@aexhq/sdk 0.40.4 → 0.40.6

package/dist/cli.mjs

@@ -7,7 +7,7 @@ var __export = (target, all) => {
 
 // dist/cli.js
 import { readFile, writeFile, readdir, stat, mkdir, chmod, rm } from "node:fs/promises";
-import { resolve as resolvePath5, join, dirname as dirname2 } from "node:path";
+import { resolve as resolvePath4, join, dirname } from "node:path";
 import { homedir } from "node:os";
 
 // ../contracts/dist/provider-support.js
@@ -1489,12 +1489,12 @@ function namespace(name, description) {
     description
   });
 }
-function file(namespaceName, path, role, status2, extra) {
+function file(namespaceName, path, role, status, extra) {
   return Object.freeze({
     namespace: namespaceName,
     path,
     role,
-    status: status2,
+    status,
     ...extra?.recordCount !== void 0 ? { recordCount: extra.recordCount } : {}
   });
 }
@@ -1820,9 +1820,9 @@ var RunStateError = class extends AexError {
     const detailRecord = details && typeof details === "object" && !Array.isArray(details) ? details : void 0;
     const cause = options?.cause ?? detailRecord?.cause;
     super("RUN_STATE_ERROR", message, details, cause === void 0 ? void 0 : { cause });
-    const status2 = detailRecord?.httpStatus ?? detailRecord?.status;
+    const status = detailRecord?.httpStatus ?? detailRecord?.status;
     const apiCode = detailRecord?.apiCode;
-    this.status = typeof status2 === "number" ? status2 : void 0;
+    this.status = typeof status === "number" ? status : void 0;
     this.apiCode = isAexApiErrorCode(apiCode) ? apiCode : void 0;
     this.requestId = typeof detailRecord?.requestId === "string" ? detailRecord.requestId : void 0;
   }
@@ -1834,9 +1834,9 @@ var AexApiError = class extends AexError {
   apiCode;
   /** Request id (body `requestId` or a response header) for support correlation. */
   requestId;
-  constructor(status2, message, body, options) {
+  constructor(status, message, body, options) {
     super("API_ERROR", message, body, options?.cause === void 0 ? void 0 : { cause: options.cause });
-    this.status = status2;
+    this.status = status;
     this.body = redactSecrets(body);
     this.apiCode = options?.apiCode;
     this.requestId = options?.requestId;
@@ -2003,14 +2003,14 @@ function apiErrorKindForCode(code) {
       return "generic";
   }
 }
-function kindForStatus(status2) {
-  if (status2 === 401 || status2 === 403)
+function kindForStatus(status) {
+  if (status === 401 || status === 403)
     return "auth";
-  if (status2 === 404)
+  if (status === 404)
     return "not_found";
-  if (status2 === 409)
+  if (status === 409)
     return "idempotency";
-  if (status2 === 429)
+  if (status === 429)
     return "rate_limit";
   return "generic";
 }
@@ -2120,8 +2120,8 @@ var HttpClient = class {
     this.#debug = options.debug;
   }
   /** Emit a redacted round-trip trace (no auth header, body, or query). */
-  #trace(method, url, status2, startedMs) {
-    this.#debug?.(`[aex] ${(method ?? "GET").toUpperCase()} ${url.pathname} -> ${status2} ${Date.now() - startedMs}ms`);
+  #trace(method, url, status, startedMs) {
+    this.#debug?.(`[aex] ${(method ?? "GET").toUpperCase()} ${url.pathname} -> ${status} ${Date.now() - startedMs}ms`);
   }
   async request(path, init = {}, query = {}) {
     const url = new URL(path.replace(/^\//, ""), this.#baseUrl);
@@ -2238,9 +2238,9 @@ function extractErrorMessage(body) {
   if (body && typeof body === "object") {
     const obj = body;
     if (typeof obj.error === "string") {
-      const status2 = body.status;
-      if (obj.error === "session_busy" && typeof status2 === "string") {
-        return `session_busy (session status: ${status2})`;
+      const status = body.status;
+      if (obj.error === "session_busy" && typeof status === "string") {
+        return `session_busy (session status: ${status})`;
       }
       if (typeof obj.message === "string" && obj.message.length > 0 && obj.message !== obj.error) {
         return `${obj.error}: ${obj.message}`;
@@ -3375,7 +3375,7 @@ async function readCappedText(response, maxBytes) {
     });
   }
   const merged = concatBytes(chunks).subarray(0, maxBytes);
-  const truncated = declared !== void 0 ? declared > maxBytes : sawMore;
+  const truncated = declared !== void 0 ? declared > maxBytes : read > maxBytes || sawMore;
   const totalBytes = declared ?? read;
   return { text: decoder.decode(merged), truncated, totalBytes };
 }
@@ -3898,11 +3898,11 @@ var USAGE_ERR = { code: 2 };
 var RUNTIME_ERR = { code: 1 };
 var TIMEOUT_ERR = { code: 3 };
 var TERMINAL_STATUSES = new Set(TERMINAL_RUN_STATUSES);
-function isSessionParked2(status2) {
-  return status2 === "idle" || status2 === "suspended" || status2 === "error" || TERMINAL_STATUSES.has(status2);
+function isSessionParked2(status) {
+  return status === "idle" || status === "suspended" || status === "error" || TERMINAL_STATUSES.has(status);
 }
-function isSessionOk(status2) {
-  return status2 === "idle" || status2 === "suspended" || status2 === "succeeded";
+function isSessionOk(status) {
+  return status === "idle" || status === "suspended" || status === "succeeded";
 }
 function extractCommonHostFlags(argv) {
   let apiKey = null;
@@ -3944,6 +3944,16 @@ function extractCommonHostFlags(argv) {
   }
   return { ok: true, flags: { apiKey, aexUrl, debug: debug2, json, rest } };
 }
+function rejectUnknownFlags(io2, rest, usage) {
+  const unknown = rest.find((arg) => arg.startsWith("--"));
+  if (unknown === void 0)
+    return null;
+  io2.stderr(`unknown flag: ${unknown}
+`);
+  io2.stderr(`${usage}
+`);
+  return USAGE_ERR;
+}
 async function resolveCommonHostFlags(io2, argv) {
   const extracted = extractCommonHostFlags(argv);
   if (!extracted.ok)
@@ -4010,18 +4020,18 @@ function describeErrorBody(body) {
   const redacted = redactSecrets(text);
   return redacted.length > 400 ? `${redacted.slice(0, 400)}\u2026 (truncated)` : redacted;
 }
-function remedyForStatus(status2) {
-  if (status2 === 400)
+function remedyForStatus(status) {
+  if (status === 400)
     return "malformed request \u2014 if this is an auth failure, check --api-key or run `aex login`";
-  if (status2 === 401)
+  if (status === 401)
     return "check --api-key, or run `aex login`";
-  if (status2 === 403)
+  if (status === 403)
     return "token lacks permission for this workspace/action";
-  if (status2 === 404)
+  if (status === 404)
     return "no such run/resource \u2014 verify the id";
-  if (status2 === 429)
+  if (status === 429)
     return "rate limited \u2014 retry with backoff";
-  if (status2 >= 500)
+  if (status >= 500)
     return "server error \u2014 retry; re-run with --debug to capture the request trace";
   return void 0;
 }
@@ -4425,11 +4435,6 @@ var CLI_VERBS = [
     name: "runtime-sizes",
     summary: "List managed runtime presets (no token needed).",
     usage: ["aex runtime-sizes list [--json]"]
-  },
-  {
-    name: "debug",
-    summary: "Operator: read the AWS plane directly (AWS creds, not --api-key).",
