@aexhq/sdk 0.35.0 → 0.37.0

package/dist/client.js

@@ -1,9 +1,8 @@
-import { AexError, DEFAULT_RUN_PROVIDER, HttpClient, RunConfigValidationError, RunStateError, SecretString, customName, isRunSettled, operations, providersForModel, streamCoordinatorEvents, decodeAssistantText, summarizeRunTrace, textOf, parseRunLimits, BUILTIN_TOOL_NAMES, TERMINAL_RUN_STATUSES } from "./_contracts/index.js";
+import { AexApiError, AexError, CredentialValidationError, DEFAULT_RUN_PROVIDER, HttpClient, RunConfigValidationError, RunStateError, SecretString, customName, isRunSettled, operations, providersForModel, streamCoordinatorEvents, parseRunLimits, parseRuntimeSize, parseRunTimeout, parseRunWebhook, BUILTIN_TOOL_NAMES, TERMINAL_RUN_STATUSES } from "./_contracts/index.js";
 import { AgentsMd } from "./agents-md.js";
 import { uploadAsset } from "./asset-upload.js";
 import { File } from "./file.js";
 import { McpServer } from "./mcp-server.js";
-import { splitProxyEndpoints } from "./proxy-endpoint.js";
 import { AexRateLimitError, isThrottleFault, parseProviderFault, withRetry } from "./retry.js";
 import { splitSecretEnv } from "./secret.js";
 import { SkillTool } from "./skill-tool.js";
@@ -95,14 +94,16 @@ export class SessionHandle {
         const readSession = await operations.getSession(this.#http, this.id).catch(() => this.#session);
         this.#session = withTerminalSessionStatus(readSession, terminalStatus);
         const outputs = await operations.listSessionOutputs(this.#http, this.id).catch(() => []);
+        const messages = projectAssistantMessages(events);
         return {
             sessionId: this.id,
             session: this.#session,
             turn,
             status: this.#session.status,
-            text: textOf(events),
+            text: assistantTextFromEvents(events),
             events,
-            outputs
+            outputs,
+            messages
         };
     }
     async suspend(options = {}) {
@@ -127,19 +128,39 @@ export class SessionHandle {
         }
     }
     /**
-     * Accessor for the session's decoded assistant messages (buffered output
-     * mode: one entry per assistant message). `list()` returns them oldest-first;
-     * `last()`/`first()` return a single entry or `undefined` when empty.
+     * Accessor for the session's assistant messages. `all()` returns them
+     * oldest-first; `last()`/`first()` return a single entry or `undefined` when
+     * empty. The accessor is callable as a compatibility shim for older
+     * `session.messages().list()` callers.
      */
-    messages() {
+    get messages() {
         const http = this.#http;
         const id = this.id;
-        const list = async () => decodeAssistantText((await operations.listSessionEvents(http, id)));
-        return {
-            list,
-            last: async () => (await list()).at(-1),
-            first: async () => (await list())[0]
+        const fromEvents = async () => projectAssistantMessages(await operations.listSessionEvents(http, id));
+        const all = async () => {
+            try {
+                const page = await operations.listSessionMessages(http, id);
+                if (!Array.isArray(page.messages)) {
+                    return fromEvents();
+                }
+                return page.messages.map(messageFromWire);
+            }
+            catch (err) {
+                if (!isMissingMessagesEndpoint(err)) {
+                    throw err;
+                }
+                return fromEvents();
+            }
         };
+        let accessor;
+        accessor = (() => accessor);
+        Object.assign(accessor, {
+            all,
+            list: all,
+            last: async () => (await all()).at(-1),
+            first: async () => (await all())[0]
+        });
+        return accessor;
     }
     /**
      * Accessor for the session's event stream: the buffered `SessionEvent`
@@ -214,6 +235,12 @@ export class SessionHandle {
      * Fetch the self-contained `RunUnit` for this session: parsed submission,
      * attempts, indexed events, outputs, capture failures, proxy-call audit, and
      * resolved skills. Use this when you need fields beyond the session record.
+     *
+     * On the managed plane this is a LEAN summary — the aggregate collections
+     * (`attempts` / `events.entries` / `outputs` / `rawEventPages`) default to
+     * empty. For authoritative per-run data use `outputs()` / `events()` /
+     * `messages()`. The returned shape is always type-valid (never `undefined`
+     * where the type promises an array/page), so array/page access is safe.
