@aexhq/sdk 0.46.4-canary → 0.50.0

package/docs/public-surface.json

@@ -1,73 +0,0 @@
-{
-  "brand": "aex",
-  "productName": "Agent Executor",
-  "oneLine": "aex is an agent execution platform for launching autonomous agents from a simple TypeScript SDK and CLI.",
-  "description": "Open durable agent sessions, send turns, stream events, capture files, and compose agents with skills, files, MCP, secrets, networking controls, and subagents across the managed runtime.",
-  "alpha": {
-    "label": "Alpha testing",
-    "description": "Access is limited to invited testers while we harden the hosted runtime, dashboard, and SDK workflows."
-  },
-  "installCommand": "npm i @aexhq/sdk",
-  "examples": {
-    "typescriptLines": [
-      "import { Aex, Sizes } from \"@aexhq/sdk\";",
-      "",
-      "const aex = new Aex({ apiKey: process.env.AEX_API_KEY! });",
-      "",
-      "const session = await aex.sessions.create({",
-      "  model: \"anthropic/claude-haiku-4-5\",",
-      "  system: \"You are a concise engineering assistant.\",",
-      "  runtime: { size: Sizes.CPU_0_25_1GB },",
-      "  overrides: { idleTtl: \"3m\" }",
-      "});",
-      "",
-      "const result = await session.messages.send(\"Write a short report and save it as a file.\").finished();",
-      "console.log(result.status, result.text);"
-    ],
-    "cliLines": [
-      "aex start \\",
-      "  --api-key \"$AEX_API_KEY\" \\",
-      "  --model anthropic/claude-haiku-4-5 \\",
-      "  --prompt \"Write a short report and save it as a file.\" \\",
-      "  --follow"
-    ]
-  },
-  "featureAreas": [
-    {
-      "slug": "agent-runtime",
-      "href": "/docs/features/#agent-runtime",
-      "title": "Agent runtime",
-      "description": "Managed autonomous sessions with filesystem read/edit, grep/glob/head/tail, open web fetch/search, background commands, code execution, git, and subagents."
-    },
-    {
-      "slug": "durable-infrastructure",
-      "href": "/docs/features/#durable-infrastructure",
-      "title": "Durable infrastructure",
-      "description": "Resumable session lifecycle, explicit run outcomes, committed checkpoints, idempotency, typed events, file capture, downloads, timeouts, and runtime sizes."
-    },
-    {
-      "slug": "agent-composition",
-      "href": "/docs/features/#agent-composition",
-      "title": "Agent composition",
-      "description": "Version-pinned skills, files, custom tools, instructions, remote MCP servers, environment variables, secrets, and networking controls."
-    },
-    {
-      "slug": "subagents",
-      "href": "/docs/features/#subagents",
-      "title": "Subagents",
-      "description": "Typed parent/child lineage for async child sessions, file handoff, and bounded agent delegation."
-    },
-    {
-      "slug": "managed-model-access",
-      "href": "/docs/features/#managed-model-access",
-      "title": "Managed model access",
-      "description": "Name any model by its Vercel AI Gateway `creator/model` slug — the platform's managed key routes it. No provider selection, no provider API keys."
-    },
-    {
-      "slug": "typed-control-surface",
-      "href": "/docs/features/#typed-control-surface",
-      "title": "Typed control surface",
-      "description": "Strongly typed SDK inputs, CLI parity, workspace secrets, assistant text modes, and file capture policy."
-    }
-  ]
-}

