@runtypelabs/cli 2.59.1 → 2.59.4

package/dist/chunk-BnWhIqW1.js

@@ -0,0 +1,109 @@
+#!/usr/bin/env node
+import { b as CredentialStore, c as loadEffectiveContext } from "./index.js";
+import { o as getClerkPublishableKey, s as getDashboardUrl, t as ApiKeyManager } from "./chunk-BW2fg46T.js";
+import open from "open";
+import crypto from "crypto";
+// src/auth/oauth-manager.ts
+var OAuthManager = class {
+	clerkPublishableKey;
+	dashboardUrl;
+	constructor(config) {
+		this.clerkPublishableKey = config.clerkPublishableKey;
+		this.dashboardUrl = config.dashboardUrl;
+	}
+	/** `orgId` preselects that organization on the dashboard's account picker; the user can still choose another. */
+	async authenticate(mode, options = {}) {
+		const state = crypto.randomBytes(32).toString("base64url");
+		const codeVerifier = crypto.randomBytes(32).toString("base64url");
+		const codeChallenge = crypto.createHash("sha256").update(codeVerifier).digest("base64url");
+		const { CallbackServer } = await import("./chunk-C7e7WwbU.js");
+		const callbackServer = new CallbackServer();
+		callbackServer.setExpectedState(state);
+		const requestedPort = await this.findAvailablePort();
+		const { actualPort, codePromise } = await callbackServer.start(requestedPort);
+		const redirectUri = `http://127.0.0.1:${actualPort}/callback`;
+		const authUrl = new URL(`${this.dashboardUrl.replace(/\/$/, "")}/${mode}`);
+		authUrl.searchParams.set("redirect_uri", redirectUri);
+		authUrl.searchParams.set("cli", "true");
+		authUrl.searchParams.set("state", state);
+		authUrl.searchParams.set("code_challenge", codeChallenge);
+		authUrl.searchParams.set("code_challenge_method", "S256");
+		authUrl.searchParams.set("publishable_key", this.clerkPublishableKey);
+		if (options.orgId) authUrl.searchParams.set("org", options.orgId);
+		console.log("🌐 Opening browser for authentication...");
+		console.log(`If the browser doesn't open, visit: ${authUrl}`);
+		try {
+			console.log("⏳ Waiting for authentication...");
+			const [code] = await Promise.all([codePromise, open(authUrl.toString()).catch(() => {
+				console.log("Failed to open browser automatically. Please visit the URL above.");
+			})]);
+			return await this.exchangeCodeForSession(code, codeVerifier, redirectUri);
+		} finally {
+			callbackServer.stop();
+		}
+	}
+	async findAvailablePort() {
+		return 8765;
+	}
+	async exchangeCodeForSession(code, codeVerifier, redirectUri) {
+		return code;
+	}
+};
+// src/auth/login-flow.ts
+var InvalidApiKeyError = class extends Error {
+	constructor() {
+		super("Invalid API key");
+		this.name = "InvalidApiKeyError";
+	}
+};
+async function storeLogin(credentials) {
+	const context = await loadEffectiveContext(credentials.apiUrl);
+	const store = new CredentialStore();
+	const account = await store.saveCredentials(credentials);
+	const isDefault = (await store.getDefaultAccount())?.id === account.id;
+	return {
+		...credentials,
+		account,
+		isDefault,
+		...context.requestedOrgId ? { requestedOrgId: context.requestedOrgId } : {}
+	};
+}
+/** Browser (Clerk) login: mint an org-owned CLI key for the organization the user authorizes. */
+async function browserLogin(options = {}) {
+	const context = await loadEffectiveContext(options.apiUrl);
+	const oauth = new OAuthManager({
+		clerkPublishableKey: getClerkPublishableKey(),
+		dashboardUrl: options.dashboardUrl || getDashboardUrl()
+	});
+	options.onProgress?.("Waiting for browser authentication...");
+	const sessionToken = await oauth.authenticate("sign-in", { orgId: context.requestedOrgId });
