@aexhq/sdk 0.25.0 → 0.25.1

package/README.md

@@ -57,7 +57,7 @@ aex run \
 
 ## Feature Areas
 
-- **Agent runtime:** managed autonomous runs with shell, filesystem, editing, notebook, web fetch/search, background command, and post-hook repair tools.
+- **Agent runtime:** managed autonomous runs with filesystem read/edit, grep/glob/head/tail, open web fetch/search defaults, optional notebook tools, and post-hook repair.
 - **Durable infrastructure:** run records, status, wait/cancel/delete, idempotency, typed events, output capture, downloads, timeouts, and runtime sizes.
 - **Agent composition:** skills, files, AGENTS.md, remote MCP servers, proxy endpoints, environment variables, packages, and networking controls.
 - **Subagents:** typed parent/child lineage for async child runs, output handoff, and bounded agent delegation.

package/dist/_contracts/index.d.ts

@@ -18,7 +18,6 @@ export * from "./run-cost.js";
 export * from "./run-custody.js";
 export * from "./run-retention.js";
 export * from "./side-effect-audit.js";
-export * from "./managed-key.js";
 export * from "./stable.js";
 export * from "./sdk-secrets.js";
 export * from "./sdk-errors.js";

package/dist/_contracts/index.js

@@ -18,7 +18,6 @@ export * from "./run-cost.js";
 export * from "./run-custody.js";
 export * from "./run-retention.js";
 export * from "./side-effect-audit.js";
-export * from "./managed-key.js";
 export * from "./stable.js";
 export * from "./sdk-secrets.js";
 export * from "./sdk-errors.js";

package/dist/_contracts/operations.d.ts

@@ -1,6 +1,6 @@
 import type { HttpClient } from "./http.js";
 import type { RunUnit } from "./run-unit.js";
-import type { AgentsMdRecord, FileRecord, Output, OutputFileDownload, OutputFileSelector, Run, RunEvent, SecretRecord, SecretReveal, SignedOutputLink, Skill, WhoAmI } from "./runtime-types.js";
+import type { AgentsMdRecord, FileRecord, Output, OutputLink, OutputLinkOptions, OutputFileDownload, OutputFileSelector, OutputFileType, OutputQuery, Run, RunEvent, SecretRecord, SecretReveal, Skill, WhoAmI } from "./runtime-types.js";
 import type { PlatformRunSubmissionInput } from "./submission.js";
 /**
  * The single source of truth for SDK<->BFF transport. The SDK class
@@ -47,8 +47,13 @@ export interface CoordinatorTicket {
  * coordinator is configured for the deployment (HTTP 503).
  */
 export declare function getCoordinatorTicket(http: HttpClient, runId: string): Promise<CoordinatorTicket>;
-export declare function listOutputs(http: HttpClient, runId: string): Promise<readonly Output[]>;
-export declare function createOutputLink(http: HttpClient, runId: string, outputId: string): Promise<SignedOutputLink>;
+export declare function listOutputs(http: HttpClient, runId: string, query?: OutputQuery): Promise<readonly Output[]>;
+export declare function findOutputs(http: HttpClient, runId: string, query: OutputQuery): Promise<readonly Output[]>;
+export declare function findOutput(http: HttpClient, runId: string, query: OutputQuery): Promise<Output | null>;
+export type OutputLinkSelector = string | OutputFileSelector | OutputQuery;
+export declare function outputLink(http: HttpClient, runId: string, selectorOrQuery: OutputLinkSelector, options?: OutputLinkOptions): Promise<OutputLink>;
+export declare function createOutputLink(http: HttpClient, runId: string, selectorOrQuery: OutputLinkSelector, options?: OutputLinkOptions): Promise<OutputLink>;
+export declare function eventArchiveLink(http: HttpClient, runId: string, options?: OutputLinkOptions): Promise<OutputLink>;
 export declare function resolveOutputFileSelector(outputs: readonly Output[], selector: OutputFileSelector, runId?: string): Output;
 export declare function downloadOutput(http: HttpClient, runId: string, selector: OutputFileSelector): Promise<OutputFileDownload>;
 export declare function cancelRun(http: HttpClient, runId: string): Promise<void>;
@@ -61,6 +66,9 @@ export declare function deleteRun(http: HttpClient, runId: string): Promise<void
  */
 export declare function deleteWorkspaceAsset(http: HttpClient, hash: string): Promise<void>;
 export declare function whoami(http: HttpClient): Promise<WhoAmI>;
+export declare function filterOutputs(outputs: readonly Output[], query: OutputQuery): readonly Output[];
+export declare function classifyOutput(output: Pick<Output, "filename" | "contentType">): OutputFileType;
+export declare function normalizeOutputLinkExpiresIn(input?: OutputLinkOptions["expiresIn"]): number;
 /**
  * Download EVERYTHING public about a run as one zip, organised into the three
  * namespace folders:

