@runtypelabs/sdk 10.5.3 → 10.7.0

package/dist/index.cjs

@@ -2352,12 +2352,13 @@ const DEFAULT_BLOCKED_CODE_PATTERNS = [
 	/\bsubprocess\b/i,
 	/\bos\.system\s*\(/i
 ];
-const DEFAULT_ALLOWED_SANDBOX_PROVIDERS = [
+const CUSTOM_TOOL_SANDBOX_PROVIDERS = [
 	"quickjs",
 	"daytona",
 	"cloudflare-worker",
-	"cloudflare-sandbox"
+	"runtype-sandbox"
 ];
+const DEFAULT_ALLOWED_SANDBOX_PROVIDERS = [...CUSTOM_TOOL_SANDBOX_PROVIDERS, "cloudflare-sandbox"];
 const DEFAULT_ALLOWED_LANGUAGES = [
 	"javascript",
 	"typescript",
@@ -2379,7 +2380,21 @@ function isLanguage(value) {
 	return value === "javascript" || value === "typescript" || value === "python";
 }
 function isSandboxProvider(value) {
-	return value === "quickjs" || value === "daytona" || value === "cloudflare-worker";
+	return CUSTOM_TOOL_SANDBOX_PROVIDERS.includes(value);
+}
+function isNetworkAccess(value) {
+	if (value === "off" || value === "on") return true;
+	if (!isObject(value) || !Array.isArray(value.allowedHostnames)) return false;
+	const hosts = value.allowedHostnames;
+	return hosts.length > 0 && hosts.every((host) => typeof host === "string" && host.length > 0);
+}
+/** Why the requested posture exceeds what the caller allowed, or null when it fits. */
+function networkAccessViolation(requested, allowed) {
+	if (requested === void 0 || requested === "off" || allowed === true) return null;
+	if (!allowed) return "Generated tool requests network access, which this gate does not allow";
+	if (requested === "on") return "Generated tool requests unrestricted network access; only an allowedHostnames list is allowed";
+	const outside = requested.allowedHostnames.filter((host) => !allowed.allowedHostnames.includes(host));
+	return outside.length > 0 ? `Generated tool requests hosts outside the allowed list: ${outside.join(", ")}` : null;
 }
 function isJSONSchema(value) {
 	if (!isObject(value)) return false;
@@ -2426,6 +2441,12 @@ function normalizeGeneratedProposal(proposal, violations) {
 	const sandboxProviderRaw = config.sandboxProvider;
 	const languageRaw = config.language;
 	const timeoutRaw = config.timeout;
+	const sandboxProvider = isSandboxProvider(sandboxProviderRaw) ? sandboxProviderRaw : "cloudflare-worker";
+	const language = isLanguage(languageRaw) ? languageRaw : "javascript";
+	const timeout = asNumber(timeoutRaw);
+	if (Array.isArray(config.secrets) && config.secrets.length > 0) violations.push("Generated tools cannot declare config.secrets (managed credentials)");
+	const networkAccess = config.networkAccess;
+	if (networkAccess !== void 0 && !isNetworkAccess(networkAccess)) violations.push("config.networkAccess must be 'off', 'on', or { allowedHostnames: string[] }");
 	return {
 		name,
 		description,
@@ -2433,9 +2454,10 @@ function normalizeGeneratedProposal(proposal, violations) {
 		parametersSchema,
 		config: {
 			code,
-			sandboxProvider: isSandboxProvider(sandboxProviderRaw) ? sandboxProviderRaw : "cloudflare-worker",
-			language: isLanguage(languageRaw) ? languageRaw : "javascript",
-			timeout: asNumber(timeoutRaw)
+			sandboxProvider,
+			language,
+			timeout,
+			...isNetworkAccess(networkAccess) ? { networkAccess } : {}
 		}
 	};
 }
@@ -2488,6 +2510,8 @@ function evaluateGeneratedRuntimeToolProposal(proposal, options = {}) {
 			violations.push(`Generated code matched blocked pattern: ${pattern}`);
 			break;
 		}
+		const networkViolation = networkAccessViolation(normalized.config.networkAccess, options.allowNetworkAccess);
+		if (networkViolation) violations.push(networkViolation);
 	}
 	const tool = {
 		name: normalized.name,
@@ -5760,10 +5784,12 @@ var AgentsEndpoint = class AgentsEndpoint {
 		return this.client.delete(`/agents/${id}`);
 	}
 	/**
-	* Export an agent as a self-contained runtime definition for @runtypelabs/runtime
+	* Export an agent as a self-contained runtime definition for @runtypelabs/runtime.
