@runtypelabs/cli 2.35.1 → 2.35.2

package/dist/index.js

@@ -17162,7 +17162,7 @@ var BuiltInToolIdPrefix = {
   PLATFORM: "platform"
 };
 
-// ../shared/dist/chunk-NWSU7U4C.mjs
+// ../shared/dist/chunk-3LDIAPYZ.mjs
 function sanitizeToolNameForAiSdk(name) {
   return name.replace(/[^a-zA-Z0-9_]/g, "_").toLowerCase().replace(/_+/g, "_").replace(/^_|_$/g, "");
 }
@@ -17551,7 +17551,7 @@ var recordCollectionSchemaSchema = external_exports.strictObject({
   additionalProperties: external_exports.boolean().optional()
 }).superRefine((schema, ctx) => addSemanticIssues(schema, ctx));
 
-// ../shared/dist/chunk-CUYPH2YF.mjs
+// ../shared/dist/chunk-WN6ECZUE.mjs
 var MCPServerCategory = {
   COMMUNICATION: "communication",
   PRODUCTIVITY: "productivity",
@@ -17573,7 +17573,11 @@ var subagentExecutionConfigSchema = external_exports.object({
 var subagentRunHandleSchema = external_exports.object({
   kind: external_exports.literal("subagent_run"),
   runId: external_exports.string(),
-  agentType: external_exports.enum(["runtype", "claude_managed"]),
+  /**
+   * Which durable lane the child executes on. `'durable'` is the ADR 0020
+   * session DO; `'runtype'` is the in-process detached-run DO.
+   */
+  agentType: external_exports.enum(["runtype", "claude_managed", "durable"]),
   status: external_exports.enum(["queued", "running"]),
   startedAt: external_exports.string()
 });
@@ -21214,7 +21218,7 @@ var UNIFIED_SSE_EVENT_TYPES = _unifiedTuple([
   "custom"
 ]);
 
-// ../shared/dist/chunk-FYZWAHYL.mjs
+// ../shared/dist/chunk-5XPR3WY2.mjs
 var mediaAnnotationsSchema = external_exports.object({
   audience: external_exports.array(external_exports.enum(["user", "assistant"])).optional()
 });
@@ -21223,7 +21227,9 @@ var mediaContentPartSchema = external_exports.union([
     type: external_exports.literal("media"),
     data: external_exports.string(),
     mediaType: external_exports.string(),
-    annotations: mediaAnnotationsSchema.optional()
+    annotations: mediaAnnotationsSchema.optional(),
+    /** Tool-result media handle (`MediaResultRef`); present once the bytes were stored. */
+    ref: external_exports.object({ uri: external_exports.string(), assetId: external_exports.string(), sizeBytes: external_exports.number() }).optional()
   }),
   external_exports.object({
     type: external_exports.literal("image-url"),
@@ -22491,7 +22497,8 @@ var AGENT_CONTENT_CONFIG_KEYS = {
   temporal: true,
   memory: true,
   sandbox: true,
-  tenancyStrategy: true
+  tenancyStrategy: true,
+  durability: true
 };
 var AGENT_CONTENT_CONFIG_KEY_LIST = Object.keys(AGENT_CONTENT_CONFIG_KEYS).sort();
 function stripTrailingChars(value, char) {
@@ -22820,6 +22827,474 @@ var MAX_MESSAGE_CONTENT_BYTES = 1024 * 1024;
 var MAX_MESSAGES_TOTAL_BYTES = 32 * 1024 * 1024;
 var encoder = new TextEncoder();
 var UNEVALUATED_VERDICT = Object.freeze({ status: "unevaluated" });
+var tenancyAssuranceLevelSchema = external_exports.enum(["anonymous", "asserted", "verified"]);
+var tenancyStrategyPresetSchema = external_exports.enum([
+  "internal",
+  "tenant-isolated",
+  "end-user-isolated"
+]);
+var tenancyAssuranceFloorSchema = external_exports.enum(["asserted", "verified"]);
+var tenancyStrategySchema = external_exports.object({
+  preset: tenancyStrategyPresetSchema,
+  assuranceFloor: external_exports.object({
+    tenant: tenancyAssuranceFloorSchema.optional(),
+    endUser: tenancyAssuranceFloorSchema.optional()
+  }).strict().optional()
+}).strict();
+var MCP_HTTP_HEADER_NAME_PATTERN = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
+function isValidMCPHTTPHeaderValue(value) {
+  for (let index = 0; index < value.length; index += 1) {
+    const code = value.charCodeAt(index);
+    if (code === 9 || code >= 32 && code <= 126 || code >= 128 && code <= 255) {
+      continue;
+    }
+    return false;
+  }
+  return true;
+}
+var INCOMPATIBLE_HEADERS_AUTH_FIELDS = [
+  "headerName",
+  "token",
+  "username",
+  "password",
+  "tokenSecretName",
+  "usernameSecretName",
+  "passwordSecretName",
+  "oauth2"
+];
+function validateMCPHeadersAuth(auth) {
+  if (!auth) return { valid: true };
+  if (auth.type !== "headers") {
+    if (auth.headers !== void 0) {
+      return {
+        valid: false,
+        code: "headers_wrong_type",
+        message: "The headers field is only valid with auth type 'headers'",
+        path: ["headers"]
+      };
+    }
+    return { valid: true };
+  }
+  for (const field of INCOMPATIBLE_HEADERS_AUTH_FIELDS) {
+    if (auth[field] !== void 0) {
+      return {
+        valid: false,
+        code: "incompatible_auth_field",
+        message: `Auth type 'headers' cannot also set ${field}`,
+        path: [field]
+      };
+    }
+  }
+  if (typeof auth.headers !== "object" || auth.headers === null || Array.isArray(auth.headers) || Object.keys(auth.headers).length === 0) {
+    return {
+      valid: false,
+      code: "headers_required",
+      message: "Auth type 'headers' requires a non-empty headers record",
+      path: ["headers"]
+    };
+  }
+  const normalizedNames = /* @__PURE__ */ new Set();
+  for (const [name, value] of Object.entries(auth.headers)) {
+    if (!MCP_HTTP_HEADER_NAME_PATTERN.test(name)) {
+      return {
+        valid: false,
+        code: "invalid_header_name",
+        message: `Invalid HTTP header name "${name}"`,
+        path: ["headers", name]
+      };
+    }
+    if (typeof value !== "string") {
+      return {
+        valid: false,
+        code: "invalid_header_value",
+        message: `Header "${name}" must have a string value`,
+        path: ["headers", name]
+      };
+    }
+    if (!isValidMCPHTTPHeaderValue(value)) {
+      return {
+        valid: false,
+        code: "invalid_header_value",
+        message: `Header "${name}" contains characters that are not valid in an HTTP header value`,
+        path: ["headers", name]
+      };
+    }
+    const normalizedName = name.toLowerCase();
+    if (normalizedNames.has(normalizedName)) {
+      return {
+        valid: false,
+        code: "duplicate_header_name",
+        message: `Header name "${name}" is duplicated case-insensitively`,
+        path: ["headers", name]
+      };
+    }
+    normalizedNames.add(normalizedName);
+  }
+  return { valid: true };
+}
+var REASONING_BUDGET_BOUNDS = {
+  /** Anthropic extended thinking (`thinking: { type: 'enabled', budgetTokens }`). */
+  budgetTokens: { min: 1e3, max: 1e5 },
+  /** Gemini 2.5 thinking budget (`thinkingConfig.thinkingBudget`). */
+  thinkingBudget: { min: 1024, max: 65536 }
+};
+var reasoningConfigSchema = external_exports.union([
+  external_exports.boolean(),
+  external_exports.object({
+    enabled: external_exports.boolean(),
+    // OpenAI GPT-5 and o-series
+    reasoningEffort: external_exports.enum(["minimal", "low", "medium", "high", "xhigh"]).optional(),
+    reasoningSummary: external_exports.enum(["auto", "detailed"]).optional(),
+    // Anthropic Claude
+    budgetTokens: external_exports.number().int().min(REASONING_BUDGET_BOUNDS.budgetTokens.min).max(REASONING_BUDGET_BOUNDS.budgetTokens.max).optional(),
+    // Anthropic ADAPTIVE thinking (Claude 4.6 and later, including the Claude 5 family): maps to output_config.effort.
