@aexhq/sdk 0.25.0 → 0.25.2

package/dist/cli.mjs

@@ -25,11 +25,16 @@ var PROXY_RESPONSE_MODES = ["status_only", "headers_only", "full"];
 var PROXY_ENDPOINT_DEFAULTS = {
   allowHeaders: [],
   responseMode: "headers_only",
-  maxRequestBytes: 64 * 1024,
+  // 10 MiB. The body is buffered into the Worker to enforce this cap, while the
+  // launch default fits practical multimodal/tool POSTs without every endpoint
+  // needing an override.
+  maxRequestBytes: 10 * 1024 * 1024,
   // Unlimited (0). The request body is buffered to enforce its cap, so that
   // stays finite; the response is streamed, so it does not need one.
   maxResponseBytes: 0,
-  timeoutMs: 1e4
+  // 5 minutes. Long-running upstream tool/model calls should not fail under a
+  // development-oriented 10s ceiling; endpoints can still set a smaller value.
+  timeoutMs: 5 * 60 * 1e3
 };
 
 // ../contracts/dist/provider-support.js
@@ -69,7 +74,6 @@ var DEEPSEEK_MANAGED_EVIDENCE = [
 var PROVIDER_PUBLIC_SUPPORT = {
   anthropic: {
     displayName: "Anthropic",
-    status: "supported",
     docsAnchor: "anthropic",
     docs: COMMON_DOCS,
     evidence: [...COMMON_EVIDENCE, ...ANTHROPIC_MANAGED_EVIDENCE],
@@ -79,7 +83,6 @@ var PROVIDER_PUBLIC_SUPPORT = {
   },
   deepseek: {
     displayName: "DeepSeek",
-    status: "supported",
     docsAnchor: "deepseek",
     docs: COMMON_DOCS,
     evidence: [...COMMON_EVIDENCE, ...DEEPSEEK_MANAGED_EVIDENCE],
@@ -89,7 +92,6 @@ var PROVIDER_PUBLIC_SUPPORT = {
   },
   openai: {
     displayName: "OpenAI",
-    status: "supported",
     docsAnchor: "openai",
     docs: COMMON_DOCS,
     evidence: COMMON_EVIDENCE,
@@ -99,7 +101,6 @@ var PROVIDER_PUBLIC_SUPPORT = {
   },
   gemini: {
     displayName: "Gemini",
-    status: "supported",
     docsAnchor: "gemini",
     docs: COMMON_DOCS,
     evidence: COMMON_EVIDENCE,
@@ -109,7 +110,6 @@ var PROVIDER_PUBLIC_SUPPORT = {
   },
   mistral: {
     displayName: "Mistral",
-    status: "supported",
     docsAnchor: "mistral",
     docs: COMMON_DOCS,
     evidence: COMMON_EVIDENCE,
@@ -119,7 +119,6 @@ var PROVIDER_PUBLIC_SUPPORT = {
   },
   openrouter: {
     displayName: "OpenRouter",
-    status: "supported",
     docsAnchor: "openrouter",
     docs: COMMON_DOCS,
     evidence: COMMON_EVIDENCE,
@@ -130,7 +129,6 @@ var PROVIDER_PUBLIC_SUPPORT = {
   // Doubao (ByteDance) via the official Ark API — international BytePlus gateway.
   doubao: {
     displayName: "Doubao",
-    status: "supported",
     docsAnchor: "doubao",
     docs: COMMON_DOCS,
     evidence: COMMON_EVIDENCE,
@@ -141,7 +139,6 @@ var PROVIDER_PUBLIC_SUPPORT = {
   // Doubao (ByteDance) via the official Ark API — China Volcengine gateway.
   "doubao-cn": {
     displayName: "Doubao (China)",
-    status: "supported",
     docsAnchor: "doubao-cn",
     docs: COMMON_DOCS,
     evidence: COMMON_EVIDENCE,
@@ -215,9 +212,7 @@ var TERMINAL_RUN_STATUSES = [
   "failed",
   "timed_out",
   "cancelled",
-  "cleanup_failed",
-  "pending_delete",
-  "deleted"
+  "cleanup_failed"
 ];
 var terminalRunStatuses = new Set(TERMINAL_RUN_STATUSES);
 
@@ -323,13 +318,13 @@ function requirePostHookRecord(input, path) {
 // ../contracts/dist/run-config.js
 var SKILL_BUNDLE_LIMITS = {
   /** Compressed (.zip) ceiling. */
-  maxCompressedBytes: 10 * 1024 * 1024,
+  maxCompressedBytes: 10 * 1024 * 1024 * 1024,
   /**
    * Hard ceiling for the direct-to-storage upload path. Bytes never transit the
    * hosted API, so its memory/request-payload limits do not cap accepted
    * bundles; objects above this product cap are rejected before upload.
