@aexhq/sdk 0.36.0 → 0.37.0

package/README.md

@@ -16,7 +16,7 @@ The package ships:
 ## Install
 
 ```bash
-bun add @aexhq/sdk
+npm i @aexhq/sdk
 ```
 
 This installs the TypeScript SDK exports and the bundled `aex` CLI. Set both

package/dist/_contracts/event-envelope.d.ts

@@ -195,6 +195,21 @@ export declare function isRunFinished(e: AexEvent): boolean;
 export declare function isRunError(e: AexEvent): boolean;
 /** A terminal event of either flavour (finished or error). */
 export declare function isRunTerminal(e: AexEvent): boolean;
+/**
+ * The CUSTOM `data.name`s the MANAGED runtime emits as a run/turn's terminal.
+ * A managed one-shot run PARKS (session_parked.v1 → `aex.session.idle` / `.error`
+ * / `.suspended`) rather than writing a `session_finished` → RUN_FINISHED, so
+ * these — not just the AG-UI RUN_FINISHED/RUN_ERROR — are what actually ends a
+ * managed run's event stream. Kept in sync with the platform journal projection
+ * (`journal-project.ts` session_parked.v1 mapping).
+ */
+export declare const AEX_SESSION_PARKED_NAMES: readonly ["aex.session.idle", "aex.session.error", "aex.session.suspended"];
+/**
+ * True for a managed-runtime session-park terminal (idle/error/suspended). The
+ * turn's work is done and the record has reached its terminal status; a stream
+ * consumer should stop here exactly as it would on RUN_FINISHED/RUN_ERROR.
+ */
+export declare function isSessionParked(e: AexEvent): boolean;
 export declare function isTextMessage(e: AexEvent): boolean;
 export declare function isToolCallStart(e: AexEvent): boolean;
 export declare function isToolCallResult(e: AexEvent): boolean;
@@ -213,7 +228,13 @@ export declare function customName(e: AexEvent): string | null;
  * platform mirrors this constant in `@aexhq/shared`.
  */
 export declare const AEX_RUN_SETTLED_NAME = "aex.run.settled";
-/** True for the settle-consistency barrier event (post-mirror, read-consistent). */
+/**
+ * True for the settle-consistency barrier event (post-mirror, read-consistent).
+ * Also true for a managed-runtime session-park terminal: the managed plane does
+ * NOT broadcast the `aex.run.settled` barrier, and by the time a run parks its
+ * record has reached a terminal status — so a `settleConsistent` stream ends at
+ * the park instead of hanging forever waiting for a barrier that never arrives.
+ */
 export declare function isRunSettled(e: AexEvent): boolean;
 export declare function isFromSource(e: AexEvent, source: AexEventSource): boolean;
 /** The channel a record rides, defaulting an absent value to `"event"`. */

package/dist/_contracts/event-envelope.js

@@ -212,6 +212,24 @@ export function isRunError(e) {
 export function isRunTerminal(e) {
     return e.type === "RUN_FINISHED" || e.type === "RUN_ERROR";
 }
+/**
+ * The CUSTOM `data.name`s the MANAGED runtime emits as a run/turn's terminal.
+ * A managed one-shot run PARKS (session_parked.v1 → `aex.session.idle` / `.error`
+ * / `.suspended`) rather than writing a `session_finished` → RUN_FINISHED, so
+ * these — not just the AG-UI RUN_FINISHED/RUN_ERROR — are what actually ends a
+ * managed run's event stream. Kept in sync with the platform journal projection
+ * (`journal-project.ts` session_parked.v1 mapping).
+ */
+export const AEX_SESSION_PARKED_NAMES = ["aex.session.idle", "aex.session.error", "aex.session.suspended"];
+/**
+ * True for a managed-runtime session-park terminal (idle/error/suspended). The
+ * turn's work is done and the record has reached its terminal status; a stream
+ * consumer should stop here exactly as it would on RUN_FINISHED/RUN_ERROR.
+ */
+export function isSessionParked(e) {
+    const name = customName(e);
+    return name !== null && AEX_SESSION_PARKED_NAMES.includes(name);
+}
 export function isTextMessage(e) {
     return e.type === "TEXT_MESSAGE_CONTENT";
 }
@@ -240,9 +258,15 @@ export function customName(e) {
  * platform mirrors this constant in `@aexhq/shared`.
  */
 export const AEX_RUN_SETTLED_NAME = "aex.run.settled";
-/** True for the settle-consistency barrier event (post-mirror, read-consistent). */
+/**
+ * True for the settle-consistency barrier event (post-mirror, read-consistent).
+ * Also true for a managed-runtime session-park terminal: the managed plane does
+ * NOT broadcast the `aex.run.settled` barrier, and by the time a run parks its
+ * record has reached a terminal status — so a `settleConsistent` stream ends at
+ * the park instead of hanging forever waiting for a barrier that never arrives.
+ */
 export function isRunSettled(e) {
-    return customName(e) === AEX_RUN_SETTLED_NAME;
+    return customName(e) === AEX_RUN_SETTLED_NAME || isSessionParked(e);
 }
 export function isFromSource(e, source) {
     return e.source === source;

