@aexhq/sdk 0.25.2 → 0.26.1

package/docs/public-surface.json

@@ -3,7 +3,7 @@
   "productName": "Agent Executor",
   "oneLine": "aex is an agent execution platform for launching autonomous agents from a simple TypeScript SDK and CLI.",
   "description": "Submit typed runs, stream durable events, capture outputs, and compose agents with skills, files, MCP, proxy endpoints, and subagents across the managed runtime.",
-  "installCommand": "npm install @aexhq/sdk",
+  "installCommand": "bun add @aexhq/sdk",
   "examples": {
     "typescriptLines": [
       "import { AgentExecutor, Models, Providers } from \"@aexhq/sdk\";",

package/docs/quickstart.md

@@ -7,7 +7,7 @@ title: Quickstart
 ## 1. Install
 
 ```bash
-npm install @aexhq/sdk
+bun add @aexhq/sdk
 ```
 
 ## 2. Submit a run

package/docs/release.md

@@ -4,79 +4,74 @@ title: Release
 
 # Release
 
-Releases are manually dispatched from `.github/workflows/release.yml` after the
-target version is already on `main`. The npm package version is the release
-source of truth. The workflow publishes to npm and runs post-publish install
-checks, but it does not create git tags or GitHub Releases, keeping the remote
-repository on a clean `main` branch unless tags are added deliberately later.
-
-## How to ship a release (canary → validate → promote)
-
-The default flow publishes a **canary** first, validates it against the real
-platform (aex-platform's local + prod cross-service suite installs
-`@aexhq/sdk@canary` and exercises it like a user), and only then promotes the
-**same bytes** to `latest`. Because npm versions are immutable, the version the
-platform tested is byte-for-byte the version users get — there is no second
-publish.
-
-1. Bump the publishable package manifests to the next shared semver:
-   `packages/contracts/package.json`, `packages/conformance/package.json`,
-   `packages/cli/package.json`, and `packages/sdk/package.json`. Also update
-   `packages/sdk/src/version.ts` to match.
-2. Land the change on `main` with any companion code or docs.
-3. Confirm CI is green.
-4. Run the **Release** workflow from `main` with dist-tag **`canary`**. This
-   publishes `@aexhq/sdk@<version>` under the `canary` tag — `latest` is
-   untouched, so `npm install @aexhq/sdk` users are unaffected.
-5. Run the platform release against the canary: in **aex-platform**, dispatch
-   `deploy.yml` with `sdk_version=<version>` (threads `AEX_USER_TEST_VERSION`
-   into the suite). The local plane gates prod, and both planes' user-tests run
-   against `@aexhq/sdk@<version>`.
-6. On a green platform release, run the **Promote** workflow
-   (`promote.yml`) with `version=<version>`. It runs
-   `npm dist-tag add @aexhq/{contracts,conformance,cli,sdk}@<version> latest` —
-   a pure re-tag, never a re-publish.
-
-Shortcut: choosing dist-tag `latest` (or `next`) at step 4 publishes straight to
-that tag and skips the canary/promote gate — use it only for docs-only or
-out-of-band releases where the platform suite is not the gate.
-
-If any package at `<version>` already exists on npm, the release workflow fails
-before publishing (this is also what forbids a re-publish — promotion must be a
-re-tag). A failed release is fixed by bumping to a higher version.
-
-## Release pipeline
-
-The workflow has two jobs:
-
-1. **`publish`** runs on Ubuntu in the protected `npm-release` environment:
-   - `pnpm install --frozen-lockfile`
-   - npm version availability checks for `@aexhq/contracts`,
-     `@aexhq/conformance`, `@aexhq/cli`, and `@aexhq/sdk` at
-     `packages/sdk/package.json#version`
-   - `pnpm lint`
-   - `pnpm test`
-   - `pnpm run docs:build`
-   - `pnpm build`
-   - `pnpm --filter @aexhq/sdk pack`
-   - `pnpm run test:user:offline` against the packed tarball
-   - a final npm version availability check
-   - `pnpm publish --provenance --no-git-checks --access public` for
-     `@aexhq/contracts`, `@aexhq/conformance`, `@aexhq/cli`, and `@aexhq/sdk`
-2. **`post-publish-user-tests`** waits for npm registry visibility, then runs
-   `pnpm run test:user:offline` against the published version on Ubuntu and
-   Windows.
-
-The pre-publish user-test gate catches broken package shape, missing CLI bin,
-workspace dependency leaks, and TypeScript/ESM install regressions before npm
-publish. The post-publish matrix confirms the published registry artifact is
-installable from clean user projects on both Linux and Windows.
+The repository is Bun-first. Build, test, docs, package validation, user tests,
+and SDK packaging run through Bun. Registry publication uses npm on the
+Bun-packed SDK tarball so npm provenance and dist-tag controls stay explicit.
+
+## Package gate
+
+Before publishing, validate the package locally and in CI:
+
+```text
+bun ci
+bun run lint
+bun run test
+bun run test:user:offline
+bun run docs:build
+bun run pack:sdk
+```
+
+`bun run pack:sdk` builds the SDK, runs a Bun pack dry-run, and runs the public
+boundary gate. Offline user tests install the packed SDK into a clean Bun
+project and exercise the SDK and CLI from that install tree.
+
+## Publish
+
+The manual `.github/workflows/release.yml` workflow:
+
+- Installs with `bun ci`.
+- Runs lint, unit/security, offline user tests, docs build, and `pack:sdk`.
+- Refuses to publish if `@aexhq/sdk@<package version>` already exists.
+- Packs `packages/sdk` with `bun pm pack`.
+- Runs the publish job in the `npm-release` GitHub Environment and requires its
+  `NPM_TOKEN` secret.
+- Publishes the tarball with npm provenance to the selected dist-tag (`canary`
+  by default).
+- Waits for npm visibility.
+- Runs live user tests against the exact published version.
+
+Publish canary first for release validation. Promote the same immutable version
+only after the downstream platform release gate is green.
+
+## npm credentials
+
+The current release path uses a GitHub environment secret:
+
+- Environment: `npm-release`
+- Secret name: `NPM_TOKEN`
+
+The workflow intentionally fails before `npm publish` if that token is absent.
+Do not remove the `environment: npm-release` binding unless the package has been
+migrated to npm trusted publishing.
+
+Trusted publishing is the target credential model, but it is a separate npm
+package setting, not just a workflow permission. Before removing `NPM_TOKEN`,
+configure the npm trusted publisher for `aexhq/aex`, workflow file
+`release.yml`, and environment `npm-release`, then run the workflow with an npm
+CLI version that supports OIDC trusted publishing.
+
+## Promote
+
+The manual `.github/workflows/promote.yml` workflow assigns an npm dist-tag to
+an already-published `@aexhq/sdk` version, usually `latest` after canary and
+platform validation. It also runs in `npm-release`, requires `NPM_TOKEN`, and
+does not rebuild or republish the package.
 
