@aexhq/sdk 0.13.8 → 0.13.10

package/dist/index.d.ts

@@ -21,7 +21,7 @@ export { AexApiError, AexError, CleanupError, CredentialValidationError, Provide
 export { MCP_SERVER_NAME_PATTERN, SKILL_BUNDLE_LIMITS, SkillBundleValidationError, buildPlatformAllowedHosts, normaliseSkillBundlePath, validateSkillBundleEntry, validateSkillBundleManifest, validateProxyAuth } from "./_contracts/index.js";
 export type { AssetRef, AgentsMdRef, FileRef, McpServerRef, SkillBundleEntry, SkillBundleManifest, SkillRef } from "./_contracts/index.js";
 export type { AgentsMdRecord as AgentsMdRecordWire, FileRecord as FileRecordWire, Output, ProviderEvent, Run, RunRecordArchiveFileV1, RunRecordArchiveFileRoleV1, RunRecordArchiveNamespaceV1, RunRecordCostV1, RunRecordDownloadErrorV1, RunRecordFileStatusV1, RunRecordManifestV1, RunRecordMetadataV1, RunRecordNamespaceV1, RunRecordSubmissionSnapshotV1, RunRecordV1, RunEvent, RuntimeManifest, RuntimeProvider, SignedOutputLink, Skill as SkillRecord, UsageSummary, WhoAmI } from "./_contracts/index.js";
-export type { PlatformAnthropicSecrets as AnthropicSecrets, PlatformInlineSecrets as InlineSecrets, PlatformMcpServerSecret as McpServerSecret, PlatformProxyEndpoint, PlatformProxyEndpointAuth, PlatformProxyAuthValue as ProxyAuthValue, PlatformEnvironment as RunEnvironment, PlatformRunSubmissionRequest, ProxyAuthShape, ProxyMethod, ProxyResponseMode } from "./_contracts/index.js";
+export type { PlatformInlineSecrets as InlineSecrets, PlatformMcpServerSecret as McpServerSecret, PlatformProxyEndpoint, PlatformProxyEndpointAuth, PlatformProxyAuthValue as ProxyAuthValue, PlatformEnvironment as RunEnvironment, PlatformRunSubmissionRequest, ProxyAuthShape, ProxyMethod, ProxyResponseMode } from "./_contracts/index.js";
 export { CUSTODY_MANIFEST_SCHEMA_VERSION, RUN_RECORD_MANIFEST_SCHEMA_VERSION, RUN_RECORD_SCHEMA_VERSION, DEFAULT_RUNTIME_SIZE, RUNTIME_SIZE_PRESETS, RUNTIME_SIZES, RuntimeSizes } from "./_contracts/index.js";
 export type { RuntimeResources, RuntimeSize } from "./_contracts/index.js";
 export { CREDENTIAL_MODES, DEFAULT_CREDENTIAL_MODE, collectManagedUnsupportedFeatures, DEFAULT_RUN_PROVIDER, RUN_PROVIDERS, RUNTIME_KINDS, RUNTIME_VALIDATION_CODES, RuntimeValidationError, selectRuntime } from "./_contracts/index.js";

