melchizedek-agents 1.2.0 → 1.3.0

package/dist/lib/onboarding.d.ts

@@ -4,7 +4,8 @@
  * WHY this file exists:
  *   A newcomer arrives with something: no key, one provider's key, several, a
  *   gateway key, a cloud account, a server to put in front of other people,
- *   or a ChatGPT / Claude.ai / Gemini CLI sign-in. Each of those is a
+ *   a ChatGPT plan on their own machine (Sign in with ChatGPT, ADR 0126), or
+ *   a Claude.ai / Gemini CLI / Codex CLI sign-in. Each of those is a
  *   different first ten minutes. This module names those levels once, from
  *   what the engine actually supports (lib/models/providerMap.ts,
  *   endpoints.ts, gateway.ts, the A2A server's identity modes and the OAuth
@@ -26,7 +27,7 @@
  *   ignored (secrets-hygiene).
  */
 import type { DoctorResult, Tier } from './doctor.ts';
-export type LevelId = 'local' | 'one-provider' | 'several-providers' | 'gateway' | 'cloud-platform' | 'byok' | 'caller-tokens' | 'oauth-grants' | 'subscription-signin';
+export type LevelId = 'local' | 'one-provider' | 'several-providers' | 'gateway' | 'cloud-platform' | 'byok' | 'caller-tokens' | 'oauth-grants' | 'chatgpt-signin' | 'subscription-signin';
 /** How a command is spelled: in a project that installed the package, or in a clone of the repository. */
 export type CommandForm = 'package' | 'clone';
 export interface EnvLine {
@@ -51,7 +52,7 @@ export interface Level {
     notes: string[];
     /** The onboarding skill a coding agent follows for this level. */
     skill: string;
-    /** False for an entry that is not a way to run the engine (subscription sign-ins). */
+    /** False for an entry that is not a way to run the engine (the unsupported subscription sign-ins). */
     detectable: boolean;
 }
 /** Shipped templates and examples by the tier their models imply, and which declare an OAuth grant. */

package/dist/lib/onboarding.js

@@ -4,7 +4,8 @@
  * WHY this file exists:
  *   A newcomer arrives with something: no key, one provider's key, several, a
  *   gateway key, a cloud account, a server to put in front of other people,
- *   or a ChatGPT / Claude.ai / Gemini CLI sign-in. Each of those is a
+ *   a ChatGPT plan on their own machine (Sign in with ChatGPT, ADR 0126), or
+ *   a Claude.ai / Gemini CLI / Codex CLI sign-in. Each of those is a
  *   different first ten minutes. This module names those levels once, from
  *   what the engine actually supports (lib/models/providerMap.ts,
  *   endpoints.ts, gateway.ts, the A2A server's identity modes and the OAuth
@@ -35,6 +36,7 @@ import { PROVIDERS } from './models/providerMap.js';
 import { CREDENTIAL_KEY_ENV } from './tools/credentialCipher.js';
 import { OAUTH_HOSTS_ENV } from './tools/oauthHosts.js';
 import { OAUTH_REDIRECT_URI_ENV } from './a2a/oauthSetup.js';
+import { CHATGPT_SIGNIN_ENV, CHATGPT_SIGNIN_FILE_ENV } from './chatgpt/state.js';
 // ── Where the package lives ──────────────────────────────────────────────────
 /** The package (or clone) root: the directory holding config/agents/syndicate.schema.json. */
 export function packageRoot(from = fileURLToPath(import.meta.url)) {
@@ -332,18 +334,43 @@ export const LEVELS = [
         skill: 'melchizedek-onboard-serve',
         detectable: true,
     },
+    {
+        id: 'chatgpt-signin',
+        menu: 'A ChatGPT plan, on your own machine (Sign in with ChatGPT, local only)',
+        title: 'Sign in with ChatGPT (local only)',
