@runtypelabs/cli 2.59.1 → 2.59.2

package/dist/chunk-87nRnNRG.js

@@ -0,0 +1,1363 @@
+#!/usr/bin/env node
+import { I as __exportAll } from "./index.js";
+import { i as extractSecretReferencesFromAnyValue } from "./chunk-BVMhjGVe.js";
+import { n as resolveModelSecretNames, t as resolveModelOptionalSettings } from "./chunk-Bpfnfk0t.js";
+import { r as createCliClient } from "./chunk-BW2fg46T.js";
+import { n as ensureAuth } from "./chunk-CJraEBVd.js";
+import { Command } from "commander";
+import chalk from "chalk";
+import * as fs$1 from "node:fs";
+import * as path$1 from "node:path";
+import { RuntypeApiError } from "@runtypelabs/sdk";
+// src/commands/deploy.ts
+var deploy_exports = /* @__PURE__ */ __exportAll({
+	BYOC_PLAN_REQUIRED_CODE: () => BYOC_PLAN_REQUIRED_CODE,
+	RETIRED_DEPLOY_FLOW_MESSAGE: () => RETIRED_DEPLOY_FLOW_MESSAGE,
+	TELEMETRY_ENV_TABLE: () => TELEMETRY_ENV_TABLE,
+	agentReleaseSelectorParams: () => agentReleaseSelectorParams,
+	collectDeploymentSecretInventory: () => collectDeploymentSecretInventory,
+	deployCommand: () => deployCommand,
+	describeAgentExportFailure: () => describeAgentExportFailure,
+	formatOptionalProviderSettings: () => formatOptionalProviderSettings,
+	readme: () => readme,
+	serverTs: () => serverTs,
+	setupSh: () => setupSh,
+	vercelReadme: () => vercelReadme,
+	vercelRouteTs: () => vercelRouteTs,
+	vercelSetupSh: () => vercelSetupSh,
+	workerIndexTs: () => workerIndexTs,
+	workerReadme: () => workerReadme,
+	workerSetupSh: () => workerSetupSh,
+	wranglerToml: () => wranglerToml
+});
+function bashSingleQuote(s) {
+	return "'" + s.replace(/'/g, "'\\''") + "'";
+}
+/**
+* Renders the `telemetry` block every scaffold passes to `createRuntime`.
+* Reporting turns on as soon as an API key is present, and each switch is a
+* plain environment variable so an operator can flip it without editing code.
+* `envAccess` is `process.env` on Node hosts and `env` inside a Worker.
+*/
+function telemetryConfigBlock(envAccess, indent) {
+	const inner = `${indent}  `;
+	return [
+		`${indent}telemetry: {`,
+		`${inner}enabled: ${envAccess}.RUNTYPE_TELEMETRY !== 'off' && Boolean(${envAccess}.RUNTYPE_API_KEY),`,
+		`${inner}apiKey: ${envAccess}.RUNTYPE_API_KEY,`,
+		`${inner}baseUrl: ${envAccess}.RUNTYPE_API_URL,`,
+		`${inner}content: ${envAccess}.RUNTYPE_TELEMETRY_CONTENT !== 'off',`,
+		`${indent}},`
+	].join("\n");
+}
+/** The four telemetry environment variables, documented once for every README. */
+const TELEMETRY_ENV_TABLE = `| Variable | Effect |
+| --- | --- |
+| \`RUNTYPE_API_KEY\` | Turns reporting on. Use an API key with the \`TELEMETRY:WRITE\` scope. |
+| \`RUNTYPE_TELEMETRY=off\` | Stops reporting even when the key is set. |
+| \`RUNTYPE_TELEMETRY_CONTENT=off\` | Reports runs without messages, tool arguments, or tool results. |
+| \`RUNTYPE_API_URL\` | Overrides the Runtype API origin. Defaults to \`https://api.runtype.com\`. |`;
+/**
+* README section describing the telemetry lane. `setCommand` is the host's own
+* way of setting the key, so the reader never has to translate the instruction.
+*/
+function telemetryReadmeSection(setCommand) {
+	return `## Telemetry
+
+Set \`RUNTYPE_API_KEY\` and this deployment reports every run to Runtype over
+OpenTelemetry, so each run appears in the dashboard with its trace tree,
+transcript, tool calls, token usage, and cost estimate.
+
+\`\`\`bash
+${setCommand}
+\`\`\`
+
+${TELEMETRY_ENV_TABLE}
+`;
+}
+function serverTs() {
+	return `/**
+ * Generated by \`runtype deploy\`.
+ *
+ * Boots a Hono server that loads every agent JSON file under ./agents/ and
+ * registers a streaming POST /agent/:name endpoint for each.
+ *
+ * See README.md for startup and deploy instructions.
+ */
+import { readFile, readdir } from 'node:fs/promises'
+import { resolve } from 'node:path'
+import { Hono } from 'hono'
+import { cors } from 'hono/cors'
+import { serve } from '@hono/node-server'
+import {
+  CloudRunAdapter,
+  createRuntime,
+  exportedAgentSchema,
+  type ExportedAgent,
+} from '@runtypelabs/runtime'
+
+async function loadAgent(filePath: string): Promise<ExportedAgent> {
+  const raw = await readFile(filePath, 'utf-8')
+  return exportedAgentSchema.parse(JSON.parse(raw))
+}
+
+async function loadAgentsDir(dir: string): Promise<Record<string, ExportedAgent>> {
+  let entries: string[]
+  try {
+    entries = await readdir(dir)
+  } catch (err) {
+    throw new Error(
+      \`[runtype] could not read agents directory at \${dir}: \${err instanceof Error ? err.message : String(err)}\`
+    )
+  }
+  const jsonFiles = entries.filter((f) => f.endsWith('.json')).sort()
+  if (jsonFiles.length === 0) {
+    throw new Error(\`[runtype] no agents found in \${dir} (expected one or more *.json files)\`)
+  }
+
+  const agents: Record<string, ExportedAgent> = {}
+  for (const file of jsonFiles) {
+    const agent = await loadAgent(resolve(dir, file))
+    if (agents[agent.name]) {
+      throw new Error(
+        \`[runtype] duplicate agent name "\${agent.name}" in \${file} — already defined by an earlier file\`
+      )
+    }
+    agents[agent.name] = agent
+    console.log(\`[runtype] loaded agent id=\${agent.id} name=\${agent.name}\`)
+  }
+  return agents
+}
+
+async function main(): Promise<void> {
+  const agentsDir = resolve(process.cwd(), 'agents')
