@aexhq/sdk 0.18.1 → 0.20.0

package/dist/index.js

@@ -7,13 +7,14 @@
  * wrapper. Everything else is types, errors, and event type guards re-exported
  * from `@aexhq/contracts`.
  */
-export { AgentsMdClient, AgentExecutor, FilesClient, SkillsClient } from "./client.js";
+export { AgentsMdClient, AgentExecutor, FilesClient, SecretsClient, SkillsClient } from "./client.js";
 // Composition primitives
 export { Skill } from "./skill.js";
 export { AgentsMd } from "./agents-md.js";
 export { File } from "./file.js";
 export { McpServer } from "./mcp-server.js";
 export { ProxyEndpoint } from "./proxy-endpoint.js";
+export { Secret } from "./secret.js";
 export { bundleSkillFiles, hashSkillBundle } from "./bundle.js";
 // Errors
 export { AexApiError, AexError, CleanupError, CredentialValidationError, ProviderError, RunStateError } from "./_contracts/index.js";
@@ -31,7 +32,7 @@ export { BUILTINS, Builtins } from "./_contracts/index.js";
 // Provider + runtime dispatch surface. Agents and SDK consumers
 // inspect these to know which (provider, runtime) combos are valid
 // and to validate submissions offline before posting.
-export { CREDENTIAL_MODES, DEFAULT_CREDENTIAL_MODE, collectManagedUnsupportedFeatures, DEFAULT_RUN_PROVIDER, RUN_MODELS, RUN_MODELS_BY_PROVIDER, Models, RunModels, providerForModel, isRunModel, parseRunModel, Providers, RUN_PROVIDERS, RUNTIME_KINDS, RUNTIME_VALIDATION_CODES, RuntimeValidationError, selectRuntime } from "./_contracts/index.js";
+export { CREDENTIAL_MODES, DEFAULT_CREDENTIAL_MODE, collectManagedUnsupportedFeatures, DEFAULT_RUN_PROVIDER, RUN_MODELS, RUN_MODELS_BY_PROVIDER, MODEL_PROVIDER_IDS, Models, RunModels, providerForModel, providersForModel, resolveProviderModelId, isRunModel, parseRunModel, Providers, RUN_PROVIDERS, RUNTIME_KINDS, RUNTIME_VALIDATION_CODES, RuntimeValidationError, selectRuntime } from "./_contracts/index.js";
 // Normalized coordinator event guards
 export { AEX_RUN_SETTLED_NAME, isCustom, isEventChannel, isFromSource, isLog, isRunError, isRunFinished, isRunSettled, isRunStarted, isRunTerminal, isTextMessage, isToolCallResult, isToolCallStart } from "./_contracts/index.js";
 // Secret utilities

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAYvF,yBAAyB;AACzB,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAQpD,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAGhE,SAAS;AACT,OAAO,EACL,WAAW,EACX,QAAQ,EACR,YAAY,EACZ,yBAAyB,EACzB,aAAa,EACb,aAAa,EACd,MAAM,kBAAkB,CAAC;AAE1B,yBAAyB;AACzB,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,0BAA0B,EAC1B,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EACxB,2BAA2B,EAC3B,iBAAiB,EAClB,MAAM,kBAAkB,CAAC;AA0D1B,oEAAoE;AACpE,6EAA6E;AAC7E,6DAA6D;AAC7D,OAAO,EACL,+BAA+B,EAC/B,kCAAkC,EAClC,yBAAyB,EACzB,oBAAoB,EACpB,oBAAoB,EACpB,aAAa,EACb,YAAY,EACb,MAAM,kBAAkB,CAAC;AAG1B,+DAA+D;AAC/D,2CAA2C;AAC3C,mEAAmE;AACnE,4BAA4B;AAC5B,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAGtD,gEAAgE;AAChE,mEAAmE;AACnE,sDAAsD;AACtD,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,iCAAiC,EACjC,oBAAoB,EACpB,UAAU,EACV,sBAAsB,EACtB,MAAM,EACN,SAAS,EACT,gBAAgB,EAChB,UAAU,EACV,aAAa,EACb,SAAS,EACT,aAAa,EACb,aAAa,EACb,wBAAwB,EACxB,sBAAsB,EACtB,aAAa,EACd,MAAM,kBAAkB,CAAC;AAS1B,sCAAsC;AACtC,OAAO,EACL,oBAAoB,EACpB,QAAQ,EACR,cAAc,EACd,YAAY,EACZ,KAAK,EACL,UAAU,EACV,aAAa,EACb,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,eAAe,EAChB,MAAM,kBAAkB,CAAC;AAE1B,mBAAmB;AACnB,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,cAAc,EAAE,aAAa,EAAE,WAAW,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,aAAa,CAAC;AAatG,yBAAyB;AACzB,OAAO,EAAE,KAAK,EAAE,MAAM,YAAY,CAAC;AACnC,OAAO,EAAE,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC1C,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,SAAS,EAAE,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAE,MAAM,EAAE,MAAM,aAAa,CAAC;AASrC,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,aAAa,CAAC;AAGhE,SAAS;AACT,OAAO,EACL,WAAW,EACX,QAAQ,EACR,YAAY,EACZ,yBAAyB,EACzB,aAAa,EACb,aAAa,EACd,MAAM,kBAAkB,CAAC;AAE1B,yBAAyB;AACzB,OAAO,EACL,uBAAuB,EACvB,mBAAmB,EACnB,0BAA0B,EAC1B,yBAAyB,EACzB,wBAAwB,EACxB,wBAAwB,EACxB,2BAA2B,EAC3B,iBAAiB,EAClB,MAAM,kBAAkB,CAAC;AA4D1B,oEAAoE;AACpE,6EAA6E;AAC7E,6DAA6D;AAC7D,OAAO,EACL,+BAA+B,EAC/B,kCAAkC,EAClC,yBAAyB,EACzB,oBAAoB,EACpB,oBAAoB,EACpB,aAAa,EACb,YAAY,EACb,MAAM,kBAAkB,CAAC;AAG1B,+DAA+D;AAC/D,2CAA2C;AAC3C,mEAAmE;AACnE,4BAA4B;AAC5B,OAAO,EAAE,QAAQ,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAGtD,gEAAgE;AAChE,mEAAmE;AACnE,sDAAsD;AACtD,OAAO,EACL,gBAAgB,EAChB,uBAAuB,EACvB,iCAAiC,EACjC,oBAAoB,EACpB,UAAU,EACV,sBAAsB,EACtB,kBAAkB,EAClB,MAAM,EACN,SAAS,EACT,gBAAgB,EAChB,iBAAiB,EACjB,sBAAsB,EACtB,UAAU,EACV,aAAa,EACb,SAAS,EACT,aAAa,EACb,aAAa,EACb,wBAAwB,EACxB,sBAAsB,EACtB,aAAa,EACd,MAAM,kBAAkB,CAAC;AAS1B,sCAAsC;AACtC,OAAO,EACL,oBAAoB,EACpB,QAAQ,EACR,cAAc,EACd,YAAY,EACZ,KAAK,EACL,UAAU,EACV,aAAa,EACb,YAAY,EACZ,YAAY,EACZ,aAAa,EACb,aAAa,EACb,gBAAgB,EAChB,eAAe,EAChB,MAAM,kBAAkB,CAAC;AAE1B,mBAAmB;AACnB,OAAO,EAAE,YAAY,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC"}

