@aexhq/sdk 0.36.0 → 0.37.1

package/dist/cli.mjs

@@ -128,6 +128,46 @@ var MODEL_PROVIDER_IDS = {
   }
 };
 var RUN_MODELS = Object.keys(MODEL_PROVIDER_IDS);
+var Models = {
+  /** Claude Haiku 4.5 — Anthropic. */
+  CLAUDE_HAIKU_4_5: "claude-haiku-4-5",
+  /** Claude 3.5 Haiku (latest) — Anthropic. */
+  CLAUDE_3_5_HAIKU_LATEST: "claude-3-5-haiku-latest",
+  /** Claude 3.5 Sonnet (latest) — Anthropic. */
+  CLAUDE_3_5_SONNET_LATEST: "claude-3-5-sonnet-latest",
+  /** Claude Sonnet 4.6 — Anthropic (1M context, reasoning-capable). */
+  CLAUDE_SONNET_4_6: "claude-sonnet-4-6",
+  /** DeepSeek V4 Flash — DeepSeek (non-thinking, fast). */
+  DEEPSEEK_V4_FLASH: "deepseek-v4-flash",
+  /** DeepSeek V4 Pro — DeepSeek (reasoning-heavy). */
+  DEEPSEEK_V4_PRO: "deepseek-v4-pro",
+  /** GPT-4.1 — OpenAI. */
+  GPT_4_1: "gpt-4.1",
+  /** GPT-4o mini — OpenAI, or via OpenRouter (`provider: Providers.OPENROUTER`). */
+  GPT_4O_MINI: "gpt-4o-mini",
+  /** GPT-4o — via OpenRouter (`provider: Providers.OPENROUTER`). */
+  GPT_4O: "gpt-4o",
+  /** Gemini 2.0 Flash — Gemini, or via OpenRouter (`provider: Providers.OPENROUTER`). */
+  GEMINI_2_0_FLASH: "gemini-2.0-flash",
+  /** Gemini 2.5 Flash — Gemini. */
+  GEMINI_2_5_FLASH: "gemini-2.5-flash",
+  /** Mistral Large (latest) — Mistral. */
+  MISTRAL_LARGE_LATEST: "mistral-large-latest",
+  /** Mistral Small (latest) — Mistral. */
+  MISTRAL_SMALL_LATEST: "mistral-small-latest",
+  /**
+   * Doubao Seed 1.8 — ByteDance, via the official Ark API. Default routes
+   * through the international BytePlus gateway (`Providers.DOUBAO`); pair with
+   * `Providers.DOUBAO_CN` for the China Volcengine gateway.
+   */
+  DOUBAO_SEED_PRO: "doubao-seed-pro",
+  /**
+   * Doubao Seed 1.6 Flash — ByteDance, via the official Ark API (fast/cheap).
+   * Default `Providers.DOUBAO` (international); pair with `Providers.DOUBAO_CN`
+   * for China.
+   */
+  DOUBAO_SEED_FLASH: "doubao-seed-flash"
+};
 var PROVIDERS_BY_MODEL = (() => {
   const map = {};
   for (const [model, providers] of Object.entries(MODEL_PROVIDER_IDS)) {
@@ -171,6 +211,15 @@ var TERMINAL_RUN_STATUSES = [
   "cleanup_failed"
 ];
 var terminalRunStatuses = new Set(TERMINAL_RUN_STATUSES);
+var CLEANUP_STATUSES = [
+  "not_started",
+  "pending",
+  "running",
+  "succeeded",
+  "failed_retryable",
+  "failed_terminal",
+  "skipped"
+];
 
 // ../contracts/dist/run-config.js
 var SKILL_BUNDLE_LIMITS = {
@@ -445,8 +494,8 @@ var RUNTIME_SIZE_PRESETS = {
 };
 var RUNTIME_SIZES = Object.keys(RUNTIME_SIZE_PRESETS);
 var DEFAULT_RUNTIME_SIZE = "shared-0.25x-1gb";
-var DEFAULT_RUN_TIMEOUT_MS = 60 * 60 * 1e3;
-var MAX_RUN_TIMEOUT_MS = 6 * 60 * 60 * 1e3;
+var DEFAULT_RUN_TIMEOUT_MS = 8 * 60 * 60 * 1e3;
+var MAX_RUN_TIMEOUT_MS = 8 * 60 * 60 * 1e3;
 var MIN_RUN_TIMEOUT_MS = 60 * 1e3;
 var RUN_PROCESS_KILL_GRACE_MS = 60 * 1e3;
 var RUN_TERMINAL_GRACE_MS = 90 * 1e3;
@@ -480,6 +529,7 @@ var RUNTIME_SECURITY_PROFILE_CONFIG = Object.freeze({
 });
 
 // ../contracts/dist/submission.js
+var PLATFORM_PACKAGE_ECOSYSTEMS = ["apt", "npm", "pip"];
 var RUN_PROVIDERS = [
   "anthropic",
   "deepseek",
@@ -530,12 +580,17 @@ var AEX_EVENT_TYPES = [
   // off-the-shelf AG-UI client filters logs out by `channel`.
