@runtypelabs/cli 2.32.1 → 2.32.3

package/dist/index.js

@@ -619,6 +619,141 @@ import { RuntypeApiError } from "@runtypelabs/sdk";
 // src/lib/sdk-client.ts
 import { createClient } from "@runtypelabs/sdk";
 
+// ../shared/dist/chunk-R7RM64AL.mjs
+var DEFAULT_MODELS_FOR_NEW_ACCOUNTS = [
+  // Mixlayer models
+  {
+    provider: "runtype",
+    modelId: "qwen/qwen3.6-27b",
+    isDefault: false,
+    strengths: "Fast, low-cost open-weight workhorse with reasoning, tool-use, and vision \u2014 good for high-volume extraction, classification, and simple transforms.",
+    bestFor: ["fast-cheap", "vision"]
+  },
+  // Routed models - benefit from automatic provider optimization
+  // OpenAI models (routed via OpenAI direct, with Vercel fallback)
+  {
+    provider: "runtype",
+    modelId: "gpt-5.5",
+    isDefault: false,
+    strengths: "Top-tier general reasoning and tool-use with excellent structured-output reliability, vision, and a 1M context \u2014 a strong pick for complex, correctness-sensitive steps.",
+    bestFor: ["default", "deep-reasoning", "agentic-tools", "vision", "long-context"]
+  },
+  {
+    provider: "runtype",
+    modelId: "gpt-5.4-mini",
+    isDefault: false,
+    strengths: "Fast and affordable with dependable JSON formatting \u2014 a good fit for mid-complexity task steps.",
+    bestFor: ["fast-cheap", "default"]
+  },
+  {
+    provider: "runtype",
+    modelId: "gpt-5.4-nano",
+    isDefault: false,
+    strengths: "Cheapest and fastest GPT-5 tier \u2014 reserve for trivial deterministic transforms, routing, and classification, not complex authoring.",
+    bestFor: ["fast-cheap"]
+  },
+  // Anthropic models (routed via Anthropic direct, with Vertex/Bedrock fallback)
+  {
+    provider: "runtype",
+    modelId: "claude-haiku-4-5",
+    isDefault: false,
+    strengths: "Fast and inexpensive while retaining real reasoning, tool-use, and vision \u2014 great for high-volume task steps that still need some judgment.",
+    bestFor: ["fast-cheap", "agentic-tools", "vision"]
+  },
+  {
+    provider: "runtype",
+    modelId: "claude-sonnet-5",
+    isDefault: false,
+    strengths: "Balanced all-rounder: strong reasoning, very reliable multi-round tool loops, vision, and a 1M context \u2014 an excellent choice for agentic and structured work.",
+    bestFor: ["default", "agentic-tools", "vision", "long-context"]
+  },
+  {
+    provider: "runtype",
+    modelId: "claude-opus-4-8",
+    isDefault: false,
+    strengths: "Deepest reasoning and planning for hard analysis and multi-constraint synthesis, with vision and a 1M context \u2014 premium-priced, so reserve for genuinely difficult steps.",
+    bestFor: ["deep-reasoning", "vision", "long-context"]
+  },
+  // Google models (routed via Google direct, with Vertex/Vercel fallback)
+  {
+    provider: "runtype",
+    modelId: "gemini-3-1-flash-lite",
+    isDefault: false,
+    strengths: "Very fast and very cheap with full multimodal input (vision and audio), good structured output, and a 1M context \u2014 ideal for high-volume, simple steps.",
+    bestFor: ["fast-cheap", "vision", "long-context"]
+  },
+  {
+    provider: "runtype",
+    modelId: "gemini-3.6-flash",
+    isDefault: false,
+    strengths: "Fast, low-cost, and natively multimodal with good reasoning, tool-use, and a 1M context \u2014 a strong choice for vision and high-throughput steps.",
+    bestFor: ["default", "vision", "fast-cheap", "agentic-tools", "long-context"]
+  },
+  {
+    provider: "runtype",
+    modelId: "gemini-3-1-flash-image",
+    isDefault: false,
+    strengths: "Specialised for image generation and editing (image output) \u2014 use for steps that produce images, not text reasoning.",
+    bestFor: ["image-generation"]
+  },
+  {
+    provider: "runtype",
+    modelId: "gemini-3.1-pro",
+    isDefault: false,
+    strengths: "Google's frontier tier: strong reasoning, a 1M context, and multimodal input \u2014 for complex analytical or long-document steps.",
+    bestFor: ["deep-reasoning", "vision", "long-context"]
+  },
+  // Inception models (routed via Vercel)
+  {
+    provider: "runtype",
+    modelId: "mercury-2",
+    isDefault: false,
+    strengths: "Diffusion-based LLM optimised for very low latency \u2014 good when speed matters more than deep reasoning.",
+    bestFor: ["fast-cheap"]
+  },
+  // Moonshot models (routed via Vercel)
+  // Kimi K2.6 is the default model: a reasoning + tool-use + vision model
+  // already trusted as the product-generator default.
+  {
+    provider: "runtype",
+    modelId: "kimi-k2.6",
+    isDefault: true,
+    strengths: "Capable open agentic model with reasoning, tool-use, and vision at strong value \u2014 the current account default and a dependable general workhorse.",
+    bestFor: ["default", "agentic-tools", "vision"]
+  },
+  // NVIDIA Nemotron Ultra (reasoning + tool-use flagship, routed via Vercel)
+  {
+    provider: "runtype",
+    modelId: "nemotron-3-ultra-550b-a55b",
+    isDefault: false,
+    strengths: "Large open-weight reasoning and tool-use flagship with a 1M context at a low price \u2014 strong analytical depth where an open model is preferred.",
+    bestFor: ["deep-reasoning", "agentic-tools", "long-context"]
+  },
+  // Google models (routed via Cloudflare Workers AI)
+  {
+    provider: "runtype",
+    modelId: "gemma-4-26b-a4b-it",
+    isDefault: false,
+    strengths: "Lightweight open-weight instruct model served free on Workers AI \u2014 fine for straightforward general tasks at zero cost.",
+    bestFor: ["fast-cheap"]
+  },
+  // Z.ai GLM-5.2 (agentic coding flagship, routed via Cloudflare Workers AI,
+  // Vercel fallback). The bare routed name resolves to `@cf/zai-org/glm-5.2`.
+  {
+    provider: "runtype",
+    modelId: "glm-5.2",
+    isDefault: false,
+    strengths: "Agentic flagship \u2014 best-in-class at long, multi-round tool-call loops and coding/agent workflows, with a 1M context; well suited to tool-heavy agent steps.",
+    bestFor: ["agentic-tools", "default", "deep-reasoning", "long-context"]
+  }
+];
+var DEFAULT_MODEL_ID = DEFAULT_MODELS_FOR_NEW_ACCOUNTS.find((m2) => m2.isDefault)?.modelId ?? "kimi-k2.6";
+function renderDefaultModelStrengthsGuide() {
+  return DEFAULT_MODELS_FOR_NEW_ACCOUNTS.map(
+    (m2) => `- \`${m2.modelId}\`${m2.isDefault ? " (account default)" : ""} \u2014 ${m2.strengths}`
+  ).join("\n");
+}
+
 // ../shared/dist/chunk-72QEJTK5.mjs
 var travrseConfig = {
   name: "Travrse",
@@ -15260,141 +15395,6 @@ var edgeContextPayloadSchema = external_exports.object({
 // ../shared/dist/chunk-SCJRL6LP.mjs
 var MAX_DURABLE_POLL_ATTEMPTS = 1e3;
 