package/dist/proxy-endpoint.d.ts

@@ -16,7 +16,7 @@ import { type PlatformProxyAuthValue, type PlatformProxyEndpoint, type PlatformP
  * Wire-format unchanged: the SDK splits each `ProxyEndpoint` instance
  * into a `PlatformProxyEndpoint` (the non-secret declaration) plus a
  * `PlatformProxyEndpointAuth` entry (the per-request secret) at
- * `submitRun` time, exactly the way `McpServer` already splits
+ * `submit` time, exactly the way `McpServer` already splits
  * `headers` into `secrets.mcpServers`.
  *
  * Five named constructors:
@@ -116,7 +116,7 @@ export declare class ProxyEndpoint {
 /**
  * Split a list of `ProxyEndpoint` instances into the public declarations
  * (`proxyEndpoints[]`) and the per-request auth bundle
- * (`secrets.proxyEndpointAuth[]`). Mirrors the way `submitRun` already
+ * (`secrets.proxyEndpointAuth[]`). Mirrors the way `submit` already
  * splits `McpServer.headers` into `secrets.mcpServers[]`.
  *
  * Throws on duplicate endpoint names — names are the cross-reference

package/dist/proxy-endpoint.js

@@ -65,7 +65,7 @@ export class ProxyEndpoint {
 /**
  * Split a list of `ProxyEndpoint` instances into the public declarations
  * (`proxyEndpoints[]`) and the per-request auth bundle
- * (`secrets.proxyEndpointAuth[]`). Mirrors the way `submitRun` already
+ * (`secrets.proxyEndpointAuth[]`). Mirrors the way `submit` already
  * splits `McpServer.headers` into `secrets.mcpServers[]`.
  *
  * Throws on duplicate endpoint names — names are the cross-reference

package/dist/secret.d.ts

@@ -0,0 +1,102 @@
+import { SecretString } from "./_contracts/index.js";
+/**
+ * Non-secret wire shape for one `secretEnv` entry. A workspace ref carries the
+ * handle (hashable, resolved server-side); an ephemeral secret carries only a
+ * value-free placeholder — the value is split into the vaulted secrets channel
+ * and excluded from the idempotency hash.
+ */
+export type SecretEnvSubmissionEntry = {
+    readonly ref: string;
+} | {
+    readonly ephemeral: true;
+};
+/**
+ * Minimal client surface `secret.upload` needs to promote an ephemeral secret
+ * into the workspace store. `AgentExecutor` satisfies it via its `secrets`
+ * client; defined structurally here so `secret.ts` does not import `client.ts`
+ * (which would be circular — `client.ts` imports `Secret`). Mirrors
+ * {@link SkillUploader}.
+ */
+export interface SecretUploader {
+    _createWorkspaceSecret(args: {
+        readonly name: string;
+        readonly value: string;
+    }): Promise<{
+        readonly name: string;
+    }>;
+}
+/**
+ * A secret with the SAME lifecycle semantic as `Skill` / `File` / `AgentsMd`:
+ * EPHEMERAL per-run by default, PROMOTABLE to a persisted, name-searchable
+ * workspace secret you can reference and reuse.
+ *
+ *   - `Secret.value(v)` — EPHEMERAL per-run: the value is vaulted at submit and
+ *     excluded from the idempotency hash; only a `{ ephemeral: true }`
+ *     placeholder rides the (hashed) submission. Deleted when the run finishes.
+ *     Clean, no workspace dependency. ≙ `Skill.fromFiles(...)` (a draft).
+ *   - `secret.upload(client, { name })` — PROMOTE that value into the workspace
+ *     secret store under `name`; resolves to a `Secret.ref`. ≙ `skill.upload(client)`.
+ *   - `Secret.ref(handle)` — WORKSPACE: only the handle rides the submission;
+ *     the value is resolved server-side from the workspace secret store. No
+ *     value ever travels. ≙ `Skill.fromCatalog(record)`.
+ *
+ * The SDK splits each `Secret` BEFORE the wire payload is built (exactly how
+ * `McpServer` splits `headers` into `secrets.mcpServers`): the env-var name keys
+ * `submission.secretEnv[name] = toSubmissionEntry()`, and for ephemeral values
+ * `secrets.envSecrets[name] = toSecretValue()`.
+ */
+export declare class Secret {
+    #private;
+    readonly kind: "value" | "ref";
+    /** Workspace handle (ref kind only); `undefined` for ephemeral values. */
+    readonly handle: string | undefined;
+    /** Internal constructor. Use `Secret.value(...)` or `Secret.ref(...)`. */
+    constructor(args: {
+        readonly kind: "value";
+        readonly value: SecretString;
+    } | {
+        readonly kind: "ref";
+        readonly handle: string;
+    });
+    /** Ephemeral per-run value. Vaulted at submit; never in the spec/hash; gone at terminal. */
+    static value(value: string | SecretString): Secret;
+    /** Reference a workspace secret by handle; resolved server-side at submit. */
+    static ref(handle: string): Secret;
+    /** True once this ephemeral secret has been promoted via `upload`. */
+    get isConsumed(): boolean;
+    /**
+     * Promote this EPHEMERAL secret into the workspace secret store under `name`
+     * and return a `Secret.ref(name)` for reuse across runs. Blocking: the store
+     * write completes before this resolves. Consumes this instance (an ephemeral
+     * value is promoted exactly once), mirroring `Skill.upload`.
+     *
+     * Only valid on a `Secret.value(...)`; a `Secret.ref(...)` is already
+     * persisted.
+     */
+    upload(client: SecretUploader, args: {
+        readonly name: string;
+    }): Promise<Secret>;
+    /** Non-secret wire entry for `submission.secretEnv[<envName>]`. */
+    toSubmissionEntry(): SecretEnvSubmissionEntry;
+    /** Raw value for the vaulted `secrets.envSecrets[<envName>]` (ephemeral only); `undefined` for refs. */
+    toSecretValue(): string | undefined;
+    /** Redacted — never prints the value. */
+    toString(): string;
+    /** Redacted — never serialises the value. */
+    toJSON(): unknown;
+}
+/**
+ * Split `secretEnv: Record<envName, Secret>` into the value-free declarations
+ * (`submission.secretEnv`) and the per-run vaulted values
+ * (`secrets.envSecrets`). Mirrors {@link splitProxyEndpoints}: declarations ride
+ * the hashed submission, ephemeral values ride the secrets channel
+ * (hash-excluded). Refs contribute only a declaration.
+ *
+ * Throws on a non-`Secret` value or an env var name that won't match the
+ * platform's `SECRET_ENV_NAME_PATTERN`, so the caller gets a precise error at
+ * the call site instead of an HTTP 400 a round-trip later.
+ */
+export declare function splitSecretEnv(secretEnv: Readonly<Record<string, Secret>> | undefined): {
+    declarations: Record<string, SecretEnvSubmissionEntry>;
+    values: Record<string, string>;
+};

