@aexhq/sdk 0.23.0 → 0.25.0

package/dist/_contracts/submission.d.ts

@@ -1,6 +1,6 @@
 import { PROXY_ENDPOINT_DEFAULTS, type ProxyAuthShape, type ProxyMethod, type ProxyRetryPolicy, type ProxyResponseMode } from "./proxy-protocol.js";
 export { PROXY_ENDPOINT_DEFAULTS };
-import type { AgentsMdRef, FileRef, McpServerRef, SkillRef } from "./run-config.js";
+import type { AgentsMdRef, FileRef, McpServerRef, SkillRef, ToolRef } from "./run-config.js";
 import { type RuntimeSize } from "./runtime-sizes.js";
 import { type PlatformPostHook, type PlatformPostHookInput } from "./post-hook.js";
 import { type RunModel } from "./models.js";
@@ -298,6 +298,7 @@ export interface PlatformSubmission {
     readonly system?: string;
     readonly prompt: readonly string[];
     readonly skills: readonly SkillRef[];
+    readonly tools?: readonly ToolRef[];
     readonly agentsMd: readonly AgentsMdRef[];
     readonly files: readonly FileRef[];
     readonly mcpServers: readonly McpServerRef[];
@@ -368,6 +369,17 @@ export interface PlatformOutputCaptureConfig {
      * platform-mandatory denies always apply and cannot be re-included.
      */
     readonly deniedDirs?: readonly string[];
+    /**
+     * Maximum time the platform may spend capturing outputs after the agent exits.
+     * Positive integer milliseconds; values above the platform maximum are clamped.
+     */
+    readonly captureTimeoutMs?: number;
+    /** Maximum size of a single captured file in bytes. Positive integer. */
+    readonly maxFileBytes?: number;
+    /** Maximum total captured output bytes for the run. Positive integer. */
+    readonly maxTotalBytes?: number;
+    /** Maximum number of captured files for the run. Positive integer. */
+    readonly maxFiles?: number;
 }
 export interface PlatformInjectionConfig {
     readonly systemPrompt?: "default" | "off";