-    usage: ["aex debug <run-id> [--plane dev|prd] [--region eu-west-2] [--cloudwatch] [--with-outputs]"]
   }
 ];
 var VERB_BY_NAME = new Map(CLI_VERBS.map((v) => [v.name, v]));
@@ -4451,6 +4456,147 @@ function renderVerbHelp(spec) {
 // dist/host/run-cmd.js
 import { resolve as resolvePath } from "node:path";
 
+// ../contracts/dist/post-hook.js
+var DEFAULT_POST_HOOK_TIMEOUT_MS = 5 * 60 * 1e3;
+
+// ../contracts/dist/internal.js
+var DIRECT_UPLOAD_MAX_ATTEMPTS = 3;
+async function uploadAsset(args) {
+  const expected = args.hash.startsWith("sha256:") ? args.hash.slice("sha256:".length) : args.hash;
+  const actual = await computeSha256Hex(args.bytes);
+  if (actual !== expected) {
+    throw new Error(`uploadAsset: client-side hash mismatch: computed sha256:${actual} but caller declared ${args.hash}. Aborting to avoid uploading corrupted data.`);
+  }
+  const contentHashHeader = `sha256:${actual}`;
+  const presign = await args.http.request("/assets/presign", {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ hash: contentHashHeader, sizeBytes: args.bytes.byteLength })
+  });
+  if (presign.exists) {
+    const contentHash2 = presign.contentHash ?? contentHashHeader;
+    return {
+      assetId: presign.assetId ?? assetIdFromContentHash(contentHash2),
+      contentHash: contentHash2,
+      sizeBytes: presign.sizeBytes ?? args.bytes.byteLength,
+      exists: true
+    };
+  }
+  if (!presign.uploadUrl) {
+    throw new Error("uploadAsset: presign returned no uploadUrl and exists:false");
+  }
+  const doFetch = args.fetch ?? globalThis.fetch;
+  const putHeaders = {
+    "content-type": args.contentType ?? "application/zip",
+    ...presign.requiredHeaders ?? {}
+  };
+  await putWithRetry(doFetch, presign.uploadUrl, {
+    method: "PUT",
+    headers: putHeaders,
+    body: args.bytes
+  });
+  const fin = await args.http.request("/assets/finalize", {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ hash: contentHashHeader, sizeBytes: args.bytes.byteLength })
+  });
+  const contentHash = fin.contentHash ?? presign.contentHash ?? contentHashHeader;
+  return {
+    assetId: fin.assetId ?? presign.assetId ?? assetIdFromContentHash(contentHash),
+    contentHash,
+    sizeBytes: fin.sizeBytes ?? args.bytes.byteLength,
+    exists: false
+  };
+}
+async function computeSha256Hex(bytes) {
+  const subtle = globalThis.crypto?.subtle;
+  if (!subtle) {
+    throw new Error("uploadAsset: globalThis.crypto.subtle is not available; Bun, Node 18+, or a Web-Crypto-capable runtime is required");
+  }
+  const digest = await subtle.digest("SHA-256", bytes);
+  return bufferToHex(digest);
+}
+function assetIdFromContentHash(contentHash) {
+  const hex = contentHash.startsWith("sha256:") ? contentHash.slice("sha256:".length) : contentHash;
+  return `asset_${hex}`;
+}
+async function putWithRetry(fetchImpl, uploadUrl, init) {
+  for (let attempt = 1; attempt <= DIRECT_UPLOAD_MAX_ATTEMPTS; attempt++) {
+    let response;
+    try {
+      response = await fetchImpl(uploadUrl, init);
+    } catch (err2) {
+      if (attempt < DIRECT_UPLOAD_MAX_ATTEMPTS && isRetryableUploadError(err2)) {
+        continue;
+      }
+      throw directUploadNetworkError(uploadUrl, err2, attempt);
+    }
+    if (response.ok)
+      return;
+    if (attempt < DIRECT_UPLOAD_MAX_ATTEMPTS && isRetryableUploadStatus(response.status)) {
+      await response.text().catch(() => "");
+      continue;
+    }
+    const detail = await response.text().catch(() => "");
+    throw directUploadResponseError(uploadUrl, response.status, detail, attempt);
+  }
+}
+function isRetryableUploadStatus(status) {
+  return status === 408 || status === 425 || status === 429 || status >= 500 && status <= 599;
+}
+function isRetryableUploadError(err2) {
+  if (isNamedError(err2, "AbortError"))
+    return false;
+  return true;
+}
+function directUploadNetworkError(uploadUrl, err2, attempts) {
+  const safeUrl = redactUrl(uploadUrl);
+  const code = extractErrorCode(err2);
+  const detail = sanitizeUploadText(errorMessage(err2)).slice(0, 500);
+  return new Error(`uploadAsset: direct upload PUT failed for ${safeUrl} after ${attemptsLabel(attempts)}` + (code ? ` (${code})` : "") + (detail ? `: ${detail}` : ""));
+}
+function directUploadResponseError(uploadUrl, status, detail, attempts) {
+  const safeUrl = redactUrl(uploadUrl);
+  const safeDetail = sanitizeUploadText(detail).slice(0, 500);
+  return new Error(`uploadAsset: direct upload PUT failed for ${safeUrl} with status ${status}` + (attempts > 1 ? ` after ${attemptsLabel(attempts)}` : "") + (safeDetail ? `: ${safeDetail}` : ""));
+}
+function attemptsLabel(attempts) {
+  return attempts === 1 ? "1 attempt" : `${attempts} attempts`;
+}
+function errorMessage(err2) {
+  if (err2 instanceof Error)
+    return err2.message || err2.name;
+  if (typeof err2 === "string")
+    return err2;
+  return String(err2);
+}
+function isNamedError(err2, name) {
+  return stringProperty2(err2, "name") === name;
+}
+function stringProperty2(value, key) {
+  if (!value || typeof value !== "object")
+    return void 0;
+  const prop = value[key];
+  return typeof prop === "string" && prop.length > 0 ? prop : void 0;
+}
+function sanitizeUploadText(text) {
+  return text.replace(/https?:\/\/[^\s<>"'`]+/g, (raw) => redactUrlPreservingTrailingPunctuation(raw)).replace(/\b(?:X-Amz-(?:Algorithm|Credential|Date|Expires|Security-Token|Signature|SignedHeaders)|AWSAccessKeyId|Signature|Credential|Security-Token|AccessKeyId|SecretAccessKey|SessionToken)=([^&\s<>"'`]+)/gi, "[redacted]").replace(/\bAKIA[0-9A-Z]{8,}\b/g, "[redacted]");
+}
+function redactUrlPreservingTrailingPunctuation(raw) {
+  const trailing = raw.match(/[),.;:!?]+$/)?.[0] ?? "";
+  const candidate = trailing ? raw.slice(0, -trailing.length) : raw;
+  return `${redactUrl(candidate)}${trailing}`;
+}
+function bufferToHex(buffer) {
+  const view = new Uint8Array(buffer);
+  let out = "";
+  for (let i2 = 0; i2 < view.length; i2++) {
+    const byte = view[i2];
+    out += byte.toString(16).padStart(2, "0");
+  }
+  return out;
+}
+
 // dist/host/run-submit.js
 var TEXT = new TextEncoder();
 var ZIP_EPOCH = new Date(Date.UTC(1980, 0, 1));
@@ -4615,7 +4761,7 @@ async function prepareTools(http, fetchImpl, tools) {
       }
       return { kind: "builtin", name: entry };
     }
-    const uploaded = await uploadAsset(http, fetchImpl, {
+    const uploaded = await stageAsset(http, fetchImpl, {
       bytes: entry.bytes,
       hash: entry.ref.contentHash,
       contentType: "application/zip"
@@ -4650,7 +4796,7 @@ async function prepareSkills(http, fetchImpl, skills) {
     seen.add(skill.name);
   }
   return mapWithConcurrency(skills, UPLOAD_CONCURRENCY, async (skill) => {
-    await uploadAsset(http, fetchImpl, { bytes: skill.bytes, hash: skill.contentHash, contentType: "application/zip" });
+    await stageAsset(http, fetchImpl, { bytes: skill.bytes, hash: skill.contentHash, contentType: "application/zip" });