      */
     unit() {
         return operations.getRunUnit(this.#http, this.id);
@@ -274,7 +301,10 @@ export class SessionClient {
      * `query.limit` (default 100).
      */
     async searchOutputs(query = {}) {
-        const sessionIds = query.runIds ?? (await this.#allSessionIds());
+        // Dedup the caller-supplied allow-list so a run repeated in `runIds` (e.g. from
+        // concatenating corpora) isn't scanned twice and doesn't inflate the hit count
+        // with duplicates (pre-launch edge-sweep F27).
+        const sessionIds = query.runIds ? [...new Set(query.runIds)] : await this.#allSessionIds();
         const limit = query.limit ?? 100;
         // Translate the search query to an OutputQuery so the contracts output
         // filter does the matching — no re-derived filter logic here.
@@ -447,6 +477,199 @@ function sessionOutputs(http, id, fetchLike) {
         download: (selector, options) => downloadSessionOutput(http, id, selector, options)
     };
 }
+function messageFromWire(message) {
+    return {
+        id: message.id,
+        sender: message.sender,
+        text: message.text,
+        ...(message.timestamp !== undefined ? { timestamp: message.timestamp } : {}),
+        ...(message.turnSeq !== undefined ? { turnSeq: message.turnSeq } : {}),
+        ...(message.sequence !== undefined ? { sequence: message.sequence } : {})
+    };
+}
+function isMissingMessagesEndpoint(err) {
+    return err instanceof AexApiError && (err.status === 404 || err.status === 405 || err.status === 501);
+}
+function projectAssistantMessages(events) {
+    const out = [];
+    const byMessageId = new Map();
+    for (let i = 0; i < events.length; i++) {
+        const event = events[i];
+        if (event.type !== "TEXT_MESSAGE_CONTENT")
+            continue;
+        const data = asRecord(event.data);
+        const text = typeof data.text === "string" ? data.text : undefined;
+        if (text === undefined)
+            continue;
+        const messageId = typeof data.messageId === "string" && data.messageId ? data.messageId : undefined;
+        const sequence = event.sequence ?? event.seq;
+        const timestamp = event.time ?? event.recordedAt ?? timestampFromEpochMs(event.receivedAt);
+        const turnSeq = typeof data.turnSeq === "number" ? data.turnSeq : undefined;
+        if (messageId !== undefined) {
+            const existing = byMessageId.get(messageId);
+            if (existing !== undefined) {
+                const current = out[existing];
+                out[existing] = {
+                    ...current,
+                    text: `${current.text}${text}`,
+                    ...(timestamp !== undefined ? { timestamp } : {}),
+                    ...(sequence !== undefined ? { sequence } : {}),
+                    ...(turnSeq !== undefined ? { turnSeq } : {})
+                };
+                continue;
+            }
+            byMessageId.set(messageId, out.length);
+        }
+        out.push({
+            id: messageId ?? (typeof event.id === "string" && event.id ? event.id : `message-${i}`),
+            sender: "assistant",
+            text,
+            ...(timestamp !== undefined ? { timestamp } : {}),
+            ...(sequence !== undefined ? { sequence } : {}),
+            ...(turnSeq !== undefined ? { turnSeq } : {})
+        });
+    }
+    return out;
+}
+function assistantTextFromEvents(events) {
+    return assistantTextEntriesFromEvents(events).map((entry) => entry.text).join("");
+}
+function runTraceFromEvents(events) {
+    return {
+        toolCalls: toolCallsFromEvents(events),
+        usage: usageFromEvents(events),
+        text: assistantTextEntriesFromEvents(events)
+    };
+}
+function assistantTextEntriesFromEvents(events) {
+    const out = [];
+    for (const raw of events) {
+        const event = raw;
+        if (event.type !== "TEXT_MESSAGE_CONTENT")
+            continue;
+        const data = asRecord(event.data);
+        const text = typeof data.text === "string" ? data.text : undefined;
+        if (text === undefined)
+            continue;
+        const entry = { text };
+        const messageId = typeof data.messageId === "string" ? data.messageId : undefined;
+        if (messageId !== undefined)
+            entry.messageId = messageId;
+        if (typeof event.seq === "number")
+            entry.seq = event.seq;
+        const recordedAt = typeof event.recordedAt === "string" ? event.recordedAt : undefined;
+        if (recordedAt !== undefined)
+            entry.recordedAt = recordedAt;
+        out.push(entry);
+    }
+    return out;
+}
+function toolCallsFromEvents(events) {
+    const order = [];
+    const byId = new Map();
+    for (const event of events) {
+        const data = asRecord(event.data);
+        if (event.type === "TOOL_CALL_START") {
