@runtypelabs/cli 2.59.1 → 2.59.4

package/dist/chunk-BVMhjGVe.js

@@ -0,0 +1,826 @@
+#!/usr/bin/env node
+import { C as unknown, S as union, b as string, c as boolean, d as lazy, f as literal, h as object, i as _enum, l as custom, m as number, o as any, p as never, s as array, v as record, y as strictObject } from "./chunk-BOpO6xE-.js";
+import { t as isRecord } from "./chunk-QSfNYiw9.js";
+/**
+* Well-known system variables always available at execution time, populated by the engine (system-vars.ts).
+* Canonical set; flow-validator-core.ts and other consumers import it rather than re-declaring it.
+* MESSAGE_VARIABLES are a subset, spread in below so there is a single source.
+*/
+const SYSTEM_VARIABLES = /* @__PURE__ */ new Set([
+	"_flow",
+	"_user",
+	"_execution",
+	"_record",
+	"_now",
+	"_schedule",
+	"_conversation",
+	"_tools",
+	"_endUser",
+	"_tenant",
+	.../* @__PURE__ */ new Set([
+		"messages",
+		"userMessage",
+		"lastMessage",
+		"messageCount"
+	])
+]);
+/**
+* Canonical {{secret:KEY}} detection regex; KEY is upper-snake, e.g. {{secret:OPENAI_API_KEY}}.
+* Narrower than the general {{var}} form so secret tokens never collide with parameter templates.
+* Single source of truth; historical duplicates import this constant instead of re-declaring the literal.
+* Build a fresh regex per call when iterating matches so the shared instance's lastIndex is never mutated.
+*/
+const SECRET_REF_PATTERN = /\{\{secret:([A-Z][A-Z0-9_]*[A-Z0-9])\}\}/g;
+/**
+* The recognized namespace prefixes and their semantics. Keyed by the literal
+* prefix (with trailing colon). Adding a namespace here is the one-line change
+* that teaches every layer about it.
+*/
+const RUNTIME_PREFIXES = {
+	"secret:": {
+		prefix: "secret:",
+		namespace: "secret",
+		resolvedBy: "the secret pre-pass (substituteSecretReferences) before the template engine runs — never the template engine itself",
+		mayReachModelUnresolved: false
+	},
+	"flow:": {
+		prefix: "flow:",
+		namespace: "flow",
+		resolvedBy: "the template engine, which treats it as an alias for the bare flow variable of the same name",
+		mayReachModelUnresolved: false
+	}
+};
+/**
+* Matches a leading `prefix:` segment. A prefix is a single identifier-ish
+* segment followed by a colon at the very start of the token. Nested paths
+* (`_record.metadata.field`) and fallback chains are NOT prefixes — they
+* contain no leading `:`-terminated segment.
+*/
+const PREFIX_PATTERN = /^([A-Za-z][A-Za-z0-9_-]*):(.*)$/s;
+/**
+* Classify a {{...}} token's variable key; the one function every layer uses to decide what a token is.
+* Pass the KEY with surrounding whitespace and any fallback operand already stripped by the caller.
+* Examples: _now.iso -> system, topic -> plain, flow:topic -> flow, secret:OPENAI -> secret, flwo:topic -> unknown.
+*/
+function classifyVariableReference(token) {
+	const trimmed = token.trim();
+	const prefixMatch = PREFIX_PATTERN.exec(trimmed);
+	if (prefixMatch) {
+		const prefix = `${prefixMatch[1]}:`;
+		const rest = prefixMatch[2] ?? "";
+		const spec = RUNTIME_PREFIXES[prefix];
+		if (spec) return {
+			namespace: spec.namespace,
+			baseName: rest.trim()
+		};
+		return {
+			namespace: "unknown",
+			raw: trimmed
+		};
+	}
+	if (isSystemVariable(trimmed)) return {
+		namespace: "system",
+		baseName: trimmed
+	};
+	return {
+		namespace: "plain",
+		baseName: trimmed
+	};
+}
+/**
+* Whether a variable key is a system variable or a nested access on one
+* (e.g. `_record.metadata.field`, `_flow.name`). The root segment is matched
+* against {@link SYSTEM_VARIABLES}.