+    // Free-form because the accepted ladder is per-model catalog data
+    // (`ModelReasoningOptions.effort`) and carries rungs outside the
+    // `reasoningEffort` union, such as 'max'. The save-time check is the flow
+    // validator's REASONING_KNOB_UNSUPPORTED advisory, not this schema: a
+    // hand-kept enum here would reject a rung the model added upstream.
+    effort: external_exports.string().min(1).max(32).optional(),
+    // Google Gemini
+    thinkingBudget: external_exports.number().int().min(REASONING_BUDGET_BOUNDS.thinkingBudget.min).max(REASONING_BUDGET_BOUNDS.thinkingBudget.max).optional(),
+    // Gemini 3+ level mode; mutually exclusive with thinkingBudget per model.
+    thinkingLevel: external_exports.string().min(1).max(32).optional(),
+    includeThoughts: external_exports.boolean().optional()
+  })
+]);
+var samplingConfigSchema = {
+  topP: external_exports.number().min(0).max(1).optional(),
+  topK: external_exports.number().int().min(1).max(500).optional(),
+  frequencyPenalty: external_exports.number().min(-2).max(2).optional(),
+  presencePenalty: external_exports.number().min(-2).max(2).optional(),
+  seed: external_exports.number().int().optional()
+};
+var errorHandlingSchema = external_exports.object({
+  onError: external_exports.enum(["fail", "continue", "fallback"]),
+  fallbacks: external_exports.array(
+    external_exports.discriminatedUnion("type", [
+      external_exports.object({
+        type: external_exports.literal("retry"),
+        delay: external_exports.number().int().min(0).max(6e4).optional()
+      }),
+      external_exports.object({
+        type: external_exports.literal("model"),
+        model: external_exports.string(),
+        temperature: external_exports.number().min(0).max(2).optional(),
+        maxTokens: external_exports.number().int().min(1).optional(),
+        delay: external_exports.number().int().min(0).max(6e4).optional()
+      }),
+      external_exports.object({
+        type: external_exports.literal("message"),
+        message: external_exports.string(),
+        delay: external_exports.number().int().min(0).max(6e4).optional()
+      })
+    ])
+  ).optional(),
+  // Conditions that activate the fallback chain. Mirrors PromptErrorHandling.triggers;
+  // defaults to error-only when omitted.
+  triggers: external_exports.array(external_exports.object({ type: external_exports.enum(["error", "empty-output"]) })).optional()
+}).optional();
+var artifactConfigSchema = external_exports.object({
+  enabled: external_exports.literal(true),
+  types: external_exports.array(external_exports.enum(["markdown", "component"])).min(1)
+});
+var temporalConfigSchema = external_exports.object({
+  injectElapsed: external_exports.boolean().optional(),
+  elapsedThresholdSeconds: external_exports.number().int().min(0).optional(),
+  groundNow: external_exports.boolean().optional(),
+  timezone: external_exports.string().optional()
+});
+var memoryConfigSchema = external_exports.object({
+  enabled: external_exports.boolean(),
+  profileTemplate: external_exports.string().optional(),
+  // When omitted and `enabled` is true, treated as `true` (smart default): a
+  // Markdown memory summary is woven into the agent's system prompt on each
+  // turn so the agent always has the user in context — without the model having
+  // to call `recall_memory` first. (The summary is cached per profile so the
+  // synthesis cost is paid once, not on every turn.) Set false to skip
+  // injection (focused task agents that don't benefit from a profile overview).
+  // Resolved via `shouldInjectMemorySummary` so the default lives in one place.
+  injectSummary: external_exports.boolean().optional()
+});
+var sandboxNetworkAccessSchema = external_exports.union([
+  external_exports.enum(["none", "essentials", "open"]),
+  external_exports.object({
+    profile: external_exports.enum(["none", "essentials", "open"]).optional(),
+    allow: external_exports.array(external_exports.string()).optional()
+  })
+]);
+var sandboxConfigSchema = external_exports.object({
+  enabled: external_exports.boolean(),
+  // INERT except `'runtype-sandbox'`: the agent-sandbox runtime
+  // (`SandboxToolService`) REJECTS any provider other than `'runtype-sandbox'`
+  // with a throw at the first sandbox tool call — `'daytona'` is NOT honored on
+  // this path (Phase 3 "Daytona parity" is unshipped). Kept parseable (not
+  // narrowed to `['runtype-sandbox']`) so a stored/imported `'daytona'` config
+  // does not fail agent-config parse, and so this schema stays aligned with the
+  // FPO public-types mirror + MCP snapshot that still list it. Selecting
+  // `'daytona'` is an author-time no-op that surfaces as a runtime error.
+  // (`quickjs` / `cloudflare-worker` are code-eval only, no shell — never valid.)
+  provider: external_exports.enum(["runtype-sandbox", "daytona"]).optional(),
+  // `'ephemeral'` and `'conversation'` (the default) are implemented.
+  // `'named'` is parseable but NOT yet implemented: the runtime silently
+  // degrades `'named'` to `'ephemeral'` (with a debug log) — no durable
+  // cross-conversation workspace exists yet (Phase 3). Kept parseable so a
+  // stored `'named'` config still loads; it just behaves as `'ephemeral'`.
+  persistence: external_exports.enum(["ephemeral", "conversation", "named"]).optional(),
+  // INERT on the agent sandbox path: `instanceType` is NOT honored — the agent
+  // sandbox always provisions `standard-4` (the blanket default fixed by
+  // apps/sandbox/wrangler.toml `[[containers]]`) regardless of this value (the
+  // value is read for the transform-data/deploy sandbox billing paths, not for
+  // the agent builtin tools). Kept parseable for forward-compat + mirror
+  // alignment; treat it as a no-op author-time hint until the agent path wires
+  // per-plan container sizing.
+  instanceType: external_exports.enum(["standard-1", "standard-2", "standard-3", "standard-4"]).optional(),
+  networkAccess: sandboxNetworkAccessSchema.optional(),
+  ttl: external_exports.enum(["5m", "1h", "24h", "unlimited"]).optional(),
+  sleepAfter: external_exports.enum(["5m", "15m", "30m", "1h"]).optional(),
+  // Operator-authored bootstrap commands. The API runs this batch once after
+  // enforcing the sandbox's network policy and before the first model-authored
+  // sandbox verb. Commands run in order from /workspace and must be foreground,
+  // self-contained, and safe to retry after an interrupted container runtime;
+  // the credential-bearing exec supervisor deliberately reaps every descendant
+  // before a command returns, so setup cannot launch a daemon meant to outlive
+  // it. Trusted Durable Object state plus a run-scoped memo prevents the batch
+  // from being repeated for the same provisioned workspace. Changing the
+  // commands or managed-secret KEY bindings creates a fresh sandbox identity;
+  // rotating a value under the same key does not rerun setup.