+            const id = typeof data.id === "string" ? data.id : undefined;
+            if (id === undefined)
+                continue;
+            const trace = {
+                id,
+                name: typeof data.name === "string" ? data.name : "",
+                args: asRecord(data.arguments)
+            };
+            const messageId = typeof data.messageId === "string" ? data.messageId : undefined;
+            if (messageId !== undefined)
+                trace.messageId = messageId;
+            if (typeof event.seq === "number")
+                trace.startSeq = event.seq;
+            if (typeof event.recordedAt === "string")
+                trace.startedAt = event.recordedAt;
+            if (!byId.has(id))
+                order.push(id);
+            byId.set(id, trace);
+            continue;
+        }
+        if (event.type === "TOOL_CALL_RESULT") {
+            const id = typeof data.id === "string" ? data.id : undefined;
+            if (id === undefined)
+                continue;
+            const result = {
+                isError: data.isError === true,
+                content: data.content ?? null
+            };
+            if (typeof event.seq === "number")
+                result.seq = event.seq;
+            if (typeof event.recordedAt === "string")
+                result.recordedAt = event.recordedAt;
+            let trace = byId.get(id);
+            if (trace === undefined) {
+                trace = { id, name: "", args: {} };
+                order.push(id);
+                byId.set(id, trace);
+            }
+            trace.result = result;
+            const duration = durationMs(trace.startedAt, result.recordedAt);
+            if (duration !== undefined)
+                trace.durationMs = duration;
+        }
+    }
+    return order.map((id) => byId.get(id));
+}
+function usageFromEvents(events) {
+    const totals = { inputTokens: 0, outputTokens: 0, cacheReadInputTokens: 0, cacheCreationInputTokens: 0 };
+    let seen = false;
+    for (const event of events) {
+        if (event.type !== "CUSTOM")
+            continue;
+        const data = asRecord(event.data);
+        if (data.name !== "aex.usage")
+            continue;
+        const value = asRecord(data.value);
+        const fields = [
+            ["input_tokens", "inputTokens"],
+            ["output_tokens", "outputTokens"],
+            ["cache_read_input_tokens", "cacheReadInputTokens"],
+            ["cache_creation_input_tokens", "cacheCreationInputTokens"]
+        ];
+        for (const [wireName, apiName] of fields) {
+            const n = value[wireName];
+            if (typeof n === "number" && Number.isFinite(n)) {
+                totals[apiName] += n;
+                seen = true;
+            }
+        }
+    }
+    if (!seen)
+        return {};
+    return {
+        inputTokens: totals.inputTokens,
+        outputTokens: totals.outputTokens,
+        cacheReadInputTokens: totals.cacheReadInputTokens,
+        cacheCreationInputTokens: totals.cacheCreationInputTokens,
+        totalTokens: totals.inputTokens + totals.outputTokens
+    };
+}
+function asRecord(value) {
+    return value && typeof value === "object" && !Array.isArray(value)
+        ? value
+        : {};
+}
+function timestampFromEpochMs(value) {
+    return typeof value === "number" && Number.isFinite(value)
+        ? new Date(value).toISOString()
+        : undefined;
+}
+function durationMs(start, end) {
+    if (start === undefined || end === undefined)
+        return undefined;
+    const a = Date.parse(start);
+    const b = Date.parse(end);
+    if (!Number.isFinite(a) || !Number.isFinite(b))
+        return undefined;
+    const delta = b - a;
+    return delta >= 0 ? delta : undefined;
+}
 function isSessionTurnTerminalEvent(event, turnSeq) {
     const name = customName(event);
     if (name !== "aex.session.idle" &&
@@ -599,7 +822,7 @@ function unwrapSecretValue(value) {
  * `client.whoami()` if you want to introspect which workspace the
  * token resolves to.
  */
-export class AgentExecutor {
+export class Aex {
     #http;
     /** The same fetch the HttpClient uses, threaded into `_uploadAsset`. */
     #fetch;
@@ -607,28 +830,32 @@ export class AgentExecutor {
     files;
     secrets;
     sessions;
-    constructor(options) {
-        if (!options.apiToken) {
-            throw new Error("AgentExecutor: apiToken is required");
+    constructor(options, overrides = {}) {
+        const resolved = typeof options === "string" ? { ...overrides, apiKey: options } : options;
+        const apiKey = resolved.apiKey ?? resolved.apiToken;
+        if (!apiKey) {
+            // Typed so a caller catching AexError (the SDK's error base) catches a
+            // missing credential too, instead of a bare Error slipping the taxonomy.
