@aexhq/sdk 0.24.0 → 0.25.1

package/dist/cli.mjs

@@ -25,16 +25,21 @@ var PROXY_RESPONSE_MODES = ["status_only", "headers_only", "full"];
 var PROXY_ENDPOINT_DEFAULTS = {
   allowHeaders: [],
   responseMode: "headers_only",
-  maxRequestBytes: 64 * 1024,
+  // 10 MiB. The body is buffered into the Worker to enforce this cap, while the
+  // launch default fits practical multimodal/tool POSTs without every endpoint
+  // needing an override.
+  maxRequestBytes: 10 * 1024 * 1024,
   // Unlimited (0). The request body is buffered to enforce its cap, so that
   // stays finite; the response is streamed, so it does not need one.
   maxResponseBytes: 0,
-  timeoutMs: 1e4
+  // 5 minutes. Long-running upstream tool/model calls should not fail under a
+  // development-oriented 10s ceiling; endpoints can still set a smaller value.
+  timeoutMs: 5 * 60 * 1e3
 };
 
 // ../contracts/dist/provider-support.js
 var COMMON_DOCS = [
-  { label: "Credentials", href: "credentials.md" },
+  { label: "Secrets", href: "secrets.md" },
   { label: "Events", href: "events.md" }
 ];
 var COMMON_EVIDENCE = [
@@ -69,7 +74,6 @@ var DEEPSEEK_MANAGED_EVIDENCE = [
 var PROVIDER_PUBLIC_SUPPORT = {
   anthropic: {
     displayName: "Anthropic",
-    status: "supported",
     docsAnchor: "anthropic",
     docs: COMMON_DOCS,
     evidence: [...COMMON_EVIDENCE, ...ANTHROPIC_MANAGED_EVIDENCE],
@@ -79,7 +83,6 @@ var PROVIDER_PUBLIC_SUPPORT = {
   },
   deepseek: {
     displayName: "DeepSeek",
-    status: "supported",
     docsAnchor: "deepseek",
     docs: COMMON_DOCS,
     evidence: [...COMMON_EVIDENCE, ...DEEPSEEK_MANAGED_EVIDENCE],
@@ -89,7 +92,6 @@ var PROVIDER_PUBLIC_SUPPORT = {
   },
   openai: {
     displayName: "OpenAI",
-    status: "live-unverified",
     docsAnchor: "openai",
     docs: COMMON_DOCS,
     evidence: COMMON_EVIDENCE,
@@ -99,7 +101,6 @@ var PROVIDER_PUBLIC_SUPPORT = {
   },
   gemini: {
     displayName: "Gemini",
-    status: "live-unverified",
     docsAnchor: "gemini",
     docs: COMMON_DOCS,
     evidence: COMMON_EVIDENCE,
@@ -109,7 +110,6 @@ var PROVIDER_PUBLIC_SUPPORT = {
   },
   mistral: {
     displayName: "Mistral",
-    status: "live-unverified",
     docsAnchor: "mistral",
     docs: COMMON_DOCS,
     evidence: COMMON_EVIDENCE,
@@ -119,7 +119,6 @@ var PROVIDER_PUBLIC_SUPPORT = {
   },
   openrouter: {
     displayName: "OpenRouter",
-    status: "live-unverified",
     docsAnchor: "openrouter",
     docs: COMMON_DOCS,
     evidence: COMMON_EVIDENCE,
@@ -128,13 +127,8 @@ var PROVIDER_PUBLIC_SUPPORT = {
     }
   },
   // Doubao (ByteDance) via the official Ark API — international BytePlus gateway.
-  // Wired + parser/routing-verified but not yet proven against a live BytePlus
-  // account, so `live-unverified`. Promote to `supported` (and swap COMMON_EVIDENCE
-  // for a DOUBAO_MANAGED_EVIDENCE pointer to live-sdk-doubao.test.ts) once the
-  // live run passes.
   doubao: {
     displayName: "Doubao",
-    status: "live-unverified",
     docsAnchor: "doubao",
     docs: COMMON_DOCS,
     evidence: COMMON_EVIDENCE,
@@ -143,11 +137,8 @@ var PROVIDER_PUBLIC_SUPPORT = {
     }
   },
   // Doubao (ByteDance) via the official Ark API — China Volcengine gateway.
