@aexhq/sdk 0.40.5 → 0.40.7

package/dist/_contracts/api-key.js

@@ -84,4 +84,3 @@ function crc32(input) {
     }
     return (crc ^ 0xffffffff) >>> 0;
 }
-//# sourceMappingURL=api-key.js.map

package/dist/_contracts/bundle-manifest.js

@@ -154,4 +154,3 @@ function posixDirname(path) {
 function byString(a, b) {
     return a < b ? -1 : a > b ? 1 : 0;
 }
-//# sourceMappingURL=bundle-manifest.js.map

package/dist/_contracts/connection-ticket.js

@@ -52,4 +52,3 @@ function timingSafeEqual(a, b) {
         diff |= a.charCodeAt(i) ^ b.charCodeAt(i);
     return diff === 0;
 }
-//# sourceMappingURL=connection-ticket.js.map

package/dist/_contracts/error-codes.js

@@ -76,4 +76,3 @@ const API_ERROR_CODE_SET = new Set(AEX_API_ERROR_CODES);
 export function isAexApiErrorCode(value) {
     return typeof value === "string" && API_ERROR_CODE_SET.has(value);
 }
-//# sourceMappingURL=error-codes.js.map

package/dist/_contracts/error-factory.js

@@ -139,4 +139,3 @@ function fallbackMessage(apiCode, body) {
         return error;
     return "aex API request failed";
 }
-//# sourceMappingURL=error-factory.js.map

package/dist/_contracts/event-envelope.js

@@ -395,4 +395,3 @@ function str(v) {
 function clip(s, max = 200) {
     return s.length <= max ? s : `${s.slice(0, max - 1)}…`;
 }
-//# sourceMappingURL=event-envelope.js.map

package/dist/_contracts/event-stream-client.js

@@ -262,4 +262,3 @@ function sleep(ms, signal) {
         }, { once: true });
     });
 }
-//# sourceMappingURL=event-stream-client.js.map

package/dist/_contracts/event-view.js

@@ -117,4 +117,3 @@ export function asAexEventView(event) {
 export function asAexEventViews(events) {
     return events.map(asAexEventView);
 }
-//# sourceMappingURL=event-view.js.map

package/dist/_contracts/http.js

@@ -192,4 +192,3 @@ function extractErrorMessage(body) {
     }
     return "aex API request failed";
 }
-//# sourceMappingURL=http.js.map

package/dist/_contracts/index.js

@@ -35,4 +35,3 @@ export * from "./error-codes.js";
 export * from "./error-factory.js";
 export * from "./suggest.js";
 export * from "./api-key.js";
-//# sourceMappingURL=index.js.map

package/dist/_contracts/internal.d.ts

@@ -1,3 +1,39 @@
 export * from "./models.js";
 export * from "./post-hook.js";
 export * from "./submission.js";
+/**
+ * Subset of `HttpClient` needed by the asset uploader. Defined structurally so
+ * SDK and CLI tests can supply thin stubs without dragging in the full client.
+ */
+export interface AssetsHttpClient {
+    request<T>(path: string, init?: RequestInit, query?: Record<string, string>): Promise<T>;
+}
+/** Minimal fetch shape for the direct-to-storage PUT. */
+export type AssetFetch = (input: string, init?: RequestInit) => Promise<{
+    readonly ok: boolean;
+    readonly status: number;
+    text(): Promise<string>;
+    readonly headers?: {
+        get(name: string): string | null;
+    };
+}>;
+export interface UploadAssetArgs {
+    readonly http: AssetsHttpClient;
+    readonly bytes: Uint8Array;
+    /** `sha256:<hex>` - the canonical content hash declared on the wire. */
+    readonly hash: string;
+    readonly contentType?: string;
+    readonly fetch?: AssetFetch;
+}
+export interface UploadedAsset {
+    readonly assetId: string;
+    readonly contentHash: string;
+    readonly sizeBytes: number;
+    /** true if identical bytes were already present (dedup hit). */
+    readonly exists: boolean;
+}
+/**
+ * Upload `bytes` to the hosted API's content-addressable asset store via the
+ * direct-to-storage presign flow shared by SDK and CLI callers.
+ */
+export declare function uploadAsset(args: UploadAssetArgs): Promise<UploadedAsset>;