package/dist/secret.js

@@ -0,0 +1,148 @@
+import { SECRET_ENV_NAME_PATTERN, SECRET_HANDLE_PATTERN, SecretString } from "./_contracts/index.js";
+/**
+ * A secret with the SAME lifecycle semantic as `Skill` / `File` / `AgentsMd`:
+ * EPHEMERAL per-run by default, PROMOTABLE to a persisted, name-searchable
+ * workspace secret you can reference and reuse.
+ *
+ *   - `Secret.value(v)` — EPHEMERAL per-run: the value is vaulted at submit and
+ *     excluded from the idempotency hash; only a `{ ephemeral: true }`
+ *     placeholder rides the (hashed) submission. Deleted when the run finishes.
+ *     Clean, no workspace dependency. ≙ `Skill.fromFiles(...)` (a draft).
+ *   - `secret.upload(client, { name })` — PROMOTE that value into the workspace
+ *     secret store under `name`; resolves to a `Secret.ref`. ≙ `skill.upload(client)`.
+ *   - `Secret.ref(handle)` — WORKSPACE: only the handle rides the submission;
+ *     the value is resolved server-side from the workspace secret store. No
+ *     value ever travels. ≙ `Skill.fromCatalog(record)`.
+ *
+ * The SDK splits each `Secret` BEFORE the wire payload is built (exactly how
+ * `McpServer` splits `headers` into `secrets.mcpServers`): the env-var name keys
+ * `submission.secretEnv[name] = toSubmissionEntry()`, and for ephemeral values
+ * `secrets.envSecrets[name] = toSecretValue()`.
+ */
+export class Secret {
+    kind;
+    /** Workspace handle (ref kind only); `undefined` for ephemeral values. */
+    handle;
+    #value;
+    /** True once promoted via `upload` — a consumed ephemeral can't be reused. */
+    #consumed = false;
+    /** Internal constructor. Use `Secret.value(...)` or `Secret.ref(...)`. */
+    constructor(args) {
+        if (!args || typeof args !== "object") {
+            throw new Error("Secret: args is required");
+        }
+        if (args.kind === "ref") {
+            if (typeof args.handle !== "string" || !SECRET_HANDLE_PATTERN.test(args.handle)) {
+                throw new Error(`Secret.ref: handle must match ${SECRET_HANDLE_PATTERN.source}`);
+            }
+            this.kind = "ref";
+            this.handle = args.handle;
+            this.#value = undefined;
+            return;
+        }
+        this.kind = "value";
+        this.handle = undefined;
+        this.#value = args.value;
+    }
+    /** Ephemeral per-run value. Vaulted at submit; never in the spec/hash; gone at terminal. */
+    static value(value) {
+        const wrapped = value instanceof SecretString ? value : new SecretString(value, "secret");
+        if (!wrapped.unwrap()) {
+            throw new Error("Secret.value: value must be a non-empty string");
+        }
+        return new Secret({ kind: "value", value: wrapped });
+    }
+    /** Reference a workspace secret by handle; resolved server-side at submit. */
+    static ref(handle) {
+        return new Secret({ kind: "ref", handle });
+    }
+    /** True once this ephemeral secret has been promoted via `upload`. */
+    get isConsumed() {
+        return this.#consumed;
+    }
+    /**
+     * Promote this EPHEMERAL secret into the workspace secret store under `name`
+     * and return a `Secret.ref(name)` for reuse across runs. Blocking: the store
+     * write completes before this resolves. Consumes this instance (an ephemeral
+     * value is promoted exactly once), mirroring `Skill.upload`.
+     *
+     * Only valid on a `Secret.value(...)`; a `Secret.ref(...)` is already
+     * persisted.
+     */
+    async upload(client, args) {
+        if (this.kind !== "value") {
+            throw new Error("Secret.upload: only ephemeral Secret.value(...) secrets can be uploaded; a Secret.ref is already persisted");
+        }
+        if (this.#consumed) {
+            throw new Error("Secret.upload: this ephemeral secret was already consumed. Build a fresh Secret.value(...) to re-upload.");
+        }
+        if (!args || typeof args.name !== "string" || !SECRET_HANDLE_PATTERN.test(args.name)) {
+            throw new Error(`Secret.upload: name must match ${SECRET_HANDLE_PATTERN.source}`);
+        }
+        const value = this.#value.unwrap();
+        await client._createWorkspaceSecret({ name: args.name, value });
+        this.#consumed = true;
+        return Secret.ref(args.name);
+    }
+    /** Non-secret wire entry for `submission.secretEnv[<envName>]`. */
+    toSubmissionEntry() {
+        if (this.kind === "ref") {
+            return { ref: this.handle };
+        }
+        if (this.#consumed) {
+            throw new Error("Secret: this ephemeral secret was consumed by upload(); reference it via the returned Secret.ref instead");
+        }
+        return { ephemeral: true };
+    }
+    /** Raw value for the vaulted `secrets.envSecrets[<envName>]` (ephemeral only); `undefined` for refs. */
+    toSecretValue() {
+        if (this.kind === "ref") {
+            return undefined;
+        }
+        if (this.#consumed) {
+            throw new Error("Secret: this ephemeral secret was consumed by upload(); reference it via the returned Secret.ref instead");
+        }
+        return this.#value?.unwrap();
+    }
+    /** Redacted — never prints the value. */
+    toString() {
+        return this.kind === "ref" ? `Secret.ref(${this.handle})` : "Secret.value([REDACTED])";
+    }
+    /** Redacted — never serialises the value. */
+    toJSON() {
+        return this.kind === "ref" ? { kind: "ref", handle: this.handle } : { kind: "value", value: "[REDACTED]" };
+    }
+}
+/**
+ * Split `secretEnv: Record<envName, Secret>` into the value-free declarations
+ * (`submission.secretEnv`) and the per-run vaulted values
+ * (`secrets.envSecrets`). Mirrors {@link splitProxyEndpoints}: declarations ride
+ * the hashed submission, ephemeral values ride the secrets channel
+ * (hash-excluded). Refs contribute only a declaration.
+ *
+ * Throws on a non-`Secret` value or an env var name that won't match the
+ * platform's `SECRET_ENV_NAME_PATTERN`, so the caller gets a precise error at
+ * the call site instead of an HTTP 400 a round-trip later.
+ */
+export function splitSecretEnv(secretEnv) {
+    const declarations = {};
+    const values = {};
+    if (!secretEnv) {
+        return { declarations, values };
+    }
+    for (const [envName, secret] of Object.entries(secretEnv)) {
+        if (!(secret instanceof Secret)) {
+            throw new TypeError(`secretEnv[${envName}] must be a Secret built via Secret.value(...) or Secret.ref(...)`);
+        }
+        if (!SECRET_ENV_NAME_PATTERN.test(envName)) {
+            throw new Error(`secretEnv key ${JSON.stringify(envName)} must be a valid env var name matching ${SECRET_ENV_NAME_PATTERN.source}`);
+        }
+        declarations[envName] = secret.toSubmissionEntry();
+        const value = secret.toSecretValue();
+        if (value !== undefined) {
+            values[envName] = value;
+        }
+    }
+    return { declarations, values };
+}
+//# sourceMappingURL=secret.js.map