+	options.onProgress?.("Creating API key...");
+	const { key, userId, orgId } = await new ApiKeyManager().exchangeSessionForApiKey(sessionToken, context.apiUrl);
+	options.onProgress?.("Storing credentials securely...");
+	return storeLogin({
+		apiKey: key,
+		userId,
+		orgId,
+		apiUrl: context.apiUrl
+	});
+}
+/** Store an existing API key as a login for whichever organization owns it. */
+async function apiKeyLogin(apiKey, options = {}) {
+	const context = await loadEffectiveContext(options.apiUrl);
+	const manager = new ApiKeyManager();
+	if (!await manager.validateApiKey(apiKey, context.apiUrl)) throw new InvalidApiKeyError();
+	const user = await manager.getCurrentUser(apiKey, context.apiUrl);
+	return storeLogin({
+		apiKey,
+		userId: user.userId,
+		orgId: user.orgId ?? void 0,
+		apiUrl: context.apiUrl
+	});
+}
+/** Non-null when the user authorized a different organization than the one this directory targets. */
+function orgMismatchWarning(login) {
+	if (!login.requestedOrgId || login.requestedOrgId === login.orgId) return null;
+	return `Logged in to ${login.orgId ?? "a personal account"}, but this invocation targets ${login.requestedOrgId}. Commands here will keep asking for a login to ${login.requestedOrgId}; run "runtype login" again and pick that organization, or update the link with "runtype link ${login.orgId ?? ""}".`;
+}
+export { browserLogin as n, orgMismatchWarning as r, apiKeyLogin as t };
+

package/dist/chunk-Bpfnfk0t.js

@@ -0,0 +1,123 @@
+#!/usr/bin/env node
+import "./chunk-QSfNYiw9.js";
+// ../shared/dist/chunk-BIfgel88.mjs
+const DEFAULT_GENERIC_OPENAI_API_FORMAT = "chat-completions";
+/** Provider defaults shared by every execution engine and deploy guidance. */
+const DEFAULT_BEDROCK_REGION = "us-east-1";
+const DEFAULT_VERTEX_LOCATION = "us-central1";
+/**
+* Ordered array of provider specs. First-match-wins on `matches` predicate.
+* Explicit-prefix providers (vertex-*, vercel/*, cloudflare/*, etc.) come before
+* base providers (anthropic, openai, google, …) for the same reason PROVIDER_REGISTRY
+* in prompt-executor.ts declares them first.
+*/
+const PROVIDER_SECRET_SPECS = [
+	{
+		providerId: "mock",
+		matches: (m) => m.startsWith("mock/"),
+		secretNames: []
+	},
+	{
+		providerId: "google-vertex-anthropic",
+		matches: (m) => m.startsWith("vertex-anthropic/"),
+		secretNames: ["GOOGLE_VERTEX_PROJECT", "GOOGLE_VERTEX_CREDENTIALS"],
+		optionalSettings: [{
+			name: "GOOGLE_VERTEX_LOCATION",
+			defaultValue: DEFAULT_VERTEX_LOCATION
+		}]
+	},
+	{
+		providerId: "google-vertex",
+		matches: (m) => m.startsWith("vertex/"),
+		secretNames: ["GOOGLE_VERTEX_PROJECT", "GOOGLE_VERTEX_CREDENTIALS"],
+		optionalSettings: [{
+			name: "GOOGLE_VERTEX_LOCATION",
+			defaultValue: DEFAULT_VERTEX_LOCATION
+		}]
+	},
+	{
+		providerId: "vercel-gateway",
+		matches: (m) => m.startsWith("vercel/") || m.startsWith("vercel."),
+		secretNames: ["VERCEL_AI_GATEWAY_API_KEY"]
+	},
+	{
+		providerId: "cloudflare-gateway",
+		matches: (m) => m.startsWith("cloudflare/") || m.startsWith("cloudflare:"),
+		secretNames: ["CF_ACCOUNT_ID", "CF_AI_GATEWAY_ID"]
+	},
+	{
+		providerId: "bedrock",
+		matches: (m) => m.startsWith("bedrock/"),
+		secretNames: ["AWS_ACCESS_KEY_ID", "AWS_SECRET_ACCESS_KEY"],
+		optionalSettings: [{
+			name: "AWS_REGION",
+			defaultValue: DEFAULT_BEDROCK_REGION
+		}]
+	},
+	{
+		providerId: "tinfoil",
+		matches: (m) => m.startsWith("tinfoil/") || m.startsWith("tinfoil:"),
