@agent-native/core 0.79.16 → 0.79.18

package/corpus/core/src/client/settings/SettingsTabsPage.tsx

@@ -0,0 +1,216 @@
+import { IconHistory, IconSettings, IconUsers } from "@tabler/icons-react";
+import {
+  useEffect,
+  useMemo,
+  useState,
+  type ComponentType,
+  type ReactNode,
+} from "react";
+
+import { cn } from "../utils.js";
+
+type SettingsTabIcon = ComponentType<{ className?: string }>;
+
+export interface SettingsTabItem {
+  id: string;
+  label: string;
+  icon?: SettingsTabIcon;
+  content: ReactNode;
+}
+
+export interface SettingsTabsPageProps {
+  general: ReactNode;
+  team?: ReactNode;
+  whatsNew?: ReactNode;
+  extraTabs?: SettingsTabItem[];
+  generalLabel?: string;
+  teamLabel?: string;
+  whatsNewLabel?: string;
+  ariaLabel?: string;
+  defaultTab?: string;
+  className?: string;
+  navClassName?: string;
+  contentClassName?: string;
+}
+
+function normalizeTabId(value?: string | null): string | null {
+  const normalized = value
+    ?.replace(/^#/, "")
+    .trim()
+    .toLowerCase()
+    .replace(/['"]/g, "")
+    .replace(/[\s_]+/g, "-");
+  if (!normalized) return null;
+  if (
+    normalized === "whats-new" ||
+    normalized === "what-s-new" ||
+    normalized === "changelog" ||
+    normalized === "updates"
+  ) {
+    return "whats-new";
+  }
+  if (
+    normalized === "workspace" ||
+    normalized === "workspace-settings" ||
+    normalized === "organization" ||
+    normalized === "org"
+  ) {
+    return "team";
+  }
+  return normalized;
+}
+
+function activeTabFromHash(
+  tabs: SettingsTabItem[],
+  defaultTab: string,
+): string {
+  if (typeof window === "undefined") return defaultTab;
+  const fromHash = normalizeTabId(window.location.hash);
+  if (fromHash && tabs.some((tab) => tab.id === fromHash)) return fromHash;
+  return defaultTab;
+}
+
+function updateHashForTab(tabId: string) {
+  if (typeof window === "undefined") return;
+  const { pathname, search } = window.location;
+  const hash = tabId === "general" ? "" : `#${encodeURIComponent(tabId)}`;
+  window.history.pushState(null, "", `${pathname}${search}${hash}`);
+}
+
+export function SettingsTabsPage({
+  general,
+  team,
+  whatsNew,
+  extraTabs = [],
+  generalLabel = "General",
+  teamLabel = "Team",
+  whatsNewLabel = "What's new",
+  ariaLabel = "Settings sections",
+  defaultTab = "general",
+  className,
+  navClassName,
+  contentClassName,
+}: SettingsTabsPageProps) {
+  const tabs = useMemo<SettingsTabItem[]>(() => {
+    const next: SettingsTabItem[] = [
+      {
+        id: "general",
+        label: generalLabel,
+        icon: IconSettings,
+        content: general,
+      },
+    ];
+    if (team) {
+      next.push({
+        id: "team",
+        label: teamLabel,
+        icon: IconUsers,
+        content: team,
+      });
+    }
+    if (whatsNew) {
+      next.push({
+        id: "whats-new",
+        label: whatsNewLabel,
+        icon: IconHistory,
+        content: whatsNew,
+      });
+    }
+    next.push(...extraTabs);
+    return next;
