@aexhq/sdk 0.40.13 → 0.40.15

package/dist/_contracts/http.d.ts

@@ -19,9 +19,10 @@ export interface HttpClientOptions {
     /** When set, every request emits a redacted one-line trace here. */
     readonly debug?: DebugSink;
     /**
-     * Retry transient transport failures for idempotent GET/HEAD requests.
+     * Retry transient transport failures for idempotent requests.
      * Disabled by default; host CLIs enable this so a single dropped API
-     * connection does not fail read-only commands.
+     * connection does not fail read-only commands or billable writes carrying
+     * an `Idempotency-Key`.
      */
     readonly retryTransientGets?: boolean | TransientGetRetryOptions;
 }

package/dist/_contracts/http.js

@@ -55,7 +55,7 @@ export class HttpClient {
             }
         }
         const method = methodOf(init.method);
-        const retry = retryForMethod(method, this.#retryTransientGets);
+        const retry = retryForRequest(method, headers, this.#retryTransientGets);
         const requestStartedMs = Date.now();
         for (let attempt = 1; attempt <= retry.maxAttempts; attempt += 1) {
             const startedMs = Date.now();
@@ -93,7 +93,7 @@ export class HttpClient {
             ...normalizeHeaders(init.headers)
         };
         const method = methodOf(init.method);
-        const retry = retryForMethod(method, this.#retryTransientGets);
+        const retry = retryForRequest(method, headers, this.#retryTransientGets);
         const requestStartedMs = Date.now();
         for (let attempt = 1; attempt <= retry.maxAttempts; attempt += 1) {
             const startedMs = Date.now();
@@ -152,12 +152,23 @@ function resolveTransientGetRetry(retry) {
 function methodOf(method) {
     return (method ?? "GET").toUpperCase();
 }
-function retryForMethod(method, retry) {
-    if (!retry || (method !== "GET" && method !== "HEAD")) {
+function retryForRequest(method, headers, retry) {
+    if (!retry || (!isMethodIdempotent(method) && !hasIdempotencyKey(headers))) {
         return { ...DEFAULT_TRANSIENT_GET_RETRY, maxAttempts: 1 };
     }
     return retry;
 }
+function isMethodIdempotent(method) {
+    return method === "GET" || method === "HEAD";
+}
+function hasIdempotencyKey(headers) {
+    for (const [name, value] of Object.entries(headers)) {
+        if (name.toLowerCase() === "idempotency-key" && value.trim().length > 0) {
+            return true;
+        }
+    }
+    return false;
+}
 function shouldRetryTransientRead(err, retry, attempt) {
     return attempt < retry.maxAttempts && transientReadErrorCode(err) !== undefined;
 }

package/dist/_contracts/operations.d.ts

@@ -121,7 +121,7 @@ export declare const READ_OUTPUT_TEXT_MAX_BYTES = 10000000;
 /** Default `maxBytes` for {@link readOutputText} — a chat-sized preview. */
 export declare const READ_OUTPUT_TEXT_DEFAULT_BYTES = 50000;
 /** Default per-attempt timeout while fetching or reading one output body. */
-export declare const OUTPUT_FILE_TRANSFER_DEFAULT_TIMEOUT_MS = 15000;
+export declare const OUTPUT_FILE_TRANSFER_DEFAULT_TIMEOUT_MS = 30000;
 /** Idempotent output GETs retry once on a transfer timeout. */
 export declare const OUTPUT_FILE_TRANSFER_ATTEMPTS = 2;
 export interface OutputTransferOptions {

package/dist/_contracts/operations.js

@@ -382,7 +382,7 @@ export const READ_OUTPUT_TEXT_MAX_BYTES = 10_000_000;
 /** Default `maxBytes` for {@link readOutputText} — a chat-sized preview. */
 export const READ_OUTPUT_TEXT_DEFAULT_BYTES = 50_000;
 /** Default per-attempt timeout while fetching or reading one output body. */
-export const OUTPUT_FILE_TRANSFER_DEFAULT_TIMEOUT_MS = 15_000;
+export const OUTPUT_FILE_TRANSFER_DEFAULT_TIMEOUT_MS = 30_000;
 /** Idempotent output GETs retry once on a transfer timeout. */
 export const OUTPUT_FILE_TRANSFER_ATTEMPTS = 2;
 /**

