@agent-native/core 0.145.3 → 0.145.5

package/dist/framework-tools.js

@@ -88,6 +88,88 @@ export function resolveFrameworkTools(input) {
         isEnabled: (group) => !disabledGroups.has(group),
     };
 }
+/**
+ * Which `frameworkTools` switch owns each framework action kit.
+ *
+ * This map is the authority. `ActionEntry.frameworkGroup` is an optional
+ * pre-resolved copy of the same answer, not a requirement: it is stamped only
+ * by `mergeCoreSharingActions`, which runs against the ungated `httpActions`
+ * registry, so for a year every app loading core kits through
+ * `loadActionsFromStaticRegistry` or its own actions directory carried
+ * untagged entries and silently ignored eight of the `frameworkTools`
+ * switches. Resolve by name and the switch works no matter how the action was
+ * registered.
+ *
+ * Membership does two jobs: one filter subtracts a whole kit from every agent
+ * tool surface at once (the plugin spreads these registries at thirteen
+ * composition sites), and it keeps these ~45 schemas out of the DEFAULT
+ * first-request tool list. They stay reachable through `tool-search`.
+ *
+ * Anything absent from this map is always-on and must be listed in
+ * `ALWAYS_ON_CORE_ACTIONS` instead. `action-discovery.spec.ts` fails when a new
+ * core action appears in neither, so "always-on" stays a decision someone made
+ * rather than the default that happens when a map goes un-updated.
+ */
+export const CORE_ACTION_GROUPS = {
+    "share-resource": "sharing",
+    "unshare-resource": "sharing",
+    "list-resource-shares": "sharing",
+    "set-resource-visibility": "sharing",
+    "create-agent-resource-link": "sharing",
+    "get-feature-flags": "featureFlags",
+    "list-feature-flags": "featureFlags",
+    "set-feature-flag": "featureFlags",
+    "list-recurring-jobs": "automation",
+    "manage-recurring-job": "automation",
+    "run-automation-now": "automation",
+    "list-automation-runs": "automation",
+    "list-automations": "automation",
+    "manage-automation": "automation",
+    "context-manifest-get": "contextXray",
+    "context-preview-get": "contextXray",
+    "context-pin": "contextXray",
+    "context-evict": "contextXray",
+    "context-restore": "contextXray",
+    "context-report": "contextXray",
+    "get-localization-preference": "localization",
+    "set-localization-preference": "localization",
+    // Profile, credentials, and appearance share one switch: an app that hides
+    // its profile surface from the agent hides password management with it.
+    "get-user-profile": "userProfile",
+    "update-user-profile": "userProfile",
+    "get-auth-methods": "userProfile",
+    "set-password": "userProfile",
+    "change-password": "userProfile",
+    "change-appearance": "userProfile",
+    "list-audit-events": "audit",
+    "get-audit-event": "audit",
+    "export-audit-events": "audit",
+    "create-resource-version": "history",
+    "list-resource-versions": "history",
+    "get-resource-version": "history",
+    "restore-resource-version": "history",
+    "list-resource-history": "history",
+    "list-review-comments": "review",
+    "create-review-comment": "review",
+    "reply-review-comment": "review",
+    "resolve-review-thread": "review",
+    "delete-review-comment": "review",
+    "consume-review-feedback": "review",
+    "get-review-feedback": "review",
+    "set-review-status": "review",
+    "send-review-thread-to-agent": "review",
+};
+/**
+ * Which group owns an action, by name first and tag second.
+ *
+ * Name first because the name is present on every registration path, while the
+ * tag is stamped on exactly one — an app is not less entitled to its
+ * `frameworkTools` switches because it loaded core kits from a generated
+ * registry instead of `autoDiscoverActions`.
+ */
+export function resolveFrameworkGroup(name, entry) {
+    return entry?.frameworkGroup ?? CORE_ACTION_GROUPS[name];
+}
 /**
  * Drop every action belonging to a disabled group. Returns the input untouched
  * when nothing is disabled so the default path allocates nothing.
@@ -95,12 +177,14 @@ export function resolveFrameworkTools(input) {
 export function filterFrameworkToolGroups(actions, disabledGroups) {
     if (disabledGroups.size === 0)
         return actions;
-    return Object.fromEntries(Object.entries(actions).filter(([, entry]) => entry.frameworkGroup === undefined ||
-        !disabledGroups.has(entry.frameworkGroup)));
+    return Object.fromEntries(Object.entries(actions).filter(([name, entry]) => {
+        const group = resolveFrameworkGroup(name, entry);
+        return group === undefined || !disabledGroups.has(group);
+    }));
 }
 /** True for actions the framework contributes rather than the app's own. */
-export function isFrameworkGroupedAction(entry) {
-    return entry.frameworkGroup !== undefined;
+export function isFrameworkGroupedAction(name, entry) {
+    return resolveFrameworkGroup(name, entry) !== undefined;
 }
 /**
  * Whether a group is live, for prompt builders that only receive the disabled

