@aexhq/sdk 0.40.6 → 0.40.8

package/dist/cli.mjs

@@ -2261,6 +2261,8 @@ function extractErrorMessage(body) {
 // ../contracts/dist/operations.js
 var operations_exports = {};
 __export(operations_exports, {
+  OUTPUT_FILE_TRANSFER_ATTEMPTS: () => OUTPUT_FILE_TRANSFER_ATTEMPTS,
+  OUTPUT_FILE_TRANSFER_DEFAULT_TIMEOUT_MS: () => OUTPUT_FILE_TRANSFER_DEFAULT_TIMEOUT_MS,
   READ_OUTPUT_TEXT_DEFAULT_BYTES: () => READ_OUTPUT_TEXT_DEFAULT_BYTES,
   READ_OUTPUT_TEXT_MAX_BYTES: () => READ_OUTPUT_TEXT_MAX_BYTES,
   approveSession: () => approveSession,
@@ -3322,28 +3324,144 @@ function resolveOutputFileSelector(outputs, selector, runId) {
   }
   return { ...selector, id: selector.id };
 }
-async function downloadOutput(http, runId, selector) {
+async function downloadOutput(http, runId, selector, options) {
   const output = isPathSelector(selector) ? resolveOutputFileSelector(await listOutputs(http, runId), selector, runId) : resolveOutputFileSelector([], selector, runId);
-  const { response } = await http.download(`/api/runs/${encodeURIComponent(runId)}/outputs/${encodeURIComponent(output.id)}/download`);
-  return { output, bytes: new Uint8Array(await response.arrayBuffer()) };
+  const timeoutMs = normalizeOutputTransferTimeoutMs(options?.timeoutMs);
+  const path = `/api/runs/${encodeURIComponent(runId)}/outputs/${encodeURIComponent(output.id)}/download`;
+  return { output, bytes: await downloadOutputBytesWithRetry(http, path, timeoutMs) };
 }
 var READ_OUTPUT_TEXT_MAX_BYTES = 1e7;
 var READ_OUTPUT_TEXT_DEFAULT_BYTES = 5e4;
+var OUTPUT_FILE_TRANSFER_DEFAULT_TIMEOUT_MS = 15e3;
+var OUTPUT_FILE_TRANSFER_ATTEMPTS = 2;
 async function readOutputText(http, runId, selector, options) {
   const maxBytes = Math.max(1, Math.min(options?.maxBytes ?? READ_OUTPUT_TEXT_DEFAULT_BYTES, READ_OUTPUT_TEXT_MAX_BYTES));
   const output = isPathSelector(selector) ? resolveOutputFileSelector(await listOutputs(http, runId), selector, runId) : resolveOutputFileSelector([], selector, runId);
-  const { response } = await http.download(`/api/runs/${encodeURIComponent(runId)}/outputs/${encodeURIComponent(output.id)}/download`);
-  const capped = await readCappedText(response, maxBytes);
+  const timeoutMs = normalizeOutputTransferTimeoutMs(options?.timeoutMs);
+  const path = `/api/runs/${encodeURIComponent(runId)}/outputs/${encodeURIComponent(output.id)}/download`;
+  const capped = await readOutputTextWithRetry(http, path, maxBytes, timeoutMs);
   const text = options?.grep === void 0 ? capped.text : grepLines(capped.text, options.grep);
   return { output, text, truncated: capped.truncated, totalBytes: capped.totalBytes };
 }
-async function readCappedText(response, maxBytes) {
+async function downloadOutputBytesWithRetry(http, path, timeoutMs) {
+  return outputTransferWithRetry(path, timeoutMs, async () => {
+    const response = await downloadOutputResponse(http, path, timeoutMs);
+    return readResponseBytes(response, timeoutMs);
+  });
+}
+async function readOutputTextWithRetry(http, path, maxBytes, timeoutMs) {
+  return outputTransferWithRetry(path, timeoutMs, async () => {
+    const response = await downloadOutputResponse(http, path, timeoutMs);
+    return readCappedText(response, maxBytes, timeoutMs);
+  });
+}
+async function downloadOutputResponse(http, path, timeoutMs) {
+  const controller = new AbortController();
+  const { response } = await withOutputTransferTimeout(http.download(path, { signal: controller.signal }), timeoutMs, () => controller.abort(), "output response");
+  return response;
+}
+async function outputTransferWithRetry(path, timeoutMs, action) {
+  const startedMs = Date.now();
+  let lastTimeout;
+  for (let attempt = 1; attempt <= OUTPUT_FILE_TRANSFER_ATTEMPTS; attempt += 1) {
+    try {
