@aexhq/sdk 0.16.1 → 0.18.0

package/dist/_contracts/models.d.ts

@@ -7,27 +7,116 @@ import type { RunProvider } from "./submission.js";
  * first so SDK types, CLI validation, docs examples, and platform parsing move
  * together.
  */
-export declare const RUN_MODELS: readonly ["claude-haiku-4-5", "claude-3-5-haiku-latest", "claude-3-5-sonnet-latest", "deepseek-chat", "gpt-4.1", "gpt-4o-mini", "gemini-2.0-flash", "gemini-2.5-flash", "mistral-large-latest", "mistral-small-latest"];
+export declare const RUN_MODELS: readonly ["claude-haiku-4-5", "claude-3-5-haiku-latest", "claude-3-5-sonnet-latest", "deepseek-v4-flash", "deepseek-v4-pro", "deepseek-chat", "deepseek-reasoner", "gpt-4.1", "gpt-4o-mini", "gemini-2.0-flash", "gemini-2.5-flash", "mistral-large-latest", "mistral-small-latest", "openai/gpt-4o-mini", "google/gemini-2.0-flash-001"];
 export type RunModel = (typeof RUN_MODELS)[number];
+/**
+ * Symbol-style accessors for the closed model set. Prefer these over raw
+ * strings so an invalid token is a compile error, not a runtime 400 — e.g.
+ * `Models.CLAUDE_HAIKU_4_5`. The upstream provider is a pure function of the
+ * model ({@link providerForModel}), so picking a model fully determines
+ * routing; callers never pass `provider` separately.
+ */
+export declare const Models: {
+    /** Claude Haiku 4.5 — Anthropic. */
+    readonly CLAUDE_HAIKU_4_5: "claude-haiku-4-5";
+    /** Claude 3.5 Haiku (latest) — Anthropic. */
+    readonly CLAUDE_3_5_HAIKU_LATEST: "claude-3-5-haiku-latest";
+    /** Claude 3.5 Sonnet (latest) — Anthropic. */
+    readonly CLAUDE_3_5_SONNET_LATEST: "claude-3-5-sonnet-latest";
+    /** DeepSeek V4 Flash — DeepSeek (non-thinking, fast). */
+    readonly DEEPSEEK_V4_FLASH: "deepseek-v4-flash";
+    /** DeepSeek V4 Pro — DeepSeek (reasoning-heavy). */
+    readonly DEEPSEEK_V4_PRO: "deepseek-v4-pro";
+    /**
+     * @deprecated Legacy alias DeepSeek routes to `deepseek-v4-flash` (non-thinking).
+     * DeepSeek removes this name on 2026-07-24 15:59 UTC — migrate to
+     * {@link Models.DEEPSEEK_V4_FLASH}.
+     */
+    readonly DEEPSEEK_CHAT: "deepseek-chat";
+    /**
+     * @deprecated Legacy alias DeepSeek routes to `deepseek-v4-flash` (thinking).
+     * DeepSeek removes this name on 2026-07-24 15:59 UTC — migrate to
+     * {@link Models.DEEPSEEK_V4_FLASH} (or {@link Models.DEEPSEEK_V4_PRO} for
+     * heavier reasoning).
+     */
+    readonly DEEPSEEK_REASONER: "deepseek-reasoner";
+    /** GPT-4.1 — OpenAI. */
+    readonly GPT_4_1: "gpt-4.1";
+    /** GPT-4o mini — OpenAI. */
+    readonly GPT_4O_MINI: "gpt-4o-mini";
+    /** Gemini 2.0 Flash — Gemini. */
+    readonly GEMINI_2_0_FLASH: "gemini-2.0-flash";
+    /** Gemini 2.5 Flash — Gemini. */
+    readonly GEMINI_2_5_FLASH: "gemini-2.5-flash";
+    /** Mistral Large (latest) — Mistral. */
+    readonly MISTRAL_LARGE_LATEST: "mistral-large-latest";
+    /** Mistral Small (latest) — Mistral. */
+    readonly MISTRAL_SMALL_LATEST: "mistral-small-latest";
+    /** GPT-4o mini via OpenRouter (provider-prefixed) — cheap, tool-obedient. */
+    readonly OPENROUTER_GPT_4O_MINI: "openai/gpt-4o-mini";
+    /** Gemini 2.0 Flash via OpenRouter (provider-prefixed) — cheap, tool-obedient. */
+    readonly OPENROUTER_GEMINI_2_0_FLASH: "google/gemini-2.0-flash-001";
+};
+/**
+ * Back-compat alias for {@link Models}. Existing imports of `RunModels`