package/docs/quickstart.md

@@ -1,135 +0,0 @@
----
-title: Quickstart
----
-
-# Quickstart
-
-## Install
-
-```bash
-npm i @aexhq/sdk
-```
-
-Set an aex workspace key. Model access needs no provider key — the managed
-gateway routes every model:
-
-```bash
-export AEX_API_KEY="<your-aex-api-key>"
-```
-
-The workspace key needs `sessions:read`, `sessions:write`, and `files:read` for
-this workflow. Add `billing:read` when the application also reads cost and
-billing-account resources.
-
-## Run a session
-
-```ts
-import { Aex, Sizes } from "@aexhq/sdk";
-
-const aex = new Aex(process.env.AEX_API_KEY!);
-const session = await aex.sessions.create({
-  model: "anthropic/claude-haiku-4-5",
-  system: "You are a concise engineering assistant.",
-  runtime: Sizes.CPU_0_25_1GB,
-});
-
-const run = session.messages.send("Write a short report and save it as a file.");
-for await (const event of run) {
-  console.log(event.type, event.runId);
-}
-
-const result = await run.finished();
-console.log(result.status, result.costUsd, result.text);
-```
-
-`finished()` resolves only after `RUN_FINISHED` or `RUN_ERROR`. A
-`RUN_FINISHED` result is checkpoint-consistent: its session record, cost,
-usage, messages, and files all reflect the same committed run. A `RUN_ERROR`
-that failed before a checkpoint has `files: []` and no `checkpoint`.
-
-Held outcomes remain explicit. `suspended` and `awaiting_approval` are not
-reported as successful runs, and `result.ok` is true only for `succeeded`.
-
-## Reopen and continue
-
-```ts
-const resumed = await aex.sessions.open(session.id);
-if (resumed.record.acceptsMessages) {
-  await resumed.messages.send("Validate the report and summarize the result.").finished();
-}
-```
-
-`record.currentRun` describes active work and `record.lastRun` describes the
-most recently completed or held run.
-
-## Publish reusable inputs
-
-Workspace resources are versioned and immutable when submitted. Publish local
-drafts first, then pass the returned pinned refs under `assets`:
-
-```ts
-import { File } from "@aexhq/sdk";
-
-const source = await aex.workspace.files.publish(
-  await File.fromPath("./input.csv", { mountPath: "/workspace/input" })
-);
-
-const withInput = await aex.sessions.create({
-  model: "anthropic/claude-haiku-4-5",
-  assets: { files: [source] },
-  builtinTools: "default",
-});
-```
-
-The same pattern applies to `aex.workspace.skills`, `.tools`, and
-`.instructions`. Raw uploaded bytes are assets; workspace resources add typed,
-versioned meaning to those bytes.
-
-## Read checkpointed files
-
-```ts
-const completed = await withInput.messages.send("Create output/report.md").finished();
-const snapshot = await withInput.files.list({
-  checkpointId: completed.checkpoint?.checkpointId
-});
-
-console.log(snapshot.revision, snapshot.files);
-const report = await withInput.files.findOne({ filename: "report.md" });
-if (report) {
-  console.log((await withInput.files.read(report)).text);
-}
-```
-
-Session file IDs are meaningful only with their checkpoint. File objects carry
-`checkpointId`, and ID selectors must include it.
-
-## One-shot convenience
-
-`aex.start()` is the one retained convenience for create, send, and finish:
-
-```ts
-const result = await aex.start({
-  model: "anthropic/claude-haiku-4-5",
-  message: "Summarize this repository.",
-});
-
-console.log(result.sessionId, result.status, result.text);
-```
-
-The bundled CLI provides the same one-shot workflow:
-
-```bash
-npx aex start \
-  --api-key "$AEX_API_KEY" \
-  --model anthropic/claude-haiku-4-5 \
-  --prompt "Write a short report and save it as a file." \
-  --follow
-```
-
-## Next
-
-- [Composition](concepts/composition.md)
-- [Events](events.md)
-- [Files](files.md)
-- [Webhooks](webhooks.md)
-- [Provider/runtime capabilities](provider-runtime-capabilities.md)

package/docs/release.md

@@ -1,44 +0,0 @@
----
-title: Release
----
-
-# Release
-
-The public release path is intentionally small:
-
-1. Local pre-push runs lint and type checks only.
-2. A push to `main` runs lint, type checks, and unit tests.
-3. After those checks pass, CI tags the tested source as
-   `canary/<version>-canary`, records the exact 40-character source SHA, and
-   publishes `@aexhq/sdk@<version>-canary` to npm's `canary` dist-tag.
-
-The workflow checks out and verifies `github.sha`, writes that SHA into the
-packed package's `aexRelease.sourceSha` metadata, and verifies the same value
-against npm after publication. The package version is the base SDK version with
-`-canary` appended, for example `0.45.0-canary`. A version is immutable: if it
-already exists, fix forward by bumping the base SDK version and pushing again.
-
-The private platform repository receives the canary version and source SHA as
-manual deploy inputs. It owns dev/prd deployment and runs the same SDK-as-a-real-
-user suite against both Lambda and container runtimes in each plane.
-
-## npm credentials
-
-The main-push publish job uses npm trusted-publisher OIDC in the `npm-release`
-GitHub Environment. It does not use a long-lived npm write token and never
-publishes directly to `latest`.
-
-## What ships in the tarball
-
-The SDK tarball is self-contained. It declares zero `@aexhq/*` runtime
-dependencies and is installable from a clean Bun project with no workspace
-access:
-
-- `@aexhq/contracts` is copied into the SDK distribution at build time.
-- `@aexhq/cli` is bundled into `dist/cli.mjs`, exposed through the `aex` bin.
-- The offline user-test package checks these invariants before publication.
-
-## Roll-forward
-
-Published versions are immutable. A bad canary is fixed by correcting the
-source, bumping the base version, and publishing a new canary.

