@aexhq/sdk 0.30.0 → 0.31.0

package/dist/cli.mjs

@@ -11841,7 +11841,7 @@ var PROXY_RESPONSE_MODES = ["status_only", "headers_only", "full"];
 var PROXY_ENDPOINT_DEFAULTS = {
   allowHeaders: [],
   responseMode: "headers_only",
-  // 10 MiB. The body is buffered into the Worker to enforce this cap, while the
+  // 10 MiB. The body is buffered in the hosted API to enforce this cap, while the
   // launch default fits practical multimodal/tool POSTs without every endpoint
   // needing an override.
   maxRequestBytes: 10 * 1024 * 1024,
@@ -11860,7 +11860,6 @@ var COMMON_DOCS = [
 ];
 var COMMON_EVIDENCE = [
   { label: "Submission parser and routing parity", href: "../../contracts/test/submission.test.ts" },
-  { label: "Runtime support validator", href: "../../contracts/test/runtime-support.test.ts" },
   { label: "Generated matrix freshness", href: "../../../scripts/validate/capability-matrix.test.ts" }
 ];
 var ANTHROPIC_LIVE_USER_EVIDENCE = [
@@ -11879,68 +11878,50 @@ var DEEPSEEK_LIVE_USER_EVIDENCE = [
     href: "../../../apps/user-tests/test/live/live-sdk-comprehensive.test.ts"
   }
 ];
-var ANTHROPIC_MANAGED_EVIDENCE = [
-  ...ANTHROPIC_LIVE_USER_EVIDENCE,
-  { label: "Runtime support validator", href: "../../contracts/test/runtime-support.test.ts" }
-];
-var DEEPSEEK_MANAGED_EVIDENCE = [
-  ...DEEPSEEK_LIVE_USER_EVIDENCE,
-  { label: "Runtime support validator", href: "../../contracts/test/runtime-support.test.ts" }
-];
+var ANTHROPIC_MANAGED_EVIDENCE = ANTHROPIC_LIVE_USER_EVIDENCE;
+var DEEPSEEK_MANAGED_EVIDENCE = DEEPSEEK_LIVE_USER_EVIDENCE;
 var PROVIDER_PUBLIC_SUPPORT = {
   anthropic: {
     displayName: "Anthropic",
     docsAnchor: "anthropic",
     docs: COMMON_DOCS,
     evidence: [...COMMON_EVIDENCE, ...ANTHROPIC_MANAGED_EVIDENCE],
-    runtimeEvidence: {
-      managed: ANTHROPIC_MANAGED_EVIDENCE
-    }
+    managedEvidence: ANTHROPIC_MANAGED_EVIDENCE
   },
   deepseek: {
     displayName: "DeepSeek",
     docsAnchor: "deepseek",
     docs: COMMON_DOCS,
     evidence: [...COMMON_EVIDENCE, ...DEEPSEEK_MANAGED_EVIDENCE],
-    runtimeEvidence: {
-      managed: DEEPSEEK_MANAGED_EVIDENCE
-    }
+    managedEvidence: DEEPSEEK_MANAGED_EVIDENCE
   },
   openai: {
     displayName: "OpenAI",
     docsAnchor: "openai",
     docs: COMMON_DOCS,
     evidence: COMMON_EVIDENCE,
-    runtimeEvidence: {
-      managed: COMMON_EVIDENCE
-    }
+    managedEvidence: COMMON_EVIDENCE
   },
   gemini: {
     displayName: "Gemini",
     docsAnchor: "gemini",
     docs: COMMON_DOCS,
     evidence: COMMON_EVIDENCE,
-    runtimeEvidence: {
-      managed: COMMON_EVIDENCE
-    }
+    managedEvidence: COMMON_EVIDENCE
   },
   mistral: {
     displayName: "Mistral",
     docsAnchor: "mistral",
     docs: COMMON_DOCS,
     evidence: COMMON_EVIDENCE,
-    runtimeEvidence: {
-      managed: COMMON_EVIDENCE
-    }
+    managedEvidence: COMMON_EVIDENCE
   },
   openrouter: {
     displayName: "OpenRouter",
     docsAnchor: "openrouter",
     docs: COMMON_DOCS,
     evidence: COMMON_EVIDENCE,
-    runtimeEvidence: {
-      managed: COMMON_EVIDENCE
-    }
+    managedEvidence: COMMON_EVIDENCE
   },
   // Doubao (ByteDance) via the official Ark API — international BytePlus gateway.
