@aexhq/sdk 0.40.4 → 0.40.6

package/README.md

@@ -1,159 +1,159 @@
----
-title: aex
----
-
-# @aexhq/sdk
-
-aex is an agent execution platform for launching autonomous agents from a simple TypeScript SDK and CLI.
-
-The package ships:
-
-- `Aex` for sessions, one-shot runs, inspect, download, cancel, and delete.
-- `sessions` / `openSession()` for durable, resumable agent sessions.
-- Typed run primitives: `Models`, `Providers`, `Sizes`, `Skill`, `Tool` / `Tools`, `AgentsMd`, `File`, `McpServer`, and `Secret`.
-- A bundled `aex` CLI with the same run, status, events, outputs, download, cancel, delete, and whoami operations.
-
-## Install
-
-```bash
-npm i @aexhq/sdk
-```
-
-This installs the TypeScript SDK exports and the bundled `aex` CLI. The CLI
-ships inside the package — invoke it with `npx aex …` after a local install, or
-`npm i -g @aexhq/sdk` to put a bare `aex` on your PATH. Set both credentials
-before running the examples: `AEX_API_KEY` authenticates to aex, and
-`ANTHROPIC_API_KEY` is your BYOK provider key for Claude.
-
-```bash
-export AEX_API_KEY="<your-aex-api-key>"
-export ANTHROPIC_API_KEY="<your-anthropic-api-key>"
-```
-
-## First Session
-
-```ts
-import { Aex, Models, Sizes } from "@aexhq/sdk";
-
-const aex = new Aex(process.env.AEX_API_KEY!);
-
-const session = await aex.openSession({
-  model: Models.CLAUDE_HAIKU_4_5,
-  system: "You are a concise engineering assistant.",
-  runtime: Sizes.SHARED_0_25X_1GB,
-  // Default is "3m"; set it explicitly when you want a different idle window.
-  overrides: { idleTtl: "3m" },
-  apiKeys: { anthropic: process.env.ANTHROPIC_API_KEY! }
-});
-
-// done() awaits settle by default, so status is the terminal outcome
-// ("succeeded"), and costUsd/usage are populated.
-const first = await session.send("Summarize this repo.").done();
-console.log(first.status, first.costUsd, first.text);
-
-const resumed = await aex.openSession(session.id);
-await resumed.send("Continue with the follow-up validation.").done();
-```
-
-Need a one-shot convenience? `run()` opens a session, sends `message` as one
-turn, and returns the collected result. The returned `runId` is the session id,
-so it can be resumed later with `openSession(runId)`.
-
-```ts
-const result = await aex.run({
-  model: Models.CLAUDE_HAIKU_4_5,
-  apiKeys: { anthropic: process.env.ANTHROPIC_API_KEY! },
-  message: "Write the report and save outputs."
-});
-
-console.log(result.runId, result.status, result.text);
-```
-
-For multiple providers, include each BYOK key in `apiKeys`:
-
-```ts
-await aex.run({
-  model: Models.CLAUDE_HAIKU_4_5,
-  apiKeys: {
-    anthropic: process.env.ANTHROPIC_API_KEY!,
-    openai: process.env.OPENAI_API_KEY!
-  },
-  message: "Delegate research to a subagent."
-});
-```
-
-The same request can run from the bundled CLI (`npx aex` on a local install):
-
-```bash
-npx aex run \
-  --api-key "$AEX_API_KEY" \
-  --anthropic-api-key "$ANTHROPIC_API_KEY" \
-  --model claude-haiku-4-5 \
-  --prompt "Write the report and save outputs." \
-  --follow
-```
-
-## CLI: login, discovery, typed errors
-
-Stop re-passing `--api-key` on every command — log in once and the token (plus
-your default `--aex-url`) is persisted to a `0600` config file
-(`$XDG_CONFIG_HOME/aex/config.json` or `~/.config/aex/config.json`; `%APPDATA%\aex\config.json`
-on Windows). An explicit `--api-key` flag always overrides the stored one.
-
-```bash
-npx aex login --api-key "$AEX_API_KEY" [--aex-url https://api.aex.dev]
-npx aex whoami            # no --api-key needed after login
-npx aex whoami --json     # machine-readable workspace + scopes + limits
-npx aex auth status       # show the resolved config (the token value is never printed)
-npx aex logout            # clear the stored token
-```
-
-Discover the closed sets the platform accepts — no token, no network (human table
-by default, machine JSON under `--json`). Per-verb `--help` is also key-free:
-
-```bash
-npx aex models list           # canonical models + their default provider
-npx aex providers list        # providers + the models each serves
-npx aex tools list            # complete builtin tool set
-npx aex runtime-sizes list    # managed runtime presets (cpus / memory / default)