package/docs/retries.md

@@ -1,108 +0,0 @@
----
-title: Retries and throttling
----
-
-# Retries and throttling
-
-The SDK retries transport failures only when repeating the HTTP request is
-provably safe:
-
-- Safe reads (`GET`, `HEAD`, and `OPTIONS`) may retry.
-- A mutation may retry only when it carries a stable `Idempotency-Key`.
-- A `POST`, `PATCH`, `PUT`, or `DELETE` without that key is attempted once.
-
-Eligible requests retry network failures and HTTP `429`, `500`, `502`, `503`,
-`504`, and `529` with bounded exponential backoff and jitter. `Retry-After` is
-honored. Validation, authentication, not-found, and conflict responses fail
-immediately.
-
-```ts
-const aex = new Aex({
-  apiKey: process.env.AEX_API_KEY!,
-  retry: {
-    maxAttempts: 4,
-    initialDelayMs: 500,
-    maxDelayMs: 20_000,
-    maxElapsedMs: 120_000
-  }
-});
-```
-
-Use `retry: false` or `{ maxAttempts: 1 }` for one general transport attempt.
-The client policy applies both to hosted API requests and to direct
-object-storage PUTs performed while publishing file, skill, tool, and
-instruction assets.
-
-`session.files.fetch()` is deliberately lower level: it returns the raw
-`Response` from a signed file URL and does not retry that transfer. The bounded
-`session.files.read()` and `session.files.download()` helpers may repeat a safe
-file GET once only when their per-attempt transfer timeout expires. None of
-these transfer policies repeat an agent run.
-
-## Application runs are not retried
-
-The SDK never reruns a whole user scenario after a terminal failure. A failed
-run is the product result a user would observe. Reliability belongs below that
-boundary, in idempotent transport, checkpointing, and the hosted runtime.
-
-When your application deliberately repeats a create or message mutation, reuse
-its idempotency key:
-
-```ts
-const result = await aex.start({
-  model,
-  message: "Write the report.",
-  idempotencyKey: "report-2026-07-10"
-});
-```
-
-`Aex.start` derives a stable message key from the create key, so repeating the
-same call cannot create a second billable run. A changed request under the same
-key fails with an idempotency conflict. Explicit keys may contain at most 255
-characters. For a create key short enough to append `:message`, the derived key
-is readable as `<createKey>:message`; longer valid keys use a deterministic
-SHA-256-derived message key that remains within the same limit.
-
-For an explicit user-driven retry on an existing session, call
-`session.messages.replayLast()` after applying your own policy. It reuses the
-last message key by default.
-
-## Throttling
-
-After eligible transport attempts are exhausted, the SDK throws
-`AexRateLimitError`. Use `isRateLimited(error)` and inspect `status`,
-`attempts`, `retryAfterMs`, `source`, and `providerFault`. Error bodies are
-scanned for secret shapes CLIENT-SIDE, inside your own process, before an
-`AexError` carries them (`redactSecrets`, exported from the SDK). Nothing is sent
-anywhere to do it, and it does not apply to your session's content — only to the
-error objects this SDK constructs.
-
-Provider failures are machine-readable on failed detail records as
-`session.providerFault` and on terminal events as
-`RUN_ERROR.data.providerFault`:
-
-```ts
-const fault = result.session.providerFault;
-if (fault?.kind === "rate_limit" || fault?.kind === "overloaded") {
-  // Apply an application-level replay policy if appropriate.
-}
-```
-
-The canonical object has exact fields `provider?`, `kind`, `status?`,
-`retryAfterMs?`, and `message?`. Known kinds are `rate_limit`, `overloaded`,
-`quota_exceeded`, `unavailable`, and `provider_error`. The SDK treats only the
-first four as throttle signals. A valid future kind is preserved but is not a
-throttle until a later SDK explicitly recognizes it; status codes and prose do
-not override the kind.
-
-For sessions created by older runtimes that do not have the field, the SDK has
-a temporary compatibility bridge for the exact historical
-`transient-provider` failure class and exact historical terminal templates.
-It does not scan arbitrary error prose. With `debug` enabled, each bridge use
-emits one local line with code `legacy_provider_fault_fallback`; the line
-contains only the mapped kind and `source=session` — nothing else is included, so
-there is nothing in it to mask.
-
-The bridge is eligible for removal only in a separate major release, after at
-least two minor releases and 90 days with zero observed fallback use. That
-earliest review is 2026-10-20; removal is not part of this contract change.