+  const agents = await loadAgentsDir(agentsDir)
+
+  const runtime = createRuntime({
+    agents,
+    keys: { mode: 'own' },
+    adapter: new CloudRunAdapter(),
+${telemetryConfigBlock("process.env", "    ")}
+  })
+
+  const app = new Hono()
+
+  const allowedOriginsEnv = process.env.ALLOWED_ORIGINS?.trim()
+  const allowedOrigins = allowedOriginsEnv
+    ? allowedOriginsEnv.split(',').map((o) => o.trim()).filter(Boolean)
+    : '*'
+  app.use(
+    '*',
+    cors({
+      origin: allowedOrigins,
+      allowMethods: ['GET', 'POST', 'OPTIONS'],
+      allowHeaders: ['Content-Type', 'Authorization'],
+      credentials: false,
+      maxAge: 86400,
+    })
+  )
+
+  app.get('/health', (c) => c.json({ status: 'ok', agents: Object.keys(agents) }))
+
+  app.post('/agent/:name', async (c) => {
+    const name = c.req.param('name')
+    if (!runtime.getAgent(name)) {
+      return c.json({ error: \`unknown agent: \${name}\` }, 404)
+    }
+
+    let body: { messages?: Array<{ role: string; content: string }> } = {}
+    try {
+      body = (await c.req.json()) as typeof body
+    } catch {
+      return c.json({ error: 'request body must be JSON' }, 400)
+    }
+    const messages = Array.isArray(body.messages) ? body.messages : []
+
+    try {
+      const response = await runtime.executeAgent(name, {
+        messages: messages as Array<{ role: 'system' | 'user' | 'assistant'; content: string }>,
+        signal: c.req.raw.signal,
+      })
+      return response
+    } catch (err) {
+      return c.json({ error: err instanceof Error ? err.message : 'unknown error' }, 500)
+    }
+  })
+
+  const port = Number(process.env.PORT ?? 8080)
+  serve({ fetch: app.fetch, port, hostname: '0.0.0.0' })
+  console.log(\`[runtype] listening on 0.0.0.0:\${port} — agents: \${Object.keys(agents).join(', ')}\`)
+}
+
+main().catch((err) => {
+  console.error('[runtype] fatal: failed to start server', err)
+  process.exit(1)
+})
+`;
+}
+function dockerfile() {
+	return `FROM node:22-bookworm-slim AS builder
+
+WORKDIR /app
+
+COPY package.json ./
+COPY packages ./packages
+RUN npm install --omit=dev --no-audit --no-fund
+
+COPY tsconfig.json server.ts ./
+COPY agents ./agents
+RUN npm install --no-save --no-audit --no-fund typescript @types/node \\
+  && npx tsc -p tsconfig.json
+
+FROM node:22-bookworm-slim AS runner
+
+WORKDIR /app
+ENV NODE_ENV=production
+ENV PORT=8080
+EXPOSE 8080
+
+COPY --from=builder /app/node_modules ./node_modules
+COPY --from=builder /app/dist ./dist
+COPY --from=builder /app/agents ./agents
+COPY --from=builder /app/package.json ./package.json
+
+CMD ["node", "dist/server.js"]
+`;
+}
+function dockerignore() {
+	return `node_modules
+dist
+*.log
+`;
+}
+function tsconfigJson() {
+	return JSON.stringify({
+		compilerOptions: {
+			target: "ES2022",
+			module: "ESNext",
+			moduleResolution: "bundler",
+			lib: ["ES2022", "DOM"],
+			strict: true,
+			esModuleInterop: true,
+			forceConsistentCasingInFileNames: true,
+			resolveJsonModule: true,
+			skipLibCheck: true,
+			outDir: "dist",
+			declaration: false,
+			sourceMap: true,
+			noEmit: false
+		},
+		include: ["*.ts"],
+		exclude: ["node_modules", "dist"]
+	}, null, 2);
+}
+function packageJson(name, runtimeDep) {
+	return JSON.stringify({
+		name,
+		version: "0.0.0",
+		private: true,
+		type: "module",
+		scripts: {
+			start: "node dist/server.js",
+			dev: "tsx server.ts",
+			build: "tsc -p tsconfig.json",
+			typecheck: "tsc -p tsconfig.json --noEmit"
+		},
+		dependencies: {
+			"@hono/node-server": "^2.0.0",
+			"@runtypelabs/runtime": runtimeDep,
+			hono: "^4.12.16"
+		},
+		devDependencies: {
+			"@types/node": "^22.10.5",
+			tsx: "^4.19.2",
+			typescript: "^5.3.3"
+		},
+		engines: { node: ">=22.0.0" }
+	}, null, 2);
+}
+function setupSh(monorepoRoot) {
+	return `#!/usr/bin/env bash
+# Generated by \`runtype deploy\`.
+#
+# Builds and packs @runtypelabs/runtime from your local monorepo, then
+# installs all dependencies so you can run \`npm start\` or deploy to
+# Cloud Run with \`gcloud run deploy --source .\`.
+#
+# Usage (from this directory):
+#   ./setup.sh
+#   # then: npm run dev   OR   gcloud run deploy …
+
+set -euo pipefail
+
+DEPLOY_DIR="$(cd "$(dirname "\${BASH_SOURCE[0]}")" && pwd)"
+MONOREPO_ROOT=${bashSingleQuote(monorepoRoot)}
+TARBALL_DIR="\${DEPLOY_DIR}/packages"
+
+echo "[setup] building @runtypelabs/runtime..."
+pnpm --dir "\${MONOREPO_ROOT}" --filter @runtypelabs/runtime build
+
+mkdir -p "\${TARBALL_DIR}"
+
+echo "[setup] packing @runtypelabs/runtime tarball..."
+pnpm --dir "\${MONOREPO_ROOT}/packages/runtime" pack \\
+  --pack-destination "\${TARBALL_DIR}"
+
+RUNTIME_TGZ="$(ls "\${TARBALL_DIR}"/runtypelabs-runtime-*.tgz | head -n 1)"
+if [ -z "\${RUNTIME_TGZ}" ]; then
+  echo "[setup] error: no tarball produced by pnpm pack" >&2
+  exit 1
+fi
+RUNTIME_TGZ_NAME="$(basename "\${RUNTIME_TGZ}")"
+
+echo "[setup] updating package.json with file: dependency..."
+node -e "
+const fs = require('fs');
+const pkg = JSON.parse(fs.readFileSync('\${DEPLOY_DIR}/package.json', 'utf8'));
+pkg.dependencies['@runtypelabs/runtime'] = 'file:./packages/\${RUNTIME_TGZ_NAME}';
+fs.writeFileSync('\${DEPLOY_DIR}/package.json', JSON.stringify(pkg, null, 2) + '\\\\n');
+"
+
+echo "[setup] installing dependencies..."
