In `@packages/cli/src/commands/run.ts`:
- Around line 332-340: The TypeScript error is because ApiError exposes
statusCode not status; update the auth-check in the run command by changing the
isAuthApiError check to use error instanceof ApiError && (error.statusCode ===
401 || error.statusCode === 403) so the computed exitCode logic (which also
references FileResolutionError, MissingInputError, MissingIntegrationError, and
ExitCode) compiles correctly; ensure you only rename the property access on the
ApiError instance in the isAuthApiError declaration.

In `@packages/cli/src/commands/run.ts`:
- Around line 594-595: The built-in integration IDs are hardcoded in the
builtInIntegrations Set inside run.ts which can drift from the source of truth;
extract these IDs into a shared constant (e.g., export an array or Set from a
central module) and import that shared symbol into
packages/cli/src/commands/run.ts, replacing the local builtInIntegrations
declaration so the CLI consumes the single exported list (ensure the shared
module exports a stable name you reference when replacing builtInIntegrations).

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@packages/cli/src/commands/run.ts`:
- Around line 704-709: The current code asserts metadata.sql_integration_id as a
string which can introduce invalid IDs; instead guard at runtime by checking
that block.metadata exists and that typeof (block.metadata as
any).sql_integration_id === 'string' before assigning to integrationId and
before calling ids.add, so only true string IDs (and not undefined or other
types) are added and built-in integration checks via BUILTIN_INTEGRATIONS remain
valid.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@packages/cli/src/commands/run.ts`:
- Around line 86-87: The RunOptions type now includes a sensitive token field;
before emitting the debug log that prints the options (the logger.debug / debug
call in run.ts where options are logged), remove or mask the token property to
avoid leaking secrets. Update the code that logs the options (reference
RunOptions and the local options/runOptions variable used in the debug call) to
either clone the object and set token = '<redacted>' (or delete token) or build
a sanitized serializable object that excludes token, then log that sanitized
object instead.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@packages/cli/src/integrations/collect-integrations.ts`:
- Around line 16-18: Normalize the built-in integration check to be
case-insensitive by lowercasing the parsed integrationId before checking the
BUILTIN_INTEGRATIONS set; e.g., after const integrationId =
z.string().optional().safeParse(metadata.sql_integration_id).data create a const
normalized = integrationId?.toLowerCase() and use
BUILTIN_INTEGRATIONS.has(normalized) for the membership test, while preserving
the original integrationId when calling ids.add(integrationId) if it should keep
original casing.

Verify each finding against the current code and only fix it if needed.

Inline comments:
In `@packages/cli/scripts/generate-json-schemas.ts`:
- Around line 6-8: Replace the overly broad unknown input type for
zodToJsonSchema with ZodTypeAny to preserve more Zod typing: update the dynamic
import cast for zodToJsonSchema to (schema: ZodTypeAny) => unknown and, if
missing, import ZodTypeAny from 'zod'; call
zodToJsonSchema(integrationsFileSchema) as before so the heavy return inference
stays untouched while avoiding deep-instantiation TS issues.