+  }, [
+    extraTabs,
+    general,
+    generalLabel,
+    team,
+    teamLabel,
+    whatsNew,
+    whatsNewLabel,
+  ]);
+
+  const fallbackTab = tabs.some((tab) => tab.id === defaultTab)
+    ? defaultTab
+    : (tabs[0]?.id ?? "general");
+  const [activeTab, setActiveTab] = useState(() =>
+    activeTabFromHash(tabs, fallbackTab),
+  );
+
+  useEffect(() => {
+    if (tabs.some((tab) => tab.id === activeTab)) return;
+    setActiveTab(fallbackTab);
+  }, [activeTab, fallbackTab, tabs]);
+
+  useEffect(() => {
+    const handleHashChange = () => {
+      setActiveTab(activeTabFromHash(tabs, fallbackTab));
+    };
+    window.addEventListener("hashchange", handleHashChange);
+    return () => window.removeEventListener("hashchange", handleHashChange);
+  }, [fallbackTab, tabs]);
+
+  const selectedTab = tabs.find((tab) => tab.id === activeTab) ?? tabs[0];
+
+  return (
+    <div
+      className={cn(
+        "flex min-h-full w-full flex-col overflow-hidden bg-background sm:flex-row",
+        className,
+      )}
+    >
+      <nav
+        aria-label={ariaLabel}
+        role="tablist"
+        className={cn(
+          "flex shrink-0 gap-1 overflow-x-auto border-b border-border/50 bg-muted/30 p-2 sm:w-48 sm:flex-col sm:overflow-x-visible sm:border-b-0 sm:border-e",
+          navClassName,
+        )}
+      >
+        {tabs.map((tab) => {
+          const Icon = tab.icon;
+          const selected = tab.id === selectedTab?.id;
+          return (
+            <button
+              key={tab.id}
+              type="button"
+              role="tab"
+              aria-selected={selected}
+              aria-controls={`settings-tabpanel-${tab.id}`}
+              id={`settings-tab-${tab.id}`}
+              onClick={() => {
+                setActiveTab(tab.id);
+                updateHashForTab(tab.id);
+              }}
+              className={cn(
+                "flex min-h-9 shrink-0 items-center gap-2 rounded-md px-3 py-2 text-start text-sm font-medium transition-colors sm:w-full",
+                selected
+                  ? "bg-background text-foreground shadow-sm ring-1 ring-border/60"
+                  : "text-muted-foreground hover:bg-accent/60 hover:text-foreground",
+              )}
+            >
+              {Icon ? (
+                <Icon
+                  className={cn(
+                    "size-4 shrink-0",
+                    selected ? "text-foreground" : "text-muted-foreground",
+                  )}
+                />
+              ) : null}
+              <span className="truncate">{tab.label}</span>
+            </button>
+          );
+        })}
+      </nav>
+      <div
+        id={`settings-tabpanel-${selectedTab?.id ?? "general"}`}
+        role="tabpanel"
+        aria-labelledby={`settings-tab-${selectedTab?.id ?? "general"}`}
+        className={cn(
+          "min-w-0 flex-1 overflow-y-auto p-4 sm:p-6",
+          contentClassName,
+        )}
+      >
+        {selectedTab?.content}
+      </div>
+    </div>
+  );
+}

