@agent-native/core 0.136.4 → 0.136.5

package/corpus/templates/clips/server/lib/post-finalize-dispatch.ts

@@ -78,6 +78,12 @@ export async function dispatchPostFinalizeJob(args: {
         }
       : {}),
   });
+  console.log("[post-finalize] dispatching", {
+    recordingId: args.recordingId,
+    kind: args.kind,
+    workerUrl,
+    usesDurableBackground,
+  });
   const post = (url: string) =>
     fetch(url, {
       method: "POST",
@@ -89,7 +95,14 @@ export async function dispatchPostFinalizeJob(args: {
       usesDurableBackground && !initialResponse.ok
         ? await post(resolveWorkerUrl(processorRoute))
         : initialResponse;
-    if (response.ok) return;
+    if (response.ok) {
+      console.log("[post-finalize] dispatch accepted", {
+        recordingId: args.recordingId,
+        kind: args.kind,
+        status: response.status,
+      });
+      return;
+    }
     const detail = (await response.text().catch(() => "")).trim().slice(0, 300);
     throw new Error(
       `Post-finalize ${args.kind} worker returned HTTP ${response.status}${

package/corpus/templates/clips/server/plugins/auth.ts

@@ -45,6 +45,15 @@ export default createAuthPlugin({
     "/api/video",
     "/api/thumbnail",
     "/api/auth/google-calendar",
+    // Internal post-finalize worker (media verification, seekable remux,
+    // transcript, brain-export, loom-import retries). It's a server-to-server
+    // self-dispatch with no session cookie — its own scoped, short-lived
+    // signed token (verifyScopedAgentAccessToken) is the real auth check, so
+    // it must bypass the session gate to ever reach that check. Exact path
+    // only, not the whole `_agent-native-background` namespace — a future
+    // route added under that prefix without its own auth check must not
+    // become silently public by inheriting this bypass.
+    "/api/_agent-native-background/post-finalize-worker",
     "/_agent-native/google/auth-url",
     "/_agent-native/google/callback",
   ],

package/corpus/templates/clips/server/routes/api/_agent-native-background/post-finalize-worker.post.ts

@@ -51,11 +51,17 @@ export default defineEventHandler(async (event: H3Event) => {
 
   const { recordingId, kind, token, delayMs, retryAttempt, regenerate } =
     parsed.data;
+  console.log("[post-finalize-worker] received job", { recordingId, kind });
   const verified = verifyScopedAgentAccessToken(token, {
     resourceKind: POST_FINALIZE_JOB_TOKEN_KIND,
     resourceId: postFinalizeJobResourceId(recordingId, kind),
   });
   if (!verified.ok) {
+    console.warn("[post-finalize-worker] token verification failed", {
+      recordingId,
+      kind,
+      reason: verified.reason,
+    });
     setResponseStatus(event, 401);
     return { ok: false, error: "Invalid or expired post-finalize job token" };
   }
@@ -153,6 +159,9 @@ export default defineEventHandler(async (event: H3Event) => {
           )
           .returning({ id: schema.recordings.id });
         if (!claimed) {
+          console.log("[post-finalize-worker] loom-import already running", {
+            recordingId,
+          });
           return {
             ok: true,
             recordingId,
@@ -161,6 +170,10 @@ export default defineEventHandler(async (event: H3Event) => {
             reason: "loom-import-already-running",
           };
         }
+        console.log("[post-finalize-worker] loom-import claimed", {
+          recordingId,
+          claimId,
+        });
         const result = await runLoomImportJob({
           recordingId,
           ownerEmail: recording.ownerEmail,