-  // Same wiring as `doubao`; additionally gated on CF Worker egress reaching the
-  // Beijing host (see apps/egress-probe). `live-unverified` until proven live.
   "doubao-cn": {
     displayName: "Doubao (China)",
-    status: "live-unverified",
     docsAnchor: "doubao-cn",
     docs: COMMON_DOCS,
     evidence: COMMON_EVIDENCE,
@@ -179,8 +170,7 @@ var MODEL_PROVIDER_IDS = {
   // China Volcengine Ark gateway (`doubao-cn`). Ark accepts the API-format
   // model NAME directly in the chat-completions `model` field (no `ep-…`
   // inference-endpoint id). The native strings are the same Ark catalog ids on
-  // both gateways; BytePlus per-account availability is confirmed at live-verify
-  // (both providers ship `live-unverified` until then — provider-support.ts).
+  // both gateways.
   //   pro   — Doubao Seed 1.8 (flagship, 256K context).
   //   flash — Doubao Seed 1.6 Flash (fast/cheap, 256K context).
   "doubao-seed-pro": { doubao: "doubao-seed-1-8-251228", "doubao-cn": "doubao-seed-1-8-251228" },
@@ -222,9 +212,7 @@ var TERMINAL_RUN_STATUSES = [
   "failed",
   "timed_out",
   "cancelled",
-  "cleanup_failed",
-  "pending_delete",
-  "deleted"
+  "cleanup_failed"
 ];
 var terminalRunStatuses = new Set(TERMINAL_RUN_STATUSES);
 
@@ -762,7 +750,7 @@ var RUNTIME_SECURITY_PROFILE_CONFIG = Object.freeze({
   }),
   standard: Object.freeze({
     name: "standard",
-    defaultNetworkingMode: "limited",
+    defaultNetworkingMode: "open",
     allowOpenNetworking: true,
     allowRuntimePackages: true,
     allowCustomerEnvVars: true,
@@ -780,27 +768,6 @@ var RUNTIME_SECURITY_PROFILE_CONFIG = Object.freeze({
   })
 });
 
-// ../contracts/dist/managed-key.js
-var MANAGED_KEY_POLICY_SCHEMA_VERSION = 1;
-var BLOCKED_MANAGED_KEY_FEATURE_POLICY_V1 = Object.freeze({
-  files: "disabled",
-  packages: "disabled",
-  builtins: "disabled",
-  mcpServers: "disabled",
-  proxyEndpoints: "disabled",
-  openNetworking: "disabled"
-});
-var BLOCKED_MANAGED_KEY_POLICY_V1 = Object.freeze({
-  schemaVersion: MANAGED_KEY_POLICY_SCHEMA_VERSION,
-  credentialMode: "managed",
-  launchStage: "blocked",
-  privateImplementationAvailable: false,
-  billingRequired: true,
-  providers: Object.freeze([]),
-  runtimes: Object.freeze([]),
-  features: BLOCKED_MANAGED_KEY_FEATURE_POLICY_V1
-});
-
 // ../contracts/dist/submission.js
 var RUN_PROVIDERS = [
   "anthropic",
@@ -904,13 +871,9 @@ var forbiddenStringPatterns = Object.freeze([
   {
     reason: "private_resource_handle",
     // `<keyword><sep><id>` opaque handles (`session_a1B2c3D4e5`, `file_9f8e7d…`).
-    // The keyword set overlaps ordinary English (agent/file/skill/resource/…), so
-    // the bare shape also matched documentation prose that simply chains those
-    // words with `_`/`-` (`agent_decision_failure`, `file_grounded`,
-    // `session_handoff_contract`, `agent-judgment` — read straight out of a
-    // skill-pack doc in tool-result text). The `accept` predicate keeps the shape
-    // but requires the id segment to look minted rather than spelled — i.e. carry
-    // a digit — so genuine handles stay flagged while dictionary-word prose does not.
