@tablestore/tablestore-agent-cli 0.2.6 → 0.2.8

package/dist/dashboard-runtime/dashboard/src/hooks/use-dream-tasks.ts

@@ -1,35 +1,118 @@
-import { useQuery } from "@tanstack/react-query";
+import { useEffect } from "react";
+import { useInfiniteQuery } from "@tanstack/react-query";
 import { listDreamTasks } from "@/services/memory";
 import { queryKeys } from "@/lib/query-keys";
 import { useRuntimeContext } from "@/providers/runtime-context-provider";
-import type { MemoryScope } from "@/types/memory";
+import type { DreamTask, MemoryScope } from "@/types/memory";
+
+/**
+ * Cap on eager auto-pagination. The Dream list API returns tasks scope-major
+ * (createdAt desc *within* a scope, but not globally), so to present a coherent
+ * scope-grouped view the hook walks every page and lets the UI group across the
+ * full result set. The cap keeps a scope with a very long history from fanning
+ * out unbounded; when it is hit the caller surfaces a "load more" affordance.
+ */
+const MAX_AUTO_PAGES = 25;
+
+interface DreamTasksPage {
+  items: DreamTask[];
+  totalCount: number;
+  scope: MemoryScope;
+  memoryStoreName: string;
+  nextToken?: string;
+}
+
+export interface UseDreamTasksResult {
+  /** All tasks loaded so far, flattened across auto-paginated pages. */
+  tasks: DreamTask[];
+  isLoading: boolean;
+  isRefetching: boolean;
+  isFetchingNextPage: boolean;
+  hasNextPage: boolean;
+  /** True when the auto-pagination cap was hit and more tasks remain unloaded. */
+  truncated: boolean;
+  fetchNextPage: () => void;
+  refetch: () => void;
+  error: Error | null;
+  errorCode: string | null;
+}
 
 export function useDreamTasks(
   memoryStoreName: string,
   scope: MemoryScope | null,
   options?: {
     limit?: number;
-    nextToken?: string;
     status?: string;
     minTimestamp?: string;
     maxTimestamp?: string;
   },
-) {
+): UseDreamTasksResult {
   const { context, ready } = useRuntimeContext();
-  return useQuery({
+  const limit = options?.limit ?? 50;
+  const filters = {
+    status: options?.status,
+    minTimestamp: options?.minTimestamp,
+    maxTimestamp: options?.maxTimestamp,
+  };
+
+  const query = useInfiniteQuery<DreamTasksPage, Error>({
+    // nextToken is intentionally omitted from the key — it is the pageParam,
+    // so all pages of one filter share a single cache entry.
     queryKey: queryKeys.dreamTasks(
       context.dataScopeKey,
       memoryStoreName,
       scope,
-      options?.nextToken,
-      options?.limit,
-      {
-        status: options?.status,
-        minTimestamp: options?.minTimestamp,
-        maxTimestamp: options?.maxTimestamp,
-      },
+      undefined,
+      limit,
+      filters,
     ),
-    queryFn: () => listDreamTasks(memoryStoreName, scope!, options),
+    queryFn: ({ pageParam }) =>
+      listDreamTasks(memoryStoreName, scope!, {
+        limit,
+        nextToken: typeof pageParam === "string" ? pageParam : undefined,
+        status: filters.status,
+        minTimestamp: filters.minTimestamp,
+        maxTimestamp: filters.maxTimestamp,
+      }),
+    getNextPageParam: (last) => last.nextToken ?? undefined,
+    initialPageParam: undefined as string | undefined,
     enabled: ready && !!memoryStoreName && !!scope?.appId,
   });
+
+  const pageCount = query.data?.pages?.length ?? 0;
+  const capReached = pageCount >= MAX_AUTO_PAGES;
+
+  // Eagerly load remaining pages (up to the cap) so grouping spans the full
+  // result set rather than a single page.
+  useEffect(() => {
+    if (query.hasNextPage && !query.isFetchingNextPage && !capReached) {
+      void query.fetchNextPage();
+    }
+  }, [query.hasNextPage, query.isFetchingNextPage, capReached, query]);
+
+  const tasks = (query.data?.pages ?? []).flatMap(
+    (page) => page.items ?? [],
+  ) as DreamTask[];
+
+  const errorCode =
+    query.error && "code" in query.error
+      ? ((query.error as { code?: string }).code ?? null)
+      : null;
+
+  return {
+    tasks,
+    isLoading: query.isLoading,
+    isRefetching: query.isRefetching,
+    isFetchingNextPage: query.isFetchingNextPage,
+    hasNextPage: Boolean(query.hasNextPage),
+    truncated: Boolean(query.hasNextPage) && capReached,
+    fetchNextPage: () => {
+      if (query.hasNextPage && !query.isFetchingNextPage) query.fetchNextPage();
+    },
+    refetch: () => {
+      void query.refetch();
+    },
+    error: query.error ?? null,
+    errorCode,
+  };
 }

