@runtypelabs/sdk 10.5.3 → 10.6.0

package/dist/index.cjs

@@ -2352,12 +2352,13 @@ const DEFAULT_BLOCKED_CODE_PATTERNS = [
 	/\bsubprocess\b/i,
 	/\bos\.system\s*\(/i
 ];
-const DEFAULT_ALLOWED_SANDBOX_PROVIDERS = [
+const CUSTOM_TOOL_SANDBOX_PROVIDERS = [
 	"quickjs",
 	"daytona",
 	"cloudflare-worker",
-	"cloudflare-sandbox"
+	"runtype-sandbox"
 ];
+const DEFAULT_ALLOWED_SANDBOX_PROVIDERS = [...CUSTOM_TOOL_SANDBOX_PROVIDERS, "cloudflare-sandbox"];
 const DEFAULT_ALLOWED_LANGUAGES = [
 	"javascript",
 	"typescript",
@@ -2379,7 +2380,21 @@ function isLanguage(value) {
 	return value === "javascript" || value === "typescript" || value === "python";
 }
 function isSandboxProvider(value) {
-	return value === "quickjs" || value === "daytona" || value === "cloudflare-worker";
+	return CUSTOM_TOOL_SANDBOX_PROVIDERS.includes(value);
+}
+function isNetworkAccess(value) {
+	if (value === "off" || value === "on") return true;
+	if (!isObject(value) || !Array.isArray(value.allowedHostnames)) return false;
+	const hosts = value.allowedHostnames;
+	return hosts.length > 0 && hosts.every((host) => typeof host === "string" && host.length > 0);
+}
+/** Why the requested posture exceeds what the caller allowed, or null when it fits. */
+function networkAccessViolation(requested, allowed) {
+	if (requested === void 0 || requested === "off" || allowed === true) return null;
+	if (!allowed) return "Generated tool requests network access, which this gate does not allow";
+	if (requested === "on") return "Generated tool requests unrestricted network access; only an allowedHostnames list is allowed";
+	const outside = requested.allowedHostnames.filter((host) => !allowed.allowedHostnames.includes(host));
+	return outside.length > 0 ? `Generated tool requests hosts outside the allowed list: ${outside.join(", ")}` : null;
 }
 function isJSONSchema(value) {
 	if (!isObject(value)) return false;
@@ -2426,6 +2441,12 @@ function normalizeGeneratedProposal(proposal, violations) {
 	const sandboxProviderRaw = config.sandboxProvider;
 	const languageRaw = config.language;
 	const timeoutRaw = config.timeout;
+	const sandboxProvider = isSandboxProvider(sandboxProviderRaw) ? sandboxProviderRaw : "cloudflare-worker";
+	const language = isLanguage(languageRaw) ? languageRaw : "javascript";
+	const timeout = asNumber(timeoutRaw);
+	if (Array.isArray(config.secrets) && config.secrets.length > 0) violations.push("Generated tools cannot declare config.secrets (managed credentials)");
+	const networkAccess = config.networkAccess;
+	if (networkAccess !== void 0 && !isNetworkAccess(networkAccess)) violations.push("config.networkAccess must be 'off', 'on', or { allowedHostnames: string[] }");
 	return {
 		name,
 		description,
@@ -2433,9 +2454,10 @@ function normalizeGeneratedProposal(proposal, violations) {
 		parametersSchema,
 		config: {
 			code,
-			sandboxProvider: isSandboxProvider(sandboxProviderRaw) ? sandboxProviderRaw : "cloudflare-worker",
-			language: isLanguage(languageRaw) ? languageRaw : "javascript",
-			timeout: asNumber(timeoutRaw)
+			sandboxProvider,
+			language,
+			timeout,
+			...isNetworkAccess(networkAccess) ? { networkAccess } : {}
 		}
 	};
 }
@@ -2488,6 +2510,8 @@ function evaluateGeneratedRuntimeToolProposal(proposal, options = {}) {
 			violations.push(`Generated code matched blocked pattern: ${pattern}`);
 			break;
 		}
+		const networkViolation = networkAccessViolation(normalized.config.networkAccess, options.allowNetworkAccess);
+		if (networkViolation) violations.push(networkViolation);
 	}
 	const tool = {
 		name: normalized.name,
@@ -13457,7 +13481,7 @@ function transformQueryParams(params) {
 }
 //#endregion
 //#region src/version.ts
-const SDK_VERSION = "10.5.3";
+const SDK_VERSION = "10.6.0";
 /**
 * Canonical client identity the API uses for attribution
 * (`detectActorSource` in apps/api/src/lib/audit-log.ts keys `'sdk'` off the

package/dist/index.d.cts

@@ -117,6 +117,45 @@ interface ContextErrorHandling {
  * Do not make direct changes to the file.