-// ../shared/dist/chunk-R7RM64AL.mjs
-var DEFAULT_MODELS_FOR_NEW_ACCOUNTS = [
-  // Mixlayer models
-  {
-    provider: "runtype",
-    modelId: "qwen/qwen3.6-27b",
-    isDefault: false,
-    strengths: "Fast, low-cost open-weight workhorse with reasoning, tool-use, and vision \u2014 good for high-volume extraction, classification, and simple transforms.",
-    bestFor: ["fast-cheap", "vision"]
-  },
-  // Routed models - benefit from automatic provider optimization
-  // OpenAI models (routed via OpenAI direct, with Vercel fallback)
-  {
-    provider: "runtype",
-    modelId: "gpt-5.5",
-    isDefault: false,
-    strengths: "Top-tier general reasoning and tool-use with excellent structured-output reliability, vision, and a 1M context \u2014 a strong pick for complex, correctness-sensitive steps.",
-    bestFor: ["default", "deep-reasoning", "agentic-tools", "vision", "long-context"]
-  },
-  {
-    provider: "runtype",
-    modelId: "gpt-5.4-mini",
-    isDefault: false,
-    strengths: "Fast and affordable with dependable JSON formatting \u2014 a good fit for mid-complexity task steps.",
-    bestFor: ["fast-cheap", "default"]
-  },
-  {
-    provider: "runtype",
-    modelId: "gpt-5.4-nano",
-    isDefault: false,
-    strengths: "Cheapest and fastest GPT-5 tier \u2014 reserve for trivial deterministic transforms, routing, and classification, not complex authoring.",
-    bestFor: ["fast-cheap"]
-  },
-  // Anthropic models (routed via Anthropic direct, with Vertex/Bedrock fallback)
-  {
-    provider: "runtype",
-    modelId: "claude-haiku-4-5",
-    isDefault: false,
-    strengths: "Fast and inexpensive while retaining real reasoning, tool-use, and vision \u2014 great for high-volume task steps that still need some judgment.",
-    bestFor: ["fast-cheap", "agentic-tools", "vision"]
-  },
-  {
-    provider: "runtype",
-    modelId: "claude-sonnet-5",
-    isDefault: false,
-    strengths: "Balanced all-rounder: strong reasoning, very reliable multi-round tool loops, vision, and a 1M context \u2014 an excellent choice for agentic and structured work.",
-    bestFor: ["default", "agentic-tools", "vision", "long-context"]
-  },
-  {
-    provider: "runtype",
-    modelId: "claude-opus-4-8",
-    isDefault: false,
-    strengths: "Deepest reasoning and planning for hard analysis and multi-constraint synthesis, with vision and a 1M context \u2014 premium-priced, so reserve for genuinely difficult steps.",
-    bestFor: ["deep-reasoning", "vision", "long-context"]
-  },
-  // Google models (routed via Google direct, with Vertex/Vercel fallback)
-  {
-    provider: "runtype",
-    modelId: "gemini-3-1-flash-lite",
-    isDefault: false,
-    strengths: "Very fast and very cheap with full multimodal input (vision and audio), good structured output, and a 1M context \u2014 ideal for high-volume, simple steps.",
-    bestFor: ["fast-cheap", "vision", "long-context"]
-  },
-  {
-    provider: "runtype",
-    modelId: "gemini-3.6-flash",
-    isDefault: false,
-    strengths: "Fast, low-cost, and natively multimodal with good reasoning, tool-use, and a 1M context \u2014 a strong choice for vision and high-throughput steps.",
-    bestFor: ["default", "vision", "fast-cheap", "agentic-tools", "long-context"]
-  },
-  {
-    provider: "runtype",
-    modelId: "gemini-3-1-flash-image",
-    isDefault: false,
-    strengths: "Specialised for image generation and editing (image output) \u2014 use for steps that produce images, not text reasoning.",
-    bestFor: ["image-generation"]
-  },
-  {
-    provider: "runtype",
-    modelId: "gemini-3.1-pro",
-    isDefault: false,
-    strengths: "Google's frontier tier: strong reasoning, a 1M context, and multimodal input \u2014 for complex analytical or long-document steps.",
-    bestFor: ["deep-reasoning", "vision", "long-context"]
-  },
-  // Inception models (routed via Vercel)
-  {
-    provider: "runtype",
-    modelId: "mercury-2",
-    isDefault: false,
-    strengths: "Diffusion-based LLM optimised for very low latency \u2014 good when speed matters more than deep reasoning.",
-    bestFor: ["fast-cheap"]
-  },
-  // Moonshot models (routed via Vercel)
-  // Kimi K2.6 is the default model: a reasoning + tool-use + vision model
-  // already trusted as the product-generator default.
-  {
-    provider: "runtype",
-    modelId: "kimi-k2.6",
-    isDefault: true,
-    strengths: "Capable open agentic model with reasoning, tool-use, and vision at strong value \u2014 the current account default and a dependable general workhorse.",
-    bestFor: ["default", "agentic-tools", "vision"]
-  },
-  // NVIDIA Nemotron Ultra (reasoning + tool-use flagship, routed via Vercel)
-  {
-    provider: "runtype",
-    modelId: "nemotron-3-ultra-550b-a55b",
-    isDefault: false,
-    strengths: "Large open-weight reasoning and tool-use flagship with a 1M context at a low price \u2014 strong analytical depth where an open model is preferred.",
-    bestFor: ["deep-reasoning", "agentic-tools", "long-context"]
-  },
-  // Google models (routed via Cloudflare Workers AI)
-  {
-    provider: "runtype",
-    modelId: "gemma-4-26b-a4b-it",
-    isDefault: false,
-    strengths: "Lightweight open-weight instruct model served free on Workers AI \u2014 fine for straightforward general tasks at zero cost.",
-    bestFor: ["fast-cheap"]
-  },
-  // Z.ai GLM-5.2 (agentic coding flagship, routed via Cloudflare Workers AI,
-  // Vercel fallback). The bare routed name resolves to `@cf/zai-org/glm-5.2`.
-  {
-    provider: "runtype",
-    modelId: "glm-5.2",
-    isDefault: false,
-    strengths: "Agentic flagship \u2014 best-in-class at long, multi-round tool-call loops and coding/agent workflows, with a 1M context; well suited to tool-heavy agent steps.",
-    bestFor: ["agentic-tools", "default", "deep-reasoning", "long-context"]
-  }
-];
-var DEFAULT_MODEL_ID = DEFAULT_MODELS_FOR_NEW_ACCOUNTS.find((m2) => m2.isDefault)?.modelId ?? "kimi-k2.6";
-function renderDefaultModelStrengthsGuide() {
-  return DEFAULT_MODELS_FOR_NEW_ACCOUNTS.map(
-    (m2) => `- \`${m2.modelId}\`${m2.isDefault ? " (account default)" : ""} \u2014 ${m2.strengths}`
-  ).join("\n");
-}
-
 // ../shared/dist/chunk-UB6BK3TZ.mjs
 function getNestedValue(obj, path20) {
   let normalizedPath = path20;
@@ -15786,7 +15786,7 @@ function resolveFallback(parsed, context, tracking, options = {}) {
 }
 var templateEngine = new SimpleTemplateEngine();
 
-// ../shared/dist/chunk-3DRXBLKO.mjs
+// ../shared/dist/chunk-MN4NECP7.mjs
 var tokensSchema = external_exports.object({ input: external_exports.number(), output: external_exports.number() });
 var wireStopReasonSchema = external_exports.enum([
   "end_turn",
@@ -16412,6 +16412,7 @@ var agentToolStartEventSchema = external_exports.object({
     "local"
   ]),
   parameters: external_exports.record(external_exports.string(), external_exports.unknown()).optional(),
+  hiddenParameterNames: external_exports.array(external_exports.string()).optional(),
   origin: external_exports.enum(["webmcp", "sdk"]).optional(),
   pageOrigin: external_exports.string().optional()
 });
@@ -17017,6 +17018,353 @@ var artifactSSEEventSchema = external_exports.discriminatedUnion("type", [
 ]);
 var UNIFIED_SSE_EVENT_TYPE_SET = new Set(UNIFIED_SSE_EVENT_TYPES);
 