     await operations_exports.upsertSkill(http, {
       name: skill.name,
       contentHash: skill.contentHash,
@@ -4662,7 +4808,7 @@ async function prepareSkills(http, fetchImpl, skills) {
 }
 async function prepareAgentsMd(http, fetchImpl, agentsMds) {
   return mapWithConcurrency(agentsMds, UPLOAD_CONCURRENCY, async (entry) => {
-    const uploaded = await uploadAsset(http, fetchImpl, {
+    const uploaded = await stageAsset(http, fetchImpl, {
       bytes: entry.bytes,
       hash: entry.contentHash,
       contentType: "application/zip"
@@ -4672,7 +4818,7 @@ async function prepareAgentsMd(http, fetchImpl, agentsMds) {
 }
 async function prepareFiles(http, fetchImpl, files) {
   return mapWithConcurrency(files, UPLOAD_CONCURRENCY, async (entry) => {
-    const uploaded = await uploadAsset(http, fetchImpl, {
+    const uploaded = await stageAsset(http, fetchImpl, {
       bytes: entry.bytes,
       hash: entry.contentHash,
       contentType: "application/zip"
@@ -4701,54 +4847,14 @@ function sessionEnvironmentForWire(environment) {
   };
   return Object.keys(out).length === 0 ? void 0 : out;
 }
-async function uploadAsset(http, fetchImpl, args) {
-  const expected = args.hash.startsWith("sha256:") ? args.hash.slice("sha256:".length) : args.hash;
-  const actual = await sha256Hex(args.bytes);
-  if (actual !== expected) {
-    throw new Error(`uploadAsset: client-side hash mismatch: computed sha256:${actual} but caller declared ${args.hash}`);
-  }
-  const contentHash = `sha256:${actual}`;
-  const presign = await http.request("/assets/presign", {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify({ hash: contentHash, sizeBytes: args.bytes.byteLength })
-  });
-  if (presign.exists) {
-    const storedHash2 = presign.contentHash ?? contentHash;
-    return {
-      assetId: presign.assetId ?? assetIdFromContentHash(storedHash2),
-      contentHash: storedHash2,
-      sizeBytes: presign.sizeBytes ?? args.bytes.byteLength,
-      exists: true
-    };
-  }
-  if (!presign.uploadUrl) {
-    throw new Error("uploadAsset: presign returned no uploadUrl and exists:false");
-  }
-  const doFetch = fetchImpl ?? globalThis.fetch;
-  const put = await doFetch(presign.uploadUrl, {
-    method: "PUT",
-    headers: {
-      "content-type": args.contentType ?? "application/zip",
-      ...presign.requiredHeaders ?? {}
-    },
-    body: args.bytes
-  });
-  if (!put.ok) {
-    throw new Error(`uploadAsset: direct upload PUT failed with status ${put.status}`);
-  }
-  const fin = await http.request("/assets/finalize", {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify({ hash: contentHash, sizeBytes: args.bytes.byteLength })
+async function stageAsset(http, fetchImpl, args) {
+  return uploadAsset({
+    http,
+    bytes: args.bytes,
+    hash: args.hash,
+    ...args.contentType !== void 0 ? { contentType: args.contentType } : {},
+    ...fetchImpl !== void 0 ? { fetch: fetchImpl } : {}
   });
-  const storedHash = fin.contentHash ?? presign.contentHash ?? contentHash;
-  return {
-    assetId: fin.assetId ?? presign.assetId ?? assetIdFromContentHash(storedHash),
-    contentHash: storedHash,
-    sizeBytes: fin.sizeBytes ?? args.bytes.byteLength,
-    exists: false
-  };
 }
 function bundleSkillFiles(files) {
   const collected = collectBundleFiles("Skill bundle", files, true);
@@ -4913,9 +5019,9 @@ async function sha256Hex(bytes) {
   const view = new Uint8Array(bytes.byteLength);
   view.set(bytes);
   const digest = await subtle.digest("SHA-256", view.buffer);
-  return bufferToHex(digest);
+  return bufferToHex2(digest);
 }
-function bufferToHex(buffer) {
+function bufferToHex2(buffer) {
   const view = new Uint8Array(buffer);
   let out = "";
   for (const byte of view) {
@@ -4923,10 +5029,6 @@ function bufferToHex(buffer) {
   }
   return out;
 }
-function assetIdFromContentHash(contentHash) {
-  const hex = contentHash.startsWith("sha256:") ? contentHash.slice("sha256:".length) : contentHash;
-  return `asset_${hex}`;
-}
 async function mapWithConcurrency(items, limit, fn) {
   const out = new Array(items.length);
   let next = 0;
@@ -5642,9 +5744,14 @@ async function runStatusCmd(io2, argv) {
 `);
     return USAGE_ERR;
   }
-  const positional = common.rest.filter((arg) => !arg.startsWith("--"));
+  const usage = "usage: aex status <session-id> [common flags]";
+  const unknown = rejectUnknownFlags(io2, common.rest, usage);
+  if (unknown)
+    return unknown;
+  const positional = common.rest;
   if (positional.length !== 1) {
-    io2.stderr("usage: aex status <session-id> [common flags]\n");
+    io2.stderr(`${usage}
+`);
     return USAGE_ERR;
   }
   const sessionId = positional[0];
@@ -5673,9 +5780,14 @@ async function runDeliveriesCmd(io2, argv) {
 `);
     return USAGE_ERR;
   }
-  const positional = common.rest.filter((arg) => !arg.startsWith("--"));
+  const usage = "usage: aex deliveries <session-id> [common flags]";
+  const unknown = rejectUnknownFlags(io2, common.rest, usage);
+  if (unknown)
+    return unknown;
+  const positional = common.rest;
   if (positional.length !== 1) {
-    io2.stderr("usage: aex deliveries <session-id> [common flags]\n");
+    io2.stderr(`${usage}
+`);
     return USAGE_ERR;
   }
   const sessionId = positional[0];
@@ -5727,9 +5839,14 @@ async function runWaitCmd(io2, argv) {
     }
     intervalMs = parsed.ms;
   }
-  const positional = intervalFlag.remaining.filter((arg) => !arg.startsWith("--"));
+  const usage = "usage: aex wait <session-id> [--timeout <dur>] [--interval <dur>] [common flags]";
+  const unknown = rejectUnknownFlags(io2, intervalFlag.remaining, usage);
+  if (unknown)
+    return unknown;
+  const positional = intervalFlag.remaining;
   if (positional.length !== 1) {
-    io2.stderr("usage: aex wait <session-id> [--timeout <dur>] [--interval <dur>] [common flags]\n");
+    io2.stderr(`${usage}
+`);
     return USAGE_ERR;
   }
   const sessionId = positional[0];
@@ -5786,9 +5903,14 @@ async function runEventsCmd(io2, argv) {
     }
     timeoutMs = parsed.ms;
   }
-  const positional = timeoutFlag.remaining.filter((arg) => !arg.startsWith("--"));
+  const usage = "usage: aex events <session-id> [--follow] [--timeout <dur>] [common flags]";
+  const unknown = rejectUnknownFlags(io2, timeoutFlag.remaining, usage);
+  if (unknown)
+    return unknown;
+  const positional = timeoutFlag.remaining;
   if (positional.length !== 1) {
-    io2.stderr("usage: aex events <session-id> [--follow] [--timeout <dur>] [common flags]\n");
+    io2.stderr(`${usage}
+`);
     return USAGE_ERR;
   }
   const sessionId = positional[0];
@@ -5881,9 +6003,14 @@ async function runOutputsCmd(io2, argv) {
   }
 }
 async function outputsList(io2, http, args) {
-  const positional = args.filter((a) => !a.startsWith("--"));
+  const usage = "usage: aex outputs <session-id> [common flags]";
+  const unknown = rejectUnknownFlags(io2, args, usage);
+  if (unknown)
+    return unknown;
