@agent-native/core 0.228.2-nightly-20261113032548 → 0.228.2

package/dist/mcp/embed-app.js

@@ -31,6 +31,9 @@ export function embedApp(options = {}) {
     return {
         title,
         requiresEmbedSession: true,
+        // Claude reads this from the resources/read content item and moves the
+        // view to its side panel; hosts that do not know the field ignore it.
+        _meta: { ui: { preferredDisplayMode: "fullscreen" } },
         ...(options.description ? { description: options.description } : {}),
         html: (ctx) => {
             const remoteBridgeFallbackEnabled = ctx.catalogMode !== "directory";
@@ -1363,6 +1366,7 @@ export function embedApp(options = {}) {
         window.history.replaceState(window.history.state, "", localPathFromUrl(appUrl, false));
       } catch {}
       await mountTransplantedHtml(html, appUrl);
+      watchPageTools();
       embedSessionRefreshAttempts = 0;
       notifyHostHeightRepeatedly();
     }
@@ -1756,6 +1760,7 @@ export function embedApp(options = {}) {
       ${ctx.catalogMode === "directory" ? "" : 'frame.allow = "clipboard-read; clipboard-write";'}
       appFrame = frame;
       appFrameReady = false;
+      notifyViewToolsChanged();
       lastFrameSrc = src;
       appFrameDocumentState.loadGeneration += 1;
       frame.addEventListener("load", () => {
@@ -2642,6 +2647,226 @@ export function embedApp(options = {}) {
       if (bridge && (!appFrame || openAiBridge)) syncOpenAiBridge(bridge);
     }, { passive: true });
 
