@inkeep/agents-core 0.0.0-dev-20260310215636 → 0.0.0-dev-20260310235813

package/dist/auth/auth.d.ts

@@ -4,7 +4,7 @@ import * as zod0 from "zod";
 import * as better_auth0 from "better-auth";
 import { BetterAuthAdvancedOptions } from "better-auth";
 import * as _better_auth_sso0 from "@better-auth/sso";
-import * as better_auth_plugins20 from "better-auth/plugins";
+import * as better_auth_plugins0 from "better-auth/plugins";
 import { GoogleOptions } from "better-auth/social-providers";
 
 //#region src/auth/auth.d.ts
@@ -277,7 +277,7 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
         handler: (inputContext: better_auth0.MiddlewareInputContext<better_auth0.MiddlewareOptions>) => Promise<void>;
       }[];
     };
-    options: better_auth_plugins20.BearerOptions | undefined;
+    options: better_auth_plugins0.BearerOptions | undefined;
   }, {
     id: "sso";
     endpoints: {
@@ -1268,30 +1268,30 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
         handler: (inputContext: better_auth0.MiddlewareInputContext<better_auth0.MiddlewareOptions>) => Promise<void>;
       }[];
     };
-  }, better_auth_plugins20.DefaultOrganizationPlugin<{
+  }, better_auth_plugins0.DefaultOrganizationPlugin<{
     allowUserToCreateOrganization: true;
-    ac: better_auth_plugins20.AccessControl;
+    ac: better_auth_plugins0.AccessControl;
     roles: {
       member: {
-        authorize<K_1 extends "project" | "organization" | "team" | "member" | "ac" | "invitation">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins20.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins20.Statements>[key] | {
-          actions: better_auth_plugins20.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins20.Statements>[key];
+        authorize<K_1 extends "organization" | "member" | "invitation" | "project" | "ac" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins0.Statements>[key] | {
+          actions: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins0.Statements>[key];
           connector: "OR" | "AND";
-        } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins20.AuthorizeResponse;
-        statements: better_auth_plugins20.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins20.Statements>;
+        } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
+        statements: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins0.Statements>;
       };
       admin: {
-        authorize<K_1 extends "project" | "organization" | "team" | "member" | "ac" | "invitation">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins20.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins20.Statements>[key] | {
-          actions: better_auth_plugins20.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins20.Statements>[key];
+        authorize<K_1 extends "organization" | "member" | "invitation" | "project" | "ac" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins0.Statements>[key] | {
+          actions: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins0.Statements>[key];
           connector: "OR" | "AND";
-        } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins20.AuthorizeResponse;
-        statements: better_auth_plugins20.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins20.Statements>;
+        } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
+        statements: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins0.Statements>;
       };
       owner: {
-        authorize<K_1 extends "project" | "organization" | "team" | "member" | "ac" | "invitation">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins20.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins20.Statements>[key] | {
-          actions: better_auth_plugins20.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins20.Statements>[key];
+        authorize<K_1 extends "organization" | "member" | "invitation" | "project" | "ac" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins0.Statements>[key] | {
+          actions: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins0.Statements>[key];
           connector: "OR" | "AND";
-        } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins20.AuthorizeResponse;
-        statements: better_auth_plugins20.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins20.Statements>;
+        } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
+        statements: better_auth_plugins0.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins0.Statements>;
       };
     };
     creatorRole: "admin";
@@ -1302,9 +1302,9 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
       id: string;
       role: string;
       email: string;
-      organization: better_auth_plugins20.Organization;
-      invitation: better_auth_plugins20.Invitation;
-      inviter: better_auth_plugins20.Member & {
+      organization: better_auth_plugins0.Organization;
+      invitation: better_auth_plugins0.Invitation;
+      inviter: better_auth_plugins0.Member & {
         user: better_auth0.User;
       };
     }): Promise<void>;
@@ -1339,28 +1339,28 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
         user,
         organization: org
       }: {
-        invitation: better_auth_plugins20.Invitation & Record<string, any>;
-        member: better_auth_plugins20.Member & Record<string, any>;
+        invitation: better_auth_plugins0.Invitation & Record<string, any>;
+        member: better_auth_plugins0.Member & Record<string, any>;
         user: better_auth0.User & Record<string, any>;
-        organization: better_auth_plugins20.Organization & Record<string, any>;
+        organization: better_auth_plugins0.Organization & Record<string, any>;
       }) => Promise<void>;
       beforeUpdateMemberRole: ({
         member,
         organization: org,
         newRole
       }: {
-        member: better_auth_plugins20.Member & Record<string, any>;
+        member: better_auth_plugins0.Member & Record<string, any>;
         newRole: string;
         user: better_auth0.User & Record<string, any>;
-        organization: better_auth_plugins20.Organization & Record<string, any>;
+        organization: better_auth_plugins0.Organization & Record<string, any>;
       }) => Promise<void>;
       beforeRemoveMember: ({
         member,
         organization: org
       }: {
-        member: better_auth_plugins20.Member & Record<string, any>;
+        member: better_auth_plugins0.Member & Record<string, any>;
         user: better_auth0.User & Record<string, any>;
-        organization: better_auth_plugins20.Organization & Record<string, any>;
+        organization: better_auth_plugins0.Organization & Record<string, any>;
       }) => Promise<void>;
     };
   }>, {
@@ -1701,8 +1701,8 @@ declare function createAuth(config: BetterAuthConfig): better_auth0.Auth<{
       readonly AUTHENTICATION_REQUIRED: "Authentication required";
     };
     options: Partial<{
-      expiresIn: better_auth_plugins20.TimeString;
-      interval: better_auth_plugins20.TimeString;
+      expiresIn: better_auth_plugins0.TimeString;
+      interval: better_auth_plugins0.TimeString;
       deviceCodeLength: number;
       userCodeLength: number;
       schema: {