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAYvF,yBAAyB;AACzB,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAQpD,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAGhE,SAAS;AACT,OAAO,EACL,WAAW,EACX,QAAQ,EACR,YAAY,EACZ,yBAAyB,EACzB,aAAa,EACb,aAAa,EACd,MAAM,kBAAkB,CAAC;AAE1B,yBAAyB;AACzB,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,0BAA0B,EAC1B,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EACxB,2BAA2B,EAC3B,iBAAiB,EAClB,MAAM,kBAAkB,CAAC;AA0D1B,oEAAoE;AACpE,6EAA6E;AAC7E,6DAA6D;AAC7D,OAAO,EACL,+BAA+B,EAC/B,kCAAkC,EAClC,yBAAyB,EACzB,oBAAoB,EACpB,oBAAoB,EACpB,aAAa,EACb,YAAY,EACb,MAAM,kBAAkB,CAAC;AAG1B,gEAAgE;AAChE,mEAAmE;AACnE,sDAAsD;AACtD,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,iCAAiC,EACjC,oBAAoB,EACpB,aAAa,EACb,aAAa,EACb,wBAAwB,EACxB,sBAAsB,EACtB,aAAa,EACd,MAAM,kBAAkB,CAAC;AAQ1B,sCAAsC;AACtC,OAAO,EACL,QAAQ,EACR,cAAc,EACd,YAAY,EACZ,KAAK,EACL,UAAU,EACV,aAAa,EACb,YAAY,EACZ,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,eAAe,EAChB,MAAM,kBAAkB,CAAC;AAE1B,mBAAmB;AACnB,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAYvF,yBAAyB;AACzB,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAQpD,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAGhE,SAAS;AACT,OAAO,EACL,WAAW,EACX,QAAQ,EACR,YAAY,EACZ,yBAAyB,EACzB,aAAa,EACb,aAAa,EACd,MAAM,kBAAkB,CAAC;AAE1B,yBAAyB;AACzB,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,0BAA0B,EAC1B,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EACxB,2BAA2B,EAC3B,iBAAiB,EAClB,MAAM,kBAAkB,CAAC;AAyD1B,oEAAoE;AACpE,6EAA6E;AAC7E,6DAA6D;AAC7D,OAAO,EACL,+BAA+B,EAC/B,kCAAkC,EAClC,yBAAyB,EACzB,oBAAoB,EACpB,oBAAoB,EACpB,aAAa,EACb,YAAY,EACb,MAAM,kBAAkB,CAAC;AAG1B,gEAAgE;AAChE,mEAAmE;AACnE,sDAAsD;AACtD,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,iCAAiC,EACjC,oBAAoB,EACpB,aAAa,EACb,aAAa,EACb,wBAAwB,EACxB,sBAAsB,EACtB,aAAa,EACd,MAAM,kBAAkB,CAAC;AAQ1B,sCAAsC;AACtC,OAAO,EACL,QAAQ,EACR,cAAc,EACd,YAAY,EACZ,KAAK,EACL,UAAU,EACV,aAAa,EACb,YAAY,EACZ,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,eAAe,EAChB,MAAM,kBAAkB,CAAC;AAE1B,mBAAmB;AACnB,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/version.d.ts

@@ -6,4 +6,4 @@
  *
  * Used by the (future) User-Agent header on outbound SDK requests.
  */
-export declare const SDK_VERSION = "0.13.8";
+export declare const SDK_VERSION = "0.13.10";

package/dist/version.js

@@ -6,5 +6,5 @@
  *
  * Used by the (future) User-Agent header on outbound SDK requests.
  */
-export const SDK_VERSION = "0.13.8";
+export const SDK_VERSION = "0.13.10";
 //# sourceMappingURL=version.js.map

package/dist/version.js.map

@@ -1 +1 @@
-{"version":3,"file":"version.js","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,QAAQ,CAAC"}
+{"version":3,"file":"version.js","sourceRoot":"","sources":["../src/version.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,WAAW,GAAG,SAAS,CAAC"}

package/docs/cleanup.md

@@ -18,7 +18,7 @@ retention field is rejected if supplied.
 const runId = await aex.submitRun({
   model: "claude-haiku-4-5",
   prompt: "...",
-  secrets: { anthropic: { apiKey: process.env.ANTHROPIC_API_KEY! } }
+  secrets: { apiKey: process.env.ANTHROPIC_API_KEY! }
 });
 ```
 

package/docs/credentials.md

@@ -6,19 +6,15 @@ title: Credentials
 
 aex does not store provider keys or MCP credential values across runs.
 
-The caller passes a workspace-scoped SDK token and exactly one matching provider key inline on every `submitRun` call. aex holds the bundle in run-scoped custody for the run lifecycle and attempts terminal cleanup/revocation for the aex-controlled references. MCP credentials and proxy endpoint auth values travel the same way.
+The caller passes a workspace-scoped SDK token and the provider key inline on every `submitRun` call. aex holds the bundle in run-scoped custody for the run lifecycle and attempts terminal cleanup/revocation for the aex-controlled references. MCP credentials and proxy endpoint auth values travel the same way.
 
-Provider keys are coupled to the submitted `provider`:
+A run targets exactly one provider (selected by `provider`, default `anthropic`), so the key is a single flat field:
 
-| `provider` | Required secret |
+| Field | Required secret |
 | --- | --- |
-| `anthropic` | `secrets.anthropic.apiKey` |
-| `deepseek` | `secrets.deepseek.apiKey` |
-| `openai` | `secrets.openai.apiKey` |
-| `gemini` | `secrets.gemini.apiKey` |
-| `mistral` | `secrets.mistral.apiKey` |
+| Provider API key | `secrets.apiKey` |
 
-Supplying a key for any other provider is rejected at submission time.
+The same `secrets.apiKey` carries the BYOK key for whichever `provider` the run selects.
 
 MCP credential types:
 
@@ -81,7 +77,7 @@ const runId = await aex.submitRun({
   prompt: "…",
   proxyEndpoints,
   secrets: {
-    anthropic: { apiKey: process.env.ANTHROPIC_API_KEY! },
+    apiKey: process.env.ANTHROPIC_API_KEY!,
     proxyEndpointAuth
   }
 });
@@ -117,7 +113,7 @@ const runId = await aex.submitRun({
   model: "claude-haiku-4-5",
   prompt: "…",
   proxyEndpoints,
-  secrets: { anthropic: { apiKey: process.env.ANTHROPIC_API_KEY! } }
+  secrets: { apiKey: process.env.ANTHROPIC_API_KEY! }
 });
 ```
 