package/dist/_contracts/submission.js

@@ -4,7 +4,7 @@ import { authShapeHeaderName, PROXY_ALLOWED_METHODS, PROXY_ENDPOINT_DEFAULTS, PR
 // existing `@aexhq/contracts` consumers of `PROXY_ENDPOINT_DEFAULTS` are
 // unaffected by the move.
 export { PROXY_ENDPOINT_DEFAULTS };
-import { parseAssetRefFields, parseMcpServerRef, parseSkillRef } from "./run-config.js";
+import { TOOL_NAME_PATTERN, normaliseSkillBundlePath, parseAssetRefFields, parseMcpServerRef, parseSkillRef } from "./run-config.js";
 import { parseRunTimeout, parseRuntimeSize } from "./runtime-sizes.js";
 import { parsePostHook } from "./post-hook.js";
 import { assertRunModelMatchesProvider, parseRunModel } from "./models.js";
@@ -1113,6 +1113,7 @@ export function parseSubmission(input) {
         "system",
         "prompt",
         "skills",
+        "tools",
         "agentsMd",
         "files",
         "mcpServers",
@@ -1134,6 +1135,7 @@ export function parseSubmission(input) {
     const system = optionalString(value.system, "submission.system");
     const prompt = parsePrompt(value.prompt);
     const skills = parseSkills(value.skills);
+    const tools = parseTools(value.tools);
     const agentsMd = parseAgentsMd(value.agentsMd);
     const files = parseFiles(value.files);
     const mcpServers = parseMcpServers(value.mcpServers);
@@ -1150,6 +1152,7 @@ export function parseSubmission(input) {
         ...(system ? { system } : {}),
         prompt,
         skills,
+        tools,
         agentsMd,
         files,
         mcpServers,
@@ -1296,12 +1299,13 @@ const MAX_OUTPUT_DIRS = 32;
  * the field.
  */
 const MAX_OUTPUT_DIR_BYTES = 512;
+const MAX_OUTPUT_CAPTURE_TIMEOUT_MS = 6 * 60 * 60 * 1000;
 function parseOutputs(input) {
     if (input === undefined || input === null) {
         return undefined;
     }
     const value = requireRecord(input, "submission.outputs");
-    const allowed = new Set(["allowedDirs", "deniedDirs"]);
+    const allowed = new Set(["allowedDirs", "deniedDirs", "captureTimeoutMs", "maxFileBytes", "maxTotalBytes", "maxFiles"]);
     for (const key of Object.keys(value)) {
         if (!allowed.has(key)) {
             throw new Error(`submission.outputs.${key} is not an allowed field; permitted: ${[...allowed].join(", ")}`);
@@ -1309,14 +1313,37 @@ function parseOutputs(input) {
     }
     const allowedDirs = parseOutputAllowedDirs(value.allowedDirs);
     const deniedDirs = parseOutputDeniedDirs(value.deniedDirs);
-    if (!allowedDirs && !deniedDirs) {
+    const captureTimeoutMs = parseOutputPositiveInteger(value.captureTimeoutMs, "submission.outputs.captureTimeoutMs", {
+        max: MAX_OUTPUT_CAPTURE_TIMEOUT_MS,
+        clamp: true
+    });
+    const maxFileBytes = parseOutputPositiveInteger(value.maxFileBytes, "submission.outputs.maxFileBytes");
+    const maxTotalBytes = parseOutputPositiveInteger(value.maxTotalBytes, "submission.outputs.maxTotalBytes");
+    const maxFiles = parseOutputPositiveInteger(value.maxFiles, "submission.outputs.maxFiles");
+    if (!allowedDirs && !deniedDirs && captureTimeoutMs === undefined && maxFileBytes === undefined && maxTotalBytes === undefined && maxFiles === undefined) {
         return undefined;
     }
     return {
         ...(allowedDirs ? { allowedDirs } : {}),
-        ...(deniedDirs ? { deniedDirs } : {})
+        ...(deniedDirs ? { deniedDirs } : {}),
+        ...(captureTimeoutMs !== undefined ? { captureTimeoutMs } : {}),
+        ...(maxFileBytes !== undefined ? { maxFileBytes } : {}),
+        ...(maxTotalBytes !== undefined ? { maxTotalBytes } : {}),
+        ...(maxFiles !== undefined ? { maxFiles } : {})
     };
 }
+function parseOutputPositiveInteger(input, field, options = {}) {
+    if (input === undefined) {
+        return undefined;
+    }
+    if (typeof input !== "number" || !Number.isInteger(input) || input <= 0) {
+        throw new Error(`${field} must be a positive integer`);
+    }
+    if (options.max !== undefined && input > options.max) {
+        return options.clamp ? options.max : input;
+    }
+    return input;
+}
 function parseOutputAllowedDirs(input) {
     if (input === undefined) {
         return undefined;
@@ -1481,6 +1508,68 @@ function parseSkills(input) {
         return ref;
     });
 }
+function parseTools(input) {
+    if (input === undefined) {
+        return [];
+    }
+    if (!Array.isArray(input)) {
+        throw new Error("submission.tools must be an array of ToolRef objects");
+    }
+    const seenNames = new Set();
+    const seenAssetIds = new Set();
+    return input.map((item, index) => {
+        const path = `submission.tools[${index}]`;
+        const raw = requireRecord(item, path);
+        for (const key of Object.keys(raw)) {
+            if (key !== "kind" &&
+                key !== "assetId" &&
+                key !== "name" &&
+                key !== "description" &&
+                key !== "input_schema" &&
+                key !== "entry") {
+                throw new Error(`${path}.${key} is not an allowed field for ToolRef; permitted: kind, assetId, name, description, input_schema, entry`);
+            }
+        }
+        if (raw.kind !== "asset") {
+            throw new Error(`${path}.kind must be 'asset' (got ${JSON.stringify(raw.kind)})`);
+        }
+        const fields = parseAssetRefFields({ kind: raw.kind, assetId: raw.assetId, name: raw.name }, path);
+        if (!TOOL_NAME_PATTERN.test(fields.name)) {
+            throw new Error(`${path}.name must match ${TOOL_NAME_PATTERN.source}`);
+        }
+        if (fields.name.includes("__")) {
+            throw new Error(`${path}.name must not contain "__"; that separator is reserved for MCP tools`);
+        }
+        if (seenNames.has(fields.name)) {
+            throw new Error(`submission.tools duplicate name: ${fields.name}`);
+        }
+        seenNames.add(fields.name);
+        if (seenAssetIds.has(fields.assetId)) {
+            throw new Error(`submission.tools duplicate assetId: ${fields.assetId}`);
+        }
+        seenAssetIds.add(fields.assetId);
+        const description = requireString(raw.description, `${path}.description`);
+        if (description.trim().length === 0 || description.length > 2048) {
+            throw new Error(`${path}.description must be non-empty and <= 2048 chars`);
+        }
+        const inputSchema = requireRecord(raw.input_schema, `${path}.input_schema`);
+        if (!isJsonValue(inputSchema)) {
+            throw new Error(`${path}.input_schema must be JSON-serializable`);
+        }
+        if (inputSchema.type !== "object") {
+            throw new Error(`${path}.input_schema.type must be "object"`);
+        }
+        const entry = normaliseSkillBundlePath(requireString(raw.entry, `${path}.entry`));
+        return {
+            kind: "asset",
+            assetId: fields.assetId,
+            name: fields.name,
+            description,
+            input_schema: inputSchema,
+            entry
+        };
+    });
+}
 function parseAgentsMd(input) {
     if (input === undefined)
         return [];

