@agent-native/core 0.122.4 → 0.123.0

package/dist/server/credential-provider.d.ts

@@ -41,6 +41,25 @@ export declare class FeatureNotConfiguredError extends Error {
         byokDocsUrl?: string;
     });
 }
+/**
+ * The credential store could not be read — which is NOT the same as the
+ * credential being absent. Never render this as "not configured": the user has
+ * nothing to configure, they have something to retry.
+ */
+export declare class CredentialStoreUnavailableError extends Error {
+    readonly errorCode = "credential_store_unavailable";
+    readonly retryable = true;
+    constructor(cause?: unknown);
+}
+/**
+ * The one place that decides when an unanswered credential lookup becomes a
+ * user-visible retryable error. A store that is not configured at all is a real
+ * "no credential"; a store that timed out or dropped the connection is not.
+ */
+export declare function assertCredentialStoreReadable(result: {
+    lookupFailed: boolean;
+    cause?: unknown;
+}): void;
 /**
  * Deployment-level credential fallback for single-tenant/local operation.
  * Multi-tenant call sites must gate this explicitly before calling.
@@ -122,6 +141,8 @@ export interface BuilderCredentialsDetailed {
      * Callers must report this as retryable rather than "not configured".
      */
     lookupFailed: boolean;
+    /** The failure, when there was one, so callers can classify it. */
+    cause?: unknown;
 }
 /**
  * Resolve the Builder assistant credential bundle from one complete scope,
@@ -273,10 +294,22 @@ export declare function deleteBuilderCredentials(email: string, options?: {
 }>;
 /**
  * Resolve a request-scoped secret. Reads from `app_secrets` first (current
- * user override, active org, then workspace row); falls back to `process.env`
- * only when the deploy fallback policy allows it.
+ * user override, active org, workspace row for that org, then the solo
+ * workspace row); falls back to `process.env` only when the deploy fallback
+ * policy allows it.
  */
 export declare function resolveSecret(key: string): Promise<string | null>;
+/**
+ * `resolveSecret` without the throw: reports whether the miss is definitive
+ * (`lookupFailed: false` — no such row anywhere the caller can reach) or just
+ * unknown (`lookupFailed: true` — the store or the org membership behind it
+ * could not be read).
+ */
+export declare function resolveSecretDetailed(key: string): Promise<{
+    value: string | null;
+    lookupFailed: boolean;
+    cause?: unknown;
+}>;
 /**
  * True when a Builder private key is configured at the deployment level.
  *

package/dist/server/credential-provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"credential-provider.d.ts","sourceRoot":"","sources":["../../src/server/credential-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAOH;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC9B;IAAE,KAAK,EAAE,MAAM,GAAG,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAK5C;AAED,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAE9B,YAAY,IAAI,EAAE;QAChB,kBAAkB,EAAE,MAAM,CAAC;QAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,EASA;CACF;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEvE;AAwBD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iCAAiC,IAAI,OAAO,CAG3D;AAED,wBAAgB,wCAAwC,CACtD,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAOT;AA2GD,KAAK,uBAAuB,GAAG,MAAM,GAAG,KAAK,GAAG,WAAW,GAAG,KAAK,CAAC;AA0BpE,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAE7E;AAuQD;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAC5C,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAKxB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,OAAO,CAE7C;AAED;;;GAGG;AACH,wBAAsB,wBAAwB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAEvE;AAED;;;GAGG;AACH,wBAAsB,wBAAwB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAGvE;AAED;;;GAGG;AACH,wBAAsB,2BAA2B,IAAI,OAAO,CAAC,OAAO,CAAC,CAEpE;AAED;;;GAGG;AACH,wBAAsB,mCAAmC,IAAI,OAAO,CAAC,OAAO,CAAC,CAG5E;AAED;;;;GAIG;AACH,wBAAsB,8BAA8B,IAAI,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAG9F;AAED,MAAM,WAAW,0BAA0B;IACzC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,YAAY,EAAE,OAAO,GAAG,IAAI,CAAC;IAC7B,aAAa,EAAE,OAAO,GAAG,IAAI,CAAC;IAC9B,sDAAsD;IACtD,MAAM,EAAE,uBAAuB,GAAG,IAAI,CAAC;IACvC;;;OAGG;IACH,YAAY,EAAE,OAAO,CAAC;CACvB;AAED;;;;;;;;GAQG;AACH,wBAAsB,iCAAiC,IAAI,OAAO,CAAC,0BAA0B,CAAC,CAiF7F;AAED;;;;GAIG;AACH,wBAAsB,yBAAyB,IAAI,OAAO,CAAC;IACzD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,YAAY,EAAE,OAAO,GAAG,IAAI,CAAC;IAC7B,aAAa,EAAE,OAAO,GAAG,IAAI,CAAC;CAC/B,CAAC,CAyBD;AAGD;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,QAAiB,CAAC;AAE1D,MAAM,WAAW,4BAA4B;IAC3C,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,wBAAgB,4BAA4B,CAC1C,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,EAC1B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GACxB,MAAM,GAAG,IAAI,CAQf;AAMD,wBAAsB,+BAA+B,CACnD,KAAK,GAAE;IACL,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB,GACL,OAAO,CAAC,4BAA4B,GAAG,IAAI,CAAC,CAkC9C;AAED,wBAAsB,kCAAkC,CAAC,OAAO,CAAC,EAAE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBhB;AAED,wBAAsB,iCAAiC,CAAC,KAAK,EAAE;IAC7D,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B,GAAG,OAAO,CAAC,IAAI,CAAC,CAYhB;AAGD,4FAA4F;AAC5F,eAAO,MAAM,4BAA4B,QAAiB,CAAC;AAE3D,MAAM,WAAW,6BAA6B;IAC5C,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,wBAAgB,6BAA6B,CAC3C,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,EACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GACpB,MAAM,GAAG,IAAI,CAUf;AAMD,wBAAsB,gCAAgC,CAAC,IAAI,EAAE;IAC3D,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,GAAG,OAAO,CAAC,6BAA6B,GAAG,IAAI,CAAC,CAqChD;AAED,wBAAsB,mCAAmC,CAAC,IAAI,EAAE;IAC9D,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoBhB;AAED,wBAAsB,kCAAkC,CAAC,IAAI,EAAE;IAC7D,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,GAAG,OAAO,CAAC,IAAI,CAAC,CAShB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,MAAM,EACb,KAAK,EAAE;IACL,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,YAAY,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IAC9B,aAAa,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;CAChC,EACD,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GACxD,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,GAAG,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CA+FrD;AAED;;;;;;;;;GASG;AACH,wBAAsB,wBAAwB,CAC5C,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GACxD,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,GAAG,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAiBrD;AAcD;;;;GAIG;AACH,wBAAsB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAyGvE;AAOD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,IAAI,OAAO,CAE9C;AAED,yEAAyE;AACzE,wBAAgB,qBAAqB,IAAI,MAAM,CAO9C;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,IAAI,MAAM,CAKjD;AAED;;;GAGG;AACH,wBAAgB,gCAAgC,IAAI,MAAM,CAKzD;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,IAAI,MAAM,CAKnD;AAED,uEAAuE;AACvE,wBAAgB,oBAAoB,IAAI,MAAM,GAAG,IAAI,CAGpD"}
