@runtypelabs/cli 2.12.8 → 2.14.0

package/dist/index.js

@@ -131,15 +131,15 @@ var init_credential_store = __esm({
 });
 
 // src/index.ts
-import { Command as Command23 } from "commander";
-import chalk30 from "chalk";
+import { Command as Command25 } from "commander";
+import chalk32 from "chalk";
 
 // src/lib/load-env.ts
 import { readFileSync } from "fs";
 import { resolve } from "path";
-function loadEnv(path14 = resolve(process.cwd(), ".env")) {
+function loadEnv(path15 = resolve(process.cwd(), ".env")) {
   try {
-    const content = readFileSync(path14, "utf8").replace(/\r\n?/g, "\n");
+    const content = readFileSync(path15, "utf8").replace(/\r\n?/g, "\n");
     for (const line of content.split("\n")) {
       if (!line.trim() || line.trimStart().startsWith("#")) continue;
       const match = line.match(/^\s*([\w.-]+)\s*=\s*(.*)?\s*$/);
@@ -174,8 +174,8 @@ var CallbackServer = class {
   expectedState;
   constructor() {
     this.app = express();
-    this.codePromise = new Promise((resolve9, reject) => {
-      this.codeResolve = resolve9;
+    this.codePromise = new Promise((resolve10, reject) => {
+      this.codeResolve = resolve10;
       this.codeReject = reject;
     });
     this.app.get("/callback", (req, res) => {
@@ -1304,10 +1304,10 @@ function mergeDefs(...defs) {
 function cloneDef(schema) {
   return mergeDefs(schema._zod.def);
 }
-function getElementAtPath(obj, path14) {
-  if (!path14)
+function getElementAtPath(obj, path15) {
+  if (!path15)
     return obj;
-  return path14.reduce((acc, key) => acc?.[key], obj);
+  return path15.reduce((acc, key) => acc?.[key], obj);
 }
 function promiseAllObject(promisesObj) {
   const keys = Object.keys(promisesObj);
@@ -1716,11 +1716,11 @@ function explicitlyAborted(x, startIndex = 0) {
   }
   return false;
 }
-function prefixIssues(path14, issues) {
+function prefixIssues(path15, issues) {
   return issues.map((iss) => {
     var _a3;
     (_a3 = iss).path ?? (_a3.path = []);
-    iss.path.unshift(path14);
+    iss.path.unshift(path15);
     return iss;
   });
 }
@@ -1867,16 +1867,16 @@ function flattenError(error51, mapper = (issue2) => issue2.message) {
 }
 function formatError(error51, mapper = (issue2) => issue2.message) {
   const fieldErrors = { _errors: [] };
-  const processError = (error52, path14 = []) => {
+  const processError = (error52, path15 = []) => {
     for (const issue2 of error52.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path14, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path15, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path14, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path15, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path14, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path15, ...issue2.path]);
       } else {
-        const fullpath = [...path14, ...issue2.path];
+        const fullpath = [...path15, ...issue2.path];
         if (fullpath.length === 0) {
           fieldErrors._errors.push(mapper(issue2));
         } else {
@@ -1903,17 +1903,17 @@ function formatError(error51, mapper = (issue2) => issue2.message) {
 }
 function treeifyError(error51, mapper = (issue2) => issue2.message) {
   const result = { errors: [] };
-  const processError = (error52, path14 = []) => {
+  const processError = (error52, path15 = []) => {
     var _a3, _b;
     for (const issue2 of error52.issues) {
       if (issue2.code === "invalid_union" && issue2.errors.length) {
-        issue2.errors.map((issues) => processError({ issues }, [...path14, ...issue2.path]));
+        issue2.errors.map((issues) => processError({ issues }, [...path15, ...issue2.path]));
       } else if (issue2.code === "invalid_key") {
-        processError({ issues: issue2.issues }, [...path14, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path15, ...issue2.path]);
       } else if (issue2.code === "invalid_element") {
-        processError({ issues: issue2.issues }, [...path14, ...issue2.path]);
+        processError({ issues: issue2.issues }, [...path15, ...issue2.path]);
       } else {
-        const fullpath = [...path14, ...issue2.path];
+        const fullpath = [...path15, ...issue2.path];
         if (fullpath.length === 0) {
           result.errors.push(mapper(issue2));
           continue;
@@ -1945,8 +1945,8 @@ function treeifyError(error51, mapper = (issue2) => issue2.message) {
 }
 function toDotPath(_path) {
   const segs = [];
-  const path14 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
-  for (const seg of path14) {
+  const path15 = _path.map((seg) => typeof seg === "object" ? seg.key : seg);
+  for (const seg of path15) {
     if (typeof seg === "number")
       segs.push(`[${seg}]`);
     else if (typeof seg === "symbol")
@@ -14632,13 +14632,13 @@ function resolveRef(ref, ctx) {
   if (!ref.startsWith("#")) {
     throw new Error("External $ref is not supported, only local refs (#/...) are allowed");
   }
-  const path14 = ref.slice(1).split("/").filter(Boolean);
-  if (path14.length === 0) {
+  const path15 = ref.slice(1).split("/").filter(Boolean);
+  if (path15.length === 0) {
     return ctx.rootSchema;
   }
   const defsKey = ctx.version === "draft-2020-12" ? "$defs" : "definitions";
-  if (path14[0] === defsKey) {
-    const key = path14[1];
+  if (path15[0] === defsKey) {
+    const key = path15[1];
     if (!key || !ctx.defs[key]) {
       throw new Error(`Reference not found: ${ref}`);
     }
@@ -15423,6 +15423,97 @@ var CONTEXT_STEP_TYPES = [
   "generate-pdf"
 ];
 var FLOW_STEP_TYPES = ["prompt", ...CONTEXT_STEP_TYPES];
+var PROVIDER_SECRET_SPECS = [
+  // ----- Explicit-prefix providers -----
+  {
+    providerId: "google-vertex-anthropic",
+    // Must come before google-vertex (shares vertex prefix) and anthropic (matches */claude-*).
+    matches: (m) => m.startsWith("vertex-anthropic/"),
+    secretNames: ["GOOGLE_VERTEX_PROJECT", "GOOGLE_VERTEX_LOCATION", "GOOGLE_VERTEX_CREDENTIALS"]
+  },
+  {
+    providerId: "google-vertex",
+    // Must come before google (matches */gemini-*).
+    matches: (m) => m.startsWith("vertex/"),
+    secretNames: ["GOOGLE_VERTEX_PROJECT", "GOOGLE_VERTEX_LOCATION", "GOOGLE_VERTEX_CREDENTIALS"]
+  },
+  {
+    providerId: "vercel-gateway",
+    // Must come before openai — vercel/openai/gpt-4o would otherwise match openai.
+    matches: (m) => m.startsWith("vercel/") || m.startsWith("vercel."),
+    secretNames: ["VERCEL_AI_GATEWAY_API_KEY"]
+  },
+  {
+    providerId: "cloudflare-gateway",
+    // Must come before workers-ai — cloudflare/<provider>/<model> needs gateway routing.
+    matches: (m) => m.startsWith("cloudflare/") || m.startsWith("cloudflare:"),
+    secretNames: ["CF_ACCOUNT_ID", "CF_AI_GATEWAY_ID"]
+  },
+  {
+    providerId: "bedrock",
+    matches: (m) => m.startsWith("bedrock/"),
+    secretNames: ["AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_REGION"]
+  },
+  {
+    providerId: "tinfoil",
+    matches: (m) => m.startsWith("tinfoil/") || m.startsWith("tinfoil:"),
+    secretNames: ["TINFOIL_API_KEY"]
+  },
+  {
+    providerId: "generic-openai",
+    // Must come before openai — shares the openai substring in its prefix.
+    matches: (m) => m.startsWith("generic-openai/") || m.startsWith("generic-openai:"),
+    secretNames: ["GENERIC_OPENAI_API_KEY", "GENERIC_OPENAI_BASE_URL"]
+  },
+  {
+    providerId: "workers-ai",
+    // Uses a CF platform binding, not a secret — secretNames is intentionally empty.
+    matches: (m) => m.startsWith("@cf/") || m.startsWith("workers-ai/"),
+    secretNames: []
+  },
+  {
+    providerId: "togetherai",
+    matches: (m) => m.startsWith("together/") || m.startsWith("togetherai/"),
+    secretNames: ["TOGETHER_API_KEY"]
+  },
+  // ----- Base providers (broader patterns — must come last) -----
+  {
+    providerId: "anthropic",
+    matches: (m) => m.startsWith("anthropic/") || m.startsWith("claude-") || m.includes("/claude-"),
+    secretNames: ["ANTHROPIC_API_KEY"]
+  },
+  {
+    providerId: "openai",
+    matches: (m) => m.startsWith("openai/") || m.startsWith("gpt-") || m.startsWith("o1-") || m.startsWith("o3-") || m.startsWith("o4-") || m.includes("/gpt-"),
+    secretNames: ["OPENAI_API_KEY"]
+  },
+  {
+    providerId: "google",
+    matches: (m) => m.startsWith("google/") || m.startsWith("gemini-") || m.includes("/gemini-"),
+    secretNames: ["GOOGLE_API_KEY"]
+  },
+  {
+    providerId: "mixlayer",
+    // Matches open-weight models Mixlayer hosts (Qwen 3.5 family, Kimi) plus
+    // explicit prefixes. Does NOT match closed Alibaba models (qwen3.5-flash/plus)
+    // which route through Vercel Gateway. See mixlayer-executor.ts for the
+    // canonical predicate mirrored here.
+    matches: (m) => m.startsWith("mixlayer/") || m.startsWith("modelsocket/") || m.startsWith("qwen/") || m.startsWith("kimi-") || m.includes("/kimi-") || /(?:^|\/)qwen3[.-]5-\d+b(?:-a\d+b)?$/i.test(m),
+    secretNames: ["MIXLAYER_API_KEY"]
+  },
+  {
+    providerId: "xai",
+    matches: (m) => m.startsWith("grok-") || m.startsWith("xai/"),
+    secretNames: ["XAI_API_KEY"]
+  }
+];
+function resolveModelSecretNames(model) {
+  const lower = model.toLowerCase();
+  for (const spec of PROVIDER_SECRET_SPECS) {
+    if (spec.matches(lower)) return [...spec.secretNames];
+  }
+  return [];
+}
 var MCPServerCategory = {
   COMMUNICATION: "communication",
   PRODUCTIVITY: "productivity",
@@ -30326,12 +30417,162 @@ var TELEGRAM_INTEGRATION = {
     }
   ]
 };
+var IMESSAGE_INTEGRATION = {
+  id: "imessage",
+  name: "iMessage",
+  description: "Send iMessage / SMS messages, read conversation history, and react to messages via Sendblue.",
+  transport: "http",
+  url: "",
+  // Credentials live on the iMessage productSurface, not in
+  // organization_integrations. The handler reads them on-demand.