+*/
+function isSystemVariable(varName) {
+	const rootSegment = varName.split(".")[0] || "";
+	return SYSTEM_VARIABLES.has(rootSegment);
+}
+/** Error text for a caller-supplied input key in the reserved `_` system namespace. */
+const RESERVED_INPUT_KEY_MESSAGE = "Input keys cannot start with '_' (reserved for system variables)";
+/** Whether caller-supplied `inputs` stay out of the reserved `_` system namespace. */
+function hasNoReservedInputKeys(inputs) {
+	if (!inputs) return true;
+	return Object.keys(inputs).every((key) => !key.startsWith("_"));
+}
+// ../shared/dist/chunk-9uTZDlBG.mjs
+const nonNegativeInteger = number().int().nonnegative();
+const annotations = {
+	title: string().optional(),
+	description: string().optional(),
+	default: unknown().optional()
+};
+const schemaNode = lazy(() => union([boolean(), schemaObject]));
+const schemaObject = lazy(() => strictObject({
+	...annotations,
+	type: _enum([
+		"object",
+		"array",
+		"string",
+		"number",
+		"integer",
+		"boolean",
+		"null"
+	]).optional(),
+	properties: record(string(), schemaNode).optional(),
+	required: array(string()).optional(),
+	additionalProperties: schemaNode.optional(),
+	items: schemaNode.optional(),
+	prefixItems: array(schemaNode).optional(),
+	minItems: nonNegativeInteger.optional(),
+	maxItems: nonNegativeInteger.optional(),
+	uniqueItems: boolean().optional(),
+	minProperties: nonNegativeInteger.optional(),
+	maxProperties: nonNegativeInteger.optional(),
+	minLength: nonNegativeInteger.optional(),
+	maxLength: nonNegativeInteger.optional(),
+	minimum: number().optional(),
+	maximum: number().optional(),
+	exclusiveMinimum: number().optional(),
+	exclusiveMaximum: number().optional(),
+	multipleOf: number().positive().optional(),
+	enum: array(unknown()).min(1).optional(),
+	const: unknown().optional(),
+	format: _enum([
+		"date",
+		"date-time",
+		"time",
+		"email",
+		"uri",
+		"uuid"
+	]).optional(),
+	allOf: array(schemaObject).min(1).optional(),
+	anyOf: array(schemaObject).min(1).optional(),
+	oneOf: array(schemaObject).min(1).optional(),
+	not: schemaObject.optional()
+}));
+function boundedJson(value) {
+	const pending = [{
+		value,
+		depth: 0
+	}];
+	let count = 0;
+	while (pending.length) {
+		const current = pending.pop();
+		if (++count > 4096 || current.depth > 16) return false;
+		if (current.value && typeof current.value === "object") for (const child of Object.values(current.value)) pending.push({
+			value: child,
+			depth: current.depth + 1
+		});
+		else if (typeof current.value === "string" && current.value.length > 65536) return false;
+	}
+	return true;
+}
+/** Whether a persisted form schema can be enforced by the elicitation answer validator. */
+function isSupportedElicitationSchema(schema) {
+	if (!boundedJson(schema)) return false;
+	const parsed = schemaNode.safeParse(schema);
+	return parsed.success && typeof parsed.data !== "boolean" && parsed.data.type === "object";
+}
+// ../shared/dist/chunk-CXNdCxH5.mjs
+/** The Tenancy Assurance Levels, in the order `tenancyAssuranceLevelSchema` is built from. */
+const TENANCY_ASSURANCE_LEVELS = [
+	"anonymous",
+	"asserted",
+	"verified"
+];
+const HOSTNAME_LABEL = /^(?!-)[a-z0-9-]{1,63}(?<!-)$/;
+const IPV4_LITERAL = /^(\d{1,3})\.(\d{1,3})\.(\d{1,3})\.(\d{1,3})$/;
+function isAudienceHostname(host) {
+	if (host.length === 0 || host.length > 253) return false;
+	const ipv4 = IPV4_LITERAL.exec(host);
+	if (ipv4) return ipv4.slice(1).every((octet) => Number(octet) <= 255);
+	return host.split(".").every((label) => HOSTNAME_LABEL.test(label));
+}
+/**
+* Normalize one `identityAudiences` entry: a lowercase hostname, or `*.` plus a hostname of at least
+* two labels. Returns `null` for anything else (schemes, ports, paths, a bare `*`, `*.com`).
+*/
+function normalizeIdentityAudiencePattern(pattern) {
+	if (typeof pattern !== "string") return null;
+	const lowered = pattern.trim().toLowerCase();
+	if (lowered.startsWith("*.")) {
+		const suffix = lowered.slice(2);
+		if (IPV4_LITERAL.test(suffix) || suffix.split(".").length < 2) return null;
+		return isAudienceHostname(suffix) ? `*.${suffix}` : null;
+	}
+	return isAudienceHostname(lowered) ? lowered : null;
+}
+/**
+* Whether an assertion audience is one the tool's `identityAudiences` permits. A `*.` pattern
+* matches exactly one extra label, so `*.example.com` admits `pr-1.example.com` only.