package/dist/_contracts/operations.js

@@ -64,12 +64,50 @@ export async function listRunEvents(http, runId) {
 export async function getCoordinatorTicket(http, runId) {
     return http.request(`/api/runs/${encodeURIComponent(runId)}/events/ticket`, { method: "POST" });
 }
-export async function listOutputs(http, runId) {
+export async function listOutputs(http, runId, query) {
     const result = await http.request(`/api/runs/${encodeURIComponent(runId)}/outputs`);
-    return result.outputs;
+    return query === undefined ? result.outputs : filterOutputs(result.outputs, query);
+}
+export async function findOutputs(http, runId, query) {
+    return listOutputs(http, runId, query);
+}
+export async function findOutput(http, runId, query) {
+    const matches = await findOutputs(http, runId, query);
+    if (matches.length === 0)
+        return null;
+    if (matches.length === 1)
+        return matches[0];
+    throw new RunStateError("findOutput: output query matched multiple files", {
+        runId,
+        matches: matches.map((output) => output.filename ?? output.id)
+    });
 }
-export async function createOutputLink(http, runId, outputId) {
-    return http.request(`/api/runs/${encodeURIComponent(runId)}/outputs/${encodeURIComponent(outputId)}/link`, { method: "POST" });
+export async function outputLink(http, runId, selectorOrQuery, options) {
+    const output = await resolveOutputLinkTarget(http, runId, selectorOrQuery);
+    const expiresInSeconds = normalizeOutputLinkExpiresIn(options?.expiresIn);
+    const result = await http.request(`/api/runs/${encodeURIComponent(runId)}/outputs/${encodeURIComponent(output.id)}/link`, {
+        method: "POST",
+        body: JSON.stringify({ expiresInSeconds })
+    });
+    return {
+        ...result,
+        expiresInSeconds: result.expiresInSeconds ?? expiresInSeconds,
+        output: result.output ?? output
+    };
+}
+export async function createOutputLink(http, runId, selectorOrQuery, options) {
+    return outputLink(http, runId, selectorOrQuery, options);
+}
+export async function eventArchiveLink(http, runId, options) {
+    const expiresInSeconds = normalizeOutputLinkExpiresIn(options?.expiresIn);
+    const result = await http.request(`/api/runs/${encodeURIComponent(runId)}/events/link`, {
+        method: "POST",
+        body: JSON.stringify({ expiresInSeconds })
+    });
+    return {
+        ...result,
+        expiresInSeconds: result.expiresInSeconds ?? expiresInSeconds
+    };
 }
 export function resolveOutputFileSelector(outputs, selector, runId) {
     if (isPathSelector(selector)) {
@@ -173,6 +211,178 @@ function isPathSelector(selector) {
 function normalizeOutputLookupPath(path) {
     return path.replace(/\\/g, "/").replace(/^\/+/, "");
 }
+export function filterOutputs(outputs, query) {
+    return outputs.filter((output) => outputMatchesQuery(output, query));
+}
+export function classifyOutput(output) {
+    const contentType = normalizeContentType(output.contentType);
+    if (contentType) {
+        if (contentType === "application/json" || contentType.endsWith("+json") || contentType.includes("json")) {
+            return "json";
+        }
+        if (contentType.startsWith("text/"))
+            return "text";
+        if (contentType.startsWith("image/"))
+            return "image";
+        if (contentType.startsWith("audio/"))
+            return "audio";
+        if (contentType.startsWith("video/"))
+            return "video";
+        if (contentType === "application/pdf")
+            return "pdf";
+        if (contentType === "application/zip" ||