+  requiredCredentials: [],
+  category: MCPServerCategory.COMMUNICATION,
+  documentationUrl: "https://docs.sendblue.com/",
+  icon: "message",
+  // A single agent can register multiple iMessage tool instances pinned to
+  // different surfaces (i.e. different phone numbers) via
+  // `toolConfig.surfaceId`.
+  multiInstance: true,
+  tools: [
+    {
+      name: "send_message",
+      description: "Send an iMessage to a phone number. Falls back to SMS automatically when the recipient is not on iMessage (was_downgraded). Long messages are bubble-split.",
+      parametersSchema: {
+        type: "object",
+        properties: {
+          to: {
+            type: "string",
+            description: "Recipient phone number in E.164 format (e.g. +14155550100)."
+          },
+          text: {
+            type: "string",
+            description: "Message text to send. Markdown is converted to plain iMessage formatting."
+          },
+          // @snake-case-ok: tool input fields use snake_case for LLM ergonomics
+          media_url: {
+            type: "string",
+            description: "Optional public URL of an image/video attachment."
+          }
+        },
+        required: ["to", "text"]
+      }
+    },
+    {
+      name: "send_group_message",
+      description: "Send a message to an iMessage group chat. Provide either group_id (preferred \u2014 preserves the existing thread) or a numbers array (creates an ad-hoc group).",
+      parametersSchema: {
+        type: "object",
+        properties: {
+          // @snake-case-ok-start: Sendblue API uses snake_case for group identifiers
+          group_id: {
+            type: "string",
+            description: "Sendblue group identifier. Required for replying to an existing group; obtain via list_conversations or get_group_info."
+          },
+          numbers: {
+            type: "array",
+            description: "Recipient phone numbers in E.164 format. Used when group_id is not yet known (creates an ad-hoc group). Ignored when group_id is set.",
+            items: { type: "string" }
+          },
+          text: { type: "string", description: "Message text to send." },
+          media_url: {
+            type: "string",
+            description: "Optional public URL of an image/video attachment."
+          }
+          // @snake-case-ok-end
+        },
+        required: ["text"]
+      }
+    },
+    {
+      name: "list_conversations",
+      description: "List recent iMessage conversations (1:1 and group) the bot has participated in, ordered by most recent activity.",
+      parametersSchema: {
+        type: "object",
+        properties: {
+          limit: {
+            type: "number",
+            description: "Maximum number of conversations to return (default 25, max 100).",
+            minimum: 1,
+            maximum: 100
+          },
+          before: {
+            type: "string",
+            description: "ISO 8601 timestamp; only return conversations whose lastMessageAt is earlier."
+          }
+        },
+        required: []
+      }
+    },
+    {
+      name: "get_conversation_history",
+      description: "Read the recent message history of an iMessage conversation. Useful for catching up on context before replying.",
+      parametersSchema: {
+        type: "object",
+        properties: {
+          // @snake-case-ok: tool input fields use snake_case for LLM ergonomics
+          conversation_id: {
+            type: "string",
+            description: "Runtype messaging conversation ID (returned by list_conversations)."
+          },
+          limit: {
+            type: "number",
+            description: "Maximum number of messages to return (default 50, max 200).",
+            minimum: 1,
+            maximum: 200
+          },
+          before: {
+            type: "string",
+            description: "ISO 8601 timestamp; only return messages created before this."
+          }
+        },
+        required: ["conversation_id"]
+      }
+    },
+    {
+      name: "get_group_info",
+      description: "Look up display name and participant phone numbers for an iMessage group, sourced from the most recent inbound webhook for that group.",
+      parametersSchema: {
+        type: "object",
+        properties: {
+          // @snake-case-ok: tool input fields use snake_case for LLM ergonomics
+          group_id: {
+            type: "string",
+            description: "Sendblue group identifier."
+          }
+        },
+        required: ["group_id"]
+      }
+    },
+    {
+      name: "send_reaction",
+      description: "Send a tapback reaction (\u{1F44D} \u2764\uFE0F \u{1F602} \u203C\uFE0F \u2753 \u{1F44E}) to a previous iMessage. iMessage-only \u2014 has no effect on SMS recipients.",
+      parametersSchema: {
+        type: "object",
+        properties: {
+          // @snake-case-ok-start: Sendblue API uses snake_case for message identifiers
+          message_handle: {
+            type: "string",
+            description: "The Sendblue message_handle of the message you are reacting to (from inbound webhooks or earlier outbound responses)."
+          },
+          reaction: {
+            type: "string",
+            enum: ["love", "like", "dislike", "laugh", "emphasize", "question"],
+            description: "Tapback type. love=\u2764\uFE0F, like=\u{1F44D}, dislike=\u{1F44E}, laugh=\u{1F602}, emphasize=\u203C\uFE0F, question=\u2753."
+          }
+          // @snake-case-ok-end
+        },
+        required: ["message_handle", "reaction"]
+      }
+    }
+  ]
+};
 var INTEGRATIONS_REGISTRY = [
   SLACK_INTEGRATION,
   GOOGLE_INTEGRATION,
   LINEAR_INTEGRATION,
   GITHUB_INTEGRATION,
-  TELEGRAM_INTEGRATION
+  TELEGRAM_INTEGRATION,
+  IMESSAGE_INTEGRATION
 ];
 function getAllIntegrations() {
   return INTEGRATIONS_REGISTRY;
@@ -32417,6 +32658,38 @@ var SLACK_MANIFEST_BOT_SCOPES = [
   ...SLACK_REQUIRED_BOT_SCOPES,
   ...SLACK_OPTIONAL_BOT_SCOPES
 ];
+var SECRET_REF_PATTERN = /\{\{secret:([A-Z][A-Z0-9_]*[A-Z0-9])\}\}/g;
+function extractSecretReferences(template) {
+  const keys = /* @__PURE__ */ new Set();
+  let match;
+  const regex = new RegExp(SECRET_REF_PATTERN.source, "g");
+  while ((match = regex.exec(template)) !== null) {
+    const key = match[1];
+    if (key) keys.add(key);
+  }
+  return Array.from(keys);
+}
+function extractSecretReferencesFromAnyValue(value, maxDepth = 10) {
+  const keys = /* @__PURE__ */ new Set();
+  walk(value, 0);
+  return Array.from(keys);
+  function walk(v, depth) {
+    if (depth > maxDepth) return;
+    if (typeof v === "string") {
+      for (const key of extractSecretReferences(v)) keys.add(key);
+      return;
+    }
+    if (Array.isArray(v)) {
+      for (const item of v) walk(item, depth + 1);
+      return;
+    }
+    if (v && typeof v === "object") {
+      for (const inner of Object.values(v)) {
+        walk(inner, depth + 1);
+      }
+    }
+  }
+}
 var FULL_PRODUCT_OBJECT_VERSION_1_0 = "1.0";
 var FULL_PRODUCT_OBJECT_VERSION_1_1 = "1.1";
 var createPolicySchema = external_exports.enum(["create", "skip", "manual"]).optional();
@@ -32679,6 +32952,7 @@ var surfaceSchema = external_exports.object({
     "slack",
     "schedule",
     "sms",
+    "imessage",
     "discord",
     "whatsapp",
     "messaging",
@@ -32832,8 +33106,8 @@ var fullProductObjectSchema = external_exports.object({
     }
   }
 });
-function createIssue(severity, code, message, path14, suggestedFix) {
-  return { code, message, path: path14, severity, ...suggestedFix ? { suggestedFix } : {} };
+function createIssue(severity, code, message, path15, suggestedFix) {
+  return { code, message, path: path15, severity, ...suggestedFix ? { suggestedFix } : {} };
 }
 function emptyResult() {
   return { valid: true, errors: [], warnings: [], recommendations: [] };
@@ -33003,38 +33277,6 @@ function validateCapability(cap, index, context) {
   }
   return mergeResults(result, subResult);
 }
-var SECRET_REF_PATTERN = /\{\{secret:([A-Z][A-Z0-9_]*[A-Z0-9])\}\}/g;
-function extractSecretReferences(template) {
-  const keys = /* @__PURE__ */ new Set();
-  let match;
-  const regex = new RegExp(SECRET_REF_PATTERN.source, "g");
-  while ((match = regex.exec(template)) !== null) {
-    const key = match[1];
-    if (key) keys.add(key);
-  }
-  return Array.from(keys);
-}
-function extractSecretReferencesFromAnyValue(value, maxDepth = 10) {
-  const keys = /* @__PURE__ */ new Set();
-  walk(value, 0);
-  return Array.from(keys);
-  function walk(v, depth) {
-    if (depth > maxDepth) return;
-    if (typeof v === "string") {
-      for (const key of extractSecretReferences(v)) keys.add(key);
-      return;
-    }
-    if (Array.isArray(v)) {
-      for (const item of v) walk(item, depth + 1);
-      return;
-    }
-    if (v && typeof v === "object") {
-      for (const inner of Object.values(v)) {
-        walk(inner, depth + 1);
-      }
-    }
-  }
-}
 function validateToolDefinition(tool, index) {
   const result = emptyResult();
   const base = `tools[${index}]`;
@@ -33113,6 +33355,7 @@ var VALID_SURFACE_TYPES = /* @__PURE__ */ new Set([
   "slack",
   "schedule",
   "sms",
+  "imessage",
   "discord",
   "whatsapp",
   "telegram",
@@ -33448,16 +33691,16 @@ var fullProductObjectTemplateSchema = external_exports.object({
 });
 var FLOW_PREFIX = "flow:";
 var SECRET_PREFIX = "secret:";
-function collectStringLeafPaths(value, path14 = []) {
+function collectStringLeafPaths(value, path15 = []) {
   if (typeof value === "string") {
-    return [{ path: path14, value }];
+    return [{ path: path15, value }];
   }
   if (Array.isArray(value)) {
-    return value.flatMap((item, index) => collectStringLeafPaths(item, [...path14, String(index)]));
+    return value.flatMap((item, index) => collectStringLeafPaths(item, [...path15, String(index)]));
   }
   if (value && typeof value === "object") {
     return Object.entries(value).flatMap(
-      ([key, nestedValue]) => collectStringLeafPaths(nestedValue, [...path14, key])
+      ([key, nestedValue]) => collectStringLeafPaths(nestedValue, [...path15, key])
     );
   }
   return [];
@@ -33512,8 +33755,8 @@ function getVariableReferences(template) {
   }
   return references;
 }
-function normalizeValidationPath(path14) {
-  return path14.map(String).join(".");
+function normalizeValidationPath(path15) {
+  return path15.map(String).join(".");
 }
 function coerceFPOTemplateVariableValue(variable, rawValue) {
   if (rawValue === void 0 || rawValue === null || rawValue === "") {
@@ -33743,6 +33986,7 @@ var ARCHITECTURE_PREVIEW_SURFACE_TYPES = [
   "email",
   "slack",
   "sms",
+  "imessage",
   "discord",
   "whatsapp",
   "telegram",
@@ -34033,6 +34277,7 @@ var PLATFORM_CATALOG = {
     "slack",
     "schedule",
     "sms",
+    "imessage",
     "discord",
     "whatsapp",
     "messaging",
@@ -34274,6 +34519,39 @@ var SURFACE_TYPE_METADATA = {
       executionHint: "You are responding via SMS. Be extremely brief \u2014 ideally one or two short sentences. Plain text only, no markdown, no lists. Get straight to the point. Do not include reasoning traces or process narration."
