@runtypelabs/sdk 9.3.0 → 9.3.2

package/CHANGELOG.md

@@ -0,0 +1,3457 @@
+# @runtypelabs/sdk
+
+## 9.3.2
+
+### Patch Changes
+
+- ccd07e2: Report a truncated agent turn as a failure instead of a clean completion. When a model turn ends with the provider finish reason `length` while a tool call's arguments are still streaming, the agent loop now stops with the loop-level `stopReason: 'length'` and `success: false` — previously the run reported `success: true` / `stopReason: 'complete'` with an empty output and an unpaired tool start that was only discoverable by pairing trace events. `decideLoopContinuation` gains the matching `length_cutoff` reason on both the runtime and its api twin, and the cutoff verdict outranks `max_cost` so a run that trips both is still reported as failed.
+
+  The cutoff is attributed per tool call, not per turn. A turn that runs a multi-step authored flow ends on its LAST prompt step's stop reason, so each unpaired `tool_start` is stamped with the stop reason of the step that owned it: an early step that truncated mid tool call fails the run even when a later step ends cleanly, and an unpaired start from a clean step no longer fails a run whose last step merely truncated its text.
+
+  Every `tool_start` the loop leaves in flight at turn end is now closed by a synthesized failed `tool_complete`, under any stop reason rather than only the cutoff — an unpaired start was previously discarded when the next turn began. The cutoff close-out names the output-token limit; any other unresolved start reports that the turn ended first.
+
+  The loop-level stop reason and any salvaged reply are now observable: `execution_error` carries an optional `stopReason` and an optional `finalOutput` (both loose, like `execution_complete`'s), emitted by both the runtime emitter and the api's legacy translator. The buffered `/v1/dispatch` agent envelope reports the same verdict that `agent_executions.stop_reason` persists instead of hard-coding `error`, the SDK's `execution_error` → `agent_complete` fold forwards it rather than flattening it to `error`, and both durable readers project a failure terminal through one shared helper. A cut-off run still spends its final-reply elicitation turn, and a messaging surface delivers that salvaged sentence instead of the surface's generic error message while still recording the run as failed. The run's span no longer reports status OK.
+
+  MIGRATION: this changes the default verdict for an existing agent whose turns are truncated mid tool call — a run that used to report `success: true` with empty output now reports `success: false` with `stopReason: 'length'`. The fix is to raise the agent's `maxTokens`. To pin the old verdict while you do, set the new `loopConfig.treatLengthCutoffAsFailure` to `false`; it defaults to `true`, and the synthesized failed `tool_complete` close-outs are emitted either way.
+
+- 8ab7d4a: Apply flow and agent version snapshots to the live execution rows atomically when publishing from any API surface.
+
+## 9.3.1
+
+### Patch Changes
+
+- 95e48e6: Address the /review findings on the legacy agent-loop retirement (#7824). No
+  behavior changes beyond three consolidated error bodies and the deletion of code
+  the retirement left unreachable; the rest is documentation and message text that
+  still described the deleted engine as a live destination.
+  - **One parity-fold refusal for three hosts.** `/v1/dispatch`,
+    `/v1/agents/:id/execute` and the Product API answered the same defect with
+    three different bodies, one of which told the author to "dispatch it via POST
+    /v1/dispatch (which routes folded definitions to the legacy engine)" — a dead
+    end now that lane returns a 400 of its own. All three share
+    `parityFoldRefusal()`, so the response is `400
+RUNTIME_AGENT_PARITY_FOLD_UNSUPPORTED` with the fold classes as evidence.
+  - **Remediation text no longer prescribes the retired opt-out.** The agent-save
+    advisory, the admission reason strings, the runtime-package gate messages, the
+    `dispatch` request-schema descriptions (public spec + SDK cores + MCP tool
+    inputs), the client SDK JSDoc, two knowledge fragments and two Fern docs pages
+    now describe the terminal answer and append `LEGACY_LANE_NO_BRIDGE_REMEDY`.
+  - **Internal census truthfulness.** Three log lines said "internal execution runs
+    on the legacy engine" while the census already reported `refused`; they now
+    agree.
+  - **Deletion residue removed:** the unsatisfiable local-inference guard in
+    `/v1/dispatch` and its `LOCAL_INFERENCE_UNAVAILABLE` export,
+    `lib/virtual-agent-summary.ts`, and five knip-verified dead modules
+    (`scripts/test-loop-standalone.ts`, which imported the deleted agent executor
+    and was therefore broken, `services/webhook-doc-crawler.ts`,
+    `lib/agent-memory/cf-types-compat.ts`, `lib/constants/record-limits.ts`,
+    `lib/email/index.ts`).
+
+## 9.3.0
+
+### Minor Changes
+
+- 6bfcfa0: Durable-by-default agent turns (ADR 0020): the `runtype_managed` agentType is deleted and durability becomes the default property of every agent turn, decided once at admission by the pure `turn-durability-policy` (outs: parity fold, Flagship `enable-durable-agent-turns` rule, per-agent `config.durability.forced` pin). The session DO adopts the `SessionEventStore` ledger with post-engine filters before journaling and single relay-owned SSE `id:` lines, gains a bounded recovery engine (incident record, budgets, sealed terminal reasons, recover-on-any-wake, sub-turn continuation with orphaned-tool repair), a 7-day parked-turn TTL with a resume-vs-expiry CAS, and two-phase fenced claim/start concurrency (`reject` / `supersede` / `queue` + `coalesce`, admission `idempotencyKey`) with every rejectable check ahead of the daily-quota reservation. Harness knobs move to `config.durability { watchLeaseMs, maxBudgetMs, forced }`.
+
+### Patch Changes
+
+- 20f2a28: Deprecate the `options.useRuntimePackage: false` legacy execution-lane opt-out on `/v1/dispatch`. The legacy agent engine is being retired: an agent dispatch that still sends `false` runs on it for one more release and its response now carries RFC 9745 `Deprecation` and `X-API-Deprecation-Warning` headers; a later release rejects `false`. The value is deprecated, not the field: omitting it selects the runtime lane, and `true` remains the strict opt-in that fails loudly instead of folding to legacy. The OpenAPI spec, SDK types and MCP `dispatch` tool input describe the new contract, every API remediation that still names the opt-out calls it a deprecated bridge, and the dashboard's agent test chat no longer sends `false` (it was forcing every dashboard agent test onto the legacy engine).
+- 9ac677d: Carry the Anthropic adaptive-thinking effort and the Gemini thinking level all the way to the model request.
+
+  `buildReasoningOptions` mapped a flat `ReasoningConfig` onto `anthropic: { budgetTokens }` and `google: { thinkingBudget, includeThoughts }` only, while `buildReasoningProviderOptions` reads `effort` in the Anthropic adaptive branch and `thinkingLevel` in the Google branch. On Claude 4.6 and later, including the Claude 5 family that left the model with no working reasoning dial at all: adaptive thinking discards `budgetTokens`, and the effort it does accept was never mapped. Gemini 3 level mode had the same shape.
+
+  `ReasoningConfig` gains `effort` and `thinkingLevel` (plain strings, because the accepted rungs are per-model catalog data that already exceeds the fixed `reasoningEffort` union), the agent config and FPO agent schemas accept them, the execution contract and the model-gateway wire schema carry them, and both prompt executors map them into their own provider bucket. Neither is cross-filled from `reasoningEffort`, which is the OpenAI ladder. The api and runtime mappings move together and are pinned by three new cases in the shared prompt-executor parity corpus.
+
+- 9ac677d: Expose per-model reasoning knobs on the model-configuration surfaces, and warn at save time when a reasoning config asks for a knob the model does not accept.
+
+  `GET /v1/model-configs` and `GET /v1/model-configs/grouped` now carry the catalog-sourced `reasoningCapability.options` (`toggle` / `effort` ladder / `budgetTokens` range), `anthropicThinkingMode` and `builtInReasoning`, so a client can render the dials a model actually has instead of a per-provider guess. The committed OpenAPI spec and the generated SDK types are regenerated for the new fields.
+
+  The model-advisory pass gains one non-blocking code, `REASONING_KNOB_UNSUPPORTED` (warning, never error): an effort level outside the model's published ladder, a `budgetTokens` on an Anthropic model the executor drives in adaptive thinking mode (which carries no token budget and drops the value before the request), or a thinking budget outside the model's published range. The effort check reads only the carrier the executor actually reads for that provider, so a level stranded on a field the request never carries (a Gemini row that stored its thinking level under the OpenAI effort field) is no longer reported as unsupported. It stays silent whenever the catalog makes no claim about the model, on the boolean `reasoning: true` form, on an explicit `enabled: false`, and on disabled steps.
+
+- e1111dc: Retire dispatch-transient `secrets` on agent dispatches.
+
+  An agent dispatch that carries a NON-EMPTY request-scoped `secrets` map is now
+  answered with a terminal 400 `RUNTIME_AGENT_TRANSIENT_SECRETS_UNSUPPORTED`.
+  Previously only an explicit `options.useRuntimePackage: true` was refused; a
+  caller who never set the option was folded onto the legacy agent engine so the
+  field could keep working. An empty map is still accepted and does nothing, and
+  the deprecated `options.useRuntimePackage: false` opt-out still routes the run
+  to the legacy engine, which honors the map for single-turn agents until that
+  engine is removed. Dispatch-transient secrets are retired
+  platform-wide (D-080, amended 2026-08-27), the census counted zero occurrences
+  in 30 days on both the fold line and the refusal line, and the fold was routing
+  callers onto an engine being deleted to honor a contract being deleted. Store
+  the value as a managed secret and reference it as `{{secret:NAME}}`.
+
+  The remediation is terminal: it no longer prescribes the deprecated
+  `options.useRuntimePackage: false` bridge. The wire field stays on the dispatch
+  schema for compatibility, with its description (and the regenerated OpenAPI
+  spec, SDK types and MCP `dispatch` input schema) rewritten to say retired. Flow
+  dispatches are unchanged: they have always accepted and ignored the field.
+
+- 6bfcfa0: Add the `runtype_managed` agent execution mode (slice 0: mode plumbing). A new `agentType` value classifies agents onto a durable self-hosted session harness (staging-only, flag-gated via the env-pinned `enable-runtype-managed` Flagship gate plus the fail-closed `runtype-managed-agents` Schematic flag). This slice lands the classification, the `agents.runtype_managed_config` column and route schemas, and loud rejections at every execution surface so the mode can never silently degrade into the in-request loop; the session DO harness and entry-surface wiring land in follow-up slices. Design: `docs/features/planning/2026-07-31-runtype-managed-harness.md`.
+
+## 9.2.1
+
+### Patch Changes
+
+- a370a11: Surface the model credit promo (ADR 0021) everywhere models are listed, not only in the dashboard picker.
+  - Every model-listing route (`GET /v1/model-configs`, `/v1/model-configs/grouped`, `/v1/model-configs/available`) now stamps `creditPromoMultiplier` (e.g. `0.1`) and a plain-language `creditPromoLabel` (e.g. `"90% off"`, `null` when undiscounted) on each row, computed server-side from the same eligibility rule the billing seam uses and gated on platform-key custody. Routed families (`runtype:deepseek-v4-flash`) resolve through the routing table to their Workers AI primary, so a discounted route is advertised even when the id says nothing about Workers AI. MCP (`list_available_models`, `list_model_configs`, `list_model_configs_grouped`), the SDK and the CLI all read the same fields.
+  - Dashboard: Settings → Models rows and the Add Model dialog show the callout next to the model name; the Add Model dialog gains a "Discounted" filter that appears only while a promo is active. The model picker prefers the server label and falls back to the shared predicate.
+
+## 9.2.0
+
+### Minor Changes
+
+- d129b45: Add bounded Flow loops and durable asynchronous execution handles with pollable status results.
+- 005b795: First-party MCP catalog tools now cross the dashboard assistant's dispatch as name-only `runtype-mcp` catalog refs that the api hydrates from its own copy of the catalog, instead of full browser-supplied manifests. `clientTools[]` accepts `{ name, catalog: 'runtype-mcp' }` beside the existing `InlineClientTool` shape on `POST /v1/dispatch` and `POST /v1/agents/:id/execute`; an unknown ref is a 400, never a silent drop. Because the catalog no longer crosses the browser, the per-string `parametersSchema` cap returns from a provisional 8KB to 2KB (runtypelabs/core#7617).
+
+  No entry is exempt from the byte caps. The catalog clears 2KB on its own merits after the description rewrite (longest string 1894 bytes), and the host proxy collapses first-party tools to refs before dispatch, so a browser bundle loaded before this ships keeps working rather than sending manifests the new cap rejects.
+
+  `@runtypelabs/sdk` gains `CatalogClientToolRef` / `ClientToolEntry` / `isCatalogClientToolRef`, and `dispatch()` forwards a ref instead of throwing on its absent `parametersSchema`.
+
+  MCP tool and parameter descriptions were rewritten to be terse and factual; the flow step `config` description dropped from 4.4KB to under 2KB, with its uncovered caveats (send-email `html`, vector-search qualifiers, `loop`, recordFilter operators) moved into the `generate-flow` build instructions.
+
+- 235751c: Report exact raw Runtype-funded provider and hosted-tool cost separately from blended execution cost.
+- dd54ba0: Allow detached Flow dispatches to run with 30-minute Flow and step budgets, and expose those controls on MCP and Code Mode `run_flow` helpers.
+- b2ac8a0: Harden durable asynchronous execution authorization, encrypted storage, native Claude Managed status polling, and SDK surface parity.
+- dae3030: Add the agent key request contract and MCP tools. `@runtypelabs/shared` owns the
+  wire contract and the canonical `runtype.api-key/v1` key-file format that the
+  CLI writer and dashboard download both emit. The MCP server gains
+  `request_api_key`, `claim_api_key`, and `cancel_api_key_request`: filing a
+  request generates its own PKCE verifier and raises the approval page through URL
+  elicitation where the client supports it, and redemption defaults to storing the
+  minted key as a Runtype secret so only a `{{secret:KEY}}` reference reaches the
+  conversation. The secret-intake URL-elicitation helpers are generalized into a
+  reusable handoff helper that both flows now share, with unchanged secret-intake
+  behavior. The SDK gains the matching request/get/claim/cancel methods.
+- c5a5baf: Exported runtime artifacts now DECLARE their host dependencies instead of being rejected for them (D-116).
+
+  `GET /v1/flows/{id}/export-runtime` no longer answers `422 DURABLE_FLOW_EXPORT_UNSUPPORTED` for a flow carrying a durable-class step (`wait-until` / `crawl`). That code is retired. Both export responses — flow and agent — now carry an additive `hostDependencies` array naming the runtime seams the artifact needs a host to wire before it can run everything it describes:
+  - `durable-pause-host` (`ExecuteFlowOptions.onDurablePause`, with `ExecuteAgentOptions.onDurablePause` as the agent-lane sibling) for durable-class steps anywhere in the artifact's executable closure;
+  - `background-run-coordinator` (`RuntimeToolExecutorDeps.backgroundRunCoordinator`) for a detached-capable `tools.subagentConfig` pool or a detached inline subagent tool.
+
+  Each entry carries the seam name, the reason, and the sites that caused it with full closure provenance (`ownerKind` / `ownerId` / `ownerName`), so a site living in an embedded agent, a capability, or an inline tool's backing definition is findable. The array is always present and empty when nothing needs wiring. The shape is a discriminated union on `kind` declared once in `@runtypelabs/shared` (`runtimeHostDependencySchema`); consumers should render `interface` and `reason` for a `kind` they do not recognise rather than failing.
+
+  The Workers-for-Platforms artifact lane is unchanged: a durable-class step is still a permanent `durable_steps_hosted_only` ineligibility reason there, because Cloudflare Workflows cannot live in a WfP dispatch namespace and that host is not the customer's to wire.
+
+### Patch Changes
+
+- b216c6a: Follow-ups to the D-107 durable-flow export rejection (#7634).
+
+  Each entry in the `422` `durableSteps` array now carries provenance — `ownerKind` (`flow` / `agent` / `capability` / `inline-tool`) plus `ownerId` and `ownerName` where they exist — and the rejection message names the carrier. The check covers a flow's whole executable closure, so a bare `stepId` routinely named a step that appears nowhere in the flow the caller is editing.
+
+  The closure walk also got three correctness fixes: a nested flow's own embedded agent registry is swept (previously only the root flow's was, so an agent reachable only through a flow-tool backing flow was never inspected); an agent capability's `tool` payload is descended like any other inline runtime tool (previously only `flow` and `subAgent` were); and the fixed ten-hop closure recursion bound — which failed OPEN, exporting a durable step found past it — is replaced by a worklist with an identity visited-set that terminates without ever declining to look.
+
+  `MAX_CONDITIONAL_NESTING_DEPTH` is now exported from `@runtypelabs/shared`, so the export gate imports the validator's own cap instead of restating it, and `isDurableStepType` replaces the last two hand-restated `wait-until` / `crawl` literal pairs.
+
+- edefa3c: Enforce single-config delegated external Agent evals and correlate their synthetic step and tool traces with the public runtime execution ID.
+- f95b02e: A messaging human takeover now lapses and the agent resumes after the surface's `interventionMode.takeoverIdleTimeoutMinutes` (default 24 hours, `0` disables) with no operator send. The lapse is evaluated at the dispatch gate on the next inbound, applied as a compare-and-set on the observed `takeoverAt`, and logged as `conversation_takeover_lapsed`. Closing or reopening a conversation (`PUT /v1/messaging/conversations/{id}` status changes, `closeConversation`, the `/new` reset) now clears the takeover so a reopened thread never inherits a stale mute. Every `agent_mode` writer lives in `apps/api/src/services/messaging-takeover.ts`.
+- f5250b6: Make saved external-agent authentication credentials write-only on agent
+  management responses. Create, update, detail, and agent-card refresh responses
+  now return `<redacted>` instead of plaintext, while safe same-auth-type PUT
+  round trips preserve the sealed credential and cross-host repoints still require
+  the caller to resend the real credential. Clients that copy an agent read into
+  a create request must now inject the original credential from their secret
+  manager instead of treating the read response as a credential export.
+- e305a29: Key a sandbox's injected egress state by execution owner instead of holding it
+  DO-level, so concurrent code-execution steps sharing one sandbox id can no
+  longer clobber or prematurely clear each other's credentials.
+
+  `reuseSandboxId` is an author-supplied string, and a constant collapses every
+  concurrent execution of a flow, for one organization, onto one sandbox id. The
+  injected API token, credential-proxy rules and `networkAccess` posture were
+  plain instance fields on `CloudflareSandboxDO`, so the last writer won: a step
+  could run under another step's egress posture and another user's token, and a
+  sibling's cleanup cleared credentials a live step was still using.
+
+  Each execution now holds one grant keyed by its containment owner id and
+  releases only its own on the way out. A grant that asks for a different API
+  token or a different `networkAccess` than a live sibling is refused and its
+  step fails with an actionable error, since a shared container has no honest
+  merge for a container-wide posture; an omitted dimension resolves against the
+  ambient layer rather than inheriting a sibling's, so an execution that asked
+  for the fail-closed default never gains a neighbour's open egress. Every
+  execution takes a grant, including one that injects nothing — it has a posture
+  too, and leaving it uncounted would let it run under a sibling's broader
+  egress. Identical
+  credential-proxy rules compose — phantom tokens are persisted per secret, so
+  concurrent runs of one flow legitimately present the same phantom, and only a
+  phantom resolving to a different rule is refused. Grants carry their
+  execution's containment deadline, so an abandoned step stops refusing siblings
+  once its own budget lapses. The long-lived callers whose credentials
+  deliberately outlive one call (`deployWithPreview`, the agent tool lane's
+  `setNetworkAccess`) keep an ambient layer that a scoped release now restores
+  rather than wipes.
+
+- 2783291: Finished the Slack OAuth install server-side, so a headless caller no longer needs the dashboard popup to complete setup. `POST /v1/oauth/slack/start` now accepts an optional `surfaceId`, validates that the surface exists and belongs to the caller before minting the encrypted state blob (400 on a malformed id, 404 on a missing or foreign one), and carries the id across the redirect; the callback then stamps the claim result onto that surface's inbound config (`integrationId`, `teamId`, `teamName`, `appId`, `botUserId`) and activates it — the same write the dashboard wizard performs client-side today. Stamping is idempotent, re-checks ownership at callback time, and never fails the OAuth: a surface deleted mid-handshake is logged and the install still completes, and a failed claim leaves the surface untouched. State blobs minted before the field existed keep parsing, and `SlackOAuthStartRequest` in the TypeScript SDK carries the new optional field. Separately, `POST /v1/integrations/slack/install` now enforces the `INTEGRATIONS:WRITE` API-key scope that every sibling integrations mutation route already required; it was missing.
+
+## 9.1.1
+
+### Patch Changes
+
+- 7aea953: Follow-ups to the #6049 §D10 wire fixes: the AG-UI translator synthesizes a `TOOL_CALL_START` for complete-only tool frames (the MCP discovery connection pseudo-tool) so strict AG-UI clients no longer see an orphan `TOOL_CALL_END`; the AG-UI runtime tee redacts the discovery pseudo-tool's raw connection-failure text on end-user streams; the SDK's `agent_tool_complete` event carries the frame's `error` field so complete-only failures stay diagnosable; the terminal error `code`/`details.errorName` invariant is folded into one `terminalErrorFields` helper.
+- 9c9eb47: Close the #6049 §D5 agent-lifecycle re-audit (D-111..D-115).
+  - `execution_start` on the resume leg of a paused agent run now carries `resumed: true` (D-113). Consumers keep run-level state across a start that carries the flag; the SDK forwards it on `AgentStartEvent.resumed` and `executeWithLocalTools` fires `onAgentStart` once per session instead of once per leg.
+  - Terminal `execution_error.code` is a stable vocabulary on the runtime flow lane too (D-115): a generic throw reports `EXECUTION_FAILED` with the class name on `details.errorName` instead of leaking `Error` / `TypeError` as the code. `StepTimeoutError` and the `AbortError` / `TimeoutError` pair still pass through by name; structured codes keep precedence. `FlowLifecycleComplete.error.details` carries the same observability host-side.
+  - Pins for the ratified pause sequence (D-111), the agent-kind shape on external / Claude Managed lanes (D-112), and the abort terminal (D-114).
+
+## 9.1.0
+
+### Minor Changes
+
+- ccdc5f6: Expose the first-class record/conversation `ownerId` on every client surface (#3395)
+  - **CLI**: `records list`, `records create`, and `records export` take `--owner-id`; `records update` takes `--owner-id` plus `--clear-owner` (an explicit `null`, which clears the stored owner — omitting both leaves it untouched). `conversations list` takes `--owner-id`. `records get`/`update` render the owner, and the CSV export gains an `ownerId` column.
+  - **SDK**: `CreateRecordRequest.ownerId` and `CreateConversationRequest.ownerId` / `UpdateConversationRequest.ownerId` accept `string | null`, so `records.update()` and `conversations.update()` can clear an owner.
+  - **MCP**: `create_record` / `create_conversation` accept `owner_id`; `update_record` / `update_conversation` accept a nullable `owner_id` where `null` clears the owner.
+  - **Code Mode MCP**: the `listRecords` / `createRecord` / `updateRecord` / `listConversations` / `createConversation` / `updateConversation` method docs describe `ownerId` and its null-clears semantics.
+
+- ccdc5f6: Promote conversation/record `ownerId` to a dedicated indexed column (#3395)
+  - Adds `records.owner_id` (B-tree indexed) via migration `0148`, backfilling every existing row whose `metadata.ownerId` is a non-empty string.
+  - Converges every write seam onto the column — conversations create/update, records create/update (`POST/PUT /v1/records`), and dispatch `resolveRecord`. One precedence rule (`resolveRecordOwner`): a top-level `ownerId` wins over a nested `metadata.ownerId`, a legacy string nested value is promoted into the column, and the nested key is never persisted again. Update requests accept `ownerId: null` to clear the owner; omitting the field leaves it untouched.
+  - Conversation and record responses source the first-class `ownerId` from the column (`GET /v1/records` list/detail and the CSV export now return it) and strip a residual nested copy from the echoed metadata when the column is set.
+  - Extends the `?ownerId=` filter to `GET /v1/records` (and the CSV export), backed by plain index equality instead of JSONB extraction. The record-filter DSL (`recordFilter` on `retrieve-record` / `update-record` / `list-records` steps, schedule `record_filter`, `POST /v1/records/preview-filter`) treats `ownerId` as a top-level column on both execution lanes.
+  - Adds the `{{_record.ownerId}}` system variable (#7549) on both execution lanes, sourced from the column; the key is omitted (never `undefined`) when a record has no owner.
+
+  Behavior note: records written after deploy carry the owner only in the column, so `{{_record.metadata.ownerId}}` no longer resolves for them. Use `{{_record.ownerId}}` instead.
+
+### Patch Changes
+
+- b4c1858: `/v1/dispatch` agent loops now run on the `@runtypelabs/runtime` lane BY DEFAULT (legacy-engine retirement program, D-109 M1).
+
+  `options.useRuntimePackage` becomes an opt-OUT: an eligible agent dispatch that omits the field selects the runtime lane instead of the legacy engine. An explicit `false` still selects legacy verbatim, and every existing fold — `claude_managed` / no agent input, the parity-fold classes, and the unchanged request/definition support gates (`authoredDefinitionSupportIssue`) — still routes ineligible definitions to legacy.
+
+  Compatibility: a request that reaches the runtime lane through the new DEFAULT and then hits a support gate degrades to a legacy execution rather than returning HTTP 400. An explicit `useRuntimePackage: true` keeps rejecting exactly as before. Local agent inference no longer requires the explicit opt-in (it is refused only for an explicit opt-out).
+
+- cf8dd74: Expose per-unit execution-engine attribution on the batch/eval read surfaces (#6106). `FlowStepResultSchema` (flow/record/batch step results), the eval results per-step rows, the eval run-scores per-case rows, and the schedules batch/run per-record results gain a nullable `executionEngine` ('runtime' | 'legacy'; null for rows written before attribution shipped or units that never executed), mapped verbatim from the persisted column. `GET /v1/batch/status/{id}` gains `executionEngineSummary` ('runtime' | 'legacy' | 'mixed' | null), derived at read time by aggregating the batch's per-record values — never inferred from IDs, sources, or models. SDK types regenerate from the updated spec.
+- 901ee20: Return the per-execution metrics `record_results` already stores from `GET /v1/records/{id}/results`, and render them on a conversation turn.
+
+  `record_results` persists `total_tokens`, `model_used`, `execution_time_ms` and `estimated_cost` on every row the executor writes, but the handler's projection selected nine columns and none of them were these. The product Activity view is the only consumer that reads a conversation's turns, so a turn rendered with no latency, cost, tokens or model while an agent run beside it in the same merged list showed all four. Nothing failed and nothing logged: the fields were simply never on the wire, and a response schema that did not declare them agreed with the omission.
+
+  The projection and `RecordResultSchema` now carry all four, so they reach the OpenAPI spec and the generated TypeScript, Python, Ruby and Java SDK types. `estimatedCost` is declared as a string because `estimated_cost` is a `decimal(10,6)` column that reaches the wire unparsed, matching how `analytics.ts` already returns it.
+
+  The Activity turn pane renders them through the same `MetricCard` the run pane uses, so the two item kinds no longer read as different depths of detail. A turn carrying none of the four renders no metric block rather than four empty tiles. A new api-side contract test asserts set equality between the schema's fields and the query's projection, so neither half can drift from the other again.
+
+- 86212a3: Make runs and conversations navigable instead of something you jump between.
+
+  Agent editor: closing the Test Agent sheet now routes to the run it produced,
+  detected by row identity rather than timestamps so it never depends on
+  client/server clock agreement, and never hijacks navigation when no run was
+  dispatched. The active tab and selected run round-trip through the URL
+  (`?tab=runs&run=…`), so a run can be linked, opened in a new tab, and reached
+  with the Back button. The Runs tab carries a run count and a failure dot, the
+  runs list gets keyboard triage, the per-run rail became a duration waterfall
+  instead of a second flat copy of the tool calls, and a stale run id renders a
+  recovery state rather than an endless skeleton.
+
+  Products: conversations are no longer reachable only from a hover-revealed icon
+  on a canvas node. A product-level Activity view lists runs and conversations
+  across every surface with a surface filter, surface nodes carry an activity and
+  failure signal, and the product header's stats link into Activity pre-filtered.
+
+  API: `agent_executions` gains a nullable `conversation_id`, exposed on the
+  executions list and detail responses, so consumers can group a multi-turn
+  thread's runs without a per-run log query. It is the run's own thread, distinct
+  from the existing `parent_conversation_id` (subagent lineage), and stays null on
+  stateless surfaces (webhook, schedule, eval, one-shot API) rather than being
+  synthesized from the execution id.
+
+- 840934b: Force managed external-agent skill orchestration through Runtime at every whole-agent production entrance, including dispatch, internal jobs, webhook, messaging, client chat, voice, evals, nested agents, and surface overrides. Managed execution now fails closed rather than degrading to direct A2A delegation when Runtime is unavailable.
+
+## 9.0.0
+
+### Major Changes
+
+- b01026e: Repair foreign-key drift across environments, separate asset storage identity from canonical ownership without breaking rollback Workers, and preserve organization-owned tools and skills when their creating user is deleted.
+
+### Patch Changes
+
+- 7a5cf94: Persist the post-approval assistant turn on `POST /v1/client/resume`
+
+  A client-tool (WebMCP) pause is a terminal success, so the pausing
+  `/v1/client/chat` turn wrote its assistant message with the gated calls still in
+  `state: 'call'` and finished, while the resume that carried the approved tool
+  outputs wrote nothing at all. Everything the model produced after the approval
+  only reached the conversation record when a later chat turn happened to re-send
+  the browser's own copy of it, so a conversation whose last turn was an approval
+  lost its final answer outright.
+
+  Resume now claims the conversation's active-turn slot when it is free (never
+  taking it back from a newer chat turn the visitor started instead of approving),
+  assembles the leg's assistant text from its own stream, resolves the
+  stored `toolInvocations` from the submitted `toolOutputs`, and persists both
+  under the same compare-and-swap guard — on completion, on a re-pause, and on the
+  buffered (`streamResponse: false`) path. A client's later echo of that message
+  is deduplicated, and the request accepts an optional `assistantMessageId` so a
+  client that mints the id locally gets exact id dedupe.
+
+## 8.0.3
+
+### Patch Changes
+
+- e154387: Surface managed Telegram bot creation failures instead of spinning silently. The status endpoint now runs a KV-cached manager-webhook health probe once a request has been pending for over two minutes and returns a `diagnostic: 'manager_webhook_unhealthy'` hint (new optional enum field in the SDK types); the verdict is derived from the delivery-blocking verify checks only, so a stale Telegram `last_error_date` cannot flip it. The Create New Bot wizard shows a slow-progress notice after 90 seconds, a misconfiguration notice when the diagnostic fires, and offers a one-click fallback to manual bot connection. Manual installs for a surface now cancel that surface's abandoned managed-bot requests, retrying after a poll timeout cancels the timed-out request, and initiate logs a traceable success line.
+
+## 8.0.2
+
+### Patch Changes
+
+- 3b4f69c: Normalize package authorship and copyright metadata.
+
+  The `author` field reads `Runtype` rather than `Runtype Labs` across every
+  workspace package that set it, and the copyright holder in each license file is
+  now `Runtype, Inc` — replacing `Travrse Labs, Inc` in the CLI and the four Fern
+  SDKs, and the `Runtype Labs` that the new `flue-otel` license was written with.
+
+  Metadata only: no source, dependency, or behavior change.
+
+## 8.0.1
+
+### Patch Changes
+
+- 047a57b: Serve `finalOutput` on the agent-executions list by default, with a `view=compact` opt-out.
+
+  `GET /v1/agents/{id}/executions` now accepts the shared `view=full|compact`
+  collection-representation parameter and defaults to `full`, which carries each
+  run's `finalOutput`. The route also serves the `?executionId=` single-row
+  lookup, so callers reading a run's result off it previously got `stopReason`
+  and `totalTokens` with no output and read the intact row as data loss.
+  `view=compact` restores the historical lightweight projection (and applies the
+  standard 100-character string preview). The per-iteration blobs
+  (`iterationDetails`, `loopConfig`) stay detail-endpoint-only in both views.
+
+  The MCP `list_agent_executions` tool gains the same `view` parameter and
+  defaults to `compact`, matching every other MCP list tool; `view` is threaded
+  through both `RuntypeClient` implementations and the Code Mode executor so an
+  explicit `full` actually reaches the API. The dashboard runs list asks for
+  `compact` explicitly since it renders only row titles and status.
+
+## 8.0.0
+
+### Major Changes
+
+- 93387f9: Add the expand-first organization model-configuration foundation: canonical organization-owned storage, creator-safe lifecycle, rollback-compatible reads and runtime settings, stale legacy-write containment, and nullable ownership/provenance fields in model-config responses. The nullable `userId` response contract is a breaking schema change required before canonical organization rows can be activated.
+- 8847973: Remove the dormant `@runtypelabs/guardrails` library and the entire skill-spector scanning feature (the `@runtypelabs/skill-spector` package, the `apps/skill-spector` scanner worker, and the API/dashboard wiring) from the codebase. The advisory `POST /v1/skills/scan` endpoint and the `enableSkillScanner` profile-features flag are removed; the TypeScript SDK drops `skills.scan()` and the `SkillScan*` verdict types; the dashboard drops the skill "Security scan" affordance.
+
+### Minor Changes
+
+- 7d284c9: Activate organization-owned model configurations with conflict-preserving migration, shared teammate CRUD, fail-closed runtime resolution, creator-independent lifecycle, transactional audit events, rollback aliases, and a dashboard recovery state for conflicting legacy settings.
+- 3ea4dd2: Migrate organization Amazon Bedrock credentials to shared organization connections with explicit BYOK custody across REST, TypeScript SDK, MCP, and Code Mode; deterministic structured-credential runtime resolution; lifecycle preservation; audit attribution; and storage-only mixed-version aliases that cannot silently select execution custody.
+- 59e5efa: Move organization OpenAI-compatible credentials and typed endpoint metadata to shared organization connections with explicit BYOK authority, exact model discovery and sync, creator-independent lifecycle, rollback-safe endpoint mirroring, and consistent REST, SDK, MCP, Code Mode, dashboard, runtime, status, telemetry, and audit behavior.
+- 60e39b1: Migrate organization Mixlayer model credentials to shared organization connections with explicit BYOK or platform-managed custody across REST, TypeScript SDK, MCP, Code Mode, and the dashboard; deterministic runtime and status resolution; lifecycle preservation; audit attribution; and canonical mixlayer policy identity for legacy Modelsocket-compatible execution.
+- 553da9d: Migrate organization Tinfoil model credentials to shared organization connections with explicit BYOK custody across REST, TypeScript SDK, MCP, and Code Mode; deterministic runtime and status resolution; lifecycle preservation; audit attribution; and storage-only mixed-version aliases that cannot silently select execution custody.
+- a2c4ec7: Migrate organization Together.ai credentials to shared organization connections with explicit BYOK custody across REST, TypeScript SDK, MCP, Code Mode, and the dashboard; deterministic runtime and status resolution; creator-independent lifecycle; transactional audit attribution; and guarded dedicated-endpoint routing that cannot redirect the organization credential outside Together.ai.
+- 6671abd: Move Vercel AI Gateway credentials to organization-owned connections with explicit shared BYOK or Platform authority, durable actor audit, creator-independent lifecycle, typed custom gateway settings, and consistent SDK, MCP, Code Mode, dashboard, runtime, and billing attribution.
+- f3aef36: Migrate Vertex AI and Vertex AI (Claude) credentials to independent organization-owned connections with explicit BYOK custody, creator-independent lifecycle, transactional actor audit, and provider-scoped service-account resolution across REST, SDK, MCP, Code Mode, dashboard, legacy execution, and hosted runtime.
+
+### Patch Changes
+
+- af59a67: Agent-lane consumers scope terminal semantics to their own execution, so a relayed flow-as-tool child no longer supplies the run's terminal, final text, or response body.
+
+  A flow tool relays its nested flow onto the parent agent's stream, and that child always completes before the parent's `tool_complete`. Consumers reading "this run's terminal / final text / reported error" now filter by the owning `executionId` (`ownExecutionFrames` / `isOwnExecutionFrame`). Fixes an HTTP 500 on non-streaming `/v1/agents/{id}/execute` (`tool_complete after terminal execution_complete`), a voice turn that failed closed on a nested `success: false`, a duplicate AG-UI terminal callback, a Product API capability returning a nested flow step's payload as its `data`/`message`, and an SDK `onAgentComplete(success:false)` firing mid-run for a nested failure the agent recovered from.
+
+- c29f1ce: Prepare Linear and GitHub built-in integrations for organization-owned credential authority with previous-Worker guards, owner-native credential preservation, and forward-compatible runtime/status resolution.
+- 4776fa0: Retain external OTLP spans, span events, and LogRecords in the append-only
+  customer Logs tier on both the standalone ingest worker and API fallback lane.
+  The projection resolves tenant attribution before retention, applies the
+  agent's logging and PII-redaction policies, scrubs credential-shaped content,
+  and records bounded-row truncation explicitly. Logs and trace readers collapse
+  at-least-once retries by kind-specific identities and rebuild the exported span
+  parent/child tree without double-counting envelope metrics. OTLP LogRecords are
+  now decoded for protobuf and JSON exports; metrics remain acknowledged without
+  storage. JSON `/v1/executions/ingest` runs remain a compatibility path and now
+  return an explicit trace-availability reason instead of looking like a
+  successful empty trace. MCP execution-id inputs clarify that they accept the
+  runtime `execution_id`, not the `aex_...` database row ID.
+
+## 7.3.1
+
+### Patch Changes
+
+- 5df5995: Migrate organization Braintrust tracing to organization-owned observability connections with shared control/runtime resolution, bound secret custody, legacy promotion, lifecycle resilience, and actor-attributed audit events.