+        summary: "OpenAI's own Sign in with ChatGPT lets an open-source app that runs on your machine use your ChatGPT plan for OpenAI requests. `melchizedek-setup --chatgpt-signin` opens your browser; once you approve, OpenAI model ids (`gpt-*`, `o<digit>*`) run on your plan whenever OPENAI_API_KEY is not set. The engine registers as its own app with OpenAI and never reads another app's sign-in. Local only: the A2A server, the worker and every other served surface refuse to start while it is the OpenAI path.",
+        env: [
+            { name: CHATGPT_SIGNIN_FILE_ENV, shape: 'a path outside any git repository (default ~/.melchizedek/chatgpt-signin.json)', purpose: 'optional: where the sign-in is stored, mode 600' },
+            { name: CHATGPT_SIGNIN_ENV, shape: 'off', purpose: 'optional: ignore a stored sign-in in this process' },
+            { name: 'OPENAI_API_KEY', shape: 'leave blank', purpose: 'a key, when set, wins over the sign-in' },
+        ],
+        confirm: 'the providers line shows `✓ OpenAI ChatGPT sign-in, local only`, and the `chatgpt` line reads `signed in · carries OpenAI ids · local only`.',
+        runs: (s) => [`OpenAI files: ${list(s.byTier.openai)}`, `with no key at all: ${list(s.byTier.keyless)}`],
+        first: {
+            package: ['npx melchizedek-setup --chatgpt-signin', 'npx melchizedek-doctor', init('package', 'research_brief'), '# change its model: lines to a GPT id your ChatGPT account offers, then:', chat('package', 'research_brief')],
+            clone: ['npm run setup -- --chatgpt-signin', 'npm run doctor', "# change a syndicate's model: lines to a GPT id your ChatGPT account offers, then:", 'npm run chat:syndicate'],
+        },
+        notes: [
+            'OpenAI documents this flow for open-source and personal projects that run locally (https://developers.openai.com/siwc/token-sharing-open-source). It is a preview: requests go to the Responses API on api.openai.com, streamed and not stored, without temperature, top_p or an output-token cap, and only models your account lists answer.',
+            "Your ChatGPT plan's usage limits apply. A limit reached is reported as an OpenAI error and is not retried.",
+            '`melchizedek-setup --chatgpt-status` shows where the sign-in is; `--chatgpt-signout` removes the tokens and revokes them at OpenAI. A stored sign-in is never copied into `.env` or the repository.',
+            'To serve on the same machine, set OPENAI_API_KEY (or Azure OpenAI), or `MELCHIZEDEK_CHATGPT_SIGNIN=off` for the served process; `doctor --check` fails a served configuration that would run on the sign-in.',
+        ],
+        skill: 'melchizedek-onboard-keys',
+        detectable: true,
+    },
     {
         id: 'subscription-signin',
-        menu: 'A ChatGPT / Codex, Claude.ai or Gemini CLI sign-in (no API key)',
-        title: 'Subscription sign-ins (ChatGPT / Codex, Claude.ai, Gemini CLI)',
-        summary: "Not supported, on purpose. A consumer subscription sign-in authorizes that vendor's own apps. The engine does not read, reuse or relay those tokens: Anthropic and Google say third-party apps may not use them, and OpenAI's plan-usage sign-in is a preview for approved or locally hosted apps that this engine has not integrated. Use the same vendor's sanctioned route instead.",
+        menu: 'A Claude.ai or Gemini CLI sign-in, or a Codex CLI login (no API key)',
+        title: 'Subscription sign-ins (Claude.ai, Gemini CLI, Codex CLI)',
+        summary: "Not supported, on purpose. A consumer subscription sign-in authorizes that vendor's own apps. The engine does not read, reuse or relay those tokens: Anthropic and Google say third-party apps may not use them, and the Codex CLI's login belongs to the Codex CLI. OpenAI's own Sign in with ChatGPT is the exception, and it is level 9, on your own machine only. Otherwise use the same vendor's sanctioned route.",