+	* Pass `versionId` or `alias` (at most one) to export a published version or the
+	* version a release alias points at; the result's `release` records which one.
 	*/
-	async exportRuntime(id) {
-		return this.client.get(`/agents/${id}/export-runtime`);
+	async exportRuntime(id, selector) {
+		return this.client.get(`/agents/${id}/export-runtime`, selector);
 	}
 	/**
 	* Roll up the agent's most recent runs: per-version and per-tool counts,
@@ -13457,7 +13483,7 @@ function transformQueryParams(params) {
 }
 //#endregion
 //#region src/version.ts
-const SDK_VERSION = "10.5.3";
+const SDK_VERSION = "10.7.0";
 /**
 * Canonical client identity the API uses for attribution
 * (`detectActorSource` in apps/api/src/lib/audit-log.ts keys `'sdk'` off the

package/dist/index.d.cts

@@ -117,6 +117,45 @@ interface ContextErrorHandling {
  * Do not make direct changes to the file.
  */
 interface paths {
+  "/.well-known/jwks.json": {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Identity assertion signing keys (JWKS)
+     * @description Public keys that verify the Runtype-signed `{{_identity.token}}` a tool call carries. Verify offline: check the ES256 signature against the key whose `kid` matches the token header, then `iss` (pin it to the one Runtype organization you trust: `<API origin>/orgs/<organizationId>`), `aud` (your host), `exp`, and the per-scope assurance in the `runtype` claim. Cache the response for up to five minutes; re-fetch when a token names an unknown `kid`.
+     */
+    get: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path?: never;
+        cookie?: never;
+      };
+      requestBody?: never;
+      responses: {
+        /** @description The published key set. Empty when this environment has no signing key configured. */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["IdentityAssertionJwks"];
+          };
+        };
+      };
+    };
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
   "/v1/agent-aliases": {
     parameters: {
       query?: never;
@@ -5218,13 +5257,20 @@ interface paths {
     };
     /**
      * Export agent for runtime
-     * @description Export a fully-resolved, self-contained agent definition that the @runtypelabs/runtime package can consume directly at boot. Capabilities, flows, and nested sub-agents are inlined recursively (up to 3 levels). MCP credential values and external-agent auth credentials are replaced with secret-name references. Requires the `RUNTIME:EXPORT` scope and an Enterprise plan (the `byoc` entitlement); an unentitled account receives `403` with code `BYOC_PLAN_REQUIRED` in every environment.
+     * @description Export a fully-resolved, self-contained agent definition that the @runtypelabs/runtime package can consume directly at boot. Capabilities, flows, and nested sub-agents are inlined recursively (up to 3 levels). Skills bound to the agent are snapshotted into `skills`, each with the skill version it resolved to, and the runtime loads them with no host wiring. MCP credential values and external-agent auth credentials are replaced with secret-name references. Requires the `RUNTIME:EXPORT` scope and an Enterprise plan (the `byoc` entitlement); an unentitled account receives `403` with code `BYOC_PLAN_REQUIRED` in every environment.
      *
      *     The response carries `hostDependencies`: the runtime seams the exported artifact needs a host to wire before it can run everything it describes. A durable-class step (`wait-until` or `crawl`) anywhere in the agent's executable closure declares a `durable-pause-host` dependency; a detached-capable dynamic subagent pool or a detached inline subagent tool declares a `background-run-coordinator` dependency. The array is empty when nothing needs wiring.
+     *
+     *     Pass at most one release selector. `versionId` exports that published version; `alias` exports the version a release alias (for example `staging`, `live` or `pr-42`) currently points at, resolved exactly as the execution selector `agent: { agentId, alias }` resolves it. With neither, the export follows the agent's default target: the version its `live` alias names when the org runs on release aliases, otherwise the agent's current definition. A version-backed export carries `release` with the resolved `versionId`, plus `alias` and `aliasRevision` when an alias selected it. An unknown version or alias, or an archived or expired alias, answers `404`.