package/docs/secrets.md

@@ -1,141 +0,0 @@
----
-title: Secrets
----
-
-# Secrets
-
-aex supports per-session credentials and reusable workspace secrets for your own
-code and MCP servers. Model access needs no provider key — the managed gateway
-routes every model. Secret values are excluded from the idempotency fingerprint
-and do not belong in session config.
-
-Runnable examples need only `AEX_API_KEY` for aex.
-
-## Run A Model In One Session
-
-### TypeScript
-
-```ts
-import { Aex } from "@aexhq/sdk";
-
-const aex = new Aex({ apiKey: process.env.AEX_API_KEY! });
-
-await aex.start({
-  model: "anthropic/claude-haiku-4-5",
-  message: "Write a short report and save it as a file.",
-});
-```
-
-### CLI
-
-```bash
-aex start \
-  --api-key "$AEX_API_KEY" \
-  --model anthropic/claude-haiku-4-5 \
-  --prompt "Write a short report and save it as a file."
-```
-
-## Persist An Env Secret
-
-Create durable secrets through the workspace namespace, then reference the
-stored name in later sessions.
-
-```ts
-import { Aex, Secret } from "@aexhq/sdk";
-
-const aex = new Aex({ apiKey: process.env.AEX_API_KEY! });
-
-await aex.workspace.secrets.set({
-  name: "github-token",
-  value: process.env.GITHUB_TOKEN!
-});
-const githubToken = Secret.ref("github-token");
-
-await aex.start({
-  model: "anthropic/claude-haiku-4-5",
-  message: "Inspect the repository issues.",
-  environment: { secrets: { GITHUB_TOKEN: githubToken } },
-});
-```
-
-## Set Or Rotate A Workspace Secret
-
-Use `client.workspace.secrets.set(...)` to create a named secret directly. Use
-`client.workspace.secrets.rotate(...)` to replace its value while keeping the same name.
-
-```ts
-await aex.workspace.secrets.set({
-  name: "serper-api-key",
-  value: process.env.SERPER_API_KEY!
-});
-
-await aex.workspace.secrets.rotate({
-  name: "serper-api-key",
-  value: process.env.SERPER_API_KEY_NEXT!
-});
-```
-
-## Retrieve Secret Metadata
-
-`list` and `get` return metadata only. They never return the secret value.
-
-```ts
-const secrets = await aex.workspace.secrets.list();
-const metadata = await aex.workspace.secrets.get("serper-api-key");
-```
-
-## Inject A Workspace Secret Into A Session
-
-Reference workspace secrets with `Secret.ref(name)`. The value resolves
-server-side and is injected as the named environment variable.
-
-```ts
-import { Secret } from "@aexhq/sdk";
-
-await aex.start({
-  model: "anthropic/claude-haiku-4-5",
-  message: "Use SERPER_API_KEY for web search.",
-  environment: {
-    secrets: { SERPER_API_KEY: Secret.ref("serper-api-key") }
-  },
-});
-```
-
-## Delete A Workspace Secret
-
-```ts
-await aex.workspace.secrets.delete("serper-api-key");
-```
-
-The CLI supports per-session runtime and MCP credentials. Workspace secret
-administration is exposed through the SDK.
-
-## What Happens To A Secret Value In Your Session
-
-aex does **not** scan, mask, or drop your session's content. A registered secret value
-that the agent prints, writes, or echoes appears **verbatim** in every surface you can
-read:
-
-- the **event stream** (tool output and model-authored text),
-- the **session journal** and `session.events` / the event archive,
-- **captured session files** (`session.files.download()` / `.read()` / the `aex download`
-  zip),
-- the container's own stdout/stderr archive.
-
-All four are byte-identical, so nothing you read is a rewritten version of something
-else. That is deliberate: your session's data is yours, and a platform that silently
-rewrote your bytes would give you an artifact you cannot trust and a value we might have
-corrupted (a "secret-shaped" build hash or file path is indistinguishable from a
-credential to any scanner).
-
-What registering a secret via `environment.secrets` **does** give you:
-
-- the value is stored encrypted and injected into the session env at run time — it is
-  never part of your submitted request body, and it is not written to your session
-  config;
-- it is scoped to the session, and only the session's own process can fetch it;
-- it never reaches a customer-controlled subprocess it was not declared for.
-
-If a value must not appear in a transcript you keep or share, do not let the agent print
-it: prefer a tool that consumes the credential internally over one that echoes it, and
-review a session's output before forwarding it.