package/docs/outputs.md

@@ -12,7 +12,7 @@ Every run produces durable metadata (status, events, snapshots, cleanup state) a
 const runId = await aex.submitRun({
   model: "claude-haiku-4-5",
   prompt: "Produce a report and save it as a file.",
-  secrets: { anthropic: { apiKey } }
+  secrets: { apiKey }
 });
 
 await aex.wait(runId);

package/docs/provider-runtime-capabilities.md

@@ -18,8 +18,8 @@ Status vocabulary: `supported`, `live-unverified`, `rejected`.
 
 | Provider | Wire value | Status | Docs | Evidence |
 | --- | --- | --- | --- | --- |
-| [Anthropic](#anthropic) | `anthropic` | supported | [Credentials](credentials.md); [Events](events.md) | [Submission parser and routing parity](../../contracts/test/submission.test.ts); [Runtime support validator](../../contracts/test/runtime-support.test.ts); [Generated matrix freshness](../../../scripts/validate/capability-matrix.test.ts); [Installed-SDK live user matrix](../../../apps/user-tests/test/live/live-sdk-comprehensive.test.ts); [Runtime support validator](../../contracts/test/runtime-support.test.ts) |
-| [DeepSeek](#deepseek) | `deepseek` | supported | [Credentials](credentials.md); [Events](events.md) | [Submission parser and routing parity](../../contracts/test/submission.test.ts); [Runtime support validator](../../contracts/test/runtime-support.test.ts); [Generated matrix freshness](../../../scripts/validate/capability-matrix.test.ts); [Installed-SDK live user matrix](../../../apps/user-tests/test/live/live-sdk-comprehensive.test.ts); [Runtime support validator](../../contracts/test/runtime-support.test.ts) |
+| [Anthropic](#anthropic) | `anthropic` | supported | [Credentials](credentials.md); [Events](events.md) | [Submission parser and routing parity](../../contracts/test/submission.test.ts); [Runtime support validator](../../contracts/test/runtime-support.test.ts); [Generated matrix freshness](../../../scripts/validate/capability-matrix.test.ts); [Installed-SDK Anthropic live user test](../../../apps/user-tests/test/live/live-sdk-anthropic-managed.test.ts); [Runtime support validator](../../contracts/test/runtime-support.test.ts) |
+| [DeepSeek](#deepseek) | `deepseek` | supported | [Credentials](credentials.md); [Events](events.md) | [Submission parser and routing parity](../../contracts/test/submission.test.ts); [Runtime support validator](../../contracts/test/runtime-support.test.ts); [Generated matrix freshness](../../../scripts/validate/capability-matrix.test.ts); [Installed-SDK DeepSeek live user test](../../../apps/user-tests/test/live/live-sdk-deepseek.test.ts); [Installed-SDK DeepSeek comprehensive live user matrix](../../../apps/user-tests/test/live/live-sdk-comprehensive.test.ts); [Runtime support validator](../../contracts/test/runtime-support.test.ts) |
 | [OpenAI](#openai) | `openai` | live-unverified | [Credentials](credentials.md); [Events](events.md) | [Submission parser and routing parity](../../contracts/test/submission.test.ts); [Runtime support validator](../../contracts/test/runtime-support.test.ts); [Generated matrix freshness](../../../scripts/validate/capability-matrix.test.ts) |
 | [Gemini](#gemini) | `gemini` | live-unverified | [Credentials](credentials.md); [Events](events.md) | [Submission parser and routing parity](../../contracts/test/submission.test.ts); [Runtime support validator](../../contracts/test/runtime-support.test.ts); [Generated matrix freshness](../../../scripts/validate/capability-matrix.test.ts) |
 | [Mistral](#mistral) | `mistral` | live-unverified | [Credentials](credentials.md); [Events](events.md) | [Submission parser and routing parity](../../contracts/test/submission.test.ts); [Runtime support validator](../../contracts/test/runtime-support.test.ts); [Generated matrix freshness](../../../scripts/validate/capability-matrix.test.ts) |
@@ -38,8 +38,8 @@ Status vocabulary: `supported`, `live-unverified`, `rejected`.
 