package/corpus/core/src/client/settings/index.ts

@@ -1,3 +1,8 @@
 export { SettingsPanel, type SettingsPanelProps } from "./SettingsPanel.js";
+export {
+  SettingsTabsPage,
+  type SettingsTabItem,
+  type SettingsTabsPageProps,
+} from "./SettingsTabsPage.js";
 export { useBuilderStatus } from "./useBuilderStatus.js";
 export { SecretsSection, type SecretsSectionProps } from "./SecretsSection.js";

package/corpus/core/src/file-upload/index.ts

@@ -8,6 +8,7 @@ export {
   unregisterFileUploadProvider,
   listFileUploadProviders,
   getActiveFileUploadProvider,
+  getActiveFileUploadProviderForRequest,
   uploadFile,
 } from "./registry.js";
 export { builderFileUploadProvider } from "./builder.js";

package/corpus/core/src/file-upload/registry.ts

@@ -54,6 +54,24 @@ export function getActiveFileUploadProvider(): FileUploadProvider | null {
   return null;
 }
 
+export async function getActiveFileUploadProviderForRequest(): Promise<FileUploadProvider | null> {
+  for (const provider of providers.values()) {
+    if (provider.isConfigured()) return provider;
+    if (provider.isConfiguredForRequest) {
+      try {
+        if (await provider.isConfiguredForRequest()) return provider;
+      } catch {
+        // Treat failed scoped credential lookups as unavailable. The upload
+        // call will surface real provider errors after a provider is selected.
+      }
+    }
+  }
+  if (builderFileUploadProvider.isConfigured()) {
+    return builderFileUploadProvider;
+  }
+  return null;
+}
+
 /**
  * Upload a file via the active provider, or `null` if no provider is
  * configured. Callers use `null` as the signal to fall back to SQL
@@ -63,12 +81,10 @@ export function getActiveFileUploadProvider(): FileUploadProvider | null {
 export async function uploadFile(
   input: FileUploadInput,
 ): Promise<FileUploadResult | null> {
-  const provider = getActiveFileUploadProvider();
-  // Only trust user-registered providers (S3, etc.) from the sync check.
-  // The builder builtin's isConfigured() only checks process.env, which causes
-  // hard failures for authenticated non-local users on multi-tenant deployments
-  // where BUILDER_PRIVATE_KEY is set at the deploy level but the user has no
-  // personal credentials. Always resolve builder credentials asynchronously.
+  const provider = await getActiveFileUploadProviderForRequest();
+  // User-registered providers (S3, etc.) may be configured by sync runtime
+  // state or request-scoped DB secrets. Builder still gets an explicit async
+  // credential check below because its sync isConfigured() only checks env.
   if (provider && provider !== builderFileUploadProvider) {
     return provider.upload(input);
   }

package/corpus/core/src/file-upload/types.ts

@@ -32,8 +32,13 @@ export interface FileUploadProvider {
   id: string;
   /** Human-readable name. */
   name: string;
-  /** Returns true if this provider is currently configured (env vars etc.). */
+  /** Returns true if this provider is configured from synchronous runtime state. */
   isConfigured: () => boolean;
+  /**
+   * Returns true if this provider is configured for the active request.
+   * Use for DB-backed user/org/workspace secrets that require request context.
+   */
+  isConfiguredForRequest?: () => Promise<boolean>;
   /** Upload a file and return a URL. Throw on failure. */
   upload: (input: FileUploadInput) => Promise<FileUploadResult>;
 }

package/corpus/core/src/integrations/adapters/email.ts

@@ -5,6 +5,7 @@ import { getHeader, readRawBody as h3ReadRawBody } from "h3";
 
 import { getDbExec } from "../../db/client.js";
 import type { EnvKeyConfig } from "../../server/create-server.js";
+import { resolveSecret } from "../../server/credential-provider.js";
 import {
   sendEmail,
   isEmailConfigured,
@@ -113,8 +114,9 @@ export function emailAdapter(): PlatformAdapter {
     },
 
     async verifyWebhook(event: H3Event): Promise<boolean> {
-      const secret = process.env.EMAIL_INBOUND_WEBHOOK_SECRET;
-      const provider = getEmailProvider();
+      const secret =
+        (await resolveSecret("EMAIL_INBOUND_WEBHOOK_SECRET")) ?? undefined;
+      const provider = await getEmailProvider();
 