+    // The keyword set overlaps ordinary prose, so require the id segment to
+    // carry a digit. That keeps genuine minted handles flagged while avoiding
+    // dictionary-word chains such as `agent_decision_failure`.
     regex: /\b(?:machine|session|agent|file|skill|env|resource|handle|token_hash|bearer_hash)[_:-][A-Za-z0-9][A-Za-z0-9_-]{7,}\b/i,
     accept: isMintedResourceHandle
   },
@@ -1397,6 +1360,7 @@ function extractErrorMessage(body) {
 var operations_exports = {};
 __export(operations_exports, {
   cancelRun: () => cancelRun,
+  classifyOutput: () => classifyOutput,
   createAgentsMd: () => createAgentsMd,
   createFile: () => createFile,
   createOutputLink: () => createOutputLink,
@@ -1414,6 +1378,10 @@ __export(operations_exports, {
   downloadMetadata: () => downloadMetadata,
   downloadOutput: () => downloadOutput,
   downloadOutputs: () => downloadOutputs,
+  eventArchiveLink: () => eventArchiveLink,
+  filterOutputs: () => filterOutputs,
+  findOutput: () => findOutput,
+  findOutputs: () => findOutputs,
   findSkillByHash: () => findSkillByHash,
   findSkillByName: () => findSkillByName,
   getAgentsMd: () => getAgentsMd,
@@ -1422,6 +1390,7 @@ __export(operations_exports, {
   getRun: () => getRun,
   getRunUnit: () => getRunUnit,
   getSecret: () => getSecret,
+  getSecretValue: () => getSecretValue,
   getSkill: () => getSkill,
   listAgentsMd: () => listAgentsMd,
   listFiles: () => listFiles,
@@ -1429,8 +1398,9 @@ __export(operations_exports, {
   listRunEvents: () => listRunEvents,
   listSecrets: () => listSecrets,
   listSkills: () => listSkills,
+  normalizeOutputLinkExpiresIn: () => normalizeOutputLinkExpiresIn,
+  outputLink: () => outputLink,
   resolveOutputFileSelector: () => resolveOutputFileSelector,
-  revealSecret: () => revealSecret,
   rotateSecret: () => rotateSecret,
   submitRun: () => submitRun,
   submitRunMultipart: () => submitRunMultipart,
@@ -2180,12 +2150,50 @@ async function listRunEvents(http, runId) {
 async function getCoordinatorTicket(http, runId) {
   return http.request(`/api/runs/${encodeURIComponent(runId)}/events/ticket`, { method: "POST" });
 }
-async function listOutputs(http, runId) {
+async function listOutputs(http, runId, query) {
   const result = await http.request(`/api/runs/${encodeURIComponent(runId)}/outputs`);
-  return result.outputs;
+  return query === void 0 ? result.outputs : filterOutputs(result.outputs, query);
+}
+async function findOutputs(http, runId, query) {
+  return listOutputs(http, runId, query);
+}
+async function findOutput(http, runId, query) {
+  const matches = await findOutputs(http, runId, query);
+  if (matches.length === 0)
+    return null;
+  if (matches.length === 1)
+    return matches[0];
+  throw new RunStateError("findOutput: output query matched multiple files", {
+    runId,
+    matches: matches.map((output) => output.filename ?? output.id)
+  });
+}
+async function outputLink(http, runId, selectorOrQuery, options) {
+  const output = await resolveOutputLinkTarget(http, runId, selectorOrQuery);
+  const expiresInSeconds = normalizeOutputLinkExpiresIn(options?.expiresIn);
+  const result = await http.request(`/api/runs/${encodeURIComponent(runId)}/outputs/${encodeURIComponent(output.id)}/link`, {
+    method: "POST",
+    body: JSON.stringify({ expiresInSeconds })
+  });
+  return {
+    ...result,
+    expiresInSeconds: result.expiresInSeconds ?? expiresInSeconds,
+    output: result.output ?? output
+  };
 }
-async function createOutputLink(http, runId, outputId) {
-  return http.request(`/api/runs/${encodeURIComponent(runId)}/outputs/${encodeURIComponent(outputId)}/link`, { method: "POST" });
+async function createOutputLink(http, runId, selectorOrQuery, options) {
+  return outputLink(http, runId, selectorOrQuery, options);
+}
+async function eventArchiveLink(http, runId, options) {
+  const expiresInSeconds = normalizeOutputLinkExpiresIn(options?.expiresIn);