package/dist/dashboard-runtime/dashboard/src/hooks/use-task-source-messages.ts

@@ -0,0 +1,179 @@
+import { useQueries, useQuery } from "@tanstack/react-query";
+import { getMemoryUnit, listMemoryMessages } from "@/services/memory";
+import { queryKeys } from "@/lib/query-keys";
+import { useRuntimeContext } from "@/providers/runtime-context-provider";
+import type { MemoryTask, MemoryUnit, SessionMessage } from "@/types/memory";
+
+function toEpochMs(value: string | number | undefined): number | undefined {
+  if (value === undefined || value === null) return undefined;
+  if (typeof value === "number") return value;
+  const ms = new Date(value).getTime();
+  return Number.isFinite(ms) ? ms : undefined;
+}
+
+export interface SourceEvidence {
+  // Real message hashes the task's units cite. Empty when no unit carries refs.
+  refIds: Set<string>;
+  // Tight timestamp window implied by the refs; Infinity / -Infinity if none.
+  minTs: number;
+  maxTs: number;
+}
+
+/**
+ * Collect the REAL source-turn evidence from a task's derived units.
+ *
+ * Only source_turn_refs are read: they carry resolved message hashes (with
+ * timestamps). source_turn_ids are deliberately ignored — they can be LOGICAL
+ * turn labels like "D2:1" (dialogue 2, turn 1) that never equal a stored
+ * messageId, so using them as a filter would hide every real message behind a
+ * false "messages were cleaned up" empty state.
+ */
+export function aggregateSourceEvidence(
+  memories: ReadonlyArray<MemoryUnit | undefined>,
+): SourceEvidence {
+  const refIds = new Set<string>();
+  let minTs = Infinity;
+  let maxTs = -Infinity;
+  for (const memory of memories) {
+    if (!memory) continue;
+    for (const ref of memory.source_turn_refs ?? []) {
+      if (ref?.messageId) refIds.add(ref.messageId);
+      const ts = ref?.timestampMs;
+      if (typeof ts === "number" && Number.isFinite(ts)) {
+        if (ts < minTs) minTs = ts;
+        if (ts > maxTs) maxTs = ts;
+      }
+    }
+  }
+  return { refIds, minTs, maxTs };
+}
+
+/**
+ * Pick the messages a task actually drew from. With real refs, filter to
+ * exactly those messageIds (precise). Without refs, show the fetched window in
+ * timestamp order (precise=false) instead of hiding everything.
+ */
+export function selectSourceMessages(
+  allMessages: ReadonlyArray<SessionMessage>,
+  refIds: ReadonlySet<string>,
+): { messages: SessionMessage[]; precise: boolean } {
+  const precise = refIds.size > 0;
+  const filtered = precise
+    ? allMessages.filter((m) => m.messageId && refIds.has(m.messageId))
+    : [...allMessages];
+  filtered.sort(
+    (a, b) => (toEpochMs(a.timestamp) ?? 0) - (toEpochMs(b.timestamp) ?? 0),
+  );
+  return { messages: filtered, precise };
+}
+
+export interface TaskSourceMessages {
+  messages: SessionMessage[];
+  isLoading: boolean;
+  // True when the result is filtered to the exact source turns the task's
+  // derived units cite. False means we fell back to the task-lifetime window
+  // (e.g. the task produced no units, or the units carry no source refs).
+  precise: boolean;
+}
+
+/**
+ * Resolve the original conversation turns that actually fed an ingest task,
+ * by walking the task's derived units and reading their source-turn evidence.
+ *
+ * This is task-bound: it never bleeds into a neighboring AddMemories call that
+ * happened to write the same scope around the same time, which the old
+ * scope+time-window heuristic could not avoid (a unit's source_turn_refs name