+  const positional = args;
   if (positional.length !== 1) {
-    io2.stderr("usage: aex outputs <session-id> [common flags]\n");
+    io2.stderr(`${usage}
+`);
     return USAGE_ERR;
   }
   const sessionId = positional[0];
@@ -5897,9 +6024,14 @@ async function outputsList(io2, http, args) {
   }
 }
 async function outputsRead(io2, http, args) {
-  const positional = args.filter((a) => !a.startsWith("--"));
+  const usage = "usage: aex outputs read <session-id> <path> [common flags]";
+  const unknown = rejectUnknownFlags(io2, args, usage);
+  if (unknown)
+    return unknown;
+  const positional = args;
   if (positional.length !== 2) {
-    io2.stderr("usage: aex outputs read <session-id> <path> [common flags]\n");
+    io2.stderr(`${usage}
+`);
     return USAGE_ERR;
   }
   const [sessionId, selector] = positional;
@@ -5919,9 +6051,14 @@ async function outputsDownload(io2, http, args, flags) {
     return USAGE_ERR;
   }
   void flags;
-  const positional = outFlag.remaining.filter((a) => !a.startsWith("--"));
+  const usage = "usage: aex outputs download <session-id> <path> [--out file] [common flags]";
+  const unknown = rejectUnknownFlags(io2, outFlag.remaining, usage);
+  if (unknown)
+    return unknown;
+  const positional = outFlag.remaining;
   if (positional.length !== 2) {
-    io2.stderr("usage: aex outputs download <session-id> <path> [--out file] [common flags]\n");
+    io2.stderr(`${usage}
+`);
     return USAGE_ERR;
   }
   const [sessionId, selector] = positional;
@@ -5941,9 +6078,14 @@ async function outputsDownload(io2, http, args, flags) {
   return SUCCESS;
 }
 async function outputsLink(io2, http, args) {
-  const positional = args.filter((a) => !a.startsWith("--"));
+  const usage = "usage: aex outputs link <session-id> <path> [common flags]";
+  const unknown = rejectUnknownFlags(io2, args, usage);
+  if (unknown)
+    return unknown;
+  const positional = args;
   if (positional.length !== 2) {
-    io2.stderr("usage: aex outputs link <session-id> <path> [common flags]\n");
+    io2.stderr(`${usage}
+`);
     return USAGE_ERR;
   }
   const [sessionId, selector] = positional;
@@ -5966,9 +6108,14 @@ async function outputsFind(io2, http, args) {
 `);
     return USAGE_ERR;
   }
-  const positional = contentType.remaining.filter((a) => !a.startsWith("--"));
+  const usage = "usage: aex outputs find <session-id> [--name S] [--ext E] [--type T] [--content-type CT] [common flags]";
+  const unknown = rejectUnknownFlags(io2, contentType.remaining, usage);
+  if (unknown)
+    return unknown;
+  const positional = contentType.remaining;
   if (positional.length !== 1) {
-    io2.stderr("usage: aex outputs find <session-id> [--name S] [--ext E] [--type T] [--content-type CT] [common flags]\n");
+    io2.stderr(`${usage}
+`);
     return USAGE_ERR;
   }
   const sessionId = positional[0];
@@ -5997,6 +6144,17 @@ async function outputsSearch(io2, http, args) {
   const err2 = query.error ?? name.error ?? ext.error ?? contentType.error ?? limit.error ?? runIds.error;
   if (err2) {
     io2.stderr(`${err2}
+`);
+    return USAGE_ERR;
+  }
+  const usage = "usage: aex outputs search [--query S] [--name S] [--ext E] [--content-type CT] [--run-id ID] [--limit N] [common flags]";
+  const unknown = rejectUnknownFlags(io2, runIds.remaining, usage);
+  if (unknown)
+    return unknown;
+  if (runIds.remaining.length > 0) {
+    io2.stderr(`unexpected arguments: ${runIds.remaining.join(" ")}
+`);
+    io2.stderr(`${usage}
 `);
     return USAGE_ERR;
   }
@@ -6129,9 +6287,14 @@ async function runDownloadCmd(io2, argv) {
     return USAGE_ERR;
   }
   const namespace2 = onlyFlag.value;
-  const positional = onlyFlag.remaining.filter((arg) => !arg.startsWith("--"));
+  const usage = "usage: aex download <session-id> [--only outputs|events|metadata] [--out path] [common flags]";
+  const unknown = rejectUnknownFlags(io2, onlyFlag.remaining, usage);
+  if (unknown)
+    return unknown;
+  const positional = onlyFlag.remaining;
   if (positional.length !== 1) {
-    io2.stderr("usage: aex download <session-id> [--only outputs|events|metadata] [--out path] [common flags]\n");
+    io2.stderr(`${usage}
+`);
     return USAGE_ERR;
   }
   const sessionId = positional[0];
@@ -6175,9 +6338,14 @@ async function runCancelCmd(io2, argv) {
 `);
     return USAGE_ERR;
   }
-  const positional = common.rest.filter((arg) => !arg.startsWith("--"));
+  const usage = "usage: aex cancel <session-id> [common flags]";
+  const unknown = rejectUnknownFlags(io2, common.rest, usage);
+  if (unknown)
+    return unknown;
+  const positional = common.rest;
   if (positional.length !== 1) {
-    io2.stderr("usage: aex cancel <session-id> [common flags]\n");
+    io2.stderr(`${usage}
+`);
     return USAGE_ERR;
   }
   const sessionId = positional[0];
@@ -6206,9 +6374,14 @@ async function runDeleteCmd(io2, argv) {
 `);
     return USAGE_ERR;
   }
-  const positional = common.rest.filter((arg) => !arg.startsWith("--"));
+  const usage = "usage: aex delete <session-id> [common flags]";
+  const unknown = rejectUnknownFlags(io2, common.rest, usage);
+  if (unknown)
+    return unknown;
+  const positional = common.rest;
   if (positional.length !== 1) {
-    io2.stderr("usage: aex delete <session-id> [common flags]\n");
+    io2.stderr(`${usage}
+`);
     return USAGE_ERR;
   }
   const sessionId = positional[0];
@@ -6237,9 +6410,14 @@ async function runDeleteAssetCmd(io2, argv) {
 `);
     return USAGE_ERR;
   }
-  const positional = common.rest.filter((arg) => !arg.startsWith("--"));
+  const usage = "usage: aex delete-asset <hash> [common flags]";
+  const unknown = rejectUnknownFlags(io2, common.rest, usage);
+  if (unknown)
+    return unknown;
+  const positional = common.rest;
   if (positional.length !== 1) {
-    io2.stderr("usage: aex delete-asset <hash> [common flags]\n");
+    io2.stderr(`${usage}
+`);
     return USAGE_ERR;
   }
   const hash = positional[0];
@@ -6565,645 +6743,6 @@ async function runSessionsCmd(io2, argv) {
   }
 }
 
-// dist/host/debug.js
-import { dirname, resolve as resolvePath4 } from "node:path";
-function status(source, state, opts = {}) {
-  return {
-    source,
-    state,
-    ...opts.detail !== void 0 ? { detail: opts.detail } : {},
-    ...opts.count !== void 0 ? { count: opts.count } : {}
-  };
-}
-function seqOf(v) {
-  if (typeof v === "number" && Number.isFinite(v))
-    return v;
-  if (typeof v === "string" && /^\d+$/.test(v))
-    return Number(v);
-  return Number.POSITIVE_INFINITY;
-}
-function sortJournal(events) {
-  return events.map((e, i2) => ({ e, i: i2 })).sort((a, b) => {
-    const d = seqOf(a.e.seq) - seqOf(b.e.seq);
-    return d !== 0 ? d : a.i - b.i;
-  }).map((x2) => x2.e);
-}
-function parseNdjson(text) {
-  const out = [];
-  for (const line of text.split("\n")) {
-    const trimmed = line.trim();
-    if (!trimmed)
-      continue;
-    try {
-      const parsed = JSON.parse(trimmed);
