@runtypelabs/cli 2.16.8 → 2.16.9

package/dist/index.js

@@ -15590,6 +15590,10 @@ var agentAwaitEventSchema = external_exports.object({
   ...baseAgentEvent,
   type: external_exports.literal("agent_await"),
   toolId: external_exports.string(),
+  // Unique per-call id (provider `toolu_…`). Parallel calls to the same local
+  // tool share `toolId`; `toolCallId` lets the widget address each in `/resume`
+  // (core#3878).
+  toolCallId: external_exports.string().optional(),
   toolName: external_exports.string(),
   parameters: external_exports.record(external_exports.string(), external_exports.unknown()).optional(),
   awaitedAt: external_exports.string(),
@@ -15768,6 +15772,10 @@ var flowAwaitEventSchema = external_exports.object({
   type: external_exports.literal("flow_await"),
   flowId: external_exports.string(),
   toolId: external_exports.string().optional(),
+  // Unique per-call id (provider `toolu_…`). Parallel calls to the same local
+  // tool share `toolId`; `toolCallId` lets a client address each in `/resume`
+  // (core#3878).
+  toolCallId: external_exports.string().optional(),
   toolName: external_exports.string().optional(),
   parameters: external_exports.record(external_exports.string(), external_exports.unknown()).optional(),
   awaitedAt: external_exports.string(),
@@ -38478,6 +38486,9 @@ var InlineClientToolSchema = external_exports.object({
   origin: external_exports.enum(["webmcp", "sdk"]).optional(),
   pageOrigin: external_exports.string().optional()
 });
+var ClientToolsPolicySchema = external_exports.object({
+  allowlist: external_exports.array(external_exports.string()).optional()
+});
 var DispatchRequestSchema = external_exports.object({
   record: RecordInputSchema.optional(),
   flow: FlowInputSchema.optional(),
@@ -38502,6 +38513,13 @@ var DispatchRequestSchema = external_exports.object({
    * wire-side counterpart that arrives per-dispatch.
    */
   clientTools: external_exports.array(InlineClientToolSchema).optional(),
+  /**
+   * Optional policy governing how `clientTools[]` are admitted on this
+   * (API-key) dispatch. Today it carries an optional `allowlist` that
+   * narrows which `origin: 'webmcp'` tools are accepted; omit it to admit
+   * every submitted webmcp tool. See {@link ClientToolsPolicySchema}.
+   */
+  clientToolsPolicy: ClientToolsPolicySchema.optional(),
   secrets: external_exports.record(external_exports.string(), external_exports.string()).optional(),
   credentialProxies: external_exports.array(credentialProxyConfigSchema).max(10).optional(),
   inputs: external_exports.record(external_exports.string(), external_exports.any()).optional().refine(

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runtypelabs/cli",
-  "version": "2.16.8",
+  "version": "2.16.9",
   "description": "Command-line interface for Runtype AI platform",
   "type": "module",
   "main": "dist/index.js",
@@ -22,7 +22,7 @@
     "rosie-skills": "0.8.1",
     "yaml": "^2.9.0",
     "@runtypelabs/ink-components": "0.3.2",
-    "@runtypelabs/sdk": "4.2.0",
+    "@runtypelabs/sdk": "4.3.0",
     "@runtypelabs/terminal-animations": "0.2.1"
   },
   "devDependencies": {
@@ -36,7 +36,7 @@
     "tsx": "^4.7.1",
     "typescript": "^5.3.3",
     "vitest": "^4.1.0",
-    "@runtypelabs/shared": "1.13.2"
+    "@runtypelabs/shared": "1.14.0"
   },
   "engines": {
     "node": ">=22.0.0"