@aexhq/sdk 0.30.0 → 0.32.0

package/dist/_contracts/submission.d.ts

@@ -11,7 +11,7 @@ export type JsonValue = JsonPrimitive | JsonValue[] | {
 };
 /**
  * Networking + runtime-package snapshot carried inside a flat submission
- * so the worker can deep-clone and mutate it per run (e.g. injecting the
+ * so the hosted API can deep-clone and mutate it per run (e.g. injecting the
  * proxy hostname into `allowed_hosts`) without sharing state across
  * concurrent runs.
  *
@@ -58,7 +58,7 @@ export declare const ENV_VARS_MAX_VALUE_BYTES = 4096;
 export declare const ENV_VARS_MAX_TOTAL_BYTES = 65536;
 export interface PlatformNetworking {
     readonly mode: "limited" | "open";
-    /** Lowercase host names. The worker always appends the proxy host. */
+    /** Lowercase host names. The hosted API always appends the proxy host. */
     readonly allowedHosts?: readonly string[];
 }
 /**
@@ -137,60 +137,6 @@ export declare const Providers: {
     /** Doubao (ByteDance) via the official China Volcengine Ark gateway. */
     readonly DOUBAO_CN: "doubao-cn";
 };
-/**
- * Product placement regions accepted on run submission. These are
- * product-level tokens, not exact city guarantees: the hosted platform maps
- * each region to co-located managed Postgres, object storage, run-state
- * placement, and sandbox backing.
- *
- *   eu-west       → London        (Western Europe)
- *   us-west       → N. California (Western North America)
- *   ap-northeast  → Seoul         (Northeast Asia)
- *
- * Prefer the {@link Regions} accessors over raw strings so a typo is a compile
- * error, not a runtime 400.
- */
-export declare const REGIONS: readonly ["eu-west", "us-west", "ap-northeast"];
-export type Region = (typeof REGIONS)[number];
-/** Symbol-style accessors for the closed region set — e.g. `Regions.EU_WEST`. */
-export declare const Regions: {
-    /** Western Europe — London. */
-    readonly EU_WEST: "eu-west";
-    /** Western North America — N. California. */
-    readonly US_WEST: "us-west";
-    /** Northeast Asia — Seoul. */
-    readonly AP_NORTHEAST: "ap-northeast";
-};
-/**
- * Customer-facing runtime selector. Optional on the wire; absent resolves
- * to the same managed runtime as `"managed"`. `"native"` is no longer an
- * accepted submission value and fails schema validation.
- */
-export declare const RUNTIME_KINDS: readonly ["managed"];
-export type RuntimeKind = (typeof RUNTIME_KINDS)[number];
-/**
- * Credential source for upstream provider access. Launch accepts only BYOK:
- * callers may omit `credentialMode` or pass `"byok"`. Other strings, including
- * `"managed"`, are invalid submission values rather than reserved product
- * promises.
- */
-export declare const CREDENTIAL_MODES: readonly ["byok"];
-export type CredentialMode = (typeof CREDENTIAL_MODES)[number];
-export declare const DEFAULT_CREDENTIAL_MODE: CredentialMode;
-export declare function parseCredentialMode(input: unknown): CredentialMode;
-export declare function credentialModeOrDefault(input: CredentialMode | undefined): CredentialMode;
-/** Outcome of the centralized runtime-support check. */
-export interface RuntimeSupportCheck {
-    readonly ok: boolean;
-    readonly message?: string;
-}
-/**
- * Centralized runtime-support validator. Native is removed from the public
- * runtime enum, so an absent runtime and `"managed"` are the only supported
- * inputs. Schema parsing rejects other runtime strings before this helper is
- * reached, but the result type remains for SDK preflight checks.
- */
-export declare function checkRuntimeSupported(provider: RunProvider, runtime: RuntimeKind | undefined): RuntimeSupportCheck;
 export interface PlatformMcpServerSecret {
     readonly name: string;
     readonly url: string;
@@ -230,13 +176,6 @@ export type PlatformProxyAuthValue = {
  * driving the MCP client).
  */
 export interface PlatformInlineSecrets {
-    /**
-     * Deprecated compatibility field: the BYOK key for the run's selected
-     * provider. New multi-provider callers should use `apiKeys`, but the parser
-     * still accepts and preserves this flat field so existing SDK/CLI callers
-     * continue to work.
-     */
-    readonly apiKey?: string;
     readonly apiKeys?: Partial<Record<RunProvider, string>>;
     readonly mcpServers?: readonly PlatformMcpServerSecret[];
     readonly proxyEndpointAuth?: readonly PlatformProxyEndpointAuth[];
@@ -331,7 +270,7 @@ export declare function optionalPositiveInt(input: unknown, field: string): numb
 export declare function optionalPositiveNumber(input: unknown, field: string): number | undefined;
 /**
  * Wire-level submission posted to /api/runs in the flat surface. The
- * `prompt` is always an array internally so the worker, the audit log,
+ * `prompt` is always an array internally so the hosted API, the audit log,
  * and the BFF idempotency hash all see one shape. `mcpServers` carries
  * only the non-secret half; bearer headers travel in
  * `secrets.mcpServers` keyed by `name`.