+      return await action();
+    } catch (err2) {
+      if (!(err2 instanceof OutputTransferTimeoutError))
+        throw err2;
+      lastTimeout = err2;
+    }
+  }
+  throw new AexNetworkError({
+    method: "GET",
+    host: "",
+    path,
+    cause: lastTimeout ?? new OutputTransferTimeoutError("output transfer", timeoutMs),
+    attempts: OUTPUT_FILE_TRANSFER_ATTEMPTS,
+    elapsedMs: Date.now() - startedMs
+  });
+}
+function normalizeOutputTransferTimeoutMs(value) {
+  if (value === void 0)
+    return OUTPUT_FILE_TRANSFER_DEFAULT_TIMEOUT_MS;
+  if (!Number.isFinite(value) || value <= 0) {
+    throw new RunConfigValidationError("outputs.download: timeoutMs must be a positive finite number", {
+      timeoutMs: value
+    });
+  }
+  return Math.max(1, Math.floor(value));
+}
+var OutputTransferTimeoutError = class extends Error {
+  code = "ETIMEDOUT";
+  constructor(label, timeoutMs) {
+    super(`${label} timed out after ${timeoutMs}ms`);
+    this.name = "OutputTransferTimeoutError";
+  }
+};
+async function withOutputTransferTimeout(promise, timeoutMs, abort, label) {
+  let timedOut = false;
+  let timeout;
+  const timeoutPromise = new Promise((_, reject) => {
+    timeout = setTimeout(() => {
+      timedOut = true;
+      reject(new OutputTransferTimeoutError(label, timeoutMs));
+      queueMicrotask(() => {
+        try {
+          abort();
+        } catch {
+        }
+      });
+    }, timeoutMs);
+  });
+  try {
+    return await Promise.race([promise, timeoutPromise]);
+  } catch (err2) {
+    if (timedOut && isAbortLikeError(err2))
+      throw new OutputTransferTimeoutError(label, timeoutMs);
+    throw err2;
+  } finally {
+    if (timeout !== void 0)
+      clearTimeout(timeout);
+  }
+}
+function isAbortLikeError(err2) {
+  const name = err2?.name;
+  return name === "AbortError";
+}
+async function readResponseBytes(response, timeoutMs) {
+  const body = response.body;
+  if (!body) {
+    const buffer = await withOutputTransferTimeout(response.arrayBuffer(), timeoutMs, () => {
+    }, "output body");
+    return new Uint8Array(buffer);
+  }
+  const reader = body.getReader();
+  const chunks = [];
+  try {
+    while (true) {
+      const { done, value } = await withOutputTransferTimeout(reader.read(), timeoutMs, () => {
+        void reader.cancel().catch(() => {
+        });
+      }, "output body");
+      if (done)
+        break;
+      if (value && value.byteLength > 0)
+        chunks.push(value);
+    }
+  } finally {
+    void reader.cancel().catch(() => {
+    });
+  }
+  return concatBytes(chunks);
+}
+async function readCappedText(response, maxBytes, timeoutMs) {
   const declaredRaw = response.headers.get("content-length");
   const declared = declaredRaw !== null && /^\d+$/.test(declaredRaw) ? Number(declaredRaw) : void 0;
   const decoder = new TextDecoder("utf-8");
   const body = response.body;
   if (!body) {
-    const buf = new Uint8Array(await response.arrayBuffer());
+    const buf = new Uint8Array(await withOutputTransferTimeout(response.arrayBuffer(), timeoutMs, () => {
+    }, "output body"));
     const total = declared ?? buf.byteLength;
     return {
       text: decoder.decode(buf.subarray(0, maxBytes)),
@@ -3357,7 +3475,10 @@ async function readCappedText(response, maxBytes) {
   let sawMore = false;
   try {
     while (read < maxBytes) {
-      const { done, value } = await reader.read();
+      const { done, value } = await withOutputTransferTimeout(reader.read(), timeoutMs, () => {
+        void reader.cancel().catch(() => {
+        });
+      }, "output body");
       if (done)
         break;
       if (value && value.byteLength > 0) {
@@ -3366,12 +3487,15 @@ async function readCappedText(response, maxBytes) {
       }
     }
     if (read >= maxBytes) {