+- 1419c72: chore: update model configs from models.dev/Vercel/Mixlayer APIs
+
+  Adds 3 runtime models (`gemini-3.7-flash`, `google/gemini-3.7-flash`,
+  `alibaba/qwen3.8-2.4t-a95b`); no models were removed and no pricing changed.
+
+  Also swaps the account default in `DEFAULT_MODELS_FOR_NEW_ACCOUNTS` from
+  `gemini-3.6-flash` to `gemini-3.7-flash` in the fast Gemini flash-tier slot:
+  same 1M context, same reasoning/tool-use/vision/audio-input capability tags,
+  same google→vercel routing, at half the blended cost (0.00225 vs 0.0045 per
+  1k tokens). This moves `DEFAULT_MODEL_ID`, which is the OpenAPI `model`
+  default on the prompt-create/update routes, so the spec and SDK types are
+  regenerated. `EVAL_JUDGE_MODEL` and `PRODUCT_GENERATOR_MODEL` are
+  intentionally untouched.
+
+- 948ceed: Migrate organization Anthropic credentials to shared organization connections with explicit custody policy, deterministic runtime resolution, lifecycle preservation, audit attribution, and mixed-version compatibility.
+- c56a67e: Migrate organization Google model credentials to shared organization connections with explicit custody policy across REST, TypeScript SDK, MCP, and Code Mode; deterministic runtime and status resolution; lifecycle preservation; audit attribution; and storage-only mixed-version aliases that cannot silently select execution custody.
+- 212bd10: Migrate organization OpenAI credentials to shared organization connections with explicit custody policy, deterministic runtime resolution, audit attribution, legacy model-config compatibility, and a provider-agnostic mixed-version guard for later provider activations.
+- 5ae8a9c: Migrate organization xAI model credentials to shared organization connections with explicit custody policy across REST, TypeScript SDK, MCP, and Code Mode; deterministic runtime and status resolution; lifecycle preservation; audit attribution; and storage-only mixed-version aliases that cannot silently select execution custody.
+
+## 7.3.0
+
+### Minor Changes
+
+- d1ba834: Add a uniform `view=compact` representation to collection endpoints, cap long string previews at 100 characters, default MCP list tools to compact responses, and fix agent type filtering.
+
+## 7.2.1
+
+### Patch Changes
+
+- 083846c: External agents can speak Runtype's unified stream (`protocol: 'runtype-stream'`).
+
+  `agents.externalConfig` gains one additive field, `protocol`. Absent and `'a2a'`
+  both mean today's A2A JSON-RPC behavior byte-for-byte — the column is JSONB, so
+  no migration and no backfill. `'runtype-stream'` means the endpoint answers
+  `POST {endpoint}` with a `text/event-stream` in the 35-event unified vocabulary,
+  the same wire Runtype's own engines emit. `framework` also gains `'flue'`, a
+  reporting hint that nothing branches on.
+
+  **This fixes a live correctness bug, not just a feature.** Everything that runs
+  an external agent through `executeAgentInternal` — plain agent batches,
+  schedules, messaging channels, webhook surfaces — got `{ success, responseText,
+error }` and wrote no `tool_executions` rows, so anything reading a run's trace
+  saw an EMPTY one. Every trace grader (`called_tool`, `tool_order`,
+  `max_tool_calls`, `used_no_tools`) therefore failed in a way that looked like the
+  agent misbehaving. On the new protocol the structure survives the boundary and
+  the rows are written.
+  - `ExternalAgentProxy.executeUnifiedStream` is a fourth method on the existing
+    proxy, so all outbound external-agent I/O keeps one home: the same
+    `UrlValidationService` (SSRF on a customer-supplied endpoint), the same
+    `buildAuthHeaders` (exactly one place materializes the sealed credential), the
+    same `timeoutMs` / `retryCount` fields. Retries cover the CONNECT phase only —
+    once a frame has been forwarded the request is not replayable.
+  - The request body is the full `messages` history rather than the A2A lane's
+    last message as one text part, so adopting the protocol also fixes that
+    truncation. It is deliberately the dispatch body `examples/flue-persona`
+    already accepts, which makes that example the executable reference
+    implementation of the server side.
+  - `executeExternalAgentUnified` (`agent-executor.ts`) folds the terminal frame
+    into the usual result shape; `InternalAgentExecutionParams` gains an optional
+    `stream`, and the external branch tees the caller's sink with
+    `createAgentToolSSETap`. The tap needed no changes — it already reads the
+    native unified tool vocabulary — which is what makes tool rows, and therefore
+    batch trace grading, start working.
+  - A terminal frame's `totalCost` is returned but never persisted as Runtype
+    cost. It is the customer's assertion about their own provider spend, and
+    `aggregateExecutionCost` has no provenance predicate yet.
+
+  **Validation is a trust boundary here.** The stream is customer-authored input
+  on the path that writes DB rows, so every frame goes through
+  `unifiedSSEEventSchema` (non-conforming frames are dropped, as the AG-UI edge
+  does) and the run goes through the shared structural validator
+  (`packages/shared/src/utils/unified-sse-conformance.ts`) — no private copy, so
+  producer and consumer are held to identical rules. A structural violation (a
+  `tool_complete` for a call that never started, a second `execution_start`, a
+  frame after the terminal, a hole in `seq`) is never forwarded and fails the
+  dispatch, and event/byte/frame caps plus the configured timeout bound every
+  hostile shape. That validator now also exposes `createConformanceTracker`, an
+  incremental form for exactly this consumer; the whole-array
+  `findConformanceViolations` is implemented in terms of it so the two can never
+  disagree.
+
+  Not included, and unchanged: the synchronous `/eval/run` path still rejects a
+  non-`runtype` agent target with `AGENT_TYPE_RUN_UNSUPPORTED` (its message is
+  narrowed to name the surfaces that do work). Direct dispatch for unified
+  external agents there is the next phase.
+
+## 7.2.0
+
+### Minor Changes
+
+- 6ae01b5: Canonicalize the "Managed in code" provenance indicator across the dashboard and expose flow provenance through the API.
+
+  One shared dashboard module now owns the badge, the save-overwrite confirmation dialog, and the predicate, which delegates to `isManagedByCodeSource` in `@runtypelabs/shared`. This fixes terraform-managed tools, which previously showed no badge and skipped the overwrite warning because the tools surface hardcoded a check against the `sdk` source.
+
+  Flows gain provenance end to end: `lastModifiedSource` is now returned on the flow list and detail responses (and by create/update), and the flow editor renders the badge and gates Save behind the confirmation dialog, matching agents. The flows index badges code-managed rows.
+
+## 7.1.0
+
+### Minor Changes
+
+- 27d0b95: Add an additive optional `stepErrorCount` to `execution_complete`: the count of top-level steps that completed carrying a non-null `error`, **including continue-on-error swallows**.
+
+  It is a **sibling** of the failure counters, never a replacement. `stepErrorCount` is deliberately the LARGER set: a step that swallowed its error under the default `errorHandling: 'continue'` reports `success: true` and still carries the reason on its top-level `error`, so it contributes to `stepErrorCount` but not to `failedSteps` or to the flow's `success` verdict. Collapsing the two onto one predicate would either redefine `success` (counting swallows as failures) or undercount errors.
+  - Emitted on `execution_complete` (unified SSE) by both the API-owned lane and the `@runtypelabs/runtime` FLOW lane, and carried inside the terminal event of the buffered JSON dispatch body.
+  - Persisted with the execution's `flow_complete` telemetry event, so a run's swallowed-error count is queryable after the fact.
+  - Threaded through the runtime's `RuntimeFlowProgress` and the persisted resume state, so a paused/resumed flow keeps an accurate count across legs.
+  - Optional and additive: absent (not `undefined`) when a producer has no counter, so existing clients and parsers are unaffected.
+
+  Documented boundary: the two dispatch-seam swallows (`generate-embedding`, `vector-search`) carry their reason on `metadata.error` with no top-level `error`, so they land in neither counter — `stepErrorCount` counts exactly what `step_complete.error` puts on the wire.
+
+### Patch Changes
+
+- 8d85ce9: Forward the A2A conversation handles on an `await` pause, so a paused external-agent run stays correlatable off the buffered response and the SDK callback.
+
+  Follow-up to #6845 (#6103 §B3), where the external-agent `input-required` pause moved from `approval_start` onto the `await` rail. Two consumers still only read the handles off `approval_start`:
+  - **API** — the buffered (`streamResponse: false`) dispatch response forwarded `externalAgent` only from an `approval_start` terminal, so a non-streaming A2A pause returned `status: 'paused'` with no `externalAgent` at all. The `await` terminal's context is now forwarded the same way. Resume was never affected (it routes off the persisted checkpoint), but the response shape regressed for exactly the lane that PR retargeted.
+  - **SDK** — the unified `await` → `agent_await` mapping dropped `awaitReason`, `elicitation`, and `externalAgent`, while the same adapter already forwards `externalAgent` on `execution_complete`. An `onAgentPaused` consumer could not tell an A2A elicitation from a client-tool wait, nor see the `contextId` / `taskId` to resume the conversation with. `AgentPausedEvent` gains the three optional fields, typed against the canonical wire schemas: a new exported `AgentElicitation` (and `AgentElicitationRequest`) restates `unifiedElicitationSchema` in full — both `mode` values, the required `message`, plus `requestedSchema`, `url`, `serverName`, `pauseCount`, and multi-request `requests` — and `externalAgent` reuses the existing exported `ExternalAgentContext`. Previously these fields were reachable only as `unknown` through an index signature, so consumers had to cast to render a form, follow a `url`-mode auth prompt, or preserve the pause-count binding.
+
+- cdff95a: A2A runtime parity for the external-agent client (#6103 §B3).
+
+  **Runtime** — "speaking A2A" is now a first-class feature of the runtime package. A new `engine/a2a/` module owns the wire protocol for both A2A clients: 0.3/1.0 negotiation off `cachedAgentCard.protocolVersion` (method names, `a2a-version` header, roles, part oneofs, `TASK_STATE` normalization), endpoint preference for the cached card, and immediate-reply result normalization (a `{ result: { message } }` reply is a completed task carrying the message text, not an empty output). The external-agent client (`external-agent.ts`) and the A2A tool path (`runA2A`) now share it, so the two clients agree on the wire. Transient send failures retry (`retryCount ?? 3`, 100ms ×2, no retry on abort / URL-validation / JSON-RPC error), and per-agent `timeoutMs` bounds each attempt while the engine wall clock still bounds the whole run.
+
+  The external-agent `input-required` / `auth-required` pause is now a resumable await instead of an `approval_start`. It emits the unified `await` frame with `awaitReason: 'a2a_input_required'` / `'a2a_auth_required'`, the peer's question on the existing elicitation payload, and a new additive optional `externalAgent: { contextId, taskId }` field (wire shape reused from `approval_start`/`execution_complete`). A resumable external-mode checkpoint (`kind: 'external-agent'`, keyed at pinned iteration 0, overwrite-on-re-pause) is persisted through the same store as loop checkpoints; a resume re-enters external mode and sends the user's reply as the next message on the checkpoint's `contextId`. No checkpoint is written when the peer assigned no `contextId`. The new `external_input_required` stop reason maps to the paused status so usage is not double-counted. `awaitReason` remains UX context only — nothing branches on it; the tool/skill approval fold is unchanged.
+
+  **API** — the runtime export pipeline now carries per-agent `timeoutMs`/`retryCount` through to the runtime lane, and the paused-status mapping understands the new stop reason.
+
+  **Shared / SDK** — the additive `await.externalAgent` field is added to the unified SSE schema (open optional field) and regenerated into the TypeScript SDK types and OpenAPI spec.
+
+## 7.0.0
+
+### Major Changes
+
+- dda50f3: Retire the legacy eval override channels. `overrides` is the only spelling the wire accepts: `stepOverrides` (with its `'*'` key), `claudeManagedOverride`, `advisorOverride`, and the four scalar surface-eval `*Override` fields no longer parse.
+
+  **Breaking**, and the major lands on `@runtypelabs/sdk` alone because that is the only package anything resolves by range: it declared `stepOverrides` and `claudeManagedOverride` as accepted input on `runVirtualEval` and no longer does. The API takes a minor — its wire contract breaks too, but the package is private, so its version is changelog and deploy metadata rather than a contract a dependent resolves. What tells an API caller about the break is this entry and the 400 itself, not a version number they never read.
+
+  A request still using a retired spelling gets a 400 naming the `overrides.*` field that replaced it. That rejection is the point rather than a side effect — the eval request schemas are `.passthrough()`, so merely undeclaring a field would leave it silently ignored, and an ignored override is recorded and scored exactly like an applied one. Failing loudly is what keeps an unmigrated caller from being graded as a baseline it never asked for.
+
+  Migration is a rename in every case:
+
+  | Retired                                                                                      | Replacement                                                                    |
+  | -------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------ |
+  | `stepOverrides['*']`                                                                         | `overrides.agent` or `overrides.flow`, whichever matches the target            |
+  | `stepOverrides[stepId]`                                                                      | `overrides.steps[stepId]`                                                      |
+  | `claudeManagedOverride`                                                                      | `overrides.claudeManaged`                                                      |
+  | `advisorOverride`                                                                            | `overrides.advisor`                                                            |
+  | `temperatureOverride` / `maxTokensOverride` / `responseFormatOverride` / `reasoningOverride` | `overrides.flow.temperature` / `.maxTokens` / `.responseFormat` / `.reasoning` |
+
+  Splitting `'*'` into `agent` / `flow` is what makes the target-illegal case a 400 instead of a drop: the one key used to mean "the agent under test" on one target kind and "every prompt step" on the other, so it could never be checked.
+
+  `options.modelOverride` is unaffected — it is a dispatch knob, not an eval override channel, and keeps its existing lowest precedence beneath the caller's own `overrides.flow`.
+
+  In-flight batches are unaffected and the deploy needs no coordination. The plan expected this deletion to require a versioned Durable Object drain or a no-batches deploy window, which holds only while "what a caller may send" and "what persisted state may contain" are the same type. They are now separate: `evalOverridesInputFromExecutionConfig` folds the state shape for internal execution metadata and pre-carrier `batchState`, and a request cannot reach it. `'*'` therefore survives inside execution metadata on purpose — it is still how the flow engine spells "every prompt step", which no wire change touches.
+
+  A data migration (`0130_backfill_eval_config_canonical_overrides`) rewrites the historical `batch_executions.eval_config` audit snapshots into the same canonical shape, so one spelling remains in the system. It cannot change what any run does: nothing executes from that column — the batch Durable Object restores `evalConfig` from its own state, never from Postgres — and every read of it is display or reporting. The Runs-list reader now understands both shapes, so it labels runs correctly whether or not the migration has run.
+
+### Minor Changes
+
+- a634b53: Eval overrides now travel on one canonical `overrides` request field
+
+  `overrides` previously carried only the per-sub-agent targets, which had no
+  legacy channel and no first-party producer. It now carries every channel —
+  `agent` / `flow` / `steps` / `claudeManaged` / `advisor` beside `subagents` /
+  `subagentDefaults` — and the dashboard, the SDK, the MCP tool inputs and the
+  OpenAPI examples all emit it.
+
+  Four new submit-time 400s replace what were silently-scored no-ops: setting
+  both the canonical and the legacy spelling of one channel, `overrides.agent` on
+  a flow target (or `overrides.flow` on an agent target), and an `overrides.steps`
+  key naming no step of the target. The unreachable-`agentId` rejection now
+  applies on every eval lane, `/eval/stream` included.
+
+  The legacy `stepOverrides` (with its `'*'` key), `claudeManagedOverride` and
+  `advisorOverride` fields still parse and still resolve identically; they are
+  deleted in a later phase.
+
+### Patch Changes
+
+- 836fc82: Phase 0 of the Persona visitor conversation-history contract. Everything here is additive: `flow` on init, `flowId` on summaries and query parameters, and the stored `metadata.flow_id` key all stay as compatibility aliases through the rolling-deploy window.
+
+  **Durable handles.** `POST /v1/client/init` now returns `conversationId` from every successful branch (fresh mint, legacy `sessionId` replay, `conversationId` resume) plus a canonical top-level `targetId` from the chat-capable ones. A widget persists the conversation, not the short-lived session. `targetId` is not the identity function on what the caller configured: an agent-only client token resolves its agent to that agent's primary flow before storing, so a widget filtering by the configured agent id would have got an empty history and, on delete-all, would have deleted nothing while reporting success. The four target shapes are pinned against the record's stored `flow_id`.
+
+  **`targetId` filter symmetry.** Both `GET` and `DELETE /v1/client/conversations` take it; a target-scoped UI can no longer clear conversations it never showed the visitor. Supplying `targetId` and `flowId` with different values is a 400 rather than a guess.
+
+  **Display projections.** A stored message's `content` is the model channel, which for anything richer than a plain text turn is not what the person read. Messages now carry an optional `displayContent` alongside it, plus `displayAvailable` on the read path; execution reads only `content`. Absent and empty-string projections are distinct states. Without a projection, stored content stands in only when it is plainly render-safe, so opaque model-only structure is withheld rather than handed to a renderer.
+
+  A terminal assistant turn is the hard case: its visible text is only computable in the browser after the stream closes, and if the visitor leaves right then no later request exists to carry it. `PATCH /v1/client/conversations/{id}/display-projections` is that channel. Projection-only (it cannot create a message or move content, role, ordering, timestamps, count, ownership, or title), all-or-nothing per batch, idempotent, bound to the session's own conversation, and bounded for a `keepalive` request. The write compare-and-swaps on `conversationRevision`: unlike the two chat-path writers, this route is not serialized by the active-turn CAS, so an unguarded rewrite of the transcript array could delete a turn persisted between its read and its write. A re-sent chat turn repairs a lost finalization.
+
+  **`conversationRevision`.** An opaque equality-only change token on init, detail, and the finalization response. It moves on every transcript mutation including a projection change, which deliberately leaves `updatedAt` alone so a closing tab cannot reorder a history list.
+
+  **Authoritative continuation.** `/v1/client/chat` executes the stored transcript merged with genuinely new message ids instead of the client's own array. A second device's turns can no longer be dropped by a stale or truncated local view; stored content wins for ids the record already holds.
+
+  **Identity acknowledgement (privacy-critical).** Identity admission is gated per owner, and with the gate off a supplied proof was accepted and ignored, so a request asking for verified cross-device scope ran silently at browser scope. A widget could not tell the difference, which is unacceptable for a verified erase. Every visitor grant now reports `identityStatus` (`not_provided` | `admitted` | `ignored`) and every history response carries `X-History-Identity-Status`. Init still succeeds with `ignored` so chat degrades gracefully; a history route handed such a proof now fails 503 `identity_proof_not_admitted` before any visitor-scoped read or mutation runs, pinned by DB-mutation counts on every destructive route. A rejected proof stays a 401 and is never reported as `ignored`.
+
+  **Previews.** Summaries carry a plain-text `preview` of the newest visitor-visible message, bounded to 140 Unicode code points, derived from the display projection and never falling through to opaque content.
+
+  Also pins the zero-message first-page-load ownership claim Persona's bootstrap depends on, and adds a generated wire fixture (`apps/api/tests/fixtures/client-conversation-history-wire.json`) for the Persona repo to pin its message mapper against.
+
+## 6.6.3
+
+### Patch Changes
+
+- f59e62b: Add per-visitor conversation history to the public client surface, so an embedded Persona widget can show a visitor their own past conversations with no backend on the host site.
+
+  History-capable clients opt in with `visitorHistory: true` on `POST /v1/client/init`. The API then mints (or resumes) a durable anonymous visitor for that browser and returns a `visitor` grant alongside the session. The raw visitor secret is returned only when minted, is stored only as a SHA-256 hash, and is namespaced per client token so a secret from one site is inert on another. Legacy clients that do not opt in keep the previous response shape and do not create discarded visitors.
+
+  New session-authed, visitor-scoped routes:
+  - `GET /v1/client/conversations` (cursor-paginated, optional `flowId` filter)
+  - `GET /v1/client/conversations/{id}`
+  - `DELETE /v1/client/conversations/{id}`
+  - `DELETE /v1/client/conversations`
+  - `POST /v1/client/visitor/reset`
+
+  Each requires both a live `sessionId` and the `X-Visitor-Token` secret: a bare client token is public and site-wide, and a bare `sessionId` is a low-entropy TypeID, so neither alone can read history. A conversation the caller does not own answers 404 rather than 403, so the routes cannot be used to enumerate other visitors' conversations.
+
+  `POST /v1/client/init` also accepts a visitor-authorized `conversationId`, mutually exclusive with legacy `sessionId`, so a conversation selected from server history can be resumed without a browser-local conversation-to-session map. Out-of-scope conversations answer 404.
+
+  Conversations can be titled server-side from their opening exchange, replacing the timestamp placeholder, so embedders no longer need to keep local message snippets just to render a history list. This ships dark behind `enable-conversation-titles`: titling sends the opening exchange to a model from a different provider than the surface's agent, and there is no per-surface way to decline that yet, so it stays off in production until the `conversationTitles` config lands (`docs/features/planning/2026-08-08-conversation-title-configuration.md`). The flag doubles as an operator kill switch for a platform-run model call on a public surface.
+
+  `POST /v1/client/init` also accepts an optional `identityProof`. When the Identity Exchange gate is on, it is verified once against the token owner's registered integrations and projected to a durable `eu_*`, which binds the browser's visitor to that person. An invalid proof is rejected 401 and nothing is bound; an absent proof leaves the session anonymous, unchanged.
+
+  Binding an end user is the anonymous-to-identified merge: the visitor's existing conversations come along (no rows move — ownership is read through the link). Cross-device reads require a fresh admitted identity proof on that request; a stored visitor binding alone never widens authorization beyond the exact browser. Sibling resolution is scoped to the client token, so one identity on two sites remains two histories, and an unbound visitor resolves to itself alone rather than unioning on a null end user. A second person signing in on a browser that is already bound gets a fresh visitor instead of inheriting the first person's history.
+
+  Visitor ownership is tracked on a new `records.client_visitor_id` column and a new `client_visitors` table, deliberately separate from the `end_users` (`eu_*`) tenancy plane: an `eu_*` is an admitted, verified identity that doubles as an authorization key for end-user-private record reads, so an anonymous browser-held secret must not mint into it. Keeping the planes separate also leaves the verified `identityProof` path untouched.
+
+- 308c44c: Stop every consumer surface from claiming execution-count caps that no longer exist (remove-execution-caps Slice 3).
+
+  Slice 2 removed execution-count caps from enforcement. This makes the dashboard, the REST responses, and the docs agree with that: a card-on-file account is never bounded by execution count, and the only remaining bound is the code-owned protective daily ceiling for accounts with no payment method, framed as "add a payment method to remove", never "upgrade your plan".
+  - `ExecutionStats` gains `executionCapReason` (`'no_card_ceiling' | null`), the single signal a surface may branch on. The neutral fallbacks (rate-limit block, spend-cap block, DO fail-open, failed display read) no longer report a ceiling-shaped limit.
+  - `GET /usage-limits` and `/usage-limits/daily` expose `executionCapReason` and always key the payload under `daily`; `inSlowMode` / `isOverage` / `overageCount` / `periodType` stay on the wire but are documented as inert.
+  - `GET /v1/billing/status` gains `usage.executionsToday` (`executionsThisMonth` is a deprecated alias carrying the same daily count); `isApproachingLimits` / `isOverLimits` are documented as always `false`.
+  - Dashboard: usage banners render only for a no-card account, the slow-mode modal is deleted (it had no producer), and the dev billing tester models the carded/no-card matrix instead of retired plan pools.
+  - CLI: `runtype billing status` and `runtype auth whoami` read `executionsToday` instead of `executionsUsed` / `executionsLimit`, which the API has never returned, so both printed "Executions: 0" against a live API. They now show a plain count (no invented denominator) and say "unavailable" when the usage read failed.
+
+## 6.6.2
+
+### Patch Changes
+
+- 941f500: Warn at authoring time when an approval-requiring agent is bound to an
+  unattended surface (slice 1 of the unanswerable-approval-surfaces plan; no
+  execution behavior change). Adds the shared surface-attendance registry (an
+  `approvalAnswerable` trait on `SurfaceTraits` with polarity-explicit helpers
+  `isApprovalAnswerableSurfaceType` / `isApprovalUnanswerableSurfaceType`) and a
+  new advisory code `APPROVAL_UNANSWERABLE_ON_SURFACE` (warning severity, never
+  blocking) emitted from the product validator, the surface-item add/update
+  response envelopes (REST and, via passthrough, MCP `add_surface_item` — the
+  SDK response types gain an optional `warnings` array), and the agent-save
+  `_warnings` when an update arms approval on an agent already bound to
+  unattended surfaces. The dashboard channel and surface config panels show the
+  same warning inline. The webhook DO and messaging trigger now read their
+  (unchanged, `false`) attendance fact from the shared registry instead of
+  omitting it per call site.
+
+## 6.6.1
+
+### Patch Changes
+
+- 5ad8bac: Add a runnable end-user usage acceptance lab, align client-token SDK types with agent-scoped surface tokens, support explicit local-test hosted identity, make magic-link OAuth continuation work across email-opened tabs, and make empty-ledger/dashboard deep-link paths testable end to end.
+- 58f5a8a: Remove surfaces as a billing dimension entirely.
+
+  Surfaces (the deployed-channel objects on products: chat, api, mcp, slack,
+  etc.) no longer count against any plan limit or appear in any billing surface:
+  - Surface create / environment-change no longer consults the Schematic
+    `production-surfaces` / `development-surfaces` entitlement flags; surfaces are
+    unlimited on every plan.
+  - Surface counts are no longer synced to Schematic as `production_surface_count`
+    / `development_surface_count` company traits.
+  - `BillingConfig` drops the `productionSurfaceLimit` / `developmentSurfaceLimit`
+    fields; `/v1/billing/status` drops the surface limit + usage fields and the
+    surface component of `isApproachingLimits` / `isOverLimits`.
+  - The 402 `PRODUCTION_SURFACE_LIMIT` / `DEVELOPMENT_SURFACE_LIMIT` responses are
+    removed from the surface create / update / ensure routes (and their OpenAPI
+    contracts), so the surface-limit error handling in the dashboard is dead code.
+
+  Surfaces remain fully functional as a product concept; only the billing and
+  entitlement machinery is removed. The Schematic-side flags/features/traits
+  become unused and can be deleted from the Schematic dashboard separately.
+
+- e12b556: Add an org-scoped, non-admin read endpoint `GET /v1/executions/{executionId}/journal`
+  that returns the durable `flow_execution_events` journal rows for an execution the
+  caller owns, redacted and in replay order (API-key/Clerk authenticated, ownership-scoped,
+  `FLOWS:READ`/`AGENTS:READ` scoped for API keys, 404 on unowned/missing ids, `truncated`
+  flag when the 1000-event cap is hit). This is a strictly-narrower read surface than the
+  admin trace bundle and is what the runtime-parity B-17 gate reads from the normal
+  `api.runtype-staging.com` surface.
+- e23af15: Add a dedicated `ScheduleEntitlementErrorSchema` OpenAPI component for the
+  schedule 402 responses (create/update/resume). The runtime bodies already
+  return `message`, `code`, and `upgradeUrl`, but the routes referenced the
+  generic `ErrorSchema` (which declares only `error` + `details`), so
+  generated SDK types hid the upgrade path. The new schema extends
+  `ErrorSchema` with the three fields and is registered as
+  `#/components/schemas/ScheduleEntitlementError`. Regenerates the OpenAPI
+  spec and all SDK cores (TS/Python/PHP/Ruby/Java).
+
+  Addresses Greptile P1 on PR #6490.
+
+## 6.6.0
+
+### Minor Changes
+
+- bcf78f5: Add typed record collections end to end (Records→Collections plan §5.1/§5.2). The SDK gains an augmentable `RecordCollections` map, a `CollectionMeta<S>` helper, and `client.records.from(slug)` — a typed scope whose `.list/.get/.create/.update` pin the record `type` to the slug and type `metadata` for that collection (`.get`/`.update` guard against cross-collection ids). A new authed `GET /v1/collections/types.d.ts` endpoint hand-emits a `.d.ts` (one interface per schematized collection plus a `declare module '@runtypelabs/sdk'` augmentation, with `// skipped:` markers for rows whose stored schema no longer parses) from the constrained schema dialect. `runtype records typegen [-o <file>]` fetches it (commit and diff-check the output in CI to catch collection-schema drift). The typegen endpoint is fanned out across surfaces: the `get_collection_types` MCP tool (standard + code-mode `getCollectionTypegen`) and the CLI.
+
+## 6.5.1
+
+### Patch Changes
+
+- 22ab25a: Widen the SSE `agent_tool_start` toolType union to include `data_connection` and `search`, matching what both engines already emit on the wire.
+
+## 6.5.0
+
+### Minor Changes
+
+- 9dca3bc: Add the agent state events to every wire layer (agent state IR, slice 2).
+
+  State change is now expressible on the wire as RFC-6902 JSON Patch over an open JSON
+  document, in all three declared contracts: the internal engine IR gains
+  `agent_state_snapshot` / `agent_state_delta`, the public unified vocabulary grows from
+  33 to 35 events with `state_snapshot` / `state_delta`, and the AG-UI union gains
+  `STATE_SNAPSHOT` / `STATE_DELTA` under the spec's own field names. Both emitters
+  (`AgentEventEmitter`, `UnifiedEventEmitter`) can produce them, the API edge translator
+  projects internal onto unified, and the AG-UI translator projects unified onto the
+  protocol events.
+
+  The JSON-Patch shape moves to `@runtypelabs/shared` (`json-patch.ts`) so all three
+  schemas type against one definition; `packages/runtime/src/engine/state-channel.ts`
+  re-exports it and keeps the apply/diff behavior.
+
+  State events are deliberately block-neutral: unlike media, approval, and tool frames
+  they do not seal an open text channel, because state is rendered out-of-band and a
+  mid-turn write must not split the assistant's message. Both producers agree, pinned by
+  the runtime/unified parity gate.
+
+  The generated SDK types and Python SDK follow the OpenAPI spec, so `ExecutionStreamEvent`
+  now includes both new variants.
+
+  Still inert: nothing seeds a state channel and no run emits these yet. The reserved
+  state-write tool, seeding, and exposing state to the model land in the next increment.
+
+- e76a310: Add feature-gated product usage analytics grouped by durable end-user identity. UsageTracker Durable Objects now retain exact, idempotent daily execution and platform-spend rollups for 93 days; the authenticated analytics API verifies product and tenant ownership, hydrates customer-facing identity labels, and reports attributed versus unattributed coverage.
+
+  Expose the breakdown through the TypeScript SDK and a lazy-loaded Usage settings subview with product, tenant, period, and sort filters, top-user metrics, unattributed-usage guidance, and formula-safe CSV export.
+
+### Patch Changes
+
+- eab2128: Pin first-party dispatch helpers to the response mode selected by their JSON or streaming transport.
+- 25412dc: Run flow-definition record batches and isolated step tests through the hosted
+  runtime, fail closed when a definition needs unsupported continuation behavior,
+  and submit large record sets to the batch processor instead of returning a
+  scheduled handle without enqueuing work. Preserve the prior temporal snapshot
+  during isolated step replays while stamping a fresh execution-start timestamp,
+  retain record execution history, and pin scheduled batches to the admitted
+  definition.
+- 7ab031f: Authorize Product surface keys with immutable capability target IDs across API, MCP, A2A, AG-UI, and webhook execution paths.
+- eab2128: Document and normalize buffered continuation responses across dispatch,
+  saved-agent, and client routes, preserving failures and chained approvals across
+  legacy and runtime continuations.
+
+## 6.4.0
+
+### Minor Changes
+
+- c576866: Add operator-authored `sandbox.setupCommands` plus a `sandbox.secretEnv` map on the
+  agent Definition (env var name → managed secret KEY). Setup runs once after network
+  policy enforcement and before the model's first sandbox verb. The API resolves
+  credential values only for setup and delivers them out-of-band over the
+  `cloudflareSandboxExecWithSecretEnv` RPC, so they never appear in command strings,
+  model-facing tool schemas, logs, or spill files.
+
+  Model-authored `bash` always uses the plain credential-less RPC, even when its
+  command references a configured variable. A run-scoped memo plus trusted Durable
+  Object claim/completion state keeps setup once-only across parallel and sequential
+  tool calls. A setup-definition fingerprint versions the sandbox identity, so
+  configuration changes get a fresh machine rather than reinjecting credentials
+  into an existing model-tainted one. Failed or interrupted setup remains retryable.
+
+  Credentialed setup must remain operator-authored, foreground, and self-contained:
+  the secret supervisor freezes pre-existing processes and reaps every descendant on
+  return. Prefer `credentialProxies` (phantom tokens) when the target protocol
+  supports them.
+
+- 9e19bc0: Surface inbound webhook health in the API and dashboard.
+
+  Rejected inbound webhooks were invisible: a Slack surface whose signing secret no longer matches returns 401 before any execution starts, so nothing reached the logs and the channel simply looked idle. The API has recorded per-surface delivery and failure history in `product_surfaces.webhook_health` all along, but never served it.
+
+  Surface responses now carry a `webhookHealth` projection (`lastDeliveryAt` plus the most recent rejections), and the dashboard keeps it refreshed while the product editor is open: the channel node shows a red "Rejecting events" dot, and the channel edit panel explains the specific failure and names the field to fix (for a Slack signature mismatch, the Signing Secret rather than the similar-looking Client Secret). Derivation and copy are single-sourced in `@runtypelabs/shared`.
+
+### Patch Changes
+
+- ad943b9: Align public dispatch request types and clients with the canonical API schema.
+- 15f3980: Document and type buffered dispatch responses, and honor `streamResponse: false` on the runtime-agent lane.
+- 41a2650: Redact protected tool parameter values from debug streams, customer logs, approvals, and persisted tool executions while preserving protected-field attribution.
+- 050c834: Retire legacy dispatch-scoped `{{secrets.key}}` values for hosted FLOW
+  execution. Hosted flows continue accepting the `secrets` field for wire
+  compatibility, but the pipeline strips it before either runtime or legacy
+  execution; use managed `{{secret:NAME}}` references for flow credentials.
+- 17382d8: Retire the per-request legacy engine override for flow dispatches while
+  continuing to accept the compatibility field for existing clients and agent
+  runtime selection.
+- 17382d8: Run eligible buffered JSON flow dispatches through `@runtypelabs/runtime`, using
+  the same structured runtime completion and unified events as the streaming path.
+  Explicit `useRuntimePackage: false` and runtime-ineligible requests continue to
+  use the legacy engine.
+
+## 6.3.6
+
+### Patch Changes
+
+- 19e0d21: Remove the remaining backtracking ambiguity from the artifact-reference
+  `savedToPattern` in `extractArtifactReferencesFromMessages`, closing CodeQL
+  alert #320 (`js/polynomial-redos`).
+
+  An earlier fix stopped the capture's _first_ character from accepting
+  whitespace, which removed the overlap with the preceding `\s+`. It left a second
+  overlap in place: the capture body `[^—\]\n]*?` accepts tabs and spaces, and so
+  did the `\s+—` alternative in the trailing group, so the two still shared split
+  points across a whitespace run.
+
+  The trailing group now lists its terminators bare (`—`, `]`, `\n`, `$`). Because
+  the capture class excludes exactly those terminators, the two are disjoint,
+  exactly one parse exists at each position, and the polynomial behavior is gone
+  structurally rather than merely bounded.
+
+  Behavior is unchanged: dropping `\s+` only moves whitespace that sits before a
+  `—` from the separator into the capture, and the capture is already `.trim()`ed
+  at the use site. Verified equivalent across 16 input shapes, and pinned by two
+  new tests covering whitespace around the separator and a 200k-character
+  whitespace run.
+
+## 6.3.5
+
+### Patch Changes
+
+- 6784100: Eliminate ReDoS on externally-influenced inputs
+
+  Five regexes that ran over third-party or tenant-authored text combined an
+  unbounded/lazy class with an overlapping quantifier, making them quadratic on a
+  hostile input. Each is now linear, with behavior preserved:
+  - **skill-spector** hostname extraction stripped delimiters with a single `/g`
+    alternation of two anchored branches (the global scan retried the `$` branch at
+    every position). Split into two separately anchored, non-global replaces, plus a
+    token-length cap — the manifest under scan is hostile by design.
+  - **sdk** artifact-reference extraction let `\s+` overlap a whitespace-accepting
+    lazy class; the capture's first character now excludes whitespace.
+  - **api** `store-vector` unwrapped `config.vectorsSource` with a regex whose `\s*`
+    overlapped `[^}]+?`. It now calls the shared, regex-free
+    `unwrapVectorSourceTemplate`, which also converges the api with the runtime's
+    previously private twin.
+  - **shared** `Link` header parsing widened `[^>]*` to `[^<>]*` so an unterminated
+    `<` fails at the next `<`.
+  - **model-execution** parameter-rejection classification now bounds the scanned
+    provider error body before matching, covering all five patterns.
+
+- d3bb1ed: Apply security overrides for dev/build tooling (batch 1), resolving 29 Dependabot
+  alerts. Adds bounded `overrides` entries for `@tootallnate/once`, `ajv`,
+  `minimatch`, `path-to-regexp`, `smol-toml`, `rollup`, `@babel/core`, `js-yaml`,
+  `brace-expansion`, `undici` (<6 only) and `sharp`, and bumps the
+  `vercel-functions-hello` example's `vercel` devDependency 44 -> 58 so
+  `@vercel/fun` stops pinning `tar@6.2.1` (which no `tar` override could clear).
+
+  No runtime source changed; this is a lockfile/root-config change. Notable
+  resolution shifts: `sharp` 0.34.5 -> 0.35.2 (prebuilt binary set swap, verified
+  against the marketing Next.js build), `rollup` 4.57.0 -> 4.62.0, and `tar@6.2.1`
+  removed from the tree entirely. `undici@7.28.0` is deliberately untouched for
+  miniflare / wrangler / `@cloudflare/vitest-pool-workers`.