package/dist/secret.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret.js","sourceRoot":"","sources":["../src/secret.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,uBAAuB,EAAE,qBAAqB,EAAE,YAAY,EAAE,MAAM,kBAAkB,CAAC;AAqBhG;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,OAAO,MAAM;IACR,IAAI,CAAkB;IAC/B,0EAA0E;IACjE,MAAM,CAAqB;IAC3B,MAAM,CAA2B;IAC1C,8EAA8E;IAC9E,SAAS,GAAG,KAAK,CAAC;IAElB,0EAA0E;IAC1E,YAAY,IAAkH;QAC5H,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,0BAA0B,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACxB,IAAI,OAAO,IAAI,CAAC,MAAM,KAAK,QAAQ,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,MAAM,CAAC,EAAE,CAAC;gBAChF,MAAM,IAAI,KAAK,CAAC,iCAAiC,qBAAqB,CAAC,MAAM,EAAE,CAAC,CAAC;YACnF,CAAC;YACD,IAAI,CAAC,IAAI,GAAG,KAAK,CAAC;YAClB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,MAAM,CAAC;YAC1B,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;YACxB,OAAO;QACT,CAAC;QACD,IAAI,CAAC,IAAI,GAAG,OAAO,CAAC;QACpB,IAAI,CAAC,MAAM,GAAG,SAAS,CAAC;QACxB,IAAI,CAAC,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC;IAC3B,CAAC;IAED,4FAA4F;IAC5F,MAAM,CAAC,KAAK,CAAC,KAA4B;QACvC,MAAM,OAAO,GAAG,KAAK,YAAY,YAAY,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,YAAY,CAAC,KAAK,EAAE,QAAQ,CAAC,CAAC;QAC1F,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC;YACtB,MAAM,IAAI,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACpE,CAAC;QACD,OAAO,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,OAAO,EAAE,CAAC,CAAC;IACvD,CAAC;IAED,8EAA8E;IAC9E,MAAM,CAAC,GAAG,CAAC,MAAc;QACvB,OAAO,IAAI,MAAM,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC;IAC7C,CAAC;IAED,sEAAsE;IACtE,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,MAAM,CAAC,MAAsB,EAAE,IAA+B;QAClE,IAAI,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC1B,MAAM,IAAI,KAAK,CAAC,4GAA4G,CAAC,CAAC;QAChI,CAAC;QACD,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,0GAA0G,CAAC,CAAC;QAC9H,CAAC;QACD,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,qBAAqB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACrF,MAAM,IAAI,KAAK,CAAC,kCAAkC,qBAAqB,CAAC,MAAM,EAAE,CAAC,CAAC;QACpF,CAAC;QACD,MAAM,KAAK,GAAG,IAAI,CAAC,MAAO,CAAC,MAAM,EAAE,CAAC;QACpC,MAAM,MAAM,CAAC,sBAAsB,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;QAChE,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACtB,OAAO,MAAM,CAAC,GAAG,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAC/B,CAAC;IAED,mEAAmE;IACnE,iBAAiB;QACf,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACxB,OAAO,EAAE,GAAG,EAAE,IAAI,CAAC,MAAO,EAAE,CAAC;QAC/B,CAAC;QACD,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,0GAA0G,CAAC,CAAC;QAC9H,CAAC;QACD,OAAO,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;IAC7B,CAAC;IAED,wGAAwG;IACxG,aAAa;QACX,IAAI,IAAI,CAAC,IAAI,KAAK,KAAK,EAAE,CAAC;YACxB,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CAAC,0GAA0G,CAAC,CAAC;QAC9H,CAAC;QACD,OAAO,IAAI,CAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAC/B,CAAC;IAED,yCAAyC;IACzC,QAAQ;QACN,OAAO,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,cAAc,IAAI,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,0BAA0B,CAAC;IACzF,CAAC;IAED,6CAA6C;IAC7C,MAAM;QACJ,OAAO,IAAI,CAAC,IAAI,KAAK,KAAK,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,YAAY,EAAE,CAAC;IAC7G,CAAC;CACF;AAED;;;;;;;;;;GAUG;AACH,MAAM,UAAU,cAAc,CAAC,SAAuD;IAIpF,MAAM,YAAY,GAA6C,EAAE,CAAC;IAClE,MAAM,MAAM,GAA2B,EAAE,CAAC;IAC1C,IAAI,CAAC,SAAS,EAAE,CAAC;QACf,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;IAClC,CAAC;IACD,KAAK,MAAM,CAAC,OAAO,EAAE,MAAM,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;QAC1D,IAAI,CAAC,CAAC,MAAM,YAAY,MAAM,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,SAAS,CACjB,aAAa,OAAO,mEAAmE,CACxF,CAAC;QACJ,CAAC;QACD,IAAI,CAAC,uBAAuB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3C,MAAM,IAAI,KAAK,CACb,iBAAiB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,0CAA0C,uBAAuB,CAAC,MAAM,EAAE,CACnH,CAAC;QACJ,CAAC;QACD,YAAY,CAAC,OAAO,CAAC,GAAG,MAAM,CAAC,iBAAiB,EAAE,CAAC;QACnD,MAAM,KAAK,GAAG,MAAM,CAAC,aAAa,EAAE,CAAC;QACrC,IAAI,KAAK,KAAK,SAAS,EAAE,CAAC;YACxB,MAAM,CAAC,OAAO,CAAC,GAAG,KAAK,CAAC;QAC1B,CAAC;IACH,CAAC;IACD,OAAO,EAAE,YAAY,EAAE,MAAM,EAAE,CAAC;AAClC,CAAC"}