+		secretNames: ["TINFOIL_API_KEY"]
+	},
+	{
+		providerId: "generic-openai",
+		matches: (m) => m.startsWith("generic-openai/") || m.startsWith("generic-openai:"),
+		secretNames: ["GENERIC_OPENAI_API_KEY", "GENERIC_OPENAI_BASE_URL"],
+		optionalSettings: [{
+			name: "GENERIC_OPENAI_API_FORMAT",
+			defaultValue: DEFAULT_GENERIC_OPENAI_API_FORMAT
+		}]
+	},
+	{
+		providerId: "workers-ai",
+		matches: (m) => m.startsWith("@cf/") || m.startsWith("workers-ai/"),
+		secretNames: []
+	},
+	{
+		providerId: "anthropic",
+		matches: (m) => m.startsWith("anthropic/") || m.startsWith("claude-") || m.includes("/claude-"),
+		secretNames: ["ANTHROPIC_API_KEY"]
+	},
+	{
+		providerId: "openai",
+		matches: (m) => m.startsWith("openai/") || m.startsWith("gpt-") || m.startsWith("o1-") || m.startsWith("o3-") || m.startsWith("o4-") || m.includes("/gpt-"),
+		secretNames: ["OPENAI_API_KEY"]
+	},
+	{
+		providerId: "google",
+		matches: (m) => m.startsWith("google/") || m.startsWith("gemini-") || m.includes("/gemini-"),
+		secretNames: ["GOOGLE_API_KEY"]
+	},
+	{
+		providerId: "mixlayer",
+		matches: (m) => m.startsWith("mixlayer/") || m.startsWith("modelsocket/") || m.startsWith("qwen/") || m.startsWith("z-ai/") || m.startsWith("kimi-") || m.includes("/kimi-") || /(?:^|\/)qwen3[.-]5-\d+b(?:-a\d+b)?$/i.test(m),
+		secretNames: ["MIXLAYER_API_KEY"]
+	},
+	{
+		providerId: "xai",
+		matches: (m) => m.startsWith("grok-") || m.startsWith("xai/"),
+		secretNames: ["XAI_API_KEY"]
+	}
+];
+/**
+* Returns the required secret names for the given model id using first-match-wins order.
+* Returns an empty array for models that use platform bindings (Workers AI) or for
+* unrecognized model strings.
+*/
+function resolveModelSecretNames(model) {
+	const lower = model.toLowerCase();
+	for (const spec of PROVIDER_SECRET_SPECS) if (spec.matches(lower)) return [...spec.secretNames];
+	return [];
+}
+/**
+* Returns optional deployment settings for the model's provider. These are
+* guidance only: runtime key validation must continue to use
+* `resolveModelSecretNames`, which contains required credentials exclusively.
+*/
+function resolveModelOptionalSettings(model) {
+	const lower = model.toLowerCase();
+	for (const spec of PROVIDER_SECRET_SPECS) if (spec.matches(lower)) return [...spec.optionalSettings ?? []];
+	return [];
+}
+export { resolveModelSecretNames as n, resolveModelOptionalSettings as t };
+

package/dist/chunk-BrhgdnM3.js

@@ -0,0 +1,108 @@
+#!/usr/bin/env node
+import chalk from "chalk";
+import readline from "readline";
+// src/lib/select-prompt.ts
+function canUseArrowKeySelect() {
+	return process.stdin.isTTY === true && process.stdout.isTTY === true && typeof process.stdin.setRawMode === "function";
+}
+function clearRenderedLines(output, lineCount) {
+	for (let index = 0; index < lineCount; index += 1) {
+		readline.clearLine(output, 0);
+		readline.cursorTo(output, 0);
+		if (index < lineCount - 1) readline.moveCursor(output, 0, -1);
+	}
+}
+function formatChoice(choice, index, selectedIndex) {
+	return ` ${index === selectedIndex ? chalk.cyan("›") : " "} ${index === selectedIndex ? chalk.cyan(`${index + 1})`) : chalk.gray(`${index + 1})`)} ${index === selectedIndex ? chalk.bold(choice.label) : choice.label}${choice.description ? chalk.gray(` - ${choice.description}`) : ""}`;
+}
+async function promptNumericSelect(choices, promptLabel) {
+	choices.forEach((choice, index) => {
+		const description = choice.description ? chalk.gray(` - ${choice.description}`) : "";