     }
   },
+  imessage: {
+    description: "iMessage messaging via Sendblue for Apple ecosystem interactions",
+    useCases: ["customer support", "appointment reminders", "rich messaging", "two-way texting"],
+    examples: ["iMessage support agent", "Appointment reminder bot", "Rich media messaging bot"],
+    traits: {
+      streaming: "none",
+      messagesMutable: false,
+      deliveryModel: "async",
+      mediaSupport: "images",
+      interactiveUI: "none",
+      inboundMediaSupport: true,
+      consumerType: "human",
+      reasoningVisibility: "always_strip",
+      markdownDialect: "none",
+      threadModel: "flat",
+      senderIdentity: "verified",
+      // ~4 short bubbles' worth of headroom. The adapter splits on paragraph
+      // boundaries before sending; this cap signals to the model that long is
+      // wrong without imposing a hard truncate that would clip mid-thought.
+      maxResponseLength: 1200,
+      executionHint: [
+        "You are responding via iMessage. Hard rules:",
+        "- Plain text only. No markdown \u2014 no **bold**, no # headings, no - bullets, no `code`, no > quotes, no fenced code blocks.",
+        "- 1\u20133 sentences per reply, under 300 characters total when possible.",
+        "- Texting tone: conversational, lowercase is fine, contractions welcome.",
+        '- No greetings ("Hi!", "Hey there!") and no closings ("Let me know!", "Hope this helps!").',
+        `- No AI disclaimers ("As an AI...", "I cannot...", "I'd be happy to help").`,
+        "- One emoji max, only when it fits naturally.",
+        "- For multi-part replies, separate logical chunks with a blank line \u2014 each chunk becomes its own bubble.",
+        "- Do not include reasoning traces or process narration."
+      ].join("\n")
+    }
+  },
   discord: {
     description: "Discord bot for community engagement",
     useCases: ["community support", "moderation", "server management"],
@@ -35085,7 +35363,7 @@ function buildDashboardUrl(opts) {
   while (base.endsWith("/")) {
     base = base.slice(0, -1);
   }
-  const path14 = opts.path.startsWith("/") ? opts.path : `/${opts.path}`;
+  const path15 = opts.path.startsWith("/") ? opts.path : `/${opts.path}`;
   const params = new URLSearchParams();
   if (isValidAccountId(opts.account)) {
     params.set(ACCOUNT_QUERY_PARAM, opts.account);
@@ -35098,7 +35376,7 @@ function buildDashboardUrl(opts) {
     }
   }
   const qs = params.toString();
-  return qs ? `${base}${path14}?${qs}` : `${base}${path14}`;
+  return qs ? `${base}${path15}?${qs}` : `${base}${path15}`;
 }
 function parseAccountId(value) {
   if (!value) return null;
@@ -36147,14 +36425,14 @@ async function promptConfirm(message, options) {
     output: process.stdout,
     terminal: true
   });
-  return new Promise((resolve9) => {
+  return new Promise((resolve10) => {
     rl.question(chalk2.cyan(`${message} (${hint}): `), (answer) => {
       rl.close();
       const trimmed = answer.trim().toLowerCase();
       if (trimmed === "") {
-        resolve9(defaultYes);
+        resolve10(defaultYes);
       } else {
-        resolve9(trimmed === "y" || trimmed === "yes");
+        resolve10(trimmed === "y" || trimmed === "yes");
       }
     });
   });
@@ -36266,9 +36544,9 @@ var ApiClient = class {
     this.baseUrl = baseUrl || getApiUrl();
   }
   /** Prefix path with API version (e.g. /v1) so all requests hit versioned routes. */
-  path(path14) {
+  path(path15) {
     const version2 = getApiVersion();
-    const p = path14.startsWith("/") ? path14 : `/${path14}`;
+    const p = path15.startsWith("/") ? path15 : `/${path15}`;
     return p.startsWith(`/${version2}/`) ? p : `/${version2}${p}`;
   }
   headers(extra) {
@@ -36301,8 +36579,8 @@ var ApiClient = class {
     }
     return response.json();
   }
-  async get(path14, params) {
-    const url2 = new URL(this.path(path14), this.baseUrl);
+  async get(path15, params) {
+    const url2 = new URL(this.path(path15), this.baseUrl);
     if (params) {
       for (const [key, value] of Object.entries(params)) {
         if (value !== void 0 && value !== "") {
@@ -36315,32 +36593,32 @@ var ApiClient = class {
     });
     return this.handleResponse(response);
   }
-  async post(path14, body) {
-    const response = await fetch(new URL(this.path(path14), this.baseUrl).toString(), {
+  async post(path15, body) {
+    const response = await fetch(new URL(this.path(path15), this.baseUrl).toString(), {
       method: "POST",
       headers: this.headers(),
       body: body !== void 0 ? JSON.stringify(body) : void 0
     });
     return this.handleResponse(response);
   }
-  async put(path14, body) {
-    const response = await fetch(new URL(this.path(path14), this.baseUrl).toString(), {
+  async put(path15, body) {
+    const response = await fetch(new URL(this.path(path15), this.baseUrl).toString(), {
       method: "PUT",
       headers: this.headers(),
       body: body !== void 0 ? JSON.stringify(body) : void 0
     });
     return this.handleResponse(response);
   }
-  async patch(path14, body) {
-    const response = await fetch(new URL(this.path(path14), this.baseUrl).toString(), {
+  async patch(path15, body) {
+    const response = await fetch(new URL(this.path(path15), this.baseUrl).toString(), {
       method: "PATCH",
       headers: this.headers(),
       body: body !== void 0 ? JSON.stringify(body) : void 0
     });
     return this.handleResponse(response);
   }
-  async delete(path14) {
-    const response = await fetch(new URL(this.path(path14), this.baseUrl).toString(), {
+  async delete(path15) {
+    const response = await fetch(new URL(this.path(path15), this.baseUrl).toString(), {
       method: "DELETE",
       headers: this.headers()
     });
@@ -36354,8 +36632,8 @@ var ApiClient = class {
       throw new ApiError(response.status, message);
     }
   }
-  async stream(path14, body) {
-    const response = await fetch(new URL(this.path(path14), this.baseUrl).toString(), {
+  async stream(path15, body) {
+    const response = await fetch(new URL(this.path(path15), this.baseUrl).toString(), {
       method: "POST",
       headers: this.headers({ Accept: "text/event-stream" }),
       body: body !== void 0 ? JSON.stringify(body) : void 0
@@ -43846,8 +44124,8 @@ function MarathonApp({
           setIsTerminalCheckpoint(true);
           isTerminalCheckpointRef.current = true;
         }
-        return new Promise((resolve9) => {
-          checkpointResolveRef.current = resolve9;
+        return new Promise((resolve10) => {
+          checkpointResolveRef.current = resolve10;
         });
       },
       updateMilestone: (milestone) => {
@@ -45174,16 +45452,16 @@ function MarathonStartupShell({
   latestAppPropsRef.current = marathonAppProps;
   useEffect20(() => {
     if (scene !== "app" || !appReadyResolverRef.current) return;
-    const resolve9 = appReadyResolverRef.current;
+    const resolve10 = appReadyResolverRef.current;
     appReadyResolverRef.current = null;
-    resolve9();
+    resolve10();
   }, [scene]);
   const beginTransition = (target) => {
     if (transitionPromiseRef.current) return transitionPromiseRef.current;
     if (target === "app" && !latestAppPropsRef.current) {
       throw new Error("Cannot complete startup before marathon app props are ready.");
     }
-    const promise2 = new Promise((resolve9) => {
+    const promise2 = new Promise((resolve10) => {
       globalThis.setTimeout(() => {
         setPrompt(null);
         setModelChoices(null);
@@ -45204,12 +45482,12 @@ function MarathonStartupShell({
         if (target === "app") {
           appReadyResolverRef.current = () => {
             transitionPromiseRef.current = null;
-            resolve9();
+            resolve10();
           };
         } else {
           dismissResolverRef.current = () => {
             transitionPromiseRef.current = null;
-            resolve9();
+            resolve10();
           };
         }
       }, Math.max(0, MIN_HOLD_MS - (Date.now() - mountedAtRef.current)));
@@ -45226,8 +45504,8 @@ function MarathonStartupShell({
         setModelChoices(null);
         setPrompt(nextPrompt);
         setSelectedPromptIndex(0);
-        return new Promise((resolve9) => {
-          promptResolverRef.current = resolve9;
+        return new Promise((resolve10) => {
+          promptResolverRef.current = resolve10;
         });
       },
       requestModelChoice: async (nextCurrentModel, models) => {
@@ -45235,8 +45513,8 @@ function MarathonStartupShell({
         setPlaybookConfirm(null);
         setCurrentModel(nextCurrentModel);
         setModelChoices(models);
-        return new Promise((resolve9) => {
-          modelResolverRef.current = resolve9;
+        return new Promise((resolve10) => {
+          modelResolverRef.current = resolve10;
         });
       },
       requestPlaybookModelConfirm: async (playbookName, milestoneModels) => {
@@ -45251,8 +45529,8 @@ function MarathonStartupShell({
           // Default selection is the "Confirm" action (first item after milestones)
           selectedIndex: names.length
         });
-        return new Promise((resolve9) => {
-          playbookConfirmResolverRef.current = resolve9;
+        return new Promise((resolve10) => {
+          playbookConfirmResolverRef.current = resolve10;
         });
       },
       completeStartup: () => beginTransition("app"),
@@ -45750,7 +46028,7 @@ async function retryOnNetworkError(fn, opts = {}) {
       }
       const delay = Math.min(baseDelay * 2 ** attempt, maxDelay);
       opts.onRetry?.(attempt + 1, delay, error51);
-      await new Promise((resolve9) => setTimeout(resolve9, delay));
+      await new Promise((resolve10) => setTimeout(resolve10, delay));
     }
   }
   throw lastError;
@@ -46010,14 +46288,14 @@ async function promptNumericSelect(choices, promptLabel) {
     output: process.stdout,
     terminal: true
   });
-  return new Promise((resolve9) => {
+  return new Promise((resolve10) => {
     const ask = () => {
       rl.question(chalk14.cyan(`
 ${promptLabel} (1-${choices.length}): `), (answer) => {
         const value = parseInt(answer.trim(), 10);
         if (value >= 1 && value <= choices.length) {
           rl.close();
-          resolve9(choices[value - 1].value);
