@elizaos/plugin-secrets-manager 1.0.0

package/dist/index.js

@@ -0,0 +1,4171 @@
+// src/plugin.ts
+import { logger as logger13 } from "@elizaos/core";
+
+// src/services/secrets.ts
+import {
+  Service,
+  logger as logger5
+} from "@elizaos/core";
+
+// src/types.ts
+var SECRET_KEY_MAX_LENGTH = 256;
+var SECRET_VALUE_MAX_LENGTH = 65536;
+var SECRET_DESCRIPTION_MAX_LENGTH = 1024;
+var SECRET_KEY_PATTERN = /^[A-Z][A-Z0-9_]*$/;
+var MAX_ACCESS_LOG_ENTRIES = 1e3;
+var SecretsError = class extends Error {
+  constructor(message, code, details) {
+    super(message);
+    this.code = code;
+    this.details = details;
+    this.name = "SecretsError";
+  }
+};
+var PermissionDeniedError = class extends SecretsError {
+  constructor(key, action, context) {
+    super(
+      `Permission denied: cannot ${action} secret '${key}' at level '${context.level}'`,
+      "PERMISSION_DENIED",
+      { key, action, context }
+    );
+    this.name = "PermissionDeniedError";
+  }
+};
+var SecretNotFoundError = class extends SecretsError {
+  constructor(key, context) {
+    super(
+      `Secret '${key}' not found at level '${context.level}'`,
+      "SECRET_NOT_FOUND",
+      { key, context }
+    );
+    this.name = "SecretNotFoundError";
+  }
+};
+var ValidationError = class extends SecretsError {
+  constructor(key, message, details) {
+    super(
+      `Validation failed for secret '${key}': ${message}`,
+      "VALIDATION_FAILED",
+      { key, ...details }
+    );
+    this.name = "ValidationError";
+  }
+};
+var EncryptionError = class extends SecretsError {
+  constructor(message, details) {
+    super(message, "ENCRYPTION_ERROR", details);
+    this.name = "EncryptionError";
+  }
+};
+var StorageError = class extends SecretsError {
+  constructor(message, details) {
+    super(message, "STORAGE_ERROR", details);
+    this.name = "StorageError";
+  }
+};
+
+// src/crypto/encryption.ts
+import {
+  createCipheriv,
+  createDecipheriv,
+  randomBytes,
+  createHash,
+  pbkdf2Sync,
+  scryptSync
+} from "crypto";
+var ALGORITHM_GCM = "aes-256-gcm";
+var ALGORITHM_CBC = "aes-256-cbc";
+var IV_LENGTH = 16;
+var KEY_LENGTH = 32;
+var DEFAULT_SALT_LENGTH = 32;
+var DEFAULT_PBKDF2_ITERATIONS = 1e5;
+function generateSalt(length = DEFAULT_SALT_LENGTH) {
+  return randomBytes(length).toString("base64");
+}
+function generateKey() {
+  return randomBytes(KEY_LENGTH);
+}
+function deriveKeyPbkdf2(password, salt, iterations = DEFAULT_PBKDF2_ITERATIONS) {
+  const saltBuffer = typeof salt === "string" ? Buffer.from(salt, "base64") : salt;
+  return pbkdf2Sync(password, saltBuffer, iterations, KEY_LENGTH, "sha256");
+}
+function deriveKeyFromAgentId(agentId, salt = "default-salt") {
+  return createHash("sha256").update(agentId + salt).digest();
+}
+function createKeyDerivationParams(salt, iterations = DEFAULT_PBKDF2_ITERATIONS) {
+  return {
+    salt: salt ?? generateSalt(),
+    iterations,
+    algorithm: "pbkdf2-sha256",
+    keyLength: KEY_LENGTH
+  };
+}
+function encryptGcm(plaintext, key, keyId = "default") {
+  if (key.length !== KEY_LENGTH) {
+    throw new EncryptionError(
+      `Invalid key length: expected ${KEY_LENGTH}, got ${key.length}`
+    );
+  }
+  const iv = randomBytes(IV_LENGTH);
+  const cipher = createCipheriv(ALGORITHM_GCM, key, iv);
+  let encrypted = cipher.update(plaintext, "utf8", "base64");
+  encrypted += cipher.final("base64");
+  const authTag = cipher.getAuthTag();
+  return {
+    value: encrypted,
+    iv: iv.toString("base64"),
+    authTag: authTag.toString("base64"),
+    algorithm: "aes-256-gcm",
+    keyId
+  };
+}
+function encrypt(plaintext, key, keyId = "default") {
+  return encryptGcm(plaintext, key, keyId);
+}
+function decryptGcm(encrypted, key) {
+  if (key.length !== KEY_LENGTH) {
+    throw new EncryptionError(
+      `Invalid key length: expected ${KEY_LENGTH}, got ${key.length}`
+    );
+  }
+  if (encrypted.algorithm !== "aes-256-gcm") {
+    throw new EncryptionError(
+      `Algorithm mismatch: expected aes-256-gcm, got ${encrypted.algorithm}`
+    );
+  }
+  if (!encrypted.authTag) {
+    throw new EncryptionError("Missing authentication tag for GCM decryption");
+  }
+  const iv = Buffer.from(encrypted.iv, "base64");
+  const authTag = Buffer.from(encrypted.authTag, "base64");
+  const decipher = createDecipheriv(ALGORITHM_GCM, key, iv);
+  decipher.setAuthTag(authTag);
+  let decrypted = decipher.update(encrypted.value, "base64", "utf8");
+  decrypted += decipher.final("utf8");
+  return decrypted;
+}
+function decryptCbc(encrypted, key) {
+  if (key.length !== KEY_LENGTH) {
+    throw new EncryptionError(
+      `Invalid key length: expected ${KEY_LENGTH}, got ${key.length}`
+    );
+  }
+  if (encrypted.algorithm !== "aes-256-cbc") {
+    throw new EncryptionError(
+      `Algorithm mismatch: expected aes-256-cbc, got ${encrypted.algorithm}`
+    );
+  }
+  const iv = Buffer.from(encrypted.iv, "base64");
+  const decipher = createDecipheriv(ALGORITHM_CBC, key, iv);
+  let decrypted = decipher.update(encrypted.value, "base64", "utf8");
+  decrypted += decipher.final("utf8");
+  return decrypted;
+}
+function decrypt(encrypted, key) {
+  if (typeof encrypted === "string") {
+    return encrypted;
+  }
+  switch (encrypted.algorithm) {
+    case "aes-256-gcm":
+      return decryptGcm(encrypted, key);
+    case "aes-256-cbc":
+      return decryptCbc(encrypted, key);
+    default:
+      throw new EncryptionError(
+        `Unsupported algorithm: ${encrypted.algorithm}`
+      );
+  }
+}
+function isEncryptedSecret(value) {
+  if (!value || typeof value !== "object") {
+    return false;
+  }
+  const obj = value;
+  return typeof obj.value === "string" && typeof obj.iv === "string" && typeof obj.algorithm === "string" && (obj.algorithm === "aes-256-gcm" || obj.algorithm === "aes-256-cbc");
+}
+function generateSecureToken(length = 32) {
+  return randomBytes(length).toString("hex");
+}
+var KeyManager = class {
+  keys = /* @__PURE__ */ new Map();
+  currentKeyId = "default";
+  derivationParams = null;
+  constructor(options) {
+    if (options?.primaryKey) {
+      const keyId = options.primaryKeyId ?? "default";
+      this.keys.set(keyId, options.primaryKey);
+      this.currentKeyId = keyId;
+    }
+    if (options?.derivationParams) {
+      this.derivationParams = options.derivationParams;
+    }
+  }
+  /**
+   * Initialize with a password-derived key
+   */
+  initializeFromPassword(password, salt) {
+    this.derivationParams = createKeyDerivationParams(salt);
+    const key = deriveKeyPbkdf2(
+      password,
+      this.derivationParams.salt,
+      this.derivationParams.iterations
+    );
+    this.keys.set("default", key);
+    this.currentKeyId = "default";
+  }
+  /**
+   * Initialize with an agent ID (OpenClaw compatible)
+   */
+  initializeFromAgentId(agentId, salt) {
+    const key = deriveKeyFromAgentId(agentId, salt);
+    this.keys.set("default", key);
+    this.currentKeyId = "default";
+  }
+  /**
+   * Add a key for decryption (supports key rotation)
+   */
+  addKey(keyId, key) {
+    this.keys.set(keyId, key);
+  }
+  /**
+   * Set the current key for encryption
+   */
+  setCurrentKey(keyId) {
+    if (!this.keys.has(keyId)) {
+      throw new EncryptionError(`Key not found: ${keyId}`);
+    }
+    this.currentKeyId = keyId;
+  }
+  /**
+   * Get the current key ID
+   */
+  getCurrentKeyId() {
+    return this.currentKeyId;
+  }
+  /**
+   * Get a key by ID
+   */
+  getKey(keyId) {
+    return this.keys.get(keyId);
+  }
+  /**
+   * Get the current encryption key
+   */
+  getCurrentKey() {
+    const key = this.keys.get(this.currentKeyId);
+    if (!key) {
+      throw new EncryptionError("No encryption key configured");
+    }
+    return key;
+  }
+  /**
+   * Get derivation parameters (for storage)
+   */
+  getDerivationParams() {
+    return this.derivationParams;
+  }
+  /**
+   * Encrypt a value with the current key
+   */
+  encrypt(plaintext) {
+    return encryptGcm(plaintext, this.getCurrentKey(), this.currentKeyId);
+  }
+  /**
+   * Decrypt a value (automatically selects the correct key)
+   */
+  decrypt(encrypted) {
+    if (typeof encrypted === "string") {
+      return encrypted;
+    }
+    const key = this.keys.get(encrypted.keyId);
+    if (!key) {
+      throw new EncryptionError(
+        `Key not found for decryption: ${encrypted.keyId}`
+      );
+    }
+    return decrypt(encrypted, key);
+  }
+  /**
+   * Re-encrypt a value with the current key (for key rotation)
+   */
+  reencrypt(encrypted) {
+    const plaintext = this.decrypt(encrypted);
+    return this.encrypt(plaintext);
+  }
+  /**
+   * Clear all keys from memory
+   */
+  clear() {
+    for (const key of this.keys.values()) {
+      key.fill(0);
+    }
+    this.keys.clear();
+  }
+};
+
+// src/storage/interface.ts
+var BaseSecretStorage = class {
+  /**
+   * Create a default secret configuration
+   */
+  createDefaultConfig(key, context, partial) {
+    return {
+      type: partial?.type ?? "secret",
+      required: partial?.required ?? false,
+      description: partial?.description ?? `Secret: ${key}`,
+      canGenerate: partial?.canGenerate ?? false,
+      validationMethod: partial?.validationMethod,
+      status: partial?.status ?? "valid",
+      lastError: partial?.lastError,
+      attempts: partial?.attempts ?? 0,
+      createdAt: partial?.createdAt ?? Date.now(),
