@runtypelabs/cli 2.33.0 → 2.33.1

package/dist/index.js

@@ -616,9 +616,6 @@ var OAuthManager = class {
 // src/auth/api-key-manager.ts
 import { RuntypeApiError } from "@runtypelabs/sdk";
 
-// src/lib/sdk-client.ts
-import { createClient } from "@runtypelabs/sdk";
-
 // ../shared/dist/chunk-ZUODFMLO.mjs
 var DEFAULT_MODELS_FOR_NEW_ACCOUNTS = [
   // Mixlayer models
@@ -15364,7 +15361,7 @@ var edgeContextPayloadSchema = external_exports.object({
 // ../shared/dist/chunk-SCJRL6LP.mjs
 var MAX_DURABLE_POLL_ATTEMPTS = 1e3;
 
-// ../shared/dist/chunk-FSHR33DZ.mjs
+// ../shared/dist/chunk-MATCHJ7V.mjs
 function getNestedValue(obj, path20) {
   let normalizedPath = path20;
   normalizedPath = normalizedPath.replace(/^\$\.?/, "");
@@ -20376,14 +20373,14 @@ function normalizeVectorSearchConfig(config3) {
   }
   const providerInput = config3.provider || config3.vectorStore || "record";
   const vectorStore = providerInput === "record" ? "pgvector" : providerInput;
-  const vectorizeConfig = config3.vectorizeConfigId || config3.vectorizeNamespace ? {
+  const vectorizeConfig = config3.vectorizeConfig || (config3.vectorizeConfigId || config3.vectorizeNamespace ? {
     configId: config3.vectorizeConfigId,
     namespace: config3.vectorizeNamespace
-  } : void 0;
-  const weaviateConfig = config3.weaviateClassName || config3.weaviateConfigId ? {
+  } : void 0);
+  const weaviateConfig = config3.weaviateConfig || (config3.weaviateClassName || config3.weaviateConfigId ? {
     configId: config3.weaviateConfigId,
     className: config3.weaviateClassName || ""
-  } : void 0;
+  } : void 0);
   return {
     query: config3.query,
     embeddingModel: config3.embeddingModel,
@@ -20956,6 +20953,9 @@ function sanitizeCodeToolIdentifier(name) {
   if (/^[0-9]/.test(safe)) safe = "_" + safe;
   return safe;
 }
+function snakeToCamel(str) {
+  return str.replace(/_([a-z])/g, (_2, letter) => letter.toUpperCase());
+}
 var flowStepValidationSchema = external_exports.object({
   // Optional stable client-supplied identifier. Preserved across saves so that
   // `flow_step_results.stepId` references stay valid and dashboard UI state
@@ -21018,6 +21018,12 @@ var KNOWN_TOOL_KEYS = /* @__PURE__ */ new Set([
   ...Object.keys(CAMEL_CASE_TOOL_KEYS),
   ...Object.keys(SNAKE_CASE_TOOL_KEYS)
 ]);
+for (const snakeKey of Object.keys(SNAKE_CASE_TOOL_KEYS)) {
+  const camelKey = snakeToCamel(snakeKey);
+  if (!(camelKey in CAMEL_CASE_TOOL_KEYS)) {
+    throw new Error(`No camelCase tool key for snake_case key "${snakeKey}"`);
+  }
+}
 var LEGACY_TOOL_KEY_SUGGESTIONS = {
   builtinTools: "toolIds"
 };
@@ -22749,16 +22755,50 @@ var runtimeArtifactManifestSchema = external_exports.object({
 var KNOWN_FLOW_STEP_TYPES = new Set(FLOW_STEP_TYPES);
 var API_INPROCESS_CAPABILITY_MATRIX = {
   target: "api-inprocess",
-  // Bumped 2026-08-03: adds the §A1 `promptCodeModeTools` fold (a prompt step's
-  // `config.tools.codeModeConfig` has no runtime flow-lane port). Carries
-  // forward 2026-07-31: the `unmaterializedPromptToolRefs` fold. Carries
-  // forward 2026-07-30: the IMPLICIT platform-default fallback candidate no
-  // longer folds (see `implicitPlatformFallback` below). Carries forward
-  // 2026-07-29.4: api-hosted runtime fulfills managed fetch methods through
-  // ManagedFetchExecutor (the managed-fetch fact remains for attribution). The
-  // EXPLICIT Layer-2 fallback fold and the remaining parity-audit folds are
-  // unchanged.
-  version: "2026-08-03.1",
+  // Bumped 2026-08-05.3: graduates `conditionalNestedExecuteAgentStep` to
+  // SUPPORTED (the runtime-conditional-nested-execute-agent leg-2 port): a
+  // conditional-nested `execute-agent` runs on the engine-owned nested path
+  // (the shared `conditionalSubStepExecutor` re-enters `runContextStep`, whose
+  // default engine path dispatches `executeExecuteAgent`), so it no longer folds
+  // to legacy. The fact stays computed for decision attribution. Rollback lever:
+  // revert this bit to `true`.
+  // Bumped 2026-08-05.3: graduates `promptMcpServers` to SUPPORTED (the #6013
+  // fold — the runtime FLOW lane now discovers `config.tools.mcpServers` on
+  // prompt steps via `discoverMCPTools`, exactly like the agent lane, merging
+  // each step's servers' tools into its `config.tools.runtimeTools` before the
+  // prompt runs). The `hasPromptMcpServers` FACT is still computed for
+  // decision attribution but no longer folds. Rollback lever: revert this bit
+  // to `true`.
+  // Bumped 2026-08-05.2: graduates `conditionalNestedPromptStep` to SUPPORTED
+  // (the #6016 leg-1 port routes nested prompt sub-steps through the engine-owned
+  // `runPromptStep` path instead of the portable executor's throw). The
+  // `hasConditionalNestedPromptStep` FACT is still computed for decision
+  // attribution but no longer folds. Rollback lever: revert this bit to `true`.
+  // Bumped 2026-08-05.1: adds the #6023 leg 1 `customToolExecution` fold (a
+  // custom runtime tool requesting code_mode / a non-JS language / a
+  // container-backed sandbox provider the runtime's JS-only executor cannot
+  // honor). Carries forward 2026-08-03: the §A1 `promptCodeModeTools` fold.
+  // Carries forward 2026-07-31: the `unmaterializedPromptToolRefs` fold.
+  // Carries forward 2026-07-30: the IMPLICIT platform-default fallback
+  // candidate no longer folds (see `implicitPlatformFallback` below). Carries
+  // forward 2026-07-29.4: api-hosted runtime fulfills managed fetch methods
+  // through ManagedFetchExecutor (the managed-fetch fact remains for
+  // attribution). The EXPLICIT Layer-2 fallback fold and the remaining
+  // parity-audit folds are unchanged.
+  // Bumped 2026-08-06.1: graduates `promptCodeModeTools` + the
+  // `transformDataCodeModeTools` runtimeTools/toolIds cases (#6013) — the
+  // runtime flow lane synthesizes `code_mode` and runs it (plus transform-data
+  // tool pools) through the host `CodeModeExecutor`
+  // (`SANDBOX.workerLoaderExecuteTransformWithTools`). The
+  // `transformDataCodeModeTools` fact now folds only the `mcpServers` case.
+  // Rollback lever: revert the two bits to `true` (plus their tests).