+// ../shared/dist/chunk-UG3J37K4.mjs
+function parseHTMLWithRegex(html) {
+  if (typeof html !== "string") {
+    throw new Error("parseHTML: input must be a string");
+  }
+  try {
+    const parser = {
+      stripTags(value) {
+        return value.replace(/<[^>]*>/g, " ").replace(/<(\/?[a-zA-Z][^>]*)$/, "&lt;$1").replace(/\s+/g, " ").trim();
+      },
+      querySelector(selector) {
+        try {
+          const tag = selector.replace(/[^a-zA-Z0-9-]/g, "");
+          const match = html.match(new RegExp("<" + tag + "[^>]*>(.*?)<\\/" + tag + ">", "is"));
+          return match ? parser.stripTags(match[1]).trim() || null : null;
+        } catch {
+          return null;
+        }
+      },
+      querySelectorAll(selector) {
+        try {
+          const tag = selector.replace(/[^a-zA-Z0-9-]/g, "");
+          const regex = new RegExp("<" + tag + "[^>]*>(.*?)<\\/" + tag + ">", "gis");
+          const results = [];
+          let match;
+          while ((match = regex.exec(html)) !== null) {
+            const value = parser.stripTags(match[1]).trim();
+            if (value) results.push(value);
+          }
+          return results;
+        } catch {
+          return [];
+        }
+      }
+    };
+    const titleMatch = html.match(/<title[^>]*>(.*?)<\/title>/is);
+    const title = titleMatch ? parser.stripTags(titleMatch[1]).trim() || void 0 : void 0;
+    const headingRegex = /<h[1-6][^>]*>(.*?)<\/h[1-6]>/gis;
+    const headings = [];
+    let headingMatch;
+    while ((headingMatch = headingRegex.exec(html)) !== null) {
+      const text2 = parser.stripTags(headingMatch[1]).trim();
+      if (text2) headings.push(text2);
+    }
+    const linkRegex = /<a\s[^>]*href=["']([^"']*)["'][^>]*>(.*?)<\/a>/gis;
+    const links = [];
+    let linkMatch;
+    while ((linkMatch = linkRegex.exec(html)) !== null) {
+      const href = linkMatch[1];
+      const text2 = parser.stripTags(linkMatch[2]).trim();
+      if (href) links.push({ href, text: text2 });
+    }
+    const text = parser.stripTags(html);
+    return {
+      title,
+      headings,
+      links,
+      text,
+      querySelector: parser.querySelector,
+      querySelectorAll: parser.querySelectorAll
+    };
+  } catch (error51) {
+    throw new Error(
+      `parseHTML failed: ${error51 instanceof Error ? error51.message : "Unknown error"}`,
+      {
+        cause: error51
+      }
+    );
+  }
+}
+function createPortableHelpers(parseHTML) {
+  return {
+    parseHTML,
+    /**
+     * Extract email addresses from text
+     * @param text Text to search for emails
+     * @returns Array of found email addresses
+     */
+    extractEmails(text) {
+      if (typeof text !== "string") {
+        return [];
+      }
+      const emailRegex = /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}/g;
+      const matches = text.match(emailRegex);
+      return matches ? [...new Set(matches)] : [];
+    },
+    /**
+     * Extract URLs from text
+     * @param text Text to search for URLs
+     * @returns Array of found URLs
+     */
+    extractURLs(text) {
+      if (typeof text !== "string") {
+        return [];
+      }
+      const urlRegex = /https?:\/\/(www\.)?[-a-zA-Z0-9@:%._+~#=]{1,256}\.[a-zA-Z0-9()]{1,6}\b([-a-zA-Z0-9()@:%_+.~#?&/=]*)/g;
+      const matches = text.match(urlRegex);
+      return matches ? [...new Set(matches)] : [];
+    },
+    /**
+     * Extract phone numbers from text
+     * @param text Text to search for phone numbers
+     * @returns Array of found phone numbers
+     */
+    extractPhoneNumbers(text) {
+      if (typeof text !== "string") {
+        return [];
+      }
+      const phoneRegex = /(?:\+?1[-.\s]?)?(?:\([0-9]{3}\)|[0-9]{3})[-.\s]?[0-9]{3}[-.\s]?[0-9]{4}/g;
+      const matches = text.match(phoneRegex);
+      return matches ? [...new Set(matches)] : [];
+    },
+    /**
+     * Truncate text to specified length with ellipsis
+     * @param text Text to truncate
+     * @param length Maximum length
+     * @returns Truncated text
+     */
+    truncate(text, length) {
+      if (typeof text !== "string" || typeof length !== "number") {
+        return text || "";
+      }
+      if (text.length <= length) {
+        return text;
+      }
+      return text.substring(0, length).trim() + "...";
+    },
+    /**
+     * Create URL-friendly slug from text
+     * @param text Text to slugify
+     * @returns URL-friendly slug
+     */
+    slugify(text) {
+      if (typeof text !== "string") {
+        return "";
+      }
+      return text.toLowerCase().trim().replace(/[^\w\s-]/g, "").replace(/[\s_-]+/g, "-").replace(/^-+|-+$/g, "");
+    },
+    /**
+     * Convert Markdown to HTML (basic conversion)
+     * @param markdown Markdown text
+     * @returns HTML string
+     */
+    markdown2html(markdown) {
+      if (typeof markdown !== "string") {
+        return "";
+      }
+      return markdown.replace(/^### (.*$)/gim, "<h3>$1</h3>").replace(/^## (.*$)/gim, "<h2>$1</h2>").replace(/^# (.*$)/gim, "<h1>$1</h1>").replace(/\*\*(.*?)\*\*/gim, "<strong>$1</strong>").replace(/__(.*?)__/gim, "<strong>$1</strong>").replace(/\*(.*?)\*/gim, "<em>$1</em>").replace(/_(.*?)_/gim, "<em>$1</em>").replace(/`(.*?)`/gim, "<code>$1</code>").replace(/\[([^\]]+)\]\(([^)]+)\)/gim, '<a href="$2">$1</a>').replace(/\n\n/gim, "</p><p>").replace(/\n/gim, "<br>").replace(/^(?!<[h|u|o|l])/gim, "<p>").replace(/$/gim, "</p>").replace(/<p><\/p>/gim, "").replace(/<p>(<h[1-6]>.*<\/h[1-6]>)<\/p>/gim, "$1");
+    },
+    /**
+     * Convert HTML to Markdown (basic conversion)
+     * @param html HTML string
+     * @returns Markdown text
+     */
+    html2markdown(html) {
+      if (typeof html !== "string") {
+        return "";
+      }
+      return html.replace(/<h1[^>]*>(.*?)<\/h1>/gim, "# $1\n\n").replace(/<h2[^>]*>(.*?)<\/h2>/gim, "## $1\n\n").replace(/<h3[^>]*>(.*?)<\/h3>/gim, "### $1\n\n").replace(/<h4[^>]*>(.*?)<\/h4>/gim, "#### $1\n\n").replace(/<h5[^>]*>(.*?)<\/h5>/gim, "##### $1\n\n").replace(/<h6[^>]*>(.*?)<\/h6>/gim, "###### $1\n\n").replace(/<strong[^>]*>(.*?)<\/strong>/gim, "**$1**").replace(/<b[^>]*>(.*?)<\/b>/gim, "**$1**").replace(/<em[^>]*>(.*?)<\/em>/gim, "*$1*").replace(/<i[^>]*>(.*?)<\/i>/gim, "*$1*").replace(/<code[^>]*>(.*?)<\/code>/gim, "`$1`").replace(/<a[^>]*href="([^"]*)"[^>]*>(.*?)<\/a>/gim, "[$2]($1)").replace(/<br[^>]*>/gim, "\n").replace(/<\/p>/gim, "\n\n").replace(/<p[^>]*>/gim, "").replace(/<li[^>]*>(.*?)<\/li>/gim, "- $1\n").replace(/<ul[^>]*>/gim, "\n").replace(/<\/ul>/gim, "\n").replace(/<ol[^>]*>/gim, "\n").replace(/<\/ol>/gim, "\n").replace(/<[^>]*>/gim, "").replace(/<(\/?[a-zA-Z][^>]*)$/, "&lt;$1").replace(/\n\s*\n\s*\n/gim, "\n\n").trim();
+    },
+    /**
+     * Parse date from various string formats
+     * @param dateStr Date string to parse
+     * @returns Date object or null if invalid
+     */
+    parseDate(dateStr) {
+      if (typeof dateStr !== "string") {
+        return null;
+      }
+      try {
+        const date5 = new Date(dateStr);
+        return isNaN(date5.getTime()) ? null : date5;
+      } catch {
+        return null;
+      }
+    },
+    /**
+     * Format date according to specified format
+     * @param date Date object or string
+     * @param format Format string (simple patterns)
+     * @returns Formatted date string
+     */
+    formatDate(date5, format) {
+      const defaultFormat = format || "YYYY-MM-DD";
+      let dateObj;
+      if (typeof date5 === "string") {
+        dateObj = new Date(date5);
+      } else if (date5 instanceof Date) {
+        dateObj = date5;
+      } else {
+        return "";
+      }
+      if (isNaN(dateObj.getTime())) {
+        return "";
+      }
+      const year = dateObj.getFullYear();
+      const month = String(dateObj.getMonth() + 1).padStart(2, "0");
+      const day = String(dateObj.getDate()).padStart(2, "0");
+      const hours = String(dateObj.getHours()).padStart(2, "0");
+      const minutes = String(dateObj.getMinutes()).padStart(2, "0");
+      const seconds = String(dateObj.getSeconds()).padStart(2, "0");
+      return defaultFormat.replace(/YYYY/g, String(year)).replace(/MM/g, month).replace(/DD/g, day).replace(/HH/g, hours).replace(/mm/g, minutes).replace(/ss/g, seconds);
+    },
+    /**
+     * Add days to a date
+     * @param date Date object or string
+     * @param days Number of days to add (can be negative)
+     * @returns New Date object
+     */
+    addDays(date5, days) {
+      let dateObj;
+      if (typeof date5 === "string") {
+        dateObj = new Date(date5);
+      } else if (date5 instanceof Date) {
+        dateObj = new Date(date5.getTime());
+      } else {
+        return null;
+      }
+      if (isNaN(dateObj.getTime()) || typeof days !== "number") {
+        return null;
+      }
+      dateObj.setDate(dateObj.getDate() + days);
+      return dateObj;
+    },
+    /**
+     * Validate email address format
+     * @param email Email address to validate
+     * @returns True if valid email format
+     */
+    isValidEmail(email3) {
+      if (typeof email3 !== "string") {
+        return false;
+      }
+      const emailRegex = /^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\.[a-zA-Z]{2,}$/;
+      return emailRegex.test(email3);
+    },
+    /**
+     * Validate URL format
+     * @param url URL to validate
+     * @returns True if valid URL format
+     */
+    isValidURL(url2) {
+      if (typeof url2 !== "string") {
+        return false;
+      }
+      try {
+        new URL(url2);
+        return true;
+      } catch {
+        return false;
+      }
+    },
+    /**
+     * Validate JSON string
+     * @param str String to validate as JSON
+     * @returns True if valid JSON
+     */
+    isValidJSON(str) {
+      if (typeof str !== "string") {
+        return false;
+      }
+      try {
+        JSON.parse(str);
+        return true;
+      } catch {
+        return false;
+      }
+    },
+    /**
+     * Encode string to base64
+     * @param str String to encode
+     * @returns Base64 encoded string
+     */
+    base64Encode(str) {
+      if (typeof str !== "string") {
+        return "";
+      }
+      try {
+        return btoa(str);
+      } catch {
+        return btoa(unescape(encodeURIComponent(str)));
+      }
+    },
+    /**
+     * Decode base64 string
+     * @param str Base64 string to decode
+     * @returns Decoded string
+     */
+    base64Decode(str) {
+      if (typeof str !== "string") {
+        return "";
+      }
+      try {
+        return atob(str);
+      } catch {
+        try {
+          return decodeURIComponent(escape(atob(str)));
+        } catch {
+          return "";
+        }
+      }
+    },
+    /**
+     * URL encode string
+     * @param str String to encode
+     * @returns URL encoded string
+     */
+    urlEncode(str) {
+      if (typeof str !== "string") {
+        return "";
+      }
+      return encodeURIComponent(str);
+    },
+    /**
+     * URL decode string
+     * @param str URL encoded string to decode
+     * @returns Decoded string
+     */
+    urlDecode(str) {
+      if (typeof str !== "string") {
+        return "";
+      }
+      try {
+        return decodeURIComponent(str);
+      } catch {
+        return str;
+      }
+    },
+    /**
+     * Return the first argument that is neither null nor undefined (a named
+     * first-non-null / nullish coalesce). The script-side counterpart of the
+     * `{{a ?? b}}` template operator — in templates prefer `{{a ?? b}}`; use
+     * `helpers.coalesce(a, b)` inside transform-data scripts.
+     * @param values Candidate values in priority order
+     * @returns The first non-null/undefined value, or null if all are null/undefined
+     */
+    coalesce(...values) {
+      for (const value of values) {
+        if (value !== null && value !== void 0) {
+          return value;
+        }
+      }
+      return null;
+    }
+  };
+}
+
 // ../shared/dist/index.mjs
 var FORMULA_TRIGGER = /^[=+\-@\t\r\n]/;
 var STRICT_NUMBER = /^[+-]?(\d+(\.\d*)?|\.\d+)([eE][+-]?\d+)?$/;
@@ -17573,7 +17921,15 @@ function isBuiltInToolId(toolId) {
 function isPlatformToolId(toolId) {
   return toolId.startsWith("platform:");
 }
-var INTEGRATION_SERVER_IDS = /* @__PURE__ */ new Set(["slack", "google", "linear", "github", "telegram"]);
+var INTEGRATION_SERVER_IDS = /* @__PURE__ */ new Set([
+  "slack",
+  "google",
+  "linear",
+  "github",
+  "telegram",
+  "imessage",
+  "granola"
+]);
 function isBuiltInIntegrationToolId(toolId) {
   if (!toolId.startsWith("builtin:")) return false;
   const { baseId } = parseToolInstanceId(toolId);
@@ -22013,280 +22369,8 @@ function parseCreateFlowValidationInput(payload) {
   };
 }
 var SERIALIZED_HELPERS_SOURCE = `
-// Transform helper functions (from packages/shared/src/transform-helpers.ts)
-const helpers = (function createHelpers() {
-  // Regex-based HTML tag stripper for extracting text content
-  const stripTags = (html) => html.replace(/<[^>]*>/g, ' ').replace(/\\s+/g, ' ').trim()
-
-  return {
-    parseHTML: (html) => {
-      if (typeof html !== 'string') throw new Error('parseHTML: input must be a string')
-      try {
-        // Extract title
-        const titleMatch = html.match(/<title[^>]*>(.*?)<\\/title>/is)
-        const title = titleMatch ? stripTags(titleMatch[1]).trim() || undefined : undefined
-
-        // Extract headings (h1-h6)
-        const headingRegex = /<h[1-6][^>]*>(.*?)<\\/h[1-6]>/gis
-        const headings = []
-        let hMatch
-        while ((hMatch = headingRegex.exec(html)) !== null) {
-          const text = stripTags(hMatch[1]).trim()
-          if (text) headings.push(text)
-        }
-
-        // Extract links
-        const linkRegex = /<a\\s[^>]*href=["']([^"']*)["'][^>]*>(.*?)<\\/a>/gis
-        const links = []
-        let lMatch
-        while ((lMatch = linkRegex.exec(html)) !== null) {
-          const href = lMatch[1]
-          const text = stripTags(lMatch[2]).trim()
-          if (href) links.push({ href, text })
-        }
-
-        // Extract all text content
-        const text = stripTags(html)
-
-        // Simple querySelector (CSS element selectors only)
-        const querySelector = (selector) => {
-          try {
-            const tag = selector.replace(/[^a-zA-Z0-9-]/g, '')
-            const match = html.match(new RegExp('<' + tag + '[^>]*>(.*?)<\\\\/' + tag + '>', 'is'))
-            return match ? stripTags(match[1]).trim() || null : null
-          } catch (error) {
-            return null
-          }
-        }
-
-        // Simple querySelectorAll (CSS element selectors only)
-        const querySelectorAll = (selector) => {
-          try {
-            const tag = selector.replace(/[^a-zA-Z0-9-]/g, '')
-            const regex = new RegExp('<' + tag + '[^>]*>(.*?)<\\\\/' + tag + '>', 'gis')
-            const results = []
-            let m
-            while ((m = regex.exec(html)) !== null) {
-              const t = stripTags(m[1]).trim()
-              if (t) results.push(t)
-            }
-            return results
-          } catch (error) {
-            return []
-          }
-        }
-
-        return { title, headings, links, text, querySelector, querySelectorAll }
-      } catch (error) {
-        throw new Error('parseHTML failed: ' + (error instanceof Error ? error.message : 'Unknown error'))
-      }
-    },
-
-    extractEmails: (text) => {
-      if (typeof text !== 'string') return []
-      const emailRegex = /[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}/g
-      const matches = text.match(emailRegex)
-      return matches ? [...new Set(matches)] : []
-    },
-
-    extractURLs: (text) => {
-      if (typeof text !== 'string') return []
-      const urlRegex = /https?:\\/\\/(www\\.)?[-a-zA-Z0-9@:%._\\+~#=]{1,256}\\.[a-zA-Z0-9()]{1,6}\\b([-a-zA-Z0-9()@:%_\\+.~#?&/=]*)/g
-      const matches = text.match(urlRegex)
-      return matches ? [...new Set(matches)] : []
-    },
-
-    extractPhoneNumbers: (text) => {
-      if (typeof text !== 'string') return []
-      const phoneRegex = /(?:\\+?1[-.\\s]?)?(?:\\([0-9]{3}\\)|[0-9]{3})[-.\\s]?[0-9]{3}[-.\\s]?[0-9]{4}/g
-      const matches = text.match(phoneRegex)
-      return matches ? [...new Set(matches)] : []
-    },
-
-    truncate: (text, length) => {
-      if (typeof text !== 'string' || typeof length !== 'number') return text || ''
-      if (text.length <= length) return text
-      return text.substring(0, length).trim() + '...'
-    },
-
-    slugify: (text) => {
-      if (typeof text !== 'string') return ''
-      return text
-        .toLowerCase()
-        .trim()
-        .replace(/[^\\w\\s-]/g, '')
-        .replace(/[\\s_-]+/g, '-')
-        .replace(/^-+|-+$/g, '')
-    },
-
-    markdown2html: (markdown) => {
-      if (typeof markdown !== 'string') return ''
-      return markdown
-        .replace(/^### (.*$)/gim, '<h3>$1</h3>')
-        .replace(/^## (.*$)/gim, '<h2>$1</h2>')
-        .replace(/^# (.*$)/gim, '<h1>$1</h1>')
-        .replace(/\\*\\*(.*?)\\*\\*/gim, '<strong>$1</strong>')
-        .replace(/__(.*?)__/gim, '<strong>$1</strong>')
-        .replace(/\\*(.*?)\\*/gim, '<em>$1</em>')
-        .replace(/_(.*?)_/gim, '<em>$1</em>')
-        .replace(/\`(.*?)\`/gim, '<code>$1</code>')
-        .replace(/\\[([^\\]]+)\\]\\(([^)]+)\\)/gim, '<a href="$2">$1</a>')
-        .replace(/\\n\\n/gim, '</p><p>')
-        .replace(/\\n/gim, '<br>')
-        .replace(/^(?!<[h|u|o|l])/gim, '<p>')
-        .replace(/$/gim, '</p>')
-        .replace(/<p><\\/p>/gim, '')
-        .replace(/<p>(<h[1-6]>.*<\\/h[1-6]>)<\\/p>/gim, '$1')
-    },
-
-    html2markdown: (html) => {
-      if (typeof html !== 'string') return ''
-      return html
-        .replace(/<h1[^>]*>(.*?)<\\/h1>/gim, '# $1\\n\\n')
-        .replace(/<h2[^>]*>(.*?)<\\/h2>/gim, '## $1\\n\\n')
-        .replace(/<h3[^>]*>(.*?)<\\/h3>/gim, '### $1\\n\\n')
-        .replace(/<h4[^>]*>(.*?)<\\/h4>/gim, '#### $1\\n\\n')
-        .replace(/<h5[^>]*>(.*?)<\\/h5>/gim, '##### $1\\n\\n')
-        .replace(/<h6[^>]*>(.*?)<\\/h6>/gim, '###### $1\\n\\n')
-        .replace(/<strong[^>]*>(.*?)<\\/strong>/gim, '**$1**')
-        .replace(/<b[^>]*>(.*?)<\\/b>/gim, '**$1**')
-        .replace(/<em[^>]*>(.*?)<\\/em>/gim, '*$1*')
-        .replace(/<i[^>]*>(.*?)<\\/i>/gim, '*$1*')
-        .replace(/<code[^>]*>(.*?)<\\/code>/gim, '\`$1\`')
-        .replace(/<a[^>]*href="([^"]*)"[^>]*>(.*?)<\\/a>/gim, '[$2]($1)')