+  const result = await http.request(`/api/runs/${encodeURIComponent(runId)}/events/link`, {
+    method: "POST",
+    body: JSON.stringify({ expiresInSeconds })
+  });
+  return {
+    ...result,
+    expiresInSeconds: result.expiresInSeconds ?? expiresInSeconds
+  };
 }
 function resolveOutputFileSelector(outputs, selector, runId) {
   if (isPathSelector(selector)) {
@@ -2270,6 +2278,171 @@ function isPathSelector(selector) {
 function normalizeOutputLookupPath(path) {
   return path.replace(/\\/g, "/").replace(/^\/+/, "");
 }
+function filterOutputs(outputs, query) {
+  return outputs.filter((output) => outputMatchesQuery(output, query));
+}
+function classifyOutput(output) {
+  const contentType = normalizeContentType(output.contentType);
+  if (contentType) {
+    if (contentType === "application/json" || contentType.endsWith("+json") || contentType.includes("json")) {
+      return "json";
+    }
+    if (contentType.startsWith("text/"))
+      return "text";
+    if (contentType.startsWith("image/"))
+      return "image";
+    if (contentType.startsWith("audio/"))
+      return "audio";
+    if (contentType.startsWith("video/"))
+      return "video";
+    if (contentType === "application/pdf")
+      return "pdf";
+    if (contentType === "application/zip" || contentType === "application/gzip" || contentType === "application/x-gzip" || contentType === "application/x-tar" || contentType === "application/x-7z-compressed" || contentType === "application/vnd.rar" || contentType === "application/zstd") {
+      return "archive";
+    }
+    if (contentType === "application/octet-stream")
+      return "binary";
+    return "unknown";
+  }
+  const extension = extensionOf(output.filename);
+  if (!extension)
+    return "unknown";
+  if (["json", "jsonl", "ndjson"].includes(extension))
+    return "json";
+  if (["txt", "log", "md", "markdown", "csv", "tsv", "xml", "html", "htm", "yaml", "yml"].includes(extension)) {
+    return "text";
+  }
+  if (["png", "jpg", "jpeg", "gif", "webp", "avif", "bmp", "tif", "tiff", "svg"].includes(extension)) {
+    return "image";
+  }
+  if (["mp3", "wav", "flac", "m4a", "aac", "ogg", "oga", "opus"].includes(extension))
+    return "audio";
+  if (["mp4", "mov", "m4v", "webm", "mkv", "avi"].includes(extension))
+    return "video";
+  if (extension === "pdf")
+    return "pdf";
+  if (["zip", "tar", "tgz", "gz", "bz2", "xz", "7z", "rar", "zst"].includes(extension))
+    return "archive";
+  if (["bin", "exe", "dll", "so", "dylib", "dmg", "iso"].includes(extension))
+    return "binary";
+  return "unknown";
+}
+function normalizeOutputLinkExpiresIn(input = "1h") {
+  if (typeof input === "number") {
+    if (!Number.isFinite(input) || input <= 0) {
+      throw new RunStateError("outputLink: expiresIn must be a positive number of seconds", {
+        expiresIn: input
+      });
+    }
+    return Math.floor(input);
+  }
+  if (input === "15m")
+    return 15 * 60;
+  if (input === "1h")
+    return 60 * 60;
+  if (input === "1d")
+    return 24 * 60 * 60;
+  throw new RunStateError('outputLink: expiresIn must be seconds, "15m", "1h", or "1d"', {
+    expiresIn: input
+  });
+}
+async function resolveOutputLinkTarget(http, runId, selectorOrQuery) {
+  if (typeof selectorOrQuery === "string") {
+    if (selectorOrQuery.length === 0) {
+      throw new RunStateError("outputLink: selector must include an output id or query", { runId });
+    }
+    return { id: selectorOrQuery };
+  }
+  if (hasOutputId(selectorOrQuery)) {
+    if (selectorOrQuery.id.length === 0) {
+      throw new RunStateError("outputLink: selector must include an output id or query", { runId });
+    }
+    return selectorOrQuery;
+  }
+  if (isPathSelector(selectorOrQuery) && selectorOrQuery.match === "suffix") {
+    return resolveOutputFileSelector(await listOutputs(http, runId), selectorOrQuery, runId);
+  }