@@ -435,30 +374,12 @@ export interface PlatformInjectionConfig {
 export interface PlatformRunSubmissionRequest {
     readonly workspaceId: string;
     readonly idempotencyKey: string;
-    /**
-     * Credential source for upstream provider access. Omitted means
-     * `"byok"`; launch does not accept managed provider credentials.
-     */
-    readonly credentialMode: CredentialMode;
     /**
      * Provider selector. Always populated after parsing — absent on the
      * wire means {@link DEFAULT_RUN_PROVIDER}. All providers are dispatched
      * through the managed runtime.
      */
     readonly provider: RunProvider;
-    /**
-     * Customer's explicit runtime choice. `undefined` and `"managed"` both
-     * resolve to the managed runtime. Other runtime values are rejected by
-     * `parseRunSubmissionRequest`.
-     */
-    readonly runtime?: RuntimeKind;
-    /**
-     * Optional product placement token requested by the caller. Omitted means
-     * the hosted platform infers a configured region from request geography and
-     * falls back to its default region. Accepted tokens do not promise exact
-     * city-level placement.
-     */
-    readonly region?: Region;
     readonly submission: PlatformSubmission;
     readonly secrets: PlatformInlineSecrets;
     readonly proxyEndpoints?: readonly PlatformProxyEndpoint[];
@@ -545,21 +466,9 @@ export interface RunLimits {
  * {@link DEFAULT_RUN_PROVIDER} (`anthropic`). The parser fills it in
  * before the value enters the run snapshot.
  */
-export type PlatformRunSubmissionInput = Omit<PlatformRunSubmissionRequest, "workspaceId" | "credentialMode" | "provider" | "runtime" | "region" | "timeoutMs" | "postHook"> & {
+export type PlatformRunSubmissionInput = Omit<PlatformRunSubmissionRequest, "workspaceId" | "provider" | "timeoutMs" | "postHook"> & {
     readonly workspaceId?: string;
-    readonly credentialMode?: CredentialMode;
     readonly provider?: RunProvider;
-    /**
-     * Optional runtime selector. Set `"managed"` explicitly or omit the
-     * field; both resolve to the managed runtime. `"native"` is no longer
-     * accepted.
-     */
-    readonly runtime?: RuntimeKind;
-    /**
-     * Optional product placement region. Invalid explicit values are rejected;
-     * omission lets the platform infer/fallback.
-     */
-    readonly region?: Region;
     /**
      * Run deadline as a human duration string (`"1h"`, `"90m"`, `"30s"`).
      * Parsed + bounded to [1m, 6h] server-side into
@@ -592,8 +501,6 @@ export declare function parseRunWebhook(input: unknown): RunWebhookSpec | undefi
  * collapses to `undefined` so it carries no signal onto the request.
  */
 export declare function parseRunLimits(input: unknown): RunLimits | undefined;
-export declare function parseRegion(input: unknown): Region | undefined;
-export declare function parseRuntimeKind(input: unknown): RuntimeKind | undefined;
 export declare function parseRunProvider(input: unknown): RunProvider;
 /**
  * Cross-check the supplied secrets bundle against the credential mode. BYOK
@@ -607,7 +514,7 @@ export declare function parseRunProvider(input: unknown): RunProvider;
  * it need not carry any of its own. The server still verifies, at admission,
  * that the parent actually holds a key for the child's provider.
  */
-export declare function enforceCredentialSecretPolicy(credentialMode: CredentialMode, secrets: PlatformInlineSecrets, provider: RunProvider, opts?: {
+export declare function enforceCredentialSecretPolicy(secrets: PlatformInlineSecrets, provider: RunProvider, opts?: {
     readonly inheritsFromParent?: boolean;
 }): void;
 export declare function parseSubmission(input: unknown): PlatformSubmission;
@@ -679,31 +586,3 @@ export declare const DEFAULT_BUILTIN_TOOLS: readonly BuiltinToolName[];
  * union is validated ⊆ the closed set so an invalid name can never leak through.
  */
 export declare function resolveBuiltinToolNames(includeBuiltinTools: boolean | undefined, toolRefs?: readonly string[]): readonly BuiltinToolName[];
-/**
- * Codes emitted when a submission contains features the active runtime cannot
- * serve. Code values are stable so dashboard / SDK error rendering can branch
- * on them.
- */
-export declare const RUNTIME_VALIDATION_CODES: readonly ["feature_runtime_mismatch"];
-export type RuntimeValidationCode = (typeof RUNTIME_VALIDATION_CODES)[number];
-/**
- * Thrown by `parseRunSubmissionRequest` and `selectRuntime` when the submitted
- * run cannot be served by the active managed runtime. The `code` field is part
- * of the public contract; keep it stable when phrasing changes.
- */
-export declare class RuntimeValidationError extends Error {
-    readonly code: RuntimeValidationCode;
-    constructor(code: RuntimeValidationCode, message: string);
-}
-/**
- * Walk the parsed submission and collect features that the active managed
- * runtime cannot serve. Provider-hosted skill refs (`kind:"provider"`) are
- * rejected now that new submissions only dispatch through managed runs.
