@aexhq/sdk 0.37.4 → 0.38.0

package/README.md

@@ -20,11 +20,11 @@ npm i @aexhq/sdk
 ```
 
 This installs the TypeScript SDK exports and the bundled `aex` CLI. Set both
-credentials before running the examples: `AEX_API_TOKEN` authenticates to aex,
+credentials before running the examples: `AEX_API_KEY` authenticates to aex,
 and `ANTHROPIC_API_KEY` is your BYOK provider key for Claude.
 
 ```bash
-export AEX_API_TOKEN="<your-aex-token>"
+export AEX_API_KEY="<your-aex-api-key>"
 export ANTHROPIC_API_KEY="<your-anthropic-api-key>"
 ```
 
@@ -33,7 +33,7 @@ export ANTHROPIC_API_KEY="<your-anthropic-api-key>"
 ```ts
 import { Aex, Models, Sizes } from "@aexhq/sdk";
 
-const aex = new Aex({ apiToken: process.env.AEX_API_TOKEN! });
+const aex = new Aex({ apiKey: process.env.AEX_API_KEY! });
 
 const session = await aex.openSession({
   model: Models.CLAUDE_HAIKU_4_5,
@@ -82,7 +82,7 @@ The same request can run from the bundled CLI:
 
 ```bash
 aex run \
-  --api-token "$AEX_API_TOKEN" \
+  --api-key "$AEX_API_KEY" \
   --anthropic-api-key "$ANTHROPIC_API_KEY" \
   --model claude-haiku-4-5 \
   --prompt "Write the report and save outputs." \
@@ -91,14 +91,14 @@ aex run \
 
 ## CLI: login, discovery, typed errors
 
-Stop re-passing `--api-token` on every command — log in once and the token (plus
+Stop re-passing `--api-key` on every command — log in once and the token (plus
 your default `--aex-url`) is persisted to a `0600` config file
 (`$XDG_CONFIG_HOME/aex/config.json` or `~/.config/aex/config.json`; `%APPDATA%\aex\config.json`
-on Windows). An explicit `--api-token` flag always overrides the stored one.
+on Windows). An explicit `--api-key` flag always overrides the stored one.
 
 ```bash
-aex login --api-token "$AEX_API_TOKEN" [--aex-url https://api.aex.dev]
-aex whoami            # no --api-token needed after login
+aex login --api-key "$AEX_API_KEY" [--aex-url https://api.aex.dev]
+aex whoami            # no --api-key needed after login
 aex auth status       # show the resolved config (the token value is never printed)
 aex logout            # clear the stored token
 ```

package/dist/_contracts/http.d.ts

@@ -14,7 +14,7 @@ export interface HttpClientOptions {
      * own URL; no env var consults this value.
      */
     readonly baseUrl?: string;
-    readonly apiToken: string;
+    readonly apiKey: string;
     readonly fetch?: FetchLike;
     /** When set, every request emits a redacted one-line trace here. */
     readonly debug?: DebugSink;

package/dist/_contracts/http.js

@@ -8,12 +8,12 @@ import { AEX_DEFAULT_BASE_URL } from "./stable.js";
  */
 export class HttpClient {
     #baseUrl;
-    #apiToken;
+    #apiKey;
     #fetch;
     #debug;
     constructor(options) {
-        if (!options.apiToken) {
-            throw new Error("HttpClient: apiToken is required");
+        if (!options.apiKey) {
+            throw new Error("HttpClient: apiKey is required");
         }
         const raw = options.baseUrl ?? AEX_DEFAULT_BASE_URL;
         const normalized = raw.endsWith("/") ? raw : `${raw}/`;
@@ -24,7 +24,7 @@ export class HttpClient {
             throw new Error(`HttpClient: invalid aex baseUrl ${JSON.stringify(redactUrl(raw))} — ` +
                 `expected an absolute URL like "${AEX_DEFAULT_BASE_URL}"`, { cause: err });
         }
-        this.#apiToken = options.apiToken;
+        this.#apiKey = options.apiKey;
         this.#fetch = options.fetch ?? fetch;
         this.#debug = options.debug;
     }
@@ -39,7 +39,7 @@ export class HttpClient {
         }
         const headers = {
             accept: "application/json",
-            authorization: `Bearer ${this.#apiToken}`,
+            authorization: `Bearer ${this.#apiKey}`,
             ...normalizeHeaders(init.headers)
         };
         if (init.body !== undefined && init.body !== null && !headers["content-type"]) {
@@ -73,7 +73,7 @@ export class HttpClient {
             url.searchParams.set(key, value);
         }
         const headers = {
-            authorization: `Bearer ${this.#apiToken}`,
+            authorization: `Bearer ${this.#apiKey}`,
             ...normalizeHeaders(init.headers)
         };
         const startedMs = Date.now();

package/dist/_contracts/operations.d.ts

@@ -10,7 +10,7 @@ import type { PlatformRunSubmissionInput } from "./submission.js";
  * Every function takes an HttpClient (so callers control auth + fetch
  * injection) and returns parsed responses.