  */
 interface paths {
+  "/.well-known/jwks.json": {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Identity assertion signing keys (JWKS)
+     * @description Public keys that verify the Runtype-signed `{{_identity.token}}` a tool call carries. Verify offline: check the ES256 signature against the key whose `kid` matches the token header, then `iss` (pin it to the one Runtype organization you trust: `<API origin>/orgs/<organizationId>`), `aud` (your host), `exp`, and the per-scope assurance in the `runtype` claim. Cache the response for up to five minutes; re-fetch when a token names an unknown `kid`.
+     */
+    get: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path?: never;
+        cookie?: never;
+      };
+      requestBody?: never;
+      responses: {
+        /** @description The published key set. Empty when this environment has no signing key configured. */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["IdentityAssertionJwks"];
+          };
+        };
+      };
+    };
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
   "/v1/agent-aliases": {
     parameters: {
       query?: never;
@@ -40582,6 +40621,15 @@ interface paths {
             "application/json": components["schemas"]["Error"];
           };
         };
+        /** @description A target record changed while the edit was applied (`record_conflict`); nothing was written, retry the edit */
+        409: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["Error"];
+          };
+        };
         /** @description A record's post-merge metadata violates its type's collection schema (enforce mode); the whole edit is rejected */
         422: {
           headers: {
@@ -41215,7 +41263,7 @@ interface paths {
               /** @enum {string} */
               role: "user" | "assistant";
             }[] | null;
-            /** @default {} */
+            /** @description Replaces the whole metadata object. Omit to leave metadata unchanged. */
             metadata?: {
               [key: string]: unknown;
             };
@@ -41306,7 +41354,7 @@ interface paths {
             "application/json": components["schemas"]["Error"];
           };
         };
-        /** @description Duplicate record */
+        /** @description Duplicate record (`duplicate_record`), or the record changed while this update was applied (`record_conflict`; re-read and retry) */
         409: {
           headers: {
             [name: string]: unknown;
@@ -53230,6 +53278,24 @@ interface components {
       valid: boolean;
       warnings: components["schemas"]["FlowValidationIssue"][];
     };
+    IdentityAssertionJwks: {
+      /** @description Every key that may have signed a live assertion: the active key first, then verify-only keys kept for rotation. */
+      keys: components["schemas"]["IdentityAssertionPublicJwk"][];
+    };
+    IdentityAssertionPublicJwk: {
+      /** @description Always `ES256`. */
+      alg: string;
+      /** @description Curve; always `P-256`. */
+      crv: string;
+      /** @description Key id, matched against the token header `kid`. */
+      kid: string;
+      /** @description Key type; always `EC`. */
+      kty: string;
+      /** @description Always `sig`. */
+      use: string;
+      x: string;
+      y: string;
+    };
     InputDeliveryReceipt: {
       deliveryId: string;
       executionId: string;