   "LOG"
 ];
+var AEX_SESSION_PARKED_NAMES = ["aex.session.idle", "aex.session.error", "aex.session.suspended"];
+function isSessionParked(e) {
+  const name = customName(e);
+  return name !== null && AEX_SESSION_PARKED_NAMES.includes(name);
+}
 function customName(e) {
   return e.type === "CUSTOM" ? str(e.data.name) || null : null;
 }
 var AEX_RUN_SETTLED_NAME = "aex.run.settled";
 function isRunSettled(e) {
-  return customName(e) === AEX_RUN_SETTLED_NAME;
+  return customName(e) === AEX_RUN_SETTLED_NAME || isSessionParked(e);
 }
 function channelOf(e) {
   return e.channel ?? "event";
@@ -593,7 +648,7 @@ function str(v) {
 var encoder = new TextEncoder();
 
 // ../contracts/dist/event-stream-client.js
-var isTerminalType = (e) => e.type === "RUN_FINISHED" || e.type === "RUN_ERROR";
+var isTerminalType = (e) => e.type === "RUN_FINISHED" || e.type === "RUN_ERROR" || isSessionParked(e);
 var COORDINATOR_PING = "aex:ping";
 var DEFAULT_IDLE_TIMEOUT_MS = 45e3;
 var DEFAULT_PING_INTERVAL_MS = 15e3;
@@ -751,6 +806,191 @@ function sleep(ms, signal) {
   });
 }
 
+// ../contracts/dist/run-unit.js
+function parseRunUnitSubmission(input) {
+  if (!input || typeof input !== "object" || Array.isArray(input)) {
+    return fallbackFlat();
+  }
+  const value = input;
+  if (value.kind === "submission") {
+    return parseFlatProjection(value);
+  }
+  return fallbackFlat();
+}
+function parseFlatProjection(value) {
+  const submissionRaw = isRecord(value.submission) ? value.submission : {};
+  const outputsRaw = isRecord(submissionRaw.outputs) ? submissionRaw.outputs : {};
+  const allowedDirs = toOptionalStringArray(outputsRaw.allowedDirs);
+  const deniedDirs = toOptionalStringArray(outputsRaw.deniedDirs);
+  const captureTimeoutMs = toOptionalPositiveInteger(outputsRaw.captureTimeoutMs);
+  const maxFileBytes = toOptionalPositiveInteger(outputsRaw.maxFileBytes);
+  const maxTotalBytes = toOptionalPositiveInteger(outputsRaw.maxTotalBytes);
+  const maxFiles = toOptionalPositiveInteger(outputsRaw.maxFiles);
+  const submission = {
+    model: coerceRunUnitModel(submissionRaw.model),
+    ...typeof submissionRaw.system === "string" ? { system: submissionRaw.system } : {},
+    prompt: toStringArray(submissionRaw.prompt),
+    agentsMd: [],
+    files: [],
+    mcpServers: toMcpServerRefArray(submissionRaw.mcpServers),
+    tools: [],
+    ...parseEnvironment(submissionRaw.environment) ? { environment: parseEnvironment(submissionRaw.environment) } : {},
+    ...parseSecurityProfile(submissionRaw.securityProfile) ? { securityProfile: parseSecurityProfile(submissionRaw.securityProfile) } : {},
+    ...isJsonRecord(submissionRaw.metadata) ? { metadata: submissionRaw.metadata } : {},
+    ...allowedDirs || deniedDirs || captureTimeoutMs !== void 0 || maxFileBytes !== void 0 || maxTotalBytes !== void 0 || maxFiles !== void 0 ? {
+      outputs: {
+        ...allowedDirs ? { allowedDirs } : {},
+        ...deniedDirs ? { deniedDirs } : {},
+        ...captureTimeoutMs !== void 0 ? { captureTimeoutMs } : {},
+        ...maxFileBytes !== void 0 ? { maxFileBytes } : {},
+        ...maxTotalBytes !== void 0 ? { maxTotalBytes } : {},
+        ...maxFiles !== void 0 ? { maxFiles } : {}
+      }
+    } : {}
+  };
+  return {
+    kind: "submission",
+    submission
+  };
+}
+function parseSecurityProfile(value) {
+  return value === "strict" || value === "standard" || value === "developer" ? value : void 0;
+}
+function toOptionalPositiveInteger(value) {
+  return typeof value === "number" && Number.isInteger(value) && value > 0 ? value : void 0;
+}
+function fallbackFlat() {
+  return {
+    kind: "submission",
+    submission: {
+      model: Models.CLAUDE_HAIKU_4_5,
+      prompt: [],
+      agentsMd: [],
+      files: [],
+      mcpServers: [],
+      tools: []
+    }
+  };
+}
+function isRecord(value) {
+  return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function normalizeRunUnit(raw) {
+  const r = isRecord(raw) ? raw : {};
+  const eventsRaw = isRecord(r.events) ? r.events : {};
+  const str3 = (v) => typeof v === "string" ? v : void 0;
+  const arr = (v) => Array.isArray(v) ? v : [];
+  return {
+    id: str3(r.id) ?? "",
+    workspaceId: str3(r.workspaceId) ?? "",
+    status: str3(r.status) ?? "unknown",
+    ...str3(r.lifecyclePhase) ? { lifecyclePhase: r.lifecyclePhase } : {},
