@aexhq/sdk 0.24.0 → 0.25.1

package/dist/_contracts/provider-support.d.ts

@@ -1,6 +1,4 @@
 import type { RunProvider, RuntimeKind } from "./submission.js";
-export declare const PROVIDER_SUPPORT_STATUSES: readonly ["supported", "live-unverified", "rejected"];
-export type ProviderSupportStatus = (typeof PROVIDER_SUPPORT_STATUSES)[number];
 export interface SupportPointer {
     readonly label: string;
     /** Markdown href, relative to `packages/sdk/docs/provider-runtime-capabilities.md`. */
@@ -8,7 +6,6 @@ export interface SupportPointer {
 }
 export interface ProviderPublicSupport {
     readonly displayName: string;
-    readonly status: ProviderSupportStatus;
     readonly docsAnchor: string;
     readonly docs: readonly SupportPointer[];
     readonly evidence: readonly SupportPointer[];
@@ -36,17 +33,16 @@ export declare const RUNTIME_VALIDATION_SUPPORT: {
 };
 /**
  * Public provider support facts for generated SDK docs. Keep this metadata
- * public-facing only: provider names, support status, docs anchors, and
- * evidence pointers.
+ * public-facing only: provider names, docs anchors, and evidence pointers.
+ * Inclusion in this registry means the provider is supported.
  */
 export declare const PROVIDER_PUBLIC_SUPPORT: {
     readonly anthropic: {
         readonly displayName: "Anthropic";
-        readonly status: "supported";
         readonly docsAnchor: "anthropic";
         readonly docs: readonly [{
-            readonly label: "Credentials";
-            readonly href: "credentials.md";
+            readonly label: "Secrets";
+            readonly href: "secrets.md";
         }, {
             readonly label: "Events";
             readonly href: "events.md";
@@ -79,11 +75,10 @@ export declare const PROVIDER_PUBLIC_SUPPORT: {
     };
     readonly deepseek: {
         readonly displayName: "DeepSeek";
-        readonly status: "supported";
         readonly docsAnchor: "deepseek";
         readonly docs: readonly [{
-            readonly label: "Credentials";
-            readonly href: "credentials.md";
+            readonly label: "Secrets";
+            readonly href: "secrets.md";
         }, {
             readonly label: "Events";
             readonly href: "events.md";
@@ -122,11 +117,10 @@ export declare const PROVIDER_PUBLIC_SUPPORT: {
     };
     readonly openai: {
         readonly displayName: "OpenAI";
-        readonly status: "live-unverified";
         readonly docsAnchor: "openai";
         readonly docs: readonly [{
-            readonly label: "Credentials";
-            readonly href: "credentials.md";
+            readonly label: "Secrets";
+            readonly href: "secrets.md";
         }, {
             readonly label: "Events";
             readonly href: "events.md";
@@ -156,11 +150,10 @@ export declare const PROVIDER_PUBLIC_SUPPORT: {
     };
     readonly gemini: {
         readonly displayName: "Gemini";
-        readonly status: "live-unverified";
         readonly docsAnchor: "gemini";
         readonly docs: readonly [{
-            readonly label: "Credentials";
-            readonly href: "credentials.md";
+            readonly label: "Secrets";
+            readonly href: "secrets.md";
         }, {
             readonly label: "Events";
             readonly href: "events.md";
@@ -190,11 +183,10 @@ export declare const PROVIDER_PUBLIC_SUPPORT: {
     };
     readonly mistral: {
         readonly displayName: "Mistral";
-        readonly status: "live-unverified";
         readonly docsAnchor: "mistral";
         readonly docs: readonly [{
-            readonly label: "Credentials";
-            readonly href: "credentials.md";
+            readonly label: "Secrets";
+            readonly href: "secrets.md";
         }, {
             readonly label: "Events";
             readonly href: "events.md";
@@ -224,11 +216,10 @@ export declare const PROVIDER_PUBLIC_SUPPORT: {
     };
     readonly openrouter: {
         readonly displayName: "OpenRouter";
-        readonly status: "live-unverified";
         readonly docsAnchor: "openrouter";
         readonly docs: readonly [{
-            readonly label: "Credentials";
-            readonly href: "credentials.md";
+            readonly label: "Secrets";
+            readonly href: "secrets.md";
         }, {
             readonly label: "Events";
             readonly href: "events.md";
@@ -258,11 +249,10 @@ export declare const PROVIDER_PUBLIC_SUPPORT: {
     };
     readonly doubao: {
         readonly displayName: "Doubao";
-        readonly status: "live-unverified";
         readonly docsAnchor: "doubao";
         readonly docs: readonly [{
-            readonly label: "Credentials";
-            readonly href: "credentials.md";
+            readonly label: "Secrets";
+            readonly href: "secrets.md";
         }, {
             readonly label: "Events";
             readonly href: "events.md";
@@ -292,11 +282,10 @@ export declare const PROVIDER_PUBLIC_SUPPORT: {
     };
     readonly "doubao-cn": {
         readonly displayName: "Doubao (China)";
-        readonly status: "live-unverified";
         readonly docsAnchor: "doubao-cn";
         readonly docs: readonly [{
-            readonly label: "Credentials";
-            readonly href: "credentials.md";
+            readonly label: "Secrets";
+            readonly href: "secrets.md";
         }, {
             readonly label: "Events";
             readonly href: "events.md";

