@agent-native/core 0.159.5 → 0.160.1

package/dist/cli/portal-transfer.js

@@ -0,0 +1,201 @@
+import { serializeBoundedRemoteJson } from "../integrations/remote-json-safety.js";
+import { appendCodeAgentTranscriptEvent } from "./code-agent-runs.js";
+export const PORTAL_TRANSFER_SCHEMA_VERSION = 1;
+export const PORTAL_TRANSFER_MAX_CONTEXT_BYTES = 900_000;
+const BINARY_FIELD_NAMES = new Set([
+    "base64",
+    "dataurl",
+    "image",
+    "imagebase64",
+    "imagedata",
+    "imagebytes",
+    "screenshot",
+    "screenshotbase64",
+    "screenshotdata",
+    "bytes",
+    "buffer",
+]);
+export function createPortalTransferContext(input) {
+    const sourceRunId = requireString(input.sourceRunId, "source run id");
+    const context = {
+        schemaVersion: PORTAL_TRANSFER_SCHEMA_VERSION,
+        sourceRunId,
+        ...(input.sourceStatus
+            ? { sourceStatus: requireString(input.sourceStatus, "source status") }
+            : {}),
+        ...(input.sourcePhase
+            ? { sourcePhase: requireString(input.sourcePhase, "source phase") }
+            : {}),
+        events: input.events.map((event, index) => normalizeSourceEvent(event, index)),
+    };
+    serializeBoundedRemoteJson(context, {
+        label: "Portal transcript context",
+        maxBytes: PORTAL_TRANSFER_MAX_CONTEXT_BYTES,
+    });
+    return context;
+}
+export function parsePortalTransferContext(value) {
+    if (value === undefined || value === null)
+        return null;
+    if (!isRecord(value) || value.schemaVersion !== 1) {
+        throw new Error("Portal transfer context has an unsupported version.");
+    }
+    const sourceRunId = requireString(value.sourceRunId, "source run id");
+    if (!Array.isArray(value.events)) {
+        throw new Error("Portal transfer context is missing transcript events.");
+    }
+    const events = value.events.map((event, index) => {
+        if (!isRecord(event)) {
+            throw new Error(`Portal transcript event ${index + 1} is invalid.`);
+        }
+        return normalizeSourceEvent(event, index);
+    });
+    const sourceStatus = optionalString(value.sourceStatus);
+    const sourcePhase = optionalString(value.sourcePhase);
+    const context = {
+        schemaVersion: 1,
+        sourceRunId,
+        ...(sourceStatus ? { sourceStatus } : {}),
+        ...(sourcePhase ? { sourcePhase } : {}),
+        events,
+    };
+    serializeBoundedRemoteJson(context, {
+        label: "Portal transcript context",
+        maxBytes: PORTAL_TRANSFER_MAX_CONTEXT_BYTES,
+    });
+    return context;
+}
+export function appendPortalTransferTranscript(context, runId) {
+    const targetRunId = requireString(runId, "target run id");
+    let appended = 0;
+    for (const event of context.events) {
+        appendCodeAgentTranscriptEvent({
+            id: event.id,
+            runId: targetRunId,
+            kind: event.kind,
+            message: event.message,
+            createdAt: event.createdAt,
+            ...(event.metadata
+                ? {
+                    metadata: {
+                        ...event.metadata,
+                        portalTransfer: {
+                            sourceRunId: context.sourceRunId,
+                            sourceEventId: event.id,
+                        },
+                    },
+                }
+                : {
+                    metadata: {
+                        portalTransfer: {
+                            sourceRunId: context.sourceRunId,
+                            sourceEventId: event.id,
+                        },
+                    },
+                }),
+            ...(event.signal ? { signal: event.signal } : {}),
+        });
+        appended++;
+    }
+    return appended;
+}