+ * keep working; new code should prefer `Models`.
+ */
 export declare const RunModels: {
+    /** Claude Haiku 4.5 — Anthropic. */
     readonly CLAUDE_HAIKU_4_5: "claude-haiku-4-5";
+    /** Claude 3.5 Haiku (latest) — Anthropic. */
     readonly CLAUDE_3_5_HAIKU_LATEST: "claude-3-5-haiku-latest";
+    /** Claude 3.5 Sonnet (latest) — Anthropic. */
     readonly CLAUDE_3_5_SONNET_LATEST: "claude-3-5-sonnet-latest";
+    /** DeepSeek V4 Flash — DeepSeek (non-thinking, fast). */
+    readonly DEEPSEEK_V4_FLASH: "deepseek-v4-flash";
+    /** DeepSeek V4 Pro — DeepSeek (reasoning-heavy). */
+    readonly DEEPSEEK_V4_PRO: "deepseek-v4-pro";
+    /**
+     * @deprecated Legacy alias DeepSeek routes to `deepseek-v4-flash` (non-thinking).
+     * DeepSeek removes this name on 2026-07-24 15:59 UTC — migrate to
+     * {@link Models.DEEPSEEK_V4_FLASH}.
+     */
     readonly DEEPSEEK_CHAT: "deepseek-chat";
+    /**
+     * @deprecated Legacy alias DeepSeek routes to `deepseek-v4-flash` (thinking).
+     * DeepSeek removes this name on 2026-07-24 15:59 UTC — migrate to
+     * {@link Models.DEEPSEEK_V4_FLASH} (or {@link Models.DEEPSEEK_V4_PRO} for
+     * heavier reasoning).
+     */
+    readonly DEEPSEEK_REASONER: "deepseek-reasoner";
+    /** GPT-4.1 — OpenAI. */
     readonly GPT_4_1: "gpt-4.1";
+    /** GPT-4o mini — OpenAI. */
     readonly GPT_4O_MINI: "gpt-4o-mini";
+    /** Gemini 2.0 Flash — Gemini. */
     readonly GEMINI_2_0_FLASH: "gemini-2.0-flash";
+    /** Gemini 2.5 Flash — Gemini. */
     readonly GEMINI_2_5_FLASH: "gemini-2.5-flash";
+    /** Mistral Large (latest) — Mistral. */
     readonly MISTRAL_LARGE_LATEST: "mistral-large-latest";
+    /** Mistral Small (latest) — Mistral. */
     readonly MISTRAL_SMALL_LATEST: "mistral-small-latest";
+    /** GPT-4o mini via OpenRouter (provider-prefixed) — cheap, tool-obedient. */
+    readonly OPENROUTER_GPT_4O_MINI: "openai/gpt-4o-mini";
+    /** Gemini 2.0 Flash via OpenRouter (provider-prefixed) — cheap, tool-obedient. */
+    readonly OPENROUTER_GEMINI_2_0_FLASH: "google/gemini-2.0-flash-001";
 };
 export declare const RUN_MODELS_BY_PROVIDER: {
     readonly anthropic: readonly ["claude-haiku-4-5", "claude-3-5-haiku-latest", "claude-3-5-sonnet-latest"];
-    readonly deepseek: readonly ["deepseek-chat"];
+    readonly deepseek: readonly ["deepseek-v4-flash", "deepseek-v4-pro", "deepseek-chat", "deepseek-reasoner"];
     readonly openai: readonly ["gpt-4.1", "gpt-4o-mini"];
     readonly gemini: readonly ["gemini-2.0-flash", "gemini-2.5-flash"];
     readonly mistral: readonly ["mistral-large-latest", "mistral-small-latest"];
+    readonly openrouter: readonly ["openai/gpt-4o-mini", "google/gemini-2.0-flash-001"];
 };
+/**
+ * Resolve the upstream provider for a model id. Returns `undefined` when the
+ * input is not a known {@link RunModel} (so the SDK can fall back to the
+ * default and let the server reject the model). Total over the closed model
+ * set, so any `RunModel` resolves.
+ */
+export declare function providerForModel(model: string): RunProvider | undefined;
 export declare function isRunModel(input: unknown): input is RunModel;
 export declare function parseRunModel(input: unknown, field?: string): RunModel;
 export declare function assertRunModelMatchesProvider(provider: RunProvider, model: RunModel, field?: string): void;