 ## What ships in the tarball
 
-The published tarball is **self-contained**. It declares **zero `@aexhq/*`
-runtime dependencies** and is installable from a clean `npm install @aexhq/sdk`
-with no workspace access:
+The SDK tarball is self-contained. It declares zero `@aexhq/*` runtime
+dependencies and is installable from a clean Bun project with no workspace
+access:
 
 - `@aexhq/contracts` lives in `packages/sdk/package.json#devDependencies`
   only. At build time, [`packages/sdk/scripts/inline-contracts.mjs`](../scripts/inline-contracts.mjs)
@@ -89,37 +84,10 @@ with no workspace access:
   single `dist/cli.mjs`, which is the `bin: aex` entry in
   `packages/sdk/package.json`.
 - This invariant is mechanically enforced by
-  `apps/user-tests/test/offline/install.test.ts` ("declares no @aexhq/*
-  runtime dependencies") before publish.
-
-## Repository setup
-
-Set `NPM_TOKEN` in the protected GitHub `npm-release` environment. The token must
-have publish rights for all four packages. The workflow still publishes with
-provenance.
-
-Trusted Publishing can replace the token after every package exists on npm and
-the trusted publisher is configured for each package:
-
-- **Organization or user**: `aexhq`
-- **Repository**: `aex`
-- **Workflow filename**: `release.yml`
-- **Environment name**: `npm-release`
-
-## Local checklist
-
-Before dispatching a release, the same public-safe checks can be run locally:
-
-```text
-pnpm lint
-pnpm test
-pnpm run test:user:offline
-pnpm run docs:build
-pnpm run pack:sdk
-```
+  `apps/user-tests/test/offline/install.test.ts` before publish.
 