   doubao: {
@@ -11948,9 +11929,7 @@ var PROVIDER_PUBLIC_SUPPORT = {
     docsAnchor: "doubao",
     docs: COMMON_DOCS,
     evidence: COMMON_EVIDENCE,
-    runtimeEvidence: {
-      managed: COMMON_EVIDENCE
-    }
+    managedEvidence: COMMON_EVIDENCE
   },
   // Doubao (ByteDance) via the official Ark API — China Volcengine gateway.
   "doubao-cn": {
@@ -11958,9 +11937,7 @@ var PROVIDER_PUBLIC_SUPPORT = {
     docsAnchor: "doubao-cn",
     docs: COMMON_DOCS,
     evidence: COMMON_EVIDENCE,
-    runtimeEvidence: {
-      managed: COMMON_EVIDENCE
-    }
+    managedEvidence: COMMON_EVIDENCE
   }
 };
 
@@ -12177,35 +12154,10 @@ function parseSkillRef(input, path5) {
   }
   const record = input;
   const kind = record.kind;
-  if (kind === "provider") {
-    for (const key of Object.keys(record)) {
-      if (key !== "kind" && key !== "vendor" && key !== "skillId" && key !== "version") {
-        throw new Error(`${path5} contains unexpected field for provider SkillRef: ${key}`);
-      }
-    }
-    const vendor = record.vendor;
-    if (vendor !== "anthropic" && vendor !== "custom") {
-      throw new Error(`${path5}.vendor must be 'anthropic' or 'custom'`);
-    }
-    const skillId = record.skillId;
-    if (typeof skillId !== "string" || skillId.length === 0 || skillId.length > 256) {
-      throw new Error(`${path5}.skillId must be a non-empty string (<= 256 chars)`);
-    }
-    const version = record.version;
-    if (version !== void 0 && (typeof version !== "string" || version.length === 0 || version.length > 64)) {
-      throw new Error(`${path5}.version, when provided, must be a non-empty string (<= 64 chars)`);
-    }
-    return {
-      kind: "provider",
-      vendor,
-      skillId,
-      ...version !== void 0 ? { version } : {}
-    };
-  }
   if (kind === "asset") {
     return parseAssetRefFields(record, path5);
   }
-  throw new Error(`${path5}.kind must be 'provider' or 'asset'`);
+  throw new Error(`${path5}.kind must be 'asset'`);
 }
 function parseAssetRefFields(record, path5) {
   for (const key of Object.keys(record)) {
@@ -12463,7 +12415,6 @@ function parseRunRequestConfig(input) {
     "mcpServers",
     "environment",
     "runtimeSize",
-    "region",
     "timeout",
     "postHook",
     "proxyEndpoints",
@@ -12482,7 +12433,6 @@ function parseRunRequestConfig(input) {
   const prompt = parseRunRequestConfigPrompt(record.prompt);
   const skills = parseRunRequestConfigSkills(record.skills);
   const mcpServers = parseRunRequestConfigMcpServers(record.mcpServers);
-  const region = parseRegion(record.region);
   const postHook = parsePostHook(record.postHook, "run request config postHook");
   return {
     model,
@@ -12496,7 +12446,6 @@ function parseRunRequestConfig(input) {
     // of truth. The CLI surfaces structural errors at submission time.