package/dist/_contracts/provider-support.js

@@ -1,10 +1,5 @@
-export const PROVIDER_SUPPORT_STATUSES = [
-    "supported",
-    "live-unverified",
-    "rejected"
-];
 const COMMON_DOCS = [
-    { label: "Credentials", href: "credentials.md" },
+    { label: "Secrets", href: "secrets.md" },
     { label: "Events", href: "events.md" }
 ];
 const COMMON_EVIDENCE = [
@@ -46,13 +41,12 @@ export const RUNTIME_VALIDATION_SUPPORT = {
 };
 /**
  * Public provider support facts for generated SDK docs. Keep this metadata
- * public-facing only: provider names, support status, docs anchors, and
- * evidence pointers.
+ * public-facing only: provider names, docs anchors, and evidence pointers.
+ * Inclusion in this registry means the provider is supported.
  */
 export const PROVIDER_PUBLIC_SUPPORT = {
     anthropic: {
         displayName: "Anthropic",
-        status: "supported",
         docsAnchor: "anthropic",
         docs: COMMON_DOCS,
         evidence: [...COMMON_EVIDENCE, ...ANTHROPIC_MANAGED_EVIDENCE],
@@ -62,7 +56,6 @@ export const PROVIDER_PUBLIC_SUPPORT = {
     },
     deepseek: {
         displayName: "DeepSeek",
-        status: "supported",
         docsAnchor: "deepseek",
         docs: COMMON_DOCS,
         evidence: [...COMMON_EVIDENCE, ...DEEPSEEK_MANAGED_EVIDENCE],
@@ -72,7 +65,6 @@ export const PROVIDER_PUBLIC_SUPPORT = {
     },
     openai: {
         displayName: "OpenAI",
-        status: "live-unverified",
         docsAnchor: "openai",
         docs: COMMON_DOCS,
         evidence: COMMON_EVIDENCE,
@@ -82,7 +74,6 @@ export const PROVIDER_PUBLIC_SUPPORT = {
     },
     gemini: {
         displayName: "Gemini",
-        status: "live-unverified",
         docsAnchor: "gemini",
         docs: COMMON_DOCS,
         evidence: COMMON_EVIDENCE,
@@ -92,7 +83,6 @@ export const PROVIDER_PUBLIC_SUPPORT = {
     },
     mistral: {
         displayName: "Mistral",
-        status: "live-unverified",
         docsAnchor: "mistral",
         docs: COMMON_DOCS,
         evidence: COMMON_EVIDENCE,
@@ -102,7 +92,6 @@ export const PROVIDER_PUBLIC_SUPPORT = {
     },
     openrouter: {
         displayName: "OpenRouter",
-        status: "live-unverified",
         docsAnchor: "openrouter",
         docs: COMMON_DOCS,
         evidence: COMMON_EVIDENCE,
@@ -111,13 +100,8 @@ export const PROVIDER_PUBLIC_SUPPORT = {
         }
     },
     // Doubao (ByteDance) via the official Ark API — international BytePlus gateway.
-    // Wired + parser/routing-verified but not yet proven against a live BytePlus
-    // account, so `live-unverified`. Promote to `supported` (and swap COMMON_EVIDENCE
-    // for a DOUBAO_MANAGED_EVIDENCE pointer to live-sdk-doubao.test.ts) once the
-    // live run passes.
     doubao: {
         displayName: "Doubao",
-        status: "live-unverified",
         docsAnchor: "doubao",
         docs: COMMON_DOCS,
         evidence: COMMON_EVIDENCE,
@@ -126,11 +110,8 @@ export const PROVIDER_PUBLIC_SUPPORT = {
         }
     },
     // Doubao (ByteDance) via the official Ark API — China Volcengine gateway.
-    // Same wiring as `doubao`; additionally gated on CF Worker egress reaching the
-    // Beijing host (see apps/egress-probe). `live-unverified` until proven live.
     "doubao-cn": {
         displayName: "Doubao (China)",
-        status: "live-unverified",
         docsAnchor: "doubao-cn",
         docs: COMMON_DOCS,
         evidence: COMMON_EVIDENCE,