       if (provider === "resend") {
         return verifyResendWebhook(event, secret);
@@ -132,8 +134,10 @@ export function emailAdapter(): PlatformAdapter {
     async parseIncomingMessage(
       event: H3Event,
     ): Promise<IncomingMessage | null> {
-      const provider = getEmailProvider();
-      const agentAddress = process.env.EMAIL_AGENT_ADDRESS?.toLowerCase();
+      const provider = await getEmailProvider();
+      const agentAddress = (
+        await resolveSecret("EMAIL_AGENT_ADDRESS")
+      )?.toLowerCase();
       if (!agentAddress) {
         console.warn("[email] EMAIL_AGENT_ADDRESS not configured");
         return null;
@@ -246,7 +250,7 @@ export function emailAdapter(): PlatformAdapter {
       message: OutgoingMessage,
       context: IncomingMessage,
     ): Promise<void> {
-      const agentAddress = process.env.EMAIL_AGENT_ADDRESS;
+      const agentAddress = await resolveSecret("EMAIL_AGENT_ADDRESS");
       if (!agentAddress) {
         console.error("[email] EMAIL_AGENT_ADDRESS not configured");
         return;
@@ -259,9 +263,8 @@ export function emailAdapter(): PlatformAdapter {
       // EMAIL_FROM overrides the from-address — required when the receiving
       // address is on a sub-domain that can't be a verified sender (e.g.
       // *.resend.app). Inbound and outbound addresses can differ.
-      const fromAddress = process.env.EMAIL_FROM
-        ? process.env.EMAIL_FROM
-        : `${displayName} <${agentAddress}>`;
+      const emailFrom = await resolveSecret("EMAIL_FROM");
+      const fromAddress = emailFrom || `${displayName} <${agentAddress}>`;
 
       const subject = context.platformContext.subject as string;
       const reSubject = subject.startsWith("Re: ") ? subject : `Re: ${subject}`;
@@ -276,7 +279,7 @@ export function emailAdapter(): PlatformAdapter {
           inReplyTo: context.platformContext.messageId as string,
           references: buildReferencesHeader(context.platformContext),
           cc: context.platformContext.isCC
-            ? buildReplyAllCc(context)
+            ? buildReplyAllCc(context, agentAddress)
             : undefined,
         });
       } catch (err) {
@@ -288,7 +291,7 @@ export function emailAdapter(): PlatformAdapter {
       message: OutgoingMessage,
       target: OutboundTarget,
     ): Promise<void> {
-      const agentAddress = process.env.EMAIL_AGENT_ADDRESS;
+      const agentAddress = await resolveSecret("EMAIL_AGENT_ADDRESS");
       if (!agentAddress) {
         console.error("[email] EMAIL_AGENT_ADDRESS not configured");
         return;
@@ -325,9 +328,11 @@ export function emailAdapter(): PlatformAdapter {
     },
 
     async getStatus(_baseUrl?: string): Promise<IntegrationStatus> {
-      const hasAgentAddress = !!process.env.EMAIL_AGENT_ADDRESS;
-      const hasEmailProvider = isEmailConfigured();
-      const hasWebhookSecret = !!process.env.EMAIL_INBOUND_WEBHOOK_SECRET;
+      const hasAgentAddress = !!(await resolveSecret("EMAIL_AGENT_ADDRESS"));
+      const hasEmailProvider = await isEmailConfigured();
+      const hasWebhookSecret = !!(await resolveSecret(
+        "EMAIL_INBOUND_WEBHOOK_SECRET",
+      ));
       const configured = hasAgentAddress && hasEmailProvider;
 