      */
     get: {
       parameters: {
-        query?: never;
+        query?: {
+          /** @description Export this published agent version. Mutually exclusive with `alias`. */
+          versionId?: string;
+          /** @description Export the version this release alias currently points at. Mutually exclusive with `versionId`. */
+          alias?: string;
+        };
         header?: never;
         path: {
           id: string;
@@ -5255,10 +5301,18 @@ interface paths {
               hostDependencies: components["schemas"]["RuntimeHostDependency"][];
               id: string;
               name: string;
+              /** @description The published version this export contains. `alias` and `aliasRevision` are present when a release alias selected it. Absent when the export read the agent's current definition. */
+              release?: {
+                alias?: string;
+                aliasRevision?: number;
+                versionId: string;
+              };
+              /** @description Skills bound to the agent, snapshotted with the skill version each resolved to. `executeAgent` loads them with no host wiring. Absent when the agent has no bound skills. */
+              skills?: components["schemas"]["RuntimeExportedSkill"][];
             };
           };
         };
-        /** @description Invalid agent ID */
+        /** @description Invalid agent ID, or both `versionId` and `alias` were supplied */
         400: {
           headers: {
             [name: string]: unknown;
@@ -5285,7 +5339,7 @@ interface paths {
             "application/json": components["schemas"]["Error"];
           };
         };
-        /** @description Agent not found */
+        /** @description Agent not found, or the selected version or alias does not exist, is archived, or has expired */
         404: {
           headers: {
             [name: string]: unknown;
@@ -5294,6 +5348,15 @@ interface paths {
             "application/json": components["schemas"]["Error"];
           };
         };
+        /** @description The agent type cannot export a selected version */
+        422: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["Error"];
+          };
+        };
         /** @description Internal server error */
         500: {
           headers: {
@@ -30181,7 +30244,9 @@ interface paths {
               data: {
                 canvas?: unknown;
                 capabilities: {
+                  agentId: string | null;
                   capabilityName: string;
+                  flowId: string | null;
                 }[];
                 capabilityCount: number;
                 createdAt: string;
@@ -40582,6 +40647,15 @@ interface paths {
             "application/json": components["schemas"]["Error"];
           };
         };
+        /** @description A target record changed while the edit was applied (`record_conflict`); nothing was written, retry the edit */
+        409: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["Error"];
+          };
+        };
         /** @description A record's post-merge metadata violates its type's collection schema (enforce mode); the whole edit is rejected */
         422: {
           headers: {
@@ -41215,7 +41289,7 @@ interface paths {
               /** @enum {string} */
               role: "user" | "assistant";
             }[] | null;
-            /** @default {} */
+            /** @description Replaces the whole metadata object. Omit to leave metadata unchanged. */
             metadata?: {
               [key: string]: unknown;
             };
@@ -41306,7 +41380,7 @@ interface paths {
             "application/json": components["schemas"]["Error"];
           };
         };
-        /** @description Duplicate record */
+        /** @description Duplicate record (`duplicate_record`), or the record changed while this update was applied (`record_conflict`; re-read and retry) */
         409: {
           headers: {
             [name: string]: unknown;
@@ -51833,6 +51907,10 @@ interface components {
     };
     DispatchAgentJsonResponse: {
       agentExecutionId?: string;
+      /** @description The published agent version the run executed. Absent when no stored version ran. */
+      agentVersionId?: string;
+      /** @description The release alias (for example `live`) the version was resolved through, when one was. */
+      alias?: string;
       blockReason?: string;
       claudeManagedAgentId?: string;
       code?: string;
@@ -53230,6 +53308,24 @@ interface components {
       valid: boolean;
       warnings: components["schemas"]["FlowValidationIssue"][];
     };
+    IdentityAssertionJwks: {
+      /** @description Every key that may have signed a live assertion: the active key first, then verify-only keys kept for rotation. */
+      keys: components["schemas"]["IdentityAssertionPublicJwk"][];
+    };
+    IdentityAssertionPublicJwk: {
+      /** @description Always `ES256`. */
+      alg: string;
+      /** @description Curve; always `P-256`. */
+      crv: string;
+      /** @description Key id, matched against the token header `kid`. */
+      kid: string;
+      /** @description Key type; always `EC`. */
+      kty: string;
+      /** @description Always `sig`. */
+      use: string;
+      x: string;
+      y: string;
+    };
     InputDeliveryReceipt: {
       deliveryId: string;
       executionId: string;
@@ -53820,6 +53916,19 @@ interface components {