@@ -56763,8 +56829,23 @@ export interface RuntimeFlowToolConfig {
 export interface RuntimeCustomToolConfig {
   code: string;
   language?: 'javascript' | 'typescript' | 'python';
-  sandboxProvider?: 'quickjs' | 'daytona' | 'cloudflare-worker';
+  sandboxProvider?: 'quickjs' | 'daytona' | 'cloudflare-worker' | 'runtype-sandbox';
   timeout?: number;
+  /** Egress posture for the code. Omitted means `'off'`; prefer an `allowedHostnames` list. */
+  networkAccess?: 'off' | 'on' | {
+    allowedHostnames: string[];
+  };
+  /** Managed secrets the code may send, read as phantom tokens from `secrets.<key>`. Requires SECRETS:READ. */
+  secrets?: RuntimeCustomToolSecret[];
+}
+/** One managed secret a custom tool may send; the egress proxy injects it only for the matching host and path. */
+export interface RuntimeCustomToolSecret {
+  /** Bare managed secret name, e.g. `GITHUB_TOKEN`. */
+  key: string;
+  hostnamePattern: string;
+  pathPattern?: string;
+  injectionMode: 'bearer_header' | 'api_key_header' | 'query_param' | 'basic_auth';
+  injectionConfig?: Record<string, JsonValue>;
 }
 export interface RuntimeExternalToolConfig {
   url: string;
@@ -62538,14 +62619,16 @@ interface ApiKeyRequestListParams {
 }
 //#endregion
 //#region src/generated-tool-gate.d.ts
+declare const CUSTOM_TOOL_SANDBOX_PROVIDERS: readonly ["quickjs", "daytona", "cloudflare-worker", "runtype-sandbox"];
+type GateSandboxProvider = (typeof CUSTOM_TOOL_SANDBOX_PROVIDERS)[number] | 'cloudflare-sandbox';
 interface GeneratedRuntimeToolGateOptions {
   /**
    * Allowed runtime tool types.
    * Defaults to ['custom'] because this gate is intended for generated code tools.
    */
   allowedToolTypes?: Array<'custom' | 'external' | 'flow' | 'local'>;
-  /** Allowed sandbox providers for generated custom tools. Defaults to ['quickjs', 'daytona', 'cloudflare-worker', 'cloudflare-sandbox']. */
-  allowedSandboxProviders?: Array<'quickjs' | 'daytona' | 'cloudflare-worker' | 'cloudflare-sandbox'>;
+  /** Allowed sandbox providers for generated custom tools. Defaults to every provider, including runtype-sandbox and its cloudflare-sandbox alias. */
+  allowedSandboxProviders?: GateSandboxProvider[];
   /** Allowed languages for generated custom tools. Defaults to JS/TS/Python. */
   allowedLanguages?: Array<'javascript' | 'typescript' | 'python'>;
   /** Maximum allowed code size in characters (default 12000). */
@@ -62561,6 +62644,15 @@ interface GeneratedRuntimeToolGateOptions {
   blockedCodePatterns?: RegExp[];
   /** Optional custom validator for additional policy checks. Return a violation message to reject. */
   customValidator?: (tool: RuntimeTool) => string | null;
+  /**
+   * Network egress a generated custom tool may request via `config.networkAccess`. Off by default:
+   * a proposal asking for anything but `'off'` is rejected. `true` passes the requested posture
+   * through; `{ allowedHostnames }` accepts only an allowlist within those hosts. A generated tool
+   * can never declare `config.secrets`: managed credentials are always rejected by this gate.
+   */
+  allowNetworkAccess?: boolean | {
+    allowedHostnames: string[];
+  };
 }
 interface GeneratedRuntimeToolGateDecision {
   approved: boolean;

package/dist/index.d.ts

@@ -117,6 +117,45 @@ interface ContextErrorHandling {
  * Do not make direct changes to the file.