-npx aex run --help            # flags for one verb (no API key required)
-```
-
-Errors are typed and actionable. Every `openSession()` / `run()` config-validation
-failure throws a `RunConfigValidationError` (`err.code === "RUN_CONFIG_INVALID"`)
-you can `catch` by code; CLI failures print a JSON envelope carrying the HTTP
-`status`, a one-line `remedy`, and the `runId` where known, and a wrong `--model`,
-`--provider`, or `--runtime-size` gets a "did you mean?" suggestion.
-
-## Continue with sessions
-
-Use sessions for conversational flows. `run()` is the one-shot convenience; a
-`SessionHandle` is the lower-level surface when you want multiple turns,
-streaming, messages, events, outputs, or downloads.
-
-```ts
-const session = await aex.openSession(result.runId);
-const next = await session.send("Turn this into a checklist.").done();
-console.log(next.text);
-
-const messages = await session.messages().list();
-const outputs = await aex.sessions.outputs(session.id).list();
-```
-
-## Feature Areas
-
-- **Agent runtime:** managed autonomous runs with filesystem read/edit, grep/glob/head/tail, open web fetch/search, background commands, code execution, git, and subagents.
-- **Durable infrastructure:** run records, status, wait/cancel/delete, idempotency, typed events, output capture, downloads, timeouts, and runtime sizes.
-- **Agent composition:** skills, files, AGENTS.md, remote MCP servers, environment variables, packages, and networking controls.
-- **Subagents:** typed parent/child lineage for async child runs, output handoff, and bounded agent delegation.
-- **Models and providers:** Anthropic, DeepSeek, OpenAI, Gemini, Mistral, OpenRouter, Doubao, and Doubao China behind one submission shape.
-- **Typed control surface:** strongly typed SDK inputs, CLI parity, BYOK provider keys, workspace secrets, redaction, and output modes.
-
-## Docs
-
-- [Quickstart](docs/quickstart.md)
-- [Run configuration](docs/run-config.md)
-- [Composition](docs/concepts/composition.md)
-- [Secrets](docs/secrets.md)
-- [Limits](docs/limits.md)
-- [Provider/runtime capabilities](docs/provider-runtime-capabilities.md)
+---
+title: aex
+---
+
+# @aexhq/sdk
+
+aex is an agent execution platform for launching autonomous agents from a simple TypeScript SDK and CLI.
+
+The package ships:
+
+- `Aex` for sessions, one-shot runs, inspect, download, cancel, and delete.
+- `sessions` / `openSession()` for durable, resumable agent sessions.
+- Typed run primitives: `Models`, `Providers`, `Sizes`, `Skill`, `Tool` / `Tools`, `AgentsMd`, `File`, `McpServer`, and `Secret`.
+- A bundled `aex` CLI with the same run, status, events, outputs, download, cancel, delete, and whoami operations.
+
+## Install
+
+```bash
+npm i @aexhq/sdk
+```
+
+This installs the TypeScript SDK exports and the bundled `aex` CLI. The CLI
+ships inside the package — invoke it with `npx aex …` after a local install, or
+`npm i -g @aexhq/sdk` to put a bare `aex` on your PATH. Set both credentials
+before running the examples: `AEX_API_KEY` authenticates to aex, and
+`ANTHROPIC_API_KEY` is your BYOK provider key for Claude.
+
+```bash
+export AEX_API_KEY="<your-aex-api-key>"
+export ANTHROPIC_API_KEY="<your-anthropic-api-key>"
+```
+
+## First Session
+
+```ts
+import { Aex, Models, Sizes } from "@aexhq/sdk";
+
+const aex = new Aex(process.env.AEX_API_KEY!);
+
+const session = await aex.openSession({
+  model: Models.CLAUDE_HAIKU_4_5,
+  system: "You are a concise engineering assistant.",
+  runtime: Sizes.SHARED_0_25X_1GB,
+  // Default is "3m"; set it explicitly when you want a different idle window.
+  overrides: { idleTtl: "3m" },
+  apiKeys: { anthropic: process.env.ANTHROPIC_API_KEY! }
+});
+
+// done() awaits settle by default, so status is the terminal outcome
+// ("succeeded"), and costUsd/usage are populated.
+const first = await session.send("Summarize this repo.").done();
+console.log(first.status, first.costUsd, first.text);
+
+const resumed = await aex.openSession(session.id);
+await resumed.send("Continue with the follow-up validation.").done();
+```
+
+Need a one-shot convenience? `run()` opens a session, sends `message` as one
+turn, and returns the collected result. The returned `runId` is the session id,