package/dist/mcp/build-server.d.ts

@@ -71,6 +71,21 @@ export interface MCPConfig {
      * a constrained / locked-down mount.
      */
     builtinCrossAppTools?: boolean;
+    /**
+     * `"app"` serves exactly the app's own tool registry, flat: every action the
+     * in-app agent holds, and nothing the in-app agent does not — no cross-app
+     * builtins, no `ask-agent`, no `tool-search`, and no compact/connector
+     * trimming. `connectorCatalog`, the compact default, and the
+     * `--full-catalog` / `AGENT_NATIVE_MCP_FULL_CATALOG` opt-ins are all inert
+     * on this mode; `externalAgents.denyActions` and the OAuth scope filter
+     * still apply, because both are explicit removals rather than tiering.
+     *
+     * The dev-open surface split is deliberately NOT bypassed: an
+     * unauthenticated loopback probe still gets `actions`, not
+     * `productionActions`. Parity is with the app's agent for a real
+     * authenticated caller, not an escalation for anonymous ones.
+     */
+    catalogMode?: "app";
     /**
      * Curated allow-list of action names served to **external connector** clients
      * on a hosted multi-tenant deployment.

package/dist/mcp/build-server.js

@@ -142,6 +142,41 @@ function isActionVisibleForOAuthScope(entry, scopes) {
     const required = entry.readOnly === true ? "mcp:read" : "mcp:write";
     return hasMcpOAuthScope(scopes, required);
 }
+/** Mirrors `TOOL_SEARCH_ACTION_NAME`; not imported, because `agent/tool-search.ts`
+ *  reaches Node-only request context and this module must stay bundleable. */
+const TOOL_SEARCH_TOOL_NAME = "tool-search";
+function withoutToolSearch(actions) {
+    if (!(TOOL_SEARCH_TOOL_NAME in actions))
+        return actions;
+    return Object.fromEntries(Object.entries(actions).filter(([name]) => name !== TOOL_SEARCH_TOOL_NAME));
+}
+/**
+ * Re-point `tool-search` at the surface this caller can actually reach.
+ *
+ * The registry's own entry closes over the app's *whole* action registry, but
+ * `tools/call` accepts only the advertised set — so unscoped it answers with
+ * names that come straight back as "Unknown tool", and its `callable` field
+ * reports plan-mode availability, not that gate. Every template that noticed
+ * worked around it by hand-rolling a narrowed copy; scoping it here is what
+ * makes the trimmed catalog honest without one.
+ */
+function scopeToolSearchToAdvertised(advertised) {
+    const entry = advertised[TOOL_SEARCH_TOOL_NAME];
+    if (!entry)
+        return advertised;
+    return {
+        ...advertised,
+        [TOOL_SEARCH_TOOL_NAME]: {
+            ...entry,
+            // Imported lazily: `agent/tool-search.ts` pulls Node-only request
+            // context, and this module has to stay bundleable for serverless.
+            run: async (args) => {
+                const { searchToolRegistry } = await import("../agent/tool-search.js");
+                return searchToolRegistry(advertised, args ?? {});
+            },
+        },
+    };
+}
 const COMPACT_MCP_APP_CATALOG_BUILTINS = new Set([
     "list_apps",
     "open_app",
@@ -149,9 +184,10 @@ const COMPACT_MCP_APP_CATALOG_BUILTINS = new Set([
     "ask_app_status",
     "create_embed_session",
     // `tool-search` MUST stay in every compact/connector surface: it is how a
-    // compacted client discovers and loads any action on demand, which is what
-    // makes "small catalog by default" safe instead of limiting.
-    "tool-search",
+    // compacted client discovers any action on demand, which is what makes
+    // "small catalog by default" non-opaque. Discovery is not permission — a
+    // searched name still has to be in the advertised set to be callable.
+    TOOL_SEARCH_TOOL_NAME,
 ]);
 function isActionAdvertisedInCompactMcpAppCatalog(name, entry, config) {
     if (COMPACT_MCP_APP_CATALOG_BUILTINS.has(name))