  *
- * Workspace identity is derived server-side from the API token on
+ * Workspace identity is derived server-side from the API key on
  * every request; callers do not pass `workspaceId`.
  */
 export declare function getRun(http: HttpClient, runId: string): Promise<Run>;

package/dist/_contracts/operations.js

@@ -10,7 +10,7 @@ import { assertRunRecordArchivePublicSafeV1, buildRunRecordDownloadManifestV1 }
  * Every function takes an HttpClient (so callers control auth + fetch
  * injection) and returns parsed responses.
  *
- * Workspace identity is derived server-side from the API token on
+ * Workspace identity is derived server-side from the API key on
  * every request; callers do not pass `workspaceId`.
  */
 export async function getRun(http, runId) {

package/dist/_contracts/run-retention.d.ts

@@ -79,7 +79,7 @@ export interface RunDeletionManifestRunV1 {
 }
 export interface RunDeletionManifestRequestV1 {
     readonly reason: RunDeletionReason;
-    readonly actorClass: "user" | "api_token" | "system" | "operator";
+    readonly actorClass: "user" | "api_key" | "system" | "operator";
 }
 export interface RunDeletionManifestSummaryV1 {
     readonly totalCount: number;

package/dist/_contracts/runtime-types.d.ts

@@ -161,7 +161,7 @@ export interface UsageSummary {
 /**
  * Filters for {@link import("./operations.js").listRuns} / the CLI's `aex runs`.
  * Every field is optional; omitting all of them lists the most recent runs in the
- * token's workspace. Workspace identity is derived server-side from the API token,
+ * token's workspace. Workspace identity is derived server-side from the API key,
  * so there is no `workspaceId` here — a token can only ever enumerate its own runs.
  */
 export interface RunListQuery {
@@ -377,9 +377,9 @@ export interface WhoAmI {
     /**
      * Kind of principal the bearer resolved to. OPTIONAL IN PRACTICE: current
      * managed deployments do not serve it (`GET /whoami` returns only
-     * `workspaceId` + `scopes` + `limits`) — treat `undefined` as "api_token".
+     * `workspaceId` + `scopes` + `limits`) — treat `undefined` as "api_key".