+            contentType === "application/gzip" ||
+            contentType === "application/x-gzip" ||
+            contentType === "application/x-tar" ||
+            contentType === "application/x-7z-compressed" ||
+            contentType === "application/vnd.rar" ||
+            contentType === "application/zstd") {
+            return "archive";
+        }
+        if (contentType === "application/octet-stream")
+            return "binary";
+        return "unknown";
+    }
+    const extension = extensionOf(output.filename);
+    if (!extension)
+        return "unknown";
+    if (["json", "jsonl", "ndjson"].includes(extension))
+        return "json";
+    if (["txt", "log", "md", "markdown", "csv", "tsv", "xml", "html", "htm", "yaml", "yml"].includes(extension)) {
+        return "text";
+    }
+    if (["png", "jpg", "jpeg", "gif", "webp", "avif", "bmp", "tif", "tiff", "svg"].includes(extension)) {
+        return "image";
+    }
+    if (["mp3", "wav", "flac", "m4a", "aac", "ogg", "oga", "opus"].includes(extension))
+        return "audio";
+    if (["mp4", "mov", "m4v", "webm", "mkv", "avi"].includes(extension))
+        return "video";
+    if (extension === "pdf")
+        return "pdf";
+    if (["zip", "tar", "tgz", "gz", "bz2", "xz", "7z", "rar", "zst"].includes(extension))
+        return "archive";
+    if (["bin", "exe", "dll", "so", "dylib", "dmg", "iso"].includes(extension))
+        return "binary";
+    return "unknown";
+}
+export function normalizeOutputLinkExpiresIn(input = "1h") {
+    if (typeof input === "number") {
+        if (!Number.isFinite(input) || input <= 0) {
+            throw new RunStateError("outputLink: expiresIn must be a positive number of seconds", {
+                expiresIn: input
+            });
+        }
+        return Math.floor(input);
+    }
+    if (input === "15m")
+        return 15 * 60;
+    if (input === "1h")
+        return 60 * 60;
+    if (input === "1d")
+        return 24 * 60 * 60;
+    throw new RunStateError("outputLink: expiresIn must be seconds, \"15m\", \"1h\", or \"1d\"", {
+        expiresIn: input
+    });
+}
+async function resolveOutputLinkTarget(http, runId, selectorOrQuery) {
+    if (typeof selectorOrQuery === "string") {
+        if (selectorOrQuery.length === 0) {
+            throw new RunStateError("outputLink: selector must include an output id or query", { runId });
+        }
+        return { id: selectorOrQuery };
+    }
+    if (hasOutputId(selectorOrQuery)) {
+        if (selectorOrQuery.id.length === 0) {
+            throw new RunStateError("outputLink: selector must include an output id or query", { runId });
+        }
+        return selectorOrQuery;
+    }
+    if (isPathSelector(selectorOrQuery) && selectorOrQuery.match === "suffix") {
+        return resolveOutputFileSelector(await listOutputs(http, runId), selectorOrQuery, runId);
+    }
+    const match = await findOutput(http, runId, selectorOrQuery);
+    if (match)
+        return match;
+    throw new RunStateError("outputLink: output query matched no files", { runId });
+}
+function outputMatchesQuery(output, query) {
+    const normalizedPath = typeof output.filename === "string" ? normalizeOutputQueryPath(output.filename) : "";
+    if (query.path !== undefined && normalizedPath !== normalizeOutputQueryPath(query.path)) {
+        return false;
+    }
+    if (query.filename !== undefined) {
+        const basename = basenameOf(normalizedPath);
+        if (typeof query.filename === "string") {
+            if (basename !== query.filename)
+                return false;
+        }
+        else {
