@runtypelabs/cli 2.10.9 → 2.11.1

package/dist/index.js

@@ -72,7 +72,7 @@ var require_default_models = __commonJS({
       // Inception models (routed via Vercel)
       { provider: "runtype", modelId: "mercury-2", isDefault: false },
       // Moonshot models (routed via Cloudflare Workers AI)
-      { provider: "runtype", modelId: "kimi-k2.5", isDefault: false },
+      { provider: "runtype", modelId: "kimi-k2.6", isDefault: false },
       // NVIDIA models (routed via Cloudflare Workers AI)
       { provider: "runtype", modelId: "nemotron-3-120b-a12b", isDefault: false },
       // Google models (routed via Cloudflare Workers AI)
@@ -107,11 +107,6 @@ var require_default_models = __commonJS({
       },
       { id: "gpt-4.1-mini", name: "GPT-4.1 Mini", description: "Fast general purpose" },
       { id: "gpt-5-nano", name: "GPT-5 Nano", description: "Latest generation, very affordable" },
-      {
-        id: "mixlayer/nvidia/orchestrator-8b",
-        name: "NVIDIA Orchestrator 8B",
-        description: "Purpose-built for tool/intent routing"
-      },
       {
         id: "mixlayer/qwen/qwen3.5-9b",
         name: "Qwen 3.5 9B",
@@ -247,6 +242,78 @@ var init_credential_store = __esm({
   }
 });
 
+// ../shared/dist/dashboard-url.js
+var require_dashboard_url = __commonJS({
+  "../shared/dist/dashboard-url.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.ACCOUNT_QUERY_PARAM = void 0;
+    exports.buildDashboardUrl = buildDashboardUrl5;
+    exports.parseAccountParam = parseAccountParam;
+    exports.parseAccountId = parseAccountId;
+    exports.isValidAccountId = isValidAccountId;
+    exports.selectAccountId = selectAccountId3;
+    exports.ACCOUNT_QUERY_PARAM = "account";
+    function buildDashboardUrl5(opts) {
+      let base = opts.baseUrl;
+      while (base.endsWith("/")) {
+        base = base.slice(0, -1);
+      }
+      const path14 = opts.path.startsWith("/") ? opts.path : `/${opts.path}`;
+      const params = new URLSearchParams();
+      if (isValidAccountId(opts.account)) {
+        params.set(exports.ACCOUNT_QUERY_PARAM, opts.account);
+      }
+      if (opts.searchParams) {
+        for (const [key, value] of Object.entries(opts.searchParams)) {
+          if (value !== void 0) {
+            params.set(key, value);
+          }
+        }
+      }
+      const qs = params.toString();
+      return qs ? `${base}${path14}?${qs}` : `${base}${path14}`;
+    }
+    function parseAccountParam(input) {
+      let value;
+      if (input instanceof URLSearchParams) {
+        value = input.get(exports.ACCOUNT_QUERY_PARAM);
+      } else if (input instanceof URL) {
+        value = input.searchParams.get(exports.ACCOUNT_QUERY_PARAM);
+      } else {
+        try {
+          value = new URL(input).searchParams.get(exports.ACCOUNT_QUERY_PARAM);
+        } catch (_a) {
+          const qs = input.startsWith("?") ? input.slice(1) : input;
+          value = new URLSearchParams(qs).get(exports.ACCOUNT_QUERY_PARAM);
+        }
+      }
+      return parseAccountId(value);
+    }
+    function parseAccountId(value) {
+      if (!value)
+        return null;
+      if (value.startsWith("user_") && value.length > "user_".length) {
+        return { kind: "user", id: value };
+      }
+      if (value.startsWith("org_") && value.length > "org_".length) {
+        return { kind: "org", id: value };
+      }
+      return null;
+    }
+    function isValidAccountId(value) {
+      return parseAccountId(value) !== null;
+    }
+    function selectAccountId3(params) {
+      if (isValidAccountId(params.organizationId))
+        return params.organizationId;
+      if (isValidAccountId(params.userId))
+        return params.userId;
+      return void 0;
+    }
+  }
+});
+
 // ../shared/dist/integration-providers.js
 var require_integration_providers = __commonJS({
   "../shared/dist/integration-providers.js"(exports) {
@@ -10994,6 +11061,7 @@ var require_builtin_tools_registry = __commonJS({
     exports.getBuiltInToolsByCategory = getBuiltInToolsByCategory;
     exports.isToolCompatibleWithModel = isToolCompatibleWithModel2;
     exports.getCompatibleBuiltInTools = getCompatibleBuiltInTools;
+    exports.validateConfigAgainstSchema = validateConfigAgainstSchema;
     exports.validateToolConfig = validateToolConfig;
     var generated_orthogonal_tools_1 = require_generated_orthogonal_tools();
     exports.BuiltInToolProvider = {
@@ -11194,11 +11262,14 @@ var require_builtin_tools_registry = __commonJS({
         executionHint: "provider"
         // Anthropic executes this natively
       },
-      // xAI Live Search (native provider feature, enabled via providerOptions)
+      // xAI Live Search (DEPRECATED — retired by xAI on 2026-01-12; requests return 410 Gone).