     ...record.environment !== void 0 ? { environment: record.environment } : {},
     ...record.runtimeSize !== void 0 ? { runtimeSize: record.runtimeSize } : {},
-    ...region !== void 0 ? { region } : {},
     ...record.timeout !== void 0 ? { timeout: record.timeout } : {},
     ...postHook !== void 0 ? { postHook: record.postHook } : {},
     ...record.proxyEndpoints !== void 0 ? { proxyEndpoints: record.proxyEndpoints } : {},
@@ -12596,20 +12545,9 @@ var RUN_PROVIDERS = [
   "doubao-cn"
 ];
 var DEFAULT_RUN_PROVIDER = "anthropic";
-var REGIONS = ["eu-west", "us-west", "ap-northeast"];
-var RUNTIME_KINDS = ["managed"];
 var MIN_REDACTION_TARGET_BYTES = 4;
 var MIN_PROXY_SECRET_BYTES = 8;
 var _MIN_PROXY_SECRET_BYTES_OK = MIN_PROXY_SECRET_BYTES >= MIN_REDACTION_TARGET_BYTES;
-function parseRegion(input) {
-  if (input === void 0) {
-    return void 0;
-  }
-  if (typeof input !== "string" || !REGIONS.includes(input)) {
-    throw new Error(`region must be one of: ${REGIONS.join(", ")} (got ${JSON.stringify(input)})`);
-  }
-  return input;
-}
 var BUILTIN_TOOL_NAMES = [
   "bash",
   "read_file",
@@ -12635,7 +12573,7 @@ var DEFAULT_BUILTIN_TOOLS = BUILTIN_TOOL_NAMES.filter((name) => name !== "notebo
 var MAX_OUTPUT_CAPTURE_TIMEOUT_MS = 6 * 60 * 60 * 1e3;
 
 // ../contracts/dist/event-envelope.js
-var AEX_EVENT_SOURCES = ["agent", "worker", "runtime", "mcp", "aex", "workflow", "host"];
+var AEX_EVENT_SOURCES = ["agent", "api", "runtime", "mcp", "aex", "workflow", "host"];
 var AEX_EVENT_TYPES = [
   "RUN_STARTED",
   "RUN_FINISHED",
@@ -12872,7 +12810,7 @@ function sleep(ms, signal) {
 }
 
 // ../contracts/dist/runtime-manifest.js
-var ANTHROPIC_PATHS = Object.freeze({
+var RUNTIME_PATHS = Object.freeze({
   skillsRoot: "/workspace/skills",
   filesRoot: "/mnt/session/uploads/aex/files",
   assetsRoot: "/mnt/session/uploads/aex/assets",
@@ -13452,7 +13390,6 @@ __export(operations_exports, {
   createFile: () => createFile,
   createOutputLink: () => createOutputLink,
   createSecret: () => createSecret,
-  createSkillBundle: () => createSkillBundle,
   createSkillBundleDirect: () => createSkillBundleDirect,
   deleteAgentsMd: () => deleteAgentsMd,
   deleteFile: () => deleteFile,
@@ -13494,7 +13431,6 @@ __export(operations_exports, {
   resolveOutputFileSelector: () => resolveOutputFileSelector,
   rotateSecret: () => rotateSecret,
   submitRun: () => submitRun,
-  submitRunMultipart: () => submitRunMultipart,
   uploadWorkspaceAsset: () => uploadWorkspaceAsset,
   whoami: () => whoami
 });
@@ -14707,87 +14643,12 @@ async function submitRun(http, request) {
     body: JSON.stringify(request)
   });
 }
-async function submitRunMultipart(http, request, bundles, agentsMdParts, fileParts) {
-  const hasBundles = Array.isArray(bundles) && bundles.length > 0;
-  const hasAgentsMd = Array.isArray(agentsMdParts) && agentsMdParts.length > 0;
-  const hasFiles = Array.isArray(fileParts) && fileParts.length > 0;
-  if (!hasBundles && !hasAgentsMd && !hasFiles) {
-    throw new Error("submitRunMultipart: bundles, agentsMdParts, or fileParts must be non-empty");
-  }
-  const form = new FormData();
-  form.append("submission", new Blob([JSON.stringify(request)], { type: "application/json" }), "submission.json");
-  const seen = /* @__PURE__ */ new Set();
-  for (const bundle of bundles) {
-    if (typeof bundle.slot !== "string" || !bundle.slot) {
-      throw new Error("submitRunMultipart: each bundle must have a non-empty slot id");
-    }
-    if (seen.has(bundle.slot)) {
-      throw new Error(`submitRunMultipart: duplicate inline skill slot "${bundle.slot}"`);
-    }
-    seen.add(bundle.slot);
-    const blob = toBlob(bundle.bytes, "application/zip");