package/dist/client/settings/SecretsSection.js

@@ -98,16 +98,23 @@ function KeysHeader({ availableSecrets = [], onSecret, onCustomKey, }) {
                                                 }, children: [_jsx(IconPlus, { size: 14 }), "Custom"] }) })] })] }) })] })] }));
 }
 function SecretCard({ secret, onChanged, open, onOpenChange, focusInput, }) {
+    const t = useT();
     const [value, setValue] = useState("");
+    const [isRotating, setIsRotating] = useState(false);
     const [busy, setBusy] = useState(null);
     const [confirmDelete, setConfirmDelete] = useState(false);
     const [toast, setToast] = useState(null);
     const inputRef = React.useRef(null);
     useEffect(() => {
-        if (open && focusInput && inputRef.current) {
+        if (!open) {
+            setValue("");
+            setIsRotating(false);
+            return;
+        }
+        if ((focusInput || isRotating) && inputRef.current) {
             inputRef.current.focus();
         }
-    }, [focusInput, open]);
+    }, [focusInput, isRotating, open]);
     const setToastAndClear = (kind, text, ms = 2500) => {
         setToast({ kind, text });
         setTimeout(() => setToast(null), ms);
@@ -131,6 +138,7 @@ function SecretCard({ secret, onChanged, open, onOpenChange, focusInput, }) {
                 return;
             }
             setValue("");
+            setIsRotating(false);
             setConfirmDelete(false);
             setToastAndClear("ok", "Saved");
             notifySecretsChanged();
@@ -166,20 +174,32 @@ function SecretCard({ secret, onChanged, open, onOpenChange, focusInput, }) {
             setBusy(null);
         }
     };
-    const handleTest = async () => {
+    const handleTest = async (candidateValue) => {
         if (busy)
             return;
-        setBusy("test");
+        const isCandidate = candidateValue !== undefined;
+        setBusy(isCandidate ? "test-candidate" : "test");
         try {
             const res = await fetch(`${ENDPOINT}/${encodeURIComponent(secret.key)}/test`, {
                 method: "POST",
+                ...(isCandidate
+                    ? {
+                        headers: { "Content-Type": "application/json" },
+                        body: JSON.stringify({ value: candidateValue }),
+                    }
+                    : {}),
             });
             const body = (await res.json().catch(() => ({})));
             if (res.ok && body.ok) {
-                setToastAndClear("ok", "Working");
+                setToastAndClear("ok", isCandidate
+                    ? t("secrets.candidateValueWorking")
+                    : t("secrets.storedValueWorking"));
             }
             else {
-                setToastAndClear("err", body.error ?? (body.ok === false ? "Invalid" : `Test failed`));
+                setToastAndClear("err", body.error ??
+                    (body.ok === false
+                        ? t("secrets.invalid")
+                        : t("secrets.testFailed")));
             }
         }
         finally {
@@ -196,12 +216,16 @@ function SecretCard({ secret, onChanged, open, onOpenChange, focusInput, }) {
         return (_jsx("span", { className: "rounded-full bg-accent/60 px-1.5 py-0.5 text-[9px] font-semibold uppercase tracking-wide text-muted-foreground", children: "Optional" }));
     }, [secret.status, secret.required]);
     const isOAuth = secret.kind === "oauth";