+      // Kept in the registry so existing flows don't throw on lookup; the xAI executor
+      // auto-migrates its config into the Agent Tools API (xai_web_search / xai_x_search)
+      // on the Responses endpoint. New flows should select xai_web_search or xai_x_search.
       {
         id: "xai_live_search",
-        name: "xAI Live Search",
-        description: "Search the live web, X posts, news, and RSS feeds using xAI's Live Search. Grok can cite sources with URLs.",
+        name: "xAI Live Search (deprecated)",
+        description: "Deprecated. xAI retired Live Search on 2026-01-12; the Chat Completions search_parameters endpoint now returns 410 Gone. Use xAI Web Search or xAI X Search (Agent Tools API) instead. Existing configs are auto-migrated at runtime.",
         category: exports.BuiltInToolCategory.WEB_SEARCH,
         providers: [exports.BuiltInToolProvider.XAI],
         parametersSchema: {
@@ -11293,11 +11364,13 @@ var require_builtin_tools_registry = __commonJS({
             models: ["grok-4", "grok-4-fast", "grok-4.1-fast"]
           }
         ],
-        documentationUrl: "https://docs.x.ai/docs/guides/live-search",
+        documentationUrl: "https://docs.x.ai/docs/guides/tools/search-tools",
         requiresApiKey: true,
         executionHint: "provider",
-        // xAI executes this natively via providerOptions.xai.searchParameters
-        platformKeySupport: true
+        // Executor auto-migrates to Responses API web_search / x_search
+        platformKeySupport: true,
+        deprecated: true,
+        hidden: true
       },
       // xAI X Search (native Responses API server-side tool)
       // Unlike xai_live_search (chat API preprocessing), this is an agentic tool
@@ -11828,6 +11901,77 @@ var require_builtin_tools_registry = __commonJS({
         platformKeySupport: true,
         requiresApiKey: false
       },
+      // Generate PDF — render HTML or Markdown to a PDF document
+      {
+        id: "generate_pdf",
+        name: "Generate PDF",
+        description: "Render HTML or Markdown to a PDF file and store it on Runtype's CDN. Returns a permanent public URL or a time-limited signed URL (default 1 hour) depending on `visibility`. Exactly one of `html` or `markdown` must be provided \u2014 markdown is rendered with GFM in an A4 print shell with sensible typography; html is passed through untouched so callers can control their own fonts and CSS. Optional `pdfOptions` (format, landscape, margin, printBackground, displayHeaderFooter, headerTemplate, footerTemplate, scale, pageRanges, preferCSSPageSize, omitBackground) are forwarded to the renderer. Source is capped at 2 MB; output is capped at 25 MB. Powered by Cloudflare Browser Rendering.",
+        category: exports.BuiltInToolCategory.FILE_OPERATIONS,
+        providers: [exports.BuiltInToolProvider.MULTI],
+        parametersSchema: {
+          type: "object",
+          properties: {
+            html: {
+              type: "string",
+              description: "Complete HTML document (or fragment) to render. Callers supply their own styling. Provide this OR `markdown`, not both."
+            },
+            markdown: {
+              type: "string",
+              description: "Markdown source. Rendered with GFM and wrapped in an A4 print shell. Inline HTML inside the markdown is escaped. Provide this OR `html`, not both."
+            },
+            filename: {
+              type: "string",
+              description: "Optional filename for the stored PDF (defaults to `document-<timestamp>.pdf`)."
+            },
+            visibility: {
+              type: "string",
+              enum: ["public", "private"],
+              description: 'Access control. "public" returns a permanent URL; "private" returns a signed URL that expires (default 1 hour). Default: "public".'
+            },
+            pdfOptions: {
+              type: "object",
+              description: "Optional puppeteer `page.pdf()` options (whitelisted).",
+              properties: {
+                format: {
+                  type: "string",
+                  description: 'Paper format (e.g. "a4", "letter", "legal"). Overrides width/height.'
+                },
+                landscape: { type: "boolean" },
+                printBackground: { type: "boolean" },
+                displayHeaderFooter: { type: "boolean" },
+                headerTemplate: {
+                  type: "string",
+                  description: "HTML template for the print header. Supports `date`, `title`, `url`, `pageNumber`, `totalPages` classes."
+                },
+                footerTemplate: { type: "string" },
+                scale: {
+                  type: "number",
+                  description: "Rendering scale, between 0.1 and 2. Default 1."
+                },
+                preferCSSPageSize: { type: "boolean" },
+                pageRanges: {
+                  type: "string",
+                  description: 'Page ranges to include, e.g. "1-5, 8, 11-13". Default: all pages.'