package/dist/_contracts/models.js

@@ -10,37 +10,112 @@ export const RUN_MODELS = [
     "claude-haiku-4-5",
     "claude-3-5-haiku-latest",
     "claude-3-5-sonnet-latest",
+    "deepseek-v4-flash",
+    "deepseek-v4-pro",
     "deepseek-chat",
+    "deepseek-reasoner",
     "gpt-4.1",
     "gpt-4o-mini",
     "gemini-2.0-flash",
     "gemini-2.5-flash",
     "mistral-large-latest",
-    "mistral-small-latest"
+    "mistral-small-latest",
+    "openai/gpt-4o-mini",
+    "google/gemini-2.0-flash-001"
 ];
-export const RunModels = {
+/**
+ * Symbol-style accessors for the closed model set. Prefer these over raw
+ * strings so an invalid token is a compile error, not a runtime 400 — e.g.
+ * `Models.CLAUDE_HAIKU_4_5`. The upstream provider is a pure function of the
+ * model ({@link providerForModel}), so picking a model fully determines
+ * routing; callers never pass `provider` separately.
+ */
+export const Models = {
+    /** Claude Haiku 4.5 — Anthropic. */
     CLAUDE_HAIKU_4_5: "claude-haiku-4-5",
+    /** Claude 3.5 Haiku (latest) — Anthropic. */
     CLAUDE_3_5_HAIKU_LATEST: "claude-3-5-haiku-latest",
+    /** Claude 3.5 Sonnet (latest) — Anthropic. */
     CLAUDE_3_5_SONNET_LATEST: "claude-3-5-sonnet-latest",
+    /** DeepSeek V4 Flash — DeepSeek (non-thinking, fast). */
+    DEEPSEEK_V4_FLASH: "deepseek-v4-flash",
+    /** DeepSeek V4 Pro — DeepSeek (reasoning-heavy). */
+    DEEPSEEK_V4_PRO: "deepseek-v4-pro",
+    /**
+     * @deprecated Legacy alias DeepSeek routes to `deepseek-v4-flash` (non-thinking).
+     * DeepSeek removes this name on 2026-07-24 15:59 UTC — migrate to
+     * {@link Models.DEEPSEEK_V4_FLASH}.
+     */
     DEEPSEEK_CHAT: "deepseek-chat",
+    /**
+     * @deprecated Legacy alias DeepSeek routes to `deepseek-v4-flash` (thinking).
+     * DeepSeek removes this name on 2026-07-24 15:59 UTC — migrate to
+     * {@link Models.DEEPSEEK_V4_FLASH} (or {@link Models.DEEPSEEK_V4_PRO} for
+     * heavier reasoning).
+     */
+    DEEPSEEK_REASONER: "deepseek-reasoner",
+    /** GPT-4.1 — OpenAI. */
     GPT_4_1: "gpt-4.1",
+    /** GPT-4o mini — OpenAI. */
     GPT_4O_MINI: "gpt-4o-mini",
+    /** Gemini 2.0 Flash — Gemini. */
     GEMINI_2_0_FLASH: "gemini-2.0-flash",
+    /** Gemini 2.5 Flash — Gemini. */
     GEMINI_2_5_FLASH: "gemini-2.5-flash",
+    /** Mistral Large (latest) — Mistral. */
     MISTRAL_LARGE_LATEST: "mistral-large-latest",
-    MISTRAL_SMALL_LATEST: "mistral-small-latest"
+    /** Mistral Small (latest) — Mistral. */
+    MISTRAL_SMALL_LATEST: "mistral-small-latest",
+    /** GPT-4o mini via OpenRouter (provider-prefixed) — cheap, tool-obedient. */
+    OPENROUTER_GPT_4O_MINI: "openai/gpt-4o-mini",
+    /** Gemini 2.0 Flash via OpenRouter (provider-prefixed) — cheap, tool-obedient. */
+    OPENROUTER_GEMINI_2_0_FLASH: "google/gemini-2.0-flash-001"
 };
+/**
+ * Back-compat alias for {@link Models}. Existing imports of `RunModels`
+ * keep working; new code should prefer `Models`.
+ */
+export const RunModels = Models;
 export const RUN_MODELS_BY_PROVIDER = {
     anthropic: [
-        RunModels.CLAUDE_HAIKU_4_5,
-        RunModels.CLAUDE_3_5_HAIKU_LATEST,
-        RunModels.CLAUDE_3_5_SONNET_LATEST
+        Models.CLAUDE_HAIKU_4_5,
+        Models.CLAUDE_3_5_HAIKU_LATEST,
+        Models.CLAUDE_3_5_SONNET_LATEST
+    ],
+    deepseek: [
+        Models.DEEPSEEK_V4_FLASH,
+        Models.DEEPSEEK_V4_PRO,
+        Models.DEEPSEEK_CHAT,
+        Models.DEEPSEEK_REASONER
     ],
-    deepseek: [RunModels.DEEPSEEK_CHAT],
-    openai: [RunModels.GPT_4_1, RunModels.GPT_4O_MINI],
-    gemini: [RunModels.GEMINI_2_0_FLASH, RunModels.GEMINI_2_5_FLASH],
-    mistral: [RunModels.MISTRAL_LARGE_LATEST, RunModels.MISTRAL_SMALL_LATEST]
+    openai: [Models.GPT_4_1, Models.GPT_4O_MINI],
+    gemini: [Models.GEMINI_2_0_FLASH, Models.GEMINI_2_5_FLASH],
+    mistral: [Models.MISTRAL_LARGE_LATEST, Models.MISTRAL_SMALL_LATEST],
+    openrouter: [Models.OPENROUTER_GPT_4O_MINI, Models.OPENROUTER_GEMINI_2_0_FLASH]
 };
+/**
+ * Reverse index: every model id → its single upstream provider. Derived from
+ * {@link RUN_MODELS_BY_PROVIDER} so the two never drift; each model appears
+ * under exactly one provider.
+ */
+const PROVIDER_BY_MODEL = (() => {
+    const map = {};
+    for (const [provider, models] of Object.entries(RUN_MODELS_BY_PROVIDER)) {
+        for (const model of models) {
+            map[model] = provider;
+        }
+    }
+    return map;
+})();
+/**
+ * Resolve the upstream provider for a model id. Returns `undefined` when the
+ * input is not a known {@link RunModel} (so the SDK can fall back to the
+ * default and let the server reject the model). Total over the closed model
+ * set, so any `RunModel` resolves.
+ */
+export function providerForModel(model) {
+    return PROVIDER_BY_MODEL[model];
+}
 export function isRunModel(input) {
     return typeof input === "string" && RUN_MODELS.includes(input);
 }

