({
+  ...DeclaredRequirements6.fields,
+  accounts: Schema_exports.Record(
+    Schema_exports.NonEmptyString,
+    Schema_exports.Struct({
+      definition: DeclaredProvider4,
+      cardinality: Schema_exports.Literals(["one", "many"]),
+      health: Schema_exports.optionalKey(Schema_exports.Literal(true))
+    })
+  ),
+  icons: Schema_exports.optionalKey(AppIcons2)
+});
+var ResolvedAccount4 = Schema_exports.Struct({
+  ...ResolvedAccount3.fields,
+  provider: DeclaredProvider4
+});
+var ResolvedAccounts4 = Schema_exports.Record(
+  Schema_exports.NonEmptyString,
+  Schema_exports.Union([ResolvedAccount4, Schema_exports.Array(ResolvedAccount4)])
+);
+var HostInvocation7 = Schema_exports.Struct({
+  ...HostInvocation6.fields,
+  accounts: ResolvedAccounts4
+});
+var Key2 = Schema_exports.String.check(Schema_exports.isPattern(/^[a-f0-9]{64}$/));
+var Time2 = Schema_exports.Finite.check(Schema_exports.isGreaterThanOrEqualTo(0));
+var CacheEntry2 = Schema_exports.Struct({
+  value: Schema_exports.Json,
+  version: Schema_exports.String,
+  freshUntil: Time2,
+  staleUntil: Time2
+});
+var CacheCommand2 = Schema_exports.Union([
+  Schema_exports.Struct({ operation: Schema_exports.Literal("read"), keys: Schema_exports.Array(Key2) }),
+  Schema_exports.Struct({
+    operation: Schema_exports.Literal("acquire"),
+    key: Key2,
+    refresh: Schema_exports.Boolean,
+    version: Schema_exports.optionalKey(Schema_exports.NullOr(Schema_exports.String)),
+    reads: Schema_exports.optionalKey(Schema_exports.Array(Key2))
+  }),
+  Schema_exports.Struct({
+    operation: Schema_exports.Literal("claim"),
+    key: Key2,
+    version: Schema_exports.NullOr(Schema_exports.String)
+  }),
+  Schema_exports.Struct({
+    operation: Schema_exports.Literal("publish"),
+    key: Key2,
+    lease: Schema_exports.String,
+    entry: CacheEntry2
+  }),
+  Schema_exports.Struct({ operation: Schema_exports.Literal("release"), key: Key2, lease: Schema_exports.String }),
+  Schema_exports.Struct({ operation: Schema_exports.Literal("renew"), key: Key2, lease: Schema_exports.String }),
+  Schema_exports.Struct({
+    operation: Schema_exports.Literal("write"),
+    entries: Schema_exports.Array(Schema_exports.Struct({ key: Key2, entry: CacheEntry2 }))
+  }),
+  Schema_exports.Struct({ operation: Schema_exports.Literal("invalidate"), key: Key2 })
+]);
+var protocol12 = {
+  version: 12,
+  schemas: {
+    ...protocol11.schemas,
+    requirements: DeclaredRequirements7,
+    accounts: ResolvedAccounts4,
+    invocation: HostInvocation7,
+    cacheCommand: CacheCommand2
+  }
+};
+
+// ../app-cache/src/contracts/cache.ts
+var CacheError3 = class extends Schema_exports.TaggedError()("CacheError", {
+  reason: Schema_exports.Literals(["unavailable", "storage", "invalid", "capacity", "timeout"]),
+  /** Which of `cacheLimits` the request exceeded, when one did. */
+  limit: Schema_exports.optionalKey(
+    Schema_exports.Literals([
+      "keyBytes",
+      "entryBytes",
+      "batchBytes",
+      "batchEntries",
+      "totalBytes",
+      "totalEntries"
+    ])
+  )
+}) {
+};
+var cacheLimits = {
+  keyBytes: 8192,
+  entryBytes: 2e6,
+  batchBytes: 8e6,
+  batchEntries: 128,
+  totalBytes: 128e6,
+  totalEntries: 1e5,
+  retentionMs: 7 * 24 * 60 * 60 * 1e3,
+  loadTimeoutMs: 9e4,
+  /**
+   * A loader's lease lapses this long after its host last renewed it. Hosts renew every
+   * `renewMs` while the invocation that claimed it runs, so a stalled or lost holder frees the
+   * key well inside an MCP execute budget.