- */
-export declare function collectManagedUnsupportedFeatures(req: PlatformRunSubmissionRequest): string[];
-/**
- * Backward-incompatible replacement for the old dual-runtime dispatcher. It is
- * kept as a pure helper so SDK, CLI, and tests can resolve the runtime without
- * I/O.
- */
-export declare function selectRuntime(req: PlatformRunSubmissionRequest): RuntimeKind;

package/dist/_contracts/submission.js

@@ -114,65 +114,6 @@ export const Providers = {
     /** Doubao (ByteDance) via the official China Volcengine Ark gateway. */
     DOUBAO_CN: "doubao-cn"
 };
-/**
- * Product placement regions accepted on run submission. These are
- * product-level tokens, not exact city guarantees: the hosted platform maps
- * each region to co-located managed Postgres, object storage, run-state
- * placement, and sandbox backing.
- *
- *   eu-west       → London        (Western Europe)
- *   us-west       → N. California (Western North America)
- *   ap-northeast  → Seoul         (Northeast Asia)
- *
- * Prefer the {@link Regions} accessors over raw strings so a typo is a compile
- * error, not a runtime 400.
- */
-export const REGIONS = ["eu-west", "us-west", "ap-northeast"];
-/** Symbol-style accessors for the closed region set — e.g. `Regions.EU_WEST`. */
-export const Regions = {
-    /** Western Europe — London. */
-    EU_WEST: "eu-west",
-    /** Western North America — N. California. */
-    US_WEST: "us-west",
-    /** Northeast Asia — Seoul. */
-    AP_NORTHEAST: "ap-northeast"
-};
-/**
- * Customer-facing runtime selector. Optional on the wire; absent resolves
- * to the same managed runtime as `"managed"`. `"native"` is no longer an
- * accepted submission value and fails schema validation.
- */
-export const RUNTIME_KINDS = ["managed"];
-/**
- * Credential source for upstream provider access. Launch accepts only BYOK:
- * callers may omit `credentialMode` or pass `"byok"`. Other strings, including
- * `"managed"`, are invalid submission values rather than reserved product
- * promises.
- */
-export const CREDENTIAL_MODES = ["byok"];
-export const DEFAULT_CREDENTIAL_MODE = "byok";
-export function parseCredentialMode(input) {
-    if (input === undefined) {
-        return DEFAULT_CREDENTIAL_MODE;
-    }
-    if (typeof input !== "string" || !CREDENTIAL_MODES.includes(input)) {
-        throw new Error(`credentialMode must be one of: ${CREDENTIAL_MODES.join(", ")} (got ${JSON.stringify(input)})`);
-    }
-    return input;
-}
-export function credentialModeOrDefault(input) {
-    return input ?? DEFAULT_CREDENTIAL_MODE;
-}
-/**
- * Centralized runtime-support validator. Native is removed from the public
- * runtime enum, so an absent runtime and `"managed"` are the only supported
- * inputs. Schema parsing rejects other runtime strings before this helper is
- * reached, but the result type remains for SDK preflight checks.
- */
-export function checkRuntimeSupported(provider, runtime) {
-    void provider;
-    return { ok: true };
-}
 export const SECRETS_KEY = "secrets";
 /** POSIX-style env var name a `secretEnv` entry binds to (e.g. `SERPER_API_KEY`). */
 export const SECRET_ENV_NAME_PATTERN = /^[A-Za-z_][A-Za-z0-9_]{0,127}$/;
@@ -239,7 +180,7 @@ function parseEnvironment(input) {
  * Validate a customer-supplied `environment.envVars` map. Returns a
  * frozen copy with keys in insertion order, or `undefined` when the
  * input is absent / an empty object (treated as not supplied so the
- * worker can omit the field from the parsed snapshot).
+ * hosted API can omit the field from the parsed snapshot).
  *
  * Rules:
  *   - Must be a JSON object whose values are all strings.
@@ -723,7 +664,7 @@ export function parseInlineSecrets(input) {
     if (input === undefined || input === null)
         return {};
     const value = requireRecord(input, "secrets");
-    const allowedTopLevel = new Set(["apiKey", "apiKeys", "mcpServers", "proxyEndpointAuth", "envSecrets"]);
+    const allowedTopLevel = new Set(["apiKeys", "mcpServers", "proxyEndpointAuth", "envSecrets"]);
     for (const key of Object.keys(value)) {
         if (key.startsWith("__aex_")) {
             // Platform-internal namespace (e.g. __aex_proxy_token). The BFF
@@ -736,13 +677,11 @@ export function parseInlineSecrets(input) {
             throw new Error(`secrets.${key} is not an allowed field; permitted: ${[...allowedTopLevel].join(", ")}`);
         }
     }
-    const apiKey = value.apiKey !== undefined ? requireString(value.apiKey, "secrets.apiKey") : undefined;
     const apiKeys = parseApiKeys(value.apiKeys);
     const mcpServers = parseMcpServerSecrets(value.mcpServers);
     const proxyEndpointAuth = parseProxyEndpointAuth(value.proxyEndpointAuth);
     const envSecrets = parseEnvSecrets(value.envSecrets);
     return {
-        ...(apiKey !== undefined ? { apiKey } : {}),
         ...(apiKeys ? { apiKeys } : {}),
         ...(mcpServers ? { mcpServers } : {}),
         ...(proxyEndpointAuth ? { proxyEndpointAuth } : {}),
@@ -1051,10 +990,7 @@ export function parseRunSubmissionRequest(input, options = {}) {
     const allowedTopLevelFields = new Set([
         "workspaceId",
         "idempotencyKey",
-        "credentialMode",
         "provider",
-        "runtime",
-        "region",
         "submission",
         "runtimeSize",
         "timeout",
@@ -1083,15 +1019,7 @@ export function parseRunSubmissionRequest(input, options = {}) {
         assertNoSecretBearingFields(fieldValue, [key]);
     }
     const provider = parseRunProvider(value.provider);
-    const runtime = parseRuntimeKind(value.runtime);
-    const region = parseRegion(value.region);
-    const credentialMode = parseCredentialMode(value.credentialMode);
     void options;
-    // Cross-field validation via the centralized runtime-support validator.