package/dist/_contracts/event-stream-client.js

@@ -24,7 +24,13 @@
  * The WebSocket is injectable so the SDK/CLI use the global `WebSocket`
  * (Bun and Node 22+ ship it; no dependency) and tests drive a fake.
  */
-const isTerminalType = (e) => e.type === "RUN_FINISHED" || e.type === "RUN_ERROR";
+import { isSessionParked } from "./event-envelope.js";
+// The default terminal predicate ends the stream on the AG-UI terminals AND on
+// the managed runtime's CUSTOM session-park terminal (aex.session.idle/.error/
+// .suspended). A managed one-shot run parks instead of emitting RUN_FINISHED, so
+// WITHOUT the session-park arm a `streamEnvelopes()` over a finished managed run
+// never sees a terminal and hangs on the idle watchdog forever.
+const isTerminalType = (e) => e.type === "RUN_FINISHED" || e.type === "RUN_ERROR" || isSessionParked(e);
 /**
  * Keep-alive ping the client sends; the coordinator answers it with the matching
  * pong in its WebSocket message handler. Must stay byte-identical to

package/dist/_contracts/operations.d.ts

@@ -1,6 +1,6 @@
 import type { HttpClient } from "./http.js";
 import type { RunUnit } from "./run-unit.js";
-import type { AgentsMdRecord, FileRecord, Output, OutputLink, OutputLinkOptions, OutputFileDownload, OutputFileSelector, OutputFileType, OutputQuery, OutputText, ReadOutputTextOptions, Run, RunEvent, RunListPage, RunListQuery, Session, SessionCreateRequest, SessionEvent, SessionListPage, SessionListQuery, SessionMessageAccepted, SessionMessageRequest, SessionMessagesPage, SessionMessagesQuery, SessionStateChangeAccepted, RunWebhookDelivery, SecretRecord, SecretReveal, WhoAmI } from "./runtime-types.js";
+import type { AgentsMdRecord, BillingCheckoutRequest, BillingHostedSession, BillingLedgerPage, BillingLedgerQuery, BillingPortalRequest, BillingSummary, FileRecord, Output, OutputLink, OutputLinkOptions, OutputFileDownload, OutputFileSelector, OutputFileType, OutputQuery, OutputText, ReadOutputTextOptions, Run, RunEvent, RunListPage, RunListQuery, Session, SessionCreateRequest, SessionEvent, SessionListPage, SessionListQuery, SessionMessageAccepted, SessionMessageRequest, SessionMessagesPage, SessionMessagesQuery, SessionStateChangeAccepted, RunWebhookDelivery, SecretRecord, SecretReveal, WebhookSigningSecret, WhoAmI } from "./runtime-types.js";
 import type { PlatformRunSubmissionInput } from "./submission.js";
 /**
  * The single source of truth for SDK<->BFF transport. The SDK class
@@ -116,6 +116,35 @@ export declare function redeliverRunWebhook(http: HttpClient, runId: string, del
  */
 export declare function deleteWorkspaceAsset(http: HttpClient, hash: string): Promise<void>;
 export declare function whoami(http: HttpClient): Promise<WhoAmI>;
+/**
+ * Read the workspace billing summary (`GET /api/billing`, scope `billing:read`):
+ * prepaid balance, current-month spend, spend cap, and plan fields. The result
+ * is additive-tolerant — server fields this SDK does not know yet pass through.
+ */
+export declare function getBilling(http: HttpClient): Promise<BillingSummary>;
+/**
+ * Create a hosted checkout session for a paid plan. Returns only the hosted
+ * URL; plan activation happens after checkout completes.
+ */
+export declare function createBillingCheckout(http: HttpClient, request: BillingCheckoutRequest): Promise<BillingHostedSession>;
+/**
+ * Create a hosted billing-portal session for the workspace customer.
+ * Returns only the hosted URL.
+ */
+export declare function createBillingPortal(http: HttpClient, request?: BillingPortalRequest): Promise<BillingHostedSession>;
+/**
+ * Read recent workspace credit-ledger rows (`GET /api/billing/ledger`, scope
+ * `billing:read`), newest first. `limit` is clamped server-side to [1, 100]
+ * (default 25); the read is not cursor-paged.
+ */
+export declare function getBillingLedger(http: HttpClient, query?: BillingLedgerQuery): Promise<BillingLedgerPage>;
+/**