+
+- 13b718f: Apply security overrides for runtime-reachable dependencies (batch 2). Adds bounded
+  `overrides` entries for `fast-uri`, `form-data` (3.x and 4.x), `lodash`, `uuid` (13.x),
+  `basic-ftp`, `defu`, `flatted`, `body-parser` (2.x), `js-yaml` (4.x),
+  `brace-expansion` (5.x), `ip-address` (10.x) and `dompurify`.
+
+  Unlike batch 1 these are reachable from shipped code, not just dev/build tooling:
+  `fast-uri` sits under `ajv` in the API worker's MCP/schema path, `form-data` and
+  `uuid` are pulled in by the API, runtime and sandbox dependency trees, `js-yaml` 4.x
+  reaches `@runtypelabs/cli`, and `brace-expansion` 5.x reaches
+  `@runtypelabs/model-execution`. The `dompurify` entry drops the vulnerable 3.3.3 copy
+  that `posthog-js` pulled in and consolidates on 3.4.12, the version
+  `@runtypelabs/persona` already ships in the same tree.
+
+  No runtime source changed; this is a lockfile/root-config change. Every override
+  carries a deliberate upper bound, since a bare `>=X` override resolves to the newest
+  match across all majors. Verified: no downgrades anywhere in the lockfile.
+
+## 6.3.4
+
+### Patch Changes
+
+- 400c1f1: Tighten the batch results header and surface failed steps at the batch level
+  - Batch and scheduled-run results responses gain a `summary.recordsWithFailedSteps` count. It is batch-wide rather than page-scoped and ignores the status filter, so it stays correct on a paginated batch. The batch's own `failedRecords` cannot express this: a record whose flow ran to the end counts as completed even when a step inside it failed.
+  - The results sheet header collapses from three rows to two. Identity (title, copyable batch ID, duration, and the new "N with failed steps" signal) shares the title row with refresh and close, so the close button no longer drifts down beside the filters; the segmented status filter and record lookup get their own row.
+  - The record lookup is now an `ExpandingSearch` that costs an icon until used, instead of a permanently open text input.
+  - Dropped the title count badge when the segmented control is present, since its "All" segment already states the count.
+  - The batch sheet no longer routes through `ExecutionFilterBar`, which removes a "Clear" button that was always lit: the sheet seeds a `from` date that the batch endpoint never sends, so the bar read as actively filtered when nothing was applied.
+
+- 400c1f1: Batch results screen redesign: honest per-record status and less chrome
+  - Batch and scheduled-run results endpoints now include a per-record step rollup (`stepCount`, `failedStepCount`, `durationMs`) so the results list can answer "did it work end to end, and how fast" without per-record fetches.
+  - Batch result rows are titled by record name (never "Unknown") and show duration plus a step summary; a completed record with failed steps renders as "Completed with errors" (amber) instead of a clean green "Completed", with the failed count spelled out in text.
+  - The batch results sheet gets a segmented status filter with counts (All / Completed / Failed / Running) driven by the batch summary, a copyable batch ID chip instead of an ID embedded in the title, a "Duration" label once the batch finishes, no $0.00 cost display, and a pagination footer only when there is something to page.
+  - The record detail panel leads with the run output, auto-expands failed steps with the error inline, quiets successful steps to icon-only status, and drops badges that repeated the header.
+
+- 93a3c5b: Hosted Google OAuth connect flow with automatic token refresh. Google Workspace moves off the paste-a-token path onto `organization_integrations`: a "Connect Google" popup flow (`POST /v1/oauth/google/start` + public callback) captures tokens server-side, and a new token broker transparently refreshes access tokens (5-minute skew, optimistic version-gated writes) for every Google tool call. `invalid_grant` surfaces as a "Needs reconnection" badge instead of silent hourly credential death. BYO OAuth client supported per connect, with the deployment's authorized redirect URI shown as a copy field in both BYO panels (served by `GET /v1/oauth/google/config` so it is always the exact string the authorize call sends); the Runtype-provided platform client additionally ships behind the `enable-google-platform-oauth-client` Flagship gate (fail-closed off in production, on in staging/dev) on top of its `GOOGLE_OAUTH_CLIENT_ID`/`GOOGLE_OAUTH_CLIENT_SECRET` env requirement, so BYO is the only path until that rollout completes. The legacy pasted-token path is removed in the same change (a census found no stored `google-workspace` credentials in any environment): `POST`/`DELETE /v1/integrations/google/credentials` now reject with a pointer to the connect flow, and Google tool failures report their real cause instead of degrading into a generic "not configured" error.
+
+## 6.3.3
+
+### Patch Changes
+
+- 844b742: Slack setup: replace the broken manifest deep link with a copy-and-paste flow. Slack's redesigned create-app modal silently ignores the `manifest_json` URL parameter, so `createAppUrl` now points at the plain app-creation page and the setup wizard has users copy the manifest and paste it into Slack's "From a manifest" option.
+
+## 6.3.2
+
+### Patch Changes
+
+- f0ec44b: Realign the outer agent loop to terminate on natural model yield. The loop now
+  continues only for mechanical reasons: the turn was cut off by the inner tool
+  budget (`max_tool_calls`), the tool surface expanded that turn (skill load or
+  `tool_search` discovery), or the turn died on a provider error (retry path,
+  bounded by the consecutive-error abort). A turn the model ends itself
+  (`end_turn`) terminates the loop with `stopReason: 'complete'` regardless of
+  output length, tool count, or wording, so conversational agents with
+  `maxTurns > 1` no longer re-run tools and answer themselves after asking the
+  user a question. `maxTurns` is now a pure safety cap. Removes the
+  `"Continue working on the task."` nudge on terminating turns and the
+  four-signal `detectAutoComplete` text heuristics (the text-only signal
+  survives only as the fallback for providers that report no stop reason).
+  Breaking-internal: `@runtypelabs/runtime` no longer exports
+  `detectAutoComplete` / `AutoCompleteSignal`; use `decideLoopContinuation` and
+  its types instead.
+
+## 6.3.1
+
+### Patch Changes
+
+- d547ab3: Fix client-chat dispatch of a locked-down (tenancy-strategy) agent failing every admitted turn: the `client_conversation` record is created at session init, before any identity proof exists, so it was un-stamped and the execution's scoped record read excluded it ("Record ... not found or not accessible"). The pipeline now claims the session-authorized conversation record into the resolved tenant/end-user scope pre-engine (idempotent claim-or-match), and rejects a cross-scope conversation with a 403 `conversation_scope_mismatch` instead of ever widening the read.
+- c065bb9: Restore debug-tier cost and token fidelity dropped by the unified SSE cutover: the edge translator now forwards the flow-level `totalTokensUsed` scalar onto `execution_complete` and per-tool `toolCost` onto flow-family `tool_complete`. FilteredStream still strips both from user-facing streams; debug/SDK streams see them again, fixing the dashboard live execution timeline's per-tool cost display.
+
+## 6.3.0
+
+### Minor Changes
+
+- 20737ee: Make the 33-event `ExecutionStreamEvent` vocabulary the platform's only public
+  execution stream. Remove request-, Persona-version-, and Flagship-based wire
+  format negotiation; translate API-owned engine frames unconditionally; expose
+  unified events in non-streaming JSON responses; and remove the public
+  `FlowSSEEvent` OpenAPI component.
+
+  Update the TypeScript and Python SDKs, dashboard, examples, smoke tests, and
+  internal tools to consume unified streams. The TypeScript SDK keeps its stable
+  flow and agent callback presentation shapes by translating the unified wire
+  client-side, while obsolete stream-format helper calls are source-compatible
+  no-ops. Preserve external-agent resume handles and flow completion counts on
+  the unified contract.
+
+### Patch Changes
+
+- 401acbd: Authored `toolMocks` on manual eval cases: a hand-written case can now carry its own `toolMocks` array without ever having been captured from a real run — `POST /eval/ensure`, `defineEval`, and the MCP eval-case tools all accept it. On a suite with `recordedToolMode: 'continue'`, `toolMocks` presence (captured or authored) is what triggers serving recorded results instead of dispatching the real tool, so an eval case can now get a `toolType: 'local'` tool past its first call (which otherwise pauses the run forever) without a captured checkpoint. `checkpoint` stays capture-only — it is execution-state (where a run was forked from), not something an author writes by hand, and `/eval/ensure` continues to reject it. Authored-mocks replay keeps the same agent (virtual-flow) target restriction as captured checkpoint cases; a flow-target suite skips the case as a gradeable failure instead of running it. The suite-run batch path (`POST /eval/suites/:id/run` above the sync case ceiling) now rejects a continue-mode case carrying `toolMocks` (`REPLAY_MODE_CASES_UNSUPPORTED_ON_BATCH`) instead of silently running it with mocks unserved; the code-mode MCP spec overlay and SDK output validation (a mock must include an explicit `output` key) round out the surface. A `ToolMock`'s `output` field is now correctly marked required in the generated OpenAPI spec and TS SDK types (a bare `z.unknown()` had rendered it as optional despite the server always requiring it, letting a caller construct an output-less mock the server then rejected with an opaque error).
+- cb8cb9e: Per-case eval graders: eval cases now carry an optional `graders` array that REPLACES the suite-level graders for that case (null ⇒ use the suite graders). `POST /eval/ensure` decomposes divergent per-case `expect` arrays into a suite default plus per-case overrides instead of rejecting them with a 400; both run paths (sync `/eval/run` and the batch scoring pass) score each case against its own effective grader array, and `graderIndex` now indexes into that per-case array. The suite CRUD case schemas, `/eval/ensure` pull round-trip, and the MCP eval-case tool inputs all carry the field.
+- 7f77e9f: Surface responses now embed the canonical public endpoint URL. The API computes `endpoint` server-side (via its own base-URL authority) on surface list, get, create, and update responses, and on surfaces embedded in the product GET: the URL for MCP, API, A2A, AG-UI, webhook, and chat surfaces, or null for channel-based types (Slack, email, schedule). The dashboard's snippet generators, endpoint listings, and onboarding steps now prefer `surface.endpoint` over client-side URL construction, which survives only as a fallback for cached payloads that predate the field.
+
+## 6.2.1
+
+### Patch Changes
+
+- 68a503e: Add `orgName` to the `GET /v1/users/profile` response: the display name of the caller's active organization, resolved from the Clerk-synced organizations table. Null for personal accounts. Lets API-key and SDK consumers resolve their org identity without a Clerk session.
+
+## 6.2.0
+
+### Minor Changes
+
+- b967727: Remove the dead product-generation sessions surface: the `/v1/products/generation/sessions` CRUD endpoints (create, list, get, update, delete, append-event) and their `product_generation_sessions` / `product_generation_session_events` tables. This surface was orphaned legacy from the March 2026 three-agent generator design and had zero consumers (dashboard, worker, CLI, SDK, or API callers); both tables held zero rows in staging and production. A drop migration removes the tables; the OpenAPI spec and generated TypeScript/Python SDK types no longer expose the routes.
+
+### Patch Changes
+
+- 2c8cf42: Secrets gain a first-class `docsUrl` ("where to get this key"). New nullable `docs_url` column on secrets with https-only validation (`secretDocsUrlSchema`) at every write path (REST create/update with null-clears, intake submit, MCP `create_secret`/`update_secret` via `docs_url`), plus a hand-curated provider-docs registry (`SECRET_PROVIDER_DOCS`, 15 providers) mapping well-known key names to official console pages. Intake manifest items resolve `docsUrl` server-side with binding > secret row > registry precedence, each candidate gated by the new `isSafeDocsUrl` guard; the dashboard gates all "Get key" anchors on the same guard (hardening for pre-gate rows) and manual mode shows a registry-driven "Get key" button as the user types a known key name. FPO `setupInstructions.docsUrl` validation tightened to https-only.
+- 2c8cf42: Secret intake sources accept an optional `description` so MCP agents can hand users a self-explanatory configuration link. `secretRequirementSourceSchema` gains the field; `buildConfigurationUrl` carries it (with `key`) into the intake screen query string; focused (`source=secret`) manifest items fall back to the caller-supplied description when the secret does not exist yet; the dashboard renders it on focused cards and forwards it from the URL. The MCP `get_secret_intake_manifest` / `submit_secret_intake` source and `create_secret.description` now guide agents to write descriptions that state the key's general, account-wide purpose and where to obtain the value. Secret values never travel in URLs.
+
+## 6.1.4
+
+### Patch Changes
+
+- 843b702: Remove the `enable-agent-skills` Flagship rollout flag now that Agent Skills is fully enabled in production. The feature is unconditionally on: the admin/control-plane gate, the legacy-flow and resume-reattach skill-loading gates, the `propose_skill` execution guard, and the dashboard Skills nav/route gating are all removed. `GET /v1/users/profile` still returns `features.enableAgentSkills`, now hardcoded to `true` for wire compatibility with deployed SPA bundles and the published SDK.
+
+## 6.1.3
+
+### Patch Changes
+
+- 1acada7: Accept inline `config.flow` flow tools at the dispatch boundary when the caller opts into the runtime execution lane (`options.useRuntimePackage: true`). The dispatch validator previously rejected any flow tool without a `flowId`/`toolId` reference, and the tools normalizer silently stripped `config.flow` — together 400-ing the rt-seam staging smoke templates and rolling back the staging deploy. Inline flows remain rejected (clean 400 with an actionable message) on the legacy lane, which cannot execute them. `flowName`-only references are accepted on the runtime lane (resolved `flowName ?? flowId` by the runtime tool executor); the SDK's mirrored `FlowToolConfig`/`RuntimeFlowToolConfig` types gained the same `flow`/`flowName` fields.
+- db2cf06: Make monetary usage delivery idempotent, normalize live billing webhooks and customer notifications, and rebuild Billing and Usage around explicit collection, credit, analytics, and enforcement sources.
+
+## 6.1.2
+
+### Patch Changes
+
+- 158223e: Launch Runtown as a disposable, standalone, staging-only Cloudflare app for navigating a real Runtype product as a third-person 3D town. A Flagship-gated dashboard command opens the experiment, which signs in with Clerk, calls the user API directly, adapts Pica's first-run tour to the product architecture, and deep-links back to canonical dashboard editors. Runtown has no production Worker, route, release dispatch, or production-access path while the experiment is being evaluated.
+
+  Add account-and-product-scoped Durable Object multiplayer with anonymous travelers, authoritative movement guards, short-lived tickets, and opt-in HRTF nearby dialogue cues that never transmit questions, generated answers, transcripts, or generated audio. Preserve the richer architecture characters, grounded streamed narration, enterable buildings, live execution traffic, quests, configuration health, and spatial voice while isolating all game code and deployment lifecycle from the dashboard.
+
+- 3abba4d: Preserve debug step costs and inline Claude Managed agent IDs in unified SSE streams while migrating smoke coverage to the default vocabulary.
+
+## 6.1.1
+
+### Patch Changes
+
+- 40cb003: Generated OpenAPI types for the flow export-runtime response now declare the
+  ADR 0014 fields (`agents` Embedded Agent Registry and `dependencyRefs`), so
+  typed SDK consumers get first-class access instead of reaching through
+  untyped extras.
+
+## 6.1.0
+
+### Minor Changes
+
+- cfacf11: feat: record collections on every non-REST surface
+
+  Fans the `/v1/collections` REST API (Records→Collections Phase 1) out to the
+  remaining surfaces, closing the Phase 1 acceptance loop — create → infer →
+  warn → validate-existing → enforce → 422 works identically via REST, SDK, MCP,
+  and CLI:
+  - **MCP** (`@runtypelabs/mcp` + the api-internal client): seven tools —
+    `list_collections`, `get_collection`, `create_collection`,
+    `update_collection`, `delete_collection`, `infer_collection_schema`,
+    `validate_collection_records` — with
+    read-only/destructive annotations, next-step hints, and collections-domain
+    error recovery hints.
+  - **Code Mode MCP**: matching `runtype.listCollections(...)` /
+    `getCollection` / `createCollection` / `updateCollection` /
+    `deleteCollection` / `inferCollectionSchema` / `validateExistingRecords`
+    executor methods with overlay docs and examples.
+  - **SDK**: `client.collections` endpoint class
+    (list/get/create/update/delete/inferSchema/validateExisting) with response
+    types derived from the generated OpenAPI spec.
+  - **CLI**: `runtype collections list|get|create|update|delete|infer|validate`,
+    including `--schema-file` round-tripping and the infer → update adoption
+    flow.
+  - **Docs**: new user-guide page "Defining a schema" plus a collections section
+    in the MCP server integration guide.
+
+  The dashboard assistant deliberately excludes the new tools
+  (`phase2:collections`) until the Collections UI ships.
+
+- cd1133f: Add a Slack "Add to Slack" OAuth install flow. The Slack setup wizard now
+  captures the bot token server-side via a real OAuth v2 handshake instead of
+  asking the user to hand-copy the App ID, install the app, and paste the
+  `xoxb-` bot token. The user pastes only the three App Credentials (Client ID,
+  Client Secret, Signing Secret) from one Slack page and clicks "Add to Slack".
+  - New authenticated `POST /v1/oauth/slack/start` returns the Slack authorize
+    URL, storing the client + signing secret in a short-lived (10 min),
+    one-time-use, AES-256-GCM-encrypted KV state blob.
+  - New public `GET /v1/oauth/slack/callback` exchanges the code, claims the
+    pending integration, and posts non-secret metadata back to the dashboard
+    opener. The bot token never transits the browser.
+  - The generated Slack app manifest now includes `oauth_config.redirect_urls`.
+  - New `integrations.startSlackOAuth` SDK method.
+
+### Patch Changes
+
+- c26556c: Add record collections: customer-defined data models for Records. New `record_collections` entity (slug = record type by convention) owning an optional constrained-dialect JSON Schema, with `/v1/collections` CRUD, append-only schema version history, additive-vs-breaking evolution gating, infer-schema-from-data proposals, and validate-existing dry runs. Validation mode defaults to `off`, so registering a collection changes no existing behavior; write-seam enforcement lands in a follow-up.
+- 2c315c5: Enforce collection schema validation at every record write seam (Records→Collections Phase 1 PR 2). When a record's type matches a collection whose validationMode is `warn` or `enforce` with a non-null schema, the write's metadata is validated: `enforce` rejects with a 422 `schema_validation_failed` envelope carrying stable field-level codes (`REQUIRED_FIELD_MISSING`, `INVALID_TYPE`, `INVALID_ENUM_VALUE`, …); `warn` proceeds, surfaces `schemaWarnings` on the response, and stamps the new nullable `records.schema_valid` column. Covered seams: POST/PUT /v1/records, bulk-edit (post-merge), CSV import (per-row), the upsert-record/update-record context steps (step errorHandling contract), the builtin record agent tools, the dispatch record-create path, and the conversations routes. `recordFilter` gains a `schemaValid` top-level pseudo-field (`isTrue`/`isFalse`/`isSet`/`isNotSet`) so filters can target nonconforming or unevaluated rows. Unregistered types see zero behavior change.
+- 644e057: Generate the Slack app manifest API-side so it always carries absolute URLs. The Slack setup wizard built the manifest in the browser from the SPA's API base, which is the relative `/api` proxy path on staging/preview, so the manifest ended up with relative URLs (`/api/v1/messaging/webhooks/slack/...`) that Slack rejects (`Input must match regex pattern: ^https?:\/\/`). A new authed endpoint `POST /v1/integrations/slack/manifest` builds the manifest from the API's true public origin; its OAuth redirect URL now reuses the same helper as the OAuth start route so the manifest's `redirect_urls` and the handshake's `redirect_uri` can never drift. Also fixes two Slack schema issues (empty `suggested_prompts`, unsanitized bot `display_name`), makes the manual webhook URL shown for surfaces absolute, and derives the OAuth-callback postMessage origin from the manifest so completion no longer breaks on relative API bases.
+
+## 6.0.2
+
+### Patch Changes
+
+- a948051: `POST /v1/client/resume` now accepts an optional refreshed `clientTools[]` + `clientToolsFingerprint` snapshot (same diff-only / send-once protocol as `/v1/client/chat`, including the 409 `client_tools_resend_required` handshake). The refreshed set is re-validated and re-gated against the surface's `behavior.webmcp` policy, then replaces the run's persisted clientTools so page tools registered after a mid-run navigation become callable on the next model turn — letting a WebMCP browser agent complete cross-page tasks (search → navigate → read product → add to cart) in a single user turn. Omitting both fields keeps the existing frozen-at-dispatch behavior.
+
+## 6.0.1
+
+### Patch Changes
+
+- 4b4bbe9: Fix and prune the `paginate-api` flow step.
+  - **`link_header` pagination now actually advances pages.** Previously the loop rebuilt the base URL every iteration and discarded the `rel="next"` URL parsed from the response `Link` header, so it either looped on page one or never followed the next link. The next URL is now threaded through the loop and fetched directly, so link-header APIs (e.g. GitHub) paginate correctly.
+  - **Removed the unused `oauth2` auth type.** The `oauth2` value is dropped from the `authType` enum and the `oauth2TokenUrl` / `oauth2ClientId` / `oauth2ClientSecret` / `oauth2Scopes` fields are removed from `authConfig`. The executor never implemented OAuth2 (it only logged a warning), and zero stored flows use it.
+  - **Removed the unused `entityIdPath` field.** It was never read by the executor.
+  - Fixed the hidden `api-data-sync` dashboard template, which used a non-schema `pagination: { type, pageSize, maxPages }` shape; it now uses the schema fields (`paginationType`, `pageSize`, `maxPages`).
+
+- 9a3dd1a: Narrow the `send-event` flow step's `provider` to PostHog only. The step never shipped a Google Analytics, Amplitude, or Segment implementation (those enum values threw at dispatch), so `provider` now accepts `'posthog'` alone; a flow that stored a removed value fails validation with an actionable message pointing at the API Call step for other analytics services. The SDK's `SendEventStepConfig.provider` type is narrowed to `'posthog'` to match. The PostHog capture request now goes through the executor's fetch seam, adding SSRF protection; that seam also defaults the Runtype User-Agent for every shared HTTP step (fetch-url, paginate-api, api-call, wait-until, send-event).
+- aab02e1: Remove dead flow-step config surface that was accepted by validation but never read by either execution engine. Each field below was verified unused in the api and runtime executors with zero stored production usage; removing them makes the schemas honest about what the platform actually does. A flow that stored one of these fields keeps running — the value was already ignored — it simply no longer appears in the schema, SDK types, or generated artifacts.
+  - **`update-record.updatesTemplate`** — removed from the schema and the runtime executor branch that implemented it. Use `updates` (per-value `{{template}}` substitution) instead. Dropping it keeps update targets' field names statically knowable. A config still carrying the field now fails loudly rather than silently applying an empty patch: the shared normalizer (which runs on the API execution and validation paths) throws a `NormalizationError`, and the runtime executor (which bypasses normalization) throws its own equivalent guard.
+  - **`generate-embedding` inline vector store** — removed the `vectorStore` sub-config and the `storeInRecord` flag. This step only produces an embedding vector into `outputVariable`; persisting it is the separate `store-vector` step's job (the inline store was never wired to an executor). The false "stores the embedding in a vector DB" doc comment is corrected.
+  - **`pinecone` vector backend** — dropped from the `vector-search` and `store-vector` provider/destination enums (plus the now-unreachable `pineconeConfig` sub-configs and dashboard affordances). Pinecone was never implemented — it only ever threw "not yet implemented". The `vector-search` executor now throws an actionable error on an unknown provider instead of silently falling through to the pgvector path.
+  - **`execute-agent.variables`** — removed from the schema and normalizer; nothing read it.
+  - **`upsert-record.metadataMapping`** — removed from the schema and normalizer; nothing read it.
+  - **`api-call.requestTemplate`** — removed from the schema and normalizer; it was dropped at the api-call → fetch-url seam.
+  - **`retrieve-record.fields`** — removed from the schema (UI-only, never read).
+  - **`fetch-url` `responseType: 'xml'`** — removed from the enum, the executor branch, and the SDK type. It only ever aliased `text` (there was never XML parsing). The schema stays strict so new authoring is rejected, but because the normalizer runs on the API execution path a legacy stored flow keeps working: `normalizeFetchUrlConfig` remaps a stored `'xml'` to `'text'` before the enum check (and the runtime executor's default branch already returns text), so immutable `flow_versions` still execute.
+
+  The removed SDK builder fields (`GenerateEmbeddingVectorStoreConfig`, `StoreVectorPineconeConfig`, and the corresponding `flow-builder` config properties) and the shared type aliases are dropped in the same change.
+
+- ebb401b: Sibling-parity fixes for two flow step types (additive, no behavior change for existing flows):
+  - **tool-call `timeout`**: the config field existed but was passed as an ignored `_timeout` parameter and never enforced. It is now enforced via `Promise.race` inside `executeToolById`. A timeout fails the step respecting its `onError` contract (throws for `fail`/`retry`, returns the continue output for `continue`). Enforcement applies only when `timeout` is set, so flows that omit it keep their prior unbounded behavior.
+  - **send-stream `outputVariable` / `errorHandling` / `defaultValue`**: send-stream previously accepted only `{ message }`. It now supports an optional `outputVariable` (defaults to `"message"`, so the flows that omit it are unaffected) plus the standard `errorHandling` / `defaultValue` continue-on-error fields shared by sibling steps. The streaming orchestrator resolves the effective output key so a custom output variable still streams. The SDK `SendStreamStepConfig` exposes the new fields; the dashboard step-card UI for `outputVariable` is deferred to a follow-up (its closest sibling, send-event, also omits it).
+
+## 6.0.0
+
+### Major Changes
+
+- 51ab2d1: Remove the `fetch-github` flow step from validation, execution, SDKs, generated schemas, and dashboard surfaces. The step was never surfaced in the UI, ignored half of its own config fields, and depended on an external repomix ingestor service. Use `api-call` for single GitHub API requests, `transform-data` with a container sandbox (`daytona` / `runtype-sandbox`) to clone and work on repositories, or the GitHub MCP server for agent-driven GitHub work.
+- a27eea9: Remove the non-functional `send-text` flow step from validation, SDKs, generated schemas, and dashboard surfaces.
+
+### Minor Changes
+
+- 5f08625: feat: product and surface setup readiness
+
+  Adds a net-new readiness primitive that answers "what's left to make this product (or surface) live?" with structured, headless-first next steps. A pure `@runtypelabs/shared` core composes pending secrets with each surface's remaining install steps, and every step names the best available way to satisfy it — an MCP tool to call now, a REST call from a coding harness, or a dashboard deep link when a browser is genuinely required (OAuth, DNS, keypair).
+  - `GET /v1/products/{id}/setup` and `GET /v1/products/{id}/surfaces/{surfaceId}/setup` (public API).
+  - `get_product_setup` and `get_surface_setup` read-only MCP tools, plus code-mode `getProductSetup` / `getSurfaceSetup`.
+
+### Patch Changes
+
+- 5cff576: Enforce full-workspace ESLint coverage for published TypeScript packages.
+- 9ab9197: Persist flow descriptions and use the generated flow request contract across the SDK and dashboard.
+
+## 5.15.0
+
+### Minor Changes
+
+- 6aac451: feat: add a multi-header auth type (`type: 'headers'`) for custom MCP servers. Servers can now send an arbitrary non-empty record of legal HTTP headers, with `{{secret:NAME}}` references resolved through the scoped secret store and registered with the per-execution leak guard. Support spans API discovery and saved-server CRUD, runtime discovery and dispatch, FPO/agent/SDK contracts, and runtime export. The dashboard exposes the uncommon configuration through a progressively disclosed **Advanced authentication** editor while keeping stored values encrypted and opaque until the user supplies a complete replacement set.
+
+## 5.14.3
+
+### Patch Changes
+
+- 29ce53f: Finish hiding pre-GA Runtype Apps from public SDK/docs/CLI surfaces and keep app-only client sessions fail-closed behind the feature flag.
+- 5d828d9: Use Schematic-accepted platform spend as the canonical billing-month spend display across Billing and Usage.
+
+## 5.14.2
+
+### Patch Changes
+
+- b00dea7: Hide pre-GA Runtype Apps surfaces from public tool catalogs, docs, schemas, skills indexes, SDK generation, and unauthenticated CLI help; keep runtime/tool access fail-closed behind the feature flag.
+
+## 5.14.1
+
+### Patch Changes
+
+- 0d4b1b8: Default Usage analytics to the current billing month and add spend analytics period presets.
+
+## 5.14.0
+
+### Minor Changes
+
+- facb5d9: Add Massive Web Render as a web-scraping provider alongside Firecrawl. Includes the `builtin:massive` agent tool, a `massive` fetch method on the fetch-url flow step (format, geotargeting, delay, and cache options), a `PLATFORM_MASSIVE_KEY` platform key with BYOK support via Settings > Integrations, cost tracking (`massive:render`), and SDK/dashboard surfaces. The whole feature ships behind the `enable-massive-web-render` Flagship flag (fail-closed in production): tool execution, the fetch-url step branch, built-in tool listings, and the dashboard surfaces (via `features.enableMassiveWebRender` on the user profile) all gate on it.
+
+## 5.13.0
+
+### Minor Changes
+
+- 89dbb72: FPO expressiveness: evals, skills, and Claude Managed agents are now first-class in the Full Product Object schema.
+  - New optional top-level `evals[]` section (suites with graders, cases, recorded-tool replay config) targeting a capability; assembly materializes suites + cases with `origin: 'fpo'`, and ensure-fpo converges suite-level fields while preserving user-added (non-FPO-origin) cases.
+  - New optional top-level `skills[]` section (content, trust level, capability refs, inline tools, `bindTo` agent capabilities); materialized via the skill service and bound to agent-backed capabilities. `mcpServers` is rejected at the schema per the v1 write invariant.
+  - `agentClaudeManagedConfigSchema` widened to the canonical surface: `setupMode` ('create' | 'connect'), `mcpServers`, `customTools` (materialized into `agent_capabilities` with FPO-local capability ids rewritten to real product capability ids), and `anthropicAgentVersion` coerced to number (legacy string input still accepted). ensure-fpo no longer rejects inline `claude_managed` / `external` agents.
+  - `pull-fpo` now reconstructs `secrets` (declarations from product secret bindings), `schedules`, `evals` (shape-compatible cases only, with skip warnings for captured checkpoint/toolMock cases), `skills` (via agent skill bindings), and Claude Managed agent configs. Records remain unreconstructed (account-scoped, not product-attributable) with an explicit warning.
+  - Mirror-drift fixes: public FPO types gain the `ag-ui` / `hosted-page` / `chrome_extension` surface types; FPO flow steps accept top-level `when`; the flat agent schema's error handling gains `message` fallbacks + `triggers` and its runtime-tool type enum gains `advisor` / `search`, matching v2.
+  - `computeFpoContentHash` covers the new sections with absent-key omission, so hashes of existing FPOs without `evals`/`skills` are unchanged (all three lockstep copies updated).
+
+## 5.12.1
+
+### Patch Changes
+
+- b2badd2: Retire the `usage-based-pricing` feature flag now that the rollout is complete across all environments. The trial-expiry and auto-topup-failed spend-gate branches, the card-entry slow-mode 429 messaging (`/settings/billing/portal` CTA), the `X-Runtype-Billing-Status` advisory header, and the billing lifecycle emails are now unconditional. The `features.usageBasedPricing` field is removed from `GET /v1/users/profile`, and the dashboard renders the card-centric billing copy unconditionally.
+
+## 5.12.0
+
+### Minor Changes
+
+- 9a527cd: Evals E6: feedback-triggered eval proposals and judge calibration.
+
+  Real end-user feedback now feeds the eval proposal queue automatically: a thumbs-down, NPS of 6 or below, or CSAT of 2 or below on a Flow conversation proposes a regression case forked just before the poorly rated reply (a left comment pre-fills the expected answer), and a thumbs-up or NPS of 9 or above proposes a golden case whose endorsed reply becomes the expectation. The on-write hook is non-blocking, dedups per conversation moment, targets the Flow's default (or only) suite, and writes through the governed E5 proposal seam so the per-suite daily cap and review-required governance apply unchanged.
+
+  Judge calibration lands the humanVerdict loop: POST /eval/scores/{scoreId}/review records a lightweight 👍/👎 review of an AI-grader verdict (run-results outcomes now carry `scoreId` and `humanVerdict`), and the suite detail exposes `judgeAgreement`, surfaced on the suite page as a plain "Agrees with you N of M times" trust display. Parity: SDK `evals.reviewScore` + `PersistedGraderOutcome`, MCP `review_eval_score`, code-mode `reviewEvalScore`, and dashboard 👍/👎 buttons with a tune-your-criteria hint on disagreement.
+
+### Patch Changes
+
+- 2821ddb: Evals E5: eval case proposal queue, definition-seeded generation, and the coverage meter. New `eval_case_proposals` table plus REST endpoints (`GET /v1/eval/suites/{id}/proposals`, accept/reject, `POST /v1/eval/suites/{id}/generate-cases`, `GET /v1/eval/suites/{id}/coverage`). Machine-generated cases never enter a suite directly: generation fans the target definition out over an explicit diversity matrix (category × persona), filters candidates for gradeability, and writes proposals that require an affirmative accept (verbatim or edited, with provenance backlink and audit trail — same governance stance as skill proposals). The coverage meter reports which target tools and instruction clauses the suite's cases and graders already exercise (structural tool inventory + a cached, definition-hash-invalidated LLM clause pass), with per-gap targeted generation. Ships with the suite-page review queue and coverage UI, SDK methods (`suites.listProposals/acceptProposal/rejectProposal/generateCases/getCoverage`), and MCP tools (`list_eval_proposals`, `resolve_eval_proposal`, `generate_eval_cases`, `get_eval_coverage`).
+- ec895c9: Prompt-caching auto-demotion loop plus two caching-ops levers.
+  - **Auto-demotion**: workloads that persistently pay the Anthropic 1.25× cache-write premium without landing reads (≥20 stamped requests in a 24h window with a <5% read rate) are automatically suppressed from stamping for 24h via a KV entry consulted upstream of `computeCachePlan`. Counters are folded inline at the usage-emit site (no cron), fail-open everywhere, keyed by tenant + agent/flow@version, with a structured `prompt-cache demotion` log charted on the Grafana prompt-cache dashboard. `CACHE_AUTO_DEMOTION_DISABLED='true'` is the ops kill switch.
+  - **Gateway cache-pinning kill switch**: `CF_GATEWAY_CACHE_PINNING_DISABLED='true'` restores Vercel-gateway Anthropic failover for cache-bearing requests without turning off caching.
+  - **Per-batch canary opt-out**: `options.skipCacheWarm` on batch submission skips the serial prompt-cache warm canary and fans out immediately (REST, SDK `BatchOptions`, MCP `submit_batch`).
+
+## 5.11.0
+
+### Minor Changes
+
+- 8f998e7: Add optional offset pagination to `GET /v1/client-tokens` (`limit` 1-200 + `offset`), mirroring the `/client-tokens/:id/conversations` sibling. When `limit` is provided the response includes a `pagination` object (`limit`, `offset`, `hasMore`); when omitted the full list and legacy envelope are returned unchanged, so existing callers keep working. The listing order gains a deterministic `id` tiebreak. The params are threaded through the SDK `clientTokens.list()`, the MCP `list_client_tokens` tool, and the Code Mode `listClientTokens(params)` method.
+- 9a47ef1: Prompt caching slice 3 — determinism guards + implicit-provider hygiene + escape hatch.
+  - **Determinism (prompt-cache hit rate):** freeze `_execution.timestamp` / `_now` once per execution instead of per loop iteration (both the api agent loop and the runtime port), so temporal system-prompt bytes stay identical across turns and don't bust the cache prefix. Weighted provider selection (`selectProviderByWeight`) is now sticky per conversation — a deterministic hash of `conversationId ?? executionId` replaces `Math.random()`, so a multi-provider family never flips providers mid-conversation onto a cold cache.
+  - **Implicit / routing-key providers:** OpenAI-family routes now carry a platform-derived `promptCacheKey` (`providerOptions.openai.promptCacheKey`) sharded per conversation — a cross-tenant routing-namespace hygiene fix and a hit-rate improvement; scope keys are derived from platform-owned identifiers only, never caller-supplied on platform keys. DeepSeek's `prompt_cache_hit_tokens` / `prompt_cache_miss_tokens` usage shape is now normalized by `normalizeCacheUsage`. No new family's billing discount is flipped on (hygiene only).
+  - **Escape hatch:** `options.cache: false` on dispatch / execute-agent (and the `.strict()` MCP tool mirrors) disables prompt caching per request, overriding the rollout flag — for eval/batch fan-outs and workloads that must never share provider cache state.
+  - New byte-prefix parity corpus (`prompt-cache-parity/`) driven by both prompt-executor ports pins the actual product outcome (hit rate): turn N is a strict byte-prefix of turn N+1, boundary sets are identical across executors, and no stray timestamp bytes appear when the template has no temporal references.
+
+### Patch Changes
+
+- e6b97e1: Regenerated OpenAPI types for the hosted end-user identity endpoints (`/v1/end-user-auth/*`): request/response schemas and the `rt_eu_`-prefixed access-token description.
+- e88000e: Trace→eval capture UI (E3 UI increment): "Add to eval" from a log trace, fork picker, replayability badge, and the next-step divergence diff.
+  - **Add to eval** — an agent execution's log detail panel gains an "Add to eval" action that forks the run into a `saved_from_run` test case. The dialog picks an agent-target eval (or creates the agent's default one), lets the user choose which recorded action becomes the graded next step (fork picker), and reports whether the case is fully replayable after saving.
+  - **Capture preview endpoint** — new `GET /v1/eval/executions/{executionId}/capture-preview` dry-runs the capture (same ownership-scoped reader and message math as the write path) and returns the recorded actions plus the fork index each maps to, so the fork picker never re-derives the seed math client-side.