+ * the precise messageIds). The time window is only used to bound the fetch;
+ * the messageId set is what makes the result exact.
+ */
+export function useTaskSourceMessages(
+  memoryStoreName: string,
+  task: MemoryTask | null,
+): TaskSourceMessages {
+  const { context, ready } = useRuntimeContext();
+  const scope = task?.scope ?? null;
+  const unitIds = task?.derivedUnitIds ?? [];
+  const baseEnabled = ready && !!memoryStoreName && !!scope?.appId;
+
+  // 1. Fetch every derived unit in parallel. Shares cache keys with
+  //    ExtractedMemoriesPanel's per-row useMemoryUnit, so no duplicate fetches.
+  const unitQueries = useQueries({
+    queries: unitIds.map((id) => ({
+      queryKey: queryKeys.memoryUnit(
+        context.dataScopeKey,
+        memoryStoreName,
+        id,
+        scope,
+      ),
+      queryFn: () =>
+        getMemoryUnit({ memoryStoreName, memoryId: id, scope: scope! }),
+      enabled: baseEnabled && !!id && id !== "-",
+      staleTime: 30_000,
+    })),
+  });
+
+  const unitsLoading =
+    unitIds.length > 0 && unitQueries.some((q) => q.isLoading);
+
+  // 2. Aggregate source-turn evidence across every derived unit. The filter
+  //    set is built from source_turn_refs only — see aggregateSourceEvidence.
+  const { refIds, minTs, maxTs } = aggregateSourceEvidence(
+    unitQueries.map((q) => q.data?.memory),
+  );
+
+  // 3. Pick a fetch window. Prefer the tight window implied by source-turn
+  //    timestamps; fall back to the task lifetime when refs lack timestamps
+  //    (or there are no units at all).
+  const hasRefWindow = Number.isFinite(minTs) && Number.isFinite(maxTs);
+  const createdMs = toEpochMs(task?.createdAt);
+  const finishedMs = toEpochMs(task?.finishedAt) ?? toEpochMs(task?.updatedAt);
+  const fallbackMax = finishedMs ?? createdMs;
+  const winMin = hasRefWindow
+    ? minTs - 2_000
+    : createdMs !== undefined
+      ? createdMs - 60_000
+      : undefined;
+  const winMax = hasRefWindow
+    ? maxTs + 2_000
+    : fallbackMax !== undefined
+      ? fallbackMax + 60_000
+      : undefined;
+  const minTimestamp =
+    winMin !== undefined ? new Date(winMin).toISOString() : undefined;
+  const maxTimestamp =
+    winMax !== undefined ? new Date(winMax).toISOString() : undefined;
+
+  const messagesEnabled =
+    baseEnabled &&
+    !unitsLoading &&
+    (minTimestamp !== undefined || maxTimestamp !== undefined);
+
+  const messagesQuery = useQuery({
+    queryKey: queryKeys.memoryMessages(
+      context.dataScopeKey,
+      memoryStoreName,
+      scope,
+      undefined,
+      100,
+      { minTimestamp, maxTimestamp },
+    ),
+    queryFn: () =>
+      listMemoryMessages(memoryStoreName, scope!, {
+        limit: 100,
+        minTimestamp,
+        maxTimestamp,
+      }),
+    enabled: messagesEnabled,
+    staleTime: 30_000,
+  });
+
+  // 4. Filter to the exact source turns; keep window order when we can't.
+  const allMessages = messagesQuery.data?.items ?? [];
+  const { messages, precise } = selectSourceMessages(allMessages, refIds);
+
+  return {
+    messages,
+    isLoading: unitsLoading || messagesQuery.isLoading,
+    precise,
+  };
+}

package/dist/dashboard-runtime/dashboard/src/lib/memory.ts

@@ -1,4 +1,4 @@
-import type { MemoryScope } from "@/types/memory";
+import type { DreamTask, MemoryScope } from "@/types/memory";
 
 export function buildMemoryScope(searchParams: URLSearchParams): MemoryScope {
   return {
@@ -50,6 +50,80 @@ export function formatScope(scope?: MemoryScope): string {
   ].filter(Boolean).join(" / ");
 }
 