+so it can be resumed later with `openSession(runId)`.
+
+```ts
+const result = await aex.run({
+  model: Models.CLAUDE_HAIKU_4_5,
+  apiKeys: { anthropic: process.env.ANTHROPIC_API_KEY! },
+  message: "Write the report and save outputs."
+});
+
+console.log(result.runId, result.status, result.text);
+```
+
+For multiple providers, include each BYOK key in `apiKeys`:
+
+```ts
+await aex.run({
+  model: Models.CLAUDE_HAIKU_4_5,
+  apiKeys: {
+    anthropic: process.env.ANTHROPIC_API_KEY!,
+    openai: process.env.OPENAI_API_KEY!
+  },
+  message: "Delegate research to a subagent."
+});
+```
+
+The same request can run from the bundled CLI (`npx aex` on a local install):
+
+```bash
+npx aex run \
+  --api-key "$AEX_API_KEY" \
+  --anthropic-api-key "$ANTHROPIC_API_KEY" \
+  --model claude-haiku-4-5 \
+  --prompt "Write the report and save outputs." \
+  --follow
+```
+
+## CLI: login, discovery, typed errors
+
+Stop re-passing `--api-key` on every command — log in once and the token (plus
+your default `--aex-url`) is persisted to a `0600` config file
+(`$XDG_CONFIG_HOME/aex/config.json` or `~/.config/aex/config.json`; `%APPDATA%\aex\config.json`
+on Windows). An explicit `--api-key` flag always overrides the stored one.
+
+```bash
+npx aex login --api-key "$AEX_API_KEY" [--aex-url https://api.aex.dev]
+npx aex whoami            # no --api-key needed after login
+npx aex whoami --json     # machine-readable workspace + scopes + limits
+npx aex auth status       # show the resolved config (the token value is never printed)
+npx aex logout            # clear the stored token
+```
+
+Discover the closed sets the platform accepts — no token, no network (human table
+by default, machine JSON under `--json`). Per-verb `--help` is also key-free:
+
+```bash
+npx aex models list           # canonical models + their default provider
+npx aex providers list        # providers + the models each serves
+npx aex tools list            # complete builtin tool set
+npx aex runtime-sizes list    # managed runtime presets (cpus / memory / default)
+npx aex run --help            # flags for one verb (no API key required)
+```
+
+Errors are typed and actionable. Every `openSession()` / `run()` config-validation
+failure throws a `RunConfigValidationError` (`err.code === "RUN_CONFIG_INVALID"`)
+you can `catch` by code; CLI failures print a JSON envelope carrying the HTTP
+`status`, a one-line `remedy`, and the `runId` where known, and a wrong `--model`,
+`--provider`, or `--runtime-size` gets a "did you mean?" suggestion.
+
+## Continue with sessions
+
+Use sessions for conversational flows. `run()` is the one-shot convenience; a
+`SessionHandle` is the lower-level surface when you want multiple turns,
+streaming, messages, events, outputs, or downloads.
+
+```ts
+const session = await aex.openSession(result.runId);
+const next = await session.send("Turn this into a checklist.").done();
+console.log(next.text);
+
+const messages = await session.messages().list();
+const outputs = await aex.sessions.outputs(session.id).list();
+```
+
+## Feature Areas
+
+- **Agent runtime:** managed autonomous runs with filesystem read/edit, grep/glob/head/tail, open web fetch/search, background commands, code execution, git, and subagents.
+- **Durable infrastructure:** run records, status, wait/cancel/delete, idempotency, typed events, output capture, downloads, timeouts, and runtime sizes.
+- **Agent composition:** skills, files, AGENTS.md, remote MCP servers, environment variables, packages, and networking controls.
+- **Subagents:** typed parent/child lineage for async child runs, output handoff, and bounded agent delegation.
+- **Models and providers:** Anthropic, DeepSeek, OpenAI, Gemini, Mistral, OpenRouter, Doubao, and Doubao China behind one submission shape.
+- **Typed control surface:** strongly typed SDK inputs, CLI parity, BYOK provider keys, workspace secrets, redaction, and output modes.
+
+## Docs
+
+- [Quickstart](docs/quickstart.md)
+- [Run configuration](docs/run-config.md)
+- [Composition](docs/concepts/composition.md)
+- [Secrets](docs/secrets.md)
+- [Limits](docs/limits.md)
+- [Provider/runtime capabilities](docs/provider-runtime-capabilities.md)