+  setupCommands: external_exports.array(external_exports.string().min(1, "setup commands must not be empty")).optional(),
+  // Credential environment available ONLY to the operator-authored setup batch
+  // above — never to a model-authored `bash` command. Keys are env var names;
+  // values are MANAGED SECRET KEYS (e.g. `GITHUB_CLONE_TOKEN`), never raw
+  // credential values. The API resolves them immediately before setup and
+  // delivers them out-of-band over `cloudflareSandboxExecWithSecretEnv`, so the
+  // values never appear in command strings, model-facing tool schemas, logs, or
+  // spill files. Like `networkAccess`, both fields are operator Definition: the
+  // model cannot author setup, name a managed secret, or grant itself one.
+  //
+  // TRUST BOUNDARY — read before configuring this. Every process started by a
+  // credentialed setup batch can read the injected values. Keep setup authored
+  // and reviewed by the operator; do not run model-, attacker-, or
+  // supply-chain-authored code (for example an install script) while credentials
+  // are present, and never persist a raw credential into /workspace for later
+  // model access. The secret supervisor freezes pre-existing processes, reaps
+  // every setup descendant, and destroys the sandbox fail-closed if cleanup
+  // fails, but output redaction remains defense-in-depth rather than permission
+  // to echo or transform a credential.
+  // Therefore:
+  //   - Prefer `credentialProxies` (phantom tokens, swapped at the egress
+  //     proxy) for any HTTP(S) protocol it supports — the real credential
+  //     never enters the container at all.
+  //   - Scope the secret as narrowly as the provider allows (read-only,
+  //     single-repo) and pair it with a tight `networkAccess` profile.
+  //   - Keep credentialed setup separate from later uncredentialed dependency
+  //     installation and model-authored work.
+  // Name shape and the 32-entry cap mirror the sandbox worker's
+  // `validateSecretEnv`; `RUNTYPE_SECRET_COMMAND` is the worker's reserved
+  // control-channel variable.
+  secretEnv: external_exports.record(
+    external_exports.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/, "must be a valid environment variable name").refine((name) => name !== "RUNTYPE_SECRET_COMMAND", {
+      message: "RUNTYPE_SECRET_COMMAND is reserved"
+    }),
+    external_exports.string().min(1, "must be a managed secret key")
+  ).refine((record2) => Object.keys(record2).length <= 32, {
+    message: "secretEnv supports at most 32 variables"
+  }).optional()
+  // NOTE: a `requireApprovalForBash` knob was forward-declared here for Phase 3
+  // but never wired to any runtime gate, so it was REMOVED from the public
+  // schema rather than ship a misleading, inert control (post-Fable handoff 05,
+  // F3). To gate `bash` today use the generic `tools.approval` config, which
+  // matches the tool by name. Re-add the dedicated knob only with its wiring.
+});
+var agentDurabilityConfigSchema = external_exports.object({
+  watchLeaseMs: external_exports.number().int().min(1e4).max(18e5).nullable().optional(),
+  maxBudgetMs: external_exports.number().int().min(1e3).max(864e5).nullable().optional(),
+  forced: external_exports.enum(["durable", "in_process"]).optional()
+});
+var DEFAULT_TURN_MAX_BUDGET_MS = 30 * 60 * 1e3;
+var agentRuntimeConfigSchema = external_exports.object({
+  model: external_exports.string().optional(),
+  systemPrompt: external_exports.string().optional(),
+  temperature: external_exports.number().min(0).max(2).optional(),
+  // Maximum output tokens (the model call's `maxOutputTokens`). A sibling of
+  // the sampling params: a static generation budget that belongs on the saved
+  // agent definition. Notably load-bearing for "thinking" default models that
+  // share reasoning + answer tokens in one output budget (Moonshot requires
+  // `>= 16k` or the visible answer can truncate to nothing after a long
+  // reasoning trace) — the Product Generator pins `24000` for exactly this.
+  // `buildVirtualFlow` already maps this onto the prompt step (defaulting to
+  // 16384 when unset), so saving it here is all that's required for it to take
+  // effect at execution time.
+  maxTokens: external_exports.number().int().min(1).optional(),
+  ...samplingConfigSchema,
+  // Unified tools configuration (nested under 'tools').
+  //
+  // This is the **createAgent / FPO-v2 create-form** projection of the canonical
+  // `agentToolsConfigSchema` (`tool-types.ts`). It is kept separate on purpose —
+  // it carries create-time constraints (`.int().min().max()`), a create-form
+  // `runtimeTools.toolType` enum (`advisor`/`search` instead of the canonical
+  // `RuntimeToolDefinition` union), and does NOT yet accept `toolSearch`.
+  // Collapsing it onto the canonical leaves would change createAgent validation,
+  // so the two are pinned by review + the planning doc rather than a shared
+  // import. Adding `toolSearch` here (to match the canonical schema + the runtime
+  // wire form) is a tracked follow-up.
+  tools: external_exports.object({
+    toolIds: external_exports.array(external_exports.string()).optional(),
+    toolConfigs: external_exports.record(external_exports.string(), external_exports.record(external_exports.string(), external_exports.unknown())).optional(),
+    runtimeTools: external_exports.array(
+      external_exports.object({
+        name: external_exports.string(),
+        description: external_exports.string(),
+        toolType: external_exports.enum([
+          "flow",
+          "custom",
+          "external",
+          "local",
+          "advisor",
+          "subagent",
+          "search"
+        ]),
+        parametersSchema: external_exports.record(external_exports.string(), external_exports.unknown()),
+        config: external_exports.record(external_exports.string(), external_exports.unknown())
+      })
+    ).optional(),
+    mcpServers: external_exports.array(
+      external_exports.object({
+        id: external_exports.string(),
+        name: external_exports.string().optional(),
+        url: external_exports.string(),
+        auth: external_exports.object({
+          type: external_exports.enum(["api_key", "bearer", "basic", "custom_header", "headers", "none"]),
+          headerName: external_exports.string().optional(),
+          token: external_exports.string().optional(),
+          username: external_exports.string().optional(),
+          password: external_exports.string().optional(),
+          // For `type: 'headers'`: arbitrary HTTP header name → value
+          // templates. The shared refinement below enforces the exclusive shape.
+          headers: external_exports.record(external_exports.string(), external_exports.string()).optional()
+        }).superRefine((auth, ctx) => {
+          const validation = validateMCPHeadersAuth(auth);
+          if (!validation.valid) {
+            ctx.addIssue({
+              code: "custom",
+              path: validation.path,
+              message: validation.message
+            });
+          }
+        }).optional(),
+        allowedTools: external_exports.array(external_exports.string()).optional(),
+        timeout: external_exports.number().optional(),
+        transport: external_exports.enum(["streamable_http", "rest"]).optional(),
+        enabled: external_exports.boolean().optional()
+      })
+    ).optional(),
+    maxToolCalls: external_exports.number().int().min(1).max(100).optional(),
+    toolCallStrategy: external_exports.enum(["auto", "required", "none"]).optional(),
+    approval: external_exports.object({
+      require: external_exports.union([external_exports.array(external_exports.string()), external_exports.boolean()]),
+      timeout: external_exports.number().optional(),
+      /** Opt out of agent-supplied approval reasons (`_approvalReason`
+       *  schema injection). Default: true. Mirrors approvalConfigSchema
+       *  in tool-types.ts. */
+      requestReason: external_exports.boolean().optional(),
+      /** Persistent "always" choices offered at the approval prompt.