package/dist/_contracts/runtime-types.d.ts

@@ -434,7 +434,7 @@ export interface ReadOutputTextOptions {
     readonly maxBytes?: number;
     /**
      * Per-attempt timeout for fetching and reading the selected output body.
-     * Defaults to 15_000ms; idempotent output reads retry once on timeout before
+     * Defaults to 30_000ms; idempotent output reads retry once on timeout before
      * surfacing a structured NETWORK_ERROR.
      */
     readonly timeoutMs?: number;

package/dist/cli.mjs

@@ -2190,7 +2190,7 @@ var HttpClient = class {
       }
     }
     const method = methodOf(init.method);
-    const retry = retryForMethod(method, this.#retryTransientGets);
+    const retry = retryForRequest(method, headers, this.#retryTransientGets);
     const requestStartedMs = Date.now();
     for (let attempt = 1; attempt <= retry.maxAttempts; attempt += 1) {
       const startedMs = Date.now();
@@ -2227,7 +2227,7 @@ var HttpClient = class {
       ...normalizeHeaders(init.headers)
     };
     const method = methodOf(init.method);
-    const retry = retryForMethod(method, this.#retryTransientGets);
+    const retry = retryForRequest(method, headers, this.#retryTransientGets);
     const requestStartedMs = Date.now();
     for (let attempt = 1; attempt <= retry.maxAttempts; attempt += 1) {
       const startedMs = Date.now();
@@ -2285,12 +2285,23 @@ function resolveTransientGetRetry(retry) {
 function methodOf(method) {
   return (method ?? "GET").toUpperCase();
 }
-function retryForMethod(method, retry) {
-  if (!retry || method !== "GET" && method !== "HEAD") {
+function retryForRequest(method, headers, retry) {
+  if (!retry || !isMethodIdempotent(method) && !hasIdempotencyKey(headers)) {
     return { ...DEFAULT_TRANSIENT_GET_RETRY, maxAttempts: 1 };
   }
   return retry;
 }
+function isMethodIdempotent(method) {
+  return method === "GET" || method === "HEAD";
+}
+function hasIdempotencyKey(headers) {
+  for (const [name, value] of Object.entries(headers)) {
+    if (name.toLowerCase() === "idempotency-key" && value.trim().length > 0) {
+      return true;
+    }
+  }
+  return false;
+}
 function shouldRetryTransientRead(err2, retry, attempt) {
   return attempt < retry.maxAttempts && transientReadErrorCode(err2) !== void 0;
 }
@@ -3460,7 +3471,7 @@ async function downloadOutput(http, runId, selector, options) {
 }
 var READ_OUTPUT_TEXT_MAX_BYTES = 1e7;
 var READ_OUTPUT_TEXT_DEFAULT_BYTES = 5e4;
-var OUTPUT_FILE_TRANSFER_DEFAULT_TIMEOUT_MS = 15e3;
+var OUTPUT_FILE_TRANSFER_DEFAULT_TIMEOUT_MS = 3e4;
 var OUTPUT_FILE_TRANSFER_ATTEMPTS = 2;
 async function readOutputText(http, runId, selector, options) {
   const maxBytes = Math.max(1, Math.min(options?.maxBytes ?? READ_OUTPUT_TEXT_DEFAULT_BYTES, READ_OUTPUT_TEXT_MAX_BYTES));

package/dist/cli.mjs.sha256

@@ -1 +1 @@
-e5a409f5a6045f4ac2f366cb55f8a34faac7a3dc0ab048fc99760230305cd5e9  cli.mjs
+3a1bd5828048c0c5f9c59b3676b2e91e30a45a080c566f95d3f9de2590f28f9c  cli.mjs

package/dist/client.d.ts

@@ -580,7 +580,7 @@ export interface OutputDownloadOptions {
     readonly to?: string;
     /**
      * Per-attempt timeout for fetching and reading the selected output body.
-     * Defaults to 15_000ms; idempotent output downloads retry once on timeout.
+     * Defaults to 30_000ms; idempotent output downloads retry once on timeout.
      */
     readonly timeoutMs?: number;
 }