-      if (parsed && typeof parsed === "object")
-        out.push(parsed);
-    } catch {
-    }
-  }
-  return out;
-}
-var CHILD_ID_KEYS = ["childRunId", "subagentRunId", "spawnedRunId", "child_run_id", "subagent_run_id"];
-function extractChildRunIds(events, selfRunId) {
-  const ids = /* @__PURE__ */ new Set();
-  const scan = (node) => {
-    if (!node || typeof node !== "object")
-      return;
-    if (Array.isArray(node)) {
-      for (const v of node)
-        scan(v);
-      return;
-    }
-    const rec = node;
-    for (const k of CHILD_ID_KEYS) {
-      const v = rec[k];
-      if (typeof v === "string" && v && v !== selfRunId)
-        ids.add(v);
-    }
-    for (const v of Object.values(rec))
-      scan(v);
-  };
-  for (const e of events)
-    scan(e);
-  return [...ids];
-}
-function parseJsonObj(text) {
-  if (!text)
-    return {};
-  try {
-    const parsed = JSON.parse(text);
-    return parsed && typeof parsed === "object" && !Array.isArray(parsed) ? parsed : {};
-  } catch {
-    return {};
-  }
-}
-function pickStr(obj, keys) {
-  for (const k of keys) {
-    const v = obj[k];
-    if (typeof v === "string" && v)
-      return v;
-  }
-  return null;
-}
-function pickTime(obj, keys) {
-  for (const k of keys) {
-    const v = obj[k];
-    if (typeof v === "string" && v)
-      return v;
-    if (typeof v === "number" && Number.isFinite(v))
-      return new Date(v).toISOString();
-  }
-  return null;
-}
-function extractRunMeta(settleText, bootText) {
-  const settle = parseJsonObj(settleText);
-  const boot = parseJsonObj(bootText);
-  return {
-    status: pickStr(settle, ["status", "runStatus", "outcome", "state", "terminalStatus"]) ?? pickStr(boot, ["status"]),
-    startedAt: pickTime(boot, ["startedAt", "createdAt", "bootAt", "queuedAt"]) ?? pickTime(settle, ["startedAt", "createdAt"]),
-    endedAt: pickTime(settle, ["endedAt", "finishedAt", "terminalAt", "settledAt", "completedAt", "ts"])
-  };
-}
-function renderIndexMd(m, depth = 0) {
-  const lines = [];
-  const h = "#".repeat(Math.min(depth + 1, 6));
-  const sub = "#".repeat(Math.min(depth + 2, 6));
-  lines.push(`${h} aex debug bundle \u2014 ${m.runId}`, "");
-  lines.push(`- generated: ${m.generatedAt}`);
-  lines.push(`- plane / region: ${m.plane} / ${m.region}`);
-  lines.push(`- run status: ${m.runStatus ?? "unknown"}`);
-  lines.push(`- started: ${m.startedAt ?? "?"}   ended: ${m.endedAt ?? "?"}`);
-  lines.push(`- journal: ${m.journalSource} (${m.journalEventCount} events)`);
-  lines.push(`- outputs bucket: ${m.outputsBucket}`, "");
-  lines.push(`${sub} sources`, "");
-  lines.push("| source | state | detail | count |");
-  lines.push("|---|---|---|---|");
-  for (const s of m.sources) {
-    lines.push(`| ${s.source} | ${s.state} | ${(s.detail ?? "").replace(/\|/g, "\\|")} | ${s.count ?? ""} |`);
-  }
-  lines.push("");
-  if (m.childRunIds.length > 0) {
-    lines.push(`${sub} child runs (${m.childRunIds.length})`, "");
-    for (const c of m.childRunIds)
-      lines.push(`- ${c} \u2192 children/${c}/`);
-    lines.push("");
-    for (const cm of m.children)
-      lines.push(renderIndexMd(cm, depth + 1), "");
-  }
-  return lines.join("\n");
-}
-async function assembleBundle(opts) {
-  const flags = { cloudwatch: opts.cloudwatch, withOutputs: opts.withOutputs, sinceMs: opts.sinceMs };
-  return assembleOne(opts.runId, opts.targets, opts.sources, flags, opts.visited ?? /* @__PURE__ */ new Set());
-}
-async function safeGetText(sources, bucket, key) {
-  try {
-    return await sources.getObjectText(bucket, key);
-  } catch {
-    return null;
-  }
-}
-async function assembleOne(runId, targets, sources, flags, visited) {
-  visited.add(runId);
-  const files = [];
-  const statuses = [];
-  const prefix = `runs/${runId}/`;
-  let listing = [];
-  let s3Error = null;
-  try {
-    listing = await sources.listObjects(targets.outputsBucket, prefix);
-  } catch (err2) {
-    s3Error = err2.message ?? "list failed";
-  }
-  files.push({
-    path: "s3-listing.ndjson",
-    content: ndjsonOf(listing.map((i2) => ({ key: i2.key, sizeBytes: i2.sizeBytes })))
-  });
-  const outputsListing = [];
-  let sealedPresent = false;
-  let sealedSize = 0;
-  let settleText = null;
-  let bootText = null;
-  for (const item of listing) {
-    if (!item.key.startsWith(prefix))
-      continue;
-    const rel = item.key.slice(prefix.length);
-    if (rel === "")
-      continue;
-    if (rel === "secrets.sealed") {
-      sealedPresent = true;
-      sealedSize = item.sizeBytes;
-      continue;
-    }
-    if (rel.startsWith("outputs/")) {
-      outputsListing.push(item);
-      if (flags.withOutputs) {
-        const body = await safeGetText(sources, targets.outputsBucket, item.key);
-        if (body !== null)
-          files.push({ path: rel, content: body });
-      }
-      continue;
-    }
-    if (rel.startsWith("assets/") || rel.startsWith("session/backup/"))
-      continue;
-    if (/\.(json|ndjson|txt|log)$/.test(rel)) {
-      const body = await safeGetText(sources, targets.outputsBucket, item.key);
-      if (body !== null) {
-        files.push({ path: rel, content: body });
-        if (rel === "settle.json")
-          settleText = body;
-        if (rel === "boot.json" || rel === "session/boot.json")
-          bootText = body;
-      }
-    }
-  }
-  files.push({
-    path: "outputs/_listing.ndjson",
-    content: ndjsonOf(outputsListing.map((i2) => ({ key: i2.key, sizeBytes: i2.sizeBytes })))
-  });
-  if (s3Error)
-    statuses.push(status("s3", "error", { detail: s3Error }));
-  else if (listing.length === 0) {
-    statuses.push(status("s3", "missing", { detail: `no objects under s3://${targets.outputsBucket}/${prefix}` }));
-  } else
-    statuses.push(status("s3", "present", { count: listing.length }));
-  statuses.push(sealedPresent ? status("secrets.sealed", "present", { detail: `${sealedSize} bytes (not downloaded)` }) : status("secrets.sealed", "missing", { detail: "absent" }));
-  const meta = extractRunMeta(settleText, bootText);
-  let journalSource = "none";
-  let events = [];
-  let ddbRows = null;
-  let ddbError = null;
-  try {
-    ddbRows = await sources.queryEvents(targets.eventsTable, runId);
-  } catch (err2) {
-    ddbError = err2.message ?? "query failed";
-  }
-  if (ddbRows && ddbRows.length > 0) {
-    events = sortJournal(ddbRows);
-    journalSource = "ddb";
-  } else {
-    const archiveText = await safeGetText(sources, targets.eventsArchiveBucket, `${runId}/log.ndjson`);
-    if (archiveText) {
-      events = sortJournal(parseNdjson(archiveText));
-      if (events.length > 0)
-        journalSource = "events-archive";
-    }
-  }
-  files.push({ path: "journal.ndjson", content: ndjsonOf(events) });
-  if (journalSource === "none") {
-    statuses.push(status("journal", "missing", {
-      detail: ddbError ? `ddb error: ${ddbError}; no events-archive fallback` : "empty in DDB and no events-archive/<runId>/log.ndjson (TTL-expired?)"