+/**
+ * A set of dream tasks that share the same input scope.
+ *
+ * The Dream list API returns tasks scope-major (grouped by scope partition,
+ * `createdAt` descending *within* each partition) but NOT globally time
+ * sorted across scopes. Under the default wildcard scope the raw list looks
+ * like its creation times jump around at every scope boundary. Grouping makes
+ * that structure explicit: one header per scope, `createdAt` descending
+ * inside, with the most recently active scope on top.
+ */
+export interface DreamTaskGroup {
+  /** Stable identifier for the group (derived from the scope(s)). */
+  key: string;
+  /** Representative scope — the first input scope of the group's tasks. */
+  scope: MemoryScope;
+  /** Human-readable scope label, e.g. `app / tenant / agent / run`. */
+  label: string;
+  /** Tasks in the group, sorted by `createdAt` descending. */
+  tasks: DreamTask[];
+  /** Epoch ms of the newest task in the group (used to order groups). */
+  latest: number;
+}
+
+const MISSING_SCOPE_LABEL = "未知 scope";
+
+function dreamTaskCreatedMs(task: DreamTask): number {
+  const ms = Date.parse(task.createdAt);
+  return Number.isFinite(ms) ? ms : 0;
+}
+
+/**
+ * Group dream tasks by their input scope for display.
+ *
+ * - Multi-scope dreams (more than one `inputScopes` entry) get their own
+ *   combined group and never merge into a single-scope group.
+ * - Tasks within a group are sorted by `createdAt` descending (defensive —
+ *   the backend already returns them that way within a scope).
+ * - Groups are ordered by their most recent task, descending, so the scope
+ *   with the latest activity appears first.
+ */
+export function groupDreamTasksByScope(tasks: DreamTask[]): DreamTaskGroup[] {
+  const groups = new Map<string, DreamTaskGroup>();
+
+  for (const task of tasks) {
+    const scopes = task.inputScopes ?? [];
+    const key =
+      scopes.length > 0
+        ? scopes.map((s) => formatScope(s)).join(" + ")
+        : MISSING_SCOPE_LABEL;
+    const label = key;
+
+    let group = groups.get(key);
+    if (!group) {
+      group = {
+        key,
+        scope: scopes[0] ?? { appId: "" },
+        label,
+        tasks: [],
+        latest: 0,
+      };
+      groups.set(key, group);
+    }
+    group.tasks.push(task);
+    group.latest = Math.max(group.latest, dreamTaskCreatedMs(task));
+  }
+
+  const result = Array.from(groups.values());
+  for (const group of result) {
+    group.tasks.sort((a, b) => dreamTaskCreatedMs(b) - dreamTaskCreatedMs(a));
+  }
+  result.sort((a, b) => b.latest - a.latest);
+  return result;
+}
+
 export function parseJsonObject(value: string): Record<string, string> | undefined {
   if (!value.trim()) return undefined;
   const parsed = JSON.parse(value) as unknown;

package/dist/dashboard-runtime/dashboard/src/lib/server/sdk-client.ts

@@ -185,6 +185,7 @@ export function configFromActiveInstance():
   const fields = {
     access_key_id: detail.access_key_id,
     access_key_secret: detail.access_key_secret,
+    api_key: detail.api_key,
     ots_endpoint: detail.ots_endpoint || ots.ots_endpoint,
     ots_instance_name: detail.ots_instance_name || ots.ots_instance_name,
     oss_endpoint: detail.oss_endpoint || oss.oss_endpoint,
@@ -192,9 +193,12 @@ export function configFromActiveInstance():
     region: detail.region || ots.region || oss.region,
   };
 
+  // A usable instance needs an endpoint/instance and at least one data-plane
+  // credential: the AK/SK pair, or an API Key (which takes precedence).
+  const hasAkSk = Boolean(fields.access_key_id && fields.access_key_secret);
+  const hasApiKey = Boolean(fields.api_key);
   if (
-    !fields.access_key_id ||
-    !fields.access_key_secret ||
+    (!hasAkSk && !hasApiKey) ||
     !fields.ots_endpoint ||
     !fields.ots_instance_name
   ) {
@@ -218,6 +222,7 @@ function buildAppConfig(fields: Record<string, string>): AppConfig {
   return {
     access_key_id: fields.access_key_id ?? "",
     access_key_secret: fields.access_key_secret ?? "",
+    api_key: fields.api_key ?? "",
     ots_endpoint: otsEndpoint,
     ots_instance_name: fields.ots_instance_name ?? "",
     oss_endpoint: fields.oss_endpoint ?? "",
@@ -243,16 +248,21 @@ function buildAppConfig(fields: Record<string, string>): AppConfig {
 function configFromEnv(): Record<string, string> | null {
   const accessKeyId = process.env.TABLESTORE_ACCESS_KEY_ID ?? "";
   const accessKeySecret = process.env.TABLESTORE_ACCESS_KEY_SECRET ?? "";
+  const apiKey = process.env.TABLESTORE_API_KEY ?? "";
   const endpoint = process.env.TABLESTORE_ENDPOINT ?? "";
   const instanceName = process.env.TABLESTORE_INSTANCE_NAME ?? "";
 
