@runtypelabs/cli 2.32.2 → 2.32.3

package/dist/index.js

@@ -619,6 +619,141 @@ import { RuntypeApiError } from "@runtypelabs/sdk";
 // src/lib/sdk-client.ts
 import { createClient } from "@runtypelabs/sdk";
 
+// ../shared/dist/chunk-R7RM64AL.mjs
+var DEFAULT_MODELS_FOR_NEW_ACCOUNTS = [
+  // Mixlayer models
+  {
+    provider: "runtype",
+    modelId: "qwen/qwen3.6-27b",
+    isDefault: false,
+    strengths: "Fast, low-cost open-weight workhorse with reasoning, tool-use, and vision \u2014 good for high-volume extraction, classification, and simple transforms.",
+    bestFor: ["fast-cheap", "vision"]
+  },
+  // Routed models - benefit from automatic provider optimization
+  // OpenAI models (routed via OpenAI direct, with Vercel fallback)
+  {
+    provider: "runtype",
+    modelId: "gpt-5.5",
+    isDefault: false,
+    strengths: "Top-tier general reasoning and tool-use with excellent structured-output reliability, vision, and a 1M context \u2014 a strong pick for complex, correctness-sensitive steps.",
+    bestFor: ["default", "deep-reasoning", "agentic-tools", "vision", "long-context"]
+  },
+  {
+    provider: "runtype",
+    modelId: "gpt-5.4-mini",
+    isDefault: false,
+    strengths: "Fast and affordable with dependable JSON formatting \u2014 a good fit for mid-complexity task steps.",
+    bestFor: ["fast-cheap", "default"]
+  },
+  {
+    provider: "runtype",
+    modelId: "gpt-5.4-nano",
+    isDefault: false,
+    strengths: "Cheapest and fastest GPT-5 tier \u2014 reserve for trivial deterministic transforms, routing, and classification, not complex authoring.",
+    bestFor: ["fast-cheap"]
+  },
+  // Anthropic models (routed via Anthropic direct, with Vertex/Bedrock fallback)
+  {
+    provider: "runtype",
+    modelId: "claude-haiku-4-5",
+    isDefault: false,
+    strengths: "Fast and inexpensive while retaining real reasoning, tool-use, and vision \u2014 great for high-volume task steps that still need some judgment.",
+    bestFor: ["fast-cheap", "agentic-tools", "vision"]
+  },
+  {
+    provider: "runtype",
+    modelId: "claude-sonnet-5",
+    isDefault: false,
+    strengths: "Balanced all-rounder: strong reasoning, very reliable multi-round tool loops, vision, and a 1M context \u2014 an excellent choice for agentic and structured work.",
+    bestFor: ["default", "agentic-tools", "vision", "long-context"]
+  },
+  {
+    provider: "runtype",
+    modelId: "claude-opus-4-8",
+    isDefault: false,
+    strengths: "Deepest reasoning and planning for hard analysis and multi-constraint synthesis, with vision and a 1M context \u2014 premium-priced, so reserve for genuinely difficult steps.",
+    bestFor: ["deep-reasoning", "vision", "long-context"]
+  },
+  // Google models (routed via Google direct, with Vertex/Vercel fallback)
+  {
+    provider: "runtype",
+    modelId: "gemini-3-1-flash-lite",
+    isDefault: false,
+    strengths: "Very fast and very cheap with full multimodal input (vision and audio), good structured output, and a 1M context \u2014 ideal for high-volume, simple steps.",
+    bestFor: ["fast-cheap", "vision", "long-context"]
+  },
+  {
+    provider: "runtype",
+    modelId: "gemini-3.6-flash",
+    isDefault: false,
+    strengths: "Fast, low-cost, and natively multimodal with good reasoning, tool-use, and a 1M context \u2014 a strong choice for vision and high-throughput steps.",
+    bestFor: ["default", "vision", "fast-cheap", "agentic-tools", "long-context"]
+  },
+  {
+    provider: "runtype",
+    modelId: "gemini-3-1-flash-image",
+    isDefault: false,
+    strengths: "Specialised for image generation and editing (image output) \u2014 use for steps that produce images, not text reasoning.",
+    bestFor: ["image-generation"]
+  },
+  {
+    provider: "runtype",
+    modelId: "gemini-3.1-pro",
+    isDefault: false,
+    strengths: "Google's frontier tier: strong reasoning, a 1M context, and multimodal input \u2014 for complex analytical or long-document steps.",
+    bestFor: ["deep-reasoning", "vision", "long-context"]
+  },
+  // Inception models (routed via Vercel)
+  {
+    provider: "runtype",
+    modelId: "mercury-2",
+    isDefault: false,
+    strengths: "Diffusion-based LLM optimised for very low latency \u2014 good when speed matters more than deep reasoning.",
+    bestFor: ["fast-cheap"]
+  },
+  // Moonshot models (routed via Vercel)
+  // Kimi K2.6 is the default model: a reasoning + tool-use + vision model
+  // already trusted as the product-generator default.
+  {
+    provider: "runtype",
+    modelId: "kimi-k2.6",
+    isDefault: true,
+    strengths: "Capable open agentic model with reasoning, tool-use, and vision at strong value \u2014 the current account default and a dependable general workhorse.",
+    bestFor: ["default", "agentic-tools", "vision"]
+  },
+  // NVIDIA Nemotron Ultra (reasoning + tool-use flagship, routed via Vercel)
+  {
+    provider: "runtype",
+    modelId: "nemotron-3-ultra-550b-a55b",
+    isDefault: false,
+    strengths: "Large open-weight reasoning and tool-use flagship with a 1M context at a low price \u2014 strong analytical depth where an open model is preferred.",
+    bestFor: ["deep-reasoning", "agentic-tools", "long-context"]
+  },
+  // Google models (routed via Cloudflare Workers AI)
+  {
+    provider: "runtype",
+    modelId: "gemma-4-26b-a4b-it",
+    isDefault: false,
+    strengths: "Lightweight open-weight instruct model served free on Workers AI \u2014 fine for straightforward general tasks at zero cost.",
+    bestFor: ["fast-cheap"]
+  },
+  // Z.ai GLM-5.2 (agentic coding flagship, routed via Cloudflare Workers AI,
+  // Vercel fallback). The bare routed name resolves to `@cf/zai-org/glm-5.2`.
+  {
+    provider: "runtype",
+    modelId: "glm-5.2",
+    isDefault: false,
+    strengths: "Agentic flagship \u2014 best-in-class at long, multi-round tool-call loops and coding/agent workflows, with a 1M context; well suited to tool-heavy agent steps.",
+    bestFor: ["agentic-tools", "default", "deep-reasoning", "long-context"]
+  }
+];
+var DEFAULT_MODEL_ID = DEFAULT_MODELS_FOR_NEW_ACCOUNTS.find((m2) => m2.isDefault)?.modelId ?? "kimi-k2.6";
+function renderDefaultModelStrengthsGuide() {
+  return DEFAULT_MODELS_FOR_NEW_ACCOUNTS.map(
+    (m2) => `- \`${m2.modelId}\`${m2.isDefault ? " (account default)" : ""} \u2014 ${m2.strengths}`
+  ).join("\n");
+}
+
 // ../shared/dist/chunk-72QEJTK5.mjs
 var travrseConfig = {
   name: "Travrse",
@@ -15260,141 +15395,6 @@ var edgeContextPayloadSchema = external_exports.object({
 // ../shared/dist/chunk-SCJRL6LP.mjs
 var MAX_DURABLE_POLL_ATTEMPTS = 1e3;
 