+ * Reveal the workspace webhook signing secret (`POST /api/webhook/signing-secret`),
+ * CREATING one on first use. Repeat calls return the same `whsec_<base64>` value —
+ * the hosted API does not rotate it. POST (not GET) so a reveal is a logged action.
+ * Pass the returned `whsec` to `verifyAexWebhook` as `secret`.
+ */
+export declare function getWebhookSigningSecret(http: HttpClient): Promise<WebhookSigningSecret>;
 export declare function filterOutputs(outputs: readonly Output[], query: OutputQuery): readonly Output[];
 export declare function classifyOutput(output: Pick<Output, "filename" | "contentType">): OutputFileType;
 export declare function normalizeOutputLinkExpiresIn(input?: OutputLinkOptions["expiresIn"]): number;

package/dist/_contracts/operations.js

@@ -1,4 +1,5 @@
 import { strToU8, zipSync } from "fflate";
+import { normalizeRunUnit } from "./run-unit.js";
 import { RunStateError } from "./sdk-errors.js";
 import { assertRunRecordArchivePublicSafeV1, buildRunRecordDownloadManifestV1 } from "./run-record.js";
 /**
@@ -28,7 +29,11 @@ export async function getRun(http, runId) {
  * stays for callers that only need the loose record.
  */
 export async function getRunUnit(http, runId) {
-    return http.request(`/api/runs/${encodeURIComponent(runId)}`);
+    // Normalize so the RunUnit type contract holds at runtime: the managed plane
+    // returns a lean record and omits the aggregate collections (F25). The
+    // aggregates default to empty (safe array/page access) — read outputs()/events()
+    // for the authoritative per-run data on that plane.
+    return normalizeRunUnit(await http.request(`/api/runs/${encodeURIComponent(runId)}`));
 }
 /**
  * List the runs in the token's workspace, most-recent first, one page at a time.
@@ -383,6 +388,54 @@ export async function deleteWorkspaceAsset(http, hash) {
 export async function whoami(http) {
     return http.request("/api/whoami");
 }
+/**
+ * Read the workspace billing summary (`GET /api/billing`, scope `billing:read`):
+ * prepaid balance, current-month spend, spend cap, and plan fields. The result
+ * is additive-tolerant — server fields this SDK does not know yet pass through.
+ */
+export async function getBilling(http) {
+    return http.request("/api/billing");
+}
+/**
+ * Create a hosted checkout session for a paid plan. Returns only the hosted
+ * URL; plan activation happens after checkout completes.
+ */
+export async function createBillingCheckout(http, request) {
+    return http.request("/api/billing/checkout", {
+        method: "POST",
+        body: JSON.stringify(request)
+    });
+}
+/**
+ * Create a hosted billing-portal session for the workspace customer.
+ * Returns only the hosted URL.
+ */
+export async function createBillingPortal(http, request = {}) {
+    return http.request("/api/billing/portal", {
+        method: "POST",
+        body: JSON.stringify(request)
+    });
+}
+/**
+ * Read recent workspace credit-ledger rows (`GET /api/billing/ledger`, scope
+ * `billing:read`), newest first. `limit` is clamped server-side to [1, 100]
+ * (default 25); the read is not cursor-paged.
+ */
+export async function getBillingLedger(http, query) {
+    const params = {};
+    if (query?.limit !== undefined)
+        params.limit = String(query.limit);
+    return http.request("/api/billing/ledger", {}, params);
+}
+/**
+ * Reveal the workspace webhook signing secret (`POST /api/webhook/signing-secret`),
+ * CREATING one on first use. Repeat calls return the same `whsec_<base64>` value —
+ * the hosted API does not rotate it. POST (not GET) so a reveal is a logged action.
+ * Pass the returned `whsec` to `verifyAexWebhook` as `secret`.
+ */
+export async function getWebhookSigningSecret(http) {
+    return http.request("/api/webhook/signing-secret", { method: "POST" });
+}
 /**
  * Download each artifact's bytes into a zip-file map keyed by
  * `<zipPrefix><relative-path>`, fetched from the `outputs`