package/dist/_contracts/api-key.js

@@ -84,4 +84,3 @@ function crc32(input) {
     }
     return (crc ^ 0xffffffff) >>> 0;
 }
-//# sourceMappingURL=api-key.js.map

package/dist/_contracts/bundle-manifest.js

@@ -154,4 +154,3 @@ function posixDirname(path) {
 function byString(a, b) {
     return a < b ? -1 : a > b ? 1 : 0;
 }
-//# sourceMappingURL=bundle-manifest.js.map

package/dist/_contracts/connection-ticket.js

@@ -52,4 +52,3 @@ function timingSafeEqual(a, b) {
         diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
     return diff === 0;
 }
-//# sourceMappingURL=connection-ticket.js.map

package/dist/_contracts/error-codes.js

@@ -76,4 +76,3 @@ const API_ERROR_CODE_SET = new Set(AEX_API_ERROR_CODES);
 export function isAexApiErrorCode(value) {
     return typeof value === "string" && API_ERROR_CODE_SET.has(value);
 }
-//# sourceMappingURL=error-codes.js.map

package/dist/_contracts/error-factory.js

@@ -139,4 +139,3 @@ function fallbackMessage(apiCode, body) {
         return error;
     return "aex API request failed";
 }
-//# sourceMappingURL=error-factory.js.map

package/dist/_contracts/event-envelope.js

@@ -395,4 +395,3 @@ function str(v) {
 function clip(s, max = 200) {
     return s.length <= max ? s : `${s.slice(0, max - 1)}…`;
 }
-//# sourceMappingURL=event-envelope.js.map

package/dist/_contracts/event-stream-client.js

@@ -262,4 +262,3 @@ function sleep(ms, signal) {
         }, { once: true });
     });
 }
-//# sourceMappingURL=event-stream-client.js.map

package/dist/_contracts/event-view.js

@@ -117,4 +117,3 @@ export function asAexEventView(event) {
 export function asAexEventViews(events) {
     return events.map(asAexEventView);
 }
-//# sourceMappingURL=event-view.js.map

package/dist/_contracts/http.js

@@ -192,4 +192,3 @@ function extractErrorMessage(body) {
     }
     return "aex API request failed";
 }
-//# sourceMappingURL=http.js.map

package/dist/_contracts/index.js

@@ -35,4 +35,3 @@ export * from "./error-codes.js";
 export * from "./error-factory.js";
 export * from "./suggest.js";
 export * from "./api-key.js";
-//# sourceMappingURL=index.js.map