       return {
@@ -339,10 +344,10 @@ export function emailAdapter(): PlatformAdapter {
           hasAgentAddress,
           hasEmailProvider,
           hasWebhookSecret,
-          provider: getEmailProvider(),
+          provider: await getEmailProvider(),
         },
         error: !configured
-          ? "Set EMAIL_AGENT_ADDRESS and either RESEND_API_KEY or SENDGRID_API_KEY"
+          ? "Save EMAIL_AGENT_ADDRESS and either RESEND_API_KEY or SENDGRID_API_KEY in settings"
           : undefined,
       };
     },
@@ -906,8 +911,11 @@ function buildReferencesHeader(ctx: Record<string, unknown>): string {
  * Build CC list for reply-all when agent was CC'd.
  * Include original To addresses and other CC addresses, excluding the agent and the original sender.
  */
-function buildReplyAllCc(context: IncomingMessage): string[] | undefined {
-  const agentAddress = process.env.EMAIL_AGENT_ADDRESS?.toLowerCase();
+function buildReplyAllCc(
+  context: IncomingMessage,
+  agentAddress: string,
+): string[] | undefined {
+  const normalizedAgentAddress = agentAddress.toLowerCase();
   const senderEmail = context.senderId?.toLowerCase();
   const toAddresses = (context.platformContext.to as string[]) || [];
   const ccAddresses = (context.platformContext.cc as string[]) || [];
@@ -916,7 +924,7 @@ function buildReplyAllCc(context: IncomingMessage): string[] | undefined {
   for (const addr of [...toAddresses, ...ccAddresses]) {
     const normalized = addr.toLowerCase().trim();
     // Exclude agent address and original sender (sender goes in To)
-    if (normalized !== agentAddress && normalized !== senderEmail) {
+    if (normalized !== normalizedAgentAddress && normalized !== senderEmail) {
       allRecipients.add(normalized);
     }
   }

package/corpus/core/src/integrations/adapters/slack.ts

@@ -2,6 +2,7 @@ import type { H3Event } from "h3";
 import { createError, getHeader, readRawBody } from "h3";
 
 import type { EnvKeyConfig } from "../../server/create-server.js";
+import { resolveSecret } from "../../server/credential-provider.js";
 import type {
   PlatformAdapter,
   IncomingMessage,
@@ -80,7 +81,7 @@ export function slackAdapter(): PlatformAdapter {
     },
 
     async verifyWebhook(event: H3Event): Promise<boolean> {
-      const signingSecret = process.env.SLACK_SIGNING_SECRET;
+      const signingSecret = await resolveSecret("SLACK_SIGNING_SECRET");
       if (!signingSecret) return false;
 
       const signature = getHeader(event, "x-slack-signature");
@@ -185,7 +186,7 @@ export function slackAdapter(): PlatformAdapter {
       // redundant and added an extra chunk that we then had to overwrite.
       // We just set the native status and return null so sendResponse posts
       // the final reply as a fresh message.
-      const token = process.env.SLACK_BOT_TOKEN;
+      const token = await resolveSecret("SLACK_BOT_TOKEN");
       if (!token) return null;
 
       const channelId = incoming.platformContext.channelId as string;
@@ -204,7 +205,7 @@ export function slackAdapter(): PlatformAdapter {
       context: IncomingMessage,
       opts?: { placeholderRef?: string },
     ): Promise<void> {
-      const token = process.env.SLACK_BOT_TOKEN;
+      const token = await resolveSecret("SLACK_BOT_TOKEN");
       if (!token) {
         console.error("[slack] SLACK_BOT_TOKEN not configured");
         return;
@@ -297,7 +298,7 @@ export function slackAdapter(): PlatformAdapter {
       message: OutgoingMessage,
       target: OutboundTarget,
     ): Promise<void> {
-      const token = process.env.SLACK_BOT_TOKEN;
+      const token = await resolveSecret("SLACK_BOT_TOKEN");
       if (!token) {
         console.error("[slack] SLACK_BOT_TOKEN not configured");
         return;
@@ -348,8 +349,8 @@ export function slackAdapter(): PlatformAdapter {
     },
 
     async getStatus(_baseUrl?: string): Promise<IntegrationStatus> {
-      const hasToken = !!process.env.SLACK_BOT_TOKEN;
-      const hasSecret = !!process.env.SLACK_SIGNING_SECRET;
+      const hasToken = !!(await resolveSecret("SLACK_BOT_TOKEN"));
+      const hasSecret = !!(await resolveSecret("SLACK_SIGNING_SECRET"));
       const configured = hasToken && hasSecret;
 