      */
-    readonly principalType?: "api_token" | "user";
+    readonly principalType?: "api_key" | "user";
     readonly workspaceId?: string;
     readonly tokenId?: string;
     readonly tokenName?: string | null;

package/dist/_contracts/side-effect-audit.d.ts

@@ -2,15 +2,15 @@ import type { RunProvider } from "./submission.js";
 export declare const SIDE_EFFECT_AUDIT_SCHEMA_VERSION = 1;
 export declare const SIDE_EFFECT_AUDIT_REDACTION_SCANNER_VERSION = 1;
 export declare const SIDE_EFFECT_AUDIT_KIND = "aex.side_effect_audit.v1";
-export declare const SIDE_EFFECT_AUDIT_ACTIONS: readonly ["run.submit.accepted", "run.submit.rejected", "run.cancel.requested", "run.delete.requested", "run.delete.completed", "run.delete.failed", "run.download.requested", "run.output.downloaded", "run.log.downloaded", "run.event.downloaded", "workspace.asset.uploaded", "workspace.asset.deleted", "proxy.endpoint.called", "mcp.credential.accessed", "mcp.proxy.called", "provider.proxy.called", "custody.manifest.written", "custody.transition.recorded", "runtime.cleanup.completed", "runtime.cleanup.failed", "terminal_redrive.attempted", "terminal_redrive.completed", "api_token.created", "api_token.deleted", "api_token.used"];
+export declare const SIDE_EFFECT_AUDIT_ACTIONS: readonly ["run.submit.accepted", "run.submit.rejected", "run.cancel.requested", "run.delete.requested", "run.delete.completed", "run.delete.failed", "run.download.requested", "run.output.downloaded", "run.log.downloaded", "run.event.downloaded", "workspace.asset.uploaded", "workspace.asset.deleted", "proxy.endpoint.called", "mcp.credential.accessed", "mcp.proxy.called", "provider.proxy.called", "custody.manifest.written", "custody.transition.recorded", "runtime.cleanup.completed", "runtime.cleanup.failed", "terminal_redrive.attempted", "terminal_redrive.completed", "api_key.created", "api_key.deleted", "api_key.used"];
 export type SideEffectAuditAction = (typeof SIDE_EFFECT_AUDIT_ACTIONS)[number];
-export declare const SIDE_EFFECT_AUDIT_ACTOR_PRINCIPAL_TYPES: readonly ["user", "api_token", "system", "runtime"];
+export declare const SIDE_EFFECT_AUDIT_ACTOR_PRINCIPAL_TYPES: readonly ["user", "api_key", "system", "runtime"];
 export type SideEffectAuditActorPrincipalType = (typeof SIDE_EFFECT_AUDIT_ACTOR_PRINCIPAL_TYPES)[number];
 export declare const SIDE_EFFECT_AUDIT_SOURCE_PLANES: readonly ["dashboard", "api", "runtime", "system"];
 export type SideEffectAuditSourcePlane = (typeof SIDE_EFFECT_AUDIT_SOURCE_PLANES)[number];
-export declare const SIDE_EFFECT_AUDIT_AUTHENTICATION_KINDS: readonly ["dashboard_auth", "api_token", "runner_token", "system"];
+export declare const SIDE_EFFECT_AUDIT_AUTHENTICATION_KINDS: readonly ["dashboard_auth", "api_key", "runner_token", "system"];
 export type SideEffectAuditAuthenticationKind = (typeof SIDE_EFFECT_AUDIT_AUTHENTICATION_KINDS)[number];
-export declare const SIDE_EFFECT_AUDIT_TARGET_TYPES: readonly ["workspace", "run", "proxy_endpoint", "mcp_credential", "mcp_proxy", "provider_proxy", "output_archive", "run_output", "run_log", "run_event_stream", "workspace_asset", "custody_manifest", "custody_transition", "cleanup", "deletion", "terminal_redrive", "api_token"];
+export declare const SIDE_EFFECT_AUDIT_TARGET_TYPES: readonly ["workspace", "run", "proxy_endpoint", "mcp_credential", "mcp_proxy", "provider_proxy", "output_archive", "run_output", "run_log", "run_event_stream", "workspace_asset", "custody_manifest", "custody_transition", "cleanup", "deletion", "terminal_redrive", "api_key"];
 export type SideEffectAuditTargetType = (typeof SIDE_EFFECT_AUDIT_TARGET_TYPES)[number];