+  const match = await findOutput(http, runId, selectorOrQuery);
+  if (match)
+    return match;
+  throw new RunStateError("outputLink: output query matched no files", { runId });
+}
+function outputMatchesQuery(output, query) {
+  const normalizedPath = typeof output.filename === "string" ? normalizeOutputQueryPath(output.filename) : "";
+  if (query.path !== void 0 && normalizedPath !== normalizeOutputQueryPath(query.path)) {
+    return false;
+  }
+  if (query.filename !== void 0) {
+    const basename2 = basenameOf(normalizedPath);
+    if (typeof query.filename === "string") {
+      if (basename2 !== query.filename)
+        return false;
+    } else {
+      query.filename.lastIndex = 0;
+      if (!query.filename.test(basename2))
+        return false;
+    }
+  }
+  if (query.dir !== void 0 && !directoryMatches(normalizedPath, query.dir, query.recursive ?? true)) {
+    return false;
+  }
+  if (query.extension !== void 0 && extensionOf(normalizedPath) !== normalizeExtension(query.extension)) {
+    return false;
+  }
+  if (query.contentType !== void 0 && !contentTypeMatches(output.contentType, query.contentType)) {
+    return false;
+  }
+  if (query.type !== void 0 && classifyOutput(output) !== query.type) {
+    return false;
+  }
+  return true;
+}
+function hasOutputId(value) {
+  return Boolean(value && typeof value === "object" && "id" in value && typeof value.id === "string");
+}
+function normalizeOutputQueryPath(path) {
+  let normalized = path.replace(/\\/g, "/").replace(/^\/+/, "");
+  while (normalized === "outputs" || normalized.startsWith("outputs/")) {
+    normalized = normalized === "outputs" ? "" : normalized.slice("outputs/".length);
+  }
+  return normalized.replace(/\/+$/, "");
+}
+function basenameOf(path) {
+  return path.split("/").filter(Boolean).pop() ?? "";
+}
+function directoryMatches(path, dir, recursive) {
+  const normalizedDir = normalizeOutputQueryPath(dir);
+  if (normalizedDir.length === 0)
+    return true;
+  const prefix = `${normalizedDir}/`;
+  if (!path.startsWith(prefix))
+    return false;
+  const remainder = path.slice(prefix.length);
+  return remainder.length > 0 && (recursive || !remainder.includes("/"));
+}
+function normalizeExtension(extension) {
+  return extension.replace(/^\.+/, "").toLowerCase();
+}
+function extensionOf(path) {
+  if (!path)
+    return "";
+  const basename2 = basenameOf(normalizeOutputQueryPath(path));
+  const index = basename2.lastIndexOf(".");
+  return index > 0 && index < basename2.length - 1 ? basename2.slice(index + 1).toLowerCase() : "";
+}
+function normalizeContentType(contentType) {
+  return (contentType ?? "").split(";")[0].trim().toLowerCase();
+}
+function contentTypeMatches(actual, expected) {
+  const normalizedActual = normalizeContentType(actual);
+  const normalizedExpected = normalizeContentType(expected);
+  if (!normalizedActual || !normalizedExpected)
+    return false;
+  if (normalizedExpected.endsWith("/*")) {
+    return normalizedActual.startsWith(normalizedExpected.slice(0, -1));
+  }
+  return normalizedActual === normalizedExpected;
+}
 async function download(http, runId) {
   const [run, events, outputs] = await Promise.all([
     getRun(http, runId),
@@ -2558,8 +2731,8 @@ async function getSecret(http, name) {
   const result = await http.request(`/api/secrets/${encodeURIComponent(name)}`);
   return unwrapSecret(result);
 }
-async function revealSecret(http, name) {
-  return http.request(`/api/secrets/${encodeURIComponent(name)}/reveal`, {
+async function getSecretValue(http, name) {
+  return http.request(`/api/secrets/${encodeURIComponent(name)}/get_value`, {
     method: "POST"
   });
 }
@@ -3498,6 +3671,7 @@ async function runRunCmd(io2, argv) {
     agentsMd: [],
     files: [],
     mcpServers: mcpServersForSubmission,
+    tools: [],
     ...runConfig.environment ? { environment: runConfig.environment } : {},