package/dist/_contracts/internal.js

@@ -1,10 +1,159 @@
-// Workspace-internal entry point. Re-exports the submission building blocks
-// (leaf parsers, helper validators, shared constants) so the platform-only
-// `@aexhq/shared` package can reuse them instead of hand-mirroring ~1.8k lines
-// of validator code. NOT part of the public `@aexhq/contracts` surface — do
-// NOT add this to the package `index`; consumers reach it via the explicit
+import { extractErrorCode, redactUrl } from "./sdk-errors.js";
+// Workspace-internal entry point. Re-exports submission building blocks and
+// hosts small shared helpers so public packages can avoid hand-mirroring
+// behavior. NOT part of the public `@aexhq/contracts` surface; do NOT add this
+// to the package `index`. Consumers reach it via the explicit
 // `@aexhq/contracts/internal` subpath.
 export * from "./models.js";
 export * from "./post-hook.js";
 export * from "./submission.js";
-//# sourceMappingURL=internal.js.map
+const DIRECT_UPLOAD_MAX_ATTEMPTS = 3;
+/**
+ * Upload `bytes` to the hosted API's content-addressable asset store via the
+ * direct-to-storage presign flow shared by SDK and CLI callers.
+ */
+export async function uploadAsset(args) {
+    const expected = args.hash.startsWith("sha256:") ? args.hash.slice("sha256:".length) : args.hash;
+    const actual = await computeSha256Hex(args.bytes);
+    if (actual !== expected) {
+        throw new Error(`uploadAsset: client-side hash mismatch: computed sha256:${actual} ` +
+            `but caller declared ${args.hash}. Aborting to avoid uploading corrupted data.`);
+    }
+    const contentHashHeader = `sha256:${actual}`;
+    const presign = await args.http.request("/assets/presign", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ hash: contentHashHeader, sizeBytes: args.bytes.byteLength })
+    });
+    if (presign.exists) {
+        const contentHash = presign.contentHash ?? contentHashHeader;
+        return {
+            assetId: presign.assetId ?? assetIdFromContentHash(contentHash),
+            contentHash,
+            sizeBytes: presign.sizeBytes ?? args.bytes.byteLength,
+            exists: true
+        };
+    }
+    if (!presign.uploadUrl) {
+        throw new Error("uploadAsset: presign returned no uploadUrl and exists:false");
+    }
+    const doFetch = args.fetch ?? globalThis.fetch;
+    const putHeaders = {
+        "content-type": args.contentType ?? "application/zip",
+        ...(presign.requiredHeaders ?? {})
+    };
+    await putWithRetry(doFetch, presign.uploadUrl, {
+        method: "PUT",
+        headers: putHeaders,
+        body: args.bytes
+    });
+    const fin = await args.http.request("/assets/finalize", {
+        method: "POST",
+        headers: { "content-type": "application/json" },
+        body: JSON.stringify({ hash: contentHashHeader, sizeBytes: args.bytes.byteLength })
+    });
+    const contentHash = fin.contentHash ?? presign.contentHash ?? contentHashHeader;
+    return {
+        assetId: fin.assetId ?? presign.assetId ?? assetIdFromContentHash(contentHash),
+        contentHash,
+        sizeBytes: fin.sizeBytes ?? args.bytes.byteLength,
+        exists: false
+    };
+}
+async function computeSha256Hex(bytes) {
+    const subtle = globalThis.crypto?.subtle;
+    if (!subtle) {
+        throw new Error("uploadAsset: globalThis.crypto.subtle is not available; " +
+            "Bun, Node 18+, or a Web-Crypto-capable runtime is required");
+    }
+    const digest = await subtle.digest("SHA-256", bytes);
+    return bufferToHex(digest);
+}
+function assetIdFromContentHash(contentHash) {