+    // App tools: the host calls these on this open view, so a "filter it" or
+    // "open that one" turn changes the panel in place instead of opening a new view.
+    const readViewToolName = "read_view";
+    const navigateViewToolName = "navigate_view";
+    const maxViewTextChars = 6000;
+    const maxPageTools = 60;
+    const pageToolWaitMs = 40000;
+    const pageToolOrigins = new Map();
+    let pageToolWatchStarted = false;
+
+    function appPageToolHelper() {
+      if (appFrame) return null;
+      const helper = window.__agentNativeWebMcp;
+      return helper && typeof helper.tools === "function" && typeof helper.call === "function"
+        ? helper
+        : null;
+    }
+
+    function currentViewUrl() {
+      if (appFrame) {
+        try {
+          return new URL(appFrame.src, window.location.href);
+          // coercion-ok: null means "no readable view URL"; read_view and navigate_view report it as an error
+        } catch {
+          return null;
+        }
+      }
+      return lastFrameSrc ? new URL(window.location.href) : null;
+    }
+
+    function readViewState() {
+      // A nested app frame is cross-origin and moves on its own, so its src is
+      // only the launch URL; reporting it would describe the wrong page.
+      if (appFrame) throw new Error("This host shows the app in a nested frame, so its current page can't be read.");
+      const url = currentViewUrl();
+      if (!url) throw new Error("No app page has loaded in this view yet.");
+      const state = {
+        path: localPathFromUrl(url, false),
+        title: document.title
+      };
+      {
+        const selection = typeof window.getSelection === "function"
+          ? String(window.getSelection() || "").trim()
+          : "";
+        if (selection) state.selectedText = selection.slice(0, maxViewTextChars);
+        const root = document.querySelector("main") || document.body;
+        state.visibleText = root
+          ? String(root.innerText || "").replace(/\\s+/g, " ").trim().slice(0, maxViewTextChars)
+          : "";
+      }
+      return state;
+    }
+
+    function navigateView(rawPath) {
+      const path = typeof rawPath === "string" ? rawPath.trim() : "";
+      if (!path.startsWith("/") || path.startsWith("//")) {
+        throw new Error("path must start with / and stay inside the open app, e.g. the path read_view returns.");
+      }
+      // The nested frame was launched on a session scoped to its start URL;
+      // pointing it at a bare app route would drop that session.
+      if (appFrame) {
+        throw new Error("This host shows the app in a nested frame, so it can't be moved from here.");
+      }
+      const base = currentViewUrl();
+      if (!base) throw new Error("No app page has loaded in this view yet.");
+      const target = new URL(path, base);
+      if (target.origin !== base.origin) throw new Error("path must stay inside the open app.");
+      const nextPath = localPathFromUrl(target, false);
+      // React Router reads the location on popstate, so a pushed entry plus a
+      // popstate event moves the transplanted app without reloading it.
+      const current = window.history.state;
+      const idx = current && typeof current.idx === "number" ? current.idx + 1 : 0;
+      window.history.pushState(
+        { usr: null, key: Math.random().toString(36).slice(2, 10), idx },
+        "",
+        nextPath
+      );
+      window.dispatchEvent(new PopStateEvent("popstate", { state: window.history.state }));
+      return { path: nextPath };
+    }
+
+    async function listViewTools() {
+      // A nested cross-origin frame can be neither read nor moved from here.
+      if (appFrame) return [];
+      const tools = [
+        {
+          name: readViewToolName,
+          title: "Read open app view",
+          description: "Read the app page open beside the chat: its path, title, selected text and visible text. Call it before acting on what the user is looking at.",
+          inputSchema: { type: "object", properties: {} },
+          annotations: { readOnlyHint: true }
+        },
+        {
+          name: navigateViewToolName,
+          title: "Navigate open app view",
+          description: "Show another page of the open app in place, such as a filtered list or one record. Pass a path in the form read_view returns.",
+          inputSchema: {
+            type: "object",
+            properties: {
+              path: {
+                type: "string",
+                description: "App path starting with /, in the form read_view returns, e.g. a list with a search query."
+              }
+            },
+            required: ["path"]
+          }
+        }
+      ];
+      const helper = appPageToolHelper();
+      if (!helper) return tools;
+      pageToolOrigins.clear();
+      try {
+        const summaries = await helper.tools();
+        for (const summary of (Array.isArray(summaries) ? summaries : []).slice(0, maxPageTools)) {
+          if (!summary || typeof summary.name !== "string") continue;
+          if (tools.some((tool) => tool.name === summary.name)) continue;
+          const full = typeof helper.describe === "function"
+            ? await helper.describe(summary.name, summary.origin)
+            : null;
+          const schema = full && full.inputSchema && full.inputSchema.type === "object"
+            ? full.inputSchema
+            : { type: "object", properties: {} };
+          tools.push({
+            name: summary.name,
+            ...(summary.title ? { title: summary.title } : {}),
+            description: String((full && full.description) || summary.description || summary.name),
+            inputSchema: schema,
+            ...(summary.readOnly ? { annotations: { readOnlyHint: true } } : {})
+          });
+          pageToolOrigins.set(summary.name, summary.origin);
+        }
+      } catch (err) {
+        console.warn("[agent-native] page tools unavailable to the MCP host", err);
+      }
+      return tools;
+    }
+
+    async function callViewTool(params) {
+      const record = objectValue(params);
+      const name = typeof record.name === "string" ? record.name : "";
+      const args = objectValue(record.arguments);
+      try {
+        let result;
+        if (name === readViewToolName) {
+          result = readViewState();
+        } else if (name === navigateViewToolName) {
+          result = navigateView(args.path);
+        } else {
+          const helper = appPageToolHelper();
+          if (!helper) throw new Error("Unknown view tool: " + name);
+          const origin = pageToolOrigins.get(name);
+          const outcome = await helper.call(name, args, {
+            waitMs: pageToolWaitMs,
+            ...(origin ? { origin } : {})
+          });
+          if (!outcome || outcome.state !== "done") {
+            throw new Error("Page tool " + name + " did not finish.");
+          }
+          if (!outcome.ok) throw new Error(outcome.error || "Page tool " + name + " failed.");
+          result = outcome.result;
+        }
+        const structured = result && typeof result === "object" && !Array.isArray(result)
+          ? result
+          : undefined;
+        return {
+          content: [{
+            type: "text",
+            text: typeof result === "string" ? result : JSON.stringify(result === undefined ? null : result)
+          }],
+          ...(structured ? { structuredContent: structured } : {})
+        };
+      } catch (err) {
+        return {
+          isError: true,
+          content: [{ type: "text", text: err && err.message ? err.message : String(err) }]
+        };
+      }
+    }
+
+    function notifyViewToolsChanged() {
+      if (app && typeof app.sendToolListChanged === "function") {
+        try {
+          app.sendToolListChanged();
+        } catch (error) {
+          console.warn("[agent-native] tools/list_changed notification failed", error);
+        }
+      }
+    }
+
+    // The app registers its WebMCP tools from module scripts that keep running
+    // after the transplant mounts, so the first list_changed can arrive before
+    // they exist. Re-announce when the helper appears and on every toolchange.
+    function watchPageTools() {
+      notifyViewToolsChanged();
+      if (pageToolWatchStarted) return;
+      pageToolWatchStarted = true;
+      let timer = null;
+      const schedule = () => {
+        clearTimeout(timer);
+        timer = setTimeout(notifyViewToolsChanged, 250);
+      };
+      let watchedContext = null;
+      let helperSeen = false;
+      let ticks = 0;
+      const check = () => {
+        const context = document.modelContext;
+        if (context && context !== watchedContext && typeof context.addEventListener === "function") {
+          context.addEventListener("toolchange", schedule);
+          watchedContext = context;
+        }
+        if (!helperSeen && appPageToolHelper()) {
+          helperSeen = true;
+          schedule();
+        }
+        if ((helperSeen && watchedContext) || ++ticks >= 20) clearInterval(poll);
+      };
+      const poll = setInterval(check, 500);
+      check();
+    }
+
     function createNativeMcpAppsBridge() {
       let rpcId = 0;
       let connectPromise = null;
@@ -2745,7 +2970,10 @@ export function embedApp(options = {}) {
               "ui/initialize",
               {
                 appInfo: { name: "Agent-Native Embed", version: "1.0.0" },
-                appCapabilities: {},
+                appCapabilities: {
+                  availableDisplayModes: ["inline", "fullscreen"],
+                  tools: { listChanged: true }
+                },
                 protocolVersion: "2026-01-26"
               },
               nativeBridgeInitializeTimeoutMs
@@ -2791,17 +3019,43 @@ export function embedApp(options = {}) {
         sendSizeChanged(params) {
           rpcNotify("ui/notifications/size-changed", objectValue(params));
         },
+        sendToolListChanged() {
+          if (connectPromise) rpcNotify("notifications/tools/list_changed", {});
+        },
         async sendMessage(params) {
           await nativeApp.connect();
           return await rpcRequest("ui/message", objectValue(params));
         }
       };
 