+      validatedAt: partial?.validatedAt ?? Date.now(),
+      plugin: partial?.plugin ?? context.level,
+      level: context.level,
+      ownerId: context.userId,
+      worldId: context.worldId,
+      encrypted: partial?.encrypted ?? true,
+      permissions: partial?.permissions ?? [],
+      sharedWith: partial?.sharedWith ?? [],
+      expiresAt: partial?.expiresAt
+    };
+  }
+};
+var CompositeSecretStorage = class {
+  storageType = "memory";
+  globalStorage;
+  worldStorage;
+  userStorage;
+  constructor(options) {
+    this.globalStorage = options.globalStorage;
+    this.worldStorage = options.worldStorage;
+    this.userStorage = options.userStorage;
+  }
+  async initialize() {
+    await Promise.all([
+      this.globalStorage.initialize(),
+      this.worldStorage.initialize(),
+      this.userStorage.initialize()
+    ]);
+  }
+  getStorageForContext(context) {
+    switch (context.level) {
+      case "global":
+        return this.globalStorage;
+      case "world":
+        return this.worldStorage;
+      case "user":
+        return this.userStorage;
+      default:
+        return this.globalStorage;
+    }
+  }
+  async exists(key, context) {
+    return this.getStorageForContext(context).exists(key, context);
+  }
+  async get(key, context) {
+    return this.getStorageForContext(context).get(key, context);
+  }
+  async set(key, value, context, config) {
+    return this.getStorageForContext(context).set(key, value, context, config);
+  }
+  async delete(key, context) {
+    return this.getStorageForContext(context).delete(key, context);
+  }
+  async list(context) {
+    return this.getStorageForContext(context).list(context);
+  }
+  async getConfig(key, context) {
+    return this.getStorageForContext(context).getConfig(key, context);
+  }
+  async updateConfig(key, context, config) {
+    return this.getStorageForContext(context).updateConfig(
+      key,
+      context,
+      config
+    );
+  }
+};
+
+// src/storage/memory-store.ts
+var MemorySecretStorage = class extends BaseSecretStorage {
+  storageType = "memory";
+  store = /* @__PURE__ */ new Map();
+  async initialize() {
+  }
+  async exists(key, context) {
+    const storageKey = this.generateStorageKey(key, context);
+    return this.store.has(storageKey);
+  }
+  async get(key, context) {
+    const storageKey = this.generateStorageKey(key, context);
+    const entry = this.store.get(storageKey);
+    if (!entry) {
+      return null;
+    }
+    if (entry.config.expiresAt && entry.config.expiresAt < Date.now()) {
+      this.store.delete(storageKey);
+      return null;
+    }
+    return entry.value;
+  }
+  async set(key, value, context, config) {
+    const storageKey = this.generateStorageKey(key, context);
+    const existingEntry = this.store.get(storageKey);
+    const fullConfig = this.createDefaultConfig(key, context, {
+      ...existingEntry?.config,
+      ...config
+    });
+    this.store.set(storageKey, {
+      value,
+      config: fullConfig
+    });
+    return true;
+  }
+  async delete(key, context) {
+    const storageKey = this.generateStorageKey(key, context);
+    return this.store.delete(storageKey);
+  }
+  async list(context) {
+    const prefix = this.getContextPrefix(context);
+    const metadata = {};
+    for (const [storageKey, entry] of this.store) {
+      if (storageKey.startsWith(prefix)) {
+        const originalKey = this.extractOriginalKey(storageKey, context);
+        if (originalKey) {
+          if (entry.config.expiresAt && entry.config.expiresAt < Date.now()) {
+            this.store.delete(storageKey);
+            continue;
+          }
+          metadata[originalKey] = { ...entry.config };
+        }
+      }
+    }
+    return metadata;
+  }
+  async getConfig(key, context) {
+    const storageKey = this.generateStorageKey(key, context);
+    const entry = this.store.get(storageKey);
+    if (!entry) {
+      return null;
+    }
+    return { ...entry.config };
+  }
+  async updateConfig(key, context, config) {
+    const storageKey = this.generateStorageKey(key, context);
+    const entry = this.store.get(storageKey);
+    if (!entry) {
+      return false;
+    }
+    entry.config = {
+      ...entry.config,
+      ...config
+    };
+    this.store.set(storageKey, entry);
+    return true;
+  }
+  /**
+   * Generate a storage key from the secret key and context
+   */
+  generateStorageKey(key, context) {
+    switch (context.level) {
+      case "global":
+        return `global:${context.agentId}:${key}`;
+      case "world":
+        return `world:${context.worldId}:${key}`;
+      case "user":
+        return `user:${context.userId}:${key}`;
+      default:
+        return `unknown:${key}`;
+    }
+  }
+  /**
+   * Get the storage key prefix for a context level
+   */
+  getContextPrefix(context) {
+    switch (context.level) {
+      case "global":
+        return `global:${context.agentId}:`;
+      case "world":
+        return `world:${context.worldId}:`;
+      case "user":
+        return `user:${context.userId}:`;
+      default:
+        return "";
+    }
+  }
+  /**
+   * Extract the original key from a storage key
+   */
+  extractOriginalKey(storageKey, context) {
+    const prefix = this.getContextPrefix(context);
+    if (!storageKey.startsWith(prefix)) {
+      return null;
+    }
+    return storageKey.slice(prefix.length);
+  }
+  /**
+   * Clear all stored secrets (for testing)
+   */
+  clear() {
+    this.store.clear();
+  }
+  /**
+   * Get the number of stored secrets (for testing)
+   */
+  size() {
+    return this.store.size;
+  }
+};
+
+// src/storage/character-store.ts
+import { logger } from "@elizaos/core";
+var SECRETS_KEY = "secrets";
+var METADATA_KEY = "__secrets_metadata";
+var CharacterSettingsStorage = class extends BaseSecretStorage {
+  storageType = "character";
+  runtime;
+  keyManager;
+  initialized = false;
+  constructor(runtime, keyManager) {
+    super();
+    this.runtime = runtime;
+    this.keyManager = keyManager;
+  }
+  async initialize() {
+    if (this.initialized) {
+      return;
+    }
+    logger.debug("[CharacterSettingsStorage] Initializing");
+    this.ensureSettingsStructure();
+    this.initialized = true;
+    logger.debug("[CharacterSettingsStorage] Initialized");
+  }
+  /**
+   * Ensure the character.settings.secrets structure exists
+   */
+  ensureSettingsStructure() {
+    if (!this.runtime.character.settings) {
+      this.runtime.character.settings = {};
+    }
+    if (!this.runtime.character.settings[SECRETS_KEY]) {
+      this.runtime.character.settings[SECRETS_KEY] = {};
+    }
+  }
+  async exists(key, _context) {
+    this.ensureSettingsStructure();
+    const secrets = this.getSecretsObject();
+    return key in secrets;
+  }
+  async get(key, context) {
+    this.ensureSettingsStructure();
+    const secrets = this.getSecretsObject();
+    const stored = secrets[key];
+    if (stored === void 0 || stored === null) {
+      return null;
+    }
+    if (typeof stored === "string") {
+      return stored;
+    }
+    if (typeof stored === "object") {
+      const storedSecret = stored;
+      if (storedSecret.config?.expiresAt && storedSecret.config.expiresAt < Date.now()) {
+        await this.delete(key, context);
+        return null;
+      }
+      if (isEncryptedSecret(storedSecret.value)) {
+        return this.keyManager.decrypt(storedSecret.value);
+      }
+      if (typeof storedSecret.value === "string") {
+        return storedSecret.value;
+      }
+    }
+    return null;
+  }
+  async set(key, value, context, config) {
+    this.ensureSettingsStructure();
+    const secrets = this.getSecretsObject();
+    const existingStored = secrets[key];
+    const existingConfig = typeof existingStored === "object" ? existingStored.config : void 0;
+    const fullConfig = this.createDefaultConfig(key, context, {
+      ...existingConfig,
+      ...config
+    });
+    const shouldEncrypt = fullConfig.encrypted !== false;
+    const storedValue = shouldEncrypt ? this.keyManager.encrypt(value) : value;
+    const storedSecret = {
+      value: storedValue,
+      config: fullConfig
+    };
+    secrets[key] = storedSecret;
+    logger.debug(`[CharacterSettingsStorage] Set secret: ${key}`);
+    return true;
+  }
+  async delete(key, _context) {
+    this.ensureSettingsStructure();
+    const secrets = this.getSecretsObject();
+    if (!(key in secrets)) {
+      return false;
+    }
+    delete secrets[key];
+    logger.debug(`[CharacterSettingsStorage] Deleted secret: ${key}`);
+    return true;
+  }
+  async list(_context) {
+    const secrets = this.getSecretsObject();
+    const metadata = {};
+    for (const [key, stored] of Object.entries(secrets)) {
+      if (key === METADATA_KEY) {
+        continue;
+      }
+      if (typeof stored === "object" && stored !== null) {
+        const storedSecret = stored;
+        if (storedSecret.config?.expiresAt && storedSecret.config.expiresAt < Date.now()) {
+          continue;
+        }
+        if (storedSecret.config) {
+          metadata[key] = { ...storedSecret.config };
+        }
+      } else {
+        metadata[key] = this.createDefaultConfig(key, {
+          level: "global",
+          agentId: this.runtime.agentId
+        });
+      }
+    }
+    return metadata;
+  }
+  async getConfig(key, context) {