 ## Rollback
 
-There is no reliable "unpublish and reuse the version" path. npm version numbers
-are effectively immutable for release purposes, so a bad release is fixed by
-publishing a higher version.
+Published version numbers are immutable. Bad releases are fixed by publishing a
+higher version and moving dist-tags forward; source rollback alone does not
+remove an npm artifact.

package/docs/testing.md

@@ -12,17 +12,17 @@ reading or changing implementation.
 Workspace-wide commands:
 
 ```text
-pnpm lint                                      # typecheck/build prerequisites + lint
-pnpm test                                      # unit, all packages, deterministic
-pnpm test:user:offline                         # clean install of packed/published SDK, no live API
-pnpm test:user                                 # live hosted API user tests
-pnpm test:user:heavy                           # explicit heavy live canary
-pnpm run docs:build                            # generated docs + Next build
-pnpm run pack:sdk                              # SDK publish dry-run + public boundary check
+bun run lint                                      # typecheck/build prerequisites + lint
+bun run test                                      # unit, all packages, deterministic
+bun run test:user:offline                         # clean Bun install of packed/published SDK, no live API
+bun run test:user                                 # live hosted API user tests
+bun run test:user:heavy                           # explicit heavy live canary
+bun run docs:build                                # generated docs + Next build
+bun run pack:sdk                                  # SDK pack dry-run + public boundary check
 ```
 
 Unit tests are deterministic and may use fakes. Offline user tests install the
-packed or published SDK into clean temp projects and do not need provider
+packed or published SDK into clean Bun temp projects and do not need provider
 credentials.
 
 When neither `AEX_USER_TEST_TARBALL` nor `AEX_USER_TEST_VERSION` is set, the
@@ -31,4 +31,5 @@ that artifact. CI or release validation can pin an explicit artifact with
 exactly one of `AEX_USER_TEST_TARBALL` or `AEX_USER_TEST_VERSION`.
 
 Live user tests run against a hosted aex API and fail loudly when required env
-is missing: `AEX_API_URL`, `AEX_API_TOKEN`, and `DEEPSEEK_API_KEY`.
+is missing: `AEX_API_URL`, `AEX_API_TOKEN`, `ANTHROPIC_API_KEY`, and
+`DEEPSEEK_API_KEY`.

package/docs/vision-skills.md

@@ -94,7 +94,7 @@ request_body = {
 ```
 
 Write the body to a file and hand it to the mounted CLI with `--data @<file>`
-(the mount has no execute bit, so invoke through `node`; see `credentials.md`):
+(the mount has no execute bit, so invoke through `bun`; see `credentials.md`):
 
 ```python
 import subprocess
@@ -102,7 +102,7 @@ body_path = "/workspace/.aex/_ark_request.json"
 open(body_path, "w").write(json.dumps(request_body))
 
 result = subprocess.run(
-    ["node", "/mnt/session/uploads/aex/aex", "proxy", "doubao-ark",
+    ["bun", "/mnt/session/uploads/aex/aex", "proxy", "doubao-ark",
      "--method", "POST",
      "--path", "/api/v3/chat/completions",
      "--header", "content-type=application/json",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@aexhq/sdk",
-  "version": "0.25.2",
+  "version": "0.26.1",
   "description": "TypeScript SDK for running autonomous agent sessions across providers (Anthropic, OpenAI, DeepSeek, Gemini, Mistral) behind one interface.",
   "license": "Apache-2.0",
   "repository": {
@@ -25,23 +25,24 @@
     "docs",
     "examples"
   ],
-  "devDependencies": {
-    "@aexhq/contracts": "0.25.2"
-  },
-  "engines": {
-    "node": ">=20"
-  },
-  "dependencies": {
-    "fflate": "0.8.2"
-  },
   "scripts": {
-    "build": "node ./scripts/clean-dist.mjs && pnpm --filter @aexhq/contracts run build && pnpm --filter @aexhq/cli run build && tsc -p tsconfig.build.json && node ./scripts/bundle-cli.mjs && node ./scripts/inline-contracts.mjs",
+    "build": "bun ./scripts/clean-dist.mjs && bun run --cwd ../.. --filter @aexhq/contracts build && bun run --cwd ../.. --filter @aexhq/cli build && tsc -p tsconfig.build.json && bun ./scripts/bundle-cli.mjs && bun ./scripts/inline-contracts.mjs",
     "lint": "tsc --noEmit",
-    "test": "pnpm test:unit",
+    "test": "bun run test:unit",
     "test:unit": "vitest run test/unit",
     "test:security": "vitest run test/security",
     "test:property": "vitest run --passWithNoTests property",
     "test:coverage": "vitest run --coverage test/unit",
-    "publish:dry-run": "pnpm publish --dry-run --no-git-checks"
+    "prepack": "bun run build",
+    "pack:dry-run": "bun pm pack --dry-run --ignore-scripts"
+  },
+  "devDependencies": {
+    "@aexhq/contracts": "0.26.0"
+  },
+  "engines": {
+    "bun": ">=1.3.14"
+  },
+  "dependencies": {
+    "fflate": "0.8.2"
   }
-}
+}