+{"version":3,"file":"credential-provider.d.ts","sourceRoot":"","sources":["../../src/server/credential-provider.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAQH;;;;;;;;GAQG;AACH,wBAAgB,2BAA2B,CACzC,KAAK,EAAE,MAAM,EACb,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,EAChC,IAAI,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAC9B;IAAE,KAAK,EAAE,MAAM,GAAG,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAK5C;AAED,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,QAAQ,CAAC,kBAAkB,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,iBAAiB,CAAC,EAAE,MAAM,CAAC;IACpC,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAE9B,YAAY,IAAI,EAAE;QAChB,kBAAkB,EAAE,MAAM,CAAC;QAC3B,OAAO,CAAC,EAAE,MAAM,CAAC;QACjB,iBAAiB,CAAC,EAAE,MAAM,CAAC;QAC3B,WAAW,CAAC,EAAE,MAAM,CAAC;KACtB,EASA;CACF;AAED;;;;GAIG;AACH,qBAAa,+BAAgC,SAAQ,KAAK;IACxD,QAAQ,CAAC,SAAS,kCAA2C;IAC7D,QAAQ,CAAC,SAAS,QAAQ;IAE1B,YAAY,KAAK,CAAC,EAAE,OAAO,EAM1B;CACF;AAED;;;;GAIG;AACH,wBAAgB,6BAA6B,CAAC,MAAM,EAAE;IACpD,YAAY,EAAE,OAAO,CAAC;IACtB,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,GAAG,IAAI,CAIP;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAEvE;AAwBD;;;;;;;;;;;;;;;GAeG;AACH,wBAAgB,iCAAiC,IAAI,OAAO,CAG3D;AAED,wBAAgB,wCAAwC,CACtD,GAAG,CAAC,EAAE,MAAM,GACX,OAAO,CAOT;AA2GD,KAAK,uBAAuB,GAAG,MAAM,GAAG,KAAK,GAAG,WAAW,GAAG,KAAK,CAAC;AA0BpE,wBAAgB,mBAAmB,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,GAAG,OAAO,CAE7E;AAoUD;;;;;GAKG;AACH,wBAAsB,wBAAwB,CAC5C,GAAG,EAAE,MAAM,GACV,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAWxB;AAED;;;GAGG;AACH,wBAAgB,mBAAmB,IAAI,OAAO,CAE7C;AAED;;;GAGG;AACH,wBAAsB,wBAAwB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAEvE;AAED;;;GAGG;AACH,wBAAsB,wBAAwB,IAAI,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAGvE;AAED;;;GAGG;AACH,wBAAsB,2BAA2B,IAAI,OAAO,CAAC,OAAO,CAAC,CAEpE;AAED;;;GAGG;AACH,wBAAsB,mCAAmC,IAAI,OAAO,CAAC,OAAO,CAAC,CAG5E;AAED;;;;GAIG;AACH,wBAAsB,8BAA8B,IAAI,OAAO,CAAC,uBAAuB,GAAG,IAAI,CAAC,CAG9F;AAED,MAAM,WAAW,0BAA0B;IACzC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,YAAY,EAAE,OAAO,GAAG,IAAI,CAAC;IAC7B,aAAa,EAAE,OAAO,GAAG,IAAI,CAAC;IAC9B,sDAAsD;IACtD,MAAM,EAAE,uBAAuB,GAAG,IAAI,CAAC;IACvC;;;OAGG;IACH,YAAY,EAAE,OAAO,CAAC;IACtB,mEAAmE;IACnE,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB;AAED;;;;;;;;GAQG;AACH,wBAAsB,iCAAiC,IAAI,OAAO,CAAC,0BAA0B,CAAC,CAqF7F;AAED;;;;GAIG;AACH,wBAAsB,yBAAyB,IAAI,OAAO,CAAC;IACzD,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,YAAY,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,YAAY,EAAE,OAAO,GAAG,IAAI,CAAC;IAC7B,aAAa,EAAE,OAAO,GAAG,IAAI,CAAC;CAC/B,CAAC,CAyBD;AAGD;;;;;GAKG;AACH,eAAO,MAAM,2BAA2B,QAAiB,CAAC;AAE1D,MAAM,WAAW,4BAA4B;IAC3C,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,wBAAgB,4BAA4B,CAC1C,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,EAC1B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,GACxB,MAAM,GAAG,IAAI,CAQf;AAMD,wBAAsB,+BAA+B,CACnD,KAAK,GAAE;IACL,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACtB,GACL,OAAO,CAAC,4BAA4