+            throw new CredentialValidationError("Aex: apiKey is required");
         }
         // Wrap the transport fetch (the caller's override, or global `fetch`) with
         // the bounded-retry layer so every BFF request gets default resilience.
         // The raw `#fetch` below stays unwrapped for the direct-to-storage asset PUT
         // and presigned output GETs, which target object storage, not the API plane.
-        const baseFetch = options.fetch ?? ((input, init) => fetch(input, init));
-        const retryingFetch = withRetry(baseFetch, options.retry);
+        const baseFetch = resolved.fetch ?? ((input, init) => fetch(input, init));
+        const retryingFetch = withRetry(baseFetch, resolved.retry);
         this.#http = new HttpClient({
-            ...(options.baseUrl ? { baseUrl: options.baseUrl } : {}),
-            apiToken: options.apiToken,
+            ...(resolved.baseUrl ? { baseUrl: resolved.baseUrl } : {}),
+            apiToken: apiKey,
             fetch: retryingFetch,
             // Opt-in local diagnostics: emit a redacted per-request trace to
             // stderr. Uploads nothing. A caller wanting a custom sink can pass
             // a function instead of `true`.
-            ...(options.debug
-                ? { debug: typeof options.debug === "function" ? options.debug : (line) => console.error(line) }
+            ...(resolved.debug
+                ? { debug: typeof resolved.debug === "function" ? resolved.debug : (line) => console.error(line) }
                 : {})
         });
-        this.#fetch = options.fetch;
+        this.#fetch = resolved.fetch;
         this.agentsMd = new AgentsMdClient(this.#http);
         this.files = new FilesClient(this.#http);
         this.secrets = new SecretsClient(this.#http);
@@ -698,6 +925,20 @@ export class AgentExecutor {
             const events = turnResult.events;
             const outputs = turnResult.outputs;
             const ok = turnResult.status === "idle" || turnResult.status === "suspended";
+            if (!ok && scopedSignal?.signal.aborted) {
+                // The client-side wait budget (opts.timeoutMs) expired before the run
+                // reached a terminal park. Parity with SessionHandle.wait(): THROW rather
+                // than silently returning a misleading {ok:false,status:"running"} with no
+                // error (pre-launch edge-sweep F3). The run continues server-side.
+                throw new RunStateError(`Aex.run: timed out after ${opts.timeoutMs}ms waiting for run ${runId} to park (last status ` +
+                    `${JSON.stringify(turnResult.status)}); the run continues server-side — cancel via ` +
+                    `session.cancel() or resume with openSession(${JSON.stringify(runId)})`);
+            }
+            const trace = runTraceFromEvents(events);
+            // Surface the trace-derived usage at the top level when the run record does
+            // not carry its own usage (the managed plane doesn't populate session.usage);
+            // the per-event trace still yields token counts (pre-launch edge-sweep F5).
+            const usage = turnResult.session.usage ?? trace.usage;
             const costUsd = typeof turnResult.session.costUsd === "number" ? turnResult.session.costUsd : undefined;
             const errorMessage = typeof turnResult.session.errorMessage === "string" && turnResult.session.errorMessage ? turnResult.session.errorMessage : undefined;
             const result = {
@@ -709,10 +950,11 @@ export class AgentExecutor {
                 status: turnResult.status,
                 ok,
                 text: turnResult.text,
+                messages: turnResult.messages,
                 events,
-                trace: summarizeRunTrace(events),
+                trace,
                 outputs,
-                ...(turnResult.session.usage ? { usage: turnResult.session.usage } : {}),
+                ...(usage ? { usage } : {}),
                 ...(typeof costUsd === "number" ? { costUsd } : {}),
                 ...(!ok && errorMessage ? { error: errorMessage } : {})
             };
@@ -730,7 +972,7 @@ export class AgentExecutor {
                         ...(throttle.retryAfterMs !== undefined ? { retryAfterMs: throttle.retryAfterMs } : {})
                     });
                 }
-                throw new RunStateError(`AgentExecutor.run: session ${runId} ended ${turnResult.status}${errorMessage ? `: ${errorMessage}` : ""}`, { runId, status: turnResult.status });
+                throw new RunStateError(`Aex.run: session ${runId} ended ${turnResult.status}${errorMessage ? `: ${errorMessage}` : ""}`, { runId, status: turnResult.status });
             }
             return result;
         }
@@ -760,8 +1002,23 @@ export class AgentExecutor {
         if (typeof options.model !== "string" || !options.model) {
             throw new RunConfigValidationError("Aex.openSession: model is required");
         }
-        const { endpoints: proxyEndpointDeclarations, auth: proxyEndpointAuthFromInstances } = splitProxyEndpoints(options.proxyEndpoints ?? []);
-        const mergedProxyAuth = mergeProxyEndpointAuth(proxyEndpointAuthFromInstances, []);
+        // Fast client-side validation via the contract parsers (the SSoT). runtimeSize
+        // and timeout are STABLE closed sets whose invalid values the create endpoint
+        // otherwise SILENTLY defaults (no error ever — pre-launch edge-sweep F11/F12);
+        // reject them synchronously with a typed error instead. webhook shape is
+        // re-checked here for a fast local fail (the server enforces it too). Model is
+        // deliberately NOT hard-rejected here to preserve forward-compat with models
+        // added server-side before an SDK upgrade (an unknown model still fails on the
+        // server).