+            query.filename.lastIndex = 0;
+            if (!query.filename.test(basename))
+                return false;
+        }
+    }
+    if (query.dir !== undefined && !directoryMatches(normalizedPath, query.dir, query.recursive ?? true)) {
+        return false;
+    }
+    if (query.extension !== undefined && extensionOf(normalizedPath) !== normalizeExtension(query.extension)) {
+        return false;
+    }
+    if (query.contentType !== undefined && !contentTypeMatches(output.contentType, query.contentType)) {
+        return false;
+    }
+    if (query.type !== undefined && classifyOutput(output) !== query.type) {
+        return false;
+    }
+    return true;
+}
+function hasOutputId(value) {
+    return Boolean(value && typeof value === "object" && "id" in value && typeof value.id === "string");
+}
+function normalizeOutputQueryPath(path) {
+    let normalized = path.replace(/\\/g, "/").replace(/^\/+/, "");
+    while (normalized === "outputs" || normalized.startsWith("outputs/")) {
+        normalized = normalized === "outputs" ? "" : normalized.slice("outputs/".length);
+    }
+    return normalized.replace(/\/+$/, "");
+}
+function basenameOf(path) {
+    return path.split("/").filter(Boolean).pop() ?? "";
+}
+function directoryMatches(path, dir, recursive) {
+    const normalizedDir = normalizeOutputQueryPath(dir);
+    if (normalizedDir.length === 0)
+        return true;
+    const prefix = `${normalizedDir}/`;
+    if (!path.startsWith(prefix))
+        return false;
+    const remainder = path.slice(prefix.length);
+    return remainder.length > 0 && (recursive || !remainder.includes("/"));
+}
+function normalizeExtension(extension) {
+    return extension.replace(/^\.+/, "").toLowerCase();
+}
+function extensionOf(path) {
+    if (!path)
+        return "";
+    const basename = basenameOf(normalizeOutputQueryPath(path));
+    const index = basename.lastIndexOf(".");
+    return index > 0 && index < basename.length - 1 ? basename.slice(index + 1).toLowerCase() : "";
+}
+function normalizeContentType(contentType) {
+    return (contentType ?? "").split(";")[0].trim().toLowerCase();
+}
+function contentTypeMatches(actual, expected) {
+    const normalizedActual = normalizeContentType(actual);
+    const normalizedExpected = normalizeContentType(expected);
+    if (!normalizedActual || !normalizedExpected)
+        return false;
+    if (normalizedExpected.endsWith("/*")) {
+        return normalizedActual.startsWith(normalizedExpected.slice(0, -1));
+    }
+    return normalizedActual === normalizedExpected;
+}
 /**
  * Download EVERYTHING public about a run as one zip, organised into the three
  * namespace folders:
@@ -468,7 +678,7 @@ export async function findSkillByName(http, name) {
     return skills.find((skill) => skill.name === name) ?? null;
 }
 // ===========================================================================
-// AgentsMd (workspace_files kind='agentsmd') operations
+// AgentsMd upload helpers. Launch submissions use content-addressed asset refs.
 // ===========================================================================
 /**
  * Upload a workspace AgentsMd file as a markdown string. The BFF
@@ -505,7 +715,7 @@ function unwrapAgentsMd(result) {
     return result;
 }
 // ===========================================================================
-// File (workspace_files kind='file') operations
+// File upload helpers. Launch submissions use content-addressed asset refs.
 // ===========================================================================
 /**
  * Upload a workspace File as a zip bundle. The BFF canonicalises the