package/dist/_contracts/proxy-protocol.d.ts

@@ -134,14 +134,16 @@ export interface ProxyIndexEntry {
  * default. A customer can opt into a per-response truncation cap by setting a
  * positive value. There is no cumulative per-run call/byte budget: it needed a
  * per-call counter on the hot path and only existed to bound memory, which
- * streaming already does.
+ * streaming already does. The platform records named-proxy request bytes,
+ * response bytes, attempts, and retries as run-log usage telemetry only; no
+ * pricing/charging model is derived here.
  */
 export declare const PROXY_ENDPOINT_DEFAULTS: {
     readonly allowHeaders: readonly string[];
     readonly responseMode: ProxyResponseMode;
     readonly maxRequestBytes: number;
     readonly maxResponseBytes: 0;
-    readonly timeoutMs: 10000;
+    readonly timeoutMs: number;
 };
 /**
  * Non-secret endpoint policy the index builder consumes. Structurally a

package/dist/_contracts/proxy-protocol.js

@@ -140,16 +140,23 @@ export const PROXY_ERROR_CODES = [
  * default. A customer can opt into a per-response truncation cap by setting a
  * positive value. There is no cumulative per-run call/byte budget: it needed a
  * per-call counter on the hot path and only existed to bound memory, which
- * streaming already does.
+ * streaming already does. The platform records named-proxy request bytes,
+ * response bytes, attempts, and retries as run-log usage telemetry only; no
+ * pricing/charging model is derived here.
  */
 export const PROXY_ENDPOINT_DEFAULTS = {
     allowHeaders: [],
     responseMode: "headers_only",
-    maxRequestBytes: 64 * 1024,
+    // 10 MiB. The body is buffered into the Worker to enforce this cap, while the
+    // launch default fits practical multimodal/tool POSTs without every endpoint
+    // needing an override.
+    maxRequestBytes: 10 * 1024 * 1024,
     // Unlimited (0). The request body is buffered to enforce its cap, so that
     // stays finite; the response is streamed, so it does not need one.
     maxResponseBytes: 0,
-    timeoutMs: 10_000
+    // 5 minutes. Long-running upstream tool/model calls should not fail under a
+    // development-oriented 10s ceiling; endpoints can still set a smaller value.
+    timeoutMs: 5 * 60 * 1000
 };
 /**
  * Build the per-run {@link ProxyIndexFile} mounted into the container at