+       *  Mirrors approvalConfigSchema.choices in tool-types.ts. */
+      choices: external_exports.object({
+        alwaysAllow: external_exports.boolean().optional(),
+        alwaysDeny: external_exports.boolean().optional()
+      }).optional()
+    }).optional(),
+    perToolLimits: external_exports.record(
+      external_exports.string(),
+      external_exports.object({
+        maxCalls: external_exports.number().optional(),
+        required: external_exports.boolean().optional()
+      })
+    ).optional(),
+    subagentConfig: external_exports.object({
+      toolPool: external_exports.array(external_exports.string()),
+      defaultMaxTurns: external_exports.number().int().min(1).max(100).optional(),
+      maxTurnsLimit: external_exports.number().int().min(1).max(100).optional(),
+      maxSpawnsPerRun: external_exports.number().int().min(1).max(50).optional(),
+      defaultModel: external_exports.string().optional(),
+      allowNesting: external_exports.boolean().optional(),
+      // Max must stay <= the dispatch `options.stepTimeoutMs` cap
+      // (600_000 — `api-schemas/dispatch.ts`): `resolveSubagentTimeouts`
+      // (apps/api subagent dispatch) stamps the child flow's
+      // `stepTimeoutMs` from the subagent's effective timeout. Keep the
+      // two bounds in lockstep or 600s subagents break at the smaller cap.
+      defaultTimeoutMs: external_exports.number().int().min(1e3).max(6e5).optional(),
+      executionModes: external_exports.array(external_exports.enum(["attached", "detached"])).min(1).optional(),
+      defaultExecutionMode: external_exports.enum(["attached", "detached"]).optional(),
+      defaultNotify: external_exports.enum(["none", "narrate", "react"]).optional(),
+      detachedMaxBudgetMs: external_exports.number().int().min(1e3).max(864e5).optional(),
+      detachedNoProgressBudgetMs: external_exports.number().int().min(1e3).max(864e5).optional()
+    }).optional(),
+    codeModeConfig: external_exports.object({
+      toolPool: external_exports.array(external_exports.string()),
+      description: external_exports.string().optional(),
+      timeoutMs: external_exports.number().int().min(1e3).max(6e5).optional()
+    }).optional()
+  }).optional(),
+  artifacts: artifactConfigSchema.optional(),
+  reasoning: reasoningConfigSchema.optional(),
+  advisor: external_exports.object({
+    model: external_exports.string(),
+    systemPrompt: external_exports.string().optional()
+  }).optional().nullable(),
+  loopConfig: external_exports.object({
+    maxTurns: external_exports.number().int().min(1).max(100).optional(),
+    maxCost: external_exports.number().min(0).optional(),
+    enableReflection: external_exports.boolean().optional(),
+    reflectionInterval: external_exports.number().int().min(1).max(50).optional()
+  }).optional(),
+  voice: external_exports.object({
+    enabled: external_exports.boolean().optional(),
+    provider: external_exports.string().optional(),
+    interruptionMode: external_exports.enum(["none", "cancel", "barge-in"]).optional(),
+    elevenLabs: external_exports.object({
+      voiceId: external_exports.string().optional(),
+      modelId: external_exports.string().optional(),
+      stability: external_exports.number().min(0).max(1).optional(),
+      similarity: external_exports.number().min(0).max(1).optional()
+    }).optional()
+  }).optional(),
+  errorHandling: errorHandlingSchema,
+  loggingPolicy: external_exports.enum(["default", "on", "off"]).optional(),
+  // Opt-in PII redaction for tail-log and telemetry payloads. `'default'`
+  // defers to a lower layer (surface/product) or the resolver default (off).
+  // Mirrors `loggingPolicy`.
+  piiRedaction: external_exports.enum(["default", "off", "redact"]).optional(),
+  // Opt-in temporal awareness. `injectElapsed` turns on the automatic
+  // "time has passed" decorator (a `<temporal_context>` block prepended to
+  // the user turn at dispatch, gated on turn ≥ 2 and a gap ≥
+  // `elapsedThresholdSeconds`). `groundNow` additionally surfaces the current
+  // datetime in that block. `timezone` is the agent's DEFAULT IANA zone —
+  // the layered tool/decorator resolution overrides it per-conversation.
+  temporal: temporalConfigSchema.optional(),
+  // Long-term memory (Cloudflare Agent Memory). Single-sourced as
+  // `memoryConfigSchema` (below) and reused by the update-agent, dispatch
+  // inline-agent, and FPO agent schemas so the four surfaces never drift —
+  // mirroring how `temporalConfigSchema` is shared.
+  memory: memoryConfigSchema.optional(),
+  // Agent Sandbox (Linux computer). When enabled, the agent gets the sandbox
+  // builtin tools + system-prompt frame at dispatch. Single-sourced as
+  // `sandboxConfigSchema` (above), mirroring `memory`. The live machine is agent
+  // state; this block is the operator Definition that enables it.
+  sandbox: sandboxConfigSchema.optional(),
+  // Tenancy Strategy (ADR 0012) — per-resource opt-in to tenant/end-user
+  // isolation. Part of the Definition (validated + persisted + content-hashed
+  // here so `ensure` tracks it). Absent → platform-global default (no behavior
+  // change); present → the execution pipeline expands it and enforces the
+  // lock-down gate pre-engine. Single-sourced as `tenancyStrategySchema` in
+  // `./tenancy-strategy`; the expansion + gate logic lives in apps/api.
+  tenancyStrategy: tenancyStrategySchema.optional(),
+  // Durable-turn knobs (ADR 0020). Single-sourced as
+  // `agentDurabilityConfigSchema` (above), mirroring `memory` / `sandbox`.
+  // Durability is the platform default; this block only tunes the turn and
+  // carries the per-agent lane pin.
+  durability: agentDurabilityConfigSchema.optional()
+}).strict();
 var contextFallbackSchema = external_exports.union([
   external_exports.object({ type: external_exports.literal("retry"), delay: external_exports.number().optional() }),
   external_exports.object({
@@ -23534,7 +24009,21 @@ var promptConfigSchema = external_exports.object({
     enabled: external_exports.literal(true),
     types: external_exports.array(external_exports.enum(["markdown", "component"])).min(1)
   }).optional(),
-  reasoning: external_exports.boolean().optional(),
+  // The canonical `reasoningConfigSchema` from `agent-runtime-config-schema.ts`,
+  // whose union already leads with `z.boolean()` — so this is the boolean-first
+  // union, not a second wrapper around one.
+  //
+  // This field was `z.boolean().optional()` until the object form was found to
+  // be unsaveable: the flow editor's reasoning dials write the full
+  // `ReasoningConfig` ({enabled, reasoningEffort | effort | thinkingLevel |
+  // budgetTokens | thinkingBudget | reasoningSummary | includeThoughts}), the
+  // engine has always honored it (`typeof flowPrompt.reasoning === 'object'` in
+  // `apps/api/src/lib/flow-execution/prompt-executor.ts`, mirrored by the
+  // runtime port), and an agent has always accepted it — only flow create /
+  // update rejected it, with SCHEMA_VALIDATION_FAILED "expected boolean,
+  // received object". Sharing ONE schema with the agent plane is what keeps the
+  // two from drifting apart again.