+npm install --no-audit --no-fund
+
+echo ""
+echo "[setup] Done! Next steps:"
+echo "  npm run dev              — start locally"
+echo "  npm run build            — compile TypeScript"
+echo "  gcloud run deploy --source . --region us-central1 --allow-unauthenticated --port 8080"
+echo ""
+echo "[setup] Telemetry: export RUNTYPE_API_KEY=<key with TELEMETRY:WRITE> to report runs"
+echo "  RUNTYPE_TELEMETRY=off             disable reporting"
+echo "  RUNTYPE_TELEMETRY_CONTENT=off     report without messages, tool arguments, or results"
+echo "  RUNTYPE_API_URL=<origin>          override https://api.runtype.com"
+`;
+}
+function formatOptionalProviderSettings(settings) {
+	return settings.map((setting) => `- \`${setting.name}\` (default: \`${setting.defaultValue}\`)`).join("\n");
+}
+function optionalProviderSettingsSection(settings) {
+	if (settings.length === 0) return "";
+	return `
+## Optional provider settings
+
+These environment variables override runtime defaults and are not required:
+
+${formatOptionalProviderSettings(settings)}
+`;
+}
+function readme(agentNames, secretNames, optionalSettings) {
+	const agentList = agentNames.map((n) => `  - ${n}`).join("\n");
+	const secretList = secretNames.length > 0 ? secretNames.map((s) => `  gcloud secrets create ${s} --data-file=-`).join("\n") : "  (none detected)";
+	return `# Runtype Deployment
+
+Generated by \`runtype deploy\`. Contains the following agents:
+
+${agentList}
+
+## Setup
+
+Run \`./setup.sh\` to build the runtime and install dependencies:
+
+\`\`\`bash
+chmod +x setup.sh
+./setup.sh
+\`\`\`
+
+## Local development
+
+\`\`\`bash
+npm run dev
+\`\`\`
+
+Test with:
+\`\`\`bash
+curl -X POST http://localhost:8080/agent/${agentNames[0] ?? "my-agent"} \\
+  -H "Content-Type: application/json" \\
+  -d '{"messages":[{"role":"user","content":"Hello!"}]}'
+\`\`\`
+
+## Required secrets
+
+Set these before deploying to Cloud Run:
+
+${secretList}
+
+${optionalProviderSettingsSection(optionalSettings)}
+
+${telemetryReadmeSection("gcloud run services update runtype-deploy --update-secrets RUNTYPE_API_KEY=runtype-api-key:latest")}
+
+## Deploy to Cloud Run
+
+\`\`\`bash
+gcloud run deploy runtype-deploy \\
+  --source . \\
+  --region us-central1 \\
+  --platform managed \\
+  --allow-unauthenticated \\
+  --port 8080
+\`\`\`
+
+## Health check
+
+\`GET /health\` returns \`{"status":"ok","agents":[...]}\`.
+`;
+}
+/**
+* Generates the Cloudflare Workers entry point.
+* Agents are statically imported (no fs access in Workers); each deployed
+* agent needs an explicit import statement so Wrangler bundles the JSON.
+*/
+function workerIndexTs(agentSlugs) {
+	return `/**
+ * Generated by \`runtype deploy --target cloudflare\`.
+ *
+ * Routes:
+ *   GET  /health           — liveness probe (lists registered agent names)
+ *   POST /agent/:name      — SSE stream of the agent event schema
+ *
+ * Agent definitions are statically imported so Wrangler bundles them.
+ * To add a new agent:
+ *   1. Export it with \`runtype deploy --agent <id> --target cloudflare\`
+ *   2. Or drop a JSON file under agents/ and add an import + entry below
+ *   3. Run \`wrangler deploy\`
+ */
+import {
+  CloudflareAdapter,
+  createRuntime,
+  exportedAgentSchema,
+  type ExportedAgent,
+} from '@runtypelabs/runtime'
+
+// ---------------------------------------------------------------------------
+// Agent registry — static imports bundled by Wrangler at deploy time
+// ---------------------------------------------------------------------------
+
+${agentSlugs.map((slug, i) => `import agent${i}Json from '../agents/${slug}.json'`).join("\n")}
+
+function parseAgent(json: unknown, filename: string): ExportedAgent {
+  try {
+    return exportedAgentSchema.parse(json)
+  } catch (err) {
+    throw new Error(
+      \`[runtype] invalid agent JSON in \${filename}: \${
+        err instanceof Error ? err.message : String(err)
+      }\`
+    )
+  }
+}
+
+const agentFiles: Array<[string, unknown]> = [
+${agentSlugs.map((slug, i) => `  ['${slug}.json', agent${i}Json],`).join("\n")}
+]
+
+const agentRegistry: Record<string, ExportedAgent> = {}
+for (const [filename, json] of agentFiles) {
+  const agent = parseAgent(json, filename)
+  if (agentRegistry[agent.name]) {
+    throw new Error(\`[runtype] duplicate agent name "\${agent.name}" in \${filename}\`)
+  }
+  agentRegistry[agent.name] = agent
+}
+
+// ---------------------------------------------------------------------------
+// Env — Wrangler injects secrets + bindings here
+// ---------------------------------------------------------------------------
+
+export interface Env {
+  // Secrets — set via \`wrangler secret put <NAME>\`
+  ANTHROPIC_API_KEY?: string
+  OPENAI_API_KEY?: string
+  GOOGLE_API_KEY?: string
+  MIXLAYER_API_KEY?: string
+  // Optional: narrow CORS from * to specific origins (comma-separated)
+  ALLOWED_ORIGINS?: string
+  // Optional: KV namespace binding for durable cross-request caching
+  CACHE_KV?: KVNamespace
+  // Telemetry: set RUNTYPE_API_KEY (scope TELEMETRY:WRITE) to report runs to Runtype
+  RUNTYPE_API_KEY?: string
+  // Optional: override the Runtype API origin (default https://api.runtype.com)
+  RUNTYPE_API_URL?: string
+  // Optional: set to "off" to stop reporting, or to report without conversation content
+  RUNTYPE_TELEMETRY?: string
+  RUNTYPE_TELEMETRY_CONTENT?: string
+}
+
+// ---------------------------------------------------------------------------
+// Worker
+// ---------------------------------------------------------------------------
+
+export default {
+  async fetch(request: Request, env: Env, ctx: ExecutionContext): Promise<Response> {
+    const url = new URL(request.url)
+    const cors = corsHeaders(request, env.ALLOWED_ORIGINS)
+
+    if (request.method === 'OPTIONS') {
+      return new Response(null, { status: 204, headers: cors })
+    }
+
+    if (request.method === 'GET' && url.pathname === '/health') {
+      return json({ status: 'ok', agents: Object.keys(agentRegistry) }, 200, cors)
+    }
+
+    const agentMatch = url.pathname.match(/^\\/agent\\/([^/]+)$/)
+    if (request.method === 'POST' && agentMatch) {
+      const name = decodeURIComponent(agentMatch[1])
+      if (!agentRegistry[name]) {
+        return json({ error: \`unknown agent: \${name}\` }, 404, cors)
+      }
+
+      const runtime = createRuntime({
+        agents: agentRegistry,
+        keys: { mode: 'own' },
+        adapter: new CloudflareAdapter(env, {
+          kvNamespace: env.CACHE_KV,
+          waitUntil: ctx.waitUntil.bind(ctx),
+        }),
+${telemetryConfigBlock("env", "        ")}
+      })
+
+      let body: { messages?: Array<{ role: string; content: string }> } = {}
+      try {
+        body = (await request.json()) as typeof body
+      } catch {
+        return json({ error: 'request body must be JSON' }, 400, cors)
+      }
+      const messages = Array.isArray(body.messages) ? body.messages : []
+
+      try {
+        const response = await runtime.executeAgent(name, {
+          messages: messages as Array<{
+            role: 'system' | 'user' | 'assistant'
+            content: string
+          }>,
+          signal: request.signal,
+        })
+        const headers = new Headers(response.headers)
+        for (const [k, v] of Object.entries(cors)) headers.set(k, v)
+        return new Response(response.body, { status: response.status, headers })
+      } catch (err) {
+        return json({ error: err instanceof Error ? err.message : 'unknown error' }, 500, cors)
+      }
+    }
+
+    return json({ error: 'not found' }, 404, cors)
+  },
+}
+
+// ---------------------------------------------------------------------------
+// Helpers
+// ---------------------------------------------------------------------------
+
+function json(body: unknown, status: number, extra: Record<string, string>): Response {
+  return new Response(JSON.stringify(body), {
+    status,
+    headers: { 'Content-Type': 'application/json', ...extra },
+  })
+}
+
+function corsHeaders(request: Request, allowedOriginsEnv?: string): Record<string, string> {
+  const origin = request.headers.get('Origin') ?? ''
+  let allow = '*'
+  if (allowedOriginsEnv) {
+    const list = allowedOriginsEnv.split(',').map((o) => o.trim()).filter(Boolean)
+    allow = list.includes(origin) ? origin : (list[0] ?? '*')
+  }
+  const headers: Record<string, string> = {
+    'Access-Control-Allow-Origin': allow,
+    'Access-Control-Allow-Methods': 'GET, POST, OPTIONS',
+    'Access-Control-Allow-Headers': 'Content-Type, Authorization',
+    'Access-Control-Max-Age': '86400',
+  }
+  if (allow !== '*') headers['Vary'] = 'Origin'
+  return headers
+}
+`;
+}
+function wranglerToml(projectName) {
+	return `name = "${projectName}"
+main = "src/index.ts"
+compatibility_date = "2025-01-01"
+
+# Secrets — set via \`wrangler secret put <NAME>\`
+# Run this for each API key your agents need:
+#   wrangler secret put ANTHROPIC_API_KEY
+#   wrangler secret put OPENAI_API_KEY
+#   wrangler secret put GOOGLE_API_KEY
+#   wrangler secret put MIXLAYER_API_KEY
+
+# Telemetry: set the Runtype API key (scope \`TELEMETRY:WRITE\`) to report every
+# run to Runtype over OpenTelemetry:
+#   wrangler secret put RUNTYPE_API_KEY
+
+# Optional: KV namespace for durable cross-request caching.