package/dist/version.d.ts

@@ -6,4 +6,4 @@
  *
  * Used by the (future) User-Agent header on outbound SDK requests.
  */
-export declare const SDK_VERSION = "0.40.13";
+export declare const SDK_VERSION = "0.40.15";

package/dist/version.js

@@ -6,5 +6,5 @@
  *
  * Used by the (future) User-Agent header on outbound SDK requests.
  */
-export const SDK_VERSION = "0.40.13";
+export const SDK_VERSION = "0.40.15";
 //# sourceMappingURL=version.js.map

package/docs/concepts/subagents.md

@@ -29,17 +29,20 @@ error). See [Credentials](../credentials.md).
 
 ## Depth and breadth limits
 
-Delegation is bounded by two server-enforced lineage limits:
+Delegation is bounded by server-enforced lineage budgets. The runtime is
+designed for broad fan-out, across hundreds and even thousands of concurrent
+child agents per root, and for high levels of recursive subagent depth. Exact
+operational limits are platform-managed and may change as the runtime scales.
 
-| Limit | Value | Behavior at the limit |
+| Limit | Runtime posture | Behavior at the limit |
 | --- | --- | --- |
-| Max depth | **5** — the root run is depth 0 and may spawn down to depth 5; a depth-5 run may not spawn further | The spawn is rejected with a `depth_exceeded` tool error (the parent keeps running). |
-| Concurrent children per lineage root | **1000** live (non-terminal) descendants by default; hard platform ceiling **4096** | Further spawns are refused until a child settles. |
+| Max recursive subagent depth | Supports high levels of nested delegation, bounded server-side. | A further spawn is rejected with a `depth_exceeded` tool error (the parent keeps running). |
+| Concurrent children per lineage root | Designed to scale across hundreds, even thousands, of live descendants, bounded server-side. | Further spawns are refused until a child settles. |
 
 The whole descendant subtree of one root shares a single depth and breadth
 budget, enforced server-side at every level — a grandchild spawn counts against
-the same root budget as a direct child. Values are mirrored in
-[Limits & quotas](../limits-and-quotas.md).
+the same root budget as a direct child. These budgets are not public per-session
+dials today.
 
 ## Where children run: `in-process` vs `container`
 
@@ -84,5 +87,5 @@ Every child — in-process or container — is a first-class run record:
 - Turn delegation off for a run by cherry-picking builtins without `subagent`
   (see [Agent tools](agent-tools.md)) or setting `includeBuiltinTools: false`.
 - A per-session spend cap (`overrides.maxSpendUsd`) bounds the parent's spend.
-- The depth/breadth limits above are platform defaults and are not settable
+- The depth/breadth budgets above are platform-managed and are not settable
   per-session today.

package/docs/defaults.md

@@ -48,10 +48,13 @@ For the hard ceilings and who can raise them, see
 
 ## Subagents
 
+Subagent breadth and depth are platform-managed budgets rather than fixed public
+numeric entitlements; exact operational values may change as capacity evolves.
+
 | Option | Default | How to override | Source |
 | --- | --- | --- | --- |
-| Concurrent child runs per lineage root | 1000 (live, non-terminal child runs) | Platform default (subagents run in-process; no public per-run override). Hard ceiling 4096. | `RUN_DEFAULT_MAX_CONCURRENT_CHILD_RUNS` |
-| Max subagent depth | 5 | Platform default (subagents run in-process; no public per-run override). | `RUN_MAX_PUBLIC_SUBAGENT_DEPTH` |
+| Concurrent child runs per lineage root | Platform-managed; designed to scale across hundreds, even thousands, of live child agents. | No public per-run override; contact support for unusually large workloads. | `RUN_DEFAULT_MAX_CONCURRENT_CHILD_RUNS` |
+| Max subagent depth | Platform-managed; supports high recursive subagent depth. | No public per-run override. | `RUN_MAX_PUBLIC_SUBAGENT_DEPTH` |
 
 ## Workspace
 

package/docs/limits-and-quotas.md

@@ -58,10 +58,15 @@ silently lost.
 