+        try {
+            parseRuntimeSize(options.runtime);
+            parseRunTimeout(options.overrides?.timeout);
+            if (options.webhook !== undefined)
+                parseRunWebhook(options.webhook);
+        }
+        catch (err) {
+            throw new RunConfigValidationError(`Aex.openSession: ${err instanceof Error ? err.message : String(err)}`);
+        }
         const { declarations: secretEnvDeclarations, values: envSecretValues } = splitSecretEnv(options.environment?.secrets);
         let limits;
         try {
@@ -804,7 +1061,6 @@ export class AgentExecutor {
         const secrets = {
             ...(options.apiKeys ? { apiKeys: options.apiKeys } : {}),
             ...(mergedMcpSecrets.length > 0 ? { mcpServers: mergedMcpSecrets } : {}),
-            ...(mergedProxyAuth.length > 0 ? { proxyEndpointAuth: mergedProxyAuth } : {}),
             ...(Object.keys(envSecretValues).length > 0 ? { envSecrets: envSecretValues } : {})
         };
         const retention = sessionRetentionForWire(options);
@@ -818,10 +1074,7 @@ export class AgentExecutor {
             // Operational/delivery concern — sibling of secrets, NOT part of the
             // hashed submission. Delivered at the settle-consistent barrier.
             ...(options.webhook ? { webhook: options.webhook } : {}),
-            secrets,
-            ...(proxyEndpointDeclarations.length > 0
-                ? { proxyEndpoints: proxyEndpointDeclarations }
-                : {})
+            secrets
         };
     }
     /**
@@ -835,9 +1088,49 @@ export class AgentExecutor {
     whoami() {
         return operations.whoami(this.#http);
     }
-}
-/** Canonical SDK client name. `AgentExecutor` remains as a compatibility alias. */
-export class Aex extends AgentExecutor {
+    /**
+     * Read the workspace billing summary: prepaid `balanceUsd`, current-month
+     * `monthSpendUsd`, the enforced `spendCapUsd`, and plan fields. Backed by
+     * `GET /api/billing` (scope `billing:read`). The result is additive-tolerant:
+     * fields a newer deployment reports that this SDK does not know yet pass
+     * through on the returned object.
+     */
+    billing() {
+        return operations.getBilling(this.#http);
+    }
+    /**
+     * Create a hosted checkout session for a paid plan (`pro` or `team`).
+     * Open the returned `url` in a browser. Plan activation happens after
+     * checkout completes.
+     */
+    billingCheckout(request) {
+        return operations.createBillingCheckout(this.#http, request);
+    }
+    /**
+     * Create a hosted billing-portal session for the workspace customer.
+     * Open the returned `url` in a browser.
+     */
+    billingPortal(request = {}) {
+        return operations.createBillingPortal(this.#http, request);
+    }
+    /**
+     * Read recent workspace credit-ledger rows, newest first — top-ups, run
+     * charges, and redemptions with signed `amountUsd`. Backed by
+     * `GET /api/billing/ledger`; `limit` is clamped server-side to [1, 100]
+     * (default 25). Not cursor-paged.
+     */
+    billingLedger(query) {
+        return operations.getBillingLedger(this.#http, query);
+    }
+    /**
+     * Reveal the workspace webhook signing secret (creating one on first use) —
+     * the `whsec_<base64>` value `verifyAexWebhook` takes as `secret`. Backed by
+     * `POST /api/webhook/signing-secret`; repeat calls return the SAME value (the
+     * hosted API does not rotate it). Treat the reveal as sensitive: never log it.