         env: [
-            { name: 'OPENAI_API_KEY', shape: 'an API key from https://platform.openai.com/api-keys', purpose: 'instead of a ChatGPT / Codex sign-in (or Azure OpenAI: level 5)' },
+            { name: 'OPENAI_API_KEY', shape: 'an API key from https://platform.openai.com/api-keys', purpose: 'instead of a Codex CLI login (or Sign in with ChatGPT: level 9; Azure OpenAI: level 5)' },
             { name: 'ANTHROPIC_API_KEY', shape: 'an API key from https://console.anthropic.com', purpose: 'instead of a Claude.ai sign-in (or Bedrock / Vertex AI: level 5)' },
             { name: 'GOOGLE_GENAI_API_KEY', shape: 'an API key from https://aistudio.google.com (free tier)', purpose: 'instead of a Gemini CLI sign-in (or Vertex AI: level 5)' },
         ],
-        confirm: 'the provider you chose shows a ✓; nothing reads a subscription sign-in.',
-        runs: () => ['as level 2 (one key) or level 5 (cloud platform)'],
+        confirm: "the provider you chose shows a ✓; nothing reads another app's sign-in.",
+        runs: () => ['as level 2 (one key), level 5 (cloud platform) or, for OpenAI on your own machine, level 9'],
         first: {
             package: [init('package', 'research_brief'), chat('package', 'research_brief')],
             clone: ['npm run chat:syndicate'],
@@ -351,7 +378,7 @@ export const LEVELS = [
         notes: [
             'Anthropic: Claude.ai (Pro/Max) OAuth is for Claude Code and its own apps; third-party developers may not offer Claude.ai login or route requests through those credentials. Use an API key, Bedrock or Vertex AI.',
             "Google: reaching Gemini CLI's services with its sign-in from third-party software is against Gemini CLI's terms. Use an AI Studio key or Vertex AI.",
-            "OpenAI: an API key or Azure OpenAI. OpenAI's Sign in with ChatGPT plan-usage flow is a documented preview for open-source, locally hosted apps; the engine does not implement it, and reusing the Codex CLI's own token is not that flow.",
+            "OpenAI: an API key, Azure OpenAI, or on your own machine Sign in with ChatGPT (level 9), which is the engine's own registration with OpenAI. The engine never reads the Codex CLI's stored login or uses its client id.",
             'A coding agent signed in with a subscription (Claude Code, Codex, Gemini CLI) can still drive this repository: the sign-in pays for the coding agent, and the engine runs on the keys above.',
         ],
         skill: 'melchizedek-onboard-keys',
@@ -416,7 +443,7 @@ export function renderOnboardingDoc(shipped = shippedIndex()) {
  * Local is always available (whether Ollama is running is not checked).
  */
 export function detectLevels(result) {
-    const direct = result.providers.filter((p) => p.platform === 'direct' && p.funded && p.transport === 'direct');
+    const direct = result.providers.filter((p) => p.platform === 'direct' && p.funded && p.transport === 'direct' && p.credential !== 'chatgpt-signin');
     const names = direct.map((p) => `${p.label} (${p.keyEnv})`);
     const cloud = result.endpoints.filter((e) => e.platform === 'vertex' || e.platform === 'bedrock' || e.platform === 'azure' || e.platform === 'invalid');
     const serving = result.serving;
@@ -464,6 +491,18 @@ export function detectLevels(result) {
             evidence: oauthSet.length ? `set: ${oauthSet.join(', ')}` : `${CREDENTIAL_KEY_ENV} unset`,
             problems: result.oauth?.problems ?? [],
         },
+        'chatgpt-signin': {
+            detected: !!result.chatgpt?.routesOpenAi,
+            // Presence only: the file's path stays on the doctor's own line.