+  - **Replayability badge** — captured cases in the suite view show a "Replayable" / "Partial replay" badge derived from whether any recorded tool output was truncated at capture.
+  - **Divergence diff** — the run-results page shows, for a captured case run in next-step mode, the recorded next action beside the new run's next action ("used to call `lookup_account`, now calls `issue_refund`"), before the grader chips. This is backed by a new persisted `eval_case_scores.next_step_tool_calls` column (a migration) written by the next-step run path and read back through `GET /v1/eval/runs/{runId}/scores`; the `NextStepToolCall` shape is added to `@runtypelabs/shared` and surfaced on the SDK's `EvalRunScores` cases.
+
+- 3ac490c: Evals E4 — recorded-tool replay ("continue past the first action"). A new
+  `RecordedToolExecutor` (runtime) serves a captured case's `toolMocks` by tool
+  name and never performs I/O, so a replayed checkpoint case can run past its
+  first action to grade what the agent does after a tool result comes back. The
+  match/policy/error-shaping logic lives in one shared pure core
+  (`resolveRecordedToolOutcome`) consumed by both the runtime executor and the
+  api eval-run chokepoint, pinned by a cross-import parity suite.
+
+  Adds a per-suite replay config on `eval_suites`: `recordedToolMode`
+  (`next_step` default | `continue`) and `recordedToolUnmatchedPolicy` (`fail`
+  default | `stub`), surfaced through the suite create/update/ensure REST routes,
+  the SDK `defineEval`, and a dashboard "Replay mode" control. Editing a mock's
+  `output` turns any recorded case into a counterfactual for free. The
+  recorded-tool config is included in the eval content hash only when non-default,
+  so existing (default) suites keep their hashes.
+
+- d7780b7: Prompt caching slice 5 — read-only observability + author advisory + breakpoint-budget tail.
+
+  `@runtypelabs/shared`: add the non-blocking `CACHE_VOLATILE_SYSTEM_PROMPT` flow-validation advisory (a `recommendation`) — a prompt step whose system prompt embeds a per-run temporal variable (`{{_now}}`, `{{_execution.*}}`, `{{_schedule.*}}`) re-renders its cacheable prefix every run, so automatic prompt caching can't land a cross-request hit; the advisory names the offending roots and suggests moving them into the user prompt. Its volatile-root rule mirrors the cache planner in `@runtypelabs/model-execution` (duplicated because `shared` cannot import that package). Adds a nine-turn byte-prefix parity fixture exercising the new reserve breakpoint.
+
+  `@runtypelabs/model-execution`: add the reserve breakpoint (budget #4) to Anthropic-family cache stamping — when a within-turn tool loop grows the gap between the system boundary and the moving last-message boundary past 15 content blocks, one intermediate history breakpoint is added at the block-count midpoint so neither gap exceeds Anthropic's cache lookback. Total stays within the 4-breakpoint budget.
+
+  `@runtypelabs/api`: surface prompt-cache read/write token counts (`cacheReadTokens` / `cacheWriteTokens`, from `flow_step_results`) in the `GET /flows/{id}/step-results` response, and add a debug-only `cache` block (`{ strategy, boundaries, prefixTokens, read, write }`) to prompt `step_complete` telemetry under `debugMode`.
+
+  `@runtypelabs/dashboard-spa`: render cache read/write token rows in the step-detail view.
+
+  `@runtypelabs/sdk`: regenerated OpenAPI types for the new step-result fields.
+
+## 5.10.0
+
+### Minor Changes
+
+- 36d84c1: feat(evals): criteria decomposition for AI graders (E2 slice 3). New `POST /eval/graders/decompose` splits one plain-language AI-grader criterion carrying several obligations into focused, independently judgeable sub-checks; each accepted sub-check becomes a plain `kind: 'ai'` grader row, indistinguishable at scoring time from a hand-typed one. SDK: `Runtype.evals.decomposeCriteria(criteria)`. The decomposer is a versioned platform prompt (`@runtypelabs/shared` `eval-criteria-decomposition.ts`) sharing the judge flow's model pair and metering path; a failed decomposition surfaces as a visible error, never a silent no-op.
+- e769fbf: Add trace→eval capture (evals Extension 2, increment 1): `POST /eval/suites/:id/cases/from-execution` forks a real agent run into a test case — it freezes the run's conversation history up to a fork point, attaches every recorded tool result as an editable mock, and saves the case with origin `saved_from_run` (the first writer for that origin). Capture is a copy, never a replay: the endpoint reads persisted rows and writes a case row; it executes nothing. The next-step run mode and the recorded-tool executor are later increments.
+
+  New additive JSONB keys inside `eval_cases.input` (no migration): `checkpoint` (`{ sourceExecutionId?, sourceConversationId?, forkMessageIndex }`) and `toolMocks` (`Array<{ toolName, input?, output, isError?, sourceToolExecutionId?, truncated? }>`), with `caseCheckpointSchema` / `toolMockSchema` in `@runtypelabs/shared`. A mock captured from a failed call is stamped `isError: true` so a future replay serves it as a failure. The SDK gains `Runtype.evals.suites.addCaseFromExecution(...)`.
+
+  Per a tool-output fidelity audit, capture sources the full-fidelity persisted `tool_executions.output_result` (uncapped) rather than the R2 log-trace tree (which truncates tool outputs at emit), runs its own secret scrub over the reconstructed history + mocks (`input_messages` is raw at rest), and caps each mock output — a truncated capture marks the case non-fully-replayable via the response's `replayable` flag.
+
+  The captured case shape (`checkpoint`/`toolMocks` and tool-call/tool-result message turns) round-trips through `addCases`/`updateCase` without a validation error. A captured case is a next-step replay case; because that run mode does not exist yet, the synchronous run path skips such a case with a clear gradeable failure instead of feeding its frozen history to dispatch (the batch path already rejects `messages`-input cases). The endpoint is also exposed through the Code-Mode MCP as `captureEvalCaseFromExecution`.
+
+### Patch Changes
+
+- 5d07273: Consolidate the duplicated content-hash primitives (`isPlainObject`, canonical `normalizeValue`, and the SHA-256 hex encoder) used by `products.ensure`, `tools.ensure`, `skills.ensure`, `surfaces.ensure`, and `products.ensureFpo` into a single internal `content-hash.ts` module. No behavior change — content hashes for all `*.ensure()` surfaces are byte-identical before and after. `flows-ensure.ts` and `evals-ensure.ts` keep their own local normalizers (they intentionally preserve `null` values, unlike the canonical normalizer) but now share the same `isPlainObject` and hex-encoding helpers.
+
+## 5.9.0
+
+### Minor Changes
+
+- e85c67e: Custom judge flows for AI graders (E2, `judgeFlowId`): an AI grader can now name one of the evaluating account's own flows as its judge instead of the platform judge prompt, via `judge(criteria, { judgeFlowId })` in the SDK or `judgeFlowId` on the grader config. The flow is executed through the normal flow pipeline in the customer's own account (so judge spend bills them and is metered once, by the pipeline) under a fixed contract: it receives the four platform judge variables (`criteria`, `caseName`, `expected`, `transcript`) as inputs, and its final output must be the platform verdict JSON (`reasoning` / `verdict` / `evidence`), parsed by the same validator as the platform judge so the verdict contract never varies by judge implementation. Contract validation is run-time: a miswired judge flow (missing, inaccessible, failing, or returning malformed output) resolves to an `insufficient_evidence` outcome with a visible grader error naming the problem, so it can neither fail nor silently pass cases. `judgePromptVersion` is not stamped into these scores' grader snapshots (the platform prompt did not produce them); the snapshot's `judgeFlowId` is the provenance.
+- f5ad9c0: Trajectory judge core (E1): the AI grader now evaluates the whole run, not just the final output. The judge is the new Runtype-owned "Runtype Eval Judge" system flow (config as code in `@runtypelabs/shared`, converged per environment via `scripts/ensure-eval-judge-flow.ts` like the Flow Generator): the builder's criteria is embedded as a variable inside a hand-crafted eval-expert system prompt, graded by `gemini-3.5-flash` with a cross-provider `nemotron-3-ultra-550b-a55b` fallback, and rendered in-process by the grader executor so judge spend bills the evaluating customer. The judge receives an indexed transcript of the run's steps and tool calls (with inputs/outputs, truncated and capped) and returns a binary verdict (`pass` / `fail` / `insufficient_evidence`) with critique-before-verdict reasoning and clickable evidence citations, instead of a 1-5 score. `insufficient_evidence` renders as a warning and never fails a case. Existing `threshold`/`.atLeast()` SDK semantics are preserved by mapping pass/fail to 5/1 internally, and the judge-prompt version is stamped into each score's `grader_snapshot` so historical scores stay interpretable. The batch scoring path now threads tool inputs/outputs from `tool_executions` into the grading trace, `eval_case_scores` gains `verdict`/`evidence` columns, and the run-results page shows insufficient-evidence badges plus evidence chips that deep-link into the case's trace section.
+
+### Patch Changes
+
+- ae6f98e: Degrade gracefully when R2 SQL fails on the logs read path. When the historical (R2 SQL) leg of a merged GET /v1/logs or /v1/logs/stats query fails (e.g. the Iceberg manifest scan limit, error 40020), the request now serves hot-tier (recent) entries and counts with a new optional `degraded: true` field on the response data instead of failing the whole request with a 500. Degraded stats responses are never cached. The dashboard logs page shows a "historical logs temporarily unavailable" banner when the flag is set.
+
+## 5.8.1
+
+### Patch Changes
+
+- 9087295: Add abuse limits to the Runtype Apps records data plane (`/v1/client/records`).
+  - **Per-app record cap**: creates are blocked once an app holds 10,000 records
+    across all its namespaces (counted by the per-app storage-type prefix within
+    the owner scope), returning `403` with a hint. This bounds unmetered writes
+    from the anonymous, freely-mintable data plane into the owner's `records`
+    table.
+  - **Write rate limiting** (`POST`/`PUT`/`DELETE`): a native Cloudflare Workers
+    rate-limit binding (`RATE_LIMIT_APP_DATA`) keyed per app (the real backstop)
+    and per session, 100 writes / 10s. Rejections return `429` with `Retry-After`.
+    Fails open (no limiting) when the binding is unconfigured so the data plane
+    never breaks.
+  - Documents both limits in the deploying-apps guide and the `build-runtype-app`
+    skill; adds the `429` response to the write routes in the OpenAPI spec.
+
+- 7007359: Add optional optimistic concurrency to `PUT /v1/client/records/:id` (the Runtype
+  Apps data plane) so concurrent anonymous sessions stop silently clobbering each
+  other. The flagship use case for apps (collaborative surfaces like a shared retro
+  board) is exactly concurrent writers, and PUT is a full metadata replace, so the
+  default last-write-wins behavior loses updates.
+  - New optional request field `expectedUpdatedAt` (the `updatedAt` from the
+    caller's last read). When provided, the update is a compare-and-set: the
+    equality is folded into the UPDATE's `WHERE` clause (closing the TOCTOU race),
+    with a fresh pre-check for a friendly error. On a mismatch the API returns
+    `409` with the **current** record in the body (`{ error, hint, record }`) so
+    the client can rebase and retry.
+  - The comparison is millisecond-precision-robust: the `records.updated_at`
+    Postgres `timestamp` stores microseconds, but the token the caller holds is a
+    millisecond ISO string (`Date.toISOString()`), so both the JS pre-check and the
+    SQL guard (`date_trunc('milliseconds', updated_at)`) compare on the
+    ms-truncated value.
+  - Omitting `expectedUpdatedAt` preserves the existing last-write-wins behavior
+    exactly — fully backward compatible.
+
+  Also updates the `build-runtype-app` agent skill and the deploying-apps developer
+  guide with the new field.
+
+- ee51039: feat(evals): "Save as test case" moment (Beginner-First Evals §6.1)
+
+  After a test run completes in the RunFlowSheet Test tab, a "Save as test case"
+  button captures the run's input and output into a pre-filled, editable eval
+  case dialog, targeting the flow's default eval suite (auto-created on first
+  save, named "<Flow name> eval"). Saved cases are tagged `origin: 'saved_from_run'`.
+  - `POST /v1/eval/suites` and `POST /v1/eval/suites/{id}/cases` accept an
+    optional, server-validated `origin` field on each case (`manual` |
+    `saved_from_run` | `generated` | `imported` | `fpo`), previously hardcoded
+    to `'manual'` on every write path.
+  - Adds the missing `createEvalSuite` method to the dashboard's browser API
+    client and an `ensureDefaultEvalSuiteForFlow` helper (find-or-create the
+    flow's default suite).
+  - `EvalCaseDialog` gains `initialValues`/`origin` props so the save-as-test-case
+    flow can reuse its existing input/expected shaping instead of a new form.
+
+- db60b0c: Score-over-time chart on the eval suite page, a Score column in the eval comparison view for suite-linked runs, and a server-side `evalSuiteId` filter on `GET /v1/eval/batches` (the suite page's run history no longer truncates to a client-side slice of the org-wide runs list). `GET /v1/eval/group/{groupId}` batches now include `evalSuiteId` and `suiteScore`.
+- 40874d8: Add pagination to the Evals page's Runs tab and to the suite detail page's
+  runs list. Both previously fetched a single `limit: 100` page and rendered it
+  with client-side search only, so an active org's older runs (or a suite past
+  its first 100 org-wide runs) were silently invisible with no way to page.
+  `GET /v1/eval/batches` is offset-based, so the pagination footer paginates by
+  offset (50/page on the Runs tab, 25/page on the suite page). The endpoint now
+  returns `hasMore` (matching the convention already used by `/v1/flows`,
+  `/v1/client/conversations`, `/v1/schedules`, …) instead of the client
+  inferring it from page fullness. Also drops the dead cursor plumbing in
+  `useEvalBatches` / `listEvalBatches` (the API never returned
+  `cursor`/`nextCursor`/`prevCursor`), and fixes two follow-on bugs found in
+  review: the suite detail page's pagination footer stayed hidden when a
+  full-page offset landed on an empty page (stranding the user with no way
+  back), and running a suite from the Evals tab while `runsOffset` was
+  non-zero refetched at the stale offset instead of surfacing the new run on
+  page 1.
+- 41b296a: Add the Runtype Apps records data plane (`/v1/client/records`). A deployed
+  app's browser JS can now persist data using its origin-locked client token,
+  governed entirely by the manifest's `data[]` namespace grants:
+  - `GET /v1/client/records?namespace=…` (cursor-paginated list), `POST /v1/client/records`,
+    `GET/PUT/DELETE /v1/client/records/:id` — all session-authed with the session
+    from `POST /v1/client/init`.
+  - Authorization is manifest-driven and evaluated per request: the session's
+    client token resolves to its app, and the requested namespace must appear in
+    the **active** version's `manifest.data[]`. Mutating verbs require
+    `read-write`; an un-granted namespace is never accessible (out-of-namespace
+    records 404 to avoid leaking existence).
+  - Rows live in the existing `records` table (`type` = namespace) under the app
+    owner's tenant, stamped with server-controlled `appId` / `versionId` /
+    `clientSessionId` provenance (reserved `_app` metadata key, stripped from
+    caller input and never echoed). Metadata is capped at 64 KB.
+  - `POST /v1/client/init` now mints a session for data-only app tokens (a
+    manifest that declares record namespaces but no flows/agents). The init
+    response carries an `app` object instead of `flow` for these sessions; `flow`
+    is now optional.
+
+  Also updates the `build-runtype-app` agent skill and the deploying-apps
+  developer/user guides with the data API and an end-to-end example.
+
+## 5.8.0
+
+### Minor Changes
+
+- 4c17349: Eval score persistence (Beginner-First Evals Phase 1, PR-A): grader scores now have a durable home.
+  - **Saved-suite runs of `POST /v1/eval/run` persist by default**: the run gets a `batchExecutions` anchor row (`executionType='eval'`, `evalSuiteId` set) and one `eval_case_scores` row per (case, grader) — the data source for run history, baselines, and score-over-time. Pass `virtual: true` to keep a run ephemeral; inline `definition` runs stay ephemeral always. The response (and SDK `RunEvalResult`) gains `runId`.
+  - **Suite-linked batch runs are scored at completion**: `completeBatch()` now grades a run with `batchExecutions.evalSuiteId` set from its persisted step results — including trace-grader coverage rebuilt from `flowStepResults` + `tool_executions` (closing the deferred batch-trace gap). Idempotent and non-fatal; dormant until a producer links batches to suites.
+  - **New read endpoint `GET /v1/eval/runs/{batchId}/scores`** returning per-case grader outcomes in the same shape as the sync run response.
+  - **Four new AI grader presets**: Stays on task, Same language, Refuses when it should, No personal data (mirrored in the SDK `judges.*` builders).
+  - CLI `runtype eval run` prints the persisted run id.
+
+- f89cb41: Eval suite CRUD + suite runs + Evals index restructure (Beginner-First Evals Phase 1, PR-B).
+  - **New `/v1/eval/suites` REST family**: create/list/get/update/delete suites, add/edit/delete test cases, and `POST /v1/eval/suites/{id}/run`. List/get include case counts and each suite's latest run + score. Suites within the synchronous case limit run inline and return the scored result; larger suites queue a durable run whose grader scoring fires in `completeBatch()` (activating the previously dormant batch scoring pass) via inline records stamped with `_evalCaseId`.
+  - **Two-writers provenance**: Definition edits (name, description, graders) from the dashboard/API stamp `lastModifiedSource` and a graders change invalidates the config-as-code `contentHash` so the next `ensure` re-converges; case mutations deliberately leave provenance untouched (cases are server-authoritative data and survive unchanged-probe deploys).
+  - **`GET /v1/eval/batches`** gains an `origin` filter (`suite` | `adhoc`) and returns `evalSuiteId`, `requestSource`, and a `suiteScore` summary per run.
+  - **Dashboard `/evals` restructure**: the index is now Evals (suites) as the primary tab — name, target, case count, latest score, last run, Run/Delete actions, and a "Managed in code" badge for ensure-converged suites — with Runs as a secondary tab carrying an origin badge + filter, a Score column for suite runs, and "Ad-hoc comparison" labeling for suite-less runs. "Compare configs" is an action on run groups.
+  - **SDK**: `client.evals.suites.*` namespace (create/list/get/update/delete/run/addCases/updateCase/deleteCase) plus a generic `patch` helper on `RuntypeClient`.
+  - **Code-Mode MCP**: `createEvalSuite`, `listEvalSuites`, `getEvalSuite`, `updateEvalSuite`, `deleteEvalSuite`, `runEvalSuite`, `addEvalCases`, `updateEvalCase`, `deleteEvalCase`.
+
+- fa6d18a: feat(flow-steps): add `get-record` and `list-records` step types, deprecate `retrieve-record`
+
+  `retrieve-record` derives its return shape (single object vs. array) from the lookup method, which is unintuitive and a common source of `{{var.field}}` resolving to `undefined`. Cardinality is now a property of the step **type**: `get-record` always returns a single record object (fails if no match), `list-records` always returns an array (newest-first, `limit` default 50 / max 1000, `onEmpty: 'succeed' | 'fail'`).
+  - **Engine (api + runtime)**: `retrieve-record` is resolved to its successor by a single pure alias (`resolveRetrieveRecordAlias`) at the normalizer seam, so both legacy executors are removed and saved / published / inline flows execute through the new `get-record` / `list-records` executors with behavior preserved (query mode → `list-records` with `limit: 1000` + `onEmpty: 'fail'`; id mode → `get-record`). SSE step events emit the resolved type for aliased steps.
+  - **Validation**: `validate_flow` emits a non-blocking `DEPRECATED_STEP_TYPE` warning for `retrieve-record` naming the successor its config resolves to, and the array/object-access warning code was renamed `RETRIEVE_RECORD_ARRAY_OBJECT_ACCESS` → `LIST_RECORDS_OBJECT_ACCESS`.
+  - **MCP**: `create_flow` / `update_flow` / `validate_flow` step-config guidance now documents both new types and marks `retrieve-record` as deprecated.
+  - **Client SDK**: `FlowBuilder`/`RuntypeFlowBuilder` gain `getRecord()` and `listRecords()` methods (plus `GetRecordStepConfig` / `ListRecordsStepConfig` types); `retrieveRecord()` is marked `@deprecated` but continues to work unchanged.
+  - **react-flow**: `get-record` and `list-records` are added to `FlowStepType` with display labels ("Get record" / "List records").
+
+  `retrieve-record` is still accepted everywhere for backward compatibility — this is additive, no breaking changes.
+
+### Patch Changes
+
+- 1422e92: Add fire-and-forget dispatch for Claude Managed agents via the RFC 7240
+  `Prefer: respond-async` request header. On the durable lane (a saved agent
+  invoked with a `conversationId`), the turn runs headlessly in the session DO
+  with full durability (seq log + `session_turns` row + watchdog alarm) and the
+  request returns `202 { executionId, status, conversationId }` plus a
+  `Preference-Applied: respond-async` header instead of streaming. Clients
+  reconnect via `GET /agents/:id/executions/:executionId/events` or poll
+  `GET /agents/:id/runs`. Requesting async on the in-request/virtual lane (no
+  durable owner to outlive the request) returns `400 ASYNC_REQUIRES_DURABLE_LANE`.
+  Honored on both `/v1/agents/:id/execute` and saved-agent `/v1/dispatch`. The
+  202 response + `AsyncDispatchHandle` schema are documented in the OpenAPI spec
+  and flow through to the generated TypeScript and Python SDKs.
+- d0df6a8: Durable Claude Managed sessions: two reliability fixes for the session DO.
+  1. Watchdog re-arm on settle: `runTurn`'s finally now mirrors `alarm()`'s
+     guard — it re-arms the watchdog when any durable `running` turn row remains
+     (an orphan stranded by a mid-turn DO eviction) instead of unconditionally
+     disarming. Previously a new turn settling inside the watchdog window
+     deleted the alarm out from under the orphaned turn, stranding it `running`
+     forever with no interrupted run row and no terminal frame.
+  2. Sub-frame-granular reconnect cursor: the legacy-to-unified translation is
+     1-to-many (one durable log row can fan out into several unified events), and
+     every sub-frame previously carried the same row seq as its SSE `id:`, so a
+     mid-row disconnect skipped the rest of the row on reconnect (worst case the
+     terminal `execution_complete`). Intermediate sub-frames now carry a
+     composite `<rowSeq>.<subIndex>` id and the row's final sub-frame keeps the
+     plain row seq, so a reconnect with the last seen id (passed verbatim as
+     `?after=`) resumes with exactly the not-yet-applied sub-frames. Plain-seq
+     cursors keep their existing semantics; the id stays opaque to Persona.
+
+- de60a30: End-user credential registration (multi-tenancy V1, inc 5) — connect leg. Adds
+  `POST /v1/end-user-integrations/{provider}/connect`: an end user attaches their
+  own third-party account (GitHub first) so a Runtype agent can act on their behalf
+  later.
+  - **Auth model:** builder-authenticated (api-key / clerk, the same credential
+    that consumes the resulting secret via builder-mediated dispatch). The
+    end-user identity comes ONLY from a verified Identity-Exchange proof
+    (`verifyExchangeProof`), never a body-asserted id. Registration admits
+    `verified` end-user assurance ONLY.
+  - **Flow:** verify the proof against the builder-owner's configured identity
+    integrations → project a durable `eu_*` (Option 1: `integration_id = NULL`, so
+    the stored secret reconciles with the builder-mediated dispatch path) → bind a
+    single-use, KV-backed `state` → return the connector's authorize URL.
+  - **Connector seam:** a new `OAuthConnector` registry (`services/end-user-oauth`)
+    with GitHub as the first provider (GitHub was previously PAT/App-paste only —
+    this is the first real OAuth-redirect connector). Adding a provider is a
+    registry entry, not a new route.
+  - Orchestration + security invariants live in
+    `services/end-user-oauth/connect-service.ts` (thin route adapter over it),
+    unit-tested with the verifier injected.
+
+  Connect leg only — the OAuth callback (token exchange → `eu_*`-scoped secret) and
+  GitHub OAuth App credential provisioning (add `GITHUB_OAUTH_CLIENT_ID` /
+  `GITHUB_OAUTH_CLIENT_SECRET` to `wrangler.toml` `required`) land in the follow-up.
+  Until provisioned, the connector reports "not configured" and connect returns 501.
+
+- 9736850: Fix non-streaming agent execution masking an approval pause. When a Quick-Agent's
+  tool call tripped the approval gate (`config.tools.approval.require`), the flow
+  paused but the non-streaming (`streamResponse: false`) `POST /v1/agents/{id}/execute`
+  and `POST /v1/dispatch` agent paths branched only on `execResult.success` (which
+  is `true` on a pause), so they persisted the `agent_executions` row as `completed`
+  (stopReason `complete`, `completedAt` stamped) and returned a bare success
+  envelope — a JSON caller could never discover or resolve the pending approval.
+
+  Both paths now mirror the streaming path's paused persistence and the dispatch
+  JSON payload's paused status: the row is persisted as `paused` (stopReason
+  `paused`, no `completedAt`) and the response carries `status: 'paused'` with a
+  `pausedReason` object. `pausedReason` threads the approval discriminators
+  (`awaitReason: 'approval_required'` + `approvalId`) so a caller can resolve the
+  gate via `POST /v1/agents/{id}/approve`. The wire shape is single-sourced in
+  `buildPausedReason` so the several producers can't drift.
+
+  `@runtypelabs/sdk` (packages/client): `AgentExecuteResponse` gains `'paused'` on
+  `stopReason` plus optional `status` and `pausedReason` fields, and
+  `AgentsEndpoint.runTask()` now stops the session loop on a `paused` result
+  instead of re-sending.
+
+  Verified live on staging.
+
+- 8f13a37: Add policy-gated PII redaction at the log/telemetry chokepoints. A new
+  `resolvePiiRedactionPolicy` resolver (mirroring `resolveLoggingPolicy`, default
+  `off`) is threaded from agent/flow, surface, and product config through the
+  execution engine into the two customer-data chokepoints: `prepareCustomerTailData`
+  (customer tail logs → dashboard, R2, hot-tier DO, live tail, Sentry/Grafana) and
+  `ExecutionTelemetryService.sendBatch` (R2 telemetry pipelines). When the resolved
+  policy is `redact`, customer-supplied (UGC) fields are masked via the shared PII
+  primitive; system fields are never touched. Opt-in and flag-free — no behavior
+  change unless a config layer sets `piiRedaction: 'redact'`.
+
+  The agent `piiRedaction` config is a first-class field on every write surface:
+  the SDK agent content-hash (`@runtypelabs/sdk`) includes it so an agent that only
+  changes its redaction policy produces a new content hash, and the MCP
+  `create_agent` / `update_agent` tools (`@runtypelabs/mcp`) accept `piiRedaction`
+  (and the previously-missing `loggingPolicy`) so it round-trips through the agent
+  tool surface.
+
+- 9002f51: Security: agent sandbox container egress now fails closed. The sandbox DO's outbound enforcement treats an unset in-memory network-access profile as `off` for raw pass-through egress (previously it fell through to unrestricted egress, so a background process that outlived a DO eviction escaped the operator's `essentials`/`none` profile). The credentialed proxy paths (per-execution api token and phantom-token credential-proxy rules) remain reachable under the unset default because their state is equally in-memory and dies with the same eviction; an explicit `off`/allowlist profile still gates all paths. The container executor forwards an explicit `on` and deploy pins its historical open posture explicitly. The flow validator's `SANDBOX_NETWORK_ACCESS_DISABLED` warning now also fires for `runtype-sandbox`/`cloudflare-sandbox` transform steps that call `fetch()` without `networkAccess`. The inert `requireApprovalForBash` sandbox config knob is removed from the public schema until its approval wiring exists (use the generic `tools.approval` config to gate `bash` by name); the `open` egress profile's flag-only gating and the org-shared `conversationId` container keying are documented as accepted risks.
+- 4520c60: Fix the subagent HITL resume model's three design gaps (runtime). (1) Exactly-once pre-gate side effects: resume is a full child re-run (the Anthropic session is archived on pause), so a non-idempotent child tool call made before the gated one used to re-execute on approve-resume (child does `create_ticket` then gated `send_email` → two tickets). `runSubagent` now records every child tool result in a `SubagentReplayJournal` that rides out on `ApprovalRequiredError.replayJournal`; passed back on resume via `ApprovalConfig.subagentReplayJournal`, matching re-issued calls (same tool name + same canonical parameters) are answered from the journal instead of executing again. (2) Boundary-scoped, parameter-bound approval grants: the gate previously matched `approvedTools` by bare tool name, so approving the child's `send_email` pre-approved the parent's and every sibling subagent's same-named tool for the whole execution — and a child re-run could re-issue the approved tool with different parameters than the human reviewed. Grants now resolve against the approval boundary (`ApprovalRequiredError.approvalScope`, e.g. `subagent:delegate_email`) and the recommended one-shot resume grant is the param-bound `ApprovalRequiredError.approvalKey`, which re-prompts when the re-issued call's parameters drift from what the human saw; bare-name grants keep working for the top-level agent's own tools but no longer bleed into children (bare-name denials stay effective at every boundary, the fail-closed direction). (3) Parent-visible approval correlation: `agent_approval_start.toolCallId` for a subagent pause is the muted child's tool_use id, which never appeared on the parent stream — the `subagent` attribution block now carries `parentToolCallId`, the subagent tool call's id whose `agent_tool_start` the client already saw (additive optional field on the shared SSE schemas and the regenerated OpenAPI spec / SDK types). Also: `ExecuteAgentOptions.onApprovalRequired` hands `executeAgent` consumers the full pause object (the SSE frame intentionally omits the resume-critical `approvalKey` / `approvalScope` / `replayJournal`), and the skill capability-load gate resolves grants through the same boundary-scoped + param-bound matcher so the pause's `approvalKey` satisfies it on resume and a top-level skill grant does not bleed into a subagent child's same-named skill load.
+- 49d599f: Fix chat surfaces created via REST/MCP silently disabling WebMCP: surface write paths (REST create/update and the config-as-code ensure service) now inject the `type` discriminant into the persisted behavior JSONB (callers passing legacy `config` or a `behavior` without `type` previously stored it verbatim), the canonical surface content hash normalizes behavior with the injected discriminant on both the shared and SDK copies so ensure converges without phantom diffs, and `readSurfaceWebMCPPolicy` accepts the surface row's `type` column as the authoritative discriminant so legacy rows written without one still resolve their WebMCP policy.
+- 9cbdba8: Carry per-request tenancy identity (`tenant` / `endUser`, multi-tenancy V1) through
+  the MCP and Code-Mode execution surfaces so multi-tenant dispatch/execute reaches
+  parity with the REST routes + generated SDKs:
+  - MCP `dispatch` tool gains optional `tenant` / `end_user` inputs (snake_case,
+    mapped to camelCase on the wire); the `.strict()` schema previously rejected them.
+  - MCP `execute_agent` tool gains the same optional `tenant` / `end_user` inputs,
+    threaded through both `RuntypeClient.executeAgent` implementations (the
+    hand-written HTTP client and the api-internal client), whose closed body objects
+    previously dropped them.
+  - Code-Mode MCP `executeAgent` becomes a pass-through like `dispatch` (its closed
+    destructure dropped `tenant`/`endUser`; it also now sends the
+    `streamResponse: false` key the execute route actually reads, instead of the
+    ignored `stream: false`), and the overlay docs show tenant/endUser on
+    `executeAgent` and `dispatch`.
+  - TS SDK `CreateSecretRequest` is now derived from the generated OpenAPI types
+    instead of a drifted hand-written interface, picking up `productTenantId` /
+    `endUserId`.
+
+  Omit `tenant` / `endUser` for the unchanged org-level default.
+
+- b82d8f1: Usage-based-pricing slice 1b-ii: propagate the platform-key spend-block
+  `blockReason` discriminant (`credit_exhausted | trial_expired |
+auto_topup_failed`) onto the public wire and render differentiated dashboard
+  paywall copy keyed off it.
+  - Wire: `blockReason` is now an optional field on the `execution_error`
+    (unified) and `flow_error` (legacy) SSE event schemas, forwarded through both
+    legacy→unified mapper branches, every `flow_error` / `dispatch_error` emitter,
+    the REST error envelope, and the buffered non-streaming payload. Regenerated
+    OpenAPI + Python SDK + client types follow.
+  - Dashboard: a shared `getSpendBlockCopy` helper maps the reason to card-centric
+    copy (out of credit / trial ended / payment failed), consumed by the streaming
+    execution-error surface, the REST 402 handler, and the usage banner. All spend
+    and slow-mode CTAs route to the credit-card entry page
+    (`/settings/billing/portal`); hardcoded "Upgrade to Startup" / "Upgrade to
+    Team" strings are replaced with "Add a payment method".
+
+  Additive and behavior-neutral: `blockReason` is only populated on an already
+  flag-gated (`usage-based-pricing`) spend block, and the paywall copy falls open
+  to generic "add a payment method" copy for an absent or unrecognized reason.
+
+- edae98b: Usage-based pricing slice 4 (dashboard): expose the `usage-based-pricing` flag to the SPA as `features.usageBasedPricing` on `GET /v1/users/profile`, and gate the card-centric billing surfaces on it. With the flag on, the SlowModeModal CTA and the BYOK card copy become "Add a payment method" (routing to the credit-card entry page), and the usage alert banner differentiates the force-upgrade reasons (out of credit vs trial ended vs payment failed) by mirroring the API spend gate's subscription/trial precedence, including a new trial-expired alert. Flag off (the production default) renders today's UI byte-identically; the flip per cohort is the launch lever.
+
+## 5.7.0
+
+### Minor Changes
+
+- fd2e18e: Durable Claude Managed sessions (slice 4a): durable run record + deliverables persistence.
+
+  The Postgres half of the durable-sessions §8 Q1 split — the raw SSE event log stays in DO-SQLite; Postgres carries only a per-turn summary plus deliverable pointers.
+  - New tables `managed_agent_runs` (one row per managed turn, written at settle with status / final text / token usage / cost / the seq ceiling) and `managed_agent_outputs` (one pointer row per swept `/mnt/session/outputs/` file; the bytes already live in asset storage). Run rows are idempotent on `execution_id`; deliverable rows dedupe on `(run_id, anthropic_file_id)`.
+  - `ClaudeManagedSessionDO` writes both at turn settle (success or failure) in the same `finally` as the lease — best-effort, so a persistence failure never fails the run. The shared `onSessionOutput` sweep callback gains an `onDeliverableSwept` hook the DO uses to collect deliverable pointers during the turn.
+  - New read routes `GET /v1/agents/{id}/runs?conversationId=` and `GET /v1/agents/{id}/runs/{runId}` (agent ownership + AGENTS:READ, the same trust level as the events reconnect route) — the queryable execution record and "deliverables tab" backbone managed turns lacked.
+
+  Adds `managed-agent-run-store.ts` mirroring the session store. No webhook or headless behavior yet (slices 4b/4c).
+
+## 5.6.0
+
+### Minor Changes
+
+- 78e6f0e: feat(evals): grader severity (`gate`/`soft`) + functional `--strict`, and inline `evals:` on `flows.ensure` (code-colocated evals increment 5)
+  - **Severity.** Every grader now carries an optional `severity: 'gate' | 'soft'` (absent ⇒ `gate`, the historical hard-gate behavior). A `soft` grader miss is tracked-but-not-failing — reported per-outcome but it does not fail the case unless the run is strict. `casePassed(outcomes, { strict })` in `@runtypelabs/shared` owns the aggregation; `EvalScoringService.scoreRun` threads a `strict` flag and stamps each outcome's severity.
+  - **`runtype eval --strict` is now functional** (previously a stub): it sends `strict: true` to `POST /v1/eval/run`, and the server-computed severity-aware `passed` drives the exit code (a soft miss alone exits `0` without `--strict`, `1` with it; a gate miss always exits `1`). The CLI also surfaces soft misses on passing cases as warnings.
+  - **SDK chainable severity handles.** Grader builders (`contains(...)`, `judge(...)`, `calledTool(...)`, …) return a `Gradeable` with `.gate()` / `.soft()` handles (and `.atLeast(n)` on AI graders to set the 1-5 judge cutoff). The handles are non-enumerable, so a grader still serializes byte-identically to its plain wire shape and the content hash of an un-annotated grader is unchanged.
+  - **Inline `evals:` on `flows.ensure`.** `defineFlow({ ..., evals: [...] })` attaches eval suites that converge with the flow; an inline eval that omits `target` defaults to the enclosing flow. This is SDK-orchestrated and honors the eval-endpoints-only rule — the flow converges through `/flows/ensure` (its `{ name, steps }` wire shape and content hash are unchanged; `evals` is never sent there) and each inline suite converges through the existing `/eval/ensure`. `Runtype.flows.ensure(...)` returns the per-suite converge outcomes under `evals`.
+
+## 5.5.0
+
+### Minor Changes
+
+- edf1724: Code-colocated evals increment 4: trace graders — deterministic, free assertions
+  over a run's execution trace (which tools/steps ran, in what order, whether it
+  completed, what it cost), not just its final output text.
+
+  New `CheckGrader` kinds scored by the pure `runCheck` engine: `called_tool`
+  (with optional `input` / `output` / `isError` / `times` filters),
+  `not_called_tool`, `used_no_tools`, `max_tool_calls`, `tool_order` (ordered
+  subsequence), `ran_step`, `step_order`, `completed`, and `cost`. `GradingTarget`
+  gains an optional `trace` ({ toolCalls, steps, completed, costUsd }); trace
+  checks fail gracefully with a clear reason when no trace was captured.
+
+  The synchronous `POST /v1/eval/run` path now populates `trace` per case: steps
+  and cost come from the `FlowExecutionResult`, and tool calls are captured
+  in-memory from the run's SSE tool events (the same mechanism the virtual-agent
+  tool-persistence tap uses), so trace graders work end-to-end without persisting
+  anything. Batch scoring (`/eval/submit`) is unchanged and still does not wire
+  trace graders — they are fully exercisable via `/eval/run`.