       error: string;
       message?: string;
     };
+    RuntimeExportedSkill: {
+      approvalDelta: string[];
+      body: string;
+      description: string;
+      resolvedTools: {
+        [key: string]: unknown;
+      }[];
+      skillId?: string;
+      /** @description The skill version this snapshot was resolved from. */
+      skillVersionId?: string;
+      /** @description Skill slug; the agent loads it as `skill:<slug>`. */
+      slug: string;
+    };
     RuntimeHostDependency: {
       interface: string;
       /** @enum {string} */
@@ -56763,8 +56872,23 @@ export interface RuntimeFlowToolConfig {
 export interface RuntimeCustomToolConfig {
   code: string;
   language?: 'javascript' | 'typescript' | 'python';
-  sandboxProvider?: 'quickjs' | 'daytona' | 'cloudflare-worker';
+  sandboxProvider?: 'quickjs' | 'daytona' | 'cloudflare-worker' | 'runtype-sandbox';
   timeout?: number;
+  /** Egress posture for the code. Omitted means `'off'`; prefer an `allowedHostnames` list. */
+  networkAccess?: 'off' | 'on' | {
+    allowedHostnames: string[];
+  };
+  /** Managed secrets the code may send, read as phantom tokens from `secrets.<key>`. Requires SECRETS:READ. */
+  secrets?: RuntimeCustomToolSecret[];
+}
+/** One managed secret a custom tool may send; the egress proxy injects it only for the matching host and path. */
+export interface RuntimeCustomToolSecret {
+  /** Bare managed secret name, e.g. `GITHUB_TOKEN`. */
+  key: string;
+  hostnamePattern: string;
+  pathPattern?: string;
+  injectionMode: 'bearer_header' | 'api_key_header' | 'query_param' | 'basic_auth';
+  injectionConfig?: Record<string, JsonValue>;
 }
 export interface RuntimeExternalToolConfig {
   url: string;
@@ -62538,14 +62662,16 @@ interface ApiKeyRequestListParams {
 }
 //#endregion
 //#region src/generated-tool-gate.d.ts
+declare const CUSTOM_TOOL_SANDBOX_PROVIDERS: readonly ["quickjs", "daytona", "cloudflare-worker", "runtype-sandbox"];
+type GateSandboxProvider = (typeof CUSTOM_TOOL_SANDBOX_PROVIDERS)[number] | 'cloudflare-sandbox';
 interface GeneratedRuntimeToolGateOptions {
   /**
    * Allowed runtime tool types.
    * Defaults to ['custom'] because this gate is intended for generated code tools.
    */
   allowedToolTypes?: Array<'custom' | 'external' | 'flow' | 'local'>;
-  /** Allowed sandbox providers for generated custom tools. Defaults to ['quickjs', 'daytona', 'cloudflare-worker', 'cloudflare-sandbox']. */
-  allowedSandboxProviders?: Array<'quickjs' | 'daytona' | 'cloudflare-worker' | 'cloudflare-sandbox'>;
+  /** Allowed sandbox providers for generated custom tools. Defaults to every provider, including runtype-sandbox and its cloudflare-sandbox alias. */
+  allowedSandboxProviders?: GateSandboxProvider[];
   /** Allowed languages for generated custom tools. Defaults to JS/TS/Python. */
   allowedLanguages?: Array<'javascript' | 'typescript' | 'python'>;
   /** Maximum allowed code size in characters (default 12000). */
@@ -62561,6 +62687,15 @@ interface GeneratedRuntimeToolGateOptions {
   blockedCodePatterns?: RegExp[];
   /** Optional custom validator for additional policy checks. Return a violation message to reject. */
   customValidator?: (tool: RuntimeTool) => string | null;
+  /**
+   * Network egress a generated custom tool may request via `config.networkAccess`. Off by default:
+   * a proposal asking for anything but `'off'` is rejected. `true` passes the requested posture
+   * through; `{ allowedHostnames }` accepts only an allowlist within those hosts. A generated tool
+   * can never declare `config.secrets`: managed credentials are always rejected by this gate.
+   */
+  allowNetworkAccess?: boolean | {
+    allowedHostnames: string[];
+  };
 }
 interface GeneratedRuntimeToolGateDecision {
   approved: boolean;
@@ -65056,9 +65191,14 @@ export declare class AgentsEndpoint {
    */
   delete(id: string): Promise<void>;
   /**
-   * Export an agent as a self-contained runtime definition for @runtypelabs/runtime
+   * Export an agent as a self-contained runtime definition for @runtypelabs/runtime.
+   * Pass `versionId` or `alias` (at most one) to export a published version or the
+   * version a release alias points at; the result's `release` records which one.
    */
-  exportRuntime(id: string): Promise<any>;
+  exportRuntime(id: string, selector?: {
+    versionId?: string;
+    alias?: string;
+  }): Promise<any>;
   /**
    * Roll up the agent's most recent runs: per-version and per-tool counts,
    * average tokens and cost, and which attached tools were never called.

package/dist/index.d.ts

@@ -117,6 +117,45 @@ interface ContextErrorHandling {
  * Do not make direct changes to the file.
  */
 interface paths {
+  "/.well-known/jwks.json": {
+    parameters: {
+      query?: never;
+      header?: never;
+      path?: never;
+      cookie?: never;
+    };
+    /**
+     * Identity assertion signing keys (JWKS)
+     * @description Public keys that verify the Runtype-signed `{{_identity.token}}` a tool call carries. Verify offline: check the ES256 signature against the key whose `kid` matches the token header, then `iss` (pin it to the one Runtype organization you trust: `<API origin>/orgs/<organizationId>`), `aud` (your host), `exp`, and the per-scope assurance in the `runtype` claim. Cache the response for up to five minutes; re-fetch when a token names an unknown `kid`.