-    return (_jsxs("div", { className: "border-b border-border last:border-b-0", children: [_jsxs(Button, { type: "button", intent: "neutral", emphasis: "ghost", "aria-expanded": open, onClick: () => onOpenChange(!open), className: "flex w-full items-center gap-2 px-2.5 py-2 text-start transition-colors hover:bg-accent/30", children: [_jsx(IconChevronRight, { size: 13, className: `shrink-0 text-muted-foreground transition-transform ${open ? "rotate-90" : ""}` }), _jsx("span", { className: "min-w-0 flex-1 truncate text-[11px] font-medium text-foreground", children: secret.label }), secret.status === "set" && secret.last4 && (_jsxs("code", { className: "text-[10px] text-muted-foreground", children: ["\u2022\u2022\u2022\u2022", secret.last4] })), _jsx("span", { className: "shrink-0", children: pill })] }), open && (_jsxs("div", { className: "border-t border-border/60 bg-accent/20 px-3 pb-3 pt-2.5", children: [secret.description && (_jsx("p", { className: "mb-2 text-[10px] leading-relaxed text-muted-foreground", children: secret.description })), isOAuth ? (_jsxs("div", { className: "mt-2 flex items-center gap-1.5", children: [secret.oauthConnectUrl && (_jsxs("a", { href: secret.oauthConnectUrl, className: "inline-flex items-center gap-1 rounded px-2 py-1 text-[10px] font-medium no-underline", style: { backgroundColor: "#00B5FF", color: "white" }, children: [_jsx(IconPlugConnected, { size: 10 }), secret.status === "set" ? "Reconnect" : "Connect"] })), secret.docsUrl && (_jsxs("a", { href: secret.docsUrl, target: "_blank", rel: "noopener noreferrer", className: "inline-flex items-center gap-1 rounded border border-border px-2 py-1 text-[10px] no-underline text-muted-foreground hover:text-foreground", children: ["Docs", _jsx(IconExternalLink, { size: 10 })] }))] })) : (_jsxs("div", { className: "mt-2 space-y-1.5", children: [secret.status === "set" && (_jsxs("div", { className: "flex items-center gap-2 text-[10px] text-muted-foreground", children: [_jsx("span", { children: "Stored value ending in" }), _jsx("code", { className: "rounded bg-background px-1 py-0.5 text-foreground", children: secret.last4 })] })), _jsxs("div", { className: "flex gap-1.5", children: [_jsx(TextField, { inputRef: inputRef, type: "password", "aria-label": secret.label, value: value, onChange: setValue, onKeyDown: (event) => {
+    const showRotationForm = secret.status !== "set" || isRotating;
+    return (_jsxs("div", { className: "border-b border-border last:border-b-0", children: [_jsxs(Button, { type: "button", intent: "neutral", emphasis: "ghost", "aria-expanded": open, onClick: () => onOpenChange(!open), className: "flex w-full items-center gap-2 px-2.5 py-2 text-start transition-colors hover:bg-accent/30", children: [_jsx(IconChevronRight, { size: 13, className: `shrink-0 text-muted-foreground transition-transform ${open ? "rotate-90" : ""}` }), _jsx("span", { className: "min-w-0 flex-1 truncate text-[11px] font-medium text-foreground", children: secret.label }), secret.status === "set" && secret.last4 && (_jsxs("code", { className: "text-[10px] text-muted-foreground", children: ["\u2022\u2022\u2022\u2022", secret.last4] })), _jsx("span", { className: "shrink-0", children: pill })] }), open && (_jsxs("div", { className: "border-t border-border/60 bg-accent/20 px-3 pb-3 pt-2.5", children: [secret.description && (_jsx("p", { className: "mb-2 text-[10px] leading-relaxed text-muted-foreground", children: secret.description })), isOAuth ? (_jsxs("div", { className: "mt-2 flex items-center gap-1.5", children: [secret.oauthConnectUrl && (_jsxs("a", { href: secret.oauthConnectUrl, className: "inline-flex items-center gap-1 rounded px-2 py-1 text-[10px] font-medium no-underline", style: { backgroundColor: "#00B5FF", color: "white" }, children: [_jsx(IconPlugConnected, { size: 10 }), secret.status === "set" ? "Reconnect" : "Connect"] })), secret.docsUrl && (_jsxs("a", { href: secret.docsUrl, target: "_blank", rel: "noopener noreferrer", className: "inline-flex items-center gap-1 rounded border border-border px-2 py-1 text-[10px] no-underline text-muted-foreground hover:text-foreground", children: ["Docs", _jsx(IconExternalLink, { size: 10 })] }))] })) : (_jsxs("div", { className: "mt-2 space-y-2", children: [secret.status === "set" && (_jsxs(_Fragment, { children: [_jsxs("div", { className: "flex items-center gap-2 text-[10px] text-muted-foreground", children: [_jsx("span", { children: "Stored value ending in" }), _jsx("code", { className: "mt-1 block w-fit rounded bg-background px-1 py-0.5 text-foreground", children: secret.last4 })] }), _jsxs("div", { className: "flex flex-wrap items-center gap-1.5", children: [_jsx(Button, { type: "button", intent: "neutral", emphasis: "outline", onClick: () => handleTest(), disabled: busy !