+            evidence: !result.chatgpt?.present
+                ? 'no ChatGPT sign-in stored'
+                : !result.chatgpt.signedIn
+                    ? 'a sign-in file without tokens (signed out)'
+                    : result.chatgpt.routesOpenAi
+                        ? 'signed in; carries OpenAI ids (local only)'
+                        : 'signed in; not used (OPENAI_API_KEY, another OpenAI endpoint, or switched off)',
+            problems: result.chatgpt?.problems ?? [],
+        },
     };
     return LEVELS.filter((l) => l.detectable).map((l) => ({ id: l.id, ...out[l.id] }));
 }

package/dist/lib/runtime/syndicateTurn.js

@@ -57,7 +57,7 @@ export { CREDENTIAL_REQUEST, credentialResponsePart, describeConsent, pendingCon
 export { chooseRuntime, describeRuntime, runtimeSetting, DEFAULT_RUNTIME, RUNTIMES, RuntimeRemovedError, UnsupportedOnRuntimeError } from './runtimeFlag.js';
 // The session store a turn takes when nothing durable is configured, and the engine's interfaces (ADR 0107).
 export { InProcessSessionService } from './sessions.js';
-import { ROUTE_STEP_SUFFIX, describeInput, inputRequestFrom, isWorkflowSyndicate } from '../workflow.js';
+import { ROUTE_STEP_SUFFIX, inputRequestFrom, isWorkflowSyndicate } from '../workflow.js';
 export { describeInput } from '../workflow.js';
 import { isDispatchSyndicate, matchRouteOverride, resolveRoute } from '../dispatch.js';
 import { collectGrounding, describeGrounding, newGroundingState, webSourcesLine } from '../grounding.js';
@@ -86,15 +86,28 @@ const CLASSIFIER_PREAMBLE = `RECENT CONVERSATION, oldest first — context for y
 // The defaults live with the loop's self-correction (lib/runtime/native/selfCorrection.ts).
 export { DEFAULT_MODEL_ERROR_RETRIES, DEFAULT_TOOL_ERROR_RETRIES } from './native/selfCorrection.js';
 // ── Draining one agent's stream ──────────────────────────────────────────────
-function formatToolArgs(args) {
-    if (!args || Object.keys(args).length === 0)
-        return '';
-    return Object.entries(args)
-        .map(([k, v]) => {
-        const raw = typeof v === 'string' ? v : JSON.stringify(v);
-        return `${k}=${raw.length > 60 ? `${raw.slice(0, 60)}...` : raw}`;
-    })
-        .join(', ');
+/**
+ * The shape of a tool call's arguments for a log line: the key names and the
+ * size, never a value. Arguments are model-chosen and routinely carry the
+ * person's words, and a server log is not where those belong (the ledger is
+ * the deliberate record, with its own retention).
+ */
+function describeToolArgs(args) {
+    const keys = args ? Object.keys(args) : [];
+    if (!keys.length)
+        return 'no args';
+    let bytes;
+    try {
+        bytes = Buffer.byteLength(JSON.stringify(args), 'utf8');
+    }
+    catch {
+        return `args: ${keys.join(', ')}`;
+    }
+    return `args: ${keys.join(', ')} (${bytes.toLocaleString()} bytes)`;
+}
+/** A pending question for a log line: who asks, never what. */
+function describeInputForLog(input) {
+    return `${input.node} asks a question${input.path?.length ? ` (${input.path.join(' → ')})` : ''}`;
 }
 /**
  * Drains one agent's event stream into a DrainedRun. The answer is the LAST
@@ -188,7 +201,7 @@ export async function drainAgentStream(stream, opts = {}) {
             if (inputRequest) {
                 // An ask_user node: the workflow waits for the person (lib/workflow.ts).