package/dist/auth/permissions.d.ts

@@ -1,29 +1,29 @@
-import * as better_auth_plugins0 from "better-auth/plugins";
+import * as better_auth_plugins35 from "better-auth/plugins";
 import { AccessControl } from "better-auth/plugins/access";
 import { organizationClient } from "better-auth/client/plugins";
 
 //#region src/auth/permissions.d.ts
 declare const ac: AccessControl;
 declare const memberRole: {
-  authorize<K_1 extends "project" | "organization" | "team" | "member" | "ac" | "invitation">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins0.Statements>[key] | {
-    actions: better_auth_plugins0.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins0.Statements>[key];
+  authorize<K_1 extends "organization" | "member" | "invitation" | "project" | "ac" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins35.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins35.Statements>[key] | {
+    actions: better_auth_plugins35.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins35.Statements>[key];
     connector: "OR" | "AND";
-  } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
-  statements: better_auth_plugins0.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins0.Statements>;
+  } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins35.AuthorizeResponse;
+  statements: better_auth_plugins35.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins35.Statements>;
 };
 declare const adminRole: {
-  authorize<K_1 extends "project" | "organization" | "team" | "member" | "ac" | "invitation">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins0.Statements>[key] | {
-    actions: better_auth_plugins0.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins0.Statements>[key];
+  authorize<K_1 extends "organization" | "member" | "invitation" | "project" | "ac" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins35.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins35.Statements>[key] | {
+    actions: better_auth_plugins35.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins35.Statements>[key];
     connector: "OR" | "AND";
-  } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
-  statements: better_auth_plugins0.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins0.Statements>;
+  } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins35.AuthorizeResponse;
+  statements: better_auth_plugins35.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins35.Statements>;
 };
 declare const ownerRole: {
-  authorize<K_1 extends "project" | "organization" | "team" | "member" | "ac" | "invitation">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins0.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins0.Statements>[key] | {
-    actions: better_auth_plugins0.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins0.Statements>[key];
+  authorize<K_1 extends "organization" | "member" | "invitation" | "project" | "ac" | "team">(request: K_1 extends infer T extends K ? { [key in T]?: better_auth_plugins35.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins35.Statements>[key] | {
+    actions: better_auth_plugins35.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins35.Statements>[key];
     connector: "OR" | "AND";
-  } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins0.AuthorizeResponse;
-  statements: better_auth_plugins0.Subset<"project" | "organization" | "team" | "member" | "ac" | "invitation", better_auth_plugins0.Statements>;
+  } | undefined } : never, connector?: "OR" | "AND"): better_auth_plugins35.AuthorizeResponse;
+  statements: better_auth_plugins35.Subset<"organization" | "member" | "invitation" | "project" | "ac" | "team", better_auth_plugins35.Statements>;
 };
 //#endregion
 export { ac, adminRole, memberRole, organizationClient, ownerRole };