package/dist/_contracts/provider-support.d.ts

@@ -1,6 +1,4 @@
 import type { RunProvider, RuntimeKind } from "./submission.js";
-export declare const PROVIDER_SUPPORT_STATUSES: readonly ["supported", "rejected"];
-export type ProviderSupportStatus = (typeof PROVIDER_SUPPORT_STATUSES)[number];
 export interface SupportPointer {
     readonly label: string;
     /** Markdown href, relative to `packages/sdk/docs/provider-runtime-capabilities.md`. */
@@ -8,7 +6,6 @@ export interface SupportPointer {
 }
 export interface ProviderPublicSupport {
     readonly displayName: string;
-    readonly status: ProviderSupportStatus;
     readonly docsAnchor: string;
     readonly docs: readonly SupportPointer[];
     readonly evidence: readonly SupportPointer[];
@@ -36,13 +33,12 @@ export declare const RUNTIME_VALIDATION_SUPPORT: {
 };
 /**
  * Public provider support facts for generated SDK docs. Keep this metadata
- * public-facing only: provider names, support status, docs anchors, and
- * evidence pointers.
+ * public-facing only: provider names, docs anchors, and evidence pointers.
+ * Inclusion in this registry means the provider is supported.
  */
 export declare const PROVIDER_PUBLIC_SUPPORT: {
     readonly anthropic: {
         readonly displayName: "Anthropic";
-        readonly status: "supported";
         readonly docsAnchor: "anthropic";
         readonly docs: readonly [{
             readonly label: "Secrets";
@@ -79,7 +75,6 @@ export declare const PROVIDER_PUBLIC_SUPPORT: {
     };
     readonly deepseek: {
         readonly displayName: "DeepSeek";
-        readonly status: "supported";
         readonly docsAnchor: "deepseek";
         readonly docs: readonly [{
             readonly label: "Secrets";
@@ -122,7 +117,6 @@ export declare const PROVIDER_PUBLIC_SUPPORT: {
     };
     readonly openai: {
         readonly displayName: "OpenAI";
-        readonly status: "supported";
         readonly docsAnchor: "openai";
         readonly docs: readonly [{
             readonly label: "Secrets";
@@ -156,7 +150,6 @@ export declare const PROVIDER_PUBLIC_SUPPORT: {
     };
     readonly gemini: {
         readonly displayName: "Gemini";
-        readonly status: "supported";
         readonly docsAnchor: "gemini";
         readonly docs: readonly [{
             readonly label: "Secrets";
@@ -190,7 +183,6 @@ export declare const PROVIDER_PUBLIC_SUPPORT: {
     };
     readonly mistral: {
         readonly displayName: "Mistral";
-        readonly status: "supported";
         readonly docsAnchor: "mistral";
         readonly docs: readonly [{
             readonly label: "Secrets";
@@ -224,7 +216,6 @@ export declare const PROVIDER_PUBLIC_SUPPORT: {
     };
     readonly openrouter: {
         readonly displayName: "OpenRouter";
-        readonly status: "supported";
         readonly docsAnchor: "openrouter";
         readonly docs: readonly [{
             readonly label: "Secrets";
@@ -258,7 +249,6 @@ export declare const PROVIDER_PUBLIC_SUPPORT: {
     };
     readonly doubao: {
         readonly displayName: "Doubao";
-        readonly status: "supported";
         readonly docsAnchor: "doubao";
         readonly docs: readonly [{
             readonly label: "Secrets";
@@ -292,7 +282,6 @@ export declare const PROVIDER_PUBLIC_SUPPORT: {
     };
     readonly "doubao-cn": {
         readonly displayName: "Doubao (China)";
-        readonly status: "supported";
         readonly docsAnchor: "doubao-cn";
         readonly docs: readonly [{
             readonly label: "Secrets";