@@ -1115,16 +1151,36 @@ export async function createMCPServerForRequest(config, identity, requestMeta) {
     const baseActions = useFullSurface && config.productionActions
         ? config.productionActions
         : config.actions;
-    const actions = mergeBuiltinTools(config, baseActions, requestMeta);
+    const appCatalog = config.catalogMode === "app";
+    // The app catalog IS a full flat catalog, so the `--full-catalog` opt-ins
+    // have nothing left to escalate — collapsing them here keeps every tier gate
+    // below reading one flag instead of testing `appCatalog` a fifth time.
+    const fullCatalogRequested = !appCatalog && explicitlyRequestsFullMcpCatalog(requestMeta);
+    // `tool-search` earns its place only on a *trimmed* catalog, where it is how
+    // a client reaches an action that was not listed. On a flat catalog — app
+    // mode or the `--full-catalog` opt-in — every tool is already in `tools/list`
+    // beside it, so it can only ever describe its own neighbours while spending
+    // a tool slot and a round trip to do it.
+    const flatCatalog = appCatalog || fullCatalogRequested;
+    // `catalogMode: "app"` asks for parity with the in-app agent, so the cross-app
+    // builtins the MCP layer adds on its own come back off too.
+    const mergedActions = appCatalog
+        ? baseActions
+        : mergeBuiltinTools(config, baseActions, requestMeta);
+    // Strip from `actions`, not just the advertised set: on the full-catalog tier
+    // `actions` IS the callable surface, so filtering only the listing would
+    // leave `tool-search` callable but invisible.
+    const actions = flatCatalog
+        ? withoutToolSearch(mergedActions)
+        : mergedActions;
     const visibleActions = Object.fromEntries(Object.entries(actions).filter(([, entry]) => isActionVisibleForOAuthScope(entry, effectiveIdentity?.oauthScopes)));
-    const fullCatalogRequested = explicitlyRequestsFullMcpCatalog(requestMeta);
     // Compact/connector is the DEFAULT for every caller — hosted connectors,
     // code clients (Claude Code / Cursor / Codex), and the local CLI alike. The
     // full ~105-tool catalog is served only on the explicit opt-in above, so a
     // host can never dump every action schema into one giant tool card. The
     // `mcp:apps` scope still lands on this compact MCP-Apps surface; with no
     // opt-in, everyone else does too.
-    const compactMcpAppCatalog = !fullCatalogRequested;
+    const compactMcpAppCatalog = !appCatalog && !fullCatalogRequested;
     const advertisedActionsBeforeConnector = compactMcpAppCatalog
         ? Object.fromEntries(Object.entries(visibleActions).filter(([name, entry]) => isActionAdvertisedInCompactMcpAppCatalog(name, entry, config)))
         : visibleActions;
@@ -1140,28 +1196,32 @@ export async function createMCPServerForRequest(config, identity, requestMeta) {
     // authenticated reads from `externalAgents.authenticatedReads: "auto"`.
     // This stays compact by default and keeps db-exec / seed-* / extension /
     // browser-session footguns off the external surface.
-    const connectorCatalogActive = (connectorNames.size > 0 || automaticConnectorPolicyActive) &&
+    const connectorCatalogActive = !appCatalog &&
+        (connectorNames.size > 0 || automaticConnectorPolicyActive) &&
         !fullCatalogRequested;
     // When the connector catalog is active, filter directly from visibleActions
     // rather than advertisedActionsBeforeConnector. This ensures the connector
     // tier is an independent, template-declared surface that doesn't accidentally
     // narrow to just the compact-catalog builtins when shouldUseCompactMcpCatalogByDefault
     // would have activated the compact catalog for the same caller.
-    const advertisedActions = connectorCatalogActive
-        ? Object.fromEntries(Object.entries(visibleActions).filter(([name, entry]) => {