+# Without this the adapter uses a per-isolate in-memory Map (ephemeral).
+# To enable:
+#   1. wrangler kv namespace create CACHE_KV
+#   2. Uncomment the block below and paste the generated id.
+# [[kv_namespaces]]
+# binding = "CACHE_KV"
+# id = "<paste your KV namespace id here>"
+
+# Optional: Workers AI binding (for @cf/* and workers-ai/* model ids).
+# [ai]
+# binding = "AI"
+
+# CORS: narrow from * to specific origins via ALLOWED_ORIGINS env var.
+# Telemetry switches: RUNTYPE_TELEMETRY = "off" stops reporting,
+# RUNTYPE_TELEMETRY_CONTENT = "off" reports without messages, tool arguments or
+# results, and RUNTYPE_API_URL overrides https://api.runtype.com.
+# [vars]
+# ALLOWED_ORIGINS = "https://yourapp.com,https://persona-chat.dev"
+# RUNTYPE_TELEMETRY = "off"
+# RUNTYPE_TELEMETRY_CONTENT = "off"
+# RUNTYPE_API_URL = "https://api.runtype.com"
+`;
+}
+function workerPackageJson(name, runtimeDep) {
+	return JSON.stringify({
+		name,
+		version: "0.0.0",
+		private: true,
+		scripts: {
+			dev: "wrangler dev",
+			deploy: "wrangler deploy",
+			typecheck: "tsc --noEmit"
+		},
+		dependencies: { "@runtypelabs/runtime": runtimeDep },
+		devDependencies: {
+			"@cloudflare/workers-types": "^5.0.0",
+			typescript: "^5.3.3",
+			wrangler: "^4.0.0"
+		}
+	}, null, 2);
+}
+function workerTsconfigJson() {
+	return JSON.stringify({
+		compilerOptions: {
+			target: "ES2022",
+			module: "ES2022",
+			moduleResolution: "bundler",
+			strict: true,
+			resolveJsonModule: true,
+			types: ["@cloudflare/workers-types"]
+		},
+		include: ["src"]
+	}, null, 2);
+}
+function workerSetupSh(monorepoRoot) {
+	return `#!/usr/bin/env bash
+# Generated by \`runtype deploy --target cloudflare\`.
+#
+# Builds and packs @runtypelabs/runtime from your local monorepo, then
+# installs all dependencies so you can run \`wrangler dev\` or deploy with
+# \`wrangler deploy\`.
+#
+# Usage (from this directory):
+#   ./setup.sh
+
+set -euo pipefail
+
+DEPLOY_DIR="$(cd "$(dirname "\${BASH_SOURCE[0]}")" && pwd)"
+MONOREPO_ROOT=${bashSingleQuote(monorepoRoot)}
+TARBALL_DIR="\${DEPLOY_DIR}/packages"
+
+echo "[setup] building @runtypelabs/runtime..."
+pnpm --dir "\${MONOREPO_ROOT}" --filter @runtypelabs/runtime build
+
+mkdir -p "\${TARBALL_DIR}"
+
+echo "[setup] packing @runtypelabs/runtime tarball..."
+pnpm --dir "\${MONOREPO_ROOT}/packages/runtime" pack \\
+  --pack-destination "\${TARBALL_DIR}"
+
+RUNTIME_TGZ="$(ls "\${TARBALL_DIR}"/runtypelabs-runtime-*.tgz | head -n 1)"
+if [ -z "\${RUNTIME_TGZ}" ]; then
+  echo "[setup] error: no tarball produced by pnpm pack" >&2
+  exit 1
+fi
+RUNTIME_TGZ_NAME="$(basename "\${RUNTIME_TGZ}")"
+
+echo "[setup] updating package.json with file: dependency..."
+node -e "
+const fs = require('fs');
+const pkg = JSON.parse(fs.readFileSync('\${DEPLOY_DIR}/package.json', 'utf8'));
+pkg.dependencies['@runtypelabs/runtime'] = 'file:./packages/\${RUNTIME_TGZ_NAME}';
+fs.writeFileSync('\${DEPLOY_DIR}/package.json', JSON.stringify(pkg, null, 2) + '\\\\n');
+"
+
+echo "[setup] installing dependencies..."
+npm install --no-audit --no-fund
+
+echo ""
+echo "[setup] Done! Next steps:"
+echo "  wrangler dev             — preview locally"
+echo "  wrangler deploy          — deploy to Cloudflare Workers"
+echo ""
+echo "[setup] Telemetry: wrangler secret put RUNTYPE_API_KEY (scope TELEMETRY:WRITE) to report runs"
+echo "  RUNTYPE_TELEMETRY=off             disable reporting"
+echo "  RUNTYPE_TELEMETRY_CONTENT=off     report without messages, tool arguments, or results"
+echo "  RUNTYPE_API_URL=<origin>          override https://api.runtype.com"
+`;
+}
+function workerReadme(agentNames, secretNames, optionalSettings) {
+	return `# Runtype Cloudflare Workers Deployment
+
+Generated by \`runtype deploy --target cloudflare\`. Contains the following agents:
+
+${agentNames.map((n) => `  - ${n}`).join("\n")}
+
+## Setup
+
+\`\`\`bash
+chmod +x setup.sh && ./setup.sh   # build runtime + install deps
+\`\`\`
+
+## Secrets
+
+Set each API key your agents use:
+
+\`\`\`bash
+${secretNames.length > 0 ? secretNames.map((s) => `  wrangler secret put ${s}`).join("\n") : "  (none detected)"}
+\`\`\`
+
+${optionalProviderSettingsSection(optionalSettings)}
+
+${telemetryReadmeSection("wrangler secret put RUNTYPE_API_KEY")}
+
+## Run locally
+
+\`\`\`bash
+wrangler dev
+\`\`\`
+
+## Deploy
+
+\`\`\`bash
+wrangler deploy
+\`\`\`
+
+## Health check
+
+\`GET /health\` returns \`{"status":"ok","agents":[...]}\`.