B,GAAG,IAAI,CAAC,CAkC9C;AAED,wBAAsB,kCAAkC,CAAC,OAAO,CAAC,EAAE;IACjE,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG,OAAO,CAAC,IAAI,CAAC,CAuBhB;AAED,wBAAsB,iCAAiC,CAAC,KAAK,EAAE;IAC7D,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC3B,GAAG,OAAO,CAAC,IAAI,CAAC,CAYhB;AAGD,4FAA4F;AAC5F,eAAO,MAAM,4BAA4B,QAAiB,CAAC;AAE3D,MAAM,WAAW,6BAA6B;IAC5C,WAAW,EAAE,MAAM,CAAC;IACpB,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,EAAE,EAAE,MAAM,CAAC;IACX,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB;AAED,wBAAgB,6BAA6B,CAC3C,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,EACnB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GACpB,MAAM,GAAG,IAAI,CAUf;AAMD,wBAAsB,gCAAgC,CAAC,IAAI,EAAE;IAC3D,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,GAAG,OAAO,CAAC,6BAA6B,GAAG,IAAI,CAAC,CAqChD;AAED,wBAAsB,mCAAmC,CAAC,IAAI,EAAE;IAC9D,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,GAAG,OAAO,CAAC,IAAI,CAAC,CAoBhB;AAED,wBAAsB,kCAAkC,CAAC,IAAI,EAAE;IAC7D,GAAG,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,GAAG,OAAO,CAAC,IAAI,CAAC,CAShB;AAED;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,MAAM,EACb,KAAK,EAAE;IACL,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACxB,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,YAAY,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;IAC9B,aAAa,CAAC,EAAE,OAAO,GAAG,IAAI,CAAC;CAChC,EACD,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GACxD,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,GAAG,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CA+FrD;AAED;;;;;;;;;GASG;AACH,wBAAsB,wBAAwB,CAC5C,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE;IAAE,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GACxD,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,GAAG,KAAK,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC,CAiBrD;AAcD;;;;;GAKG;AACH,wBAAsB,aAAa,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAOvE;AAED;;;;;GAKG;AACH,wBAAsB,qBAAqB,CACzC,GAAG,EAAE,MAAM,GACV,OAAO,CAAC;IAAE,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,YAAY,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,CAqI3E;AAOD;;;;;;GAMG;AACH,wBAAgB,oBAAoB,IAAI,OAAO,CAE9C;AAED,yEAAyE;AACzE,wBAAgB,qBAAqB,IAAI,MAAM,CAO9C;AAED;;;;GAIG;AACH,wBAAgB,wBAAwB,IAAI,MAAM,CAKjD;AAED;;;GAGG;AACH,wBAAgB,gCAAgC,IAAI,MAAM,CAKzD;AAED;;;GAGG;AACH,wBAAgB,0BAA0B,IAAI,MAAM,CAKnD;AAED,uEAAuE;AACvE,wBAAgB,oBAAoB,IAAI,MAAM,GAAG,IAAI,CAGpD"}

package/dist/server/credential-provider.js

@@ -18,7 +18,8 @@
  * (e.g. additional Builder-hosted services) without rewrites.
  */
 import { createHash } from "node:crypto";
-import { isLocalDatabase } from "../db/client.js";
+import { CREDENTIAL_STORE_UNAVAILABLE_ERROR_CODE } from "../agent/engine/credential-errors.js";
+import { isLocalDatabase, isTransientDatabaseError } from "../db/client.js";
 import { getRequestUserEmail, getRequestOrgId } from "./request-context.js";
 /**
  * Decide which `app_secrets` scope a Builder/credential write should use.
@@ -48,6 +49,29 @@ export class FeatureNotConfiguredError extends Error {
         this.byokDocsUrl = opts.byokDocsUrl;
     }
 }
+/**
+ * The credential store could not be read — which is NOT the same as the
+ * credential being absent. Never render this as "not configured": the user has
+ * nothing to configure, they have something to retry.