+		console.log(`  ${chalk.green(`${index + 1})`)} ${choice.label}${description}`);
+	});
+	const rl = readline.createInterface({
+		input: process.stdin,
+		output: process.stdout,
+		terminal: true
+	});
+	return new Promise((resolve) => {
+		const ask = () => {
+			rl.question(chalk.cyan(`\n${promptLabel} (1-${choices.length}): `), (answer) => {
+				const value = parseInt(answer.trim(), 10);
+				if (value >= 1 && value <= choices.length) {
+					rl.close();
+					resolve(choices[value - 1].value);
+					return;
+				}
+				console.log(chalk.red(`Please enter a number between 1 and ${choices.length}.`));
+				ask();
+			});
+		};
+		ask();
+	});
+}
+async function promptSelect(message, choices, options) {
+	if (message) console.log(chalk.cyan(`\n${message}`));
+	if (!canUseArrowKeySelect()) return promptNumericSelect(choices, options?.promptLabel ?? "Select");
+	const input = process.stdin;
+	const output = process.stdout;
+	const promptLabel = options?.promptLabel ?? "Select";
+	const shortcutRange = choices.length === 1 ? "1" : `1-${choices.length}`;
+	const instructions = chalk.gray(`Use ${chalk.cyan("↑/↓")} to move, ${chalk.cyan("Enter")} to select, or press ${shortcutRange}.`);
+	const previousRawMode = input.isRaw === true;
+	let selectedIndex = 0;
+	let renderedLineCount = 0;
+	return new Promise((resolve) => {
+		const renderMenu = () => {
+			if (renderedLineCount > 0) clearRenderedLines(output, renderedLineCount);
+			const lines = [
+				...choices.map((choice, index) => formatChoice(choice, index, selectedIndex)),
+				"",
+				`${promptLabel}: ${instructions}`
+			];
+			output.write(`${lines.join("\n")}`);
+			renderedLineCount = lines.length;
+		};
+		const cleanup = () => {
+			input.off("keypress", onKeypress);
+			if (typeof input.setRawMode === "function") input.setRawMode(previousRawMode);
+			output.write("\n");
+		};
+		const finish = (value) => {
+			cleanup();
+			resolve(value);
+		};
+		const onKeypress = (_, key) => {
+			if (key.ctrl && key.name === "c") {
+				cleanup();
+				process.kill(process.pid, "SIGINT");
+				return;
+			}
+			if (key.name === "up" || key.name === "k") {
+				selectedIndex = (selectedIndex - 1 + choices.length) % choices.length;
+				renderMenu();
+				return;
+			}
+			if (key.name === "down" || key.name === "j") {
+				selectedIndex = (selectedIndex + 1) % choices.length;
+				renderMenu();
+				return;
+			}
+			if (key.name === "return" || key.name === "enter") {
+				finish(choices[selectedIndex].value);
+				return;
+			}
+			if (/^[1-9]$/.test(key.sequence ?? "")) {
+				const numericIndex = Number(key.sequence) - 1;
+				if (numericIndex >= 0 && numericIndex < choices.length) finish(choices[numericIndex].value);
+			}
+		};
+		readline.emitKeypressEvents(input);
+		input.on("keypress", onKeypress);
+		input.resume();
+		input.setRawMode?.(true);
+		renderMenu();
+	});
+}
+export { promptSelect as t };
+

package/dist/chunk-Bt0XAgX5.js

@@ -0,0 +1,327 @@
+#!/usr/bin/env node
+import { C as unknown, S as union, a as _null, b as string, c as boolean, f as literal, h as object, i as _enum, m as number, o as any, s as array, u as discriminatedUnion, v as record, y as strictObject } from "./chunk-BOpO6xE-.js";
+// ../shared/dist/chunk-DH-C5yxa.mjs
+/** The person a turn runs as: exposed to tools as `_endUser.*`, shards memory, and satisfies `end-user-isolated`. */
+const hostEndUserIdentitySchema = object({
+	id: string().min(1),
+	email: string().optional()