+
+## Call an agent
+
+\`\`\`bash
+curl https://<worker-subdomain>.workers.dev/agent/<name> \\
+  -H 'Content-Type: application/json' \\
+  -d '{"messages":[{"role":"user","content":"Hello"}]}'
+\`\`\`
+`;
+}
+/**
+* Generates the Vercel catch-all API route.
+* Uses Hono for routing. Agent JSONs are statically imported so Vercel
+* bundles them into the function package at build time.
+*/
+function vercelRouteTs(agentSlugs) {
+	return `/**
+ * Generated by \`runtype deploy --target vercel\`.
+ *
+ * Catch-all Vercel Function. All traffic is rewritten here by vercel.json.
+ * Routes:
+ *   GET  /health           — liveness probe (lists registered agent names)
+ *   POST /agent/:name      — SSE stream of the agent event schema
+ *
+ * Agent definitions are statically imported and bundled by Vercel.
+ * To add a new agent:
+ *   1. Export it with \`runtype deploy --agent <id> --target vercel\`
+ *   2. Or drop a JSON file under agents/ and add an import + entry below
+ *   3. Run \`vercel deploy\`
+ */
+import { Hono } from 'hono'
+import { handle } from 'hono/vercel'
+import { cors } from 'hono/cors'
+import {
+  VercelAdapter,
+  createRuntime,
+  exportedAgentSchema,
+  type ExportedAgent,
+} from '@runtypelabs/runtime'
+
+// ---------------------------------------------------------------------------
+// Agent registry — built at module load, cached across warm invocations
+// ---------------------------------------------------------------------------
+
+${agentSlugs.map((slug, i) => `import agent${i}Json from '../agents/${slug}.json'`).join("\n")}
+
+function parseAgent(json: unknown, filename: string): ExportedAgent {
+  try {
+    return exportedAgentSchema.parse(json)
+  } catch (err) {
+    throw new Error(
+      \`[runtype] invalid agent JSON in \${filename}: \${
+        err instanceof Error ? err.message : String(err)
+      }\`
+    )
+  }
+}
+
+const agentFiles: Array<[string, unknown]> = [
+${agentSlugs.map((slug, i) => `  ['${slug}.json', agent${i}Json],`).join("\n")}
+]
+
+const agentRegistry: Record<string, ExportedAgent> = {}
+for (const [filename, json] of agentFiles) {
+  const agent = parseAgent(json, filename)
+  if (agentRegistry[agent.name]) {
+    throw new Error(\`[runtype] duplicate agent name "\${agent.name}" in \${filename}\`)
+  }
+  agentRegistry[agent.name] = agent
+}
+
+// ---------------------------------------------------------------------------
+// Runtime — constructed at module scope (warm across invocations)
+// ---------------------------------------------------------------------------
+
+const runtime = createRuntime({
+  agents: agentRegistry,
+  keys: { mode: 'own' },
+  adapter: new VercelAdapter(),
+${telemetryConfigBlock("process.env", "  ")}
+})
+
+// ---------------------------------------------------------------------------
+// Hono app
+// ---------------------------------------------------------------------------
+
+const app = new Hono()
+
+const allowedOriginsEnv = process.env.ALLOWED_ORIGINS?.trim()
+const allowedOrigins = allowedOriginsEnv
+  ? allowedOriginsEnv.split(',').map((o) => o.trim()).filter(Boolean)
+  : '*'
+
+app.use(
+  '*',
+  cors({
+    origin: allowedOrigins,
+    allowMethods: ['GET', 'POST', 'OPTIONS'],
+    allowHeaders: ['Content-Type', 'Authorization'],
+    maxAge: 86400,
+  })
+)
+
+app.get('/health', (c) => c.json({ status: 'ok', agents: Object.keys(agentRegistry) }))
+
+app.post('/agent/:name', async (c) => {
+  const name = c.req.param('name')
+  if (!runtime.getAgent(name)) {
+    return c.json({ error: \`unknown agent: \${name}\` }, 404)
+  }
+
+  let body: { messages?: Array<{ role: string; content: string }> } = {}
+  try {
+    body = (await c.req.json()) as typeof body
+  } catch {
+    return c.json({ error: 'request body must be JSON' }, 400)
+  }
+  const messages = Array.isArray(body.messages) ? body.messages : []
+
+  try {
+    const response = await runtime.executeAgent(name, {
+      messages: messages as Array<{
+        role: 'system' | 'user' | 'assistant'
+        content: string
+      }>,
+      signal: c.req.raw.signal,
+    })
+    return response
+  } catch (err) {
+    return c.json({ error: err instanceof Error ? err.message : 'unknown error' }, 500)
+  }
+})
+
+export const GET = handle(app)
+export const POST = handle(app)
+`;
+}
+function vercelJson() {
+	return JSON.stringify({
+		rewrites: [{
+			source: "/(.*)",
+			destination: "/api/[[...route]]"
+		}],
+		functions: { "api/[[...route]].ts": { maxDuration: 60 } }
+	}, null, 2);
+}
+function vercelPackageJson(name, runtimeDep) {
+	return JSON.stringify({
+		name,
+		version: "0.0.0",
+		private: true,
+		scripts: {
+			dev: "vercel dev",
+			deploy: "vercel deploy",
+			typecheck: "tsc --noEmit"
+		},
+		dependencies: {
+			"@runtypelabs/runtime": runtimeDep,
+			hono: "^4.12.16"
+		},
+		devDependencies: {
+			"@types/node": "^22.0.0",
+			"@vercel/node": "^5.0.0",
+			typescript: "^5.3.3",
+			vercel: "^44.0.0"
+		}
+	}, null, 2);
+}
+function vercelTsconfigJson() {
+	return JSON.stringify({
+		compilerOptions: {
+			target: "ES2022",
+			module: "ESNext",
+			moduleResolution: "bundler",
+			strict: true,
+			resolveJsonModule: true,
+			esModuleInterop: true,
+			skipLibCheck: true
+		},
+		include: ["api"]
+	}, null, 2);
+}
+function vercelSetupSh(monorepoRoot) {
+	return `#!/usr/bin/env bash
+# Generated by \`runtype deploy --target vercel\`.
+#
+# Builds and packs @runtypelabs/runtime from your local monorepo, then
+# installs all dependencies so you can run \`vercel dev\` or deploy with
+# \`vercel deploy\`.
+#
+# Usage (from this directory):
+#   ./setup.sh
+
+set -euo pipefail
+
+DEPLOY_DIR="$(cd "$(dirname "\${BASH_SOURCE[0]}")" && pwd)"
+MONOREPO_ROOT=${bashSingleQuote(monorepoRoot)}
+TARBALL_DIR="\${DEPLOY_DIR}/packages"
+
+echo "[setup] building @runtypelabs/runtime..."