+    cleanupStatus: CLEANUP_STATUSES.includes(r.cleanupStatus) ? r.cleanupStatus : "not_started",
+    createdAt: str3(r.createdAt) ?? "",
+    updatedAt: str3(r.updatedAt) ?? "",
+    ...str3(r.startedAt) ? { startedAt: r.startedAt } : {},
+    ...str3(r.terminalAt) ? { terminalAt: r.terminalAt } : {},
+    ...str3(r.deletedAt) ? { deletedAt: r.deletedAt } : {},
+    attemptCount: typeof r.attemptCount === "number" ? r.attemptCount : Array.isArray(r.attempts) ? r.attempts.length : 0,
+    submission: parseRunUnitSubmission(r.submission),
+    ...isRecord(r.capsSnapshot) ? { capsSnapshot: r.capsSnapshot } : {},
+    attempts: arr(r.attempts),
+    events: {
+      entries: arr(eventsRaw.entries),
+      totalCount: typeof eventsRaw.totalCount === "number" ? eventsRaw.totalCount : 0,
+      truncated: eventsRaw.truncated === true,
+      ...str3(eventsRaw.nextCursor) ? { nextCursor: eventsRaw.nextCursor } : {}
+    },
+    rawEventPages: arr(r.rawEventPages),
+    outputs: arr(r.outputs),
+    outputCaptureFailures: arr(r.outputCaptureFailures),
+    ...isRecord(r.costTelemetry) ? { costTelemetry: r.costTelemetry } : {},
+    ...isRecord(r.runtimeManifest) ? { runtimeManifest: r.runtimeManifest } : {}
+  };
+}
+function coerceRunUnitModel(value) {
+  if (typeof value !== "string")
+    return Models.CLAUDE_HAIKU_4_5;
+  try {
+    return parseRunModel(value, "run unit submission.model");
+  } catch {
+    return Models.CLAUDE_HAIKU_4_5;
+  }
+}
+function isJsonRecord(value) {
+  return isRecord(value);
+}
+function toStringArray(value) {
+  if (!Array.isArray(value)) {
+    return [];
+  }
+  return value.filter((item) => typeof item === "string");
+}
+function toOptionalStringArray(value) {
+  if (!Array.isArray(value) || value.length === 0) {
+    return void 0;
+  }
+  const filtered = value.filter((item) => typeof item === "string");
+  return filtered.length === 0 ? void 0 : filtered;
+}
+function toMcpServerRefArray(value) {
+  if (!Array.isArray(value)) {
+    return [];
+  }
+  const out = [];
+  for (let i2 = 0; i2 < value.length; i2++) {
+    try {
+      out.push(parseMcpServerRef(value[i2], `submission.mcpServers[${i2}]`));
+    } catch {
+    }
+  }
+  return out;
+}
+function parseEnvironment(value) {
+  if (!isRecord(value)) {
+    return void 0;
+  }
+  const env = {};
+  if (isRecord(value.networking)) {
+    const mode = value.networking.mode;
+    const allowedHosts = value.networking.allowedHosts;
+    if (mode === "limited" || mode === "open") {
+      env.networking = {
+        mode,
+        ...Array.isArray(allowedHosts) ? { allowedHosts: toStringArray(allowedHosts) } : {}
+      };
+    }
+  }
+  if (Array.isArray(value.packages)) {
+    const pkgs = value.packages.filter(isRecord).map((p) => {
+      const r = p;
+      if (typeof r.name !== "string")
+        return null;
+      const ecosystem = typeof r.ecosystem === "string" && PLATFORM_PACKAGE_ECOSYSTEMS.includes(r.ecosystem) ? r.ecosystem : "apt";
+      return {
+        name: r.name,
+        ...typeof r.version === "string" ? { version: r.version } : {},
+        ecosystem
+      };
+    }).filter((p) => p !== null);
+    if (pkgs.length > 0) {
+      env.packages = pkgs;
+    }
+  }
+  if (isRecord(value.envVars)) {
+    const out = {};
+    for (const [k, v] of Object.entries(value.envVars)) {
+      if (typeof v === "string") {
+        out[k] = v;
+      }
+    }
+    if (Object.keys(out).length > 0) {
+      env.envVars = out;
+    }
+  }
+  return env.networking || env.packages || env.envVars ? env : void 0;
+}
+
 // ../contracts/dist/runtime-manifest.js
 var RUNTIME_PATHS = Object.freeze({
   skillsRoot: "/workspace/skills",
@@ -1329,6 +1569,8 @@ __export(operations_exports, {
   cancelRun: () => cancelRun,
   cancelSession: () => cancelSession,
   classifyOutput: () => classifyOutput,
+  createBillingCheckout: () => createBillingCheckout,
+  createBillingPortal: () => createBillingPortal,
   createOutputLink: () => createOutputLink,
   createSecret: () => createSecret,
   createSession: () => createSession,
@@ -1348,6 +1590,8 @@ __export(operations_exports, {
   findOutput: () => findOutput,
   findOutputs: () => findOutputs,
   getAgentsMd: () => getAgentsMd,
+  getBilling: () => getBilling,
+  getBillingLedger: () => getBillingLedger,
   getCoordinatorTicket: () => getCoordinatorTicket,
   getFile: () => getFile,
   getRun: () => getRun,