+    const secrets = this.getSecretsObject();
+    const stored = secrets[key];
+    if (!stored) {
+      return null;
+    }
+    if (typeof stored === "object" && "config" in stored) {
+      return { ...stored.config };
+    }
+    return this.createDefaultConfig(key, context);
+  }
+  async updateConfig(key, _context, config) {
+    this.ensureSettingsStructure();
+    const secrets = this.getSecretsObject();
+    const stored = secrets[key];
+    if (!stored) {
+      return false;
+    }
+    if (typeof stored === "object" && "config" in stored) {
+      const storedSecret = stored;
+      storedSecret.config = {
+        ...storedSecret.config,
+        ...config
+      };
+      secrets[key] = storedSecret;
+    } else {
+      const defaultConfig = this.createDefaultConfig(key, {
+        level: "global",
+        agentId: this.runtime.agentId
+      });
+      const storedSecret = {
+        value: stored,
+        config: { ...defaultConfig, ...config }
+      };
+      secrets[key] = storedSecret;
+    }
+    return true;
+  }
+  /**
+   * Get the secrets object from character settings
+   *
+   * Accesses character.settings.secrets directly instead of using getSetting()
+   * because getSetting() only returns primitives, not objects.
+   */
+  getSecretsObject() {
+    this.ensureSettingsStructure();
+    const settings = this.runtime.character.settings;
+    const secrets = settings[SECRETS_KEY];
+    if (!secrets || typeof secrets !== "object") {
+      return {};
+    }
+    return secrets;
+  }
+  /**
+   * Migrate legacy environment variable format to new format
+   */
+  async migrateFromEnvVars(envVarPrefix = "ENV_") {
+    let migrated = 0;
+    const settings = this.runtime.character?.settings ?? {};
+    for (const [key, value] of Object.entries(settings)) {
+      if (key.startsWith(envVarPrefix) && typeof value === "string") {
+        const secretKey = key.slice(envVarPrefix.length);
+        const exists = await this.exists(secretKey, {
+          level: "global",
+          agentId: this.runtime.agentId
+        });
+        if (!exists) {
+          await this.set(
+            secretKey,
+            value,
+            { level: "global", agentId: this.runtime.agentId },
+            {
+              description: `Migrated from ${key}`,
+              encrypted: true
+            }
+          );
+          migrated++;
+        }
+      }
+    }
+    logger.info(
+      `[CharacterSettingsStorage] Migrated ${migrated} env vars to secrets`
+    );
+    return migrated;
+  }
+  /**
+   * Get a secret as an environment variable (for backward compatibility)
+   */
+  async getAsEnvVar(key) {
+    return this.get(key, { level: "global", agentId: this.runtime.agentId });
+  }
+  /**
+   * Sync a secret to process.env (for plugins that read env vars directly)
+   */
+  async syncToEnv(key, envVarName) {
+    const value = await this.getAsEnvVar(key);
+    if (value === null) {
+      return false;
+    }
+    const envKey = envVarName ?? key;
+    process.env[envKey] = value;
+    return true;
+  }
+  /**
+   * Sync all secrets to process.env
+   */
+  async syncAllToEnv() {
+    const metadata = await this.list({
+      level: "global",
+      agentId: this.runtime.agentId
+    });
+    let synced = 0;
+    for (const key of Object.keys(metadata)) {
+      if (await this.syncToEnv(key)) {
+        synced++;
+      }
+    }
+    return synced;
+  }
+};
+
+// src/storage/world-store.ts
+import { logger as logger2, Role } from "@elizaos/core";
+var WorldMetadataStorage = class extends BaseSecretStorage {
+  storageType = "world";
+  runtime;
+  keyManager;
+  worldCache = /* @__PURE__ */ new Map();
+  constructor(runtime, keyManager) {
+    super();
+    this.runtime = runtime;
+    this.keyManager = keyManager;
+  }
+  async initialize() {
+    logger2.debug("[WorldMetadataStorage] Initialized");
+  }
+  async exists(key, context) {
+    if (!context.worldId) {
+      return false;
+    }
+    const secrets = await this.getWorldSecrets(context.worldId);
+    return key in secrets;
+  }
+  async get(key, context) {
+    if (!context.worldId) {
+      logger2.warn("[WorldMetadataStorage] Cannot get secret without worldId");
+      return null;
+    }
+    const secrets = await this.getWorldSecrets(context.worldId);
+    const stored = secrets[key];
+    if (stored === void 0 || stored === null) {
+      return null;
+    }
+    if (typeof stored === "string") {
+      return stored;
+    }
+    if (typeof stored === "object") {
+      const storedSecret = stored;
+      if (storedSecret.config?.expiresAt && storedSecret.config.expiresAt < Date.now()) {
+        await this.delete(key, context);
+        return null;
+      }
+      if (isEncryptedSecret(storedSecret.value)) {
+        return this.keyManager.decrypt(storedSecret.value);
+      }
+      if (typeof storedSecret.value === "string") {
+        return storedSecret.value;
+      }
+    }
+    return null;
+  }
+  async set(key, value, context, config) {
+    if (!context.worldId) {
+      throw new StorageError("Cannot set world secret without worldId");
+    }
+    if (context.requesterId) {
+      const hasPermission = await this.checkWritePermission(
+        context.worldId,
+        context.requesterId
+      );
+      if (!hasPermission) {
+        throw new PermissionDeniedError(key, "write", context);
+      }
+    }
+    const world = await this.getWorld(context.worldId);
+    if (!world) {
+      throw new StorageError(`World not found: ${context.worldId}`);
+    }
+    if (!world.metadata) {
+      world.metadata = {};
+    }
+    const worldMeta = world.metadata;
+    if (!worldMeta.secrets) {
+      worldMeta.secrets = {};
+    }
+    const secrets = worldMeta.secrets;
+    const existingStored = secrets[key];
+    const existingConfig = typeof existingStored === "object" ? existingStored.config : void 0;
+    const fullConfig = this.createDefaultConfig(key, context, {
+      ...existingConfig,
+      ...config,
+      worldId: context.worldId
+    });
+    const shouldEncrypt = fullConfig.encrypted !== false;
+    const storedValue = shouldEncrypt ? this.keyManager.encrypt(value) : value;
+    const storedSecret = {
+      value: storedValue,
+      config: fullConfig
+    };
+    secrets[key] = storedSecret;
+    worldMeta.secrets = secrets;
+    await this.runtime.updateWorld(world);
+    this.worldCache.set(context.worldId, world);
+    logger2.debug(
+      `[WorldMetadataStorage] Set secret: ${key} for world: ${context.worldId}`
+    );
+    return true;
+  }
+  async delete(key, context) {
+    if (!context.worldId) {
+      return false;
+    }
+    if (context.requesterId) {
+      const hasPermission = await this.checkWritePermission(
+        context.worldId,
+        context.requesterId
+      );
+      if (!hasPermission) {
+        throw new PermissionDeniedError(key, "delete", context);
+      }
+    }
+    const world = await this.getWorld(context.worldId);
+    if (!world) {
+      return false;
+    }
+    const metadata = world.metadata;
+    if (!metadata?.secrets) {
+      return false;
+    }
+    const secrets = metadata.secrets;
+    if (!(key in secrets)) {
+      return false;
+    }
+    delete secrets[key];
+    metadata.secrets = secrets;
+    await this.runtime.updateWorld(world);
+    this.worldCache.set(context.worldId, world);
+    logger2.debug(
+      `[WorldMetadataStorage] Deleted secret: ${key} from world: ${context.worldId}`
+    );
+    return true;
+  }
+  async list(context) {
+    if (!context.worldId) {
+      return {};
+    }
+    const secrets = await this.getWorldSecrets(context.worldId);
+    const metadata = {};
+    for (const [key, stored] of Object.entries(secrets)) {
+      if (typeof stored === "object" && stored !== null) {
+        const storedSecret = stored;
+        if (storedSecret.config?.expiresAt && storedSecret.config.expiresAt < Date.now()) {
+          continue;
+        }
+        if (storedSecret.config) {
+          metadata[key] = { ...storedSecret.config };
+        }
+      } else {
+        metadata[key] = this.createDefaultConfig(key, context);
+      }
+    }
+    return metadata;
+  }
+  async getConfig(key, context) {
+    if (!context.worldId) {
+      return null;
+    }
+    const secrets = await this.getWorldSecrets(context.worldId);
+    const stored = secrets[key];
+    if (!stored) {
+      return null;
+    }
+    if (typeof stored === "object" && "config" in stored) {
+      return { ...stored.config };
+    }
+    return this.createDefaultConfig(key, context);
+  }
+  async updateConfig(key, context, config) {
+    if (!context.worldId) {
+      return false;
+    }
+    if (context.requesterId) {
+      const hasPermission = await this.checkWritePermission(
+        context.worldId,
+        context.requesterId
+      );
+      if (!hasPermission) {
+        throw new PermissionDeniedError(key, "write", context);
+      }
+    }
+    const world = await this.getWorld(context.worldId);
+    if (!world) {
+      return false;
+    }
+    const metadata = world.metadata;
+    if (!metadata?.secrets) {
+      return false;
+    }
+    const secrets = metadata.secrets;
+    const stored = secrets[key];
+    if (!stored) {
+      return false;
+    }
+    if (typeof stored === "object" && "config" in stored) {
+      const storedSecret = stored;