-    const runtimeSupport = checkRuntimeSupported(provider, runtime);
-    if (!runtimeSupport.ok) {
-        throw new Error(runtimeSupport.message ?? "unsupported runtime");
-    }
     const runtimeSize = parseRuntimeSize(value.runtimeSize);
     const timeoutMs = parseRunTimeout(value.timeout);
     // Lineage parent only. `depth` is NEVER accepted from the wire — the server
@@ -1102,7 +1030,7 @@ export function parseRunSubmissionRequest(input, options = {}) {
     const postHook = parsePostHook(value.postHook, "submission.postHook");
     const proxyEndpoints = parseProxyEndpoints(value.proxyEndpoints);
     const secrets = parseInlineSecrets(value.secrets);
-    enforceCredentialSecretPolicy(credentialMode, secrets, provider, {
+    enforceCredentialSecretPolicy(secrets, provider, {
         inheritsFromParent: parentRunId !== undefined
     });
     crossValidateProxyEndpointsAndAuth(proxyEndpoints, secrets.proxyEndpointAuth);
@@ -1127,28 +1055,10 @@ export function parseRunSubmissionRequest(input, options = {}) {
             }
         }
     }
-    const candidate = {
-        workspaceId: "",
-        idempotencyKey: "",
-        credentialMode,
-        provider,
-        ...(runtime ? { runtime } : {}),
-        ...(region ? { region } : {}),
-        submission,
-        secrets
-    };
-    const unsupportedManagedFeatures = collectManagedUnsupportedFeatures(candidate);
-    if (unsupportedManagedFeatures.length > 0) {
-        throw new RuntimeValidationError("feature_runtime_mismatch", `The managed runtime does not support these submission features: ` +
-            `${unsupportedManagedFeatures.join(", ")}. Remove them or use inline aex skills.`);
-    }
     return {
         workspaceId: requireString(value.workspaceId, "workspaceId"),
         idempotencyKey: requireString(value.idempotencyKey, "idempotencyKey"),
-        credentialMode,
         provider,
-        ...(runtime ? { runtime } : {}),
-        ...(region ? { region } : {}),
         submission,
         ...(runtimeSize ? { runtimeSize } : {}),
         ...(timeoutMs !== undefined ? { timeoutMs } : {}),
@@ -1235,24 +1145,6 @@ export function parseRunLimits(input) {
         ...(maxSpendUsd !== undefined ? { maxSpendUsd } : {})
     };
 }
-export function parseRegion(input) {
-    if (input === undefined) {
-        return undefined;
-    }
-    if (typeof input !== "string" || !REGIONS.includes(input)) {
-        throw new Error(`region must be one of: ${REGIONS.join(", ")} (got ${JSON.stringify(input)})`);
-    }
-    return input;
-}
-export function parseRuntimeKind(input) {
-    if (input === undefined) {
-        return undefined;
-    }
-    if (typeof input !== "string" || !RUNTIME_KINDS.includes(input)) {
-        throw new Error(`runtime must be one of: ${RUNTIME_KINDS.join(", ")} (got ${JSON.stringify(input)})`);
-    }
-    return input;
-}
 export function parseRunProvider(input) {
     if (input === undefined) {
         return DEFAULT_RUN_PROVIDER;
@@ -1274,12 +1166,11 @@ export function parseRunProvider(input) {
  * it need not carry any of its own. The server still verifies, at admission,
  * that the parent actually holds a key for the child's provider.
  */
-export function enforceCredentialSecretPolicy(credentialMode, secrets, provider, opts) {
-    void credentialMode;
+export function enforceCredentialSecretPolicy(secrets, provider, opts) {
     if (opts?.inheritsFromParent)
         return;
-    if (!(secrets.apiKeys?.[provider] ?? secrets.apiKey)) {
-        throw new Error(`secrets.apiKey is required when credentialMode is byok (or secrets.apiKeys["${provider}"])`);
+    if (!secrets.apiKeys?.[provider]) {
+        throw new Error(`secrets.apiKeys["${provider}"] is required`);
     }
 }
 export function parseSubmission(input) {
@@ -1509,7 +1400,7 @@ function parseIncludeBuiltinTools(input) {
  * plus a generous margin for legitimate multi-root use cases (per-tool
  * output directory + scratch state + logs, repeated across a few
  * subdirectories), without inviting abuse of the synthetic-turn path
- * the worker drives at session terminal.