+      async function answerHostRequest(message) {
+        let reply;
+        try {
+          if (message.method === "tools/list") {
+            reply = { result: { tools: await listViewTools() } };
+          } else if (message.method === "tools/call") {
+            reply = { result: await callViewTool(message.params) };
+          } else if (message.method === "ping" || message.method === "ui/resource-teardown") {
+            reply = { result: {} };
+          } else {
+            reply = { error: { code: -32601, message: "Method not found: " + message.method } };
+          }
+        } catch (err) {
+          reply = { error: { code: -32603, message: err && err.message ? err.message : String(err) } };
+        }
+        window.parent.postMessage({ jsonrpc: "2.0", id: message.id, ...reply }, "*");
+      }
+
       function onMessage(event) {
         if (event.source !== window.parent) return;
         const message = event.data;
         if (!message || message.jsonrpc !== "2.0") return;
-        if (typeof message.id === "number" || typeof message.id === "string") {
+        const hasId = typeof message.id === "number" || typeof message.id === "string";
+        if (hasId && typeof message.method === "string") {
+          void answerHostRequest(message);
+          return;
+        }
+        if (hasId) {
           settleRpcResponse(message);
           return;
         }
@@ -2881,9 +3135,11 @@ export function embedApp(options = {}) {
       const { App } = await import("${MCP_APP_IMPORT}");
       app = new App(
         { name: "Agent-Native Embed", version: "1.0.0" },
-        {},
+        { availableDisplayModes: ["inline", "fullscreen"], tools: { listChanged: true } },
         { autoResize: false }
       );
+      app.onlisttools = async () => ({ tools: await listViewTools() });
+      app.oncalltool = async (params) => await callViewTool(params);
       appConnectPromise = null;
       app.ontoolinput = (params) => {
         toolInput = params.arguments || {};