                 d.inputRequests.push(inputRequest);
-                ev.log?.(`⏸ ${describeInput(inputRequest)}`);
+                ev.log?.(`⏸ ${describeInputForLog(inputRequest)}`);
                 continue;
             }
             if (!name)
@@ -197,7 +210,7 @@ export async function drainAgentStream(stream, opts = {}) {
             if (opts.subagentNames?.has(name))
                 d.delegations.push(name);
             d.toolCalls.push({ agent: e.author ?? 'unknown', name, args });
-            ev.log?.(`→ Tool: ${name}(${formatToolArgs(args)})`);
+            ev.log?.(`→ Tool: ${name} by ${e.author ?? 'unknown'} — ${describeToolArgs(args)}`);
             if (opts.publishToolStatus)
                 ev.onProgress?.(`Invoking tool: ${name}`);
         }
@@ -580,7 +593,7 @@ async function runTurnInner(opts, control, _runtime, nestedTurn) {
         result.status = 'input-required';
         result.input = input;
         result.text = input.message;
-        ev.log?.(`⏸ Input needed: ${describeInput(input)}`);
+        ev.log?.(`⏸ Input needed: ${describeInputForLog(input)}`);
         return finish();
     };
     /** After the answering run: does a pause wait inside a delegated call `agentName` left open (ADR 0110)? */
@@ -595,7 +608,7 @@ async function runTurnInner(opts, control, _runtime, nestedTurn) {
             result.status = 'input-required';
             result.input = below.question;
             result.text = below.question.message;
-            ev.log?.(`⏸ Input needed: ${describeInput(below.question)} (${below.path.join(' → ')})`);
+            ev.log?.(`⏸ Input needed: ${describeInputForLog({ node: below.question.node, path: below.path })}`);
             return finish();
         }
         return undefined;
@@ -612,7 +625,7 @@ async function runTurnInner(opts, control, _runtime, nestedTurn) {
         result.status = 'input-required';
         result.input = input;
         result.text = input.message;
-        ev.log?.(`⏸ Input needed: ${describeInput(input)}${input.path ? ` (${input.path.join(' → ')})` : ''}`);
+        ev.log?.(`⏸ Input needed: ${describeInputForLog(input)}`);
         return finish();
     };
     /** A nested workflow's walk, or a nested dispatch syndicate's turn, paused below a route (ADR 0119, ADR 0120): its approval request, its consent request, else its question. */
@@ -922,7 +935,8 @@ async function runTurnInner(opts, control, _runtime, nestedTurn) {
             throw new Error(`Dispatch failed: no subagent named '${resolution.route}' is declared.`);
         result.route = { ...resolution, decidedBy };
         const routeNote = resolution.reason ? ` — ${resolution.reason}` : '';
-        ev.log?.(`⇄ Route: ${resolution.route}${routeNote}`);
+        // The classifier's reason can paraphrase the person: progress (to the caller) carries it, the log does not.
+        ev.log?.(`⇄ Route: ${resolution.route}`);
         ev.onProgress?.(`Routed to ${resolution.route}${routeNote}`);
         // ══ DISPATCH ═════════════════════════════════════════════════════════
         if (routeCfg.a2a_agent_url) {

package/dist/lib/syndicateSchema.d.ts

@@ -28,6 +28,8 @@ export declare const REASONING_LEVELS: readonly ['none', 'low', 'medium', 'high'
 export declare const OUTPUT_MIMES: readonly ['application/json', 'text/plain'];
 export declare const TOOL_CHOICE_MODES: readonly ['auto', 'none', 'required'];
 export declare const SKILL_SCRIPT_MODES: readonly ['none', 'local'];
+/** An `mcp_servers` entry's name: lowercase, bounded, one character class (no backtracking). */
+export declare const MCP_SERVER_NAME: RegExp;
 export declare const agentSchema: z.ZodObject<{
     name: z.ZodString;
     description: z.ZodOptional<z.ZodString>;
@@ -131,8 +133,9 @@ export declare const agentSchema: z.ZodObject<{
                 authorization_code: "authorization_code";
                 client_credentials: "client_credentials";
             }>;
+            client_registration: z.ZodOptional<z.ZodLiteral<"dynamic">>;