-    }));
-  } else {
-    statuses.push(status("journal", "present", { detail: `source=${journalSource}`, count: events.length }));
-  }
-  if (!targets.account) {
-    statuses.push(status("sfn", "skipped", { detail: "no account id (pass --account or grant s3:ListBuckets) \u2014 cannot build execution ARN" }));
-  } else {
-    const arn = `arn:${targets.partition}:states:${targets.region}:${targets.account}:execution:${targets.stateMachineName}:${runId}`;
-    let history = null;
-    let sfnError = null;
-    try {
-      history = await sources.getExecutionHistory(arn);
-    } catch (err2) {
-      sfnError = err2.message ?? "GetExecutionHistory failed";
-    }
-    if (history) {
-      files.push({ path: "sfn-history.json", content: JSON.stringify({ executionArn: arn, events: history }, null, 2) });
-      statuses.push(status("sfn", history.length > 0 ? "present" : "empty", { count: history.length }));
-    } else {
-      statuses.push(status("sfn", sfnError ? "error" : "missing", {
-        detail: sfnError ?? "execution not found (expired or never ran)"
-      }));
-    }
-  }
-  if (flags.cloudwatch) {
-    const endMs = toMs(meta.endedAt) ?? Date.now();
-    const startMs = toMs(meta.startedAt) ?? endMs - flags.sinceMs;
-    for (const [label, group] of Object.entries(targets.logGroups)) {
-      let res;
-      try {
-        res = await sources.filterLogs(group, runId, startMs, endMs);
-      } catch (err2) {
-        res = { kind: "error", message: err2.message ?? "FilterLogEvents failed" };
-      }
-      const src = `cloudwatch:${label}`;
-      if (res.kind === "events") {
-        files.push({ path: `cloudwatch/${label}.ndjson`, content: ndjsonOf(res.events) });
-        statuses.push(status(src, res.events.length > 0 ? "present" : "empty", { count: res.events.length }));
-      } else if (res.kind === "empty") {
-        statuses.push(status(src, "empty", { detail: `no events in window for ${group}` }));
-      } else if (res.kind === "expired") {
-        statuses.push(status(src, "expired", { detail: `log group ${group} not found / retention expired` }));
-      } else {
-        statuses.push(status(src, "error", { detail: res.message }));
-      }
-    }
-  } else {
-    statuses.push(status("cloudwatch", "skipped", { detail: "pass --cloudwatch to fetch (fresh runs only)" }));
-  }
-  const childRunIds = extractChildRunIds(events, runId).filter((id) => !visited.has(id));
-  const children = [];
-  for (const childId of childRunIds) {
-    if (visited.has(childId))
-      continue;
-    const childBundle = await assembleOne(childId, targets, sources, flags, visited);
-    for (const f of childBundle.files)
-      files.push({ path: `children/${childId}/${f.path}`, content: f.content });
-    children.push(childBundle.manifest);
-  }
-  const manifest = {
-    runId,
-    generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
-    plane: targets.plane,
-    region: targets.region,
-    outputsBucket: targets.outputsBucket,
-    eventsArchiveBucket: targets.eventsArchiveBucket,
-    runStatus: meta.status,
-    startedAt: meta.startedAt,
-    endedAt: meta.endedAt,
-    journalSource,
-    journalEventCount: events.length,
-    childRunIds,
-    sources: statuses,
-    children
-  };
-  files.push({ path: "manifest.json", content: JSON.stringify(manifest, null, 2) });
-  files.push({ path: "index.md", content: renderIndexMd(manifest) });
-  return { files, manifest };
-}
-function ndjsonOf(rows) {
-  return rows.length === 0 ? "" : rows.map((r) => JSON.stringify(r)).join("\n") + "\n";
-}
-function toMs(iso) {
-  if (!iso)
-    return null;
-  const ms = Date.parse(iso);
-  return Number.isFinite(ms) ? ms : null;
-}
-async function writeDebugBundle(io2, baseDir, bundle) {
-  const encoder3 = new TextEncoder();
-  for (const file2 of bundle.files) {
-    const abs = resolvePath4(baseDir, file2.path);
-    if (io2.mkdirp)
-      await io2.mkdirp(dirname(abs));
-    await io2.writeFile(abs, encoder3.encode(file2.content));
-  }
-}
-async function loadModule(pkg) {
-  try {
-    return await import(pkg);
-  } catch (err2) {
-    throw new Error(`aex debug needs the AWS SDK v3 package "${pkg}". Install it (e.g. \`npm i ${pkg}\`) and retry. (${err2.message})`);
-  }
-}
-function isNotFound(err2) {
-  const name = err2?.name ?? "";
-  return /NotFound|NoSuchKey|NoSuchBucket|ResourceNotFound|ExecutionDoesNotExist/i.test(name);
-}
-function partitionForRegion(region) {
-  if (region.startsWith("cn-"))
-    return "aws-cn";
-  if (region.startsWith("us-gov-"))
-    return "aws-us-gov";
-  return "aws";
-}
-function unmarshallAttr(av) {
-  if ("S" in av)
-    return av.S;
-  if ("N" in av)
-    return Number(av.N);
-  if ("BOOL" in av)
-    return av.BOOL;
-  if ("NULL" in av)
-    return null;
-  if ("M" in av) {
-    const m = av.M;
-    const out = {};
-    for (const [k, v] of Object.entries(m))
-      out[k] = unmarshallAttr(v);
-    return out;
-  }
-  if ("L" in av)
-    return av.L.map(unmarshallAttr);
-  if ("SS" in av)
-    return av.SS;
-  if ("NS" in av)
-    return av.NS.map(Number);
-  if ("B" in av)
-    return av.B;
-  return av;
-}
-function unmarshallItem(item) {
-  const out = {};
-  for (const [k, v] of Object.entries(item))
-    out[k] = unmarshallAttr(v);
-  return out;
-}
-function makeAwsSources(region) {
-  const clients = /* @__PURE__ */ new Map();
-  const modules = /* @__PURE__ */ new Map();
-  async function mod(pkg) {
-    let m = modules.get(pkg);
-    if (!m) {
-      m = await loadModule(pkg);
-      modules.set(pkg, m);
-    }
-    return m;
-  }
-  async function client(pkg, ctorName) {
-    let c = clients.get(pkg);
-    if (!c) {
-      const m = await mod(pkg);
-      const Ctor = m[ctorName];
-      c = new Ctor({ region });
-      clients.set(pkg, c);
-    }
-    return c;
-  }
-  async function listBuckets() {
-    const m = await mod("@aws-sdk/client-s3");
-    const c = await client("@aws-sdk/client-s3", "S3Client");
-    const Cmd = m.ListBucketsCommand;
-    const out = await c.send(new Cmd({}));
-    const buckets = out.Buckets ?? [];
-    return buckets.map((b) => b.Name ?? "").filter((n) => n !== "");
-  }
-  return {
-    async resolveTargets(plane, regionArg, accountHint) {
-      const prefix = `aex-${plane}-${regionArg}`;
-      let account = accountHint;
-      let outputsBucket = account ? `${prefix}-outputs-${account}` : "";
-      let eventsArchiveBucket = account ? `${prefix}-events-archive-${account}` : "";
-      if (!account) {
-        const names = await listBuckets();
-        const out = names.find((n) => n.startsWith(`${prefix}-outputs-`));
-        const arch = names.find((n) => n.startsWith(`${prefix}-events-archive-`));
-        if (out) {
-          outputsBucket = out;
-          account = out.slice(`${prefix}-outputs-`.length) || null;
-        }
-        if (arch)
-          eventsArchiveBucket = arch;
-      }
-      if (!outputsBucket)
-        outputsBucket = `${prefix}-outputs-${account ?? "unknown"}`;
-      if (!eventsArchiveBucket)
-        eventsArchiveBucket = `${prefix}-events-archive-${account ?? "unknown"}`;
-      return {
-        plane,
-        region: regionArg,
-        partition: partitionForRegion(regionArg),
-        account: account ?? null,
-        outputsBucket,
-        eventsArchiveBucket,
-        eventsTable: `${prefix}-events`,