+                },
+                omitBackground: { type: "boolean" },
+                margin: {
+                  type: "object",
+                  properties: {
+                    top: { type: "string" },
+                    right: { type: "string" },
+                    bottom: { type: "string" },
+                    left: { type: "string" }
+                  }
+                }
+              }
+            }
+          },
+          required: []
+        },
+        executionHint: "platform",
+        platformKeySupport: true,
+        requiresApiKey: false
+      },
       // Record Management Tools — CRUD operations on Runtype records
       {
         id: "runtype_record_upsert",
@@ -12705,13 +12849,8 @@ var require_builtin_tools_registry = __commonJS({
     function getCompatibleBuiltInTools(modelId, provider) {
       return exports.BUILTIN_TOOLS_REGISTRY.filter((tool) => !tool.hidden && isToolCompatibleWithModel2(tool.id, modelId, provider));
     }
-    function validateToolConfig(toolId, config2) {
-      const tool = getBuiltInToolById2(toolId);
-      if (!tool) {
-        return { valid: false, errors: ["Tool not found"] };
-      }
+    function validateConfigAgainstSchema(schema, config2) {
       const errors = [];
-      const schema = tool.parametersSchema;
       if (schema.required) {
         for (const field of schema.required) {
           if (!(field in config2)) {
@@ -12727,19 +12866,23 @@ var require_builtin_tools_registry = __commonJS({
             continue;
           }
           const actualType = Array.isArray(value) ? "array" : typeof value;
-          if (propSchema.type && actualType !== propSchema.type) {
+          const matchesSchemaType = !propSchema.type || actualType === propSchema.type || propSchema.type === "integer" && actualType === "number";
+          if (!matchesSchemaType) {
             errors.push(`Field ${key} should be ${propSchema.type}, got ${actualType}`);
           }
           if (propSchema.enum && !propSchema.enum.includes(value)) {
             errors.push(`Field ${key} must be one of: ${propSchema.enum.join(", ")}`);
           }
-          if (propSchema.type === "number" && typeof value === "number") {
+          if ((propSchema.type === "number" || propSchema.type === "integer") && typeof value === "number") {
             if (propSchema.minimum !== void 0 && value < propSchema.minimum) {
               errors.push(`Field ${key} must be >= ${propSchema.minimum}`);
             }
             if (propSchema.maximum !== void 0 && value > propSchema.maximum) {
               errors.push(`Field ${key} must be <= ${propSchema.maximum}`);
             }
+            if (propSchema.type === "integer" && !Number.isInteger(value)) {
+              errors.push(`Field ${key} should be integer, got non-integer number`);
+            }
           }
           if (propSchema.type === "string" && typeof value === "string") {
             if (propSchema.minLength !== void 0 && value.length < propSchema.minLength) {
@@ -12756,6 +12899,13 @@ var require_builtin_tools_registry = __commonJS({
         errors: errors.length > 0 ? errors : void 0
       };
     }
+    function validateToolConfig(toolId, config2) {
+      const tool = getBuiltInToolById2(toolId);
+      if (!tool) {
+        return { valid: false, errors: ["Tool not found"] };
+      }
+      return validateConfigAgainstSchema(tool.parametersSchema, config2);
+    }
   }
 });
 
@@ -12915,6 +13065,7 @@ var require_generated_model_routing = __commonJS({
       "kimi-k2-thinking-turbo": ["vercel"],
       "kimi-k2-turbo": ["vercel"],
       "kimi-k2.5": ["vercel"],
+      "kimi-k2.6": ["vercel"],
       "llama-3-1-70b": ["vercel"],
       "llama-3-1-8b": ["vercel"],
       "llama-3-2-11b": ["vercel"],
@@ -12978,6 +13129,7 @@ var require_generated_model_routing = __commonJS({
       "qwen-3-235b": ["vercel"],
       "qwen-3-30b": ["vercel"],
       "qwen-3-32b": ["vercel"],
+      "qwen-3.6-max-preview": ["vercel"],
       "qwen3-235b-a22b-thinking": ["vercel"],
       "qwen3-coder": ["vercel"],
       "qwen3-coder-30b-a3b": ["vercel"],
@@ -12997,6 +13149,7 @@ var require_generated_model_routing = __commonJS({
       "qwen3.5-27b": ["mixlayer"],
       "qwen3.5-35b-a3b": ["mixlayer"],
       "qwen3.5-397b-a17b": ["mixlayer"],
+      "qwen3.5-4b-free": ["mixlayer"],
       "qwen3.5-9b": ["mixlayer"],
       "qwen3.5-flash": ["vercel"],
       "qwen3.5-plus": ["vercel"],
@@ -13159,6 +13312,7 @@ var require_generated_model_routing = __commonJS({