-        .replace(/<br[^>]*>/gim, '\\n')
-        .replace(/<\\/p>/gim, '\\n\\n')
-        .replace(/<p[^>]*>/gim, '')
-        .replace(/<li[^>]*>(.*?)<\\/li>/gim, '- $1\\n')
-        .replace(/<ul[^>]*>/gim, '\\n')
-        .replace(/<\\/ul>/gim, '\\n')
-        .replace(/<ol[^>]*>/gim, '\\n')
-        .replace(/<\\/ol>/gim, '\\n')
-        .replace(/<[^>]+>/gim, '')
-        .replace(/\\n\\s*\\n\\s*\\n/gim, '\\n\\n')
-        .trim()
-    },
-
-    parseDate: (dateStr) => {
-      if (typeof dateStr !== 'string') return null
-      try {
-        const date = new Date(dateStr)
-        return isNaN(date.getTime()) ? null : date
-      } catch {
-        return null
-      }
-    },
-
-    formatDate: (date, format) => {
-      const defaultFormat = format || 'YYYY-MM-DD'
-      let dateObj
-      if (typeof date === 'string') {
-        dateObj = new Date(date)
-      } else if (date instanceof Date) {
-        dateObj = date
-      } else {
-        return ''
-      }
-      if (isNaN(dateObj.getTime())) return ''
-      const year = dateObj.getFullYear()
-      const month = String(dateObj.getMonth() + 1).padStart(2, '0')
-      const day = String(dateObj.getDate()).padStart(2, '0')
-      const hours = String(dateObj.getHours()).padStart(2, '0')
-      const minutes = String(dateObj.getMinutes()).padStart(2, '0')
-      const seconds = String(dateObj.getSeconds()).padStart(2, '0')
-      return defaultFormat
-        .replace(/YYYY/g, String(year))
-        .replace(/MM/g, month)
-        .replace(/DD/g, day)
-        .replace(/HH/g, hours)
-        .replace(/mm/g, minutes)
-        .replace(/ss/g, seconds)
-    },
-
-    addDays: (date, days) => {
-      let dateObj
-      if (typeof date === 'string') {
-        dateObj = new Date(date)
-      } else if (date instanceof Date) {
-        dateObj = new Date(date.getTime())
-      } else {
-        return null
-      }
-      if (isNaN(dateObj.getTime()) || typeof days !== 'number') return null
-      dateObj.setDate(dateObj.getDate() + days)
-      return dateObj
-    },
-
-    isValidEmail: (email) => {
-      if (typeof email !== 'string') return false
-      const emailRegex = /^[a-zA-Z0-9._%+-]+@[a-zA-Z0-9.-]+\\.[a-zA-Z]{2,}$/
-      return emailRegex.test(email)
-    },
-
-    isValidURL: (url) => {
-      if (typeof url !== 'string') return false
-      try {
-        new URL(url)
-        return true
-      } catch {
-        return false
-      }
-    },
-
-    isValidJSON: (str) => {
-      if (typeof str !== 'string') return false
-      try {
-        JSON.parse(str)
-        return true
-      } catch {
-        return false
-      }
-    },
-
-    base64Encode: (str) => {
-      if (typeof str !== 'string') return ''
-      try {
-        return btoa(str)
-      } catch {
-        return btoa(unescape(encodeURIComponent(str)))
-      }
-    },
-
-    base64Decode: (str) => {
-      if (typeof str !== 'string') return ''
-      try {
-        return atob(str)
-      } catch {
-        try {
-          return decodeURIComponent(escape(atob(str)))
-        } catch {
-          return ''
-        }
-      }
-    },
-
-    urlEncode: (str) => {
-      if (typeof str !== 'string') return ''
-      return encodeURIComponent(str)
-    },
-
-    urlDecode: (str) => {
-      if (typeof str !== 'string') return ''
-      try {
-        return decodeURIComponent(str)
-      } catch {
-        return str
-      }
-    },
-
-    coalesce: (...values) => {
-      for (const value of values) {
-        if (value !== null && value !== undefined) return value
-      }
-      return null
-    },
-  }
-})()
+// Transform helper functions generated from the canonical portable factory.
+const helpers = (${createPortableHelpers.toString()})(${parseHTMLWithRegex.toString()})
 `.trim();
 var AGENT_EXECUTION_STATUSES = [
   "queued",
@@ -22298,6 +22382,8 @@ var AGENT_EXECUTION_STATUSES = [
   "interrupted"
 ];
 var agentExecutionStatusSchema = external_exports.enum(AGENT_EXECUTION_STATUSES);
+var DEFAULT_BEDROCK_REGION = "us-east-1";
+var DEFAULT_VERTEX_LOCATION = "us-central1";
 var PROVIDER_SECRET_SPECS = [
   {
     providerId: "mock",
@@ -22309,13 +22395,15 @@ var PROVIDER_SECRET_SPECS = [
     providerId: "google-vertex-anthropic",
     // Must come before google-vertex (shares vertex prefix) and anthropic (matches */claude-*).
     matches: (m2) => m2.startsWith("vertex-anthropic/"),
-    secretNames: ["GOOGLE_VERTEX_PROJECT", "GOOGLE_VERTEX_LOCATION", "GOOGLE_VERTEX_CREDENTIALS"]
+    secretNames: ["GOOGLE_VERTEX_PROJECT", "GOOGLE_VERTEX_CREDENTIALS"],
+    optionalSettings: [{ name: "GOOGLE_VERTEX_LOCATION", defaultValue: DEFAULT_VERTEX_LOCATION }]
   },
   {
     providerId: "google-vertex",
     // Must come before google (matches */gemini-*).
     matches: (m2) => m2.startsWith("vertex/"),
-    secretNames: ["GOOGLE_VERTEX_PROJECT", "GOOGLE_VERTEX_LOCATION", "GOOGLE_VERTEX_CREDENTIALS"]
+    secretNames: ["GOOGLE_VERTEX_PROJECT", "GOOGLE_VERTEX_CREDENTIALS"],
+    optionalSettings: [{ name: "GOOGLE_VERTEX_LOCATION", defaultValue: DEFAULT_VERTEX_LOCATION }]
   },
   {
     providerId: "vercel-gateway",
@@ -22332,7 +22420,8 @@ var PROVIDER_SECRET_SPECS = [
   {
     providerId: "bedrock",
     matches: (m2) => m2.startsWith("bedrock/"),
-    secretNames: ["AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_REGION"]
+    secretNames: ["AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY"],
+    optionalSettings: [{ name: "AWS_REGION", defaultValue: DEFAULT_BEDROCK_REGION }]
   },
   {
     providerId: "tinfoil",
@@ -22345,15 +22434,6 @@ var PROVIDER_SECRET_SPECS = [
     matches: (m2) => m2.startsWith("generic-openai/") || m2.startsWith("generic-openai:"),
     secretNames: ["GENERIC_OPENAI_API_KEY", "GENERIC_OPENAI_BASE_URL"]
   },
-  {
-    providerId: "general-compute",
-    // General Compute (https://api.generalcompute.com/v1) is an OpenAI-compatible
-    // host. Models are addressed only with the explicit `general-compute/` prefix
-    // (e.g. `general-compute/minimax-m2.7`) so they never collide with the same
-    // bare model id served by another gateway (Vercel already routes `minimax-m2.7`).
-    matches: (m2) => m2.startsWith("general-compute/") || m2.startsWith("general-compute:"),
-    secretNames: ["GENERAL_COMPUTE_API_KEY"]
-  },
   {
     providerId: "workers-ai",
     // Uses a CF platform binding, not a secret — secretNames is intentionally empty.
@@ -22403,6 +22483,13 @@ function resolveModelSecretNames(model) {
   }
   return [];
 }
+function resolveModelOptionalSettings(model) {
+  const lower = model.toLowerCase();
+  for (const spec of PROVIDER_SECRET_SPECS) {
+    if (spec.matches(lower)) return [...spec.optionalSettings ?? []];
+  }
+  return [];
+}
 var RUNTIME_ARTIFACT_MANIFEST_VERSION = "2026-06-08";
 var runtimeArtifactResourceTypeSchema = external_exports.enum(["flow", "agent"]);
 var runtimeArtifactEntrypointSchema = external_exports.enum(["flow", "agent"]);
@@ -22510,6 +22597,77 @@ var runtimeArtifactManifestSchema = external_exports.object({
     reasons: external_exports.array(runtimeArtifactEligibilityReasonSchema)
   })
 });
+var KNOWN_FLOW_STEP_TYPES = new Set(FLOW_STEP_TYPES);
+var API_INPROCESS_CAPABILITY_MATRIX = {
+  target: "api-inprocess",
+  // Bumped 2026-07-30: the IMPLICIT platform-default fallback candidate no
+  // longer folds (see `implicitPlatformFallback` below). Carries forward
+  // 2026-07-29.4: api-hosted runtime fulfills managed fetch methods through
+  // ManagedFetchExecutor (the managed-fetch fact remains for attribution). The
+  // EXPLICIT Layer-2 fallback fold and the remaining parity-audit folds are
+  // unchanged.
+  version: "2026-07-30.1",
+  unsupportedStepTypes: ["wait-until", "crawl"],
+  unsupportedFeatures: {
+    approvalSteps: true,
+    batchInputMode: true,
+    claudeManagedAgent: true,
+    inexpressibleVectorStep: true,
+    unresolvableAgentRef: true,
+    conditionalNestedPromptStep: true,
+    conditionalNestedExecuteAgentStep: true,
+    // SUPPORTED as of 2026-07-23 (slice 6 activation): the runtime flow lane
+    // now PAUSES on definition-embedded client-executed (local / webmcp) tools
+    // — `ClientToolRequiredError` → `step_await` / `flow_await` → durable KV
+    // ResumeState → the runtime continuation leg — instead of failing the call
+    // in-band. The `hasClientExecutedTools` FACT is still computed (for
+    // decision-attribution logs), but it no longer folds the flow to legacy.
+    // Rollback lever after retiring the flow request override: revert this bit
+    // to `true` (the agent lane retains its separate rollout gate).
+    clientExecutedTools: false,
+    advisorTools: true,
+    // G2 SUPPORTED: api-hosted runtime delegates Firecrawl / Massive fetch-url
+    // methods through ManagedFetchExecutor to the same API implementations the
+    // legacy executor uses. Keep the fact computed for attribution, like
+    // clientExecutedTools above.
+    unsupportedFetchMethod: false,
+    // Remaining 2026-07-29 parity-audit BRIDGE folds (G4/G5/G10/G14): feature
+    // classes the runtime flow lane still cannot faithfully run.
+    transformDataCodeModeTools: true,
+    unsupportedTransformExecution: true,
+    promptMcpServers: true,
+    promptArtifacts: true,
+    // EXPLICIT author-configured Layer-2 chains stay unsupported: the runtime
+    // flow engine cannot run them and cannot synthesize their `usedFallback` /
+    // `fallbackModel` / `fallbackExecutions` attribution, so a folded flow would
+    // both change behavior and undercount fallback usage.
+    fallbackErrorHandling: true,
+    // SUPPORTED as of 2026-07-30: the IMPLICIT platform-default chain (the
+    // orchestrator's synthesized same-model-next-provider + cross-model rungs
+    // for a prompt with NO explicit `errorHandling`) does not fold the flow to
+    // legacy. Rationale: a prompt step without `errorHandling` is the DEFAULT
+    // shape of nearly every hosted flow, so folding on it reverted the hosted
+    // flow lane to legacy for the common case — the opposite of runtime-primary.
+    // The runtime lane already carries Layer-1 resilience natively
+    // (`withModelCallResilience`: TTFT + idle watchdog + bounded same-model
+    // retry — packages/runtime prompt-executor.ts), so the residual delta is
+    // narrow: on a retryable platform-key failure that survives Layer 1 with no
+    // partial output, the runtime surfaces the step error where legacy would
+    // additionally swap upstream/model. That is an availability nicety, not a
+    // semantic difference — and unlike the folds above it cannot silently
+    // produce a WRONG result. `hasImplicitPlatformFallbackCandidate` is still
+    // computed for decision attribution. Rollback lever: flip this bit to `true`
+    // (plus its test) to restore the fold.
+    implicitPlatformFallback: false
+  }
+};
+var DURABLE_HOSTED_STEP_TYPES = /* @__PURE__ */ new Set(["wait-until", "crawl"]);
+var API_DURABLE_RESUME_CAPABILITY_MATRIX = {
+  ...API_INPROCESS_CAPABILITY_MATRIX,
+  unsupportedStepTypes: API_INPROCESS_CAPABILITY_MATRIX.unsupportedStepTypes.filter(
+    (stepType) => !DURABLE_HOSTED_STEP_TYPES.has(stepType)
+  )
+};
 var edgeAuthSnapshotSchema = external_exports.object({
   /**
    * Schema version. A plain positive int (not a literal) so a consumer pinned
@@ -39931,7 +40089,6 @@ var MODEL_FAMILY_PROVIDER_IDS = {
     "vercel": "xiaomi/mimo-v2.5-pro"
   },
   "minimax-m2-7": {
-    "general-compute": "general-compute/minimax-m2.7",
     "togetherai": "togetherai/MiniMaxAI/MiniMax-M2.7",
     "vercel": "minimax/minimax-m2.7"
   },
@@ -39939,7 +40096,6 @@ var MODEL_FAMILY_PROVIDER_IDS = {
     "vercel": "minimax/minimax-m2.7-highspeed"
   },
   "minimax-m2.7": {
-    "general-compute": "general-compute/minimax-m2.7",
     "vercel": "minimax/minimax-m2.7"
   },
   "minimax-m2.7-highspeed": {
@@ -40315,7 +40471,6 @@ var PLATFORM_KEY_PROVIDER_MAP = {
   "vertex-anthropic": false,
   "tinfoil": false,
   "generic-openai": false,
-  "general-compute": true,
   // Keyless platform provider: there is no API key (user or platform) — the
   // Cloudflare `AI` binding IS the platform credential. Marking it true makes
   // the router's platform-spend gate apply and keeps keySource attribution
@@ -40389,13 +40544,8 @@ var MANUAL_PROVIDER_MAP_OVERRIDES = {
     "mixlayer": "z-ai/glm-5.2",
     "vercel": "zai/glm-5.2"
   },
-  // MiniMax M2.7: explicit provider IDs for the GC-primary / Vercel-fallback route.
-  // `general-compute` is NOT in PROVIDERS_WITHOUT_PREFIX, so resolveRoutedFamily
-  // prepends `general-compute/` itself — store the BARE id here to avoid a double
-  // prefix (`general-compute/general-compute/...`). Vercel IS prefixless, so its
-  // value is the gateway-form `minimax/minimax-m2.7` used as-is.
+  // MiniMax M2.7: Vercel's gateway-form id.
   "minimax-m2.7": {
-    "general-compute": "minimax-m2.7",
     "vercel": "minimax/minimax-m2.7"
   }
 };
@@ -41313,7 +41463,55 @@ var sandboxConfigSchema = external_exports.object({
   instanceType: external_exports.enum(["standard-1", "standard-2", "standard-3", "standard-4"]).optional(),
   networkAccess: sandboxNetworkAccessSchema.optional(),
   ttl: external_exports.enum(["5m", "1h", "24h", "unlimited"]).optional(),
-  sleepAfter: external_exports.enum(["5m", "15m", "30m", "1h"]).optional()
+  sleepAfter: external_exports.enum(["5m", "15m", "30m", "1h"]).optional(),
+  // Operator-authored bootstrap commands. The API runs this batch once after
+  // enforcing the sandbox's network policy and before the first model-authored
+  // sandbox verb. Commands run in order from /workspace and must be foreground,
+  // self-contained, and safe to retry after an interrupted container runtime;
+  // the credential-bearing exec supervisor deliberately reaps every descendant
+  // before a command returns, so setup cannot launch a daemon meant to outlive
+  // it. Trusted Durable Object state plus a run-scoped memo prevents the batch
+  // from being repeated for the same provisioned workspace. Changing the
+  // commands or managed-secret KEY bindings creates a fresh sandbox identity;
+  // rotating a value under the same key does not rerun setup.
+  setupCommands: external_exports.array(external_exports.string().min(1, "setup commands must not be empty")).optional(),
+  // Credential environment available ONLY to the operator-authored setup batch
+  // above — never to a model-authored `bash` command. Keys are env var names;
+  // values are MANAGED SECRET KEYS (e.g. `GITHUB_CLONE_TOKEN`), never raw
+  // credential values. The API resolves them immediately before setup and
+  // delivers them out-of-band over `cloudflareSandboxExecWithSecretEnv`, so the
+  // values never appear in command strings, model-facing tool schemas, logs, or
+  // spill files. Like `networkAccess`, both fields are operator Definition: the
+  // model cannot author setup, name a managed secret, or grant itself one.
+  //
+  // TRUST BOUNDARY — read before configuring this. Every process started by a
+  // credentialed setup batch can read the injected values. Keep setup authored
+  // and reviewed by the operator; do not run model-, attacker-, or
+  // supply-chain-authored code (for example an install script) while credentials
+  // are present, and never persist a raw credential into /workspace for later
+  // model access. The secret supervisor freezes pre-existing processes, reaps
+  // every setup descendant, and destroys the sandbox fail-closed if cleanup
+  // fails, but output redaction remains defense-in-depth rather than permission
+  // to echo or transform a credential.
+  // Therefore:
+  //   - Prefer `credentialProxies` (phantom tokens, swapped at the egress
+  //     proxy) for any HTTP(S) protocol it supports — the real credential
+  //     never enters the container at all.
+  //   - Scope the secret as narrowly as the provider allows (read-only,
+  //     single-repo) and pair it with a tight `networkAccess` profile.
+  //   - Keep credentialed setup separate from later uncredentialed dependency
+  //     installation and model-authored work.
+  // Name shape and the 32-entry cap mirror the sandbox worker's
+  // `validateSecretEnv`; `RUNTYPE_SECRET_COMMAND` is the worker's reserved
+  // control-channel variable.
+  secretEnv: external_exports.record(
+    external_exports.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/, "must be a valid environment variable name").refine((name) => name !== "RUNTYPE_SECRET_COMMAND", {
+      message: "RUNTYPE_SECRET_COMMAND is reserved"
+    }),
+    external_exports.string().min(1, "must be a managed secret key")
+  ).refine((record2) => Object.keys(record2).length <= 32, {
+    message: "secretEnv supports at most 32 variables"
+  }).optional()
   // NOTE: a `requireApprovalForBash` knob was forward-declared here for Phase 3
   // but never wired to any runtime gate, so it was REMOVED from the public
   // schema rather than ship a misleading, inert control (post-Fable handoff 05,
@@ -41632,7 +41830,7 @@ var identityProofSchema = external_exports.object({
   /** The customer-native proof (JWT / opaque session token). */
   token: external_exports.string().min(1).max(8192)
 }).describe(
-  "Customer-native auth proof for the Identity Exchange. When present and the surface has a matching integration, the verified tenant/end-user replace any body-asserted tenant/endUser (which are never trusted for web-embedded callers). Ignored until the Identity Exchange admission upgrade ships."
+  "Customer-native auth proof for the Identity Exchange. When present and the surface has a matching integration, the verified tenant/end-user replace any body-asserted tenant/endUser (which are never trusted for web-embedded callers). When Identity Exchange admission is disabled for the caller, the proof is accepted but ignored and confers no trust."
 );
 function extractSecretReferences(template) {
   const keys = /* @__PURE__ */ new Set();
@@ -44699,6 +44897,27 @@ Only use a \`tool-call\` step when the tool must run deterministically at a fixe
   - Nullish fallback: \`{{count ?? 0}}\` \u2014 keeps 0 / "" / false (only null/undefined fall through)
   - Chains: \`{{a || b || "default"}}\` \u2014 supports paths and string/number/boolean/null literals; do NOT mix \`||\` and \`??\` in one expression
 