+ * the platform capture path drives at session terminal.
  */
 const MAX_OUTPUT_DIRS = 32;
 /**
@@ -1708,23 +1599,13 @@ function parseSkills(input) {
     if (!Array.isArray(input)) {
         throw new Error("submission.skills must be an array of SkillRef objects");
     }
-    const seenProvider = new Set();
     const seenAssetId = new Set();
     return input.map((item, index) => {
         const ref = parseSkillRef(item, `submission.skills[${index}]`);
-        if (ref.kind === "provider") {
-            const key = `${ref.vendor}:${ref.skillId}:${ref.version ?? ""}`;
-            if (seenProvider.has(key)) {
-                throw new Error(`submission.skills duplicate provider skill: ${ref.vendor}:${ref.skillId}${ref.version ? `:${ref.version}` : ""}`);
-            }
-            seenProvider.add(key);
-        }
-        else if (ref.kind === "asset") {
-            if (seenAssetId.has(ref.assetId)) {
-                throw new Error(`submission.skills duplicate assetId: ${ref.assetId}`);
-            }
-            seenAssetId.add(ref.assetId);
+        if (seenAssetId.has(ref.assetId)) {
+            throw new Error(`submission.skills duplicate assetId: ${ref.assetId}`);
         }
+        seenAssetId.add(ref.assetId);
         return ref;
     });
 }
@@ -1879,57 +1760,4 @@ function parseMcpServers(input) {
         return ref;
     });
 }
-// ===========================================================================
-// Runtime dispatcher
-// ===========================================================================
-/**
- * Codes emitted when a submission contains features the active runtime cannot
- * serve. Code values are stable so dashboard / SDK error rendering can branch
- * on them.
- */
-export const RUNTIME_VALIDATION_CODES = [
-    "feature_runtime_mismatch"
-];
-/**
- * Thrown by `parseRunSubmissionRequest` and `selectRuntime` when the submitted
- * run cannot be served by the active managed runtime. The `code` field is part
- * of the public contract; keep it stable when phrasing changes.
- */
-export class RuntimeValidationError extends Error {
-    code;
-    constructor(code, message) {
-        super(message);
-        this.name = "RuntimeValidationError";
-        this.code = code;
-    }
-}
-/**
- * Walk the parsed submission and collect features that the active managed
- * runtime cannot serve. Provider-hosted skill refs (`kind:"provider"`) are
- * rejected now that new submissions only dispatch through managed runs.
- */
-export function collectManagedUnsupportedFeatures(req) {
-    const features = [];
-    for (const skill of req.submission.skills) {
-        if (skill.kind === "provider") {
-            const versionSuffix = skill.version ? `@${skill.version}` : "";
-            features.push(`provider skill "${skill.vendor}/${skill.skillId}${versionSuffix}" (kind:"provider")`);
-        }
-    }
-    return features;
-}
-/**
- * Backward-incompatible replacement for the old dual-runtime dispatcher. It is
- * kept as a pure helper so SDK, CLI, and tests can resolve the runtime without
- * I/O.
- */
-export function selectRuntime(req) {
-    const unsupported = collectManagedUnsupportedFeatures(req);
-    if (unsupported.length > 0) {
-        throw new RuntimeValidationError("feature_runtime_mismatch", `The managed runtime does not support these submission features: ` +
-            `${unsupported.join(", ")}. Remove them or use inline aex skills.`);
-    }
-    void req;
-    return "managed";
-}
 //# sourceMappingURL=submission.js.map

package/dist/_contracts/webhook-verify.d.ts

@@ -12,7 +12,7 @@
  * the HMAC key is the raw bytes after the `whsec_` prefix. Verification accepts
  * the secret with or without the prefix.
  *
- * Pure Web Crypto — identical under Bun, Node, and workerd; this mirrors the
+ * Pure Web Crypto — identical under Bun and Node; this mirrors the
  * `standardwebhooks` library so a customer can verify with either.
  */
 export interface VerifyAexWebhookInput {

package/dist/_contracts/webhook-verify.js

@@ -12,7 +12,7 @@
  * the HMAC key is the raw bytes after the `whsec_` prefix. Verification accepts
  * the secret with or without the prefix.
  *
- * Pure Web Crypto — identical under Bun, Node, and workerd; this mirrors the
+ * Pure Web Crypto — identical under Bun and Node; this mirrors the
  * `standardwebhooks` library so a customer can verify with either.
  */
 const encoder = new TextEncoder();

package/dist/asset-upload.d.ts

@@ -11,18 +11,13 @@
  *
  *   1. POST /assets/presign  → { exists } | { uploadUrl, requiredHeaders }
  *      - `exists:true` is a dedup hit; we're done.
- *      - otherwise the Worker mints a presigned PUT scoped to the exact
+ *      - otherwise the hosted API mints a presigned PUT scoped to the exact
  *        content-addressed key and signs `x-amz-checksum-sha256` so the object
  *        store enforces integrity server-side.