 export declare const SIDE_EFFECT_AUDIT_OUTCOMES: readonly ["accepted", "rejected", "succeeded", "failed", "denied", "canceled", "pending"];
 export type SideEffectAuditOutcome = (typeof SIDE_EFFECT_AUDIT_OUTCOMES)[number];

package/dist/_contracts/side-effect-audit.js

@@ -24,13 +24,13 @@ export const SIDE_EFFECT_AUDIT_ACTIONS = [
     "runtime.cleanup.failed",
     "terminal_redrive.attempted",
     "terminal_redrive.completed",
-    "api_token.created",
-    "api_token.deleted",
-    "api_token.used"
+    "api_key.created",
+    "api_key.deleted",
+    "api_key.used"
 ];
 export const SIDE_EFFECT_AUDIT_ACTOR_PRINCIPAL_TYPES = [
     "user",
-    "api_token",
+    "api_key",
     "system",
     "runtime"
 ];
@@ -42,7 +42,7 @@ export const SIDE_EFFECT_AUDIT_SOURCE_PLANES = [
 ];
 export const SIDE_EFFECT_AUDIT_AUTHENTICATION_KINDS = [
     "dashboard_auth",
-    "api_token",
+    "api_key",
     "runner_token",
     "system"
 ];
@@ -63,7 +63,7 @@ export const SIDE_EFFECT_AUDIT_TARGET_TYPES = [
     "cleanup",
     "deletion",
     "terminal_redrive",
-    "api_token"
+    "api_key"
 ];
 export const SIDE_EFFECT_AUDIT_OUTCOMES = [
     "accepted",

package/dist/_contracts/submission.d.ts

@@ -397,7 +397,7 @@ export interface RunMachine {
 /**
  * Wire shape posted by the SDK and CLI. `workspaceId` is **omitted by
  * design** — token-authenticated clients never name the workspace
- * because it is derived from their API token on the server. The BFF
+ * because it is derived from their API key on the server. The BFF
  * route resolves the workspace from the token and injects it before
  * calling the parser. The dashboard UI (Auth.js user principal,
  * multi-workspace) is the only caller that supplies `workspaceId`

package/dist/cli.mjs

@@ -1581,12 +1581,12 @@ var encoder2 = new TextEncoder();
 // ../contracts/dist/http.js
 var HttpClient = class {
   #baseUrl;
-  #apiToken;
+  #apiKey;
   #fetch;
   #debug;
   constructor(options) {
-    if (!options.apiToken) {
-      throw new Error("HttpClient: apiToken is required");
+    if (!options.apiKey) {
+      throw new Error("HttpClient: apiKey is required");
     }
     const raw = options.baseUrl ?? AEX_DEFAULT_BASE_URL;
     const normalized = raw.endsWith("/") ? raw : `${raw}/`;
@@ -1595,7 +1595,7 @@ var HttpClient = class {
     } catch (err2) {
       throw new Error(`HttpClient: invalid aex baseUrl ${JSON.stringify(redactUrl(raw))} \u2014 expected an absolute URL like "${AEX_DEFAULT_BASE_URL}"`, { cause: err2 });
     }
-    this.#apiToken = options.apiToken;
+    this.#apiKey = options.apiKey;
     this.#fetch = options.fetch ?? fetch;
     this.#debug = options.debug;
   }
@@ -1610,7 +1610,7 @@ var HttpClient = class {
     }
     const headers = {
       accept: "application/json",
-      authorization: `Bearer ${this.#apiToken}`,
+      authorization: `Bearer ${this.#apiKey}`,
       ...normalizeHeaders(init.headers)
     };
     if (init.body !== void 0 && init.body !== null && !headers["content-type"]) {
@@ -1639,7 +1639,7 @@ var HttpClient = class {
       url.searchParams.set(key, value);
     }
     const headers = {
-      authorization: `Bearer ${this.#apiToken}`,
+      authorization: `Bearer ${this.#apiKey}`,
       ...normalizeHeaders(init.headers)
     };
     const startedMs = Date.now();
@@ -3252,7 +3252,7 @@ function isSessionOk(status2) {
   return status2 === "idle" || status2 === "suspended" || status2 === "succeeded";
 }
 function extractCommonHostFlags(argv) {
-  let apiToken = null;
+  let apiKey = null;
   let aexUrl = null;
   let debug2 = false;
   const rest = [];
@@ -3262,11 +3262,11 @@ function extractCommonHostFlags(argv) {
