@runtypelabs/cli 2.22.3 → 2.22.5

package/dist/index.js

@@ -21348,6 +21348,49 @@ var runtimeArtifactManifestSchema = external_exports.object({
     reasons: external_exports.array(runtimeArtifactEligibilityReasonSchema)
   })
 });
+var edgeAuthSnapshotSchema = external_exports.object({
+  /**
+   * Schema version. A plain positive int (not a literal) so a consumer pinned
+   * to v1 can still parse a future v(N) record whose only delta is additive
+   * optional fields. Producer writes {@link EDGE_AUTH_SNAPSHOT_SCHEMA_VERSION}.
+   */
+  schemaVersion: external_exports.number().int().positive(),
+  /** Resolved Runtype user id (`user_…`). */
+  userId: external_exports.string().min(1),
+  /** Resolved org id (`org_…`); null for a personal (no-org) credential. */
+  orgId: external_exports.string().min(1).nullable(),
+  /** Effective permission scopes for the credential (e.g. `["*"]`). */
+  scopes: external_exports.array(external_exports.string()),
+  /**
+   * Test credential? Normalized across types: API key → prefix-derived
+   * `isTestKey`; client token → `environment === 'test'`. The consumer routes
+   * test credentials to the API (never the edge fast path).
+   */
+  isTestKey: external_exports.boolean(),
+  /**
+   * Mirror of the platform-key spend ceiling (`getPlatformKeyAccessStatus`'s
+   * `blocked`, per-org). A best-effort copy bounded by the record's short TTL;
+   * the authoritative spend gate stays on the API path.
+   */
+  spendExceeded: external_exports.boolean(),
+  /**
+   * Demotion backstop (decision D): when true the edge must fall back to the
+   * API. Always `false` from the producer; flipped asynchronously by the
+   * control plane (out of scope for the write-through producer).
+   */
+  forceFallback: external_exports.boolean(),
+  /**
+   * Credential expiry as epoch MILLISECONDS (same unit as the signed-context
+   * `exp`), or `null` for no expiry. The edge MUST reject a record whose
+   * `expiresAt <= now` even on a KV hit: the producer also caps the KV TTL at
+   * the remaining lifetime, but KV's 60s minimum TTL means a near-expiry record
+   * can briefly outlive the credential, so the field is the precise gate.
+   * Optional for additive-compat with records written before this field existed
+   * (a v1 consumer treats an absent value as "no expiry recorded"). API keys
+   * populate it from their `expiresAt`; client tokens have no expiry (null).
+   */
+  expiresAt: external_exports.number().int().positive().nullable().optional()
+});
 var EMIT_ARTIFACT_MARKDOWN_TOOL_ID = "emit_artifact_markdown";
 var EMIT_ARTIFACT_COMPONENT_TOOL_ID = "emit_artifact_component";
 var EMIT_ARTIFACT_MARKDOWN_FULL_ID = `builtin:${EMIT_ARTIFACT_MARKDOWN_TOOL_ID}`;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runtypelabs/cli",
-  "version": "2.22.3",
+  "version": "2.22.5",
   "description": "Command-line interface for Runtype AI platform",
   "type": "module",
   "main": "dist/index.js",
@@ -23,8 +23,8 @@
     "react": "^19.2.4",
     "rosie-skills": "0.8.1",
     "yaml": "^2.9.0",
-    "@runtypelabs/sdk": "4.19.2",
     "@runtypelabs/ink-components": "0.3.2",
+    "@runtypelabs/sdk": "4.21.0",
     "@runtypelabs/terminal-animations": "0.2.1"
   },
   "devDependencies": {
@@ -39,7 +39,7 @@
     "tsx": "^4.7.1",
     "typescript": "^5.3.3",
     "vitest": "^4.1.0",
-    "@runtypelabs/shared": "1.35.2"
+    "@runtypelabs/shared": "1.35.4"
   },
   "engines": {
     "node": ">=22.0.0"