+*/
+function identityAudienceAllowed(audience, patterns) {
+	const host = audience.toLowerCase();
+	return patterns.some((pattern) => {
+		if (!pattern.startsWith("*.")) return host === pattern;
+		const suffix = pattern.slice(1);
+		if (!host.endsWith(suffix)) return false;
+		const label = host.slice(0, -suffix.length);
+		return HOSTNAME_LABEL.test(label);
+	});
+}
+// ../shared/dist/chunk-D0Rc89Pf.mjs
+function extractSecretReferences(template) {
+	const keys = /* @__PURE__ */ new Set();
+	let match;
+	const regex = new RegExp(SECRET_REF_PATTERN.source, "g");
+	while ((match = regex.exec(template)) !== null) {
+		const key = match[1];
+		if (key) keys.add(key);
+	}
+	return Array.from(keys);
+}
+function extractSecretReferencesFromAnyValue(value, maxDepth = 10) {
+	const keys = /* @__PURE__ */ new Set();
+	walk(value, 0);
+	return Array.from(keys);
+	function walk(v, depth) {
+		if (depth > maxDepth) return;
+		if (typeof v === "string") {
+			for (const key of extractSecretReferences(v)) keys.add(key);
+			return;
+		}
+		if (Array.isArray(v)) {
+			for (const item of v) walk(item, depth + 1);
+			return;
+		}
+		if (v && typeof v === "object") for (const inner of Object.values(v)) walk(inner, depth + 1);
+	}
+}
+function isManagedDeploymentTargetPath(path) {
+	if (!path.startsWith("/") || path.startsWith("//") || /[\\?#\s{}]/.test(path)) return false;
+	let decoded = path;
+	for (let pass = 0; pass < 4; pass++) {
+		if (/[\\?#]/.test(decoded) || decoded.startsWith("//")) return false;
+		if (decoded.split("/").some((part) => part === "." || part === "..")) return false;
+		let next;
+		try {
+			next = decodeURIComponent(decoded);
+		} catch {
+			return false;
+		}
+		if (next === decoded) return true;
+		if (next.split("/").length !== decoded.split("/").length) return false;
+		decoded = next;
+	}
+	return false;
+}
+const managedDeploymentTargetSchema = object({
+	kind: literal("sandbox-deployment"),
+	deploymentId: string().regex(/^sbd_[0-9abcdefghjkmnpqrstvwxyz]{20,32}$/),
+	path: string().refine(isManagedDeploymentTargetPath, "Expected a fixed relative application path").optional(),
+	bearerSecretName: string().refine((name) => extractSecretReferences(`{{secret:${name}}}`)[0] === name, "Expected a canonical managed secret name").optional()
+}).strict();
+const httpDestinationSchema = union([object({
+	url: string().min(1),
+	target: never().optional()
+}), object({
+	target: managedDeploymentTargetSchema,
+	url: never().optional()
+})]);
+function validateManagedDeploymentTargetConfig(config) {
+	if (httpDestinationSchema.safeParse(config).success) return void 0;
+	if (config.target === void 0) return "URL is required";
+	const parsed = managedDeploymentTargetSchema.safeParse(config.target);
+	if (!parsed.success) return parsed.error.issues.map((issue) => issue.message).join("; ");
+	if (config.url !== void 0) return "Use either URL or a managed deployment target, not both";
+}
+/** Validate authored targets while preserving incomplete external-tool drafts and saved MCP references. */
+function validateToolHttpDestination(tool, ctx) {
+	if (!tool || typeof tool !== "object" || Array.isArray(tool)) return;
+	if (tool.toolType !== "external" && tool.toolType !== "mcp") return;
+	if (!tool.config || typeof tool.config !== "object" || Array.isArray(tool.config)) return;
+	if (!("target" in tool.config)) return;
+	if (tool.config.target === void 0) return;
+	const issue = validateManagedDeploymentTargetConfig(tool.config);
+	if (issue) ctx.addIssue({
+		code: "custom",
+		path: ["config", "target"],
+		message: issue
+	});
+}
+const primitiveSchema = strictObject({
+	type: _enum([
+		"string",
+		"number",
+		"integer",
+		"boolean"
+	]),
+	title: string().optional(),
+	description: string().optional(),
+	enum: array(union([
+		string(),
+		number(),
+		boolean()
+	])).min(1).optional(),
+	minLength: number().int().nonnegative().optional(),
+	maxLength: number().int().nonnegative().optional(),
+	minimum: number().optional(),
+	maximum: number().optional(),
+	exclusiveMinimum: number().optional(),
+	exclusiveMaximum: number().optional()
+}).superRefine((schema, ctx) => {
+	const stringBounds = schema.minLength !== void 0 || schema.maxLength !== void 0;
+	const numberBounds = [
+		schema.minimum,
+		schema.maximum,
+		schema.exclusiveMinimum,
+		schema.exclusiveMaximum
+	].some((bound) => bound !== void 0);
+	if (stringBounds && schema.type !== "string" || numberBounds && schema.type !== "number" && schema.type !== "integer") ctx.addIssue({
+		code: "custom",
+		message: "Bounds must match the property type"