       debug2 = true;
       continue;
     }
-    if (arg === "--api-token") {
+    if (arg === "--api-key") {
       const v = argv[++i2];
       if (v === void 0)
-        return { ok: false, reason: "--api-token requires a value" };
-      apiToken = v;
+        return { ok: false, reason: "--api-key requires a value" };
+      apiKey = v;
       continue;
     }
     if (arg === "--aex-url") {
@@ -3279,18 +3279,18 @@ function extractCommonHostFlags(argv) {
     if (arg === "--workspace" || arg === "--workspace-id") {
       return {
         ok: false,
-        reason: `unknown flag ${arg}: workspace is derived from --api-token on the server; drop this flag`
+        reason: `unknown flag ${arg}: workspace is derived from --api-key on the server; drop this flag`
       };
     }
     rest.push(arg);
   }
-  return { ok: true, flags: { apiToken, aexUrl, debug: debug2, rest } };
+  return { ok: true, flags: { apiKey, aexUrl, debug: debug2, rest } };
 }
 async function resolveCommonHostFlags(io2, argv) {
   const extracted = extractCommonHostFlags(argv);
   if (!extracted.ok)
     return extracted;
-  const { apiToken: flagToken, aexUrl: flagUrl, debug: debug2, rest } = extracted.flags;
+  const { apiKey: flagToken, aexUrl: flagUrl, debug: debug2, rest } = extracted.flags;
   let token = flagToken;
   let url = flagUrl;
   let source = flagToken ? "flag" : "none";
@@ -3298,8 +3298,8 @@ async function resolveCommonHostFlags(io2, argv) {
   if (!token && io2.configStore) {
     const stored = await io2.configStore.read();
     storedLocation = io2.configStore.location();
-    if (stored?.apiToken) {
-      token = stored.apiToken;
+    if (stored?.apiKey) {
+      token = stored.apiKey;
       source = "stored";
       if (!url && stored.aexUrl)
         url = stored.aexUrl;
@@ -3307,14 +3307,14 @@ async function resolveCommonHostFlags(io2, argv) {
   }
   const resolvedUrl = url ?? AEX_DEFAULT_BASE_URL;
   if (debug2) {
-    const where = source === "flag" ? "--api-token flag" : source === "stored" ? `stored token (${storedLocation})` : "none";
+    const where = source === "flag" ? "--api-key flag" : source === "stored" ? `stored token (${storedLocation})` : "none";
     io2.stderr(`[aex] auth: ${where}; aex-url=${resolvedUrl}
 `);
   }
   if (!token) {
-    return { ok: false, reason: "no API token \u2014 pass --api-token or run `aex login`" };
+    return { ok: false, reason: "no API key \u2014 pass --api-key or run `aex login`" };
   }
-  return { ok: true, flags: { apiToken: token, aexUrl: resolvedUrl, debug: debug2 }, rest };
+  return { ok: true, flags: { apiKey: token, aexUrl: resolvedUrl, debug: debug2 }, rest };
 }
 function describeApiError(err2) {
   if (err2 instanceof AexApiError) {
@@ -3354,9 +3354,9 @@ function describeErrorBody(body) {
 }
 function remedyForStatus(status2) {
   if (status2 === 400)
-    return "malformed request \u2014 if this is an auth failure, check --api-token or run `aex login`";
+    return "malformed request \u2014 if this is an auth failure, check --api-key or run `aex login`";
   if (status2 === 401)
-    return "check --api-token, or run `aex login`";
+    return "check --api-key, or run `aex login`";
   if (status2 === 403)
     return "token lacks permission for this workspace/action";
   if (status2 === 404)
@@ -3428,7 +3428,7 @@ function levenshtein(a, b) {
 function makeHttpClient(io2, flags) {
   return new HttpClient({
     baseUrl: flags.aexUrl,
-    apiToken: flags.apiToken,
+    apiKey: flags.apiKey,
     fetch: io2.fetchImpl,
     // `--debug`: route the transport's redacted per-request traces to stderr.