    */
-  maxBytes: 2 * 1024 * 1024 * 1024,
+  maxBytes: 10 * 1024 * 1024 * 1024,
   /** Sum of uncompressed file sizes. */
   maxDecompressedBytes: 50 * 1024 * 1024,
   /** Number of regular file entries (directories don't count). */
@@ -655,6 +650,7 @@ function parseRunRequestConfig(input) {
     "mcpServers",
     "environment",
     "runtimeSize",
+    "region",
     "timeout",
     "postHook",
     "proxyEndpoints",
@@ -673,6 +669,7 @@ function parseRunRequestConfig(input) {
   const prompt = parseRunRequestConfigPrompt(record.prompt);
   const skills = parseRunRequestConfigSkills(record.skills);
   const mcpServers = parseRunRequestConfigMcpServers(record.mcpServers);
+  const region = parseRunRegion(record.region);
   const postHook = parsePostHook(record.postHook, "run request config postHook");
   return {
     model,
@@ -686,6 +683,7 @@ function parseRunRequestConfig(input) {
     // of truth. The CLI surfaces structural errors at submission time.
     ...record.environment !== void 0 ? { environment: record.environment } : {},
     ...record.runtimeSize !== void 0 ? { runtimeSize: record.runtimeSize } : {},
+    ...region !== void 0 ? { region } : {},
     ...record.timeout !== void 0 ? { timeout: record.timeout } : {},
     ...postHook !== void 0 ? { postHook: record.postHook } : {},
     ...record.proxyEndpoints !== void 0 ? { proxyEndpoints: record.proxyEndpoints } : {},
@@ -755,7 +753,7 @@ var RUNTIME_SECURITY_PROFILE_CONFIG = Object.freeze({
   }),
   standard: Object.freeze({
     name: "standard",
-    defaultNetworkingMode: "limited",
+    defaultNetworkingMode: "open",
     allowOpenNetworking: true,
     allowRuntimePackages: true,
     allowCustomerEnvVars: true,
@@ -773,27 +771,6 @@ var RUNTIME_SECURITY_PROFILE_CONFIG = Object.freeze({
   })
 });
 
-// ../contracts/dist/managed-key.js
-var MANAGED_KEY_POLICY_SCHEMA_VERSION = 1;
-var BLOCKED_MANAGED_KEY_FEATURE_POLICY_V1 = Object.freeze({
-  files: "disabled",
-  packages: "disabled",
-  builtins: "disabled",
-  mcpServers: "disabled",
-  proxyEndpoints: "disabled",
-  openNetworking: "disabled"
-});
-var BLOCKED_MANAGED_KEY_POLICY_V1 = Object.freeze({
-  schemaVersion: MANAGED_KEY_POLICY_SCHEMA_VERSION,
-  credentialMode: "managed",
-  launchStage: "blocked",
-  privateImplementationAvailable: false,
-  billingRequired: true,
-  providers: Object.freeze([]),
-  runtimes: Object.freeze([]),
-  features: BLOCKED_MANAGED_KEY_FEATURE_POLICY_V1
-});
-
 // ../contracts/dist/submission.js
 var RUN_PROVIDERS = [
   "anthropic",
@@ -806,10 +783,20 @@ var RUN_PROVIDERS = [
   "doubao-cn"
 ];
 var DEFAULT_RUN_PROVIDER = "anthropic";
+var RUN_REGIONS = ["lhr", "iad", "sfo", "bom"];
 var RUNTIME_KINDS = ["managed"];
 var MIN_REDACTION_TARGET_BYTES = 4;
 var MIN_PROXY_SECRET_BYTES = 8;
 var _MIN_PROXY_SECRET_BYTES_OK = MIN_PROXY_SECRET_BYTES >= MIN_REDACTION_TARGET_BYTES;
+function parseRunRegion(input) {
+  if (input === void 0) {
+    return void 0;
+  }
+  if (typeof input !== "string" || !RUN_REGIONS.includes(input)) {
+    throw new Error(`region must be one of: ${RUN_REGIONS.join(", ")} (got ${JSON.stringify(input)})`);
+  }
+  return input;
+}
 var MAX_OUTPUT_CAPTURE_TIMEOUT_MS = 6 * 60 * 60 * 1e3;
 
 // ../contracts/dist/connection-ticket.js
@@ -897,13 +884,9 @@ var forbiddenStringPatterns = Object.freeze([
   {
     reason: "private_resource_handle",
     // `<keyword><sep><id>` opaque handles (`session_a1B2c3D4e5`, `file_9f8e7d…`).