-  if (!accessKeyId || !accessKeySecret || !endpoint || !instanceName) {
+  // Need an endpoint/instance and at least one credential (AK/SK or API Key).
+  const hasAkSk = Boolean(accessKeyId && accessKeySecret);
+  const hasApiKey = Boolean(apiKey);
+  if ((!hasAkSk && !hasApiKey) || !endpoint || !instanceName) {
     return null;
   }
 
   return {
     access_key_id: accessKeyId,
     access_key_secret: accessKeySecret,
+    api_key: apiKey,
     ots_endpoint: endpoint,
     ots_instance_name: instanceName,
     oss_endpoint: process.env.TABLESTORE_OSS_ENDPOINT ?? "",
@@ -288,6 +298,7 @@ function tokenFieldsForInstance(
     return {
       access_key_id: detail.access_key_id,
       access_key_secret: detail.access_key_secret,
+      api_key: detail.api_key,
       ots_endpoint: detail.ots_endpoint || ots.ots_endpoint,
       ots_instance_name: detail.ots_instance_name || ots.ots_instance_name,
       oss_endpoint: detail.oss_endpoint || oss.oss_endpoint,
@@ -316,6 +327,7 @@ function tokenMatchesInstance(
   const requiredKeys = [
     "access_key_id",
     "access_key_secret",
+    "api_key",
     "ots_endpoint",
     "ots_instance_name",
     "oss_endpoint",
@@ -444,6 +456,7 @@ function computeClientCacheKey(
     instanceName ?? "",
     fields.access_key_id ?? "",
     fields.access_key_secret ?? "",
+    fields.api_key ?? "",
     fields.ots_endpoint ?? "",
     fields.ots_instance_name ?? "",
     fields.oss_endpoint ?? "",
@@ -457,6 +470,7 @@ function computeCredentialFingerprint(fields: Record<string, string>): string {
   const raw = [
     fields.access_key_id ?? "",
     fields.access_key_secret ?? "",
+    fields.api_key ?? "",
     fields.ots_endpoint ?? "",
     fields.ots_instance_name ?? "",
     fields.oss_endpoint ?? "",

package/dist/dashboard-runtime/dashboard/src/schemas/instance.ts

@@ -16,10 +16,52 @@ const trimmedNonEmpty = (label: string, max = 512) =>
 const optionalTrimmed = (max = 512) =>
   z.string().trim().max(max).optional().or(z.literal(""));
 