+### Prompt Caching: Where Large Context Goes
+
+Runtype caches the request prefix automatically on Claude models. **The part that gets REUSED across runs is the tools + \`systemPrompt\` prefix.** A second boundary is placed at the end of the last message, but a cache hit there needs the whole request \u2014 \`userPrompt\` included \u2014 to repeat byte-for-byte, which per-request task text does not. (Within one request it still helps: a multi-turn or tool-looping step re-sends the grown prompt each round-trip and reads that boundary warm.) This applies to ordinary single-shot \`prompt\` steps, not just multi-turn agents.
+
+- **Large STABLE context goes in \`systemPrompt\`** \u2014 style guides, voice/tone corpora, exemplars and few-shot examples, JSON schemas, policy documents, canonical reference text. Anything identical from run to run.
+- **Per-request content goes in \`userPrompt\`** \u2014 the task, the user's input, records retrieved for this run, prior-step outputs. A 25,000-token reference corpus pasted into \`userPrompt\` sits behind per-request text, so it is re-billed as uncached input on every single run.
+- **Reuse requires a byte-identical prefix.** Two steps share a cache entry only when their tools AND their \`systemPrompt\` strings match exactly. When a flow calls the same role more than once (draft \u2192 review \u2192 redraft, or the same analysis over N items), give those steps the SAME \`systemPrompt\` and put the per-call difference in \`userPrompt\`. Two near-identical system prompts are two cache entries and zero reuse.
+- **Below the model's minimum, nothing is stamped.** The prefix must exceed the model's minimum cacheable prefix (~1,024 tokens on Sonnet/Opus-class, up to 4,096 on Haiku-class) or the request goes out uncached. Do not contort a short system prompt to chase caching \u2014 this only matters when the stable context is genuinely large or the step runs many times.
+- **Per-run variables in \`systemPrompt\` kill the prefix.** \`{{_now.*}}\`, \`{{_execution.*}}\`, and \`{{_schedule.*}}\` re-render the system prompt on every execution, so it can never produce a cross-run hit; \`validate_flow\` reports this as \`CACHE_VOLATILE_SYSTEM_PROMPT\` (recommendation). Move the changing value into \`userPrompt\` or a later step. Other variables (\`{{_user.id}}\`, step outputs) do not disable caching, but they fork the cache per distinct substituted value \u2014 keep them out of a prefix you intend several steps or runs to share.
+
+\`\`\`json
+// BEFORE \u2014 the corpus rides in userPrompt and is re-sent uncached on every run,
+// and the two steps have different system prompts, so neither shares a prefix
+{ "type": "prompt", "name": "Draft", "config": { "model": "claude-opus-5", "systemPrompt": "You are a copywriter.", "userPrompt": "STYLE GUIDE: <25,000 tokens of client style corpus> --- Write a launch email about {{topic}}.", "outputVariable": "draft" } }
+{ "type": "prompt", "name": "Revise", "config": { "model": "claude-opus-5", "systemPrompt": "You revise copy.", "userPrompt": "STYLE GUIDE: <the same 25,000 tokens again> --- Revise this draft: {{draft}}", "outputVariable": "final" } }
+
+// AFTER \u2014 one byte-identical prefix; the second step and every later run read it warm
+{ "type": "prompt", "name": "Draft", "config": { "model": "claude-opus-5", "systemPrompt": "You write and revise copy for this client. STYLE GUIDE: <25,000 tokens of client style corpus>", "userPrompt": "Write a launch email about {{topic}}.", "outputVariable": "draft" } }
+{ "type": "prompt", "name": "Revise", "config": { "model": "claude-opus-5", "systemPrompt": "You write and revise copy for this client. STYLE GUIDE: <25,000 tokens of client style corpus>", "userPrompt": "Revise this draft: {{draft}}", "outputVariable": "final" } }
+\`\`\`
+
 ### Model Selection
 