  */
 interface paths {
+  "/.well-known/jwks.json": {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Identity assertion signing keys (JWKS)
+     * @description Public keys that verify the Runtype-signed `{{_identity.token}}` a tool call carries. Verify offline: check the ES256 signature against the key whose `kid` matches the token header, then `iss` (pin it to the one Runtype organization you trust: `<API origin>/orgs/<organizationId>`), `aud` (your host), `exp`, and the per-scope assurance in the `runtype` claim. Cache the response for up to five minutes; re-fetch when a token names an unknown `kid`.
+     */
+    get: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path?: never;
+        cookie?: never;
+      };
+      requestBody?: never;
+      responses: {
+        /** @description The published key set. Empty when this environment has no signing key configured. */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["IdentityAssertionJwks"];
+          };
+        };
+      };
+    };
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
   "/v1/agent-aliases": {
     parameters: {
       query?: never;
@@ -40582,6 +40621,15 @@ interface paths {
             "application/json": components["schemas"]["Error"];
           };
         };
+        /** @description A target record changed while the edit was applied (`record_conflict`); nothing was written, retry the edit */
+        409: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["Error"];
+          };
+        };
         /** @description A record's post-merge metadata violates its type's collection schema (enforce mode); the whole edit is rejected */
         422: {
           headers: {
@@ -41215,7 +41263,7 @@ interface paths {
               /** @enum {string} */
               role: "user" | "assistant";
             }[] | null;
-            /** @default {} */
+            /** @description Replaces the whole metadata object. Omit to leave metadata unchanged. */
             metadata?: {
               [key: string]: unknown;
             };
@@ -41306,7 +41354,7 @@ interface paths {
             "application/json": components["schemas"]["Error"];
           };
         };
-        /** @description Duplicate record */
+        /** @description Duplicate record (`duplicate_record`), or the record changed while this update was applied (`record_conflict`; re-read and retry) */
         409: {
           headers: {
             [name: string]: unknown;
@@ -53230,6 +53278,24 @@ interface components {
       valid: boolean;
       warnings: components["schemas"]["FlowValidationIssue"][];
     };
+    IdentityAssertionJwks: {
+      /** @description Every key that may have signed a live assertion: the active key first, then verify-only keys kept for rotation. */
+      keys: components["schemas"]["IdentityAssertionPublicJwk"][];
+    };
+    IdentityAssertionPublicJwk: {
+      /** @description Always `ES256`. */
+      alg: string;
+      /** @description Curve; always `P-256`. */
+      crv: string;
+      /** @description Key id, matched against the token header `kid`. */
+      kid: string;
+      /** @description Key type; always `EC`. */
+      kty: string;
+      /** @description Always `sig`. */
+      use: string;
+      x: string;
+      y: string;
+    };
     InputDeliveryReceipt: {
       deliveryId: string;
       executionId: string;
@@ -56763,8 +56829,23 @@ export interface RuntimeFlowToolConfig {
 export interface RuntimeCustomToolConfig {
   code: string;
   language?: 'javascript' | 'typescript' | 'python';
-  sandboxProvider?: 'quickjs' | 'daytona' | 'cloudflare-worker';
+  sandboxProvider?: 'quickjs' | 'daytona' | 'cloudflare-worker' | 'runtype-sandbox';
   timeout?: number;
+  /** Egress posture for the code. Omitted means `'off'`; prefer an `allowedHostnames` list. */
+  networkAccess?: 'off' | 'on' | {
+    allowedHostnames: string[];
+  };
+  /** Managed secrets the code may send, read as phantom tokens from `secrets.<key>`. Requires SECRETS:READ. */
+  secrets?: RuntimeCustomToolSecret[];
+}
+/** One managed secret a custom tool may send; the egress proxy injects it only for the matching host and path. */
+export interface RuntimeCustomToolSecret {
+  /** Bare managed secret name, e.g. `GITHUB_TOKEN`. */
+  key: string;
+  hostnamePattern: string;
+  pathPattern?: string;
+  injectionMode: 'bearer_header' | 'api_key_header' | 'query_param' | 'basic_auth';
+  injectionConfig?: Record<string, JsonValue>;
 }
 export interface RuntimeExternalToolConfig {
   url: string;
@@ -62538,14 +62619,16 @@ interface ApiKeyRequestListParams {
 }
 //#endregion
 //#region src/generated-tool-gate.d.ts
+declare const CUSTOM_TOOL_SANDBOX_PROVIDERS: readonly ["quickjs", "daytona", "cloudflare-worker", "runtype-sandbox"];
+type GateSandboxProvider = (typeof CUSTOM_TOOL_SANDBOX_PROVIDERS)[number] | 'cloudflare-sandbox';
 interface GeneratedRuntimeToolGateOptions {
   /**
    * Allowed runtime tool types.
