@aexhq/sdk 0.13.10 → 0.15.0

package/README.md

@@ -30,6 +30,7 @@ aex cancel  <run-id>             --api-token …
 aex delete  <run-id>             --api-token …
 aex whoami                       --api-token …
 aex skills  <upload|list|get|delete> [flags] --api-token …
+aex delete-asset <assetId|hash>  --api-token …
 ```
 
 The SDK class and the CLI are backed by the same public `@aexhq/contracts` operations module — any read or write you can do through one, you can do through the other, against the same durable run records. The same npm package also ships the in-container `aex` CLI as its `bin` entry; managed runs mount that CLI inside the runner so skills can call `aex proxy …` against the per-run manifest. See [product capabilities and boundaries](docs/product-boundaries.md).
@@ -102,7 +103,7 @@ Stream events live with `aex.stream(runId)`:
 
 ```ts
 for await (const event of aex.stream(runId)) {
-  if (event.type === "agent.message") {
+  if (event.type === "TEXT_MESSAGE_CONTENT") {
     // typed event helpers live under `aex`'s event guard exports.
   }
 }

package/dist/_contracts/run-config.js

@@ -428,9 +428,11 @@ export function rejectStdioMcpShape(record) {
 /**
  * Reasons an IP-literal host should be refused. Returns null when the
  * literal is a routable public address (or not an IP literal at all — name
- * resolution is the caller's concern). Single source of truth for the
- * numeric-range deny-list so the shared MCP parser, the Worker BYOK proxy
- * handlers, and `submission.parseProxyBaseUrl` classify the same bytes.
+ * resolution is the caller's concern). This in-package copy of the
+ * numeric-range deny-list is kept byte-identical to
+ * platform/packages/shared/src/blueprint.ts by the contract-parity gate, so
+ * the shared MCP parser, the Worker BYOK proxy handlers, and
+ * `submission.parseProxyBaseUrl` all classify the same bytes.
  *
  * `host` is the already-bracket-stripped, lowercased hostname.
  *

package/dist/client.d.ts

@@ -1,5 +1,6 @@
 import { HttpClient, type AexEvent, type AgentsMdRecord, type CredentialMode, type DebugSink, type FetchLike, type FileRecord, type Output, type OutputMode, type PlatformSubmission, type PlatformInlineSecrets, type PlatformProxyEndpoint, type PlatformProxyEndpointAuth, type Run, type RunEvent, type RunProvider, type RunUnit, type RuntimeSize, type RuntimeKind, type SignedOutputLink, type Skill as SkillRecord, type WhoAmI } from "./_contracts/index.js";
 import { AgentsMd } from "./agents-md.js";
+import { type UploadedAsset } from "./asset-upload.js";
 import { File } from "./file.js";
 import { McpServer } from "./mcp-server.js";
 import { ProxyEndpoint } from "./proxy-endpoint.js";
@@ -275,10 +276,10 @@ export declare class AgentExecutor {
      * NOTE (tech-debt): this is part of the legacy workspace-skill upload
      * surface (`SkillsClient` + `operations.createSkillBundle` + the TUS
      * chunked path in asset-upload.ts). The live submit path materializes
-     * inline skills via `uploadAsset` instead; `Skill` no longer
-     * exposes `.upload()`/`.fromId()`. This surface is retained pending a
-     * deliberate deprecation pass (it still threads into the CLI host
-     * commands), tracked in the remediation plan as item 4a.
+     * inline skills via `uploadAsset` instead; `Skill.upload(client)`
+     * pre-stages a draft explicitly for reuse. This surface is retained
+     * pending a deliberate deprecation pass (it still threads into the CLI
+     * host commands), tracked in the remediation plan as item 4a.
      */
     _uploadSkillBundle(args: {
         readonly name: string;
@@ -302,6 +303,17 @@ export declare class AgentExecutor {
         readonly name: string;
         readonly bytes: Uint8Array;
     }): Promise<FileRecord>;
+    /**
+     * Internal: materialize raw bytes to the content-addressable asset store
+     * (`/assets/presign` → PUT → `/assets/finalize`). Used by `Skill.upload(this)`
+     * to pre-upload a draft skill bundle so a later run carries only a plain
+     * `kind:"asset"` ref. NOT part of the public API.
+     */
+    _uploadAsset(args: {
+        readonly bytes: Uint8Array;
+        readonly hash: string;
+        readonly contentType?: string;
+    }): Promise<UploadedAsset>;
     /**
      * Submit a run and wait for it to reach a terminal state. Returns the
      * final `Run` record. For long-running flows, prefer `submitRun` +
@@ -317,15 +329,12 @@ export declare class AgentExecutor {
      * before sending so credentials never enter the hashed submission or
      * the run snapshot.
      *
-     * Unstaged inline skills (`Skill.fromFiles` / `Skill.fromPath`
-     * without a prior `.upload`) are accepted: the SDK switches to a
-     * multipart body that carries the canonical zip bytes alongside the
-     * JSON submission. The dashboard BFF ingests each one through the
-     * standard workspace-skill upload pipeline (dedup by content hash;
-     * upload via the existing two-phase pending → ready flow) and
-     * rewrites the run's `skills[]` to reference the resulting `skl_*`
-     * ids. The bytes persist on aex; the user can browse and
-     * download the resulting workspace skill from the dashboard.
+     * Unstaged inline skills / agentsMd / files (`Skill.fromFiles` /
+     * `Skill.fromPath` / `AgentsMd.fromContent` / `File.fromBytes` without a
+     * prior `.upload`) are auto-uploaded to the content-addressable asset
+     * store (`/assets/presign` → PUT → `/assets/finalize`) before `POST /runs`,
+     * deduped by content hash, and referenced in the submission as plain
+     * `{ kind:"asset" }` refs — identical to a pre-staged `.upload(client)`.
      */
     submitRun(options: SubmitRunOptions): Promise<string>;
     getRun(runId: string): Promise<Run>;