package/dist/_contracts/provider-support.d.ts

@@ -222,5 +222,39 @@ export declare const PROVIDER_PUBLIC_SUPPORT: {
             }];
         };
     };
+    readonly openrouter: {
+        readonly displayName: "OpenRouter";
+        readonly status: "live-unverified";
+        readonly docsAnchor: "openrouter";
+        readonly docs: readonly [{
+            readonly label: "Credentials";
+            readonly href: "credentials.md";
+        }, {
+            readonly label: "Events";
+            readonly href: "events.md";
+        }];
+        readonly evidence: readonly [{
+            readonly label: "Submission parser and routing parity";
+            readonly href: "../../contracts/test/submission.test.ts";
+        }, {
+            readonly label: "Runtime support validator";
+            readonly href: "../../contracts/test/runtime-support.test.ts";
+        }, {
+            readonly label: "Generated matrix freshness";
+            readonly href: "../../../scripts/validate/capability-matrix.test.ts";
+        }];
+        readonly runtimeEvidence: {
+            readonly managed: readonly [{
+                readonly label: "Submission parser and routing parity";
+                readonly href: "../../contracts/test/submission.test.ts";
+            }, {
+                readonly label: "Runtime support validator";
+                readonly href: "../../contracts/test/runtime-support.test.ts";
+            }, {
+                readonly label: "Generated matrix freshness";
+                readonly href: "../../../scripts/validate/capability-matrix.test.ts";
+            }];
+        };
+    };
 };
 export declare function providerPublicSupport(provider: RunProvider): ProviderPublicSupport;