    * Defaults to ['custom'] because this gate is intended for generated code tools.
    */
   allowedToolTypes?: Array<'custom' | 'external' | 'flow' | 'local'>;
-  /** Allowed sandbox providers for generated custom tools. Defaults to ['quickjs', 'daytona', 'cloudflare-worker', 'cloudflare-sandbox']. */
-  allowedSandboxProviders?: Array<'quickjs' | 'daytona' | 'cloudflare-worker' | 'cloudflare-sandbox'>;
+  /** Allowed sandbox providers for generated custom tools. Defaults to every provider, including runtype-sandbox and its cloudflare-sandbox alias. */
+  allowedSandboxProviders?: GateSandboxProvider[];
   /** Allowed languages for generated custom tools. Defaults to JS/TS/Python. */
   allowedLanguages?: Array<'javascript' | 'typescript' | 'python'>;
   /** Maximum allowed code size in characters (default 12000). */
@@ -62561,6 +62644,15 @@ interface GeneratedRuntimeToolGateOptions {
   blockedCodePatterns?: RegExp[];
   /** Optional custom validator for additional policy checks. Return a violation message to reject. */
   customValidator?: (tool: RuntimeTool) => string | null;
+  /**
+   * Network egress a generated custom tool may request via `config.networkAccess`. Off by default:
+   * a proposal asking for anything but `'off'` is rejected. `true` passes the requested posture
+   * through; `{ allowedHostnames }` accepts only an allowlist within those hosts. A generated tool
+   * can never declare `config.secrets`: managed credentials are always rejected by this gate.
+   */
+  allowNetworkAccess?: boolean | {
+    allowedHostnames: string[];
+  };
 }
 interface GeneratedRuntimeToolGateDecision {
   approved: boolean;

package/dist/index.mjs

@@ -2351,12 +2351,13 @@ const DEFAULT_BLOCKED_CODE_PATTERNS = [
 	/\bsubprocess\b/i,
 	/\bos\.system\s*\(/i
 ];
-const DEFAULT_ALLOWED_SANDBOX_PROVIDERS = [
+const CUSTOM_TOOL_SANDBOX_PROVIDERS = [
 	"quickjs",
 	"daytona",
 	"cloudflare-worker",
-	"cloudflare-sandbox"
+	"runtype-sandbox"
 ];
+const DEFAULT_ALLOWED_SANDBOX_PROVIDERS = [...CUSTOM_TOOL_SANDBOX_PROVIDERS, "cloudflare-sandbox"];
 const DEFAULT_ALLOWED_LANGUAGES = [
 	"javascript",
 	"typescript",
@@ -2378,7 +2379,21 @@ function isLanguage(value) {
 	return value === "javascript" || value === "typescript" || value === "python";
 }
 function isSandboxProvider(value) {
-	return value === "quickjs" || value === "daytona" || value === "cloudflare-worker";
+	return CUSTOM_TOOL_SANDBOX_PROVIDERS.includes(value);
+}
+function isNetworkAccess(value) {
+	if (value === "off" || value === "on") return true;
+	if (!isObject(value) || !Array.isArray(value.allowedHostnames)) return false;
+	const hosts = value.allowedHostnames;
+	return hosts.length > 0 && hosts.every((host) => typeof host === "string" && host.length > 0);
+}
+/** Why the requested posture exceeds what the caller allowed, or null when it fits. */
+function networkAccessViolation(requested, allowed) {
+	if (requested === void 0 || requested === "off" || allowed === true) return null;