       return {
@@ -362,7 +363,7 @@ export function slackAdapter(): PlatformAdapter {
           hasSecret,
         },
         error: !configured
-          ? "Set SLACK_BOT_TOKEN and SLACK_SIGNING_SECRET in your environment"
+          ? "Save SLACK_BOT_TOKEN and SLACK_SIGNING_SECRET in settings"
           : undefined,
       };
     },

package/corpus/core/src/integrations/adapters/telegram.ts

@@ -2,6 +2,7 @@ import type { H3Event } from "h3";
 import { getHeader } from "h3";
 
 import type { EnvKeyConfig } from "../../server/create-server.js";
+import { resolveSecret } from "../../server/credential-provider.js";
 import { readBody } from "../../server/h3-helpers.js";
 import type {
   PlatformAdapter,
@@ -86,7 +87,7 @@ export function telegramAdapter(): PlatformAdapter {
     },
 
     async verifyWebhook(event: H3Event): Promise<boolean> {
-      const secret = process.env.TELEGRAM_WEBHOOK_SECRET;
+      const secret = await resolveSecret("TELEGRAM_WEBHOOK_SECRET");
       if (!secret) {
         if (shouldRefuseWhenSecretMissing()) {
           if (!_telegramUnverifiedWarned) {
@@ -105,7 +106,7 @@ export function telegramAdapter(): PlatformAdapter {
           );
         }
         // Dev mode: still require the bot token to be configured at all.
-        return !!process.env.TELEGRAM_BOT_TOKEN;
+        return !!(await resolveSecret("TELEGRAM_BOT_TOKEN"));
       }
 
       const headerSecret = getHeader(event, "x-telegram-bot-api-secret-token");
@@ -172,7 +173,7 @@ export function telegramAdapter(): PlatformAdapter {
       message: OutgoingMessage,
       context: IncomingMessage,
     ): Promise<void> {
-      const token = process.env.TELEGRAM_BOT_TOKEN;
+      const token = await resolveSecret("TELEGRAM_BOT_TOKEN");
       if (!token) {
         console.error("[telegram] TELEGRAM_BOT_TOKEN not configured");
         return;
@@ -224,7 +225,7 @@ export function telegramAdapter(): PlatformAdapter {
       message: OutgoingMessage,
       target: OutboundTarget,
     ): Promise<void> {
-      const token = process.env.TELEGRAM_BOT_TOKEN;
+      const token = await resolveSecret("TELEGRAM_BOT_TOKEN");
       if (!token) {
         console.error("[telegram] TELEGRAM_BOT_TOKEN not configured");
         return;
@@ -272,14 +273,13 @@ export function telegramAdapter(): PlatformAdapter {
     },
 
     async getStatus(_baseUrl?: string): Promise<IntegrationStatus> {
-      const hasToken = !!process.env.TELEGRAM_BOT_TOKEN;
+      const token = await resolveSecret("TELEGRAM_BOT_TOKEN");
+      const hasToken = !!token;
 
       let botName: string | undefined;
       if (hasToken) {
         try {
-          const res = await fetch(
-            `https://api.telegram.org/bot${process.env.TELEGRAM_BOT_TOKEN}/getMe`,
-          );
+          const res = await fetch(`https://api.telegram.org/bot${token}/getMe`);
           const data = (await res.json()) as {
             ok: boolean;
             result?: { username?: string };
@@ -299,9 +299,7 @@ export function telegramAdapter(): PlatformAdapter {
           hasToken,
           botUsername: botName,
         },
-        error: !hasToken
-          ? "Set TELEGRAM_BOT_TOKEN in your environment"
-          : undefined,
+        error: !hasToken ? "Save TELEGRAM_BOT_TOKEN in settings" : undefined,
       };
     },
   };

package/corpus/core/src/integrations/adapters/whatsapp.ts

@@ -2,6 +2,7 @@ import type { H3Event } from "h3";
 import { getQuery, getHeader, readRawBody as h3ReadRawBody } from "h3";
 