@@ -1357,6 +1601,7 @@ __export(operations_exports, {
   getSecretValue: () => getSecretValue,
   getSession: () => getSession,
   getSessionCoordinatorTicket: () => getSessionCoordinatorTicket,
+  getWebhookSigningSecret: () => getWebhookSigningSecret,
   listAgentsMd: () => listAgentsMd,
   listFiles: () => listFiles,
   listOutputs: () => listOutputs,
@@ -2103,7 +2348,7 @@ async function getRun(http, runId) {
   return hasRun(result) ? result.run : result;
 }
 async function getRunUnit(http, runId) {
-  return http.request(`/api/runs/${encodeURIComponent(runId)}`);
+  return normalizeRunUnit(await http.request(`/api/runs/${encodeURIComponent(runId)}`));
 }
 async function listRuns(http, query) {
   const params = {};
@@ -2386,6 +2631,30 @@ async function deleteWorkspaceAsset(http, hash) {
 async function whoami(http) {
   return http.request("/api/whoami");
 }
+async function getBilling(http) {
+  return http.request("/api/billing");
+}
+async function createBillingCheckout(http, request) {
+  return http.request("/api/billing/checkout", {
+    method: "POST",
+    body: JSON.stringify(request)
+  });
+}
+async function createBillingPortal(http, request = {}) {
+  return http.request("/api/billing/portal", {
+    method: "POST",
+    body: JSON.stringify(request)
+  });
+}
+async function getBillingLedger(http, query) {
+  const params = {};
+  if (query?.limit !== void 0)
+    params.limit = String(query.limit);
+  return http.request("/api/billing/ledger", {}, params);
+}
+async function getWebhookSigningSecret(http) {
+  return http.request("/api/webhook/signing-secret", { method: "POST" });
+}
 async function collectArtifactBytes(http, runId, items, zipPrefix, namespace2) {
   const entries = [];
   const captured = [];
@@ -2652,7 +2921,7 @@ function jsonlEntry(path, events) {
 }
 function extractSubmissionSnapshot(run) {
   const raw = run.submission;
-  if (!isRecord(raw) || raw.kind !== "submission" || !isRecord(raw.submission)) {
+  if (!isRecord2(raw) || raw.kind !== "submission" || !isRecord2(raw.submission)) {
     return void 0;
   }
   return {
@@ -2661,9 +2930,9 @@ function extractSubmissionSnapshot(run) {
 }
 function extractCostTelemetry(run) {
   const raw = run.costTelemetry;
-  return isRecord(raw) ? raw : void 0;
+  return isRecord2(raw) ? raw : void 0;
 }
-function isRecord(value) {
+function isRecord2(value) {
   return typeof value === "object" && value !== null && !Array.isArray(value);
 }
 async function submitRun(http, request) {
@@ -2784,7 +3053,7 @@ var USAGE_ERR = { code: 2 };
 var RUNTIME_ERR = { code: 1 };
 var TIMEOUT_ERR = { code: 3 };
 var TERMINAL_STATUSES = new Set(TERMINAL_RUN_STATUSES);
-function isSessionParked(status2) {
+function isSessionParked2(status2) {
   return status2 === "idle" || status2 === "suspended" || status2 === "error" || TERMINAL_STATUSES.has(status2);
 }
 function isSessionOk(status2) {
@@ -2871,6 +3140,8 @@ function describeApiError(err2) {
   return { code: "error", message: err2 instanceof Error ? err2.message : String(err2) };
 }
 function remedyForStatus(status2) {
+  if (status2 === 400)
+    return "malformed request \u2014 if this is an auth failure, check --api-token or run `aex login`";
   if (status2 === 401)
     return "check --api-token, or run `aex login`";
   if (status2 === 403)
@@ -3460,7 +3731,7 @@ async function runRunCmd(io2, argv) {
   const seen = /* @__PURE__ */ new Set();
   let currentStatus = accepted.session.status;
   const deadline = followTimeoutMs === null ? Number.POSITIVE_INFINITY : Date.now() + followTimeoutMs;
-  while (!isSessionParked(currentStatus)) {
+  while (!isSessionParked2(currentStatus)) {
     await sleep2(2e3);
     try {
       const events = await operations_exports.listSessionEvents(http, session.id);
@@ -3481,7 +3752,7 @@ async function runRunCmd(io2, argv) {
       io2.stderr(`(transient) status poll failed: ${err2.message}
 `);
     }
-    if (!isSessionParked(currentStatus) && Date.now() >= deadline) {
+    if (!isSessionParked2(currentStatus) && Date.now() >= deadline) {
       emitJsonError(io2, "run_follow_timeout", `timed out after ${followTimeoutMs}ms following session`, {
         sessionId: session.id,
         hint: `aex status ${session.id} | aex events ${session.id} | aex download ${session.id}`
@@ -3677,7 +3948,7 @@ async function runWaitCmd(io2, argv) {
       await sleep3(intervalMs);