       "kimi-k2": ["vercel"],
       "kimi-k2-0905": ["vercel"],
       "kimi-k2-5": ["vercel"],
+      "kimi-k2-6": ["vercel"],
       "kimi-k2-thinking-turbo": ["vercel"],
       "kimi-k2-turbo": ["vercel"],
       "llama-3-2-11b": ["vercel"],
@@ -13216,12 +13370,14 @@ var require_generated_model_routing = __commonJS({
       "qwen-3-14b": ["vercel"],
       "qwen-3-235b": ["vercel"],
       "qwen-3-30b": ["vercel"],
+      "qwen-3-6-max": ["vercel"],
       "qwen3-235b-a22b": ["vercel"],
       "qwen3-32b": ["vercel"],
       "qwen3-5-122b-a10b": ["mixlayer"],
       "qwen3-5-27b": ["mixlayer"],
       "qwen3-5-35b-a3b": ["mixlayer"],
       "qwen3-5-397b-a17b": ["mixlayer"],
+      "qwen3-5-4b-free": ["mixlayer"],
       "qwen3-5-9b": ["mixlayer"],
       "qwen3-5-flash": ["vercel"],
       "qwen3-5-plus": ["vercel"],
@@ -13914,6 +14070,9 @@ var require_generated_model_routing = __commonJS({
       "kimi-k2-5": {
         "vercel": "moonshotai/kimi-k2.5"
       },
+      "kimi-k2-6": {
+        "vercel": "moonshotai/kimi-k2.6"
+      },
       "kimi-k2-thinking": {
         "vercel": "moonshotai/kimi-k2-thinking"
       },
@@ -13926,6 +14085,9 @@ var require_generated_model_routing = __commonJS({
       "kimi-k2.5": {
         "vercel": "moonshotai/kimi-k2.5"
       },
+      "kimi-k2.6": {
+        "vercel": "moonshotai/kimi-k2.6"
+      },
       "llama-3-1-70b": {
         "vercel": "meta/llama-3-1-70b"
       },
@@ -14163,6 +14325,12 @@ var require_generated_model_routing = __commonJS({
       "qwen-3-32b": {
         "vercel": "alibaba/qwen-3-32b"
       },
+      "qwen-3-6-max": {
+        "vercel": "alibaba/qwen-3.6-max-preview"
+      },
+      "qwen-3.6-max-preview": {
+        "vercel": "alibaba/qwen-3.6-max-preview"
+      },
       "qwen3-235b-a22b": {
         "vercel": "alibaba/qwen3-235b-a22b-thinking"
       },
@@ -14184,6 +14352,9 @@ var require_generated_model_routing = __commonJS({
       "qwen3-5-397b-a17b": {
         "mixlayer": "qwen/qwen3.5-397b-a17b"
       },
+      "qwen3-5-4b-free": {
+        "mixlayer": "qwen/qwen3.5-4b-free"
+      },
       "qwen3-5-9b": {
         "mixlayer": "qwen/qwen3.5-9b"
       },
@@ -14259,6 +14430,9 @@ var require_generated_model_routing = __commonJS({
       "qwen3.5-397b-a17b": {
         "mixlayer": "qwen/qwen3.5-397b-a17b"
       },
+      "qwen3.5-4b-free": {
+        "mixlayer": "qwen/qwen3.5-4b-free"
+      },
       "qwen3.5-9b": {
         "mixlayer": "qwen/qwen3.5-9b"
       },
@@ -14417,6 +14591,7 @@ var require_generated_model_routing = __commonJS({
       "qwen-3-235b-a22b": { providers: [{ provider: "vercel", weight: 100 }] },
       "qwen-3-30b": { providers: [{ provider: "vercel", weight: 100 }] },
       "qwen-3-32b": { providers: [{ provider: "vercel", weight: 100 }] },
+      "qwen-3-6-max": { providers: [{ provider: "vercel", weight: 100 }] },
       "qwen3-235b-a22b": { providers: [{ provider: "vercel", weight: 100 }] },
       "qwen3-32b": { providers: [{ provider: "vercel", weight: 100 }] },
       "qwen3-5-flash": { providers: [{ provider: "vercel", weight: 100 }] },
@@ -14689,6 +14864,14 @@ var require_provider_routing = __commonJS({
         ],
         fallback: ["vercel"]
       },
+      // Kimi K2.6 - Route through Vercel AI Gateway (not available on Workers AI)
+      // Kimi K2.6 - Route through Cloudflare Workers AI
+      "kimi-k2.6": {
+        providers: [
+          { provider: "workers-ai", weight: 100 }
+        ],
+        fallback: ["vercel"]
+      },
       // NVIDIA Nemotron-3 120B - Route through Cloudflare Workers AI (no Vercel equivalent)
       "nemotron-3-120b-a12b": {
         providers: [
@@ -14729,6 +14912,9 @@ var require_provider_routing = __commonJS({
       "kimi-k2.5": {
         "workers-ai": "@cf/moonshotai/kimi-k2.5"
       },
+      "kimi-k2.6": {
+        "workers-ai": "@cf/moonshotai/kimi-k2.6"
+      },
       "nemotron-3-120b-a12b": {
         "workers-ai": "@cf/nvidia/nemotron-3-120b-a12b"
       },
@@ -19617,12 +19803,17 @@ var require_fpo_schema = __commonJS({
     var setupInstructionsSchema = zod_1.z.object({
       summary: zod_1.z.string().min(1),
       steps: zod_1.z.array(zod_1.z.string()),
-      docsUrl: zod_1.z.string().optional()
+      // Constrained to an absolute URL because this lands in the rendered
+      // `<a href={…}>` in the secret intake and quick-start preview UIs —
+      // `javascript:` / `data:` schemes in an unrestricted string would be a
+      // live XSS vector when a malicious template is imported.