             authorization_url: z.ZodOptional<z.ZodString>;
-            token_url: z.ZodString;
+            token_url: z.ZodOptional<z.ZodString>;
             client_id: z.ZodOptional<z.ZodString>;
             client_id_env: z.ZodOptional<z.ZodString>;
             client_secret_env: z.ZodOptional<z.ZodString>;
@@ -140,6 +143,38 @@ export declare const agentSchema: z.ZodObject<{
             authorization_params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
         }, z.core.$strict>;
     }, z.core.$strict>>;
+    mcp_transport: z.ZodOptional<z.ZodEnum<{
+        auto: "auto";
+        sse: "sse";
+        streamable_http: "streamable_http";
+    }>>;
+    mcp_servers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        url: z.ZodString;
+        tools: z.ZodArray<z.ZodString>;
+        auth: z.ZodOptional<z.ZodObject<{
+            oauth2: z.ZodObject<{
+                provider: z.ZodString;
+                grant: z.ZodEnum<{
+                    authorization_code: "authorization_code";
+                    client_credentials: "client_credentials";
+                }>;
+                client_registration: z.ZodOptional<z.ZodLiteral<"dynamic">>;
+                authorization_url: z.ZodOptional<z.ZodString>;
+                token_url: z.ZodOptional<z.ZodString>;
+                client_id: z.ZodOptional<z.ZodString>;
+                client_id_env: z.ZodOptional<z.ZodString>;
+                client_secret_env: z.ZodOptional<z.ZodString>;
+                scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                authorization_params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            }, z.core.$strict>;
+        }, z.core.$strict>>;
+        transport: z.ZodOptional<z.ZodEnum<{
+            auto: "auto";
+            sse: "sse";
+            streamable_http: "streamable_http";
+        }>>;
+    }, z.core.$strict>>>;
     skills: z.ZodOptional<z.ZodObject<{
         dir: z.ZodString;
         scripts: z.ZodOptional<z.ZodEnum<{
@@ -171,8 +206,9 @@ export declare const agentSchema: z.ZodObject<{
                     authorization_code: "authorization_code";
                     client_credentials: "client_credentials";
                 }>;
+                client_registration: z.ZodOptional<z.ZodLiteral<"dynamic">>;
                 authorization_url: z.ZodOptional<z.ZodString>;
-                token_url: z.ZodString;
+                token_url: z.ZodOptional<z.ZodString>;
                 client_id: z.ZodOptional<z.ZodString>;
                 client_id_env: z.ZodOptional<z.ZodString>;
                 client_secret_env: z.ZodOptional<z.ZodString>;
@@ -306,8 +342,9 @@ export declare const subagentSchema: z.ZodObject<{
                 authorization_code: "authorization_code";
                 client_credentials: "client_credentials";
             }>;
+            client_registration: z.ZodOptional<z.ZodLiteral<"dynamic">>;
             authorization_url: z.ZodOptional<z.ZodString>;
-            token_url: z.ZodString;
+            token_url: z.ZodOptional<z.ZodString>;
             client_id: z.ZodOptional<z.ZodString>;
             client_id_env: z.ZodOptional<z.ZodString>;
             client_secret_env: z.ZodOptional<z.ZodString>;
@@ -315,6 +352,38 @@ export declare const subagentSchema: z.ZodObject<{
             authorization_params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
         }, z.core.$strict>;
     }, z.core.$strict>>;
+    mcp_transport: z.ZodOptional<z.ZodEnum<{
+        auto: "auto";
+        sse: "sse";
+        streamable_http: "streamable_http";
+    }>>;
+    mcp_servers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+        name: z.ZodString;
+        url: z.ZodString;
+        tools: z.ZodArray<z.ZodString>;
+        auth: z.ZodOptional<z.ZodObject<{
+            oauth2: z.ZodObject<{
+                provider: z.ZodString;
+                grant: z.ZodEnum<{
+                    authorization_code: "authorization_code";