-// ../shared/dist/chunk-R7RM64AL.mjs
-var DEFAULT_MODELS_FOR_NEW_ACCOUNTS = [
-  // Mixlayer models
-  {
-    provider: "runtype",
-    modelId: "qwen/qwen3.6-27b",
-    isDefault: false,
-    strengths: "Fast, low-cost open-weight workhorse with reasoning, tool-use, and vision \u2014 good for high-volume extraction, classification, and simple transforms.",
-    bestFor: ["fast-cheap", "vision"]
-  },
-  // Routed models - benefit from automatic provider optimization
-  // OpenAI models (routed via OpenAI direct, with Vercel fallback)
-  {
-    provider: "runtype",
-    modelId: "gpt-5.5",
-    isDefault: false,
-    strengths: "Top-tier general reasoning and tool-use with excellent structured-output reliability, vision, and a 1M context \u2014 a strong pick for complex, correctness-sensitive steps.",
-    bestFor: ["default", "deep-reasoning", "agentic-tools", "vision", "long-context"]
-  },
-  {
-    provider: "runtype",
-    modelId: "gpt-5.4-mini",
-    isDefault: false,
-    strengths: "Fast and affordable with dependable JSON formatting \u2014 a good fit for mid-complexity task steps.",
-    bestFor: ["fast-cheap", "default"]
-  },
-  {
-    provider: "runtype",
-    modelId: "gpt-5.4-nano",
-    isDefault: false,
-    strengths: "Cheapest and fastest GPT-5 tier \u2014 reserve for trivial deterministic transforms, routing, and classification, not complex authoring.",
-    bestFor: ["fast-cheap"]
-  },
-  // Anthropic models (routed via Anthropic direct, with Vertex/Bedrock fallback)
-  {
-    provider: "runtype",
-    modelId: "claude-haiku-4-5",
-    isDefault: false,
-    strengths: "Fast and inexpensive while retaining real reasoning, tool-use, and vision \u2014 great for high-volume task steps that still need some judgment.",
-    bestFor: ["fast-cheap", "agentic-tools", "vision"]
-  },
-  {
-    provider: "runtype",
-    modelId: "claude-sonnet-5",
-    isDefault: false,
-    strengths: "Balanced all-rounder: strong reasoning, very reliable multi-round tool loops, vision, and a 1M context \u2014 an excellent choice for agentic and structured work.",
-    bestFor: ["default", "agentic-tools", "vision", "long-context"]
-  },
-  {
-    provider: "runtype",
-    modelId: "claude-opus-4-8",
-    isDefault: false,
-    strengths: "Deepest reasoning and planning for hard analysis and multi-constraint synthesis, with vision and a 1M context \u2014 premium-priced, so reserve for genuinely difficult steps.",
-    bestFor: ["deep-reasoning", "vision", "long-context"]
-  },
-  // Google models (routed via Google direct, with Vertex/Vercel fallback)
-  {
-    provider: "runtype",
-    modelId: "gemini-3-1-flash-lite",
-    isDefault: false,
-    strengths: "Very fast and very cheap with full multimodal input (vision and audio), good structured output, and a 1M context \u2014 ideal for high-volume, simple steps.",
-    bestFor: ["fast-cheap", "vision", "long-context"]
-  },
-  {
-    provider: "runtype",
-    modelId: "gemini-3.6-flash",
-    isDefault: false,
-    strengths: "Fast, low-cost, and natively multimodal with good reasoning, tool-use, and a 1M context \u2014 a strong choice for vision and high-throughput steps.",
-    bestFor: ["default", "vision", "fast-cheap", "agentic-tools", "long-context"]
-  },
-  {
-    provider: "runtype",
-    modelId: "gemini-3-1-flash-image",
-    isDefault: false,
-    strengths: "Specialised for image generation and editing (image output) \u2014 use for steps that produce images, not text reasoning.",
-    bestFor: ["image-generation"]
-  },
-  {
-    provider: "runtype",
-    modelId: "gemini-3.1-pro",
-    isDefault: false,
-    strengths: "Google's frontier tier: strong reasoning, a 1M context, and multimodal input \u2014 for complex analytical or long-document steps.",
-    bestFor: ["deep-reasoning", "vision", "long-context"]
-  },
-  // Inception models (routed via Vercel)
-  {
-    provider: "runtype",
-    modelId: "mercury-2",
-    isDefault: false,
-    strengths: "Diffusion-based LLM optimised for very low latency \u2014 good when speed matters more than deep reasoning.",
-    bestFor: ["fast-cheap"]
-  },
-  // Moonshot models (routed via Vercel)
-  // Kimi K2.6 is the default model: a reasoning + tool-use + vision model
-  // already trusted as the product-generator default.
-  {
-    provider: "runtype",
-    modelId: "kimi-k2.6",
-    isDefault: true,
-    strengths: "Capable open agentic model with reasoning, tool-use, and vision at strong value \u2014 the current account default and a dependable general workhorse.",
-    bestFor: ["default", "agentic-tools", "vision"]
-  },
-  // NVIDIA Nemotron Ultra (reasoning + tool-use flagship, routed via Vercel)
-  {
-    provider: "runtype",
-    modelId: "nemotron-3-ultra-550b-a55b",
-    isDefault: false,
-    strengths: "Large open-weight reasoning and tool-use flagship with a 1M context at a low price \u2014 strong analytical depth where an open model is preferred.",
-    bestFor: ["deep-reasoning", "agentic-tools", "long-context"]
-  },
-  // Google models (routed via Cloudflare Workers AI)
-  {
-    provider: "runtype",
-    modelId: "gemma-4-26b-a4b-it",
-    isDefault: false,
-    strengths: "Lightweight open-weight instruct model served free on Workers AI \u2014 fine for straightforward general tasks at zero cost.",
-    bestFor: ["fast-cheap"]
-  },
-  // Z.ai GLM-5.2 (agentic coding flagship, routed via Cloudflare Workers AI,
-  // Vercel fallback). The bare routed name resolves to `@cf/zai-org/glm-5.2`.
-  {
-    provider: "runtype",
-    modelId: "glm-5.2",
-    isDefault: false,
-    strengths: "Agentic flagship \u2014 best-in-class at long, multi-round tool-call loops and coding/agent workflows, with a 1M context; well suited to tool-heavy agent steps.",
-    bestFor: ["agentic-tools", "default", "deep-reasoning", "long-context"]
-  }
-];
-var DEFAULT_MODEL_ID = DEFAULT_MODELS_FOR_NEW_ACCOUNTS.find((m2) => m2.isDefault)?.modelId ?? "kimi-k2.6";
-function renderDefaultModelStrengthsGuide() {
-  return DEFAULT_MODELS_FOR_NEW_ACCOUNTS.map(
-    (m2) => `- \`${m2.modelId}\`${m2.isDefault ? " (account default)" : ""} \u2014 ${m2.strengths}`
-  ).join("\n");
-}
-
 // ../shared/dist/chunk-UB6BK3TZ.mjs
 function getNestedValue(obj, path20) {
   let normalizedPath = path20;
@@ -15786,7 +15786,7 @@ function resolveFallback(parsed, context, tracking, options = {}) {
 }
 var templateEngine = new SimpleTemplateEngine();
 
-// ../shared/dist/chunk-3DRXBLKO.mjs
+// ../shared/dist/chunk-MN4NECP7.mjs
 var tokensSchema = external_exports.object({ input: external_exports.number(), output: external_exports.number() });
 var wireStopReasonSchema = external_exports.enum([
   "end_turn",
@@ -16412,6 +16412,7 @@ var agentToolStartEventSchema = external_exports.object({
     "local"
   ]),
   parameters: external_exports.record(external_exports.string(), external_exports.unknown()).optional(),
+  hiddenParameterNames: external_exports.array(external_exports.string()).optional(),
   origin: external_exports.enum(["webmcp", "sdk"]).optional(),
   pageOrigin: external_exports.string().optional()
 });
@@ -17017,7 +17018,7 @@ var artifactSSEEventSchema = external_exports.discriminatedUnion("type", [
 ]);
 var UNIFIED_SSE_EVENT_TYPE_SET = new Set(UNIFIED_SSE_EVENT_TYPES);
 