+          resolve10(choices[value - 1].value);
           return;
         }
         console.log(chalk14.red(`Please enter a number between 1 and ${choices.length}.`));
@@ -46045,7 +46323,7 @@ ${message}`));
   const previousRawMode = input.isRaw === true;
   let selectedIndex = 0;
   let renderedLineCount = 0;
-  return new Promise((resolve9) => {
+  return new Promise((resolve10) => {
     const renderMenu = () => {
       if (renderedLineCount > 0) {
         clearRenderedLines(output, renderedLineCount);
@@ -46067,7 +46345,7 @@ ${message}`));
     };
     const finish = (value) => {
       cleanup();
-      resolve9(value);
+      resolve10(value);
     };
     const onKeypress = (_, key) => {
       if (key.ctrl && key.name === "c") {
@@ -48277,7 +48555,7 @@ async function taskAction(agent, options) {
     waitForUiExit = renderedShell.waitUntilExit;
     rerenderUi = renderedShell.rerender;
     unmountUi = renderedShell.unmount;
-    await new Promise((resolve9) => setTimeout(resolve9, 0));
+    await new Promise((resolve10) => setTimeout(resolve10, 0));
     if (!startupShellRef.current) {
       exitAltScreen();
       unmountUi?.();
@@ -48823,7 +49101,7 @@ Saving state... done. Session saved to ${filePath}`);
       waitForUiExit = renderedApp.waitUntilExit;
       unmountUi = renderedApp.unmount;
     }
-    await new Promise((resolve9) => setTimeout(resolve9, 0));
+    await new Promise((resolve10) => setTimeout(resolve10, 0));
     const streamActions = streamRef.current;
     if (!streamActions) {
       exitAltScreen();
@@ -48948,7 +49226,7 @@ Saving state... done. Session saved to ${filePath}`);
           };
           if (event.phase === "start") {
             currentActions.startContextCompaction(absoluteEvent);
-            await new Promise((resolve9) => setTimeout(resolve9, 0));
+            await new Promise((resolve10) => setTimeout(resolve10, 0));
             return;
           }
           currentActions.finishContextCompaction(absoluteEvent);
@@ -50927,13 +51205,13 @@ apiKeysCommand.command("delete <id>").description("Delete an API key").option("-
     await waitUntilExit2();
     return;
   }
-  const confirmed = await new Promise((resolve9) => {
+  const confirmed = await new Promise((resolve10) => {
     const { unmount } = render14(
       React14.createElement(ConfirmPrompt, {
         message: `Delete API key ${id}?`,
         defaultValue: false,
         onConfirm: (result) => {
-          resolve9(result);
+          resolve10(result);
           unmount();
         }
       })
@@ -51038,8 +51316,8 @@ apiKeysCommand.command("analytics").description("Show API key usage analytics").
   const client = new ApiClient(apiKey);
   if (!isTTY(options) || options.json) {
     try {
-      const path14 = options.key ? `/api-keys/${options.key}/analytics` : "/api-keys/analytics";
-      const data = await client.get(path14);
+      const path15 = options.key ? `/api-keys/${options.key}/analytics` : "/api-keys/analytics";
+      const data = await client.get(path15);
       printJson(data);
     } catch (error51) {
       const message = error51 instanceof Error ? error51.message : "Unknown error";
@@ -51056,8 +51334,8 @@ apiKeysCommand.command("analytics").description("Show API key usage analytics").
     useEffect25(() => {
       const run = async () => {
         try {
-          const path14 = options.key ? `/api-keys/${options.key}/analytics` : "/api-keys/analytics";
-          const data = await client.get(path14);
+          const path15 = options.key ? `/api-keys/${options.key}/analytics` : "/api-keys/analytics";
+          const data = await client.get(path15);
           printJson(data);
           setSuccess(true);
           setLoading(false);
@@ -51399,13 +51677,13 @@ clientTokensCommand.command("delete <id>").description("Delete a client token").
     await waitUntilExit2();
     return;
   }
-  const confirmed = await new Promise((resolve9) => {
+  const confirmed = await new Promise((resolve10) => {
     const { unmount } = render15(
       React15.createElement(ConfirmPrompt, {
         message: `Delete client token ${id}?`,
         defaultValue: false,
         onConfirm: (result) => {
-          resolve9(result);
+          resolve10(result);
           unmount();
         }
       })
@@ -51710,8 +51988,8 @@ function defaultTokenName(agentName) {
 }
 async function promptLine(rl, question, defaultValue) {
   const hint = defaultValue ? chalk23.dim(` (${defaultValue})`) : "";
-  const answer = await new Promise((resolve9) => {
-    rl.question(`${question}${hint}: `, resolve9);
+  const answer = await new Promise((resolve10) => {
+    rl.question(`${question}${hint}: `, resolve10);
   });
   const trimmed = answer.trim();
   if (!trimmed && defaultValue !== void 0) {
@@ -51721,8 +51999,8 @@ async function promptLine(rl, question, defaultValue) {
 }
 async function promptConfirm2(rl, message, defaultYes = false) {
   const hint = defaultYes ? chalk23.dim(" (Y/n)") : chalk23.dim(" (y/N)");
-  const answer = await new Promise((resolve9) => {
-    rl.question(`${message}${hint}: `, resolve9);
+  const answer = await new Promise((resolve10) => {
+    rl.question(`${message}${hint}: `, resolve10);
   });
   const t = answer.trim().toLowerCase();
   if (t === "") return defaultYes;
@@ -51791,18 +52069,18 @@ Dashboard: ${initial.dashboardUrl}`));
     process.stdin.removeAllListeners("keypress");
     process.stdin.pause();
   };
-  await new Promise((resolve9) => {
+  await new Promise((resolve10) => {
     const onKeypress = async (_str, key) => {
       if (!key) return;
       if (key.ctrl && key.name === "c") {
         cleanup();
-        resolve9();
+        resolve10();
         process.exit(0);
       }
       const name = key.name;
       if (name === "q" || name === "escape") {
         cleanup();
-        resolve9();
+        resolve10();
         return;
       }
       if (name === "c") {
@@ -52662,9 +52940,283 @@ flowVersionsCommand.command("publish <flowId>").description("Publish a version")
   await waitUntilExit();
 });
 
-// src/commands/tail.ts
+// src/commands/agent-versions.ts
 import { Command as Command21 } from "commander";
 import chalk27 from "chalk";
+import React19 from "react";
+import { render as render19 } from "ink";
+import { useState as useState33, useEffect as useEffect30 } from "react";
+import { Text as Text35 } from "ink";
+var agentVersionsCommand = new Command21("agent-versions").description(
+  "Manage agent versions"
+);
+agentVersionsCommand.command("list <agentId>").description("List all versions for an agent").option("--json", "Output as JSON").option("--tty", "Force TTY mode").option("--no-tty", "Force non-TTY mode").action(async (agentId, options) => {
+  const apiKey = await ensureAuth();
+  if (!apiKey) return;
+  const client = new ApiClient(apiKey);
+  if (!isTTY(options) || options.json) {
+    try {
+      const data = await client.get(`/agent-versions/${agentId}`);
+      if (options.json) {
+        printJson(data);
+      } else {
+        const versions = data.versions ?? [];
+        if (versions.length === 0) {
+          console.log(chalk27.gray("No versions found"));
+          return;
+        }
+        console.log(chalk27.cyan(`Versions for agent ${agentId}:`));
+        for (const v of versions) {
+          const isPublished = v.id === data.publishedVersionId;
+          const liveTag = isPublished ? chalk27.green(" [live]") : "";
+          const versionLabel = v.label || (v.versionNumber !== void 0 ? `v${v.versionNumber}` : v.id);
+          const date5 = v.createdAt ? chalk27.gray(` ${v.createdAt}`) : "";
+          console.log(`  ${chalk27.green(v.id)} ${versionLabel}${liveTag}${date5}`);
+        }
+      }
+    } catch (error51) {
+      const message = error51 instanceof Error ? error51.message : "Unknown error";
+      console.error(chalk27.red("Failed to fetch versions"));
+      console.error(chalk27.red(message));
+      process.exit(1);
+    }
+    return;
+  }
+  const App = () => {
+    const [loading, setLoading] = useState33(true);
+    const [items, setItems] = useState33(null);
+    const [publishedId, setPublishedId] = useState33(null);
+    const [error51, setError] = useState33(null);
+    useEffect30(() => {
+      const run = async () => {
+        try {
+          const data = await client.get(`/agent-versions/${agentId}`);
+          setItems(data.versions ?? []);
+          setPublishedId(data.publishedVersionId ?? null);
+          setLoading(false);
+        } catch (err) {
+          setError(err instanceof Error ? err : new Error(String(err)));
+          setLoading(false);
+        }
+      };
+      run();
+    }, []);
+    return React19.createElement(DataList, {
+      title: `Versions for agent ${agentId}`,
+      items,
+      error: error51,
+      loading,
+      emptyMessage: "No versions found",
+      renderCard: (item) => {
+        const v = item;
+        const liveTag = v.id === publishedId ? " [live]" : "";
+        const versionLabel = v.label || (v.versionNumber !== void 0 ? `v${v.versionNumber}` : v.id);
+        return React19.createElement(
+          Text35,
+          null,
+          `  ${v.id} ${versionLabel}${liveTag}${v.createdAt ? ` ${v.createdAt}` : ""}`
+        );
+      }
+    });
+  };
+  const { waitUntilExit } = render19(React19.createElement(App));
+  await waitUntilExit();
+});
+agentVersionsCommand.command("get <agentId> <versionId>").description("Get a specific version").option("--json", "Output as JSON").option("--tty", "Force TTY mode").option("--no-tty", "Force non-TTY mode").action(
+  async (agentId, versionId, options) => {
+    const apiKey = await ensureAuth();
+    if (!apiKey) return;
+    const client = new ApiClient(apiKey);
+    if (!isTTY(options) || options.json) {
+      try {
+        const data = await client.get(`/agent-versions/${agentId}/${versionId}`);
+        if (options.json) {
+          printJson(data);
+        } else {
+          printDetail("Agent Version", [
+            { label: "ID", value: data.id },
+            { label: "Agent ID", value: data.agentId },
+            { label: "Version", value: data.versionNumber },
+            { label: "Type", value: data.versionType },