package/dist/bundle.d.ts

@@ -1,3 +1,4 @@
+import { type ToolInputSchema } from "./_contracts/index.js";
 /**
  * In-memory skill bundle: a flat path -> bytes map and the
  * deterministically-zipped representation.
@@ -22,6 +23,18 @@ export interface BundledSkill {
 /** Inline files map: path -> contents (UTF-8 string or raw bytes). */
 export type SkillFiles = Readonly<Record<string, string | Uint8Array>>;
 export declare function bundleSkillFiles(files: SkillFiles): BundledSkill;
+export interface BundledTool {
+    readonly zip: Uint8Array;
+    readonly fileCount: number;
+    readonly compressedSize: number;
+}
+export interface ToolBundleManifest {
+    readonly name: string;
+    readonly description: string;
+    readonly input_schema: ToolInputSchema;
+    readonly entry: string;
+}
+export declare function bundleToolFiles(files: SkillFiles, manifest: ToolBundleManifest): BundledTool;
 /**
  * Compute `sha256:<hex>` of the given canonicalised zip bytes. Used by
  * `Skill.fromFiles` / `Skill.fromPath` to populate the

package/dist/bundle.js

@@ -53,6 +53,57 @@ export function bundleSkillFiles(files) {
     }
     return { zip, fileCount: entries.length, compressedSize: zip.byteLength };
 }
+export function bundleToolFiles(files, manifest) {
+    if (!files || typeof files !== "object") {
+        throw new Error("Tool files map is required");
+    }
+    const entries = Object.entries(files);
+    if (entries.length === 0) {
+        throw new Error("Tool files map cannot be empty");
+    }
+    if (entries.length > SKILL_BUNDLE_LIMITS.maxFiles) {
+        throw new Error(`Tool bundle exceeds ${SKILL_BUNDLE_LIMITS.maxFiles} file limit (got ${entries.length})`);
+    }
+    const collected = new Map();
+    let totalDecompressed = 0;
+    let hasEntry = false;
+    const entryPath = validateSkillBundleEntry({ path: manifest.entry, size: 0 }).path;
+    for (const [rawPath, contents] of entries) {
+        const bytes = typeof contents === "string" ? TEXT.encode(contents) : contents;
+        if (!(bytes instanceof Uint8Array)) {
+            throw new Error(`Tool file "${rawPath}" must be a string or Uint8Array`);
+        }
+        const entry = validateSkillBundleEntry({ path: rawPath, size: bytes.byteLength });
+        totalDecompressed += bytes.byteLength;
+        if (totalDecompressed > SKILL_BUNDLE_LIMITS.maxDecompressedBytes) {
+            throw new Error(`Tool bundle exceeds decompressed cap of ${SKILL_BUNDLE_LIMITS.maxDecompressedBytes} bytes`);
+        }
+        if (collected.has(entry.path)) {
+            throw new Error(`Tool bundle contains duplicate path: ${entry.path}`);
+        }
+        if (entry.path === entryPath)
+            hasEntry = true;
+        collected.set(entry.path, bytes);
+    }
+    if (!hasEntry) {
+        throw new Error(`Tool bundle entry "${entryPath}" must exist in files`);
+    }
+    const manifestBytes = TEXT.encode(`${JSON.stringify(manifest, null, 2)}\n`);
+    if (collected.has("tool.json")) {
+        throw new Error('Tool bundle files must not include reserved "tool.json"; pass manifest fields to Tool.fromFiles instead');
+    }
+    collected.set("tool.json", manifestBytes);
+    const sorted = [...collected.entries()].sort((a, b) => (a[0] < b[0] ? -1 : a[0] > b[0] ? 1 : 0));
+    const zippable = {};
+    for (const [path, bytes] of sorted) {
+        zippable[path] = [bytes, { mtime: ZIP_EPOCH }];
+    }
+    const zip = zipSync(zippable, { level: 6 });
+    if (zip.byteLength > SKILL_BUNDLE_LIMITS.maxCompressedBytes) {
+        throw new Error(`Tool bundle exceeds compressed cap of ${SKILL_BUNDLE_LIMITS.maxCompressedBytes} bytes (got ${zip.byteLength})`);
+    }
+    return { zip, fileCount: collected.size, compressedSize: zip.byteLength };
+}
 const ZIP_EPOCH = new Date(Date.UTC(1980, 0, 1));
 /**
  * Compute `sha256:<hex>` of the given canonicalised zip bytes. Used by