+     */
+    webhookSigningSecret() {
+        return operations.getWebhookSigningSecret(this.#http);
+    }
 }
 // `Run.status` is a loose `string` on the wire shape, so we membership-test
 // against the canonical terminal set rather than re-deriving one (which is how
@@ -895,7 +1188,7 @@ function resolveOutputFileSelector(outputs, selector, runId) {
     if (isOutputPathSelector(selector)) {
         const target = normalizeOutputLookupPath(selector.path);
         if (!target) {
-            throw new RunStateError("AgentExecutor.downloadOutput: output path must be non-empty", {
+            throw new RunStateError("Aex.downloadOutput: output path must be non-empty", {
                 runId,
                 path: selector.path
             });
@@ -912,15 +1205,15 @@ function resolveOutputFileSelector(outputs, selector, runId) {
         if (matches.length === 1)
             return matches[0];
         if (matches.length > 1) {
-            throw new RunStateError(`AgentExecutor.downloadOutput: output path "${selector.path}" matched multiple files`, { runId, path: selector.path, matches: matches.map((output) => output.filename ?? output.id) });
+            throw new RunStateError(`Aex.downloadOutput: output path "${selector.path}" matched multiple files`, { runId, path: selector.path, matches: matches.map((output) => output.filename ?? output.id) });
         }
-        throw new RunStateError(`AgentExecutor.downloadOutput: output path "${selector.path}" was not found`, {
+        throw new RunStateError(`Aex.downloadOutput: output path "${selector.path}" was not found`, {
             runId,
             path: selector.path
         });
     }
     if (typeof selector.id !== "string" || selector.id.length === 0) {
-        throw new RunStateError("AgentExecutor.downloadOutput: selector must include an output id or path", { runId });
+        throw new RunStateError("Aex.downloadOutput: selector must include an output id or path", { runId });
     }
     return { ...selector, id: selector.id };
 }
@@ -1010,6 +1303,7 @@ function normaliseSessionInput(input, surface, field) {
 }
 function assertNoLegacySessionFields(options, surface) {
     const record = options;
+    const removedProxyField = "proxy" + "Endpoints";
     const messages = {
         input: "send user messages with session.send(...) or use run({ message }).",
         prompt: "use message for one-shot run input or session.send(...) for follow-up messages.",
@@ -1025,7 +1319,8 @@ function assertNoLegacySessionFields(options, surface) {
         limits: "use overrides.",
         timeout: "use overrides.timeout.",
         signal: "use session.cancel() / session.suspend() for remote control.",
-        postHook: "send a follow-up validation message when the session returns idle."
+        postHook: "send a follow-up validation message when the session returns idle.",
+        [removedProxyField]: "proxy endpoints are not part of the public SDK session API."
     };
     for (const [field, message] of Object.entries(messages)) {
         if (Object.prototype.hasOwnProperty.call(record, field)) {
@@ -1247,29 +1542,4 @@ function mergeMcpServers(inputs, explicitSecrets) {
         mergedMcpSecrets: Array.from(secretByName.values())
     };
 }
-/**
- * Merge `ProxyEndpoint`-derived auth entries with any
- * `secrets.proxyEndpointAuth` the caller passed explicitly. Per-instance
- * auth values win on the same `name`; a type mismatch (e.g. instance
- * declares `bearer` but secrets carry `header` for the same name) is a
- * call-site error and we throw at the SDK boundary instead of letting
- * the BFF reject the submission an HTTP request later.
- */
-function mergeProxyEndpointAuth(fromInstances, fromExplicitSecrets) {
-    if (fromInstances.length === 0 && fromExplicitSecrets.length === 0)
-        return [];
-    const byName = new Map();
-    for (const entry of fromExplicitSecrets) {
-        byName.set(entry.name, entry);
-    }
-    for (const entry of fromInstances) {
-        const existing = byName.get(entry.name);
-        if (existing && existing.value.type !== entry.value.type) {
-            throw new RunConfigValidationError(`aex: proxyEndpoint "${entry.name}" auth type conflicts ` +
-                `with secrets.proxyEndpointAuth (instance=${entry.value.type}, secrets=${existing.value.type})`);
-        }
-        byName.set(entry.name, entry);
-    }
-    return Array.from(byName.values());
-}
 //# sourceMappingURL=client.js.map