-export const connectInstanceSchema = z.object({
+// Credential-mode rules shared by connect / update / edit schemas:
+//   1. AccessKey ID and Secret must be supplied together (or both omitted).
+//   2. At least one data-plane credential must be present — the AK/SK pair or
+//      an API Key. (Update/edit relax rule 2 to allow "keep existing".)
+const akSkPaired = (v: {
+  accessKeyId?: string;
+  accessKeySecret?: string;
+}): boolean => Boolean(v.accessKeyId) === Boolean(v.accessKeySecret);
+const AK_SK_PAIR_ERROR = {
+  message: "AccessKey ID 与 Secret 必须成对填写",
+  path: ["accessKeySecret"],
+};
+const someCredential = (v: {
+  accessKeyId?: string;
+  accessKeySecret?: string;
+  apiKey?: string;
+}): boolean =>
+  Boolean(v.accessKeyId && v.accessKeySecret) || Boolean(v.apiKey);
+const CREDENTIAL_REQUIRED_ERROR = {
+  message: "请至少提供 API Key，或 AccessKey ID + Secret",
+  path: ["apiKey"],
+};
+
+/**
+ * Apply the credential-mode rules to any object schema that carries the
+ * `accessKeyId` / `accessKeySecret` / `apiKey` fields. Exposed so the
+ * interactive form can layer its own URL-shape overrides onto the base object
+ * (via `.extend`) and still inherit the exact same credential validation.
+ * The predicates read the parsed value loosely (`Record`) because the input
+ * type varies across the connect / form variants.
+ */
+export function withCredentialModeRules<S extends z.ZodTypeAny>(schema: S) {
+  return schema
+    .refine((v) => akSkPaired(v as Record<string, string>), AK_SK_PAIR_ERROR)
+    .refine(
+      (v) => someCredential(v as Record<string, string>),
+      CREDENTIAL_REQUIRED_ERROR,
+    );
+}
+
+/** Base object (no refinements) so callers can `.extend` before refining. */
+export const connectInstanceBaseSchema = z.object({
   name: instanceNameSchema,
-  accessKeyId: trimmedNonEmpty("AccessKey ID", 128),
-  accessKeySecret: trimmedNonEmpty("AccessKey Secret", 512),
+  accessKeyId: optionalTrimmed(128),
+  accessKeySecret: optionalTrimmed(512),
+  apiKey: optionalTrimmed(512),
   otsEndpoint: trimmedNonEmpty("OTS Endpoint", 256),
   otsInstanceName: trimmedNonEmpty("OTS 实例名", 128),
   ossEndpoint: optionalTrimmed(256),
@@ -28,10 +70,16 @@ export const connectInstanceSchema = z.object({
   activate: z.boolean().optional(),
 });
 
+export const connectInstanceSchema = withCredentialModeRules(
+  connectInstanceBaseSchema,
+);
+
 export const updateInstanceSchema = z
   .object({
     accessKeyId: optionalTrimmed(128),
     accessKeySecret: optionalTrimmed(512),
+    // Optional on update: omit/leave blank to keep the existing credential.
+    apiKey: optionalTrimmed(512),
     otsEndpoint: optionalTrimmed(256),
     otsInstanceName: optionalTrimmed(128),
     ossEndpoint: optionalTrimmed(256),
@@ -43,7 +91,9 @@ export const updateInstanceSchema = z
   // one of the pair previously sneaked past validation and later tripped a
   // generic 500 on the server side where the pair is encoded as a single
   // credential. Matching both at the schema layer surfaces the mistake in
-  // the form itself with a field-targeted message.
+  // the form itself with a field-targeted message. (No "at least one
+  // credential" rule here: a partial update may touch only OSS/region and
+  // legitimately leave both credential fields blank to keep the current one.)
   .refine(
     (v) => {
       const hasId = Boolean(v.accessKeyId && v.accessKeyId.length > 0);
@@ -70,6 +120,8 @@ export const editInstanceFormSchema = z
     name: instanceNameSchema,
     accessKeyId: optionalTrimmed(128),
     accessKeySecret: optionalTrimmed(512),
+    // Leave blank to keep the existing API Key.
+    apiKey: optionalTrimmed(512),
     otsEndpoint: trimmedNonEmpty("OTS Endpoint", 256),
     otsInstanceName: trimmedNonEmpty("OTS 实例名", 128),
     ossEndpoint: optionalTrimmed(256),

package/dist/dashboard-runtime/dashboard/src/types/instance.ts

@@ -25,6 +25,8 @@ export interface InstanceDetail extends InstanceSummary {
   accessKeyIdMasked?: string;
   /** Masked SK (first4****last4), safe for UI display. */
   accessKeySecretMasked?: string;
+  /** Masked API Key (first4****last4), safe for UI display. */
+  apiKeyMasked?: string;
   memoryDefaults?: {
     storeName?: string;
     appId?: string;
@@ -36,8 +38,14 @@ export interface InstanceDetail extends InstanceSummary {
 
 export interface ConnectInstancePayload {
   name: string;
-  accessKeyId: string;
-  accessKeySecret: string;
+  /** AccessKey pair. Optional when an API Key is supplied instead. */
+  accessKeyId?: string;
+  accessKeySecret?: string;
+  /**
+   * Tablestore API Key (data-plane credential). Takes precedence over AK/SK.
+   * Requires otsEndpoint/otsInstanceName since it cannot auto-provision.
+   */
+  apiKey?: string;
   otsEndpoint: string;
   otsInstanceName: string;
   ossEndpoint?: string;