package/dist/skill.d.ts

@@ -1,7 +1,7 @@
 import { type AssetRef, type FetchLike, type SkillRef } from "./_contracts/index.js";
 import { type SkillFiles } from "./bundle.js";
 /**
- * One `Skill` class for skill bytes. `client.submitRun` materializes the bytes
+ * One `Skill` class for skill bytes. `client.submit` materializes the bytes
  * as an uploaded asset before the run lands; the wire ref becomes
  * `kind:"asset"`.
  *
@@ -30,7 +30,7 @@ export declare class Skill {
     /**
      * The wire-level reference. Returns the SDK-private draft shape for
      * un-materialized skills (kind:"draft", with name + contentHash).
-     * `client.submitRun` walks these and uploads them before the run
+     * `client.submit` walks these and uploads them before the run
      * lands.
      */
     get ref(): AssetRef | DraftSkillRef;
@@ -41,7 +41,7 @@ export declare class Skill {
      * Build a draft Skill from an inline files map. The SDK validates
      * basic safety (no path traversal, size caps, has `SKILL.md`),
      * deterministically zips the bundle, and computes the
-     * `sha256:<hex>` content hash. `client.submitRun` materializes
+     * `sha256:<hex>` content hash. `client.submit` materializes
      * these before the run lands.
      */
     static fromFiles(args: {
@@ -66,7 +66,7 @@ export declare class Skill {
      *
      * The archive must contain `SKILL.md` at its root, or inside a single
      * top-level folder (which is stripped). The signed URL only needs to be valid
-     * for this call; `client.submitRun` snapshots the bytes into the run.
+     * for this call; `client.submit` snapshots the bytes into the run.
      *
      * Universal (Node 18+ / browser): requires a global `fetch`, or pass one.
      */
@@ -86,7 +86,7 @@ export declare class Skill {
      * `Skill` record returned by `client.skills.list()` / `.get()`:
      *
      *   const [s] = await client.skills.list();
-     *   await client.submitRun({ ..., skills: [Skill.fromCatalog(s)] });
+     *   await client.submit({ ..., skills: [Skill.fromCatalog(s)] });
      *
      * The record must be `ready` (it has a content hash). Unlike the draft
      * builders this performs no upload — the bytes already live in the catalog.
@@ -96,9 +96,9 @@ export declare class Skill {
         readonly hash?: string | null;
     }): Skill;
     /**
-     * Internal: yield the draft's bytes + metadata so `client.submitRun`
+     * Internal: yield the draft's bytes + metadata so `client.submit`
      * can upload the asset. After this returns, the Skill is marked consumed
-     * so a second submitRun call against the same instance throws
+     * so a second submit call against the same instance throws
      * (avoid silently re-uploading; explicit re-construction is the
      * supported retry pattern).
      *
@@ -123,7 +123,7 @@ export declare class Skill {
 }
 /**
  * SDK-internal draft skill marker. Never reaches the wire; the
- * materialize step inside `client.submitRun` converts these to
+ * materialize step inside `client.submit` converts these to
  * `kind:"asset"` refs.
  */
 export interface DraftSkillRef {