-      const next = await reader.read();
+      const next = await withOutputTransferTimeout(reader.read(), timeoutMs, () => {
+        void reader.cancel().catch(() => {
+        });
+      }, "output body");
       if (!next.done && next.value && next.value.byteLength > 0)
         sawMore = true;
     }
   } finally {
-    await reader.cancel().catch(() => {
+    void reader.cancel().catch(() => {
     });
   }
   const merged = concatBytes(chunks).subarray(0, maxBytes);
@@ -3443,17 +3567,17 @@ async function getBillingLedger(http, query) {
 async function getWebhookSigningSecret(http) {
   return http.request("/api/webhook/signing-secret", { method: "POST" });
 }
-async function collectArtifactBytes(http, runId, items, zipPrefix, namespace2) {
+async function collectArtifactBytes(http, runId, items, zipPrefix, namespace2, timeoutMs = OUTPUT_FILE_TRANSFER_DEFAULT_TIMEOUT_MS) {
   const entries = [];
   const captured = [];
   const errors = [];
   for (const item of items) {
     const rel = item.filename ?? item.id;
     try {
-      const { response } = await http.download(`/api/runs/${encodeURIComponent(runId)}/${namespace2}/${encodeURIComponent(item.id)}/download`);
+      const path = `/api/runs/${encodeURIComponent(runId)}/${namespace2}/${encodeURIComponent(item.id)}/download`;
       entries.push({
         path: `${zipPrefix}${rel}`,
-        bytes: new Uint8Array(await response.arrayBuffer()),
+        bytes: await downloadOutputBytesWithRetry(http, path, timeoutMs),
         ...item.contentType !== void 0 ? { contentType: item.contentType } : {},
         customerContent: true
       });
@@ -3679,9 +3803,10 @@ async function download(http, runId) {
     jsonEntry("manifest.json", manifest)
   ]);
 }
-async function downloadOutputs(http, runId) {
+async function downloadOutputs(http, runId, options) {
   const outputs = await listOutputs(http, runId);
-  const { entries, captured, errors } = await collectArtifactBytes(http, runId, outputs, "", "outputs");
+  const timeoutMs = normalizeOutputTransferTimeoutMs(options?.timeoutMs);
+  const { entries, captured, errors } = await collectArtifactBytes(http, runId, outputs, "", "outputs", timeoutMs);
   return zipEntries([
     ...entries,
     jsonEntry("manifest.json", { runId, namespace: "outputs", outputs: captured, errors })
@@ -4456,91 +4581,119 @@ function renderVerbHelp(spec) {
 // dist/host/run-cmd.js
 import { resolve as resolvePath } from "node:path";
 
-// ../contracts/dist/post-hook.js
-var DEFAULT_POST_HOOK_TIMEOUT_MS = 5 * 60 * 1e3;
-
-// ../contracts/dist/internal.js
-var DIRECT_UPLOAD_MAX_ATTEMPTS = 3;
-async function uploadAsset(args) {
-  const expected = args.hash.startsWith("sha256:") ? args.hash.slice("sha256:".length) : args.hash;
-  const actual = await computeSha256Hex(args.bytes);
-  if (actual !== expected) {
-    throw new Error(`uploadAsset: client-side hash mismatch: computed sha256:${actual} but caller declared ${args.hash}. Aborting to avoid uploading corrupted data.`);
-  }
-  const contentHashHeader = `sha256:${actual}`;
-  const presign = await args.http.request("/assets/presign", {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify({ hash: contentHashHeader, sizeBytes: args.bytes.byteLength })
-  });
-  if (presign.exists) {
-    const contentHash2 = presign.contentHash ?? contentHashHeader;
-    return {
-      assetId: presign.assetId ?? assetIdFromContentHash(contentHash2),
-      contentHash: contentHash2,
-      sizeBytes: presign.sizeBytes ?? args.bytes.byteLength,
-      exists: true
-    };
+// ../contracts/dist/retry-core.js
+var RETRYABLE_HTTP_STATUS = [429, 500, 502, 503, 504, 529];
+var RATE_LIMIT_HTTP_STATUS = [429, 503, 529];
+var RETRYABLE_HTTP_STATUS_SET = new Set(RETRYABLE_HTTP_STATUS);