-    // The keyword set overlaps ordinary English (agent/file/skill/resource/…), so
-    // the bare shape also matched documentation prose that simply chains those
-    // words with `_`/`-` (`agent_decision_failure`, `file_grounded`,
-    // `session_handoff_contract`, `agent-judgment` — read straight out of a
-    // skill-pack doc in tool-result text). The `accept` predicate keeps the shape
-    // but requires the id segment to look minted rather than spelled — i.e. carry
-    // a digit — so genuine handles stay flagged while dictionary-word prose does not.
+    // The keyword set overlaps ordinary prose, so require the id segment to
+    // carry a digit. That keeps genuine minted handles flagged while avoiding
+    // dictionary-word chains such as `agent_decision_failure`.
     regex: /\b(?:machine|session|agent|file|skill|env|resource|handle|token_hash|bearer_hash)[_:-][A-Za-z0-9][A-Za-z0-9_-]{7,}\b/i,
     accept: isMintedResourceHandle
   },
@@ -1390,6 +1373,7 @@ function extractErrorMessage(body) {
 var operations_exports = {};
 __export(operations_exports, {
   cancelRun: () => cancelRun,
+  classifyOutput: () => classifyOutput,
   createAgentsMd: () => createAgentsMd,
   createFile: () => createFile,
   createOutputLink: () => createOutputLink,
@@ -1407,6 +1391,10 @@ __export(operations_exports, {
   downloadMetadata: () => downloadMetadata,
   downloadOutput: () => downloadOutput,
   downloadOutputs: () => downloadOutputs,
+  eventArchiveLink: () => eventArchiveLink,
+  filterOutputs: () => filterOutputs,
+  findOutput: () => findOutput,
+  findOutputs: () => findOutputs,
   findSkillByHash: () => findSkillByHash,
   findSkillByName: () => findSkillByName,
   getAgentsMd: () => getAgentsMd,
@@ -1423,6 +1411,8 @@ __export(operations_exports, {
   listRunEvents: () => listRunEvents,
   listSecrets: () => listSecrets,
   listSkills: () => listSkills,
+  normalizeOutputLinkExpiresIn: () => normalizeOutputLinkExpiresIn,
+  outputLink: () => outputLink,
   resolveOutputFileSelector: () => resolveOutputFileSelector,
   rotateSecret: () => rotateSecret,
   submitRun: () => submitRun,
@@ -2173,12 +2163,50 @@ async function listRunEvents(http, runId) {
 async function getCoordinatorTicket(http, runId) {
   return http.request(`/api/runs/${encodeURIComponent(runId)}/events/ticket`, { method: "POST" });
 }
-async function listOutputs(http, runId) {
+async function listOutputs(http, runId, query) {
   const result = await http.request(`/api/runs/${encodeURIComponent(runId)}/outputs`);
-  return result.outputs;
+  return query === void 0 ? result.outputs : filterOutputs(result.outputs, query);
 }
-async function createOutputLink(http, runId, outputId) {
-  return http.request(`/api/runs/${encodeURIComponent(runId)}/outputs/${encodeURIComponent(outputId)}/link`, { method: "POST" });
+async function findOutputs(http, runId, query) {
+  return listOutputs(http, runId, query);
+}
+async function findOutput(http, runId, query) {
+  const matches = await findOutputs(http, runId, query);
+  if (matches.length === 0)
+    return null;
+  if (matches.length === 1)
+    return matches[0];
+  throw new RunStateError("findOutput: output query matched multiple files", {
+    runId,
+    matches: matches.map((output) => output.filename ?? output.id)
+  });
+}
+async function outputLink(http, runId, selectorOrQuery, options) {
+  const output = await resolveOutputLinkTarget(http, runId, selectorOrQuery);
+  const expiresInSeconds = normalizeOutputLinkExpiresIn(options?.expiresIn);
+  const result = await http.request(`/api/runs/${encodeURIComponent(runId)}/outputs/${encodeURIComponent(output.id)}/link`, {
+    method: "POST",
+    body: JSON.stringify({ expiresInSeconds })
+  });
+  return {
+    ...result,
+    expiresInSeconds: result.expiresInSeconds ?? expiresInSeconds,
+    output: result.output ?? output
+  };
+}