+pnpm --dir "\${MONOREPO_ROOT}" --filter @runtypelabs/runtime build
+
+mkdir -p "\${TARBALL_DIR}"
+
+echo "[setup] packing @runtypelabs/runtime tarball..."
+pnpm --dir "\${MONOREPO_ROOT}/packages/runtime" pack \\
+  --pack-destination "\${TARBALL_DIR}"
+
+RUNTIME_TGZ="$(ls "\${TARBALL_DIR}"/runtypelabs-runtime-*.tgz | head -n 1)"
+if [ -z "\${RUNTIME_TGZ}" ]; then
+  echo "[setup] error: no tarball produced by pnpm pack" >&2
+  exit 1
+fi
+RUNTIME_TGZ_NAME="$(basename "\${RUNTIME_TGZ}")"
+
+echo "[setup] updating package.json with file: dependency..."
+node -e "
+const fs = require('fs');
+const pkg = JSON.parse(fs.readFileSync('\${DEPLOY_DIR}/package.json', 'utf8'));
+pkg.dependencies['@runtypelabs/runtime'] = 'file:./packages/\${RUNTIME_TGZ_NAME}';
+fs.writeFileSync('\${DEPLOY_DIR}/package.json', JSON.stringify(pkg, null, 2) + '\\\\n');
+"
+
+echo "[setup] installing dependencies..."
+npm install --no-audit --no-fund
+
+echo ""
+echo "[setup] Done! Next steps:"
+echo "  vercel dev              — preview locally"
+echo "  vercel deploy           — deploy to Vercel Functions"
+echo ""
+echo "[setup] Telemetry: vercel env add RUNTYPE_API_KEY (scope TELEMETRY:WRITE) to report runs"
+echo "  RUNTYPE_TELEMETRY=off             disable reporting"
+echo "  RUNTYPE_TELEMETRY_CONTENT=off     report without messages, tool arguments, or results"
+echo "  RUNTYPE_API_URL=<origin>          override https://api.runtype.com"
+`;
+}
+function vercelReadme(agentNames, secretNames, optionalSettings) {
+	return `# Runtype Vercel Functions Deployment
+
+Generated by \`runtype deploy --target vercel\`. Contains the following agents:
+
+${agentNames.map((n) => `  - ${n}`).join("\n")}
+
+## Setup
+
+\`\`\`bash
+chmod +x setup.sh && ./setup.sh   # build runtime + install deps
+\`\`\`
+
+## Secrets
+
+Set each API key your agents use via the Vercel dashboard or CLI:
+
+\`\`\`bash
+${secretNames.length > 0 ? secretNames.map((s) => `  vercel env add ${s}`).join("\n") : "  (none detected)"}
+\`\`\`
+
+${optionalProviderSettingsSection(optionalSettings)}
+
+${telemetryReadmeSection("vercel env add RUNTYPE_API_KEY")}
+
+## Run locally
+
+\`\`\`bash
+vercel dev
+\`\`\`
+
+## Deploy
+
+\`\`\`bash
+vercel deploy
+\`\`\`
+
+## Health check
+
+\`GET /health\` returns \`{"status":"ok","agents":[...]}\`.
+
+## Call an agent
+
+\`\`\`bash
+curl https://<your-project>.vercel.app/agent/<name> \\
+  -H 'Content-Type: application/json' \\
+  -d '{"messages":[{"role":"user","content":"Hello"}]}'
+\`\`\`
+`;
+}
+function collectExportedExecutionInventory(definition) {
+	const models = /* @__PURE__ */ new Set();
+	const namedSecrets = /* @__PURE__ */ new Set();
+	const visited = /* @__PURE__ */ new WeakSet();
+	const isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+	const addModel = (value) => {
+		if (typeof value === "string" && value) models.add(value);
+	};
+	const walkMcpServers = (servers) => {
+		if (!Array.isArray(servers)) return;
+		for (const server of servers) {
+			if (!isObject(server) || !isObject(server.auth)) continue;
+			for (const key of [
+				"tokenSecretName",
+				"usernameSecretName",
+				"passwordSecretName"
+			]) {
+				const value = server.auth[key];
+				if (typeof value === "string" && value) namedSecrets.add(value);
+			}
+		}
+	};
+	function walkRuntimeTools(runtimeTools) {
+		if (!Array.isArray(runtimeTools)) return;
+		for (const tool of runtimeTools) {
+			if (!isObject(tool) || !isObject(tool.config)) continue;
+			if (isObject(tool.config.flow)) walkFlow(tool.config.flow);
+			if (isObject(tool.config.agent)) walkAgent(tool.config.agent);
+			if (isObject(tool.config.skill)) walkRuntimeTools(tool.config.skill.resolvedTools);
+		}
+	}
+	function walkTools(tools) {
+		if (!isObject(tools)) return;
+		walkMcpServers(tools.mcpServers);
+		walkRuntimeTools(tools.runtimeTools);
+	}
+	function walkFallbackModels(config) {
+		if (!isObject(config.errorHandling) || !Array.isArray(config.errorHandling.fallbacks)) return;
+		for (const fallback of config.errorHandling.fallbacks) if (isObject(fallback) && fallback.type === "model") addModel(fallback.model);
+	}
+	function walkSteps(steps) {
+		if (!Array.isArray(steps)) return;
+		for (const step of steps) {
+			if (!isObject(step) || !isObject(step.config)) continue;
+			if (step.type === "prompt") addModel(step.config.model);
+			walkFallbackModels(step.config);
+			walkTools(step.config.tools);
+			if (step.type !== "conditional") continue;
+			for (const key of [
+				"trueSteps",
+				"falseSteps",
+				"otherwiseSteps"
+			]) walkSteps(step.config[key]);
+			if (Array.isArray(step.config.branches)) {
+				for (const branch of step.config.branches) if (isObject(branch)) walkSteps(branch.steps);
+			}
+		}
+	}
+	function walkFlow(flow) {
+		if (visited.has(flow)) return;
+		visited.add(flow);
+		walkSteps(flow.steps);
+		if (isObject(flow.agents)) {
+			for (const agent of Object.values(flow.agents)) if (isObject(agent)) walkAgent(agent);
+		}
+	}
+	function walkAgent(agent) {
+		if (visited.has(agent)) return;
+		visited.add(agent);
+		if (isObject(agent.config)) {
+			addModel(agent.config.model);
+			walkTools(agent.config.tools);
+		}
+		if (isObject(agent.claudeManagedConfig)) addModel(agent.claudeManagedConfig.model);
+		if (Array.isArray(agent.skills)) {
+			for (const skill of agent.skills) if (isObject(skill)) walkRuntimeTools(skill.resolvedTools);
+		}
+		if (Array.isArray(agent.capabilities)) for (const capability of agent.capabilities) {
+			if (!isObject(capability)) continue;
+			if (isObject(capability.flow)) walkFlow(capability.flow);
+			if (isObject(capability.subAgent)) walkAgent(capability.subAgent);
+		}
+	}
+	if (isObject(definition)) {
+		if (Array.isArray(definition.steps) && !isObject(definition.config)) walkFlow(definition);
+		else walkAgent(definition);
+	}
+	return {
+		models: Array.from(models),
+		namedSecrets: Array.from(namedSecrets)
+	};
+}
+function collectDeploymentSecretInventory(agentDef) {
+	const requiredNames = /* @__PURE__ */ new Set();
+	const optionalSettings = /* @__PURE__ */ new Map();
+	const executionInventory = collectExportedExecutionInventory(agentDef);
+	for (const model of executionInventory.models) {
+		for (const name of resolveModelSecretNames(model)) requiredNames.add(name);
+		for (const setting of resolveModelOptionalSettings(model)) optionalSettings.set(setting.name, setting);
+	}
+	for (const name of executionInventory.namedSecrets) requiredNames.add(name);
+	for (const name of extractSecretReferencesFromAnyValue(agentDef, 512)) requiredNames.add(name);
+	for (const name of requiredNames) optionalSettings.delete(name);
+	return {
+		requiredNames: Array.from(requiredNames),
+		optionalSettings: Array.from(optionalSettings.values())
+	};
+}
+function slugify(s) {
+	return s.toLowerCase().replace(/[^a-z0-9]+/g, "-").replace(/^-+|-+$/g, "").slice(0, 63);
+}
+/**
+* Why `runtype deploy --flow` no longer scaffolds, and the two supported ways to
+* deploy a flow instead. Exported so a test pins that both stay named.