package/dist/bundle.js.map

@@ -1 +1 @@
-{"version":3,"file":"bundle.js","sourceRoot":"","sources":["../src/bundle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAiB,MAAM,QAAQ,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAE,wBAAwB,EAAE,MAAM,kBAAkB,CAAC;AAwBjF,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC;AAK/B,MAAM,UAAU,gBAAgB,CAAC,KAAiB;IAChD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,mBAAmB,CAAC,QAAQ,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,wBAAwB,mBAAmB,CAAC,QAAQ,oBAAoB,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7G,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,GAAG,EAAsB,CAAC;IAChD,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAE1B,KAAK,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,OAAO,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC9E,IAAI,CAAC,CAAC,KAAK,YAAY,UAAU,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,eAAe,OAAO,kCAAkC,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,KAAK,GAAG,wBAAwB,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;QAClF,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC9B,UAAU,GAAG,IAAI,CAAC;QACpB,CAAC;QACD,iBAAiB,IAAI,KAAK,CAAC,UAAU,CAAC;QACtC,IAAI,iBAAiB,GAAG,mBAAmB,CAAC,oBAAoB,EAAE,CAAC;YACjE,MAAM,IAAI,KAAK,CACb,4CAA4C,mBAAmB,CAAC,oBAAoB,QAAQ,CAC7F,CAAC;QACJ,CAAC;QACD,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,yCAAyC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,2DAA2D;YACzD,uEAAuE;YACvE,gDAAgD,CACnD,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,sEAAsE;IACtE,qEAAqE;IACrE,sDAAsD;IACtD,MAAM,MAAM,GAAG,CAAC,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjG,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QACnC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IAC5C,IAAI,GAAG,CAAC,UAAU,GAAG,mBAAmB,CAAC,kBAAkB,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CACb,0CAA0C,mBAAmB,CAAC,kBAAkB,eAAe,GAAG,CAAC,UAAU,GAAG,CACjH,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC;AAC5E,CAAC;AAED,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAEjD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,QAAoB;IACxD,MAAM,MAAM,GAAI,UAAqD,CAAC,MAAM,EAAE,MAAM,CAAC;IACrF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,kHAAkH,CACnH,CAAC;IACJ,CAAC;IACD,qEAAqE;IACrE,uEAAuE;IACvE,oEAAoE;IACpE,qEAAqE;IACrE,aAAa;IACb,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACjD,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACnB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3D,OAAO,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,WAAW,CAAC,MAAmB;IACtC,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAW,CAAC;QAC/B,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"bundle.js","sourceRoot":"","sources":["../src/bundle.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAiB,MAAM,QAAQ,CAAC;AAChD,OAAO,EAAE,mBAAmB,EAAE,wBAAwB,EAAwB,MAAM,kBAAkB,CAAC;AAwBvG,MAAM,IAAI,GAAG,IAAI,WAAW,EAAE,CAAC;AAK/B,MAAM,UAAU,gBAAgB,CAAC,KAAiB;IAChD,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IACjD,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACrD,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,mBAAmB,CAAC,QAAQ,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,wBAAwB,mBAAmB,CAAC,QAAQ,oBAAoB,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IAC7G,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,GAAG,EAAsB,CAAC;IAChD,IAAI,UAAU,GAAG,KAAK,CAAC;IACvB,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAE1B,KAAK,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,OAAO,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC9E,IAAI,CAAC,CAAC,KAAK,YAAY,UAAU,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,eAAe,OAAO,kCAAkC,CAAC,CAAC;QAC5E,CAAC;QACD,MAAM,KAAK,GAAG,wBAAwB,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;QAClF,IAAI,KAAK,CAAC,IAAI,KAAK,UAAU,EAAE,CAAC;YAC9B,UAAU,GAAG,IAAI,CAAC;QACpB,CAAC;QACD,iBAAiB,IAAI,KAAK,CAAC,UAAU,CAAC;QACtC,IAAI,iBAAiB,GAAG,mBAAmB,CAAC,oBAAoB,EAAE,CAAC;YACjE,MAAM,IAAI,KAAK,CACb,4CAA4C,mBAAmB,CAAC,oBAAoB,QAAQ,CAC7F,CAAC;QACJ,CAAC;QACD,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,yCAAyC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACzE,CAAC;QACD,