package/dist/_contracts/run-config.d.ts

@@ -303,7 +303,7 @@ export interface RunRequestConfig {
     readonly environment?: PlatformEnvironment;
     /** Managed runtime size preset (see {@link RuntimeSize}). */
     readonly runtimeSize?: RuntimeSize;
-    /** Run deadline as a duration string (`"1h"`, `"30m"`); bounded [1m, 6h] server-side. */
+    /** Run deadline as a duration string (`"1h"`, `"30m"`); bounded [1m, 8h] server-side. */
     readonly timeout?: string;
     readonly metadata?: Readonly<Record<string, JsonValue>>;
 }

package/dist/_contracts/run-unit.d.ts

@@ -136,3 +136,15 @@ export interface RunUnit {
  * the whole detail page.
  */
 export declare function parseRunUnitSubmission(input: unknown): RunUnitSubmission;
+/**
+ * Normalize a `GET /api/runs/:runId` payload into a RunUnit whose type contract
+ * holds AT RUNTIME. The managed (AWS) plane returns a LEAN record (scalars +
+ * costTelemetry only) and omits the aggregate collections; the RunUnit type
+ * declares those non-optional, so a naive cast leaves `unit.outputs` /
+ * `unit.events.totalCount` `undefined` and a typed consumer crashes on
+ * `.map()` / `.totalCount` (pre-launch edge-sweep F25). We fill the aggregates
+ * with their empty defaults so array/page access is always safe. NOTE: on the
+ * managed plane these summaries are best-effort — read `outputs()` / `events()`
+ * / `messages()` for the authoritative per-run data.
+ */
+export declare function normalizeRunUnit(raw: unknown): RunUnit;