-    form.append(`skill:${bundle.slot}`, blob, bundle.filename);
-  }
-  for (const part of agentsMdParts ?? []) {
-    if (typeof part.slot !== "string" || !part.slot) {
-      throw new Error("submitRunMultipart: each agentsMd part must have a non-empty slot id");
-    }
-    const partKey = `agentsmd:${part.slot}`;
-    if (seen.has(partKey)) {
-      throw new Error(`submitRunMultipart: duplicate agentsMd slot "${part.slot}"`);
-    }
-    seen.add(partKey);
-    const blob = new Blob([part.content], { type: "text/plain" });
-    form.append(partKey, blob, part.filename);
-  }
-  for (const part of fileParts ?? []) {
-    if (typeof part.slot !== "string" || !part.slot) {
-      throw new Error("submitRunMultipart: each file part must have a non-empty slot id");
-    }
-    const partKey = `file:${part.slot}`;
-    if (seen.has(partKey)) {
-      throw new Error(`submitRunMultipart: duplicate file slot "${part.slot}"`);
-    }
-    seen.add(partKey);
-    const blob = toBlob(part.bytes, "application/zip");
-    form.append(partKey, blob, part.filename);
-  }
-  return http.request("/api/runs", {
-    method: "POST",
-    body: form
-  });
-}
-async function createSkillBundle(http, args) {
-  const form = new FormData();
-  form.append("name", args.name);
-  const blobBody = toBlob(args.body, args.contentType ?? "application/zip");
-  form.append("bundle", blobBody, args.filename ?? `${args.name}.zip`);
-  const result = await http.request("/api/skills", {
+async function createSkillBundleDirect(http, fetchImpl, args) {
+  const presign = await http.request("/api/skills/presign", {
     method: "POST",
-    body: form
+    headers: { "content-type": "application/json" },
+    body: JSON.stringify({ name: args.name, hash: args.contentHash, sizeBytes: args.body.byteLength })
   });
-  return unwrapSkill(result);
-}
-async function createSkillBundleDirect(http, fetchImpl, args) {
-  let presign;
-  try {
-    presign = await http.request("/api/skills/presign", {
-      method: "POST",
-      headers: { "content-type": "application/json" },
-      body: JSON.stringify({ name: args.name, hash: args.contentHash, sizeBytes: args.body.byteLength })
-    });
-  } catch (err2) {
-    const status2 = err2.status;
-    const code = (err2.details ?? {}).code;
-    if (status2 === 503 && code === "presign_unconfigured") {
-      return createSkillBundle(http, {
-        name: args.name,
-        body: args.body,
-        ...args.contentType ? { contentType: args.contentType } : {}
-      });
-    }
-    throw err2;
-  }
   const putRes = await fetchImpl(presign.uploadUrl, {
     method: "PUT",
     headers: { "content-type": args.contentType ?? "application/zip", ...presign.requiredHeaders ?? {} },
@@ -15648,35 +15509,6 @@ async function runRunCmd(io2, argv) {
   }
   if (!providerKeyValues[provider]) {
     io2.stderr(`--${provider}-api-key is required when --provider is ${provider} (the platform does not store provider keys on your behalf)
-`);
-    return USAGE_ERR;
-  }
-  const runtimeFlag = takeFlagValue(rest, "--runtime");
-  if (runtimeFlag.error) {
-    io2.stderr(`${runtimeFlag.error}
-`);
-    return USAGE_ERR;
-  }
-  rest = runtimeFlag.remaining;
-  let runtime;
-  if (runtimeFlag.value !== null) {
-    if (!RUNTIME_KINDS.includes(runtimeFlag.value)) {
-      io2.stderr(`--runtime must be one of: ${RUNTIME_KINDS.join(", ")} (got: ${runtimeFlag.value})
-`);
-      return USAGE_ERR;
-    }
-    runtime = runtimeFlag.value;
-  }
-  const regionFlag = takeFlagValue(rest, "--region");
-  if (regionFlag.error) {
-    io2.stderr(`${regionFlag.error}
-`);
-    return USAGE_ERR;
-  }
-  rest = regionFlag.remaining;
-  if (regionFlag.value && !REGIONS.includes(regionFlag.value)) {