+  // Bumped 2026-08-06.3: integration re-bump past the .1/.2 collisions — five
+  // #6013/#6016 graduations (advisorTools, transformDataCodeModeTools,
+  // promptCodeModeTools, promptMcpServers, promptArtifacts) landed on
+  // independent branches that each claimed their own suffix, plus the
+  // vendored-export re-fold pass. No bit changes with this bump; it exists so
+  // the combined base carries one unambiguous version.
+  version: "2026-08-06.3",
   unsupportedStepTypes: ["wait-until", "crawl"],
   unsupportedFeatures: {
     approvalSteps: true,
@@ -22766,8 +22806,18 @@ var API_INPROCESS_CAPABILITY_MATRIX = {
     claudeManagedAgent: true,
     inexpressibleVectorStep: true,
     unresolvableAgentRef: true,
-    conditionalNestedPromptStep: true,
-    conditionalNestedExecuteAgentStep: true,
+    // SUPPORTED as of 2026-08-05 (#6016 leg 1): the runtime flow lane routes a
+    // conditional-nested prompt through the engine-owned `runPromptStep` path
+    // (nested prompt dispatch in flow-engine.ts), so a prompt inside a
+    // conditional branch no longer folds to legacy.
+    conditionalNestedPromptStep: false,
+    // SUPPORTED as of 2026-08-05.3 (runtime-conditional-nested-execute-agent):
+    // the runtime flow lane routes a conditional-nested `execute-agent` through
+    // the engine-owned nested path (`conditionalSubStepExecutor` -> `runContextStep`
+    // -> the default engine dispatch of `executeExecuteAgent`), so an execute-agent
+    // inside a conditional branch no longer folds to legacy. The fact stays
+    // computed for decision attribution. Rollback lever: revert this bit.
+    conditionalNestedExecuteAgentStep: false,
     // SUPPORTED as of 2026-07-23 (slice 6 activation): the runtime flow lane
     // now PAUSES on definition-embedded client-executed (local / webmcp) tools
     // — `ClientToolRequiredError` → `step_await` / `flow_await` → durable KV
@@ -22777,7 +22827,13 @@ var API_INPROCESS_CAPABILITY_MATRIX = {
     // Rollback lever after retiring the flow request override: revert this bit
     // to `true` (the agent lane retains its separate rollout gate).
     clientExecutedTools: false,
-    advisorTools: true,
+    // SUPPORTED as of 2026-08-06 (#6013 advisor port): the runtime flow lane
+    // now executes advisor runtime tools server-side via nested model inference
+    // (`RuntimeToolExecutor.runAdvisor`), so an advisor flow stays on the
+    // runtime lane instead of folding to legacy. The `hasAdvisorTools` FACT is
+    // still computed for decision attribution but no longer folds. Rollback
+    // lever: flip this bit back to `true` (plus its test).
+    advisorTools: false,
     // G2 SUPPORTED: api-hosted runtime delegates Firecrawl / Massive fetch-url
     // methods through ManagedFetchExecutor to the same API implementations the
     // legacy executor uses. Keep the fact computed for attribution, like
@@ -22785,19 +22841,48 @@ var API_INPROCESS_CAPABILITY_MATRIX = {
     unsupportedFetchMethod: false,
     // Remaining 2026-07-29 parity-audit BRIDGE folds (G4/G5/G10/G14): feature
     // classes the runtime flow lane still cannot faithfully run.
-    transformDataCodeModeTools: true,
+    // SUPPORTED as of 2026-08-06 (#6013): a `transform-data` step whose
+    // `config.tools` carries a runtime tool pool binds those tools through the
+    // host `CodeModeExecutor` (`workerLoaderExecuteTransformWithTools`). The
+    // `mcpServers`-only case STAYS folded via the narrow
+    // `transformDataMcpServers` bit below (the runtime has no MCP discovery on
+    // transform steps, so an MCP tool pool would silently lose its tools).
+    // Rollback lever: revert this bit to `true` (plus its test).
+    transformDataCodeModeTools: false,
+    // #6013 narrow carve-out — the mcpServers-only transform code-mode case.
+    // `transformDataHasCodeModeTools` now fires only on `config.tools.mcpServers`,
+    // and this bit keeps that narrow case routed to legacy while the
+    // runtimeTools/toolIds cases graduate (bit above flipped false).
+    transformDataMcpServers: true,
     unsupportedTransformExecution: true,
-    promptMcpServers: true,
-    promptArtifacts: true,
-    // §A1 parity-audit BRIDGE fold (2026-08-03): a PROMPT step's
-    // `config.tools.codeModeConfig` with a non-empty `toolPool`. The
-    // `transformDataCodeModeTools` fold above covers only a TRANSFORM-DATA
-    // step's `config.tools` bag; a prompt step's code_mode synthesizer (the
-    // legacy `buildSynthesizedCodeModeTool`) has no runtime flow-lane port, so
-    // an unfolded prompt would run on the runtime lane with its code_mode tool
-    // pool silently absent. Routes to legacy until the prompt-step code_mode
-    // synthesizer is ported.
-    promptCodeModeTools: true,
+    // #6023 leg 1 (2026-08-05): a custom runtime tool requesting code_mode / a
+    // non-JS language / a container-backed sandbox provider has no runtime-lane
+    // port — `runCustom` ignores all three and silently misexecutes as JS. Same
+    // bridge class as `unsupportedTransformExecution` (G5), at the tool level.
+    customToolExecution: true,
+    // SUPPORTED as of 2026-08-05 (#6013 fold): the runtime FLOW lane now
+    // discovers `config.tools.mcpServers` on prompt steps via `discoverMCPTools`
+    // (mirroring the agent lane's agent-engine.ts wiring) and merges the
+    // discovered tools into each prompt step's `config.tools.runtimeTools`
+    // before it runs. Runtime discovery is the ONLY model-visible schema source
+    // (real `tools/list` schemas + fresh auth — no export-time materialization,
+    // which would ship empty schemas for allowedTools-gated servers). The
+    // `hasPromptMcpServers` FACT is still computed for decision-attribution logs
+    // but no longer folds. Rollback lever: revert this bit to `true`.
+    promptMcpServers: false,
+    // #6013 (G14, 2026-08-06): prompt-step artifact emission is ported to the
+    // runtime lane (injection + emit_artifact_* execution + artifact_* frame
+    // emission + strip). `hasPromptArtifacts` stays computed for decision
+    // attribution. Rollback lever: set this back to `true` (plus its test).
+    promptArtifacts: false,
+    // SUPPORTED as of 2026-08-06 (#6013): the runtime flow lane synthesizes
+    // the `code_mode` tool (byte-identical description/schema to legacy via the
+    // shared builders) and executes it through the host `CodeModeExecutor`.
+    // The `hasPromptCodeModeTools` FACT is still computed (for decision
+    // attribution) but no longer folds. A pool referencing an unmaterialized
+    // class still folds via the separate `unmaterializedPromptToolRefs` fact.
+    // Rollback lever: revert this bit to `true` (plus its test).