+  reasoning: reasoningConfigSchema.optional(),
   previousMessages: promptPreviousMessagesSchema.optional(),
   streamOutput: external_exports.boolean().optional(),
   errorHandling: promptErrorHandlingConfigSchema.optional(),
@@ -28943,97 +29432,6 @@ var runtimeHostDependencySchema = external_exports.union([
   backgroundRunCoordinatorDependencySchema,
   unknownHostDependencySchema
 ]);
-var MCP_HTTP_HEADER_NAME_PATTERN = /^[!#$%&'*+.^_`|~0-9A-Za-z-]+$/;
-function isValidMCPHTTPHeaderValue(value) {
-  for (let index = 0; index < value.length; index += 1) {
-    const code = value.charCodeAt(index);
-    if (code === 9 || code >= 32 && code <= 126 || code >= 128 && code <= 255) {
-      continue;
-    }
-    return false;
-  }
-  return true;
-}
-var INCOMPATIBLE_HEADERS_AUTH_FIELDS = [
-  "headerName",
-  "token",
-  "username",
-  "password",
-  "tokenSecretName",
-  "usernameSecretName",
-  "passwordSecretName",
-  "oauth2"
-];
-function validateMCPHeadersAuth(auth) {
-  if (!auth) return { valid: true };
-  if (auth.type !== "headers") {
-    if (auth.headers !== void 0) {
-      return {
-        valid: false,
-        code: "headers_wrong_type",
-        message: "The headers field is only valid with auth type 'headers'",
-        path: ["headers"]
-      };
-    }
-    return { valid: true };
-  }
-  for (const field of INCOMPATIBLE_HEADERS_AUTH_FIELDS) {
-    if (auth[field] !== void 0) {
-      return {
-        valid: false,
-        code: "incompatible_auth_field",
-        message: `Auth type 'headers' cannot also set ${field}`,
-        path: [field]
-      };
-    }
-  }
-  if (typeof auth.headers !== "object" || auth.headers === null || Array.isArray(auth.headers) || Object.keys(auth.headers).length === 0) {
-    return {
-      valid: false,
-      code: "headers_required",
-      message: "Auth type 'headers' requires a non-empty headers record",
-      path: ["headers"]
-    };
-  }
-  const normalizedNames = /* @__PURE__ */ new Set();
-  for (const [name, value] of Object.entries(auth.headers)) {
-    if (!MCP_HTTP_HEADER_NAME_PATTERN.test(name)) {
-      return {
-        valid: false,
-        code: "invalid_header_name",
-        message: `Invalid HTTP header name "${name}"`,
-        path: ["headers", name]
-      };
-    }
-    if (typeof value !== "string") {
-      return {
-        valid: false,
-        code: "invalid_header_value",
-        message: `Header "${name}" must have a string value`,
-        path: ["headers", name]
-      };
-    }
-    if (!isValidMCPHTTPHeaderValue(value)) {
-      return {
-        valid: false,
-        code: "invalid_header_value",
-        message: `Header "${name}" contains characters that are not valid in an HTTP header value`,
-        path: ["headers", name]
-      };
-    }
-    const normalizedName = name.toLowerCase();
-    if (normalizedNames.has(normalizedName)) {
-      return {
-        valid: false,
-        code: "duplicate_header_name",
-        message: `Header name "${name}" is duplicated case-insensitively`,
-        path: ["headers", name]
-      };
-    }
-    normalizedNames.add(normalizedName);
-  }
-  return { valid: true };
-}
 var SKILL_NAME_PATTERN = /^[a-z][a-z0-9_-]{0,63}$/;
 var EMIT_ARTIFACT_MARKDOWN_TOOL_ID = "emit_artifact_markdown";
 var EMIT_ARTIFACT_COMPONENT_TOOL_ID = "emit_artifact_component";
@@ -29533,357 +29931,6 @@ var SLACK_MANIFEST_BOT_SCOPES = [
   ...SLACK_REQUIRED_BOT_SCOPES,
   ...SLACK_OPTIONAL_BOT_SCOPES
 ];
-var tenancyAssuranceLevelSchema = external_exports.enum(["anonymous", "asserted", "verified"]);
-var tenancyStrategyPresetSchema = external_exports.enum([
-  "internal",
-  "tenant-isolated",
-  "end-user-isolated"
-]);
-var tenancyAssuranceFloorSchema = external_exports.enum(["asserted", "verified"]);
-var tenancyStrategySchema = external_exports.object({
-  preset: tenancyStrategyPresetSchema,
-  assuranceFloor: external_exports.object({
-    tenant: tenancyAssuranceFloorSchema.optional(),
-    endUser: tenancyAssuranceFloorSchema.optional()
-  }).strict().optional()
-}).strict();
-var reasoningConfigSchema = external_exports.union([
-  external_exports.boolean(),
-  external_exports.object({
-    enabled: external_exports.boolean(),
-    // OpenAI GPT-5 and o-series
-    reasoningEffort: external_exports.enum(["minimal", "low", "medium", "high", "xhigh"]).optional(),
-    reasoningSummary: external_exports.enum(["auto", "detailed"]).optional(),
-    // Anthropic Claude
-    budgetTokens: external_exports.number().int().min(1e3).max(1e5).optional(),
-    // Google Gemini
-    thinkingBudget: external_exports.number().int().min(1024).max(65536).optional(),
-    includeThoughts: external_exports.boolean().optional()
-  })
-]);
-var samplingConfigSchema = {
-  topP: external_exports.number().min(0).max(1).optional(),
-  topK: external_exports.number().int().min(1).max(500).optional(),
-  frequencyPenalty: external_exports.number().min(-2).max(2).optional(),
-  presencePenalty: external_exports.number().min(-2).max(2).optional(),
-  seed: external_exports.number().int().optional()
-};
-var errorHandlingSchema = external_exports.object({
-  onError: external_exports.enum(["fail", "continue", "fallback"]),
-  fallbacks: external_exports.array(
-    external_exports.discriminatedUnion("type", [
-      external_exports.object({
-        type: external_exports.literal("retry"),
-        delay: external_exports.number().int().min(0).max(6e4).optional()
-      }),
-      external_exports.object({
-        type: external_exports.literal("model"),
-        model: external_exports.string(),
-        temperature: external_exports.number().min(0).max(2).optional(),
-        maxTokens: external_exports.number().int().min(1).optional(),
-        delay: external_exports.number().int().min(0).max(6e4).optional()
-      }),
-      external_exports.object({
-        type: external_exports.literal("message"),
-        message: external_exports.string(),
-        delay: external_exports.number().int().min(0).max(6e4).optional()
-      })
-    ])
-  ).optional(),
-  // Conditions that activate the fallback chain. Mirrors PromptErrorHandling.triggers;
-  // defaults to error-only when omitted.