package/dist/mcp/oauth-route.js

@@ -310,6 +310,13 @@ function protectedResourcePathFromRequest(event) {
     pathname = pathname.replace(/\/+$/, "");
     if (!pathname || pathname === "/")
         return undefined;
+    // RFC 9728 inserts the whole resource path after the well-known segment, so
+    // a mounted app (resource /dispatch/mcp) is asked about /dispatch/mcp.
+    const issuer = getMcpOAuthIssuer(event);
+    const basePath = issuer ? new URL(issuer).pathname.replace(/\/+$/, "") : "";
+    if (basePath && pathname.startsWith(`${basePath}/`)) {
+        pathname = pathname.slice(basePath.length);
+    }
     return ([
         MCP_PUBLIC_ROUTE_PREFIX,
         MCP_LEGACY_ROUTE_PREFIX,

package/dist/mcp/screen-memory-stdio.d.ts

@@ -283,20 +283,20 @@ export declare function screenMemoryMcpToolDefinitions(): ({
                 type: string;
             };
             startAt: {
-                description?: undefined;
                 type: string;
+                description?: undefined;
             };
             endAt: {
-                description?: undefined;
                 type: string;
+                description?: undefined;
             };
             count: {
                 type: string;
                 description: string;
             };
             reason: {
-                description?: undefined;
                 type: string;
+                description?: undefined;
             };
             includeMicrophone?: undefined;
             includeSystemAudio?: undefined;

package/dist/notifications/routes.d.ts

@@ -1,18 +1,18 @@
 export declare function createNotificationsHandler(): import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<"" | import("./types.js").Notification[] | {
     error?: undefined;
-    ok?: undefined;
     count: number;
     updated?: undefined;
+    ok?: undefined;
 } | {
     error?: undefined;
-    ok?: undefined;
     count?: undefined;
     updated: number;
-} | {
     ok?: undefined;
+} | {
     count?: undefined;
     updated?: undefined;
     error: string;
+    ok?: undefined;
 } | {
     error?: undefined;
     count?: undefined;

package/dist/observability/routes.d.ts

@@ -27,10 +27,10 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     thumbsUpRate: number;
     avgEvalScore: number;
 } | {
-    summary?: undefined;
     ok?: undefined;
     error: string;
     message: string;
+    summary?: undefined;
     spans?: undefined;
 } | {
     error?: undefined;
@@ -40,30 +40,30 @@ export declare function createObservabilityHandler(): import("h3").EventHandlerW
     spans: import("./types.js").TraceSpan[];
 } | {
     error?: undefined;
-    summary?: undefined;
     ok?: undefined;
     message?: undefined;
+    summary?: undefined;
     spans?: undefined;
     traceMissing: true;
     id: string;
 } | {
     error?: undefined;
-    summary?: undefined;
     ok?: undefined;
     message?: undefined;
+    summary?: undefined;
     spans?: undefined;
     traceMissing?: undefined;
     id: string;
 } | {
-    summary?: undefined;
     ok?: undefined;
     message?: undefined;
+    summary?: undefined;
     spans?: undefined;
     error: any;
 } | {
     error?: undefined;
-    summary?: undefined;
     message?: undefined;
+    summary?: undefined;
     spans?: undefined;
     ok: boolean;
 }>>;