+    promptCodeModeTools: false,
     // SUPPORTED as of the fallback-chain port: the runtime flow engine now
     // executes EXPLICIT author-configured Layer-2 chains and synthesizes their
     // `usedFallback` / `fallbackModel` / `fallbackExecutions` attribution, so
@@ -22842,6 +22927,180 @@ var API_DURABLE_RESUME_CAPABILITY_MATRIX = {
     (stepType) => !DURABLE_HOSTED_STEP_TYPES.has(stepType)
   )
 };
+var VENDORED_EXPORT_CAPABILITY_MATRIX = {
+  ...API_INPROCESS_CAPABILITY_MATRIX,
+  target: "vendored-export",
+  // Bumped 2026-08-06.3: one-pass re-decision of the restated fold block after
+  // the five #6013/#6016 api-inprocess graduations (advisorTools,
+  // transformDataCodeModeTools, promptCodeModeTools, promptMcpServers,
+  // promptArtifacts) plus `conditionalNestedExecuteAgentStep`. Each restated
+  // literal was re-classified against this file's own criterion — ENGINE-owned
+  // (a self-contained container runs it) inherits the base `false`; HOST-SEAM
+  // (fulfilled only by an api-wired optional executor a vendored container
+  // lacks) becomes a documented entry in {@link VENDORED_EXPORT_REFOLDS}. The
+  // two CodeModeExecutor-backed bits re-fold; the other four graduate here too.
+  // Bumped 2026-08-06.2: re-folds `unsupportedFetchMethod` (see
+  // VENDORED_EXPORT_REFOLDS) — api-inprocess supports managed fetch methods
+  // only because the api host wires `ManagedFetchExecutor`; no export bundle
+  // does, so a firecrawl/massive fetch-url step fails as-shipped.
+  version: "2026-08-06.3",
+  unsupportedStepTypes: [
+    // ── Carried over from api-inprocess: durable-host-only step types. A
+    // self-contained container has no durable host (BYOC §3.3 / S0 — the
+    // exported runtime's `waitUntil` seam is unset; crawl needs the
+    // `CrawlPendingError` durable pause). Graduation lever: wire a durable
+    // store in the export (e.g. a Cloud SQL CheckpointStore) — then flip.
+    "wait-until",
+    "crawl",
+    // ── Hosted-service / DB-backed record & email steps (BYOC §7.2). A
+    // self-contained container has no hosted RecordStore / EmailSender; the
+    // Hosted endpoints are PROPOSED, not built, and S0 shows send-email /
+    // record steps fail in BOTH default and wired configs (no Bundled mode).
+    // Graduation lever: build the Hosted endpoints OR ship a Bundled
+    // RecordStore/EmailSender in the standard export — then remove.
+    "send-email",
+    "upsert-record",
+    "update-record",
+    "retrieve-record",
+    "get-record",
+    "list-records",
+    "search",
+    // ── Vector DB / embedding provider steps (BYOC §3.4 / §7.4). Only a
+    // customer-wired VectorStore / EmbeddingProvider can host these; the
+    // container ships neither. Graduation lever: bundle a pgvector
+    // VectorStore + a provider-backed EmbeddingProvider in the export.
+    "generate-embedding",
+    "vector-search",
+    "store-vector",
+    // ── Hosted asset / PDF service steps (BYOC §7.2). store-asset /
+    // generate-pdf are Hosted-only; no Bundled fulfillment. Graduation lever:
+    // build the Hosted asset/PDF endpoints or ship a Bundled renderer/store.
+    "store-asset",
+    "generate-pdf",
+    // ── Hosted memory-store steps (BYOC §3.4 / §7.2). Memory has Hosted/Custom
+    // only, no Bundled mode. Graduation lever: a Bundled MemoryStore seam in
+    // the export (or the Hosted memory endpoints).
+    "save-memory",
+    "recall-memory",
+    "memory-summary",
+    // ── template & transform-data: FAIL AS-SHIPPED (S0 §5.2.1 / §5.2.2). The
+    // export does NOT bundle liquidjs / QuickJS, so a self-contained container
+    // throws `TemplateRenderer not configured` / `SandboxNotConfiguredError`
+    // out of the box; they only PASS once the container wires the Bundled
+    // fulfillment (LiquidTemplateRenderer + QuickJSSafeCodeExecutor). Per the
+    // fail-closed / keep-gates-truthful principle these stay UNSUPPORTED for
+    // this v1. Graduation lever: bundle liquidjs + QuickJS as part of the
+    // STANDARD export (default-wire the renderer and sandbox) — then flip both
+    // to supported.
+    "template",
+    "transform-data"
+  ],
+  // Every api-inprocess feature fold carries over (shared engine, derived by
+  // spreading the base). Each is restated below with its evidence + graduation
+  // lever so the contract is self-documenting; values are pinned to the
+  // api-inprocess semantics a container inherits, never loosened — except the
+  // vendored-specific RE-FOLDS enumerated in {@link VENDORED_EXPORT_REFOLDS},
+  // which are strictly stricter.
+  unsupportedFeatures: {
+    ...API_INPROCESS_CAPABILITY_MATRIX.unsupportedFeatures,
+    approvalSteps: true,
+    // api-inprocess fold; the runtime flow engine derives no approval config. Graduation: port the approval rail.
+    batchInputMode: true,
+    // api-inprocess fold; batch has no conversational context (BYOC §3.2).
+    claudeManagedAgent: true,
+    // api-inprocess fold; exported execute-agent rejects claude_managed/external (BYOC §3.6, D-030/D-031).
+    inexpressibleVectorStep: true,
+    // api-inprocess fold; no vector seam in a self-contained container.
+    unresolvableAgentRef: true,
+    // api-inprocess fold; execute-agent resolves only against the embedded registry (ADR 0014).
+    // Nested-prompt dispatch is ENGINE-owned and works identically in a
+    // container, so this stays SUPPORTED (false) exactly as api-inprocess has
+    // it — a container does not re-fold what the engine runs itself.
+    conditionalNestedPromptStep: false,
+    // Conditional-nested `execute-agent` dispatch is ENGINE-owned exactly like
+    // nested prompt above (`conditionalSubStepExecutor` -> `runContextStep` ->
+    // `executeExecuteAgent`), so it inherits the base SUPPORTED (`false`) from
+    // the spread. NOT restated as a literal: the 2026-08-06.3 re-decision pass
+    // exists because a restated literal went stale when the base graduated.
+    // Client-executed (local/webmcp) tools PAUSE natively on the runtime flow
+    // lane; a self-contained container still pauses on them, so SUPPORTED
+    // (false) — carried over verbatim.
+    clientExecutedTools: false,
+    // `advisorTools` inherits the base SUPPORTED (`false`): `RuntimeToolExecutor
+    // .runAdvisor` resolves the advisor model through `PROVIDER_REGISTRY` +
+    // `adapter.getSecret`/`getBinding` — the same machinery every prompt step
+    // already uses — so a container that runs prompts runs advisors. No host
+    // seam involved.
+    // VENDORED RE-FOLD (not carried over): api-inprocess marks managed fetch
+    // methods SUPPORTED (false) only because the api host wires
+    // `ManagedFetchExecutor` — the seam exists precisely because the portable
+    // runtime cannot own Firecrawl / Massive credentials, rollout gates, or
+    // platform-spend metering. No export bundle wires it (the only
+    // implementation is `ApiManagedFetchExecutor`, wired solely by
+    // `apps/api/src/lib/runtime/playground-runtime.ts`), so a `fetch-url` step
+    // with `fetchMethod: 'firecrawl' | 'massive'` falls through to the portable
+    // base's not-supported error — and under the default `errorHandling:
+    // 'continue'` that failure is SWALLOWED and downstream steps see null.