  *   2. PUT the bytes straight to `uploadUrl` with `requiredHeaders` (the signed
  *      checksum). The store rejects a byte mismatch — a 2xx proves bytes == hash.
  *   3. POST /assets/finalize → confirms the object exists (HEAD only).
  *
- * Fallback: when the hosted API has no object-store upload credentials it
- * answers presign with 503 `presign_unconfigured`; we POST the bytes to the
- * buffered `/assets`
- * path (small bundles only). The runner re-verifies the hash on download in
- * every case.
  */
 /**
  * Subset of `HttpClient` needed by the asset uploader. Defined as a
@@ -56,11 +51,10 @@ export interface UploadedAsset {
 }
 /**
  * Upload `bytes` to the hosted API's content-addressable asset store via the
- * direct-to-storage presign flow, falling back to the buffered `/assets` POST
- * when the hosted API has no object-store upload credentials.
+ * direct-to-storage presign flow.
  *
  * Verifies the advisory hash matches the bytes BEFORE sending so a mismatch
- * fails fast on the client. The store (or the buffered endpoint) re-verifies, and the
- * runner re-checks on download.
+ * fails fast on the client. Object storage re-verifies via the signed checksum,
+ * and the runner re-checks on download.
  */
 export declare function uploadAsset(args: UploadAssetArgs): Promise<UploadedAsset>;

package/dist/asset-upload.js

@@ -11,27 +11,21 @@
  *
  *   1. POST /assets/presign  → { exists } | { uploadUrl, requiredHeaders }
  *      - `exists:true` is a dedup hit; we're done.
- *      - otherwise the Worker mints a presigned PUT scoped to the exact
+ *      - otherwise the hosted API mints a presigned PUT scoped to the exact
  *        content-addressed key and signs `x-amz-checksum-sha256` so the object
  *        store enforces integrity server-side.
  *   2. PUT the bytes straight to `uploadUrl` with `requiredHeaders` (the signed
  *      checksum). The store rejects a byte mismatch — a 2xx proves bytes == hash.
  *   3. POST /assets/finalize → confirms the object exists (HEAD only).
  *
- * Fallback: when the hosted API has no object-store upload credentials it
- * answers presign with 503 `presign_unconfigured`; we POST the bytes to the
- * buffered `/assets`
- * path (small bundles only). The runner re-verifies the hash on download in
- * every case.
  */
 /**
  * Upload `bytes` to the hosted API's content-addressable asset store via the
- * direct-to-storage presign flow, falling back to the buffered `/assets` POST
- * when the hosted API has no object-store upload credentials.
+ * direct-to-storage presign flow.
  *
  * Verifies the advisory hash matches the bytes BEFORE sending so a mismatch
- * fails fast on the client. The store (or the buffered endpoint) re-verifies, and the
- * runner re-checks on download.
+ * fails fast on the client. Object storage re-verifies via the signed checksum,
+ * and the runner re-checks on download.
  */
 export async function uploadAsset(args) {
     const expected = args.hash.startsWith("sha256:") ? args.hash.slice("sha256:".length) : args.hash;
@@ -51,10 +45,6 @@ export async function uploadAsset(args) {
         });
     }
     catch (err) {
-        // 503 presign_unconfigured → fall back to the buffered upload path.
-        if (isPresignUnconfigured(err)) {
-            return uploadAssetBuffered(args, actual);
-        }
         throw err;
     }
     // Dedup hit — identical bytes already vaulted under this workspace.
@@ -100,39 +90,6 @@ export async function uploadAsset(args) {
         exists: false
     };
 }
-/** Detect the 503 `presign_unconfigured` rejection, regardless of error class. */
-function isPresignUnconfigured(err) {
-    if (!err || typeof err !== "object")
-        return false;
-    const e = err;
-    if (e.status !== 503)
-        return false;
-    const detailCode = e.details?.code;
-    return e.code === "presign_unconfigured" || detailCode === "presign_unconfigured";
-}
-/**
- * Fallback: POST the bytes to the buffered `/assets` endpoint. Used only when
- * the hosted API has no object-store upload credentials (presign 503). Subject to the API's
- * payload limit, so suitable for small bundles only.