+      storedSecret.config = {
+        ...storedSecret.config,
+        ...config
+      };
+      secrets[key] = storedSecret;
+    } else {
+      const defaultConfig = this.createDefaultConfig(key, context);
+      const storedSecret = {
+        value: stored,
+        config: { ...defaultConfig, ...config }
+      };
+      secrets[key] = storedSecret;
+    }
+    metadata.secrets = secrets;
+    await this.runtime.updateWorld(world);
+    this.worldCache.set(context.worldId, world);
+    return true;
+  }
+  /**
+   * Get a world from cache or database
+   */
+  async getWorld(worldId) {
+    const cached = this.worldCache.get(worldId);
+    if (cached) {
+      return cached;
+    }
+    const world = await this.runtime.getWorld(worldId);
+    if (world) {
+      this.worldCache.set(worldId, world);
+    }
+    return world;
+  }
+  /**
+   * Get secrets object from world metadata
+   */
+  async getWorldSecrets(worldId) {
+    const world = await this.getWorld(worldId);
+    const metadata = world?.metadata;
+    if (!metadata?.secrets) {
+      return {};
+    }
+    return metadata.secrets;
+  }
+  /**
+   * Check if a user has write permission in a world
+   */
+  async checkWritePermission(worldId, userId) {
+    const world = await this.getWorld(worldId);
+    if (!world) {
+      return false;
+    }
+    if (userId === this.runtime.agentId) {
+      return true;
+    }
+    const roles = world.metadata?.roles;
+    if (!roles) {
+      return false;
+    }
+    const userRole = roles[userId];
+    return userRole === Role.OWNER || userRole === Role.ADMIN;
+  }
+  /**
+   * Clear the world cache
+   */
+  clearCache() {
+    this.worldCache.clear();
+  }
+  /**
+   * Invalidate a specific world in the cache
+   */
+  invalidateWorld(worldId) {
+    this.worldCache.delete(worldId);
+  }
+};
+
+// src/storage/component-store.ts
+import { logger as logger3, createUniqueUuid } from "@elizaos/core";
+var COMPONENT_TYPE = "secret";
+var ComponentSecretStorage = class extends BaseSecretStorage {
+  storageType = "component";
+  runtime;
+  keyManager;
+  constructor(runtime, keyManager) {
+    super();
+    this.runtime = runtime;
+    this.keyManager = keyManager;
+  }
+  async initialize() {
+    logger3.debug("[ComponentSecretStorage] Initialized");
+  }
+  async exists(key, context) {
+    if (!context.userId) {
+      return false;
+    }
+    const component = await this.findSecretComponent(context.userId, key);
+    return component !== null;
+  }
+  async get(key, context) {
+    if (!context.userId) {
+      logger3.warn("[ComponentSecretStorage] Cannot get secret without userId");
+      return null;
+    }
+    if (context.requesterId && context.requesterId !== context.userId) {
+      throw new PermissionDeniedError(key, "read", context);
+    }
+    const component = await this.findSecretComponent(context.userId, key);
+    if (!component) {
+      return null;
+    }
+    const data = component.data;
+    if (!data) {
+      return null;
+    }
+    if (data.config?.expiresAt && data.config.expiresAt < Date.now()) {
+      await this.delete(key, context);
+      return null;
+    }
+    if (isEncryptedSecret(data.value)) {
+      return this.keyManager.decrypt(data.value);
+    }
+    if (typeof data.value === "string") {
+      return data.value;
+    }
+    return null;
+  }
+  async set(key, value, context, config) {
+    if (!context.userId) {
+      throw new StorageError("Cannot set user secret without userId");
+    }
+    if (context.requesterId && context.requesterId !== context.userId) {
+      throw new PermissionDeniedError(key, "write", context);
+    }
+    const existingComponent = await this.findSecretComponent(
+      context.userId,
+      key
+    );
+    const existingData = existingComponent?.data;
+    const existingConfig = existingData?.config;
+    const fullConfig = this.createDefaultConfig(key, context, {
+      ...existingConfig,
+      ...config,
+      ownerId: context.userId
+    });
+    const shouldEncrypt = fullConfig.encrypted !== false;
+    const storedValue = shouldEncrypt ? this.keyManager.encrypt(value) : value;
+    const componentData = {
+      key,
+      value: storedValue,
+      config: fullConfig,
+      updatedAt: Date.now()
+    };
+    if (existingComponent) {
+      await this.runtime.updateComponent({
+        ...existingComponent,
+        data: componentData
+      });
+      logger3.debug(
+        `[ComponentSecretStorage] Updated secret: ${key} for user: ${context.userId}`
+      );
+    } else {
+      const newComponent = {
+        id: createUniqueUuid(this.runtime, `${context.userId}-secret-${key}`),
+        createdAt: Date.now(),
+        entityId: context.userId,
+        agentId: this.runtime.agentId,
+        roomId: this.runtime.agentId,
+        worldId: this.runtime.agentId,
+        sourceEntityId: context.userId,
+        type: COMPONENT_TYPE,
+        data: componentData
+      };
+      await this.runtime.createComponent(newComponent);
+      logger3.debug(
+        `[ComponentSecretStorage] Created secret: ${key} for user: ${context.userId}`
+      );
+    }
+    return true;
+  }
+  async delete(key, context) {
+    if (!context.userId) {
+      return false;
+    }
+    if (context.requesterId && context.requesterId !== context.userId) {
+      throw new PermissionDeniedError(key, "delete", context);
+    }
+    const component = await this.findSecretComponent(context.userId, key);
+    if (!component) {
+      return false;
+    }
+    await this.runtime.deleteComponent(component.id);
+    logger3.debug(
+      `[ComponentSecretStorage] Deleted secret: ${key} for user: ${context.userId}`
+    );
+    return true;
+  }
+  async list(context) {
+    if (!context.userId) {
+      return {};
+    }
+    if (context.requesterId && context.requesterId !== context.userId) {
+      throw new PermissionDeniedError("*", "read", context);
+    }
+    const components = await this.runtime.getComponents(context.userId);
+    const metadata = {};
+    for (const component of components) {
+      if (component.type !== COMPONENT_TYPE) {
+        continue;
+      }
+      const data = component.data;
+      if (!data?.key || !data?.config) {
+        continue;
+      }
+      if (data.config.expiresAt && data.config.expiresAt < Date.now()) {
+        continue;
+      }
+      metadata[data.key] = { ...data.config };
+    }
+    return metadata;
+  }
+  async getConfig(key, context) {
+    if (!context.userId) {
+      return null;
+    }
+    const component = await this.findSecretComponent(context.userId, key);
+    if (!component) {
+      return null;
+    }
+    const data = component.data;
+    return data?.config ? { ...data.config } : null;
+  }
+  async updateConfig(key, context, config) {
+    if (!context.userId) {
+      return false;
+    }
+    if (context.requesterId && context.requesterId !== context.userId) {
+      throw new PermissionDeniedError(key, "write", context);
+    }
+    const component = await this.findSecretComponent(context.userId, key);
+    if (!component) {
+      return false;
+    }
+    const data = component.data;
+    if (!data) {
+      return false;
+    }
+    data.config = {
+      ...data.config,
+      ...config
+    };
+    data.updatedAt = Date.now();
+    await this.runtime.updateComponent({
+      ...component,
+      data
+    });
+    return true;
+  }
+  /**
+   * Find a secret component for a user by key
+   */
+  async findSecretComponent(userId, key) {
+    const components = await this.runtime.getComponents(userId);
+    for (const component of components) {
+      if (component.type !== COMPONENT_TYPE) {
+        continue;
+      }
+      const data = component.data;
+      if (data?.key === key) {
+        return component;
+      }
+    }
+    return null;
+  }
+  /**
+   * Get all secret keys for a user
+   */
+  async listKeys(userId) {
+    const components = await this.runtime.getComponents(userId);
+    const keys = [];
+    for (const component of components) {
+      if (component.type !== COMPONENT_TYPE) {
+        continue;
+      }
+      const data = component.data;
+      if (data?.key) {
+        keys.push(data.key);
+      }
+    }
+    return keys;
+  }
+  /**
+   * Delete all secrets for a user
+   */
+  async deleteAllForUser(userId) {
+    const components = await this.runtime.getComponents(userId);
+    let deleted = 0;
+    for (const component of components) {
+      if (component.type !== COMPONENT_TYPE) {
+        continue;
+      }
+      await this.runtime.deleteComponent(component.id);
+      deleted++;
+    }
+    logger3.info(
+      `[ComponentSecretStorage] Deleted ${deleted} secrets for user: ${userId}`
+    );
+    return deleted;
+  }
+  /**
+   * Count secrets for a user
+   */
+  async countForUser(userId) {
+    const components = await this.runtime.getComponents(userId);
+    let count = 0;
+    for (const component of components) {
+      if (component.type === COMPONENT_TYPE) {
+        count++;
+      }
+    }
+    return count;
+  }
+};
+
+// src/validation.ts
+import { logger as logger4 } from "@elizaos/core";
+var ValidationStrategies = {
+  /**
+   * No validation - always passes
+   */
+  none: async (_key, _value) => ({
+    isValid: true,
+    validatedAt: Date.now()
+  }),
+  /**
+   * OpenAI API key validation
+   * Format: sk-... or sk-proj-...