package/dist/_contracts/run-config.d.ts

@@ -47,6 +47,12 @@ export declare const SKILL_ID_PATTERN: RegExp;
  * surface so callers fail at the boundary rather than in the BFF.
  */
 export declare const SKILL_NAME_PATTERN: RegExp;
+/**
+ * Provider-safe submitted tool name. Tool names share the same lowercase
+ * kebab/underscore envelope as skills. Submission parsing rejects `__`
+ * because SessionDO reserves that separator for MCP namespace routing.
+ */
+export declare const TOOL_NAME_PATTERN: RegExp;
 /**
  * Hard caps applied at upload time. The SDK enforces these before
  * computing the zip hash so a clearly-too-big bundle never wastes
@@ -87,6 +93,23 @@ export interface AssetRef {
     readonly name: string;
     readonly mountPath?: string;
 }
+type ToolJsonPrimitive = string | number | boolean | null;
+type ToolJsonValue = ToolJsonPrimitive | ToolJsonValue[] | {
+    readonly [key: string]: ToolJsonValue;
+};
+export type ToolInputSchema = {
+    readonly [key: string]: ToolJsonValue;
+};
+/**
+ * User-supplied executable tool bundle. The bytes are addressed by the same
+ * content-addressed asset ref used by Skills/Files, while the provider-visible
+ * manifest rides as value-free metadata on the submission.
+ */
+export interface ToolRef extends AssetRef {
+    readonly description: string;
+    readonly input_schema: ToolInputSchema;
+    readonly entry: string;
+}
 export interface ProviderSkillRef {
     readonly kind: "provider";
     readonly vendor: "anthropic" | "custom";
@@ -141,10 +164,10 @@ export declare function parseSkillRef(input: unknown, path: string): SkillRef;
  */
 export declare function parseAssetRefFields(record: Record<string, unknown>, path: string): AssetRef;
 /**
- * Manifest entry persisted in `skill_bundles.manifest` and
- * `run_skill_snapshots.manifest`. `path` is forward-slash, relative,
- * normalised. `mode` is the stored POSIX mode (sanitised, NOT the user's
- * filesystem mode) — see `SKILL_BUNDLE_LIMITS.defaultFileMode`.
+ * Manifest entry persisted in `skill_bundles.manifest` and in run-owned
+ * snapshots. `path` is forward-slash, relative, normalised. `mode` is the
+ * stored POSIX mode (sanitised, NOT the user's filesystem mode) — see
+ * `SKILL_BUNDLE_LIMITS.defaultFileMode`.
  */
 export interface SkillBundleEntry {
     readonly path: string;
@@ -330,3 +353,4 @@ export interface NormalisedRunRequestConfig {
     }>;
 }
 export declare function normaliseRunRequestConfig(config: RunRequestConfig): NormalisedRunRequestConfig;
+export {};

package/dist/_contracts/run-config.js

@@ -48,6 +48,12 @@ export const SKILL_ID_PATTERN = /^skl_[A-Za-z0-9_-]{8,128}$/;
  * surface so callers fail at the boundary rather than in the BFF.
  */
 export const SKILL_NAME_PATTERN = /^[a-z0-9][a-z0-9_-]{0,127}$/;
+/**
+ * Provider-safe submitted tool name. Tool names share the same lowercase
+ * kebab/underscore envelope as skills. Submission parsing rejects `__`
+ * because SessionDO reserves that separator for MCP namespace routing.
+ */
+export const TOOL_NAME_PATTERN = SKILL_NAME_PATTERN;
 // ---------------------------------------------------------------------------
 // Skill bundle limits (uploaded bundles)
 // ---------------------------------------------------------------------------
@@ -465,11 +471,10 @@ export function rejectStdioMcpShape(record) {
 /**
  * Reasons an IP-literal host should be refused. Returns null when the
  * literal is a routable public address (or not an IP literal at all — name
- * resolution is the caller's concern). This in-package copy of the
- * numeric-range deny-list is kept byte-identical to
- * platform/packages/shared/src/blueprint.ts by the contract-parity gate, so
- * the shared MCP parser, the Worker BYOK proxy handlers, and
- * `submission.parseProxyBaseUrl` all classify the same bytes.
+ * resolution is the caller's concern). This numeric-range deny-list is kept
+ * in parity across the public contract parser and platform shared parser so
+ * the MCP parser, BYOK proxy handlers, and `submission.parseProxyBaseUrl`
+ * classify the same bytes.
  *
  * `host` is the already-bracket-stripped, lowercased hostname.
  *