package/dist/_contracts/provider-support.js

@@ -1,7 +1,3 @@
-export const PROVIDER_SUPPORT_STATUSES = [
-    "supported",
-    "rejected"
-];
 const COMMON_DOCS = [
     { label: "Secrets", href: "secrets.md" },
     { label: "Events", href: "events.md" }
@@ -45,13 +41,12 @@ export const RUNTIME_VALIDATION_SUPPORT = {
 };
 /**
  * Public provider support facts for generated SDK docs. Keep this metadata
- * public-facing only: provider names, support status, docs anchors, and
- * evidence pointers.
+ * public-facing only: provider names, docs anchors, and evidence pointers.
+ * Inclusion in this registry means the provider is supported.
  */
 export const PROVIDER_PUBLIC_SUPPORT = {
     anthropic: {
         displayName: "Anthropic",
-        status: "supported",
         docsAnchor: "anthropic",
         docs: COMMON_DOCS,
         evidence: [...COMMON_EVIDENCE, ...ANTHROPIC_MANAGED_EVIDENCE],
@@ -61,7 +56,6 @@ export const PROVIDER_PUBLIC_SUPPORT = {
     },
     deepseek: {
         displayName: "DeepSeek",
-        status: "supported",
         docsAnchor: "deepseek",
         docs: COMMON_DOCS,
         evidence: [...COMMON_EVIDENCE, ...DEEPSEEK_MANAGED_EVIDENCE],
@@ -71,7 +65,6 @@ export const PROVIDER_PUBLIC_SUPPORT = {
     },
     openai: {
         displayName: "OpenAI",
-        status: "supported",
         docsAnchor: "openai",
         docs: COMMON_DOCS,
         evidence: COMMON_EVIDENCE,
@@ -81,7 +74,6 @@ export const PROVIDER_PUBLIC_SUPPORT = {
     },
     gemini: {
         displayName: "Gemini",
-        status: "supported",
         docsAnchor: "gemini",
         docs: COMMON_DOCS,
         evidence: COMMON_EVIDENCE,
@@ -91,7 +83,6 @@ export const PROVIDER_PUBLIC_SUPPORT = {
     },
     mistral: {
         displayName: "Mistral",
-        status: "supported",
         docsAnchor: "mistral",
         docs: COMMON_DOCS,
         evidence: COMMON_EVIDENCE,
@@ -101,7 +92,6 @@ export const PROVIDER_PUBLIC_SUPPORT = {
     },
     openrouter: {
         displayName: "OpenRouter",
-        status: "supported",
         docsAnchor: "openrouter",
         docs: COMMON_DOCS,
         evidence: COMMON_EVIDENCE,
@@ -112,7 +102,6 @@ export const PROVIDER_PUBLIC_SUPPORT = {
     // Doubao (ByteDance) via the official Ark API — international BytePlus gateway.
     doubao: {
         displayName: "Doubao",
-        status: "supported",
         docsAnchor: "doubao",
         docs: COMMON_DOCS,
         evidence: COMMON_EVIDENCE,
@@ -123,7 +112,6 @@ export const PROVIDER_PUBLIC_SUPPORT = {
     // Doubao (ByteDance) via the official Ark API — China Volcengine gateway.
     "doubao-cn": {
         displayName: "Doubao (China)",
-        status: "supported",
         docsAnchor: "doubao-cn",
         docs: COMMON_DOCS,
         evidence: COMMON_EVIDENCE,

package/dist/_contracts/proxy-protocol.d.ts

@@ -134,14 +134,16 @@ export interface ProxyIndexEntry {
  * default. A customer can opt into a per-response truncation cap by setting a
  * positive value. There is no cumulative per-run call/byte budget: it needed a
  * per-call counter on the hot path and only existed to bound memory, which
- * streaming already does.
+ * streaming already does. The platform records named-proxy request bytes,
+ * response bytes, attempts, and retries as run-log usage telemetry only; no
+ * pricing/charging model is derived here.
  */
 export declare const PROXY_ENDPOINT_DEFAULTS: {
     readonly allowHeaders: readonly string[];
     readonly responseMode: ProxyResponseMode;
     readonly maxRequestBytes: number;
     readonly maxResponseBytes: 0;
-    readonly timeoutMs: 10000;
+    readonly timeoutMs: number;
 };
 /**
  * Non-secret endpoint policy the index builder consumes. Structurally a