+ */
+export class CredentialStoreUnavailableError extends Error {
+    errorCode = CREDENTIAL_STORE_UNAVAILABLE_ERROR_CODE;
+    retryable = true;
+    constructor(cause) {
+        super("Could not read your saved connections — the app database did not answer. This is temporary; try again in a moment.", { cause });
+        this.name = "CredentialStoreUnavailableError";
+    }
+}
+/**
+ * The one place that decides when an unanswered credential lookup becomes a
+ * user-visible retryable error. A store that is not configured at all is a real
+ * "no credential"; a store that timed out or dropped the connection is not.
+ */
+export function assertCredentialStoreReadable(result) {
+    if (result.lookupFailed && isTransientDatabaseError(result.cause)) {
+        throw new CredentialStoreUnavailableError(result.cause);
+    }
+}
 /**
  * Deployment-level credential fallback for single-tenant/local operation.
  * Multi-tenant call sites must gate this explicitly before calling.
@@ -221,20 +245,28 @@ async function readBuilderCredentialScope(readAppSecrets, scope, scopeId) {
 async function resolveOrgIdForRequestEmail(email) {
     try {
         const { resolveOrgIdForEmail } = await import("../org/context.js");
-        return await resolveOrgIdForEmail(email);
+        return { orgId: await resolveOrgIdForEmail(email) };
     }
-    catch {
-        return null;
+    catch (err) {
+        // Could not read org membership, so org- and workspace-scoped rows were
+        // never searched. Report the failure instead of the empty answer.
+        return { orgId: null, cause: err };
     }
 }
+const NOT_FOUND = {
+    value: null,
+    source: null,
+    lookupFailed: false,
+};
 async function resolveScopedBuilderCredential(key) {
     const email = getRequestUserEmail();
     if (!email)
-        return null;
+        return NOT_FOUND;
     // Trace only when explicitly requested. These diagnostics are useful for
     // support, but they include account identifiers and run on hot paths.
     const traceLookup = shouldTraceCredentialResolve();
     let scopeAttempted = "user";
+    let orgLookupCause;
     try {
         const { readAppSecret } = await import("../secrets/storage.js");
         // 1. Per-user override: a user can paste their own key in settings to
@@ -248,14 +280,16 @@ async function resolveScopedBuilderCredential(key) {
             if (traceLookup) {
                 console.log(`[builder-credential] key=${key} email=${email} scope=user hit=true`);
             }
-            return { value: userSecret.value, source: "user" };
+            return { value: userSecret.value, source: "user", lookupFailed: false };
         }
         let orgId = getRequestOrgId();
         let orgSource = orgId
             ? "request"
             : "none";
         if (!orgId) {
-            orgId = await resolveOrgIdForRequestEmail(email);
+            const resolved = await resolveOrgIdForRequestEmail(email);
+            orgLookupCause = resolved.cause;
+            orgId = resolved.orgId;
             if (orgId)
                 orgSource = "email-fallback";
         }
@@ -275,7 +309,7 @@ async function resolveScopedBuilderCredential(key) {
                 if (traceLookup) {
                     console.log(`[builder-credential] key=${key} email=${email} orgId=${orgId} orgSource=${orgSource} scope=org hit=true`);
                 }
-                return { value: orgSecret.value, source: "org" };
+                return { value: orgSecret.value, source: "org", lookupFailed: false };
             }
             // Older setup flows wrote shared credentials at workspace scope.