package/dist/_contracts/run-cost.d.ts

@@ -1,14 +1,13 @@
-import type { CredentialMode } from "./managed-key.js";
-import type { RunProvider, RuntimeKind } from "./submission.js";
+import type { CredentialMode, RunProvider, RuntimeKind } from "./submission.js";
 export declare const RUN_COST_TELEMETRY_SCHEMA_VERSION = 1;
 export declare const RUN_USAGE_SAMPLE_SCHEMA_VERSION = 1;
 export declare const RUN_COST_SUMMARY_STATUSES: readonly ["pending", "partial", "complete", "unavailable", "not_applicable"];
 export type RunCostSummaryStatus = (typeof RUN_COST_SUMMARY_STATUSES)[number];
 export declare const RUN_USAGE_SAMPLE_UNITS: readonly ["token", "millisecond", "byte", "byte_millisecond", "count", "file", "credit_unit"];
 export type RunUsageSampleUnit = (typeof RUN_USAGE_SAMPLE_UNITS)[number];
-export declare const RUN_USAGE_SAMPLE_SOURCE_TYPES: readonly ["coordinator-event", "run-event", "usage-ledger", "output-object", "proxy-call", "runtime-job", "provider-session", "storage-accrual", "billing-reservation", "billing-settlement", "billing-release", "manual-adjustment"];
+export declare const RUN_USAGE_SAMPLE_SOURCE_TYPES: readonly ["coordinator-event", "run-event", "usage-ledger", "output-object", "proxy-call", "runtime-job", "provider-session", "storage-accrual", "manual-adjustment"];
 export type RunUsageSampleSourceType = (typeof RUN_USAGE_SAMPLE_SOURCE_TYPES)[number];
-export declare const RUN_USAGE_SAMPLE_METRICS: readonly ["provider.input_tokens", "provider.output_tokens", "provider.cache_read_input_tokens", "provider.cache_creation_input_tokens", "provider.total_tokens", "runtime.queued_ms", "runtime.active_ms", "runtime.output_capture_ms", "runtime.cleanup_ms", "run.total_ms", "output.discovered_files", "output.captured_files", "output.failed_files", "output.captured_bytes", "retry.runtime_attempts", "retry.provider_poll", "retry.output_capture", "retry.output_upload", "capture.uploaded_files", "capture.failed_files", "capture.total_bytes", "storage.current_bytes", "storage.byte_milliseconds", "proxy.call_count", "proxy.failed_call_count", "proxy.request_bytes", "proxy.response_bytes", "proxy.duration_ms", "managed_key.reserved_credit_units", "managed_key.charged_credit_units", "managed_key.released_credit_units"];
+export declare const RUN_USAGE_SAMPLE_METRICS: readonly ["provider.input_tokens", "provider.output_tokens", "provider.cache_read_input_tokens", "provider.cache_creation_input_tokens", "provider.total_tokens", "runtime.queued_ms", "runtime.active_ms", "runtime.output_capture_ms", "runtime.cleanup_ms", "run.total_ms", "output.discovered_files", "output.captured_files", "output.failed_files", "output.captured_bytes", "retry.runtime_attempts", "retry.provider_poll", "retry.output_capture", "retry.output_upload", "capture.uploaded_files", "capture.failed_files", "capture.total_bytes", "storage.current_bytes", "storage.byte_milliseconds", "proxy.call_count", "proxy.failed_call_count", "proxy.request_bytes", "proxy.response_bytes", "proxy.duration_ms"];
 export type RunUsageSampleMetric = (typeof RUN_USAGE_SAMPLE_METRICS)[number];
 export interface RunUsageSampleSource {
     readonly type: RunUsageSampleSourceType;
@@ -86,12 +85,6 @@ export interface RunCostProxyTelemetry {
     readonly responseBytes?: number;
     readonly durationMs?: number;
 }
-export interface RunCostManagedKeyBudgetTelemetry {
-    readonly credentialMode?: CredentialMode;
-    readonly reservedCreditUnits?: number;
-    readonly chargedCreditUnits?: number;
-    readonly releasedCreditUnits?: number;
-}
 /**
  * The basis for a {@link RunCostTelemetry.billedCostUsd}: an honest marker of
  * whether the figure is a settle-time ESTIMATE or has been RECONCILED against
@@ -122,7 +115,6 @@ export interface RunCostTelemetry {
     readonly providerUsage?: readonly RunCostProviderUsage[];
     readonly storage?: RunCostStorageTelemetry;
     readonly proxy?: RunCostProxyTelemetry;
-    readonly managedKey?: RunCostManagedKeyBudgetTelemetry;
     /**
      * Customer-facing AEX cost of serving this run, USD — a REPORTED ESTIMATE,
      * not a charge (telemetry/showback only; no invoicing or credit deduction).