-    const hint = suggest(regionFlag.value, REGIONS);
-    io2.stderr(`--region must be one of: ${REGIONS.join(", ")}${hint ? `; did you mean "${hint}"?` : ""}
 `);
     return USAGE_ERR;
   }
@@ -15959,18 +15791,15 @@ async function runRunCmd(io2, argv) {
   };
   const hasAdditionalProviderKeys = Object.keys(providerKeyValues).some((p) => p !== provider);
   const secrets = {
-    apiKey: providerKeyValues[provider],
-    ...hasAdditionalProviderKeys ? { apiKeys: providerKeyValues } : {},
+    apiKeys: hasAdditionalProviderKeys ? providerKeyValues : { [provider]: providerKeyValues[provider] },
     ...mcpServerSecrets.length > 0 ? { mcpServers: mcpServerSecrets } : {},
     ...proxyAuth.length > 0 ? { proxyEndpointAuth: proxyAuth } : {}
   };
   const request = {
     idempotencyKey: idempotency.value ?? generateIdempotencyKey(),
     provider,
-    ...runtime ? { runtime } : {},
     submission,
     secrets,
-    ...regionFlag.value ? { region: regionFlag.value } : runConfig.region ? { region: runConfig.region } : {},
     ...runtimeSizeFlag.value ? { runtimeSize: runtimeSizeFlag.value } : runConfig.runtimeSize ? { runtimeSize: runConfig.runtimeSize } : {},
     ...runTimeoutFlag.value ? { timeout: runTimeoutFlag.value } : runConfig.timeout ? { timeout: runConfig.timeout } : {},
     ...runConfig.postHook ? { postHook: runConfig.postHook } : {},
@@ -18572,7 +18401,6 @@ Protocol version: ${manifest.protocolVersion}
   io2.stdout("aex run flags:\n");
   io2.stdout(`  --provider <name>           Optional; one of: ${RUN_PROVIDERS.join(", ")} (default anthropic)
 `);
-  io2.stdout("  --runtime managed           Optional runtime selector; omitted also uses managed\n");
   for (const provider of RUN_PROVIDERS) {
     io2.stdout(`  --${provider}-api-key <key>${" ".repeat(Math.max(1, 13 - provider.length))}REQUIRED when --provider ${provider}; never stored
 `);
@@ -18586,8 +18414,6 @@ Protocol version: ${manifest.protocolVersion}
   io2.stdout("  --metadata key=value        Submission metadata entry (repeatable)\n");
   io2.stdout("  --proxy-endpoint '<json>'   PlatformProxyEndpoint JSON (repeatable)\n");
   io2.stdout("  --proxy-auth name=<spec>    bearer:tok | basic:u:p | header:v | query:v (repeatable)\n");
-  io2.stdout(`  --region <region>           Product placement region; one of: ${REGIONS.join(", ")}
-`);
   io2.stdout("  --runtime-size <size>       managed runtime preset\n");
   io2.stdout("  --run-timeout <dur>         Server-side run deadline (e.g. 1h); distinct from --timeout\n");
   io2.stdout("  --idempotency-key <key>     Optional; defaults to a fresh UUID\n");

package/dist/cli.mjs.sha256

@@ -1 +1 @@
-88682d1f64442fabb34e7f3645f950c2a109b192183b100cd75dbaf92fd8f385  cli.mjs
+6fdbb02bcedc98dc959c46f14b44bc0d061c799e01627d2550e58980d954e722  cli.mjs

package/dist/client.d.ts

@@ -1,4 +1,4 @@
-import { HttpClient, SecretString, type AexEvent, type AgentsMdRecord, type CredentialMode, type DebugSink, type FetchLike, type FileRecord, type Output, type OutputFileType, type OutputLink, type OutputLinkOptions, type OutputQuery, type OutputText, type OutputMode, type ReadOutputTextOptions, type RunListPage, type RunListQuery, type OutputSearchQuery, type OutputSearchPage, type PlatformEnvironmentInput, type PlatformSubmission, type PlatformInlineSecrets, type PlatformProxyEndpoint, type PlatformProxyEndpointAuth, type PlatformPostHookInput, type Run, type RunModel, type RunEvent, type RunTrace, type UsageSummary, type RunLimits, type RunWebhookDelivery, type RunProvider, type Region, type SecretRecord, type SecretReveal, type RunUnit, type BuiltinToolName, type RuntimeSize, type RuntimeKind, type Skill as SkillRecord, type WhoAmI } from "./_contracts/index.js";