+
+  The SDK gains trace-grader builders: `calledTool(name, opts?)`,
+  `notCalledTool(name)`, `usedNoTools()`, `maxToolCalls(max)`, `toolOrder(tools)`,
+  `ranStep(name)`, `stepOrder(steps)`, `completed()`, and `cost(maxUsd)`.
+  `defineEval` now accepts these kinds (previously rejected as "not available
+  yet").
+
+## 5.4.0
+
+### Minor Changes
+
+- 0cd1d82: Add `defineEval` — the pure authoring layer for code-colocated evals. Define the evals for a flow or agent right next to its `defineFlow` / `flows.ensure` definition, using grader builders (`contains`, `regex`, `jsonField`, `length`, `latency`, `noError`, `matchesExpected`, `judge`, and the `judges.*` presets) that emit the canonical `GraderConfig` wire shapes. `defineEval` validates and normalizes a definition (target + cases + per-case graders, with suite-level `graders` merged into each case) into an environment-portable `EvalDefinition`, and `computeEvalContentHash` provides the hash-first basis for future `evals.ensure` convergence. Pure and local (no I/O), mirroring the `defineFlow` precedent. The converge endpoint, `runtype eval` CLI, and trace/severity grader extensions land in follow-up increments (see `docs/features/planning/2026-06-24-code-colocated-evals.md`).
+- a7b06ce: Code-colocated evals increment 3: the `runtype eval run` CI gate plus the
+  synchronous run+score endpoint behind it.
+
+  New `POST /v1/eval/run` runs every case of an eval suite (a saved suite by id, or
+  an inline `--virtual` definition) against its target flow/saved-agent, grades the
+  outputs with the suite graders via `EvalScoringService`, and returns the suite
+  score + per-case grader outcomes in one response. Synchronous and ephemeral — no
+  batch is created and no `eval_case_scores` are persisted (AI-grader spend is
+  still metered); bounded by a per-run case ceiling, with a per-case timeout.
+  `claude_managed` agents and inline/virtual agent targets are rejected with an
+  actionable error.
+
+  The SDK gains `client.evals.runSuite({ suiteId } | { definition })` (and the
+  `runEvalSuite` helper) returning the typed `RunEvalResult`.
+
+  The CLI gains `runtype eval run [idOrDirPrefix]`: it discovers `**/*.eval.ts`,
+  loads each `defineEval(...)` default export via jiti, `ensure`s the suite (or runs
+  it inline with `--virtual`), runs it, and maps the result to eve-style exit codes
+  (`0` pass / `1` gate failure / `2` config error). Supports `--junit <path>`,
+  `--url <api>`, `--cwd <dir>`, and a `--strict` stub (grader severity lands in a
+  later increment).
+
+- 17f7b6b: Add the code-colocated eval converge surface (increment 2): `POST /v1/eval/ensure`
+  - `GET /v1/eval/pull`, the `client.evals.ensure(def)` / `client.evals.pull(name)`
+    SDK methods, and the canonical `computeEvalContentHash` in `@runtypelabs/shared`.
+
+  `evals.ensure` is the deploy-time, non-executing converge for `defineEval` suites
+  — the eval sibling of `flows.ensure`. It is hash-first (the steady state is one
+  tiny probe), upserts an eval suite + replaces its cases, and returns
+  `unchanged | created | updated | definitionRequired` with the server-computed
+  content hash. Suite identity is the suite name (defaults to `flow:<name>` /
+  `agent:<name>`) + account scope; the target flow/agent is resolved by name and
+  fails loudly on a missing or ambiguous match. Every write stamps
+  `last_modified_source = 'sdk'` for the deferred external-edit conflict guard.
+
+  Lean v2 scope: hash-first idempotency only. Per-case divergent graders, dry-run /
+  plan, 409 conflict codes, and version snapshots are deferred to later increments;
+  `virtual: true` suites are rejected (ephemeral, nothing durable to converge).
+  Adds `EVALS:*` / `EVALS:READ` / `EVALS:WRITE` API-key scopes.
+
+## 5.3.1
+
+### Patch Changes
+
+- 2260366: Switch the flow generator and product generator to GLM 5.2 (`glm-5.2`).
+  - The flow generator's `FLOW_GENERATION_MODEL_ID` now points at `glm-5.2`.
+  - The product generator is now a **single fixed model**: the `product-generator-model` Flagship flag (and its allowlist, profile plumbing, and dashboard-side resolution) has been removed entirely. `@runtypelabs/shared` now exports a single `PRODUCT_GENERATOR_MODEL = 'glm-5.2'` constant used by both the converged agent definition and the dashboard generate route. The `features.productGeneratorModel` field is dropped from `GET /v1/users/profile`.
+
+## 5.3.0
+
+### Minor Changes
+
+- 83d57ad: Add the `_tenant` system variable and the `ResolvedTenancyContext` spine (multi-tenancy V1, increment 1)
+
+  Dispatch and `agents/:id/execute` now accept an optional top-level `tenant: { id, ... }`
+  object, exposed in templates as `{{_tenant.*}}` — the Product Tenant scope (the
+  builder's customer _inside_ a Product), nested under the Builder Org (`_user`) and
+  above the End User (`_endUser`). It is threaded exactly like `_endUser`: additive,
+  caller-asserted, and keyed to nothing yet (the trust boundary, identity projection,
+  and scoped memory/records/secrets land in later increments).
+
+  Internally, `runExecutionPipeline` now computes a `ResolvedTenancyContext` once at the
+  execution seam (a thin, pure projection of the caller + dispatch identity) and attaches
+  it to `executionMetadata.resolvedTenancy` as the forward-stated dependency root later
+  increments read scope from. Every existing execution behaves identically.
+
+- 9ed5154: Multi-tenancy V1 (increment 4): Tenancy Strategy + lock-down gate (ADR 0012).
+  A resource can now declare a `tenancyStrategy` on its Definition (an archetype
+  preset — `internal` / `tenant-isolated` / `end-user-isolated` — expanding into
+  two orthogonal axes, data scope × credential authority, plus a per-scope
+  assurance floor). At the execution-pipeline seam the strategy is expanded
+  (populating `dataScope` / `credentialAuthority` on `ResolvedTenancyContext`) and
+  a **lock-down gate** runs **pre-engine**: a locked-down resource is rejected
+  (403) when the resolved tenancy lacks a required scope or sits below the declared
+  assurance floor — never silently run against the global scope. This is the first
+  consumer of increment 3's graded `assurance`, so a web-embedded `client-token`
+  dispatch of an `end-user-isolated` agent correctly **fails closed** (graded
+  `anonymous`) until an Identity Exchange can raise it to `verified`.
+
+  Scope is the **agent** resource (authorable via the agent create/update/ensure
+  config, the FPO inline-agent config, and the SDK — content-hashed so `ensure`
+  tracks it). Enforcement is at the pipeline seam (single-turn agent dispatch /
+  `:id/execute` / product-chat / client-token). The multi-turn loop executor and
+  the background schedule/eval executor — neither of which resolves per-execution
+  tenancy yet — apply a **fail-closed** backstop: a locked-down agent is refused
+  there rather than run global. Resources with no strategy behave identically to
+  today (the headline invariant). Flow-resource strategies, the config-bearing
+  tenant overlay, elicitation surfaces, full loop/background enforcement, and
+  ResumeState scope persistence are forward-stated follow-ups (the scoped-data
+  increment).
+
+## 5.2.3
+
+### Patch Changes
+
+- 346f947: Run workspace type-checking on the TypeScript 7 native compiler (`tsgo`, from `@typescript/native-preview`). The per-package `typecheck` / `type-check` scripts now invoke `tsgo --noEmit` instead of `tsc --noEmit` (~5x faster across the workspace). This is a type-check-only change: `typescript` stays pinned at `^6.0.3` for builds, lint, and codegen — whose compiler-API consumers (tsup `.d.ts` emit, typescript-eslint, ts-morph) are not stable on the 7.x API until ~7.1 — so no package's runtime behavior or emitted types change. The `typecheck:native` benchmark harness is updated to stay version-agnostic (it derives the `tsc` baseline for `--compare`), `@typescript/native-preview` is bumped to the latest tracked build, and the orphaned `@runtypelabs/system-product-generator` package's stray `typescript@^5.9.3` pin is aligned to `^6.0.3`.
+
+## 5.2.2
+
+### Patch Changes
+
+- c09b0af: Agent Sandbox (Phase 1): give a hosted agent a Linux computer via five `builtin`
+  tools — `bash`, `read_file`, `write_file`, `edit_file`, `expose_port` — injected
+  at dispatch when `agent.config.sandbox.enabled` and the `enable-agent-sandbox`
+  Flagship flag is on. The agent acts as if it is already inside the machine; the
+  container is provisioned lazily on the first sandbox tool call. Phase 1 ships the
+  `runtype-sandbox` provider with `ephemeral` persistence behind the flag.
+
+  The egress posture defaults to a curated, versioned, single-sourced `essentials`
+  network profile (language registries, OS mirrors, GitHub) enforced at the single
+  DO egress proxy — bounded, not open. The runtime is untouched: the tools route
+  through the existing injected `ToolExecutor`, and all
+  provisioning/network/billing lives API-side (ADR 0010). `bash`/`read_file`/etc.
+  do not appear in tool discovery (injected, not catalog-selected).
+
+## 5.2.1
+
+### Patch Changes
+
+- 9a77df1: Subagent HITL approval propagation (runtime Claude Managed path). When a Claude Managed subagent's child agent calls a tool that requires approval, the runtime now pauses for a human instead of swallowing the request into an opaque subagent tool failure. The Claude Managed bridge no longer converts a child tool's `ApprovalRequiredError` into an `is_error` result — it re-raises it; `runSubagent` forwards the parent's approval policy (`require` / `approvedTools` / `deniedTools`) into the child and enriches the propagating error with subagent attribution, so the parent agent loop emits a single `agent_approval_start`. The `agent_approval_start` / `approval_start` SSE events gain an optional `subagent` attribution object (`toolName`, `agentName`) so an approval UI can render "subagent X wants to run tool Y". On resume the parent re-dispatches the subagent with the now-approved tool, which proceeds. Attribution is UX context only — no code branches on it. (api virtual-flow / Claude Managed subagent paths are tracked as a gated follow-up.)
+
+## 5.2.0
+
+### Minor Changes
+
+- 049bcf9: Surface nested flow-as-tool attribution on the unified SSE stream via `text_start.parentToolCallId` and `reasoning_start.parentToolCallId`.
+
+  When a flow runs as a tool, the server enriches its streamed prompt text and reasoning with the parent model tool-call id (`toolContext.toolId`). The unified (Persona 4.0) translator previously dropped that enrichment, so the nested flow's text and thinking were flattened into the parent execution's channels with no way to attribute them. The unified `text_start` and `reasoning_start` events now carry an optional `parentToolCallId` (matching `tool_start.toolCallId`): a consumer maps a block's `id` to its `parentToolCallId` and routes the nested streamed text/thinking into the parent tool's row instead of the top-level assistant message. Additive and optional — top-level (non-nested) text/reasoning omits the field.
+
+## 5.1.0
+
+### Minor Changes
+
+- 82d897c: Two follow-ups to the unified SSE cutover:
+
+  **Single public SSE schema name.** Rename the OpenAPI component `UnifiedSSEEvent`
+  → `ExecutionStreamEvent` (and the SDK's canonical `UnifiedStreamEvent` type →
+  `ExecutionStreamEvent`), so the published spec / Fern API reference / SDK types
+  expose a single, neutrally-named SSE event union with no "unified vs legacy"
+  framing. The internal Zod source keeps its `unified*` names; `DispatchEvent` /
+  `AgentStreamEvent` remain deprecated aliases of the renamed type, and the
+  legacy `FlowSSEEvent` component stays registered (no route reference) so the
+  SDK's FlowBuilder convenience types keep resolving.
+
+  **Per-step token usage in the unified stream.** Add an optional `tokensUsed`
+  field to the unified `step_complete` event and forward it through the edge
+  translator, restoring the per-step token count on surfaces that moved to the
+  unified vocabulary (e.g. the dashboard flow-builder test-step result).
+
+### Patch Changes
+
+- 97a3431: Normalize remaining dashboard dispatch SSE consumers and flow-tool execution streams for the unified SSE default.
+
+## 5.0.0
+
+### Major Changes
+
+- 44779c1: Remove phantom prompt-execution surfaces that targeted server routes which never existed (`POST /prompts/{id}/run` and `POST /prompts/{id}/run-on-record`): drops `prompts.run()` / `PromptRunner` / `PromptRunOptions` and `PromptsEndpoint.runOnRecord()`. These methods always 404'd; use `dispatch()` to execute a prompt step instead.
+
+## 4.21.0
+
+### Minor Changes
+
+- b43088f: Make the unified SSE event vocabulary the default for streaming responses.
+
+  Every execution stream (`/v1/dispatch`, `/v1/agents/{id}/execute`, the client
+  chat/resume routes, and the dispatch resume/approve routes) now emits the
+  unified 33-event vocabulary by default. The OpenAPI spec and generated SDK types
+  document the unified `UnifiedSSEEvent` union only; the legacy `AgentSSEEvent` /
+  `DispatchSSEEvent` components are removed (`FlowSSEEvent` is retained solely for
+  the not-yet-ported eval stream).
+
+  The wire vocabulary is resolved per request by `resolveSseEventFormat`:
+  1. an explicit `?events=unified` / `?events=legacy` query param wins;
+  2. otherwise the `X-Persona-Version` header negotiates (v4.0+ → unified, an older
+     announced version → legacy, so deployed pre-4.0 widgets are protected);
+  3. otherwise the new `default-sse-event-format` Cloudflare Flagship flag (enum
+     `unified` | `legacy`, code default `unified`) decides — targetable by
+     environment, organization, user, or surface so a cohort can be rolled back to
+     the legacy vocabulary during the surgical rollout.
+
+  The engine continues to emit legacy frames internally; they are translated to
+  the unified vocabulary at the stream edge.
+
+### Patch Changes
+
+- 4bef8db: Port the Python SDK (`runtype-sdk`) to consume the unified SSE event vocabulary
+  as its only wire format. Every streaming request opts into `?events=unified` and
+  the SDK parses the unified 33-event vocabulary natively (no legacy parsers, no
+  translation layer). The hand-written event models, the SSE dispatch, the
+  local-tool pause/resume collector, and the `FlowResult` / `FlowSummary`
+  accumulation are all rewritten to the unified events.
+
+  This is a breaking change to the Python SDK's streaming surface (`runtype-sdk`
+  4.0.0): the legacy `agent_*` / `flow_*` event models are replaced by the unified
+  models (`UnifiedEvent` union), `StreamCallbacks` exposes one callback per unified
+  event type (and is the single surface for flow + agent, with `AgentStreamCallbacks`
+  as an alias), and `FlowSummary.execution_time` becomes `duration_ms`. The npm
+  `@runtypelabs/sdk` (TypeScript SDK) is unchanged; this entry exists to record the
+  Python SDK change in the release pipeline.
+
+- 2b788c7: Port the TS SDK's hand-written SSE runtime parsers to the unified 33-event
+  vocabulary. The dispatch and agent execution streams (`/dispatch`,
+  `/dispatch/resume`, `/agents/{id}/execute`, `/agents/{id}/resume`) now request
+  `?events=unified` and reverse-translate the unified frames back to the SDK's
+  existing legacy event shapes, so the public `StreamCallbacks` /
+  `AgentStreamCallbacks` surface is unchanged. The translators are tolerant of a
+  legacy stream too (pass-through), keeping the SDK safe during the server-side
+  rollout. Still-legacy producers (`/prompts/{id}/run`, the eval stream,
+  `/tools/{id}/execute`) are untouched.
+
+## 4.20.0
+
+### Minor Changes
+
+- 3fdf801: FPO config-as-code PR3 — `pull-fpo` + `prune`, closing the whole-FPO round-trip.
+  - **`GET /v1/products/pull-fpo?name=…`** (SDK `products.pullFpo(name)`) reconstructs
+    a self-contained Full Product Object from the live product graph — the absorb-drift
+    direction of `ensure-fpo`. It composes the existing per-entity pulls (product,
+    backing flows/agents, surfaces) and mints deterministic FPO-local ids, so feeding
+    the result back into `ensure-fpo` converges to `unchanged`. records/schedules/secrets
+    are not reconstructed and `tools` is emitted empty (tool refs are portable
+    `tool:<name>`); per-pull caveats are surfaced in `warnings`.
+  - **`prune` (opt-in)** on `POST /v1/products/ensure-fpo` (SDK `ensureFpo(fpo, { prune })`):
+    after the converge passes, removes product-scoped `product_capabilities` / `product_surfaces`
+    (and their `product_surface_items`) absent from the FPO. Account-scoped flows/agents/tools/records
+    are NEVER touched; `createPolicy: 'skip'` entities are kept. Adds a `pruned` per-entity
+    result; with `dryRun`, would-be removals are reported as `pruned` plan rows without deleting.
+
+## 4.19.2
+
+### Patch Changes
+
+- d5b9f87: Normalize client identity + version advertisement across all Runtype SDKs/clients.
+
+  Every first-party client now sends a consistent `X-Runtype-Client: <kind>` header
+  plus a `runtype-<kind>/<version>` `User-Agent`, so the API can attribute traffic by
+  client and version (`detectActorSource` in `audit-log.ts`):
+  - **JS/TS SDK (`@runtypelabs/sdk`)**: previously sent no attribution at all — now
+    defaults to `X-Runtype-Client: sdk` + `User-Agent: runtype-sdk/<version> (typescript)`
+    (version inlined at build via tsup `define`). Caller-supplied headers still override,
+    so the CLI's `runtype-cli/<version>` wrapping is unaffected.
+  - **Python SDK**: now sends `X-Runtype-Client: sdk` + `User-Agent: runtype-sdk/<version> (python)`
+    on both the ergonomic client and the generated `.api` surface. The version is resolved
+    from installed distribution metadata via `importlib.metadata` (single source: `pyproject.toml`).
+  - **MCP (`@runtypelabs/mcp`)**: now advertises `X-Runtype-Client: mcp` +
+    `User-Agent: runtype-mcp/<version>` (the headers were previously gated on a client
+    kind that no call site ever set, so the MCP server sent no attribution at all).
+  - **Code Mode MCP**: now versions its proxy `User-Agent` (`Runtype-CodeMode/<version>`),
+    keeping the exact prefix casing the Analytics Engine dashboard filters on.
+
+  The `runtype-sdk/` prefix is shared by both SDKs (it's what the API parses); the
+  TypeScript vs Python distinction rides in the standard User-Agent comment
+  (`(typescript)` / `(python)`). The CLI already advertised identity + version and is
+  unchanged.
+
+- 6d5ba51: Harden WebMCP page-tool handling against indirect prompt injection (Chrome WebMCP security guidance / OWASP LLM01):
+  - **Spotlight untrusted tool output.** Output from `origin: 'webmcp'` page tools (and any tool a page flags with the new `untrustedContentHint`) is now wrapped in a randomized-nonce delimiter envelope before the model reads it, so the model treats contaminated third-party data as data, not instructions. Verbatim output is unchanged in ResumeState, `{{toolName_result}}` variables, and the SSE stream.
+  - **Cap untrusted output size** at 64KB (truncated with a visible marker) to prevent context/token-exhaustion via an unbounded page-tool result.
+  - **Cap `clientTools[]` descriptions at 2KB** to close the malicious-manifest / tool-poisoning vector (hidden instructions in an oversized description).
+  - **Add `untrustedContentHint`** to the inline client-tool wire schema so a page can mark an `sdk`-origin tool's output as untrusted.
+  - Strengthen the dashboard assistant's safety prompt to recognize the spotlight envelope and treat tool names/descriptions as untrusted data.
+
+## 4.19.1
+
+### Patch Changes
+
+- cd7b402: Refresh default models for new accounts. The global default model is now
+  `kimi-k2.6` (a reasoning + tool-use + vision model already trusted as the
+  product-generator default) instead of the tagless 9B `qwen/qwen3.5-9b`. Bumped
+  flagship tiers to the current generation and dropped the superseded versions:
+  `gpt-5.4` → `gpt-5.5`, `claude-opus-4-6` → `claude-opus-4-8`, `qwen/qwen3.5-9b`
+  → `qwen/qwen3.6-27b`, `qwen3.5-plus` → `qwen3.6-plus`, and added
+  `gemini-3.5-flash` and `nemotron-3-ultra-550b-a55b`. Dropped the grok tiers and
+  `nemotron-3-120b-a12b` from the auto-enabled set. Cheaper tiers with no newer
+  equivalent (`gpt-5.4-mini`, `gpt-5.4-nano`, `gemini-3-1-flash-lite`,
+  `gemini-3.1-pro`, `claude-sonnet-4-6`) are unchanged.
+
+  Kept in sync with the new default: the `prompts.model` column default (migration
+  `0077`), the agent-facing model-selection guidance in `knowledge-fragments.ts`,
+  and the regenerated OpenAPI spec / SDK types (the `create_prompt` / `update_prompt`
+  `model` default).
+
+## 4.19.0
+
+### Minor Changes
+
+- 9efb803: Marathon playbooks: opt-in `fallbackOnEmpty` to recover from empty (text-less)
+  model output.
+
+  Set `fallbackOnEmpty: true` on a milestone (or at the playbook top level as a
+  default) to make that milestone's `fallbackModels` chain also fire when the model
+  finishes successfully but returns no visible text — the "thinking model spends its
+  whole budget reasoning and answers nothing" failure — instead of only on errors.
+  It attaches the execution engine's existing `empty-output` fallback trigger to the
+  agent `errorHandling` the marathon writes. Off by default (never automatic) and
+  only effective when `fallbackModels` is configured; the playbook loader warns when
+  it is enabled without a fallback chain. No API change.
+
+- 9efb803: Marathon: support per-session `maxTokens` and `temperature` overrides for the
+  **primary** model, settable from the CLI (`--max-tokens` / `--temperature`) and
+  in playbooks (per-milestone fields plus top-level defaults).
+  - API: `POST /v1/agents/:id/execute` now accepts request-level `temperature` and
+    `maxTokens`, merged into the agent config before `buildVirtualFlow` (mirrors the
+    existing `model` / `systemPrompt` overrides). Out-of-range values are ignored.
+  - SDK: `RunTaskOptions`, `AgentExecuteRequest`, and `WorkflowMilestoneConfig` gain
+    optional `temperature` / `maxTokens`; the marathon runner threads them into each
+    session's execute request.
+  - CLI: resolves both per phase with precedence per-milestone playbook value >
+    global CLI flag > playbook top-level default.
+
+  Previously only a fallback model could carry a `maxTokens`, so a "thinking"
+  primary model that spent its budget reasoning could return no tool call and stall
+  the run with nothing to show.
+
+### Patch Changes
+
+- e96edad: feat(products): ensure-fpo PR2 — converge surfaces, records, schedules, secrets, and capability-as-tool composition
+
+  Extends `POST /v1/products/ensure-fpo` (and SDK `products.ensureFpo()`) beyond the PR1 product → capability-backing graph to converge the rest of the Full Product Object:
+  - **Surfaces + surface items**: each `fpo.surfaces[]` converges via the product-scoped surface-ensure service (behavior `{ type, ...config }`), and route → `product_surface_items` join rows reconcile against the converged capabilities. Integration-backed types (slack/telegram/discord) reserve a pending integration once, on first create only (idempotent; `inbound` stored raw and excluded from the content hash).
+  - **Records**: `fpo.records[]` reconcile by tenant `(type, name)` with merged metadata (mirrors the assembler's `onConflictDoUpdate`).
+  - **Schedules**: `fpo.schedules[]` reconcile by `(owner, backing flow/agent, triggerType)` with update-in-place (never orphan — an orphaned schedule keeps firing). A within-FPO duplicate `(capabilityId, triggerType)` guard keeps the identity unambiguous.
+  - **Secrets**: tool `auth.setupRequired` secret bindings + product-level `fpo.secrets[]` materialize via the (now shared) assembler helpers. The route additionally requires `SECRETS:WRITE` — but only when the FPO actually carries secrets, so secret-free callers keep working with `PRODUCTS:WRITE` alone.
+  - **Capability-as-tool composition**: `capability:<id>` toolIds and `capabilityToolRefs[]` now materialize as flow-backed tools (converged by name via tool-ensure) with the agent ref rewritten to the portable `tool:<name>` form before the agent converges. The PR1 rejection guard is removed. Backing converges in two passes (flows then agents) so a composition target resolves regardless of FPO order.
+
+  The per-entity report (`entities[]`) gains `tool` / `surface` / `record` / `schedule` kinds. Still NON-atomic and self-healing on re-run; whole-FPO fast-probe, `pull-fpo`, and `prune` remain deferred to PR3.
+
+## 4.18.0
+
+### Minor Changes
+
+- 266280e: Add whole-FPO config-as-code converge: `POST /v1/products/ensure-fpo` + `products.ensureFpo()`.
+
+  Converges an entire Full Product Object (the nested product graph) in one shot by fanning out to the
+  existing per-entity ensure services in dependency order (product → capability backing flows/agents →
+  capability link rows), threading FPO-local refs to real identities and returning a per-entity report.
+  NON-atomic by design: a per-entity failure is reported (not thrown) and a re-run self-heals.
+
+  This first release converges product + capability backing flows/agents + capability links. Surfaces,
+  records, schedules, `fpo.tools` secret bindings, capability-as-tool composition, the whole-FPO
+  hash-only fast-probe, `pull-fpo`, and opt-in `prune` are deliberately deferred to follow-ups (such
+  capabilities are reported as `failed`/`skipped` in the per-entity report). Adds the canonical
+  `computeFpoContentHash` to `@runtypelabs/shared` (with an inlined SDK copy pinned by a shared parity
+  corpus).
+
+## 4.17.1
+
+### Patch Changes
+
+- 408e8f4: Enable conditional revalidation (instant-lists part 4) for the Agents list, the
+  root deferred from part 3. The canonical first page of `GET /agents` now supports
+  HTTP conditional GET: it returns a weak `ETag` and `304 Not Modified` when the
+  caller's `If-None-Match` still matches, skipping the page query. The dashboard
+  sends the prior ETag when warming/revalidating the Agents list, so a navigation or
+  reload where nothing changed costs a single `304` with no body and keeps the warm
+  seed on screen.
+
+  The agents list `lastRunAt` is a correlated `MAX(agent_executions.created_at)` per
+  agent rather than an `agents` column, so the change token folds that cross-table
+  max in (via a new additive `freshnessExpressions` option on the shared
+  `evaluateListConditional` helper). This means a new agent run busts the cache and
+  the "Last run" cell never goes stale behind a `304` — a deliberate trade that
+  lowers the `304` hit rate for actively-running accounts in exchange for
+  correctness. See `docs/features/planning/2026-06-14-list-conditional-revalidation.md`.
+
+- fee4239: Extend conditional revalidation (instant-lists part 3) to the Records, Tools, and
+  Schedules lists. The canonical first page of `GET /records`, `GET /tools`, and
+  `GET /schedules` now supports HTTP conditional GET: each returns a weak `ETag`
+  (`COUNT` + `MAX(updated_at, ...)`) and `304 Not Modified` when the caller's
+  `If-None-Match` still matches, skipping the page query entirely. The dashboard
+  sends the prior ETag when warming/revalidating these lists, so a navigation or
+  reload where nothing changed costs a single `304` with no body and keeps the warm
+  seed on screen. Schedules folds `next_run_at`/`last_run_at` into the freshness MAX
+  (the scheduler writes them without bumping `updated_at`); records/tools need no
+  extra freshness columns. The conditional path is gated to the truly unfiltered
+  canonical page on both sides — any filter/search/cursor or non-default page size
+  falls back to a plain GET.
+
+  The Agents list is intentionally deferred to a follow-up: its `lastRunAt` is a
+  correlated subquery over the executions table rather than an `agents` column, so a
+  token over `agents` alone would 304 after a new run and leave "Last run" stale.
+  See `docs/features/planning/2026-06-14-list-conditional-revalidation.md`.
+
+## 4.17.0
+
+### Minor Changes
+
+- 83e5921: Conditional revalidation for the Flows list (instant-lists part 2). The canonical
+  first page of `GET /flows` now supports HTTP conditional GET: it returns a weak
+  `ETag` (`COUNT` + `MAX(updated_at)`) and `304 Not Modified` when the caller's
+  `If-None-Match` still matches, skipping the page query entirely. The dashboard
+  sends the prior ETag when warming/revalidating the Flows list, so a navigation or
+  reload where nothing changed costs a single `304` with no body and keeps the warm
+  seed on screen. Adds `RuntypeClient.getConditional()` to the SDK. Other primary
+  lists and detail-shell seeding are fast-follows (see
+  `docs/features/planning/2026-06-14-list-conditional-revalidation.md`).
+
+## 4.16.0
+
+### Minor Changes
+
+- 46624dc: Add config-as-code `ensure` for skills (admin/control plane). New `POST /v1/skills/ensure` (idempotent hash-first converge: create the skill or append a new version when the canonical manifest hash differs; `release: 'publish'` publishes the converged version) and `GET /v1/skills/pull` (canonical definition + provenance, the absorb-drift direction). Identity is name + account scope; the content hash (`computeSkillContentHash`) covers the manifest with the frontmatter `name` excluded. Ensure is the admin-plane `create_skill` path — API scopes only (`SKILLS:WRITE`/`SKILLS:*`), no review queue, no proposal row — distinct from the deployed-agent `propose_skill` data plane. Adds `configHash` / `lastModifiedSource` / `lastSdkSyncAt` provenance columns on `skills`, a `skill_ensure_locks` scoped-name serialization table, and the SDK surface `defineSkill` + `skills.ensure()` / `skills.pull()`.
+- 845d81b: Add config-as-code `ensure` / `pull` for surfaces. New product-scoped endpoints
+  `POST /v1/products/{id}/surfaces/ensure` and `GET /v1/products/{id}/surfaces/pull`
+  idempotently converge a repo-defined surface onto a product (identity is
+  productId + name) using the shared hash-first ensure protocol — hash-only probe,
+  `definitionRequired` miss, 422 content-hash-mismatch, 409 conflict, and `dryRun`
+  planning. Surfaces have no version snapshots (release `none`), so there is no
+  publish option. The SDK gains `Runtype.surfaces.ensure(productId, def)` /
+  `Runtype.surfaces.pull(productId, name)` and `defineSurface`. Credentials in
+  `inbound` / `outbound` are sealed before write and the content hash is computed
+  over the plaintext form so probes stay stable across pulls.
+- 45aaaa7: Add cross-session "Always allow" persisted tool-approval grants. A remembered tool
+  approval now persists server-side, keyed to (owner, agent, end-user) with an
+  account-level fallback, so the human-in-the-loop prompt is skipped automatically on
+  future dispatches for that tool. Enabled per-agent via `approval.choices.alwaysAllow`
+  (default off) and revocable from the dashboard. Skill-load approvals
+  (`toolType === 'skill'`) are excluded, and a grant only short-circuits the approval
+  prompt — tool resolution, ownership scoping, and secret access are unaffected
+  (approval ≠ authorization).
+- 3396ef1: Tighten context-step `errorHandling` validation to object-only (errorHandling v2, leg 4)
+
+  Flow create / update / ensure / validate now reject the legacy bare-string
+  `errorHandling` shorthand (`'fail' | 'continue' | 'default'`) on context steps,
+  along with the deprecated `'default'` onError alias. Clients must send the object
+  form `{ onError: 'fail' | 'continue' | 'fallback' }` (which the dashboard, SDK,
+  templates, and AI generators have emitted since the leg-2 convergence).
+
+  This is a deliberate, low-risk breaking change to the flow-authoring contract:
+  30-day production telemetry (`Flow ErrorHandling Written`) showed inbound
+  string-form context writes came 100% from one internal smoke-test account, with
+  zero organic customer traffic.
+
+  The SDK (`@runtypelabs/sdk`) context-step builders now type `errorHandling` as the
+  object form only (`ContextErrorHandling`), so the now-rejected bare-string form is
+  caught at compile time instead of surfacing as a runtime 400. Prompt-step builders
+  still accept the string shorthand.
+
+  The runtime is unchanged: the replay normalizer still tolerates the string and
+  `'default'` forms, so immutable historical flow versions keep executing, and
+  `/dispatch` (which does not run this validator) is unaffected. Prompt-step
+  `errorHandling` uses its own richer schema and is out of scope.
+
+- f9b537d: Add Agent Skill scan verdicts (warnings vs errors).
+
+  Introduces a deterministic two-tier verdict layer over SkillSpector findings: a
+  `warning` when a skill _appears_ malicious (low–medium confidence) and an
+  `error` when it is high-confidence malicious or matches an always-block category
+  (credential exfiltration, prompt injection, MCP tool poisoning, data
+  exfiltration, privilege escalation).
+  - `@runtypelabs/shared`: `deriveSkillScanVerdict()` + the confidence × severity
+    matrix, hard-block categories, and the scanner-Worker RPC contract types
+    (`SkillScanRequest` / `SkillScanResponse`). Pure and single-sourced so the API,
+    dashboard, and scanner Worker share identical thresholds.
+  - New `runtype-skill-spector` Worker app wraps `@runtypelabs/skill-spector` in
+    its own bundle (off the API's bundle budget) and exposes a `scanSkill` RPC.
+  - `@runtypelabs/api`: `scanSkillManifest()` client that serializes a manifest to
+    its canonical SKILL.md, calls the scanner over the optional
+    `SKILL_SPECTOR_SCAN` binding, and fails closed when the scanner is
+    unavailable. Includes a `dev:bun` in-process stub for parity.
+  - `@runtypelabs/api`: `POST /v1/skills/scan` ("scan before save", no persist/
+    gate) + the `scanSkillManifest` client over the optional `SKILL_SPECTOR_SCAN`
+    binding (staging-bound; fails closed when absent). Dev:bun in-process stub.
+  - `@runtypelabs/sdk`: `skills.scan(markdown)` returning the verdict.
+  - `@runtypelabs/dashboard-spa`: a "Security scan" affordance + verdict banner
+    (green clean / amber suspicious / red blocked, with a findings list) in the
+    skill editor.
+
+  Publish/bind gating and scan persistence remain sequenced follow-ups, and the
+  production scanner binding is added once the production scanner Worker is
+  deployed (worker-first ordering).
+
+## 4.15.0
+
+### Minor Changes
+
+- 0dcd669: Add config-as-code `ensure`/`pull` for products. `POST /v1/products/ensure` idempotently converges a repo-defined product (create-or-update by name + account scope, hash-first probe protocol) and `GET /v1/products/pull` returns the canonical definition + provenance (the absorb-drift direction). The SDK gains `Runtype.products.ensure`/`Runtype.products.pull` plus `defineProduct`, mirroring the tool ensure surface.
+
+  Scope (v1): the converge covers the top-level product record only — `description`, `icon`, and the `spec` (ProductSpec: identity / stack / internal docs). The canonical content hash (`computeProductContentHash` in `@runtypelabs/shared`) excludes `name` (identity) and `canvas` (architecture-viewer UI layout state). Nested capabilities/surfaces/tools/records/schedules are not converged. Like tools, products have no version snapshots, so there is no publish option.
+
+  Adds `config_hash` / `last_modified_source` / `last_sdk_sync_at` provenance columns to `products` and a `product_ensure_locks` table for scoped-name serialization (migration `0071`).
+
+## 4.14.0
+
+### Minor Changes
+
+- fec3688: feat(api): per-turn systemPrompt + clientTools on POST /v1/agents/:id/execute
+
+  Unblocks config-as-code migration (ADR 0003) for agents whose defining state is
+  per-turn dynamic — the Dev Mode and Dashboard assistants rebuild their system
+  prompt every turn (embedding the flow being edited / page context) and the
+  Dashboard assistant's entire tool surface arrives as browser `clientTools[]`.
+  They can now be referenced by saved-agent id instead of dispatched fully inline.
+  - **`systemPrompt` override** (#4398): optional request-level override, applied to
+    the loaded agent config before `buildVirtualFlow` (covers both the loop and
+    non-loop paths), mirroring the existing `model` / `reasoning` overrides.
+    Request-scoped, never persisted. Trusted-server-proxy-only.
+  - **`clientTools` passthrough** (#4399): optional request-level WebMCP / SDK local
+    tools, admitted through the SAME seam dispatch uses and threaded via
+    `executionMetadata.clientTools` (api prompt-executor merge, precedence
+    `saved < runtimeTools < clientTools`; stays off the runtime package).
+  - **Shared admission seam**: extracted `admitApiKeyClientTools` in
+    `runtime-tools-utils.ts`. `POST /v1/dispatch` is refactored onto it
+    (behavior-preserving), pinned by a `.claude/review/touchpoints.yaml` row.
+  - **SDK parity**: `AgentExecuteRequest` (`@runtypelabs/sdk`) gains `systemPrompt`,
+    `clientTools`, and `clientToolsPolicy`, mirroring its existing `model` /
+    `reasoning` overrides and the `DispatchRequest` contract.
+
+  Also adds `maxTokens` to the `FpoAgentRuntimeConfig` public type snapshot (the v2
+  inline-agent `config` mirror), with a new `FpoAgentRuntimeConfig ↔
+agentRuntimeConfigSchema` parity guard so the hand-maintained mirror can no longer
+  drift silently. Docs: `guide-runtime-tools.mdx` updated — `clientTools[]` /
+  `clientToolsPolicy` are now accepted on both `/v1/dispatch` and
+  `/v1/agents/:id/execute`.