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,IAAI,KAAK,CACb,2DAA2D;YACzD,uEAAuE;YACvE,gDAAgD,CACnD,CAAC;IACJ,CAAC;IAED,sEAAsE;IACtE,sEAAsE;IACtE,qEAAqE;IACrE,sDAAsD;IACtD,MAAM,MAAM,GAAG,CAAC,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjG,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QACnC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IAC5C,IAAI,GAAG,CAAC,UAAU,GAAG,mBAAmB,CAAC,kBAAkB,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CACb,0CAA0C,mBAAmB,CAAC,kBAAkB,eAAe,GAAG,CAAC,UAAU,GAAG,CACjH,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,OAAO,CAAC,MAAM,EAAE,cAAc,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC;AAC5E,CAAC;AAeD,MAAM,UAAU,eAAe,CAC7B,KAAiB,EACjB,QAA4B;IAE5B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QACxC,MAAM,IAAI,KAAK,CAAC,4BAA4B,CAAC,CAAC;IAChD,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,OAAO,CAAC,KAAK,CAAC,CAAC;IACtC,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC,EAAE,CAAC;QACzB,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACpD,CAAC;IACD,IAAI,OAAO,CAAC,MAAM,GAAG,mBAAmB,CAAC,QAAQ,EAAE,CAAC;QAClD,MAAM,IAAI,KAAK,CAAC,uBAAuB,mBAAmB,CAAC,QAAQ,oBAAoB,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC;IAC5G,CAAC;IAED,MAAM,SAAS,GAAG,IAAI,GAAG,EAAsB,CAAC;IAChD,IAAI,iBAAiB,GAAG,CAAC,CAAC;IAC1B,IAAI,QAAQ,GAAG,KAAK,CAAC;IACrB,MAAM,SAAS,GAAG,wBAAwB,CAAC,EAAE,IAAI,EAAE,QAAQ,CAAC,KAAK,EAAE,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC;IAEnF,KAAK,MAAM,CAAC,OAAO,EAAE,QAAQ,CAAC,IAAI,OAAO,EAAE,CAAC;QAC1C,MAAM,KAAK,GAAG,OAAO,QAAQ,KAAK,QAAQ,CAAC,CAAC,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,QAAQ,CAAC;QAC9E,IAAI,CAAC,CAAC,KAAK,YAAY,UAAU,CAAC,EAAE,CAAC;YACnC,MAAM,IAAI,KAAK,CAAC,cAAc,OAAO,kCAAkC,CAAC,CAAC;QAC3E,CAAC;QACD,MAAM,KAAK,GAAG,wBAAwB,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,IAAI,EAAE,KAAK,CAAC,UAAU,EAAE,CAAC,CAAC;QAClF,iBAAiB,IAAI,KAAK,CAAC,UAAU,CAAC;QACtC,IAAI,iBAAiB,GAAG,mBAAmB,CAAC,oBAAoB,EAAE,CAAC;YACjE,MAAM,IAAI,KAAK,CACb,2CAA2C,mBAAmB,CAAC,oBAAoB,QAAQ,CAC5F,CAAC;QACJ,CAAC;QACD,IAAI,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;YAC9B,MAAM,IAAI,KAAK,CAAC,wCAAwC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACxE,CAAC;QACD,IAAI,KAAK,CAAC,IAAI,KAAK,SAAS;YAAE,QAAQ,GAAG,IAAI,CAAC;QAC9C,SAAS,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,KAAK,CAAC,CAAC;IACnC,CAAC;IAED,IAAI,CAAC,QAAQ,EAAE,CAAC;QACd,MAAM,IAAI,KAAK,CAAC,sBAAsB,SAAS,uBAAuB,CAAC,CAAC;IAC1E,CAAC;IAED,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,CAAC,GAAG,IAAI,CAAC,SAAS,CAAC,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC;IAC5E,IAAI,SAAS,CAAC,GAAG,CAAC,WAAW,CAAC,EAAE,CAAC;QAC/B,MAAM,IAAI,KAAK,CAAC,yGAAyG,CAAC,CAAC;IAC7H,CAAC;IACD,SAAS,CAAC,GAAG,CAAC,WAAW,EAAE,aAAa,CAAC,CAAC;IAE1C,MAAM,MAAM,GAAG,CAAC,GAAG,SAAS,CAAC,OAAO,EAAE,CAAC,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IACjG,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,KAAK,MAAM,CAAC,IAAI,EAAE,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;QACnC,QAAQ,CAAC,IAAI,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IACjD,CAAC;IAED,MAAM,GAAG,GAAG,OAAO,CAAC,QAAQ,EAAE,EAAE,KAAK,EAAE,CAAC,EAAE,CAAC,CAAC;IAC5C,IAAI,GAAG,CAAC,UAAU,GAAG,mBAAmB,CAAC,kBAAkB,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CACb,yCAAyC,mBAAmB,CAAC,kBAAkB,eAAe,GAAG,CAAC,UAAU,GAAG,CAChH,CAAC;IACJ,CAAC;IAED,OAAO,EAAE,GAAG,EAAE,SAAS,EAAE,SAAS,CAAC,IAAI,EAAE,cAAc,EAAE,GAAG,CAAC,UAAU,EAAE,CAAC;AAC5E,CAAC;AAED,MAAM,SAAS,GAAG,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAEjD;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,QAAoB;IACxD,MAAM,MAAM,GAAI,UAAqD,CAAC,MAAM,EAAE,MAAM,CAAC;IACrF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,kHAAkH,CACnH,CAAC;IACJ,CAAC;IACD,qEAAqE;IACrE,uEAAuE;IACvE,oEAAoE;IACpE,qEAAqE;IACrE,aAAa;IACb,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC;IACjD,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,CAAC;IACnB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3D,OAAO,SAAS,GAAG,WAAW,CAAC,MAAM,CAAC,CAAC;AACzC,CAAC;AAED,SAAS,WAAW,CAAC,MAAmB;IACtC,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAW,CAAC;QAC/B,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}