 Use ONLY routed model IDs from the list below (platform-key compatible). Never
@@ -45647,7 +45866,7 @@ var InlineClientToolSchema = external_exports.object({
 var ClientToolsPolicySchema = external_exports.object({
   allowlist: external_exports.array(external_exports.string()).optional()
 });
-var DispatchRequestSchema = external_exports.object({
+var DispatchRequestEnvelopeSchema = external_exports.object({
   record: RecordInputSchema.optional(),
   flow: FlowInputSchema.optional(),
   agent: AgentInputSchema.optional(),
@@ -45684,7 +45903,9 @@ var DispatchRequestSchema = external_exports.object({
    * every submitted webmcp tool. See {@link ClientToolsPolicySchema}.
    */
   clientToolsPolicy: ClientToolsPolicySchema.optional(),
-  secrets: external_exports.record(external_exports.string(), external_exports.string()).optional(),
+  secrets: external_exports.record(external_exports.string(), external_exports.string()).optional().describe(
+    "Per-request credentials for agent/external-tool execution. Ignored when `flow` is the hosted target; FLOW credentials must use managed {{secret:NAME}} references."
+  ),
   credentialProxies: external_exports.array(credentialProxyConfigSchema).max(10).optional(),
   inputs: external_exports.record(external_exports.string(), external_exports.any()).optional().refine(
     (data) => {
@@ -45710,10 +45931,11 @@ var DispatchRequestSchema = external_exports.object({
     id: external_exports.string().min(1)
   }).passthrough().optional(),
   // Identity Exchange proof (design §4.1): a customer-native auth token the
-  // broker will verify server-side and admit as `verified` tenant/end-user.
-  // Wire contract only for now — parsed here, consumed by NOTHING until the
-  // admission slice wires verification into the tenancy seam. The token is a
-  // live credential: never log or persist it (see identityProofSchema docs).
+  // broker verifies server-side and admits as `verified` tenant/end-user when
+  // Identity Exchange admission is enabled for the caller. With the rollout
+  // gate disabled it remains accepted-but-ignored and confers no trust. The
+  // token is a live credential: never log or persist it (see
+  // identityProofSchema docs).
   identityProof: identityProofSchema.optional(),
   options: external_exports.object({
     streamResponse: external_exports.boolean().optional().default(true),
@@ -45725,7 +45947,7 @@ var DispatchRequestSchema = external_exports.object({
     debugMode: external_exports.boolean().optional().default(false),
     loggingPolicy: external_exports.enum(["default", "on", "off"]).optional(),
     useRuntimePackage: external_exports.boolean().optional().describe(
-      "Selects the execution engine for a streaming FLOW dispatch (two controls, A4-3). `true` forces the @runtypelabs/runtime lane (subject only to eligibility \u2014 an ineligible flow still folds to legacy silently); `false` forces the legacy engine. When omitted, the `use-runtime-package-flows` rollout flag sets the default engine for this caller. An explicit value always wins over the flag. Left undefined on purpose \u2014 do NOT default it, or the flag-as-default case becomes unreachable."
+      "For FLOW dispatches this compatibility field is accepted but ignored: eligible flows always use the @runtypelabs/runtime lane, while ineligible flows still fold to legacy silently. Agent dispatches still require an explicit `true` and remain subject to their separate runtime-agent rollout gate."
     ),
     /** Route prompt model calls through an attached dashboard browser. */
     localInference: LocalInferenceSelectionSchema.optional(),
@@ -45792,20 +46014,23 @@ var DispatchRequestSchema = external_exports.object({
     storeResults: true,
     autoAppendMetadata: false,
     debugMode: false,
-    // useRuntimePackage intentionally omitted — absent = silent request, so
-    // the `use-runtime-package-flows` flag decides the default engine (A4-3).
+    // useRuntimePackage intentionally omitted. Flow dispatch ignores the
+    // compatibility field; agent dispatch still requires explicit true.
     environment: "development",
     createVersion: false
   })
-}).refine((data) => data.flow || data.agent, {
-  message: "Either 'flow' or 'agent' configuration must be provided"
-}).superRefine((data, ctx) => {
+});
+var DispatchRequestSchema = external_exports.union([
+  DispatchRequestEnvelopeSchema.extend({ flow: FlowInputSchema }),
+  DispatchRequestEnvelopeSchema.extend({ agent: AgentInputSchema })
+]).superRefine((data, ctx) => {
   if (!data.options.localInference) return;
-  if (!data.options.useRuntimePackage) {
+  const runtimeLaneDisabled = data.agent != null && data.options.useRuntimePackage !== true;
+  if (runtimeLaneDisabled) {
     ctx.addIssue({
       code: "custom",
       path: ["options", "useRuntimePackage"],
-      message: "Local inference requires useRuntimePackage to be enabled"
+      message: data.agent != null ? "Local agent inference requires useRuntimePackage to be enabled" : "Local flow inference cannot use the legacy engine"
     });
   }
   if (data.options.modelOverride) {
@@ -53141,7 +53366,9 @@ import React14 from "react";
 import { render as render14 } from "ink";
 import { useState as useState15, useEffect as useEffect16 } from "react";
 import { readFileSync as readFileSync5 } from "fs";
-import { processStream as processStream3 } from "@runtypelabs/sdk";
+import {
+  processStream as processStream3
+} from "@runtypelabs/sdk";
 var dispatchCommand = new Command15("dispatch").description("Execute a flow or agent via the dispatch API").option("-f, --flow <id>", "Flow ID to execute").option("-a, --agent <id>", "Agent ID to execute").option("-r, --record <id>", "Existing record ID").option("--record-json <file>", "JSON file with record data").option("-m, --message <text>", "Message to send").option("-v, --variable <key=value>", "Set a variable (repeatable)", collectVariables, []).option("--stream", "Stream the response (default)", true).option("--no-stream", "Wait for complete response").option("--json", "Output as JSON").option("--debug", "Show step-level details").option("--tty", "Force TTY mode").option("--no-tty", "Force non-TTY mode").action(async (options) => {
   if (!options.flow && !options.agent) {
     console.error(chalk17.red("Error: Either --flow or --agent is required"));
@@ -53150,44 +53377,50 @@ var dispatchCommand = new Command15("dispatch").description("Execute a flow or a
   const apiKey = await ensureAuth();
   if (!apiKey) return;
   const client = createCliClient(apiKey);
-  const payload = {};
-  if (options.flow) {
-    payload.flow = { id: options.flow };
+  let payload;
+  try {
+    payload = buildDispatchRequest(options);
+  } catch (error51) {
+    const message = error51 instanceof Error ? error51.message : "Unknown error";
+    console.error(chalk17.red(`Failed to read record JSON: ${message}`));
+    process.exit(1);
+  }
+  if (options.stream) {
+    await handleStreaming(client, payload, options);
+  } else {
+    await handleNonStreaming(client, payload, options);
   }
+});
+function collectVariables(value, previous) {
+  return previous.concat([value]);
+}
+function buildDispatchRequest(options) {
+  if (!options.flow && !options.agent) {
+    throw new Error("Either --flow or --agent is required");
+  }
+  const payload = options.flow ? { flow: { id: options.flow } } : { agent: { agentId: options.agent } };
   if (options.agent) {
-    payload.agent = { id: options.agent };
+    payload.agent = { agentId: options.agent };
   }
   if (options.record) {
     payload.record = { id: options.record };
   } else if (options.recordJson) {
-    try {
-      const data = JSON.parse(readFileSync5(options.recordJson, "utf-8"));
-      payload.record = { metadata: data };
-    } catch (error51) {
-      const message = error51 instanceof Error ? error51.message : "Unknown error";
-      console.error(chalk17.red(`Failed to read record JSON: ${message}`));
-      process.exit(1);
-    }
+    const data = JSON.parse(readFileSync5(options.recordJson, "utf-8"));
+    payload.record = { metadata: data };
   }
   if (options.message) {
     payload.messages = [{ role: "user", content: options.message }];
   }
   if (options.variable && options.variable.length > 0) {
-    const variables = {};
-    for (const v2 of options.variable) {
-      const [key, ...rest] = v2.split("=");
-      variables[key] = rest.join("=");
+    const inputs = {};
+    for (const variable of options.variable) {
+      const [key, ...rest] = variable.split("=");
+      inputs[key] = rest.join("=");
     }
-    payload.variables = variables;
+    payload.inputs = inputs;
   }
-  if (options.stream) {
-    await handleStreaming(client, payload, options);
-  } else {
-    await handleNonStreaming(client, payload, options);
-  }
-});
-function collectVariables(value, previous) {
-  return previous.concat([value]);
+  payload.options = { streamResponse: options.stream };
+  return payload;
 }
 async function handleStreaming(client, payload, options) {
   console.log(chalk17.gray("Starting execution..."));
@@ -53241,7 +53474,6 @@ Error: ${err.message}`));
 async function handleNonStreaming(client, payload, options) {
   if (!isTTY(options)) {
     try {
-      payload.streamResponse = false;
       const result = await client.post("/dispatch", payload);
       if (options.json) {
         printJson(result);
@@ -53276,7 +53508,6 @@ async function handleNonStreaming(client, payload, options) {
     useEffect16(() => {
       const run2 = async () => {
         try {
-          payload.streamResponse = false;
           const result = await client.post("/dispatch", payload);
           setLoading(false);
           setSuccess(true);
@@ -68487,8 +68718,8 @@ import { execFileSync } from "child_process";
 // src/lib/persona-init.ts
 init_credential_store();
 