+
+- 26c393c: feat(agents): make `maxTokens` a savable agent config field
+
+  `maxTokens` is now part of the canonical agent runtime config surface
+  (`agentRuntimeConfigSchema`), so it can be set via `createAgent`, `updateAgent`,
+  and the config-as-code `ensure` protocol (`defineAgent({ maxTokens })`), persisted
+  on the agent row, and included in the content hash. Previously it was an unknown
+  key, silently stripped on write — agents that need a fixed output budget (e.g. the
+  Product Generator pinning `24000` for a "thinking" default model) could not save it.
+
+  The execution wiring already consumed `config.maxTokens` (mapped onto the virtual
+  flow's prompt step, defaulting to `16384` when unset), so saving it is all that was
+  required for it to take effect. No per-request route override is added — a fixed
+  token budget is a static property of the agent definition.
+
+## 4.13.1
+
+### Patch Changes
+
+- 8bffeb2: Internal, tenant-scoped asset offload for inbound conversation media.
+
+  Large inline media (base64 images / file attachments) on inbound conversation
+  message writes can now be offloaded to internal, tenant-scoped R2 storage and
+  replaced with a small `asset_ref` reference in the persisted JSONB, then
+  rehydrated back to bytes at model-execution time. Internal assets are resolved
+  **server-side only**, gated on the authenticated caller's tenant — they are never
+  exposed via a public or signed URL.
+  - `AssetStorageService` gains a `visibility: 'internal'` mode and a
+    tenant-checked `getInternal()` getter; `assets.public_url` is now nullable.
+  - New authenticated, tenant-scoped serve route `GET /v1/internal-assets/{assetId}`.
+  - Offload-on-write is gated behind the `enable-asset-offload` flag (off in
+    production by default). Rehydration is always-on and a no-op when no references
+    are present, so toggling the flag never strands data.
+  - Shared offload/rehydrate primitives live in `@runtypelabs/model-execution`
+    (`offloadInlineMediaInMessages`, `rehydrateAssetReferences`,
+    `AssetReferenceContent`) and are wired into both the api and runtime prompt
+    executors from the single shared implementation (no api↔runtime drift).
+
+## 4.13.0
+
+### Minor Changes
+
+- 04db6c7: Generalize config-as-code name-based resolution from tools to **agents and
+  flows**: reference a saved agent or flow from a portable `defineAgent` /
+  `defineFlow` definition by name with the new `agent:<name>` and `flow:<name>`
+  forms — the agent/flow analogue of the shipped `tool:<name>`.
+
+  Three reference sites are covered:
+  - an `execute-agent` flow step's `config.agentId` → `agent:<name>`
+  - a saved subagent runtime tool's `config.agentId` → `agent:<name>`
+  - a flow-as-tool runtime tool's `config.flowId` → `flow:<name>`
+
+  The name is canonical (hashed and persisted), and resolves to a concrete row at
+  execute time, every dispatch — ownership-scoped, oldest-wins on duplicate names —
+  so the same definition converges to the same content hash across environments
+  even though the underlying agent/flow ids differ. All three surfaces already
+  loaded the **live row** by id at execution (no published-version indirection), so
+  name resolution loads the same live row.
+
+  Highlights:
+  - Reserved `agent:` / `flow:` reference prefixes with
+    `isNamedAgentRef` / `parseNamedAgentRef` / `formatNamedAgentRef` (and the flow
+    trio) in `@runtypelabs/shared`. They coexist with the `{{flow:X}}` template
+    **variable** namespace, which is a separate grammar (only meaningful inside
+    `{{…}}`).
+  - **Ensure/validation time** (including `dryRun`): an `agent:<name>` / `flow:<name>`
+    that resolves to zero rows (missing) or more than one (ambiguous) is a hard
+    `400` per reference path (`AGENT_NOT_FOUND` / `AGENT_NAME_AMBIGUOUS` /
+    `FLOW_NOT_FOUND` / `FLOW_NAME_AMBIGUOUS`) via the flow-validator account-scoped
+    pass.
+  - **Execution time**: names resolve oldest-wins with a structured warn for
+    missing/ambiguous; a turn is never failed over reference quality. Wired into the
+    execute-agent step handler, subagent dispatch, and the flow-as-tool executor.
+  - Raw `agent_…` / `flow_…` ids stay rejected on the ensure surface. This also
+    **closes a pre-existing portability hole**: the agent and flow ensure scans now
+    cover saved-subagent / flow-as-tool runtime-tool refs and an `execute-agent`
+    step's top-level `config.agentId`, none of which were scanned before.
+  - `pull` reverse-maps raw `agent_…` / `flow_…` references to their name forms so a
+    dashboard-built definition round-trips; references that can't safely round-trip
+    (deleted, or name-shadowed by an older same-named row) are left as raw ids and
+    reported in the existing `warnings` field.
+
+  Note: agents and flows have no "active/callable" gate (unlike tools), so
+  resolution is over all rows in scope and ambiguity is simply "≥2 rows share the
+  name". See `docs/features/planning/2026-06-13-ensure-name-based-agent-flow-resolution.md`.
+
+- 7ea7ece: Layer 3 of the variable-namespace re-architecture: a prompt dispatched to the model with a surviving `{{...}}` token is now an observable signal, not just a buried server log.
+  - A new optional `unresolvedVariables: string[]` field on the `step_complete` SSE event (canonical Zod in `sse-event-schemas.ts`, flowing to the OpenAPI spec + generated TS/Python SDK types). Prompt steps populate it (and telemetry) when template substitution left any reference unresolved — sourced from the engine's `missingVariables`, which already includes unknown-namespace tokens. Non-fatal: the step still runs.
+  - The api prompt-executor's previously warn-only "missing variables" path now threads the unresolved names onto the wire + telemetry, and logs a clearer message.
+  - The portable runtime engine emits the same field on its own `step_complete` (threaded through `PromptStepResult` → `StepLifecycleComplete` → the flow-stream emitter) and warns to the console — api↔runtime parity, not just the api.
+
+  This is the execute-time catch-all that surfaces the original `{{flow:topic}}` foot-gun on the first dispatch regardless of static coverage.
+
+### Patch Changes
+
+- 3a162cc: Marathon ledger unification (increment 3): gate provider-native compaction prediction on the masked send view.
+
+  `buildNativeCompactionEvent` previously decided whether to announce a provider-native (Anthropic-side) compaction by comparing `breakdown.estimatedInputTokens` — the **true pre-mask** conversation size — against the auto-compact threshold. But provider-native compaction is performed by Anthropic, which only ever sees the **masked send view** (hot-tail offload has already shrunk old tool outputs before the request leaves the SDK). Gating on the larger pre-mask size made the SDK emit `start`/`complete` compaction lifecycle events for compactions the provider never performed.
+
+  The predictor now gates on `breakdown.sendEstimatedInputTokens ?? breakdown.estimatedInputTokens` (the send view's size, falling back to the true size when no masking reduction happened — the two are equal then). The event payload still reports the true pre-mask numbers (`estimatedTokens` / `beforeTokens`) for honest accounting display.
+
+  SDK-only; no wire-contract or behavior change for `summary_fallback` compaction. (Anchoring the provider-native summary in the durable ledger and fixing the latent compaction-summary leak in `stream-helpers.ts` are deferred to a follow-up increment — see the planning doc.)
+
+- ee6f248: Harden record metadata key normalization (P0.6). Keys that normalize to a reserved prototype name (`constructor`, `prototype`, `__proto__`) or to an empty string are now rejected at every write seam (create, update, bulk-edit, CSV import) with a `METADATA_RESERVED_KEY` 400 (CSV reports the offending row and continues). Collision renames that were previously silent are now surfaced as `warnings: [{ code: 'KEY_RENAMED', from, to }]` on the create/update/bulk-edit/CSV responses. Also fixes a latent false-collision bug where the collision check traversed `Object.prototype` (now built on a null-prototype accumulator). The SDK's `records.create()` / `records.update()` now return `RecordWriteResponse` and `BulkEditResponse` carries an optional `warnings` field so typed consumers can read the rename notices.
+
+## 4.12.0
+
+### Minor Changes
+
+- d895f91: Add name-based tool resolution to the config-as-code (`ensure`) surface:
+  reference a saved tool from a portable `defineAgent` / `defineFlow` definition by
+  its name with the new `tool:<name>` form (e.g.
+  `toolIds: ['builtin:web-search', 'tool:My Scraper']`).
+
+  The name is canonical: it is what gets hashed and persisted, and it resolves to a
+  concrete tool row at execute time, every dispatch (ownership-scoped, oldest-wins
+  on duplicate names) — so the same definition converges to the same content hash
+  across environments even though the underlying tool ids differ. Raw `tool_…` ids
+  stay rejected on the ensure surface (they are environment-bound); the rejection
+  message now points at `tool:<name>`.
+
+  Highlights:
+  - `tool:` is a reserved tool-ref prefix; `separateToolIds` gains a `namedToolIds`
+    bucket. Helpers `isNamedToolRef` / `parseNamedToolRef` / `formatNamedToolRef`
+    live in `@runtypelabs/shared`.
+  - **Ensure/validation time** (including `dryRun`): a `tool:<name>` that resolves
+    to zero tools (missing) or more than one (ambiguous) is a hard `400` per
+    reference path — the breakage surfaces at converge time in CI, not as a silent
+    dispatch-time drop. Agent path in `agent-ensure-service`; flow path via the
+    flow-validator account-scoped pass (which also fixes a pre-existing gap: the
+    flow ensure scan now covers a `tool-call` step's top-level `config.toolId`).
+  - **Execution time**: names resolve oldest-wins with a structured warn for
+    missing/ambiguous; a turn is never failed over reference quality. Wired into
+    the prompt-executor, code-step tool resolver, and tool-call executor.
+  - `requiresApproval` accepts the `tool:<name>` form (matching the saved tool's
+    name; the decision is still made on tool name + parameters only).
+  - `pull` reverse-maps raw `tool_…` references to `tool:<name>` so a
+    dashboard-built definition round-trips; references that can't safely round-trip
+    (deleted, or name-shadowed by an older same-named tool) are left as raw ids and
+    reported in a new `warnings` field on the pull response.
+
+  Note: named resolution is ownership-scoped (org-shared via `ownershipFilter`),
+  intentionally broader than the legacy by-id custom-tool load in the
+  prompt-executor (`eq(userId)`) — see the planning doc's open question #3. The
+  by-id load's narrower scoping is left unchanged here to avoid a broad
+  behavior change.
+
+- 2392c5e: Hide the Agents Subdomains surface (`/v1/agents-subdomains`) from the published
+  schema surface until GA. The routes stay mounted and runtime-gated by the
+  `enable-agents-subdomains` Flagship flag, but they are now excluded from the
+  public OpenAPI spec, the generated TypeScript SDK types, the Python SDK, and
+  Fern docs.
+
+  This adds a build-time, declarative hidden-surface list
+  (`HIDDEN_PUBLIC_PATH_PREFIXES` in `apps/api/src/lib/openapi/registry.ts`) that
+  the OpenAPI generator applies only to the PUBLIC document (the same code path as
+  `INTERNAL_TAG`, but keyed by path prefix so a whole feature can be hidden with
+  one entry). The internal/admin spec still records the surface. Because the
+  generator is deterministic and CI-drift-gated, hiding cannot depend on the
+  runtime flag; this is a static exclusion that leaves runtime behavior unchanged.
+
+  Two customer-facing surfaces that the build-time spec exclusion can't reach are
+  also gated at runtime by the same flag:
+  - `GET /v1/api-keys/options` (which feeds the dashboard API-key scope picker) now
+    omits the `AGENTS_SUBDOMAINS:*` / `:READ` / `:WRITE` scopes when the flag is off
+    for the caller, so the feature isn't advertised there.
+  - OAuth-minted MCP keys no longer include `AGENTS_SUBDOMAINS:*` until GA.
+
+  To un-hide the surface when it's ready, remove its entry from
+  `HIDDEN_PUBLIC_PATH_PREFIXES`, regenerate the spec + SDKs, re-add
+  `AGENTS_SUBDOMAINS:*` to `MCP_OAUTH_PERMISSIONS`, and drop the
+  `AGENTS_SUBDOMAINS` entry from `KNOWN_EXCLUDED` in
+  `tests/mcp-oauth-minted-scope.test.ts`. (The `/v1/api-keys/options` picker
+  un-hides automatically once the flag is on.)
+
+- 4cfef88: Marathon ledger unification (increment 1): route SDK hot-tail tool-output offloads through one artifact store.
+  - SDK: new `offloadRecorder` option on `RunTaskOptions` (and exported `RunTaskOffloadRecorder` type). When supplied, `offloadToolResult` delegates persistence to the recorder and splices its reference into the send view instead of writing to the unledgered `.runtype/marathons/<slug>/tool-outputs/` fallback. The SDK still owns the offload decision (its inline threshold); the recorder owns storage. Declining (returning `undefined`/throwing) falls back to the built-in store, so non-marathon and browser consumers are unchanged.
+  - CLI: supplies a recorder backed by the existing content-addressed ledger store (`offloadToolOutput`), so the 500–100k char band becomes a first-class ledger citizen (content-addressed `art_<sha256>`, hashed, `read_offloaded_output`-resolvable, deduped, on-timeline) instead of a separate unledgered store.
+  - CLI: fix the per-offload `loadTreeLog` reload — `recordOffloadedArtifact` now appends through a shared head accessor (`getOrLoadTreeLogSync`) so artifact entries land on-chain at the live head instead of as sibling stubs off a stale, disk-reloaded head, and offload cost is O(1) rather than O(tree-log size).
+
+- 04dc52c: Plan-tiered preview TTL and preview expiry extension.
+
+  `publish_page` preview pages now expire based on the account's plan instead of a uniform 7 days: the new `htmlPreviewTtlSeconds` billing entitlement (Schematic feature "HTML Preview TTL Seconds") is resolved at publish time, with -1 meaning permanent (no expiry) and a fail-closed 7-day default when unset or unreachable. The TTL is snapshotted at upload, so plan changes never retroactively expire existing URLs.
+
+  New `POST /v1/assets/:assetId/extend` endpoint re-ups a preview page's expiry to the caller's current plan TTL at the same URL — including previews that have already expired (expired pages keep their stored content; only serving is blocked). Exposed through the Runtype MCP server as the `extend_asset_expiry` tool, gated by the new `ASSETS:WRITE` API-key scope.
+
+  Callers can also choose a custom lifetime: `publish_page` accepts an optional `expiresInSeconds` parameter and the extend endpoint an optional `{ expiresInSeconds }` body (`expires_in_seconds` on the MCP tool). The plan TTL is a hard ceiling — shorter lifetimes are honored, longer requests are clamped, and permanence can never be requested (only granted by a permanent-plan entitlement).
+
+- 6f6dd80: Extend config-as-code `ensure`/`pull` to the **tools** entity. Adds `POST /v1/tools/ensure` (idempotent, hash-first create-or-update by name + ownership) and `GET /v1/tools/pull` (round-trippable canonical definition + provenance), built on the shared `ensure-protocol` decision core used by agents and flows.
+  - **SDK**: `defineTool`, `Runtype.tools.ensure(def, opts)`, and `Runtype.tools.pull(name)` with `expectNoChanges` drift gating and `onConflict` handling. The inlined content hash is parity-pinned against `@runtypelabs/shared` via a shared fixture corpus.
+  - **Shared**: `computeToolContentHash` / `normalizeToolDefinition` over `{ toolType, description, parametersSchema, config }` (name is identity, excluded from the hash).
+  - **Provenance**: `ensure` writes stamp `lastModifiedSource: 'sdk'` on the tool. Both dashboards render a "Managed in code" badge and a save-warning dialog when editing a code-managed tool.
+
+  Tools have no version snapshots, so (unlike agents/flows) there is no `release: 'publish'` option and no `versionId` in the response.
+
+### Patch Changes
+
+- cf9eae0: Add the Runtype Apps index page to the dashboard (SPA): a Tier-1 list view to create apps, manage details (name, description, visibility), suspend/resume, delete, and browse version history with activate/rollback. The nav entry and route are gated behind the `enable-runtype-apps` flag via a new `features.enableRuntypeApps` field on `GET /v1/users/profile` (fail-closed in production), so a flag-off account never sees Apps. Regenerated OpenAPI spec and SDK types follow the new profile field.
+- 6c475fe: Close record-tool surface-parity gaps (P0.7): expose already-existing `/v1/records` API capabilities on the client surfaces that lacked them.
+  - MCP: add the `delete_record` tool (input schema, schema-map registration, destructive tool definition, execution handler, and `deleteRecord` on the `RuntypeClient` interface + both implementers).
+  - Code-Mode MCP: add `deleteRecord(id)` → `DELETE /v1/records/:id` to the executor and code-spec overlay.
+  - SDK: add `records.getStepResults(id, params?)` → `GET /v1/records/:id/step-results` and `records.getCosts(id)` → `GET /v1/records/:id/costs` to `RecordsEndpoint`.
+  - CLI: add `records results <id>` and `records costs <id>` subcommands routed through the SDK.
+
+## 4.11.0
+
+### Minor Changes
+
+- e7a7c22: Default marathon workflow adopts the stall-policy and write-rule primitives (Phase 2). The default workflow now ships `stallPolicy: { nudgeAfter: 1, escalateModelAfter: 2, stopAfter: 3 }`, so a session that ends without any tool calls gets a corrective nudge on the very next session, a second actionless session signals model escalation (consumed when a fallback model is configured), and the run stalls on the third as before. The research and planning guards become trace-aware: once the plan file is written, product writes unlock in the same session instead of being blocked until the phase advances between sessions, confined by the same write-target rules execution enforces (modify allowlist, creation `outputRoot`), now shared via one helper. Creation tasks are also told about the `outputRoot` confinement in the planning instructions and execution tool guidance instead of discovering it through blocked writes.
+- e7a7c22: Add workflow stall policy and richer marathon playbooks. WorkflowDefinition gains an optional `stallPolicy` (`nudgeAfter` / `escalateModelAfter` / `stopAfter`) keyed on the consecutive-empty-sessions counter, so narration-only sessions trigger a recovery nudge, a model-escalation signal (`state.stallEscalationRequested`), or a configurable stall threshold instead of silently dying after 3 empty sessions. Playbooks can now declare per-milestone `recovery` messages (triggered on the same stall counter), `transitionSummary` strings, and a top-level `stallPolicy`; policy blocks also compile into model-facing tool guidance so enforced constraints (write globs, outputRoot, plan-first) are stated to the model instead of silently blocking it. The CLI consumes the escalation signal by restarting the marathon on the milestone's next `fallbackModels` entry, and surfaces playbook authoring warnings (e.g. no milestone sets `canAcceptCompletion: true`) at load time. Default (non-playbook) marathon behavior is unchanged.
+- e7a7c22: TypeScript playbooks. Marathon playbooks can now be `.ts`/`.mts` modules, loaded at runtime via jiti (no Node version or transpile-step requirements) from the same search paths as YAML/JSON. Every workflow config behavior slot (instructions, tool guidance, completion criteria, recovery, transition summaries, intercepts, force-end-turn, accept-completion, classify/bootstrap/candidate-block) now accepts a plain function in addition to inline data and hook references, so TypeScript playbooks express custom logic directly without registry ceremony; `definePlaybook(...)` is exported from the SDK as optional type-inference sugar. A module playbook's default export is either a config object or a factory receiving the injected `{ registerWorkflowHook }` API for named-hook registration. Load failures, missing default exports, and non-config exports fail with actionable errors naming the playbook path.
+- e7a7c22: Workflow hook registry and the default marathon workflow as data (Phase 3). The SDK gains a named hook registry (`registerWorkflowHook` with a reserved `builtin:` namespace, slot-kind validation, and actionable load-time errors) and an environment-free `compileWorkflowConfig` that turns declarative workflow configs into `WorkflowDefinition`s, with glob matching injected via deps. The default workflow's behaviors (classification, bootstrap discovery, per-phase instructions/guards/recovery/completion heuristics) are now registered as `builtin:*` hooks and composed by an exported `defaultWorkflowConfig` compiled through the same function — so playbooks and the default share one compile path and a user playbook can reuse or override any slice of the default by hook name. The CLI playbook loader delegates compilation to the SDK and adds: hook references in every behavior slot (`instructions: builtin:research-instructions`, `completionCriteria: { type: acme:my-completion }`), per-milestone `intercept`/`forceEndTurn` slots, and a `plugins:` field that loads JS modules (confined to the playbook's directory) which register custom hooks via an injected `registerWorkflowHook` API. `loadPlaybook` is now async. Compiled output for the default workflow is behavior-identical (pinned by the existing workflow test suite).
+
+### Patch Changes
+
+- 713e743: Add the `chrome_extension` product surface type: a downloadable Manifest V3 Chrome extension that embeds the product's agent (vendored Persona widget) in the browser side panel with packaged browser tools (read page, fill forms, navigate tabs) executed through the native WebMCP client-tool loop. The dashboard assembles the ZIP client-side, pins a stable extension ID via the manifest `key` field, and converges the surface's client token allowlist and `behavior.webmcp` policy on download. The WebMCP surface-policy gate now admits `chrome_extension` behaviors alongside `chat`.
+
+## 4.10.0
+
+### Minor Changes
+
+- ad2dd30: Agent config-as-code: `POST /v1/agents/ensure` (non-executing, hash-first idempotent converge with dryRun planning, onConflict/release policies, and 409/422 conflict detection), `GET /v1/agents/pull` (canonical definition + provenance), SDK `defineAgent` + `client.agents.ensure/pull`, shared `computeAgentContentHash` canonical serializer, and `configHash`/`lastModifiedSource` provenance columns on agents (all non-ensure write paths now stamp their source).
+- 90a4707: Enrich `GET /v1/skill-proposals` listings with the underlying skill + proposed
+  version manifest. Each item now carries two additive, optional fields —
+  `skill: { id, name, description, status } | null` and
+  `version: { id, versionNumber, manifest: { frontmatter, runtype, body } } | null`
+  — so the review queue can show reviewers WHAT they are approving. A skill body is
+  instructions injected into another agent's context, and the `runtype` block
+  carries the proposed capability bindings (flows, agents, tools, MCP servers,
+  inline tools) — the most security-relevant part of an approval decision — so
+  blind approval defeated review-by-default governance. Both fields are `null` only when the underlying
+  skill/version row was deleted out from under the proposal (the listing degrades
+  gracefully via a LEFT JOIN rather than 500-ing), and are entirely absent on
+  older API servers — consumers must tolerate them being `undefined`. The SDK's
+  `SkillProposal` interface gains the matching optional `skill?` / `version?`
+  fields.
+- 7027149: Flow config-as-code: `POST /v1/flows/ensure` (non-executing, hash-first idempotent converge with dryRun planning, onConflict/release policies, and 409/422 conflict detection) and `GET /v1/flows/pull` (canonical definition + provenance), built on a generic ensure decision core shared with the agent ensure service. SDK gains `defineFlow` + `client.flows.ensure/pull`; `flows.upsert()` is unchanged and documented as the execute-flavored sibling (save-and-run) of the deploy-time ensure verb. The dashboards' flow integration-code generators add an "Ensure Flow (config-as-code)" example (defineFlow + flows.ensure snippet and the `/v1/flows/ensure` HTTP request) alongside the existing upsert example, whose copy now distinguishes save-and-run from converge. Adds the `flow_ensure_locks` scoped-name serialization table and a flow content-hash parity fixture corpus shared by the SDK and `@runtypelabs/shared`.
+- f07ceb8: Add marathon context-ledger artifact plumbing, derive tool-result context views without mutating saved history, and enable session context recall by default.
+- 7d398a2: Mid-session hard abort for marathon (Esc Esc). The SDK's `runTask` and `executeWithLocalTools` accept an `abortSignal` that cancels the in-flight SSE stream and ends the run gracefully (cost and tokens preserved, state persisted, status `paused`/resumable). In the marathon TUI, pressing Esc twice while the agent works interrupts the turn, restores any queued steering messages and composer draft into the checkpoint input, and lands at a "stopped" checkpoint where Enter exits or new instructions continue the task.
+- 92c6ae3: Marathon context ledger: window-base compaction and persistence fixes.
+
+  SDK: compaction now records a send-window base (`RunTaskState.contextWindowBaseIndex`). After a compaction, sessions send `[stored summary, messages since base, continuation]` and only re-compact when that window itself re-crosses the threshold — previously every post-threshold session re-summarized the whole task and dropped all recent raw turns from the send. The persist path appends exactly the new continuation message per session, fixing duplicated (and fidelity-degraded) history once replay trimming made the send view shorter than the source. Send-view derivation no longer deep-clones the full history per send, and hot-tail offload skips rewriting files that already exist. Offload reference markers now live in a shared `offload-markers` module with locale-pinned size formatting.
+
+  CLI: tree-log delta checkpoints no longer re-embed compaction summary text on every save (summary ledger entries are the durable copy; materialization and `/tree` navigation rebuild them from the chain). Repeated offloads of identical output record one artifact entry. `read_offloaded_output` verifies content against the recorded sha256 and warns on mismatch. Tools rebuilt after a `/tools` or sandbox checkpoint change keep their offload wrapping. The unused artifact GC stub (which would have deleted still-readable legacy offload files) was removed.
+
+- 518018a: Replace Helicone with [models.dev](https://models.dev) as the build-time source of model metadata. The auto-generated catalog now carries real `contextLength`, `maxOutputTokens`, modalities, capability flags, knowledge cutoff, release date, and cached-token pricing — replacing the previous name-pattern estimates. Vercel AI Gateway stays authoritative for pricing.
+
+  New optional `ModelConfig` fields (all surfaced via `@runtypelabs/shared`): `knowledgeCutoff`, `releaseDate`, `inputModalities`, `outputModalities`, `supportsVision`, `supportsToolUse`, `supportsReasoning`, `inputCacheReadCostPer1kTokens`, `inputCacheWriteCostPer1kTokens`. These populate only on the verbose lazy-loaded catalog (`apps/api/src/lib/model-catalog/generated-metadata.ts`, a separate Wrangler module); the hot-path `generated-configs.ts` tuple format is unchanged so the main Workers bundle does not grow.
+
+  The `pnpm update-models` script also gains a disappearance classifier that aborts when a `DEFAULT_MODELS_FOR_NEW_ACCOUNTS` entry vanishes from upstream without being in `RETIRED_MODELS` / `DEPRECATED_MODELS`, preventing silent breakage of new-account onboarding.
+
+  Tag vocabulary is normalized on `'tool-use'` for tool-calling capability (matching Vercel AI Gateway passthrough tags and the model-advisory validator), and the dashboard "tools" capability filter now matches it. The `'playground'` tag (previously emitted from Helicone's `show_in_playground`) is no longer generated — no consumer read it.
+
+- 6ecce93: Runtype Apps increment 1, PR 3: agent + developer deploy surfaces. Adds six MCP tools (`create_app`, `deploy_app_version`, `activate_app_version`, `list_apps`, `get_app`, `delete_app`) on both MCP servers (standard + Code Mode `runtype.*` methods), an SDK `client.apps` endpoint (incl. raw-zip `uploadVersion` and JSON `uploadVersionFiles`), a `runtype apps` CLI command family (`create`, `deploy <dir>`, `list`, `versions`, `activate`, `delete`), a JSON `{ files, filesBase64 }` upload variant on `POST /v1/apps/:id/versions` (the API zips server-side for surfaces that cannot stream binary bodies), and the `build-runtype-app` agent skill.
+- c7bad37: Cursor pagination for the Agent Skills list. `GET /v1/skills` now accepts `cursor`, `limit`, `direction`, and `includeCount` query params and returns the standard `pagination` envelope alongside `data` (additive; the status filter still works with cursors). The TypeScript SDK adds `skills.listPage()` for the full `{ data, pagination }` envelope while `skills.list()` keeps returning the plain array, and the dashboard Skills tab pages through skills with the standard cursor pagination footer.
+- 6e53e7f: Use typed model capability flags instead of tag/name heuristics. `GET /v1/model-configs/grouped` now returns `supportsVision`, `supportsToolUse`, and `supportsReasoning` per group (derived from the typed ModelConfig flags populated by the models.dev pipeline, with capability tags as fallback for tag-only sources, OR-merged across a group's provider entries). The dashboard add-model capability filters and the settings page tools/reasoning filters read these flags (tags remain a fallback), replacing the hand-coded provider/model-name heuristics. The model-advisory `MODEL_CAPABILITY_MISMATCH` checks also accept the typed flags.
+
+### Patch Changes
+
+- df3a66d: Dashboard provenance guardrail for config-as-code agents: agents whose live config was last converged from a code definition (`lastModifiedSource: 'sdk'`, stamped only by `POST /v1/agents/ensure`) now show a "Managed in code" badge in the agent editor and edit slide-over, and saving dashboard edits to such an agent asks for confirmation first (the next deploy may overwrite the edit). Also documents the existing `lastModifiedSource` and `configHash` response fields in the agent detail/mutation OpenAPI schemas (they were already on the wire via the row spread).
+- 2bb37c4: Skill proposal review enrichment: `GET /v1/skill-proposals` now resolves the manifest's capability IDs (flows, agents, tools) to tenant-scoped names via `resolvedCapabilityNames`, and resolves the proposing execution to the authoring agent via `proposingAgent`. IDs that do not resolve inside the reviewer's account are surfaced with a null name as a review signal instead of being dropped. The dashboard proposals queue renders the named capability grants inline (with a "Not found in this account" flag for unresolved IDs) and shows the proposing agent's name in place of the raw execution typeid.
+- 4e3999f: Dashboard SPA build-time cuts and hygiene: skip the duplicate shared build during Workers Builds installs (SKIP_PREPARE=1), env-gate tsup .d.ts generation (TSUP_SKIP_DTS=1, set by the SPA build:cf scripts), disable Vite's gzip-size report pass, switch shiki to the fine-grained core bundle with the JavaScript regex engine and an explicit grammar set in both dashboards (~274 fewer emitted chunks, no oniguruma wasm), restore the SPA ESLint baseline to the legacy dashboard's effective rule set, wire up the SPA vitest suite, and make the SDK's stream-utils import style consistent to silence Rollup's mixed static/dynamic import warning.
+
+## 4.9.0
+
+### Minor Changes
+
+- 96ec88a: Mid-run steering queue for marathon (Pi-style): press Enter while the agent is working to open a composer and queue a steering message. Queued steers end the in-flight session at the next local-tool pause and are delivered at the start of the next session; Tab toggles delivery to "after all work" (follow-up). `runTask` gains additive `getQueuedUserMessages` / `hasQueuedUserMessages` options.
+
+## 4.8.1
+
+### Patch Changes
+
+- 15b4a2f: Add a native Granola integration. Connect Granola from Settings > Integrations by pasting a `grn_` API key (verified live against Granola's public API before storage). Agents, flows, and transform-data code steps gain five read-only `builtin:granola:*` tools (list/get meeting notes, transcript, folders, and bounded client-side search). Ships a "New Granola Meeting Notes" flow template that pairs with a schedule to poll for new or updated notes using the `{{_schedule.lastRunAt}}` cursor with overlap. SDK types regenerated for the new `/v1/integrations/granola/install` endpoint.
+
+  Granola credential resolution is explicit-only: each `builtin:granola:*` tool instance must name its credential in `toolConfigs[toolId]` (`GranolaToolConfig`) as either `apiKey` (a `{{secret:NAME}}` reference to a secret holding a `grn_` API key, enabling per-tenant keys; literal keys are rejected) or `integrationId` (pin one connected workspace, the explicit way to use the account's connected Granola). There is no silent fallback to the org's workspace, so adding a Granola tool can never unintentionally expose the whole org's meeting corpus.
+
+- 698edda: Regenerated OpenAPI types: the GET /v1/logs/stats response schema now documents the existing cachedAt field (string when served from the 30s stats cache, null for fresh responses).
+
+## 4.8.0
+
+### Minor Changes
+
+- 8aeda2c: Add internal builder docs to the FPO/template model
+
+  Templates and products can now carry non-user-facing builder documentation that
+  captures intent: why a template is shaped the way it is, design choices, best
+  practices, and implementation notes.
+  - New shared `internalDocsSchema` (`content` markdown body, `tags` for indexing,
+    and a forward-compatible `resources` array seeding a broader template
+    knowledge/resource system). Added to the FPO `product` object and the
+    FPO-template top level.
+  - Persisted on `products.spec.internalDocs` and accepted by the products
+    create/update routes (`null` clears it).
+  - Editable from the product edit panel in the architecture viewer. The field is
+    intentionally excluded from the agent-facing public type snapshots, so it is
+    not exposed in end-user surfaces by default.
+
+### Patch Changes
+
+- 982da6c: Agent-supplied approval reasons. When a tool call requires approval, the engine now injects a reserved optional `_approvalReason` parameter into the model-visible tool schema so the agent can justify the call. The value is stripped before the tool executes and surfaced to the approver as `reason` on `agent_approval_start` / `step_await` events, in Slack/Telegram approval prompts, and in the dashboard approval card. Enabled by default for approval-gated tools; opt out with `tools.approval.requestReason: false`. Tools that already define `_approvalReason` in their own schema are left untouched.
+
+## 4.7.1
+
+### Patch Changes
+
+- 2c12987: Close six SSE contract-field gaps surfaced by a new drift audit (same class as `step_complete.stopReason`): fields emitted on the public wire (and read by consumers) that the canonical SSE schema omitted, so the public OpenAPI components and generated SDK types under-represented the stream. All additions are optional, so existing frames still validate.
+  - `step_start.outputVariable` — the step output-variable name the dashboard reads to unwrap the `{ [outputVariable]: <rendered> }` envelope at render time.
+  - `flow_complete.flowName` — emitted by the API raw-write paths; now declared for wire-superset parity with `flow_start`.
+  - `agent_error` / `agent_reflection` / `agent_skill_loaded` / `agent_skill_proposed` `.timestamp` — the runtime `AgentEventEmitter` injects an ISO timestamp on these events; reconciled into the shared schema per the runtime↔shared wire-contract rule.
+
+  Regenerates the public/internal OpenAPI spec and the generated TS + Python SDK types. Adds a `contract-field-drift-hunter` agent that audits the API surface for this drift class.
+
+## 4.7.0
+
+### Minor Changes
+
+- 5d3eada: Harden flows Dev Mode SDK code generation against drift by deriving parser and completions from SDK metadata and adding SDK builder coverage for all generated step methods.
+- 6730e12: Complete the public SSE/OpenAPI contract for Persona Runtype streams (#3975):
+  - Add the optional `stopReason` field (`end_turn` | `max_tool_calls` | `length` | `content_filter` | `error` | `unknown`) to the canonical `step_complete` SSE schema, so the public `FlowSSEEvent` component and generated SDK types document the model finish reason that prompt steps already emit on the wire.
+  - Re-export stable public stream-event aliases (`DispatchEvent`, `FlowStreamEvent`, `AgentStreamEvent`, `StreamEventOf`) from the SDK barrel, tied to the generated OpenAPI components so they drift only with the public spec.
+  - Add public OpenAPI coverage for the remaining browser client-token runtime endpoints — `POST /v1/client/init`, `POST /v1/client/resume` (SSE), and `POST /v1/client/feedback` — reusing the runtime validation schemas so the docs and implementation cannot drift.
+
+### Patch Changes
+
+- 6efd928: Fix a race in `/client/chat` interrupt handling where a slower, older request could reclaim the active turn slot from a newer interrupting turn. `markClientChatTurnStarted` now claims the slot with a compare-and-swap on the turn's arrival timestamp (captured at request entry), so a stale request whose write lands late can no longer restore its turn id and defeat the interrupt.
+
+## 4.6.1
+
+### Patch Changes
+
+- cf15960: Improve dashboard responsiveness with persisted safe query caching, lazy analytics loading, optimistic list actions, and batched product editor context loading.
+
+## 4.6.0
+
+### Minor Changes
+
+- e7eefe0: Agent memory: thread `endUser` identity through the dispatch / agent-execute / SDK surface so templates like `{{_endUser.id}}` resolve for per-end-user memory sharding (distinct from `_user`, the Runtype account holder). `endUser` is exposed as `{{_endUser.*}}` in template variables on both the agent and flow execution paths, and is carried into the memory profile resolution so multi-tenant SaaS callers can shard long-term memory per end-user. Also persists agent `config.memory` on create/update and adds the agent-editor memory config state plumbing.
+
+## 4.5.0
+
+### Minor Changes
+
+- 55eb091: Add agent self-service coverage for OpenAI-compatible (BYOK) model endpoints across MCP, the SDK, and Code Mode. Agents can now connect a custom OpenAI-compatible endpoint, discover its models, and register them without the dashboard.
+  - **MCP**: new `create_provider_key`, `list_provider_keys`, `update_provider_key`, `delete_provider_key`, `discover_provider_models`, and `sync_provider_models` tools, plus `create_model_config` extended to accept `provider: "generic-openai"` with a `base_url` and custom-model pricing/display fields (and normalizing the bare endpoint model id to the routed `generic-openai:` form the API expects). Mirrored across both MCP servers (`RuntypeApiClient` and `RuntypeInternalClient`) and Code Mode (`runtype.createProviderKey`, `discoverProviderModels`, `syncProviderModels`, etc.).
+  - **SDK**: new `client.providerKeys` endpoint (`create`, `list`, `update`, `delete`, `discoverModels`, `discoverModelsForKey`, `syncModels`); `CreateModelConfigRequest`/`CreateProviderKeyRequest`/`UpdateProviderKeyRequest` extended for `generic-openai`.
+  - These wrap existing BYOK-gated REST routes, so callers without the entitlement receive `402 BYOK_NOT_AVAILABLE`. Documentation updated for connecting an OpenAI-compatible endpoint via the API, MCP, and SDK.
+
+### Patch Changes
+
+- 3f65083: Derive the `provider` enum on `CreateProviderKeyRequest` and `CreateModelConfigRequest` from the generated OpenAPI types instead of hand-maintaining the unions. This fixes a real drift: the hand-written unions accepted `'huggingface'` (which the API rejects) and omitted valid providers such as `vertex`, `vertex-anthropic`, `bedrock`, `tinfoil`, `braintrust`, `weaviate`, `vectorize`, `browser-rendering`, plus `model`/`runtime`/`mock`/`modelsocket` for model configs. Type-only change; no runtime behavior change.