       continue;
     }
-    if (isSessionParked(session.status)) {
+    if (isSessionParked2(session.status)) {
       io2.stdout(JSON.stringify(session) + "\n");
       return isSessionOk(session.status) ? SUCCESS : RUNTIME_ERR;
     }
@@ -3757,7 +4028,7 @@ async function runEventsCmd(io2, argv) {
     }
     try {
       const session = await operations_exports.getSession(http, sessionId);
-      if (isSessionParked(session.status)) {
+      if (isSessionParked2(session.status)) {
         return SUCCESS;
       }
     } catch (err2) {
@@ -4002,25 +4273,26 @@ async function runWhoamiCmd(io2, argv) {
   }
 }
 
-// dist/host/redeem.js
-function messageForStatus(status2, serverMessage) {
-  switch (status2) {
-    case 404:
-      return "coupon code not found";
-    case 403:
-      return "this coupon can't be redeemed by this workspace";
-    case 409:
-      return "coupon already redeemed";
-    case 400:
-      return serverMessage ? `invalid input: ${serverMessage}` : "invalid input";
-    case 401:
-      return "not authorized \u2014 check --api-token, or run `aex login`";
-    default:
-      return serverMessage ? `redeem failed: ${serverMessage}` : `redeem failed (HTTP ${status2})`;
+// dist/host/billing.js
+function usd(value) {
+  return typeof value === "number" && Number.isFinite(value) ? `$${value.toFixed(2)}` : "-";
+}
+function isPaidPlanKey(value) {
+  return value === "pro" || value === "team";
+}
+function parseLimit(io2, raw) {
+  if (raw === void 0)
+    return { ok: true, limit: void 0 };
+  const limit = Number(raw);
+  if (!Number.isInteger(limit) || limit < 1) {
+    io2.stderr(`--limit must be a positive integer (got: ${raw})
+`);
+    return { ok: false };
   }
+  return { ok: true, limit };
 }
-async function runRedeemCmd(io2, argv) {
-  if (await refuseInsideManagedRun(io2, "redeem"))
+async function runBillingCmd(io2, argv) {
+  if (await refuseInsideManagedRun(io2, "billing"))
     return USAGE_ERR;
   const common = await resolveCommonHostFlags(io2, argv);
   if (!common.ok) {
@@ -4028,54 +4300,255 @@ async function runRedeemCmd(io2, argv) {
 `);
     return USAGE_ERR;
   }
-  const positional = common.rest.filter((arg) => !arg.startsWith("--"));
-  if (positional.length !== 1) {
-    io2.stderr("usage: aex redeem <code> [common flags]\n");
+  if (common.rest[0] === "ledger") {
+    return runBillingLedger(io2, common.rest.slice(1), common.flags);
+  }
+  if (common.rest[0] === "upgrade") {
+    return runBillingUpgrade(io2, common.rest.slice(1), common.flags);
+  }
+  if (common.rest[0] === "portal") {
+    return runBillingPortal(io2, common.rest.slice(1), common.flags);
+  }
+  const { present: json, remaining } = takeBooleanFlag(common.rest, "--json");
+  if (remaining.length > 0) {
+    io2.stderr(`unexpected arguments: ${remaining.join(" ")}
+`);
+    io2.stderr("usage: aex billing [--json] | aex billing ledger [--limit N] | aex billing upgrade pro|team | aex billing portal [common flags]\n");
+    return USAGE_ERR;
+  }
+  const http = makeHttpClient(io2, common.flags);
+  try {
+    const billing = await operations_exports.getBilling(http);
+    if (json) {
+      io2.stdout(JSON.stringify(billing) + "\n");
+      return SUCCESS;
+    }
+    io2.stdout(`Balance:      ${usd(billing.balanceUsd)}
+`);
+    io2.stdout(`Month spend:  ${usd(billing.monthSpendUsd)}
+`);
+    io2.stdout(`Spend cap:    ${usd(billing.spendCapUsd)}
+`);
+    io2.stdout(`Plan:         ${billing.planKey} (subscription: ${billing.subscriptionStatus})
+`);
+    return SUCCESS;
+  } catch (err2) {
+    const d = describeApiError(err2);
+    return emitJsonError(io2, "billing_failed", d.message, {
+      ...d.status !== void 0 ? { status: d.status } : {},
+      ...d.remedy ? { remedy: d.remedy } : {}
+    });
+  }
+}
+async function runBillingUpgrade(io2, argv, flags) {
+  const { present: json, remaining: rest1 } = takeBooleanFlag(argv, "--json");
+  const { value: successUrl, remaining: rest2 } = takeOptionFlag(rest1, "--success-url");
+  const { value: cancelUrl, remaining: rest3 } = takeOptionFlag(rest2, "--cancel-url");
+  const { value: idempotencyKey, remaining } = takeOptionFlag(rest3, "--idempotency-key");
+  const planKey = remaining[0];
+  if (!isPaidPlanKey(planKey) || remaining.length !== 1) {
+    io2.stderr("usage: aex billing upgrade pro|team [--success-url URL] [--cancel-url URL] [--idempotency-key KEY] [--json] [common flags]\n");