package/dist/skill.js

@@ -3,7 +3,7 @@ import { bundleSkillFiles, hashSkillBundle } from "./bundle.js";
 import { fetchSkillArchive } from "./fetch-archive.js";
 import { readDirectoryAsFiles } from "./node-fs.js";
 /**
- * One `Skill` class for skill bytes. `client.submitRun` materializes the bytes
+ * One `Skill` class for skill bytes. `client.submit` materializes the bytes
  * as an uploaded asset before the run lands; the wire ref becomes
  * `kind:"asset"`.
  *
@@ -37,7 +37,7 @@ export class Skill {
     /**
      * The wire-level reference. Returns the SDK-private draft shape for
      * un-materialized skills (kind:"draft", with name + contentHash).
-     * `client.submitRun` walks these and uploads them before the run
+     * `client.submit` walks these and uploads them before the run
      * lands.
      */
     get ref() {
@@ -54,7 +54,7 @@ export class Skill {
      * Build a draft Skill from an inline files map. The SDK validates
      * basic safety (no path traversal, size caps, has `SKILL.md`),
      * deterministically zips the bundle, and computes the
-     * `sha256:<hex>` content hash. `client.submitRun` materializes
+     * `sha256:<hex>` content hash. `client.submit` materializes
      * these before the run lands.
      */
     static async fromFiles(args) {
@@ -92,7 +92,7 @@ export class Skill {
      *
      * The archive must contain `SKILL.md` at its root, or inside a single
      * top-level folder (which is stripped). The signed URL only needs to be valid
-     * for this call; `client.submitRun` snapshots the bytes into the run.
+     * for this call; `client.submit` snapshots the bytes into the run.
      *
      * Universal (Node 18+ / browser): requires a global `fetch`, or pass one.
      */
@@ -120,7 +120,7 @@ export class Skill {
      * `Skill` record returned by `client.skills.list()` / `.get()`:
      *
      *   const [s] = await client.skills.list();
-     *   await client.submitRun({ ..., skills: [Skill.fromCatalog(s)] });
+     *   await client.submit({ ..., skills: [Skill.fromCatalog(s)] });
      *
      * The record must be `ready` (it has a content hash). Unlike the draft
      * builders this performs no upload — the bytes already live in the catalog.
@@ -141,9 +141,9 @@ export class Skill {
         return new Skill(ref);
     }
     /**
-     * Internal: yield the draft's bytes + metadata so `client.submitRun`
+     * Internal: yield the draft's bytes + metadata so `client.submit`
      * can upload the asset. After this returns, the Skill is marked consumed
-     * so a second submitRun call against the same instance throws
+     * so a second submit call against the same instance throws
      * (avoid silently re-uploading; explicit re-construction is the
      * supported retry pattern).
      *
@@ -151,8 +151,8 @@ export class Skill {
      */
     _takeDraftBundle() {
         if (this.#consumed) {
-            throw new Error("Skill: cannot reuse a consumed Skill in submitRun. Build a fresh Skill via " +
-                "Skill.fromPath(...) / Skill.fromFiles(...) per submitRun call.");
+            throw new Error("Skill: cannot reuse a consumed Skill in submit. Build a fresh Skill via " +
+                "Skill.fromPath(...) / Skill.fromFiles(...) per submit call.");
         }
         if (this.#ref.kind !== "draft" || !this.#inlineBytes) {
             return undefined;
@@ -190,7 +190,7 @@ export class Skill {
     toJSON() {
         if (this.#ref.kind === "draft") {
             throw new Error("Skill: draft Skills cannot be JSON-serialised — they only become wire refs when " +
-                "client.submitRun uploads the bytes as an asset.");
+                "client.submit uploads the bytes as an asset.");
         }
         return this.#ref;
     }