+}).passthrough().describe("The end user (the person) the turn runs as. Exposed to tools as _endUser.*, drives memory-profile sharding, and satisfies an end-user-isolated tenancyStrategy. Distinct from _user (the Builder User).");
+/** The product tenant (under the Builder Org) the turn runs within, exposed as `_tenant.*`. */
+const hostTenantIdentitySchema = object({ id: string().min(1) }).passthrough().describe("The product tenant (a customer of your product, under your Builder Org) the turn runs within. Exposed to tools as _tenant.*.");
+/** Suite-level default identity an eval case inherits when it does not carry its own. */
+const evalIdentityDefaultsSchema = object({
+	endUser: hostEndUserIdentitySchema.optional(),
+	tenant: hostTenantIdentitySchema.optional()
+}).strict().describe("Default identity every case in the suite runs as unless the case sets its own endUser/tenant. No credentials or identity proofs: the identity is asserted by the suite author.");
+const tokenCountSchema = number().int().nonnegative().max(Number.MAX_SAFE_INTEGER);
+const judgeParseErrorSchema = _enum([
+	"empty_completion",
+	"invalid_json",
+	"invalid_contract",
+	"missing_access_assessment",
+	"invalid_access_assessment",
+	"output_truncated"
+]);
+const judgeFinishReasonSchema = _enum([
+	"stop",
+	"length",
+	"content-filter",
+	"tool-calls",
+	"error",
+	"other",
+	"unknown"
+]);
+/** Bounded metadata only: never persist judge prompts, response text, or provider error messages here. */
+const judgeAttemptDiagnosticSchema = strictObject({
+	attempt: union([literal(1), literal(2)]),
+	requestedModel: string().max(160),
+	resolvedModel: string().max(160).optional(),
+	provider: string().max(64).optional(),
+	durationMs: tokenCountSchema,
+	status: _enum([
+		"valid",
+		"invalid_response",
+		"model_error"
+	]),
+	parseError: judgeParseErrorSchema.optional(),
+	modelError: _enum(["empty_completion", "model_call_error"]).optional(),
+	finishReason: judgeFinishReasonSchema.optional(),
+	responseChars: tokenCountSchema.optional(),
+	usageObserved: boolean(),
+	promptTokens: tokenCountSchema.optional(),
+	completionTokens: tokenCountSchema.optional(),
+	reasoningTokens: tokenCountSchema.optional(),
+	cacheReadTokens: tokenCountSchema.optional(),
+	cacheWriteTokens: tokenCountSchema.optional()
+});
+const judgeDiagnosticsSchema = strictObject({
+	attempts: array(judgeAttemptDiagnosticSchema).max(2),
+	flowFailure: _enum([
+		"deadline_exhausted",
+		"execution_failed",
+		"invalid_response"
+	]).optional()
+}).refine((diagnostics) => diagnostics.attempts.length > 0 || diagnostics.flowFailure !== void 0, { message: "Judge diagnostics require an attempt or an explicit custom flow failure." });
+const BUILT_IN_GRADER_IDS = [
+	"answersQuestion",
+	"matchesExpected",
+	"followsInstructions",
+	"grounded",
+	"rightTone",
+	"safeToSend",
+	"staysOnTask",
+	"sameLanguage",
+	"refusesWhenItShould",
+	"noPersonalData"
+];
+/**
+* Per-grader severity. A `gate` miss always fails the case; a `soft` miss is
+* tracked-but-not-failing unless the run is `--strict`. Absent ⇒ `gate` (the
+* historical, every-grader-is-a-hard-gate behavior). Severity rides on EVERY
+* grader — check and AI alike — so it is spread into each member below.
+*/
+const graderSeveritySchema = _enum(["gate", "soft"]);
+/**
+* Shared severity field, spread into each grader member to preserve kind-based discriminated union narrowing.
+* An intersection at the union level would lose that narrowing.
+* Optional and absent-by-default keeps the wire shape/content-hash unchanged for un-annotated graders.