+	});
+	if (schema.enum?.some((value) => schema.type === "integer" ? !Number.isInteger(value) : typeof value !== schema.type)) ctx.addIssue({
+		code: "custom",
+		message: "Enum values must match the property type"
+	});
+	if ((schema.minLength ?? 0) > (schema.maxLength ?? Infinity) || (schema.minimum ?? -Infinity) > (schema.maximum ?? Infinity)) ctx.addIssue({
+		code: "custom",
+		message: "Minimum must not exceed maximum"
+	});
+});
+const toolElicitationConfigSchema = strictObject({
+	message: string().min(1).max(4096),
+	requestedSchema: strictObject({
+		type: literal("object"),
+		title: string().optional(),
+		description: string().optional(),
+		properties: record(string(), primitiveSchema),
+		required: array(string()).optional(),
+		additionalProperties: literal(false)
+	}),
+	merge: literal("parameters")
+});
+function canonicalToolInputDefinition(value) {
+	if (Array.isArray(value)) return `[${value.map(canonicalToolInputDefinition).join(",")}]`;
+	if (isRecord(value)) return `{${Object.keys(value).sort().map((key) => `${JSON.stringify(key)}:${canonicalToolInputDefinition(value[key])}`).join(",")}}`;
+	return JSON.stringify(value) ?? "null";
+}
+/** Validate authored input against the final dispatch schema at every definition boundary. */
+function validateToolElicitationDefinition(tool, ctx) {
+	if (!isRecord(tool)) {
+		ctx.addIssue({
+			code: "custom",
+			message: "Runtime tool definition must be an object"
+		});
+		return;
+	}
+	const config = isRecord(tool.config) ? tool.config : void 0;
+	if (config?.elicit === void 0) return;
+	const issue = (message) => {
+		ctx.addIssue({
+			code: "custom",
+			path: ["config", "elicit"],
+			message
+		});
+	};
+	if (tool.toolType !== "external" && tool.toolType !== "custom") {
+		issue("Authored input is supported only on external and custom tools");
+		return;
+	}
+	const parsed = toolElicitationConfigSchema.safeParse(config.elicit);
+	if (!parsed.success) {
+		for (const error of parsed.error.issues) ctx.addIssue({
+			...error,
+			path: [
+				"config",
+				"elicit",
+				...error.path
+			]
+		});
+		return;
+	}
+	const final = tool.parametersSchema;
+	const allowedRootKeys = /* @__PURE__ */ new Set([
+		"type",
+		"title",
+		"description",
+		"properties",
+		"required",
+		"additionalProperties"
+	]);
+	if (!isSupportedElicitationSchema(final) || !isRecord(final) || final.type !== "object" || final.additionalProperties !== false || !isRecord(final.properties) || Object.keys(final).some((key) => !allowedRootKeys.has(key))) {
+		issue("Final parametersSchema must be a closed, projectable object without cross-field constraints");
+		return;
+	}
+	const requested = parsed.data.requestedSchema;
+	const names = Object.keys(requested.properties);
+	const required = requested.required ?? [];
+	const finalRequired = Array.isArray(final.required) ? final.required : [];
+	if (!names.length || required.some((name) => !names.includes(name)) || new Set(required).size !== required.length || finalRequired.some((name) => typeof name !== "string" || !Object.prototype.hasOwnProperty.call(final.properties, name))) issue("Requested properties and required fields must be nonempty and well formed");
+	for (const name of names) {
+		if (name.startsWith("_") || [
+			"constructor",
+			"prototype",
+			"__proto__"
+		].includes(name) || tool.hiddenParameterNames?.includes(name)) issue(`Human-owned property is reserved or protected: ${name}`);
+		if (!Object.prototype.hasOwnProperty.call(final.properties, name) || canonicalToolInputDefinition(final.properties[name]) !== canonicalToolInputDefinition(requested.properties[name]) || finalRequired.includes(name) !== required.includes(name)) issue(`Human-owned property must match the final schema and requiredness: ${name}`);
+	}
+}
+const IDENTITY_AUDIENCE_TOOL_TYPES = /* @__PURE__ */ new Set(["external", "mcp"]);
+const URL_AUTHORITY = /^\s*(https?):\/\/([^/?#]*)/i;
+/** The hostname of a URL whose authority is authored literally; `undefined` when it is templated or unparseable. */
+function literalUrlHost(url) {
+	if (typeof url !== "string") return void 0;
+	const match = URL_AUTHORITY.exec(url);
+	if (!match || match[2].includes("{{")) return void 0;
+	try {
+		return new URL(`${match[1].toLowerCase()}://${match[2]}`).hostname.toLowerCase() || void 0;
+	} catch {
+		return;
+	}
+}
+/**
+* The problem with a tool's `config.identityAudiences`, the hosts its `{{_identity.token}}` may be minted
+* for, or `undefined` when it is absent or valid. A literal URL host must itself be listed.