+    const hex = contentHash.startsWith("sha256:") ? contentHash.slice("sha256:".length) : contentHash;
+    return `asset_${hex}`;
+}
+async function putWithRetry(fetchImpl, uploadUrl, init) {
+    for (let attempt = 1; attempt <= DIRECT_UPLOAD_MAX_ATTEMPTS; attempt++) {
+        let response;
+        try {
+            response = await fetchImpl(uploadUrl, init);
+        }
+        catch (err) {
+            if (attempt < DIRECT_UPLOAD_MAX_ATTEMPTS && isRetryableUploadError(err)) {
+                continue;
+            }
+            throw directUploadNetworkError(uploadUrl, err, attempt);
+        }
+        if (response.ok)
+            return;
+        if (attempt < DIRECT_UPLOAD_MAX_ATTEMPTS && isRetryableUploadStatus(response.status)) {
+            await response.text().catch(() => "");
+            continue;
+        }
+        const detail = await response.text().catch(() => "");
+        throw directUploadResponseError(uploadUrl, response.status, detail, attempt);
+    }
+}
+function isRetryableUploadStatus(status) {
+    return status === 408 || status === 425 || status === 429 || (status >= 500 && status <= 599);
+}
+function isRetryableUploadError(err) {
+    if (isNamedError(err, "AbortError"))
+        return false;
+    return true;
+}
+function directUploadNetworkError(uploadUrl, err, attempts) {
+    const safeUrl = redactUrl(uploadUrl);
+    const code = extractErrorCode(err);
+    const detail = sanitizeUploadText(errorMessage(err)).slice(0, 500);
+    return new Error(`uploadAsset: direct upload PUT failed for ${safeUrl} after ${attemptsLabel(attempts)}` +
+        (code ? ` (${code})` : "") +
+        (detail ? `: ${detail}` : ""));
+}
+function directUploadResponseError(uploadUrl, status, detail, attempts) {
+    const safeUrl = redactUrl(uploadUrl);
+    const safeDetail = sanitizeUploadText(detail).slice(0, 500);
+    return new Error(`uploadAsset: direct upload PUT failed for ${safeUrl} with status ${status}` +
+        (attempts > 1 ? ` after ${attemptsLabel(attempts)}` : "") +
+        (safeDetail ? `: ${safeDetail}` : ""));
+}
+function attemptsLabel(attempts) {
+    return attempts === 1 ? "1 attempt" : `${attempts} attempts`;
+}
+function errorMessage(err) {
+    if (err instanceof Error)
+        return err.message || err.name;
+    if (typeof err === "string")
+        return err;
+    return String(err);
+}
+function isNamedError(err, name) {
+    return stringProperty(err, "name") === name;
+}
+function stringProperty(value, key) {
+    if (!value || typeof value !== "object")
+        return undefined;
+    const prop = value[key];
+    return typeof prop === "string" && prop.length > 0 ? prop : undefined;
+}
+function sanitizeUploadText(text) {
+    return text
+        .replace(/https?:\/\/[^\s<>"'`]+/g, (raw) => redactUrlPreservingTrailingPunctuation(raw))
+        .replace(/\b(?:X-Amz-(?:Algorithm|Credential|Date|Expires|Security-Token|Signature|SignedHeaders)|AWSAccessKeyId|Signature|Credential|Security-Token|AccessKeyId|SecretAccessKey|SessionToken)=([^&\s<>"'`]+)/gi, "[redacted]")
+        .replace(/\bAKIA[0-9A-Z]{8,}\b/g, "[redacted]");
+}
+function redactUrlPreservingTrailingPunctuation(raw) {
+    const trailing = raw.match(/[),.;:!?]+$/)?.[0] ?? "";
+    const candidate = trailing ? raw.slice(0, -trailing.length) : raw;
+    return `${redactUrl(candidate)}${trailing}`;
+}
+function bufferToHex(buffer) {
+    const view = new Uint8Array(buffer);
+    let out = "";
+    for (let i = 0; i < view.length; i++) {
+        const byte = view[i];
+        out += byte.toString(16).padStart(2, "0");
+    }
+    return out;
+}