package/dist/cli.mjs

@@ -34,7 +34,7 @@ var PROXY_ENDPOINT_DEFAULTS = {
 
 // ../contracts/dist/provider-support.js
 var COMMON_DOCS = [
-  { label: "Credentials", href: "credentials.md" },
+  { label: "Secrets", href: "secrets.md" },
   { label: "Events", href: "events.md" }
 ];
 var COMMON_EVIDENCE = [
@@ -89,7 +89,7 @@ var PROVIDER_PUBLIC_SUPPORT = {
   },
   openai: {
     displayName: "OpenAI",
-    status: "live-unverified",
+    status: "supported",
     docsAnchor: "openai",
     docs: COMMON_DOCS,
     evidence: COMMON_EVIDENCE,
@@ -99,7 +99,7 @@ var PROVIDER_PUBLIC_SUPPORT = {
   },
   gemini: {
     displayName: "Gemini",
-    status: "live-unverified",
+    status: "supported",
     docsAnchor: "gemini",
     docs: COMMON_DOCS,
     evidence: COMMON_EVIDENCE,
@@ -109,7 +109,7 @@ var PROVIDER_PUBLIC_SUPPORT = {
   },
   mistral: {
     displayName: "Mistral",
-    status: "live-unverified",
+    status: "supported",
     docsAnchor: "mistral",
     docs: COMMON_DOCS,
     evidence: COMMON_EVIDENCE,
@@ -119,7 +119,7 @@ var PROVIDER_PUBLIC_SUPPORT = {
   },
   openrouter: {
     displayName: "OpenRouter",
-    status: "live-unverified",
+    status: "supported",
     docsAnchor: "openrouter",
     docs: COMMON_DOCS,
     evidence: COMMON_EVIDENCE,
@@ -128,13 +128,9 @@ var PROVIDER_PUBLIC_SUPPORT = {
     }
   },
   // Doubao (ByteDance) via the official Ark API — international BytePlus gateway.
-  // Wired + parser/routing-verified but not yet proven against a live BytePlus
-  // account, so `live-unverified`. Promote to `supported` (and swap COMMON_EVIDENCE
-  // for a DOUBAO_MANAGED_EVIDENCE pointer to live-sdk-doubao.test.ts) once the
-  // live run passes.
   doubao: {
     displayName: "Doubao",
-    status: "live-unverified",
+    status: "supported",
     docsAnchor: "doubao",
     docs: COMMON_DOCS,
     evidence: COMMON_EVIDENCE,
@@ -143,11 +139,9 @@ var PROVIDER_PUBLIC_SUPPORT = {
     }
   },
   // Doubao (ByteDance) via the official Ark API — China Volcengine gateway.
-  // Same wiring as `doubao`; additionally gated on CF Worker egress reaching the
-  // Beijing host (see apps/egress-probe). `live-unverified` until proven live.
   "doubao-cn": {
     displayName: "Doubao (China)",
-    status: "live-unverified",
+    status: "supported",
     docsAnchor: "doubao-cn",
     docs: COMMON_DOCS,
     evidence: COMMON_EVIDENCE,
@@ -179,8 +173,7 @@ var MODEL_PROVIDER_IDS = {
   // China Volcengine Ark gateway (`doubao-cn`). Ark accepts the API-format
   // model NAME directly in the chat-completions `model` field (no `ep-…`
   // inference-endpoint id). The native strings are the same Ark catalog ids on
-  // both gateways; BytePlus per-account availability is confirmed at live-verify
-  // (both providers ship `live-unverified` until then — provider-support.ts).
+  // both gateways.
   //   pro   — Doubao Seed 1.8 (flagship, 256K context).
   //   flash — Doubao Seed 1.6 Flash (fast/cheap, 256K context).
   "doubao-seed-pro": { doubao: "doubao-seed-1-8-251228", "doubao-cn": "doubao-seed-1-8-251228" },
@@ -817,6 +810,7 @@ var RUNTIME_KINDS = ["managed"];
 var MIN_REDACTION_TARGET_BYTES = 4;
 var MIN_PROXY_SECRET_BYTES = 8;
 var _MIN_PROXY_SECRET_BYTES_OK = MIN_PROXY_SECRET_BYTES >= MIN_REDACTION_TARGET_BYTES;
+var MAX_OUTPUT_CAPTURE_TIMEOUT_MS = 6 * 60 * 60 * 1e3;
 
 // ../contracts/dist/connection-ticket.js
 var encoder = new TextEncoder();
@@ -1421,6 +1415,7 @@ __export(operations_exports, {
   getRun: () => getRun,
   getRunUnit: () => getRunUnit,
   getSecret: () => getSecret,
+  getSecretValue: () => getSecretValue,
   getSkill: () => getSkill,
   listAgentsMd: () => listAgentsMd,
   listFiles: () => listFiles,
@@ -1429,7 +1424,6 @@ __export(operations_exports, {
   listSecrets: () => listSecrets,
   listSkills: () => listSkills,
   resolveOutputFileSelector: () => resolveOutputFileSelector,
-  revealSecret: () => revealSecret,
   rotateSecret: () => rotateSecret,
   submitRun: () => submitRun,
   submitRunMultipart: () => submitRunMultipart,
@@ -2557,8 +2551,8 @@ async function getSecret(http, name) {
   const result = await http.request(`/api/secrets/${encodeURIComponent(name)}`);
   return unwrapSecret(result);
 }
-async function revealSecret(http, name) {
-  return http.request(`/api/secrets/${encodeURIComponent(name)}/reveal`, {
+async function getSecretValue(http, name) {
+  return http.request(`/api/secrets/${encodeURIComponent(name)}/get_value`, {
     method: "POST"
   });
 }
@@ -3497,6 +3491,7 @@ async function runRunCmd(io2, argv) {
     agentsMd: [],
     files: [],
     mcpServers: mcpServersForSubmission,
+    tools: [],
     ...runConfig.environment ? { environment: runConfig.environment } : {},
     ...runConfig.metadata ? { metadata: runConfig.metadata } : {}
   };