+export function portalTransferContinuationPrompt(input) {
+    return [
+        "[Portal session continuation]",
+        `This coding session was moved to ${requireString(input.hostLabel, "Portal host label")}.`,
+        `Portal handoff: ${requireString(input.handoffId, "Portal handoff id")}`,
+        `The preceding ${input.eventCount} transcript event${input.eventCount === 1 ? "" : "s"} came from the original computer and is part of this session context.`,
+        "Review the transferred transcript and Portal workspace before acting. Continue the unfinished task from the latest state, and do not repeat work that is already complete.",
+    ].join("\n");
+}
+function normalizeSourceEvent(value, index) {
+    const id = requireString(value.id, `transcript event ${index + 1} id`);
+    const kind = normalizeKind(value.kind ?? value.type, index);
+    const messageValue = value.message ?? value.text;
+    if (typeof messageValue !== "string") {
+        throw new Error(`Portal transcript event ${index + 1} is missing text.`);
+    }
+    const createdAt = requireString(value.createdAt, `transcript event ${index + 1} timestamp`);
+    const metadata = sanitizeMetadata(value.metadata);
+    const signal = value.signal === "credential-gap" ? "credential-gap" : undefined;
+    return {
+        schemaVersion: 1,
+        id,
+        kind,
+        message: messageValue,
+        createdAt,
+        ...(metadata ? { metadata } : {}),
+        ...(signal ? { signal } : {}),
+    };
+}
+function normalizeKind(value, index) {
+    const kind = typeof value === "string" ? value.trim().toLowerCase() : "";
+    if (kind === "user" ||
+        kind === "system" ||
+        kind === "note" ||
+        kind === "artifact" ||
+        kind === "status") {
+        return kind;
+    }
+    if (kind === "assistant" || kind === "human" || kind === "prompt") {
+        return kind === "assistant" ? "system" : "user";
+    }
+    throw new Error(`Portal transcript event ${index + 1} has an invalid kind.`);
+}
+function sanitizeMetadata(value) {
+    if (!isRecord(value))
+        return undefined;
+    const sanitized = sanitizeObject(value);
+    return Object.keys(sanitized).length > 0 ? sanitized : undefined;
+}
+function sanitizeObject(value) {
+    const result = {};
+    let binaryOmitted = false;
+    for (const [key, child] of Object.entries(value)) {
+        if (isBinaryFieldName(key)) {
+            binaryOmitted = true;
+            continue;
+        }
+        const sanitized = sanitizeValue(child);
+        if (sanitized !== undefined)
+            result[key] = sanitized;
+    }
+    if (binaryOmitted)
+        result.binaryContentOmitted = true;
+    return result;
+}
+function sanitizeValue(value) {
+    if (value === null ||
+        typeof value === "string" ||
+        typeof value === "number" ||
+        typeof value === "boolean") {
+        return value;
+    }
+    if (Array.isArray(value)) {
+        return value
+            .map((item) => sanitizeValue(item))
+            .filter((item) => item !== undefined);
+    }
+    if (isRecord(value))
+        return sanitizeObject(value);
+    return undefined;
+}
+function isBinaryFieldName(key) {
+    const normalized = key.toLowerCase().replace(/[^a-z0-9]/g, "");
+    return BINARY_FIELD_NAMES.has(normalized);
+}
+function isRecord(value) {
+    return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function requireString(value, label) {
+    const result = optionalString(value);
+    if (!result)
+        throw new Error(`Portal ${label} is missing.`);
+    return result;
+}
+function optionalString(value) {
+    if (typeof value !== "string")
+        return undefined;
+    const result = value.trim();
+    return result || undefined;
+}