- */
-async function uploadAssetBuffered(args, actualHex) {
-    const body = await args.http.request("/assets", {
-        method: "POST",
-        headers: {
-            "content-type": args.contentType ?? "application/zip",
-            "content-length": String(args.bytes.byteLength),
-            "x-asset-hash": `sha256:${actualHex}`
-        },
-        body: args.bytes
-    });
-    const contentHash = body.contentHash ?? body.hash ?? `sha256:${actualHex}`;
-    return {
-        assetId: body.assetId ?? assetIdFromContentHash(contentHash),
-        contentHash,
-        sizeBytes: body.sizeBytes,
-        exists: body.exists
-    };
-}
 // ---------------------------------------------------------------------------
 // Internal helpers
 // ---------------------------------------------------------------------------

package/dist/asset-upload.js.map

@@ -1 +1 @@
-{"version":3,"file":"asset-upload.js","sourceRoot":"","sources":["../src/asset-upload.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AAoCH;;;;;;;;GAQG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAqB;IACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IACjG,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClD,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,2DAA2D,MAAM,GAAG;YAClE,uBAAuB,IAAI,CAAC,IAAI,+CAA+C,CAClF,CAAC;IACJ,CAAC;IACD,MAAM,iBAAiB,GAAG,UAAU,MAAM,EAAE,CAAC;IAE7C,4CAA4C;IAC5C,IAAI,OAUS,CAAC;IACd,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAA8B,iBAAiB,EAAE;YAChF,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;SACpF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,oEAAoE;QACpE,IAAI,qBAAqB,CAAC,GAAG,CAAC,EAAE,CAAC;YAC/B,OAAO,mBAAmB,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;QAC3C,CAAC;QACD,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,oEAAoE;IACpE,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,iBAAiB,CAAC;QAC7D,OAAO;YACL,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,sBAAsB,CAAC,WAAW,CAAC;YAC/D,WAAW;YACX,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU;YACrD,MAAM,EAAE,IAAI;SACb,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IAED,+FAA+F;IAC/F,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,IAAK,UAAU,CAAC,KAA+B,CAAC;IAC1E,MAAM,UAAU,GAA2B;QACzC,cAAc,EAAE,IAAI,CAAC,WAAW,IAAI,iBAAiB;QACrD,GAAG,CAAC,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC;KACnC,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE;QAC9C,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,UAAU;QACnB,IAAI,EAAE,IAAI,CAAC,KAAK;KACjB,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACnD,MAAM,IAAI,KAAK,CACb,qDAAqD,MAAM,CAAC,MAAM,EAAE;YAClE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAC9C,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAKhC,kBAAkB,EAAE;QACrB,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;KACpF,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW,IAAI,OAAO,CAAC,WAAW,IAAI,iBAAiB,CAAC;IAChF,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,IAAI,sBAAsB,CAAC,WAAW,CAAC;QAC9E,WAAW;QACX,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU;QACjD,MAAM,EAAE,KAAK;KACd,CAAC;AACJ,CAAC;AAED,kFAAkF;AAClF,SAAS,qBAAqB,CAAC,GAAY;IACzC,IAAI,CAAC,GAAG,IAAI,OAAO,GAAG,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAClD,MAAM,CAAC,GAAG,GAA8D,CAAC;IACzE,IAAI,CAAC,CAAC,MAAM,KAAK,GAAG;QAAE,OAAO,KAAK,CAAC;IACnC,MAAM,UAAU,GAAI,CAAC,CAAC,OAA0C,EAAE,IAAI,CAAC;IACvE,OAAO,CAAC,CAAC,IAAI,KAAK,sBAAsB,IAAI,UAAU,KAAK,sBAAsB,CAAC;AACpF,CAAC;AAED;;;;GAIG;AACH,KAAK,UAAU,mBAAmB,CAAC,IAAqB,EAAE,SAAiB;IACzE,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAQjC,SAAS,EAAE;QACZ,MAAM,EAAE,MAAM;QACd,OAAO,EAAE;YACP,cAAc,EAAE,IAAI,CAAC,WAAW,IAAI,iBAAiB;YACrD,gBAAgB,EAAE,MAAM,CAAC,IAAI,CAAC,KAAK,CAAC,UAAU,CAAC;YAC/C,cAAc,EAAE,UAAU,SAAS,EAAE;SACtC;QACD,IAAI,EAAE,IAAI,CAAC,KAAK;KACjB,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,IAAI,CAAC,WAAW,IAAI,IAAI,CAAC,IAAI,IAAI,UAAU,SAAS,EAAE,CAAC;IAC3E,OAAO;QACL,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,sBAAsB,CAAC,WAAW,CAAC;QAC5D,WAAW;QACX,SAAS,EAAE,IAAI,CAAC,SAAS;QACzB,MAAM,EAAE,IAAI,CAAC,MAAM;KACpB,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E;;;;GAIG;AACH,KAAK,UAAU,gBAAgB,CAAC,KAAiB;IAC/C,MAAM,MAAM,GAAI,UAAqD,CAAC,MAAM,EAAE,MAAM,CAAC;IACrF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,0DAA0D;YACxD,4DAA4D,CAC/D,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC9C,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAChB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3D,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,sBAAsB,CAAC,WAAmB;IACjD,MAAM,GAAG,GAAG,WAAW,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;IAClG,OAAO,SAAS,GAAG,EAAE,CAAC;AACxB,CAAC;AAED,SAAS,WAAW,CAAC,MAAmB;IACtC,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAW,CAAC;QAC/B,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}