-            if (denyNames.has(name))
-                return false;
-            if (COMPACT_MCP_APP_CATALOG_BUILTINS.has(name))
+    const advertisedActionsBeforeToolSearchScope = appCatalog
+        ? Object.fromEntries(Object.entries(visibleActions).filter(([name]) => !denyNames.has(name)))
+        : connectorCatalogActive
+            ? Object.fromEntries(Object.entries(visibleActions).filter(([name, entry]) => {
+                if (denyNames.has(name))
+                    return false;
+                if (COMPACT_MCP_APP_CATALOG_BUILTINS.has(name))
+                    return true;
+                if (!connectorNames.has(name))
+                    return false;
+                if (externalAgentWritesAreAskAppOnly(config) &&
+                    entry.readOnly !== true) {
+                    return false;
+                }
                 return true;
-            if (!connectorNames.has(name))
-                return false;
-            if (externalAgentWritesAreAskAppOnly(config) &&
-                entry.readOnly !== true) {
-                return false;
-            }
-            return true;
-        }))
-        : advertisedActionsBeforeConnector;
+            }))
+            : advertisedActionsBeforeConnector;
+    const advertisedActions = scopeToolSearchToAdvertised(advertisedActionsBeforeToolSearchScope);
     if (fullCatalogRequested) {
         warnFullCatalogServed(Object.keys(advertisedActions).length);
     }
@@ -1389,8 +1449,10 @@ export async function createMCPServerForRequest(config, identity, requestMeta) {
                     annotations,
                 };
             }));
-            if (!compactMcpAppCatalog &&
-                !connectorCatalogActive &&
+            // `ask-agent` is the legacy full-catalog meta-tool; `ask_app` is the
+            // builtin every other tier carries. Gate on the one flag that means
+            // "this caller opted all the way in".
+            if (fullCatalogRequested &&
                 config.askAgent &&
                 hasMcpOAuthScope(effectiveIdentity?.oauthScopes, "mcp:write")) {
                 tools.push({
@@ -1436,7 +1498,7 @@ export async function createMCPServerForRequest(config, identity, requestMeta) {
         return withCallerContext(async () => {
             const { name, arguments: args } = request.params;
             if (name === "ask-agent" && config.askAgent) {
-                if (compactMcpAppCatalog || connectorCatalogActive) {
+                if (!fullCatalogRequested) {
                     return {
                         content: [{ type: "text", text: `Unknown tool: ${name}` }],
                         isError: true,
@@ -1483,12 +1545,14 @@ export async function createMCPServerForRequest(config, identity, requestMeta) {
                     };
                 }
             }
-            // Connector-catalog tier: when active, callableActions === advertisedActions
-            // (the filtered set). Non-listed tools are not callable — mirroring how
-            // compactMcpAppCatalog gates calls on advertisedActions.
-            const callableActions = compactMcpAppCatalog || connectorCatalogActive
-                ? advertisedActions
-                : actions;
+            // Every tier except the explicit full-catalog opt-in treats the
+            // advertised set as the authoritative callable surface: a name that
+            // was not listed is rejected, not merely hidden. Deriving this from
+            // the one opt-in flag rather than re-testing each tier is what keeps a
+            // newly added tier from silently defaulting to "everything callable".
+            const callableActions = fullCatalogRequested
+                ? actions
+                : advertisedActions;
             const entry = callableActions[name];
             if (!entry) {
                 return {