package/dist/client/agent-chat-adapter.js

@@ -1,6 +1,6 @@
 import { unwrapAttachmentEnvelope } from "@agent-native/toolkit/composer/pasted-text";
 import { actionPreparationContinuationNote } from "../agent/action-continuation-guidance.js";
-import { LLM_MISSING_CREDENTIALS_ERROR_CODE, LLM_MISSING_CREDENTIALS_MESSAGE, } from "../agent/engine/credential-errors.js";
+import { formatLlmCredentialErrorMessage, isLlmCredentialError, LLM_MISSING_CREDENTIALS_ERROR_CODE, LLM_MISSING_CREDENTIALS_MESSAGE, } from "../agent/engine/credential-errors.js";
 import { ANALYTICS_CLIENT_PLATFORM_HEADER } from "../shared/analytics-platform.js";
 import { clearPendingTurnIfMatches, getActiveRun, setActiveRun, updateActiveRunSeq, clearActiveRun, clearActiveRunIfMatches, setPendingTurn, } from "./active-run-state.js";
 import { getAnalyticsClientPlatform } from "./analytics-platform.js";
@@ -199,6 +199,25 @@ const BACKGROUND_TERMINAL_REASON_MESSAGES = {
     missing_credentials: LLM_MISSING_CREDENTIALS_MESSAGE,
     turn_continuation_budget_exhausted: "This request needed more automatic continuations than allowed and was stopped. Try breaking it into smaller steps.",
 };
+/**
+ * Re-decide the mapped copy for whoever is reading it.
+ *
+ * The map above is client-authored copy for a server-produced code, and for the
+ * credential reasons that duplicates a decision the server already makes with
+ * `formatLlmCredentialErrorMessage({ visitorFacing })` — without the one input
+ * the decision needs. Earlier notes called this an unfixable residual gap on the
+ * grounds that the client cannot know the lane; the framing was wrong, because
+ * the lane is a fact about the deployment that the run snapshot can carry
+ * (`deploymentPaysForAi` on `/runs/active`). Everything else in the map is
+ * background-handoff copy that reads the same to either party.
+ */
+function laneAwareTerminalReasonMessage(mapped, terminalReason, deploymentPaysForAi) {
+    if (!mapped || !isLlmCredentialError(mapped, terminalReason))
+        return mapped;
+    return formatLlmCredentialErrorMessage({
+        visitorFacing: deploymentPaysForAi,
+    });
+}
 /**
  * `agent_runs.terminal_reason` values that mark a CHUNK boundary, not the end
  * of the turn — `markBackgroundContinuationChunkTerminal` (production-agent.ts)
@@ -2280,38 +2299,50 @@ export function createAgentChatAdapter(options) {
                     const hasErrorTerminalReason = rawTerminalReason.startsWith("error:");
                     const terminalReason = rawTerminalReason.replace(/^error:/, "");
                     const mappedMessage = terminalReason
-                        ? BACKGROUND_TERMINAL_REASON_MESSAGES[terminalReason]
+                        ? laneAwareTerminalReasonMessage(BACKGROUND_TERMINAL_REASON_MESSAGES[terminalReason], terminalReason, lastKnown?.deploymentPaysForAi === true)
                         : undefined;
                     const mappedErrorCode = terminalReason === "missing_api_key" ||
                         terminalReason === LLM_MISSING_CREDENTIALS_ERROR_CODE
                         ? LLM_MISSING_CREDENTIALS_ERROR_CODE
                         : terminalReason;
-                    if (mappedMessage) {
-                        yield* emitBackgroundTerminalError({
-                            message: mappedMessage,
-                            errorCode: mappedErrorCode,
-                            details: `terminal_reason: ${rawTerminalReason}`,
-                        });
-                        return;
-                    }
                     if (hasErrorTerminalReason) {
-                        if (lastRecoverableRunError) {
+                        // Never REPLACE the wording the server chose for this failure: a
+                        // deployment that pays for its own AI answers whoever is chatting
+                        // with one visitor line, and the map only knows the owner copy.
+                        // Only the captured error whose code IS the terminal reason is that
+                        // wording — an earlier auto-recoverable error in the same run is
+                        // stale (the cursor reset only clears it when the followed run
+                        // changes), and letting it outrank the terminal reason reports a
+                        // transient blip for a run that died of something else.
+                        const serverChosenError = lastRecoverableRunError?.errorCode === terminalReason
+                            ? lastRecoverableRunError
+                            : null;
+                        if (serverChosenError) {
                             yield* emitBackgroundTerminalError({
-                                message: lastRecoverableRunError.message,
-                                errorCode: lastRecoverableRunError.errorCode ||
+                                message: serverChosenError.message,
+                                errorCode: serverChosenError.errorCode ||
                                     mappedErrorCode ||
                                     "background_run_failed",
-                                details: lastRecoverableRunError.details,
+                                details: serverChosenError.details,
                             });
                             return;
                         }
                         yield* emitBackgroundTerminalError({
-                            message: "The agent's background run failed before its final response could be recovered. You can retry from the preserved chat context.",
+                            message: mappedMessage ??
+                                "The agent's background run failed before its final response could be recovered. You can retry from the preserved chat context.",
                             errorCode: mappedErrorCode || "background_run_failed",
                             details: `terminal_reason: ${rawTerminalReason}`,
                         });
                         return;
                     }
+                    if (mappedMessage) {
+                        yield* emitBackgroundTerminalError({
+                            message: mappedMessage,
+                            errorCode: mappedErrorCode,
+                            details: `terminal_reason: ${rawTerminalReason}`,
+                        });
+                        return;
+                    }
                     if (status === "completed") {
                         // The turn finished server-side; the events we managed to fold are
                         // the durable transcript. Never turn a terminal tool-only chunk