package/dist/_contracts/internal.d.ts

@@ -1,3 +1,39 @@
 export * from "./models.js";
 export * from "./post-hook.js";
 export * from "./submission.js";
+/**
+ * Subset of `HttpClient` needed by the asset uploader. Defined structurally so
+ * SDK and CLI tests can supply thin stubs without dragging in the full client.
+ */
+export interface AssetsHttpClient {
+    request<T>(path: string, init?: RequestInit, query?: Record<string, string>): Promise<T>;
+}
+/** Minimal fetch shape for the direct-to-storage PUT. */
+export type AssetFetch = (input: string, init?: RequestInit) => Promise<{
+    readonly ok: boolean;
+    readonly status: number;
+    text(): Promise<string>;
+    readonly headers?: {
+        get(name: string): string | null;
+    };
+}>;
+export interface UploadAssetArgs {
+    readonly http: AssetsHttpClient;
+    readonly bytes: Uint8Array;
+    /** `sha256:<hex>` - the canonical content hash declared on the wire. */
+    readonly hash: string;
+    readonly contentType?: string;
+    readonly fetch?: AssetFetch;
+}
+export interface UploadedAsset {
+    readonly assetId: string;
+    readonly contentHash: string;
+    readonly sizeBytes: number;
+    /** true if identical bytes were already present (dedup hit). */
+    readonly exists: boolean;
+}
+/**
+ * Upload `bytes` to the hosted API's content-addressable asset store via the
+ * direct-to-storage presign flow shared by SDK and CLI callers.
+ */
+export declare function uploadAsset(args: UploadAssetArgs): Promise<UploadedAsset>;