-// ../../node_modules/.pnpm/@runtypelabs+persona@4.13.0/node_modules/@runtypelabs/persona/dist/codegen.js
-var w = "4.13.0";
+// ../../node_modules/.pnpm/@runtypelabs+persona@4.14.0/node_modules/@runtypelabs/persona/dist/codegen.js
+var w = "4.14.0";
 var S = w;
 function b(e) {
   return e?.cdnBase?.trim().replace(/\/+$/, "").replace(/[\\'"<>`]/g, (r) => `%${r.charCodeAt(0).toString(16).toUpperCase().padStart(2, "0")}`) || `https://cdn.jsdelivr.net/npm/@runtypelabs/persona@${S}/dist`;
@@ -71871,7 +72102,20 @@ echo "  npm run build            \u2014 compile TypeScript"
 echo "  gcloud run deploy --source . --region us-central1 --allow-unauthenticated --port 8080"
 `;
 }
-function readme(agentNames, secretNames) {
+function formatOptionalProviderSettings(settings) {
+  return settings.map((setting) => `- \`${setting.name}\` (default: \`${setting.defaultValue}\`)`).join("\n");
+}
+function optionalProviderSettingsSection(settings) {
+  if (settings.length === 0) return "";
+  return `
+## Optional provider settings
+
+These environment variables override runtime defaults and are not required:
+
+${formatOptionalProviderSettings(settings)}
+`;
+}
+function readme(agentNames, secretNames, optionalSettings) {
   const agentList = agentNames.map((n) => `  - ${n}`).join("\n");
   const secretList = secretNames.length > 0 ? secretNames.map((s) => `  gcloud secrets create ${s} --data-file=-`).join("\n") : "  (none detected)";
   return `# Runtype Deployment
@@ -71908,6 +72152,8 @@ Set these before deploying to Cloud Run:
 