+var RATE_LIMIT_HTTP_STATUS_SET = new Set(RATE_LIMIT_HTTP_STATUS);
+function parseRetryAfterMs(headerValue, now = Date.now()) {
+  if (headerValue === null || headerValue === void 0)
+    return void 0;
+  const trimmed = headerValue.trim();
+  if (trimmed.length === 0)
+    return void 0;
+  if (/^\d+$/.test(trimmed)) {
+    return Number(trimmed) * 1e3;
   }
-  if (!presign.uploadUrl) {
-    throw new Error("uploadAsset: presign returned no uploadUrl and exists:false");
+  const dateMs = Date.parse(trimmed);
+  if (!Number.isNaN(dateMs)) {
+    return Math.max(0, dateMs - now);
   }
-  const doFetch = args.fetch ?? globalThis.fetch;
-  const putHeaders = {
-    "content-type": args.contentType ?? "application/zip",
-    ...presign.requiredHeaders ?? {}
-  };
-  await putWithRetry(doFetch, presign.uploadUrl, {
-    method: "PUT",
-    headers: putHeaders,
-    body: args.bytes
-  });
-  const fin = await args.http.request("/assets/finalize", {
-    method: "POST",
-    headers: { "content-type": "application/json" },
-    body: JSON.stringify({ hash: contentHashHeader, sizeBytes: args.bytes.byteLength })
+  return void 0;
+}
+function computeRetryBackoffDelayMs(config, attemptNumber, random) {
+  const exponent = Math.max(0, attemptNumber - 1);
+  const nominal = Math.min(config.maxDelayMs, config.initialDelayMs * 2 ** exponent);
+  return Math.round(random() * nominal);
+}
+function computeRetryDelayMs(config, attemptNumber, random, retryAfterMs) {
+  const backoff = computeRetryBackoffDelayMs(config, attemptNumber, random);
+  return retryAfterMs === void 0 ? backoff : Math.max(retryAfterMs, backoff);
+}
+function abortableSleep(ms, signal) {
+  return new Promise((resolve, reject) => {
+    if (signal?.aborted) {
+      reject(abortReason(signal));
+      return;
+    }
+    const timer = setTimeout(() => {
+      signal?.removeEventListener("abort", onAbort);
+      resolve();
+    }, ms);
+    const onAbort = () => {
+      clearTimeout(timer);
+      reject(signal ? abortReason(signal) : makeAbortError());
+    };
+    signal?.addEventListener("abort", onAbort, { once: true });
   });
-  const contentHash = fin.contentHash ?? presign.contentHash ?? contentHashHeader;
-  return {
-    assetId: fin.assetId ?? presign.assetId ?? assetIdFromContentHash(contentHash),
-    contentHash,
-    sizeBytes: fin.sizeBytes ?? args.bytes.byteLength,
-    exists: false
-  };
 }
-async function computeSha256Hex(bytes) {
-  const subtle = globalThis.crypto?.subtle;
-  if (!subtle) {
-    throw new Error("uploadAsset: globalThis.crypto.subtle is not available; Bun, Node 18+, or a Web-Crypto-capable runtime is required");
-  }
-  const digest = await subtle.digest("SHA-256", bytes);
-  return bufferToHex(digest);
+function abortReason(signal) {
+  return signal.reason instanceof Error ? signal.reason : makeAbortError();
 }
-function assetIdFromContentHash(contentHash) {
-  const hex = contentHash.startsWith("sha256:") ? contentHash.slice("sha256:".length) : contentHash;
-  return `asset_${hex}`;
+function makeAbortError() {
+  if (typeof DOMException !== "undefined")
+    return new DOMException("Aborted", "AbortError");
+  const err2 = new Error("Aborted");
+  err2.name = "AbortError";
+  return err2;
 }
-async function putWithRetry(fetchImpl, uploadUrl, init) {
-  for (let attempt = 1; attempt <= DIRECT_UPLOAD_MAX_ATTEMPTS; attempt++) {
+
+// ../contracts/dist/asset-upload-helper.js
+var DIRECT_UPLOAD_MAX_ATTEMPTS = 3;
+var DIRECT_UPLOAD_INITIAL_DELAY_MS = 500;
+var DIRECT_UPLOAD_MAX_DELAY_MS = 5e3;
+var DIRECT_UPLOAD_MAX_ELAPSED_MS = 3e4;
+async function putDirectUploadWithRetry(fetchImpl, uploadUrl, init, options = {}) {
+  const config = resolveAssetUploadRetryConfig(options);
+  const sleep5 = options.sleep ?? abortableSleep;