package/dist/_contracts/internal.js

@@ -1,10 +1,159 @@
-// Workspace-internal entry point. Re-exports the submission building blocks
-// (leaf parsers, helper validators, shared constants) so the platform-only
-// `@aexhq/shared` package can reuse them instead of hand-mirroring ~1.8k lines
-// of validator code. NOT part of the public `@aexhq/contracts` surface — do
-// NOT add this to the package `index`; consumers reach it via the explicit
+import { extractErrorCode, redactUrl } from "./sdk-errors.js";
+// Workspace-internal entry point. Re-exports submission building blocks and
+// hosts small shared helpers so public packages can avoid hand-mirroring
+// behavior. NOT part of the public `@aexhq/contracts` surface; do NOT add this
+// to the package `index`. Consumers reach it via the explicit
 // `@aexhq/contracts/internal` subpath.
 export * from "./models.js";
 export * from "./post-hook.js";
 export * from "./submission.js";
-//# sourceMappingURL=internal.js.map
+const DIRECT_UPLOAD_MAX_ATTEMPTS = 3;
+/**
+ * Upload `bytes` to the hosted API's content-addressable asset store via the
+ * direct-to-storage presign flow shared by SDK and CLI callers.
+ */
+export async function uploadAsset(args) {
+    const expected = args.hash.startsWith("sha256:") ? args.hash.slice("sha256:".length) : args.hash;
+    const actual = await computeSha256Hex(args.bytes);
+    if (actual !== expected) {
+        throw new Error(`uploadAsset: client-side hash mismatch: computed sha256:${actual} ` +
+            `but caller declared ${args.hash}. Aborting to avoid uploading corrupted data.`);
+    }
+    const contentHashHeader = `sha256:${actual}`;
+    const presign = await args.http.request("/assets/presign", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ hash: contentHashHeader, sizeBytes: args.bytes.byteLength })
+    });
+    if (presign.exists) {
+        const contentHash = presign.contentHash ?? contentHashHeader;
+        return {
+            assetId: presign.assetId ?? assetIdFromContentHash(contentHash),
+            contentHash,
+            sizeBytes: presign.sizeBytes ?? args.bytes.byteLength,
+            exists: true
+        };
+    }
+    if (!presign.uploadUrl) {
+        throw new Error("uploadAsset: presign returned no uploadUrl and exists:false");
+    }
+    const doFetch = args.fetch ?? globalThis.fetch;
+    const putHeaders = {
+        "content-type": args.contentType ?? "application/zip",
+        ...(presign.requiredHeaders ?? {})
+    };
+    await putWithRetry(doFetch, presign.uploadUrl, {
+        method: "PUT",
+        headers: putHeaders,
+        body: args.bytes
+    });
+    const fin = await args.http.request("/assets/finalize", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ hash: contentHashHeader, sizeBytes: args.bytes.byteLength })
+    });
+    const contentHash = fin.contentHash ?? presign.contentHash ?? contentHashHeader;
+    return {
+        assetId: fin.assetId ?? presign.assetId ?? assetIdFromContentHash(contentHash),
+        contentHash,
+        sizeBytes: fin.sizeBytes ?? args.bytes.byteLength,
+        exists: false
+    };
+}
+async function computeSha256Hex(bytes) {
+    const subtle = globalThis.crypto?.subtle;
+    if (!subtle) {
+        throw new Error("uploadAsset: globalThis.crypto.subtle is not available; " +
+            "Bun, Node 18+, or a Web-Crypto-capable runtime is required");
+    }
+    const digest = await subtle.digest("SHA-256", bytes);
+    return bufferToHex(digest);
+}
+function assetIdFromContentHash(contentHash) {
+    const hex = contentHash.startsWith("sha256:") ? contentHash.slice("sha256:".length) : contentHash;
+    return `asset_${hex}`;
+}
+async function putWithRetry(fetchImpl, uploadUrl, init) {
+    for (let attempt = 1; attempt <= DIRECT_UPLOAD_MAX_ATTEMPTS; attempt++) {
+        let response;
+        try {
+            response = await fetchImpl(uploadUrl, init);
+        }
+        catch (err) {
+            if (attempt < DIRECT_UPLOAD_MAX_ATTEMPTS && isRetryableUploadError(err)) {
+                continue;
+            }
+            throw directUploadNetworkError(uploadUrl, err, attempt);
+        }
+        if (response.ok)
+            return;
+        if (attempt < DIRECT_UPLOAD_MAX_ATTEMPTS && isRetryableUploadStatus(response.status)) {
+            await response.text().catch(() => "");
+            continue;
+        }
+        const detail = await response.text().catch(() => "");
+        throw directUploadResponseError(uploadUrl, response.status, detail, attempt);
+    }
+}
+function isRetryableUploadStatus(status) {
+    return status === 408 || status === 425 || status === 429 || (status >= 500 && status <= 599);
+}
+function isRetryableUploadError(err) {
+    if (isNamedError(err, "AbortError"))
+        return false;
+    return true;
+}
+function directUploadNetworkError(uploadUrl, err, attempts) {
+    const safeUrl = redactUrl(uploadUrl);
+    const code = extractErrorCode(err);
+    const detail = sanitizeUploadText(errorMessage(err)).slice(0, 500);
+    return new Error(`uploadAsset: direct upload PUT failed for ${safeUrl} after ${attemptsLabel(attempts)}` +
+        (code ? ` (${code})` : "") +
+        (detail ? `: ${detail}` : ""));
+}
+function directUploadResponseError(uploadUrl, status, detail, attempts) {
+    const safeUrl = redactUrl(uploadUrl);
+    const safeDetail = sanitizeUploadText(detail).slice(0, 500);
+    return new Error(`uploadAsset: direct upload PUT failed for ${safeUrl} with status ${status}` +
+        (attempts > 1 ? ` after ${attemptsLabel(attempts)}` : "") +
+        (safeDetail ? `: ${safeDetail}` : ""));
+}
+function attemptsLabel(attempts) {
+    return attempts === 1 ? "1 attempt" : `${attempts} attempts`;
+}
+function errorMessage(err) {
+    if (err instanceof Error)
+        return err.message || err.name;
+    if (typeof err === "string")
+        return err;
+    return String(err);
+}
+function isNamedError(err, name) {
+    return stringProperty(err, "name") === name;
+}
+function stringProperty(value, key) {
+    if (!value || typeof value !== "object")
+        return undefined;
+    const prop = value[key];
+    return typeof prop === "string" && prop.length > 0 ? prop : undefined;
+}
+function sanitizeUploadText(text) {
+    return text
+        .replace(/https?:\/\/[^\s<>"'`]+/g, (raw) => redactUrlPreservingTrailingPunctuation(raw))
+        .replace(/\b(?:X-Amz-(?:Algorithm|Credential|Date|Expires|Security-Token|Signature|SignedHeaders)|AWSAccessKeyId|Signature|Credential|Security-Token|AccessKeyId|SecretAccessKey|SessionToken)=([^&\s<>"'`]+)/gi, "[redacted]")
+        .replace(/\bAKIA[0-9A-Z]{8,}\b/g, "[redacted]");
+}
+function redactUrlPreservingTrailingPunctuation(raw) {
+    const trailing = raw.match(/[),.;:!?]+$/)?.[0] ?? "";
+    const candidate = trailing ? raw.slice(0, -trailing.length) : raw;
+    return `${redactUrl(candidate)}${trailing}`;
+}
+function bufferToHex(buffer) {
+    const view = new Uint8Array(buffer);
+    let out = "";
+    for (let i = 0; i < view.length; i++) {
+        const byte = view[i];
+        out += byte.toString(16).padStart(2, "0");
+    }
+    return out;
+}