+     */
+    get: {
+      parameters: {
+        query?: never;
+        header?: never;
+        path?: never;
+        cookie?: never;
+      };
+      requestBody?: never;
+      responses: {
+        /** @description The published key set. Empty when this environment has no signing key configured. */
+        200: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["IdentityAssertionJwks"];
+          };
+        };
+      };
+    };
+    put?: never;
+    post?: never;
+    delete?: never;
+    options?: never;
+    head?: never;
+    patch?: never;
+    trace?: never;
+  };
   "/v1/agent-aliases": {
     parameters: {
       query?: never;
@@ -5218,13 +5257,20 @@ interface paths {
     };
     /**
      * Export agent for runtime
-     * @description Export a fully-resolved, self-contained agent definition that the @runtypelabs/runtime package can consume directly at boot. Capabilities, flows, and nested sub-agents are inlined recursively (up to 3 levels). MCP credential values and external-agent auth credentials are replaced with secret-name references. Requires the `RUNTIME:EXPORT` scope and an Enterprise plan (the `byoc` entitlement); an unentitled account receives `403` with code `BYOC_PLAN_REQUIRED` in every environment.
+     * @description Export a fully-resolved, self-contained agent definition that the @runtypelabs/runtime package can consume directly at boot. Capabilities, flows, and nested sub-agents are inlined recursively (up to 3 levels). Skills bound to the agent are snapshotted into `skills`, each with the skill version it resolved to, and the runtime loads them with no host wiring. MCP credential values and external-agent auth credentials are replaced with secret-name references. Requires the `RUNTIME:EXPORT` scope and an Enterprise plan (the `byoc` entitlement); an unentitled account receives `403` with code `BYOC_PLAN_REQUIRED` in every environment.
      *
      *     The response carries `hostDependencies`: the runtime seams the exported artifact needs a host to wire before it can run everything it describes. A durable-class step (`wait-until` or `crawl`) anywhere in the agent's executable closure declares a `durable-pause-host` dependency; a detached-capable dynamic subagent pool or a detached inline subagent tool declares a `background-run-coordinator` dependency. The array is empty when nothing needs wiring.
+     *
+     *     Pass at most one release selector. `versionId` exports that published version; `alias` exports the version a release alias (for example `staging`, `live` or `pr-42`) currently points at, resolved exactly as the execution selector `agent: { agentId, alias }` resolves it. With neither, the export follows the agent's default target: the version its `live` alias names when the org runs on release aliases, otherwise the agent's current definition. A version-backed export carries `release` with the resolved `versionId`, plus `alias` and `aliasRevision` when an alias selected it. An unknown version or alias, or an archived or expired alias, answers `404`.
      */
     get: {
       parameters: {
-        query?: never;
+        query?: {
+          /** @description Export this published agent version. Mutually exclusive with `alias`. */
+          versionId?: string;
+          /** @description Export the version this release alias currently points at. Mutually exclusive with `versionId`. */
+          alias?: string;
+        };
         header?: never;
         path: {
           id: string;
@@ -5255,10 +5301,18 @@ interface paths {
               hostDependencies: components["schemas"]["RuntimeHostDependency"][];
               id: string;
               name: string;
+              /** @description The published version this export contains. `alias` and `aliasRevision` are present when a release alias selected it. Absent when the export read the agent's current definition. */
+              release?: {
+                alias?: string;
+                aliasRevision?: number;
+                versionId: string;
+              };
+              /** @description Skills bound to the agent, snapshotted with the skill version each resolved to. `executeAgent` loads them with no host wiring. Absent when the agent has no bound skills. */
+              skills?: components["schemas"]["RuntimeExportedSkill"][];
             };
           };
         };
-        /** @description Invalid agent ID */
+        /** @description Invalid agent ID, or both `versionId` and `alias` were supplied */
         400: {
           headers: {
             [name: string]: unknown;
@@ -5285,7 +5339,7 @@ interface paths {
             "application/json": components["schemas"]["Error"];
           };
         };
-        /** @description Agent not found */
+        /** @description Agent not found, or the selected version or alias does not exist, is archived, or has expired */
         404: {
           headers: {
             [name: string]: unknown;
@@ -5294,6 +5348,15 @@ interface paths {
             "application/json": components["schemas"]["Error"];
           };
         };
+        /** @description The agent type cannot export a selected version */
+        422: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["Error"];
+          };
+        };
         /** @description Internal server error */
         500: {
           headers: {