-  triggers: external_exports.array(external_exports.object({ type: external_exports.enum(["error", "empty-output"]) })).optional()
-}).optional();
-var artifactConfigSchema = external_exports.object({
-  enabled: external_exports.literal(true),
-  types: external_exports.array(external_exports.enum(["markdown", "component"])).min(1)
-});
-var temporalConfigSchema = external_exports.object({
-  injectElapsed: external_exports.boolean().optional(),
-  elapsedThresholdSeconds: external_exports.number().int().min(0).optional(),
-  groundNow: external_exports.boolean().optional(),
-  timezone: external_exports.string().optional()
-});
-var memoryConfigSchema = external_exports.object({
-  enabled: external_exports.boolean(),
-  profileTemplate: external_exports.string().optional(),
-  // When omitted and `enabled` is true, treated as `true` (smart default): a
-  // Markdown memory summary is woven into the agent's system prompt on each
-  // turn so the agent always has the user in context — without the model having
-  // to call `recall_memory` first. (The summary is cached per profile so the
-  // synthesis cost is paid once, not on every turn.) Set false to skip
-  // injection (focused task agents that don't benefit from a profile overview).
-  // Resolved via `shouldInjectMemorySummary` so the default lives in one place.
-  injectSummary: external_exports.boolean().optional()
-});
-var sandboxNetworkAccessSchema = external_exports.union([
-  external_exports.enum(["none", "essentials", "open"]),
-  external_exports.object({
-    profile: external_exports.enum(["none", "essentials", "open"]).optional(),
-    allow: external_exports.array(external_exports.string()).optional()
-  })
-]);
-var sandboxConfigSchema = external_exports.object({
-  enabled: external_exports.boolean(),
-  // INERT except `'runtype-sandbox'`: the agent-sandbox runtime
-  // (`SandboxToolService`) REJECTS any provider other than `'runtype-sandbox'`
-  // with a throw at the first sandbox tool call — `'daytona'` is NOT honored on
-  // this path (Phase 3 "Daytona parity" is unshipped). Kept parseable (not
-  // narrowed to `['runtype-sandbox']`) so a stored/imported `'daytona'` config
-  // does not fail agent-config parse, and so this schema stays aligned with the
-  // FPO public-types mirror + MCP snapshot that still list it. Selecting
-  // `'daytona'` is an author-time no-op that surfaces as a runtime error.
-  // (`quickjs` / `cloudflare-worker` are code-eval only, no shell — never valid.)
-  provider: external_exports.enum(["runtype-sandbox", "daytona"]).optional(),
-  // `'ephemeral'` and `'conversation'` (the default) are implemented.
-  // `'named'` is parseable but NOT yet implemented: the runtime silently
-  // degrades `'named'` to `'ephemeral'` (with a debug log) — no durable
-  // cross-conversation workspace exists yet (Phase 3). Kept parseable so a
-  // stored `'named'` config still loads; it just behaves as `'ephemeral'`.
-  persistence: external_exports.enum(["ephemeral", "conversation", "named"]).optional(),
-  // INERT on the agent sandbox path: `instanceType` is NOT honored — the agent
-  // sandbox always provisions `standard-4` (the blanket default fixed by
-  // apps/sandbox/wrangler.toml `[[containers]]`) regardless of this value (the
-  // value is read for the transform-data/deploy sandbox billing paths, not for
-  // the agent builtin tools). Kept parseable for forward-compat + mirror
-  // alignment; treat it as a no-op author-time hint until the agent path wires
-  // per-plan container sizing.
-  instanceType: external_exports.enum(["standard-1", "standard-2", "standard-3", "standard-4"]).optional(),
-  networkAccess: sandboxNetworkAccessSchema.optional(),
-  ttl: external_exports.enum(["5m", "1h", "24h", "unlimited"]).optional(),
-  sleepAfter: external_exports.enum(["5m", "15m", "30m", "1h"]).optional(),
-  // Operator-authored bootstrap commands. The API runs this batch once after
-  // enforcing the sandbox's network policy and before the first model-authored
-  // sandbox verb. Commands run in order from /workspace and must be foreground,
-  // self-contained, and safe to retry after an interrupted container runtime;
-  // the credential-bearing exec supervisor deliberately reaps every descendant
-  // before a command returns, so setup cannot launch a daemon meant to outlive
-  // it. Trusted Durable Object state plus a run-scoped memo prevents the batch
-  // from being repeated for the same provisioned workspace. Changing the
-  // commands or managed-secret KEY bindings creates a fresh sandbox identity;
-  // rotating a value under the same key does not rerun setup.
-  setupCommands: external_exports.array(external_exports.string().min(1, "setup commands must not be empty")).optional(),
-  // Credential environment available ONLY to the operator-authored setup batch
-  // above — never to a model-authored `bash` command. Keys are env var names;
-  // values are MANAGED SECRET KEYS (e.g. `GITHUB_CLONE_TOKEN`), never raw
-  // credential values. The API resolves them immediately before setup and
-  // delivers them out-of-band over `cloudflareSandboxExecWithSecretEnv`, so the
-  // values never appear in command strings, model-facing tool schemas, logs, or
-  // spill files. Like `networkAccess`, both fields are operator Definition: the
-  // model cannot author setup, name a managed secret, or grant itself one.
-  //
-  // TRUST BOUNDARY — read before configuring this. Every process started by a
-  // credentialed setup batch can read the injected values. Keep setup authored
-  // and reviewed by the operator; do not run model-, attacker-, or
-  // supply-chain-authored code (for example an install script) while credentials
-  // are present, and never persist a raw credential into /workspace for later
-  // model access. The secret supervisor freezes pre-existing processes, reaps
-  // every setup descendant, and destroys the sandbox fail-closed if cleanup
-  // fails, but output redaction remains defense-in-depth rather than permission
-  // to echo or transform a credential.
-  // Therefore:
-  //   - Prefer `credentialProxies` (phantom tokens, swapped at the egress
-  //     proxy) for any HTTP(S) protocol it supports — the real credential
-  //     never enters the container at all.
-  //   - Scope the secret as narrowly as the provider allows (read-only,
-  //     single-repo) and pair it with a tight `networkAccess` profile.
-  //   - Keep credentialed setup separate from later uncredentialed dependency
-  //     installation and model-authored work.
-  // Name shape and the 32-entry cap mirror the sandbox worker's
-  // `validateSecretEnv`; `RUNTYPE_SECRET_COMMAND` is the worker's reserved
-  // control-channel variable.
-  secretEnv: external_exports.record(
-    external_exports.string().regex(/^[A-Za-z_][A-Za-z0-9_]*$/, "must be a valid environment variable name").refine((name) => name !== "RUNTYPE_SECRET_COMMAND", {
-      message: "RUNTYPE_SECRET_COMMAND is reserved"
-    }),
-    external_exports.string().min(1, "must be a managed secret key")
-  ).refine((record2) => Object.keys(record2).length <= 32, {
-    message: "secretEnv supports at most 32 variables"
-  }).optional()
-  // NOTE: a `requireApprovalForBash` knob was forward-declared here for Phase 3
-  // but never wired to any runtime gate, so it was REMOVED from the public
-  // schema rather than ship a misleading, inert control (post-Fable handoff 05,
-  // F3). To gate `bash` today use the generic `tools.approval` config, which
-  // matches the tool by name. Re-add the dedicated knob only with its wiring.
-});
-var agentRuntimeConfigSchema = external_exports.object({
-  model: external_exports.string().optional(),
-  systemPrompt: external_exports.string().optional(),
-  temperature: external_exports.number().min(0).max(2).optional(),
-  // Maximum output tokens (the model call's `maxOutputTokens`). A sibling of
-  // the sampling params: a static generation budget that belongs on the saved
-  // agent definition. Notably load-bearing for "thinking" default models that
-  // share reasoning + answer tokens in one output budget (Moonshot requires
-  // `>= 16k` or the visible answer can truncate to nothing after a long
-  // reasoning trace) — the Product Generator pins `24000` for exactly this.