 import type { EnvKeyConfig } from "../../server/create-server.js";
+import { resolveSecret } from "../../server/credential-provider.js";
 import type {
   PlatformAdapter,
   IncomingMessage,
@@ -103,7 +104,7 @@ export function whatsappAdapter(): PlatformAdapter {
       const mode = query["hub.mode"];
       const token = query["hub.verify_token"];
       const challenge = query["hub.challenge"];
-      const expected = process.env.WHATSAPP_VERIFY_TOKEN;
+      const expected = await resolveSecret("WHATSAPP_VERIFY_TOKEN");
 
       if (mode === "subscribe" && expected && typeof token === "string") {
         // Timing-safe compare so an attacker can't measure character-wise
@@ -126,7 +127,7 @@ export function whatsappAdapter(): PlatformAdapter {
     },
 
     async verifyWebhook(event: H3Event): Promise<boolean> {
-      const appSecret = process.env.WHATSAPP_APP_SECRET;
+      const appSecret = await resolveSecret("WHATSAPP_APP_SECRET");
       if (!appSecret) {
         if (shouldRefuseWhenSecretMissing()) {
           if (!_whatsappUnverifiedWarned) {
@@ -145,7 +146,7 @@ export function whatsappAdapter(): PlatformAdapter {
           );
         }
         // Dev mode: still require the access token to be configured at all.
-        return !!process.env.WHATSAPP_ACCESS_TOKEN;
+        return !!(await resolveSecret("WHATSAPP_ACCESS_TOKEN"));
       }
 
       const signature = getHeader(event, "x-hub-signature-256");
@@ -223,8 +224,8 @@ export function whatsappAdapter(): PlatformAdapter {
       message: OutgoingMessage,
       context: IncomingMessage,
     ): Promise<void> {
-      const accessToken = process.env.WHATSAPP_ACCESS_TOKEN;
-      const phoneNumberId = process.env.WHATSAPP_PHONE_NUMBER_ID;
+      const accessToken = await resolveSecret("WHATSAPP_ACCESS_TOKEN");
+      const phoneNumberId = await resolveSecret("WHATSAPP_PHONE_NUMBER_ID");
       if (!accessToken || !phoneNumberId) {
         console.error(
           "[whatsapp] WHATSAPP_ACCESS_TOKEN or WHATSAPP_PHONE_NUMBER_ID not configured",
@@ -269,9 +270,11 @@ export function whatsappAdapter(): PlatformAdapter {
     },
 
     async getStatus(_baseUrl?: string): Promise<IntegrationStatus> {
-      const hasAccessToken = !!process.env.WHATSAPP_ACCESS_TOKEN;
-      const hasVerifyToken = !!process.env.WHATSAPP_VERIFY_TOKEN;
-      const hasPhoneNumberId = !!process.env.WHATSAPP_PHONE_NUMBER_ID;
+      const hasAccessToken = !!(await resolveSecret("WHATSAPP_ACCESS_TOKEN"));
+      const hasVerifyToken = !!(await resolveSecret("WHATSAPP_VERIFY_TOKEN"));
+      const hasPhoneNumberId = !!(await resolveSecret(
+        "WHATSAPP_PHONE_NUMBER_ID",
+      ));
       const configured = hasAccessToken && hasVerifyToken && hasPhoneNumberId;
 
       return {
@@ -285,7 +288,7 @@ export function whatsappAdapter(): PlatformAdapter {
           hasPhoneNumberId,
         },
         error: !configured
-          ? "Set WHATSAPP_ACCESS_TOKEN, WHATSAPP_VERIFY_TOKEN, and WHATSAPP_PHONE_NUMBER_ID"
+          ? "Save WHATSAPP_ACCESS_TOKEN, WHATSAPP_VERIFY_TOKEN, and WHATSAPP_PHONE_NUMBER_ID in settings"
           : undefined,
       };
     },