@@ -30181,7 +30244,9 @@ interface paths {
               data: {
                 canvas?: unknown;
                 capabilities: {
+                  agentId: string | null;
                   capabilityName: string;
+                  flowId: string | null;
                 }[];
                 capabilityCount: number;
                 createdAt: string;
@@ -40582,6 +40647,15 @@ interface paths {
             "application/json": components["schemas"]["Error"];
           };
         };
+        /** @description A target record changed while the edit was applied (`record_conflict`); nothing was written, retry the edit */
+        409: {
+          headers: {
+            [name: string]: unknown;
+          };
+          content: {
+            "application/json": components["schemas"]["Error"];
+          };
+        };
         /** @description A record's post-merge metadata violates its type's collection schema (enforce mode); the whole edit is rejected */
         422: {
           headers: {
@@ -41215,7 +41289,7 @@ interface paths {
               /** @enum {string} */
               role: "user" | "assistant";
             }[] | null;
-            /** @default {} */
+            /** @description Replaces the whole metadata object. Omit to leave metadata unchanged. */
             metadata?: {
               [key: string]: unknown;
             };
@@ -41306,7 +41380,7 @@ interface paths {
             "application/json": components["schemas"]["Error"];
           };
         };
-        /** @description Duplicate record */
+        /** @description Duplicate record (`duplicate_record`), or the record changed while this update was applied (`record_conflict`; re-read and retry) */
         409: {
           headers: {
             [name: string]: unknown;
@@ -51833,6 +51907,10 @@ interface components {
     };
     DispatchAgentJsonResponse: {
       agentExecutionId?: string;
+      /** @description The published agent version the run executed. Absent when no stored version ran. */
+      agentVersionId?: string;
+      /** @description The release alias (for example `live`) the version was resolved through, when one was. */
+      alias?: string;
       blockReason?: string;
       claudeManagedAgentId?: string;
       code?: string;
@@ -53230,6 +53308,24 @@ interface components {
       valid: boolean;
       warnings: components["schemas"]["FlowValidationIssue"][];
     };
+    IdentityAssertionJwks: {
+      /** @description Every key that may have signed a live assertion: the active key first, then verify-only keys kept for rotation. */
+      keys: components["schemas"]["IdentityAssertionPublicJwk"][];
+    };
+    IdentityAssertionPublicJwk: {
+      /** @description Always `ES256`. */
+      alg: string;
+      /** @description Curve; always `P-256`. */
+      crv: string;
+      /** @description Key id, matched against the token header `kid`. */
+      kid: string;
+      /** @description Key type; always `EC`. */
+      kty: string;
+      /** @description Always `sig`. */
+      use: string;
+      x: string;
+      y: string;
+    };
     InputDeliveryReceipt: {
       deliveryId: string;
       executionId: string;
@@ -53820,6 +53916,19 @@ interface components {
       error: string;
       message?: string;
     };
+    RuntimeExportedSkill: {
+      approvalDelta: string[];
+      body: string;
+      description: string;
+      resolvedTools: {
+        [key: string]: unknown;
+      }[];
+      skillId?: string;
+      /** @description The skill version this snapshot was resolved from. */
+      skillVersionId?: string;
+      /** @description Skill slug; the agent loads it as `skill:<slug>`. */
+      slug: string;
+    };
     RuntimeHostDependency: {
       interface: string;
       /** @enum {string} */
@@ -56763,8 +56872,23 @@ export interface RuntimeFlowToolConfig {
 export interface RuntimeCustomToolConfig {
   code: string;
   language?: 'javascript' | 'typescript' | 'python';
-  sandboxProvider?: 'quickjs' | 'daytona' | 'cloudflare-worker';
+  sandboxProvider?: 'quickjs' | 'daytona' | 'cloudflare-worker' | 'runtype-sandbox';
   timeout?: number;
+  /** Egress posture for the code. Omitted means `'off'`; prefer an `allowedHostnames` list. */
+  networkAccess?: 'off' | 'on' | {
+    allowedHostnames: string[];
+  };
+  /** Managed secrets the code may send, read as phantom tokens from `secrets.<key>`. Requires SECRETS:READ. */
+  secrets?: RuntimeCustomToolSecret[];
+}
+/** One managed secret a custom tool may send; the egress proxy injects it only for the matching host and path. */
+export interface RuntimeCustomToolSecret {
+  /** Bare managed secret name, e.g. `GITHUB_TOKEN`. */
+  key: string;
+  hostnamePattern: string;
+  pathPattern?: string;
+  injectionMode: 'bearer_header' | 'api_key_header' | 'query_param' | 'basic_auth';
+  injectionConfig?: Record<string, JsonValue>;
 }
 export interface RuntimeExternalToolConfig {
   url: string;
@@ -62538,14 +62662,16 @@ interface ApiKeyRequestListParams {
 }
 //#endregion
 //#region src/generated-tool-gate.d.ts
+declare const CUSTOM_TOOL_SANDBOX_PROVIDERS: readonly ["quickjs", "daytona", "cloudflare-worker", "runtype-sandbox"];
+type GateSandboxProvider = (typeof CUSTOM_TOOL_SANDBOX_PROVIDERS)[number] | 'cloudflare-sandbox';
 interface GeneratedRuntimeToolGateOptions {
   /**
    * Allowed runtime tool types.