-  // `buildVirtualFlow` already maps this onto the prompt step (defaulting to
-  // 16384 when unset), so saving it here is all that's required for it to take
-  // effect at execution time.
-  maxTokens: external_exports.number().int().min(1).optional(),
-  ...samplingConfigSchema,
-  // Unified tools configuration (nested under 'tools').
-  //
-  // This is the **createAgent / FPO-v2 create-form** projection of the canonical
-  // `agentToolsConfigSchema` (`tool-types.ts`). It is kept separate on purpose —
-  // it carries create-time constraints (`.int().min().max()`), a create-form
-  // `runtimeTools.toolType` enum (`advisor`/`search` instead of the canonical
-  // `RuntimeToolDefinition` union), and does NOT yet accept `toolSearch`.
-  // Collapsing it onto the canonical leaves would change createAgent validation,
-  // so the two are pinned by review + the planning doc rather than a shared
-  // import. Adding `toolSearch` here (to match the canonical schema + the runtime
-  // wire form) is a tracked follow-up.
-  tools: external_exports.object({
-    toolIds: external_exports.array(external_exports.string()).optional(),
-    toolConfigs: external_exports.record(external_exports.string(), external_exports.record(external_exports.string(), external_exports.unknown())).optional(),
-    runtimeTools: external_exports.array(
-      external_exports.object({
-        name: external_exports.string(),
-        description: external_exports.string(),
-        toolType: external_exports.enum([
-          "flow",
-          "custom",
-          "external",
-          "local",
-          "advisor",
-          "subagent",
-          "search"
-        ]),
-        parametersSchema: external_exports.record(external_exports.string(), external_exports.unknown()),
-        config: external_exports.record(external_exports.string(), external_exports.unknown())
-      })
-    ).optional(),
-    mcpServers: external_exports.array(
-      external_exports.object({
-        id: external_exports.string(),
-        name: external_exports.string().optional(),
-        url: external_exports.string(),
-        auth: external_exports.object({
-          type: external_exports.enum(["api_key", "bearer", "basic", "custom_header", "headers", "none"]),
-          headerName: external_exports.string().optional(),
-          token: external_exports.string().optional(),
-          username: external_exports.string().optional(),
-          password: external_exports.string().optional(),
-          // For `type: 'headers'`: arbitrary HTTP header name → value
-          // templates. The shared refinement below enforces the exclusive shape.
-          headers: external_exports.record(external_exports.string(), external_exports.string()).optional()
-        }).superRefine((auth, ctx) => {
-          const validation = validateMCPHeadersAuth(auth);
-          if (!validation.valid) {
-            ctx.addIssue({
-              code: "custom",
-              path: validation.path,
-              message: validation.message
-            });
-          }
-        }).optional(),
-        allowedTools: external_exports.array(external_exports.string()).optional(),
-        timeout: external_exports.number().optional(),
-        transport: external_exports.enum(["streamable_http", "rest"]).optional(),
-        enabled: external_exports.boolean().optional()
-      })
-    ).optional(),
-    maxToolCalls: external_exports.number().int().min(1).max(100).optional(),
-    toolCallStrategy: external_exports.enum(["auto", "required", "none"]).optional(),
-    approval: external_exports.object({
-      require: external_exports.union([external_exports.array(external_exports.string()), external_exports.boolean()]),
-      timeout: external_exports.number().optional(),
-      /** Opt out of agent-supplied approval reasons (`_approvalReason`
-       *  schema injection). Default: true. Mirrors approvalConfigSchema
-       *  in tool-types.ts. */
-      requestReason: external_exports.boolean().optional(),
-      /** Persistent "always" choices offered at the approval prompt.
-       *  Mirrors approvalConfigSchema.choices in tool-types.ts. */
-      choices: external_exports.object({
-        alwaysAllow: external_exports.boolean().optional(),
-        alwaysDeny: external_exports.boolean().optional()
-      }).optional()
-    }).optional(),
-    perToolLimits: external_exports.record(
-      external_exports.string(),
-      external_exports.object({
-        maxCalls: external_exports.number().optional(),
-        required: external_exports.boolean().optional()
-      })
-    ).optional(),
-    subagentConfig: external_exports.object({
-      toolPool: external_exports.array(external_exports.string()),
-      defaultMaxTurns: external_exports.number().int().min(1).max(100).optional(),
-      maxTurnsLimit: external_exports.number().int().min(1).max(100).optional(),
-      maxSpawnsPerRun: external_exports.number().int().min(1).max(50).optional(),
-      defaultModel: external_exports.string().optional(),
-      allowNesting: external_exports.boolean().optional(),
-      // Max must stay <= the dispatch `options.stepTimeoutMs` cap
-      // (600_000 — `api-schemas/dispatch.ts`): `resolveSubagentTimeouts`
-      // (apps/api subagent dispatch) stamps the child flow's
-      // `stepTimeoutMs` from the subagent's effective timeout. Keep the
-      // two bounds in lockstep or 600s subagents break at the smaller cap.
-      defaultTimeoutMs: external_exports.number().int().min(1e3).max(6e5).optional(),
-      executionModes: external_exports.array(external_exports.enum(["attached", "detached"])).min(1).optional(),
-      defaultExecutionMode: external_exports.enum(["attached", "detached"]).optional(),
-      defaultNotify: external_exports.enum(["none", "narrate", "react"]).optional(),
-      detachedMaxBudgetMs: external_exports.number().int().min(1e3).max(864e5).optional(),
-      detachedNoProgressBudgetMs: external_exports.number().int().min(1e3).max(864e5).optional()
-    }).optional(),
-    codeModeConfig: external_exports.object({
-      toolPool: external_exports.array(external_exports.string()),
-      description: external_exports.string().optional(),
-      timeoutMs: external_exports.number().int().min(1e3).max(6e5).optional()
-    }).optional()
-  }).optional(),
-  artifacts: artifactConfigSchema.optional(),
-  reasoning: reasoningConfigSchema.optional(),
-  advisor: external_exports.object({
-    model: external_exports.string(),
-    systemPrompt: external_exports.string().optional()
-  }).optional().nullable(),
-  loopConfig: external_exports.object({
-    maxTurns: external_exports.number().int().min(1).max(100).optional(),
-    maxCost: external_exports.number().min(0).optional(),
-    enableReflection: external_exports.boolean().optional(),
-    reflectionInterval: external_exports.number().int().min(1).max(50).optional()
-  }).optional(),
-  voice: external_exports.object({
-    enabled: external_exports.boolean().optional(),
-    provider: external_exports.string().optional(),
-    interruptionMode: external_exports.enum(["none", "cancel", "barge-in"]).optional(),
-    elevenLabs: external_exports.object({
-      voiceId: external_exports.string().optional(),
-      modelId: external_exports.string().optional(),
-      stability: external_exports.number().min(0).max(1).optional(),
-      similarity: external_exports.number().min(0).max(1).optional()
-    }).optional()
-  }).optional(),
-  errorHandling: errorHandlingSchema,
-  loggingPolicy: external_exports.enum(["default", "on", "off"]).optional(),
-  // Opt-in PII redaction for tail-log and telemetry payloads. `'default'`
-  // defers to a lower layer (surface/product) or the resolver default (off).