+{"version":3,"file":"asset-upload.js","sourceRoot":"","sources":["../src/asset-upload.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAoCH;;;;;;;GAOG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAAC,IAAqB;IACrD,MAAM,QAAQ,GAAG,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC;IACjG,MAAM,MAAM,GAAG,MAAM,gBAAgB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IAClD,IAAI,MAAM,KAAK,QAAQ,EAAE,CAAC;QACxB,MAAM,IAAI,KAAK,CACb,2DAA2D,MAAM,GAAG;YAClE,uBAAuB,IAAI,CAAC,IAAI,+CAA+C,CAClF,CAAC;IACJ,CAAC;IACD,MAAM,iBAAiB,GAAG,UAAU,MAAM,EAAE,CAAC;IAE7C,4CAA4C;IAC5C,IAAI,OAUS,CAAC;IACd,IAAI,CAAC;QACH,OAAO,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAA8B,iBAAiB,EAAE;YAChF,MAAM,EAAE,MAAM;YACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;YAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;SACpF,CAAC,CAAC;IACL,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,MAAM,GAAG,CAAC;IACZ,CAAC;IAED,oEAAoE;IACpE,IAAI,OAAO,CAAC,MAAM,EAAE,CAAC;QACnB,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,iBAAiB,CAAC;QAC7D,OAAO;YACL,OAAO,EAAE,OAAO,CAAC,OAAO,IAAI,sBAAsB,CAAC,WAAW,CAAC;YAC/D,WAAW;YACX,SAAS,EAAE,OAAO,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU;YACrD,MAAM,EAAE,IAAI;SACb,CAAC;IACJ,CAAC;IACD,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,CAAC;QACvB,MAAM,IAAI,KAAK,CAAC,6DAA6D,CAAC,CAAC;IACjF,CAAC;IAED,+FAA+F;IAC/F,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,IAAK,UAAU,CAAC,KAA+B,CAAC;IAC1E,MAAM,UAAU,GAA2B;QACzC,cAAc,EAAE,IAAI,CAAC,WAAW,IAAI,iBAAiB;QACrD,GAAG,CAAC,OAAO,CAAC,eAAe,IAAI,EAAE,CAAC;KACnC,CAAC;IACF,MAAM,MAAM,GAAG,MAAM,OAAO,CAAC,OAAO,CAAC,SAAS,EAAE;QAC9C,MAAM,EAAE,KAAK;QACb,OAAO,EAAE,UAAU;QACnB,IAAI,EAAE,IAAI,CAAC,KAAK;KACjB,CAAC,CAAC;IACH,IAAI,CAAC,MAAM,CAAC,EAAE,EAAE,CAAC;QACf,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,EAAE,CAAC,CAAC;QACnD,MAAM,IAAI,KAAK,CACb,qDAAqD,MAAM,CAAC,MAAM,EAAE;YAClE,CAAC,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC,CAC9C,CAAC;IACJ,CAAC;IAED,yEAAyE;IACzE,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,IAAI,CAAC,OAAO,CAKhC,kBAAkB,EAAE;QACrB,MAAM,EAAE,MAAM;QACd,OAAO,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE;QAC/C,IAAI,EAAE,IAAI,CAAC,SAAS,CAAC,EAAE,IAAI,EAAE,iBAAiB,EAAE,SAAS,EAAE,IAAI,CAAC,KAAK,CAAC,UAAU,EAAE,CAAC;KACpF,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,GAAG,CAAC,WAAW,IAAI,OAAO,CAAC,WAAW,IAAI,iBAAiB,CAAC;IAChF,OAAO;QACL,OAAO,EAAE,GAAG,CAAC,OAAO,IAAI,OAAO,CAAC,OAAO,IAAI,sBAAsB,CAAC,WAAW,CAAC;QAC9E,WAAW;QACX,SAAS,EAAE,GAAG,CAAC,SAAS,IAAI,IAAI,CAAC,KAAK,CAAC,UAAU;QACjD,MAAM,EAAE,KAAK;KACd,CAAC;AACJ,CAAC;AAED,8EAA8E;AAC9E,mBAAmB;AACnB,8EAA8E;AAE9E;;;;GAIG;AACH,KAAK,UAAU,gBAAgB,CAAC,KAAiB;IAC/C,MAAM,MAAM,GAAI,UAAqD,CAAC,MAAM,EAAE,MAAM,CAAC;IACrF,IAAI,CAAC,MAAM,EAAE,CAAC;QACZ,MAAM,IAAI,KAAK,CACb,0DAA0D;YACxD,4DAA4D,CAC/D,CAAC;IACJ,CAAC;IACD,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;IAC9C,IAAI,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAChB,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,MAAM,CAAC,SAAS,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAC3D,OAAO,WAAW,CAAC,MAAM,CAAC,CAAC;AAC7B,CAAC;AAED,SAAS,sBAAsB,CAAC,WAAmB;IACjD,MAAM,GAAG,GAAG,WAAW,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,CAAC;IAClG,OAAO,SAAS,GAAG,EAAE,CAAC;AACxB,CAAC;AAED,SAAS,WAAW,CAAC,MAAmB;IACtC,MAAM,IAAI,GAAG,IAAI,UAAU,CAAC,MAAM,CAAC,CAAC;IACpC,IAAI,GAAG,GAAG,EAAE,CAAC;IACb,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;QACrC,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAW,CAAC;QAC/B,GAAG,IAAI,IAAI,CAAC,QAAQ,CAAC,EAAE,CAAC,CAAC,QAAQ,CAAC,CAAC,EAAE,GAAG,CAAC,CAAC;IAC5C,CAAC;IACD,OAAO,GAAG,CAAC;AACb,CAAC"}