package/dist/org/index.d.ts

@@ -180,9 +180,9 @@ export declare const getMyOrgHandler: import("h3").EventHandlerWithFetch<import(
     soloDeploymentAdmin: boolean | undefined;
 }>>;
 export declare const createOrgHandler: import("h3").EventHandlerWithFetch<import("h3").EventHandlerRequest, Promise<{
-    success: boolean;
     id?: undefined;
     name?: undefined;
+    success: boolean;
     role?: undefined;
 } | {
     success?: undefined;

package/dist/secrets/api-keys.js

@@ -10,8 +10,9 @@ import { readOrgMemberRole } from "../server/personal-provider-key-policy.js";
 import { canonicalSecretKey, secretKeyNames } from "./key-aliases.js";
 import { resolveSecretManagedBy } from "./managed-keys.js";
 import { getRequiredSecret, listRequiredSecrets, } from "./register.js";
-import { deleteAppSecret, listAppSecretsForScope, VAULT_SYNC_DESCRIPTION_PREFIX, } from "./storage.js";
+import { deleteAppSecret, listAppSecretsForScope, } from "./storage.js";
 import { describeSecretUsage } from "./usage.js";
+import { isVaultManagedSecret } from "./vault-managed.js";
 /**
  * The rows the resolver reads for the caller, in its precedence order:
  * personal, the pre-organization solo row, then the organization's.
@@ -63,7 +64,7 @@ function toEntry(caller, meta, owner, manages) {
     const registered = getRequiredSecret(meta.key);
     const managedBy = resolveSecretManagedBy(meta.key);
     const provider = providerForName(meta.key);
-    const vault = isVaultSynced(meta.scope, meta.description);
+    const vault = isVaultSynced(meta.scope, meta);
     const mayChange = !managedBy && !vault && (owner === "user" || manages);
     // Replace writes through the routes' own target, so it only applies when
     // that target is this row; otherwise it would add a second row instead.
@@ -155,9 +156,9 @@ export async function listApiKeys(caller) {
         canManageOrg: manages,
     };
 }
-/** Vault writes shared rows with this description; a user's own rows are never synced. */
-function isVaultSynced(scope, description) {
-    return (scope !== "user" && !!description?.startsWith(VAULT_SYNC_DESCRIPTION_PREFIX));
+/** The Vault owns the shared rows it writes; a user's own rows never belong to it. */
+function isVaultSynced(scope, meta) {
+    return scope !== "user" && isVaultManagedSecret(meta);
 }
 /**
  * Delete one saved key row. A provider key also takes its endpoint and older
@@ -181,7 +182,7 @@ export async function deleteApiKey(caller, input) {
     const row = rows.find((meta) => meta.key === input.name);
     if (!row)
         return { status: "not-found" };
-    if (isVaultSynced(storedScope, row.description))
+    if (isVaultSynced(storedScope, row))
         return { status: "vault" };
     const provider = AGENT_PROVIDER_CATALOG.find((option) => option.id === providerForName(input.name));
     const names = provider
@@ -198,7 +199,7 @@ export async function deleteApiKey(caller, input) {
             continue;
         // Vault owns its rows, and a managed name is never the user's to delete,
         // even when it sits beside the key being removed.
-        if (isVaultSynced(storedScope, meta.description))
+        if (isVaultSynced(storedScope, meta))
             continue;
         if (resolveSecretManagedBy(name))
             continue;