+async function createOutputLink(http, runId, selectorOrQuery, options) {
+  return outputLink(http, runId, selectorOrQuery, options);
+}
+async function eventArchiveLink(http, runId, options) {
+  const expiresInSeconds = normalizeOutputLinkExpiresIn(options?.expiresIn);
+  const result = await http.request(`/api/runs/${encodeURIComponent(runId)}/events/link`, {
+    method: "POST",
+    body: JSON.stringify({ expiresInSeconds })
+  });
+  return {
+    ...result,
+    expiresInSeconds: result.expiresInSeconds ?? expiresInSeconds
+  };
 }
 function resolveOutputFileSelector(outputs, selector, runId) {
   if (isPathSelector(selector)) {
@@ -2263,6 +2291,171 @@ function isPathSelector(selector) {
 function normalizeOutputLookupPath(path) {
   return path.replace(/\\/g, "/").replace(/^\/+/, "");
 }
+function filterOutputs(outputs, query) {
+  return outputs.filter((output) => outputMatchesQuery(output, query));
+}
+function classifyOutput(output) {
+  const contentType = normalizeContentType(output.contentType);
+  if (contentType) {
+    if (contentType === "application/json" || contentType.endsWith("+json") || contentType.includes("json")) {
+      return "json";
+    }
+    if (contentType.startsWith("text/"))
+      return "text";
+    if (contentType.startsWith("image/"))
+      return "image";
+    if (contentType.startsWith("audio/"))
+      return "audio";
+    if (contentType.startsWith("video/"))
+      return "video";
+    if (contentType === "application/pdf")
+      return "pdf";
+    if (contentType === "application/zip" || contentType === "application/gzip" || contentType === "application/x-gzip" || contentType === "application/x-tar" || contentType === "application/x-7z-compressed" || contentType === "application/vnd.rar" || contentType === "application/zstd") {
+      return "archive";
+    }
+    if (contentType === "application/octet-stream")
+      return "binary";
+    return "unknown";
+  }
+  const extension = extensionOf(output.filename);
+  if (!extension)
+    return "unknown";
+  if (["json", "jsonl", "ndjson"].includes(extension))
+    return "json";
+  if (["txt", "log", "md", "markdown", "csv", "tsv", "xml", "html", "htm", "yaml", "yml"].includes(extension)) {
+    return "text";
+  }
+  if (["png", "jpg", "jpeg", "gif", "webp", "avif", "bmp", "tif", "tiff", "svg"].includes(extension)) {
+    return "image";
+  }
+  if (["mp3", "wav", "flac", "m4a", "aac", "ogg", "oga", "opus"].includes(extension))
+    return "audio";
+  if (["mp4", "mov", "m4v", "webm", "mkv", "avi"].includes(extension))
+    return "video";
+  if (extension === "pdf")
+    return "pdf";
+  if (["zip", "tar", "tgz", "gz", "bz2", "xz", "7z", "rar", "zst"].includes(extension))
+    return "archive";
+  if (["bin", "exe", "dll", "so", "dylib", "dmg", "iso"].includes(extension))
+    return "binary";
+  return "unknown";
+}
+function normalizeOutputLinkExpiresIn(input = "1h") {
+  if (typeof input === "number") {
+    if (!Number.isFinite(input) || input <= 0) {
+      throw new RunStateError("outputLink: expiresIn must be a positive number of seconds", {
+        expiresIn: input
+      });
+    }
+    return Math.floor(input);
+  }
+  if (input === "15m")
+    return 15 * 60;
+  if (input === "1h")
+    return 60 * 60;
+  if (input === "1d")
+    return 24 * 60 * 60;
+  throw new RunStateError('outputLink: expiresIn must be seconds, "15m", "1h", or "1d"', {
+    expiresIn: input
+  });
+}
+async function resolveOutputLinkTarget(http, runId, selectorOrQuery) {
+  if (typeof selectorOrQuery === "string") {
+    if (selectorOrQuery.length === 0) {
+      throw new RunStateError("outputLink: selector must include an output id or query", { runId });
+    }
+    return { id: selectorOrQuery };
+  }
+  if (hasOutputId(selectorOrQuery)) {
+    if (selectorOrQuery.id.length === 0) {
+      throw new RunStateError("outputLink: selector must include an output id or query", { runId });