+   */
+  "api_key:openai": async (key, value) => {
+    const validatedAt = Date.now();
+    if (!value.startsWith("sk-")) {
+      return {
+        isValid: false,
+        error: 'OpenAI API key must start with "sk-"',
+        validatedAt
+      };
+    }
+    if (value.length < 20) {
+      return {
+        isValid: false,
+        error: "OpenAI API key is too short",
+        validatedAt
+      };
+    }
+    const shouldVerify = process.env.VALIDATE_API_KEYS === "true";
+    if (shouldVerify) {
+      const verified = await verifyOpenAIKey(value);
+      if (!verified.isValid) {
+        return { ...verified, validatedAt };
+      }
+    }
+    return { isValid: true, validatedAt };
+  },
+  /**
+   * Anthropic API key validation
+   * Format: sk-ant-...
+   */
+  "api_key:anthropic": async (key, value) => {
+    const validatedAt = Date.now();
+    if (!value.startsWith("sk-ant-")) {
+      return {
+        isValid: false,
+        error: 'Anthropic API key must start with "sk-ant-"',
+        validatedAt
+      };
+    }
+    if (value.length < 30) {
+      return {
+        isValid: false,
+        error: "Anthropic API key is too short",
+        validatedAt
+      };
+    }
+    const shouldVerify = process.env.VALIDATE_API_KEYS === "true";
+    if (shouldVerify) {
+      const verified = await verifyAnthropicKey(value);
+      if (!verified.isValid) {
+        return { ...verified, validatedAt };
+      }
+    }
+    return { isValid: true, validatedAt };
+  },
+  /**
+   * Groq API key validation
+   * Format: gsk_...
+   */
+  "api_key:groq": async (key, value) => {
+    const validatedAt = Date.now();
+    if (!value.startsWith("gsk_")) {
+      return {
+        isValid: false,
+        error: 'Groq API key must start with "gsk_"',
+        validatedAt
+      };
+    }
+    if (value.length < 20) {
+      return {
+        isValid: false,
+        error: "Groq API key is too short",
+        validatedAt
+      };
+    }
+    return { isValid: true, validatedAt };
+  },
+  /**
+   * Google API key validation
+   * Format: AIza...
+   */
+  "api_key:google": async (key, value) => {
+    const validatedAt = Date.now();
+    if (!value.startsWith("AIza")) {
+      return {
+        isValid: false,
+        error: 'Google API key must start with "AIza"',
+        validatedAt
+      };
+    }
+    if (value.length < 30) {
+      return {
+        isValid: false,
+        error: "Google API key is too short",
+        validatedAt
+      };
+    }
+    return { isValid: true, validatedAt };
+  },
+  /**
+   * Mistral API key validation
+   */
+  "api_key:mistral": async (key, value) => {
+    const validatedAt = Date.now();
+    if (value.length < 20) {
+      return {
+        isValid: false,
+        error: "Mistral API key is too short",
+        validatedAt
+      };
+    }
+    return { isValid: true, validatedAt };
+  },
+  /**
+   * Cohere API key validation
+   */
+  "api_key:cohere": async (key, value) => {
+    const validatedAt = Date.now();
+    if (value.length < 20) {
+      return {
+        isValid: false,
+        error: "Cohere API key is too short",
+        validatedAt
+      };
+    }
+    return { isValid: true, validatedAt };
+  },
+  /**
+   * URL format validation
+   */
+  "url:valid": async (key, value) => {
+    const validatedAt = Date.now();
+    try {
+      new URL(value);
+      return { isValid: true, validatedAt };
+    } catch {
+      return {
+        isValid: false,
+        error: "Invalid URL format",
+        validatedAt
+      };
+    }
+  },
+  /**
+   * URL reachability validation
+   */
+  "url:reachable": async (key, value) => {
+    const validatedAt = Date.now();
+    try {
+      new URL(value);
+    } catch {
+      return {
+        isValid: false,
+        error: "Invalid URL format",
+        validatedAt
+      };
+    }
+    try {
+      const response = await fetch(value, {
+        method: "HEAD",
+        signal: AbortSignal.timeout(5e3)
+      });
+      if (!response.ok) {
+        return {
+          isValid: false,
+          error: `URL returned status ${response.status}`,
+          validatedAt
+        };
+      }
+      return { isValid: true, validatedAt };
+    } catch (error) {
+      return {
+        isValid: false,
+        error: `URL is not reachable: ${error instanceof Error ? error.message : "Unknown error"}`,
+        validatedAt
+      };
+    }
+  },
+  /**
+   * Custom validation placeholder
+   */
+  custom: async (key, value) => {
+    return {
+      isValid: true,
+      details: "Custom validation not implemented",
+      validatedAt: Date.now()
+    };
+  }
+};
+var customValidators = /* @__PURE__ */ new Map();
+function registerValidator(name, validator) {
+  customValidators.set(name, validator);
+  logger4.debug(`[Validation] Registered custom validator: ${name}`);
+}
+function unregisterValidator(name) {
+  return customValidators.delete(name);
+}
+function getValidator(strategy) {
+  if (strategy in ValidationStrategies) {
+    return ValidationStrategies[strategy];
+  }
+  return customValidators.get(strategy);
+}
+async function validateSecret(key, value, strategy) {
+  const strategyName = strategy ?? "none";
+  const validator = getValidator(strategyName);
+  if (!validator) {
+    logger4.warn(`[Validation] Unknown validation strategy: ${strategyName}`);
+    return {
+      isValid: true,
+      details: `Unknown validation strategy: ${strategyName}`,
+      validatedAt: Date.now()
+    };
+  }
+  try {
+    return await validator(key, value);
+  } catch (error) {
+    const errorMessage = error instanceof Error ? error.message : "Validation error";
+    logger4.error(`[Validation] Error validating ${key}: ${errorMessage}`);
+    return {
+      isValid: false,
+      error: errorMessage,
+      validatedAt: Date.now()
+    };
+  }
+}
+function inferValidationStrategy(key) {
+  const upperKey = key.toUpperCase();
+  if (upperKey.includes("OPENAI") && upperKey.includes("KEY")) {
+    return "api_key:openai";
+  }
+  if (upperKey.includes("ANTHROPIC") && upperKey.includes("KEY")) {
+    return "api_key:anthropic";
+  }
+  if (upperKey.includes("GROQ") && upperKey.includes("KEY")) {
+    return "api_key:groq";
+  }
+  if (upperKey.includes("GOOGLE") && upperKey.includes("KEY")) {
+    return "api_key:google";
+  }
+  if (upperKey.includes("MISTRAL") && upperKey.includes("KEY")) {
+    return "api_key:mistral";
+  }
+  if (upperKey.includes("COHERE") && upperKey.includes("KEY")) {
+    return "api_key:cohere";
+  }
+  if (upperKey.includes("URL") || upperKey.includes("ENDPOINT")) {
+    return "url:valid";
+  }
+  return "none";
+}
+async function verifyOpenAIKey(apiKey) {
+  try {
+    const response = await fetch("https://api.openai.com/v1/models", {
+      method: "GET",
+      headers: {
+        Authorization: `Bearer ${apiKey}`
+      },
+      signal: AbortSignal.timeout(1e4)
+    });
+    if (response.status === 401) {
+      return { isValid: false, error: "Invalid API key" };
+    }
+    if (response.status === 429) {
+      return { isValid: true };
+    }
+    if (!response.ok) {
+      return {
+        isValid: false,
+        error: `API returned status ${response.status}`
+      };
+    }
+    return { isValid: true };
+  } catch (error) {
+    return {
+      isValid: false,
+      error: `Failed to verify: ${error instanceof Error ? error.message : "Unknown error"}`
+    };
+  }
+}
+async function verifyAnthropicKey(apiKey) {
+  try {
+    const response = await fetch("https://api.anthropic.com/v1/messages", {
+      method: "POST",
+      headers: {
+        "x-api-key": apiKey,
+        "anthropic-version": "2023-06-01",
+        "content-type": "application/json"
+      },
+      body: JSON.stringify({
+        model: "claude-3-haiku-20240307",
+        max_tokens: 1,
+        messages: [{ role: "user", content: "Hi" }]
+      }),
+      signal: AbortSignal.timeout(1e4)
+    });
+    if (response.status === 401) {
+      return { isValid: false, error: "Invalid API key" };
+    }
+    if (response.status === 429) {
+      return { isValid: true };
+    }
+    if (response.status === 400) {
+      const body = await response.json().catch(() => ({}));
+      if (body.error?.type === "invalid_request_error") {
+        return { isValid: true };
+      }
+    }
+    if (!response.ok && response.status !== 400) {
+      return {
+        isValid: false,
+        error: `API returned status ${response.status}`
+      };
+    }
+    return { isValid: true };
+  } catch (error) {
+    return {
+      isValid: false,
+      error: `Failed to verify: ${error instanceof Error ? error.message : "Unknown error"}`
+    };
+  }
+}
+
+// src/services/secrets.ts