package/dist/_contracts/run-cost.js

@@ -25,9 +25,6 @@ export const RUN_USAGE_SAMPLE_SOURCE_TYPES = [
     "runtime-job",
     "provider-session",
     "storage-accrual",
-    "billing-reservation",
-    "billing-settlement",
-    "billing-release",
     "manual-adjustment"
 ];
 export const RUN_USAGE_SAMPLE_METRICS = [
@@ -58,10 +55,7 @@ export const RUN_USAGE_SAMPLE_METRICS = [
     "proxy.failed_call_count",
     "proxy.request_bytes",
     "proxy.response_bytes",
-    "proxy.duration_ms",
-    "managed_key.reserved_credit_units",
-    "managed_key.charged_credit_units",
-    "managed_key.released_credit_units"
+    "proxy.duration_ms"
 ];
 const RUN_USAGE_SAMPLE_METRIC_UNITS = {
     "provider.input_tokens": "token",
@@ -91,10 +85,7 @@ const RUN_USAGE_SAMPLE_METRIC_UNITS = {
     "proxy.failed_call_count": "count",
     "proxy.request_bytes": "byte",
     "proxy.response_bytes": "byte",
-    "proxy.duration_ms": "millisecond",
-    "managed_key.reserved_credit_units": "credit_unit",
-    "managed_key.charged_credit_units": "credit_unit",
-    "managed_key.released_credit_units": "credit_unit"
+    "proxy.duration_ms": "millisecond"
 };
 /**
  * The basis for a {@link RunCostTelemetry.billedCostUsd}: an honest marker of
@@ -144,7 +135,6 @@ export function buildRunCostTelemetry(input) {
         ...(input.providerUsage ? { providerUsage: input.providerUsage.map(normalizeProviderUsage) } : {}),
         ...(input.storage ? { storage: normalizeStorage(input.storage) } : {}),
         ...(input.proxy ? { proxy: normalizeProxy(input.proxy) } : {}),
-        ...(input.managedKey ? { managedKey: normalizeManagedKey(input.managedKey) } : {}),
         ...(input.billedCostUsd !== undefined ? { billedCostUsd: nonNegativeFinite(input.billedCostUsd, "billedCostUsd") } : {}),
         ...(input.costBasis ? { costBasis: normalizeCostBasis(input.costBasis) } : {})
     });
@@ -170,10 +160,8 @@ export function buildRunCostTelemetryFromUsageSamples(input) {
     const capture = {};
     const storage = {};
     const proxy = {};
-    const managedKey = {};
     const providerUsage = new Map();
     let captureAttempted = false;
-    let managedKeyCredentialMode;
     for (const sample of samples) {
         switch (sample.metric) {
             case "provider.input_tokens":
@@ -263,18 +251,6 @@ export function buildRunCostTelemetryFromUsageSamples(input) {
             case "proxy.duration_ms":
                 addDraftNumber(proxy, "durationMs", sample.quantity);
                 break;
-            case "managed_key.reserved_credit_units":
-                managedKeyCredentialMode = sample.credentialMode ?? managedKeyCredentialMode;
-                addDraftNumber(managedKey, "reservedCreditUnits", sample.quantity);
-                break;
-            case "managed_key.charged_credit_units":
-                managedKeyCredentialMode = sample.credentialMode ?? managedKeyCredentialMode;
-                addDraftNumber(managedKey, "chargedCreditUnits", sample.quantity);
-                break;
-            case "managed_key.released_credit_units":