package/dist/_contracts/models.js

@@ -198,4 +198,3 @@ export function assertRunModelMatchesProvider(provider, model, field = "submissi
             `expected one of: ${providers.join(", ")}`);
     }
 }
-//# sourceMappingURL=models.js.map

package/dist/_contracts/operations.js

@@ -445,7 +445,7 @@ async function readCappedText(response, maxBytes) {
         await reader.cancel().catch(() => { });
     }
     const merged = concatBytes(chunks).subarray(0, maxBytes);
-    const truncated = declared !== undefined ? declared > maxBytes : sawMore;
+    const truncated = declared !== undefined ? declared > maxBytes : read > maxBytes || sawMore;
     const totalBytes = declared ?? read;
     return { text: decoder.decode(merged), truncated, totalBytes };
 }
@@ -1082,4 +1082,3 @@ export async function uploadWorkspaceAsset(http, input) {
         body: input.bytes
     });
 }
-//# sourceMappingURL=operations.js.map

package/dist/_contracts/post-hook.js

@@ -65,4 +65,3 @@ function requirePostHookRecord(input, path) {
     }
     return input;
 }
-//# sourceMappingURL=post-hook.js.map

package/dist/_contracts/provider-support.js

@@ -92,4 +92,3 @@ export const PROVIDER_PUBLIC_SUPPORT = {
 export function providerPublicSupport(provider) {
     return PROVIDER_PUBLIC_SUPPORT[provider];
 }
-//# sourceMappingURL=provider-support.js.map

package/dist/_contracts/run-artifacts.js

@@ -100,4 +100,3 @@ export function runAssetKey(runId, hash) {
     const hex = hash.startsWith("sha256:") ? hash.slice("sha256:".length) : hash;
     return `runs/${runId}/${RUN_ASSETS_PREFIX}/${hex}`;
 }
-//# sourceMappingURL=run-artifacts.js.map

package/dist/_contracts/run-config.js

@@ -711,4 +711,3 @@ export function normaliseRunRequestConfig(config) {
         mcpServerSecrets
     };
 }
-//# sourceMappingURL=run-config.js.map

package/dist/_contracts/run-cost.js

@@ -583,4 +583,3 @@ function nonNegativeFinite(value, field) {
 function isStringIn(value, allowed) {
     return typeof value === "string" && allowed.includes(value);
 }
-//# sourceMappingURL=run-cost.js.map

package/dist/_contracts/run-custody.js

@@ -484,4 +484,3 @@ function formatFindingPaths(findings) {
 function cloneJson(value) {
     return JSON.parse(JSON.stringify(value));
 }
-//# sourceMappingURL=run-custody.js.map

package/dist/_contracts/run-record.js

@@ -163,4 +163,3 @@ function tryParseJson(text) {
 function formatArchiveFindingPaths(findings) {
     return findings.map((finding) => `${finding.entryPath}${finding.path} (${finding.reason})`).join(", ");
 }
-//# sourceMappingURL=run-record.js.map

package/dist/_contracts/run-retention.js

@@ -469,4 +469,3 @@ function formatFindingPaths(findings) {
 function cloneJson(value) {
     return JSON.parse(JSON.stringify(value));
 }
-//# sourceMappingURL=run-retention.js.map

package/dist/_contracts/run-trace.js

@@ -1,2 +1 @@
 export {};
-//# sourceMappingURL=run-trace.js.map

package/dist/_contracts/run-unit.js

@@ -279,4 +279,3 @@ function parseEnvironment(value) {
         ? env
         : undefined;
 }
-//# sourceMappingURL=run-unit.js.map

package/dist/_contracts/runner-event.js

@@ -183,4 +183,3 @@ function isJsonValue(input) {
     }
     return false;
 }
-//# sourceMappingURL=runner-event.js.map

package/dist/_contracts/runtime-manifest.js

@@ -81,4 +81,3 @@ export function buildRuntimeManifest(input) {
         mountedFiles: Object.freeze(mountedFiles)
     });
 }
-//# sourceMappingURL=runtime-manifest.js.map

package/dist/_contracts/runtime-security-profile.js

@@ -70,4 +70,3 @@ export function evaluateRuntimeSecurityProfile(profileName, input) {
     }
     return Object.freeze(violations);
 }
-//# sourceMappingURL=runtime-security-profile.js.map