+var SECRETS_SERVICE_TYPE = "SECRETS";
+var DEFAULT_CONFIG = {
+  enableEncryption: true,
+  encryptionSalt: void 0,
+  enableAccessLogging: true,
+  maxAccessLogEntries: MAX_ACCESS_LOG_ENTRIES
+};
+var SecretsService = class _SecretsService extends Service {
+  static serviceType = SECRETS_SERVICE_TYPE;
+  capabilityDescription = "Manage secrets at global, world, and user levels with encryption and access control";
+  secretsConfig;
+  keyManager;
+  storage;
+  globalStorage;
+  worldStorage;
+  userStorage;
+  accessLogs = [];
+  changeCallbacks = /* @__PURE__ */ new Map();
+  globalChangeCallbacks = [];
+  constructor(runtime, config) {
+    super(runtime);
+    this.secretsConfig = { ...DEFAULT_CONFIG, ...config };
+    this.keyManager = new KeyManager();
+    if (runtime) {
+      this.keyManager.initializeFromAgentId(
+        runtime.agentId,
+        this.secretsConfig.encryptionSalt ?? runtime.getSetting("ENCRYPTION_SALT")
+      );
+      this.globalStorage = new CharacterSettingsStorage(
+        runtime,
+        this.keyManager
+      );
+      this.worldStorage = new WorldMetadataStorage(runtime, this.keyManager);
+      this.userStorage = new ComponentSecretStorage(runtime, this.keyManager);
+      this.storage = new CompositeSecretStorage({
+        globalStorage: this.globalStorage,
+        worldStorage: this.worldStorage,
+        userStorage: this.userStorage
+      });
+    }
+  }
+  /**
+   * Start the service
+   */
+  static async start(runtime, config) {
+    const service = new _SecretsService(runtime, config);
+    await service.initialize();
+    return service;
+  }
+  /**
+   * Initialize the service
+   */
+  async initialize() {
+    logger5.info("[SecretsService] Initializing");
+    await this.storage.initialize();
+    const migrated = await this.globalStorage.migrateFromEnvVars();
+    if (migrated > 0) {
+      logger5.info(`[SecretsService] Migrated ${migrated} legacy env vars`);
+    }
+    const synced = await this.globalStorage.syncAllToEnv();
+    logger5.debug(`[SecretsService] Synced ${synced} secrets to process.env`);
+    logger5.info("[SecretsService] Initialized");
+  }
+  /**
+   * Stop the service
+   */
+  async stop() {
+    logger5.info("[SecretsService] Stopping");
+    this.keyManager.clear();
+    this.accessLogs = [];
+    this.changeCallbacks.clear();
+    this.globalChangeCallbacks = [];
+    logger5.info("[SecretsService] Stopped");
+  }
+  // ============================================================================
+  // Core Secret Operations
+  // ============================================================================
+  /**
+   * Get a secret value
+   */
+  async get(key, context) {
+    this.logAccess(key, "read", context, true);
+    const value = await this.storage.get(key, context);
+    if (value === null) {
+      this.logAccess(key, "read", context, false, "Secret not found");
+    }
+    return value;
+  }
+  /**
+   * Set a secret value
+   */
+  async set(key, value, context, config) {
+    this.logAccess(key, "write", context, true);
+    if (config?.validationMethod && config.validationMethod !== "none") {
+      const validation = await this.validate(
+        key,
+        value,
+        config.validationMethod
+      );
+      if (!validation.isValid) {
+        this.logAccess(
+          key,
+          "write",
+          context,
+          false,
+          `Validation failed: ${validation.error}`
+        );
+        throw new SecretsError(
+          `Validation failed for ${key}: ${validation.error}`,
+          "VALIDATION_FAILED",
+          { key, error: validation.error }
+        );
+      }
+    }
+    const previousValue = await this.storage.get(key, context);
+    const success = await this.storage.set(key, value, context, config);
+    if (success) {
+      if (context.level === "global") {
+        await this.globalStorage.syncToEnv(key);
+      }
+      await this.emitChangeEvent({
+        type: previousValue === null ? "created" : "updated",
+        key,
+        value,
+        previousValue: previousValue ?? void 0,
+        context,
+        timestamp: Date.now()
+      });
+    } else {
+      this.logAccess(key, "write", context, false, "Storage operation failed");
+    }
+    return success;
+  }
+  /**
+   * Delete a secret
+   */
+  async delete(key, context) {
+    this.logAccess(key, "delete", context, true);
+    const previousValue = await this.storage.get(key, context);
+    const success = await this.storage.delete(key, context);
+    if (success) {
+      if (context.level === "global") {
+        delete process.env[key];
+      }
+      await this.emitChangeEvent({
+        type: "deleted",
+        key,
+        value: null,
+        previousValue: previousValue ?? void 0,
+        context,
+        timestamp: Date.now()
+      });
+    } else {
+      this.logAccess(key, "delete", context, false, "Secret not found");
+    }
+    return success;
+  }
+  /**
+   * Check if a secret exists
+   */
+  async exists(key, context) {
+    return this.storage.exists(key, context);
+  }
+  /**
+   * List secrets (metadata only, no values)
+   */
+  async list(context) {
+    return this.storage.list(context);
+  }
+  /**
+   * Get secret configuration
+   */
+  async getConfig(key, context) {
+    return this.storage.getConfig(key, context);
+  }
+  /**
+   * Update secret configuration
+   */
+  async updateConfig(key, context, config) {
+    return this.storage.updateConfig(key, context, config);
+  }
+  // ============================================================================
+  // Convenience Methods
+  // ============================================================================
+  /**
+   * Get a global secret (agent-level)
+   */
+  async getGlobal(key) {
+    return this.get(key, { level: "global", agentId: this.runtime.agentId });
+  }
+  /**
+   * Set a global secret (agent-level)
+   */
+  async setGlobal(key, value, config) {
+    return this.set(
+      key,
+      value,
+      { level: "global", agentId: this.runtime.agentId },
+      config
+    );
+  }
+  /**
+   * Get a world secret
+   */
+  async getWorld(key, worldId) {
+    return this.get(key, {
+      level: "world",
+      worldId,
+      agentId: this.runtime.agentId
+    });
+  }
+  /**
+   * Set a world secret
+   */
+  async setWorld(key, value, worldId, config) {
+    return this.set(
+      key,
+      value,
+      { level: "world", worldId, agentId: this.runtime.agentId },
+      config
+    );
+  }
+  /**
+   * Get a user secret
+   */
+  async getUser(key, userId) {
+    return this.get(key, {
+      level: "user",
+      userId,
+      agentId: this.runtime.agentId,
+      requesterId: userId
+    });
+  }
+  /**
+   * Set a user secret
+   */
+  async setUser(key, value, userId, config) {
+    return this.set(
+      key,
+      value,
+      {
+        level: "user",
+        userId,
+        agentId: this.runtime.agentId,
+        requesterId: userId
+      },
+      config
+    );
+  }
+  // ============================================================================
+  // Validation
+  // ============================================================================
+  /**
+   * Validate a secret value
+   */
+  async validate(key, value, strategy) {
+    return validateSecret(key, value, strategy);
+  }
+  /**
+   * Get available validation strategies
+   */
+  getValidationStrategies() {
+    return Object.keys(ValidationStrategies);
+  }
+  // ============================================================================
+  // Plugin Requirements
+  // ============================================================================
+  /**
+   * Check which secrets are missing for a plugin
+   */
+  async checkPluginRequirements(pluginId, requirements) {
+    const missingRequired = [];
+    const missingOptional = [];
+    const invalid = [];
+    for (const [key, requirement] of Object.entries(requirements)) {
+      const value = await this.getGlobal(key);
+      if (value === null) {
+        if (requirement.required) {
+          missingRequired.push(key);
+        } else {
+          missingOptional.push(key);
+        }
+        continue;
+      }
+      if (requirement.validationMethod && requirement.validationMethod !== "none") {
+        const validation = await this.validate(
+          key,
+          value,
+          requirement.validationMethod
+        );
+        if (!validation.isValid) {
+          invalid.push(key);
+        }
+      }
+    }
+    return {
+      ready: missingRequired.length === 0 && invalid.length === 0,
+      missingRequired,
+      missingOptional,
+      invalid
+    };
+  }
+  /**
+   * Get missing secrets for a set of keys
+   */