+   */
+  leaseMs: 15e3,
+  renewMs: 5e3,
+  /** The longest a caller waits on another loader before loading for itself without publishing. */
+  waitMs: 1e4,
+  /** Bound for one command to a host store; a lost reply fails instead of holding its caller. */
+  commandTimeoutMs: 1e4
+};
+var Key3 = Schema_exports.String.check(Schema_exports.isPattern(/^[a-f0-9]{64}$/));
+var Time3 = Schema_exports.Finite.check(Schema_exports.isGreaterThanOrEqualTo(0));
+var CacheEntry3 = Schema_exports.Struct({
+  value: Schema_exports.Json,
+  version: Schema_exports.String,
+  freshUntil: Time3,
+  staleUntil: Time3
+});
+var CacheAcquired = Schema_exports.Struct({
+  entry: Schema_exports.NullOr(CacheEntry3),
+  lease: Schema_exports.NullOr(Schema_exports.String),
+  /**
+   * The entries of the command's `reads`, in order, read in the same transaction as `entry`.
+   * Absent when the store did not read them: a store that predates them, or reads past the
+   * batch byte bound. The caller then reads them with a separate `read`.
+   */
+  reads: Schema_exports.optionalKey(Schema_exports.Array(Schema_exports.NullOr(CacheEntry3)))
+});
+var CacheCommand3 = Schema_exports.Union([
+  Schema_exports.Struct({ operation: Schema_exports.Literal("read"), keys: Schema_exports.Array(Key3) }),
+  Schema_exports.Struct({
+    operation: Schema_exports.Literal("acquire"),
+    key: Key3,
+    /** Claim even a fresh entry, as an explicit refresh does. */
+    refresh: Schema_exports.Boolean,
+    /** Claim only while the entry still has this version. Absent accepts the current one. */
+    version: Schema_exports.optionalKey(Schema_exports.NullOr(Schema_exports.String)),
+    /**
+     * Other keys to read in the same transaction, as `read` would, so a caller that needs them
+     * beside the entry makes one round trip. Reading them claims and changes nothing.
+     */
+    reads: Schema_exports.optionalKey(Schema_exports.Array(Key3))
+  }),
+  Schema_exports.Struct({
+    operation: Schema_exports.Literal("claim"),
+    key: Key3,
+    version: Schema_exports.NullOr(Schema_exports.String)
+  }),
+  Schema_exports.Struct({
+    operation: Schema_exports.Literal("publish"),
+    key: Key3,
+    lease: Schema_exports.String,
+    entry: CacheEntry3
+  }),
+  Schema_exports.Struct({ operation: Schema_exports.Literal("release"), key: Key3, lease: Schema_exports.String }),
+  /** Extend a lease its holder still owns. Replies false once the lease lapsed or was replaced. */
+  Schema_exports.Struct({ operation: Schema_exports.Literal("renew"), key: Key3, lease: Schema_exports.String }),
+  Schema_exports.Struct({
+    operation: Schema_exports.Literal("write"),
+    entries: Schema_exports.Array(Schema_exports.Struct({ key: Key3, entry: CacheEntry3 }))
+  }),
+  Schema_exports.Struct({ operation: Schema_exports.Literal("invalidate"), key: Key3 })
+]);
+var CacheReply3 = Schema_exports.Union([
+  Schema_exports.Struct({ ok: Schema_exports.Literal(true), value: Schema_exports.Json }),
+  Schema_exports.Struct({ ok: Schema_exports.Literal(false), error: CacheError3 })
+]);
+
 // src/contracts/schedules.ts
 var minimumIntervalMilliseconds2 = 6e4;
 var count2 = Schema_exports.Int.check(Schema_exports.isGreaterThan(0));
@@ -3909,6 +4352,7 @@ var ScheduleTiming2 = Schema_exports.Union([
 ]);
 var OperationSchedule2 = Schema_exports.Struct({
   name: Schema_exports.NonEmptyString,
+  scope: Schema_exports.optionalKey(Schema_exports.Literal("app")),
   timing: ScheduleTiming2,
   input: JsonValue
 });
@@ -3955,7 +4399,7 @@ var CredentialHost2 = Schema_exports.String.check(
     /^(\*\.)?[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?(?:\.[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?)*(?::[0-9]{1,5})?$/