-// ../shared/dist/chunk-REUID6D4.mjs
+// ../shared/dist/chunk-UG3J37K4.mjs
 function parseHTMLWithRegex(html) {
   if (typeof html !== "string") {
     throw new Error("parseHTML: input must be a string");
@@ -17025,7 +17026,7 @@ function parseHTMLWithRegex(html) {
   try {
     const parser = {
       stripTags(value) {
-        return value.replace(/<[^>]*>/g, " ").replace(/\s+/g, " ").trim();
+        return value.replace(/<[^>]*>/g, " ").replace(/<(\/?[a-zA-Z][^>]*)$/, "&lt;$1").replace(/\s+/g, " ").trim();
       },
       querySelector(selector) {
         try {
@@ -17175,7 +17176,7 @@ function createPortableHelpers(parseHTML) {
       if (typeof html !== "string") {
         return "";
       }
-      return html.replace(/<h1[^>]*>(.*?)<\/h1>/gim, "# $1\n\n").replace(/<h2[^>]*>(.*?)<\/h2>/gim, "## $1\n\n").replace(/<h3[^>]*>(.*?)<\/h3>/gim, "### $1\n\n").replace(/<h4[^>]*>(.*?)<\/h4>/gim, "#### $1\n\n").replace(/<h5[^>]*>(.*?)<\/h5>/gim, "##### $1\n\n").replace(/<h6[^>]*>(.*?)<\/h6>/gim, "###### $1\n\n").replace(/<strong[^>]*>(.*?)<\/strong>/gim, "**$1**").replace(/<b[^>]*>(.*?)<\/b>/gim, "**$1**").replace(/<em[^>]*>(.*?)<\/em>/gim, "*$1*").replace(/<i[^>]*>(.*?)<\/i>/gim, "*$1*").replace(/<code[^>]*>(.*?)<\/code>/gim, "`$1`").replace(/<a[^>]*href="([^"]*)"[^>]*>(.*?)<\/a>/gim, "[$2]($1)").replace(/<br[^>]*>/gim, "\n").replace(/<\/p>/gim, "\n\n").replace(/<p[^>]*>/gim, "").replace(/<li[^>]*>(.*?)<\/li>/gim, "- $1\n").replace(/<ul[^>]*>/gim, "\n").replace(/<\/ul>/gim, "\n").replace(/<ol[^>]*>/gim, "\n").replace(/<\/ol>/gim, "\n").replace(/<[^>]+>/gim, "").replace(/\n\s*\n\s*\n/gim, "\n\n").trim();
+      return html.replace(/<h1[^>]*>(.*?)<\/h1>/gim, "# $1\n\n").replace(/<h2[^>]*>(.*?)<\/h2>/gim, "## $1\n\n").replace(/<h3[^>]*>(.*?)<\/h3>/gim, "### $1\n\n").replace(/<h4[^>]*>(.*?)<\/h4>/gim, "#### $1\n\n").replace(/<h5[^>]*>(.*?)<\/h5>/gim, "##### $1\n\n").replace(/<h6[^>]*>(.*?)<\/h6>/gim, "###### $1\n\n").replace(/<strong[^>]*>(.*?)<\/strong>/gim, "**$1**").replace(/<b[^>]*>(.*?)<\/b>/gim, "**$1**").replace(/<em[^>]*>(.*?)<\/em>/gim, "*$1*").replace(/<i[^>]*>(.*?)<\/i>/gim, "*$1*").replace(/<code[^>]*>(.*?)<\/code>/gim, "`$1`").replace(/<a[^>]*href="([^"]*)"[^>]*>(.*?)<\/a>/gim, "[$2]($1)").replace(/<br[^>]*>/gim, "\n").replace(/<\/p>/gim, "\n\n").replace(/<p[^>]*>/gim, "").replace(/<li[^>]*>(.*?)<\/li>/gim, "- $1\n").replace(/<ul[^>]*>/gim, "\n").replace(/<\/ul>/gim, "\n").replace(/<ol[^>]*>/gim, "\n").replace(/<\/ol>/gim, "\n").replace(/<[^>]*>/gim, "").replace(/<(\/?[a-zA-Z][^>]*)$/, "&lt;$1").replace(/\n\s*\n\s*\n/gim, "\n\n").trim();
     },
     /**
      * Parse date from various string formats
@@ -17920,7 +17921,15 @@ function isBuiltInToolId(toolId) {
 function isPlatformToolId(toolId) {
   return toolId.startsWith("platform:");
 }
-var INTEGRATION_SERVER_IDS = /* @__PURE__ */ new Set(["slack", "google", "linear", "github", "telegram"]);
+var INTEGRATION_SERVER_IDS = /* @__PURE__ */ new Set([
+  "slack",
+  "google",
+  "linear",
+  "github",
+  "telegram",
+  "imessage",
+  "granola"
+]);
 function isBuiltInIntegrationToolId(toolId) {
   if (!toolId.startsWith("builtin:")) return false;
   const { baseId } = parseToolInstanceId(toolId);
@@ -22373,6 +22382,8 @@ var AGENT_EXECUTION_STATUSES = [
   "interrupted"
 ];
 var agentExecutionStatusSchema = external_exports.enum(AGENT_EXECUTION_STATUSES);
+var DEFAULT_BEDROCK_REGION = "us-east-1";
+var DEFAULT_VERTEX_LOCATION = "us-central1";
 var PROVIDER_SECRET_SPECS = [
   {
     providerId: "mock",
@@ -22384,13 +22395,15 @@ var PROVIDER_SECRET_SPECS = [
     providerId: "google-vertex-anthropic",
     // Must come before google-vertex (shares vertex prefix) and anthropic (matches */claude-*).
     matches: (m2) => m2.startsWith("vertex-anthropic/"),
-    secretNames: ["GOOGLE_VERTEX_PROJECT", "GOOGLE_VERTEX_LOCATION", "GOOGLE_VERTEX_CREDENTIALS"]
+    secretNames: ["GOOGLE_VERTEX_PROJECT", "GOOGLE_VERTEX_CREDENTIALS"],
+    optionalSettings: [{ name: "GOOGLE_VERTEX_LOCATION", defaultValue: DEFAULT_VERTEX_LOCATION }]
   },
   {
     providerId: "google-vertex",
     // Must come before google (matches */gemini-*).
     matches: (m2) => m2.startsWith("vertex/"),
-    secretNames: ["GOOGLE_VERTEX_PROJECT", "GOOGLE_VERTEX_LOCATION", "GOOGLE_VERTEX_CREDENTIALS"]
+    secretNames: ["GOOGLE_VERTEX_PROJECT", "GOOGLE_VERTEX_CREDENTIALS"],
+    optionalSettings: [{ name: "GOOGLE_VERTEX_LOCATION", defaultValue: DEFAULT_VERTEX_LOCATION }]
   },
   {
     providerId: "vercel-gateway",
@@ -22407,7 +22420,8 @@ var PROVIDER_SECRET_SPECS = [
   {
     providerId: "bedrock",
     matches: (m2) => m2.startsWith("bedrock/"),
-    secretNames: ["AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY", "AWS_REGION"]
+    secretNames: ["AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY"],
+    optionalSettings: [{ name: "AWS_REGION", defaultValue: DEFAULT_BEDROCK_REGION }]
   },
   {
     providerId: "tinfoil",
@@ -22420,15 +22434,6 @@ var PROVIDER_SECRET_SPECS = [
     matches: (m2) => m2.startsWith("generic-openai/") || m2.startsWith("generic-openai:"),
     secretNames: ["GENERIC_OPENAI_API_KEY", "GENERIC_OPENAI_BASE_URL"]
   },
-  {
-    providerId: "general-compute",
-    // General Compute (https://api.generalcompute.com/v1) is an OpenAI-compatible
-    // host. Models are addressed only with the explicit `general-compute/` prefix
-    // (e.g. `general-compute/minimax-m2.7`) so they never collide with the same
-    // bare model id served by another gateway (Vercel already routes `minimax-m2.7`).
-    matches: (m2) => m2.startsWith("general-compute/") || m2.startsWith("general-compute:"),
-    secretNames: ["GENERAL_COMPUTE_API_KEY"]
-  },
   {
     providerId: "workers-ai",
     // Uses a CF platform binding, not a secret — secretNames is intentionally empty.
@@ -22478,6 +22483,13 @@ function resolveModelSecretNames(model) {
   }
   return [];
 }
+function resolveModelOptionalSettings(model) {
+  const lower = model.toLowerCase();
+  for (const spec of PROVIDER_SECRET_SPECS) {
+    if (spec.matches(lower)) return [...spec.optionalSettings ?? []];
+  }
+  return [];
+}
 var RUNTIME_ARTIFACT_MANIFEST_VERSION = "2026-06-08";
 var runtimeArtifactResourceTypeSchema = external_exports.enum(["flow", "agent"]);
 var runtimeArtifactEntrypointSchema = external_exports.enum(["flow", "agent"]);
@@ -22585,6 +22597,77 @@ var runtimeArtifactManifestSchema = external_exports.object({
     reasons: external_exports.array(runtimeArtifactEligibilityReasonSchema)
   })
 });
+var KNOWN_FLOW_STEP_TYPES = new Set(FLOW_STEP_TYPES);
+var API_INPROCESS_CAPABILITY_MATRIX = {
+  target: "api-inprocess",
+  // Bumped 2026-07-30: the IMPLICIT platform-default fallback candidate no
+  // longer folds (see `implicitPlatformFallback` below). Carries forward
+  // 2026-07-29.4: api-hosted runtime fulfills managed fetch methods through
+  // ManagedFetchExecutor (the managed-fetch fact remains for attribution). The
+  // EXPLICIT Layer-2 fallback fold and the remaining parity-audit folds are
+  // unchanged.
+  version: "2026-07-30.1",
+  unsupportedStepTypes: ["wait-until", "crawl"],
+  unsupportedFeatures: {
+    approvalSteps: true,
+    batchInputMode: true,
+    claudeManagedAgent: true,
+    inexpressibleVectorStep: true,
+    unresolvableAgentRef: true,
+    conditionalNestedPromptStep: true,
+    conditionalNestedExecuteAgentStep: true,
+    // SUPPORTED as of 2026-07-23 (slice 6 activation): the runtime flow lane
+    // now PAUSES on definition-embedded client-executed (local / webmcp) tools
+    // — `ClientToolRequiredError` → `step_await` / `flow_await` → durable KV
+    // ResumeState → the runtime continuation leg — instead of failing the call
+    // in-band. The `hasClientExecutedTools` FACT is still computed (for
+    // decision-attribution logs), but it no longer folds the flow to legacy.
+    // Rollback lever after retiring the flow request override: revert this bit
+    // to `true` (the agent lane retains its separate rollout gate).
+    clientExecutedTools: false,
+    advisorTools: true,
+    // G2 SUPPORTED: api-hosted runtime delegates Firecrawl / Massive fetch-url
+    // methods through ManagedFetchExecutor to the same API implementations the
+    // legacy executor uses. Keep the fact computed for attribution, like
+    // clientExecutedTools above.
+    unsupportedFetchMethod: false,
+    // Remaining 2026-07-29 parity-audit BRIDGE folds (G4/G5/G10/G14): feature
+    // classes the runtime flow lane still cannot faithfully run.
+    transformDataCodeModeTools: true,
+    unsupportedTransformExecution: true,
+    promptMcpServers: true,
+    promptArtifacts: true,
+    // EXPLICIT author-configured Layer-2 chains stay unsupported: the runtime
+    // flow engine cannot run them and cannot synthesize their `usedFallback` /
+    // `fallbackModel` / `fallbackExecutions` attribution, so a folded flow would
+    // both change behavior and undercount fallback usage.
+    fallbackErrorHandling: true,
+    // SUPPORTED as of 2026-07-30: the IMPLICIT platform-default chain (the
+    // orchestrator's synthesized same-model-next-provider + cross-model rungs
+    // for a prompt with NO explicit `errorHandling`) does not fold the flow to
+    // legacy. Rationale: a prompt step without `errorHandling` is the DEFAULT
+    // shape of nearly every hosted flow, so folding on it reverted the hosted
+    // flow lane to legacy for the common case — the opposite of runtime-primary.
+    // The runtime lane already carries Layer-1 resilience natively
+    // (`withModelCallResilience`: TTFT + idle watchdog + bounded same-model
+    // retry — packages/runtime prompt-executor.ts), so the residual delta is
+    // narrow: on a retryable platform-key failure that survives Layer 1 with no
+    // partial output, the runtime surfaces the step error where legacy would
+    // additionally swap upstream/model. That is an availability nicety, not a
+    // semantic difference — and unlike the folds above it cannot silently
+    // produce a WRONG result. `hasImplicitPlatformFallbackCandidate` is still
+    // computed for decision attribution. Rollback lever: flip this bit to `true`
+    // (plus its test) to restore the fold.
+    implicitPlatformFallback: false
+  }
+};
+var DURABLE_HOSTED_STEP_TYPES = /* @__PURE__ */ new Set(["wait-until", "crawl"]);
+var API_DURABLE_RESUME_CAPABILITY_MATRIX = {
+  ...API_INPROCESS_CAPABILITY_MATRIX,
+  unsupportedStepTypes: API_INPROCESS_CAPABILITY_MATRIX.unsupportedStepTypes.filter(
+    (stepType) => !DURABLE_HOSTED_STEP_TYPES.has(stepType)
+  )
+};
 var edgeAuthSnapshotSchema = external_exports.object({
   /**
    * Schema version. A plain positive int (not a literal) so a consumer pinned
@@ -40006,7 +40089,6 @@ var MODEL_FAMILY_PROVIDER_IDS = {
     "vercel": "xiaomi/mimo-v2.5-pro"
   },
   "minimax-m2-7": {
-    "general-compute": "general-compute/minimax-m2.7",
     "togetherai": "togetherai/MiniMaxAI/MiniMax-M2.7",
     "vercel": "minimax/minimax-m2.7"
   },
@@ -40014,7 +40096,6 @@ var MODEL_FAMILY_PROVIDER_IDS = {
     "vercel": "minimax/minimax-m2.7-highspeed"
   },
   "minimax-m2.7": {
-    "general-compute": "general-compute/minimax-m2.7",
     "vercel": "minimax/minimax-m2.7"
   },
   "minimax-m2.7-highspeed": {
@@ -40390,7 +40471,6 @@ var PLATFORM_KEY_PROVIDER_MAP = {
   "vertex-anthropic": false,
   "tinfoil": false,
   "generic-openai": false,
-  "general-compute": true,
   // Keyless platform provider: there is no API key (user or platform) — the
   // Cloudflare `AI` binding IS the platform credential. Marking it true makes
   // the router's platform-spend gate apply and keeps keySource attribution
@@ -40464,13 +40544,8 @@ var MANUAL_PROVIDER_MAP_OVERRIDES = {
     "mixlayer": "z-ai/glm-5.2",
     "vercel": "zai/glm-5.2"
   },
-  // MiniMax M2.7: explicit provider IDs for the GC-primary / Vercel-fallback route.
-  // `general-compute` is NOT in PROVIDERS_WITHOUT_PREFIX, so resolveRoutedFamily
-  // prepends `general-compute/` itself — store the BARE id here to avoid a double
-  // prefix (`general-compute/general-compute/...`). Vercel IS prefixless, so its
-  // value is the gateway-form `minimax/minimax-m2.7` used as-is.
+  // MiniMax M2.7: Vercel's gateway-form id.
   "minimax-m2.7": {
-    "general-compute": "minimax-m2.7",
     "vercel": "minimax/minimax-m2.7"
   }
 };
@@ -41388,7 +41463,55 @@ var sandboxConfigSchema = external_exports.object({
   instanceType: external_exports.enum(["standard-1", "standard-2", "standard-3", "standard-4"]).optional(),
   networkAccess: sandboxNetworkAccessSchema.optional(),
   ttl: external_exports.enum(["5m", "1h", "24h", "unlimited"]).optional(),
-  sleepAfter: external_exports.enum(["5m", "15m", "30m", "1h"]).optional()
+  sleepAfter: external_exports.enum(["5m", "15m", "30m", "1h"]).optional(),
+  // Operator-authored bootstrap commands. The API runs this batch once after
+  // enforcing the sandbox's network policy and before the first model-authored
+  // sandbox verb. Commands run in order from /workspace and must be foreground,
+  // self-contained, and safe to retry after an interrupted container runtime;
+  // the credential-bearing exec supervisor deliberately reaps every descendant
+  // before a command returns, so setup cannot launch a daemon meant to outlive
+  // it. Trusted Durable Object state plus a run-scoped memo prevents the batch
+  // from being repeated for the same provisioned workspace. Changing the
+  // commands or managed-secret KEY bindings creates a fresh sandbox identity;
+  // rotating a value under the same key does not rerun setup.
+  setupCommands: external_exports.array(external_exports.string().min(1, "setup commands must not be empty")).optional(),
+  // Credential environment available ONLY to the operator-authored setup batch
+  // above — never to a model-authored `bash` command. Keys are env var names;
+  // values are MANAGED SECRET KEYS (e.g. `GITHUB_CLONE_TOKEN`), never raw
+  // credential values. The API resolves them immediately before setup and
+  // delivers them out-of-band over `cloudflareSandboxExecWithSecretEnv`, so the
+  // values never appear in command strings, model-facing tool schemas, logs, or
+  // spill files. Like `networkAccess`, both fields are operator Definition: the
+  // model cannot author setup, name a managed secret, or grant itself one.
+  //
+  // TRUST BOUNDARY — read before configuring this. Every process started by a
+  // credentialed setup batch can read the injected values. Keep setup authored
+  // and reviewed by the operator; do not run model-, attacker-, or
+  // supply-chain-authored code (for example an install script) while credentials
+  // are present, and never persist a raw credential into /workspace for later
+  // model access. The secret supervisor freezes pre-existing processes, reaps
+  // every setup descendant, and destroys the sandbox fail-closed if cleanup
+  // fails, but output redaction remains defense-in-depth rather than permission
+  // to echo or transform a credential.
+  // Therefore:
+  //   - Prefer `credentialProxies` (phantom tokens, swapped at the egress
+  //     proxy) for any HTTP(S) protocol it supports — the real credential
+  //     never enters the container at all.
+  //   - Scope the secret as narrowly as the provider allows (read-only,
+  //     single-repo) and pair it with a tight `networkAccess` profile.
+  //   - Keep credentialed setup separate from later uncredentialed dependency
+  //     installation and model-authored work.
+  // Name shape and the 32-entry cap mirror the sandbox worker's
+  // `validateSecretEnv`; `RUNTYPE_SECRET_COMMAND` is the worker's reserved
+  // control-channel variable.
+  secretEnv: external_exports.record(
+    external_exports.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/, "must be a valid environment variable name").refine((name) => name !== "RUNTYPE_SECRET_COMMAND", {
+      message: "RUNTYPE_SECRET_COMMAND is reserved"
+    }),
+    external_exports.string().min(1, "must be a managed secret key")
+  ).refine((record2) => Object.keys(record2).length <= 32, {
+    message: "secretEnv supports at most 32 variables"
+  }).optional()
   // NOTE: a `requireApprovalForBash` knob was forward-declared here for Phase 3
   // but never wired to any runtime gate, so it was REMOVED from the public
   // schema rather than ship a misleading, inert control (post-Fable handoff 05,
@@ -41707,7 +41830,7 @@ var identityProofSchema = external_exports.object({
   /** The customer-native proof (JWT / opaque session token). */
   token: external_exports.string().min(1).max(8192)
 }).describe(
-  "Customer-native auth proof for the Identity Exchange. When present and the surface has a matching integration, the verified tenant/end-user replace any body-asserted tenant/endUser (which are never trusted for web-embedded callers). Ignored until the Identity Exchange admission upgrade ships."
+  "Customer-native auth proof for the Identity Exchange. When present and the surface has a matching integration, the verified tenant/end-user replace any body-asserted tenant/endUser (which are never trusted for web-embedded callers). When Identity Exchange admission is disabled for the caller, the proof is accepted but ignored and confers no trust."
 );
 function extractSecretReferences(template) {
   const keys = /* @__PURE__ */ new Set();
@@ -44774,6 +44897,27 @@ Only use a \`tool-call\` step when the tool must run deterministically at a fixe
   - Nullish fallback: \`{{count ?? 0}}\` \u2014 keeps 0 / "" / false (only null/undefined fall through)
   - Chains: \`{{a || b || "default"}}\` \u2014 supports paths and string/number/boolean/null literals; do NOT mix \`||\` and \`??\` in one expression
 