+  async getMissingSecrets(keys, level = "global") {
+    const missing = [];
+    for (const key of keys) {
+      let exists;
+      switch (level) {
+        case "global":
+          exists = await this.exists(key, {
+            level: "global",
+            agentId: this.runtime.agentId
+          });
+          break;
+        case "world":
+        case "user":
+          exists = false;
+          break;
+        default:
+          exists = false;
+      }
+      if (!exists) {
+        missing.push(key);
+      }
+    }
+    return missing;
+  }
+  // ============================================================================
+  // Change Notifications
+  // ============================================================================
+  /**
+   * Register a callback for changes to a specific secret
+   */
+  onSecretChanged(key, callback) {
+    const callbacks = this.changeCallbacks.get(key) ?? [];
+    callbacks.push(callback);
+    this.changeCallbacks.set(key, callbacks);
+    return () => {
+      const cbs = this.changeCallbacks.get(key);
+      if (cbs) {
+        const index = cbs.indexOf(callback);
+        if (index !== -1) {
+          cbs.splice(index, 1);
+        }
+      }
+    };
+  }
+  /**
+   * Register a callback for all secret changes
+   */
+  onAnySecretChanged(callback) {
+    this.globalChangeCallbacks.push(callback);
+    return () => {
+      const index = this.globalChangeCallbacks.indexOf(callback);
+      if (index !== -1) {
+        this.globalChangeCallbacks.splice(index, 1);
+      }
+    };
+  }
+  /**
+   * Emit a change event to registered callbacks
+   */
+  async emitChangeEvent(event) {
+    const keyCallbacks = this.changeCallbacks.get(event.key) ?? [];
+    for (const callback of keyCallbacks) {
+      await callback(event.key, event.value, event.context);
+    }
+    for (const callback of this.globalChangeCallbacks) {
+      await callback(event.key, event.value, event.context);
+    }
+    logger5.debug(
+      `[SecretsService] Emitted ${event.type} event for ${event.key}`
+    );
+  }
+  // ============================================================================
+  // Access Logging
+  // ============================================================================
+  /**
+   * Log a secret access attempt
+   */
+  logAccess(key, action, context, success, error) {
+    if (!this.secretsConfig.enableAccessLogging) {
+      return;
+    }
+    const log = {
+      secretKey: key,
+      accessedBy: context.requesterId ?? context.userId ?? context.agentId,
+      action,
+      timestamp: Date.now(),
+      context,
+      success,
+      error
+    };
+    this.accessLogs.push(log);
+    if (this.accessLogs.length > this.secretsConfig.maxAccessLogEntries) {
+      this.accessLogs = this.accessLogs.slice(
+        -this.secretsConfig.maxAccessLogEntries
+      );
+    }
+    if (!success && error) {
+      logger5.debug(
+        `[SecretsService] Access denied: ${action} ${key} - ${error}`
+      );
+    }
+  }
+  /**
+   * Get access logs
+   */
+  getAccessLogs(filter) {
+    let logs = [...this.accessLogs];
+    if (filter?.key) {
+      logs = logs.filter((l) => l.secretKey === filter.key);
+    }
+    if (filter?.action) {
+      logs = logs.filter((l) => l.action === filter.action);
+    }
+    if (filter?.since) {
+      logs = logs.filter((l) => l.timestamp >= filter.since);
+    }
+    if (filter?.context) {
+      logs = logs.filter((l) => {
+        if (filter.context.level && l.context.level !== filter.context.level)
+          return false;
+        if (filter.context.worldId && l.context.worldId !== filter.context.worldId)
+          return false;
+        if (filter.context.userId && l.context.userId !== filter.context.userId)
+          return false;
+        return true;
+      });
+    }
+    return logs;
+  }
+  /**
+   * Clear access logs
+   */
+  clearAccessLogs() {
+    this.accessLogs = [];
+  }
+  // ============================================================================
+  // Storage Access
+  // ============================================================================
+  /**
+   * Get the global storage backend
+   */
+  getGlobalStorage() {
+    return this.globalStorage;
+  }
+  /**
+   * Get the world storage backend
+   */
+  getWorldStorage() {
+    return this.worldStorage;
+  }
+  /**
+   * Get the user storage backend
+   */
+  getUserStorage() {
+    return this.userStorage;
+  }
+  /**
+   * Get the key manager (for advanced use cases)
+   */
+  getKeyManager() {
+    return this.keyManager;
+  }
+};
+
+// src/services/plugin-activator.ts
+import {
+  Service as Service2,
+  logger as logger6
+} from "@elizaos/core";
+var PLUGIN_ACTIVATOR_SERVICE_TYPE = "PLUGIN_ACTIVATOR";
+var DEFAULT_CONFIG2 = {
+  enableAutoActivation: true,
+  pollingIntervalMs: 5e3,
+  maxWaitMs: 0
+  // 0 = wait forever
+};
+var PluginActivatorService = class _PluginActivatorService extends Service2 {
+  static serviceType = PLUGIN_ACTIVATOR_SERVICE_TYPE;
+  capabilityDescription = "Activate plugins dynamically when their required secrets become available";
+  activatorConfig;
+  secretsService = null;
+  pendingPlugins = /* @__PURE__ */ new Map();
+  activatedPlugins = /* @__PURE__ */ new Set();
+  pluginSecretMapping = /* @__PURE__ */ new Map();
+  pollingInterval = null;
+  unsubscribeSecretChanges = null;
+  constructor(runtime, config) {
+    super(runtime);
+    this.activatorConfig = { ...DEFAULT_CONFIG2, ...config };
+  }
+  /**
+   * Start the service
+   */
+  static async start(runtime, config) {
+    const service = new _PluginActivatorService(runtime, config);
+    await service.initialize();
+    return service;
+  }
+  /**
+   * Initialize the service
+   */
+  async initialize() {
+    logger6.info("[PluginActivator] Initializing");
+    this.secretsService = this.runtime.getService(SECRETS_SERVICE_TYPE);
+    if (!this.secretsService) {
+      logger6.warn(
+        "[PluginActivator] SecretsService not available, activation will be limited"
+      );
+    } else {
+      this.unsubscribeSecretChanges = this.secretsService.onAnySecretChanged(
+        async (key, value, context) => {
+          await this.onSecretChanged(key, value, context);
+        }
+      );
+    }
+    if (this.activatorConfig.enableAutoActivation && this.activatorConfig.pollingIntervalMs > 0) {
+      this.startPolling();
+    }
+    logger6.info("[PluginActivator] Initialized");
+  }
+  /**
+   * Stop the service
+   */
+  async stop() {
+    logger6.info("[PluginActivator] Stopping");
+    if (this.pollingInterval) {
+      clearInterval(this.pollingInterval);
+      this.pollingInterval = null;
+    }
+    if (this.unsubscribeSecretChanges) {
+      this.unsubscribeSecretChanges();
+      this.unsubscribeSecretChanges = null;
+    }
+    this.pendingPlugins.clear();
+    this.activatedPlugins.clear();
+    this.pluginSecretMapping.clear();
+    logger6.info("[PluginActivator] Stopped");
+  }
+  // ============================================================================
+  // Plugin Registration
+  // ============================================================================
+  /**
+   * Register a plugin for activation when secrets are ready
+   */
+  async registerPlugin(plugin, activationCallback) {
+    const pluginId = plugin.name;
+    if (this.activatedPlugins.has(pluginId)) {
+      logger6.debug(`[PluginActivator] Plugin ${pluginId} already activated`);
+      return true;
+    }
+    if (!plugin.requiredSecrets || Object.keys(plugin.requiredSecrets).length === 0) {
+      logger6.info(
+        `[PluginActivator] Plugin ${pluginId} has no secret requirements, activating`
+      );
+      return this.activatePlugin(pluginId, plugin, activationCallback);
+    }
+    const status = await this.checkPluginRequirements(plugin);
+    if (status.ready) {
+      logger6.info(
+        `[PluginActivator] Plugin ${pluginId} has all required secrets, activating`
+      );
+      return this.activatePlugin(pluginId, plugin, activationCallback);
+    }
+    logger6.info(
+      `[PluginActivator] Plugin ${pluginId} queued, waiting for: ${status.missingRequired.join(", ")}`
+    );
+    const requiredSecrets = Object.entries(plugin.requiredSecrets).filter(([_, req]) => req.required).map(([key]) => key);
+    this.pendingPlugins.set(pluginId, {
+      pluginId,
+      requiredSecrets,
+      callback: async () => {
+        await this.activatePlugin(pluginId, plugin, activationCallback);
+      },
+      registeredAt: Date.now()
+    });
+    for (const secretKey of requiredSecrets) {
+      const plugins = this.pluginSecretMapping.get(secretKey) ?? /* @__PURE__ */ new Set();
+      plugins.add(pluginId);