+    // Declaring such a flow container-eligible is exactly the silent-misexecution
+    // class the fail-closed posture (which folded template / transform-data for
+    // the identical "passes only when hand-wired" reason) exists to prevent.
+    // Graduation lever: ship a Bundled managed-fetch fulfillment in the standard
+    // export (direct provider-credential fetch, or a hosted managed-fetch
+    // endpoint) — then flip back to false and drop it from
+    // {@link VENDORED_EXPORT_REFOLDS}. Plain `fetch-url` (no managed method)
+    // stays supported; only the managed methods fold.
+    unsupportedFetchMethod: true,
+    // VENDORED RE-FOLD (not carried over): api-inprocess graduated a
+    // `transform-data` step's runtimeTools/toolIds pool (#6013) only because the
+    // api host wires `ApiCodeModeExecutor` → `SANDBOX
+    // .workerLoaderExecuteTransformWithTools`. The seam exists precisely because
+    // NONE of the runtime's four shipped `SafeCodeExecutor`s can bind pool tools
+    // to sandboxed code, so an unwired container throws
+    // `CodeModeExecutorNotConfiguredError` (`runtime-context-step-executor.ts`
+    // fails closed on the transform-data path). Graduation lever: ship a Bundled
+    // code-with-tools fulfillment in the standard export — then flip to false and
+    // drop from {@link VENDORED_EXPORT_REFOLDS}.
+    transformDataCodeModeTools: true,
+    // The narrow mcpServers-only transform carve-out (#6013) is a base fold;
+    // carried over as `true` and restated for the same reason (no MCP discovery
+    // on transform steps).
+    transformDataMcpServers: true,
+    unsupportedTransformExecution: true,
+    // api-inprocess fold (G5); carried over.
+    customToolExecution: true,
+    // api-inprocess fold (#6023 leg 1); carried over.
+    // `promptMcpServers` inherits the base SUPPORTED (`false`). The runtime owns
+    // MCP end to end for the shipped default transport: `discoverMCPTools` falls
+    // back to its own `listServerTools` over `adapter.fetch` when no host
+    // `MCPToolExecutor` is present, and `RuntimeToolExecutor.runMCP` has a
+    // portable Streamable-HTTP JSON-RPC dispatch path on the same fallback. Only
+    // `transport: 'rest'` requires the host executor, and that is a per-server
+    // authoring choice this flow-level bit cannot express — the agent lane makes
+    // the identical bet in a container today.
+    // `promptArtifacts` inherits the base SUPPORTED (`false`): artifact emission
+    // is pure `UnifiedEventEmitter` frame production plus builtin-tool injection
+    // and strip, entirely inside the engine. (Persisting an artifact to hosted
+    // storage is the separate `store-asset` STEP TYPE, which stays folded above.)
+    // VENDORED RE-FOLD (not carried over): api-inprocess graduated a PROMPT
+    // step's `codeModeConfig.toolPool` (#6013) on the same `ApiCodeModeExecutor`
+    // seam as `transformDataCodeModeTools` above. The runtime synthesizes the
+    // `code_mode` tool byte-identically, but firing it without a host executor
+    // throws `CodeModeExecutorNotConfiguredError` (`tool-executor.ts` fails
+    // closed rather than silently degrading the pool to plain model tools).
+    // Under the default `errorHandling: 'continue'` that failure is swallowed —
+    // the same silent-misexecution class the fail-closed posture exists to
+    // prevent. Same graduation lever as the transform-data bit.
+    promptCodeModeTools: true,
+    // Explicit Layer-2 fallback chains are SUPPORTED (false) on the runtime
+    // lane, engine-owned, so a container runs them — carried over verbatim.
+    fallbackErrorHandling: false,
+    // Implicit platform-default fallback SUPPORTED (false) — engine-owned
+    // resilience; carried over verbatim (a container is not less capable).
+    implicitPlatformFallback: false,
+    unmaterializedPromptToolRefs: true
+    // api-inprocess fold (§A1); carried over.
+  }
+};
 var edgeAuthSnapshotSchema = external_exports.object({
   /**
    * Schema version. A plain positive int (not a literal) so a consumer pinned
@@ -37822,7 +38081,7 @@ var CORE_BUILTIN_TOOLS_REGISTRY = [
   {
     id: "sandbox:exec",
     name: "Sandbox Exec",
-    description: "Run a shell command in a Linux sandbox (Node 22, Python 3.12, git, pnpm). The sandbox persists across tool calls within the same execution \u2014 install packages, write files, then run them. Returns stdout, stderr, and exit code.",
+    description: "Run a shell command in a Linux sandbox (Node 22, Python 3.12, git, pnpm). Commands run in /workspace; installed packages and files you write there stay available to later calls in the same execution, but the working directory does not carry over \u2014 every call starts in /workspace again. Chain a directory change inside one command (`cd app && npm test`) or use absolute paths; a lone `cd` does nothing. Returns stdout, stderr, and exit code.",
     category: BuiltInToolCategory.SANDBOX,
     toolGroup: BuiltInToolGroup.SANDBOX_USE,
     providers: [BuiltInToolProvider.MULTI],
@@ -37831,7 +38090,7 @@ var CORE_BUILTIN_TOOLS_REGISTRY = [
       properties: {
         command: {
           type: "string",
-          description: "Shell command to execute (runs in bash)"
+          description: "Shell command to execute (runs in bash, cwd is /workspace)."