package/dist/mcp/oauth-client-metadata.js

@@ -170,12 +170,16 @@ function validateClientMetadataDocument(clientId, value) {
     if (tokenEndpointAuthMethod !== "none") {
         throw new Error("Only public Client ID Metadata clients are supported");
     }
+    // A grant type we do not support is not a reason to reject the document —
+    // clients advertise grants they use elsewhere (Claude.ai's CIMD document
+    // lists "urn:ietf:params:oauth:grant-type:jwt-bearer" next to the two we
+    // support). The token endpoint independently honors only
+    // "authorization_code"/"refresh_token" no matter what this list says.
     const grantTypes = parseStringArray(document.grant_types);
     if ((document.grant_types !== undefined &&
         (!Array.isArray(document.grant_types) ||
             grantTypes.length !== document.grant_types.length)) ||
-        grantTypes.length > 10 ||
-        !grantTypes.every((grant) => grant === "authorization_code" || grant === "refresh_token")) {
+        grantTypes.length > 10) {
         throw new Error("Client metadata document grant_types are unsupported");
     }
     const responseTypes = parseStringArray(document.response_types);

package/dist/mcp/screen-memory-stdio.d.ts

@@ -137,13 +137,13 @@ export declare function screenMemoryMcpToolDefinitions(): ({
     inputSchema: {
         type: string;
         properties: {
+            count?: undefined;
             query?: undefined;
             minutes?: undefined;
             limit?: undefined;
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
-            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;
@@ -159,6 +159,7 @@ export declare function screenMemoryMcpToolDefinitions(): ({
     inputSchema: {
         type: string;
         properties: {
+            count?: undefined;
             query: {
                 type: string;
                 description: string;
@@ -174,7 +175,6 @@ export declare function screenMemoryMcpToolDefinitions(): ({
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
-            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;
@@ -190,6 +190,7 @@ export declare function screenMemoryMcpToolDefinitions(): ({
     inputSchema: {
         type: string;
         properties: {
+            count?: undefined;
             minutes: {
                 type: string;
                 description: string;
@@ -199,7 +200,6 @@ export declare function screenMemoryMcpToolDefinitions(): ({
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
-            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;
@@ -216,6 +216,7 @@ export declare function screenMemoryMcpToolDefinitions(): ({
         type: string;
         required: string[];
         properties: {
+            count?: undefined;
             query: {
                 type: string;
                 description: string;
@@ -234,7 +235,6 @@ export declare function screenMemoryMcpToolDefinitions(): ({
             };
             timestamp?: undefined;
             chapterId?: undefined;
-            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;
@@ -250,6 +250,7 @@ export declare function screenMemoryMcpToolDefinitions(): ({
         type: string;
         required: string[];
         properties: {
+            count?: undefined;
             query?: undefined;
             minutes?: undefined;
             limit?: undefined;
@@ -263,7 +264,6 @@ export declare function screenMemoryMcpToolDefinitions(): ({
                 description: string;
             };
             chapterId?: undefined;
-            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             includeMicrophone?: undefined;
@@ -314,13 +314,13 @@ export declare function screenMemoryMcpToolDefinitions(): ({
         type: string;
         required: string[];
         properties: {
+            count?: undefined;
             query?: undefined;
             minutes?: undefined;
             limit?: undefined;
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
-            count?: undefined;
             startAt: {
                 type: string;
                 description: string;
@@ -349,13 +349,13 @@ export declare function screenMemoryMcpToolDefinitions(): ({
         type: string;
         required: string[];
         properties: {
+            count?: undefined;
             query?: undefined;
             minutes?: undefined;
             limit?: undefined;
             clientHint?: undefined;
             timestamp?: undefined;
             chapterId?: undefined;
-            count?: undefined;
             startAt?: undefined;
             endAt?: undefined;
             reason?: undefined;

package/dist/notifications/routes.d.ts

@@ -13,13 +13,13 @@
 export declare function createNotificationsHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<"" | import("./types.js").Notification[] | {
     count: number;
     updated?: undefined;
-    error?: undefined;
     ok?: undefined;
+    error?: undefined;
 } | {
     count?: undefined;
     updated: number;
-    error?: undefined;
     ok?: undefined;
+    error?: undefined;
 } | {
     count?: undefined;
     updated?: undefined;

package/dist/observability/routes.d.ts

@@ -41,16 +41,16 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     thumbsUpRate: number;
     avgEvalScore: number;
 } | {
+    error?: undefined;
     summary: import("./types.js").TraceSummary;
     spans: import("./types.js").TraceSpan[];
     id?: undefined;
-    error?: undefined;
     ok?: undefined;
 } | {
+    error?: undefined;
     summary?: undefined;
     spans?: undefined;
     id: string;
-    error?: undefined;
     ok?: undefined;
 } | {
     summary?: undefined;
@@ -59,9 +59,9 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     error: any;
     ok?: undefined;
 } | {
+    error?: undefined;
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
-    error?: undefined;
     ok: boolean;
 }>>;

package/dist/progress/routes.d.ts

@@ -15,6 +15,6 @@ export declare function createProgressHandler(): import("h3").EventHandlerWithFe
     error: string;
     ok?: undefined;
 } | {
-    ok: boolean;
     error?: undefined;
+    ok: boolean;
 }>>;