package/LICENSE

@@ -1,201 +0,0 @@
-                                 Apache License
-                           Version 2.0, January 2004
-                        http://www.apache.org/licenses/
-
-   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
-
-   1. Definitions.
-
-      "License" shall mean the terms and conditions for use, reproduction,
-      and distribution as defined by Sections 1 through 9 of this document.
-
-      "Licensor" shall mean the copyright owner or entity authorized by
-      the copyright owner that is granting the License.
-
-      "Legal Entity" shall mean the union of the acting entity and all
-      other entities that control, are controlled by, or are under common
-      control with that entity. For the purposes of this definition,
-      "control" means (i) the power, direct or indirect, to cause the
-      direction or management of such entity, whether by contract or
-      otherwise, or (ii) ownership of fifty percent (50%) or more of the
-      outstanding shares, or (iii) beneficial ownership of such entity.
-
-      "You" (or "Your") shall mean an individual or Legal Entity
-      exercising permissions granted by this License.
-
-      "Source" form shall mean the preferred form for making modifications,
-      including but not limited to software source code, documentation
-      source, and configuration files.
-
-      "Object" form shall mean any form resulting from mechanical
-      transformation or translation of a Source form, including but
-      not limited to compiled object code, generated documentation,
-      and conversions to other media types.
-
-      "Work" shall mean the work of authorship, whether in Source or
-      Object form, made available under the License, as indicated by a
-      copyright notice that is included in or attached to the work
-      (an example is provided in the Appendix below).
-
-      "Derivative Works" shall mean any work, whether in Source or Object
-      form, that is based on (or derived from) the Work and for which the
-      editorial revisions, annotations, elaborations, or other modifications
-      represent, as a whole, an original work of authorship. For the purposes
-      of this License, Derivative Works shall not include works that remain
-      separable from, or merely link (or bind by name) to the interfaces of,
-      the Work and Derivative Works thereof.
-
-      "Contribution" shall mean any work of authorship, including
-      the original version of the Work and any modifications or additions
-      to that Work or Derivative Works thereof, that is intentionally
-      submitted to Licensor for inclusion in the Work by the copyright owner
-      or by an individual or Legal Entity authorized to submit on behalf of
-      the copyright owner. For the purposes of this definition, "submitted"
-      means any form of electronic, verbal, or written communication sent
-      to the Licensor or its representatives, including but not limited to
-      communication on electronic mailing lists, source code control systems,
-      and issue tracking systems that are managed by, or on behalf of, the
-      Licensor for the purpose of discussing and improving the Work, but
-      excluding communication that is conspicuously marked or otherwise
-      designated in writing by the copyright owner as "Not a Contribution."
-
-      "Contributor" shall mean Licensor and any individual or Legal Entity
-      on behalf of whom a Contribution has been received by Licensor and
-      subsequently incorporated within the Work.
-
-   2. Grant of Copyright License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      copyright license to reproduce, prepare Derivative Works of,
-      publicly display, publicly perform, sublicense, and distribute the
-      Work and such Derivative Works in Source or Object form.
-
-   3. Grant of Patent License. Subject to the terms and conditions of
-      this License, each Contributor hereby grants to You a perpetual,
-      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
-      (except as stated in this section) patent license to make, have made,
-      use, offer to sell, sell, import, and otherwise transfer the Work,
-      where such license applies only to those patent claims licensable
-      by such Contributor that are necessarily infringed by their
-      Contribution(s) alone or by combination of their Contribution(s)
-      with the Work to which such Contribution(s) was submitted. If You
-      institute patent litigation against any entity (including a
-      cross-claim or counterclaim in a lawsuit) alleging that the Work
-      or a Contribution incorporated within the Work constitutes direct
-      or contributory patent infringement, then any patent licenses
-      granted to You under this License for that Work shall terminate
-      as of the date such litigation is filed.
-
-   4. Redistribution. You may reproduce and distribute copies of the
-      Work or Derivative Works thereof in any medium, with or without
-      modifications, and in Source or Object form, provided that You
-      meet the following conditions:
-
-      (a) You must give any other recipients of the Work or
-          Derivative Works a copy of this License; and
-
-      (b) You must cause any modified files to carry prominent notices
-          stating that You changed the files; and
-
-      (c) You must retain, in the Source form of any Derivative Works
-          that You distribute, all copyright, patent, trademark, and
-          attribution notices from the Source form of the Work,
-          excluding those notices that do not pertain to any part of