package/dist/_contracts/runtime-sizes.js

@@ -114,4 +114,3 @@ export const RUN_PROCESS_KILL_GRACE_MS = 60 * 1000;
  * before host-level cleanup.
  */
 export const RUN_TERMINAL_GRACE_MS = 90 * 1000;
-//# sourceMappingURL=runtime-sizes.js.map

package/dist/_contracts/runtime-types.js

@@ -31,4 +31,3 @@ export function usageFromProviderUsage(providerUsage) {
         ...(totalTokens !== undefined ? { totalTokens } : {})
     };
 }
-//# sourceMappingURL=runtime-types.js.map

package/dist/_contracts/sdk-errors.js

@@ -250,4 +250,3 @@ function stringProperty(value, key) {
     const prop = value[key];
     return typeof prop === "string" && prop.length > 0 ? prop : undefined;
 }
-//# sourceMappingURL=sdk-errors.js.map

package/dist/_contracts/sdk-secrets.js

@@ -259,4 +259,3 @@ function shannonEntropyBits(value) {
     }
     return bits;
 }
-//# sourceMappingURL=sdk-secrets.js.map

package/dist/_contracts/side-effect-audit.js

@@ -486,4 +486,3 @@ function formatFindingPaths(findings) {
 function isStringIn(value, allowed) {
     return typeof value === "string" && allowed.includes(value);
 }
-//# sourceMappingURL=side-effect-audit.js.map

package/dist/_contracts/stable.d.ts

@@ -22,18 +22,23 @@
  * exact default API plane.
  */
 export declare const AEX_DEFAULT_BASE_URL = "https://api.aex.dev";
+/**
+ * Canonical hosted dev API plane URL. Used when a self-describing dev API key is
+ * passed with no explicit `baseUrl`.
+ */
+export declare const AEX_DEV_BASE_URL = "https://dev-api.aex.dev";
 /**
  * Plane → API base URL. When the SDK constructor is given no explicit `baseUrl`
  * it DERIVES the target from the API key's embedded plane (see
  * {@link import("./api-key.js").parseApiKey}) rather than blindly defaulting to
- * prod — so a dev key never silently 401s against `api.aex.dev`.
+ * prod — so a dev key routes to `dev-api.aex.dev` and a prd key routes to
+ * `api.aex.dev`.
  *
- * `prd` is {@link AEX_DEFAULT_BASE_URL}. `dev` is `null`: the dev plane has no
- * stable public hostname yet, so a dev key still requires an explicit `baseUrl`
- * — but the plane-mismatch guard (dev key + prd baseUrl) still fires.
+ * The plane-mismatch guard still fires when a key is pointed at the wrong
+ * canonical host (for example, a dev key with `baseUrl=https://api.aex.dev`).
  */
 export declare const PLANE_BASE_URLS: {
-    readonly dev: null;
+    readonly dev: "https://dev-api.aex.dev";
     readonly prd: "https://api.aex.dev";
 };
 export declare function stableStringify(value: unknown): string;

package/dist/_contracts/stable.js

@@ -23,18 +23,23 @@ import { createHash } from "node:crypto";
  * exact default API plane.
  */
 export const AEX_DEFAULT_BASE_URL = "https://api.aex.dev";
+/**
+ * Canonical hosted dev API plane URL. Used when a self-describing dev API key is
+ * passed with no explicit `baseUrl`.
+ */
+export const AEX_DEV_BASE_URL = "https://dev-api.aex.dev";
 /**
  * Plane → API base URL. When the SDK constructor is given no explicit `baseUrl`
  * it DERIVES the target from the API key's embedded plane (see
  * {@link import("./api-key.js").parseApiKey}) rather than blindly defaulting to
- * prod — so a dev key never silently 401s against `api.aex.dev`.
+ * prod — so a dev key routes to `dev-api.aex.dev` and a prd key routes to
+ * `api.aex.dev`.
  *
- * `prd` is {@link AEX_DEFAULT_BASE_URL}. `dev` is `null`: the dev plane has no
- * stable public hostname yet, so a dev key still requires an explicit `baseUrl`
- * — but the plane-mismatch guard (dev key + prd baseUrl) still fires.
+ * The plane-mismatch guard still fires when a key is pointed at the wrong
+ * canonical host (for example, a dev key with `baseUrl=https://api.aex.dev`).
  */
 export const PLANE_BASE_URLS = {
-    dev: null,
+    dev: AEX_DEV_BASE_URL,
     prd: AEX_DEFAULT_BASE_URL
 };
 export function stableStringify(value) {
@@ -55,4 +60,3 @@ function sortValue(value) {
     }
     return value;
 }
-//# sourceMappingURL=stable.js.map