+*/
+function toolIdentityAudiencesIssue(tool) {
+	const config = isRecord(tool) && isRecord(tool.config) ? tool.config : void 0;
+	if (config?.identityAudiences === void 0) return void 0;
+	if (!IDENTITY_AUDIENCE_TOOL_TYPES.has(tool.toolType)) return "identityAudiences is supported only on external and mcp tools";
+	const raw = config.identityAudiences;
+	if (!Array.isArray(raw) || raw.length === 0 || raw.length > 20) return `identityAudiences must list 1 to 20 hostnames`;
+	const patterns = [];
+	for (const entry of raw) {
+		const normalized = normalizeIdentityAudiencePattern(entry);
+		if (!normalized) return `identityAudiences entry ${JSON.stringify(entry)} must be a hostname such as "api.example.com" or a one-label wildcard such as "*.staging.example.com"`;
+		patterns.push(normalized);
+	}
+	const host = literalUrlHost(config.url);
+	if (host && !identityAudienceAllowed(host, patterns)) return `The tool URL host "${host}" is not listed in identityAudiences`;
+}
+/** The same check for an inline MCP server, whose discovered tools inherit its `identityAudiences`. */
+function mcpServerIdentityAudiencesIssue(server) {
+	if (server.identityAudiences === void 0) return void 0;
+	return toolIdentityAudiencesIssue({
+		toolType: "mcp",
+		config: {
+			url: server.url,
+			identityAudiences: server.identityAudiences
+		}
+	});
+}
+/** Zod refinement form of `toolIdentityAudiencesIssue`, wired at every tool definition boundary. */
+function validateToolIdentityAudiences(tool, ctx) {
+	const message = toolIdentityAudiencesIssue(tool);
+	if (message) ctx.addIssue({
+		code: "custom",
+		path: ["config", "identityAudiences"],
+		message
+	});
+}
+const ToolExecutionStatus = {
+	PENDING: "pending",
+	SUCCESS: "success",
+	FAILED: "failed",
+	WAITING_FOR_LOCAL: "waiting_for_local",
+	/** The call paused at an approval gate and has not been decided. */
+	AWAITING_APPROVAL: "awaiting_approval",
+	/** The approver declined (or the approval timed out); the tool never ran. */
+	DENIED: "denied"
+};
+ToolExecutionStatus.PENDING, ToolExecutionStatus.WAITING_FOR_LOCAL, ToolExecutionStatus.AWAITING_APPROVAL;
+const MCPServerCategory = {
+	COMMUNICATION: "communication",
+	PRODUCTIVITY: "productivity",
+	DEVELOPMENT: "development",
+	PROJECT_MANAGEMENT: "project_management"
+};
+const subagentExecutionModeSchema = _enum(["attached", "detached"]);
+const subagentNotificationModeSchema = _enum([
+	"none",
+	"narrate",
+	"react"
+]);
+object({
+	/** Attached is the backwards-compatible default. */
+	mode: subagentExecutionModeSchema.optional(),
+	/** Detached tools default to `narrate`; attached tools ignore this field. */
+	notify: subagentNotificationModeSchema.optional(),
+	/** Absolute background-run wall-clock ceiling. */
+	maxBudgetMs: number().int().min(1e3).max(864e5).optional(),
+	/** Optional resetting silence budget after observable progress. */
+	noProgressBudgetMs: number().int().min(1e3).max(864e5).optional()
+});
+object({
+	kind: literal("subagent_run"),
+	runId: string(),
+	/**
+	* Which durable lane the child executes on. `'durable'` is the ADR 0020
+	* session DO; `'runtype'` is the in-process detached-run DO.
+	*/
+	agentType: _enum([
+		"runtype",
+		"claude_managed",
+		"durable"
+	]),
+	status: _enum(["queued", "running"]),
+	startedAt: string()
+}).extend({
+	agentType: literal("durable"),
+	status: _enum(["paused", "detached"]),
+	awaitReason: string().optional(),
+	approvalId: string().optional(),
+	toolName: string().optional(),
+	/** How the child is resumed, and whether its result is delivered to the parent conversation. */
+	resumeHint: string()
+});
+/**
+* Opt-in configuration for agent-driven dynamic subagent spawning (surface C).
+* Setting subagentConfig synthesizes a spawn_subagent tool into the AI-SDK tool list.
+* The parent's LLM picks the child's task, tool subset, and optionally systemPrompt/model,
+* drawing only from toolPool.
+*/
+const agentSubagentConfigSchema = object({
+	/**
+	* Pool of tool IDs the parent is permitted to grant to ad-hoc subagents.