package/dist/_contracts/models.js

@@ -198,4 +198,3 @@ export function assertRunModelMatchesProvider(provider, model, field = "submissi
             `expected one of: ${providers.join(", ")}`);
     }
 }
-//# sourceMappingURL=models.js.map

package/dist/_contracts/operations.js

@@ -445,7 +445,7 @@ async function readCappedText(response, maxBytes) {
         await reader.cancel().catch(() => { });
     }
     const merged = concatBytes(chunks).subarray(0, maxBytes);
-    const truncated = declared !== undefined ? declared > maxBytes : sawMore;
+    const truncated = declared !== undefined ? declared > maxBytes : read > maxBytes || sawMore;
     const totalBytes = declared ?? read;
     return { text: decoder.decode(merged), truncated, totalBytes };
 }
@@ -1082,4 +1082,3 @@ export async function uploadWorkspaceAsset(http, input) {
         body: input.bytes
     });
 }
-//# sourceMappingURL=operations.js.map

package/dist/_contracts/post-hook.js

@@ -65,4 +65,3 @@ function requirePostHookRecord(input, path) {
     }
     return input;
 }
-//# sourceMappingURL=post-hook.js.map

package/dist/_contracts/provider-support.js

@@ -92,4 +92,3 @@ export const PROVIDER_PUBLIC_SUPPORT = {
 export function providerPublicSupport(provider) {
     return PROVIDER_PUBLIC_SUPPORT[provider];
 }
-//# sourceMappingURL=provider-support.js.map

package/dist/_contracts/run-artifacts.js

@@ -100,4 +100,3 @@ export function runAssetKey(runId, hash) {
     const hex = hash.startsWith("sha256:") ? hash.slice("sha256:".length) : hash;
     return `runs/${runId}/${RUN_ASSETS_PREFIX}/${hex}`;
 }
-//# sourceMappingURL=run-artifacts.js.map

package/dist/_contracts/run-config.js

@@ -711,4 +711,3 @@ export function normaliseRunRequestConfig(config) {
         mcpServerSecrets
     };
 }
-//# sourceMappingURL=run-config.js.map

package/dist/_contracts/run-cost.js

@@ -583,4 +583,3 @@ function nonNegativeFinite(value, field) {
 function isStringIn(value, allowed) {
     return typeof value === "string" && allowed.includes(value);
 }
-//# sourceMappingURL=run-cost.js.map

package/dist/_contracts/run-custody.js

@@ -484,4 +484,3 @@ function formatFindingPaths(findings) {
 function cloneJson(value) {
     return JSON.parse(JSON.stringify(value));
 }
-//# sourceMappingURL=run-custody.js.map

package/dist/_contracts/run-record.js

@@ -163,4 +163,3 @@ function tryParseJson(text) {
 function formatArchiveFindingPaths(findings) {
     return findings.map((finding) => `${finding.entryPath}${finding.path} (${finding.reason})`).join(", ");
 }
-//# sourceMappingURL=run-record.js.map

package/dist/_contracts/run-retention.js

@@ -469,4 +469,3 @@ function formatFindingPaths(findings) {
 function cloneJson(value) {
     return JSON.parse(JSON.stringify(value));
 }
-//# sourceMappingURL=run-retention.js.map