     ...runConfig.metadata ? { metadata: runConfig.metadata } : {}
   };

package/dist/cli.mjs.sha256

@@ -1 +1 @@
-e5614dc8a94834dcf24cb939f4f553141c15790d63fa3b842eaaf0723256d658  cli.mjs
+1b28b0b2c5ae5867dad0581510c232cf2cf956226db8efc20e66d97549a0d3b0  cli.mjs

package/dist/client.d.ts

@@ -1,4 +1,4 @@
-import { HttpClient, SecretString, type AexEvent, type AgentsMdRecord, type CredentialMode, type DebugSink, type FetchLike, type FileRecord, type Output, type OutputMode, type PlatformEnvironmentInput, type PlatformSubmission, type PlatformInlineSecrets, type PlatformProxyEndpoint, type PlatformProxyEndpointAuth, type PlatformPostHookInput, type Run, type RunModel, type RunEvent, type RunProvider, type SecretRecord, type SecretReveal, type RunUnit, type Builtin, type RuntimeSize, type RuntimeKind, type SignedOutputLink, type Skill as SkillRecord, type WhoAmI } from "./_contracts/index.js";
+import { HttpClient, SecretString, type AexEvent, type AgentsMdRecord, type CredentialMode, type DebugSink, type FetchLike, type FileRecord, type Output, type OutputFileType, type OutputLink, type OutputLinkOptions, type OutputQuery, type OutputMode, type PlatformEnvironmentInput, type PlatformSubmission, type PlatformInlineSecrets, type PlatformProxyEndpoint, type PlatformProxyEndpointAuth, type PlatformPostHookInput, type Run, type RunModel, type RunEvent, type RunProvider, type SecretRecord, type SecretReveal, type RunUnit, type Builtin, type RuntimeSize, type RuntimeKind, type Skill as SkillRecord, type WhoAmI } from "./_contracts/index.js";
 import { AgentsMd } from "./agents-md.js";
 import { type UploadedAsset } from "./asset-upload.js";
 import { File } from "./file.js";
@@ -6,6 +6,7 @@ import { McpServer } from "./mcp-server.js";
 import { ProxyEndpoint } from "./proxy-endpoint.js";
 import { Secret } from "./secret.js";
 import { Skill } from "./skill.js";
+import { Tool } from "./tool.js";
 export interface AgentExecutorOptions {
     /** Workspace-scoped SDK API token. */
     readonly apiToken: string;
@@ -50,8 +51,6 @@ export interface SubmitOptions {
     /**
      * Credential source for upstream provider access. Omitted defaults to
      * `"byok"`, which requires `secrets.apiKey`.
-     * `"managed"` is reserved for paid managed-key mode and currently fails
-     * closed until the hosted private implementation is wired.
      */
     readonly credentialMode?: CredentialMode;
     /**
@@ -83,6 +82,7 @@ export interface SubmitOptions {
     readonly system?: string;
     readonly prompt: string | readonly string[];
     readonly skills?: readonly Skill[];
+    readonly tools?: readonly Tool[];
     readonly agentsMd?: readonly AgentsMd[];
     readonly files?: readonly File[];
     readonly mcpServers?: readonly McpServer[];
@@ -137,19 +137,17 @@ export interface SubmitOptions {
         readonly maxFiles?: number;
     };
     /**
-     * Override the managed runtime builtin extensions enabled inside the runner.
+     * Override the managed runtime builtins enabled inside the runner.
      * Each entry is one of the closed {@link Builtin} set — prefer the
      * {@link Builtins} symbol const so a typo is a compile error.
      *
-     * - Omitted (default): the runner enables `[Builtins.DEVELOPER]`
-     *   which gives the agent `shell`, `write`, `edit`, and `tree` tools (bash,
-     *   grep via shell, file read via shell or editor, file edit).
-     * - Empty array: the agent runs with zero builtin extensions —
-     *   useful for pure-MCP setups where every tool comes from a
-     *   submitted `mcpServers` entry.
-     * - Custom list: e.g.
-     *   `[Builtins.DEVELOPER, Builtins.COMPUTER_CONTROLLER]` to add
-     *   web fetch/scrape alongside the default shell/edit toolkit.
+     * - Omitted (default): the runner enables `DEFAULT_BUILTINS`
+     *   (`web_search`, `web_fetch`, `read`, `edit`, `glob`, `grep`, `head`,
+     *   `tail`).