             // Keep reading those rows so status UIs and runtime resolution agree
@@ -290,12 +324,27 @@ async function resolveScopedBuilderCredential(key) {
                 if (traceLookup) {
                     console.log(`[builder-credential] key=${key} email=${email} orgId=${orgId} orgSource=${orgSource} scope=workspace hit=true`);
                 }
-                return { value: workspaceSecret.value, source: "workspace" };
+                return {
+                    value: workspaceSecret.value,
+                    source: "workspace",
+                    lookupFailed: false,
+                };
             }
             if (traceLookup) {
                 console.log(`[builder-credential] key=${key} email=${email} orgId=${orgId} orgSource=${orgSource} miss tried=user,org,workspace`);
             }
         }
+        // Membership lookup failure means the org scopes were never searched.
+        // Do not let a pre-org solo row silently impersonate the current org while
+        // the membership read is retryable.
+        if (orgLookupCause !== undefined) {
+            return {
+                value: null,
+                source: null,
+                lookupFailed: true,
+                cause: orgLookupCause,
+            };
+        }
         // 3. Solo-workspace fallback: always checked, even when an org id was
         //    found above. Older no-org connect flows wrote here, so a credential
         //    written before the user joined/created an org must not become
@@ -310,7 +359,11 @@ async function resolveScopedBuilderCredential(key) {
             if (traceLookup) {
                 console.log(`[builder-credential] key=${key} email=${email} orgId=${orgId ?? "(none)"} orgSource=${orgSource} scope=workspace-solo hit=true`);
             }
-            return { value: soloWorkspaceSecret.value, source: "workspace" };
+            return {
+                value: soloWorkspaceSecret.value,
+                source: "workspace",
+                lookupFailed: false,
+            };
         }
         if (traceLookup) {
             console.log(`[builder-credential] key=${key} email=${email} orgId=${orgId ?? "(none)"} orgSource=${orgSource} miss tried=${orgId ? "user,org,workspace,workspace-solo" : "user,workspace-solo"}`);
@@ -320,9 +373,14 @@ async function resolveScopedBuilderCredential(key) {
         if (traceLookup) {
             console.log(`[builder-credential] key=${key} email=${email} scope=${scopeAttempted} error=${err?.message ?? err}`);
         }
-        // Secrets table not ready — treat as missing.
+        return { value: null, source: null, lookupFailed: true, cause: err };
     }
-    return null;
+    return {
+        value: null,
+        source: null,
+        lookupFailed: orgLookupCause !== undefined,
+        cause: orgLookupCause,
+    };
 }
 async function resolveScopedBuilderCredentials() {
     const email = getRequestUserEmail();
@@ -330,6 +388,7 @@ async function resolveScopedBuilderCredentials() {
         return { creds: null, lookupFailed: false };
     const traceLookup = shouldTraceCredentialResolve();
     let scopeAttempted = "user";
+    let orgLookupCause;
     try {
         const { readAppSecrets } = await import("../secrets/storage.js");
         const traceScope = (creds, scopeId, extra = "") => {
@@ -347,7 +406,9 @@ async function resolveScopedBuilderCredentials() {
             ? "request"
             : "none";
         if (!orgId) {
-            orgId = await resolveOrgIdForRequestEmail(email);
+            const resolved = await resolveOrgIdForRequestEmail(email);
+            orgLookupCause = resolved.cause;
+            orgId = resolved.orgId;
             if (orgId)
                 orgSource = "email-fallback";
         }
@@ -365,6 +426,9 @@ async function resolveScopedBuilderCredentials() {
                 return { creds: workspaceCreds, lookupFailed: false };
             }
         }
+        if (orgLookupCause !== undefined) {
+            return { creds: null, lookupFailed: true, cause: orgLookupCause };
+        }
         // Solo-workspace fallback: always checked, even when an org id was found
         // above. See resolveScopedBuilderCredential for why this must not be
         // gated behind "no org".