   )
 );
-var exposure2 = {
+var exposure3 = {
   /** Not secret: app code reads the real value and forms show it. */
   plain: Schema_exports.optionalKey(Schema_exports.Array(Schema_exports.NonEmptyString)),
   /** Secret, but app code reads the real value, for signing and similar uses. */
@@ -3968,44 +4412,54 @@ var exposure2 = {
    */
   request: Schema_exports.optionalKey(Placements)
 };
-var DeclaredAuthMethod4 = Schema_exports.Union([
+var DeclaredAuthMethod5 = Schema_exports.Union([
   Schema_exports.Struct({
     type: Schema_exports.Literal("secrets"),
     label: Schema_exports.String,
     fields: JsonObject2,
-    ...exposure2
+    ...exposure3
   }),
   Schema_exports.Struct({
     type: Schema_exports.Literal("oauth2"),
     ...OAuth2Config.members[0].fields,
     response: JsonObject2,
-    ...exposure2
+    ...exposure3
   }),
   Schema_exports.Struct({
     type: Schema_exports.Literal("oauth2"),
     ...OAuth2Config.members[1].fields,
     response: JsonObject2,
-    ...exposure2
+    ...exposure3
   }),
   Schema_exports.Struct({
     type: Schema_exports.Literal("oauth2"),
     ...OAuth2Config.members[2].fields,
     response: JsonObject2,
-    ...exposure2
+    ...exposure3
   }),
   Schema_exports.Struct({
     type: Schema_exports.Literal("oauth2"),
     ...OAuth2Config.members[3].fields,
     response: JsonObject2,
-    ...exposure2
+    ...exposure3
   })
 ]);
-var DeclaredProvider4 = Schema_exports.Struct({
+var DeclaredProvider5 = Schema_exports.Struct({
   name: Schema_exports.NonEmptyString,
-  auth: Schema_exports.Record(Schema_exports.NonEmptyString, DeclaredAuthMethod4),
+  auth: Schema_exports.Record(Schema_exports.NonEmptyString, DeclaredAuthMethod5),
   hosts: Schema_exports.optionalKey(Schema_exports.Array(CredentialHost2))
 });
-var DeclaredRequirements6 = Schema_exports.Struct({
+var DeclaredAccountSlot = Schema_exports.Struct({
+  definition: DeclaredProvider5,
+  cardinality: Schema_exports.Literals(["one", "many"]),
+  /**
+   * The slot's provider defines an account check. Kept beside the definition, not in it, so
+   * adding or editing a check never changes the provider's identity.
+   */
+  health: Schema_exports.optionalKey(Schema_exports.Literal(true))
+});
+var DeclaredAccountSlots = Schema_exports.Record(Schema_exports.NonEmptyString, DeclaredAccountSlot);
+var DeclaredRequirements8 = Schema_exports.Struct({
   /** Protocol support of this retained framework build, not an author-declared requirement. */
   capabilities: Schema_exports.optionalKey(
     Schema_exports.Struct({
@@ -4023,18 +4477,13 @@ var DeclaredRequirements6 = Schema_exports.Struct({
    * `sql` instead; the field remains so requirements read from older retained builds keep their meaning.
    */
   database: Schema_exports.optionalKey(DatabaseSchema),
-  accounts: Schema_exports.Record(
-    Schema_exports.NonEmptyString,
-    Schema_exports.Struct({
-      definition: DeclaredProvider4,
-      cardinality: Schema_exports.Literals(["one", "many"]),
-      /**
-       * The slot's provider defines an account check. Kept beside the definition, not in it, so
-       * adding or editing a check never changes the provider's identity.
-       */
-      health: Schema_exports.optionalKey(Schema_exports.Literal(true))
-    })
-  ),
+  /**
+   * Requirements by scope. `app` requirements are filled by the accounts the app's managers link for everyone,
+   * for every caller and for background work; `user` requirements by each caller's linked
+   * accounts. A name is used in one scope only. Bundles of protocol 12 and earlier declare user
+   * requirements only.