package/dist/_contracts/run-unit.js

@@ -18,6 +18,7 @@
  * detail response stays bounded). The archive zip carries the bytes.
  */
 import { parseMcpServerRef } from "./run-config.js";
+import { CLEANUP_STATUSES } from "./status.js";
 import { Models, parseRunModel } from "./models.js";
 import { PLATFORM_PACKAGE_ECOSYSTEMS } from "./submission.js";
 // ---------------------------------------------------------------------------
@@ -119,6 +120,60 @@ function fallbackFlat() {
 function isRecord(value) {
     return typeof value === "object" && value !== null && !Array.isArray(value);
 }
+/**
+ * Normalize a `GET /api/runs/:runId` payload into a RunUnit whose type contract
+ * holds AT RUNTIME. The managed (AWS) plane returns a LEAN record (scalars +
+ * costTelemetry only) and omits the aggregate collections; the RunUnit type
+ * declares those non-optional, so a naive cast leaves `unit.outputs` /
+ * `unit.events.totalCount` `undefined` and a typed consumer crashes on
+ * `.map()` / `.totalCount` (pre-launch edge-sweep F25). We fill the aggregates
+ * with their empty defaults so array/page access is always safe. NOTE: on the
+ * managed plane these summaries are best-effort — read `outputs()` / `events()`
+ * / `messages()` for the authoritative per-run data.
+ */
+export function normalizeRunUnit(raw) {
+    const r = isRecord(raw) ? raw : {};
+    const eventsRaw = isRecord(r.events) ? r.events : {};
+    const str = (v) => (typeof v === "string" ? v : undefined);
+    const arr = (v) => (Array.isArray(v) ? v : []);
+    return {
+        id: str(r.id) ?? "",
+        workspaceId: str(r.workspaceId) ?? "",
+        status: str(r.status) ?? "unknown",
+        ...(str(r.lifecyclePhase) ? { lifecyclePhase: r.lifecyclePhase } : {}),
+        cleanupStatus: CLEANUP_STATUSES.includes(r.cleanupStatus)
+            ? r.cleanupStatus
+            : "not_started",
+        createdAt: str(r.createdAt) ?? "",
+        updatedAt: str(r.updatedAt) ?? "",
+        ...(str(r.startedAt) ? { startedAt: r.startedAt } : {}),
+        ...(str(r.terminalAt) ? { terminalAt: r.terminalAt } : {}),
+        ...(str(r.deletedAt) ? { deletedAt: r.deletedAt } : {}),
+        attemptCount: typeof r.attemptCount === "number"
+            ? r.attemptCount
+            : Array.isArray(r.attempts)
+                ? r.attempts.length
+                : 0,
+        submission: parseRunUnitSubmission(r.submission),
+        ...(isRecord(r.capsSnapshot) ? { capsSnapshot: r.capsSnapshot } : {}),
+        attempts: arr(r.attempts),
+        events: {
+            entries: arr(eventsRaw.entries),
+            totalCount: typeof eventsRaw.totalCount === "number" ? eventsRaw.totalCount : 0,
+            truncated: eventsRaw.truncated === true,
+            ...(str(eventsRaw.nextCursor) ? { nextCursor: eventsRaw.nextCursor } : {})
+        },
+        rawEventPages: arr(r.rawEventPages),
+        outputs: arr(r.outputs),
+        outputCaptureFailures: arr(r.outputCaptureFailures),
+        ...(isRecord(r.costTelemetry)
+            ? { costTelemetry: r.costTelemetry }
+            : {}),
+        ...(isRecord(r.runtimeManifest)
+            ? { runtimeManifest: r.runtimeManifest }
+            : {})
+    };
+}
 function coerceRunUnitModel(value) {
     if (typeof value !== "string")
         return Models.CLAUDE_HAIKU_4_5;

package/dist/_contracts/runtime-sizes.d.ts

@@ -65,9 +65,9 @@ export declare function runtimeResources(size: RuntimeSize): RuntimeResources;
  * consumers apply {@link DEFAULT_RUNTIME_SIZE}.
  */
 export declare function parseRuntimeSize(input: unknown): RuntimeSize | undefined;
-/** Default run deadline when `timeout` is omitted (1 hour). */
+/** Default run deadline when `timeout` is omitted (8 hours). */
 export declare const DEFAULT_RUN_TIMEOUT_MS: number;
-/** Hard ceiling on a run deadline (6 hours). */
+/** Hard ceiling on a run deadline (8 hours). */
 export declare const MAX_RUN_TIMEOUT_MS: number;
 /** Floor on a run deadline (1 minute). */
 export declare const MIN_RUN_TIMEOUT_MS: number;