         },
         timeout: {
           type: "number",
@@ -37873,7 +38132,7 @@ var CORE_BUILTIN_TOOLS_REGISTRY = [
   {
     id: "sandbox:write_file",
     name: "Sandbox Write File",
-    description: "Write a file to the sandbox filesystem. Creates parent directories automatically. Use sandbox:exec to run files after writing them.",
+    description: "Write a file to the sandbox filesystem. Creates parent directories automatically. Relative paths resolve against /workspace, the directory every sandbox call starts in. Files written there stay available to later calls in the same execution. Use sandbox:exec to run files after writing them.",
     category: BuiltInToolCategory.SANDBOX,
     toolGroup: BuiltInToolGroup.SANDBOX_USE,
     providers: [BuiltInToolProvider.MULTI],
@@ -37882,7 +38141,7 @@ var CORE_BUILTIN_TOOLS_REGISTRY = [
       properties: {
         path: {
           type: "string",
-          description: "File path in the sandbox (e.g., /home/user/app/index.js)"
+          description: "File path in the sandbox (e.g. /workspace/app/index.js, or app/index.js relative to /workspace)"
         },
         content: {
           type: "string",
@@ -37898,7 +38157,7 @@ var CORE_BUILTIN_TOOLS_REGISTRY = [
   {
     id: "sandbox:read_file",
     name: "Sandbox Read File",
-    description: "Read a file from the sandbox filesystem. Returns the file content as a string.",
+    description: "Read a file from the sandbox filesystem. Relative paths resolve against /workspace, the directory every sandbox call starts in. Returns the file content as a string.",
     category: BuiltInToolCategory.SANDBOX,
     toolGroup: BuiltInToolGroup.SANDBOX_USE,
     providers: [BuiltInToolProvider.MULTI],
@@ -37907,7 +38166,7 @@ var CORE_BUILTIN_TOOLS_REGISTRY = [
       properties: {
         path: {
           type: "string",
-          description: "File path to read"
+          description: "File path to read (relative paths resolve against /workspace)"
         }
       },
       required: ["path"]
@@ -37944,7 +38203,7 @@ var CORE_BUILTIN_TOOLS_REGISTRY = [
   {
     id: "sandbox:git_checkout",
     name: "Sandbox Git Checkout",
-    description: "Clone a git repository into the sandbox. The repo is cloned into the current working directory.",
+    description: "Clone a git repository into the sandbox. The repo is cloned under /workspace, the directory every sandbox call starts in; reach it afterward with an explicit path (`cd <repo> && ...`), since the working directory does not carry over between calls.",
     category: BuiltInToolCategory.SANDBOX,
     toolGroup: BuiltInToolGroup.SANDBOX_USE,
     providers: [BuiltInToolProvider.MULTI],
@@ -37993,7 +38252,7 @@ var CORE_BUILTIN_TOOLS_REGISTRY = [
   {
     id: "sandbox:session_exec",
     name: "Sandbox Session Exec",
-    description: "Run a shell command in a specific sandbox identified by sandboxId.",
+    description: "Run a shell command in a specific sandbox identified by sandboxId. Commands run in /workspace; files stay available across calls but the working directory does not carry over \u2014 every call starts in /workspace again, so chain a directory change inside one command (`cd app && npm test`) or use absolute paths.",
     category: BuiltInToolCategory.SANDBOX,
     toolGroup: BuiltInToolGroup.SANDBOX_SESSION,
     providers: [BuiltInToolProvider.MULTI],
@@ -38006,7 +38265,7 @@ var CORE_BUILTIN_TOOLS_REGISTRY = [
         },
         command: {
           type: "string",
-          description: "Shell command to execute"
+          description: "Shell command to execute (runs in bash, cwd is /workspace)."
         },
         timeout: {
           type: "number",
@@ -38195,7 +38454,7 @@ var CORE_BUILTIN_TOOLS_REGISTRY = [
   {
     id: "bash",
     name: "Bash",
-    description: "Run a shell command on your Linux computer (Node 22, Python 3.12, git, pnpm, uv, ripgrep preinstalled). Commands run in /workspace; files you write there are available to later commands, but system-level changes outside /workspace may not persist. Combined stdout/stderr is returned. Prefer searching over dumping: use `rg`/`grep` to find the lines you need and `head`/`tail`/`sed -n` to read slices. Output is capped. If the command is still running at timeout_ms, it is NOT killed: bash returns a durable process_id and partial output. When the result has a deliveryId, pass it as ack_delivery_id on the next bash_output poll so newer output can advance. Poll only new output with bash_output, stop it with kill_process, or inspect handles with list_processes. Use run_in_background=true to yield immediately.",
+    description: "Run a shell command on your Linux computer (Node 22, Python 3.12, git, pnpm, uv, ripgrep preinstalled). Commands run in /workspace; files you write there are available to later commands, but system-level changes outside /workspace may not persist. Combined stdout/stderr is returned. Prefer searching over dumping: use `rg`/`grep` to find the lines you need and `head`/`tail`/`sed -n` to read slices. Output is capped. If the command is still running at timeout_ms, it is NOT killed: bash returns a durable process_id and partial output. When the result has a deliveryId, pass it as ack_delivery_id on the next bash_output poll so newer output can advance. Read only new output with bash_output (pass its wait_for_exit_ms to wait for the process rather than polling in a loop), stop it with kill_process, or inspect handles with list_processes. Use run_in_background=true to yield immediately.",
     category: BuiltInToolCategory.SANDBOX,
     toolGroup: BuiltInToolGroup.SANDBOX_AGENT,
     providers: [BuiltInToolProvider.MULTI],
@@ -38237,7 +38496,7 @@ var CORE_BUILTIN_TOOLS_REGISTRY = [
   {
     id: "bash_output",
     name: "Bash Output",
-    description: "Read only the new combined stdout/stderr produced after the last acknowledged delivery of a background bash process. Pass the previous successful bash or bash_output result's deliveryId as ack_delivery_id on the next poll; unacknowledged output is replayed so an API timeout cannot lose it. Acknowledge a terminal result's final delivery with one more poll so its bounded history record can retire. Returns status and an actual exitCode only after the process is terminal. Output is bounded and untrusted.",
+    description: "Read only the new combined stdout/stderr produced after the last acknowledged delivery of a background bash process. Do NOT poll in a tight loop: pass wait_for_exit_ms to wait server-side for the process to finish, so one call replaces many. Pass the previous successful bash or bash_output result's deliveryId as ack_delivery_id on the next poll; unacknowledged output is replayed so an API timeout cannot lose it. Acknowledge a terminal result's final delivery with one more poll so its bounded history record can retire. Returns status and an actual exitCode only after the process is terminal. Output is bounded and untrusted.",
     category: BuiltInToolCategory.SANDBOX,
     toolGroup: BuiltInToolGroup.SANDBOX_AGENT,
     providers: [BuiltInToolProvider.MULTI],
@@ -38256,6 +38515,10 @@ var CORE_BUILTIN_TOOLS_REGISTRY = [
           description: "deliveryId from the most recent successful bash or bash_output result for this process. Acknowledges that batch before reading newer output. Omit when no deliveryId has been received.",
           minLength: 1,
           maxLength: 64
+        },
+        wait_for_exit_ms: {
+          type: "number",
+          description: "Milliseconds to wait for the process to exit before returning. Use this instead of repeated polling when you expect the command to finish soon: it returns as soon as the process exits, or immediately if output is already waiting or the process has already finished. It waits for EXIT, so a process that prints progress as it goes still returns only at exit or at this deadline. Clamped to at most 240000 and to the time left in the turn; defaults to 0 (return whatever is available now)."
         }
       },
       required: ["process_id"]
@@ -45053,7 +45316,7 @@ var FLOW_STEP_TYPE_METADATA = {
     configHints: "recordId, recordType, recordName, recordFilter ({ type, where: { field, op, value } }), outputVariable (returns one object \u2014 access as {{var.field}})"
   },
   "list-records": {
-    description: "Load an ARRAY of records from the Runtype record store by type, name, or a chip-style recordFilter (metadata + top-level columns: id, name, createdAt, updatedAt), ordered by updated_at desc. Always returns an array \u2014 even for a single match \u2014 so index it in templates ({{var.0.field}}). Default limit 50 (max 1000).",
+    description: "Load an ARRAY of records from the Runtype record store by type, name, or a chip-style recordFilter (metadata + top-level columns: id, name, createdAt, updatedAt, schemaValid), ordered by updated_at desc. Always returns an array \u2014 even for a single match \u2014 so index it in templates ({{var.0.field}}). Default limit 50 (max 1000).",
     category: "data",
     isPrompt: false,
     configHints: "recordType, recordName, recordFilter ({ type, where: { field, op, value } }), limit (default 50, max 1000), onEmpty (succeed|fail), outputVariable (returns an array \u2014 index as {{var.0.field}})"
@@ -46026,7 +46289,7 @@ var FLOW_GENERATION_GUIDE = `## Flow Generation Guide
 - **conditional**: Branch logic. Either the binary shape (condition (JS expression), trueSteps, falseSteps) or N-way named branches (branches: [{ id, name, condition, steps }], evaluated first-match-wins, with otherwiseSteps as the fallback). Set outputVariable to merge whichever branch ran into one named result.