package/docs/session-config.md

@@ -1,51 +0,0 @@
----
-title: Session configuration
----
-
-# Session configuration
-
-`aex.sessions.create(...)` accepts the durable session configuration. The
-one-shot `aex.start(...)` accepts the same fields plus `message`,
-`messageIdempotencyKey`, `deleteAfter`, and stream options.
-
-Core fields include:
-
-- `model` — a Vercel AI Gateway `creator/model` slug (no `provider` field)
-- `system`
-- immutable workspace refs grouped under `assets`
-- `builtinTools`
-- `mcpServers`
-- `environment`
-- `fileCapture`
-- `runtime`, `metadata`, and `overrides`
-- `outputMode`, `responseFormat`, `approvalGate`, and `webhook`
-- `idempotencyKey`
-
-Secrets are never part of a reusable JSON config. Model access needs no provider
-key; supply runtime secrets through `environment.secrets` at the call site.
-
-```ts
-const base = {
-  model: "anthropic/claude-haiku-4-5",
-  system: "You are a concise automation agent.",
-  builtinTools: "default" as const,
-  overrides: { idleTtl: "3m", timeout: "30m", maxTurns: 20 }
-};
-
-const session = await aex.sessions.create({
-  ...base,
-  assets: { files: [input], instructions: [rules] },
-});
-```
-
-`assets` accepts only refs returned by `aex.workspace.files`, `skills`, `tools`,
-and `instructions`. Publish local drafts before create; there is no implicit
-upload or compatibility field.
-
-## CLI
-
-`aex start` accepts a credential-free JSON config through `--config`, or
-explicit flags such as `--model`, `--system`, `--prompt`, `--mcp`,
-`--runtime-size`, and `--session-timeout`. Reusable resources are published and
-attached with repeatable `--skill`, `--tool`, `--instructions`, and `--file`
-flags. The legacy instruction flag is not accepted.