package/dist/secrets/index.d.ts

@@ -1,5 +1,6 @@
 export { registerRequiredSecret, listRequiredSecrets, getRequiredSecret, registerSecretUsage, getRegisteredSecretUsage, __resetSecretsRegistry, type RegisteredSecret, type SecretUsage, type SecretManagedBy, type SecretScope, type SecretKind, type SecretValidator, type ValidatorResult, } from "./register.js";
-export { writeAppSecret, readAppSecret, hasAppSecret, readAppSecretMeta, deleteAppSecret, getAppSecretMeta, listAppSecretsForScope, last4, VAULT_SYNC_DESCRIPTION_PREFIX, type SecretRef, type WriteSecretArgs, type ReadSecretResult, type SecretMeta, } from "./storage.js";
+export { writeAppSecret, readAppSecret, hasAppSecret, readAppSecretMeta, readAppSecretMetaById, deleteAppSecret, deleteAppSecretById, getAppSecretMeta, listAppSecretsForScope, listAppSecretSummaries, updateAppSecretById, AppSecretKeyConflictError, last4, type SecretRef, type WriteSecretArgs, type ReadSecretResult, type SecretMeta, type AppSecretSummary, type UpdateAppSecretPatch, } from "./storage.js";
+export { VAULT_SYNC_DESCRIPTION_PREFIX, isVaultManagedSecret, } from "./vault-managed.js";
 export { APP_SECRETS_CREATE_SQL, appSecrets } from "./schema.js";
 export { encryptSecretValue, decryptSecretValue, isEncryptedSecretValue, } from "./crypto.js";
 export { createListSecretsHandler, createWriteSecretHandler, createTestSecretHandler, createAdHocSecretHandler, type SecretStatusPayload, type AdHocSecretPayload, } from "./routes.js";

package/dist/secrets/index.js

@@ -1,5 +1,6 @@
 export { registerRequiredSecret, listRequiredSecrets, getRequiredSecret, registerSecretUsage, getRegisteredSecretUsage, __resetSecretsRegistry, } from "./register.js";
-export { writeAppSecret, readAppSecret, hasAppSecret, readAppSecretMeta, deleteAppSecret, getAppSecretMeta, listAppSecretsForScope, last4, VAULT_SYNC_DESCRIPTION_PREFIX, } from "./storage.js";
+export { writeAppSecret, readAppSecret, hasAppSecret, readAppSecretMeta, readAppSecretMetaById, deleteAppSecret, deleteAppSecretById, getAppSecretMeta, listAppSecretsForScope, listAppSecretSummaries, updateAppSecretById, AppSecretKeyConflictError, last4, } from "./storage.js";
+export { VAULT_SYNC_DESCRIPTION_PREFIX, isVaultManagedSecret, } from "./vault-managed.js";
 export { APP_SECRETS_CREATE_SQL, appSecrets } from "./schema.js";
 export { encryptSecretValue, decryptSecretValue, isEncryptedSecretValue, } from "./crypto.js";
 export { createListSecretsHandler, createWriteSecretHandler, createTestSecretHandler, createAdHocSecretHandler, } from "./routes.js";

package/dist/secrets/routes.d.ts

@@ -55,14 +55,14 @@ export declare function createWriteSecretHandler(): import("h3").EventHandlerWit
     errorCode: "secret_managed_elsewhere";
     managedBy: SecretManagedBy;
 } | {
-    errorCode?: undefined;
-    error: string;
     ok?: undefined;
+    error: string;
+    errorCode?: undefined;
     status?: undefined;
 } | {
+    ok?: undefined;
     error: string;
     errorCode: string;
-    ok?: undefined;
     status?: undefined;
 } | {
     error?: undefined;