+            { label: "Label", value: data.label ?? void 0 },
+            { label: "Notes", value: data.notes ?? void 0 },
+            { label: "Created", value: data.createdAt }
+          ]);
+        }
+      } catch (error51) {
+        const message = error51 instanceof Error ? error51.message : "Unknown error";
+        console.error(chalk27.red("Failed to fetch version"));
+        console.error(chalk27.red(message));
+        process.exit(1);
+      }
+      return;
+    }
+    const App = () => {
+      const [loading, setLoading] = useState33(true);
+      const [success2, setSuccess] = useState33(null);
+      const [error51, setError] = useState33(null);
+      const [resultNode, setResultNode] = useState33(void 0);
+      useEffect30(() => {
+        const run = async () => {
+          try {
+            const data = await client.get(`/agent-versions/${agentId}/${versionId}`);
+            setResultNode(
+              React19.createElement(EntityCard, {
+                fields: [
+                  { label: "ID", value: data.id },
+                  { label: "Agent ID", value: data.agentId },
+                  { label: "Version", value: data.versionNumber },
+                  { label: "Type", value: data.versionType },
+                  { label: "Label", value: data.label ?? void 0 },
+                  { label: "Notes", value: data.notes ?? void 0 },
+                  { label: "Created", value: data.createdAt }
+                ]
+              })
+            );
+            setSuccess(true);
+            setLoading(false);
+          } catch (err) {
+            setError(err instanceof Error ? err : new Error(String(err)));
+            setSuccess(false);
+            setLoading(false);
+          }
+        };
+        run();
+      }, []);
+      return React19.createElement(MutationResult, {
+        loading,
+        loadingLabel: "Fetching version...",
+        success: success2,
+        successMessage: "Agent Version",
+        error: error51,
+        result: resultNode
+      });
+    };
+    const { waitUntilExit } = render19(React19.createElement(App));
+    await waitUntilExit();
+  }
+);
+agentVersionsCommand.command("published <agentId>").description("Get the published version for an agent").option("--json", "Output as JSON").option("--tty", "Force TTY mode").option("--no-tty", "Force non-TTY mode").action(async (agentId, options) => {
+  const apiKey = await ensureAuth();
+  if (!apiKey) return;
+  const client = new ApiClient(apiKey);
+  if (!isTTY(options) || options.json) {
+    try {
+      const data = await client.get(`/agent-versions/${agentId}/published`);
+      if (options.json) {
+        printJson(data);
+      } else {
+        printDetail("Published Version", [
+          { label: "ID", value: data.id },
+          { label: "Version", value: data.versionNumber },
+          { label: "Label", value: data.label ?? void 0 },
+          { label: "Created", value: data.createdAt }
+        ]);
+      }
+    } catch (error51) {
+      const message = error51 instanceof Error ? error51.message : "Unknown error";
+      console.error(chalk27.red("Failed to fetch published version"));
+      console.error(chalk27.red(message));
+      process.exit(1);
+    }
+    return;
+  }
+  const App = () => {
+    const [loading, setLoading] = useState33(true);
+    const [success2, setSuccess] = useState33(null);
+    const [error51, setError] = useState33(null);
+    const [resultNode, setResultNode] = useState33(void 0);
+    useEffect30(() => {
+      const run = async () => {
+        try {
+          const data = await client.get(`/agent-versions/${agentId}/published`);
+          setResultNode(
+            React19.createElement(EntityCard, {
+              fields: [
+                { label: "ID", value: data.id },
+                { label: "Version", value: data.versionNumber },
+                { label: "Label", value: data.label ?? void 0 },
+                { label: "Created", value: data.createdAt }
+              ]
+            })
+          );
+          setSuccess(true);
+          setLoading(false);
+        } catch (err) {
+          setError(err instanceof Error ? err : new Error(String(err)));
+          setSuccess(false);
+          setLoading(false);
+        }
+      };
+      run();
+    }, []);
+    return React19.createElement(MutationResult, {
+      loading,
+      loadingLabel: "Fetching published version...",
+      success: success2,
+      successMessage: "Published Version",
+      error: error51,
+      result: resultNode
+    });
+  };
+  const { waitUntilExit } = render19(React19.createElement(App));
+  await waitUntilExit();
+});
+agentVersionsCommand.command("publish <agentId>").description("Publish a version").requiredOption("-v, --version <versionId>", "Version ID to publish").option("--tty", "Force TTY mode").option("--no-tty", "Force non-TTY mode").action(
+  async (agentId, options) => {
+    const apiKey = await ensureAuth();
+    if (!apiKey) return;
+    const client = new ApiClient(apiKey);
+    if (!isTTY(options)) {
+      try {
+        await client.post(`/agent-versions/${agentId}/publish`, {
+          versionId: options.version
+        });
+        console.log(chalk27.green("Version published"));
+      } catch (error51) {
+        const message = error51 instanceof Error ? error51.message : "Unknown error";
+        console.error(chalk27.red("Failed to publish version"));
+        console.error(chalk27.red(message));
+        process.exit(1);
+      }
+      return;
+    }
+    const App = () => {
+      const [loading, setLoading] = useState33(true);
+      const [success2, setSuccess] = useState33(null);
+      const [error51, setError] = useState33(null);
+      useEffect30(() => {
+        const run = async () => {
+          try {
+            await client.post(`/agent-versions/${agentId}/publish`, {
+              versionId: options.version
+            });
+            setSuccess(true);
+            setLoading(false);
+          } catch (err) {
+            setError(err instanceof Error ? err : new Error(String(err)));
+            setSuccess(false);
+            setLoading(false);
+          }
+        };
+        run();
+      }, []);
+      return React19.createElement(MutationResult, {
+        loading,
+        loadingLabel: "Publishing version...",
+        success: success2,
+        successMessage: "Version published",
+        error: error51
+      });
+    };
+    const { waitUntilExit } = render19(React19.createElement(App));
+    await waitUntilExit();
+  }
+);
+
+// src/commands/tail.ts
+import { Command as Command22 } from "commander";
+import chalk28 from "chalk";
 function abbreviateId(id) {
   const underscoreIdx = id.lastIndexOf("_");
   if (underscoreIdx === -1) {
@@ -52683,20 +53235,20 @@ function formatTime(ts) {
   return `${hh}:${mm}:${ss}.${ms}`;
 }
 var LEVEL_COLORS = {
-  debug: chalk27.gray,
-  info: chalk27.blue,
-  warn: chalk27.yellow,
-  error: chalk27.red
+  debug: chalk28.gray,
+  info: chalk28.blue,
+  warn: chalk28.yellow,
+  error: chalk28.red
 };
 function levelBadge(level, useColor) {
   const tag = level.toUpperCase().padEnd(5);
   if (!useColor) return `[${tag}]`;
-  const colorFn = LEVEL_COLORS[level] || chalk27.white;
+  const colorFn = LEVEL_COLORS[level] || chalk28.white;
   return colorFn(`[${tag}]`);
 }
 function categoryBadge(category, useColor) {
   if (!useColor) return `[${category}]`;
-  return chalk27.magenta(`[${category}]`);
+  return chalk28.magenta(`[${category}]`);
 }
 function formatTailData(data) {
   return Object.entries(data).map(([k, v]) => `${k}=${typeof v === "string" ? v : JSON.stringify(v)}`).join(" ");
@@ -52711,14 +53263,14 @@ function formatContextIds(event, useColor) {
   if (event.conversationId) ids.push(`conv=${abbreviateId(event.conversationId)}`);
   if (ids.length === 0) return "";
   const text = ids.join(" ");
-  return useColor ? chalk27.gray(` ${text}`) : ` ${text}`;
+  return useColor ? chalk28.gray(` ${text}`) : ` ${text}`;
 }
 function formatEvent(event, useColor) {
-  const time3 = useColor ? chalk27.gray(formatTime(event.timestamp)) : formatTime(event.timestamp);
+  const time3 = useColor ? chalk28.gray(formatTime(event.timestamp)) : formatTime(event.timestamp);
   const level = levelBadge(event.level, useColor);
   const cat = categoryBadge(event.category, useColor);
   const ctx = formatContextIds(event, useColor);
-  const data = event.tailData && Object.keys(event.tailData).length > 0 ? useColor ? chalk27.gray(` | ${formatTailData(event.tailData)}`) : ` | ${formatTailData(event.tailData)}` : "";
+  const data = event.tailData && Object.keys(event.tailData).length > 0 ? useColor ? chalk28.gray(` | ${formatTailData(event.tailData)}`) : ` | ${formatTailData(event.tailData)}` : "";
   return `${time3} ${level} ${cat} ${event.message}${data}${ctx}`;
 }
 async function consumeSSEStream(reader, options, signal) {
@@ -52757,17 +53309,17 @@ async function consumeSSEStream(reader, options, signal) {
           break;
         case "tail_gap":
           process.stderr.write(
-            (useColor ? chalk27.yellow(`[warn] Dropped ${msg.droppedCount} event(s) between ${msg.fromTimestamp} and ${msg.toTimestamp}`) : `[warn] Dropped ${msg.droppedCount} event(s) between ${msg.fromTimestamp} and ${msg.toTimestamp}`) + "\n"
+            (useColor ? chalk28.yellow(`[warn] Dropped ${msg.droppedCount} event(s) between ${msg.fromTimestamp} and ${msg.toTimestamp}`) : `[warn] Dropped ${msg.droppedCount} event(s) between ${msg.fromTimestamp} and ${msg.toTimestamp}`) + "\n"
           );
           break;
         case "tail_connected":
           process.stderr.write(
-            (useColor ? chalk27.green(`Connected to tail session ${msg.sessionId}`) : `Connected to tail session ${msg.sessionId}`) + "\n"
+            (useColor ? chalk28.green(`Connected to tail session ${msg.sessionId}`) : `Connected to tail session ${msg.sessionId}`) + "\n"
           );
           break;
         case "tail_error":
           process.stderr.write(
-            (useColor ? chalk27.red(`[error] ${msg.error}`) : `[error] ${msg.error}`) + "\n"
+            (useColor ? chalk28.red(`[error] ${msg.error}`) : `[error] ${msg.error}`) + "\n"
           );