+	* Supports exact IDs, wildcards (`mcp:*`, `builtin:*`, `platform:*`), and
+	* runtime-tool names. Must be a SUBSET of the parent's resolved tools —
+	* validated at dispatch (no privilege escalation).
+	*/
+	toolPool: array(string()),
+	/** Accepted but not applied yet: a spawned child's turn cap comes only from the model's `maxTurns` request. */
+	defaultMaxTurns: number().optional(),
+	/** Hard cap a spawned subagent can request. Default 10. */
+	maxTurnsLimit: number().optional(),
+	/** Hard ceiling on total spawns per top-level parent invocation. Default 5. */
+	maxSpawnsPerRun: number().optional(),
+	/** Default model for spawned subagents. Defaults to parent's model. */
+	defaultModel: string().optional(),
+	/**
+	* Whether a spawned subagent can itself spawn subagents. Default `false`
+	* (Anthropic-aligned). Even when `true`, MAX_NESTED_DEPTH still bounds the
+	* recursion tree.
+	*/
+	allowNesting: boolean().optional(),
+	/** Default per-spawn timeout. Default 300_000 (5 min). */
+	defaultTimeoutMs: number().optional(),
+	/** Execution modes the model may request. Default `['attached']`. */
+	executionModes: array(subagentExecutionModeSchema).min(1).optional(),
+	/** Default mode when the model omits `executionMode`. */
+	defaultExecutionMode: subagentExecutionModeSchema.optional(),
+	/** Default completion policy for detached dynamic children. */
+	defaultNotify: subagentNotificationModeSchema.optional(),
+	/** Absolute wall-clock ceiling for detached dynamic children. */
+	detachedMaxBudgetMs: number().int().min(1e3).max(864e5).optional(),
+	/** Optional resetting silence budget for detached dynamic children. */
+	detachedNoProgressBudgetMs: number().int().min(1e3).max(864e5).optional()
+});
+/**
+* Configuration for the synthesized `code_mode` agent tool.
+* When set on AgentToolsConfig, the prompt-step layer creates a tool that
+* lets the LLM write and execute JavaScript with access to a subset of tools.
+*/
+const codeModeConfigSchema = object({
+	/** Tool IDs available in the sandbox (subset of agent's tools, supports wildcards like `mcp:*`) */
+	toolPool: array(string()),
+	/** Optional custom description prefix for the synthesized tool */
+	description: string().optional(),
+	/** Sandbox execution timeout in ms (default 60000) */
+	timeoutMs: number().optional()
+});
+const toolLimitSchema = object({
+	maxCalls: number().optional(),
+	required: boolean().optional()
+});
+/**
+* Approval configuration for human-in-the-loop tool approval.
+* Lives under `tools.approval` in agent/flow configs.
+*/
+const approvalConfigSchema = object({
+	/** Tools that require user approval before execution.
+	*  string[]: tool names/patterns ("send_email", "mcp:*", "builtin:*")
+	*  true: all tools require approval
+	*  false/undefined: no approval required (default) */
+	require: union([array(string()), boolean()]).optional(),
+	/** Timeout in ms for approval response (default: 300000 = 5 min) */
+	timeout: number().optional(),
+	/** Messaging channels only: whether a timed-out approval posts the agent's follow-up.
+	*  Default true. With false the run ends on timeout without resuming the agent, so nothing is sent. */
+	notifyUser: boolean().optional(),
+	/** Whether to ask the model for a per-call justification on approval-gated
+	*  tools by injecting a reserved optional `_approvalReason` string into the
+	*  model-visible parameters schema. The value is stripped before the tool
+	*  executes and surfaced to the approver. Default: true (opt out with false). */
+	requestReason: boolean().optional(),
+	/**
+	* Who may answer the gate. `owner` (default) is authorization by the builder org;
+	* `end-user` lets a client-token chat visitor give consent (confirm their own order);
+	* never for policy or budget gates. Stamped into the pause at pause time.
+	*/
+	approver: _enum(["owner", "end-user"]).optional(),
+	/**
+	* Persistent "always" choices at the human approval prompt; user-facing options, not auto-behavior.
+	* Keys mirror the grant decision enum (alwaysAllow -> 'allow', alwaysDeny -> 'deny').
+	* Default: both off; this is the sole control for persisted approval grants (no Flagship flag).
+	* See docs/features/planning/2026-06-13-cross-session-always-allow-approval-grants.md
+	*/
+	choices: object({
+		alwaysAllow: boolean().optional(),
+		alwaysDeny: boolean().optional()
+	}).optional()
+});
+const toolSearchConfigSchema = object({
+	/** On by default for agents; false opts out, true forces it on below the threshold. Multi-turn runs only. */
+	enabled: boolean().optional(),
+	/** Tool count at which search activates (default: 20) */
+	threshold: number().optional(),
+	/** Tool names or IDs that should always be in the hot set */
+	alwaysLoaded: array(string()).optional()
+});
+/**
+* When a durable host may run a non-idempotent server-side tool. `mandatory`: only once its
+* intent is committed; a refused intent answers `TOOL_INTENT_NOT_COMMITTED` and never runs it.