package/dist/_contracts/provider-support.js

@@ -99,6 +99,16 @@ export const PROVIDER_PUBLIC_SUPPORT = {
         runtimeEvidence: {
             managed: COMMON_EVIDENCE
         }
+    },
+    openrouter: {
+        displayName: "OpenRouter",
+        status: "live-unverified",
+        docsAnchor: "openrouter",
+        docs: COMMON_DOCS,
+        evidence: COMMON_EVIDENCE,
+        runtimeEvidence: {
+            managed: COMMON_EVIDENCE
+        }
     }
 };
 export function providerPublicSupport(provider) {

package/dist/_contracts/proxy-protocol.d.ts

@@ -65,6 +65,21 @@ export declare const PROXY_ALLOWED_METHODS: readonly ["GET", "POST", "PUT", "PAT
 export type ProxyMethod = (typeof PROXY_ALLOWED_METHODS)[number];
 export declare const PROXY_RESPONSE_MODES: readonly ["status_only", "headers_only", "full"];
 export type ProxyResponseMode = (typeof PROXY_RESPONSE_MODES)[number];
+export declare const PROXY_RETRY_JITTERS: readonly ["full", "none"];
+export type ProxyRetryJitter = (typeof PROXY_RETRY_JITTERS)[number];
+export interface ProxyRetryPolicy {
+    /** Total attempts, including the initial request. */
+    readonly maxAttempts?: number;
+    readonly initialDelayMs?: number;
+    readonly maxDelayMs?: number;
+    readonly jitter?: ProxyRetryJitter;
+    readonly retryOnStatuses?: readonly number[];
+    readonly retryOnMethods?: readonly ProxyMethod[];
+    readonly respectRetryAfter?: boolean;
+}
+export type ResolvedProxyRetryPolicy = Required<ProxyRetryPolicy>;
+export declare const PROXY_RETRY_POLICY_DEFAULTS: ResolvedProxyRetryPolicy;
+export declare function resolveProxyRetryPolicy(policy: ProxyRetryPolicy): ResolvedProxyRetryPolicy;
 /**
  * Returns the narrower of the two response modes (lower width wins).
  * Pure function so the CLI and BFF can both call it without import cycles.
@@ -106,6 +121,7 @@ export interface ProxyIndexEntry {
     readonly maxRequestBytes: number;
     readonly maxResponseBytes: number;
     readonly timeoutMs: number;
+    readonly retry?: ResolvedProxyRetryPolicy;
 }
 /**
  * Default caps for a proxy endpoint when the submission doesn't specify one.
@@ -143,6 +159,7 @@ export interface ProxyEndpointPolicy {
     readonly maxRequestBytes?: number;
     readonly maxResponseBytes?: number;
     readonly timeoutMs?: number;
+    readonly retry?: ProxyRetryPolicy;
 }
 export interface BuildProxyIndexFileInput {
     readonly runId: string;