-        stateMachineName: `${prefix}-sfn`,
-        logGroups: {
-          api: `/aws/lambda/${prefix}-api`,
-          sfn: `/aws/states/${prefix}-run`,
-          brain: `/aws/ecs/${prefix}-brain`,
-          egress: `/aws/ecs/${prefix}-egress`
-        }
-      };
-    },
-    async listObjects(bucket, keyPrefix) {
-      const m = await mod("@aws-sdk/client-s3");
-      const c = await client("@aws-sdk/client-s3", "S3Client");
-      const Cmd = m.ListObjectsV2Command;
-      const items = [];
-      let token;
-      do {
-        const out = await c.send(new Cmd({ Bucket: bucket, Prefix: keyPrefix, ...token ? { ContinuationToken: token } : {} }));
-        const contents = out.Contents ?? [];
-        for (const o of contents)
-          if (o.Key)
-            items.push({ key: o.Key, sizeBytes: o.Size ?? 0 });
-        token = out.IsTruncated ? out.NextContinuationToken : void 0;
-      } while (token);
-      return items;
-    },
-    async getObjectText(bucket, key) {
-      const m = await mod("@aws-sdk/client-s3");
-      const c = await client("@aws-sdk/client-s3", "S3Client");
-      const Cmd = m.GetObjectCommand;
-      try {
-        const out = await c.send(new Cmd({ Bucket: bucket, Key: key }));
-        const body = out.Body;
-        if (body?.transformToString)
-          return await body.transformToString();
-        return null;
-      } catch (err2) {
-        if (isNotFound(err2))
-          return null;
-        throw err2;
-      }
-    },
-    async queryEvents(table, runId) {
-      try {
-        const m = await mod("@aws-sdk/client-dynamodb");
-        const c = await client("@aws-sdk/client-dynamodb", "DynamoDBClient");
-        const Cmd = m.QueryCommand;
-        const items = [];
-        let startKey;
-        do {
-          const out = await c.send(new Cmd({
-            TableName: table,
-            KeyConditionExpression: "runId = :r",
-            ExpressionAttributeValues: { ":r": { S: runId } },
-            ScanIndexForward: true,
-            ...startKey ? { ExclusiveStartKey: startKey } : {}
-          }));
-          const rows = out.Items ?? [];
-          for (const r of rows)
-            items.push(unmarshallItem(r));
-          startKey = out.LastEvaluatedKey;
-        } while (startKey);
-        return items;
-      } catch (err2) {
-        if (isNotFound(err2))
-          return null;
-        return null;
-      }
-    },
-    async getExecutionHistory(executionArn) {
-      try {
-        const m = await mod("@aws-sdk/client-sfn");
-        const c = await client("@aws-sdk/client-sfn", "SFNClient");
-        const Cmd = m.GetExecutionHistoryCommand;
-        const events = [];
-        let token;
-        do {
-          const out = await c.send(new Cmd({ executionArn, maxResults: 1e3, includeExecutionData: true, ...token ? { nextToken: token } : {} }));
-          const page = out.events ?? [];
-          events.push(...page);
-          token = out.nextToken;
-        } while (token);
-        return events;
-      } catch (err2) {
-        if (isNotFound(err2))
-          return null;
-        throw err2;
-      }
-    },
-    async filterLogs(logGroup, runId, startMs, endMs) {
-      try {
-        const m = await mod("@aws-sdk/client-cloudwatch-logs");
-        const c = await client("@aws-sdk/client-cloudwatch-logs", "CloudWatchLogsClient");
-        const Cmd = m.FilterLogEventsCommand;
-        const events = [];
-        let token;
-        let pages = 0;
-        do {
-          const out = await c.send(new Cmd({
-            logGroupName: logGroup,
-            startTime: startMs,
-            endTime: endMs,
-            filterPattern: `"${runId}"`,
-            ...token ? { nextToken: token } : {}
-          }));
-          const page = out.events ?? [];
-          events.push(...page);
-          token = out.nextToken;
-        } while (token && ++pages < 10);
-        return events.length > 0 ? { kind: "events", events } : { kind: "empty" };
-      } catch (err2) {
-        if (isNotFound(err2))
-          return { kind: "expired" };
-        return { kind: "error", message: err2.message ?? "FilterLogEvents failed" };
-      }
-    }
-  };
-}
-var USAGE = "usage: aex debug <run-id> [--plane dev|prd] [--region eu-west-2] [--out dir] [--account <id>] [--cloudwatch] [--since <dur>] [--with-outputs]\n  operator command \u2014 uses the standard AWS SDK credential chain (env/profile), NOT --api-key\n";
-async function runDebugCmd(io2, argv) {
-  if (await refuseInsideManagedRun(io2, "debug"))
-    return USAGE_ERR;
-  const planeF = takeOptionFlag(argv, "--plane");
-  const regionF = takeOptionFlag(planeF.remaining, "--region");
-  const outF = takeOptionFlag(regionF.remaining, "--out");
-  const accountF = takeOptionFlag(outF.remaining, "--account");
-  const sinceF = takeOptionFlag(accountF.remaining, "--since");
-  const cwF = takeBooleanFlag(sinceF.remaining, "--cloudwatch");
-  const woF = takeBooleanFlag(cwF.remaining, "--with-outputs");
-  const rest = woF.remaining;
-  const unknownFlags = rest.filter((a) => a.startsWith("--"));
-  if (unknownFlags.length > 0) {
-    io2.stderr(`unknown flag(s): ${unknownFlags.join(", ")}
-${USAGE}`);
-    return USAGE_ERR;
-  }
-  const positional = rest.filter((a) => !a.startsWith("--"));
-  if (positional.length !== 1) {
-    io2.stderr(USAGE);
-    return USAGE_ERR;
-  }
-  const runId = positional[0];
-  const plane = planeF.value ?? "dev";
-  if (plane !== "dev" && plane !== "prd") {
-    io2.stderr(`--plane must be one of: dev, prd (got "${plane}")
-`);
-    return USAGE_ERR;
-  }
-  const region = regionF.value ?? "eu-west-2";
-  let sinceMs = 24 * 60 * 60 * 1e3;
-  if (sinceF.value !== void 0) {
-    const d = parseDuration(sinceF.value);
-    if (d.error || d.ms === null) {
-      io2.stderr(`--since: ${d.error ?? "invalid duration"}
-`);
-      return USAGE_ERR;
-    }
-    sinceMs = d.ms;
-  }
-  const outDir = resolvePath4(io2.cwd(), outF.value ?? `aex-debug-${runId}`);
-  const client = makeAwsSources(region);
-  let targets;
-  try {
-    targets = await client.resolveTargets(plane, region, accountF.value ?? null);
-  } catch (err2) {
-    io2.stderr(JSON.stringify({
-      error: "debug_resolve_failed",
-      message: err2.message ?? "failed to resolve plane targets",
-      hint: "check AWS credentials (env/profile) or pass --account <id>"
-    }) + "\n");
-    return RUNTIME_ERR;
-  }
-  let bundle;
-  try {
-    bundle = await assembleBundle({
-      runId,
-      targets,
-      sources: client,
-      cloudwatch: cwF.present,
-      withOutputs: woF.present,
-      sinceMs
-    });
-  } catch (err2) {
-    io2.stderr(JSON.stringify({ error: "debug_assemble_failed", message: err2.message ?? "assembly failed" }) + "\n");
-    return RUNTIME_ERR;
-  }
-  try {
-    await writeDebugBundle(io2, outDir, bundle);
-  } catch (err2) {
-    io2.stderr(JSON.stringify({ error: "debug_write_failed", message: err2.message ?? "write failed", outDir }) + "\n");
-    return RUNTIME_ERR;
-  }
-  io2.stdout(JSON.stringify({
-    runId,
-    plane,
-    region,
-    outDir,
-    fileCount: bundle.files.length,
-    runStatus: bundle.manifest.runStatus,
-    journalSource: bundle.manifest.journalSource,
-    journalEventCount: bundle.manifest.journalEventCount,
-    childRunIds: bundle.manifest.childRunIds,