+
+## 4.4.0
+
+### Minor Changes
+
+- 59fd1b6: Remove the no-op `parallelCalls` tool-config flag (and the unused
+  `parallelToolCalls` field on `ToolsConfig`).
+
+  `parallelCalls` was accepted and plumbed through the dispatch schema, SDK,
+  MCP tool inputs, FPO schema, OpenAPI spec, config-merge, and runtime export,
+  but it was never applied at the provider level — no executor ever passed a
+  parallel-tool-use option to the model. Parallel tool calls therefore always
+  used (and continue to use) each provider's default, which is parallel-enabled
+  for current Claude/OpenAI/etc. models. Removing the dead config makes the
+  surface honest: it no longer implies you can toggle a behavior that the
+  platform never actually controlled.
+
+  Backward compatible at runtime: request schemas strip unknown keys, so an
+  older client that still sends `parallelCalls` is accepted unchanged (the key
+  is ignored, exactly as before). The only change is type-level — the field is
+  gone from the SDK and API types.
+
+## 4.3.0
+
+### Minor Changes
+
+- e133753: Add the optional `clientToolsPolicy` field to the SDK's `DispatchRequest` type.
+
+  Follow-up to allowing WebMCP `clientTools[]` on `/dispatch`: typed
+  `@runtypelabs/sdk` callers can now pass `clientToolsPolicy.allowlist` to
+  self-restrict which `origin: 'webmcp'` client tools are admitted, matching the
+  shared `DispatchRequestSchema`.
+
+### Patch Changes
+
+- 26401de: WebMCP: make parallel calls to the same local tool individually addressable on resume (core#3878, follow-on to #3870).
+
+  When a single model turn calls the same local tool more than once in parallel (the common "add A and B to my cart" case), the `flow_await` / `agent_await` / `step_await` events now carry a unique per-call `toolCallId` (the provider `tool_use` id). The `/resume` `toolOutputs` map can be keyed by that `toolCallId` so a client can resolve every pending call of one paused execution in a single resume, including multiple calls to the same tool. Keying by tool name still works (legacy contract; collapses same-tool parallel calls onto one slot). Resolution remains tolerant: outputs can arrive in any order across one or more `/resume` requests, and missing siblings re-pause.
+
+## 4.2.0
+
+### Minor Changes
+
+- 52091ac: Bump `@daytonaio/sdk` to `^0.184.0` and let the Daytona deploy path tag sandboxes with labels + opt into server-side reaping.
+  - **`@runtypelabs/sandbox`:** upgraded `@daytonaio/sdk` (`^0.27.1` → `^0.184.0`). Existing call sites (`create`/`get`/`delete`/`codeRun`/`executeCommand`/`getPreviewLink`/`setAutostopInterval`) remain compatible; we don't use the now-async-iterator `list()`. `DaytonaDeployOptions` gains optional `labels`, `autoStopInterval`, and `autoDeleteInterval`. Labels are applied at sandbox creation (new sandboxes only); `autoStopInterval` defaults to the existing 120 minutes; `autoDeleteInterval` (via `setAutoDeleteInterval`) is opt-in so callers can have leaked sandboxes self-reap.
+  - **`@runtypelabs/api`:** `POST /api/tools/sandbox/deploy` now accepts optional `labels`, `autoStopInterval`, and `autoDeleteInterval` and forwards them to the Daytona executor. Default behavior is unchanged when they're omitted. The executor guards both intervals with `Number.isFinite` so a non-number from the untyped request body falls back to the default instead of silently leaving the sandbox with no auto-stop.
+  - **`@runtypelabs/sdk`:** `DeploySandboxRequest` gains the same three optional fields so SDK/CLI callers can pass them in lockstep with the REST route.
+
+  This lets CI tag its Daytona sandboxes (e.g. `source: 'runtype-ci'`) for traceability and gives them a short auto-stop + immediate auto-delete so a killed run can't leak a live sandbox.
+
+- 0aa81ed: `runWithLocalTools` now resolves parallel local tool calls in a single pause/resume cycle (core#3870 follow-up).
+
+  When a model turn requests several local (client-side / WebMCP) tool calls at once — e.g. "search for X **and** add SKU Y" — the server emits a `flow_await`/`step_await` per call and its `/resume` accepts every output in one request. The SDK previously processed only the last paused tool per cycle (last-writer-wins), so N parallel calls took N pause/resume round-trips. Both `RuntypeClient.runWithLocalTools` and the FlowBuilder's `runWithLocalTools` now collect the whole batch (keyed by tool name, merging `flow_await` + `step_await`), execute every handler concurrently, and resume once with all `toolOutputs`. Single-tool turns are unchanged; the merge of partial `flow_await`/`step_await` context is preserved.
+
+## 4.1.0
+
+### Minor Changes
+
+- 88d04d6: Add `FlowBuilder.validate()` to the SDK (#10, slice 3 of the end-to-end
+  type-safety initiative — the SDK-facing consumer of the shared flow validator).
+
+  `new FlowBuilder()…validate(client)` (and the bound `runtype.flow(name)…validate()`
+  / `Runtype.flows.virtual()…validate()`) POSTs the prospective flow to the public
+  validation endpoint (`POST /v1/public/flows/validate`) WITHOUT creating it, and
+  returns the same `errors` / `warnings` / `recommendations` envelope the API,
+  dashboard, and MCP `validate_flow` tool use. Structural issues, the upsert-record
+  JSON foot-gun, undeclared-variable warnings, and sub-optimal model selections now
+  surface at author time rather than at dispatch time. Authentication is optional;
+  an authenticated client additionally runs account-scoped checks (referenced
+  tools / flows / agents must exist + be owned), reported via `result.context`.
+
+  Implemented as the API-backed option (slice-3 option a), so the SDK stays
+  **zero-dependency**: `validate()` reuses the client's existing `post<T>` transport
+  (no new HTTP plumbing). The return type (`FlowValidationResult`) and `FlowValidationIssue`
+  are **spec-derived** from `components['schemas']` in the generated OpenAPI types, so
+  they cannot drift from the API contract. New public exports: `FlowValidationResult`,
+  `FlowValidationIssue`, `FlowValidationClient`.
+
+  The `@runtypelabs/shared` bump is the regenerated `generated-sdk-reference.ts`
+  (the SDK reference auto-extracts the public API surface, so the two new `validate`
+  methods land in the MCP `runtype://types/sdk-reference` resource).
+
+- ac87cbe: Type `DispatchRequest.flow.steps` instead of `Array<any>`.
+
+  `flow.steps` is now `FlowStepDefinition[]`, a step shape derived from the
+  OpenAPI spec's `POST /v1/flows` request body, so its `type` discriminant is the
+  canonical `FlowStepType` union (the 26 `FLOW_STEP_TYPES` from
+  `@runtypelabs/shared`) rather than `any`. A malformed step — an unknown `type`,
+  or a non-object element — is now a compile error in `dispatch()` payloads and
+  the FlowBuilders. Two new public types are exported: `FlowStepType` and
+  `FlowStepDefinition`.
+
+  Because the type is spec-derived, it cannot drift from the API:
+  `pnpm generate:types` regenerates the underlying SDK types from the committed
+  spec and `generate:types:check` fails CI on drift. A new compile-time guard
+  (`flow-step-definition.type-assert.ts`, type-checked but not shipped) pins the
+  "malformed step is a compile error" contract so a future regression toward
+  `any` breaks the build.
+
+  Step `config` is still `unknown` at this layer (the API keeps step config loose
+  at the schema layer and validates it imperatively for rich, field-level agent
+  feedback). Compile-time per-type `config` typing — and typing the dispatch
+  request body directly in the spec — is the remaining follow-up (#12(a) of the
+  end-to-end type-safety initiative).
+
+  Dashboard (`patch`): three call sites that assemble dispatch payloads from
+  dynamically-typed flow data (`product-generator-agent.ts`, `ai-flow-assistant-flow.ts`,
+  `useStandaloneDispatchExecution.ts`) were updated to assert the SDK's narrowed
+  step shape at the wire boundary — type-only adjustments, no behavior change.
+
+  Classified **minor**, not major: the runtime/wire contract is byte-identical
+  (this is a compile-time-only tightening), `any` was an eslint-disabled escape
+  hatch rather than a real contract, every valid step payload still compiles, and
+  the primary consumers (`FlowBuilder` / `RuntypeFlowBuilder`) produce conforming
+  steps. Only step literals that were already invalid per the API contract (a
+  non-canonical `type`, a non-object element) become compile errors — the
+  intended safety improvement.
+
+### Patch Changes
+
+- 2711b97: Fix `flows.create()` step type: `CreateFlowRequest.flowSteps[].type` now uses the
+  spec-derived `FlowStepType` (the full canonical `FLOW_STEP_TYPES` set) instead of a
+  stale hand-written 5-value literal (`'prompt' | 'context' | 'condition' | 'output' |
+'email'`, 4 of which were never real step types). Real step types like
+  `'transform-data'` and `'conditional'` are now accepted, and the type is pinned by a
+  compile-time assertion so it cannot drift from the API spec again.
+- 84ab7da: Consolidate the three `validate()` implementations (`FlowBuilder`,
+  `ClientFlowBuilder`, `RuntypeFlowBuilder`) onto a single shared
+  `validateInlineFlow()` helper. The saved-flow-by-id guard, the
+  `POST /public/flows/validate` path, and the `{ name, steps }` body shape were
+  duplicated verbatim across `flow-builder.ts` and `flows-namespace.ts`; they now
+  share one implementation, so the validation contract can no longer drift between
+  the two surfaces. Behavior is identical — error messages are byte-for-byte the
+  same (each caller passes its own surface-specific remediation hint). Internal
+  refactor only; no public API change.
+
+## 4.0.4
+
+### Patch Changes
+
+- 2e3a776: Begin the converge-then-tighten path toward strict validation of steps nested
+  inside `conditional` branches (the last unmigrated step type, #6 capstone).
+
+  Leg 1 (non-breaking, measure-first):
+  - `setVariableConfigSchema` now accepts `value: null`, aligning the schema with
+    the runtime normalizer and executor (which already permit it). Clearing a
+    variable (`value: null`) is a legitimate idiom, commonly the else-branch of a
+    conditional. The SDK's `SetVariableStepConfig.value` type is widened to match.
+  - New read-only `Flow NestedStep Shape Written` PostHog event counts legacy
+    markers (snake_case configs, `set-variable value:null`, legacy `true_steps` /
+    `false_steps` branch keys, lenient envelopes, unknown types) on steps nested
+    inside conditional branches per flow write. This is the decay watch that gates
+    the eventual strict recursive-union tighten — no behavior change to what is
+    persisted or validated.
+
+  See `docs/features/planning/2026-06-04-conditional-nested-step-strict-validation.md`.
+
+## 4.0.3
+
+### Patch Changes
+
+- 8f11ab5: Normalize the generic REST request-validation error envelope. Every `.openapi()`
+  route now returns the same coded `{ code, message, path, suggestion? }` detail
+  shape (stable Runtype codes like `MISSING_REQUIRED_FIELD`, `INVALID_ENUM`,
+  `OUT_OF_RANGE`) instead of raw Zod issues, so REST/SDK callers get the same
+  enriched, machine-readable feedback that MCP previously had to reconstruct via
+  `enrichErrorForAgent`. The four `defaultHook` sites (shared `createOpenAPIApp()`
+  factory plus the hand-rolled product-api / quick-start / product-chat mappers)
+  now route through a single shared `validationErrorResponse` helper. The MCP
+  client now forwards the new `code` and `suggestion` fields through
+  `enrichErrorForAgent`, so MCP-surface agents receive the same coded feedback.
+- edf2b2a: Register the OpenAPI error envelope and four other high-duplication schemas as
+  shared `#/components/schemas/*` components, so routes emit one-line `$ref`s
+  instead of inlining the full object at every use site:
+  - `Error` — the 4xx/5xx error envelope (~1,291 copies → 1 definition)
+  - `Pagination` — the cursor envelope on every paginated list response (12×)
+  - `FlowValidationResult` / `FlowValidationIssue` — the flow-validation envelope
+    and its issue item (the issue appeared 36× = 12 results × 3 arrays)
+  - `RecordFilterCondition` — the record-filter `field/op/value` clause (12×)
+
+  Net: the committed spec artifacts shrink ~98k lines and the generated SDK types
+  shrink ~14k lines, exposing reusable `components['schemas']['*']` types.
+  Representation-only: runtime request/response bodies and documented shapes are
+  byte-identical (verified zero semantic diffs across all 1,773 public + 2,004
+  internal resolved schemas).
+
+## 4.0.2
+
+### Patch Changes
+
+- d4ca2dd: Correct `createExternalTool` JSDoc to stop documenting `{{_internal.auth_token}}`, `{{_internal.user_id}}`, and `{{_internal.org_id}}` as available auth variables. These `_internal.*` variables are never populated at runtime and are actively blocked by the execution engine; the docs now point users to secret references (`{{secret:NAME}}`) for credentials.
+
+## 4.0.1
+
+### Patch Changes
+
+- a7cb0d9: Add a `slow` fallback trigger: a per-model-call total wall-clock duration cap that fails a slow-but-not-stalled model call over to its configured fallback model. A model that streams continuously but slowly (e.g. ~24 tok/s) never trips the existing TTFT/idle stall watchdogs (an idle timer resets on every chunk), so a step can now opt in with `errorHandling.triggers: [{ type: 'slow', afterMs }]` (suggested default 45s) plus a `model` fallback.
+
+  The cap aborts-and-falls-over **only while the partial work is safely discardable**, gated two ways: it disarms permanently the moment a tool chunk passes (a side effect may have fired — re-running could double it), and, in a streaming-to-client dispatch, the moment a delta is flushed live (falling over would double-emit). In a non-streaming (`streamResponse: false`) dispatch the buffered partial is discardable, so the cap can fire mid-generation — the case it exists for. A duration-cap abort skips the same-model retry and routes straight to the configured fallback (a slow model is likely slow again).
+
+  `withModelCallResilience` gains optional `maxDurationMs` / `streamingToClient` / `isToolChunk` (off by default — fully opt-in, zero change to existing calls) and a `duration_cap` `ModelStreamStallError` phase. The runtime honors the trigger too, but with no Layer-2 fallback chain a cap abort surfaces as a clean `StepExecutionError`. The flow validator rejects a `slow` trigger with a non-positive `afterMs` (`SLOW_TRIGGER_INVALID_AFTER_MS`), and the error-handling editor preserves a saved slow trigger's `afterMs` across save.
+
+## 4.0.0
+
+### Major Changes
+
+- 55d5817: SDK: alias four more entity types to the generated OpenAPI types, and remove a dead endpoint.
+
+  **Breaking (types only — runtime behavior unchanged):** `Surface`, `ScheduleRun`, `ProviderApiKey`, and `BuiltInTool` now re-export from the committed OpenAPI spec instead of hand-mirrored interfaces, so they reflect what the API actually returns:
+  - `ProviderApiKey.id` is now `string` (was `number`); `provider` widens from a literal union to `string`; `keyPreview`/`lastUsedAt` become `| null`; gains optional `settings`.
+  - `BuiltInTool.category` widens from a literal union to `string`; gains optional `modelCompatibility`; `parametersSchema` is an opaque object.
+  - `ScheduleRun` gains `totalRecords`/`processedRecords`/`failedRecords` and drops its `[key: string]: unknown` index signature.
+  - `Surface.inbound` is now a typed (Slack) object rather than `Record<string, unknown>`.
+
+  Consumers reading dropped/renamed fields were already getting `undefined` at runtime; the types now match the wire.
+
+  **Breaking:** removed `tools.getExecutions()` and the exported `ToolExecution` type. They called `GET /tools/{id}/executions`, which has **no route handler** and 404s in production. The never-mounted dashboard `ToolExecutionHistory` component and its API test (which asserted the nonexistent route) are removed alongside.
+
+- 89b107f: feat(sdk): alias Flow/FlowStep/Tool from the OpenAPI spec; fix flow + tool response-schema drift
+
+  Continues the OpenAPI codegen swap (after #3645/#3665). Three coupled changes that all touch `entities.ts` + the regenerated spec + SDK `types.ts`:
+  - **Flow phantom fix (API spec accuracy):** the flow `GET`/`LIST`/`POST` response schemas advertised a `status` field the handlers stopped returning (removed in #3404), and the shared detail schema carried a `draftVersionId` that only the `PUT` handler returns. Removed `status` everywhere and split a dedicated `UpdatedFlowResponseSchema` (`FlowDetailSchema.extend({ draftVersionId })`) for the update route so `GET`/`POST` no longer promise it.
+  - **Tool schema split:** `GET /v1/tools/{id}` never attaches `validation` (only create/update/convert do, when custom-tool code produces warnings). Split `ToolDetailSchema` (base, GET) from `ToolWithValidationSchema` (create/update/convert).
+  - **SDK aliases:** `Flow`, `FlowStep`, and `Tool` are now `paths[...]`-derived from the generated spec instead of hand-written interfaces. Added a `FlowListItem` alias for the lighter `GET /v1/flows` list item and retyped `flows.list()` to `PaginationResponse<FlowListItem>` (it was incorrectly typed as the detail shape). `FlowListItem` is named to avoid colliding with the flow-execution `FlowSummary` already exported by `flow-builder.ts`.
+
+  This is a **major** bump for `@runtypelabs/sdk` because the generated shapes are looser/more accurate than the old interfaces: the GET flow detail no longer carries `status`/`description`, flow steps have optional `name`/`order`/`enabled`/`config`, the tool GET shape drops `validation`, and tool `config`/`parametersSchema` are typed as the JSONB records the API actually returns. Dashboard and CLI consumers are updated in lockstep.
+
+- e1a4368: Alias the SDK `RuntypeRecord` type to the generated OpenAPI contract (PR3 of the
+  OpenAPI codegen swap, following #3665 / #3670).
+
+  `RuntypeRecord` is now derived from `GET /v1/records/{id}` and a new
+  `RecordListItem` type from `GET /v1/records`, replacing the hand-written
+  interface that had drifted from what the API actually returns:
+  - **`availableFields` is list-only.** It is computed per-row from metadata keys
+    and returned only when `includeFields=true`, so it now lives on
+    `RecordListItem` (returned by `records.list()` / `records.getExample()`), not
+    on the GET/create/update `RuntypeRecord`. Mirrors the `FlowListItem` split.
+  - **`metadataSchema` typing corrected.** The hand-written `keyMapping` /
+    `keyTypes` / `sizeKb` / `keyCount` / `updatedAt` fields never existed on the
+    wire — the trigger-computed JSONB summary is returned verbatim with snake_case
+    keys. It is now typed as `{ keys: string[] }` (the only field consumers read)
+    plus a catchall for the remaining computed fields.
+  - **`metadataLabels`** tightened from `Record<string, unknown>` to
+    `Record<string, string>` (its real shape).
+
+  API-side, the records list response schema now documents `availableFields` via a
+  `RecordListItemSchema`, and `RecordSchema` accurately describes the
+  `metadataSchema` / `metadataLabels` shapes.
+
+### Minor Changes
+
+- a0b30f3: Add `Runtype.skills.*` — a hand-written SDK resource for the Agent Skills admin/control plane. Covers `create`, `get`, `list`, `update` (append draft version), `delete`, `listVersions`, `publishVersion`, `import`, `bind`, `unbind`, `listBindings`, plus a nested `skills.proposals` review queue (`list`, `approve`, `reject`). The deployed-agent `propose_skill` data plane is intentionally not exposed. Also adds generic `put`/`delete` request helpers to `RuntypeClient` (the skills surface uses real `PUT`/`DELETE` verbs).
+
+### Patch Changes
+
+- c3536a2: Upgrade A2A (Agent-to-Agent) protocol support to spec v1.0.
+
+  **Surface (we expose agents as A2A): 1.0 only.** The agent card now advertises
+  `supportedInterfaces[]` + `securitySchemes`, the JSON-RPC endpoint uses
+  PascalCase methods (`SendMessage`/`SendStreamingMessage`/`GetTask`/`CancelTask`/
+  `SubscribeToTask`, plus the new `ListTasks`), Parts use the unified 1.0 oneof
+  (`text`/`raw`/`url`/`data`, `mediaType`, no `kind`), task states are
+  SCREAMING*SNAKE (`TASK_STATE*\*`), streaming events are `StreamResponse`
+wrappers (`statusUpdate`/`artifactUpdate`, no `final`), and errors use the
+`google.rpc.Status`form. Wire encoding is centralized in a new`apps/api/src/lib/a2a-wire/v10.ts` serializer. (No production A2A surface had
+  ever been invoked, so the hard cut breaks no existing consumer.)
+
+  **Import / federation (we consume external A2A agents): supports both 0.3 and
+  1.0.** External agent cards are parsed against a dual-version schema; an
+  interface selector prefers a 1.0 JSON-RPC interface and falls back to the 0.3
+  top-level `url`. The external-agent proxy and the `runA2A` runtime tool emit
+  the envelope matching the negotiated version (`A2AToolConfig.protocolVersion`,
+  default 0.3).
+
+- 8fefe6f: Agent Skills (admin plane): expose the `enable-agent-skills` flag to clients via `GET /v1/users/profile` (`features.enableAgentSkills`) so the dashboard can gate its Skills nav, and add a dedicated `GET /v1/skills/{id}/versions` endpoint for listing a skill's version history. Regenerated the public/internal OpenAPI artifacts and the SDK's generated types.
+- aa97266: Add an `empty-output` fallback trigger and terminal `message` fallback to prompt/agent error handling. Fallbacks can now fire when a model finishes successfully but returns no visible text (the "thinking" model reasoning-spiral failure), not just on error. `errorHandling.triggers` is an array (`error` | `empty-output`, defaulting to `[{type:'error'}]`), and a `{type:'message', message}` fallback yields a graceful author-controlled reply when retries/model swaps still come back empty. The product generator agent opts in (retry → reliable non-thinking model → synthesized message) so Kimi K2.6 empty answers no longer surface as blank chat bubbles.
+
+  The error-handling editor (used by both flow prompt steps and now the agent editor sidebar) exposes the new options: toggles for which conditions run the fallback chain (errors / empty replies) and a "Fixed message" fallback type. Agents gain a dedicated "Error handling" section that reuses the same modal.
+
+  The SDK's inlined error-handling types gain `MessageFallback`, the `triggers` field on `PromptErrorHandling`, and `FallbackTrigger`; the `FallbacksExhaustedEvent` type is corrected to match the wire event (`fallback_exhausted`, optional `finalError`, new `reason`).
+
+- 42979fc: Add a `product-generator-model` Flagship string flag that selects which model the dashboard's product generator dispatches with (`kimi-k2.6` default, `claude-sonnet-4-6`, `gpt-5.5`, `claude-opus-4-8`). The flag is evaluated per user/org by the API and surfaced via `GET /v1/users/profile` as `features.productGeneratorModel`; the dashboard resolves it before dispatch and falls back to `kimi-k2.6` on any lookup failure.
+- af80a8a: Add Agent Skills — versioned, loadable context bundles (Anthropic SKILL.md +
+  a `runtype:` capability extension) that deployed Runtype agents load on demand.
+  - Two-plane governance: admin/control authoring (REST/SDK/MCP, scopes-only) vs
+    deployed-agent self-authoring via `propose_skill` (review-by-default, with a
+    human-set, agent-unreachable auto-publish opt-out scoped to the proposing
+    agent).
+  - Runtime: `skill:<slug>` virtual tools, stateless `runSkill` (body-as-result +
+    capability activation through the existing tool-discovery channel), the
+    capability-load approval gate reusing `ApprovalRequiredError`, and the
+    `agent_skill_loaded` / `agent_skill_proposed` SSE events.
+  - v1 capability scope: `flowIds`/`agentIds`/`toolIds`/`inlineTools`
+    (`mcpServers` rejected at write, still parsed losslessly on import).
+
+## 3.0.0
+
+### Major Changes
+
+- 53bfe49: Generate SDK types from the committed OpenAPI 3.2 spec via `openapi-typescript`, replacing hand-mirrored types. Adds `pnpm generate:types` (+ `:check` drift gate, wired into CI).
+
+  **Breaking (types only — runtime behavior unchanged):** several public types now reflect what the API actually returns, so over-declared fields are removed and some become optional:
+  - `StreamEvent` and its members derive from the spec's `FlowSSEEvent` union — fields the API may omit (e.g. `StepCompleteEvent.name`, `executionTime`) are now optional, and the deprecated fallback event aliases (`FallbackFailEvent`, `FallbackSuccessEvent`, `FallbacksInitiatedEvent`) map onto the canonical discriminants (`fallback_exhausted`, `fallback_complete`, `fallback_start`).
+  - Entity types re-export from the spec: `Prompt` (drops `isStreamed`/`tools`/`inputVariables`), `UserProfile` (drops `firstName`/`lastName`/`preferences.defaultModel`), `IntegrationTool` (`parametersSchema` → `parameters`), plus `Secret`, `Conversation`, `ConversationListItem`, `AgentVersionDetail`, `FlowVersionDetail`, `Integration`, `ModelUsageDetail`, `Schedule`.
+
+  Consumers reading removed fields were already getting `undefined` at runtime (the API never returned them); the types now match reality.
+
+## 2.2.0
+
+### Minor Changes
+
+- f676234: Add typed SDK endpoint classes for resources the client previously lacked: `secrets`, `schedules` (CRUD + pause/resume/run-now + runs/stats), `surfaces`, `conversations`, `logs` (query/stats/trace), `agentVersions`, `flowVersions`, `integrations`, and `billing`. Each is exposed as a typed property on `RuntypeClient`, bringing the SDK closer to parity with the API surface used by the CLI.
+
+### Patch Changes
+
+- 75c7cbd: CLI consistency polish: standardize output and pagination flags, bump Node engine
+  - Unify the `--json` flag description to `Output as JSON` across commands and the
+    root program (semantically distinct variants on `tail`, `agents task`, and
+    `persona init` are intentionally preserved).
+  - Standardize pagination flags on list commands whose API supports cursor
+    pagination: `--limit <n>` + `--cursor <cursor>`, with an actionable
+    "fetch the next page with `--cursor …`" hint when more results exist.
+    - Added to: `flows`, `prompts`, `records`, `agents`, `schedules`,
+      `conversations`, `tools`, `products`.
+    - `--limit` has no forced default — when omitted, the API's own page size
+      applies (avoids silently shrinking existing default result counts).
+    - `conversations`/`tools` previously printed a dead-end "pass ?limit and
+      ?cursor" hint without exposing the flags; they now work.
+  - Add shared `buildListParams` / `printNextCursorHint` helpers in `lib/output.ts`
+    (normalizing the `nextCursor`/`cursor` and `hasMore`/`hasNextPage` response
+    variants) and adopt them in `surfaces` and `logs`, replacing hand-rolled query
+    builders and inline hints (also fixes a `surfaces` hint that rendered a trailing
+    space when no cursor was present).
+  - Bump `engines.node` from `>=18.0.0` to `>=22.0.0` for `@runtypelabs/cli`,
+    `@runtypelabs/sdk`, `@runtypelabs/ink-components`, and
+    `@runtypelabs/terminal-animations`. Node 18 is EOL; 22 is the current LTS. (The
+    repo root requires `>=24`, but these are published/consumer-installed packages,
+    so the floor is held at the current LTS rather than the dev-toolchain version.)
+
+- 3b357cc: Route all CLI API access through the SDK client instead of a hand-rolled raw HTTP client. Every command now constructs a configured `@runtypelabs/sdk` client via `createCliClient`, using typed endpoint methods (e.g. `client.flows.list()`) where available and the SDK's generic methods elsewhere. This makes the SDK the CLI's single source of truth for the API surface, so the CLI stops drifting behind the API, and a new `runtype/cli-use-sdk` lint rule prevents reintroducing a parallel raw client. The CLI client disables request timeouts by default for long-running executions via the SDK's new `timeout: null` support. Also fixes two latent bugs surfaced during the migration: `flows run --no-stream` now correctly requests a non-streamed response (`options.streamResponse`), and `flows get` displays the step count from the actual `flowSteps`/`stepCount` response fields.
+
+## 2.1.1
+
+### Patch Changes
+
+- 3b6779b: Migrate WebMCP polyfill from navigator.modelContext to document.modelContext per Chrome 150 spec change (WebML CG Issue 173 / PR #184)
+
+## 2.1.0
+
+### Minor Changes
+
+- 7d37b2f: Add `dispatch.clientTools[]` — a per-dispatch wire field for client-executed
+  tools (WebMCP page tools and SDK locals).
+  - Server validates the envelope (`webmcp:` prefix is server-applied,
+    ~64KB budget, duplicate / regex / shape checks) and merges into the
+    prompt-step tool set with precedence `saved < runtimeTools < clientTools`.
+  - SDK extends `runWithLocalTools` with `{ scope?: 'turn' | 'session' }`.
+    Default `'session'` is back-compat. `'turn'` auto-builds
+    `dispatch.clientTools[]` from the handler map.
+  - Surface model gains an opt-in `chat.webmcp.{enabled, allowlist,
+requireConfirmFor}` block. Default off; dashboard UI is Phase 4.
+
+  Complementary to in-engine `resolveTools`
+  (`packages/runtime/src/engine/agent-engine.ts:687`): `resolveTools` is
+  per-iteration inside one agent loop; `clientTools[]` is the wire-side
+  counterpart that arrives per-dispatch.
+
+## 2.0.1
+
+### Patch Changes
+
+- 89dc476: Preserve reasoning content (Anthropic extended-thinking signatures, Gemini thought signatures) across the platform-key proxy round-trip. Previously, when the runtime ran multi-round tool loops over `keys.mode: "platform"`, the assistant's round-1 `ReasoningPart` was silently dropped on round 2's POST body — breaking Anthropic extended thinking because the model requires its signed thinking block to ride alongside subsequent `tool_use` content. Now:
+  - `StreamChunk.reasoningProviderOptions` carries the signature on the `reason_complete` SSE chunk. The capture lives in a single shared helper (`buildReasonCompleteChunk` in `stream-helpers.ts`) used by `processStandardStreamEvent` and the four hand-written executors (cloudflare-gateway, mixlayer, togetherai, workers-ai).
+  - `MessageContent` gains a `reasoning` variant at every schema site: model-execution, runtime, shared dispatch, shared feedback-types, shared runtime-proxy (newly extracted), the api dispatch / schedules / client routes (consolidated onto the shared `MessageContentSchema`), the MCP `execute_agent` tool input, the public `DispatchChatMessage` agent-facing type snapshot, and the runtime's exported `PromptMessage` interface.
+  - The runtime-proxy schema moved from `apps/api/src/routes/runtime-proxy.ts` to `@runtypelabs/shared/api-schemas/runtime-proxy.ts` so the cross-package parity test can validate proxy ↔ runtime ↔ dispatch in one place.
+  - `PlatformKeyProxyLanguageModel`'s `translateNonSystemMessage` and `translateChunkToV2Parts` now emit reasoning parts in both directions, with provider signatures verbatim.
+  - `buildMessagesArray` reconstructs assistant messages with reasoning **before** tool-call (Anthropic ordering rule); `applyTemplateToContent` skips template substitution on reasoning text (would invalidate the signed payload); `SecretLeakGuard.scrubValue` is applied to reasoning text to prevent secrets in chain-of-thought leaking through the proxy.
+  - Tool-call and tool-result `providerOptions` (Anthropic `cache_control`, Gemini `thought_signature`) now round-trip through the proxy schema.
+  - The dispatch route's pre-validation message filter (`hasNonEmptyMessageContent`) accepts `reasoning` (and `file`) variants so legitimate multi-modal turns are no longer silently dropped before Zod validation runs.
+
+## 2.0.0
+
+### Major Changes
+
+- dc704fb: Remove the unused `status` lifecycle field from Flows and Agents (Option A from the status-field planning doc). The field gated nothing at runtime — dispatch always ran the live config row — and conflated lifecycle and draft/publish concerns. Dropped the `flows.status` and `agents.status` columns (and their now-redundant indexes), removed `status` from the REST list/create/update routes, the SDK `Flow` type, the MCP create/update agent + flow tools and list filters, the FPO agent schema, and the dashboard status pill/selectors.
+
+  Breaking: API responses for flows/agents no longer include `status`; the create/update endpoints and MCP tools no longer accept it; `Flow.status` is removed from `@runtypelabs/sdk`. Surface status, product status, and execution/run status are unaffected. Draft vs. published is now owned entirely by the versioning system.
+
+### Minor Changes
+
+- fed76a8: Add a first-class `ownerId` field to conversations and dispatch records. `POST`/`PUT /v1/conversations` and dispatch `record` inputs accept a top-level `ownerId` (stored as `metadata.ownerId`, overriding any nested value); `GET /v1/conversations?ownerId=<id>` filters the list server-side by owner; and conversation responses echo `ownerId` as a top-level field. The SDK's `DispatchRequest.record` gains an `ownerId` field. Enables multi-tenant apps to scope conversations per end-user under a single shared API key.
+- 102e70b: CSV record upload now supports a constant type. `POST /records/upload-csv` accepts a new optional `typeValue` form field; when set, every imported record receives that type and the header lookup for `typeColumn` is skipped. The dashboard upload dialog gains a "From column" / "Constant" toggle on the Type field, defaulting to "Constant" when no type-like column is auto-detected. The SDK (`records.uploadCsv`) and dashboard API client (`uploadRecordsCsv`) gain a matching optional `typeValue` parameter; `typeValue` takes precedence when both `typeColumn` and `typeValue` are supplied.
+- 95df762: Make flow step IDs stable across saves and let "Test step" replay against unsaved edits. Previously every `PUT /v1/flows/:id` regenerated all step IDs, which broke the dashboard "Test step" modal (stale id → 404) and orphaned prior `flow_step_results`. Step IDs supplied by the client are now preserved; the server only mints an ID when none is provided. Duplicate IDs within a flow are rejected. `POST /v1/dispatch/test-step` accepts an optional inline `step` config so the dashboard can iterate on unsaved edits without saving the flow first.
+
+### Patch Changes
+
+- cd6d918: Address code-review findings on the Claude Managed eval adapter:
+  - Surface eval streaming path now passes `billing` to `adapter.runOnVariant` so platform-key token spend is recorded in Schematic instead of running free.
+  - Eval variant agents are now created with `PLATFORM_ANTHROPIC_KEY` when available so the daily orphan sweeper can reach them regardless of which user spawned the eval. The resolved key is persisted on the `EvalVariantHandle` so archive paths (including the batch DO's terminal cleanup) succeed even when the underlying agent row was deleted mid-batch.
+  - SDK `EvalEndpoint.runVirtualEval` type signature now exposes `agentId` and per-config `claudeManagedOverride` so SDK callers can target Claude Managed agents without casting.
+  - `/eval/stream` route now uses the shared `loadAndGateClaudeManagedAgent` helper instead of re-inlining the six-gate check.
+  - The `claudeManagedOverride` Zod schema in product-surface-eval is extracted to a single constant shared between the realtime and batch request schemas.
+  - `CLAUDE_MANAGED_SYNTHETIC_STEP_ID` is now imported from `agent-internal-executor` in `virtual-eval-executor` and `product-surface-eval` instead of being redeclared / hardcoded.
+
+## 1.24.2
+
+### Patch Changes
+
+- bade11f: External A2A agent enhancements: per-call `skillId` override, A2A 0.3.0 `contextId` threading, and caller-supplied `metadata` merge.
+
+  `ExecuteAgentOptions.externalAgent?: { skillId?; contextId?; metadata? }` — pass a per-call skill override (wins over the cached agent card resolution), a conversation handle to resume an existing A2A conversation, and arbitrary metadata that merges into `params.metadata` alongside the reserved `skill` / `system` keys.
+
+  `AgentCompleteEvent.externalAgent?: { contextId?; taskId? }` and `AgentApprovalStartEvent.externalAgent?: { contextId?; taskId? }` are new optional fields on the wire that surface the upstream-assigned conversation handle and task id. Callers persist `contextId` and pass it back on the next `executeAgent` call to resume the same conversation. Mirrored in `@runtypelabs/shared`'s `sse-parser` types in lockstep so Persona clients can type-check the new fields. Fully additive — the api emitter leaves the field unset and existing parsers ignore unknown fields.
+
+  `runExternalAgentTurn` and `runExternalAgentTurnStreaming` accept an optional 6th `invokeOptions` parameter; `RunExternalAgentTurnResult` gains an optional `contextId?: string` on both `'completed'` and `'paused'` variants.
+
+  `@runtypelabs/sdk` — the SDK's local copies of `AgentApprovalStartEvent` and `AgentCompleteEvent` in `endpoints.ts` gain the same optional `externalAgent` field so callers using `agents.executeWithCallbacks` / `agents.executeWithLocalTools` can access the conversation handle type-safely without casting.
+
+- 6fbe4ed: Consolidate the `{ contextId?: string; taskId?: string }` shape — previously declared inline 6 times across `@runtypelabs/shared`, `@runtypelabs/runtime`, and `@runtypelabs/sdk` — into a named `ExternalAgentContext` interface. `shared` is the canonical source; the runtime re-exports it; the SDK keeps a structurally identical local copy to preserve its zero-production-dep posture. New type-level parity test pins the consolidated shape across all three surfaces and both variants of `RunExternalAgentTurnResult` via `expectTypeOf`. No wire-format change; the shape is bit-for-bit identical.
+
+## 1.24.1
+
+### Patch Changes
+
+- d659976: Fix persisted flow protocol 422 detection — check statusCode instead of message string
+- 0442e36: Harden persisted flow 422 detection to handle both error types, add unit tests
+
+## 1.24.0
+
+### Minor Changes
+
+- 761dd74: Add persisted flow protocol (APQ-style) for zero-overhead upsert execution
+
+  SDK now sends only a flow name + content hash on upsert dispatch. If the API recognizes the hash, it executes immediately with no comparison or write overhead. On first deploy or code change, the API responds with FLOW_DEFINITION_REQUIRED and the SDK retries once with the full definition. This eliminates sending the full flow definition over the wire on every execution for the common case (steady-state deployment).