package/dist/client-exports.d.ts

@@ -19,8 +19,9 @@ declare const FullAgentDefinitionSchema: z.ZodObject<{
   subAgents: z.ZodRecord<z.ZodString, z.ZodUnion<readonly [z.ZodObject<{
     id: z.ZodString;
     name: z.ZodString;
+    createdAt: z.ZodOptional<z.ZodString>;
+    updatedAt: z.ZodOptional<z.ZodString>;
     description: z.ZodOptional<z.ZodNullable<z.ZodString>>;
-    conversationHistoryConfig: z.ZodOptional<z.ZodNullable<z.ZodType<ConversationHistoryConfig, ConversationHistoryConfig, z.core.$ZodTypeInternals<ConversationHistoryConfig, ConversationHistoryConfig>>>>;
     models: z.ZodOptional<z.ZodObject<{
       base: z.ZodOptional<z.ZodObject<{
         model: z.ZodOptional<z.ZodString>;
@@ -35,8 +36,7 @@ declare const FullAgentDefinitionSchema: z.ZodObject<{
         providerOptions: z.ZodOptional<z.ZodRecord<z.ZodString, z.ZodAny>>;
       }, z.core.$strip>>;
     }, z.core.$strip>>;
-    createdAt: z.ZodOptional<z.ZodString>;
-    updatedAt: z.ZodOptional<z.ZodString>;
+    conversationHistoryConfig: z.ZodOptional<z.ZodNullable<z.ZodType<ConversationHistoryConfig, ConversationHistoryConfig, z.core.$ZodTypeInternals<ConversationHistoryConfig, ConversationHistoryConfig>>>>;
     type: z.ZodLiteral<"internal">;
     canUse: z.ZodArray<z.ZodObject<{
       agentToolRelationId: z.ZodOptional<z.ZodString>;

package/dist/data-access/manage/agents.d.ts

@@ -9,13 +9,13 @@ import { PgTable } from "drizzle-orm/pg-core";
 declare const getAgentById: (db: AgentsManageDatabaseClient) => (params: {
   scopes: AgentScopeConfig;
 }) => Promise<{
-  name: string;
-  description: string | null;
-  tenantId: string;
-  projectId: string;
   id: string;
+  name: string;
   createdAt: string;
   updatedAt: string;
+  projectId: string;
+  tenantId: string;
+  description: string | null;
   defaultSubAgentId: string | null;
   contextConfigId: string | null;
   models: {
@@ -55,13 +55,13 @@ declare const getAgentById: (db: AgentsManageDatabaseClient) => (params: {
 declare const getAgentWithDefaultSubAgent: (db: AgentsManageDatabaseClient) => (params: {
   scopes: AgentScopeConfig;
 }) => Promise<{
-  name: string;
-  description: string | null;
-  tenantId: string;
-  projectId: string;
   id: string;
+  name: string;
   createdAt: string;
   updatedAt: string;
+  projectId: string;
+  tenantId: string;
+  description: string | null;
   defaultSubAgentId: string | null;
   contextConfigId: string | null;
   models: {
@@ -98,14 +98,14 @@ declare const getAgentWithDefaultSubAgent: (db: AgentsManageDatabaseClient) => (
     transferCountIs?: number | undefined;
   } | null;
   defaultSubAgent: {
-    name: string;
-    description: string | null;
-    tenantId: string;
-    projectId: string;
-    agentId: string;
     id: string;
+    name: string;
     createdAt: string;
     updatedAt: string;
+    agentId: string;
+    projectId: string;
+    tenantId: string;
+    description: string | null;
     models: {
       base?: {
         model?: string | undefined;
@@ -130,13 +130,13 @@ declare const getAgentWithDefaultSubAgent: (db: AgentsManageDatabaseClient) => (
 declare const listAgents: (db: AgentsManageDatabaseClient) => (params: {
   scopes: ProjectScopeConfig;
 }) => Promise<{
-  name: string;
-  description: string | null;
-  tenantId: string;
-  projectId: string;
   id: string;
+  name: string;
   createdAt: string;
   updatedAt: string;
+  projectId: string;
+  tenantId: string;
+  description: string | null;
   defaultSubAgentId: string | null;
   contextConfigId: string | null;
   models: {
@@ -246,13 +246,13 @@ declare function listAgentsAcrossProjectMainBranches(db: AgentsManageDatabaseCli
   projectIds: string[];
 }): Promise<AvailableAgentInfo[]>;
 declare const createAgent: (db: AgentsManageDatabaseClient) => (data: AgentInsert) => Promise<{
-  name: string;
-  description: string | null;
-  tenantId: string;
-  projectId: string;
   id: string;
+  name: string;
   createdAt: string;
   updatedAt: string;
+  projectId: string;
+  tenantId: string;
+  description: string | null;
   defaultSubAgentId: string | null;
   contextConfigId: string | null;
   models: {