+### Prompt Caching: Where Large Context Goes
+
+Runtype caches the request prefix automatically on Claude models. **The part that gets REUSED across runs is the tools + \`systemPrompt\` prefix.** A second boundary is placed at the end of the last message, but a cache hit there needs the whole request \u2014 \`userPrompt\` included \u2014 to repeat byte-for-byte, which per-request task text does not. (Within one request it still helps: a multi-turn or tool-looping step re-sends the grown prompt each round-trip and reads that boundary warm.) This applies to ordinary single-shot \`prompt\` steps, not just multi-turn agents.
+
+- **Large STABLE context goes in \`systemPrompt\`** \u2014 style guides, voice/tone corpora, exemplars and few-shot examples, JSON schemas, policy documents, canonical reference text. Anything identical from run to run.
+- **Per-request content goes in \`userPrompt\`** \u2014 the task, the user's input, records retrieved for this run, prior-step outputs. A 25,000-token reference corpus pasted into \`userPrompt\` sits behind per-request text, so it is re-billed as uncached input on every single run.
+- **Reuse requires a byte-identical prefix.** Two steps share a cache entry only when their tools AND their \`systemPrompt\` strings match exactly. When a flow calls the same role more than once (draft \u2192 review \u2192 redraft, or the same analysis over N items), give those steps the SAME \`systemPrompt\` and put the per-call difference in \`userPrompt\`. Two near-identical system prompts are two cache entries and zero reuse.
+- **Below the model's minimum, nothing is stamped.** The prefix must exceed the model's minimum cacheable prefix (~1,024 tokens on Sonnet/Opus-class, up to 4,096 on Haiku-class) or the request goes out uncached. Do not contort a short system prompt to chase caching \u2014 this only matters when the stable context is genuinely large or the step runs many times.
+- **Per-run variables in \`systemPrompt\` kill the prefix.** \`{{_now.*}}\`, \`{{_execution.*}}\`, and \`{{_schedule.*}}\` re-render the system prompt on every execution, so it can never produce a cross-run hit; \`validate_flow\` reports this as \`CACHE_VOLATILE_SYSTEM_PROMPT\` (recommendation). Move the changing value into \`userPrompt\` or a later step. Other variables (\`{{_user.id}}\`, step outputs) do not disable caching, but they fork the cache per distinct substituted value \u2014 keep them out of a prefix you intend several steps or runs to share.
+
+\`\`\`json
+// BEFORE \u2014 the corpus rides in userPrompt and is re-sent uncached on every run,
+// and the two steps have different system prompts, so neither shares a prefix
+{ "type": "prompt", "name": "Draft", "config": { "model": "claude-opus-5", "systemPrompt": "You are a copywriter.", "userPrompt": "STYLE GUIDE: <25,000 tokens of client style corpus> --- Write a launch email about {{topic}}.", "outputVariable": "draft" } }
+{ "type": "prompt", "name": "Revise", "config": { "model": "claude-opus-5", "systemPrompt": "You revise copy.", "userPrompt": "STYLE GUIDE: <the same 25,000 tokens again> --- Revise this draft: {{draft}}", "outputVariable": "final" } }
+
+// AFTER \u2014 one byte-identical prefix; the second step and every later run read it warm
+{ "type": "prompt", "name": "Draft", "config": { "model": "claude-opus-5", "systemPrompt": "You write and revise copy for this client. STYLE GUIDE: <25,000 tokens of client style corpus>", "userPrompt": "Write a launch email about {{topic}}.", "outputVariable": "draft" } }
+{ "type": "prompt", "name": "Revise", "config": { "model": "claude-opus-5", "systemPrompt": "You write and revise copy for this client. STYLE GUIDE: <25,000 tokens of client style corpus>", "userPrompt": "Revise this draft: {{draft}}", "outputVariable": "final" } }
+\`\`\`
+
 ### Model Selection
 