@@ -380,9 +444,13 @@ async function resolveScopedBuilderCredentials() {
         if (traceLookup) {
             console.log(`[builder-credential] email=${email} scope=${scopeAttempted} credentials error=${err?.message ?? err}`);
         }
-        return { creds: null, lookupFailed: true };
+        return { creds: null, lookupFailed: true, cause: err };
     }
-    return { creds: null, lookupFailed: false };
+    return {
+        creds: null,
+        lookupFailed: orgLookupCause !== undefined,
+        cause: orgLookupCause,
+    };
 }
 /**
  * Resolve a Builder credential for the current request. User/org credentials
@@ -392,11 +460,17 @@ async function resolveScopedBuilderCredentials() {
  */
 export async function resolveBuilderCredential(key) {
     const scoped = await resolveScopedBuilderCredential(key);
-    if (scoped)
+    if (scoped.value)
         return scoped.value;
-    if (!canUseBuilderDeployCredentialFallbackForRequest())
-        return null;
-    return readDeployCredentialEnv(key) ?? null;
+    const envValue = canUseBuilderDeployCredentialFallbackForRequest()
+        ? (readDeployCredentialEnv(key) ?? null)
+        : null;
+    if (envValue)
+        return envValue;
+    // Nothing answered AND the store never gave a real answer: that is not
+    // "not connected", it is "we could not look".
+    assertCredentialStoreReadable(scoped);
+    return null;
 }
 /**
  * True when `BUILDER_PRIVATE_KEY` is set at the deployment level. This means
@@ -454,7 +528,7 @@ export async function resolveBuilderCredentialSource() {
  * should use `resolveBuilderCredentials()` instead.
  */
 export async function resolveBuilderCredentialsDetailed() {
-    const { creds: scoped, lookupFailed } = await resolveScopedBuilderCredentials();
+    const { creds: scoped, lookupFailed, cause, } = await resolveScopedBuilderCredentials();
     if (scoped) {
         const { privateKey, publicKey, userId, orgName, orgKind, subscription, subscriptionLevel, subscriptionName, isEnterprise, isFreeAccount, source, } = scoped;
         return {
@@ -516,6 +590,7 @@ export async function resolveBuilderCredentialsDetailed() {
         isFreeAccount,
         source: canUseEnv && privateKey ? "env" : null,
         lookupFailed,
+        cause,
     };
 }
 /**
@@ -855,12 +930,30 @@ export async function deleteBuilderCredentials(email, options) {
 // ---------------------------------------------------------------------------
 /**
  * Resolve a request-scoped secret. Reads from `app_secrets` first (current
- * user override, active org, then workspace row); falls back to `process.env`
- * only when the deploy fallback policy allows it.
+ * user override, active org, workspace row for that org, then the solo
+ * workspace row); falls back to `process.env` only when the deploy fallback
+ * policy allows it.
  */
 export async function resolveSecret(key) {
+    const resolved = await resolveSecretDetailed(key);
+    if (resolved.value)
+        return resolved.value;
+    // Nothing answered AND the store never gave a real answer. Reporting null
+    // here is what turns a database blip into "you never configured this".
+    assertCredentialStoreReadable(resolved);
+    return null;
+}
+/**
+ * `resolveSecret` without the throw: reports whether the miss is definitive
+ * (`lookupFailed: false` — no such row anywhere the caller can reach) or just
+ * unknown (`lookupFailed: true` — the store or the org membership behind it
+ * could not be read).
+ */
+export async function resolveSecretDetailed(key) {
     const traceLookup = shouldTraceCredentialResolve();
     const email = getRequestUserEmail();
+    let lookupFailed = false;
+    let cause;
     if (email) {
         try {
             const { readAppSecret } = await import("../secrets/storage.js");
@@ -874,9 +967,18 @@ export async function resolveSecret(key) {
                 if (traceLookup) {
                     console.log(`[resolve-secret] key=${key} email=${email} scope=user hit=true`);
                 }
-                return userSecret.value;
+                return { value: userSecret.value, lookupFailed: false };
+            }
+            // Mirrors resolveScopedBuilderCredential: a transient org_members read
+            // failure makes getOrgContext report no org, which would otherwise hide
+            // an org-scoped vault row behind an intermittent "not configured" error.