package/dist/secrets/routes.js

@@ -51,17 +51,16 @@ import { PERSONAL_PROVIDER_KEYS_RESTRICTED_ERROR_CODE, resolvePersonalProviderKe
 import { canonicalSecretKey, secretKeyNames } from "./key-aliases.js";
 import { isManagedDeleteAllowed, managedDeleteRefusal, resolveSecretManagedBy, } from "./managed-keys.js";
 import { listRequiredSecrets, getRequiredSecret, } from "./register.js";
-import { writeAppSecret, updateAppSecretUrlAllowlist, deleteAppSecret, last4, listAppSecretsForScope, readAppSecretMeta, VAULT_SYNC_DESCRIPTION_PREFIX, } from "./storage.js";
+import { writeAppSecret, updateAppSecretUrlAllowlist, deleteAppSecret, last4, listAppSecretsForScope, readAppSecretMeta, } from "./storage.js";
 import { registeredUrlAllowlist, validateUrlAllowlist, } from "./substitution.js";
 import { describeSecretUsage } from "./usage.js";
+import { isVaultManagedSecret } from "./vault-managed.js";
 export const SECRET_REJECTED_ERROR_CODE = "secret_rejected";
 export const SECRET_VALIDATION_UNAVAILABLE_ERROR_CODE = "secret_validation_unavailable";
-function secretSource(scope, description) {
+function secretSource(scope, meta) {
     if (scope === "user")
         return "personal";
-    return description?.startsWith(VAULT_SYNC_DESCRIPTION_PREFIX)
-        ? "vault"
-        : "workspace";
+    return isVaultManagedSecret(meta) ? "vault" : "workspace";
 }
 const NOT_RESOLVED = {
     value: null,
@@ -216,7 +215,7 @@ export function createListSecretsHandler() {
             const meta = await readAppSecretMeta(hit);
             base.last4 = meta?.last4 || last4(effective.value);
             base.updatedAt = meta?.updatedAt;
-            base.source = secretSource(hit.scope, meta?.description);
+            base.source = secretSource(hit.scope, meta);
             base.managedHere = hit.scope === secret.scope && hit.scopeId === scopeId;
             if (base.managedHere && secret.scope === "user") {
                 const shared = await asRequestUser(event, () => resolveSecretWithAliasesDetailed(secret.key, {
@@ -233,7 +232,7 @@ export function createListSecretsHandler() {
                             scopeId: shared.scopeId,
                         })
                         : null;
-                    const sharedSource = secretSource(shared.source, sharedMeta?.description);
+                    const sharedSource = secretSource(shared.source, sharedMeta);
                     base.overrides = sharedSource === "vault" ? "vault" : "workspace";
                 }
             }
@@ -513,7 +512,7 @@ function metaToPayload(meta) {
         name: meta.key,
         scope: meta.scope,
         scopeId: meta.scopeId,
-        source: secretSource(meta.scope, meta.description),
+        source: secretSource(meta.scope, meta),
         description: meta.description,
         last4: meta.last4,
         urlAllowlist: meta.urlAllowlist,

package/dist/secrets/schema.d.ts

@@ -138,6 +138,57 @@ export declare const appSecrets: import("drizzle-orm/pg-core").PgTableWithColumn
             identity: undefined;
             generated: undefined;
         }, {}, {}>;
+        label: import("drizzle-orm/pg-core").PgColumn<{
+            name: "label";
+            tableName: "app_secrets";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        provider: import("drizzle-orm/pg-core").PgColumn<{
+            name: "provider";
+            tableName: "app_secrets";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
+        createdBy: import("drizzle-orm/pg-core").PgColumn<{
+            name: "created_by";
+            tableName: "app_secrets";
+            dataType: "string";
+            columnType: "PgText";
+            data: string;
+            driverParam: string;
+            notNull: false;
+            hasDefault: false;
+            isPrimaryKey: false;
+            isAutoincrement: false;
+            hasRuntimeDefault: false;
+            enumValues: [string, ...string[]];
+            baseColumn: never;
+            identity: undefined;
+            generated: undefined;
+        }, {}, {}>;
         createdAt: import("drizzle-orm/pg-core").PgColumn<{
             name: "created_at";
             tableName: "app_secrets";

package/dist/secrets/schema.js

@@ -8,6 +8,9 @@ export const appSecrets = table("app_secrets", {
     sharedEncryptedValue: text("shared_encrypted_value"),
     description: text("description"),
     urlAllowlist: text("url_allowlist"),
+    label: text("label"),
+    provider: text("provider"),
+    createdBy: text("created_by"),
     createdAt: bigint("created_at", { mode: "number" }).notNull(),
     updatedAt: bigint("updated_at", { mode: "number" }).notNull(),
 });