    * Defaults to ['custom'] because this gate is intended for generated code tools.
    */
   allowedToolTypes?: Array<'custom' | 'external' | 'flow' | 'local'>;
-  /** Allowed sandbox providers for generated custom tools. Defaults to ['quickjs', 'daytona', 'cloudflare-worker', 'cloudflare-sandbox']. */
-  allowedSandboxProviders?: Array<'quickjs' | 'daytona' | 'cloudflare-worker' | 'cloudflare-sandbox'>;
+  /** Allowed sandbox providers for generated custom tools. Defaults to every provider, including runtype-sandbox and its cloudflare-sandbox alias. */
+  allowedSandboxProviders?: GateSandboxProvider[];
   /** Allowed languages for generated custom tools. Defaults to JS/TS/Python. */
   allowedLanguages?: Array<'javascript' | 'typescript' | 'python'>;
   /** Maximum allowed code size in characters (default 12000). */
@@ -62561,6 +62687,15 @@ interface GeneratedRuntimeToolGateOptions {
   blockedCodePatterns?: RegExp[];
   /** Optional custom validator for additional policy checks. Return a violation message to reject. */
   customValidator?: (tool: RuntimeTool) => string | null;
+  /**
+   * Network egress a generated custom tool may request via `config.networkAccess`. Off by default:
+   * a proposal asking for anything but `'off'` is rejected. `true` passes the requested posture
+   * through; `{ allowedHostnames }` accepts only an allowlist within those hosts. A generated tool
+   * can never declare `config.secrets`: managed credentials are always rejected by this gate.
+   */
+  allowNetworkAccess?: boolean | {
+    allowedHostnames: string[];
+  };
 }
 interface GeneratedRuntimeToolGateDecision {
   approved: boolean;
@@ -65056,9 +65191,14 @@ export declare class AgentsEndpoint {
    */
   delete(id: string): Promise<void>;
   /**
-   * Export an agent as a self-contained runtime definition for @runtypelabs/runtime
+   * Export an agent as a self-contained runtime definition for @runtypelabs/runtime.
+   * Pass `versionId` or `alias` (at most one) to export a published version or the
+   * version a release alias points at; the result's `release` records which one.
    */
-  exportRuntime(id: string): Promise<any>;
+  exportRuntime(id: string, selector?: {
+    versionId?: string;
+    alias?: string;
+  }): Promise<any>;
   /**
    * Roll up the agent's most recent runs: per-version and per-tool counts,
    * average tokens and cost, and which attached tools were never called.