-          the Derivative Works; and
-
-      (d) If the Work includes a "NOTICE" text file as part of its
-          distribution, then any Derivative Works that You distribute must
-          include a readable copy of the attribution notices contained
-          within such NOTICE file, excluding those notices that do not
-          pertain to any part of the Derivative Works, in at least one
-          of the following places: within a NOTICE text file distributed
-          as part of the Derivative Works; within the Source form or
-          documentation, if provided along with the Derivative Works; or,
-          within a display generated by the Derivative Works, if and
-          wherever such third-party notices normally appear. The contents
-          of the NOTICE file are for informational purposes only and
-          do not modify the License. You may add Your own attribution
-          notices within Derivative Works that You distribute, alongside
-          or as an addendum to the NOTICE text from the Work, provided
-          that such additional attribution notices cannot be construed
-          as modifying the License.
-
-      You may add Your own copyright statement to Your modifications and
-      may provide additional or different license terms and conditions
-      for use, reproduction, or distribution of Your modifications, or
-      for any such Derivative Works as a whole, provided Your use,
-      reproduction, and distribution of the Work otherwise complies with
-      the conditions stated in this License.
-
-   5. Submission of Contributions. Unless You explicitly state otherwise,
-      any Contribution intentionally submitted for inclusion in the Work
-      by You to the Licensor shall be under the terms and conditions of
-      this License, without any additional terms or conditions.
-      Notwithstanding the above, nothing herein shall supersede or modify
-      the terms of any separate license agreement you may have executed
-      with Licensor regarding such Contributions.
-
-   6. Trademarks. This License does not grant permission to use the trade
-      names, trademarks, service marks, or product names of the Licensor,
-      except as required for describing the origin of the Work and
-      reproducing the content of the NOTICE file.
-
-   7. Disclaimer of Warranty. Unless required by applicable law or
-      agreed to in writing, Licensor provides the Work (and each
-      Contributor provides its Contributions) on an "AS IS" BASIS,
-      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-      implied, including, without limitation, any warranties or conditions
-      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
-      PARTICULAR PURPOSE. You are solely responsible for determining the
-      appropriateness of using or redistributing the Work and assume any
-      risks associated with Your exercise of permissions under this License.
-
-   8. Limitation of Liability. In no event and under no legal theory,
-      whether in tort (including negligence), contract, or otherwise,
-      unless required by applicable law (such as deliberate and grossly
-      negligent acts) or agreed to in writing, shall any Contributor be
-      liable to You for damages, including any direct, indirect, special,
-      incidental, or consequential damages of any character arising as a
-      result of this License or out of the use or inability to use the
-      Work (including but not limited to damages for loss of goodwill,
-      work stoppage, computer failure or malfunction, or any and all
-      other commercial damages or losses), even if such Contributor
-      has been advised of the possibility of such damages.
-
-   9. Accepting Warranty or Additional Liability. While redistributing
-      the Work or Derivative Works thereof, You may choose to offer,
-      and charge a fee for, acceptance of support, warranty, indemnity,
-      or other liability obligations and/or rights consistent with this
-      License. However, in accepting such obligations, You may act only
-      on Your own behalf and on Your sole responsibility, not on behalf
-      of any other Contributor, and only if You agree to indemnify,
-      defend, and hold each Contributor harmless for any liability
-      incurred by, or claims asserted against, such Contributor by reason
-      of your accepting any such warranty or additional liability.
-
-   END OF TERMS AND CONDITIONS
-
-   APPENDIX: How to apply the Apache License to your work.
-
-      To apply the Apache License to your work, attach the following
-      boilerplate notice, with the fields enclosed by brackets "[]"
-      replaced with your own identifying information. (Don't include
-      the brackets!)  The text should be enclosed in the appropriate
-      comment syntax for the file format. We also recommend that a
-      file or class name and description of purpose be included on the
-      same "printed page" as the copyright notice for easier
-      identification within third-party archives.
-
-   Copyright 2026 aex contributors
-
-   Licensed under the Apache License, Version 2.0 (the "License");
-   you may not use this file except in compliance with the License.
-   You may obtain a copy of the License at
-
-       http://www.apache.org/licenses/LICENSE-2.0
-
-   Unless required by applicable law or agreed to in writing, software
-   distributed under the License is distributed on an "AS IS" BASIS,
-   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-   implied. See the License for the specific language governing
-   permissions and limitations under the License.