package/dist/client/error-format.js

@@ -1,3 +1,4 @@
+import { GATEWAY_UNAVAILABLE_VISITOR_MESSAGE } from "../agent/engine/credential-errors.js";
 /**
  * Append a Builder CTA markdown link to gateway errors that users can fix
  * outside the app. Used by both
@@ -33,8 +34,9 @@ function isSafeUpgradeUrl(url) {
 }
 export function formatChatErrorText(errorMessage, upgradeUrl, errorCode) {
     const normalized = normalizeChatError(errorMessage, errorCode);
-    if (errorCode === "gateway_not_enabled" ||
-        /space has not enabled the LLM gateway/i.test(normalized.message)) {
+    if (!isServerChosenVisitorMessage(normalized.message) &&
+        (errorCode === "gateway_not_enabled" ||
+            /space has not enabled the LLM gateway/i.test(normalized.message))) {
         return `Error: ${normalized.message}\n\n[${OPEN_BUILDER_SPACE_SETTINGS_LABEL}](${BUILDER_SPACE_SETTINGS_URL})`;
     }
     if (errorCode === "builder_gateway_error") {
@@ -49,6 +51,22 @@ export function formatChatErrorText(errorMessage, upgradeUrl, errorCode) {
     }
     return `Error: ${normalized.message}\n\n[${UPGRADE_AT_BUILDER_LABEL}](${upgradeUrl})`;
 }
+/**
+ * True when the server already decided what this reader may be told.
+ *
+ * A Builder-credits deployment answers every gateway rejection with one visitor
+ * line and keeps the real reason on `errorCode` for its owner. Every mapping
+ * below is keyed on that code, so re-deriving copy from it hands the visitor
+ * back the owner instruction the server just removed — "reconnect Builder in
+ * Settings" to someone with no account. This is an identity check against the
+ * exported constant, not a keyword match: the rewrite is the whole message.
+ *
+ * Deliberately not a `KNOWN_CHAT_ERROR_KEYS` entry: that map localizes copy,
+ * while this returns before any mapping runs at all.
+ */
+function isServerChosenVisitorMessage(text) {
+    return text === GATEWAY_UNAVAILABLE_VISITOR_MESSAGE;
+}
 const KNOWN_CHAT_ERROR_KEYS = new Map([
     [
         "No LLM provider is connected. Open this app's Manage agent > LLM, then connect Builder.io or add a provider key.",
@@ -200,6 +218,11 @@ export function normalizeChatError(errorMessage, errorCode) {
     const looksHtml = /<html[\s>]|<body[\s>]|<head[\s>]/i.test(raw);
     const text = looksHtml ? htmlToText(raw) : raw.trim();
     const providerPayload = looksHtml ? null : parseProviderErrorPayload(text);
+    // Ahead of every mapping below, including the provider-payload fallback: the
+    // server already chose this reader's message, and any re-derivation from a
+    // code hands a visitor the owner instruction it deliberately removed.
+    if (isServerChosenVisitorMessage(text))
+        return { message: text };
     const code = normalizeErrorCode(errorCode ?? providerPayload?.errorCode);
     const providerMessage = providerPayload?.errorCode === "overloaded_error"
         ? "The model provider is overloaded right now. Wait a moment, then retry."

package/dist/client/sse-event-processor.d.ts

@@ -91,6 +91,8 @@ export interface SSEEvent {
     upgradeUrl?: string;
     details?: string;
     recoverable?: boolean;
+    /** The engine said another attempt may succeed — see `AgentChatEvent`. */
+    providerRetryable?: boolean;
     maxIterations?: number;
 }
 export type AgentAutoContinueReason = "run_timeout" | "loop_limit" | "no_progress" | "stream_ended" | "stale_run";

package/dist/client/sse-event-processor.js

@@ -534,7 +534,12 @@ function isAutoRecoverableError(ev, errMsg) {
         code === "http_504" ||
         code === "rate_limited" ||
         code === "too_many_concurrent_requests" ||
-        code === "overloaded_error") {
+        code === "overloaded_error" ||
+        // A gateway stream that ended without a stop event. The partial turn is
+        // real, so this continues rather than retrying: the code carries what the
+        // message used to (`msg.includes("stream ended")` below), which a
+        // Builder-credits deployment replaces with its one visitor line.
+        code === "builder_gateway_stream_ended") {
         return true;
     }
     if (ev.recoverable === true)
@@ -548,6 +553,12 @@ function isAutoRecoverableError(ev, errMsg) {
         return false;
     if (msg.includes("daily gateway request cap"))
         return false;
+    // The engine's structural verdict, checked after every terminal code above so
+    // it can never revive a quota or auth rejection. It is the only retry signal
+    // left once the message is one visitor line: an upstream "Overloaded" carries
+    // no code, and its text is what the rewrite removed.
+    if (ev.providerRetryable === true)
+        return true;
     // "gateway error" intentionally absent — that's the no-detail Builder
     // gateway fallback and the production-agent already retries it
     // synchronously up to MAX_RETRIES before the error escapes here. Treating