+	if (!allowed) return "Generated tool requests network access, which this gate does not allow";
+	if (requested === "on") return "Generated tool requests unrestricted network access; only an allowedHostnames list is allowed";
+	const outside = requested.allowedHostnames.filter((host) => !allowed.allowedHostnames.includes(host));
+	return outside.length > 0 ? `Generated tool requests hosts outside the allowed list: ${outside.join(", ")}` : null;
 }
 function isJSONSchema(value) {
 	if (!isObject(value)) return false;
@@ -2425,6 +2440,12 @@ function normalizeGeneratedProposal(proposal, violations) {
 	const sandboxProviderRaw = config.sandboxProvider;
 	const languageRaw = config.language;
 	const timeoutRaw = config.timeout;
+	const sandboxProvider = isSandboxProvider(sandboxProviderRaw) ? sandboxProviderRaw : "cloudflare-worker";
+	const language = isLanguage(languageRaw) ? languageRaw : "javascript";
+	const timeout = asNumber(timeoutRaw);
+	if (Array.isArray(config.secrets) && config.secrets.length > 0) violations.push("Generated tools cannot declare config.secrets (managed credentials)");
+	const networkAccess = config.networkAccess;
+	if (networkAccess !== void 0 && !isNetworkAccess(networkAccess)) violations.push("config.networkAccess must be 'off', 'on', or { allowedHostnames: string[] }");
 	return {
 		name,
 		description,
@@ -2432,9 +2453,10 @@ function normalizeGeneratedProposal(proposal, violations) {
 		parametersSchema,
 		config: {
 			code,
-			sandboxProvider: isSandboxProvider(sandboxProviderRaw) ? sandboxProviderRaw : "cloudflare-worker",
-			language: isLanguage(languageRaw) ? languageRaw : "javascript",
-			timeout: asNumber(timeoutRaw)
+			sandboxProvider,
+			language,
+			timeout,
+			...isNetworkAccess(networkAccess) ? { networkAccess } : {}
 		}
 	};
 }
@@ -2487,6 +2509,8 @@ function evaluateGeneratedRuntimeToolProposal(proposal, options = {}) {
 			violations.push(`Generated code matched blocked pattern: ${pattern}`);
 			break;
 		}
+		const networkViolation = networkAccessViolation(normalized.config.networkAccess, options.allowNetworkAccess);
+		if (networkViolation) violations.push(networkViolation);
 	}
 	const tool = {
 		name: normalized.name,
@@ -13456,7 +13480,7 @@ function transformQueryParams(params) {
 }
 //#endregion
 //#region src/version.ts
-const SDK_VERSION = "10.5.3";
+const SDK_VERSION = "10.6.0";
 /**
 * Canonical client identity the API uses for attribution
 * (`detectActorSource` in apps/api/src/lib/audit-log.ts keys `'sdk'` off the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runtypelabs/sdk",
-  "version": "10.5.3",
+  "version": "10.6.0",
   "type": "module",
   "description": "TypeScript SDK for the Runtype API with fluent methods. Use it to quickly realize AI products, agents, and workflows.",
   "main": "dist/index.cjs",
@@ -24,7 +24,7 @@
   ],
   "dependencies": {},
   "devDependencies": {
-    "@runtypelabs/shared": "3.66.0",
+    "@runtypelabs/shared": "3.67.0",
     "openapi-typescript": "^7.13.0",
     "tsdown": "^0.23.0",
     "typescript": "^6.0.3",