     return USAGE_ERR;
   }
-  const code = positional[0];
-  const base = common.flags.aexUrl.replace(/\/+$/, "");
-  const url = `${base}/billing/redeem`;
-  let response;
+  const http = makeHttpClient(io2, flags);
   try {
-    response = await io2.fetchImpl(url, {
-      method: "POST",
-      headers: {
-        accept: "application/json",
-        "content-type": "application/json",
-        authorization: `Bearer ${common.flags.apiToken}`
-      },
-      body: JSON.stringify({ code })
+    const session = await operations_exports.createBillingCheckout(http, {
+      planKey,
+      ...successUrl !== void 0 ? { successUrl } : {},
+      ...cancelUrl !== void 0 ? { cancelUrl } : {},
+      ...idempotencyKey !== void 0 ? { idempotencyKey } : {}
     });
+    io2.stdout(json ? `${JSON.stringify(session)}
+` : `${session.url}
+`);
+    return SUCCESS;
   } catch (err2) {
-    io2.stderr(`redeem failed: ${err2 instanceof Error ? err2.message : String(err2)}
+    const d = describeApiError(err2);
+    return emitJsonError(io2, "billing_checkout_failed", d.message, {
+      ...d.status !== void 0 ? { status: d.status } : {},
+      ...d.remedy ? { remedy: d.remedy } : {}
+    });
+  }
+}
+async function runBillingPortal(io2, argv, flags) {
+  const { present: json, remaining: rest1 } = takeBooleanFlag(argv, "--json");
+  const { value: returnUrl, remaining } = takeOptionFlag(rest1, "--return-url");
+  if (remaining.length > 0) {
+    io2.stderr(`unexpected arguments: ${remaining.join(" ")}
 `);
-    return RUNTIME_ERR;
+    io2.stderr("usage: aex billing portal [--return-url URL] [--json] [common flags]\n");
+    return USAGE_ERR;
   }
-  if (common.flags.debug) {
-    io2.stderr(`[aex] POST /billing/redeem -> ${response.status}
+  const http = makeHttpClient(io2, flags);
+  try {
+    const session = await operations_exports.createBillingPortal(http, returnUrl !== void 0 ? { returnUrl } : void 0);
+    io2.stdout(json ? `${JSON.stringify(session)}
+` : `${session.url}
 `);
+    return SUCCESS;
+  } catch (err2) {
+    const d = describeApiError(err2);
+    return emitJsonError(io2, "billing_portal_failed", d.message, {
+      ...d.status !== void 0 ? { status: d.status } : {},
+      ...d.remedy ? { remedy: d.remedy } : {}
+    });
   }
-  const text = await response.text();
-  let body = {};
+}
+async function runBillingLedger(io2, argv, flags) {
+  const { value: rawLimit, remaining } = takeOptionFlag(argv, "--limit");
+  if (remaining.length > 0) {
+    io2.stderr(`unexpected arguments: ${remaining.join(" ")}
+`);
+    io2.stderr("usage: aex billing ledger [--limit N] [common flags]\n");
+    return USAGE_ERR;
+  }
+  const parsed = parseLimit(io2, rawLimit);
+  if (!parsed.ok)
+    return USAGE_ERR;
+  const http = makeHttpClient(io2, flags);
   try {
-    if (text.length > 0)
-      body = JSON.parse(text);
-  } catch {
-    body = {};
+    const page = await operations_exports.getBillingLedger(http, parsed.limit !== void 0 ? { limit: parsed.limit } : void 0);
+    io2.stdout(JSON.stringify(page.entries) + "\n");
+    return SUCCESS;
+  } catch (err2) {
+    const d = describeApiError(err2);
+    return emitJsonError(io2, "billing_ledger_failed", d.message, {
+      ...d.status !== void 0 ? { status: d.status } : {},
+      ...d.remedy ? { remedy: d.remedy } : {}
+    });
   }
-  if (!response.ok) {
-    const serverMessage = body && typeof body === "object" && typeof body.message === "string" ? body.message : void 0;
-    io2.stderr(`${messageForStatus(response.status, serverMessage)}
+}
+
+// dist/host/webhooks-cmd.js
+async function runWebhooksCmd(io2, argv) {
+  if (await refuseInsideManagedRun(io2, "webhooks"))
+    return USAGE_ERR;
+  const common = await resolveCommonHostFlags(io2, argv);
+  if (!common.ok) {
+    io2.stderr(`${common.reason}
 `);
-    return RUNTIME_ERR;
+    return USAGE_ERR;
+  }
+  const [sub, ...rest] = common.rest;
+  if (sub !== "secret") {
+    io2.stderr("usage: aex webhooks secret [common flags]\n");
+    return USAGE_ERR;
   }
-  const ok = body;
-  const amountUsd = typeof ok.amountUsd === "number" ? ok.amountUsd : 0;
-  const newBalanceUsd = typeof ok.newBalanceUsd === "number" ? ok.newBalanceUsd : 0;
-  io2.stdout(`Redeemed $${amountUsd.toFixed(2)}. New balance: $${newBalanceUsd.toFixed(2)}.