== null, className: "inline-flex items-center gap-1 rounded border border-border px-2 py-1 text-[10px] text-muted-foreground hover:text-foreground disabled:opacity-40", children: busy === "test" ? (_jsx(IconLoader2, { size: 10, className: "animate-spin" })) : (t("secrets.testStoredValue")) }), _jsxs(Button, { type: "button", intent: "primary", emphasis: "solid", onClick: () => setIsRotating(true), disabled: busy !== null, className: "inline-flex items-center gap-1 rounded px-2 py-1 text-[10px] font-medium disabled:opacity-40", style: { backgroundColor: "#00B5FF", color: "white" }, children: [_jsx(IconRefresh, { size: 10 }), "Rotate"] }), _jsxs(Button, { type: "button", intent: "danger", emphasis: "outline", onClick: () => setConfirmDelete(true), disabled: busy !== null, className: "inline-flex items-center gap-1 rounded border border-border px-2 py-1 text-[10px] text-muted-foreground hover:text-red-500 disabled:opacity-40", children: [_jsx(IconTrash, { size: 10 }), "Delete"] })] })] })), showRotationForm && (_jsxs("div", { className: "space-y-1.5", children: [_jsx("hr", { className: "my-4" }), _jsx(TextField, { inputRef: inputRef, type: "password", "aria-label": secret.label, value: value, onChange: setValue, onKeyDown: (event) => {
                                             if (event.key === "Enter")
                                                 handleSave();
                                         }, placeholder: secret.status === "set"
                                             ? "Enter new value to rotate"
-                                            : "Paste key", className: "flex-1 text-[11px]" }), _jsx(Button, { type: "button", intent: "primary", emphasis: "solid", onClick: handleSave, disabled: !value.trim() || busy !== null, className: "inline-flex items-center gap-1 rounded px-2 py-1 text-[10px] font-medium disabled:opacity-40", style: { backgroundColor: "#00B5FF", color: "white" }, children: busy === "save" ? (_jsx(IconLoader2, { size: 10, className: "animate-spin" })) : secret.status === "set" ? (_jsxs(_Fragment, { children: [_jsx(IconRefresh, { size: 10 }), "Rotate"] })) : ("Save") })] }), _jsxs("div", { className: "flex items-center gap-1.5", children: [secret.status === "set" && (_jsxs(_Fragment, { children: [_jsx(Button, { type: "button", intent: "neutral", emphasis: "outline", onClick: handleTest, disabled: busy !== null, className: "inline-flex items-center gap-1 rounded border border-border px-2 py-1 text-[10px] text-muted-foreground hover:text-foreground disabled:opacity-40", children: busy === "test" ? (_jsx(IconLoader2, { size: 10, className: "animate-spin" })) : ("Test") }), _jsxs(Button, { type: "button", intent: "danger", emphasis: "outline", onClick: () => setConfirmDelete(true), disabled: busy !== null, className: "inline-flex items-center gap-1 rounded border border-border px-2 py-1 text-[10px] text-muted-foreground hover:text-red-500 disabled:opacity-40", children: [_jsx(IconTrash, { size: 10 }), "Remove"] })] })), secret.docsUrl && (_jsxs("a", { href: secret.docsUrl, target: "_blank", rel: "noopener noreferrer", className: "inline-flex items-center gap-1 rounded border border-border px-2 py-1 text-[10px] no-underline text-muted-foreground hover:text-foreground ms-auto", children: ["Get key", _jsx(IconExternalLink, { size: 10 })] }))] }), confirmDelete && (_jsxs("div", { className: "flex items-center gap-1.5 rounded border border-red-500/30 bg-red-500/10 px-2 py-1.5 text-[10px] text-red-500", children: [_jsx("span", { className: "min-w-0 flex-1", children: "Remove this saved value?" }), _jsx(Button, { type: "button", intent: "danger", emphasis: "solid", onClick: handleDelete, disabled: busy !