 - **fetch-url**: HTTP request. Config: http (url, method, headers, body), responseType, outputVariable. Optional fetchMethod: 'firecrawl' (structured extraction) or 'massive' (JS-rendered/blocked pages, with massive: { format, country, delay, expiration }) instead of a raw fetch
 - **api-call**: Structured API call. Config: http, auth, responseMapping, outputVariable
-- **get-record**: Load a SINGLE record OBJECT. Config: recordId, OR recordType + recordName, OR recordFilter ({ type, where: { field, op, value } }) for richer metadata-aware queries; outputVariable. Reachable filter columns include id, name, createdAt, updatedAt plus any metadata key. Returns one object \u2014 access fields directly in templates (\`{{record.field}}\`). On multiple matches the first by updated_at desc wins; fails if none match.
+- **get-record**: Load a SINGLE record OBJECT. Config: recordId, OR recordType + recordName, OR recordFilter ({ type, where: { field, op, value } }) for richer metadata-aware queries; outputVariable. Reachable filter columns include id, name, createdAt, updatedAt, schemaValid (the collection-validation stamp) plus any metadata key. Returns one object \u2014 access fields directly in templates (\`{{record.field}}\`). On multiple matches the first by updated_at desc wins; fails if none match.
 - **list-records**: Load an ARRAY of records. Config: recordType, recordName, OR recordFilter ({ type, where: { field, op, value } }); limit (default 50, max 1000), onEmpty (succeed|fail, default succeed), outputVariable. Ordered by updated_at desc. Always writes an array \u2014 even for a single match \u2014 so index it in templates (\`{{records.0.field}}\` or \`{{records[0].field}}\`); object-style access (\`{{records.field}}\`) on the array resolves to undefined.
 - **retrieve-record**: DEPRECATED \u2014 use get-record (single object) or list-records (array). Still accepted at write and aliased at execution onto one of them; its return shape is inferred from the lookup method (recordId \u2192 object, type/name/filter \u2192 array), which is the ambiguity the successors remove.
 - **upsert-record**: Create/update a record keyed by \`(recordType, recordName)\` per owner. Config: recordType, **recordName** (REQUIRED for upsert semantics \u2014 without it each run creates a fresh \`\${recordType}-\${Date.now()}\` record), sourceVariable (the JSON metadata payload only \u2014 do NOT wrap as \`{ name, type, metadata }\`; the wrapper gets stored verbatim), outputVariable. See "Record-Keyed Upsert Patterns" in the build-product instructions for the full anti-pattern list (silent timestamped fallback, wrapped-source footgun, JSONB-blob aggregate races).
@@ -46855,7 +47118,15 @@ var FlowInputSchema = external_exports.object({
   name: external_exports.string().min(1).optional(),
   description: external_exports.string().optional(),
   steps: external_exports.array(external_exports.any()).optional(),
-  contentHash: external_exports.string().length(64).optional()
+  contentHash: external_exports.string().length(64).optional(),
+  // An inline/virtual flow may embed an agent registry (an `agents` map,
+  // mirroring `ExportedFlowDefinition.agents`) so the lane-routing eligibility
+  // analyzer and the runtime leg can resolve `execute-agent` refs against it
+  // instead of folding a resolvable embedded ref to legacy (or failing with
+  // AGENT_NOT_RESOLVED at execution). Optional and backward-compatible: flows
+  // without embedded agents omit it, and the values pass through verbatim so
+  // the full ExportedAgent shape survives the schema boundary.
+  agents: external_exports.record(external_exports.string(), external_exports.any()).optional()
 }).refine(
   (data) => {
     const hasFlowId = !!data.id;
@@ -47394,7 +47665,12 @@ var RuntimeStoredRecordSchema = external_exports.object({
   userId: external_exports.string(),
   organizationId: external_exports.string().nullable(),
   createdAt: external_exports.string(),
-  updatedAt: external_exports.string()
+  updatedAt: external_exports.string(),
+  metadataSchema: external_exports.record(external_exports.string(), external_exports.unknown()).nullable().optional(),
+  metadataLabels: external_exports.record(external_exports.string(), external_exports.string()).nullable().optional(),
+  schemaValid: external_exports.boolean().nullable().optional(),
+  messages: external_exports.array(external_exports.object({ role: external_exports.string(), content: external_exports.string() })).nullable().optional(),
+  productSurfaceId: external_exports.string().nullable().optional()
 });
 var FILTER_FIELD_NAME_RE = /^[a-zA-Z0-9_][a-zA-Z0-9_.-]{0,63}$/;
 var runtimeRecordFilterConditionSchema = external_exports.object({
@@ -47714,6 +47990,167 @@ var appDataGrantSchema = external_exports.object({
   // this field directly.
   writePolicy: external_exports.enum(["app", "creator"]).optional()
 });
+var APP_CSP_DIRECTIVES = [
+  "default-src",
+  "script-src",
+  "script-src-elem",
+  "script-src-attr",
+  "style-src",
+  "style-src-elem",
+  "style-src-attr",
+  "img-src",
+  "media-src",
+  "font-src",
+  "connect-src",
+  "frame-src",
+  "child-src",
+  "worker-src",
+  "object-src",
+  "manifest-src",
+  "form-action",
+  "base-uri",
+  "frame-ancestors"
+];
+var APP_CSP_KEYWORD_SOURCES = [
+  "'self'",
+  "'none'",
+  "'unsafe-inline'",
+  "'unsafe-eval'",
+  "'wasm-unsafe-eval'",
+  "'strict-dynamic'",
+  "'report-sample'"
+];
+var APP_CSP_SCHEME_SOURCES = ["https:", "data:", "blob:", "wss:", "mediastream:"];
+var APP_CSP_HOST_SOURCE_PATTERN = /^(https|wss):\/\/(\*\.)?[a-z0-9-]+(\.[a-z0-9-]+)*(:\d{1,5})?$/i;
+var APP_CSP_LIMITS = {
+  maxSourcesPerDirective: 20,
+  sourceMaxLength: 256
+};
+var APP_RESPONSE_HEADER_LIMITS = {
+  maxEntries: 20,
+  nameMaxLength: 128,
+  valueMaxLength: 1024
+};
+var APP_RESPONSE_HEADER_NAME_PATTERN = /^[a-zA-Z0-9-]+$/;
+var APP_DENIED_RESPONSE_HEADERS = {
+  "content-security-policy": 'Use the manifest "csp" field instead.',
+  "content-type": "Content types are inferred from the file extension.",
+  "content-length": "Runtype sets transport headers for the served response.",
+  "content-encoding": "Runtype sets transport headers for the served response.",
+  "transfer-encoding": "Runtype sets transport headers for the served response.",
+  connection: "Runtype sets transport headers for the served response.",
+  etag: "The ETag is derived from the stored bundle file.",
+  "cache-control": "Runtype owns caching so activating an older version takes effect immediately.",
+  "set-cookie": "Apps authenticate through the injected client token, not cookies.",
+  "x-robots-tag": "Indexing follows the app's visibility setting.",
+  "x-content-type-options": "Runtype always sends nosniff.",
+  "strict-transport-security": "HSTS is set for the whole serving domain.",
+  location: "Served bundle files are static content and never redirect."