package/dist/data-access/manage/artifactComponents.d.ts

@@ -9,13 +9,13 @@ declare const getArtifactComponentById: (db: AgentsManageDatabaseClient) => (par
   scopes: ProjectScopeConfig;
   id: string;
 }) => Promise<{
-  name: string;
-  description: string | null;
-  tenantId: string;
-  projectId: string;
   id: string;
+  name: string;
   createdAt: string;
   updatedAt: string;
+  projectId: string;
+  tenantId: string;
+  description: string | null;
   props: {
     [x: string]: unknown;
     type: "object";
@@ -65,13 +65,13 @@ declare const listArtifactComponentsPaginated: (db: AgentsManageDatabaseClient)
   };
 }>;
 declare const createArtifactComponent: (db: AgentsManageDatabaseClient) => (params: ArtifactComponentInsert) => Promise<{
-  name: string;
-  description: string | null;
-  tenantId: string;
-  projectId: string;
   id: string;
+  name: string;
   createdAt: string;
   updatedAt: string;
+  projectId: string;
+  tenantId: string;
+  description: string | null;
   props: {
     [x: string]: unknown;
     type: "object";
@@ -141,12 +141,12 @@ declare const associateArtifactComponentWithAgent: (db: AgentsManageDatabaseClie
   scopes: SubAgentScopeConfig;
   artifactComponentId: string;
 }) => Promise<{
-  tenantId: string;
-  projectId: string;
-  agentId: string;
-  subAgentId: string;
   id: string;
   createdAt: string;
+  agentId: string;
+  projectId: string;
+  tenantId: string;
+  subAgentId: string;
   artifactComponentId: string;
 }>;
 declare const removeArtifactComponentFromAgent: (db: AgentsManageDatabaseClient) => (params: {
@@ -184,12 +184,12 @@ declare const upsertAgentArtifactComponentRelation: (db: AgentsManageDatabaseCli
   scopes: SubAgentScopeConfig;
   artifactComponentId: string;
 }) => Promise<{
-  tenantId: string;
-  projectId: string;
-  agentId: string;
-  subAgentId: string;
   id: string;
   createdAt: string;
+  agentId: string;
+  projectId: string;
+  tenantId: string;
+  subAgentId: string;
   artifactComponentId: string;
 } | null>;
 /**