+*/
+const severityFields = { severity: graderSeveritySchema.optional() };
+const checkGraderSchema = discriminatedUnion("kind", [
+	object({
+		kind: literal("contains"),
+		value: string(),
+		caseSensitive: boolean().optional(),
+		...severityFields
+	}),
+	object({
+		kind: literal("not_contains"),
+		value: string(),
+		caseSensitive: boolean().optional(),
+		...severityFields
+	}),
+	object({
+		kind: literal("matches_expected"),
+		...severityFields
+	}),
+	object({
+		kind: literal("regex"),
+		pattern: string(),
+		flags: string().optional(),
+		...severityFields
+	}),
+	object({
+		kind: literal("valid_json"),
+		...severityFields
+	}),
+	object({
+		kind: literal("json_field"),
+		path: string(),
+		equals: unknown().optional(),
+		exists: boolean().optional(),
+		...severityFields
+	}),
+	object({
+		kind: literal("length"),
+		minChars: number().int().nonnegative().optional(),
+		maxChars: number().int().nonnegative().optional(),
+		...severityFields
+	}),
+	object({
+		kind: literal("latency"),
+		maxMs: number().int().positive(),
+		...severityFields
+	}),
+	object({
+		kind: literal("no_error"),
+		...severityFields
+	}),
+	object({
+		kind: literal("called_tool"),
+		name: string().min(1),
+		input: unknown().optional(),
+		output: unknown().optional(),
+		isError: boolean().optional(),
+		times: number().int().positive().optional(),
+		...severityFields
+	}),
+	object({
+		kind: literal("not_called_tool"),
+		name: string().min(1),
+		...severityFields
+	}),
+	object({
+		kind: literal("used_no_tools"),
+		...severityFields
+	}),
+	object({
+		kind: literal("max_tool_calls"),
+		max: number().int().nonnegative(),
+		...severityFields
+	}),
+	object({
+		kind: literal("tool_order"),
+		tools: array(string()).min(1),
+		...severityFields
+	}),
+	object({
+		kind: literal("ran_step"),
+		name: string().min(1),
+		...severityFields
+	}),
+	object({
+		kind: literal("step_order"),
+		steps: array(string()).min(1),
+		...severityFields
+	}),
+	object({
+		kind: literal("completed"),
+		...severityFields
+	}),
+	object({
+		kind: literal("cost"),
+		maxUsd: number().positive(),
+		...severityFields
+	})
+]);
+const aiGraderSchema = object({
+	kind: literal("ai"),
+	preset: _enum(BUILT_IN_GRADER_IDS).optional(),
+	/** Plain language: "what does a good answer look like?" */
+	criteria: string().min(1),
+	/** Reference-guided when the case has `expected`. */
+	useExpected: boolean().default(false),
+	/** Defaults to the Runtype Eval Judge flow's model pair (`EVAL_JUDGE_MODEL` with a cross-provider fallback) at execution time. Ignored when `judgeFlowId` is set (the flow's own steps pin their models). */
+	model: string().optional(),
+	/**
+	* Custom judge flow: the escape hatch when the platform judge prompt isn't enough.
+	* The referenced flow runs through the normal pipeline, receiving the four EvalJudgeVariables as inputs.
+	* Its output must match the same verdict JSON contract the platform judge returns.
+	* A missing/failed/malformed judge resolves to insufficient_evidence with a visible error; it never decides cases.
+	*/
+	judgeFlowId: string().min(1).optional(),
+	/** Pass cutoff for the 1-5 scale. */
+	threshold: number().min(1).max(5).optional(),
+	/**
+	* The platform judge-prompt version that produced this grader's most recent outcome.
+	* Stamped by grader-executor.ts at grade time; not settable by callers.
+	* Any caller-supplied value is overwritten before scoring, or stripped for judgeFlowId graders.
+	*/
+	judgePromptVersion: number().int().positive().optional(),
+	...severityFields
+});
+const judgeVerdictSchema = _enum([
+	"pass",
+	"fail",
+	"insufficient_evidence"
+]);
+_enum(["agree", "disagree"]);
+const judgeEvidenceSchema = object({
+	kind: _enum(["message", "tool_call"]),
+	/**
+	* Position in the transcript the judge was shown: an index into
+	* `GradingTrace.steps` for `kind: 'message'`, or `GradingTrace.toolCalls`
+	* for `kind: 'tool_call'` — the same ordering the transcript renderer
+	* numbered when building the judge prompt.