+    }
+    return selectorOrQuery;
+  }
+  if (isPathSelector(selectorOrQuery) && selectorOrQuery.match === "suffix") {
+    return resolveOutputFileSelector(await listOutputs(http, runId), selectorOrQuery, runId);
+  }
+  const match = await findOutput(http, runId, selectorOrQuery);
+  if (match)
+    return match;
+  throw new RunStateError("outputLink: output query matched no files", { runId });
+}
+function outputMatchesQuery(output, query) {
+  const normalizedPath = typeof output.filename === "string" ? normalizeOutputQueryPath(output.filename) : "";
+  if (query.path !== void 0 && normalizedPath !== normalizeOutputQueryPath(query.path)) {
+    return false;
+  }
+  if (query.filename !== void 0) {
+    const basename2 = basenameOf(normalizedPath);
+    if (typeof query.filename === "string") {
+      if (basename2 !== query.filename)
+        return false;
+    } else {
+      query.filename.lastIndex = 0;
+      if (!query.filename.test(basename2))
+        return false;
+    }
+  }
+  if (query.dir !== void 0 && !directoryMatches(normalizedPath, query.dir, query.recursive ?? true)) {
+    return false;
+  }
+  if (query.extension !== void 0 && extensionOf(normalizedPath) !== normalizeExtension(query.extension)) {
+    return false;
+  }
+  if (query.contentType !== void 0 && !contentTypeMatches(output.contentType, query.contentType)) {
+    return false;
+  }
+  if (query.type !== void 0 && classifyOutput(output) !== query.type) {
+    return false;
+  }
+  return true;
+}
+function hasOutputId(value) {
+  return Boolean(value && typeof value === "object" && "id" in value && typeof value.id === "string");
+}
+function normalizeOutputQueryPath(path) {
+  let normalized = path.replace(/\\/g, "/").replace(/^\/+/, "");
+  while (normalized === "outputs" || normalized.startsWith("outputs/")) {
+    normalized = normalized === "outputs" ? "" : normalized.slice("outputs/".length);
+  }
+  return normalized.replace(/\/+$/, "");
+}
+function basenameOf(path) {
+  return path.split("/").filter(Boolean).pop() ?? "";
+}
+function directoryMatches(path, dir, recursive) {
+  const normalizedDir = normalizeOutputQueryPath(dir);
+  if (normalizedDir.length === 0)
+    return true;
+  const prefix = `${normalizedDir}/`;
+  if (!path.startsWith(prefix))
+    return false;
+  const remainder = path.slice(prefix.length);
+  return remainder.length > 0 && (recursive || !remainder.includes("/"));
+}
+function normalizeExtension(extension) {
+  return extension.replace(/^\.+/, "").toLowerCase();
+}
+function extensionOf(path) {
+  if (!path)
+    return "";
+  const basename2 = basenameOf(normalizeOutputQueryPath(path));
+  const index = basename2.lastIndexOf(".");
+  return index > 0 && index < basename2.length - 1 ? basename2.slice(index + 1).toLowerCase() : "";
+}
+function normalizeContentType(contentType) {
+  return (contentType ?? "").split(";")[0].trim().toLowerCase();
+}
+function contentTypeMatches(actual, expected) {
+  const normalizedActual = normalizeContentType(actual);
+  const normalizedExpected = normalizeContentType(expected);
+  if (!normalizedActual || !normalizedExpected)
+    return false;
+  if (normalizedExpected.endsWith("/*")) {
+    return normalizedActual.startsWith(normalizedExpected.slice(0, -1));
+  }
+  return normalizedActual === normalizedExpected;
+}
 async function download(http, runId) {
   const [run, events, outputs] = await Promise.all([
     getRun(http, runId),
@@ -3227,6 +3420,18 @@ async function runRunCmd(io2, argv) {
     }
     runtime = runtimeFlag.value;
   }
+  const regionFlag = takeFlagValue(rest, "--region");
+  if (regionFlag.error) {
+    io2.stderr(`${regionFlag.error}
+`);
+    return USAGE_ERR;
+  }
+  rest = regionFlag.remaining;
+  if (regionFlag.value && !RUN_REGIONS.includes(regionFlag.value)) {
+    io2.stderr(`--region must be one of: ${RUN_REGIONS.join(", ")}