-  // Mirrors `loggingPolicy`.
-  piiRedaction: external_exports.enum(["default", "off", "redact"]).optional(),
-  // Opt-in temporal awareness. `injectElapsed` turns on the automatic
-  // "time has passed" decorator (a `<temporal_context>` block prepended to
-  // the user turn at dispatch, gated on turn ≥ 2 and a gap ≥
-  // `elapsedThresholdSeconds`). `groundNow` additionally surfaces the current
-  // datetime in that block. `timezone` is the agent's DEFAULT IANA zone —
-  // the layered tool/decorator resolution overrides it per-conversation.
-  temporal: temporalConfigSchema.optional(),
-  // Long-term memory (Cloudflare Agent Memory). Single-sourced as
-  // `memoryConfigSchema` (below) and reused by the update-agent, dispatch
-  // inline-agent, and FPO agent schemas so the four surfaces never drift —
-  // mirroring how `temporalConfigSchema` is shared.
-  memory: memoryConfigSchema.optional(),
-  // Agent Sandbox (Linux computer). When enabled, the agent gets the sandbox
-  // builtin tools + system-prompt frame at dispatch. Single-sourced as
-  // `sandboxConfigSchema` (above), mirroring `memory`. The live machine is agent
-  // state; this block is the operator Definition that enables it.
-  sandbox: sandboxConfigSchema.optional(),
-  // Tenancy Strategy (ADR 0012) — per-resource opt-in to tenant/end-user
-  // isolation. Part of the Definition (validated + persisted + content-hashed
-  // here so `ensure` tracks it). Absent → platform-global default (no behavior
-  // change); present → the execution pipeline expands it and enforces the
-  // lock-down gate pre-engine. Single-sourced as `tenancyStrategySchema` in
-  // `./tenancy-strategy`; the expansion + gate logic lives in apps/api.
-  tenancyStrategy: tenancyStrategySchema.optional()
-}).strict();
 var identityAdapterKindSchema = external_exports.enum(["oidc-jwt", "session", "custom"]);
 var ASYMMETRIC_JWT_ALGORITHMS = [
   "RS256",
@@ -30117,7 +30164,12 @@ var agentReasoningConfigSchema = external_exports.object({
   reasoningEffort: external_exports.enum(["minimal", "low", "medium", "high", "xhigh"]).optional(),
   reasoningSummary: external_exports.enum(["auto", "detailed"]).optional(),
   budgetTokens: external_exports.number().int().min(1e3).max(1e5).optional(),
+  // Anthropic adaptive thinking / Gemini 3+ level mode. Free-form for the same
+  // per-model catalog-ladder reason as `reasoningConfigSchema` in
+  // `agent-runtime-config-schema.ts`; kept in lockstep with it.
+  effort: external_exports.string().min(1).max(32).optional(),
   thinkingBudget: external_exports.number().int().min(1024).max(65536).optional(),
+  thinkingLevel: external_exports.string().min(1).max(32).optional(),
   includeThoughts: external_exports.boolean().optional()
 });
 var agentVoiceConfigSchema = external_exports.object({
@@ -32459,7 +32511,7 @@ var DispatchRequestEnvelopeSchema = external_exports.object({
    */
   clientToolsPolicy: ClientToolsPolicySchema.optional(),
   secrets: external_exports.record(external_exports.string(), external_exports.string()).optional().describe(
-    "Per-request credentials for agent/external-tool execution. Ignored when `flow` is the hosted target; FLOW credentials must use managed {{secret:NAME}} references."
+    "Retired. A NON-EMPTY map on an agent dispatch is rejected with 400 RUNTIME_AGENT_TRANSIENT_SECRETS_UNSUPPORTED, unless the deprecated `options.useRuntimePackage: false` opt-out routes the run to the legacy engine, which still honors it for single-turn (non-loop) agents until that engine is removed. An empty map is accepted and does nothing. Ignored on flow dispatches. Store credentials as managed secrets and reference them as {{secret:NAME}}. The field is kept on the wire for compatibility only."
   ),
   credentialProxies: external_exports.array(credentialProxyConfigSchema).max(10).optional(),
   inputs: external_exports.record(external_exports.string(), external_exports.any()).optional().refine(
@@ -32502,7 +32554,7 @@ var DispatchRequestEnvelopeSchema = external_exports.object({
     debugMode: external_exports.boolean().optional().default(false),
     loggingPolicy: external_exports.enum(["default", "on", "off"]).optional(),
     useRuntimePackage: external_exports.boolean().optional().describe(
-      "Compatibility execution-lane OPT-OUT. For FLOW dispatches the field is accepted but ignored: eligible flows always use the @runtypelabs/runtime lane, while ineligible flows still fold to legacy silently. For AGENT dispatches, an eligible agent now uses the @runtypelabs/runtime lane by DEFAULT when this field is omitted; only an explicit `false` forces the legacy engine. Definitions the runtime lane cannot execute faithfully still fold to legacy on their own."
+      "Execution-lane selector. `false` is DEPRECATED: the legacy agent engine is being retired, an agent dispatch that sends `false` still runs on it today with RFC 9745 `Deprecation` + `X-API-Deprecation-Warning` response headers, and a later release rejects it. Omitted (the default) runs an eligible agent on the @runtypelabs/runtime lane and folds a definition the lane cannot execute faithfully to legacy on its own; `true` is the strict opt-in that turns such a fold into a 400 instead. For FLOW dispatches the field is accepted but ignored: eligible flows always use the runtime lane, while ineligible flows still fold to legacy silently."
     ),
     /** Route prompt model calls through an attached dashboard browser. */
     localInference: LocalInferenceSelectionSchema.optional(),
@@ -53354,18 +53406,15 @@ agentsCommand.command("execute <id>").description("Execute an agent").requiredOp
   const apiKey = await ensureAuth();
   if (!apiKey) return;
   const client = createCliClient(apiKey);
+  const messages = [{ role: "user", content: options.message }];
   const payload = {
-    messages: [{ role: "user", content: options.message }],
+    messages,
     streamResponse: options.stream
   };
   if (options.stream) {
     console.log(chalk25.gray("Starting agent..."));
     try {
-      const response = await client.requestStream(`/agents/${id}/execute`, {
-        method: "POST",
-        body: JSON.stringify(payload),
-        headers: { Accept: "text/event-stream" }
-      });
+      const response = await client.agents.executeStream(id, { messages });
       const callbacks = {
         onStepDelta: (chunk) => {
           process.stdout.write(chunk);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runtypelabs/cli",
-  "version": "2.35.1",
+  "version": "2.35.2",
   "description": "Command-line interface for Runtype AI platform",
   "type": "module",
   "main": "dist/index.js",
@@ -26,8 +26,8 @@
     "react": "^19.2.8",
     "rosie-skills": "0.8.1",
     "yaml": "^2.9.0",
-    "@runtypelabs/sdk": "9.2.1",
     "@runtypelabs/ink-components": "0.3.7",
+    "@runtypelabs/sdk": "9.3.0",
     "@runtypelabs/terminal-animations": "0.2.4"
   },
   "devDependencies": {
@@ -43,7 +43,7 @@
     "tsx": "^4.7.1",
     "typescript": "^6.0.3",
     "vitest": "^4.1.0",
-    "@runtypelabs/shared": "3.34.2"
+    "@runtypelabs/shared": "3.35.0"
   },
   "engines": {
     "node": ">=22.12.0"