+};
+function isAllowedAppCspDirective(name) {
+  return APP_CSP_DIRECTIVES.includes(name);
+}
+function isValidAppCspSource(source) {
+  if (source.length === 0 || source.length > APP_CSP_LIMITS.sourceMaxLength) return false;
+  if (APP_CSP_KEYWORD_SOURCES.includes(source)) return true;
+  if (APP_CSP_SCHEME_SOURCES.includes(source)) return true;
+  return APP_CSP_HOST_SOURCE_PATTERN.test(source);
+}
+function appResponseHeaderDenialReason(name) {
+  return APP_DENIED_RESPONSE_HEADERS[name.toLowerCase()] ?? null;
+}
+var APP_CSP_SOURCE_HELP = `Use a quoted keyword (${APP_CSP_KEYWORD_SOURCES.join(
+  ", "
+)}), a scheme (${APP_CSP_SCHEME_SOURCES.join(", ")}), or an https/wss origin such as https://cdn.example.com`;
+var appCspOverridesSchema = external_exports.record(external_exports.string(), external_exports.array(external_exports.string())).superRefine((overrides, ctx) => {
+  for (const [directive, sources] of Object.entries(overrides)) {
+    if (!isAllowedAppCspDirective(directive)) {
+      ctx.addIssue({
+        code: "custom",
+        path: [directive],
+        message: `Unsupported CSP directive "${directive}". Allowed directives: ${APP_CSP_DIRECTIVES.join(", ")}.`
+      });
+      continue;
+    }
+    if (sources.length === 0) {
+      ctx.addIssue({
+        code: "custom",
+        path: [directive],
+        message: `CSP directive "${directive}" needs at least one source. Use "'none'" to block everything.`
+      });
+      continue;
+    }
+    if (sources.length > APP_CSP_LIMITS.maxSourcesPerDirective) {
+      ctx.addIssue({
+        code: "custom",
+        path: [directive],
+        message: `CSP directive "${directive}" has ${sources.length} sources, which exceeds the ${APP_CSP_LIMITS.maxSourcesPerDirective}-source limit.`
+      });
+      continue;
+    }
+    for (const [index, source] of sources.entries()) {
+      if (source.length > APP_CSP_LIMITS.sourceMaxLength) {
+        ctx.addIssue({
+          code: "custom",
+          path: [directive, index],
+          message: `CSP source in "${directive}" exceeds the ${APP_CSP_LIMITS.sourceMaxLength}-character limit.`
+        });
+        continue;
+      }
+      if (!isValidAppCspSource(source)) {
+        ctx.addIssue({
+          code: "custom",
+          path: [directive, index],
+          message: `CSP directive "${directive}" has an unsupported source "${source}". ${APP_CSP_SOURCE_HELP}.`
+        });
+      }
+    }
+  }
+});
+var appResponseHeaderOverridesSchema = external_exports.record(external_exports.string(), external_exports.string()).superRefine((headers, ctx) => {
+  const entries = Object.entries(headers);
+  if (entries.length > APP_RESPONSE_HEADER_LIMITS.maxEntries) {
+    ctx.addIssue({
+      code: "custom",
+      message: `${entries.length} response headers exceeds the ${APP_RESPONSE_HEADER_LIMITS.maxEntries}-header limit.`
+    });
+    return;
+  }
+  for (const [name, value] of entries) {
+    if (name.length > APP_RESPONSE_HEADER_LIMITS.nameMaxLength || !APP_RESPONSE_HEADER_NAME_PATTERN.test(name)) {
+      ctx.addIssue({
+        code: "custom",
+        path: [name],
+        message: `Response header name "${name}" is invalid. Use letters, digits, and hyphens only (max ${APP_RESPONSE_HEADER_LIMITS.nameMaxLength} characters).`
+      });
+      continue;
+    }
+    const denied = appResponseHeaderDenialReason(name);
+    if (denied) {
+      ctx.addIssue({
+        code: "custom",
+        path: [name],
+        message: `Response header "${name}" is set by Runtype and cannot be overridden. ${denied}`
+      });
+      continue;
+    }
+    if (/[\r\n]/.test(value)) {
+      ctx.addIssue({
+        code: "custom",
+        path: [name],
+        message: `Response header "${name}" must not contain a carriage return or newline.`
+      });
+      continue;
+    }
+    if (value.length > APP_RESPONSE_HEADER_LIMITS.valueMaxLength) {
+      ctx.addIssue({
+        code: "custom",
+        path: [name],
+        message: `Response header "${name}" exceeds the ${APP_RESPONSE_HEADER_LIMITS.valueMaxLength}-character value limit.`
+      });
+    }
+  }
+});
 var appManifestSchema = external_exports.object({
   name: external_exports.string().min(1).max(APP_MANIFEST_LIMITS.nameMaxLength),
   description: external_exports.string().max(2e3).optional(),
@@ -47722,7 +48159,9 @@ var appManifestSchema = external_exports.object({
     agents: external_exports.array(external_exports.string()).max(APP_MANIFEST_LIMITS.maxAgents).default([])
   }).strict().default({ flows: [], agents: [] }),
   data: external_exports.array(appDataGrantSchema).max(APP_MANIFEST_LIMITS.maxDataNamespaces).default([]),
-  auth: external_exports.enum(["none", "optional", "required"]).default("none")
+  auth: external_exports.enum(["none", "optional", "required"]).default("none"),
+  csp: appCspOverridesSchema.optional(),
+  headers: appResponseHeaderOverridesSchema.optional()
 }).strict();
 var appRoutingDocSchema = external_exports.object({
   appId: external_exports.string(),
@@ -47739,6 +48178,20 @@ var appRoutingDocSchema = external_exports.object({
     apiUrl: external_exports.string(),
     clientToken: external_exports.string().nullable()
   }),
+  /**
+   * The active manifest's serving policy, copied forward on activation.
+   * Optional so routing docs written before this field keep parsing.
+   *
+   * The SHAPE is validated here but the CONTENT deliberately is not: a doc
+   * whose csp/headers fail the stricter manifest rules must still parse, or a
+   * single bad value would take the whole app off the air. The edge runs
+   * `sanitizeAppCspOverrides` / `sanitizeAppResponseHeaders` at header-build
+   * time and falls back to the platform default for anything it rejects.