+	*/
+	index: number().int().nonnegative()
+});
+const graderConfigSchema = union([checkGraderSchema, aiGraderSchema]);
+/** The executed grader snapshot carries server metadata that authored grader config deliberately omits. */
+const evalGraderSnapshotSchema = graderConfigSchema.and(object({ judgeDiagnostics: judgeDiagnosticsSchema.optional() }));
+array(graderConfigSchema);
+const caseExpectedSchema = object({
+	text: string().optional(),
+	json: unknown().optional(),
+	facts: array(string()).optional()
+});
+_enum([
+	"manual",
+	"saved_from_run",
+	"generated",
+	"imported",
+	"fpo",
+	"ensure"
+]);
+/**
+* Where a saved_from_run case was forked from.
+* Exactly one of sourceExecutionId / sourceConversationId identifies the origin trace.
+* forkMessageIndex is the count of frozen history messages kept before the graded next step.
+* The fork slices history at [0, forkMessageIndex).
+*/
+const caseCheckpointSchema = object({
+	/** Execution id the case was captured from (`from-execution`). */
+	sourceExecutionId: string().optional(),
+	/** Conversation id the case was captured from (`from-conversation`). */
+	sourceConversationId: string().optional(),
+	/**
+	* Number of leading history messages kept before the fork point — the
+	* length of the frozen `input.messages` prefix the target is seeded with.
+	*/
+	forkMessageIndex: number().int().nonnegative()
+}).strict();
+/**
+* A REQUIRED 'any JSON value' field, unlike a bare z.unknown()/z.any().
+* Zod's isOptional() returns true for unknown()/any(), which silently made this field optional in the OpenAPI spec/SDKs.
+* A union of concrete JSON-value types has isOptional() = false, so the field correctly lands in 'required'.
+* Also TS-compatible: z.custom() would throw UnknownZodTypeError in this repo's OpenAPI generator.
+*/
+const requiredJsonValueSchema = union([
+	_null(),
+	boolean(),
+	number(),
+	string(),
+	array(any()),
+	record(string(), any())
+]);
+/**
+* One recorded tool result captured from a run, matched to a replayed call by toolName.
+* output is the finalized tool result (scrubbed + possibly truncated at capture).
+* sourceToolExecutionId is the tool_executions row it came from, for audit.
+* Editing output turns any recorded case into a counterfactual for free.
+*/
+const toolMockSchema = object({
+	toolName: string().min(1),
+	input: unknown().optional(),
+	output: requiredJsonValueSchema,
+	/**
+	* True when the recorded call FAILED — `output` is then the error payload,
+	* and a replay must serve it as a failure, not a success. Captured now so
+	* the bit survives even after the source `tool_executions` rows age out.
+	*/
+	isError: boolean().optional(),
+	/** The `tool_executions.id` this mock was captured from, when persisted. */
+	sourceToolExecutionId: string().optional(),
+	/** True when `output` was capped at `MAX_TOOL_MOCK_OUTPUT_CHARS` on capture. */
+	truncated: boolean().optional()
+}).strict();
+_enum([
+	"definition",
+	"trace",
+	"feedback",
+	"coverage_gap"
+]);
+_enum([
+	"proposed",
+	"accepted",
+	"edited_accepted",
+	"rejected"
+]);
+object({
+	name: string().min(1),
+	input: object({
+		variables: record(string(), unknown()).optional(),
+		messages: array(object({
+			role: string().min(1),
+			content: string()
+		}).passthrough()).optional(),
+		checkpoint: caseCheckpointSchema.optional(),
+		toolMocks: array(toolMockSchema).optional(),
+		endUser: hostEndUserIdentitySchema.optional(),
+		tenant: hostTenantIdentitySchema.optional()
+	}).strict(),
+	expected: caseExpectedSchema.optional(),
+	notes: string().optional()
+}).strict();
+export { graderConfigSchema as a, hostTenantIdentitySchema as c, toolMockSchema as d, evalIdentityDefaultsSchema as i, judgeEvidenceSchema as l, caseExpectedSchema as n, graderSeveritySchema as o, evalGraderSnapshotSchema as r, hostEndUserIdentitySchema as s, caseCheckpointSchema as t, judgeVerdictSchema as u };
+