+* `best-effort` (the default): the intent write never blocks the call.
+*/
+const toolIntentPolicySchema = _enum(["mandatory", "best-effort"]);
+/**
+* Unified tool configuration used by both agents and flow steps; the canonical source of truth.
+* AgentToolsConfig is z.infer'd from this; fpo-schema.ts, runtime/schemas.ts, and skill-manifest-types.ts are documented projections.
+* Distinct from the simpler ToolsConfig in client-types.ts (client SDK requests).
+* runtimeTools/mcpServers use z.custom<T>() so structural validation stays deferred to validateRuntimeTools.
+*/
+const agentToolsConfigSchema = object({
+	/** IDs of tools to enable (builtin:*, mcp:*, platform:*, platform:orthogonal:*, custom tool IDs) */
+	toolIds: array(string()).optional(),
+	/** Per-tool parameter configurations, keyed by tool ID */
+	toolConfigs: record(string(), custom()).optional(),
+	/** Inline tool definitions (no DB storage needed) */
+	runtimeTools: array(custom().superRefine(validateToolHttpDestination).superRefine(validateToolElicitationDefinition).superRefine(validateToolIdentityAudiences)).optional(),
+	/** Runtime MCP server connections */
+	mcpServers: array(custom()).optional(),
+	/** Maximum tool calls per execution (renamed from maxTurns in agents) */
+	maxToolCalls: number().optional(),
+	/** Tool calling strategy */
+	toolCallStrategy: _enum([
+		"auto",
+		"required",
+		"none"
+	]).optional(),
+	/** Per-tool call limits */
+	perToolLimits: record(string(), toolLimitSchema).optional(),
+	/** Human-in-the-loop approval configuration */
+	approval: approvalConfigSchema.optional(),
+	/**
+	* Opt-in: enables agent-driven dynamic subagent spawning. When set, the
+	* prompt-step tool-prep layer synthesizes a `spawn_subagent` tool into the
+	* AI-SDK tool list with a dynamically-generated description listing the
+	* tools the parent's LLM can grant. See `AgentSubagentConfig` for fields.
+	*/
+	subagentConfig: agentSubagentConfigSchema.optional(),
+	/**
+	* Opt-in: enables a synthesized `code_mode` tool that lets agents execute
+	* JavaScript code in a sandboxed V8 isolate with access to a subset of
+	* the agent's tools. The LLM writes code that calls tool functions
+	* deterministically instead of making individual tool calls.
+	*/
+	codeModeConfig: codeModeConfigSchema.optional(),
+	/**
+	* Tool search configuration; when total tool count exceeds the threshold, deferred loading activates.
+	* Only a hot set of tools is sent to the model each turn; tool_search lets it discover more on demand.
+	* On by default for agents: activates on a multi-turn run once the tool count reaches 20, even when omitted.
+	* Set enabled: false to force all tools to be sent regardless of count.
+	*/
+	toolSearch: toolSearchConfigSchema.optional(),
+	/** Intent policy for non-idempotent server-side tools on a durable host; default `best-effort`. */
+	intent: toolIntentPolicySchema.optional()
+});
+const CreateToolSchema = object({
+	name: string().min(1).max(100),
+	description: string().min(1).max(500),
+	toolType: _enum([
+		"flow",
+		"custom",
+		"external",
+		"graphql",
+		"mcp",
+		"local",
+		"subagent"
+	]),
+	parametersSchema: record(string(), any()),
+	config: record(string(), any())
+}).superRefine(validateToolElicitationDefinition).superRefine(validateToolIdentityAudiences);
+object({
+	toolId: string().optional(),
+	parameters: record(string(), any()),
+	toolConfig: record(string(), unknown()).optional().describe("Built-in tools only: the instance config an agent's toolConfigs entry would carry, validated against the tool's configSchema. Rejected for a saved tool."),
+	context: object({
+		flowExecutionId: string().optional(),
+		stepId: string().optional(),
+		userId: string()
+	}).optional()
+});
+/**
+* Parse a tool instance ID into its base ID and instance ID
+* @param toolId - Tool ID that may include instance suffix (e.g., "builtin:vector-search#abc123")
+* @returns Object with baseId (e.g., "builtin:vector-search") and instanceId (e.g., "abc123")
+*/
+function parseToolInstanceId(toolId) {
+	const hashIndex = toolId.indexOf("#");
+	if (hashIndex === -1) return {
+		baseId: toolId,
+		instanceId: ""
+	};
+	return {
+		baseId: toolId.substring(0, hashIndex),
+		instanceId: toolId.substring(hashIndex + 1)
+	};
+}
+/**
+* Check if a tool ID represents a built-in tool
+*/
+function isBuiltInToolId(toolId) {
+	return toolId.startsWith("builtin:");
+}
+/**
+* Check if a tool ID represents a platform integration tool
+*/
+function isPlatformToolId(toolId) {
+	return toolId.startsWith("platform:");
+}
+/**
+* Check if a tool ID represents a built-in integration tool (Slack, GitHub, etc.)