package/dist/collab/awareness.d.ts

@@ -62,11 +62,11 @@ export declare const postAwareness: import("h3").EventHandlerWithFetch<import("h
     error: string;
     states?: undefined;
 } | {
-    error?: undefined;
     states: {
         clientId: number;
         state: string;
     }[];
+    error?: undefined;
 }>>;
 /**
  * GET /_agent-native/collab/:docId/users
@@ -77,9 +77,9 @@ export declare const getActiveUsers: import("h3").EventHandlerWithFetch<import("
     error: string;
     users?: undefined;
 } | {
-    error?: undefined;
     users: {
         clientId: number;
         lastSeen: number;
     }[];
+    error?: undefined;
 }>>;

package/dist/collab/struct-routes.d.ts

@@ -13,8 +13,8 @@
  * Body: { json: any, fieldName?: string, type?: "map"|"array", requestSource?: string }
  */
 export declare const postCollabJson: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    error: string;
     ok?: undefined;
+    error: string;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/jobs/background-automation-runner.js

@@ -1,5 +1,4 @@
 import { collectFinalResponseTextFromAgentEvents } from "../a2a/response-text.js";
-import { createBuilderEngine } from "../agent/engine/builder-engine.js";
 import { getStoredModelForEngine, normalizeModelForEngine, resolveEngine, } from "../agent/engine/index.js";
 import { actionsToEngineTools, filterInitialEngineTools, getOwnerActiveApiKey, } from "../agent/production-agent.js";
 import { runAgentLoopDirectWithSoftTimeout } from "../agent/run-loop-with-resume.js";
@@ -10,7 +9,6 @@ import { resolveAutomationExecutionIdentity, } from "../automations/service.js";
 import { createThread } from "../chat-threads/store.js";
 import { queryOrgMembers } from "../org/context.js";
 import { organizationIdFromResourceOwner, organizationResourceOwner, } from "../resources/store.js";
-import { resolveBuilderCredentialsDetailed } from "../server/credential-provider.js";
 import { runWithRequestContext, } from "../server/request-context.js";
 import { attachAutomationRunThread, finishAutomationRun, startAutomationRun, } from "./run-history.js";
 const BACKGROUND_RUN_STUCK_MS = 10 * 60_000;
@@ -238,23 +236,19 @@ async function executeBackgroundAutomation(options, deps, historyId) {
         const availableTools = actionsToEngineTools(actions);
         const tools = filterInitialEngineTools(availableTools, initialToolNames);
         const userApiKey = await getOwnerActiveApiKey(ownerEmail);
-        const resolvedEngine = deps.engine ??
+        // The run manager invokes its detached callback after the scheduler's
+        // setup stack has yielded, so the engine's credentials must be captured
+        // now, while the owner/org identity is explicit. Passing
+        // `credentialIdentity` is what makes resolveEngine capture them, on the
+        // same gateway lane the interactive path uses — a Builder-credits site has
+        // no per-user connection to find, so resolving that lane by hand here once
+        // left every scheduled automation dead while chat still worked.
+        const engine = deps.engine ??
             (await resolveEngine({
                 apiKey: userApiKey ?? deps.apiKey,
                 appId: deps.appId,
+                credentialIdentity: { userEmail: ownerEmail, orgId },
             }));
-        // The run manager invokes its detached callback after the scheduler's
-        // setup stack has yielded. Capture the verified Builder pair while the
-        // owner/org identity is explicit, then keep it on the engine so a
-        // concurrent serverless run cannot make this call look unauthenticated.
-        const engine = !deps.engine && resolvedEngine.name === "builder"
-            ? createBuilderEngine({
-                credentials: await resolveBuilderCredentialsDetailed({
-                    userEmail: ownerEmail,
-                    orgId,
-                }),
-            })
-            : resolvedEngine;
         const modelCandidate = automation.meta.model ??
             deps.model ??
             (await getStoredModelForEngine(engine, { appId: deps.appId })) ??