+                    client_credentials: "client_credentials";
+                }>;
+                client_registration: z.ZodOptional<z.ZodLiteral<"dynamic">>;
+                authorization_url: z.ZodOptional<z.ZodString>;
+                token_url: z.ZodOptional<z.ZodString>;
+                client_id: z.ZodOptional<z.ZodString>;
+                client_id_env: z.ZodOptional<z.ZodString>;
+                client_secret_env: z.ZodOptional<z.ZodString>;
+                scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                authorization_params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+            }, z.core.$strict>;
+        }, z.core.$strict>>;
+        transport: z.ZodOptional<z.ZodEnum<{
+            auto: "auto";
+            sse: "sse";
+            streamable_http: "streamable_http";
+        }>>;
+    }, z.core.$strict>>>;
     skills: z.ZodOptional<z.ZodObject<{
         dir: z.ZodString;
         scripts: z.ZodOptional<z.ZodEnum<{
@@ -346,8 +415,9 @@ export declare const subagentSchema: z.ZodObject<{
                     authorization_code: "authorization_code";
                     client_credentials: "client_credentials";
                 }>;
+                client_registration: z.ZodOptional<z.ZodLiteral<"dynamic">>;
                 authorization_url: z.ZodOptional<z.ZodString>;
-                token_url: z.ZodString;
+                token_url: z.ZodOptional<z.ZodString>;
                 client_id: z.ZodOptional<z.ZodString>;
                 client_id_env: z.ZodOptional<z.ZodString>;
                 client_secret_env: z.ZodOptional<z.ZodString>;
@@ -485,8 +555,9 @@ export declare const syndicateSchema: z.ZodObject<{
                     authorization_code: "authorization_code";
                     client_credentials: "client_credentials";
                 }>;
+                client_registration: z.ZodOptional<z.ZodLiteral<"dynamic">>;
                 authorization_url: z.ZodOptional<z.ZodString>;
-                token_url: z.ZodString;
+                token_url: z.ZodOptional<z.ZodString>;
                 client_id: z.ZodOptional<z.ZodString>;
                 client_id_env: z.ZodOptional<z.ZodString>;
                 client_secret_env: z.ZodOptional<z.ZodString>;
@@ -494,6 +565,38 @@ export declare const syndicateSchema: z.ZodObject<{
                 authorization_params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
             }, z.core.$strict>;
         }, z.core.$strict>>;
+        mcp_transport: z.ZodOptional<z.ZodEnum<{
+            auto: "auto";
+            sse: "sse";
+            streamable_http: "streamable_http";
+        }>>;
+        mcp_servers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            url: z.ZodString;
+            tools: z.ZodArray<z.ZodString>;
+            auth: z.ZodOptional<z.ZodObject<{
+                oauth2: z.ZodObject<{
+                    provider: z.ZodString;
+                    grant: z.ZodEnum<{
+                        authorization_code: "authorization_code";
+                        client_credentials: "client_credentials";
+                    }>;
+                    client_registration: z.ZodOptional<z.ZodLiteral<"dynamic">>;
+                    authorization_url: z.ZodOptional<z.ZodString>;
+                    token_url: z.ZodOptional<z.ZodString>;
+                    client_id: z.ZodOptional<z.ZodString>;
+                    client_id_env: z.ZodOptional<z.ZodString>;
+                    client_secret_env: z.ZodOptional<z.ZodString>;
+                    scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                    authorization_params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+                }, z.core.$strict>;
+            }, z.core.$strict>>;
+            transport: z.ZodOptional<z.ZodEnum<{
+                auto: "auto";
+                sse: "sse";
+                streamable_http: "streamable_http";
+            }>>;
+        }, z.core.$strict>>>;