 | Provider | Runtime | Status | Ownership | Enforcement path | Evidence |
 | --- | --- | --- | --- | --- | --- |
-| `anthropic` | `managed` | supported | supported | submission parser + managed dispatch | [Installed-SDK live user matrix](../../../apps/user-tests/test/live/live-sdk-comprehensive.test.ts); [Runtime support validator](../../contracts/test/runtime-support.test.ts) |
-| `deepseek` | `managed` | supported | supported | submission parser + managed dispatch | [Installed-SDK live user matrix](../../../apps/user-tests/test/live/live-sdk-comprehensive.test.ts); [Runtime support validator](../../contracts/test/runtime-support.test.ts) |
+| `anthropic` | `managed` | supported | supported | submission parser + managed dispatch | [Installed-SDK Anthropic live user test](../../../apps/user-tests/test/live/live-sdk-anthropic-managed.test.ts); [Runtime support validator](../../contracts/test/runtime-support.test.ts) |
+| `deepseek` | `managed` | supported | supported | submission parser + managed dispatch | [Installed-SDK DeepSeek live user test](../../../apps/user-tests/test/live/live-sdk-deepseek.test.ts); [Installed-SDK DeepSeek comprehensive live user matrix](../../../apps/user-tests/test/live/live-sdk-comprehensive.test.ts); [Runtime support validator](../../contracts/test/runtime-support.test.ts) |
 | `openai` | `managed` | live-unverified | live-unverified | submission parser + managed dispatch | [Submission parser and routing parity](../../contracts/test/submission.test.ts); [Runtime support validator](../../contracts/test/runtime-support.test.ts); [Generated matrix freshness](../../../scripts/validate/capability-matrix.test.ts) |
 | `gemini` | `managed` | live-unverified | live-unverified | submission parser + managed dispatch | [Submission parser and routing parity](../../contracts/test/submission.test.ts); [Runtime support validator](../../contracts/test/runtime-support.test.ts); [Generated matrix freshness](../../../scripts/validate/capability-matrix.test.ts) |
 | `mistral` | `managed` | live-unverified | live-unverified | submission parser + managed dispatch | [Submission parser and routing parity](../../contracts/test/submission.test.ts); [Runtime support validator](../../contracts/test/runtime-support.test.ts); [Generated matrix freshness](../../../scripts/validate/capability-matrix.test.ts) |
@@ -68,7 +68,7 @@ Notes:
 - Public status: supported
 - Auto route: `managed`
 - Docs: [Credentials](credentials.md); [Events](events.md)
-- Evidence: [Submission parser and routing parity](../../contracts/test/submission.test.ts); [Runtime support validator](../../contracts/test/runtime-support.test.ts); [Generated matrix freshness](../../../scripts/validate/capability-matrix.test.ts); [Installed-SDK live user matrix](../../../apps/user-tests/test/live/live-sdk-comprehensive.test.ts); [Runtime support validator](../../contracts/test/runtime-support.test.ts)
+- Evidence: [Submission parser and routing parity](../../contracts/test/submission.test.ts); [Runtime support validator](../../contracts/test/runtime-support.test.ts); [Generated matrix freshness](../../../scripts/validate/capability-matrix.test.ts); [Installed-SDK Anthropic live user test](../../../apps/user-tests/test/live/live-sdk-anthropic-managed.test.ts); [Runtime support validator](../../contracts/test/runtime-support.test.ts)
 