+  const { present: rotate, remaining } = takeBooleanFlag(rest, "--rotate");
+  if (rotate) {
+    io2.stderr("--rotate is not supported: the hosted API reveals (or creates on first use) the workspace webhook signing secret but does not rotate it. Run `aex webhooks secret` to reveal the current value.\n");
+    return USAGE_ERR;
+  }
+  if (remaining.length > 0) {
+    io2.stderr(`unexpected arguments: ${remaining.join(" ")}
 `);
-  return SUCCESS;
+    io2.stderr("usage: aex webhooks secret [common flags]\n");
+    return USAGE_ERR;
+  }
+  const http = makeHttpClient(io2, common.flags);
+  try {
+    const { whsec } = await operations_exports.getWebhookSigningSecret(http);
+    io2.stdout(`${whsec}
+`);
+    return SUCCESS;
+  } catch (err2) {
+    const d = describeApiError(err2);
+    return emitJsonError(io2, "webhooks_secret_failed", d.message, {
+      ...d.status !== void 0 ? { status: d.status } : {},
+      ...d.remedy ? { remedy: d.remedy } : {}
+    });
+  }
+}
+
+// dist/host/list-cmds.js
+function parseLimit2(io2, raw) {
+  if (raw === void 0)
+    return { ok: true, limit: void 0 };
+  const limit = Number(raw);
+  if (!Number.isInteger(limit) || limit < 1) {
+    io2.stderr(`--limit must be a positive integer (got: ${raw})
+`);
+    return { ok: false };
+  }
+  return { ok: true, limit };
+}
+async function runRunsCmd(io2, argv) {
+  if (await refuseInsideManagedRun(io2, "runs"))
+    return USAGE_ERR;
+  const common = await resolveCommonHostFlags(io2, argv);
+  if (!common.ok) {
+    io2.stderr(`${common.reason}
+`);
+    return USAGE_ERR;
+  }
+  const { value: rawLimit, remaining: afterLimit } = takeOptionFlag(common.rest, "--limit");
+  const { value: since, remaining } = takeOptionFlag(afterLimit, "--since");
+  if (remaining.length > 0) {
+    io2.stderr(`unexpected arguments: ${remaining.join(" ")}
+`);
+    io2.stderr("usage: aex runs [--limit N] [--since ISO-8601] [common flags]\n");
+    return USAGE_ERR;
+  }
+  const parsed = parseLimit2(io2, rawLimit);
+  if (!parsed.ok)
+    return USAGE_ERR;
+  const sinceMs = since !== void 0 ? Date.parse(since) : void 0;
+  if (sinceMs !== void 0 && Number.isNaN(sinceMs)) {
+    io2.stderr(`--since must be an ISO-8601 timestamp (got: ${since})
+`);
+    return USAGE_ERR;
+  }
+  const http = makeHttpClient(io2, common.flags);
+  try {
+    const page = await operations_exports.listRuns(http, {
+      ...parsed.limit !== void 0 ? { limit: parsed.limit } : {},
+      ...since !== void 0 ? { since } : {}
+    });
+    const runs = sinceMs === void 0 ? page.runs : page.runs.filter((run) => {
+      const created = Date.parse(run.createdAt);
+      return !Number.isNaN(created) && created >= sinceMs;
+    });
+    io2.stdout(JSON.stringify({ ...page, runs }) + "\n");
+    return SUCCESS;
+  } catch (err2) {
+    const d = describeApiError(err2);
+    return emitJsonError(io2, "runs_failed", d.message, {
+      ...d.status !== void 0 ? { status: d.status } : {},
+      ...d.remedy ? { remedy: d.remedy } : {}
+    });
+  }
+}
+async function runSessionsCmd(io2, argv) {
+  if (await refuseInsideManagedRun(io2, "sessions"))
+    return USAGE_ERR;
+  const common = await resolveCommonHostFlags(io2, argv);
+  if (!common.ok) {
+    io2.stderr(`${common.reason}
+`);
+    return USAGE_ERR;
+  }
+  const { value: rawLimit, remaining } = takeOptionFlag(common.rest, "--limit");
+  if (remaining.length > 0) {
+    io2.stderr(`unexpected arguments: ${remaining.join(" ")}
+`);
+    io2.stderr("usage: aex sessions [--limit N] [common flags]\n");
+    return USAGE_ERR;
+  }
+  const parsed = parseLimit2(io2, rawLimit);
+  if (!parsed.ok)
+    return USAGE_ERR;
+  const http = makeHttpClient(io2, common.flags);
+  try {