package/dist/data-access/manage/contextConfigs.d.ts

@@ -9,26 +9,26 @@ declare const getContextConfigById: (db: AgentsManageDatabaseClient) => (params:
   scopes: AgentScopeConfig;
   id: string;
 }) => Promise<{
-  tenantId: string;
-  projectId: string;
-  agentId: string;
   id: string;
-  headersSchema: unknown;
-  contextVariables: Record<string, ContextFetchDefinition> | null;
   createdAt: string;
   updatedAt: string;
+  headersSchema: unknown;
+  contextVariables: Record<string, ContextFetchDefinition> | null;
+  agentId: string;
+  projectId: string;
+  tenantId: string;
 } | undefined>;
 declare const listContextConfigs: (db: AgentsManageDatabaseClient) => (params: {
   scopes: AgentScopeConfig;
 }) => Promise<{
-  tenantId: string;
-  projectId: string;
-  agentId: string;
   id: string;
-  headersSchema: unknown;
-  contextVariables: Record<string, ContextFetchDefinition> | null;
   createdAt: string;
   updatedAt: string;
+  headersSchema: unknown;
+  contextVariables: Record<string, ContextFetchDefinition> | null;
+  agentId: string;
+  projectId: string;
+  tenantId: string;
 }[]>;
 declare const listContextConfigsPaginated: (db: AgentsManageDatabaseClient) => (params: {
   scopes: AgentScopeConfig;
@@ -43,14 +43,14 @@ declare const listContextConfigsPaginated: (db: AgentsManageDatabaseClient) => (
   };
 }>;
 declare const createContextConfig: (db: AgentsManageDatabaseClient) => (params: ContextConfigInsert) => Promise<{
-  tenantId: string;
-  projectId: string;
-  agentId: string;
   id: string;
-  headersSchema: unknown;
-  contextVariables: Record<string, ContextFetchDefinition> | null;
   createdAt: string;
   updatedAt: string;
+  headersSchema: unknown;
+  contextVariables: Record<string, ContextFetchDefinition> | null;
+  agentId: string;
+  projectId: string;
+  tenantId: string;
 }>;
 declare const updateContextConfig: (db: AgentsManageDatabaseClient) => (params: {
   scopes: AgentScopeConfig;
@@ -83,14 +83,14 @@ declare const countContextConfigs: (db: AgentsManageDatabaseClient) => (params:
 declare const upsertContextConfig: (db: AgentsManageDatabaseClient) => (params: {
   data: ContextConfigInsert;
 }) => Promise<{
-  tenantId: string;
-  projectId: string;
-  agentId: string;
   id: string;
-  headersSchema: unknown;
-  contextVariables: Record<string, ContextFetchDefinition> | null;
   createdAt: string;
   updatedAt: string;
+  headersSchema: unknown;
+  contextVariables: Record<string, ContextFetchDefinition> | null;
+  agentId: string;
+  projectId: string;
+  tenantId: string;
 }>;
 //#endregion
 export { countContextConfigs, createContextConfig, deleteContextConfig, getContextConfigById, hasContextConfig, listContextConfigs, listContextConfigsPaginated, updateContextConfig, upsertContextConfig };

package/dist/data-access/manage/credentialReferences.d.ts

@@ -92,7 +92,9 @@ declare const countCredentialReferences: (db: AgentsManageDatabaseClient) => (pa
   scopes: ProjectScopeConfig;
 }) => Promise<number>;
 /**
- * Upsert a credential reference (create if it doesn't exist, update if it does)
+ * Upsert a credential reference (create if it doesn't exist, update if it does).
+ * For user-scoped credentials (toolId + userId set), uses an atomic INSERT ... ON CONFLICT
+ * on the (toolId, userId) unique constraint to avoid TOCTOU races.
  */
 declare const upsertCredentialReference: (db: AgentsManageDatabaseClient) => (params: {
   data: CredentialReferenceInsert;

package/dist/data-access/manage/credentialReferences.js

@@ -119,20 +119,24 @@ const countCredentialReferences = (db) => async (params) => {
 	return typeof total === "string" ? Number.parseInt(total, 10) : total;
 };
 /**
-* Upsert a credential reference (create if it doesn't exist, update if it does)
+* Upsert a credential reference (create if it doesn't exist, update if it does).
+* For user-scoped credentials (toolId + userId set), uses an atomic INSERT ... ON CONFLICT
+* on the (toolId, userId) unique constraint to avoid TOCTOU races.
 */
 const upsertCredentialReference = (db) => async (params) => {
 	const scopes = {
 		tenantId: params.data.tenantId,
 		projectId: params.data.projectId
 	};
-	if (await getCredentialReference(db)({
+	const now = (/* @__PURE__ */ new Date()).toISOString();
+	const existingById = await getCredentialReference(db)({
 		scopes,
 		id: params.data.id
-	})) {
+	});
+	if (existingById) {
 		const updated = await updateCredentialReference(db)({
 			scopes,
-			id: params.data.id,
+			id: existingById.id,
 			data: {
 				name: params.data.name,
 				type: params.data.type,
@@ -143,6 +147,23 @@ const upsertCredentialReference = (db) => async (params) => {
 		if (!updated) throw new Error("Failed to update credential reference - no rows affected");
 		return updated;
 	}
+	if (params.data.toolId && params.data.userId) {
+		const [result] = await db.insert(credentialReferences).values({
+			...params.data,
+			createdAt: now,
+			updatedAt: now
+		}).onConflictDoUpdate({
+			target: [credentialReferences.toolId, credentialReferences.userId],
+			set: {
+				name: params.data.name,
+				type: params.data.type,
+				credentialStoreId: params.data.credentialStoreId,
+				retrievalParams: params.data.retrievalParams,
+				updatedAt: now
+			}
+		}).returning();
+		return result;
+	}
 	return await createCredentialReference(db)(params.data);
 };
 