+* Format: builtin:serverId:toolName (e.g., builtin:slack:send_message)
+* This is a 3-part builtin ID, distinct from 2-part builtin IDs like builtin:gpt-image-2
+* Note: Tool instance IDs like builtin:vector-search#abc123 are NOT integration tools
+*/
+const INTEGRATION_SERVER_IDS = /* @__PURE__ */ new Set([
+	"slack",
+	"google",
+	"linear",
+	"github",
+	"telegram",
+	"imessage",
+	"granola"
+]);
+function isBuiltInIntegrationToolId(toolId) {
+	if (!toolId.startsWith("builtin:")) return false;
+	const { baseId } = parseToolInstanceId(toolId);
+	const parts = baseId.split(":");
+	if (parts.length < 3) return false;
+	return INTEGRATION_SERVER_IDS.has(parts[1]);
+}
+/**
+* Check if a tool ID represents an MCP tool (custom MCP servers only)
+* Format: mcp:serverId:toolName (e.g., mcp:custom_myserver:toolname)
+*/
+function isMCPToolId(toolId) {
+	return toolId.startsWith("mcp:");
+}
+/**
+* Check if a string is a name-based saved-tool reference (`tool:<name>`).
+*/
+function isNamedToolRef(toolId) {
+	return toolId.startsWith("tool:") && toolId.length > 5;
+}
+/**
+* Parse a tool:<name> reference into its name, splitting on the first colon only.
+* The remainder is the tool name verbatim since names may contain colons, spaces, any varchar content.
+* Exact, case-sensitive; no trimming. Returns null when toolId isn't a valid named tool ref.
+*/
+function parseNamedToolRef(toolId) {
+	if (!isNamedToolRef(toolId)) return null;
+	return { name: toolId.slice(5) };
+}
+/**
+* Separate built-in, platform, integration, MCP, and custom tool IDs from a mixed array
+* - builtInToolIds: 2-part IDs like builtin:gpt-image-2
+* - integrationToolIds: 3-part IDs like builtin:slack:send_message
+* - mcpToolIds: custom MCP server tools like mcp:custom_xxx:tool
+*/
+function separateToolIds(toolIds) {
+	const builtInToolIds = [];
+	const platformToolIds = [];
+	const integrationToolIds = [];
+	const mcpToolIds = [];
+	const dataConnectionToolIds = [];
+	const namedToolIds = [];
+	const customToolIds = [];
+	for (const toolId of toolIds) if (isDataConnectionToolId(toolId)) dataConnectionToolIds.push(toolId);
+	else if (isPlatformToolId(toolId)) platformToolIds.push(toolId);
+	else if (isBuiltInIntegrationToolId(toolId)) integrationToolIds.push(toolId);
+	else if (isBuiltInToolId(toolId)) builtInToolIds.push(toolId);
+	else if (isMCPToolId(toolId)) mcpToolIds.push(toolId);
+	else if (isNamedToolRef(toolId)) namedToolIds.push(toolId);
+	else customToolIds.push(toolId);
+	return {
+		builtInToolIds,
+		platformToolIds,
+		integrationToolIds,
+		mcpToolIds,
+		dataConnectionToolIds,
+		namedToolIds,
+		customToolIds
+	};
+}
+/**
+* Check if a tool ID represents a data connection tool
+* Format: dc:{connectionId}:{action}
+*/
+function isDataConnectionToolId(toolId) {
+	return toolId.startsWith("dc:");
+}
+export { classifyVariableReference as C, SECRET_REF_PATTERN as S, validateToolHttpDestination as _, isBuiltInIntegrationToolId as a, RESERVED_INPUT_KEY_MESSAGE as b, managedDeploymentTargetSchema as c, parseToolInstanceId as d, separateToolIds as f, validateToolElicitationDefinition as g, validateManagedDeploymentTargetConfig as h, extractSecretReferencesFromAnyValue as i, mcpServerIdentityAudiencesIssue as l, toolSearchConfigSchema as m, MCPServerCategory as n, isBuiltInToolId as o, toolIntentPolicySchema as p, agentToolsConfigSchema as r, isPlatformToolId as s, CreateToolSchema as t, parseNamedToolRef as u, validateToolIdentityAudiences as v, hasNoReservedInputKeys as w, RUNTIME_PREFIXES as x, TENANCY_ASSURANCE_LEVELS as y };
+