package/dist/_contracts/proxy-protocol.js

@@ -72,6 +72,27 @@ export const PROXY_HEADERS_HEADER = "x-aex-headers";
 export const PROXY_RESPONSE_MODE_HEADER = "x-aex-response-mode";
 export const PROXY_ALLOWED_METHODS = ["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD"];
 export const PROXY_RESPONSE_MODES = ["status_only", "headers_only", "full"];
+export const PROXY_RETRY_JITTERS = ["full", "none"];
+export const PROXY_RETRY_POLICY_DEFAULTS = {
+    maxAttempts: 3,
+    initialDelayMs: 250,
+    maxDelayMs: 5000,
+    jitter: "full",
+    retryOnStatuses: [408, 425, 429, 500, 502, 503, 504],
+    retryOnMethods: ["GET", "HEAD"],
+    respectRetryAfter: true
+};
+export function resolveProxyRetryPolicy(policy) {
+    return {
+        maxAttempts: policy.maxAttempts ?? PROXY_RETRY_POLICY_DEFAULTS.maxAttempts,
+        initialDelayMs: policy.initialDelayMs ?? PROXY_RETRY_POLICY_DEFAULTS.initialDelayMs,
+        maxDelayMs: policy.maxDelayMs ?? PROXY_RETRY_POLICY_DEFAULTS.maxDelayMs,
+        jitter: policy.jitter ?? PROXY_RETRY_POLICY_DEFAULTS.jitter,
+        retryOnStatuses: policy.retryOnStatuses ?? PROXY_RETRY_POLICY_DEFAULTS.retryOnStatuses,
+        retryOnMethods: policy.retryOnMethods ?? PROXY_RETRY_POLICY_DEFAULTS.retryOnMethods,
+        respectRetryAfter: policy.respectRetryAfter ?? PROXY_RETRY_POLICY_DEFAULTS.respectRetryAfter
+    };
+}
 /**
  * Narrowing order: a request may only narrow below the policy ceiling.
  * `status_only` is narrowest, `full` is widest. The BFF computes
@@ -162,7 +183,8 @@ export function buildProxyIndexFile(input) {
             responseMode: e.responseMode ?? PROXY_ENDPOINT_DEFAULTS.responseMode,
             maxRequestBytes: e.maxRequestBytes ?? PROXY_ENDPOINT_DEFAULTS.maxRequestBytes,
             maxResponseBytes: e.maxResponseBytes ?? PROXY_ENDPOINT_DEFAULTS.maxResponseBytes,
-            timeoutMs: e.timeoutMs ?? PROXY_ENDPOINT_DEFAULTS.timeoutMs
+            timeoutMs: e.timeoutMs ?? PROXY_ENDPOINT_DEFAULTS.timeoutMs,
+            ...(e.retry !== undefined ? { retry: resolveProxyRetryPolicy(e.retry) } : {})
         }))
     };
 }