+      docsUrl: zod_1.z.string().url().optional()
     });
     var toolAuthSchema = zod_1.z.object({
       type: zod_1.z.enum(["oauth", "api_key", "none", "user_provided"]),
       setupRequired: zod_1.z.boolean(),
-      secrets: zod_1.z.array(secretSchema),
+      // Each secret drives a DB write via materializeSecretBindings at assembly time.
+      secrets: zod_1.z.array(secretSchema).max(20),
       setupInstructions: setupInstructionsSchema
     });
     exports.toolSchema = zod_1.z.object({
@@ -19692,9 +19883,9 @@ var require_fpo_schema = __commonJS({
         icon: zod_1.z.string().optional(),
         metadata: zod_1.z.record(zod_1.z.string(), zod_1.z.any()).optional()
       }),
-      capabilities: zod_1.z.array(exports.capabilitySchema),
-      tools: zod_1.z.array(exports.toolSchema),
-      surfaces: zod_1.z.array(exports.surfaceSchema),
+      capabilities: zod_1.z.array(exports.capabilitySchema).max(50),
+      tools: zod_1.z.array(exports.toolSchema).max(100),
+      surfaces: zod_1.z.array(exports.surfaceSchema).max(50),
       _meta: metaSchema
     }).superRefine((fpo, ctx) => {
       const capIds = /* @__PURE__ */ new Set();
@@ -19886,12 +20077,59 @@ var require_capability_validator = __commonJS({
   }
 });
 
+// ../shared/dist/product-generation/secret-ref.js
+var require_secret_ref = __commonJS({
+  "../shared/dist/product-generation/secret-ref.js"(exports) {
+    "use strict";
+    Object.defineProperty(exports, "__esModule", { value: true });
+    exports.extractSecretReferences = extractSecretReferences;
+    exports.extractSecretReferencesFromAnyValue = extractSecretReferencesFromAnyValue;
+    var SECRET_REF_PATTERN = /\{\{secret:([A-Z][A-Z0-9_]*[A-Z0-9])\}\}/g;
+    function extractSecretReferences(template) {
+      const keys = /* @__PURE__ */ new Set();
+      let match;
+      const regex = new RegExp(SECRET_REF_PATTERN.source, "g");
+      while ((match = regex.exec(template)) !== null) {
+        const key = match[1];
+        if (key)
+          keys.add(key);
+      }
+      return Array.from(keys);
+    }
+    function extractSecretReferencesFromAnyValue(value, maxDepth = 10) {
+      const keys = /* @__PURE__ */ new Set();
+      walk(value, 0);
+      return Array.from(keys);
+      function walk(v, depth) {
+        if (depth > maxDepth)
+          return;
+        if (typeof v === "string") {
+          for (const key of extractSecretReferences(v))
+            keys.add(key);
+          return;
+        }
+        if (Array.isArray(v)) {
+          for (const item of v)
+            walk(item, depth + 1);
+          return;
+        }
+        if (v && typeof v === "object") {
+          for (const inner of Object.values(v)) {
+            walk(inner, depth + 1);
+          }
+        }
+      }
+    }
+  }
+});
+
 // ../shared/dist/product-generation/validators/tool-validator.js
 var require_tool_validator = __commonJS({
   "../shared/dist/product-generation/validators/tool-validator.js"(exports) {
     "use strict";
     Object.defineProperty(exports, "__esModule", { value: true });
     exports.validateToolDefinition = validateToolDefinition;
+    var secret_ref_1 = require_secret_ref();
     var types_1 = require_types2();
     function validateToolDefinition(tool, index) {
       const result = (0, types_1.emptyResult)();
@@ -19903,13 +20141,30 @@ var require_tool_validator = __commonJS({
         result.errors.push((0, types_1.createIssue)("error", "INTEGRATION_NO_PROVIDER", "Integration tools must have a provider", `${base}.provider`));
       }
       if (tool.auth) {
+        const declaredKeys = /* @__PURE__ */ new Set();
         if (tool.auth.secrets) {
           for (const [i, secret] of tool.auth.secrets.entries()) {
             if (!secret.key || secret.key.trim() === "") {
               result.errors.push((0, types_1.createIssue)("error", "SECRET_KEY_EMPTY", "Secret key is required", `${base}.auth.secrets[${i}].key`));
+              continue;
             }
+            declaredKeys.add(secret.key);
           }
         }
+        const referencedKeys = new Set((0, secret_ref_1.extractSecretReferencesFromAnyValue)(tool.config));
+        for (const key of referencedKeys) {
+          if (!declaredKeys.has(key)) {
+            result.errors.push((0, types_1.createIssue)("error", "SECRET_REFERENCE_UNDECLARED", `Tool config references \`{{secret:${key}}}\` but this tool does not declare it in \`auth.secrets\`.`, `${base}.auth.secrets`, `Add \`{ key: '${key}', required: true }\` to this tool's \`auth.secrets\`.`));