     ...flags.debug ? { debug: (line) => io2.stderr(`${line}
@@ -5335,7 +5335,7 @@ function makeAwsSources(region) {
     }
   };
 }
-var USAGE = "usage: aex debug <run-id> [--plane dev|prd] [--region eu-west-2] [--out dir] [--account <id>] [--cloudwatch] [--since <dur>] [--with-outputs]\n  operator command \u2014 uses the standard AWS SDK credential chain (env/profile), NOT --api-token\n";
+var USAGE = "usage: aex debug <run-id> [--plane dev|prd] [--region eu-west-2] [--out dir] [--account <id>] [--cloudwatch] [--since <dur>] [--with-outputs]\n  operator command \u2014 uses the standard AWS SDK credential chain (env/profile), NOT --api-key\n";
 async function runDebugCmd(io2, argv) {
   if (await refuseInsideManagedRun(io2, "debug"))
     return USAGE_ERR;
@@ -5437,19 +5437,19 @@ async function runLoginCmd(io2, argv) {
 `);
     return USAGE_ERR;
   }
-  const { apiToken, aexUrl, debug: debug2, rest } = extracted.flags;
+  const { apiKey, aexUrl, debug: debug2, rest } = extracted.flags;
   const positional = rest.filter((a) => !a.startsWith("--"));
   if (positional.length > 0) {
     io2.stderr(`unexpected arguments: ${positional.join(" ")}
 `);
     return USAGE_ERR;
   }
-  if (!apiToken) {
-    io2.stderr("usage: aex login --api-token <token> [--aex-url <url>]\n");
+  if (!apiKey) {
+    io2.stderr("usage: aex login --api-key <token> [--aex-url <url>]\n");
     return USAGE_ERR;
   }
   const resolvedUrl = aexUrl ?? AEX_DEFAULT_BASE_URL;
-  const http = makeHttpClient(io2, { apiToken, aexUrl: resolvedUrl, debug: debug2 });
+  const http = makeHttpClient(io2, { apiKey, aexUrl: resolvedUrl, debug: debug2 });
   let workspaceId;
   try {
     const me = await operations_exports.whoami(http);
@@ -5466,7 +5466,7 @@ async function runLoginCmd(io2, argv) {
       ...described.remedy ? { remedy: described.remedy } : {}
     });
   }
-  await io2.configStore.write({ schemaVersion: 1, apiToken, ...aexUrl ? { aexUrl: resolvedUrl } : {} });
+  await io2.configStore.write({ schemaVersion: 1, apiKey, ...aexUrl ? { aexUrl: resolvedUrl } : {} });
   if (debug2)
     io2.stderr(`[aex] login: persisted to ${io2.configStore.location()}
 `);
@@ -5507,8 +5507,8 @@ async function runAuthStatusCmd(io2, argv) {
     return USAGE_ERR;
   }
   const stored = await io2.configStore.read();
-  const hasToken = Boolean(stored?.apiToken);
-  const tokenSuffix = hasToken ? stored.apiToken.slice(-4) : void 0;
+  const hasToken = Boolean(stored?.apiKey);
+  const tokenSuffix = hasToken ? stored.apiKey.slice(-4) : void 0;
   io2.stdout(JSON.stringify({
     configPath: io2.configStore.location(),
     hasToken,
@@ -6103,28 +6103,28 @@ async function dispatch(io2, args) {
 async function printGlobalHelp(io2) {
   io2.stdout("aex \u2014 unified CLI for the aex platform (mirrors the SDK 1:1)\n\n");
   io2.stdout("Usage:\n");
-  io2.stdout("  aex run --config <run.json> --<provider>-api-key K --api-token T [flags]\n");
-  io2.stdout("  aex run --model M --prompt P [--system S] [--mcp name=url ...] --<provider>-api-key K --api-token T [flags]\n");
-  io2.stdout("  aex status <session-id> --api-token T\n");
-  io2.stdout("  aex deliveries <session-id> --api-token T\n");
-  io2.stdout("  aex wait <session-id> [--timeout 8m] [--interval 2s] --api-token T\n");
-  io2.stdout("  aex events <session-id> [--follow] [--timeout 8m] --api-token T\n");
-  io2.stdout("  aex tail <session-id> [--json] [--filter <type|source>] [--logs] [--settle] [--timeout 8m] --api-token T\n");
-  io2.stdout("  aex inspect <session-id> [--json] [--filter <type|source>] [--logs] [--timeout 8m] --api-token T\n");
-  io2.stdout("  aex outputs <session-id> --api-token T\n");
-  io2.stdout("  aex download <session-id> [--only outputs|events|metadata] [--out path] --api-token T\n");