-                managedKeyCredentialMode = sample.credentialMode ?? managedKeyCredentialMode;
-                addDraftNumber(managedKey, "releasedCreditUnits", sample.quantity);
-                break;
         }
     }
     if (Object.keys(durations).length > 0)
@@ -293,12 +269,6 @@ export function buildRunCostTelemetryFromUsageSamples(input) {
         telemetry.storage = storage;
     if (Object.keys(proxy).length > 0)
         telemetry.proxy = proxy;
-    if (Object.keys(managedKey).length > 0 || managedKeyCredentialMode) {
-        telemetry.managedKey = {
-            ...(managedKeyCredentialMode ? { credentialMode: managedKeyCredentialMode } : {}),
-            ...managedKey
-        };
-    }
     return buildRunCostTelemetry(telemetry);
 }
 export function summarizeUsageSamples(samples) {
@@ -329,7 +299,6 @@ export function mergeRunCostTelemetry(base, next) {
     const providerUsage = [...(base.providerUsage ?? []), ...(patch.providerUsage ?? [])];
     const storage = sumStorage(base.storage, patch.storage);
     const proxy = sumProxy(base.proxy, patch.proxy);
-    const managedKey = mergeManagedKey(base.managedKey, patch.managedKey);
     // Derived cost fields are LAST-WRITER-WINS (a re-derivation supersedes the
     // prior estimate), not summed — they are projections of the whole sample set,
     // not additive metrics.
@@ -361,8 +330,6 @@ export function mergeRunCostTelemetry(base, next) {
         merged.storage = storage;
     if (proxy)
         merged.proxy = proxy;
-    if (managedKey)
-        merged.managedKey = managedKey;
     if (billedCostUsd !== undefined)
         merged.billedCostUsd = billedCostUsd;
     if (costBasis)
@@ -435,16 +402,6 @@ function normalizeProxy(input) {
         durationMs: input.durationMs
     });
 }
-function normalizeManagedKey(input) {
-    return Object.freeze({
-        ...(input.credentialMode ? { credentialMode: input.credentialMode } : {}),
-        ...freezeOptionalNumbers({
-            reservedCreditUnits: input.reservedCreditUnits,
-            chargedCreditUnits: input.chargedCreditUnits,
-            releasedCreditUnits: input.releasedCreditUnits
-        })
-    });
-}
 function normalizeSourceSummary(input) {
     return Object.freeze({
         sampleCount: nonNegativeFinite(input.sampleCount, "sourceSummary.sampleCount"),
@@ -599,18 +556,6 @@ function mergeCapture(base, next) {
         ...(failureReasons.length > 0 ? { failureReasons } : {})
     });
 }
-function mergeManagedKey(base, next) {
-    if (!base && !next) {
-        return undefined;
-    }
-    const credentialMode = next?.credentialMode ?? base?.credentialMode;
-    return normalizeManagedKey({
-        ...(credentialMode ? { credentialMode } : {}),
-        reservedCreditUnits: (base?.reservedCreditUnits ?? 0) + (next?.reservedCreditUnits ?? 0),
-        chargedCreditUnits: (base?.chargedCreditUnits ?? 0) + (next?.chargedCreditUnits ?? 0),
-        releasedCreditUnits: (base?.releasedCreditUnits ?? 0) + (next?.releasedCreditUnits ?? 0)
-    });
-}
 function mergeSourceSummary(base, next) {
     if (!base && !next) {
         return undefined;