package/dist/_contracts/runtime-sizes.js

@@ -54,10 +54,10 @@ export function parseRuntimeSize(input) {
 // ===========================================================================
 // Run timeout
 // ===========================================================================
-/** Default run deadline when `timeout` is omitted (1 hour). */
-export const DEFAULT_RUN_TIMEOUT_MS = 60 * 60 * 1000;
-/** Hard ceiling on a run deadline (6 hours). */
-export const MAX_RUN_TIMEOUT_MS = 6 * 60 * 60 * 1000;
+/** Default run deadline when `timeout` is omitted (8 hours). */
+export const DEFAULT_RUN_TIMEOUT_MS = 8 * 60 * 60 * 1000;
+/** Hard ceiling on a run deadline (8 hours). */
+export const MAX_RUN_TIMEOUT_MS = 8 * 60 * 60 * 1000;
 /** Floor on a run deadline (1 minute). */
 export const MIN_RUN_TIMEOUT_MS = 60 * 1000;
 const DURATION_PATTERN = /^(\d+(?:\.\d+)?)(ms|s|m|h)?$/;
@@ -95,7 +95,7 @@ export function parseRunTimeout(input) {
         throw new Error(`timeout must be at least ${MIN_RUN_TIMEOUT_MS}ms (1m); got ${ms}ms`);
     }
     if (ms > MAX_RUN_TIMEOUT_MS) {
-        throw new Error(`timeout must be at most ${MAX_RUN_TIMEOUT_MS}ms (6h); got ${ms}ms`);
+        throw new Error(`timeout must be at most ${MAX_RUN_TIMEOUT_MS}ms (8h); got ${ms}ms`);
     }
     return ms;
 }