-  io2.stdout("  aex cancel <session-id> --api-token T\n");
-  io2.stdout("  aex delete <session-id> --api-token T\n");
-  io2.stdout("  aex delete-asset <assetId|hash> --api-token T\n");
-  io2.stdout("  aex runs [--limit N] [--since ISO] --api-token T      List the workspace's runs (newest first, JSON)\n");
-  io2.stdout("  aex sessions [--limit N] --api-token T      List the workspace's sessions (newest first, JSON)\n");
-  io2.stdout("  aex whoami --api-token T\n");
-  io2.stdout("  aex billing [--json] --api-token T          Show prepaid balance, month spend, and spend cap\n");
-  io2.stdout("  aex billing ledger [--limit N] --api-token T   Recent credit-ledger entries (newest first, JSON)\n");
-  io2.stdout("  aex billing upgrade pro|team --api-token T   Create a hosted checkout session and print its URL\n");
-  io2.stdout("  aex billing portal --api-token T             Create a hosted billing portal session and print its URL\n");
-  io2.stdout("  aex webhooks secret --api-token T           Reveal (create on first use) the webhook signing secret\n");
-  io2.stdout("  aex login --api-token T [--aex-url U]      Persist token + url (then other verbs need no --api-token)\n");
+  io2.stdout("  aex run --config <run.json> --<provider>-api-key K --api-key T [flags]\n");
+  io2.stdout("  aex run --model M --prompt P [--system S] [--mcp name=url ...] --<provider>-api-key K --api-key T [flags]\n");
+  io2.stdout("  aex status <session-id> --api-key T\n");
+  io2.stdout("  aex deliveries <session-id> --api-key T\n");
+  io2.stdout("  aex wait <session-id> [--timeout 8m] [--interval 2s] --api-key T\n");
+  io2.stdout("  aex events <session-id> [--follow] [--timeout 8m] --api-key T\n");
+  io2.stdout("  aex tail <session-id> [--json] [--filter <type|source>] [--logs] [--settle] [--timeout 8m] --api-key T\n");
+  io2.stdout("  aex inspect <session-id> [--json] [--filter <type|source>] [--logs] [--timeout 8m] --api-key T\n");
+  io2.stdout("  aex outputs <session-id> --api-key T\n");
+  io2.stdout("  aex download <session-id> [--only outputs|events|metadata] [--out path] --api-key T\n");
+  io2.stdout("  aex cancel <session-id> --api-key T\n");
+  io2.stdout("  aex delete <session-id> --api-key T\n");
+  io2.stdout("  aex delete-asset <assetId|hash> --api-key T\n");
+  io2.stdout("  aex runs [--limit N] [--since ISO] --api-key T      List the workspace's runs (newest first, JSON)\n");
+  io2.stdout("  aex sessions [--limit N] --api-key T      List the workspace's sessions (newest first, JSON)\n");
+  io2.stdout("  aex whoami --api-key T\n");
+  io2.stdout("  aex billing [--json] --api-key T          Show prepaid balance, month spend, and spend cap\n");
+  io2.stdout("  aex billing ledger [--limit N] --api-key T   Recent credit-ledger entries (newest first, JSON)\n");
+  io2.stdout("  aex billing upgrade pro|team --api-key T   Create a hosted checkout session and print its URL\n");
+  io2.stdout("  aex billing portal --api-key T             Create a hosted billing portal session and print its URL\n");
+  io2.stdout("  aex webhooks secret --api-key T           Reveal (create on first use) the webhook signing secret\n");
+  io2.stdout("  aex login --api-key T [--aex-url U]      Persist token + url (then other verbs need no --api-key)\n");
   io2.stdout("  aex logout                                 Clear the stored token\n");
   io2.stdout("  aex auth status                            Show the resolved config (token never printed)\n");
   io2.stdout("  aex models list [--json]                   List models + default provider (no token needed)\n");
@@ -6134,7 +6134,7 @@ async function printGlobalHelp(io2) {