+  const random = options.random ?? Math.random;
+  const now = options.now ?? Date.now;
+  const startedAt = now();
+  for (let attempt = 1; attempt <= config.maxAttempts; attempt++) {
     let response;
     try {
       response = await fetchImpl(uploadUrl, init);
     } catch (err2) {
-      if (attempt < DIRECT_UPLOAD_MAX_ATTEMPTS && isRetryableUploadError(err2)) {
+      if (attempt < config.maxAttempts && isRetryableUploadError(err2)) {
+        const delay = directUploadRetryDelayMs(config, attempt, random, void 0);
+        if (!withinDirectUploadRetryBudget(config, startedAt, delay, now)) {
+          throw directUploadNetworkError(uploadUrl, err2, attempt);
+        }
+        await sleep5(delay, init.signal ?? void 0);
         continue;
       }
       throw directUploadNetworkError(uploadUrl, err2, attempt);
     }
     if (response.ok)
       return;
-    if (attempt < DIRECT_UPLOAD_MAX_ATTEMPTS && isRetryableUploadStatus(response.status)) {
+    const retryAfterMs = parseRetryAfterMs(response.headers?.get("retry-after"), now());
+    if (attempt < config.maxAttempts && isRetryableUploadStatus(response.status)) {
+      const delay = directUploadRetryDelayMs(config, attempt, random, retryAfterMs);
+      if (!withinDirectUploadRetryBudget(config, startedAt, delay, now)) {
+        const detail2 = await response.text().catch(() => "");
+        throw directUploadResponseError(uploadUrl, response.status, detail2, attempt);
+      }
       await response.text().catch(() => "");
+      await sleep5(delay, init.signal ?? void 0);
       continue;
     }
     const detail = await response.text().catch(() => "");
     throw directUploadResponseError(uploadUrl, response.status, detail, attempt);
   }
 }
+function resolveAssetUploadRetryConfig(options = {}) {
+  const maxAttempts = Math.max(1, Math.floor(options.maxAttempts ?? DIRECT_UPLOAD_MAX_ATTEMPTS));
+  const initialDelayMs = Math.max(0, options.initialDelayMs ?? DIRECT_UPLOAD_INITIAL_DELAY_MS);
+  const maxDelayMs = Math.max(initialDelayMs, options.maxDelayMs ?? DIRECT_UPLOAD_MAX_DELAY_MS);
+  const maxElapsedMs = Math.max(0, options.maxElapsedMs ?? DIRECT_UPLOAD_MAX_ELAPSED_MS);
+  return { maxAttempts, initialDelayMs, maxDelayMs, maxElapsedMs };
+}
+function directUploadRetryDelayMs(config, attempt, random, retryAfterMs) {
+  return computeRetryDelayMs(config, attempt, random, retryAfterMs);
+}
+function withinDirectUploadRetryBudget(config, startedAt, delayMs, now) {
+  return now() - startedAt + delayMs <= config.maxElapsedMs;
+}
 function isRetryableUploadStatus(status) {
   return status === 408 || status === 425 || status === 429 || status >= 500 && status <= 599;
 }
@@ -4560,6 +4713,9 @@ function directUploadResponseError(uploadUrl, status, detail, attempts) {
   const safeDetail = sanitizeUploadText(detail).slice(0, 500);
   return new Error(`uploadAsset: direct upload PUT failed for ${safeUrl} with status ${status}` + (attempts > 1 ? ` after ${attemptsLabel(attempts)}` : "") + (safeDetail ? `: ${safeDetail}` : ""));
 }
+function sanitizeUploadText(text) {
+  return text.replace(/https?:\/\/[^\s<>"'`]+/g, (raw) => redactUrlPreservingTrailingPunctuation(raw)).replace(/\b(?:X-Amz-(?:Algorithm|Credential|Date|Expires|Security-Token|Signature|SignedHeaders)|AWSAccessKeyId|Signature|Credential|Security-Token|AccessKeyId|SecretAccessKey|SessionToken)=([^&\s<>"'`]+)/gi, "[redacted]").replace(/\bAKIA[0-9A-Z]{8,}\b/g, "[redacted]");
+}
 function attemptsLabel(attempts) {
   return attempts === 1 ? "1 attempt" : `${attempts} attempts`;
 }
@@ -4579,14 +4735,75 @@ function stringProperty2(value, key) {
   const prop = value[key];
   return typeof prop === "string" && prop.length > 0 ? prop : void 0;
 }
-function sanitizeUploadText(text) {