package/dist/notifications/routes.d.ts

@@ -11,23 +11,23 @@
  *   DELETE /_agent-native/notifications/:id         — delete
  */
 export declare function createNotificationsHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<"" | import("./types.js").Notification[] | {
-    error?: undefined;
     count: number;
     updated?: undefined;
+    error?: undefined;
     ok?: undefined;
 } | {
-    error?: undefined;
+    count?: undefined;
     updated: number;
+    error?: undefined;
     ok?: undefined;
-    count?: undefined;
 } | {
+    count?: undefined;
     updated?: undefined;
     error: string;
     ok?: undefined;
-    count?: undefined;
 } | {
-    error?: undefined;
+    count?: undefined;
     updated?: undefined;
+    error?: undefined;
     ok: boolean;
-    count?: undefined;
 }>>;

package/dist/observability/routes.d.ts

@@ -41,27 +41,27 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     thumbsUpRate: number;
     avgEvalScore: number;
 } | {
+    error?: undefined;
+    ok?: undefined;
     summary: import("./types.js").TraceSummary;
     spans: import("./types.js").TraceSpan[];
     id?: undefined;
+} | {
     error?: undefined;
     ok?: undefined;
-} | {
     summary?: undefined;
     spans?: undefined;
     id: string;
-    error?: undefined;
-    ok?: undefined;
 } | {
+    ok?: undefined;
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
     error: any;
-    ok?: undefined;
 } | {
+    error?: undefined;
     summary?: undefined;
     spans?: undefined;
     id?: undefined;
     ok: boolean;
-    error?: undefined;
 }>>;

package/dist/resources/handlers.d.ts

@@ -48,8 +48,8 @@ export declare function handleUpdateResource(event: any): Promise<import("./stor
 }>;
 /** DELETE /_agent-native/resources/:id — delete a resource */
 export declare function handleDeleteResource(event: any): Promise<{
-    ok?: undefined;
     error: string;
+    ok?: undefined;
 } | {
     error?: undefined;
     ok: boolean;

package/dist/secrets/register-framework-secrets.js

@@ -107,6 +107,31 @@ export function registerFrameworkSecrets() {
             });
         }
     }
+    if (!getRequiredSecret("ANTHROPIC_API_KEY")) {
+        registerRequiredSecret({
+            key: "ANTHROPIC_API_KEY",
+            label: "Anthropic API key",
+            description: "Bring your own Claude key instead of routing model calls through Builder.io.",
+            docsUrl: "https://console.anthropic.com/settings/keys",
+            scope: "user",
+            kind: "api-key",
+            required: false,
+            validator: async (value) => {
+                const response = await fetch("https://api.anthropic.com/v1/models", {
+                    headers: {
+                        "x-api-key": value,
+                        "anthropic-version": "2023-06-01",
+                    },
+                });
+                return response.ok
+                    ? { ok: true }
+                    : {
+                        ok: false,
+                        error: `Anthropic rejected the key (HTTP ${response.status}).`,
+                    };
+            },
+        });
+    }
     if (!getRequiredSecret("OPENAI_API_KEY")) {
         registerRequiredSecret({
             key: "OPENAI_API_KEY",

package/dist/secrets/routes.d.ts

@@ -34,37 +34,37 @@ export declare function createListSecretsHandler(): import("h3").EventHandlerWit
 /** POST /_agent-native/secrets/:key — write a secret. */
 export declare function createWriteSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
     error: string;
-    status?: undefined;
     ok?: undefined;
+    status?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     status: string;
-    error?: undefined;
 } | {
+    ok?: undefined;
     error: string;
     removed?: undefined;
-    ok?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     removed: boolean;
-    error?: undefined;
 }>>;
 /**
  * POST /_agent-native/secrets/:key/test — validate an optional candidate value
  * or the current stored value without changing anything.
  */
 export declare function createTestSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
+    ok?: undefined;
     error: string;
     note?: undefined;
-    ok?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     note?: undefined;
-    error?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     note: string;
-    error?: undefined;
 } | {
     note?: undefined;
     ok: boolean;
@@ -95,11 +95,11 @@ export interface AdHocSecretPayload {
 export declare function createAdHocSecretHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<AdHocSecretPayload[] | {
     error: string;
 } | {
+    error?: undefined;
     ok: boolean;
     key: string;
-    error?: undefined;
 } | {
+    error?: undefined;
     ok: boolean;
     removed: boolean;
-    error?: undefined;
 }>>;