 Use ONLY routed model IDs from the list below (platform-key compatible). Never
@@ -45722,7 +45866,7 @@ var InlineClientToolSchema = external_exports.object({
 var ClientToolsPolicySchema = external_exports.object({
   allowlist: external_exports.array(external_exports.string()).optional()
 });
-var DispatchRequestSchema = external_exports.object({
+var DispatchRequestEnvelopeSchema = external_exports.object({
   record: RecordInputSchema.optional(),
   flow: FlowInputSchema.optional(),
   agent: AgentInputSchema.optional(),
@@ -45759,7 +45903,9 @@ var DispatchRequestSchema = external_exports.object({
    * every submitted webmcp tool. See {@link ClientToolsPolicySchema}.
    */
   clientToolsPolicy: ClientToolsPolicySchema.optional(),
-  secrets: external_exports.record(external_exports.string(), external_exports.string()).optional(),
+  secrets: external_exports.record(external_exports.string(), external_exports.string()).optional().describe(
+    "Per-request credentials for agent/external-tool execution. Ignored when `flow` is the hosted target; FLOW credentials must use managed {{secret:NAME}} references."
+  ),
   credentialProxies: external_exports.array(credentialProxyConfigSchema).max(10).optional(),
   inputs: external_exports.record(external_exports.string(), external_exports.any()).optional().refine(
     (data) => {
@@ -45785,10 +45931,11 @@ var DispatchRequestSchema = external_exports.object({
     id: external_exports.string().min(1)
   }).passthrough().optional(),
   // Identity Exchange proof (design §4.1): a customer-native auth token the
-  // broker will verify server-side and admit as `verified` tenant/end-user.
-  // Wire contract only for now — parsed here, consumed by NOTHING until the
-  // admission slice wires verification into the tenancy seam. The token is a
-  // live credential: never log or persist it (see identityProofSchema docs).
+  // broker verifies server-side and admits as `verified` tenant/end-user when
+  // Identity Exchange admission is enabled for the caller. With the rollout
+  // gate disabled it remains accepted-but-ignored and confers no trust. The
+  // token is a live credential: never log or persist it (see
+  // identityProofSchema docs).
   identityProof: identityProofSchema.optional(),
   options: external_exports.object({
     streamResponse: external_exports.boolean().optional().default(true),
@@ -45800,7 +45947,7 @@ var DispatchRequestSchema = external_exports.object({
     debugMode: external_exports.boolean().optional().default(false),
     loggingPolicy: external_exports.enum(["default", "on", "off"]).optional(),
     useRuntimePackage: external_exports.boolean().optional().describe(
-      "Selects the execution engine for a streaming FLOW dispatch (two controls, A4-3). `true` forces the @runtypelabs/runtime lane (subject only to eligibility \u2014 an ineligible flow still folds to legacy silently); `false` forces the legacy engine. When omitted, the `use-runtime-package-flows` rollout flag sets the default engine for this caller. An explicit value always wins over the flag. Left undefined on purpose \u2014 do NOT default it, or the flag-as-default case becomes unreachable."
+      "For FLOW dispatches this compatibility field is accepted but ignored: eligible flows always use the @runtypelabs/runtime lane, while ineligible flows still fold to legacy silently. Agent dispatches still require an explicit `true` and remain subject to their separate runtime-agent rollout gate."
     ),
     /** Route prompt model calls through an attached dashboard browser. */
     localInference: LocalInferenceSelectionSchema.optional(),
@@ -45867,20 +46014,23 @@ var DispatchRequestSchema = external_exports.object({
     storeResults: true,
     autoAppendMetadata: false,
     debugMode: false,
-    // useRuntimePackage intentionally omitted — absent = silent request, so
-    // the `use-runtime-package-flows` flag decides the default engine (A4-3).
+    // useRuntimePackage intentionally omitted. Flow dispatch ignores the
+    // compatibility field; agent dispatch still requires explicit true.
     environment: "development",
     createVersion: false
   })
-}).refine((data) => data.flow || data.agent, {
-  message: "Either 'flow' or 'agent' configuration must be provided"
-}).superRefine((data, ctx) => {
+});
+var DispatchRequestSchema = external_exports.union([
+  DispatchRequestEnvelopeSchema.extend({ flow: FlowInputSchema }),
+  DispatchRequestEnvelopeSchema.extend({ agent: AgentInputSchema })
+]).superRefine((data, ctx) => {
   if (!data.options.localInference) return;
-  if (!data.options.useRuntimePackage) {
+  const runtimeLaneDisabled = data.agent != null && data.options.useRuntimePackage !== true;
+  if (runtimeLaneDisabled) {
     ctx.addIssue({
       code: "custom",
       path: ["options", "useRuntimePackage"],
-      message: "Local inference requires useRuntimePackage to be enabled"
+      message: data.agent != null ? "Local agent inference requires useRuntimePackage to be enabled" : "Local flow inference cannot use the legacy engine"
     });
   }
   if (data.options.modelOverride) {
@@ -53216,7 +53366,9 @@ import React14 from "react";
 import { render as render14 } from "ink";
 import { useState as useState15, useEffect as useEffect16 } from "react";
 import { readFileSync as readFileSync5 } from "fs";
-import { processStream as processStream3 } from "@runtypelabs/sdk";
+import {
+  processStream as processStream3
+} from "@runtypelabs/sdk";
 var dispatchCommand = new Command15("dispatch").description("Execute a flow or agent via the dispatch API").option("-f, --flow <id>", "Flow ID to execute").option("-a, --agent <id>", "Agent ID to execute").option("-r, --record <id>", "Existing record ID").option("--record-json <file>", "JSON file with record data").option("-m, --message <text>", "Message to send").option("-v, --variable <key=value>", "Set a variable (repeatable)", collectVariables, []).option("--stream", "Stream the response (default)", true).option("--no-stream", "Wait for complete response").option("--json", "Output as JSON").option("--debug", "Show step-level details").option("--tty", "Force TTY mode").option("--no-tty", "Force non-TTY mode").action(async (options) => {
   if (!options.flow && !options.agent) {
     console.error(chalk17.red("Error: Either --flow or --agent is required"));
@@ -53225,44 +53377,50 @@ var dispatchCommand = new Command15("dispatch").description("Execute a flow or a
   const apiKey = await ensureAuth();
   if (!apiKey) return;
   const client = createCliClient(apiKey);
-  const payload = {};
-  if (options.flow) {
-    payload.flow = { id: options.flow };
+  let payload;
+  try {
+    payload = buildDispatchRequest(options);
+  } catch (error51) {
+    const message = error51 instanceof Error ? error51.message : "Unknown error";
+    console.error(chalk17.red(`Failed to read record JSON: ${message}`));
+    process.exit(1);
+  }
+  if (options.stream) {
+    await handleStreaming(client, payload, options);
+  } else {
+    await handleNonStreaming(client, payload, options);
   }
+});
+function collectVariables(value, previous) {
+  return previous.concat([value]);
+}
+function buildDispatchRequest(options) {
+  if (!options.flow && !options.agent) {
+    throw new Error("Either --flow or --agent is required");
+  }
+  const payload = options.flow ? { flow: { id: options.flow } } : { agent: { agentId: options.agent } };
   if (options.agent) {
-    payload.agent = { id: options.agent };
+    payload.agent = { agentId: options.agent };
   }
   if (options.record) {
     payload.record = { id: options.record };
   } else if (options.recordJson) {
-    try {
-      const data = JSON.parse(readFileSync5(options.recordJson, "utf-8"));
-      payload.record = { metadata: data };
-    } catch (error51) {
-      const message = error51 instanceof Error ? error51.message : "Unknown error";
-      console.error(chalk17.red(`Failed to read record JSON: ${message}`));
-      process.exit(1);
-    }
+    const data = JSON.parse(readFileSync5(options.recordJson, "utf-8"));
+    payload.record = { metadata: data };
   }
   if (options.message) {
     payload.messages = [{ role: "user", content: options.message }];
   }
   if (options.variable && options.variable.length > 0) {
-    const variables = {};
-    for (const v2 of options.variable) {
-      const [key, ...rest] = v2.split("=");
-      variables[key] = rest.join("=");
+    const inputs = {};
+    for (const variable of options.variable) {
+      const [key, ...rest] = variable.split("=");
+      inputs[key] = rest.join("=");
     }
-    payload.variables = variables;
-  }
-  if (options.stream) {
-    await handleStreaming(client, payload, options);
-  } else {
-    await handleNonStreaming(client, payload, options);
+    payload.inputs = inputs;
   }
-});
-function collectVariables(value, previous) {
-  return previous.concat([value]);
+  payload.options = { streamResponse: options.stream };
+  return payload;
 }
 async function handleStreaming(client, payload, options) {
   console.log(chalk17.gray("Starting execution..."));
@@ -53316,7 +53474,6 @@ Error: ${err.message}`));
 async function handleNonStreaming(client, payload, options) {
   if (!isTTY(options)) {
     try {
-      payload.streamResponse = false;
       const result = await client.post("/dispatch", payload);
       if (options.json) {
         printJson(result);
@@ -53351,7 +53508,6 @@ async function handleNonStreaming(client, payload, options) {
     useEffect16(() => {
       const run2 = async () => {
         try {
-          payload.streamResponse = false;
           const result = await client.post("/dispatch", payload);
           setLoading(false);
           setSuccess(true);
@@ -68562,8 +68718,8 @@ import { execFileSync } from "child_process";
 // src/lib/persona-init.ts
 init_credential_store();
 