package/dist/_contracts/proxy-protocol.js

@@ -140,16 +140,23 @@ export const PROXY_ERROR_CODES = [
  * default. A customer can opt into a per-response truncation cap by setting a
  * positive value. There is no cumulative per-run call/byte budget: it needed a
  * per-call counter on the hot path and only existed to bound memory, which
- * streaming already does.
+ * streaming already does. The platform records named-proxy request bytes,
+ * response bytes, attempts, and retries as run-log usage telemetry only; no
+ * pricing/charging model is derived here.
  */
 export const PROXY_ENDPOINT_DEFAULTS = {
     allowHeaders: [],
     responseMode: "headers_only",
-    maxRequestBytes: 64 * 1024,
+    // 10 MiB. The body is buffered into the Worker to enforce this cap, while the
+    // launch default fits practical multimodal/tool POSTs without every endpoint
+    // needing an override.
+    maxRequestBytes: 10 * 1024 * 1024,
     // Unlimited (0). The request body is buffered to enforce its cap, so that
     // stays finite; the response is streamed, so it does not need one.
     maxResponseBytes: 0,
-    timeoutMs: 10_000
+    // 5 minutes. Long-running upstream tool/model calls should not fail under a
+    // development-oriented 10s ceiling; endpoints can still set a smaller value.
+    timeoutMs: 5 * 60 * 1000
 };
 /**
  * Build the per-run {@link ProxyIndexFile} mounted into the container at

package/dist/_contracts/run-config.d.ts

@@ -164,10 +164,10 @@ export declare function parseSkillRef(input: unknown, path: string): SkillRef;
  */
 export declare function parseAssetRefFields(record: Record<string, unknown>, path: string): AssetRef;
 /**
- * Manifest entry persisted in `skill_bundles.manifest` and
- * `run_skill_snapshots.manifest`. `path` is forward-slash, relative,
- * normalised. `mode` is the stored POSIX mode (sanitised, NOT the user's
- * filesystem mode) — see `SKILL_BUNDLE_LIMITS.defaultFileMode`.
+ * Manifest entry persisted in `skill_bundles.manifest` and in run-owned
+ * snapshots. `path` is forward-slash, relative, normalised. `mode` is the
+ * stored POSIX mode (sanitised, NOT the user's filesystem mode) — see
+ * `SKILL_BUNDLE_LIMITS.defaultFileMode`.
  */
 export interface SkillBundleEntry {
     readonly path: string;

package/dist/_contracts/run-config.js

@@ -471,11 +471,10 @@ export function rejectStdioMcpShape(record) {
 /**
  * Reasons an IP-literal host should be refused. Returns null when the
  * literal is a routable public address (or not an IP literal at all — name
- * resolution is the caller's concern). This in-package copy of the
- * numeric-range deny-list is kept byte-identical to
- * platform/packages/shared/src/blueprint.ts by the contract-parity gate, so
- * the shared MCP parser, the Worker BYOK proxy handlers, and
- * `submission.parseProxyBaseUrl` all classify the same bytes.
+ * resolution is the caller's concern). This numeric-range deny-list is kept
+ * in parity across the public contract parser and platform shared parser so
+ * the MCP parser, BYOK proxy handlers, and `submission.parseProxyBaseUrl`
+ * classify the same bytes.
  *
  * `host` is the already-bracket-stripped, lowercased hostname.
  *