+`);
+    return USAGE_ERR;
+  }
   const idempotency = takeFlagValue(rest, "--idempotency-key");
   if (idempotency.error) {
     io2.stderr(`${idempotency.error}
@@ -3506,6 +3711,7 @@ async function runRunCmd(io2, argv) {
     ...runtime ? { runtime } : {},
     submission,
     secrets,
+    ...regionFlag.value ? { region: regionFlag.value } : runConfig.region ? { region: runConfig.region } : {},
     ...runtimeSizeFlag.value ? { runtimeSize: runtimeSizeFlag.value } : runConfig.runtimeSize ? { runtimeSize: runConfig.runtimeSize } : {},
     ...runTimeoutFlag.value ? { timeout: runTimeoutFlag.value } : runConfig.timeout ? { timeout: runConfig.timeout } : {},
     ...runConfig.postHook ? { postHook: runConfig.postHook } : {},
@@ -4430,6 +4636,8 @@ Protocol version: ${manifest.protocolVersion}
   io2.stdout("  --metadata key=value        Submission metadata entry (repeatable)\n");
   io2.stdout("  --proxy-endpoint '<json>'   PlatformProxyEndpoint JSON (repeatable)\n");
   io2.stdout("  --proxy-auth name=<spec>    bearer:tok | basic:u:p | header:v | query:v (repeatable)\n");
+  io2.stdout(`  --region <region>           Product placement token; one of: ${RUN_REGIONS.join(", ")}
+`);
   io2.stdout("  --runtime-size <size>       managed runtime preset\n");
   io2.stdout("  --run-timeout <dur>         Server-side run deadline (e.g. 1h); distinct from --timeout\n");
   io2.stdout("  --idempotency-key <key>     Optional; defaults to a fresh UUID\n");

package/dist/cli.mjs.sha256

@@ -1 +1 @@
-762430dc71b8a73c4ee49790997d44ada327ea0eec648cf7c26714ee785ba86e  cli.mjs
+731645495d2d705531e428f4e587cb0cbc7e3e3324e6fcdaa20154ef04572466  cli.mjs

package/dist/client.d.ts

@@ -1,4 +1,4 @@
-import { HttpClient, SecretString, type AexEvent, type AgentsMdRecord, type CredentialMode, type DebugSink, type FetchLike, type FileRecord, type Output, type OutputMode, type PlatformEnvironmentInput, type PlatformSubmission, type PlatformInlineSecrets, type PlatformProxyEndpoint, type PlatformProxyEndpointAuth, type PlatformPostHookInput, type Run, type RunModel, type RunEvent, type RunProvider, type SecretRecord, type SecretReveal, type RunUnit, type Builtin, type RuntimeSize, type RuntimeKind, type SignedOutputLink, type Skill as SkillRecord, type WhoAmI } from "./_contracts/index.js";
+import { HttpClient, SecretString, type AexEvent, type AgentsMdRecord, type CredentialMode, type DebugSink, type FetchLike, type FileRecord, type Output, type OutputFileType, type OutputLink, type OutputLinkOptions, type OutputQuery, type OutputMode, type PlatformEnvironmentInput, type PlatformSubmission, type PlatformInlineSecrets, type PlatformProxyEndpoint, type PlatformProxyEndpointAuth, type PlatformPostHookInput, type Run, type RunModel, type RunEvent, type RunProvider, type RunRegion, type SecretRecord, type SecretReveal, type RunUnit, type Builtin, type RuntimeSize, type RuntimeKind, type Skill as SkillRecord, type WhoAmI } from "./_contracts/index.js";
 import { AgentsMd } from "./agents-md.js";
 import { type UploadedAsset } from "./asset-upload.js";
 import { File } from "./file.js";
@@ -51,8 +51,6 @@ export interface SubmitOptions {
     /**
      * Credential source for upstream provider access. Omitted defaults to
      * `"byok"`, which requires `secrets.apiKey`.
-     * `"managed"` is reserved for paid managed-key mode and currently fails
-     * closed until the hosted private implementation is wired.
      */
     readonly credentialMode?: CredentialMode;
     /**
@@ -75,6 +73,12 @@ export interface SubmitOptions {
      * is no longer accepted.
      */
     readonly runtime?: RuntimeKind;
+    /**
+     * Optional hosted-platform placement token for this run. These are product
+     * region tokens, not exact city guarantees; omit to let the platform infer a
+     * configured region and fall back when no hint matches.