package/dist/cli.mjs.sha256

@@ -1 +1 @@
-37cb8db75fb0852134f1feae2b14bcea847d968f9fe13862c508f916366d1f85  cli.mjs
+762430dc71b8a73c4ee49790997d44ada327ea0eec648cf7c26714ee785ba86e  cli.mjs

package/dist/client.d.ts

@@ -6,6 +6,7 @@ import { McpServer } from "./mcp-server.js";
 import { ProxyEndpoint } from "./proxy-endpoint.js";
 import { Secret } from "./secret.js";
 import { Skill } from "./skill.js";
+import { Tool } from "./tool.js";
 export interface AgentExecutorOptions {
     /** Workspace-scoped SDK API token. */
     readonly apiToken: string;
@@ -83,6 +84,7 @@ export interface SubmitOptions {
     readonly system?: string;
     readonly prompt: string | readonly string[];
     readonly skills?: readonly Skill[];
+    readonly tools?: readonly Tool[];
     readonly agentsMd?: readonly AgentsMd[];
     readonly files?: readonly File[];
     readonly mcpServers?: readonly McpServer[];
@@ -131,6 +133,10 @@ export interface SubmitOptions {
     readonly outputs?: {
         readonly allowedDirs?: readonly string[];
         readonly deniedDirs?: readonly string[];
+        readonly captureTimeoutMs?: number;
+        readonly maxFileBytes?: number;
+        readonly maxTotalBytes?: number;
+        readonly maxFiles?: number;
     };
     /**
      * Override the managed runtime builtin extensions enabled inside the runner.
@@ -313,11 +319,11 @@ export declare class FilesClient {
  * Lifecycle parity with assets/skills: a `Secret.value(...)` is per-run and
  * gone at terminal; `set` (or promoting an ephemeral via `secret.upload`)
  * persists a named, searchable workspace secret you can `get` (metadata),
- * `reveal` (audited value), `rotate`, `list`, and `delete`. The identity is the
+ * `get_value` (audited value), `rotate`, `list`, and `delete`. The identity is the
  * `name`; the value rotates under that stable name.
  *
  * Values are write-only: `set`/`rotate` send the value in the request BODY (never
- * the URL); `get`/`list` return metadata only; `reveal` is the explicit audited
+ * the URL); `get`/`list` return metadata only; `get_value` is the explicit audited
  * value read.
  */
 export declare class SecretsClient {
@@ -332,8 +338,8 @@ export declare class SecretsClient {
     list(): Promise<readonly SecretRecord[]>;
     /** Metadata for one workspace secret by name. Never returns the value. */
     get(name: string): Promise<SecretRecord>;
-    /** Audited value read — the only path that returns a workspace secret value. */
-    reveal(name: string): Promise<SecretReveal>;
+    /** Audited value read — the preferred path that returns a workspace secret value. */
+    get_value(name: string): Promise<SecretReveal>;
     /** Replace the value of an existing workspace secret; bumps its version. */
     rotate(args: {
         readonly name: string;