-// ../../node_modules/.pnpm/@runtypelabs+persona@4.13.0/node_modules/@runtypelabs/persona/dist/codegen.js
-var w = "4.13.0";
+// ../../node_modules/.pnpm/@runtypelabs+persona@4.14.0/node_modules/@runtypelabs/persona/dist/codegen.js
+var w = "4.14.0";
 var S = w;
 function b(e) {
   return e?.cdnBase?.trim().replace(/\/+$/, "").replace(/[\\'"<>`]/g, (r) => `%${r.charCodeAt(0).toString(16).toUpperCase().padStart(2, "0")}`) || `https://cdn.jsdelivr.net/npm/@runtypelabs/persona@${S}/dist`;
@@ -71946,7 +72102,20 @@ echo "  npm run build            \u2014 compile TypeScript"
 echo "  gcloud run deploy --source . --region us-central1 --allow-unauthenticated --port 8080"
 `;
 }
-function readme(agentNames, secretNames) {
+function formatOptionalProviderSettings(settings) {
+  return settings.map((setting) => `- \`${setting.name}\` (default: \`${setting.defaultValue}\`)`).join("\n");
+}
+function optionalProviderSettingsSection(settings) {
+  if (settings.length === 0) return "";
+  return `
+## Optional provider settings
+
+These environment variables override runtime defaults and are not required:
+
+${formatOptionalProviderSettings(settings)}
+`;
+}
+function readme(agentNames, secretNames, optionalSettings) {
   const agentList = agentNames.map((n) => `  - ${n}`).join("\n");
   const secretList = secretNames.length > 0 ? secretNames.map((s) => `  gcloud secrets create ${s} --data-file=-`).join("\n") : "  (none detected)";
   return `# Runtype Deployment
@@ -71983,6 +72152,8 @@ Set these before deploying to Cloud Run:
 