+*/
+const RETIRED_DEPLOY_FLOW_MESSAGE = [
+	"Error: `runtype deploy --flow` is retired (ADR 0024).",
+	"  The scaffold wrapped an exported flow in a primary-flow agent, and that agent execution mode is gone.",
+	"  Two ways to deploy a flow instead:",
+	"    1. Attach the flow to an agent as a runtime tool ({ toolType: 'flow', flowId }), then deploy that agent:",
+	"         runtype deploy --agent <agentId>",
+	"    2. Run the flow on the hosted API without scaffolding anything:",
+	"         runtype dispatch --flow <flowId>"
+];
+const BYOC_PLAN_REQUIRED_CODE = "BYOC_PLAN_REQUIRED";
+/**
+* Hints printed under a failed `GET /agents/{id}/export-runtime`, keyed on the
+* API's own denial contract: a 403 is the plan or scope gate, a 404 is the
+* agent itself. Exported so a test pins that a 404 is never read as an
+* environment restriction again.
+*/
+function describeAgentExportFailure(err) {
+	if (!(err instanceof RuntypeApiError)) return [];
+	if (err.statusCode === 403) {
+		if ((err.data && typeof err.data === "object" && "code" in err.data ? err.data.code : void 0) === "BYOC_PLAN_REQUIRED") return ["Self-hosting (BYOC) requires an Enterprise plan. Contact support to enable it for your account.", "The API key also needs the RUNTIME:EXPORT scope."];
+		return ["The API key needs the RUNTIME:EXPORT scope, and self-hosting (BYOC) requires an Enterprise plan."];
+	}
+	if (err.statusCode === 404) {
+		const code = err.data && typeof err.data === "object" && "code" in err.data ? err.data.code : void 0;
+		if (typeof code === "string" && RELEASE_SELECTOR_NOT_FOUND_CODES.has(code)) return ["The requested --alias or --version-id does not exist on this agent, or the alias is archived or expired."];
+		return ["Agent not found, or not owned by this account."];
+	}
+	return [];
+}
+const RELEASE_SELECTOR_NOT_FOUND_CODES = /* @__PURE__ */ new Set([
+	"alias_not_found",
+	"alias_archived",
+	"alias_expired",
+	"version_not_found"
+]);
+/** The export-runtime query for a release selector; errors when both selectors are given. */
+function agentReleaseSelectorParams(options, agentCount) {
+	if (options.alias !== void 0 && options.versionId !== void 0) return { error: "Pass either --alias or --version-id, not both." };
+	if (options.versionId !== void 0 && agentCount !== 1) return { error: "--version-id names one agent version, so pass exactly one --agent with it." };
+	return { params: {
+		...options.alias !== void 0 ? { alias: options.alias } : {},
+		...options.versionId !== void 0 ? { versionId: options.versionId } : {}
+	} };
+}
+function describeExportedRelease(def) {
+	const release = def.release;
+	if (!release?.versionId) return "";
+	const via = release.alias ? ` via ${release.alias}${release.aliasRevision !== void 0 ? ` r${release.aliasRevision}` : ""}` : "";
+	return chalk.dim(` (${release.versionId}${via})`);
+}
+const deployCommand = new Command("deploy").description("Export an agent and scaffold a deployment (cloud-run, cloudflare, or vercel)").option("--agent <id>", "Agent ID to export (may be repeated)", (v, acc) => {
+	acc.push(v);
+	return acc;
+}, []).option("--flow <id>", "Removed (ADR 0024): export the agent that runs the flow instead", (v, acc) => {
+	acc.push(v);
+	return acc;
+}, []).option("--output <dir>", "Output directory for the scaffold (default: ./runtype-deploy)", "./runtype-deploy").option("--name <name>", "Project name used in package.json (default: derived from output dir)").option("--target <target>", "Deployment target: cloud-run, cloudflare, or vercel (default: cloud-run)", "cloud-run").option("--alias <name>", "Export the version each agent's release alias points at (e.g. staging, live, pr-42)").option("--version-id <id>", "Export this published agent version (requires exactly one --agent)").action(async (options) => {
+	const agentIds = options.agent;
+	if (options.flow.length > 0) {
+		for (const line of RETIRED_DEPLOY_FLOW_MESSAGE) console.error(chalk.yellow(line));
+		process.exit(1);
+	}
+	if (agentIds.length === 0) {
+		console.error(chalk.red("Error: provide at least one --agent <id>"));
+		process.exit(1);
+	}
+	const selector = agentReleaseSelectorParams(options, agentIds.length);
+	if ("error" in selector) {
+		console.error(chalk.red(`Error: ${selector.error}`));
+		process.exit(1);
+	}
+	const target = options.target;
+	if (target !== "cloud-run" && target !== "cloudflare" && target !== "vercel") {
+		console.error(chalk.red(`Error: unknown --target "${target}". Must be one of: cloud-run, cloudflare, vercel`));
+		process.exit(1);
+	}
+	const apiKey = await ensureAuth();
+	if (!apiKey) return;
+	const client = createCliClient(apiKey);
+	const outDir = path$1.resolve(options.output);
+	const projectName = options.name ?? slugify(path$1.basename(outDir));
+	console.log(chalk.cyan(`\nScaffolding ${target} deployment to ${outDir}\n`));
+	const agentDefs = [];
+	for (const id of agentIds) {
+		process.stdout.write(`  Exporting agent ${chalk.green(id)}... `);
+		try {
+			const def = await client.get(`/agents/${id}/export-runtime`, selector.params);
+			agentDefs.push({
+				id,
+				name: String(def.name ?? id),
+				def
+			});
+			process.stdout.write(chalk.green("✓") + describeExportedRelease(def) + "\n");
+		} catch (err) {
+			const msg = err instanceof RuntypeApiError ? err.message : String(err);
+			process.stdout.write(chalk.red(`✗\n`));
+			console.error(chalk.red(`  Failed to export agent ${id}: ${msg}`));
+			for (const hint of describeAgentExportFailure(err)) console.error(chalk.yellow(`  ${hint}`));
+			process.exit(1);
+		}
+	}
+	const agentSlugs = agentDefs.map(({ name }) => slugify(name));
+	const slugSet = /* @__PURE__ */ new Set();
+	for (let i = 0; i < agentSlugs.length; i++) {
+		const slug = agentSlugs[i];
+		if (slugSet.has(slug)) {
+			const colliders = agentDefs.filter(({ name }) => slugify(name) === slug).map(({ name }) => `"${name}"`).join(" and ");