 ### DeepSeek
 
@@ -76,7 +76,7 @@ Notes:
 - Public status: supported
 - Auto route: `managed`
 - Docs: [Credentials](credentials.md); [Events](events.md)
-- Evidence: [Submission parser and routing parity](../../contracts/test/submission.test.ts); [Runtime support validator](../../contracts/test/runtime-support.test.ts); [Generated matrix freshness](../../../scripts/validate/capability-matrix.test.ts); [Installed-SDK live user matrix](../../../apps/user-tests/test/live/live-sdk-comprehensive.test.ts); [Runtime support validator](../../contracts/test/runtime-support.test.ts)
+- Evidence: [Submission parser and routing parity](../../contracts/test/submission.test.ts); [Runtime support validator](../../contracts/test/runtime-support.test.ts); [Generated matrix freshness](../../../scripts/validate/capability-matrix.test.ts); [Installed-SDK DeepSeek live user test](../../../apps/user-tests/test/live/live-sdk-deepseek.test.ts); [Installed-SDK DeepSeek comprehensive live user matrix](../../../apps/user-tests/test/live/live-sdk-comprehensive.test.ts); [Runtime support validator](../../contracts/test/runtime-support.test.ts)
 
 ### OpenAI
 

package/docs/quickstart.md

@@ -19,7 +19,7 @@ const aex = new AgentExecutor({
 const runId = await aex.submitRun({
   model: "claude-haiku-4-5",
   prompt: "Write a short answer about agent-first SDK design.",
-  secrets: { anthropic: { apiKey: process.env.ANTHROPIC_API_KEY! } }
+  secrets: { apiKey: process.env.ANTHROPIC_API_KEY! }
 });
 
 const run = await aex.wait(runId);
@@ -39,7 +39,7 @@ function summarise(topic: string) {
 