-    sources: bundle.manifest.sources
-  }, null, 2) + "\n");
-  return SUCCESS;
-}
-
 // dist/host/auth-cmd.js
 async function runLoginCmd(io2, argv) {
   if (await refuseInsideManagedRun(io2, "login"))
@@ -7218,14 +6757,19 @@ async function runLoginCmd(io2, argv) {
     return USAGE_ERR;
   }
   const { apiKey, aexUrl, debug: debug2, rest } = extracted.flags;
-  const positional = rest.filter((a) => !a.startsWith("--"));
+  const loginUsage = "usage: aex login --api-key <token> [--aex-url <url>]";
+  const unknown = rejectUnknownFlags(io2, rest, loginUsage);
+  if (unknown)
+    return unknown;
+  const positional = rest;
   if (positional.length > 0) {
     io2.stderr(`unexpected arguments: ${positional.join(" ")}
 `);
     return USAGE_ERR;
   }
   if (!apiKey) {
-    io2.stderr("usage: aex login --api-key <token> [--aex-url <url>]\n");
+    io2.stderr(`${loginUsage}
+`);
     return USAGE_ERR;
   }
   const resolvedUrl = aexUrl ?? AEX_DEFAULT_BASE_URL;
@@ -7267,6 +6811,17 @@ async function runLogoutCmd(io2, argv) {
   const extracted = extractCommonHostFlags(argv);
   if (!extracted.ok) {
     io2.stderr(`${extracted.reason}
+`);
+    return USAGE_ERR;
+  }
+  const logoutUsage = "usage: aex logout";
+  const unknown = rejectUnknownFlags(io2, extracted.flags.rest, logoutUsage);
+  if (unknown)
+    return unknown;
+  if (extracted.flags.rest.length > 0) {
+    io2.stderr(`unexpected arguments: ${extracted.flags.rest.join(" ")}
+`);
+    io2.stderr(`${logoutUsage}
 `);
     return USAGE_ERR;
   }
@@ -7283,6 +6838,17 @@ async function runAuthStatusCmd(io2, argv) {
   const extracted = extractCommonHostFlags(argv);
   if (!extracted.ok) {
     io2.stderr(`${extracted.reason}
+`);
+    return USAGE_ERR;
+  }
+  const authUsage = "usage: aex auth status";
+  const unknown = rejectUnknownFlags(io2, extracted.flags.rest, authUsage);
+  if (unknown)
+    return unknown;
+  if (extracted.flags.rest.length > 0) {
+    io2.stderr(`unexpected arguments: ${extracted.flags.rest.join(" ")}
+`);
+    io2.stderr(`${authUsage}
 `);
     return USAGE_ERR;
   }
@@ -7380,11 +6946,14 @@ function stripListSubcommand(argv) {
   return argv[0] === "list" ? argv.slice(1) : argv;
 }
 function hasUnknown(io2, rest, verb) {
-  const stray = rest.filter((a) => !a.startsWith("--"));
+  const usage = `usage: aex ${verb} list [--json]`;
+  if (rejectUnknownFlags(io2, rest, usage))
+    return true;
+  const stray = rest;
   if (stray.length > 0) {
-    io2.stderr(`usage: aex ${verb} list [--json]
-`);
     io2.stderr(`unexpected arguments: ${stray.join(" ")}
+`);
+    io2.stderr(`${usage}
 `);
     return true;
   }
@@ -7432,9 +7001,14 @@ async function runTailCmd(io2, argv) {
     }
     timeoutMs = parsed.ms;
   }
-  const positional = timeoutFlag.remaining.filter((a) => !a.startsWith("--"));
+  const usage = "usage: aex tail <session-id> [--json] [--filter <type|source>] [--logs] [--from <seq>] [--settle] [--timeout <dur>] [common flags]";
+  const unknown = rejectUnknownFlags(io2, timeoutFlag.remaining, usage);
+  if (unknown)
+    return unknown;
+  const positional = timeoutFlag.remaining;
   if (positional.length !== 1) {
-    io2.stderr("usage: aex tail <session-id> [--json] [--filter <type|source>] [--logs] [--from <seq>] [--settle] [--timeout <dur>] [common flags]\n");
+    io2.stderr(`${usage}
+`);
     return USAGE_ERR;
   }
   const sessionId = positional[0];
@@ -7574,9 +7148,14 @@ async function runInspectCmd(io2, argv) {
     }
     timeoutMs = parsed.ms;
   }
-  const positional = timeoutFlag.remaining.filter((a) => !a.startsWith("--"));
+  const usage = "usage: aex inspect <session-id> [--json] [--filter <type|source>] [--logs] [--timeout <dur>] [common flags]";
+  const unknown = rejectUnknownFlags(io2, timeoutFlag.remaining, usage);
+  if (unknown)
+    return unknown;
+  const positional = timeoutFlag.remaining;
   if (positional.length !== 1) {
-    io2.stderr("usage: aex inspect <session-id> [--json] [--filter <type|source>] [--logs] [--timeout <dur>] [common flags]\n");
+    io2.stderr(`${usage}
+`);
     return USAGE_ERR;
   }
   const sessionId = positional[0];
@@ -7676,17 +7255,17 @@ async function runInspectCmd(io2, argv) {
 `);
     }
     const costUsd = finalSession.costUsd;
-    const usage = finalSession.usage;
-    if (costUsd !== void 0 || usage) {
+    const usage2 = finalSession.usage;
+    if (costUsd !== void 0 || usage2) {
       const parts = [`status=${finalSession.status}`];
       if (costUsd !== void 0)
         parts.push(`costUsd=${costUsd}`);
-      if (usage?.inputTokens !== void 0)
-        parts.push(`in=${usage.inputTokens}`);
-      if (usage?.outputTokens !== void 0)
-        parts.push(`out=${usage.outputTokens}`);
-      if (usage?.totalTokens !== void 0)
-        parts.push(`total=${usage.totalTokens}`);
+      if (usage2?.inputTokens !== void 0)
+        parts.push(`in=${usage2.inputTokens}`);
+      if (usage2?.outputTokens !== void 0)
+        parts.push(`out=${usage2.outputTokens}`);
+      if (usage2?.totalTokens !== void 0)
+        parts.push(`total=${usage2.totalTokens}`);
       io2.stdout(`
 \u2014 ${parts.join(" \xB7 ")}
 `);
@@ -7772,8 +7351,6 @@ async function dispatch(io2, args) {
       return runToolsCmd(io2, rest);
     case "runtime-sizes":
       return runRuntimeSizesCmd(io2, rest);
-    case "debug":
-      return runDebugCmd(io2, rest);
     default:
       io2.stderr(`unknown subcommand: ${sub}
 `);
@@ -7812,7 +7389,6 @@ async function printGlobalHelp(io2) {
   io2.stdout("  aex providers list [--json]                List providers + their models (no token needed)\n");
   io2.stdout("  aex tools list [--json]                    List builtin tools (all default; no token needed)\n");
   io2.stdout("  aex runtime-sizes list [--json]            List managed runtime presets (no token needed)\n");
-  io2.stdout("  aex debug <run-id> [--plane dev|prd] [--region eu-west-2] [--cloudwatch] [--with-outputs]   (operator; AWS creds)\n");
   io2.stdout("  aex --help\n\n");
   io2.stdout("Common flags on every host subcommand:\n");
   io2.stdout("  --api-key <token>         REQUIRED \u2014 aex SDK API key (workspace is derived from it)\n");
@@ -7854,7 +7430,7 @@ async function walkDirectory(root) {
   async function visit(dir) {
     const entries = await readdir(dir, { withFileTypes: true });
     for (const entry of entries) {
-      const full = resolvePath5(dir, entry.name);
+      const full = resolvePath4(dir, entry.name);
       if (entry.isDirectory()) {
         await visit(full);
       } else if (entry.isFile()) {
@@ -7903,7 +7479,7 @@ var configStore = {
     }
   },
   write: async (config) => {
-    await mkdir(dirname2(configPath), { recursive: true, mode: 448 });
+    await mkdir(dirname(configPath), { recursive: true, mode: 448 });
     await writeFile(configPath, JSON.stringify(config, null, 2) + "\n", { mode: 384 });
     try {
       await chmod(configPath, 384);
@@ -7920,9 +7496,6 @@ var webSocketFactory = typeof WebSocket === "undefined" ? void 0 : (url) => new
 var io = {
   readFile: (path) => readFile(path, "utf8"),
   writeFile: (path, data) => writeFile(path, data),
-  mkdirp: async (path) => {
-    await mkdir(path, { recursive: true });
-  },
   fetchImpl: fetch,
   stdout: (chunk) => process.stdout.write(chunk),
   stderr: (chunk) => process.stderr.write(chunk),