           break;
       }
@@ -52847,7 +53399,7 @@ async function runTail(options) {
   const useColor = options.color;
   const activeFilters = Object.entries(filters).filter(([, v]) => v !== void 0).map(([k, v]) => `${k}=${v}`);
   process.stderr.write(
-    (useColor ? chalk27.gray(`Connecting to ${apiUrl}...${activeFilters.length ? ` filters: ${activeFilters.join(", ")}` : ""}`) : `Connecting to ${apiUrl}...${activeFilters.length ? ` filters: ${activeFilters.join(", ")}` : ""}`) + "\n"
+    (useColor ? chalk28.gray(`Connecting to ${apiUrl}...${activeFilters.length ? ` filters: ${activeFilters.join(", ")}` : ""}`) : `Connecting to ${apiUrl}...${activeFilters.length ? ` filters: ${activeFilters.join(", ")}` : ""}`) + "\n"
   );
   const controller = new AbortController();
   let shuttingDown = false;
@@ -52855,7 +53407,7 @@ async function runTail(options) {
     if (shuttingDown) return;
     shuttingDown = true;
     process.stderr.write(
-      (useColor ? chalk27.gray("\nDisconnecting...") : "\nDisconnecting...") + "\n"
+      (useColor ? chalk28.gray("\nDisconnecting...") : "\nDisconnecting...") + "\n"
     );
     controller.abort();
   };
@@ -52869,7 +53421,7 @@ async function runTail(options) {
       const result = await connectAndStream(session.sseUrl, apiKey, options, controller.signal);
       if (result === "aborted" || shuttingDown) break;
       process.stderr.write(
-        (useColor ? chalk27.yellow("Stream ended, reconnecting...") : "Stream ended, reconnecting...") + "\n"
+        (useColor ? chalk28.yellow("Stream ended, reconnecting...") : "Stream ended, reconnecting...") + "\n"
       );
     } catch (err) {
       if (shuttingDown || controller.signal.aborted) break;
@@ -52877,22 +53429,22 @@ async function runTail(options) {
       const delay = Math.min(BASE_DELAY_MS * Math.pow(2, attempt - 1), MAX_DELAY_MS);
       const message = err instanceof Error ? err.message : String(err);
       process.stderr.write(
-        (useColor ? chalk27.red(`Connection error: ${message}`) : `Connection error: ${message}`) + "\n"
+        (useColor ? chalk28.red(`Connection error: ${message}`) : `Connection error: ${message}`) + "\n"
       );
       if (attempt >= MAX_ATTEMPTS) {
         process.stderr.write(
-          (useColor ? chalk27.red(`Max reconnect attempts (${MAX_ATTEMPTS}) reached. Exiting.`) : `Max reconnect attempts (${MAX_ATTEMPTS}) reached. Exiting.`) + "\n"
+          (useColor ? chalk28.red(`Max reconnect attempts (${MAX_ATTEMPTS}) reached. Exiting.`) : `Max reconnect attempts (${MAX_ATTEMPTS}) reached. Exiting.`) + "\n"
         );
         process.exit(1);
       }
       process.stderr.write(
-        (useColor ? chalk27.gray(`Retrying in ${delay / 1e3}s (attempt ${attempt}/${MAX_ATTEMPTS})...`) : `Retrying in ${delay / 1e3}s (attempt ${attempt}/${MAX_ATTEMPTS})...`) + "\n"
+        (useColor ? chalk28.gray(`Retrying in ${delay / 1e3}s (attempt ${attempt}/${MAX_ATTEMPTS})...`) : `Retrying in ${delay / 1e3}s (attempt ${attempt}/${MAX_ATTEMPTS})...`) + "\n"
       );
-      await new Promise((resolve9) => {
-        const timer = setTimeout(resolve9, delay);
+      await new Promise((resolve10) => {
+        const timer = setTimeout(resolve10, delay);
         const onAbort = () => {
           clearTimeout(timer);
-          resolve9();
+          resolve10();
         };
         controller.signal.addEventListener("abort", onAbort, { once: true });
       });
@@ -52901,16 +53453,16 @@ async function runTail(options) {
   process.removeListener("SIGINT", shutdown);
   process.removeListener("SIGTERM", shutdown);
 }
-var tailCommand = new Command21("tail").description("Stream live execution logs from the Runtype API").option("--flow <id>", "Filter by flow ID").option("--agent <id>", "Filter by agent ID").option("--surface <id>", "Filter by surface ID").option("--execution <id>", "Filter by execution ID").option("--level <level>", "Filter by level (debug/info/warn/error)").option("--category <category>", "Filter by category (execution/agent/tool/model/system/error)").option("--json", "Output raw JSON (one object per line)").option("--no-color", "Disable color output").action(async (options) => {
+var tailCommand = new Command22("tail").description("Stream live execution logs from the Runtype API").option("--flow <id>", "Filter by flow ID").option("--agent <id>", "Filter by agent ID").option("--surface <id>", "Filter by surface ID").option("--execution <id>", "Filter by execution ID").option("--level <level>", "Filter by level (debug/info/warn/error)").option("--category <category>", "Filter by category (execution/agent/tool/model/system/error)").option("--json", "Output raw JSON (one object per line)").option("--no-color", "Disable color output").action(async (options) => {
   await runTail(options);
 });
 
 // src/commands/validate-product.ts
-import { Command as Command22, Option } from "commander";
-import chalk28 from "chalk";
+import { Command as Command23, Option } from "commander";
+import chalk29 from "chalk";
 import { readFileSync as readFileSync15 } from "fs";
 function createValidateProductCommand() {
-  return new Command22("validate-product").description("Validate a product (FPO) or FPO template locally (no API call)").argument(
+  return new Command23("validate-product").description("Validate a product (FPO) or FPO template locally (no API call)").argument(
     "[input]",
     'Path to JSON file, raw JSON string (starts with "{"), or "-" for stdin'
   ).option("--template", "Force FPO template validation").option("--fpo", "Force FPO (non-template) validation").addOption(
@@ -52934,7 +53486,7 @@ var validateProductCommand = createValidateProductCommand();
 async function runValidateAction(input, _options) {
   const options = this.optsWithGlobals();
   if (options.template && options.fpo) {
-    console.error(chalk28.red("Error: --template and --fpo are mutually exclusive"));
+    console.error(chalk29.red("Error: --template and --fpo are mutually exclusive"));
     process.exit(1);
   }
   let raw;
@@ -52942,7 +53494,7 @@ async function runValidateAction(input, _options) {
     raw = await readInput(input);
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    console.error(chalk28.red(`Failed to read input: ${message}`));
+    console.error(chalk29.red(`Failed to read input: ${message}`));
     process.exit(1);
     return;
   }
@@ -52951,7 +53503,7 @@ async function runValidateAction(input, _options) {
     parsed = JSON.parse(raw);
   } catch (err) {
     const message = err instanceof Error ? err.message : String(err);
-    console.error(chalk28.red(`Invalid JSON: ${message}`));
+    console.error(chalk29.red(`Invalid JSON: ${message}`));
     process.exit(1);
     return;
   }
@@ -53041,16 +53593,16 @@ function runValidation(body, kind) {
 function printHumanResult(kind, result) {
   const label = kind === "template" ? "FPO template" : "FPO";
   const overallValid = !hasAnyErrors(result);
-  const headline = overallValid ? chalk28.green(`\u2713 Valid ${label}`) : chalk28.red(`\u2717 Invalid ${label}`);
+  const headline = overallValid ? chalk29.green(`\u2713 Valid ${label}`) : chalk29.red(`\u2717 Invalid ${label}`);
   console.log(headline);
   console.log(
-    chalk28.gray(
+    chalk29.gray(
       `  ${result.errors.length} error(s), ${result.warnings.length} warning(s), ${result.recommendations.length} recommendation(s)`
     )
   );
-  printIssues("Errors", result.errors, chalk28.red);
-  printIssues("Warnings", result.warnings, chalk28.yellow);
-  printIssues("Recommendations", result.recommendations, chalk28.blue);
+  printIssues("Errors", result.errors, chalk29.red);
+  printIssues("Warnings", result.warnings, chalk29.yellow);
+  printIssues("Recommendations", result.recommendations, chalk29.blue);
   if (result.kind === "template") {
     const defaults = result.defaultsValidation;
     const structuralErrors = defaults.errors.filter(
@@ -53062,22 +53614,22 @@ function printHumanResult(kind, result) {
     if (structuralErrors.length > 0) {
       console.log();
       console.log(
-        chalk28.red(
+        chalk29.red(
           `Defaults validation: template defaults do not produce a valid FPO`
         )
       );
-      printIssues("Default-resolution errors", structuralErrors, chalk28.red);
-      printIssues("Default-resolution warnings", defaults.warnings, chalk28.yellow);
+      printIssues("Default-resolution errors", structuralErrors, chalk29.red);
+      printIssues("Default-resolution warnings", defaults.warnings, chalk29.yellow);
     }
     if (missingVars.length > 0) {
       console.log();
       console.log(
-        chalk28.gray(
+        chalk29.gray(
           `Template variables needing deploy-time values (${missingVars.length}):`
         )
       );
       for (const issue2 of missingVars) {
-        console.log(chalk28.gray(`  \u2022 ${issue2.path} \u2014 ${issue2.message}`));
+        console.log(chalk29.gray(`  \u2022 ${issue2.path} \u2014 ${issue2.message}`));
       }
     }
   }
@@ -53087,19 +53639,515 @@ function printIssues(title, issues, color) {
   console.log();
   console.log(color(`${title}:`));
   for (const issue2 of issues) {
-    const pathLabel = issue2.path ? chalk28.gray(` [${issue2.path}]`) : "";
-    console.log(`  ${color("\u2022")} ${chalk28.bold(issue2.code)}${pathLabel} ${issue2.message}`);
+    const pathLabel = issue2.path ? chalk29.gray(` [${issue2.path}]`) : "";
+    console.log(`  ${color("\u2022")} ${chalk29.bold(issue2.code)}${pathLabel} ${issue2.message}`);
     if (issue2.suggestedFix) {
-      console.log(`    ${chalk28.gray("fix:")} ${issue2.suggestedFix}`);
+      console.log(`    ${chalk29.gray("fix:")} ${issue2.suggestedFix}`);
+    }
+  }
+}
+
+// src/commands/deploy.ts
+import { Command as Command24 } from "commander";
+import chalk30 from "chalk";
+import * as fs14 from "fs";
+import * as path14 from "path";
+function bashSingleQuote(s) {
+  return "'" + s.replace(/'/g, "'\\''") + "'";
+}
+function serverTs() {
+  return `/**
+ * Generated by \`runtype deploy\`.
+ *
+ * Boots a Hono server that loads every agent JSON file under ./agents/ and
+ * registers a streaming POST /agent/:name endpoint for each.
+ *
+ * See README.md for startup and deploy instructions.