+   */
+  serving: external_exports.object({
+    csp: external_exports.record(external_exports.string(), external_exports.array(external_exports.string())).optional(),
+    headers: external_exports.record(external_exports.string(), external_exports.string()).optional()
+  }).optional(),
   updatedAt: external_exports.string()
 });
 var SKILL_SCAN_HARD_BLOCK_CATEGORIES = [
@@ -47775,6 +48228,9 @@ function getDevPlanOverride() {
   return process.env.RUNTYPE_DEV_PLAN_OVERRIDE;
 }
 
+// src/lib/sdk-client.ts
+import { createClient } from "@runtypelabs/sdk";
+
 // src/lib/cli-version.ts
 import { readFileSync as readFileSync2 } from "fs";
 import { dirname, join } from "path";
@@ -47839,6 +48295,24 @@ var isAuthMeResponse = (value) => {
   const record2 = value;
   return typeof record2.userId === "string";
 };
+var ApiKeyValidationUnavailableError = class extends Error {
+  constructor(message, statusCode, options) {
+    super(message, options);
+    this.statusCode = statusCode;
+    this.name = "ApiKeyValidationUnavailableError";
+  }
+  statusCode;
+};
+var describeUnverifiableStatus = (statusCode, apiUrl) => {
+  const answered = `Could not verify the API key: the API at ${apiUrl} answered HTTP ${statusCode}`;
+  if (statusCode === 403 || statusCode === 407) {
+    return `${answered} (this can be an egress proxy or firewall blocking ${apiUrl}, not an invalid key)`;
+  }
+  if (statusCode >= 500) {
+    return `${answered} (the API or something in front of it is failing, not an invalid key). Try again shortly.`;
+  }
+  return `${answered}, which is neither a success nor a credential rejection, so the key was not verified.`;
+};
 var ApiKeyManager = class {
   /**
    * Exchange a Clerk session JWT for a persistent API key.
@@ -47868,14 +48342,32 @@ var ApiKeyManager = class {
     }
     return result;
   }
+  /**
+   * Resolve whether the API accepts this key.
+   *
+   * `false` means strictly "the API looked at these credentials and rejected
+   * them". Anything that leaves the key unchecked throws instead — the SDK
+   * mints a `RuntypeApiError` for every non-2xx response, so returning false
+   * for all of them reported an intercepting proxy's 403, a 407, or an API
+   * 5xx as "Invalid API key" and sent people hunting for a credential problem
+   * that did not exist.
+   */
   async validateApiKey(apiKey, apiUrl) {
-    const client = createCliClient(apiKey, apiUrl);
+    const resolvedApiUrl = apiUrl || getApiUrl();
+    const client = createCliClient(apiKey, resolvedApiUrl);
     try {
       await client.get("/users/profile");
       return true;
     } catch (error51) {
       if (error51 instanceof RuntypeApiError) {
-        return false;
+        if (error51.statusCode === 401) {
+          return false;
+        }
+        throw new ApiKeyValidationUnavailableError(
+          describeUnverifiableStatus(error51.statusCode, resolvedApiUrl),
+          error51.statusCode,
+          { cause: error51 }
+        );
       }
       throw error51;
     }
@@ -48549,6 +49041,10 @@ var NON_TTY_LOGIN_GUIDANCE = {
     "Existing account: ask the user for an API key from the dashboard (Settings > API keys), then run: runtype auth login --api-key <key>"
   ]
 };
+var API_UNREACHABLE_NEXT = [
+  "Confirm this environment can reach the Runtype API directly over HTTPS.",
+  "If egress is restricted, allowlist api.runtype.com (staging: api.runtype-staging.com), then re-run: runtype auth login --api-key <key>"
+];
 function refuseForcedTtyLogin(options) {
   if (options.tty === true && process.stdout.isTTY !== true) {
     console.error(
@@ -48661,6 +49157,21 @@ async function loginAction(options) {
           )
         );
       } catch (error51) {
+        if (error51 instanceof ApiKeyValidationUnavailableError) {
+          console.error(
+            JSON.stringify(
+              {
+                status: "error",
+                code: "api_unreachable",
+                error: error51.message,
+                next: API_UNREACHABLE_NEXT
+              },
+              null,
+              2
+            )
+          );
+          process.exit(1);
+        }
         const message = error51 instanceof Error ? error51.message : "Unknown error";
         console.error(JSON.stringify({ status: "error", error: message }, null, 2));
         process.exit(1);
@@ -49131,7 +49642,11 @@ async function ensureAuth(options) {
       if (isValid) {
         return envApiKey;
       }
-    } catch {
+    } catch (error51) {
+      if (error51 instanceof ApiKeyValidationUnavailableError) {
+        console.error(chalk4.yellow(`
+${error51.message}`));
+      }
     }
   }
   const store = new CredentialStore();
@@ -54001,6 +54516,7 @@ function InitApp({ apiUrl, onComplete }) {
     const checkAndAuth = async () => {
       const store = new CredentialStore();
       const existingKey = await store.getApiKey();
+      let storedKeyNotice = null;
       if (existingKey) {
         const apiKeyManager = new ApiKeyManager();
         try {
@@ -54019,14 +54535,15 @@ function InitApp({ apiUrl, onComplete }) {
             }));
             return;
           }
-        } catch {
+        } catch (err) {
+          storedKeyNotice = err instanceof Error ? err.message : String(err);
         }
       }
       setState((prev) => ({
         ...prev,
         step: 1,
         loading: true,
-        loadingLabel: "Opening browser to sign in..."
+        loadingLabel: storedKeyNotice ? `${storedKeyNotice} Opening browser to sign in instead...` : "Opening browser to sign in..."
       }));
       try {
         const oauth = new OAuthManager({
@@ -54534,6 +55051,21 @@ var initCommand = new Command14("init").description("Set up Runtype CLI with gui
           )
         );
       } catch (error51) {
+        if (error51 instanceof ApiKeyValidationUnavailableError) {
+          console.error(
+            JSON.stringify(
+              {
+                status: "error",
+                code: "api_unreachable",
+                error: error51.message,
+                next: "If egress is restricted, allowlist api.runtype.com (staging: api.runtype-staging.com), then re-run: runtype init --api-key <key>"
+              },
+              null,
+              2
+            )
+          );
+          process.exit(1);
+        }
         const message = error51 instanceof Error ? error51.message : "Authentication failed";
         console.error(
           JSON.stringify({ status: "error", error: message }, null, 2)
@@ -70337,7 +70869,10 @@ async function getPersonaInitApiKeyNonInteractive(apiUrl) {
       if (isValid) {
         return envApiKey;
       }
-    } catch {
+    } catch (error51) {
+      if (error51 instanceof ApiKeyValidationUnavailableError) {
+        console.error(error51.message);
+      }
     }
   }
   const store = new CredentialStore();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runtypelabs/cli",
-  "version": "2.33.0",
+  "version": "2.33.1",
   "description": "Command-line interface for Runtype AI platform",
   "type": "module",
   "main": "dist/index.js",
@@ -27,7 +27,7 @@
     "rosie-skills": "0.8.1",
     "yaml": "^2.9.0",
     "@runtypelabs/ink-components": "0.3.6",
-    "@runtypelabs/sdk": "6.6.0",
+    "@runtypelabs/sdk": "6.6.1",
     "@runtypelabs/terminal-animations": "0.2.3"
   },
   "devDependencies": {
@@ -36,14 +36,14 @@
     "@types/express": "^5.0.6",
     "@types/micromatch": "^4.0.9",
     "@types/node": "^25.3.3",
-    "@types/react": "^19.2.17",
+    "@types/react": "^19.2.18",
     "@vitest/coverage-v8": "^4.1.5",
     "ink-testing-library": "4.0.0",
     "tsup": "^8.0.2",
     "tsx": "^4.7.1",
     "typescript": "^6.0.3",
     "vitest": "^4.1.0",
-    "@runtypelabs/shared": "3.15.0"
+    "@runtypelabs/shared": "3.17.0"
   },
   "engines": {
     "node": ">=22.12.0"