== null, className: "inline-flex items-center gap-1 rounded border border-red-500/40 px-1.5 py-0.5 font-medium disabled:opacity-40", children: busy === "delete" ? (_jsx(IconLoader2, { size: 10, className: "animate-spin" })) : ("Confirm") }), _jsx(Button, { type: "button", intent: "neutral", emphasis: "outline", onClick: () => setConfirmDelete(false), disabled: busy !== null, className: "rounded border border-border px-1.5 py-0.5 text-muted-foreground hover:text-foreground disabled:opacity-40", children: "Cancel" })] }))] })), toast && (_jsx("p", { className: `mt-1.5 text-[10px] ${toast.kind === "ok" ? "text-green-500" : "text-red-500"}`, children: toast.text }))] }))] }));
+                                            : "Paste key", className: "w-full text-[11px]" }), _jsxs("div", { className: "flex flex-wrap items-center gap-1.5", children: [_jsx(Button, { type: "button", intent: "neutral", emphasis: "outline", onClick: () => handleTest(value.trim()), disabled: !value.trim() || busy !== null, className: "inline-flex items-center gap-1 rounded border border-border px-2 py-1 text-[10px] text-muted-foreground hover:text-foreground disabled:opacity-40", children: busy === "test-candidate" ? (_jsx(IconLoader2, { size: 10, className: "animate-spin" })) : (t("secrets.testStoredValue")) }), secret.docsUrl && (_jsxs("a", { href: secret.docsUrl, target: "_blank", rel: "noopener noreferrer", className: "inline-flex items-center gap-1 rounded border border-border px-2 py-1 text-[10px] no-underline text-muted-foreground hover:text-foreground", children: ["Get key", _jsx(IconExternalLink, { size: 10 })] })), secret.status === "set" && (_jsx(Button, { type: "button", intent: "neutral", emphasis: "outline", onClick: () => {
+                                                    setValue("");
+                                                    setIsRotating(false);
+                                                }, disabled: busy !== null, className: "rounded border border-border px-2 py-1 text-[10px] text-muted-foreground hover:text-foreground disabled:opacity-40", children: "Discard" })), _jsx(Button, { type: "button", intent: "primary", emphasis: "solid", onClick: handleSave, disabled: !value.trim() || busy !== null, className: "inline-flex items-center gap-1 rounded px-2 py-1 text-[10px] font-medium disabled:opacity-40", style: { backgroundColor: "#00B5FF", color: "white" }, children: busy === "save" ? (_jsx(IconLoader2, { size: 10, className: "animate-spin" })) : ("Save") })] })] })), confirmDelete && (_jsxs("div", { className: "flex items-center gap-1.5 rounded border border-red-500/30 bg-red-500/10 px-2 py-1.5 text-[10px] text-red-500", children: [_jsx("span", { className: "min-w-0 flex-1", children: "Remove this saved value?" }), _jsx(Button, { type: "button", intent: "danger", emphasis: "solid", onClick: handleDelete, disabled: busy !== null, className: "inline-flex items-center gap-1 rounded border border-red-500/40 px-1.5 py-0.5 font-medium disabled:opacity-40", children: busy === "delete" ? (_jsx(IconLoader2, { size: 10, className: "animate-spin" })) : ("Confirm") }), _jsx(Button, { type: "button", intent: "neutral", emphasis: "outline", onClick: () => setConfirmDelete(false), disabled: busy !== null, className: "rounded border border-border px-1.5 py-0.5 text-muted-foreground hover:text-foreground disabled:opacity-40", children: "Cancel" })] }))] })), toast && (_jsx("p", { className: `mt-1.5 text-[10px] ${toast.kind === "ok" ? "text-green-500" : "text-red-500"}`, children: toast.text }))] }))] }));
 }
 const ADHOC_ENDPOINT = agentNativePath("/_agent-native/secrets/adhoc");
 function AdHocKeysSection({ showForm, onShowFormChange, showEmptyState, }) {