+     * - Empty array: the agent runs with zero builtins — useful for pure-MCP
+     *   setups where every tool comes from a submitted `mcpServers` entry.
+     * - Custom list: narrows or extends the surface, e.g.
+     *   `[Builtins.WEB_SEARCH, Builtins.NOTEBOOK]`.
      *
      * Validation: each entry must be a member of {@link Builtins}, max 16
      * entries, deduplicated server-side.
@@ -211,6 +209,7 @@ export interface OutputFileIdSelector {
     readonly id: string;
 }
 export type OutputFileSelector = Output | OutputFileIdSelector | OutputFilePathSelector;
+export type OutputLinkSelector = string | OutputFileSelector | OutputQuery;
 export interface OutputDownloadOptions {
     readonly to?: string;
 }
@@ -317,11 +316,11 @@ export declare class FilesClient {
  * Lifecycle parity with assets/skills: a `Secret.value(...)` is per-run and
  * gone at terminal; `set` (or promoting an ephemeral via `secret.upload`)
  * persists a named, searchable workspace secret you can `get` (metadata),
- * `reveal` (audited value), `rotate`, `list`, and `delete`. The identity is the
+ * `get_value` (audited value), `rotate`, `list`, and `delete`. The identity is the
  * `name`; the value rotates under that stable name.
  *
  * Values are write-only: `set`/`rotate` send the value in the request BODY (never
- * the URL); `get`/`list` return metadata only; `reveal` is the explicit audited
+ * the URL); `get`/`list` return metadata only; `get_value` is the explicit audited
  * value read.
  */
 export declare class SecretsClient {
@@ -336,8 +335,8 @@ export declare class SecretsClient {
     list(): Promise<readonly SecretRecord[]>;
     /** Metadata for one workspace secret by name. Never returns the value. */
     get(name: string): Promise<SecretRecord>;
-    /** Audited value read — the only path that returns a workspace secret value. */
-    reveal(name: string): Promise<SecretReveal>;
+    /** Audited value read — the preferred path that returns a workspace secret value. */
+    get_value(name: string): Promise<SecretReveal>;
     /** Replace the value of an existing workspace secret; bumps its version. */
     rotate(args: {
         readonly name: string;
@@ -503,10 +502,15 @@ export declare class AgentExecutor {
     waitForRun(runId: string, options?: WaitForRunOptions): Promise<Run>;
     /** Short alias for `waitForRun`. */
     wait(runId: string, options?: WaitForRunOptions): Promise<Run>;
-    listOutputs(runId: string): Promise<readonly Output[]>;
+    listOutputs(runId: string, query?: OutputQuery): Promise<readonly Output[]>;
     /** Short alias for `listOutputs`. */
-    outputs(runId: string): Promise<readonly Output[]>;
-    createOutputLink(runId: string, outputId: string): Promise<SignedOutputLink>;
+    outputs(runId: string, query?: OutputQuery): Promise<readonly Output[]>;
+    findOutputs(runId: string, query: OutputQuery): Promise<readonly Output[]>;
+    findOutput(runId: string, query: OutputQuery): Promise<Output | null>;
+    outputLink(runId: string, selectorOrQuery: OutputLinkSelector, options?: OutputLinkOptions): Promise<OutputLink>;
+    createOutputLink(runId: string, selectorOrQuery: OutputLinkSelector, options?: OutputLinkOptions): Promise<OutputLink>;
+    fetchOutput(runId: string, selectorOrQuery: OutputLinkSelector, options?: OutputLinkOptions): Promise<Response>;
+    eventArchiveLink(runId: string, options?: OutputLinkOptions): Promise<OutputLink>;
     /**
      * Download captured deliverables. Omit `selector` to receive the full
      * outputs namespace as a zip; pass an id, Output object, or path selector
@@ -544,4 +548,4 @@ export declare class AgentExecutor {
     /** Download only the run record (the `metadata` namespace) as a zip. */
     downloadMetadata(runId: string, options?: OutputDownloadOptions): Promise<Uint8Array>;
 }
-export type { PlatformProxyEndpoint, PlatformProxyEndpointAuth };
+export type { OutputFileType, OutputLink, OutputLinkOptions, OutputQuery, PlatformProxyEndpoint, PlatformProxyEndpointAuth };