+   */
+  accounts: Schema_exports.Struct({ app: DeclaredAccountSlots, user: DeclaredAccountSlots }),
   /** The build has SQL files in `migrations/` and owns a raw SQLite database. */
   sql: Schema_exports.optionalKey(Schema_exports.Literal(true)),
   /** The events the app declares, so a host lists them without evaluating the app. */
@@ -4042,9 +4491,9 @@ var DeclaredRequirements6 = Schema_exports.Struct({
   /** The icons the app declares, so a host shows them without evaluating the app. */
   icons: Schema_exports.optionalKey(AppIcons)
 });
-var ResolvedAccount4 = Schema_exports.Struct({
+var ResolvedAccount5 = Schema_exports.Struct({
   id: AccountId,
-  provider: DeclaredProvider4,
+  provider: DeclaredProvider5,
   method: Schema_exports.NonEmptyString,
   /**
    * Changes when the account is reconnected or its credentials replaced, not on renewal. Hosts
@@ -4053,10 +4502,14 @@ var ResolvedAccount4 = Schema_exports.Struct({
   generation: Schema_exports.optionalKey(Schema_exports.Int),
   fields: JsonObject2
 });
-var ResolvedAccounts4 = Schema_exports.Record(
+var ResolvedAccountSlots = Schema_exports.Record(
   Schema_exports.NonEmptyString,
-  Schema_exports.Union([ResolvedAccount4, Schema_exports.Array(ResolvedAccount4)])
+  Schema_exports.Union([ResolvedAccount5, Schema_exports.Array(ResolvedAccount5)])
 );
+var ResolvedAccounts5 = Schema_exports.Struct({
+  app: ResolvedAccountSlots,
+  user: Schema_exports.optionalKey(ResolvedAccountSlots)
+});
 var TrustedToolApproval2 = Schema_exports.Struct({ tool: Schema_exports.NonEmptyString, input: JsonValue });
 var InvocationDeadline2 = Schema_exports.Finite.check(Schema_exports.isGreaterThanOrEqualTo(0));
 var HostedTool3 = Schema_exports.Struct({
@@ -4247,7 +4700,7 @@ var HostError6 = Schema_exports.Union([
   ElicitationFailed,
   HostKindMismatch2
 ]);
-var HostResponse6 = Schema_exports.Union([
+var HostResponse7 = Schema_exports.Union([
   Schema_exports.Struct({
     ok: Schema_exports.Literal(true),
     value: JsonValue,
@@ -4257,9 +4710,9 @@ var HostResponse6 = Schema_exports.Union([
   }),
   Schema_exports.Struct({ ok: Schema_exports.Literal(false), error: HostError6 })
 ]);
-var HostInvocation7 = Schema_exports.Struct({
+var HostInvocation8 = Schema_exports.Struct({
   command: HostRequest5,
-  accounts: ResolvedAccounts4,
+  accounts: ResolvedAccounts5,
   approval: Schema_exports.optionalKey(TrustedToolApproval2),
   replay: Schema_exports.optionalKey(WorkflowReplay),
   deadline: Schema_exports.optionalKey(InvocationDeadline2),
@@ -4268,10 +4721,10 @@ var HostInvocation7 = Schema_exports.Struct({
 var current = {
   version: frameworkProtocol,
   schemas: {
-    invocation: HostInvocation7,
+    invocation: HostInvocation8,
     request: HostRequest5,
-    response: HostResponse6,
-    requirements: DeclaredRequirements6,
+    response: HostResponse7,
+    requirements: DeclaredRequirements8,
     catalog: HostedCatalog4,
     catalogSummary: HostedCatalogSummary4,
     skills: SkillCatalogResponse3,
@@ -4280,23 +4733,31 @@ var current = {
     workflowStep: WorkflowRpcCommand,
     workflowStepReply: WorkflowRpcResult,
     workflowControl: WorkflowControlCommand,
-    cacheCommand: CacheCommand,
-    cacheReply: CacheReply,
+    cacheCommand: CacheCommand3,
+    cacheReply: CacheReply3,