-  return text.replace(/https?:\/\/[^\s<>"'`]+/g, (raw) => redactUrlPreservingTrailingPunctuation(raw)).replace(/\b(?:X-Amz-(?:Algorithm|Credential|Date|Expires|Security-Token|Signature|SignedHeaders)|AWSAccessKeyId|Signature|Credential|Security-Token|AccessKeyId|SecretAccessKey|SessionToken)=([^&\s<>"'`]+)/gi, "[redacted]").replace(/\bAKIA[0-9A-Z]{8,}\b/g, "[redacted]");
-}
 function redactUrlPreservingTrailingPunctuation(raw) {
   const trailing = raw.match(/[),.;:!?]+$/)?.[0] ?? "";
   const candidate = trailing ? raw.slice(0, -trailing.length) : raw;
   return `${redactUrl(candidate)}${trailing}`;
 }
+
+// ../contracts/dist/post-hook.js
+var DEFAULT_POST_HOOK_TIMEOUT_MS = 5 * 60 * 1e3;
+
+// ../contracts/dist/internal.js
+async function uploadAsset(args) {
+  const expected = args.hash.startsWith("sha256:") ? args.hash.slice("sha256:".length) : args.hash;
+  const actual = await computeSha256Hex(args.bytes);
+  if (actual !== expected) {
+    throw new Error(`uploadAsset: client-side hash mismatch: computed sha256:${actual} but caller declared ${args.hash}. Aborting to avoid uploading corrupted data.`);
+  }
+  const contentHashHeader = `sha256:${actual}`;
+  const presign = await args.http.request("/assets/presign", {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ hash: contentHashHeader, sizeBytes: args.bytes.byteLength })
+  });
+  if (presign.exists) {
+    const contentHash2 = presign.contentHash ?? contentHashHeader;
+    return {
+      assetId: presign.assetId ?? assetIdFromContentHash(contentHash2),
+      contentHash: contentHash2,
+      sizeBytes: presign.sizeBytes ?? args.bytes.byteLength,
+      exists: true
+    };
+  }
+  if (!presign.uploadUrl) {
+    throw new Error("uploadAsset: presign returned no uploadUrl and exists:false");
+  }
+  const doFetch = args.fetch ?? globalThis.fetch;
+  const putHeaders = {
+    "content-type": args.contentType ?? "application/zip",
+    ...presign.requiredHeaders ?? {}
+  };
+  await putDirectUploadWithRetry(doFetch, presign.uploadUrl, {
+    method: "PUT",
+    headers: putHeaders,
+    body: args.bytes
+  }, args.retry);
+  const fin = await args.http.request("/assets/finalize", {
+    method: "POST",
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ hash: contentHashHeader, sizeBytes: args.bytes.byteLength })
+  });
+  const contentHash = fin.contentHash ?? presign.contentHash ?? contentHashHeader;
+  return {
+    assetId: fin.assetId ?? presign.assetId ?? assetIdFromContentHash(contentHash),
+    contentHash,
+    sizeBytes: fin.sizeBytes ?? args.bytes.byteLength,
+    exists: false
+  };
+}
+async function computeSha256Hex(bytes) {
+  const subtle = globalThis.crypto?.subtle;
+  if (!subtle) {
+    throw new Error("uploadAsset: globalThis.crypto.subtle is not available; Bun, Node 18+, or a Web-Crypto-capable runtime is required");
+  }
+  const digest = await subtle.digest("SHA-256", bytes);
+  return bufferToHex(digest);
+}
+function assetIdFromContentHash(contentHash) {
+  const hex = contentHash.startsWith("sha256:") ? contentHash.slice("sha256:".length) : contentHash;
+  return `asset_${hex}`;
+}
 function bufferToHex(buffer) {
   const view = new Uint8Array(buffer);
   let out = "";

package/dist/cli.mjs.sha256

@@ -1 +1 @@
-a67b2cbba2818c579806f112ebfbfddb975b028d0950381985e0e6aa73d259ee  cli.mjs
+cdab07311ba092bc586f1d536208b0ca762c2014ddfb8f4219beb21a6302b59b  cli.mjs

package/dist/client.d.ts

@@ -555,6 +555,11 @@ export type OutputFileSelector = Output | OutputFileIdSelector | OutputFilePathS
 export type OutputLinkSelector = string | OutputFileSelector | OutputQuery;
 export interface OutputDownloadOptions {
     readonly to?: string;
+    /**
+     * Per-attempt timeout for fetching and reading the selected output body.