+import { HttpClient, SecretString, type AexEvent, type AgentsMdRecord, type DebugSink, type FetchLike, type FileRecord, type Output, type OutputFileType, type OutputLink, type OutputLinkOptions, type OutputQuery, type OutputText, type OutputMode, type ReadOutputTextOptions, type RunListPage, type RunListQuery, type OutputSearchQuery, type OutputSearchPage, type PlatformEnvironmentInput, type PlatformSubmission, type PlatformInlineSecrets, type PlatformProxyEndpoint, type PlatformProxyEndpointAuth, type PlatformPostHookInput, type Run, type RunModel, type RunEvent, type RunTrace, type UsageSummary, type RunLimits, type RunWebhookDelivery, type RunProvider, type SecretRecord, type SecretReveal, type RunUnit, type BuiltinToolName, type RuntimeSize, type Skill as SkillRecord, type WhoAmI } from "./_contracts/index.js";
 import { AgentsMd } from "./agents-md.js";
 import { type UploadedAsset } from "./asset-upload.js";
 import { File } from "./file.js";
@@ -40,30 +40,22 @@ export interface AgentExecutorOptions {
  *     secret is bundled into the constructor and split into
  *     `secrets.proxyEndpointAuth` server-side; the public submission
  *     only carries the declaration (`{ name, baseUrl, authShape, … }`).
- *   - `apiKey` / `credentials` / `secrets` — the BYOK provider key(s). A key for
- *     the selected provider is REQUIRED; the simplest call passes just `apiKey`.
- *     Use `credentials` (or `secrets.apiKeys`) to carry keys for additional
- *     providers so subagents spawned with a different-family model can use them
- *     (the child inherits the parent's keys server-side). The platform never
- *     holds a long-lived provider key on your behalf.
+ *   - `secrets.apiKeys` — the BYOK provider key(s), keyed by provider. A key
+ *     for the selected provider is REQUIRED unless this is an admitted child
+ *     run inheriting keys from its parent. The platform never holds a
+ *     long-lived provider key on your behalf.
  *
  * `idempotencyKey` is auto-generated when omitted; pass one explicitly
  * if you want client-driven retry safety across process restarts.
  */
 export interface SubmitOptions {
-    /**
-     * Credential source for upstream provider access. Omitted defaults to
-     * `"byok"`, which requires `secrets.apiKey` or
-     * `secrets.apiKeys[provider]`.
-     */
-    readonly credentialMode?: CredentialMode;
     /**
      * Upstream provider selector. Prefer naming it explicitly with the
      * {@link Providers} symbol const, e.g. `provider: Providers.DEEPSEEK`. The
      * same model id can route through different providers, so `provider` is a
      * first-class field — pass it alongside `model` rather than letting the model
      * alone decide routing. The BYOK key for the selected provider is supplied as
-     * `secrets.apiKey` or `secrets.apiKeys[provider]`.
+     * `secrets.apiKeys[provider]`.
      *
      * Optional today: when omitted it is derived from `model` (each currently
      * supported model maps to a single provider), so existing call sites keep
@@ -71,18 +63,6 @@ export interface SubmitOptions {
      * throws.
      */
     readonly provider?: RunProvider;
-    /**
-     * Optional runtime selector. Omit it or pass `"managed"`; both run on
-     * the managed runtime through the hosted BYOK provider-proxy. `"native"`
-     * is no longer accepted.
-     */
-    readonly runtime?: RuntimeKind;
-    /**
-     * Optional hosted-platform placement region for this run. These are
-     * product-level tokens, not exact city guarantees; omit to let the platform
-     * infer a configured region and fall back when no hint matches.
-     */
-    readonly region?: Region;
     /**
      * Closed public model id. Prefer the {@link Models} symbol const, e.g.