package/dist/_contracts/status.js

@@ -118,4 +118,3 @@ export const CLEANUP_STATUSES = [
     "failed_terminal",
     "skipped"
 ];
-//# sourceMappingURL=status.js.map

package/dist/_contracts/submission.js

@@ -1615,4 +1615,3 @@ function parseMcpServers(input) {
         return ref;
     });
 }
-//# sourceMappingURL=submission.js.map

package/dist/_contracts/suggest.js

@@ -51,4 +51,3 @@ export function levenshtein(a, b) {
     }
     return prev[n];
 }
-//# sourceMappingURL=suggest.js.map

package/dist/_contracts/webhook-verify.js

@@ -91,4 +91,3 @@ export async function verifyAexWebhook(input) {
     }
     return false;
 }
-//# sourceMappingURL=webhook-verify.js.map

package/dist/asset-upload.d.ts

@@ -19,50 +19,10 @@
  *   3. POST /assets/finalize → confirms the object exists (HEAD only).
  *
  */
+import type { AssetFetch, AssetsHttpClient, UploadedAsset } from "./_contracts/internal.js";
 import type { ByteSink } from "./canonical-zip.js";
-/**
- * Subset of `HttpClient` needed by the asset uploader. Defined as a
- * structural type so tests can supply a thin stub without dragging in
- * the full client.
- */
-export interface AssetsHttpClient {
-    request<T>(path: string, init?: RequestInit, query?: Record<string, string>): Promise<T>;
-}
-/** Minimal fetch shape for the direct-to-storage PUT (defaults to global fetch). */
-export type AssetFetch = (input: string, init?: RequestInit) => Promise<{
-    readonly ok: boolean;
-    readonly status: number;
-    text(): Promise<string>;
-    /** Present on real `fetch` Responses; used to read a multipart part's ETag. */
-    readonly headers?: {
-        get(name: string): string | null;
-    };
-}>;
-export interface UploadAssetArgs {
-    readonly http: AssetsHttpClient;
-    readonly bytes: Uint8Array;
-    /** `sha256:<hex>` — the canonical content hash declared on the wire. */
-    readonly hash: string;
-    readonly contentType?: string;
-    /** Injected in tests; defaults to `globalThis.fetch` for the direct PUT. */
-    readonly fetch?: AssetFetch;
-}
-export interface UploadedAsset {
-    readonly assetId: string;
-    readonly contentHash: string;
-    readonly sizeBytes: number;
-    /** true if identical bytes were already present (dedup hit). */
-    readonly exists: boolean;
-}
-/**
- * Upload `bytes` to the hosted API's content-addressable asset store via the
- * direct-to-storage presign flow.
- *
- * Verifies the advisory hash matches the bytes BEFORE sending so a mismatch
- * fails fast on the client. Object storage re-verifies via the signed checksum,
- * and the runner re-checks on download.
- */
-export declare function uploadAsset(args: UploadAssetArgs): Promise<UploadedAsset>;
+export { uploadAsset } from "./_contracts/internal.js";
+export type { AssetFetch, AssetsHttpClient, UploadAssetArgs, UploadedAsset } from "./_contracts/internal.js";
 /** Default multipart part size — 16 MiB covers the 100 GiB cap within S3's 10 000-part limit. */
 export declare const DEFAULT_MULTIPART_PART_SIZE: number;
 /** Default in-flight part concurrency. */