package/docs/session-record.md

@@ -1,58 +0,0 @@
----
-title: Session archives
----
-
-# Session archives
-
-`Session` is the one live state model returned by `aex.sessions.get(...)`,
-`session.refresh()`, and finished run results. A session archive is the
-public-safe downloadable bundle of that state, typed events, captured files,
-and versioned manifest metadata.
-
-## Listing sessions
-
-`aex.sessions.list(query?)` enumerates the sessions in this workspace, most-recent first, one page at a time. The workspace is derived server-side from the API key, so this only ever returns your own sessions. It is the workspace-wide discovery entry point: open a row with `aex.sessions.open(id)`, then use `session.files.list()` / `.read(...)` (see [Files](files.md)) to reach that session's deliverables.
-
-```ts
-let cursor: string | undefined;
-do {
-  const page = await aex.sessions.list({ status: "idle", limit: 25, cursor });
-  for (const session of page.sessions) {
-    console.log(session.id, session.status, session.createdAt, session.costUsd);
-  }
-  cursor = page.nextCursor;
-} while (cursor);
-```
-
-`query` fields are all optional: `status` (single session lifecycle status, e.g. `"idle"`), `since` (ISO-8601 lower bound on `createdAt`), `limit` (an integer from 1 through 100; default 25), and `cursor` (the opaque keyset cursor from a prior page's `nextCursor`, absent on the last page). Invalid values fail before the request. Each page row is a public-safe `SessionSummary` (`id`, `status`, `runtime`, `acceptsMessages`, `createdAt`, `updatedAt`, and `costUsd` once a RUN terminal is committed); it deliberately omits the submission snapshot (model / system / env). Use `aex.sessions.get(id)` or `session.record` for the canonical session read, and the `messages`, `events`, and `files` namespaces for authoritative run data.
-
-## Downloading a session archive
-
-`session.download()` and `aex download <session-id>` return a zip with this layout:
-
-```text
-manifest.json
-metadata/session.json
-metadata/submission.json      # when a public-safe submission snapshot is returned by the read API
-metadata/cost.json            # when public cost telemetry is returned by the read API
-events/events.jsonl
-files/<captured deliverable files>
-```
-
-`manifest.json` is versioned as `SessionRecordManifestV1`:
-
-| Field | Meaning |
-| --- | --- |
-| `schemaVersion` | `aex.session-record.manifest.v1`. |
-| `sessionRecordSchemaVersion` | `aex.session-record.v1`. |
-| `sessionId` | The session the archive was assembled for. |
-| `namespaces[]` | The documented top-level namespaces: `metadata`, `events`, `files`. |
-| `files[]` | Inventory of expected and present files with `namespace`, `path`, `role`, and `status`. |
-| `sessionFiles[]` | Session file metadata for entries present under the `files/` namespace. |
-| `errors[]` | Per-artifact byte fetch failures during archive assembly. |
-
-Current v1 downloads always include `metadata/session.json` and `events/events.jsonl`. `events/events.jsonl` contains typed event-channel records only; internal diagnostics and full internal streams are not mixed into that file.
-
-`metadata/submission.json` is present only when the session read shape includes a public-safe submission snapshot. `metadata/cost.json` is present only when the session read shape includes public `costTelemetry`; otherwise cost stays `pending`. `metadata/custody.json` remains `pending` until the custody manifest writer and public read surface land. `events/manifest.json` remains `unavailable` in this client-side slice because there is no public coordinator-manifest download route.
-
-The record boundary is public-safe. It must not contain credentials, runner bearers, workspace tokens, signed URLs, raw provider response bodies, object-store keys, Vault ids, raw query strings, secret-shaped values, or internal diagnostic files. Session environment and MCP secrets are vaulted separately for the session lifetime.

package/docs/skills.md

@@ -1,65 +0,0 @@
----
-title: Skills
----
-
-# Skills
-
-A skill is a `SKILL.md` bundle plus optional supporting files. Build a local
-draft with a `Skill.from*` factory, publish it to the workspace, and attach the
-returned immutable ref under `assets.skills`.
-
-```ts
-import { Skill } from "@aexhq/sdk";
-
-const draft = await Skill.fromDir("./skills/report-writer", {
-  name: "report-writer"
-});
-const reportWriter = await aex.workspace.skills.publish(draft);
-
-const result = await aex.start({
-  model,
-  message: "Write the report.",
-  assets: { skills: [reportWriter] }
-});
-```
-
-Available draft factories:
-
-- `Skill.fromDir(path, { name? })`
-- `Skill.fromUrl(url, { name?, sha256?, timeoutMs?, fetch? })`
-- `Skill.fromFiles({ name?, files, meta? })`
-- `Skill.fromContent(skillMd, { name? })`
-- `Skill.fromBytes({ name?, zip })`
-
-Every bundle needs a root `SKILL.md` with a non-empty `description` in YAML
-frontmatter. Names are validated locally, and archives are canonicalized and
-content-hashed before publication.
-
-## Immutable versions
-
-Publication returns a `WorkspaceSkillRecord` containing a stable `resourceId`,
-an immutable `version`, and the exact `assetId`/`contentHash`. Publishing new
-bytes creates another version. Existing session submissions remain pinned to
-their recorded version; they cannot silently observe later edits.
-
-Drafts cannot be submitted or serialized directly. This keeps the only
-promotion path visible and auditable:
-
-```ts
-const published = await aex.workspace.skills.publish(draft);
-```
-
-## Workspace administration
-
-```ts
-const page = await aex.workspace.skills.list({ limit: 100 });
-const exact = await aex.workspace.skills.get(published.resourceId, published.version);
-await aex.workspace.skills.delete(published.resourceId);
-```
-
-List calls return `{ resources, nextCursor? }`. `limit` defaults to 100 and
-must be an integer from 1 through 100.
-
-Skills are distinct from custom tools. The runtime exposes skills through its
-skill-loading capability; executable custom functions belong in
-`assets.tools`.