package/dist/client.js

@@ -6,6 +6,7 @@ import { McpServer } from "./mcp-server.js";
 import { splitProxyEndpoints } from "./proxy-endpoint.js";
 import { splitSecretEnv } from "./secret.js";
 import { Skill } from "./skill.js";
+import { Tool } from "./tool.js";
 /**
  * Workspace skill admin operations exposed under `client.skills`.
  *
@@ -136,11 +137,11 @@ export class FilesClient {
  * Lifecycle parity with assets/skills: a `Secret.value(...)` is per-run and
  * gone at terminal; `set` (or promoting an ephemeral via `secret.upload`)
  * persists a named, searchable workspace secret you can `get` (metadata),
- * `reveal` (audited value), `rotate`, `list`, and `delete`. The identity is the
+ * `get_value` (audited value), `rotate`, `list`, and `delete`. The identity is the
  * `name`; the value rotates under that stable name.
  *
  * Values are write-only: `set`/`rotate` send the value in the request BODY (never
- * the URL); `get`/`list` return metadata only; `reveal` is the explicit audited
+ * the URL); `get`/`list` return metadata only; `get_value` is the explicit audited
  * value read.
  */
 export class SecretsClient {
@@ -160,9 +161,9 @@ export class SecretsClient {
     get(name) {
         return operations.getSecret(this.#http, name);
     }
-    /** Audited value read — the only path that returns a workspace secret value. */
-    reveal(name) {
-        return operations.revealSecret(this.#http, name);
+    /** Audited value read — the preferred path that returns a workspace secret value. */
+    get_value(name) {
+        return operations.getSecretValue(this.#http, name);
     }
     /** Replace the value of an existing workspace secret; bumps its version. */
     rotate(args) {
@@ -360,20 +361,23 @@ export class AgentExecutor {
             throw new AexError("RUNTIME_UNSUPPORTED", `AgentExecutor.submit: runtime must be one of: ${RUNTIME_KINDS.join(", ")} ` +
                 `(got ${JSON.stringify(options.runtime)})`);
         }
-        // Walk Skill / AgentsMd / File instances. Inline drafts are eagerly
+        // Walk Skill / Tool / AgentsMd / File instances. Inline drafts are eagerly
         // uploaded to the content-addressable asset store here (before POST /runs)
         // and referenced as plain `kind:"asset"` refs. Already-materialized asset
         // refs pass through unchanged.
         const uploader = (args) => this._uploadAsset(args);
         const preparedSkills = await prepareSkills(options.skills ?? [], uploader);
+        const preparedTools = await prepareTools(options.tools ?? [], uploader);
         const preparedAgentsMd = await prepareAgentsMd(options.agentsMd ?? [], uploader);
         const preparedFiles = await prepareFiles(options.files ?? [], uploader);
         const { submissionMcpServers, mergedMcpSecrets } = mergeMcpServers(options.mcpServers ?? [], options.secrets.mcpServers ?? []);
+        const outputCapture = outputsForWire(options.outputs);
         const submission = {
             model: options.model,
             ...(options.system ? { system: options.system } : {}),
             prompt,
             skills: preparedSkills,
+            tools: preparedTools,
             agentsMd: preparedAgentsMd,
             files: preparedFiles,
             // submissionMcpServers may contain workspace refs of the shape
@@ -393,10 +397,7 @@ export class AgentExecutor {
                 ? { environment: options.environment }
                 : {}),
             ...(options.metadata ? { metadata: options.metadata } : {}),
-            ...(options.outputs &&
-                ((options.outputs.allowedDirs?.length ?? 0) > 0 || (options.outputs.deniedDirs?.length ?? 0) > 0)
-                ? { outputs: options.outputs }
-                : {}),
+            ...(outputCapture ? { outputs: outputCapture } : {}),
             // Pass-through `builtins` verbatim — including an empty array,
             // which is the "disable all builtins" signal. Distinguish from
             // omitted (default applies) via `!== undefined`.
@@ -731,6 +732,28 @@ function postHookForWire(input) {
     }
     return input;
 }
+function outputsForWire(outputs) {
+    if (outputs === undefined) {
+        return undefined;
+    }
+    const allowedDirs = outputs.allowedDirs?.filter((dir) => dir.length > 0);
+    const deniedDirs = outputs.deniedDirs?.filter((dir) => dir.length > 0);
+    const hasNumericOverride = outputs.captureTimeoutMs !== undefined ||
+        outputs.maxFileBytes !== undefined ||
+        outputs.maxTotalBytes !== undefined ||
+        outputs.maxFiles !== undefined;
+    if ((allowedDirs?.length ?? 0) === 0 && (deniedDirs?.length ?? 0) === 0 && !hasNumericOverride) {
+        return undefined;
+    }
+    return {
+        ...(allowedDirs && allowedDirs.length > 0 ? { allowedDirs } : {}),
+        ...(deniedDirs && deniedDirs.length > 0 ? { deniedDirs } : {}),
+        ...(outputs.captureTimeoutMs !== undefined ? { captureTimeoutMs: outputs.captureTimeoutMs } : {}),
+        ...(outputs.maxFileBytes !== undefined ? { maxFileBytes: outputs.maxFileBytes } : {}),
+        ...(outputs.maxTotalBytes !== undefined ? { maxTotalBytes: outputs.maxTotalBytes } : {}),
+        ...(outputs.maxFiles !== undefined ? { maxFiles: outputs.maxFiles } : {})
+    };
+}
 /** Walk Skill[], eagerly upload drafts as assets, and return plain asset refs. */
 async function prepareSkills(skills, uploader) {
     const refs = [];
@@ -765,6 +788,34 @@ async function prepareSkills(skills, uploader) {
     }
     return refs;
 }
+async function prepareTools(tools, uploader) {
+    const refs = [];
+    for (let i = 0; i < tools.length; i++) {
+        const entry = tools[i];
+        if (!(entry instanceof Tool)) {
+            throw new Error(`AgentExecutor.submit: tools[${i}] must be a Tool instance`);
+        }
+        if (entry.isConsumed) {
+            throw new Error(`AgentExecutor.submit: tools[${i}] was already consumed by a prior submit`);
+        }
+        const ref = entry.ref;
+        if (ref.kind === "draft") {
+            const bundle = entry._takeDraftBundle();
+            if (!bundle) {
+                throw new Error(`AgentExecutor.submit: tools[${i}] is draft but has no bytes`);
+            }
+            const uploaded = await uploader({
+                bytes: bundle.bytes,
+                hash: bundle.contentHash,
+                contentType: "application/zip"
+            });
+            refs.push({ ...bundle.ref, assetId: uploaded.assetId });
+            continue;
+        }
+        refs.push(ref);
+    }
+    return refs;
+}
 /** Walk AgentsMd[], eagerly upload drafts as assets, and return plain asset refs. */
 async function prepareAgentsMd(agentsMds, uploader) {
     const refs = [];