+     */
+    readonly region?: RunRegion;
     /**
      * Closed public model id. Prefer the {@link Models} symbol const, e.g.
      * `Models.CLAUDE_HAIKU_4_5`. Pair it with an explicit {@link Providers} value
@@ -139,19 +143,17 @@ export interface SubmitOptions {
         readonly maxFiles?: number;
     };
     /**
-     * Override the managed runtime builtin extensions enabled inside the runner.
+     * Override the managed runtime builtins enabled inside the runner.
      * Each entry is one of the closed {@link Builtin} set — prefer the
      * {@link Builtins} symbol const so a typo is a compile error.
      *
-     * - Omitted (default): the runner enables `[Builtins.DEVELOPER]`
-     *   which gives the agent `shell`, `write`, `edit`, and `tree` tools (bash,
-     *   grep via shell, file read via shell or editor, file edit).
-     * - Empty array: the agent runs with zero builtin extensions —
-     *   useful for pure-MCP setups where every tool comes from a
-     *   submitted `mcpServers` entry.
-     * - Custom list: e.g.
-     *   `[Builtins.DEVELOPER, Builtins.COMPUTER_CONTROLLER]` to add
-     *   web fetch/scrape alongside the default shell/edit toolkit.
+     * - Omitted (default): the runner enables `DEFAULT_BUILTINS`
+     *   (`web_search`, `web_fetch`, `read`, `edit`, `glob`, `grep`, `head`,
+     *   `tail`).
+     * - Empty array: the agent runs with zero builtins — useful for pure-MCP
+     *   setups where every tool comes from a submitted `mcpServers` entry.
+     * - Custom list: narrows or extends the surface, e.g.
+     *   `[Builtins.WEB_SEARCH, Builtins.NOTEBOOK]`.
      *
      * Validation: each entry must be a member of {@link Builtins}, max 16
      * entries, deduplicated server-side.
@@ -213,6 +215,7 @@ export interface OutputFileIdSelector {
     readonly id: string;
 }
 export type OutputFileSelector = Output | OutputFileIdSelector | OutputFilePathSelector;
+export type OutputLinkSelector = string | OutputFileSelector | OutputQuery;
 export interface OutputDownloadOptions {
     readonly to?: string;
 }
@@ -505,10 +508,15 @@ export declare class AgentExecutor {
     waitForRun(runId: string, options?: WaitForRunOptions): Promise<Run>;
     /** Short alias for `waitForRun`. */
     wait(runId: string, options?: WaitForRunOptions): Promise<Run>;
-    listOutputs(runId: string): Promise<readonly Output[]>;
+    listOutputs(runId: string, query?: OutputQuery): Promise<readonly Output[]>;
     /** Short alias for `listOutputs`. */
-    outputs(runId: string): Promise<readonly Output[]>;
-    createOutputLink(runId: string, outputId: string): Promise<SignedOutputLink>;
+    outputs(runId: string, query?: OutputQuery): Promise<readonly Output[]>;
+    findOutputs(runId: string, query: OutputQuery): Promise<readonly Output[]>;
+    findOutput(runId: string, query: OutputQuery): Promise<Output | null>;
+    outputLink(runId: string, selectorOrQuery: OutputLinkSelector, options?: OutputLinkOptions): Promise<OutputLink>;
+    createOutputLink(runId: string, selectorOrQuery: OutputLinkSelector, options?: OutputLinkOptions): Promise<OutputLink>;
+    fetchOutput(runId: string, selectorOrQuery: OutputLinkSelector, options?: OutputLinkOptions): Promise<Response>;
+    eventArchiveLink(runId: string, options?: OutputLinkOptions): Promise<OutputLink>;
     /**
      * Download captured deliverables. Omit `selector` to receive the full
      * outputs namespace as a zip; pass an id, Output object, or path selector
@@ -546,4 +554,4 @@ export declare class AgentExecutor {
     /** Download only the run record (the `metadata` namespace) as a zip. */
     downloadMetadata(runId: string, options?: OutputDownloadOptions): Promise<Uint8Array>;
 }
-export type { PlatformProxyEndpoint, PlatformProxyEndpointAuth };
+export type { OutputFileType, OutputLink, OutputLinkOptions, OutputQuery, PlatformProxyEndpoint, PlatformProxyEndpointAuth };

package/dist/client.js

@@ -1,4 +1,4 @@