package/dist/_contracts/run-cost.d.ts

@@ -1,14 +1,13 @@
-import type { CredentialMode } from "./managed-key.js";
-import type { RunProvider, RuntimeKind } from "./submission.js";
+import type { CredentialMode, RunProvider, RuntimeKind } from "./submission.js";
 export declare const RUN_COST_TELEMETRY_SCHEMA_VERSION = 1;
 export declare const RUN_USAGE_SAMPLE_SCHEMA_VERSION = 1;
 export declare const RUN_COST_SUMMARY_STATUSES: readonly ["pending", "partial", "complete", "unavailable", "not_applicable"];
 export type RunCostSummaryStatus = (typeof RUN_COST_SUMMARY_STATUSES)[number];
 export declare const RUN_USAGE_SAMPLE_UNITS: readonly ["token", "millisecond", "byte", "byte_millisecond", "count", "file", "credit_unit"];
 export type RunUsageSampleUnit = (typeof RUN_USAGE_SAMPLE_UNITS)[number];
-export declare const RUN_USAGE_SAMPLE_SOURCE_TYPES: readonly ["coordinator-event", "run-event", "usage-ledger", "output-object", "proxy-call", "runtime-job", "provider-session", "storage-accrual", "billing-reservation", "billing-settlement", "billing-release", "manual-adjustment"];
+export declare const RUN_USAGE_SAMPLE_SOURCE_TYPES: readonly ["coordinator-event", "run-event", "usage-ledger", "output-object", "proxy-call", "runtime-job", "provider-session", "storage-accrual", "manual-adjustment"];
 export type RunUsageSampleSourceType = (typeof RUN_USAGE_SAMPLE_SOURCE_TYPES)[number];
-export declare const RUN_USAGE_SAMPLE_METRICS: readonly ["provider.input_tokens", "provider.output_tokens", "provider.cache_read_input_tokens", "provider.cache_creation_input_tokens", "provider.total_tokens", "runtime.queued_ms", "runtime.active_ms", "runtime.output_capture_ms", "runtime.cleanup_ms", "run.total_ms", "output.discovered_files", "output.captured_files", "output.failed_files", "output.captured_bytes", "retry.runtime_attempts", "retry.provider_poll", "retry.output_capture", "retry.output_upload", "capture.uploaded_files", "capture.failed_files", "capture.total_bytes", "storage.current_bytes", "storage.byte_milliseconds", "proxy.call_count", "proxy.failed_call_count", "proxy.request_bytes", "proxy.response_bytes", "proxy.duration_ms", "managed_key.reserved_credit_units", "managed_key.charged_credit_units", "managed_key.released_credit_units"];
+export declare const RUN_USAGE_SAMPLE_METRICS: readonly ["provider.input_tokens", "provider.output_tokens", "provider.cache_read_input_tokens", "provider.cache_creation_input_tokens", "provider.total_tokens", "runtime.queued_ms", "runtime.active_ms", "runtime.output_capture_ms", "runtime.cleanup_ms", "run.total_ms", "output.discovered_files", "output.captured_files", "output.failed_files", "output.captured_bytes", "retry.runtime_attempts", "retry.provider_poll", "retry.output_capture", "retry.output_upload", "capture.uploaded_files", "capture.failed_files", "capture.total_bytes", "storage.current_bytes", "storage.byte_milliseconds", "proxy.call_count", "proxy.failed_call_count", "proxy.request_bytes", "proxy.response_bytes", "proxy.duration_ms"];
 export type RunUsageSampleMetric = (typeof RUN_USAGE_SAMPLE_METRICS)[number];
 export interface RunUsageSampleSource {
     readonly type: RunUsageSampleSourceType;
@@ -86,12 +85,6 @@ export interface RunCostProxyTelemetry {
     readonly responseBytes?: number;
     readonly durationMs?: number;
 }
-export interface RunCostManagedKeyBudgetTelemetry {
-    readonly credentialMode?: CredentialMode;
-    readonly reservedCreditUnits?: number;
-    readonly chargedCreditUnits?: number;
-    readonly releasedCreditUnits?: number;
-}
 /**
  * The basis for a {@link RunCostTelemetry.billedCostUsd}: an honest marker of
  * whether the figure is a settle-time ESTIMATE or has been RECONCILED against
@@ -122,7 +115,6 @@ export interface RunCostTelemetry {
     readonly providerUsage?: readonly RunCostProviderUsage[];
     readonly storage?: RunCostStorageTelemetry;
     readonly proxy?: RunCostProxyTelemetry;
-    readonly managedKey?: RunCostManagedKeyBudgetTelemetry;
     /**
      * Customer-facing AEX cost of serving this run, USD — a REPORTED ESTIMATE,
      * not a charge (telemetry/showback only; no invoicing or credit deduction).