package/dist/_contracts/submission.d.ts

@@ -1,4 +1,4 @@
-import { PROXY_ENDPOINT_DEFAULTS, type ProxyAuthShape, type ProxyMethod, type ProxyResponseMode } from "./proxy-protocol.js";
+import { PROXY_ENDPOINT_DEFAULTS, type ProxyAuthShape, type ProxyMethod, type ProxyRetryPolicy, type ProxyResponseMode } from "./proxy-protocol.js";
 export { PROXY_ENDPOINT_DEFAULTS };
 import type { AgentsMdRef, FileRef, McpServerRef, SkillRef } from "./run-config.js";
 import { type RuntimeSize } from "./runtime-sizes.js";
@@ -105,9 +105,35 @@ export declare function packageInstallString(pkg: PlatformPackage): string;
  * runtime; provider selection only decides which upstream model route
  * the managed provider-proxy uses.
  */
-export declare const RUN_PROVIDERS: readonly ["anthropic", "deepseek", "openai", "gemini", "mistral"];
+export declare const RUN_PROVIDERS: readonly ["anthropic", "deepseek", "openai", "gemini", "mistral", "openrouter"];
 export type RunProvider = (typeof RUN_PROVIDERS)[number];
 export declare const DEFAULT_RUN_PROVIDER: RunProvider;
+/**
+ * Symbol-style accessors for the closed provider set. Prefer these over raw
+ * strings so an invalid token is a compile error, not a runtime 400 — e.g.
+ * `Providers.DEEPSEEK`. The same model id can route through different upstream
+ * providers (official vs OpenRouter, etc.), so `provider` is a first-class
+ * submission field; name it explicitly with one of these constants rather than
+ * relying on the model alone to determine routing.
+ *
+ * Every value mirrors {@link RUN_PROVIDERS} exactly; a unit test asserts
+ * `Object.values(Providers)` deep-equals `RUN_PROVIDERS` so the two can never
+ * drift.
+ */
+export declare const Providers: {
+    /** Anthropic — Claude models. */
+    readonly ANTHROPIC: "anthropic";
+    /** DeepSeek. */
+    readonly DEEPSEEK: "deepseek";
+    /** OpenAI — GPT models. */
+    readonly OPENAI: "openai";
+    /** Google Gemini. */
+    readonly GEMINI: "gemini";
+    /** Mistral. */
+    readonly MISTRAL: "mistral";
+    /** OpenRouter — OpenAI-compatible aggregator routing to many upstream models. */
+    readonly OPENROUTER: "openrouter";
+};
 /**
  * Customer-facing runtime selector. Optional on the wire; absent resolves
  * to the same managed runtime as `"managed"`. `"native"` is no longer an
@@ -190,11 +216,13 @@ export interface PlatformProxyEndpoint {
     readonly maxRequestBytes?: number;
     readonly maxResponseBytes?: number;
     readonly timeoutMs?: number;
+    readonly retry?: ProxyRetryPolicy;
 }
 export declare const SECRETS_KEY = "secrets";
 export declare const PROXY_ENDPOINT_NAME_PATTERN: RegExp;
 export declare const RESERVED_PROXY_ENDPOINT_NAMES: Set<string>;
 export declare const deniedSecretFields: Set<string>;
+export declare function parseProxyRetryPolicy(input: unknown, field: string): ProxyRetryPolicy | undefined;
 export declare function parseProxyAuthShape(input: unknown, field: string): ProxyAuthShape;
 export declare function parseProxyMethods(input: unknown, field: string): readonly ProxyMethod[];
 export declare function parseProxyPathPrefixes(input: unknown, field: string): readonly string[];
@@ -246,23 +274,22 @@ export interface PlatformSubmission {
     readonly outputs?: PlatformOutputCaptureConfig;
     /**
      * Optional override for the managed-runtime builtin extensions enabled
-     * inside the runner container. Each entry is the bare extension name
-     * accepted by the selected runtime. The platform
-     * default is `["developer"]` which gives the agent shell + write +
-     * edit + tree tools (bash, grep via shell, file read via shell or
-     * editor, file edit). To opt in to more tools (e.g. web search via
-     * the `computercontroller` extension), pass the full list. To opt
-     * out of all builtins (pure-MCP setup), pass an empty array.
+     * inside the runner container. Each entry is one of the closed
+     * {@link BUILTINS} set (prefer the {@link Builtins} symbol
+     * const). The platform default is `["developer"]` which gives the agent
+     * shell + write + edit + tree tools (bash, grep via shell, file read via
+     * shell or editor, file edit). To opt in to more tools (e.g. web fetch via
+     * the `computercontroller` extension), pass the full list. To opt out of
+     * all builtins (pure-MCP setup), pass an empty array.
      *
      * Validation:
-     *   - Each entry matches /^[a-z][a-z0-9_-]{0,63}$/ (managed-runtime
-     *     builtin naming convention).
+     *   - Each entry must be a member of {@link BUILTINS}.
      *   - Max 16 entries.
      *   - Deduplicated.
      *
      * The dispatcher accepts and persists it for snapshot fidelity.
      */
-    readonly builtins?: readonly string[];
+    readonly builtins?: readonly Builtin[];
     /**
      * Assistant-output granularity. `buffered` (the default) emits one event per
      * assistant message; `stream` emits the agent's per-token text deltas as they
@@ -396,6 +423,31 @@ export declare function parseSubmission(input: unknown): PlatformSubmission;
 export declare const OUTPUT_MODES: readonly ["buffered", "stream"];
 export type OutputMode = (typeof OUTPUT_MODES)[number];
 export declare const DEFAULT_OUTPUT_MODE: OutputMode;
+/**
+ * Managed-runtime builtin extensions — the closed set the managed runtime
+ * accepts. Closed so an invalid name is a compile error via {@link Builtins},
+ * not a silent runtime no-op. `developer` is the platform default when
+ * `builtins` is omitted; pass an empty array to disable all builtins
+ * (pure-MCP setup).
+ */
+export declare const BUILTINS: readonly ["developer", "computercontroller", "memory", "autovisualiser", "tutorial"];
+export type Builtin = (typeof BUILTINS)[number];
+/**
+ * Symbol-style accessors for the closed builtin set, e.g.
+ * `Builtins.COMPUTER_CONTROLLER`.
+ */
+export declare const Builtins: {
+    /** Shell (bash + UNIX tools incl. grep), write, edit, tree. The default. */
+    readonly DEVELOPER: "developer";
+    /** Web fetch/scrape, scripting, general computer-control tools. */
+    readonly COMPUTER_CONTROLLER: "computercontroller";
+    /** Cross-session preference memory. */
+    readonly MEMORY: "memory";
+    /** Inline data-visualisation rendering. */
+    readonly AUTOVISUALISER: "autovisualiser";
+    /** Interactive guided tutorials. */
+    readonly TUTORIAL: "tutorial";
+};
 /**
  * Codes emitted when a submission contains features the active runtime cannot
  * serve. Code values are stable so dashboard / SDK error rendering can branch