+			console.error(chalk.red(`Error: agents ${colliders} produce the same slug "${slug}".`));
+			console.error(chalk.yellow("  Rename one of them in the Runtype dashboard to make slugs unique."));
+			process.exit(1);
+		}
+		slugSet.add(slug);
+	}
+	fs$1.mkdirSync(path$1.join(outDir, "agents"), { recursive: true });
+	fs$1.mkdirSync(path$1.join(outDir, "packages"), { recursive: true });
+	for (const { name, def } of agentDefs) {
+		const filename = `${slugify(name)}.json`;
+		fs$1.writeFileSync(path$1.join(outDir, "agents", filename), JSON.stringify(def, null, 2));
+		console.log(`  Wrote agents/${filename}`);
+	}
+	const agentNames = agentDefs.map((a) => a.name);
+	let monorepoRoot = process.cwd();
+	for (let i = 0; i < 8; i++) {
+		if (fs$1.existsSync(path$1.join(monorepoRoot, "pnpm-workspace.yaml"))) break;
+		const parent = path$1.dirname(monorepoRoot);
+		if (parent === monorepoRoot) break;
+		monorepoRoot = parent;
+	}
+	const allSecrets = /* @__PURE__ */ new Set();
+	const allOptionalSettings = /* @__PURE__ */ new Map();
+	for (const { def } of agentDefs) {
+		const inventory = collectDeploymentSecretInventory(def);
+		for (const name of inventory.requiredNames) allSecrets.add(name);
+		for (const setting of inventory.optionalSettings) allOptionalSettings.set(setting.name, setting);
+	}
+	for (const name of allSecrets) allOptionalSettings.delete(name);
+	const secretNames = Array.from(allSecrets);
+	const optionalSettings = Array.from(allOptionalSettings.values());
+	if (target === "cloudflare") {
+		fs$1.mkdirSync(path$1.join(outDir, "src"), { recursive: true });
+		fs$1.writeFileSync(path$1.join(outDir, "src", "index.ts"), workerIndexTs(agentSlugs));
+		fs$1.writeFileSync(path$1.join(outDir, "wrangler.toml"), wranglerToml(projectName));
+		fs$1.writeFileSync(path$1.join(outDir, "package.json"), workerPackageJson(projectName, "workspace:*"));
+		fs$1.writeFileSync(path$1.join(outDir, "tsconfig.json"), workerTsconfigJson());
+		const setupPath = path$1.join(outDir, "setup.sh");
+		fs$1.writeFileSync(setupPath, workerSetupSh(monorepoRoot));
+		fs$1.chmodSync(setupPath, 493);
+		fs$1.writeFileSync(path$1.join(outDir, "README.md"), workerReadme(agentNames, secretNames, optionalSettings));
+	} else if (target === "vercel") {
+		fs$1.mkdirSync(path$1.join(outDir, "api"), { recursive: true });
+		fs$1.writeFileSync(path$1.join(outDir, "api", "[[...route]].ts"), vercelRouteTs(agentSlugs));
+		fs$1.writeFileSync(path$1.join(outDir, "vercel.json"), vercelJson());
+		fs$1.writeFileSync(path$1.join(outDir, "package.json"), vercelPackageJson(projectName, "workspace:*"));
+		fs$1.writeFileSync(path$1.join(outDir, "tsconfig.json"), vercelTsconfigJson());
+		const setupPath = path$1.join(outDir, "setup.sh");
+		fs$1.writeFileSync(setupPath, vercelSetupSh(monorepoRoot));
+		fs$1.chmodSync(setupPath, 493);
+		fs$1.writeFileSync(path$1.join(outDir, "README.md"), vercelReadme(agentNames, secretNames, optionalSettings));
+	} else {
+		fs$1.writeFileSync(path$1.join(outDir, "server.ts"), serverTs());
+		fs$1.writeFileSync(path$1.join(outDir, "Dockerfile"), dockerfile());
+		fs$1.writeFileSync(path$1.join(outDir, ".dockerignore"), dockerignore());
+		fs$1.writeFileSync(path$1.join(outDir, "tsconfig.json"), tsconfigJson());
+		fs$1.writeFileSync(path$1.join(outDir, "package.json"), packageJson(projectName, "workspace:*"));
+		const setupPath = path$1.join(outDir, "setup.sh");
+		fs$1.writeFileSync(setupPath, setupSh(monorepoRoot));
+		fs$1.chmodSync(setupPath, 493);
+		fs$1.writeFileSync(path$1.join(outDir, "README.md"), readme(agentNames, secretNames, optionalSettings));
+	}
+	console.log("");
+	console.log(chalk.green(`✓ Scaffold written to ${outDir}`));
+	console.log("");
+	console.log(chalk.bold("Next steps:"));
+	console.log(`  cd ${options.output}`);
+	console.log("  chmod +x setup.sh && ./setup.sh   # pack runtime + install deps");
+	if (optionalSettings.length > 0) {
+		console.log("");
+		console.log(chalk.yellow("Optional provider settings (defaults used when unset):"));
+		for (const setting of optionalSettings) console.log(`  ${chalk.cyan(setting.name)} (default: ${chalk.cyan(setting.defaultValue)})`);
+	}
+	if (target === "cloudflare") {
+		console.log("  wrangler dev                       # test locally");
+		console.log("");
+		if (secretNames.length > 0) {
+			console.log(chalk.yellow("Required secrets (set via wrangler):"));
+			for (const s of secretNames) console.log(`  wrangler secret put ${chalk.cyan(s)}`);
+			console.log("");
+		}
+		console.log("Deploy to Cloudflare Workers:");
+		console.log("  wrangler deploy");
+	} else if (target === "vercel") {
+		console.log("  vercel dev                         # test locally");
+		console.log("");
+		if (secretNames.length > 0) {
+			console.log(chalk.yellow("Required secrets (set via Vercel):"));
+			for (const s of secretNames) console.log(`  vercel env add ${chalk.cyan(s)}`);
+			console.log("");
+		}
+		console.log("Deploy to Vercel Functions:");
+		console.log("  vercel deploy");
+	} else {
+		console.log("  npm run dev                        # test locally");
+		console.log("");
+		if (secretNames.length > 0) {
+			console.log(chalk.yellow("Required secrets (set before deploying):"));
+			for (const s of secretNames) console.log(`  ${chalk.cyan(s)}`);
+			console.log("");
+			console.log("  Set via Cloud Run:  gcloud run deploy … --set-secrets KEY=NAME:latest");
+			console.log("  Or export locally:  export KEY=<value>");
+			console.log("");
+		}
+		console.log("Deploy to Cloud Run:");
+		console.log(`  gcloud run deploy ${projectName} --source ${options.output} \\`);
+		console.log("    --region us-central1 --platform managed \\");
+		console.log("    --allow-unauthenticated --port 8080");
+	}
+});
+export { deploy_exports as n, describeAgentExportFailure as r, agentReleaseSelectorParams as t };
+