package/dist/_contracts/runtime-types.d.ts

@@ -398,6 +398,29 @@ export interface WhoAmI {
          */
         readonly maxRunDurationMs?: number | null;
     };
+    /**
+     * ADDITIVE effective per-workspace limits returned by `GET /whoami` on
+     * current platform deployments — everything a caller needs to anticipate a
+     * `429` / `402` submit rejection before hitting it. Every value is the same
+     * one the platform's admission gates enforce. Optional: older deployments
+     * omit the field entirely.
+     */
+    readonly limits?: {
+        /** Effective live-run concurrency cap. One more live run past it fails with `429 workspace_concurrency_exceeded`. */
+        readonly maxConcurrentRuns: number;
+        /** Effective submit-velocity cap per minute; `0` = unlimited (disabled). Past it: `429 workspace_submit_rate_exceeded`. */
+        readonly submitRatePerMinute: number;
+        /** Effective monthly spend cap in USD; `0` = unlimited. Once `monthSpendUsd` reaches it: `402 workspace_spend_cap_exceeded`. */
+        readonly spendCapUsd: number;
+        /** Accrued spend in the current UTC calendar month — the value the spend gate compares. */
+        readonly monthSpendUsd: number;
+        /** Prepaid balance read-model — the value the balance gate compares. */
+        readonly balanceUsd: number;
+        /** Effective (payment-method-aware) submit floor: submits fail with `402 insufficient_balance` once `balanceUsd` is at or below it. */
+        readonly balanceGraceFloorUsd: number;
+        /** `"active"` means a bounded card overdraft is already folded into `balanceGraceFloorUsd`. */
+        readonly paymentMethodStatus: "none" | "active";
+    };
     readonly [key: string]: unknown;
 }
 /**
@@ -505,3 +528,78 @@ export interface SecretReveal {
     readonly name: string;
     readonly value: string;
 }
+/**
+ * Customer-facing billing summary — `GET /api/billing` (scope `billing:read`).
+ * All money fields are USD numbers. The index signature keeps the shape tolerant
+ * of ADDITIVE server fields (e.g. a deployment newer than this SDK reporting
+ * extra plan attributes) — unknown keys are preserved, never rejected.
+ */
+export interface BillingSummary {
+    /** Prepaid balance (authoritative ledger sum). */
+    readonly balanceUsd: number;
+    /** Accrued spend for the current calendar month. */
+    readonly monthSpendUsd: number;
+    /** Monthly spend cap enforced on new runs. */
+    readonly spendCapUsd: number;
+    readonly planKey: string;
+    readonly subscriptionStatus: string;
+    /** `"active"` once a payment method is bound; older deployments omit it. */
+    readonly paymentMethodStatus?: string;
+    readonly [key: string]: unknown;
+}
+/** Self-serve paid plans exposed through hosted checkout. */
+export type BillingCheckoutPlanKey = "pro" | "team";
+export interface BillingCheckoutRequest {
+    readonly planKey: BillingCheckoutPlanKey;
+    /** Optional return URL after successful hosted checkout. */
+    readonly successUrl?: string;
+    /** Optional return URL after checkout cancellation. */
+    readonly cancelUrl?: string;
+    /** Optional caller-stable key so a retry does not create a second hosted session. */
+    readonly idempotencyKey?: string;
+}
+export interface BillingPortalRequest {
+    /** Optional return URL after leaving the hosted billing portal. */
+    readonly returnUrl?: string;
+}
+/** Hosted checkout/portal session. The client should open `url`. */
+export interface BillingHostedSession {
+    readonly url: string;
+    readonly [key: string]: unknown;
+}
+/**
+ * One row of the workspace credit ledger as returned by
+ * `GET /api/billing/ledger` (newest first). `amountUsd` is signed: top-ups are
+ * positive, run charges negative. Tolerant of additive server fields.
+ */
+export interface BillingLedgerEntry {
+    readonly id: string;
+    /** e.g. `top_up`, `run_charge`. Open server vocabulary. */
+    readonly entryType: string;
+    readonly amountUsd: number;
+    readonly currency: string;
+    /** The run this entry charges, `null` for non-run entries. */
+    readonly runId?: string | null;
+    readonly description?: string | null;
+    readonly createdBy?: string;
+    readonly createdAt: string;
+    readonly [key: string]: unknown;
+}
+/** Query for the billing ledger read. `limit` is clamped server-side to [1, 100] (default 25). */
+export interface BillingLedgerQuery {
+    readonly limit?: number;
+}
+/** One page of recent ledger rows (newest first). Not cursor-paged — `limit` bounds the read. */
+export interface BillingLedgerPage {
+    readonly entries: readonly BillingLedgerEntry[];
+}
+/**
+ * The workspace webhook signing secret reveal — `POST /api/webhook/signing-secret`.
+ * `whsec` is the Standard-Webhooks style `whsec_<base64>` string that
+ * `verifyAexWebhook` accepts as `secret`. The endpoint reveals the current
+ * secret, CREATING one on first use; it does not rotate (a repeat call returns
+ * the same value). POST (not GET) so every reveal is a logged action.
+ */
+export interface WebhookSigningSecret {
+    readonly whsec: string;
+}

package/dist/_contracts/submission.d.ts

@@ -329,8 +329,8 @@ export interface PlatformRunSubmissionRequest {
     readonly runtimeSize?: RuntimeSize;
     /**
      * Run deadline in milliseconds, normalised by the parser from the wire
-     * `timeout` duration string (bounded to [1m, 6h]). Absent ⇒
-     * {@link DEFAULT_RUN_TIMEOUT_MS} (1h). Applies to the managed runner's
+     * `timeout` duration string (bounded to [1m, 8h]). Absent ⇒
+     * {@link DEFAULT_RUN_TIMEOUT_MS} (8h). Applies to the managed runner's
      * terminal wait window and self-kill deadline.
      */
     readonly timeoutMs?: number;
@@ -412,8 +412,8 @@ export type PlatformRunSubmissionInput = Omit<PlatformRunSubmissionRequest, "wor
     readonly provider?: RunProvider;
     /**
      * Run deadline as a human duration string (`"1h"`, `"90m"`, `"30s"`).
-     * Parsed + bounded to [1m, 6h] server-side into
-     * {@link PlatformRunSubmissionRequest.timeoutMs}. Absent ⇒ 1h default.
+     * Parsed + bounded to [1m, 8h] server-side into
+     * {@link PlatformRunSubmissionRequest.timeoutMs}. Absent ⇒ 8h default.
      */
     readonly timeout?: string;
 };