package/dist/skill.js.map

@@ -1 +1 @@
-{"version":3,"file":"skill.js","sourceRoot":"","sources":["../src/skill.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAInB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAmB,MAAM,aAAa,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEpD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,OAAO,KAAK;IACP,IAAI,CAA2B;IAC/B,YAAY,CAAyB;IAC9C,SAAS,GAAG,KAAK,CAAC;IAElB;;;OAGG;IACH,YAAoB,GAA6B,EAAE,WAAwB;QACzE,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC;QAChB,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC;IAClC,CAAC;IAED;;;;;OAKG;IACH,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,kEAAkE;IAClE,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;IACvD,CAAC;IAED,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,IAA2D;QAChF,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACzE,MAAM,IAAI,KAAK,CAAC,oCAAoC,kBAAkB,CAAC,MAAM,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7C,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACvD,MAAM,GAAG,GAAkB;YACzB,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW;SACZ,CAAC;QACF,OAAO,IAAI,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IACrC,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAe,EAAE,IAA+B;QACpE,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAClD,OAAO,KAAK,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrD,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,MAAM,CAAC,KAAK,CAAC,OAAO,CAClB,GAAW,EACX,IAKC;QAED,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACzE,MAAM,IAAI,KAAK,CAAC,kCAAkC,kBAAkB,CAAC,MAAM,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE;YACzC,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3D,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrD,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,MAAM,CAAC,WAAW,CAAC,MAAgE;QACjF,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7E,MAAM,IAAI,KAAK,CAAC,6CAA6C,kBAAkB,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5F,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QAC1F,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CACb,wGAAwG,CACzG,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAa,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;QACxF,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAED;;;;;;;;OAQG;IACH,gBAAgB;QACd,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,6EAA6E;gBAC3E,gEAAgE,CACnE,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACrD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACtB,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;YACpB,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW;YAClC,KAAK,EAAE,IAAI,CAAC,YAAY;SACzB,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,MAAM,CAAC,MAAqB;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACvC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,gEAAgE;gBAC9D,iDAAiD,CACpD,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC;YACzC,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,IAAI,EAAE,MAAM,CAAC,WAAW;YACxB,WAAW,EAAE,iBAAiB;SAC/B,CAAC,CAAC;QACH,MAAM,GAAG,GAAa,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;QACtF,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAED,MAAM;QACJ,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACb,kFAAkF;gBAClF,iDAAiD,CAClD,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;CACF"}
+{"version":3,"file":"skill.js","sourceRoot":"","sources":["../src/skill.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,kBAAkB,EAInB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAmB,MAAM,aAAa,CAAC;AACjF,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,EAAE,oBAAoB,EAAE,MAAM,cAAc,CAAC;AAEpD;;;;;;;;;;;;;;;;;;;GAmBG;AACH,MAAM,OAAO,KAAK;IACP,IAAI,CAA2B;IAC/B,YAAY,CAAyB;IAC9C,SAAS,GAAG,KAAK,CAAC;IAElB;;;OAGG;IACH,YAAoB,GAA6B,EAAE,WAAwB;QACzE,IAAI,CAAC,IAAI,GAAG,GAAG,CAAC;QAChB,IAAI,CAAC,YAAY,GAAG,WAAW,CAAC;IAClC,CAAC;IAED;;;;;OAKG;IACH,IAAI,GAAG;QACL,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;IAED,kEAAkE;IAClE,IAAI,OAAO;QACT,OAAO,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,IAAI,CAAC,SAAS,CAAC;IACvD,CAAC;IAED,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,SAAS,CAAC;IACxB,CAAC;IAED;;;;;;OAMG;IACH,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,IAA2D;QAChF,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;QACvD,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACzE,MAAM,IAAI,KAAK,CAAC,oCAAoC,kBAAkB,CAAC,MAAM,EAAE,CAAC,CAAC;QACnF,CAAC;QACD,MAAM,OAAO,GAAG,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QAC7C,MAAM,WAAW,GAAG,MAAM,eAAe,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;QACvD,MAAM,GAAG,GAAkB;YACzB,IAAI,EAAE,OAAO;YACb,IAAI,EAAE,IAAI,CAAC,IAAI;YACf,WAAW;SACZ,CAAC;QACF,OAAO,IAAI,KAAK,CAAC,GAAG,EAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IACrC,CAAC;IAED;;;OAGG;IACH,MAAM,CAAC,KAAK,CAAC,QAAQ,CAAC,OAAe,EAAE,IAA+B;QACpE,MAAM,KAAK,GAAG,MAAM,oBAAoB,CAAC,OAAO,CAAC,CAAC;QAClD,OAAO,KAAK,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrD,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,MAAM,CAAC,KAAK,CAAC,OAAO,CAClB,GAAW,EACX,IAKC;QAED,IAAI,CAAC,IAAI,IAAI,OAAO,IAAI,KAAK,QAAQ,EAAE,CAAC;YACtC,MAAM,IAAI,KAAK,CAAC,iCAAiC,CAAC,CAAC;QACrD,CAAC;QACD,IAAI,OAAO,IAAI,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,EAAE,CAAC;YACzE,MAAM,IAAI,KAAK,CAAC,kCAAkC,kBAAkB,CAAC,MAAM,EAAE,CAAC,CAAC;QACjF,CAAC;QACD,MAAM,KAAK,GAAG,MAAM,iBAAiB,CAAC,GAAG,EAAE;YACzC,GAAG,CAAC,IAAI,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,IAAI,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;YACtE,GAAG,CAAC,IAAI,CAAC,KAAK,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,KAAK,EAAE,IAAI,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;SAC3D,CAAC,CAAC;QACH,OAAO,KAAK,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACrD,CAAC;IAED;;;;;;;;;;;;;;OAcG;IACH,MAAM,CAAC,WAAW,CAAC,MAAgE;QACjF,IAAI,CAAC,MAAM,IAAI,OAAO,MAAM,KAAK,QAAQ,EAAE,CAAC;YAC1C,MAAM,IAAI,KAAK,CAAC,uDAAuD,CAAC,CAAC;QAC3E,CAAC;QACD,IAAI,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,MAAM,CAAC,IAAI,CAAC,EAAE,CAAC;YAC7E,MAAM,IAAI,KAAK,CAAC,6CAA6C,kBAAkB,CAAC,MAAM,EAAE,CAAC,CAAC;QAC5F,CAAC;QACD,MAAM,OAAO,GAAG,OAAO,MAAM,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC;QACnE,MAAM,OAAO,GAAG,OAAO,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,OAAO,CAAC;QAC1F,IAAI,CAAC,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC;YACpC,MAAM,IAAI,KAAK,CACb,wGAAwG,CACzG,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAa,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,SAAS,OAAO,EAAE,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;QACxF,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAED;;;;;;;;OAQG;IACH,gBAAgB;QACd,IAAI,IAAI,CAAC,SAAS,EAAE,CAAC;YACnB,MAAM,IAAI,KAAK,CACb,0EAA0E;gBACxE,6DAA6D,CAChE,CAAC;QACJ,CAAC;QACD,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACrD,OAAO,SAAS,CAAC;QACnB,CAAC;QACD,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC;QACtB,OAAO;YACL,IAAI,EAAE,IAAI,CAAC,IAAI,CAAC,IAAI;YACpB,WAAW,EAAE,IAAI,CAAC,IAAI,CAAC,WAAW;YAClC,KAAK,EAAE,IAAI,CAAC,YAAY;SACzB,CAAC;IACJ,CAAC;IAED;;;;;;;;OAQG;IACH,KAAK,CAAC,MAAM,CAAC,MAAqB;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,gBAAgB,EAAE,CAAC;QACvC,IAAI,CAAC,MAAM,EAAE,CAAC;YACZ,MAAM,IAAI,KAAK,CACb,gEAAgE;gBAC9D,iDAAiD,CACpD,CAAC;QACJ,CAAC;QACD,MAAM,QAAQ,GAAG,MAAM,MAAM,CAAC,YAAY,CAAC;YACzC,KAAK,EAAE,MAAM,CAAC,KAAK;YACnB,IAAI,EAAE,MAAM,CAAC,WAAW;YACxB,WAAW,EAAE,iBAAiB;SAC/B,CAAC,CAAC;QACH,MAAM,GAAG,GAAa,EAAE,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,OAAO,EAAE,IAAI,EAAE,MAAM,CAAC,IAAI,EAAE,CAAC;QACtF,OAAO,IAAI,KAAK,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAED,MAAM;QACJ,IAAI,IAAI,CAAC,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,CAAC;YAC/B,MAAM,IAAI,KAAK,CACb,kFAAkF;gBAClF,8CAA8C,CAC/C,CAAC;QACJ,CAAC;QACD,OAAO,IAAI,CAAC,IAAI,CAAC;IACnB,CAAC;CACF"}