 ${secretList}
 
+${optionalProviderSettingsSection(optionalSettings)}
+
 ## Deploy to Cloud Run
 
 \`\`\`bash
@@ -72280,7 +72451,7 @@ echo "  wrangler dev             \u2014 preview locally"
 echo "  wrangler deploy          \u2014 deploy to Cloudflare Workers"
 `;
 }
-function workerReadme(agentNames, secretNames) {
+function workerReadme(agentNames, secretNames, optionalSettings) {
   const agentList = agentNames.map((n) => `  - ${n}`).join("\n");
   const secretList = secretNames.length > 0 ? secretNames.map((s) => `  wrangler secret put ${s}`).join("\n") : "  (none detected)";
   return `# Runtype Cloudflare Workers Deployment
@@ -72303,6 +72474,8 @@ Set each API key your agents use:
 ${secretList}
 \`\`\`
 
+${optionalProviderSettingsSection(optionalSettings)}
+
 ## Run locally
 
 \`\`\`bash
@@ -72557,7 +72730,7 @@ echo "  vercel dev              \u2014 preview locally"
 echo "  vercel deploy           \u2014 deploy to Vercel Functions"
 `;
 }
-function vercelReadme(agentNames, secretNames) {
+function vercelReadme(agentNames, secretNames, optionalSettings) {
   const agentList = agentNames.map((n) => `  - ${n}`).join("\n");
   const secretList = secretNames.length > 0 ? secretNames.map((s) => `  vercel env add ${s}`).join("\n") : "  (none detected)";
   return `# Runtype Vercel Functions Deployment
@@ -72580,6 +72753,8 @@ Set each API key your agents use via the Vercel dashboard or CLI:
 ${secretList}
 \`\`\`
 