+          }
+        }
+        for (const key of declaredKeys) {
+          if (!referencedKeys.has(key)) {
+            result.warnings.push((0, types_1.createIssue)("warning", "SECRET_DECLARED_BUT_UNREFERENCED", `Secret \`${key}\` is declared in \`auth.secrets\` but never referenced as \`{{secret:${key}}}\` in this tool's config.`, `${base}.auth.secrets`, `Either reference \`{{secret:${key}}}\` in the tool config or remove it from \`auth.secrets\`. Integrations that consume secrets outside the config (e.g. MCP servers) can ignore this warning.`));
+          }
+        }
+        if (declaredKeys.size > 0 && tool.auth.setupRequired === false) {
+          result.recommendations.push((0, types_1.createIssue)("recommendation", "SETUP_REQUIRED_IMPLIED", `Tool declares ${declaredKeys.size} secret(s) in \`auth.secrets\` but \`auth.setupRequired\` is false \u2014 pending secrets will not be surfaced in the intake flow.`, `${base}.auth.setupRequired`, "Set `auth.setupRequired: true` so these secrets are materialized as pending bindings and shown to the user after import."));
+        }
       }
       result.valid = result.errors.length === 0;
       return result;
@@ -20134,8 +20389,21 @@ var require_fpo_template = __commonJS({
       version: zod_1.z.literal(exports.FULL_PRODUCT_OBJECT_TEMPLATE_VERSION),
       productObject: fpo_schema_1.fullProductObjectSchema,
       template: zod_1.z.object({
-        variables: zod_1.z.array(exports.fpoTemplateVariableSchema).min(1, "Template must declare at least one variable")
+        variables: zod_1.z.array(exports.fpoTemplateVariableSchema).max(50)
       })
+    }).superRefine((doc, ctx) => {
+      const hasVariables = doc.template.variables.length > 0;
+      const hasPendingSecretTool = doc.productObject.tools.some((tool) => {
+        var _a, _b;
+        return ((_a = tool.auth) === null || _a === void 0 ? void 0 : _a.setupRequired) === true && Array.isArray((_b = tool.auth) === null || _b === void 0 ? void 0 : _b.secrets) && tool.auth.secrets.length > 0;
+      });
+      if (!hasVariables && !hasPendingSecretTool) {
+        ctx.addIssue({
+          code: "custom",
+          message: "Template must declare at least one template variable or at least one tool with `auth.setupRequired: true` and pending secrets.",
+          path: ["template", "variables"]
+        });
+      }
     });
     function collectStringLeafPaths(value, path14 = []) {
       if (typeof value === "string") {
@@ -20165,7 +20433,7 @@ var require_fpo_template = __commonJS({
         const inner = value.slice(start + 2, end);
         const separatorIndex = inner.indexOf("|");
         const key = (separatorIndex === -1 ? inner : inner.slice(0, separatorIndex)).trim();
-        if (key.length > 0) {
+        if (key.length > 0 && !key.startsWith("secret:")) {
           references.push({
             key,
             defaultValue: separatorIndex === -1 ? void 0 : inner.slice(separatorIndex + 1).trim(),
@@ -20347,6 +20615,9 @@ var require_fpo_template = __commonJS({
         if (!referencedKeys.has(variable.key)) {
           result.warnings.push((0, types_1.createIssue)("warning", "UNUSED_TEMPLATE_VARIABLE", `Template variable "${variable.key}" is declared but not used`, `template.variables.${variable.key}`));
         }
+        if (variable.inputType === "secret") {
+          result.warnings.push((0, types_1.createIssue)("warning", "TEMPLATE_VARIABLE_SECRET_IS_UNSAFE", `Template variable "${variable.key}" uses \`inputType: 'secret'\`, which substitutes the supplied value literally into the product record at resolve time \u2014 the value ends up persisted in the database.`, `template.variables.${variable.key}.inputType`, `Prefer declaring pending secrets via the target tool's \`auth.secrets\` array and referencing the value as \`{{secret:${variable.key.toUpperCase()}}}\` so the secret is stored in the secrets vault instead of in the product object.`));
+        }
       }
       const defaultsResolution = (_a = options.defaultsResolution) !== null && _a !== void 0 ? _a : resolveFPOTemplate(template);
       const defaultsValidation = (0, types_1.mergeResults)((0, fpo_validator_1.validateFPO)(defaultsResolution.resolved), defaultsResolution.missingVariables.length > 0 ? {
@@ -22960,12 +23231,29 @@ configCommand.command("path").description("Show configuration file path").action
 });
 
 // src/commands/products.ts