      * `Models.CLAUDE_HAIKU_4_5`. Pair it with an explicit {@link Providers} value
@@ -172,24 +152,9 @@ export interface SubmitOptions {
      * typing UIs.
      */
     readonly outputMode?: OutputMode;
-    /**
-     * Single-provider BYOK key sugar — the key for the run's selected `provider`.
-     * The simplest call passes just `apiKey` (no nested `secrets` envelope). When
-     * several sources name a key for the same provider they must agree (else submit
-     * throws); resolution precedence is
-     * `secrets.apiKeys[provider] ?? secrets.apiKey ?? credentials[provider] ?? apiKey`.
-     */
-    readonly apiKey?: string;
-    /**
-     * Multi-provider BYOK key map — the clean way to supply keys for more than one
-     * provider (e.g. so a subagent spawned with a different-family model inherits a
-     * key server-side). Folded into the `secrets.apiKeys` wire shape.
-     */
-    readonly credentials?: Partial<Record<RunProvider, string>>;
     /**
      * Advanced inline secrets bundle (per-provider `apiKeys`, MCP headers, proxy
-     * auth, env secrets). OPTIONAL — the common case uses `apiKey` / `credentials`.
-     * `secrets.apiKey` / `secrets.apiKeys` keep working unchanged.
+     * auth, env secrets). Provider keys must use `secrets.apiKeys`.
      */
     readonly secrets?: PlatformInlineSecrets;
     readonly idempotencyKey?: string;
@@ -223,8 +188,6 @@ export interface SubmitOptions {
     readonly limits?: RunLimits;
     readonly signal?: AbortSignal;
 }
-/** @deprecated Renamed to {@link SubmitOptions}. Kept for one release. */
-export type SubmitRunOptions = SubmitOptions;
 /**
  * The settle-consistent result of {@link AgentExecutor.run} / `runAndCollect`:
  * the terminal run record plus its settle-bracketed events, decoded trace,
@@ -340,14 +303,6 @@ export declare class SkillsClient {
      * the cost is negligible.
      */
     findByName(name: string): Promise<SkillRecord | null>;
-    /**
-     * Internal: post a pre-bundled skill zip to the BFF. Only
-     * `Skill.upload` calls this. NOT part of the public API.
-     */
-    _uploadSkillBundle(args: {
-        readonly name: string;
-        readonly body: Uint8Array;
-    }): Promise<SkillRecord>;
 }
 /**
  * Workspace AgentsMd admin operations exposed under `client.agentsMd`.
@@ -461,22 +416,6 @@ export declare class AgentExecutor {
     readonly files: FilesClient;
     readonly secrets: SecretsClient;
     constructor(options: AgentExecutorOptions);
-    /**
-     * Internal: forwards to `SkillsClient._uploadSkillBundle`. NOT part of
-     * the public API.
-     *
-     * NOTE (tech-debt): this is part of the legacy workspace-skill upload
-     * surface (`SkillsClient` + `operations.createSkillBundle` + the TUS
-     * chunked path in asset-upload.ts). The live submit path materializes
-     * inline skills via `uploadAsset` instead; `Skill.upload(client)`
-     * pre-stages a draft explicitly for reuse. This surface is retained
-     * pending a deliberate deprecation pass (it still threads into the CLI
-     * host commands), tracked in the remediation plan as item 4a.
-     */
-    _uploadSkillBundle(args: {
-        readonly name: string;
-        readonly body: Uint8Array;
-    }): Promise<SkillRecord>;
     /**
      * Internal: an `AgentsMd.upload(this)` shortcut that bypasses
      * `client.agentsMd` indirection. Forwarded to
@@ -611,7 +550,7 @@ export declare class AgentExecutor {
     stream(runId: string, options?: StreamEventsOptions): AsyncIterable<RunEvent>;
     /**
      * Stream the unified {@link AexEvent} envelope live over the coordinator
-     * WebSocket. The Worker's ticket broker authorizes the connection (workspace
+     * WebSocket. The hosted API's ticket broker authorizes the connection (workspace
      * token → short-lived coordinator ticket); the shared client replays from
      * the cursor, tails live, and resumes exactly-once across reconnects. The
      * ticket is re-minted on each (re)connect so a long run never outlives it.