+ */
+import { readFile, readdir } from 'node:fs/promises'
+import { resolve } from 'node:path'
+import { Hono } from 'hono'
+import { cors } from 'hono/cors'
+import { serve } from '@hono/node-server'
+import {
+  CloudRunAdapter,
+  createRuntime,
+  exportedAgentSchema,
+  type ExportedAgent,
+} from '@runtypelabs/runtime'
+
+async function loadAgent(filePath: string): Promise<ExportedAgent> {
+  const raw = await readFile(filePath, 'utf-8')
+  return exportedAgentSchema.parse(JSON.parse(raw))
+}
+
+async function loadAgentsDir(dir: string): Promise<Record<string, ExportedAgent>> {
+  let entries: string[]
+  try {
+    entries = await readdir(dir)
+  } catch (err) {
+    throw new Error(
+      \`[runtype] could not read agents directory at \${dir}: \${err instanceof Error ? err.message : String(err)}\`
+    )
+  }
+  const jsonFiles = entries.filter((f) => f.endsWith('.json')).sort()
+  if (jsonFiles.length === 0) {
+    throw new Error(\`[runtype] no agents found in \${dir} (expected one or more *.json files)\`)
+  }
+
+  const agents: Record<string, ExportedAgent> = {}
+  for (const file of jsonFiles) {
+    const agent = await loadAgent(resolve(dir, file))
+    if (agents[agent.name]) {
+      throw new Error(
+        \`[runtype] duplicate agent name "\${agent.name}" in \${file} \u2014 already defined by an earlier file\`
+      )
     }
+    agents[agent.name] = agent
+    console.log(\`[runtype] loaded agent id=\${agent.id} name=\${agent.name}\`)
   }
+  return agents
+}
+
+async function main(): Promise<void> {
+  const agentsDir = resolve(process.cwd(), 'agents')
+  const agents = await loadAgentsDir(agentsDir)
+
+  const runtime = createRuntime({
+    agents,
+    keys: { mode: 'own' },
+    adapter: new CloudRunAdapter(),
+  })
+
+  const app = new Hono()
+
+  const allowedOriginsEnv = process.env.ALLOWED_ORIGINS?.trim()
+  const allowedOrigins = allowedOriginsEnv
+    ? allowedOriginsEnv.split(',').map((o) => o.trim()).filter(Boolean)
+    : '*'
+  app.use(
+    '*',
+    cors({
+      origin: allowedOrigins,
+      allowMethods: ['GET', 'POST', 'OPTIONS'],
+      allowHeaders: ['Content-Type', 'Authorization'],
+      credentials: false,
+      maxAge: 86400,
+    })
+  )
+
+  app.get('/health', (c) => c.json({ status: 'ok', agents: Object.keys(agents) }))
+
+  app.post('/agent/:name', async (c) => {
+    const name = c.req.param('name')
+    if (!runtime.getAgent(name)) {
+      return c.json({ error: \`unknown agent: \${name}\` }, 404)
+    }
+
+    let body: { messages?: Array<{ role: string; content: string }> } = {}
+    try {
+      body = (await c.req.json()) as typeof body
+    } catch {
+      return c.json({ error: 'request body must be JSON' }, 400)
+    }
+    const messages = Array.isArray(body.messages) ? body.messages : []
+
+    try {
+      const response = await runtime.executeAgent(name, {
+        messages: messages as Array<{ role: 'system' | 'user' | 'assistant'; content: string }>,
+        signal: c.req.raw.signal,
+      })
+      return response
+    } catch (err) {
+      return c.json({ error: err instanceof Error ? err.message : 'unknown error' }, 500)
+    }
+  })
+
+  const port = Number(process.env.PORT ?? 8080)
+  serve({ fetch: app.fetch, port, hostname: '0.0.0.0' })
+  console.log(\`[runtype] listening on 0.0.0.0:\${port} \u2014 agents: \${Object.keys(agents).join(', ')}\`)
+}
+
+main().catch((err) => {
+  console.error('[runtype] fatal: failed to start server', err)
+  process.exit(1)
+})
+`;
 }
+function dockerfile() {
+  return `FROM node:22-bookworm-slim AS builder
+
+WORKDIR /app
+
+COPY package.json ./
+COPY packages ./packages
+RUN npm install --omit=dev --no-audit --no-fund
+
+COPY tsconfig.json server.ts ./
+COPY agents ./agents
+RUN npm install --no-save --no-audit --no-fund typescript @types/node \\
+  && npx tsc -p tsconfig.json
+
+FROM node:22-bookworm-slim AS runner
+
+WORKDIR /app
+ENV NODE_ENV=production
+ENV PORT=8080
+EXPOSE 8080
+
+COPY --from=builder /app/node_modules ./node_modules
+COPY --from=builder /app/dist ./dist
+COPY --from=builder /app/agents ./agents
+COPY --from=builder /app/package.json ./package.json
+
+CMD ["node", "dist/server.js"]
+`;
+}
+function dockerignore() {
+  return `node_modules
+dist
+*.log
+`;
+}
+function tsconfigJson() {
+  return JSON.stringify(
+    {
+      compilerOptions: {
+        target: "ES2022",
+        module: "ESNext",
+        moduleResolution: "bundler",
+        lib: ["ES2022", "DOM"],
+        strict: true,
+        esModuleInterop: true,
+        forceConsistentCasingInFileNames: true,
+        resolveJsonModule: true,
+        skipLibCheck: true,
+        outDir: "dist",
+        declaration: false,
+        sourceMap: true,
+        noEmit: false
+      },
+      include: ["*.ts"],
+      exclude: ["node_modules", "dist"]
+    },
+    null,
+    2
+  );
+}
+function packageJson(name, runtimeDep) {
+  return JSON.stringify(
+    {
+      name,
+      version: "0.0.0",
+      private: true,
+      type: "module",
+      scripts: {
+        start: "node dist/server.js",
+        dev: "tsx server.ts",
+        build: "tsc -p tsconfig.json",
+        typecheck: "tsc -p tsconfig.json --noEmit"
+      },
+      dependencies: {
+        "@hono/node-server": "^2.0.0",
+        "@runtypelabs/runtime": runtimeDep,
+        hono: "^4.12.16"
+      },
+      devDependencies: {
+        "@types/node": "^22.10.5",
+        tsx: "^4.19.2",
+        typescript: "^5.3.3"
+      },
+      engines: {
+        node: ">=22.0.0"
+      }
+    },
+    null,
+    2
+  );
+}
+function setupSh(monorepoRoot) {
+  return `#!/usr/bin/env bash
+# Generated by \`runtype deploy\`.
+#
+# Builds and packs @runtypelabs/runtime from your local monorepo, then
+# installs all dependencies so you can run \`npm start\` or deploy to
+# Cloud Run with \`gcloud run deploy --source .\`.
+#
+# Usage (from this directory):
+#   ./setup.sh
+#   # then: npm run dev   OR   gcloud run deploy \u2026
+
+set -euo pipefail
+
+DEPLOY_DIR="$(cd "$(dirname "\${BASH_SOURCE[0]}")" && pwd)"
+MONOREPO_ROOT=${bashSingleQuote(monorepoRoot)}
+TARBALL_DIR="\${DEPLOY_DIR}/packages"
+
+echo "[setup] building @runtypelabs/runtime..."
+pnpm --dir "\${MONOREPO_ROOT}" --filter @runtypelabs/runtime build
+
+mkdir -p "\${TARBALL_DIR}"
+
+echo "[setup] packing @runtypelabs/runtime tarball..."
+pnpm --dir "\${MONOREPO_ROOT}/packages/runtime" pack \\
+  --pack-destination "\${TARBALL_DIR}"
+
+RUNTIME_TGZ="$(ls "\${TARBALL_DIR}"/runtypelabs-runtime-*.tgz | head -n 1)"
+if [ -z "\${RUNTIME_TGZ}" ]; then
+  echo "[setup] error: no tarball produced by pnpm pack" >&2
+  exit 1
+fi
+RUNTIME_TGZ_NAME="$(basename "\${RUNTIME_TGZ}")"
+
+echo "[setup] updating package.json with file: dependency..."
+node -e "
+const fs = require('fs');
+const pkg = JSON.parse(fs.readFileSync('\${DEPLOY_DIR}/package.json', 'utf8'));
+pkg.dependencies['@runtypelabs/runtime'] = 'file:./packages/\${RUNTIME_TGZ_NAME}';
+fs.writeFileSync('\${DEPLOY_DIR}/package.json', JSON.stringify(pkg, null, 2) + '\\\\n');
+"
+
+echo "[setup] installing dependencies..."
+npm install --no-audit --no-fund
+
+echo ""
+echo "[setup] Done! Next steps:"
+echo "  npm run dev              \u2014 start locally"
+echo "  npm run build            \u2014 compile TypeScript"
+echo "  gcloud run deploy --source . --region us-central1 --allow-unauthenticated --port 8080"
+`;
+}
+function readme(agentNames, secretNames) {
+  const agentList = agentNames.map((n) => `  - ${n}`).join("\n");
+  const secretList = secretNames.length > 0 ? secretNames.map((s) => `  gcloud secrets create ${s} --data-file=-`).join("\n") : "  (none detected)";
+  return `# Runtype Deployment
+
+Generated by \`runtype deploy\`. Contains the following agents:
+
+${agentList}
+
+## Setup
+
+Run \`./setup.sh\` to build the runtime and install dependencies:
+
+\`\`\`bash
+chmod +x setup.sh
+./setup.sh
+\`\`\`
+
+## Local development
+
+\`\`\`bash
+npm run dev
+\`\`\`
+
+Test with:
+\`\`\`bash
+curl -X POST http://localhost:8080/agent/${agentNames[0] ?? "my-agent"} \\
+  -H "Content-Type: application/json" \\
+  -d '{"messages":[{"role":"user","content":"Hello!"}]}'
+\`\`\`
+
+## Required secrets
+
+Set these before deploying to Cloud Run:
+
+${secretList}
+
+## Deploy to Cloud Run
+
+\`\`\`bash
+gcloud run deploy runtype-deploy \\
+  --source . \\
+  --region us-central1 \\
+  --platform managed \\
+  --allow-unauthenticated \\
+  --port 8080
+\`\`\`
+
+## Health check
+
+\`GET /health\` returns \`{"status":"ok","agents":[...]}\`.