         skills: z.ZodOptional<z.ZodObject<{
             dir: z.ZodString;
             scripts: z.ZodOptional<z.ZodEnum<{
@@ -525,8 +628,9 @@ export declare const syndicateSchema: z.ZodObject<{
                         authorization_code: "authorization_code";
                         client_credentials: "client_credentials";
                     }>;
+                    client_registration: z.ZodOptional<z.ZodLiteral<"dynamic">>;
                     authorization_url: z.ZodOptional<z.ZodString>;
-                    token_url: z.ZodString;
+                    token_url: z.ZodOptional<z.ZodString>;
                     client_id: z.ZodOptional<z.ZodString>;
                     client_id_env: z.ZodOptional<z.ZodString>;
                     client_secret_env: z.ZodOptional<z.ZodString>;
@@ -654,8 +758,9 @@ export declare const syndicateSchema: z.ZodObject<{
                     authorization_code: "authorization_code";
                     client_credentials: "client_credentials";
                 }>;
+                client_registration: z.ZodOptional<z.ZodLiteral<"dynamic">>;
                 authorization_url: z.ZodOptional<z.ZodString>;
-                token_url: z.ZodString;
+                token_url: z.ZodOptional<z.ZodString>;
                 client_id: z.ZodOptional<z.ZodString>;
                 client_id_env: z.ZodOptional<z.ZodString>;
                 client_secret_env: z.ZodOptional<z.ZodString>;
@@ -663,6 +768,38 @@ export declare const syndicateSchema: z.ZodObject<{
                 authorization_params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
             }, z.core.$strict>;
         }, z.core.$strict>>;
+        mcp_transport: z.ZodOptional<z.ZodEnum<{
+            auto: "auto";
+            sse: "sse";
+            streamable_http: "streamable_http";
+        }>>;
+        mcp_servers: z.ZodOptional<z.ZodArray<z.ZodObject<{
+            name: z.ZodString;
+            url: z.ZodString;
+            tools: z.ZodArray<z.ZodString>;
+            auth: z.ZodOptional<z.ZodObject<{
+                oauth2: z.ZodObject<{
+                    provider: z.ZodString;
+                    grant: z.ZodEnum<{
+                        authorization_code: "authorization_code";
+                        client_credentials: "client_credentials";
+                    }>;
+                    client_registration: z.ZodOptional<z.ZodLiteral<"dynamic">>;
+                    authorization_url: z.ZodOptional<z.ZodString>;
+                    token_url: z.ZodOptional<z.ZodString>;
+                    client_id: z.ZodOptional<z.ZodString>;
+                    client_id_env: z.ZodOptional<z.ZodString>;
+                    client_secret_env: z.ZodOptional<z.ZodString>;
+                    scopes: z.ZodOptional<z.ZodArray<z.ZodString>>;
+                    authorization_params: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodString>>;
+                }, z.core.$strict>;
+            }, z.core.$strict>>;
+            transport: z.ZodOptional<z.ZodEnum<{
+                auto: "auto";
+                sse: "sse";
+                streamable_http: "streamable_http";
+            }>>;
+        }, z.core.$strict>>>;
         skills: z.ZodOptional<z.ZodObject<{
             dir: z.ZodString;
             scripts: z.ZodOptional<z.ZodEnum<{
@@ -694,8 +831,9 @@ export declare const syndicateSchema: z.ZodObject<{
                         authorization_code: "authorization_code";
                         client_credentials: "client_credentials";
                     }>;
+                    client_registration: z.ZodOptional<z.ZodLiteral<"dynamic">>;
                     authorization_url: z.ZodOptional<z.ZodString>;
-                    token_url: z.ZodString;
+                    token_url: z.ZodOptional<z.ZodString>;
                     client_id: z.ZodOptional<z.ZodString>;
                     client_id_env: z.ZodOptional<z.ZodString>;
                     client_secret_env: z.ZodOptional<z.ZodString>;