package/dist/version.d.ts

@@ -6,4 +6,4 @@
  *
  * Used by the (future) User-Agent header on outbound SDK requests.
  */
-export declare const SDK_VERSION = "0.18.1";
+export declare const SDK_VERSION = "0.20.0";

package/dist/version.js

@@ -6,5 +6,5 @@
  *
  * Used by the (future) User-Agent header on outbound SDK requests.
  */
-export const SDK_VERSION = "0.18.1";
+export const SDK_VERSION = "0.20.0";
 //# sourceMappingURL=version.js.map

package/docs/cleanup.md

@@ -17,7 +17,7 @@ retention field is rejected if supplied.
 ```ts
 import { RunModels } from "@aexhq/sdk";
 
-const runId = await aex.submitRun({
+const runId = await aex.submit({
   model: RunModels.CLAUDE_HAIKU_4_5,
   prompt: "...",
   secrets: { apiKey: process.env.ANTHROPIC_API_KEY! }

package/docs/credentials.md

@@ -6,7 +6,7 @@ title: Credentials
 
 aex does not store provider keys or MCP credential values across runs.
 
-The caller passes a workspace-scoped SDK token and the provider key inline on every `submitRun` call. aex holds the bundle in run-scoped custody for the run lifecycle and attempts terminal cleanup/revocation for the aex-controlled references. MCP credentials and proxy endpoint auth values travel the same way.
+The caller passes a workspace-scoped SDK token and the provider key inline on every `submit` call. aex holds the bundle in run-scoped custody for the run lifecycle and attempts terminal cleanup/revocation for the aex-controlled references. MCP credentials and proxy endpoint auth values travel the same way.
 
 A run targets exactly one provider (selected by `provider`, default `anthropic`), so the key is a single flat field:
 
@@ -80,7 +80,7 @@ const proxyEndpointAuth = [
 // Fail fast at submission time when policy and auth disagree.
 validateProxyAuth(proxyEndpoints, proxyEndpointAuth);
 
-const runId = await aex.submitRun({
+const runId = await aex.submit({
   model: RunModels.CLAUDE_HAIKU_4_5,
   prompt: "…",
   proxyEndpoints,
@@ -119,7 +119,7 @@ const proxyEndpoints = [
   }
 ] as const;
 
-const runId = await aex.submitRun({
+const runId = await aex.submit({
   model: RunModels.CLAUDE_HAIKU_4_5,
   prompt: "…",
   proxyEndpoints,
@@ -155,4 +155,4 @@ const allowedHosts = buildPlatformAllowedHosts({
 
 ### Secrets are always explicit at the call site
 
-There is no `defaultSecrets` and no client-held secret state. Every `submitRun` call carries its full `secrets` bundle (one provider key + optional MCP credentials + optional `proxyEndpointAuth`). This is the agent-first invariant: the credentials being used on any given call are visible in the same line of code that submits the run.
+There is no `defaultSecrets` and no client-held secret state. Every `submit` call carries its full `secrets` bundle (one provider key + optional MCP credentials + optional `proxyEndpointAuth`). This is the agent-first invariant: the credentials being used on any given call are visible in the same line of code that submits the run.

package/docs/events.md

@@ -48,7 +48,7 @@ and `3` when `--timeout` elapses first (a `--timeout` on `events --follow` /
 `run --follow` uses the same exit-`3` convention). Durations accept `ms`/`s`/`m`/`h`
 suffixes or a bare millisecond integer.
 
-Both surfaces observe the same events. A subscriber attached after `submitRun()` returns replays the events it missed, then continues live.
+Both surfaces observe the same events. A subscriber attached after `submit()` returns replays the events it missed, then continues live.
 
 ## Terminal events vs. the run record
 
@@ -90,7 +90,7 @@ run's last stream event, immediately after the durable record commits.
 
 ## Event shape
 
-Events are typed as the discriminated `RunEvent` union for compatibility and as the versioned coordinator envelope for live consumers. aex records raw runtime/provider payloads **after** secret redaction and structural sanitization, so the bytes you see never contain the provider key, MCP credentials, or proxy bearer that were supplied to `submitRun`.
+Events are typed as the discriminated `RunEvent` union for compatibility and as the versioned coordinator envelope for live consumers. aex records raw runtime/provider payloads **after** secret redaction and structural sanitization, so the bytes you see never contain the provider key, MCP credentials, or proxy bearer that were supplied to `submit`.
 
 ## Typed helpers
 

package/docs/outputs.md

@@ -11,7 +11,7 @@ Every run produces durable metadata (status, events, snapshots, cleanup state) a
 ```ts
 import { RunModels } from "@aexhq/sdk";
 
-const runId = await aex.submitRun({
+const runId = await aex.submit({
   model: RunModels.CLAUDE_HAIKU_4_5,
   prompt: "Produce a report and save it as a file.",
   secrets: { apiKey }
@@ -90,7 +90,7 @@ console.log(looseReport.byteLength);
 ## `outputs.allowedDirs` — override capture roots
 
 ```ts
-aex.submitRun({
+aex.submit({
   /* ... */,
   outputs: {
     allowedDirs: ["/workspace/reports", "/workspace/state"]
@@ -115,7 +115,7 @@ Runtime notes:
 ## `outputs.deniedDirs` — subtract noise
 
 ```ts
-aex.submitRun({
+aex.submit({
   /* ... */,
   outputs: {
     deniedDirs: ["node_modules", "/var/cache", "*.tmp"]