+`;
+}
+function collectSecretNames(agentDef) {
+  const names = /* @__PURE__ */ new Set();
+  const model = agentDef.config?.model?.toLowerCase();
+  if (model) {
+    for (const s of resolveModelSecretNames(model)) names.add(s);
+  }
+  const toolsCfg = agentDef.config?.tools;
+  const mcpServers = toolsCfg?.mcpServers;
+  if (mcpServers) {
+    for (const srv of mcpServers) {
+      const auth = srv.auth;
+      if (auth?.tokenSecretName) names.add(String(auth.tokenSecretName));
+      if (auth?.usernameSecretName) names.add(String(auth.usernameSecretName));
+      if (auth?.passwordSecretName) names.add(String(auth.passwordSecretName));
+    }
+  }
+  for (const s of extractSecretReferencesFromAnyValue(agentDef)) names.add(s);
+  return Array.from(names);
+}
+function slugify2(s) {
+  return s.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 63);
+}
+var deployCommand = new Command24("deploy").description("Export an agent or flow and scaffold a Cloud Run deployment").option("--agent <id>", "Agent ID to export (may be repeated)", (v, acc) => {
+  acc.push(v);
+  return acc;
+}, []).option("--flow <id>", "Flow ID to export (may be repeated)", (v, acc) => {
+  acc.push(v);
+  return acc;
+}, []).option("--output <dir>", "Output directory for the scaffold (default: ./runtype-deploy)", "./runtype-deploy").option("--name <name>", "Project name used in package.json (default: derived from output dir)").action(
+  async (options) => {
+    const agentIds = options.agent;
+    const flowIds = options.flow;
+    if (agentIds.length === 0 && flowIds.length === 0) {
+      console.error(chalk30.red("Error: provide at least one --agent <id> or --flow <id>"));
+      process.exit(1);
+    }
+    const apiKey = await ensureAuth();
+    if (!apiKey) return;
+    const client = new ApiClient(apiKey);
+    const outDir = path14.resolve(options.output);
+    const projectName = options.name ?? slugify2(path14.basename(outDir));
+    console.log(chalk30.cyan(`
+Scaffolding deployment to ${outDir}
+`));
+    const agentDefs = [];
+    for (const id of agentIds) {
+      process.stdout.write(`  Exporting agent ${chalk30.green(id)}... `);
+      try {
+        const def = await client.get(`/agents/${id}/export-runtime`);
+        agentDefs.push({ id, name: String(def.name ?? id), def });
+        process.stdout.write(chalk30.green("\u2713\n"));
+      } catch (err) {
+        const msg = err instanceof ApiError ? err.message : String(err);
+        process.stdout.write(chalk30.red(`\u2717
+`));
+        console.error(chalk30.red(`  Failed to export agent ${id}: ${msg}`));
+        if (err instanceof ApiError && err.statusCode === 404) {
+          console.error(chalk30.yellow("  The export-runtime feature may not be enabled on your account or environment."));
+          console.error(chalk30.gray("  If you have your own environment, try: RUNTYPE_API_URL={API Base URI} runtype deploy ..."));
+        }
+        process.exit(1);
+      }
+    }
+    for (const id of flowIds) {
+      process.stdout.write(`  Exporting flow ${chalk30.green(id)}... `);
+      try {
+        const def = await client.get(`/flows/${id}/export-runtime`);
+        const wrappedName = String(def.name ?? id);
+        agentDefs.push({
+          id,
+          name: wrappedName,
+          def: {
+            id: def.id,
+            name: wrappedName,
+            description: def.description ?? null,
+            agentType: "runtype",
+            config: {},
+            primaryFlow: def
+          }
+        });
+        process.stdout.write(chalk30.green("\u2713\n"));
+      } catch (err) {
+        const msg = err instanceof ApiError ? err.message : String(err);
+        process.stdout.write(chalk30.red(`\u2717
+`));
+        console.error(chalk30.red(`  Failed to export flow ${id}: ${msg}`));
+        if (err instanceof ApiError && err.statusCode === 404) {
+          console.error(chalk30.yellow("  The export-runtime feature may not be enabled on your account or environment."));
+          console.error(chalk30.gray("  If you have your own environment, try: RUNTYPE_API_URL={API Base URI} runtype deploy ..."));
+        }
+        process.exit(1);
+      }
+    }
+    fs14.mkdirSync(path14.join(outDir, "agents"), { recursive: true });
+    fs14.mkdirSync(path14.join(outDir, "packages"), { recursive: true });
+    for (const { name, def } of agentDefs) {
+      const filename = `${slugify2(name)}.json`;
+      fs14.writeFileSync(
+        path14.join(outDir, "agents", filename),
+        JSON.stringify(def, null, 2)
+      );
+      console.log(`  Wrote agents/${filename}`);
+    }
+    fs14.writeFileSync(
+      path14.join(outDir, "server.ts"),
+      serverTs()
+    );
+    fs14.writeFileSync(
+      path14.join(outDir, "Dockerfile"),
+      dockerfile()
+    );
+    fs14.writeFileSync(
+      path14.join(outDir, ".dockerignore"),
+      dockerignore()
+    );
+    fs14.writeFileSync(
+      path14.join(outDir, "tsconfig.json"),
+      tsconfigJson()
+    );
+    fs14.writeFileSync(
+      path14.join(outDir, "package.json"),
+      packageJson(projectName, "workspace:*")
+    );
+    let monorepoRoot = process.cwd();
+    for (let i = 0; i < 8; i++) {
+      if (fs14.existsSync(path14.join(monorepoRoot, "pnpm-workspace.yaml"))) break;
+      const parent = path14.dirname(monorepoRoot);
+      if (parent === monorepoRoot) break;
+      monorepoRoot = parent;
+    }
+    const setupScript = setupSh(monorepoRoot);
+    const setupPath = path14.join(outDir, "setup.sh");
+    fs14.writeFileSync(setupPath, setupScript);
+    fs14.chmodSync(setupPath, 493);
+    const allSecrets = /* @__PURE__ */ new Set();
+    for (const { def } of agentDefs) {
+      for (const s of collectSecretNames(def)) allSecrets.add(s);
+    }
+    const secretNames = Array.from(allSecrets);
+    fs14.writeFileSync(
+      path14.join(outDir, "README.md"),
+      readme(
+        agentDefs.map((a) => a.name),
+        secretNames
+      )
+    );
+    console.log("");
+    console.log(chalk30.green(`\u2713 Scaffold written to ${outDir}`));
+    console.log("");
+    console.log(chalk30.bold("Next steps:"));
+    console.log(`  cd ${options.output}`);
+    console.log("  chmod +x setup.sh && ./setup.sh   # pack runtime + install deps");
+    console.log("  npm run dev                        # test locally");
+    console.log("");
+    if (secretNames.length > 0) {
+      console.log(chalk30.yellow("Required secrets (set before deploying):"));
+      for (const s of secretNames) {
+        console.log(`  ${chalk30.cyan(s)}`);
+      }
+      console.log("");
+      console.log("  Set via Cloud Run:  gcloud run deploy \u2026 --set-secrets KEY=NAME:latest");
+      console.log("  Or export locally:  export KEY=<value>");
+      console.log("");
+    }
+    console.log("Deploy to Cloud Run:");
+    console.log(
+      `  gcloud run deploy ${projectName} --source ${options.output} \\`
+    );
+    console.log("    --region us-central1 --platform managed \\");
+    console.log("    --allow-unauthenticated --port 8080");
+  }
+);
 
 // src/index.ts
 init_credential_store();
 
 // src/lib/update-check.ts
-import chalk29 from "chalk";
+import chalk31 from "chalk";
 import Conf3 from "conf";
 var UPDATE_CHECK_INTERVAL_MS = 12 * 60 * 60 * 1e3;
 var UPDATE_NOTIFY_INTERVAL_MS = 24 * 60 * 60 * 1e3;
@@ -53193,7 +54241,7 @@ function notifyFromCachedCliUpdate(args, options = {}) {
     console.error(message);
   });
   notify(
-    `${chalk29.yellow("Update available:")} ${chalk29.red(currentVersion)} ${chalk29.gray("->")} ${chalk29.green(latestVersion)}  ${chalk29.gray(`(${getUpgradeCommand()})`)}`
+    `${chalk31.yellow("Update available:")} ${chalk31.red(currentVersion)} ${chalk31.gray("->")} ${chalk31.green(latestVersion)}  ${chalk31.gray(`(${getUpgradeCommand()})`)}`
   );
   store.set("lastNotifiedAt", now.toISOString());
   store.set("lastNotifiedVersion", latestVersion);
@@ -53235,7 +54283,7 @@ function maybeNotifyAboutCliUpdate(args, options = {}) {
 // src/index.ts
 loadEnv();
 setCliTitle();
-var program = new Command23();
+var program = new Command25();
 program.name("runtype").description("CLI for Runtype AI Platform").version(getCliVersion()).option("-v, --verbose", "Enable verbose output").option("--api-url <url>", "Override API URL").option("--json", "Output in JSON format");
 program.addCommand(initCommand);
 program.addCommand(loginCommand);
@@ -53257,9 +54305,11 @@ program.addCommand(personaCommand);
 program.addCommand(analyticsCommand);
 program.addCommand(billingCommand);
 program.addCommand(flowVersionsCommand);
+program.addCommand(agentVersionsCommand);
 program.addCommand(createMarathonCommand());
 program.addCommand(tailCommand);
 program.addCommand(validateProductCommand);
+program.addCommand(deployCommand);
 program.exitOverride();
 try {
   const userArgs = process.argv.slice(2);
@@ -53273,15 +54323,15 @@ try {
 } catch (error51) {
   const commanderError = error51;
   if (commanderError.code === "commander.missingArgument") {
-    console.error(chalk30.red(`Error: ${commanderError.message}`));
+    console.error(chalk32.red(`Error: ${commanderError.message}`));
     process.exit(1);
   } else if (commanderError.code === "commander.unknownOption") {
-    console.error(chalk30.red(`Error: ${commanderError.message}`));
+    console.error(chalk32.red(`Error: ${commanderError.message}`));
     process.exit(1);
   } else if (commanderError.code === "commander.help" || commanderError.code === "commander.version") {
     process.exit(0);
   } else {
-    console.error(chalk30.red("An unexpected error occurred:"));
+    console.error(chalk32.red("An unexpected error occurred:"));
     console.error(error51);
     process.exit(1);
   }
@@ -53290,12 +54340,12 @@ async function handleNoCommand() {
   const store = new CredentialStore();
   const hasCredentials = await store.hasCredentials();
   if (!hasCredentials) {
-    console.log(chalk30.cyan("\nWelcome to Runtype CLI!\n"));
+    console.log(chalk32.cyan("\nWelcome to Runtype CLI!\n"));
     console.log("It looks like this is your first time. Run the setup wizard:");
-    console.log(`  ${chalk30.green("runtype init")}
+    console.log(`  ${chalk32.green("runtype init")}
 `);
     console.log("Or see all available commands:");
-    console.log(`  ${chalk30.green("runtype --help")}
+    console.log(`  ${chalk32.green("runtype --help")}
 `);
   } else {
     try {