-import { AexError, DEFAULT_CREDENTIAL_MODE, DEFAULT_RUN_PROVIDER, HttpClient, RUNTIME_KINDS, RunStateError, SecretString, isRunSettled, operations, parseCredentialMode, providersForModel, streamCoordinatorEvents, TERMINAL_RUN_STATUSES } from "./_contracts/index.js";
+import { AexError, DEFAULT_CREDENTIAL_MODE, DEFAULT_RUN_PROVIDER, HttpClient, RUN_REGIONS, RUNTIME_KINDS, RunStateError, SecretString, isRunSettled, operations, parseCredentialMode, providersForModel, streamCoordinatorEvents, TERMINAL_RUN_STATUSES } from "./_contracts/index.js";
 import { AgentsMd } from "./agents-md.js";
 import { uploadAsset } from "./asset-upload.js";
 import { File } from "./file.js";
@@ -332,9 +332,6 @@ export class AgentExecutor {
         }
         const provider = options.provider ?? supportedProviders[0] ?? DEFAULT_RUN_PROVIDER;
         const credentialMode = parseCredentialMode(options.credentialMode);
-        if (credentialMode === "managed") {
-            throw new AexError("CREDENTIAL_INVALID", "AgentExecutor.submit: credentialMode \"managed\" is not available without a private managed-key implementation");
-        }
         if (!options.secrets) {
             throw new Error("AgentExecutor.submit: secrets is required");
         }
@@ -361,6 +358,11 @@ export class AgentExecutor {
             throw new AexError("RUNTIME_UNSUPPORTED", `AgentExecutor.submit: runtime must be one of: ${RUNTIME_KINDS.join(", ")} ` +
                 `(got ${JSON.stringify(options.runtime)})`);
         }
+        if (options.region !== undefined &&
+            !RUN_REGIONS.includes(options.region)) {
+            throw new AexError("RUN_CONFIG_INVALID", `AgentExecutor.submit: region must be one of: ${RUN_REGIONS.join(", ")} ` +
+                `(got ${JSON.stringify(options.region)})`);
+        }
         // Walk Skill / Tool / AgentsMd / File instances. Inline drafts are eagerly
         // uploaded to the content-addressable asset store here (before POST /runs)
         // and referenced as plain `kind:"asset"` refs. Already-materialized asset
@@ -423,6 +425,7 @@ export class AgentExecutor {
             // dispatcher auto-route. Only emit it when the caller asked for
             // a specific runtime so the wire shape stays minimal.
             ...(options.runtime ? { runtime: options.runtime } : {}),
+            ...(options.region ? { region: options.region } : {}),
             submission,
             ...(options.runtimeSize ? { runtimeSize: options.runtimeSize } : {}),
             ...(options.timeout ? { timeout: options.timeout } : {}),
@@ -550,15 +553,31 @@ export class AgentExecutor {
     wait(runId, options) {
         return this.waitForRun(runId, options);
     }
-    listOutputs(runId) {
-        return operations.listOutputs(this.#http, runId);
+    listOutputs(runId, query) {
+        return operations.listOutputs(this.#http, runId, query);
     }
     /** Short alias for `listOutputs`. */
-    outputs(runId) {
-        return this.listOutputs(runId);
+    outputs(runId, query) {
+        return this.listOutputs(runId, query);
+    }
+    findOutputs(runId, query) {
+        return operations.findOutputs(this.#http, runId, query);
+    }
+    findOutput(runId, query) {
+        return operations.findOutput(this.#http, runId, query);
+    }
+    outputLink(runId, selectorOrQuery, options) {
+        return operations.outputLink(this.#http, runId, selectorOrQuery, options);
+    }
+    createOutputLink(runId, selectorOrQuery, options) {
+        return this.outputLink(runId, selectorOrQuery, options);
+    }
+    async fetchOutput(runId, selectorOrQuery, options) {
+        const link = await this.outputLink(runId, selectorOrQuery, options);
+        return (this.#fetch ?? fetch)(link.url);
     }
-    createOutputLink(runId, outputId) {
-        return operations.createOutputLink(this.#http, runId, outputId);
+    eventArchiveLink(runId, options) {
+        return operations.eventArchiveLink(this.#http, runId, options);
     }
     async downloadOutput(runId, selectorOrOptions, options) {
         const hasSelector = selectorOrOptions !== undefined && !isOutputDownloadOptionsOnly(selectorOrOptions);