 const runId = await aex.submitRun({
   ...summarise("agent-first SDK design"),
-  secrets: { anthropic: { apiKey: process.env.ANTHROPIC_API_KEY! } }
+  secrets: { apiKey: process.env.ANTHROPIC_API_KEY! }
 });
 ```
 
@@ -65,7 +65,7 @@ Every kind of thing you want to ship at run time has exactly one right primitive
 | Non-secret paths or config (`BROLL_STORE`, mode flags) | `environment.envVars` | Mounted as `RUNTIME.env` / `RUNTIME.json`; `__KEY__` substitution in agent-facing markdown; echoed back as `run.runtimeManifest.envVars` |
 | Upstream HTTPS API keys (TMDB, Brave, Tavily, …) | `ProxyEndpoint` | Credentials live server-side; aex proxy injects them on outbound calls. The key never enters the container. |
 | MCP server credentials | `secrets.mcpServers` | Held in run-scoped custody, attached per run |
-| Provider API key | `secrets.<provider>.apiKey` | Required on every `submitRun`; held in run-scoped custody, matching `provider` |
+| Provider API key | `secrets.apiKey` | Required on every `submitRun`; held in run-scoped custody. Carries the BYOK key for the selected `provider` |
 | Non-secret reference data folders (transcripts, persona docs, PDFs) | `File.fromPath('./customer-folder/')` | Materialized under `files/<f_id>/<name>` in the run workspace by default and described in the agent-facing instructions |
 | Executable skill code (a `.pyz` wrapper, scripts, prompts) | `Skill.fromPath('./skills/my-skill/')` | Mounted under `skills/<name>/`; the bundle's `SKILL.md` is composed into the agent's instructions |
 | Agent instructions file | `AgentsMd.fromPath('./AGENTS.md')` | Prepended as the first user turn |
@@ -96,7 +96,7 @@ async function submitWithRetry() {
         model: "claude-haiku-4-5",
         prompt: "...",
         idempotencyKey,
-        secrets: { anthropic: { apiKey: process.env.ANTHROPIC_API_KEY! } }
+        secrets: { apiKey: process.env.ANTHROPIC_API_KEY! }
       });
     } catch (err) {
       if (err instanceof Error && err.message.includes("network")) continue;

package/docs/release.md

@@ -12,16 +12,18 @@ repository on a clean `main` branch unless tags are added deliberately later.
 
 ## How to ship a release
 
-1. Bump both `packages/sdk/package.json#version` and
-   `packages/sdk/src/version.ts` to the next semver.
+1. Bump the publishable package manifests to the next shared semver:
+   `packages/contracts/package.json`, `packages/conformance/package.json`,
+   `packages/cli/package.json`, and `packages/sdk/package.json`. Also update
+   `packages/sdk/src/version.ts` to match.
 2. Land the change on `main` with any companion code or docs.
 3. Confirm CI is green.
 4. Run the **Release** workflow from `main` and choose the npm dist-tag
    (`latest` or `next`).
 
-If `@aexhq/sdk@<version>` already exists on npm, the release workflow fails before
-publishing. A failed release is fixed by bumping to a higher version and running
-the workflow again.
+If any package at `<version>` already exists on npm, the release workflow fails
+before publishing. A failed release is fixed by bumping to a higher version and
+running the workflow again.
 
 ## Release pipeline
 
@@ -29,7 +31,9 @@ The workflow has two jobs:
 
 1. **`publish`** runs on Ubuntu in the protected `npm-release` environment:
    - `pnpm install --frozen-lockfile`
-   - npm version availability check for `packages/sdk/package.json#version`
+   - npm version availability checks for `@aexhq/contracts`,
+     `@aexhq/conformance`, `@aexhq/cli`, and `@aexhq/sdk` at
+     `packages/sdk/package.json#version`
    - `pnpm lint`
    - `pnpm test`
    - `pnpm run docs:build`
@@ -37,7 +41,8 @@ The workflow has two jobs:
    - `pnpm --filter @aexhq/sdk pack`
    - `pnpm run test:user:offline` against the packed tarball
    - a final npm version availability check
-   - `pnpm publish --provenance --no-git-checks --access public`
+   - `pnpm publish --provenance --no-git-checks --access public` for
+     `@aexhq/contracts`, `@aexhq/conformance`, `@aexhq/cli`, and `@aexhq/sdk`
 2. **`post-publish-user-tests`** waits for npm registry visibility, then runs
    `pnpm run test:user:offline` against the published version on Ubuntu and
    Windows.
@@ -69,17 +74,18 @@ with no workspace access:
 
 ## Repository setup
 
-Configure npm Trusted Publishing for this repository:
+Set `NPM_TOKEN` in the protected GitHub `npm-release` environment. The token must
+have publish rights for all four packages. The workflow still publishes with
+provenance.
+
+Trusted Publishing can replace the token after every package exists on npm and
+the trusted publisher is configured for each package:
 
 - **Organization or user**: `aexhq`
 - **Repository**: `aex`
 - **Workflow filename**: `release.yml`
 - **Environment name**: `npm-release`
 
-Protect the GitHub `npm-release` environment with the reviewers or deployment
-rules you want before enabling real publishes. No `NPM_TOKEN` secret is
-required when Trusted Publishing is configured.
-
 ## Local checklist
 
 Before dispatching a release, the same public-safe checks can be run locally:

package/docs/run-config.md

@@ -36,7 +36,7 @@ function summarise(topic: string) {
 
 await aex.submitRun({
   ...summarise("agent-first SDK design"),
-  secrets: { anthropic: { apiKey } }
+  secrets: { apiKey }
 });
 ```
 

package/docs/skills.md

@@ -45,7 +45,7 @@ const aex = new AgentExecutor({ apiToken });
 await aex.submitRun({
   model, prompt,
   skills: [await Skill.fromFiles({ name: "rules", files })],
-  secrets: { anthropic: { apiKey } }
+  secrets: { apiKey }
 });
 ```
 
@@ -110,7 +110,7 @@ await aex.submitRun({
   skills: [
     await Skill.fromUrl(signedUrl, { name: "rules", sha256: "sha256:<hex>" })
   ],
-  secrets: { anthropic: { apiKey } }
+  secrets: { apiKey }
 });
 ```
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aexhq/sdk",
-  "version": "0.13.8",
+  "version": "0.13.10",
   "description": "TypeScript SDK for running autonomous agent sessions across providers (Anthropic, OpenAI, DeepSeek, Gemini, Mistral) behind one interface.",
   "license": "Apache-2.0",
   "repository": {
@@ -26,7 +26,7 @@
     "examples"
   ],
   "devDependencies": {
-    "@aexhq/contracts": "0.13.8"
+    "@aexhq/contracts": "0.13.10"
   },
   "engines": {
     "node": ">=20"