+${optionalProviderSettingsSection(optionalSettings)}
+
 ## Run locally
 
 \`\`\`bash
@@ -72605,24 +72780,113 @@ curl https://<your-project>.vercel.app/agent/<name> \\
 \`\`\`
 `;
 }
-function collectSecretNames(agentDef) {
-  const names = /* @__PURE__ */ new Set();
-  const model = agentDef.config?.model?.toLowerCase();
-  if (model) {
-    for (const s of resolveModelSecretNames(model)) names.add(s);
+function collectExportedExecutionInventory(definition) {
+  const models = /* @__PURE__ */ new Set();
+  const namedSecrets = /* @__PURE__ */ new Set();
+  const visited = /* @__PURE__ */ new WeakSet();
+  const isObject2 = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+  const addModel = (value) => {
+    if (typeof value === "string" && value) models.add(value);
+  };
+  const walkMcpServers = (servers) => {
+    if (!Array.isArray(servers)) return;
+    for (const server of servers) {
+      if (!isObject2(server) || !isObject2(server.auth)) continue;
+      for (const key of ["tokenSecretName", "usernameSecretName", "passwordSecretName"]) {
+        const value = server.auth[key];
+        if (typeof value === "string" && value) namedSecrets.add(value);
+      }
+    }
+  };
+  function walkRuntimeTools(runtimeTools) {
+    if (!Array.isArray(runtimeTools)) return;
+    for (const tool of runtimeTools) {
+      if (!isObject2(tool) || !isObject2(tool.config)) continue;
+      if (isObject2(tool.config.flow)) walkFlow(tool.config.flow);
+      if (isObject2(tool.config.agent)) walkAgent(tool.config.agent);
+      if (isObject2(tool.config.skill)) walkRuntimeTools(tool.config.skill.resolvedTools);
+    }
+  }
+  function walkTools(tools) {
+    if (!isObject2(tools)) return;
+    walkMcpServers(tools.mcpServers);
+    walkRuntimeTools(tools.runtimeTools);
+  }
+  function walkFallbackModels(config3) {
+    if (!isObject2(config3.errorHandling) || !Array.isArray(config3.errorHandling.fallbacks)) return;
+    for (const fallback of config3.errorHandling.fallbacks) {
+      if (isObject2(fallback) && fallback.type === "model") addModel(fallback.model);
+    }
+  }
+  function walkSteps(steps) {
+    if (!Array.isArray(steps)) return;
+    for (const step of steps) {
+      if (!isObject2(step) || !isObject2(step.config)) continue;
+      if (step.type === "prompt") addModel(step.config.model);
+      walkFallbackModels(step.config);
+      walkTools(step.config.tools);
+      if (step.type !== "conditional") continue;
+      for (const key of ["trueSteps", "falseSteps", "otherwiseSteps"]) walkSteps(step.config[key]);
+      if (Array.isArray(step.config.branches)) {
+        for (const branch of step.config.branches) {
+          if (isObject2(branch)) walkSteps(branch.steps);
+        }
+      }
+    }
+  }
+  function walkFlow(flow) {
+    if (visited.has(flow)) return;
+    visited.add(flow);
+    walkSteps(flow.steps);
+    if (isObject2(flow.agents)) {
+      for (const agent of Object.values(flow.agents)) {
+        if (isObject2(agent)) walkAgent(agent);
+      }
+    }
   }
-  const toolsCfg = agentDef.config?.tools;
-  const mcpServers = toolsCfg?.mcpServers;
-  if (mcpServers) {
-    for (const srv of mcpServers) {
-      const auth = srv.auth;
-      if (auth?.tokenSecretName) names.add(String(auth.tokenSecretName));
-      if (auth?.usernameSecretName) names.add(String(auth.usernameSecretName));
-      if (auth?.passwordSecretName) names.add(String(auth.passwordSecretName));
+  function walkAgent(agent) {
+    if (visited.has(agent)) return;
+    visited.add(agent);
+    if (isObject2(agent.config)) {
+      addModel(agent.config.model);
+      walkTools(agent.config.tools);
+    }
+    if (isObject2(agent.claudeManagedConfig)) addModel(agent.claudeManagedConfig.model);
+    if (isObject2(agent.primaryFlow)) walkFlow(agent.primaryFlow);
+    if (Array.isArray(agent.capabilities)) {
+      for (const capability of agent.capabilities) {
+        if (!isObject2(capability)) continue;
+        if (isObject2(capability.flow)) walkFlow(capability.flow);
+        if (isObject2(capability.subAgent)) walkAgent(capability.subAgent);
+      }
     }
   }
-  for (const s of extractSecretReferencesFromAnyValue(agentDef)) names.add(s);
-  return Array.from(names);
+  if (isObject2(definition)) {
+    if (Array.isArray(definition.steps) && !isObject2(definition.config)) walkFlow(definition);
+    else walkAgent(definition);
+  }
+  return {
+    models: Array.from(models),
+    namedSecrets: Array.from(namedSecrets)
+  };
+}
+function collectDeploymentSecretInventory(agentDef) {
+  const requiredNames = /* @__PURE__ */ new Set();
+  const optionalSettings = /* @__PURE__ */ new Map();
+  const executionInventory = collectExportedExecutionInventory(agentDef);
+  for (const model of executionInventory.models) {
+    for (const name of resolveModelSecretNames(model)) requiredNames.add(name);
+    for (const setting of resolveModelOptionalSettings(model)) {
+      optionalSettings.set(setting.name, setting);
+    }
+  }
+  for (const name of executionInventory.namedSecrets) requiredNames.add(name);
+  for (const name of extractSecretReferencesFromAnyValue(agentDef, 512)) requiredNames.add(name);
+  for (const name of requiredNames) optionalSettings.delete(name);
+  return {
+    requiredNames: Array.from(requiredNames),
+    optionalSettings: Array.from(optionalSettings.values())
+  };
 }
 function slugify2(s) {
   return s.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 63);
@@ -72731,10 +72995,17 @@ Scaffolding ${target} deployment to ${outDir}
       monorepoRoot = parent;
     }
     const allSecrets = /* @__PURE__ */ new Set();
+    const allOptionalSettings = /* @__PURE__ */ new Map();
     for (const { def } of agentDefs) {
-      for (const s of collectSecretNames(def)) allSecrets.add(s);
+      const inventory = collectDeploymentSecretInventory(def);
+      for (const name of inventory.requiredNames) allSecrets.add(name);
+      for (const setting of inventory.optionalSettings) {
+        allOptionalSettings.set(setting.name, setting);
+      }
     }
+    for (const name of allSecrets) allOptionalSettings.delete(name);
     const secretNames = Array.from(allSecrets);
+    const optionalSettings = Array.from(allOptionalSettings.values());
     if (target === "cloudflare") {
       fs16.mkdirSync(path17.join(outDir, "src"), { recursive: true });
       fs16.writeFileSync(path17.join(outDir, "src", "index.ts"), workerIndexTs(agentSlugs));
@@ -72744,7 +73015,10 @@ Scaffolding ${target} deployment to ${outDir}
       const setupPath = path17.join(outDir, "setup.sh");
       fs16.writeFileSync(setupPath, workerSetupSh(monorepoRoot));
       fs16.chmodSync(setupPath, 493);
-      fs16.writeFileSync(path17.join(outDir, "README.md"), workerReadme(agentNames, secretNames));
+      fs16.writeFileSync(
+        path17.join(outDir, "README.md"),
+        workerReadme(agentNames, secretNames, optionalSettings)
+      );
     } else if (target === "vercel") {
       fs16.mkdirSync(path17.join(outDir, "api"), { recursive: true });
       fs16.writeFileSync(path17.join(outDir, "api", "[[...route]].ts"), vercelRouteTs(agentSlugs));
@@ -72754,7 +73028,10 @@ Scaffolding ${target} deployment to ${outDir}
       const setupPath = path17.join(outDir, "setup.sh");
       fs16.writeFileSync(setupPath, vercelSetupSh(monorepoRoot));
       fs16.chmodSync(setupPath, 493);
-      fs16.writeFileSync(path17.join(outDir, "README.md"), vercelReadme(agentNames, secretNames));
+      fs16.writeFileSync(
+        path17.join(outDir, "README.md"),
+        vercelReadme(agentNames, secretNames, optionalSettings)
+      );
     } else {
       fs16.writeFileSync(path17.join(outDir, "server.ts"), serverTs());
       fs16.writeFileSync(path17.join(outDir, "Dockerfile"), dockerfile());
@@ -72764,7 +73041,10 @@ Scaffolding ${target} deployment to ${outDir}
       const setupPath = path17.join(outDir, "setup.sh");
       fs16.writeFileSync(setupPath, setupSh(monorepoRoot));
       fs16.chmodSync(setupPath, 493);
-      fs16.writeFileSync(path17.join(outDir, "README.md"), readme(agentNames, secretNames));
+      fs16.writeFileSync(
+        path17.join(outDir, "README.md"),
+        readme(agentNames, secretNames, optionalSettings)
+      );
     }
     console.log("");
     console.log(chalk38.green(`\u2713 Scaffold written to ${outDir}`));
@@ -72772,6 +73052,15 @@ Scaffolding ${target} deployment to ${outDir}
     console.log(chalk38.bold("Next steps:"));
     console.log(`  cd ${options.output}`);
     console.log("  chmod +x setup.sh && ./setup.sh   # pack runtime + install deps");
+    if (optionalSettings.length > 0) {
+      console.log("");
+      console.log(chalk38.yellow("Optional provider settings (defaults used when unset):"));
+      for (const setting of optionalSettings) {
+        console.log(
+          `  ${chalk38.cyan(setting.name)} (default: ${chalk38.cyan(setting.defaultValue)})`
+        );
+      }
+    }
     if (target === "cloudflare") {
       console.log("  wrangler dev                       # test locally");
       console.log("");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runtypelabs/cli",
-  "version": "2.32.2",
+  "version": "2.32.3",
   "description": "Command-line interface for Runtype AI platform",
   "type": "module",
   "main": "dist/index.js",
@@ -26,13 +26,13 @@
     "react": "^19.2.4",
     "rosie-skills": "0.8.1",
     "yaml": "^2.9.0",
-    "@runtypelabs/ink-components": "0.3.5",
-    "@runtypelabs/sdk": "6.3.6",
-    "@runtypelabs/terminal-animations": "0.2.2"
+    "@runtypelabs/terminal-animations": "0.2.2",
+    "@runtypelabs/sdk": "6.4.0",
+    "@runtypelabs/ink-components": "0.3.5"
   },
   "devDependencies": {
     "@modelcontextprotocol/server": "2.0.0",
-    "@runtypelabs/persona": "4.13.0",
+    "@runtypelabs/persona": "4.14.0",
     "@types/express": "^5.0.6",
     "@types/micromatch": "^4.0.9",
     "@types/node": "^25.3.3",
@@ -43,7 +43,7 @@
     "tsx": "^4.7.1",
     "typescript": "^6.0.3",
     "vitest": "^4.1.0",
-    "@runtypelabs/shared": "3.9.2"
+    "@runtypelabs/shared": "3.10.0"
   },
   "engines": {
     "node": ">=22.12.0"