+var import_dashboard_url2 = __toESM(require_dashboard_url(), 1);
 import { Command as Command7 } from "commander";
 import chalk9 from "chalk";
 import React6 from "react";
 import { render as render6 } from "ink";
 import { useState as useState7, useEffect as useEffect8 } from "react";
 import open2 from "open";
+
+// src/lib/account-context.ts
+var import_dashboard_url = __toESM(require_dashboard_url(), 1);
+init_credential_store();
+async function getCurrentAccountId() {
+  try {
+    const store = new CredentialStore();
+    const creds = await store.getCredentials();
+    if (!creds) return void 0;
+    return (0, import_dashboard_url.selectAccountId)({ userId: creds.userId, organizationId: creds.orgId });
+  } catch {
+    return void 0;
+  }
+}
+
+// src/commands/products.ts
 function displayAgentCard(agentCard) {
   console.log(chalk9.cyan("\nAgent Details:"));
   console.log(`  Name:        ${agentCard.name}`);
@@ -23006,8 +23294,13 @@ async function createProduct(apiKey, templateId, agentCard, sourceUrl, productNa
   }
   return response.json();
 }
-function displayCreationSuccess(result, agentCard, dashboardBaseUrl, jsonOutput) {
-  const productUrl = `${dashboardBaseUrl}/products/${result.product.id}?launch=true`;
+function displayCreationSuccess(result, agentCard, dashboardBaseUrl, jsonOutput, account) {
+  const productUrl = (0, import_dashboard_url2.buildDashboardUrl)({
+    baseUrl: dashboardBaseUrl,
+    path: `/products/${result.product.id}`,
+    account,
+    searchParams: { launch: "true" }
+  });
   if (jsonOutput) {
     console.log(
       JSON.stringify(
@@ -23129,7 +23422,14 @@ productsCommand.command("init").description("Initialize a product from an extern
         }
         process.exit(1);
       }
-      displayCreationSuccess(createResult, result.agentCard, getDashboardUrl(), isJsonMode);
+      const account = await getCurrentAccountId();
+      displayCreationSuccess(
+        createResult,
+        result.agentCard,
+        getDashboardUrl(),
+        isJsonMode,
+        account
+      );
     } catch (error) {
       const message = error instanceof Error ? error.message : "Unknown error";
       console.error(chalk9.red(`Failed: ${message}`));
@@ -23195,6 +23495,7 @@ productsCommand.command("init").description("Initialize a product from an extern
             return;
           }
           const dashboardUrl = getDashboardUrl();
+          const account = await getCurrentAccountId();
           setResultNode(
             React6.createElement(EntityCard, {
               fields: [
@@ -23202,7 +23503,11 @@ productsCommand.command("init").description("Initialize a product from an extern
                 { label: "Name", value: createResult.product.name },
                 {
                   label: "Dashboard",
-                  value: `${dashboardUrl}/products/${createResult.product.id}`
+                  value: (0, import_dashboard_url2.buildDashboardUrl)({
+                    baseUrl: dashboardUrl,
+                    path: `/products/${createResult.product.id}`,
+                    account
+                  })
                 }
               ]
             })
@@ -23266,6 +23571,7 @@ import React7 from "react";
 import { render as render7 } from "ink";
 
 // src/ink/init/InitApp.tsx
+var import_dashboard_url3 = __toESM(require_dashboard_url(), 1);
 init_credential_store();
 import { useState as useState8, useEffect as useEffect9, useCallback } from "react";
 import { Box as Box6, Text as Text7, useApp as useApp3, useInput as useInput4 } from "ink";
@@ -23336,7 +23642,8 @@ function InitApp({ apiUrl, onComplete }) {
     loading: true,
     loadingLabel: "Checking credentials...",
     complete: false,
-    createdProductId: null
+    createdProductId: null,
+    account: void 0
   });
   const getSummary = useCallback(() => {
     const answers = [];
@@ -23370,9 +23677,14 @@ function InitApp({ apiUrl, onComplete }) {
             apiUrl
           );
           if (isValid) {
+            const existingCreds = await store.getCredentials();
             setState((prev) => ({
               ...prev,
               apiKey: existingKey,
+              account: (0, import_dashboard_url3.selectAccountId)({
+                userId: existingCreds?.userId,
+                organizationId: existingCreds?.orgId
+              }),
               step: 2,
               loading: false
             }));
@@ -23411,6 +23723,7 @@ function InitApp({ apiUrl, onComplete }) {
         setState((s) => ({