+    const page = await operations_exports.listSessions(http, parsed.limit !== void 0 ? { limit: parsed.limit } : void 0);
+    io2.stdout(JSON.stringify(page) + "\n");
+    return SUCCESS;
+  } catch (err2) {
+    const d = describeApiError(err2);
+    return emitJsonError(io2, "sessions_failed", d.message, {
+      ...d.status !== void 0 ? { status: d.status } : {},
+      ...d.remedy ? { remedy: d.remedy } : {}
+    });
+  }
 }
 
 // dist/host/debug.js
@@ -5145,7 +5618,7 @@ async function runTailCmd(io2, argv) {
   }
   if (isSessionOk(finalStatus))
     return SUCCESS;
-  if (isSessionParked(finalStatus))
+  if (isSessionParked2(finalStatus))
     return RUNTIME_ERR;
   io2.stderr(JSON.stringify({
     error: "tail_ended_before_terminal",
@@ -5354,10 +5827,16 @@ async function dispatch(io2, args) {
       return runDeleteCmd(io2, rest);
     case "delete-asset":
       return runDeleteAssetCmd(io2, rest);
+    case "runs":
+      return runRunsCmd(io2, rest);
+    case "sessions":
+      return runSessionsCmd(io2, rest);
     case "whoami":
       return runWhoamiCmd(io2, rest);
-    case "redeem":
-      return runRedeemCmd(io2, rest);
+    case "billing":
+      return runBillingCmd(io2, rest);
+    case "webhooks":
+      return runWebhooksCmd(io2, rest);
     case "login":
       return runLoginCmd(io2, rest);
     case "logout":
@@ -5397,8 +5876,14 @@ async function printGlobalHelp(io2) {
   io2.stdout("  aex cancel <session-id> --api-token T\n");
   io2.stdout("  aex delete <session-id> --api-token T\n");
   io2.stdout("  aex delete-asset <assetId|hash> --api-token T\n");
+  io2.stdout("  aex runs [--limit N] [--since ISO] --api-token T      List the workspace's runs (newest first, JSON)\n");
+  io2.stdout("  aex sessions [--limit N] --api-token T      List the workspace's sessions (newest first, JSON)\n");
   io2.stdout("  aex whoami --api-token T\n");
-  io2.stdout("  aex redeem <code> --api-token T             Redeem a coupon code into the workspace prepaid balance\n");
+  io2.stdout("  aex billing [--json] --api-token T          Show prepaid balance, month spend, and spend cap\n");
+  io2.stdout("  aex billing ledger [--limit N] --api-token T   Recent credit-ledger entries (newest first, JSON)\n");
+  io2.stdout("  aex billing upgrade pro|team --api-token T   Create a hosted checkout session and print its URL\n");
+  io2.stdout("  aex billing portal --api-token T             Create a hosted billing portal session and print its URL\n");
+  io2.stdout("  aex webhooks secret --api-token T           Reveal (create on first use) the webhook signing secret\n");
   io2.stdout("  aex login --api-token T [--aex-url U]      Persist token + url (then other verbs need no --api-token)\n");
   io2.stdout("  aex logout                                 Clear the stored token\n");
   io2.stdout("  aex auth status                            Show the resolved config (token never printed)\n");
@@ -5427,7 +5912,7 @@ async function printGlobalHelp(io2) {
   io2.stdout("  --mcp-auth name=Hdr:Val     Auth header on the matching --mcp; routed into vaulted secrets (repeatable)\n");
   io2.stdout("  --metadata key=value        Submission metadata entry (repeatable)\n");
   io2.stdout("  --runtime-size <size>       managed runtime preset\n");
-  io2.stdout("  --run-timeout <dur>         Server-side run deadline (e.g. 1h); distinct from --timeout\n");
+  io2.stdout("  --run-timeout <dur>         Server-side run deadline (e.g. 1h, max 8h); distinct from --timeout\n");
   io2.stdout("  --idempotency-key <key>     Optional; defaults to a fresh UUID\n");
   io2.stdout("  --webhook <url>             Optional per-run callback URL (https); receives the terminal run.finished event\n");
   io2.stdout("  --follow                    Poll events to stdout until the run terminates\n");