package/dist/provider-api/actions/custom-provider-registration.d.ts

@@ -75,7 +75,6 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
         user: "user";
     }>>;
 }, z.core.$strip>>, {
-    message?: undefined;
     deleted?: undefined;
     found?: undefined;
     providers: {
@@ -92,8 +91,8 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
     registered?: undefined;
     id?: undefined;
     label?: undefined;
-} | {
     message?: undefined;
+} | {
     deleted?: undefined;
     providers?: undefined;
     count?: undefined;
@@ -102,8 +101,8 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
     registered?: undefined;
     id?: undefined;
     label?: undefined;
-} | {
     message?: undefined;
+} | {
     deleted?: undefined;
     providers?: undefined;
     count?: undefined;
@@ -112,8 +111,8 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
     id: string;
     registered?: undefined;
     label?: undefined;
-} | {
     message?: undefined;
+} | {
     found?: undefined;
     providers?: undefined;
     count?: undefined;
@@ -122,6 +121,7 @@ export declare function createCustomProviderRegistrationAction<TSchema extends Z
     id: string;
     registered?: undefined;
     label?: undefined;
+    message?: undefined;
 } | {
     deleted?: undefined;
     found?: undefined;

package/dist/provider-api/actions/provider-api.d.ts

@@ -311,9 +311,9 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         notes?: string | undefined;
         scope?: "org" | "user" | undefined;
     }, {
-        deleted?: undefined;
         id?: undefined;
         provider?: undefined;
+        deleted?: undefined;
         found?: undefined;
         providers: {
             id: string;
@@ -329,9 +329,9 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         label?: undefined;
         message?: undefined;
     } | {
+        id?: undefined;
         deleted?: undefined;
         count?: undefined;
-        id?: undefined;
         providers?: undefined;
         found: boolean;
         provider: import("../custom-registry.js").CustomProviderConfig;
@@ -339,9 +339,9 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         label?: undefined;
         message?: undefined;
     } | {
+        provider?: undefined;
         deleted?: undefined;
         count?: undefined;
-        provider?: undefined;
         providers?: undefined;
         found: boolean;
         id: string;
@@ -349,9 +349,9 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         label?: undefined;
         message?: undefined;
     } | {
-        count?: undefined;
         provider?: undefined;
         found?: undefined;
+        count?: undefined;
         providers?: undefined;
         deleted: boolean;
         id: string;
@@ -359,10 +359,10 @@ export declare function createProviderApiActions(runtime: Pick<ProviderApiRuntim
         label?: undefined;
         message?: undefined;
     } | {
-        deleted?: undefined;
-        count?: undefined;
         provider?: undefined;
+        deleted?: undefined;
         found?: undefined;
+        count?: undefined;
         providers?: undefined;
         registered: boolean;
         id: string;

package/dist/secrets/routes.d.ts

@@ -34,37 +34,37 @@ export declare function createListSecretsHandler(): import("h3").EventHandlerWit
 /** POST /_agent-native/secrets/:key — write a secret. */
 export declare function createWriteSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: string;
-    ok?: undefined;
     status?: undefined;
+    ok?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
     status: string;
+    error?: undefined;
 } | {
-    ok?: undefined;
     error: string;
     removed?: undefined;
+    ok?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
     removed: boolean;
+    error?: undefined;
 }>>;
 /**
  * POST /_agent-native/secrets/:key/test — validate an optional candidate value
  * or the current stored value without changing anything.
  */
 export declare function createTestSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    ok?: undefined;
     error: string;
     note?: undefined;
+    ok?: undefined;
 } | {
-    error?: undefined;
     ok: boolean;
     note?: undefined;
-} | {
     error?: undefined;
+} | {
     ok: boolean;
     note: string;
+    error?: undefined;
 } | {
     note?: undefined;
     ok: boolean;
@@ -95,11 +95,11 @@ export interface AdHocSecretPayload {
 export declare function createAdHocSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<AdHocSecretPayload[] | {
     error: string;
 } | {
-    error?: undefined;
     ok: boolean;
     key: string;
-} | {
     error?: undefined;
+} | {
     ok: boolean;
     removed: boolean;
+    error?: undefined;
 }>>;