package/dist/_contracts/run-custody.d.ts

@@ -1,11 +1,8 @@
-import type { CredentialMode } from "./managed-key.js";
 import type { RunStatus } from "./status.js";
-import type { RunProvider, RuntimeKind } from "./submission.js";
+import type { CredentialMode, RunProvider, RuntimeKind } from "./submission.js";
 export declare const CUSTODY_MANIFEST_SCHEMA_VERSION = 1;
-export declare const CUSTODY_TOMBSTONE_SCHEMA_VERSION = 1;
 export declare const CUSTODY_REDACTION_SCANNER_VERSION = 1;
 export declare const CUSTODY_MANIFEST_KIND = "aex.custody_manifest.v1";
-export declare const CUSTODY_TOMBSTONE_KIND = "aex.custody_tombstone.v1";
 export declare const CUSTODY_MANIFEST_CONTENT_TYPE = "application/json; charset=utf-8";
 export declare const CUSTODY_MANIFEST_RUN_REL_PATH = "metadata/custody.json";
 export declare const CUSTODY_SECRET_CLASSES: readonly ["provider_api_key", "mcp_credential", "proxy_endpoint_auth", "runner_bearer", "managed_system_credential"];
@@ -26,10 +23,6 @@ export declare const CUSTODY_EVIDENCE_SOURCES: readonly ["run_row", "runtime_man
 export type CustodyEvidenceSource = (typeof CUSTODY_EVIDENCE_SOURCES)[number];
 export declare const CUSTODY_MANIFEST_EXCLUDED_VALUE_CLASSES: readonly ["raw_secret_values", "bearer_hashes", "provider_response_bodies", "signed_urls", "object_store_keys", "vault_ids", "private_resource_handles"];
 export type CustodyManifestExcludedValueClass = (typeof CUSTODY_MANIFEST_EXCLUDED_VALUE_CLASSES)[number];
-export declare const CUSTODY_TOMBSTONE_MANIFEST_STATUSES: readonly ["written", "not_written", "write_failed", "purged"];
-export type CustodyTombstoneManifestStatus = (typeof CUSTODY_TOMBSTONE_MANIFEST_STATUSES)[number];
-export declare const CUSTODY_TOMBSTONE_DELETION_STATUSES: readonly ["not_deleted", "pending_delete", "deleted"];
-export type CustodyTombstoneDeletionStatus = (typeof CUSTODY_TOMBSTONE_DELETION_STATUSES)[number];
 export interface CustodyManifestRunV1 {
     readonly runId: string;
     readonly workspaceId: string;
@@ -137,48 +130,6 @@ export interface CustodyManifestInput {
     readonly resources?: readonly CustodyManifestResourceClassInput[];
     readonly cleanup?: CustodyManifestCleanupInput;
 }
-export interface CustodyTombstoneRunV1 {
-    readonly runId: string;
-    readonly workspaceId: string;
-    readonly terminalStatus: RunStatus | string;
-    readonly terminalAt?: string;
-}
-export interface CustodyTombstoneManifestV1 {
-    readonly schemaVersion: typeof CUSTODY_MANIFEST_SCHEMA_VERSION;
-    readonly status: CustodyTombstoneManifestStatus;
-    readonly generatedAt?: string;
-    readonly finalizedAt?: string;
-    readonly tombstonedAt: string;
-}
-export interface CustodyTombstoneDeletionV1 {
-    readonly status: CustodyTombstoneDeletionStatus;
-    readonly pendingAt?: string;
-    readonly deletedAt?: string;
-}
-export interface CustodyTombstoneRetentionV1 {
-    readonly defaultPolicy: "retain_indefinitely";
-    readonly userAction: "purge_or_anonymize_later";
-}
-export interface CustodyTombstoneV1 {
-    readonly schemaVersion: typeof CUSTODY_TOMBSTONE_SCHEMA_VERSION;
-    readonly kind: typeof CUSTODY_TOMBSTONE_KIND;
-    readonly run: CustodyTombstoneRunV1;
-    readonly manifest: CustodyTombstoneManifestV1;
-    readonly summary: CustodyManifestSummaryV1;
-    readonly deletion: CustodyTombstoneDeletionV1;
-    readonly retention: CustodyTombstoneRetentionV1;
-}
-export interface CustodyTombstoneInput {
-    readonly run: CustodyTombstoneRunV1;
-    readonly manifest: Omit<CustodyTombstoneManifestV1, "schemaVersion">;
-    readonly summary: CustodyManifestSummaryV1;
-    readonly deletion?: CustodyTombstoneDeletionV1;
-}
-export interface CustodyTombstoneFromManifestInput {
-    readonly manifestStatus?: CustodyTombstoneManifestStatus;
-    readonly tombstonedAt: string;
-    readonly deletion?: CustodyTombstoneDeletionV1;
-}
 export interface CustodyManifestWriteObject {
     readonly key: string;
     readonly contentType: typeof CUSTODY_MANIFEST_CONTENT_TYPE;
@@ -220,7 +171,5 @@ export declare function custodyManifestObjectKey(runId: string): string;
 export declare function createCustodyManifestWriter(store: CustodyManifestObjectStore): CustodyManifestWriter;
 export declare function writeCustodyManifest(store: CustodyManifestObjectStore, input: CustodyManifestInput): Promise<CustodyManifestWriteResult>;
 export declare function buildCustodyManifest(input: CustodyManifestInput): CustodyManifestV1;
-export declare function buildCustodyTombstone(input: CustodyTombstoneInput): CustodyTombstoneV1;
-export declare function buildCustodyTombstoneFromManifest(manifest: CustodyManifestV1, input: CustodyTombstoneFromManifestInput): CustodyTombstoneV1;
 export declare function scanCustodyPayloadForSensitiveValues(input: unknown): readonly CustodyRedactionFinding[];
 export declare function assertPublicSafeCustodyPayload(input: unknown): void;