 ${secretList}
 
+${optionalProviderSettingsSection(optionalSettings)}
+
 ## Deploy to Cloud Run
 
 \`\`\`bash
@@ -72205,7 +72451,7 @@ echo "  wrangler dev             \u2014 preview locally"
 echo "  wrangler deploy          \u2014 deploy to Cloudflare Workers"
 `;
 }
-function workerReadme(agentNames, secretNames) {
+function workerReadme(agentNames, secretNames, optionalSettings) {
   const agentList = agentNames.map((n) => `  - ${n}`).join("\n");
   const secretList = secretNames.length > 0 ? secretNames.map((s) => `  wrangler secret put ${s}`).join("\n") : "  (none detected)";
   return `# Runtype Cloudflare Workers Deployment
@@ -72228,6 +72474,8 @@ Set each API key your agents use:
 ${secretList}
 \`\`\`
 
+${optionalProviderSettingsSection(optionalSettings)}
+
 ## Run locally
 
 \`\`\`bash
@@ -72482,7 +72730,7 @@ echo "  vercel dev              \u2014 preview locally"
 echo "  vercel deploy           \u2014 deploy to Vercel Functions"
 `;
 }
-function vercelReadme(agentNames, secretNames) {
+function vercelReadme(agentNames, secretNames, optionalSettings) {
   const agentList = agentNames.map((n) => `  - ${n}`).join("\n");
   const secretList = secretNames.length > 0 ? secretNames.map((s) => `  vercel env add ${s}`).join("\n") : "  (none detected)";
   return `# Runtype Vercel Functions Deployment
@@ -72505,6 +72753,8 @@ Set each API key your agents use via the Vercel dashboard or CLI:
 ${secretList}
 \`\`\`
 
+${optionalProviderSettingsSection(optionalSettings)}
+
 ## Run locally
 
 \`\`\`bash
@@ -72530,24 +72780,113 @@ curl https://<your-project>.vercel.app/agent/<name> \\
 \`\`\`
 `;
 }
-function collectSecretNames(agentDef) {
-  const names = /* @__PURE__ */ new Set();
-  const model = agentDef.config?.model?.toLowerCase();
-  if (model) {
-    for (const s of resolveModelSecretNames(model)) names.add(s);
+function collectExportedExecutionInventory(definition) {
+  const models = /* @__PURE__ */ new Set();
+  const namedSecrets = /* @__PURE__ */ new Set();
+  const visited = /* @__PURE__ */ new WeakSet();
+  const isObject2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+  const addModel = (value) => {
+    if (typeof value === "string" && value) models.add(value);
+  };
+  const walkMcpServers = (servers) => {
+    if (!Array.isArray(servers)) return;
+    for (const server of servers) {
+      if (!isObject2(server) || !isObject2(server.auth)) continue;
+      for (const key of ["tokenSecretName", "usernameSecretName", "passwordSecretName"]) {
+        const value = server.auth[key];
+        if (typeof value === "string" && value) namedSecrets.add(value);
+      }
+    }
+  };
+  function walkRuntimeTools(runtimeTools) {
+    if (!Array.isArray(runtimeTools)) return;
+    for (const tool of runtimeTools) {
+      if (!isObject2(tool) || !isObject2(tool.config)) continue;
+      if (isObject2(tool.config.flow)) walkFlow(tool.config.flow);
+      if (isObject2(tool.config.agent)) walkAgent(tool.config.agent);
+      if (isObject2(tool.config.skill)) walkRuntimeTools(tool.config.skill.resolvedTools);
+    }
   }
-  const toolsCfg = agentDef.config?.tools;
-  const mcpServers = toolsCfg?.mcpServers;
-  if (mcpServers) {
-    for (const srv of mcpServers) {
-      const auth = srv.auth;
-      if (auth?.tokenSecretName) names.add(String(auth.tokenSecretName));
-      if (auth?.usernameSecretName) names.add(String(auth.usernameSecretName));
-      if (auth?.passwordSecretName) names.add(String(auth.passwordSecretName));
+  function walkTools(tools) {
+    if (!isObject2(tools)) return;
+    walkMcpServers(tools.mcpServers);
+    walkRuntimeTools(tools.runtimeTools);
+  }
+  function walkFallbackModels(config3) {
+    if (!isObject2(config3.errorHandling) || !Array.isArray(config3.errorHandling.fallbacks)) return;
+    for (const fallback of config3.errorHandling.fallbacks) {
+      if (isObject2(fallback) && fallback.type === "model") addModel(fallback.model);
+    }
+  }
+  function walkSteps(steps) {
+    if (!Array.isArray(steps)) return;
+    for (const step of steps) {
+      if (!isObject2(step) || !isObject2(step.config)) continue;
+      if (step.type === "prompt") addModel(step.config.model);
+      walkFallbackModels(step.config);
+      walkTools(step.config.tools);
+      if (step.type !== "conditional") continue;
+      for (const key of ["trueSteps", "falseSteps", "otherwiseSteps"]) walkSteps(step.config[key]);
+      if (Array.isArray(step.config.branches)) {
+        for (const branch of step.config.branches) {
+          if (isObject2(branch)) walkSteps(branch.steps);
+        }
+      }
     }
   }
-  for (const s of extractSecretReferencesFromAnyValue(agentDef)) names.add(s);
-  return Array.from(names);
+  function walkFlow(flow) {
+    if (visited.has(flow)) return;
+    visited.add(flow);
+    walkSteps(flow.steps);
+    if (isObject2(flow.agents)) {
+      for (const agent of Object.values(flow.agents)) {
+        if (isObject2(agent)) walkAgent(agent);
+      }
+    }
+  }
+  function walkAgent(agent) {
+    if (visited.has(agent)) return;
+    visited.add(agent);
+    if (isObject2(agent.config)) {
+      addModel(agent.config.model);
+      walkTools(agent.config.tools);
+    }
+    if (isObject2(agent.claudeManagedConfig)) addModel(agent.claudeManagedConfig.model);
+    if (isObject2(agent.primaryFlow)) walkFlow(agent.primaryFlow);
+    if (Array.isArray(agent.capabilities)) {
+      for (const capability of agent.capabilities) {
+        if (!isObject2(capability)) continue;
+        if (isObject2(capability.flow)) walkFlow(capability.flow);
+        if (isObject2(capability.subAgent)) walkAgent(capability.subAgent);
+      }
+    }
+  }
+  if (isObject2(definition)) {
+    if (Array.isArray(definition.steps) && !isObject2(definition.config)) walkFlow(definition);
+    else walkAgent(definition);
+  }
+  return {
+    models: Array.from(models),
+    namedSecrets: Array.from(namedSecrets)
+  };
+}
+function collectDeploymentSecretInventory(agentDef) {
+  const requiredNames = /* @__PURE__ */ new Set();
+  const optionalSettings = /* @__PURE__ */ new Map();
+  const executionInventory = collectExportedExecutionInventory(agentDef);
+  for (const model of executionInventory.models) {
+    for (const name of resolveModelSecretNames(model)) requiredNames.add(name);
+    for (const setting of resolveModelOptionalSettings(model)) {
+      optionalSettings.set(setting.name, setting);
+    }
+  }
+  for (const name of executionInventory.namedSecrets) requiredNames.add(name);
+  for (const name of extractSecretReferencesFromAnyValue(agentDef, 512)) requiredNames.add(name);
+  for (const name of requiredNames) optionalSettings.delete(name);
+  return {
+    requiredNames: Array.from(requiredNames),
+    optionalSettings: Array.from(optionalSettings.values())
+  };
 }
 function slugify2(s) {
   return s.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 63);
@@ -72656,10 +72995,17 @@ Scaffolding ${target} deployment to ${outDir}
       monorepoRoot = parent;
     }
     const allSecrets = /* @__PURE__ */ new Set();
+    const allOptionalSettings = /* @__PURE__ */ new Map();
     for (const { def } of agentDefs) {
-      for (const s of collectSecretNames(def)) allSecrets.add(s);
+      const inventory = collectDeploymentSecretInventory(def);
+      for (const name of inventory.requiredNames) allSecrets.add(name);
+      for (const setting of inventory.optionalSettings) {
+        allOptionalSettings.set(setting.name, setting);
+      }
     }
+    for (const name of allSecrets) allOptionalSettings.delete(name);
     const secretNames = Array.from(allSecrets);
+    const optionalSettings = Array.from(allOptionalSettings.values());
     if (target === "cloudflare") {
       fs16.mkdirSync(path17.join(outDir, "src"), { recursive: true });
       fs16.writeFileSync(path17.join(outDir, "src", "index.ts"), workerIndexTs(agentSlugs));
@@ -72669,7 +73015,10 @@ Scaffolding ${target} deployment to ${outDir}
       const setupPath = path17.join(outDir, "setup.sh");
       fs16.writeFileSync(setupPath, workerSetupSh(monorepoRoot));
       fs16.chmodSync(setupPath, 493);
-      fs16.writeFileSync(path17.join(outDir, "README.md"), workerReadme(agentNames, secretNames));
+      fs16.writeFileSync(
+        path17.join(outDir, "README.md"),
+        workerReadme(agentNames, secretNames, optionalSettings)
+      );
     } else if (target === "vercel") {
       fs16.mkdirSync(path17.join(outDir, "api"), { recursive: true });
       fs16.writeFileSync(path17.join(outDir, "api", "[[...route]].ts"), vercelRouteTs(agentSlugs));
@@ -72679,7 +73028,10 @@ Scaffolding ${target} deployment to ${outDir}
       const setupPath = path17.join(outDir, "setup.sh");
       fs16.writeFileSync(setupPath, vercelSetupSh(monorepoRoot));
       fs16.chmodSync(setupPath, 493);
-      fs16.writeFileSync(path17.join(outDir, "README.md"), vercelReadme(agentNames, secretNames));
+      fs16.writeFileSync(
+        path17.join(outDir, "README.md"),
+        vercelReadme(agentNames, secretNames, optionalSettings)
+      );
     } else {
       fs16.writeFileSync(path17.join(outDir, "server.ts"), serverTs());
       fs16.writeFileSync(path17.join(outDir, "Dockerfile"), dockerfile());
@@ -72689,7 +73041,10 @@ Scaffolding ${target} deployment to ${outDir}
       const setupPath = path17.join(outDir, "setup.sh");
       fs16.writeFileSync(setupPath, setupSh(monorepoRoot));
       fs16.chmodSync(setupPath, 493);
-      fs16.writeFileSync(path17.join(outDir, "README.md"), readme(agentNames, secretNames));
+      fs16.writeFileSync(
+        path17.join(outDir, "README.md"),
+        readme(agentNames, secretNames, optionalSettings)
+      );
     }
     console.log("");
     console.log(chalk38.green(`\u2713 Scaffold written to ${outDir}`));
@@ -72697,6 +73052,15 @@ Scaffolding ${target} deployment to ${outDir}
     console.log(chalk38.bold("Next steps:"));
     console.log(`  cd ${options.output}`);
     console.log("  chmod +x setup.sh && ./setup.sh   # pack runtime + install deps");
+    if (optionalSettings.length > 0) {
+      console.log("");
+      console.log(chalk38.yellow("Optional provider settings (defaults used when unset):"));
+      for (const setting of optionalSettings) {
+        console.log(
+          `  ${chalk38.cyan(setting.name)} (default: ${chalk38.cyan(setting.defaultValue)})`
+        );
+      }
+    }
     if (target === "cloudflare") {
       console.log("  wrangler dev                       # test locally");
       console.log("");