+            let orgId = getRequestOrgId();
+            if (!orgId) {
+                const resolved = await resolveOrgIdForRequestEmail(email);
+                cause = resolved.cause;
+                lookupFailed = cause !== undefined;
+                orgId = resolved.orgId;
             }
-            const orgId = getRequestOrgId();
             if (orgId) {
                 // Fall back to the active org's shared row, when present. Builder
                 // Connect uses this first-class org scope.
@@ -889,7 +991,7 @@ export async function resolveSecret(key) {
                     if (traceLookup) {
                         console.log(`[resolve-secret] key=${key} email=${email} orgId=${orgId} scope=org hit=true`);
                     }
-                    return orgSecret.value;
+                    return { value: orgSecret.value, lookupFailed: false };
                 }
                 // Registered secrets historically used "workspace" scope for
                 // org-shared configuration. Keep reading it so Settings status and
@@ -903,28 +1005,37 @@ export async function resolveSecret(key) {
                     if (traceLookup) {
                         console.log(`[resolve-secret] key=${key} email=${email} orgId=${orgId} scope=workspace hit=true`);
                     }
-                    return workspaceSecret.value;
+                    return { value: workspaceSecret.value, lookupFailed: false };
                 }
             }
-            else {
-                const soloWorkspaceSecret = await readAppSecret({
-                    key,
-                    scope: "workspace",
-                    scopeId: `solo:${email}`,
-                });
-                if (soloWorkspaceSecret?.value) {
-                    if (traceLookup) {
-                        console.log(`[resolve-secret] key=${key} email=${email} scope=workspace-solo hit=true`);
-                    }
-                    return soloWorkspaceSecret.value;
+            if (lookupFailed) {
+                return { value: null, lookupFailed: true, cause };
+            }
+            // Solo-workspace fallback: always checked, even when an org id was found
+            // above. A secret written before the user joined/created an org lives
+            // here, and must not become unreachable once that org exists. It stays
+            // inside this try so a failed org-scoped read still surfaces as
+            // retryable instead of being answered by a stale pre-org row.
+            const soloWorkspaceSecret = await readAppSecret({
+                key,
+                scope: "workspace",
+                scopeId: `solo:${email}`,
+            });
+            if (soloWorkspaceSecret?.value) {
+                if (traceLookup) {
+                    console.log(`[resolve-secret] key=${key} email=${email} orgId=${orgId ?? "(none)"} scope=workspace-solo hit=true`);
                 }
+                return { value: soloWorkspaceSecret.value, lookupFailed: false };
             }
         }
         catch (err) {
             if (traceLookup) {
                 console.log(`[resolve-secret] key=${key} email=${email} scope=error err=${err?.message ?? err}`);
             }
-            // Secrets table not ready — treat as missing.
+            // Keep looking (env may still have the key), but remember that the store
+            // never actually answered "no row".
+            lookupFailed = true;
+            cause = err;
         }
         // Read deployment-provided env values as fallbacks; framework code must not
         // write to `process.env`, but keys supplied by the host remain valid config.
@@ -938,7 +1049,11 @@ export async function resolveSecret(key) {
         if (traceLookup) {
             console.log(`[resolve-secret] key=${key} email=${email} orgId=${getRequestOrgId() ?? "(none)"} scope=${envFallback ? "env-fallback" : "none"} hit=${!!envFallback}`);
         }
-        return envFallback;
+        return {
+            value: envFallback,
+            lookupFailed: lookupFailed && !envFallback,
+            cause,
+        };
     }
     // Unauthenticated / local-dev / CLI / background context: env fallback
     // is safe because there's no user to mis-identify.
@@ -946,7 +1061,7 @@ export async function resolveSecret(key) {
     if (traceLookup) {
         console.log(`[resolve-secret] key=${key} email=(none) scope=env-anonymous hit=${!!value}`);
     }
-    return value;
+    return { value, lookupFailed: false };
 }
 // ---------------------------------------------------------------------------
 // Synchronous helpers — env-only fallbacks for contexts where per-user