+     * Defaults to 15_000ms; idempotent output downloads retry once on timeout.
+     */
+    readonly timeoutMs?: number;
 }
 /**
  * Workspace AgentsMd admin operations exposed under `client.agentsMd`.

package/dist/client.js

@@ -746,9 +746,10 @@ function isSessionEnvelopeTerminal(event) {
 async function downloadSessionOutput(http, id, selector, options) {
     // One selector-resolution path: the contracts `downloadOutput` lists-if-path
     // then downloads, throwing with PUBLIC verb names — no duplicated resolver.
+    const transferOptions = options?.timeoutMs === undefined ? undefined : { timeoutMs: options.timeoutMs };
     const bytes = selector === undefined
-        ? await operations.downloadOutputs(http, id)
-        : (await operations.downloadOutput(http, id, selector)).bytes;
+        ? await operations.downloadOutputs(http, id, transferOptions)
+        : (await operations.downloadOutput(http, id, selector, transferOptions)).bytes;
     return writeOptionalFile(bytes, options?.to);
 }
 /**
@@ -1766,11 +1767,9 @@ export class Aex {
  * Resolve the effective `baseUrl` from a self-describing API key (ZERO-network):
  *   - key omitted-of-shape (opaque/legacy): return the caller's `baseUrl`
  *     unchanged (HttpClient falls back to the prd default).
- *   - `baseUrl` omitted: DERIVE it from the key's plane; a plane with no default
- *     host (dev) requires an explicit `baseUrl` — throw with that guidance.
+ *   - `baseUrl` omitted: DERIVE it from the key's plane.
  *   - `baseUrl` supplied but its plane DISAGREES with the key's plane: throw
- *     {@link CredentialValidationError} BEFORE any request (the exact `dev key
- *     against the prd default → bare token_invalid` trap).
+ *     {@link CredentialValidationError} BEFORE any request.
  */
 function resolveBaseUrlForKey(apiKey, baseUrl) {
     const parsed = parseApiKey(apiKey);
@@ -1778,15 +1777,11 @@ function resolveBaseUrlForKey(apiKey, baseUrl) {
         return baseUrl;
     const planeUrl = PLANE_BASE_URLS[parsed.plane];
     if (baseUrl === undefined) {
-        if (planeUrl === null) {
-            throw new CredentialValidationError(`Aex: this API key is for the ${parsed.plane} plane, which has no default host — pass baseUrl explicitly.`, { plane: parsed.plane });
-        }
         return planeUrl;
     }
-    // The only client-detectable mismatch: a non-prd key pointed at the canonical
-    // prd host (dev has no canonical host to compare a prd key against).
-    if (baseUrl === PLANE_BASE_URLS.prd && parsed.plane !== "prd") {
-        throw new CredentialValidationError(`Aex: this API key is for the ${parsed.plane} plane but baseUrl targets the prd plane (${PLANE_BASE_URLS.prd}) — ` +
+    const canonicalPlane = baseUrl === PLANE_BASE_URLS.dev ? "dev" : baseUrl === PLANE_BASE_URLS.prd ? "prd" : undefined;
+    if (canonicalPlane !== undefined && canonicalPlane !== parsed.plane) {
+        throw new CredentialValidationError(`Aex: this API key is for the ${parsed.plane} plane but baseUrl targets the ${canonicalPlane} plane (${baseUrl}) — ` +
             `pass the ${parsed.plane} plane baseUrl, or omit baseUrl to auto-route.`, { plane: parsed.plane, baseUrl });
     }
     return baseUrl;