     accountCheck: AccountCheckResult,
-    accounts: ResolvedAccounts4,
+    accounts: ResolvedAccounts5,
     migrate: MigrateResult2
   }
 };
 
 // src/contracts/host.ts
 var HostAccount = Schema_exports.Struct({
-  ...ResolvedAccount4.fields,
+  ...ResolvedAccount5.fields,
   managed: Schema_exports.optionalKey(Schema_exports.Literal(true))
 });
-var HostAccounts = Schema_exports.Record(
+var HostAccountSlots = Schema_exports.Record(
   Schema_exports.NonEmptyString,
   Schema_exports.Union([HostAccount, Schema_exports.Array(HostAccount)])
 );
+var HostAccounts = Schema_exports.Struct({
+  app: HostAccountSlots,
+  user: Schema_exports.optionalKey(HostAccountSlots)
+});
+var scopedSlots = (accounts) => [
+  ...Object.entries(accounts.app),
+  ...Object.entries(accounts.user ?? {})
+];
 var skillsCommand = (sources) => sources ? { operation: "skills", sources: true } : { operation: "skills" };
 var skillCatalog = (response) => Schema_exports.is(SkillSources3)(response) ? response : { skills: response };
 var inspectCommand = (tools, scheduled) => ({
@@ -4372,6 +4833,36 @@ var InvocationTimingSink = Context_exports.Reference(
 );
 
 export {
+  maxFailureMessageLength,
+  FailureSource,
+  FailureName,
+  FailureCode,
+  FailureMessage,
+  maxFailureFields,
+  maxFailureFieldLength,
+  FailureFieldName,
+  FailureFieldValue,
+  FailureFields,
+  FailureDetail,
+  maxUpstreamMessageLength,
+  UpstreamError,
+  FailurePhase,
+  ProviderError,
+  NetworkRefusal,
+  NetworkRefused,
+  networkRefusalStatus,
+  networkRefusalHeader,
+  NetworkRefusedHeader,
+  networkRefusalResponse,
+  RestrictedFetchOption,
+  supportedFetchOptions,
+  FetchOptionUnsupported,
+  CacheError3 as CacheError,
+  cacheLimits,
+  CacheEntry3 as CacheEntry,
+  CacheAcquired,
+  CacheCommand3 as CacheCommand,
+  CacheReply3 as CacheReply,
   SecretsMethod,
   OAuthClientAuth,
   OAuthSecretClientAuth,
@@ -4485,6 +4976,8 @@ export {
   protocol8,
   protocol9,
   protocol10,
+  protocol11,
+  protocol12,
   minimumIntervalMilliseconds2 as minimumIntervalMilliseconds,
   Interval,
   CalendarSchedule2 as CalendarSchedule,
@@ -4493,11 +4986,14 @@ export {
   McpError6 as McpError2,
   SkillLoadFailed3 as SkillLoadFailed,
   CredentialHost2 as CredentialHost,
-  DeclaredAuthMethod4 as DeclaredAuthMethod,
-  DeclaredProvider4 as DeclaredProvider,
-  DeclaredRequirements6 as DeclaredRequirements,
-  ResolvedAccount4 as ResolvedAccount,
-  ResolvedAccounts4 as ResolvedAccounts,
+  DeclaredAuthMethod5 as DeclaredAuthMethod,
+  DeclaredProvider5 as DeclaredProvider,
+  DeclaredAccountSlot,
+  DeclaredAccountSlots,
+  DeclaredRequirements8 as DeclaredRequirements,
+  ResolvedAccount5 as ResolvedAccount,
+  ResolvedAccountSlots,
+  ResolvedAccounts5 as ResolvedAccounts,
   TrustedToolApproval2 as TrustedToolApproval,
   InvocationDeadline2 as InvocationDeadline,
   HostedTool3 as HostedTool,
@@ -4528,11 +5024,13 @@ export {
   HostToolPolicyFailed2 as HostToolPolicyFailed,
   HostOutputInvalid2 as HostOutputInvalid,
   HostError6 as HostError,
-  HostResponse6 as HostResponse,
-  HostInvocation7 as HostInvocation,
+  HostResponse7 as HostResponse,
+  HostInvocation8 as HostInvocation,
   current,
   HostAccount,
+  HostAccountSlots,
   HostAccounts,
+  scopedSlots,
   skillsCommand,
   skillCatalog,
   inspectCommand,