 ### Subagents (per run lineage)
 
+Subagent lineage bounds are enforced server-side but are intentionally not
+advertised as fixed public ceilings because capacity can change. The runtime
+posture is high fan-out and high recursive depth; exact admission is governed
+by the platform at spawn time.
+
 | Limit | Value | Source | Raisable? | Constant |
 | --- | --- | --- | --- | --- |
-| Max subagent depth (`subagent` tool) | 5 (a depth-5 lineage may not spawn deeper) | aex policy | No public per-run override (subagents run in-process) | `RUN_MAX_PUBLIC_SUBAGENT_DEPTH` |
-| Concurrent child runs per lineage root | 1000 live (non-terminal); hard ceiling 4096 | aex policy | No public per-run override (subagents run in-process) | `RUN_DEFAULT_MAX_CONCURRENT_CHILD_RUNS` |
+| Max subagent depth (`subagent` tool) | High recursive subagent depth, bounded server-side. | aex policy | No public per-run override (subagents run in-process) | `RUN_MAX_PUBLIC_SUBAGENT_DEPTH` |
+| Concurrent child runs per lineage root | Designed to scale across hundreds, even thousands, of live child agents, bounded server-side. | aex policy | No public per-run override (subagents run in-process) | `RUN_DEFAULT_MAX_CONCURRENT_CHILD_RUNS` |
 
 ### Retention (per run)
 
@@ -98,7 +103,7 @@ A few behaviours are worth knowing before you rely on the filesystem or RAM:
 | Limit | Value | Source | Raisable? | Constant |
 | --- | --- | --- | --- | --- |
 | Workspace storage cap | 500 GB (decimal; admins uncapped — not a customer entitlement) | Workspace default | Per-plane via env `AEX_WORKSPACE_STORAGE_CAP_BYTES` | `WORKSPACE_DEFAULT_STORAGE_CAP_BYTES` |
-| Max concurrent runs per workspace | Plan-based: **5** live (non-terminal) root runs on the free plan, **50** on Pro, **200** on Team; hard platform ceiling **200**. One more submit past the cap fails with `429 workspace_concurrency_exceeded` (see [Errors](errors.md)). Subagent children are governed separately by the per-lineage caps below. Read your effective cap from `aex.whoami().limits.maxConcurrentRuns`. | Workspace default (per plan) | Per-plan (upgrade) or per-workspace override (contact support), clamped to the 200 ceiling | `PLANS[planKey].maxConcurrentRuns` / `WORKSPACE_MAX_CONCURRENT_RUNS_CEILING` |
+| Max concurrent runs per workspace | Plan-based: **5** live (non-terminal) root runs on the free plan, **50** on Pro, **200** on Team; hard platform ceiling **200**. One more submit past the cap fails with `429 workspace_concurrency_exceeded` (see [Errors](errors.md)). Subagent children are governed separately by the platform-managed per-lineage budgets above. Read your effective cap from `aex.whoami().limits.maxConcurrentRuns`. | Workspace default (per plan) | Per-plan (upgrade) or per-workspace override (contact support), clamped to the 200 ceiling | `PLANS[planKey].maxConcurrentRuns` / `WORKSPACE_MAX_CONCURRENT_RUNS_CEILING` |
 | Monthly workspace spend cap | **$250** per rolling UTC calendar month by default; `0` = unlimited. A submit past the cap fails with `402 workspace_spend_cap_exceeded` (see [Errors](errors.md)). | Workspace default | Per-workspace override (contact support) | `WORKSPACE_DEFAULT_SPEND_CAP_USD` |
 | Skill bundle max compressed size (`.zip`) | 10 GiB (enforced at upload by the SDK and re-enforced server-side) | aex policy | No (hard ceiling) | `SKILL_BUNDLE_LIMITS.maxCompressedBytes` |
 | Skill bundle max decompressed size (sum of uncompressed file sizes) | 50 MB | aex policy | No (hard ceiling) | `SKILL_BUNDLE_LIMITS.maxDecompressedBytes` |

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aexhq/sdk",
-  "version": "0.40.13",
+  "version": "0.40.15",
   "description": "TypeScript SDK for running autonomous agent sessions across providers (Anthropic, OpenAI, DeepSeek, Gemini, Mistral) behind one interface.",
   "license": "Apache-2.0",
   "repository": {