   io2.stdout("  aex debug <run-id> [--plane dev|prd] [--region eu-west-2] [--cloudwatch] [--with-outputs]   (operator; AWS creds)\n");
   io2.stdout("  aex --help\n\n");
   io2.stdout("Common flags on every host subcommand:\n");
-  io2.stdout("  --api-token <token>         REQUIRED \u2014 aex SDK API token (workspace is derived from it)\n");
+  io2.stdout("  --api-key <token>         REQUIRED \u2014 aex SDK API key (workspace is derived from it)\n");
   io2.stdout("  --aex-url <url>         Optional; defaults to https://api.aex.dev (local/staging/hosted plane)\n");
   io2.stdout("  --debug                     Optional; print a redacted per-request trace to stderr (uploads nothing)\n\n");
   io2.stdout("aex run flags:\n");

package/dist/cli.mjs.sha256

@@ -1 +1 @@
-c8d969d9ee5c6e6bb2e0a642ba8adce0aa235ef2bba96b99d8832ae1957ed2a3  cli.mjs
+5e34d5001f6ad9cd7e95730c6b14e0a5ebce55d732b19288a95f04df76fba078  cli.mjs

package/dist/client.d.ts

@@ -8,10 +8,8 @@ import { Secret } from "./secret.js";
 import { SkillTool } from "./skill-tool.js";
 import { Tool } from "./tool.js";
 export interface AexOptions {
-    /** Workspace-scoped SDK API token. */
+    /** Workspace-scoped SDK API key. */
     readonly apiKey?: string;
-    /** @deprecated Use `apiKey`; kept as a source-compatible alias during launch. */
-    readonly apiToken?: string;
     /**
      * API plane root, e.g. `https://aex.example.com`. Optional —
      * defaults to the canonical hosted URL (`https://api.aex.dev`).
@@ -498,7 +496,7 @@ export declare class SecretsClient {
  * the dashboard BFF and operate on durable run records.
  *
  * The SDK never asks the caller for a workspace id — workspace identity
- * is derived server-side from the API token on every request. Use
+ * is derived server-side from the API key on every request. Use
  * `client.whoami()` if you want to introspect which workspace the
  * token resolves to.
  */
@@ -508,7 +506,7 @@ export declare class Aex {
     readonly files: FilesClient;
     readonly secrets: SecretsClient;
     readonly sessions: SessionClient;
-    constructor(apiKey: string, options?: Omit<AexOptions, "apiKey" | "apiToken">);
+    constructor(apiKey: string, options?: Omit<AexOptions, "apiKey">);
     constructor(options: AexOptions);
     /**
      * Internal: satisfies the `SecretUploader` surface so a

package/dist/client.js

@@ -889,7 +889,7 @@ function unwrapSecretValue(value) {
  * the dashboard BFF and operate on durable run records.
  *
  * The SDK never asks the caller for a workspace id — workspace identity
- * is derived server-side from the API token on every request. Use
+ * is derived server-side from the API key on every request. Use
  * `client.whoami()` if you want to introspect which workspace the
  * token resolves to.
  */
@@ -903,7 +903,7 @@ export class Aex {
     sessions;
     constructor(options, overrides = {}) {
         const resolved = typeof options === "string" ? { ...overrides, apiKey: options } : options;
-        const apiKey = resolved.apiKey ?? resolved.apiToken;
+        const apiKey = resolved.apiKey;
         if (!apiKey) {
             // Typed so a caller catching AexError (the SDK's error base) catches a
             // missing credential too, instead of a bare Error slipping the taxonomy.
@@ -917,7 +917,7 @@ export class Aex {
         const retryingFetch = withRetry(baseFetch, resolved.retry);
         this.#http = new HttpClient({
             ...(resolved.baseUrl ? { baseUrl: resolved.baseUrl } : {}),
-            apiToken: apiKey,
+            apiKey,
             fetch: retryingFetch,
             // Opt-in local diagnostics: emit a redacted per-request trace to
             // stderr. Uploads nothing. A caller wanting a custom sink can pass