package/dist/collab/struct-routes.d.ts

@@ -13,8 +13,8 @@
  * Body: { json: any, fieldName?: string, type?: "map"|"array", requestSource?: string }
  */
 export declare const postCollabJson: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    ok?: undefined;
     error: string;
+    ok?: undefined;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/file-upload/actions/upload-image.d.ts

@@ -17,12 +17,12 @@ declare const _default: import("../../action.js").ActionDefinition<{
     id?: undefined;
     provider?: undefined;
 } | {
-    error?: undefined;
     configured?: undefined;
     connectPath?: undefined;
     url: string;
     id: string;
     provider: string;
+    error?: undefined;
 }>;
 export default _default;
 //# sourceMappingURL=upload-image.d.ts.map

package/dist/localization/default-messages.d.ts

@@ -57,6 +57,11 @@ declare const messages: {
         scopeLabel: string;
         scopePersonal: string;
         scopeWorkspace: string;
+        testStoredValue: string;
+        candidateValueWorking: string;
+        storedValueWorking: string;
+        invalid: string;
+        testFailed: string;
         scopePersonalDescription: string;
         scopeWorkspaceDescription: string;
     };

package/dist/localization/default-messages.js

@@ -62,6 +62,11 @@ const messages = {
         scopeLabel: "Scope",
         scopePersonal: "Personal",
         scopeWorkspace: "Workspace",
+        testStoredValue: "Test",
+        candidateValueWorking: "New value works",
+        storedValueWorking: "Working",
+        invalid: "Invalid",
+        testFailed: "Test failed",
         scopePersonalDescription: "Only your own signed-in sessions use this key. Integration, webhook, scheduled job, automation, and agent-to-agent runs sign in as their owner rather than as you, so they cannot read it.",
         scopeWorkspaceDescription: "Everyone in this workspace uses this key, including integration, webhook, scheduled job, automation, and agent-to-agent runs.",
     },

package/dist/mcp/screen-memory-stdio.d.ts

@@ -137,13 +137,13 @@ export declare function screenMemoryMcpToolDefinitions(): ({
     inputSchema: {
         type: string;
         properties: {
-            count?: undefined;
             query?: undefined;
             minutes?: undefined;
             limit?: undefined;
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
+            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;
@@ -159,7 +159,6 @@ export declare function screenMemoryMcpToolDefinitions(): ({
     inputSchema: {
         type: string;
         properties: {
-            count?: undefined;
             query: {
                 type: string;
                 description: string;
@@ -175,6 +174,7 @@ export declare function screenMemoryMcpToolDefinitions(): ({
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
+            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;
@@ -190,7 +190,6 @@ export declare function screenMemoryMcpToolDefinitions(): ({
     inputSchema: {
         type: string;
         properties: {
-            count?: undefined;
             minutes: {
                 type: string;
                 description: string;
@@ -200,6 +199,7 @@ export declare function screenMemoryMcpToolDefinitions(): ({
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
+            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;
@@ -216,7 +216,6 @@ export declare function screenMemoryMcpToolDefinitions(): ({
         type: string;
         required: string[];
         properties: {
-            count?: undefined;
             query: {
                 type: string;
                 description: string;
@@ -235,6 +234,7 @@ export declare function screenMemoryMcpToolDefinitions(): ({
             };
             timestamp?: undefined;
             chapterId?: undefined;
+            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;
@@ -250,7 +250,6 @@ export declare function screenMemoryMcpToolDefinitions(): ({
         type: string;
         required: string[];
         properties: {
-            count?: undefined;
             query?: undefined;
             minutes?: undefined;
             limit?: undefined;
@@ -264,6 +263,7 @@ export declare function screenMemoryMcpToolDefinitions(): ({
                 description: string;
             };
             chapterId?: undefined;
+            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             includeMicrophone?: undefined;
@@ -314,13 +314,13 @@ export declare function screenMemoryMcpToolDefinitions(): ({
         type: string;
         required: string[];
         properties: {
-            count?: undefined;
             query?: undefined;
             minutes?: undefined;
             limit?: undefined;
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
+            count?: undefined;
             startAt: {
                 type: string;
                 description: string;
@@ -349,13 +349,13 @@ export declare function screenMemoryMcpToolDefinitions(): ({
         type: string;
         required: string[];
         properties: {
-            count?: undefined;
             query?: undefined;
             minutes?: undefined;
             limit?: undefined;
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
+            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;

package/dist/notifications/routes.d.ts

@@ -13,22 +13,22 @@
 export declare function createNotificationsHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<"" | import("./types.js").Notification[] | {
     count: number;
     updated?: undefined;
-    ok?: undefined;
     error?: undefined;
+    ok?: undefined;
 } | {
-    count?: undefined;
     updated: number;
-    ok?: undefined;
     error?: undefined;
-} | {
+    ok?: undefined;
     count?: undefined;
+} | {
     updated?: undefined;
     error: string;
     ok?: undefined;
-} | {
     count?: undefined;
+} | {
     updated?: undefined;
     ok: boolean;
     error?: undefined;
+    count?: undefined;
 }>>;
 //# sourceMappingURL=routes.d.ts.map

package/dist/observability/routes.d.ts

@@ -62,7 +62,7 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
-    error?: undefined;
     ok: boolean;
+    error?: undefined;
 }>>;
 //# sourceMappingURL=routes.d.ts.map

package/dist/resources/handlers.d.ts

@@ -48,8 +48,8 @@ export declare function handleUpdateResource(event: any): Promise<import("./stor
 }>;
 /** DELETE /_agent-native/resources/:id — delete a resource */
 export declare function handleDeleteResource(event: any): Promise<{
-    ok?: undefined;
     error: string;
+    ok?: undefined;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/secrets/routes.d.ts