           ...s,
           apiKey: key,
+          account: (0, import_dashboard_url3.selectAccountId)({ userId, organizationId: orgId }),
           step: 2,
           loading: false
         }));
@@ -23792,6 +24105,11 @@ function InitApp({ apiUrl, onComplete }) {
   }
   if (state.step === 7) {
     const dashboardUrl = getDashboardUrl();
+    const productDashboardUrl = state.createdProductId ? (0, import_dashboard_url3.buildDashboardUrl)({
+      baseUrl: dashboardUrl,
+      path: `/products/${state.createdProductId}`,
+      account: state.account
+    }) : "";
     return /* @__PURE__ */ jsxs7(Box6, { flexDirection: "column", children: [
       state.createdProductId ? /* @__PURE__ */ jsxs7(Box6, { flexDirection: "column", children: [
         /* @__PURE__ */ jsxs7(Text7, { color: theme7.success, bold: true, children: [
@@ -23807,9 +24125,7 @@ function InitApp({ apiUrl, onComplete }) {
           "  ",
           "Dashboard:",
           " ",
-          dashboardUrl,
-          "/products/",
-          state.createdProductId
+          productDashboardUrl
         ] })
       ] }) : /* @__PURE__ */ jsxs7(Text7, { color: theme7.success, bold: true, children: [
         "\u2713",
@@ -24194,6 +24510,7 @@ import { render as render9 } from "ink";
 import React9 from "react";
 
 // src/ink/marathon/MarathonApp.tsx
+var import_dashboard_url4 = __toESM(require_dashboard_url(), 1);
 import { useState as useState22, useEffect as useEffect19, useRef as useRef9, useCallback as useCallback8, useMemo as useMemo11 } from "react";
 import { execSync } from "child_process";
 import * as fs4 from "fs";
@@ -29328,13 +29645,31 @@ function MarathonApp({
   const [upgradeModalDismissed, setUpgradeModalDismissed] = useState22(false);
   const [clipboardFlash, setClipboardFlash] = useState22(null);
   const flashTimeout = useRef9(null);
-  const billingPageUrl = billingUrl || `${(dashboardUrl || "https://use.runtype.com").replace(/\/$/, "")}/settings/billing`;
+  const [account, setAccount] = useState22(void 0);
+  useEffect19(() => {
+    let cancelled = false;
+    getCurrentAccountId().then((id) => {
+      if (!cancelled) setAccount(id);
+    });
+    return () => {
+      cancelled = true;
+    };
+  }, []);
+  const billingPageUrl = billingUrl || (0, import_dashboard_url4.buildDashboardUrl)({
+    baseUrl: dashboardUrl || "https://use.runtype.com",
+    path: "/settings/billing",
+    account
+  });
   function showFlash(msg) {
     setClipboardFlash(msg);
     if (flashTimeout.current) clearTimeout(flashTimeout.current);
     flashTimeout.current = setTimeout(() => setClipboardFlash(null), 2e3);
   }
-  const agentPageUrl = agentId && dashboardUrl ? `${dashboardUrl.replace(/\/$/, "")}/agents/${agentId}` : null;
+  const agentPageUrl = agentId && dashboardUrl ? (0, import_dashboard_url4.buildDashboardUrl)({
+    baseUrl: dashboardUrl,
+    path: `/agents/${agentId}`,
+    account
+  }) : null;
   const handleCopySession = useCallback8(() => {
     setShowSessionMenu(false);
     try {
@@ -36908,6 +37243,7 @@ import open5 from "open";
 import { execFileSync } from "child_process";
 
 // src/lib/persona-init.ts
+var import_dashboard_url5 = __toESM(require_dashboard_url(), 1);
 init_credential_store();
 
 // src/lib/persona-snippets.ts
@@ -37071,7 +37407,12 @@ async function runPersonaInit(options) {
     personaFormat
   );
   const dashboardBase = getDashboardUrl();
-  const dashboardUrl = `${dashboardBase}/agents/${agent.id}`;
+  const account = await getCurrentAccountId();
+  const dashboardUrl = (0, import_dashboard_url5.buildDashboardUrl)({
+    baseUrl: dashboardBase,
+    path: `/agents/${agent.id}`,
+    account
+  });
   return {
     status: "created",
     agent: { id: agent.id, name: agent.name },

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runtypelabs/cli",
-  "version": "2.10.9",
+  "version": "2.11.1",
   "description": "Command-line interface for Runtype AI platform",
   "type": "module",
   "main": "dist/index.js",
@@ -23,7 +23,7 @@
     "micromatch": "^4.0.8",
     "yaml": "^2.8.3",
     "@runtypelabs/ink-components": "0.3.1",
-    "@runtypelabs/sdk": "1.16.0",
+    "@runtypelabs/sdk": "1.17.1",
     "@runtypelabs/terminal-animations": "0.2.0"
   },
   "devDependencies": {
@@ -37,7 +37,7 @@
     "tsx": "^4.7.1",
     "typescript": "^5.3.3",
     "vitest": "^4.0.18",
-    "@runtypelabs/shared": "1.4.3"
+    "@runtypelabs/shared": "1.5.0"
   },
   "engines": {
     "node": ">=18.0.0"