package/dist/index.mjs

@@ -2351,12 +2351,13 @@ const DEFAULT_BLOCKED_CODE_PATTERNS = [
 	/\bsubprocess\b/i,
 	/\bos\.system\s*\(/i
 ];
-const DEFAULT_ALLOWED_SANDBOX_PROVIDERS = [
+const CUSTOM_TOOL_SANDBOX_PROVIDERS = [
 	"quickjs",
 	"daytona",
 	"cloudflare-worker",
-	"cloudflare-sandbox"
+	"runtype-sandbox"
 ];
+const DEFAULT_ALLOWED_SANDBOX_PROVIDERS = [...CUSTOM_TOOL_SANDBOX_PROVIDERS, "cloudflare-sandbox"];
 const DEFAULT_ALLOWED_LANGUAGES = [
 	"javascript",
 	"typescript",
@@ -2378,7 +2379,21 @@ function isLanguage(value) {
 	return value === "javascript" || value === "typescript" || value === "python";
 }
 function isSandboxProvider(value) {
-	return value === "quickjs" || value === "daytona" || value === "cloudflare-worker";
+	return CUSTOM_TOOL_SANDBOX_PROVIDERS.includes(value);
+}
+function isNetworkAccess(value) {
+	if (value === "off" || value === "on") return true;
+	if (!isObject(value) || !Array.isArray(value.allowedHostnames)) return false;
+	const hosts = value.allowedHostnames;
+	return hosts.length > 0 && hosts.every((host) => typeof host === "string" && host.length > 0);
+}
+/** Why the requested posture exceeds what the caller allowed, or null when it fits. */
+function networkAccessViolation(requested, allowed) {
+	if (requested === void 0 || requested === "off" || allowed === true) return null;
+	if (!allowed) return "Generated tool requests network access, which this gate does not allow";
+	if (requested === "on") return "Generated tool requests unrestricted network access; only an allowedHostnames list is allowed";
+	const outside = requested.allowedHostnames.filter((host) => !allowed.allowedHostnames.includes(host));
+	return outside.length > 0 ? `Generated tool requests hosts outside the allowed list: ${outside.join(", ")}` : null;
 }
 function isJSONSchema(value) {
 	if (!isObject(value)) return false;
@@ -2425,6 +2440,12 @@ function normalizeGeneratedProposal(proposal, violations) {
 	const sandboxProviderRaw = config.sandboxProvider;
 	const languageRaw = config.language;
 	const timeoutRaw = config.timeout;
+	const sandboxProvider = isSandboxProvider(sandboxProviderRaw) ? sandboxProviderRaw : "cloudflare-worker";
+	const language = isLanguage(languageRaw) ? languageRaw : "javascript";
+	const timeout = asNumber(timeoutRaw);
+	if (Array.isArray(config.secrets) && config.secrets.length > 0) violations.push("Generated tools cannot declare config.secrets (managed credentials)");
+	const networkAccess = config.networkAccess;
+	if (networkAccess !== void 0 && !isNetworkAccess(networkAccess)) violations.push("config.networkAccess must be 'off', 'on', or { allowedHostnames: string[] }");
 	return {
 		name,
 		description,
@@ -2432,9 +2453,10 @@ function normalizeGeneratedProposal(proposal, violations) {
 		parametersSchema,
 		config: {
 			code,
-			sandboxProvider: isSandboxProvider(sandboxProviderRaw) ? sandboxProviderRaw : "cloudflare-worker",
-			language: isLanguage(languageRaw) ? languageRaw : "javascript",
-			timeout: asNumber(timeoutRaw)
+			sandboxProvider,
+			language,
+			timeout,
+			...isNetworkAccess(networkAccess) ? { networkAccess } : {}
 		}
 	};
 }
@@ -2487,6 +2509,8 @@ function evaluateGeneratedRuntimeToolProposal(proposal, options = {}) {
 			violations.push(`Generated code matched blocked pattern: ${pattern}`);
 			break;
 		}
+		const networkViolation = networkAccessViolation(normalized.config.networkAccess, options.allowNetworkAccess);
+		if (networkViolation) violations.push(networkViolation);
 	}
 	const tool = {
 		name: normalized.name,
@@ -5759,10 +5783,12 @@ var AgentsEndpoint = class AgentsEndpoint {
 		return this.client.delete(`/agents/${id}`);
 	}
 	/**
-	* Export an agent as a self-contained runtime definition for @runtypelabs/runtime
+	* Export an agent as a self-contained runtime definition for @runtypelabs/runtime.
+	* Pass `versionId` or `alias` (at most one) to export a published version or the
+	* version a release alias points at; the result's `release` records which one.
 	*/
-	async exportRuntime(id) {
-		return this.client.get(`/agents/${id}/export-runtime`);
+	async exportRuntime(id, selector) {
+		return this.client.get(`/agents/${id}/export-runtime`, selector);
 	}
 	/**
 	* Roll up the agent's most recent runs: per-version and per-tool counts,
@@ -13456,7 +13482,7 @@ function transformQueryParams(params) {
 }
 //#endregion
 //#region src/version.ts
-const SDK_VERSION = "10.5.3";
+const SDK_VERSION = "10.7.0";
 /**
 * Canonical client identity the API uses for attribution
 * (`detectActorSource` in apps/api/src/lib/audit-log.ts keys `'sdk'` off the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@runtypelabs/sdk",
-  "version": "10.5.3",
+  "version": "10.7.0",
   "type": "module",
   "description": "TypeScript SDK for the Runtype API with fluent methods. Use it to quickly realize AI products, agents, and workflows.",
   "main": "dist/index.cjs",
@@ -24,7 +24,7 @@
   ],
   "dependencies": {},
   "devDependencies": {
-    "@runtypelabs/shared": "3.66.0",
+    "@runtypelabs/shared": "3.68.0",
     "openapi-typescript": "^7.13.0",
     "tsdown": "^0.23.0",
     "typescript": "^6.0.3",