@@ -50,8 +50,8 @@ export declare function createWriteSecretHandler(): import("h3").EventHandlerWit
     removed: boolean;
 }>>;
 /**
- * POST /_agent-native/secrets/:key/test — re-run the validator against the
- * current stored value without changing anything. Useful for the "Test" button.
+ * POST /_agent-native/secrets/:key/test — validate an optional candidate value
+ * or the current stored value without changing anything.
  */
 export declare function createTestSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     ok?: undefined;

package/dist/secrets/routes.js

@@ -277,8 +277,8 @@ async function handleDelete(event, secret) {
     return { ok: true, removed };
 }
 /**
- * POST /_agent-native/secrets/:key/test — re-run the validator against the
- * current stored value without changing anything. Useful for the "Test" button.
+ * POST /_agent-native/secrets/:key/test — validate an optional candidate value
+ * or the current stored value without changing anything.
  */
 export function createTestSecretHandler() {
     return defineEventHandler(async (event) => {
@@ -301,25 +301,49 @@ export function createTestSecretHandler() {
             const has = await hasOAuthSecretForEvent(event, secret).catch(() => false);
             return { ok: has };
         }
-        if (!secret.validator) {
-            return { ok: true, note: "No validator registered" };
+        const body = (await readBody(event).catch(() => ({})));
+        const hasCandidateValue = Object.hasOwn(body, "value");
+        const candidateValue = typeof body.value === "string" ? body.value.trim() : undefined;
+        if (hasCandidateValue && !candidateValue) {
+            setResponseStatus(event, 400);
+            return { error: "value must be a non-empty string" };
         }
-        const { scopeId } = await resolveScopeId(event, secret.scope);
+        const { scopeId, reason } = await resolveScopeId(event, secret.scope);
         if (!scopeId) {
             setResponseStatus(event, 401);
-            return { error: "Unable to resolve scope" };
+            return { error: reason ?? "Unable to resolve scope" };
         }
-        const stored = await readAppSecret({
-            key: secret.key,
-            scope: secret.scope,
-            scopeId,
-        });
-        if (!stored) {
-            setResponseStatus(event, 404);
-            return { error: "No value stored" };
+        if (secret.scope === "workspace" &&
+            !(await canMutateWorkspaceScope(event, scopeId))) {
+            setResponseStatus(event, 403);
+            return {
+                error: "Only organization owners and admins can set workspace-scoped secrets",
+            };
+        }
+        if (secret.scope === "org" && !(await canMutateOrgScope(event, scopeId))) {
+            setResponseStatus(event, 403);
+            return {
+                error: "Only organization owners and admins can set org-scoped secrets",
+            };
+        }
+        if (!secret.validator) {
+            return { ok: true, note: "No validator registered" };
+        }
+        let value = candidateValue;
+        if (!value) {
+            const stored = await readAppSecret({
+                key: secret.key,
+                scope: secret.scope,
+                scopeId,
+            });
+            if (!stored) {
+                setResponseStatus(event, 404);
+                return { error: "No value stored" };
+            }
+            value = stored.value;
         }
         try {
-            const result = await secret.validator(stored.value);
+            const result = await secret.validator(value);
             const ok = typeof result === "boolean" ? result : result?.ok === true;
             if (!ok) {
                 const err = typeof result === "object" && result && result.error
@@ -327,7 +351,7 @@ export function createTestSecretHandler() {
                     : "Validator rejected the value";
                 return {
                     ok: false,
-                    error: redactSecretFromMessage(err, stored.value),
+                    error: redactSecretFromMessage(err, value),
                 };
             }
             return { ok: true };
@@ -338,7 +362,7 @@ export function createTestSecretHandler() {
                 : "Validator threw";
             return {
                 ok: false,
-                error: redactSecretFromMessage(message, stored.value),
+                error: redactSecretFromMessage(message, value),
             };
         }
     });

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agent-native/core",
-  "version": "0.136.4",
+  "version": "0.136.5",
   "description": "Framework for agent-native application development — where AI agents and UI share SQL state, actions, and context",
   "homepage": "https://github.com/BuilderIO/agent-native#readme",
   "bugs": {