+
+## 1.23.0
+
+### Minor Changes
+
+- 96b2f28: Bulk Edit Records dialog now uses the same record-filter chip builder as the records list, schedules, and per-step record queries. The filter picks fields from the live record schema (with type-aware operators, sample values, and nested AND/OR groups) instead of the hand-rolled equals/contains/etc. select trio.
+
+  The `POST /v1/records/bulk-edit` endpoint, the `bulk_edit_records` MCP tool, and the Code-Mode `bulkEditRecords` spec all accept an optional `recordFilter` (the record-filter DSL) on the request body. The legacy `conditions` shape is still supported for backward compatibility.
+
+- 5b7e3fe: Add Phase 2 runtime export API endpoints: `GET /v1/flows/:id/export-runtime` and `GET /v1/agents/:id/export-runtime`. These endpoints return fully-resolved, self-contained JSON definitions that the `@runtypelabs/runtime` package can consume at boot with no live database queries needed at execution time.
+
+  Key features:
+  - Flow steps inlined in execution order
+  - Agent capabilities resolved recursively (up to 3 levels of nested sub-agents)
+  - MCP server credentials sanitized — raw tokens replaced with secret-name references, `{{secret:NAME}}` references preserved
+  - External agent credentials unsealed before export
+  - Built-in tool IDs resolved to inline `InlineRuntimeTool` definitions
+  - DB-backed tool TypeIDs fetched and inlined as `InlineToolDefinition` entries
+
+## 1.22.0
+
+### Minor Changes
+
+- de7f600: Add computed `keyStatus` enum to model API responses. The server now resolves per-user key availability at response time, returning `"platform"` (works out of the box), `"custom"` (user brought their own key), or `"needs_setup"` (user action required). This replaces the static `supportsCustomKey: boolean` which was always `true` and provided no useful signal to agents or consumers.
+
+## 1.21.3
+
+### Patch Changes
+
+- 569e7d5: Rename model field `requiresApiKey` to `supportsCustomKey` to clarify that models are available by default via platform keys and custom API keys are optional (BYOK). Rename embedding model field `requiresApiKey` string to `customKeyProvider` for consistency.
+
+## 1.21.2
+
+### Patch Changes
+
+- b3a580e: Consolidate SDK builder and product surface skill config types around canonical shared contracts.
+
+## 1.21.1
+
+### Patch Changes
+
+- c5e0c1d: Consolidate entity types into single source of truth in packages/shared
+  - Define canonical API response entity types (Agent, Surface, SurfaceItem, SurfaceKey, Product, Capability, ApiKey, UserModelConfig) in packages/shared/src/types/entities.ts
+  - Update packages/shared/src/types/client-types.ts with comprehensive Flow, FlowStep, RuntypeRecord types matching actual API response shapes
+  - Update dashboard product types to re-export from @runtypelabs/shared instead of maintaining independent definitions
+  - Remove dead packages/types package (zero imports across codebase, stale column references)
+  - Remove dead convertKeysToCamelCase/convertKeysToSnakeCase code from SDK transform.ts (pass-through since API uses native camelCase)
+  - Use SurfaceBehavior discriminated union from shared for Surface.behavior typing
+
+## 1.21.0
+
+### Minor Changes
+
+- 5190fd0: Add type-driven SDK code generation metadata registry that prevents silent drift between SDK config interfaces and the dashboard code generator
+
+## 1.20.0
+
+### Minor Changes
+
+- f777029: Linear-style chip+popover record filter builder (`RecordFilterChips`), unified across the schedules page and the `retrieve-record` flow step card. Same `RecordFilter` wire shape — drop-in for the existing builder.
+
+  Each chip is split into independent segments (`field | op | value | X`) with per-segment popovers. The value popover for set-membership / equality on string fields now renders a contextual list of distinct field values with per-value match counts (Linear-style), backed by a new `GET /v1/records/field-values?type=&field=` endpoint. Free-text fallback preserved via "Use 'X'" search row.
+
+  **Schedule UI unification**: dropped the three-way `Record Target` mode selector (`All records of a type` / `Specific record IDs` / `Records matching a filter`). The chip filter is now the single way to target records, since:
+  - `id`, `name`, `createdAt`, `updatedAt` are now reachable as top-level columns in the filter compiler — `id is one of [...]` covers what `Specific record IDs` used to do.
+  - A filter with type only and no chips covers what `All records of a type` used to do.
+
+  A "Paste IDs" button drops a pre-filled `id is one of [...]` chip for power users with a list to paste; the value picker also bulk-adds when you paste a comma- or newline-separated list into its search input. Old saved schedules still load (and their `recordType` / `recordIds` are normalized into a chip filter on edit) — the executor's resolver still understands all three legacy fields, so existing schedules keep running unchanged.
+
+  **`retrieve-record` step now accepts a `recordFilter`**: in query mode, the step card renders the same `RecordFilterChips` UI, replacing the `where type is X / and name contains Y` two-row form. The new `config.recordFilter` is validated via `recordFilterSchema`, normalized through the shared normalizer, and AND-ed into the executor's where clause (with `{{template}}` substitution applied to chip values before compilation). Legacy `recordType` / `recordName` keep working — old saved steps load by normalizing into chips, and the executor still falls back to the legacy fields when no `recordFilter` is set.
+
+  **`update-record` step gets the same treatment**: a new "Find record" radio at the top of the step card lets users target by context (`_record`, the existing default), by ID, or by chip filter. When a filter is set, the executor compiles it with templates substituted and takes the first match (ordered by `updatedAt desc`). Filter validation is enforced at validate-time via a new `updateRecordConfigSchema`. Same backward-compatibility story: legacy `recordType` / `recordName` keep working until the user edits.
+
+  **MCP discoverability**: the `create-flow` / `update-flow` / `validate-flow` MCP tool descriptions now document `recordFilter` as a valid `config` shape for `retrieve-record` and `update-record`, including the operator allowlist and reachable top-level columns. New `RecordFilter`, `RecordFilterCondition`, `RecordFilterGroup`, `RecordFilterOperator`, `RetrieveRecordConfig`, and `UpdateRecordConfig` types are added to `runtype://types/flow-steps` so agent clients see the shape directly. `flow-step-type-metadata.ts` config-hints lines now mention `recordFilter` for both steps. The runtime passthrough already worked (config is forwarded as an opaque object); this slice makes it discoverable.
+
+  Also fix two bugs surfaced by the new UI:
+  - **`/v1/records/preview-filter` 500 on `is one of` / `is not one of`**: drizzle's `sql` template expanded `${array}` as a row constructor `($1, $2)`, so `= ANY(${list})` compiled to `text = ANY(($1, $2))` and Postgres rejected it as `text = record`. Switched both `in` and `notIn` to the `IN (${list})` form, which compiles to the correct `text IN ($1, $2)`. Pinned with a regression test.
+  - **Trailing comma vanished while typing in the multi-value input**: every keystroke re-rendered from the parsed array, eating the comma. Now holds the raw typed text in local state and keeps the parsed array in sync on every keystroke so Apply still reads a fresh value.
+
+## 1.19.1
+
+### Patch Changes
+
+- 7712f0d: Expose flowTimeoutMs/stepTimeoutMs in dispatch options, add timeout abort smoke test, and fix partial token accounting on aborted prompt steps
+
+## 1.19.0
+
+### Minor Changes
+
+- e6d59df: Add per-step `when` predicate for conditional step execution. Any step can carry
+  a JS expression evaluated at runtime; if falsy the step is skipped with its
+  outputVariable set to null and a `step_skip` SSE event emitted. Default-skip-on-
+  throw; opt into fail-loud via `errorHandling.onError: 'fail'`.
+
+## 1.18.1
+
+### Patch Changes
+
+- 778a8be: Fix flow tools failing when referenced via saved tool ID instead of direct flowId
+
+  When a saved tool with `toolType: 'flow'` was added as an agent capability, the dashboard and API built the runtime tool config with `config.toolId` (the saved tool's database ID) instead of `config.flowId` (the ID of the flow to execute). This caused validation to fail with "Flow tool missing flowId".
+  - Dashboard now resolves saved tool config to extract the actual `flowId`
+  - API executor resolves `config.toolId` → saved tool → `flowId` at execution time
+  - Validation accepts either `flowId` or `toolId` for flow tools
+  - Added end-to-end smoke test for flow-as-tool on agents
+
+## 1.18.0
+
+### Minor Changes
+
+- 7070cfb: Remove `chunk` from the SDK's `step_delta` event shape, the
+  `StepChunkEvent` alias, and the `onStepChunk` callback. Customers migrate
+  to `text` and `onStepDelta`. Bruno API examples and the dashboard's
+  generated SDK code now use the new field/callback names. The shared
+  flow-execution streaming hook drops its unrelated `data.content` legacy
+  reader. Runtime: `StepDeltaEventData` adds optional `partId? /
+messageId? / toolId?` fields to match the api's canonical
+  `StepDeltaData` per the api-parity-for-ports rule.
+
+### Patch Changes
+
+- e886078: Add first-class `agent_media` SSE events for multimodal tool output, aligned with AI SDK standards. Media types use AI SDK v3/v4 content-part shapes (`media`, `image-url`, `file-url`) and tools wire up `toModelOutput` so models receive native multimodal content. Messaging surfaces (Telegram, Slack) collect and deliver media natively via channel adapters.
+- e6fcbe6: Add media visibility control for agent_media SSE events
+
+  Two-layer visibility system: MCP `annotations.audience` on content parts (spec compliance) and tool-level `mediaVisibility` config via `toolConfigs`. Tools can now return media to the model for reasoning without it being shown to the user. Default behavior unchanged — all existing tools continue to show media to both audiences.
+
+- 94261ac: Restore browser tools and add dedicated Browser category with namespaced tool IDs
+  - Unhide all 16 browser tools (7 quick-action + 9 session) that were hidden pending staging validation
+  - Add `BROWSER` category to separate browser tools from generic web scraping
+  - Rename tool IDs from `browser-*` to `browser:*` namespace format (e.g. `builtin:browser:screenshot`)
+  - Add alias support for backward compatibility with legacy `browser-*` IDs
+  - Add Browser ToolGroupCard in the dashboard tools sheet
+
+- 91db7b9: Add typed agent approval stream events and callbacks to the TypeScript SDK.
+
+## 1.17.1
+
+### Patch Changes
+
+- 28f126c: Thread AI SDK `finishReason` through the model-execution stream into dispatch `step_complete` SSE events as a new `stopReason` field, and — for parity — onto `agent_turn_complete` on both the API agent-loop path (`/agents/:id/execute`, `/dispatch`, `/product-chat`, `/mcp-capability`) and the self-hosted runtime. Clients can now distinguish a model invocation that ended naturally (`end_turn`) from one that was capped mid-loop by `stopWhen` (`max_tool_calls`), plus `length`, `content_filter`, `error`, and `unknown`. Fixes the empty-chat-bubble symptom in the dashboard when a virtual-agent tool call hits `maxToolCalls: 1`: the follow-up model invocation was cut off silently and the UI had no way to explain why.
+
+  `@runtypelabs/runtime` mirrors the feature end-to-end: `PromptStepResult.stopReason` exposes the per-step value, `FlowEngineResult.lastStopReason` surfaces the last-prompt-step reason of a flow run, and `AgentTurnCompleteEventData.stopReason` lands on the `agent_turn_complete` SSE event so self-hosted Persona clients see the same signal as the hosted API. `StepStopReason` and `mapFinishReasonToStopReason` are now re-exported from the runtime barrel so external consumers can type-annotate the new field.
+
+  `@runtypelabs/sdk` gains `stopReason` on its `AgentTurnCompleteEvent` interface — the public SDK surface was missing the field even though the wire carried it.
+
+  **Bug fixes pulled in alongside the feature**:
+  - `collectUsageWithTimeout` (and the three inline variants in `cloudflare-gateway-executor`, `workers-ai-executor`, `mixlayer-executor`) no longer discard an already-resolved `finishReason` when the usage race times out. Previously `Promise.all` rejected the whole await when the usage arm rejected, losing `finishReason: 'tool-calls'` that had arrived at t=0 — re-creating the empty-bubble symptom for providers with slow usage accounting. Switched to `Promise.allSettled` so the two arms resolve independently.
+
+  **Python SDK** (`packages/python-sdk`, versioned separately): `StepCompleteEvent` gains an optional `stop_reason` field with `AliasChoices('stop_reason', 'stopReason')`, plus a new `StepStopReason` Literal type. Full agent-loop event modeling (`agent_turn_complete`, etc.) in the Python SDK is out of scope — it doesn't model agent events today.
+
+## 1.17.0
+
+### Minor Changes
+
+- 060278a: Add Subagent tool authoring UI and SDK builder methods.
+
+  Dashboard: `subagent` is now selectable in the Create Tool dialog. The tool
+  detail page exposes an agent picker (from `/v1/agents`), an allowed-tools
+  multiselect drawn from the selected agent's configured tools, an output
+  format radio (`text` / `json` / `last_message`), and optional `maxTurns`,
+  `timeoutMs`, `taskTemplate`, and `inheritMessages` controls. Tools list
+  renders a Bot icon + "Subagent" badge for the new type.
+
+  SDK: `FlowBuilder` gains `.withSubagentTool(name, opts)` (attach a subagent
+  runtime tool to the most recent prompt step) and `.withSubagents(opts)`
+  (enable agent-driven dynamic spawning via the synthesized `spawn_subagent`
+  tool). `Tool`, `ToolConfig`, `RuntimeTool`, and `ToolsConfig` types are
+  extended with `'subagent'` and the new `SubagentToolConfig` /
+  `RuntimeSubagentToolConfig` / `AgentSubagentConfig` shapes.
+
+  The API trust boundary (tool-pool intersection, leak guard propagation,
+  recursion depth, per-run spawn ceiling) is unchanged — this PR is a
+  UX-only veneer over the already-shipped API engine.
+
+## 1.16.0
+
+### Minor Changes
+
+- 23b42c8: Add sampling config parameters (topP, topK, frequencyPenalty, presencePenalty, seed) for model execution
+
+  Adds end-to-end support for five new sampling parameters across the platform:
+  - API: ExecutionOptions, all model executors, prompt executor, agent executor, dispatch/flow-steps validation
+  - Dashboard: New SamplingParameterControl component, model selector, prompt card, agent editor
+  - SDK: Prompt step builders, prompt run options, eval overrides, agent execute request, and shared dispatch/eval override types
+  - All params default to undefined (use model default) with no fallback values
+  - Qwen 3.5 open-weight models routed through Mixlayer still apply their specialized defaults when these fields are unset, but any explicitly configured sampling value takes precedence over those Qwen fallbacks
+
+## 1.15.3
+
+### Patch Changes
+
+- 60dbf93: Improve `deploy_sandbox` on the Cloudflare Sandbox provider: auto-create parent directories when writing nested `files` entries, reject reserved port 3000 up front with a clear message, default to port 8080, and return a `stage` field plus captured stdout/stderr in `output` on failure for easier debugging.
+
+## 1.15.2
+
+### Patch Changes
+
+- 64dfdb5: Replace stale model references in user-facing examples, JSDoc, templates, and builtin-tool compatibility lists. After the tranche-2 model curation, several example and documentation sites still referenced models that had been filtered from the generated catalog (`gpt-3.5-turbo`, `gpt-4-turbo`, `o1`, `o1-mini`, `claude-3-5-sonnet`, `claude-3-opus`, `gemini-1.5-flash`, `gemini-2.0-flash`, `gemini-pro`, `grok-3`, `grok-3-mini`). Users copying those examples would receive model-not-found errors.
+
+  Touched:
+  - `apps/dashboard/lib/constants/vector-flow-templates.ts` — user-facing vector flow template (`gpt-3.5-turbo` → `gpt-5-nano`)
+  - `apps/dashboard/lib/api-request-generator.ts` — dashboard-generated API example payloads (eval comparison pair → `claude-sonnet-4-6`, `gemini-3-flash`)
+  - `apps/dashboard/lib/sdk-completions.ts` — SDK autocompletion options for the `model` field (OpenAI + Anthropic + Google current)
+  - `apps/dashboard/lib/sdk-code-generator.ts` — SDK eval-comparison example (`gpt-5.4`, `claude-opus-4-6`, `gemini-3.1-pro`)
+  - `packages/mcp/src/core/tools.ts` — `run_prompt` / `execute_agent` MCP tool schema descriptions (example model triplet in the `model` arg description)
+  - `packages/client/src/runtype.ts`, `evals-namespace.ts`, `eval-builder.ts` — five JSDoc `@example` blocks that showed `compareModels` usage with `claude-3-opus` / `gpt-4o` / `gemini-pro`
+  - `packages/shared/src/product-generation/knowledge-fragments.ts` — rewrote the xAI Live Search compatibility paragraph to drop grok-3 advice (grok-3 is no longer in the catalog)
+  - `packages/shared/src/builtin-tools-registry.ts` — `modelCompatibility` lists for DALL-E, OpenAI web search, Anthropic web search/fetch, and xAI Live Search: removed filtered-out models and added current ones
+
+  No runtime behavior changes — this is all documentation, example code, and compatibility-list hygiene.
+
+## 1.15.1
+
+### Patch Changes
+
+- ca82595: Fix Cloudflare Sandbox deploy/cleanup routes overflowing the SDK's 63-char sandbox ID limit
+
+  The `@cloudflare/sandbox` SDK's `sanitizeSandboxId()` throws a `SecurityError` when the ID exceeds 63 chars (DNS subdomain limit). The prior scoping format — `${user.orgId || user.userId}_cf-sandbox-${uuid}` — produced ~76-char IDs with Clerk-style org/user IDs, so every call to `/tools/sandbox/cf-sandbox/deploy` threw before reaching the inner try/catch and returned a generic 500 `Failed to deploy Cloudflare Sandbox`. Replace the direct prefix with a 12-hex-char SHA-256 tenant hash so scoped IDs land under 50 chars, and lowercase the result to avoid the SDK's case-insensitivity warning on preview hostnames. The SDK client now appends `details` to error messages when the API returns a `{ error, details }` shape, so future failures like this aren't hidden behind the top-level label.
+
+## 1.15.0
+
+### Minor Changes
+
+- 2820927: Replace the `cloudflare-shell` sandbox provider with `cloudflare-sandbox`, backed by `@cloudflare/sandbox`.
+  - `sandboxProvider` on transform-data steps and custom runtime tools accepts `'cloudflare-sandbox'` instead of `'cloudflare-shell'`.
+  - New `CloudflareSandboxDO` container-backed Durable Object replaces `ShellSandboxDO`. Each sandbox is a full Linux computer (Node 22, Python 3.12, pnpm, tsx, uv, git) with snapshot-backed persistence, preview URLs, and Active-CPU pricing.
+  - New routes: `POST /tools/sandbox/cf-sandbox/deploy` and `DELETE /tools/sandbox/cf-sandbox/:sandboxId`. The old `cf-shell` routes are removed.
+  - SDK: `deployCfShell` / `cleanupCfShell` renamed to `deployCfSandbox` / `cleanupCfSandbox`. `DeployCfShellRequest` / `DeployCfShellResponse` renamed to `DeployCfSandboxRequest` / `DeployCfSandboxResponse`.
+  - CLI: `createDeployCfShellLocalTool` / `cleanupCfShellWorkers` renamed to `createDeployCfSandboxLocalTool` / `cleanupCfSandboxes`. Python is now a supported language for Cloudflare Sandbox.
+  - Infrastructure: wrangler migration `v7` drops `ShellSandboxDO` and adds `CloudflareSandboxDO`. `SHELL_STORAGE` R2 binding renamed to `SANDBOX_STORAGE`. Requires Workers Paid + Containers add-on on the Cloudflare account.
+
+  Breaking change: any caller passing `sandboxProvider: 'cloudflare-shell'` must switch to `'cloudflare-sandbox'`. There was no production usage of the old provider, so the impact is limited to internal testing.
+
+## 1.14.1
+
+### Patch Changes
+
+- 799f8db: Extend `BuiltInTool` category union for commerce and artifact tools; type `IntegrationToolsCombobox` for minimal tool rows used by built-in groupings.
+
+## 1.14.0
+
+### Minor Changes
+
+- 040c7e8: Add body template support for external tools. External tool configs now accept an optional `body` field with `{{variable}}` interpolation, enabling control over the exact JSON body structure sent to APIs. When absent, behavior is unchanged (remaining parameters auto-serialized).
+
+## 1.13.3
+
+### Patch Changes
+
+- e10c4d4: Fix marathon tasks completing prematurely by preventing auto-waive from forcing plan-written and best-candidate-verified gates open, and routing stopReason=complete through workflow canAcceptCompletion gates.
+
+## 1.13.2
+
+### Patch Changes
+
+- 7f727ab: feat: add record management built-in tools for agents
+
+  Adds 5 new built-in tools (runtype_record_upsert, runtype_record_batch_upsert, runtype_record_get, runtype_record_list, runtype_record_delete) that enable agents to create, read, update, and delete Runtype records during execution. Tools appear as a grouped "Record Management" section in the tool picker with a select-all checkbox.
+
+- 19b9c08: fix(sdk): refine marathon task agent workflow phase handling and resume copy
+
+  Align `TASK_COMPLETE` checks with the workflow phase at session start when the phase transitions mid-turn. Treat non-default execute phases as execution-like for local tool trace bookkeeping. Distinguish forced-compaction and continuation guardrails for in-progress (saved) tasks versus completed tasks.
+
+## 1.13.1
+
+### Patch Changes
+
+- d73361a: Disable source maps in published packages to reduce npm package size
+
+## 1.13.0
+
+### Minor Changes
+
+- 2de3530: Add `deployCfShell` and `cleanupCfShell` methods to the Tools endpoint
+
+## 1.12.0
+
+### Minor Changes
+
+- 62c2f83: Add Cloudflare Shell as a new sandbox provider for Marathon CLI
+
+  Introduces `cloudflare-shell` as an alternative to Daytona for agent code execution in Marathon. Uses `@cloudflare/worker-bundler` for runtime TypeScript compilation and npm dependency resolution, and `@cloudflare/shell` for virtual filesystem persistence backed by SQLite + R2.
+
+  Key features:
+  - JavaScript and TypeScript execution with npm dependencies
+  - Virtual filesystem persistence via `@cloudflare/shell` Workspace
+  - Deploy-with-preview via persistent Dynamic Workers
+  - No API key required (uses existing Cloudflare Workers infrastructure)
+  - ~1-5ms startup vs ~100-500ms for Daytona
+
+  Usage: `runtype task "your task" --sandbox cloudflare-shell`
+
+## 1.11.0
+
+### Minor Changes
+
+- cc9ff7a: Add Orthogonal-backed platform tools with hierarchical `platform:orthogonal:company:tool` ID format, catalog generation, managed execution, and spend tracking via DO + Analytics Engine.
+
+## 1.10.2
+
+### Patch Changes
+
+- 9e3fee1: Fix marathon session reliability: resolve completion deadlocks (verification auto-waive, premature TASK_COMPLETE), fix write loops and stall detection, retain accumulated cost across checkpoint restarts, retry server-side network errors in session loop, and add 'o' key to open files from Files tab or open agent in dashboard
+
+## 1.10.1
+
+### Patch Changes
+
+- ce76184: Fix the SDK package entrypoints to emit stable ESM and CommonJS bundles for workspace consumers.
+
+## 1.10.0
+
+### Minor Changes
+
+- 190adf8: Add agent fallback-model and playbook policy support across the API, CLI, and SDK.
+
+  Improve marathon task execution with safer verification handling, creation-task output constraints, and better recovery when verification is repeatedly blocked.
+
+## 1.9.2
+
+### Patch Changes
+
+- bd08d42: Wire streamed tool input through the API, SDK, and Marathon CLI, keep local tools active through client-side execution, and enable Anthropic eager input streaming behind a feature flag.
+
+## 1.9.1
+
+### Patch Changes
+
+- 8494865: Wire streamed tool input through the API, SDK, and Marathon CLI, keep local tools active through client-side execution, and enable Anthropic eager input streaming behind a feature flag.
+- f49d2d6: Improve Marathon build-and-serve workflow routing for prompts that ask the agent to create a runnable web app, serve it, and verify routes.
+
+## 1.9.0
+
+### Minor Changes
+
+- 152019b: Add a first-class Cloudflare Browser Rendering `crawl` flow step with synchronous execution, settings-based credentials, per-page platform billing, and editor/SDK authoring support.
+
+### Patch Changes
+
+- b6d2ceb: Fix Marathon history replay so local tool call/result pairs stay valid when continuation history is trimmed or resumed. This prevents Anthropic and Claude runs from failing on orphaned `tool_result` messages during Marathon continuation.
+
+## 1.8.2
+
+### Patch Changes
+
+- c7229a9: Make marathon web research tasks honor the existing `external` workflow variant end-to-end. External prompts now steer agents toward built-in web tools, block repo discovery during research, and stop injecting repo-editing guidance into session context for website-focused runs.
+- c7229a9: Make marathon external research tasks write their final findings to a workspace markdown file before completion. External runs now default that artifact path to `<task-slug>.md`, require `write_file` to that path, and do not accept `TASK_COMPLETE` until the markdown report has been saved.
+
+## 1.8.1
+
+### Patch Changes
+
+- 4ec90b5: Fix `--compact-threshold` parsing to remove ambiguous bare-ratio format. The flag now accepts only two formats: percent (e.g. `--compact-threshold 80%`) and absolute token count (e.g. `--compact-threshold 120000`). Bare decimal values like `0.8` are no longer interpreted as ratios. Also ensure provider-native compaction lifecycle cleanup fires even when session execution throws, preventing a stuck compaction indicator in the TUI.
+- 4ec90b5: Add provider-aware marathon context management with model-budget-aware compaction thresholds, compaction lifecycle telemetry, structured compact summaries, CLI controls for compaction strategy and instructions, and tool-output guardrails that surface or offload oversized local tool results.
+
+## 1.8.0
+
+### Minor Changes
+
+- 564d33c: Add --tools flag to marathon command for enabling built-in tools (exa, firecrawl, dalle, web search, etc.) during agent runs
+
+## 1.7.3
+
+### Patch Changes
+
+- f9b1333: Switch SDK build from tsc (CommonJS) to tsup (dual ESM + CJS) to fix named export errors when consumed by ESM packages like the CLI on Node.js v24+
+
+## 1.7.2
+
+### Patch Changes
+
+- cb689ac: Improve marathon safety and verification by checkpointing original files before writes, adding rollback and guarded verification tools, and requiring successful verification before completion.
+- cb689ac: Fix marathon resume and execution-state handling so resumed or restarted runs keep their workflow phase, advance cleanly from planning into execution, avoid reusing the wrong local-tool results across resume cycles, and stop reporting errored runs as completed.
+- cb689ac: Tighten marathon execution target tracking by trimming candidate paths, ignoring scratch-file writes as targets, blocking planning/execution writes to undeclared files, sanitizing poisoned saved marathon state on resume, and surfacing clearer rate-limit details when marathon hits a 429.
+- cb689ac: Harden marathon repo-editing runs by requiring stronger UX-task research, preserving existing functionality during execution, preferring tool-trace memory over freeform narration, and blocking completion until the edited target is re-read after writes.
+- cb689ac: Fix marathon execution loops by only advancing after a successful write to the exact plan path, ignoring `.runtype` artifact candidates, and blocking redundant execution-phase discovery until the current target read fails.
+
+## 1.7.1
+
+### Patch Changes
+
+- 458711d: refactor: remove modelsocket provider, consolidate onto mixlayer
+
+  Removes the redundant `modelsocket` provider and consolidates all model routing onto `mixlayer`. Both providers were backed by the same Mixlayer infrastructure (`https://models.mixlayer.ai`) and shared the same API key. This simplifies the codebase and removes the `modelsocket` npm dependency.
+
+  Key changes:
+  - Rewrites `/chat` endpoint from proprietary WebSocket SDK to AI SDK `streamText()`
+  - Adds backward compatibility: stored `modelsocket` references transparently resolve to `mixlayer`
+  - Includes database migration to convert existing `modelsocket` records to `mixlayer`
+  - Removes `modelsocket-executor.ts` and related test files
+  - Updates all dashboard UI, routing, and config files
+  - Keeps `modelsocketKey` field name and `MODELSOCKET_*` env vars for infrastructure compatibility
+
+## 1.7.0
+
+### Minor Changes
+
+- 3531abb: Make Cloudflare Worker the default sandbox provider for transform-data steps, soft-deprecating QuickJS as legacy
+
+## 1.6.0
+
+### Minor Changes
+
+- 57ca1e0: Add Cloudflare Worker-Loader sandbox provider for transform-data steps
+  - Add cloudflare-worker as third sandbox provider option
+  - Full async/await support with V8 isolate sandboxing
+  - Helper function injection and console output capture
+  - Network isolation and configurable timeout
+  - Zero cost (in-process, no external API calls)
+  - Runtime-aware AI code generation: magic button and flow generator now produce code matching the selected runtime's constraints (sync-only for QuickJS, helpers.\* namespace for Cloudflare Worker, fetch/npm for Daytona)
+
+## 1.5.1
+
+### Patch Changes
+
+- 077b0ff: Internal maintenance: update comments and rename imports for clarity
+
+## 1.5.0
+
+### Minor Changes
+
+- a96ce5d: Rename `maxIterations` to `maxTurns` in agent loop configuration and SSE event types to align with industry conventions (OpenAI, Anthropic, Vercel AI SDK). The `stopReason` value `max_iterations` is now `max_turns`.
+
+### Patch Changes
+
+- 8505d96: Add 'timeout' to agent loop stop reason types for wall-clock timeout guard
+
+## 1.4.0
+
+### Minor Changes
+
+- ed4d85a: Unify SSE event naming across the platform
+  - Rename `step_chunk` to `step_delta` (aligns with Anthropic/OpenAI/Vercel convention)
+  - Rename `flow_paused` to `flow_await`, `step_waiting_local` to `step_await`, `agent_paused` to `agent_await`
+  - Consolidate fallback events: merge `fallbacks_initiated` into `fallback_start`, unify `fallback_success`/`fallback_fail` into `fallback_complete`, rename `fallbacks_exhausted` to `fallback_exhausted`
+  - Add structured TypeScript interfaces for tool events (`ToolStartEventData`, `ToolCompleteEventData`, `ToolErrorEventData`)
+  - Formalize `tool_error` as a first-class event type with `emitToolError()` method
+
+  All renames use dual-emit for backwards compatibility: the API sends both the new and legacy event names during the transition period. SDK consumers accept both names.
+
+## 1.3.0
+
+### Minor Changes
+
+- ffab49e: Add marathon continuation support: RunTaskContinuation type, previousMessages/continuationMessage/compact options, costByModel tracking, and compact summary for resume
+
+## 1.2.1
+
+### Patch Changes
+
+- 0e5a64a: Add `markdownIfAvailable` support for fetch-url steps so SDK consumers can explicitly control markdown-first text fetching behavior.
+
+## 1.2.0
+
+### Minor Changes
+
+- b0bada9: Add `end_turn` stop reason to distinguish "turn ended" from "task completed." Non-loop agents now return `end_turn` instead of `complete`, enabling multi-session marathon execution to continue across sessions. SDK includes client-side stop-phrase detection as a fallback for non-loop agents.
+
+## 1.1.0
+
+### Minor Changes
+
+- ebe3c6b: Add `agents.runTask()` method for multi-session long-task agent execution with automatic state management, streaming support, cost tracking, and optional dashboard progress sync via records.
+
+## 1.0.2
+
+### Patch Changes
+
+- aa97d84: Remove `embedCode` from `CreateClientTokenResponse`. The API no longer returns embed snippets (dashboard uses persona's generateCodeSnippet instead). Aligns SDK types with API.
+
+## 1.0.1
+
+### Patch Changes
+
+- de81f99: Remove unused `promptId`, `contextTemplateId`, `prompt`, and `contextTemplate` fields from the `FlowStep` type. These fields were never functional at runtime and have been removed from the API.
+
+## 1.0.0
+
+### Major Changes
+
+- 065de96: BREAKING: Normalize SSE stream events for consistency.
+
+  ## Changes
+
+  ### 1. Standardize on `result` field
+
+  Previously, prompt steps used `result` while context steps used `output`. Now all step types consistently use `result`.
+  - Removed `output` field from `StepCompleteEvent` type
+  - Removed fallback logic (`event.result ?? event.output`) from stream handlers
+
+  ### 2. Rename `executionType` to `stepType`
+
+  Renamed the field from `executionType` to `stepType` to better align with industry conventions (Zapier, n8n, LangGraph) and clarify that it describes the type of step, not how it executes.
+
+  ### 3. Expand `stepType` values
+
+  Previously, `executionType` was limited to `'prompt' | 'context'`. Now `stepType` provides the specific step type like `'prompt'`, `'transform-data'`, `'api-call'`, `'send-email'`, etc.
+
+  This is more useful for:
+  - Filtering specific step types
+  - Building step-type-specific UI
+  - Consumer control logic
+  - Future agent execution types
+
+  ### 4. User-facing visibility
+
+  `stepType` is now visible in user-facing mode (debugMode: false) for `step_chunk`, `step_complete`, and `step_error` events, allowing consumers to use it for control logic.
+
+  ## Migration
+  1. Change `event.output` to `event.result`
+  2. Change `event.executionType` to `event.stepType`
+  3. If checking `stepType === 'context'`, update to check for specific types or use `stepType !== 'prompt'`
+
+## 0.5.0
+
+### Minor Changes
+
+- 0140d17: Add `withInputs()` method to FlowBuilder for top-level input variables
+
+  You can now pass input variables directly accessible as `{{varName}}` in templates without needing the `_record.metadata` prefix:
+
+  ```typescript
+  const result = await new FlowBuilder()
+    .useExistingFlow('flow_abc123')
+    .withInputs({
+      customerName: 'Acme Corp',
+      topic: 'Q4 sales',
+    })
+    .run(apiClient, { streamResponse: true })
+  ```
+
+  The `inputs` field is also available directly on `DispatchRequest` for API calls.
+
+## 0.4.0
+
+### Minor Changes
+
+- cf6fcdc: Add strongly-typed JSON types to replace `any` usage across the SDK. This includes:
+  - `JsonValue`, `JsonObject`, `JsonPrimitive`, `JsonArray` types for type-safe JSON handling
+  - `Metadata`, `StepOutput`, `ToolArgs`, `ToolResult` semantic type aliases
+  - Type guards: `isJsonValue()`, `isJsonObject()`, `isJsonPrimitive()`, `isJsonArray()`
+  - Updated all interfaces to use proper types instead of `any`:
+    - `FlowStep.config` now uses `JsonObject`
+    - `RuntypeRecord.metadata` now uses `Metadata`
+    - `ModelConfig.settings` now uses `JsonObject`
+    - Tool-related types (`parametersSchema`, `inputParameters`, `outputResult`) now use `JSONSchema`, `JsonObject`, `JsonValue`
+    - Request/response types updated throughout
+
+  These changes improve TypeScript type safety while maintaining backward compatibility - existing code that passes plain objects will continue to work.
+
+## 0.3.0
+
+### Minor Changes
+
+- 9ec83bd: Add ReasoningConfig type for fine-grained control over AI reasoning/extended thinking
+  - New `ReasoningConfig` interface supports GPT-5, Claude 4, and Gemini 2.5 reasoning options
+  - `reasoning` field on prompt steps now accepts `boolean | ReasoningConfig`
+  - GPT-5 users can configure `reasoningEffort` and `reasoningSummary` for streaming
+  - Claude users can set `budgetTokens` for extended thinking
+  - Google users can configure `thinkingBudget` and `includeThoughts`
+
+  Example usage:
+
+  ```typescript
+  .prompt({
+    name: 'Analyze',
+    model: 'gpt-5',
+    userPrompt: 'Analyze this data',
+    reasoning: {
+      enabled: true,
+      reasoningEffort: 'high',
+      reasoningSummary: 'detailed'
+    }
+  })
+  ```
+
+- a63f268: Migrate SDK to native camelCase API convention
+  - Transform functions (`transformRequest`, `transformResponse`, `transformQueryParams`) are now pass-through since the API uses native camelCase
+  - Added TypeScript utility types for compile-time case conversion: `ToCamelCase`, `ToSnakeCase`, `SnakeToCamelString`, `CamelToSnakeString`
+  - No changes to the SDK's external API surface - existing code continues to work
+
+## 0.2.1
+
+### Patch Changes
+
+- 8506aa1: Remove private @runtypelabs/shared dependency from all public packages by inlining types and constants. This fixes npm installation errors where users couldn't install packages due to the unpublished internal shared package dependency.
+
+## 0.2.0
+
+### Minor Changes
+
+- Remove `includeDistance` option from `VectorSearchStepConfig` interface. Distance/similarity scores are now always included in vector search results when available.
+- 06ac26d: Add SDK support for error handling fallbacks and client token management
+
+  TypeScript SDK (@runtypelabs/sdk):
+  - Add error handling types to step configs (PromptErrorHandling, ContextErrorHandling)
+  - Add support for fallback chains with retry and model fallbacks
+  - Add fallback SSE event types (fallbacks_initiated, fallback_start, fallback_success, fallback_fail, fallbacks_exhausted)
+  - Add ClientTokensEndpoint for client token CRUD operations
+  - Re-export error handling and client token types from shared lib
+
+  MCP Server (@runtypelabs/mcp-server):
+  - Add client token management tools: list_client_tokens, get_client_token, create_client_token, update_client_token, delete_client_token, regenerate_client_token
+
+## 0.1.3
+
+### Patch Changes
+
+- 2eb58c6: Add official npm package badge to README