package/dist/data-access/manage/dataComponents.d.ts

@@ -65,12 +65,12 @@ declare const associateDataComponentWithAgent: (db: AgentsManageDatabaseClient)
   scopes: SubAgentScopeConfig;
   dataComponentId: string;
 }) => Promise<{
-  tenantId: string;
-  projectId: string;
-  agentId: string;
-  subAgentId: string;
   id: string;
   createdAt: string;
+  agentId: string;
+  projectId: string;
+  tenantId: string;
+  subAgentId: string;
   dataComponentId: string;
 }>;
 /**
@@ -107,12 +107,12 @@ declare const upsertAgentDataComponentRelation: (db: AgentsManageDatabaseClient)
   scopes: SubAgentScopeConfig;
   dataComponentId: string;
 }) => Promise<{
-  tenantId: string;
-  projectId: string;
-  agentId: string;
-  subAgentId: string;
   id: string;
   createdAt: string;
+  agentId: string;
+  projectId: string;
+  tenantId: string;
+  subAgentId: string;
   dataComponentId: string;
 } | null>;
 /**

package/dist/data-access/manage/functionTools.d.ts

@@ -53,14 +53,14 @@ declare const createFunctionTool: (db: AgentsManageDatabaseClient) => (params: {
   data: FunctionToolApiInsert;
   scopes: AgentScopeConfig;
 }) => Promise<{
-  name: string;
-  description: string | null;
-  tenantId: string;
-  projectId: string;
-  agentId: string;
   id: string;
+  name: string;
   createdAt: string;
   updatedAt: string;
+  agentId: string;
+  projectId: string;
+  tenantId: string;
+  description: string | null;
   functionId: string;
 }>;
 /**
@@ -95,14 +95,14 @@ declare const upsertFunctionTool: (db: AgentsManageDatabaseClient) => (params: {
   data: FunctionToolApiInsert;
   scopes: AgentScopeConfig;
 }) => Promise<{
-  name: string;
-  description: string | null;
-  tenantId: string;
-  projectId: string;
-  agentId: string;
   id: string;
+  name: string;
   createdAt: string;
   updatedAt: string;
+  agentId: string;
+  projectId: string;
+  tenantId: string;
+  description: string | null;
   functionId: string;
 }>;
 declare const getFunctionToolsForSubAgent: (db: AgentsManageDatabaseClient) => (params: {
@@ -161,17 +161,17 @@ declare const addFunctionToolToSubAgent: (db: AgentsManageDatabaseClient) => (pa
     needsApproval?: boolean;
   }> | null;
 }) => Promise<{
-  tenantId: string;
-  projectId: string;
-  agentId: string;
-  subAgentId: string;
   id: string;
   createdAt: string;
   updatedAt: string;
-  functionToolId: string;
+  agentId: string;
+  projectId: string;
+  tenantId: string;
+  subAgentId: string;
   toolPolicies: Record<string, {
     needsApproval?: boolean;
   }> | null;
+  functionToolId: string;
 }>;
 /**
  * Update an agent-function tool relation
@@ -226,17 +226,17 @@ declare const associateFunctionToolWithSubAgent: (db: AgentsManageDatabaseClient
     needsApproval?: boolean;
   }> | null;
 }) => Promise<{
-  tenantId: string;
-  projectId: string;
-  agentId: string;
-  subAgentId: string;
   id: string;
   createdAt: string;
   updatedAt: string;
-  functionToolId: string;
+  agentId: string;
+  projectId: string;
+  tenantId: string;
+  subAgentId: string;
   toolPolicies: Record<string, {
     needsApproval?: boolean;
   }> | null;
+  functionToolId: string;
 }>;
 //#endregion
 export { addFunctionToolToSubAgent, associateFunctionToolWithSubAgent, createFunctionTool, deleteFunctionTool, getFunctionToolById, getFunctionToolsForSubAgent, getSubAgentsUsingFunctionTool, isFunctionToolAssociatedWithSubAgent, listFunctionTools, removeFunctionToolFromSubAgent, updateFunctionTool, updateSubAgentFunctionToolRelation, upsertFunctionTool, upsertSubAgentFunctionToolRelation };