+      this.pluginSecretMapping.set(secretKey, plugins);
+    }
+    return false;
+  }
+  /**
+   * Unregister a pending plugin
+   */
+  unregisterPlugin(pluginId) {
+    const pending = this.pendingPlugins.get(pluginId);
+    if (!pending) {
+      return false;
+    }
+    for (const secretKey of pending.requiredSecrets) {
+      const plugins = this.pluginSecretMapping.get(secretKey);
+      if (plugins) {
+        plugins.delete(pluginId);
+        if (plugins.size === 0) {
+          this.pluginSecretMapping.delete(secretKey);
+        }
+      }
+    }
+    this.pendingPlugins.delete(pluginId);
+    logger6.info(`[PluginActivator] Unregistered plugin ${pluginId}`);
+    return true;
+  }
+  // ============================================================================
+  // Plugin Activation
+  // ============================================================================
+  /**
+   * Activate a plugin
+   */
+  async activatePlugin(pluginId, plugin, callback) {
+    try {
+      if (callback) {
+        await callback();
+      }
+      if (plugin.onSecretsReady) {
+        await plugin.onSecretsReady(this.runtime);
+      }
+      this.activatedPlugins.add(pluginId);
+      this.pendingPlugins.delete(pluginId);
+      logger6.info(`[PluginActivator] Activated plugin ${pluginId}`);
+      return true;
+    } catch (error) {
+      const errorMessage = error instanceof Error ? error.message : String(error);
+      logger6.error(
+        `[PluginActivator] Failed to activate plugin ${pluginId}: ${errorMessage}`
+      );
+      return false;
+    }
+  }
+  /**
+   * Check requirements for a plugin
+   */
+  async checkPluginRequirements(plugin) {
+    if (!plugin.requiredSecrets) {
+      return {
+        pluginId: plugin.name,
+        ready: true,
+        missingRequired: [],
+        missingOptional: [],
+        invalid: [],
+        message: "No secrets required"
+      };
+    }
+    if (!this.secretsService) {
+      const required = Object.entries(plugin.requiredSecrets).filter(([_, req]) => req.required).map(([key]) => key);
+      return {
+        pluginId: plugin.name,
+        ready: required.length === 0,
+        missingRequired: required,
+        missingOptional: [],
+        invalid: [],
+        message: "SecretsService not available"
+      };
+    }
+    const result = await this.secretsService.checkPluginRequirements(
+      plugin.name,
+      plugin.requiredSecrets
+    );
+    return {
+      pluginId: plugin.name,
+      ...result,
+      message: result.ready ? "All secrets available" : `Missing: ${result.missingRequired.join(", ")}`
+    };
+  }
+  /**
+   * Get status of all registered plugins
+   */
+  getPluginStatuses() {
+    const statuses = /* @__PURE__ */ new Map();
+    for (const [pluginId, pending] of this.pendingPlugins) {
+      statuses.set(pluginId, {
+        pending: true,
+        activated: false,
+        missingSecrets: pending.requiredSecrets
+      });
+    }
+    for (const pluginId of this.activatedPlugins) {
+      statuses.set(pluginId, {
+        pending: false,
+        activated: true,
+        missingSecrets: []
+      });
+    }
+    return statuses;
+  }
+  // ============================================================================
+  // Secret Change Handling
+  // ============================================================================
+  /**
+   * Handle secret change event
+   */
+  async onSecretChanged(key, value, context) {
+    if (context.level !== "global") {
+      return;
+    }
+    const affectedPlugins = this.pluginSecretMapping.get(key);
+    if (!affectedPlugins || affectedPlugins.size === 0) {
+      return;
+    }
+    logger6.debug(
+      `[PluginActivator] Secret ${key} changed, checking ${affectedPlugins.size} plugins`
+    );
+    for (const pluginId of affectedPlugins) {
+      const pending = this.pendingPlugins.get(pluginId);
+      if (!pending) {
+        continue;
+      }
+      const missing = await this.getMissingSecrets(pending.requiredSecrets);
+      if (missing.length === 0) {
+        logger6.info(
+          `[PluginActivator] All secrets available for ${pluginId}, activating`
+        );
+        await pending.callback();
+      }
+    }
+  }
+  /**
+   * Get missing secrets from a list
+   */
+  async getMissingSecrets(keys) {
+    if (!this.secretsService) {
+      return keys;
+    }
+    return this.secretsService.getMissingSecrets(keys, "global");
+  }
+  // ============================================================================
+  // Polling
+  // ============================================================================
+  /**
+   * Start polling for pending plugins
+   */
+  startPolling() {
+    if (this.pollingInterval) {
+      return;
+    }
+    this.pollingInterval = setInterval(async () => {
+      await this.checkPendingPlugins();
+    }, this.activatorConfig.pollingIntervalMs);
+    logger6.debug(
+      `[PluginActivator] Started polling every ${this.activatorConfig.pollingIntervalMs}ms`
+    );
+  }
+  /**
+   * Stop polling
+   */
+  stopPolling() {
+    if (this.pollingInterval) {
+      clearInterval(this.pollingInterval);
+      this.pollingInterval = null;
+    }
+  }
+  /**
+   * Check all pending plugins
+   */
+  async checkPendingPlugins() {
+    if (this.pendingPlugins.size === 0) {
+      return;
+    }
+    const now = Date.now();
+    for (const [pluginId, pending] of this.pendingPlugins) {
+      if (this.activatorConfig.maxWaitMs > 0) {
+        const elapsed = now - pending.registeredAt;
+        if (elapsed > this.activatorConfig.maxWaitMs) {
+          logger6.warn(
+            `[PluginActivator] Plugin ${pluginId} timed out waiting for secrets`
+          );
+          this.unregisterPlugin(pluginId);
+          continue;
+        }
+      }
+      const missing = await this.getMissingSecrets(pending.requiredSecrets);
+      if (missing.length === 0) {
+        logger6.info(`[PluginActivator] Secrets now available for ${pluginId}`);
+        await pending.callback();
+      }
+    }
+  }
+  // ============================================================================
+  // Utility Methods
+  // ============================================================================
+  /**
+   * Get list of pending plugins
+   */
+  getPendingPlugins() {
+    return Array.from(this.pendingPlugins.keys());
+  }
+  /**
+   * Get list of activated plugins
+   */
+  getActivatedPlugins() {
+    return Array.from(this.activatedPlugins);
+  }
+  /**
+   * Check if a plugin is pending
+   */
+  isPending(pluginId) {
+    return this.pendingPlugins.has(pluginId);
+  }
+  /**
+   * Check if a plugin is activated
+   */
+  isActivated(pluginId) {
+    return this.activatedPlugins.has(pluginId);
+  }
+  /**
+   * Get secrets required by pending plugins
+   */
+  getRequiredSecrets() {
+    const secrets = /* @__PURE__ */ new Set();
+    for (const pending of this.pendingPlugins.values()) {
+      for (const key of pending.requiredSecrets) {
+        secrets.add(key);
+      }
+    }
+    return secrets;
+  }
+  /**
+   * Get plugins waiting for a specific secret
+   */
+  getPluginsWaitingFor(secretKey) {
+    const plugins = this.pluginSecretMapping.get(secretKey);
+    return plugins ? Array.from(plugins) : [];
+  }
+};
+
+// src/actions/set-secret.ts
+import {
+  ModelType,
+  logger as logger7,
+  composePromptFromState
+} from "@elizaos/core";
+var extractSecretsTemplate = `You are extracting secret/configuration values from the user's message.
+
+The user wants to set one or more secrets. Extract:
+1. The secret key (should be UPPERCASE_WITH_UNDERSCORES format)
+2. The secret value
+3. Optional description
+4. Secret type (api_key, secret, credential, url, or config)
+
+Common patterns:
+- "Set my OpenAI key to sk-..." -> key: OPENAI_API_KEY, value: sk-...
+- "My Anthropic API key is sk-ant-..." -> key: ANTHROPIC_API_KEY, value: sk-ant-...
+- "Use this Discord token: ..." -> key: DISCORD_BOT_TOKEN, value: ...
+- "Set DATABASE_URL to postgres://..." -> key: DATABASE_URL, value: postgres://...
+
+{{recentMessages}}
+
+Extract the secrets from the user's message. If the key name isn't explicitly specified, infer an appropriate UPPERCASE_WITH_UNDERSCORES name based on the context.`;
+var setSecretAction = {
+  name: "SET_SECRET",
+  similes: [
+    "STORE_SECRET",
+    "SAVE_SECRET",
+    "SET_API_KEY",
+    "CONFIGURE_SECRET",
+    "SET_ENV_VAR",
+    "STORE_API_KEY",
+    "SET_TOKEN",
+    "SAVE_KEY"
+  ],
+  description: "Set a secret value (API key, token, password, etc.) for the agent to use",
+  validate: async (runtime, message, state) => {
+    const text = message.content.text?.toLowerCase() ?? "";
+    const setPatterns = [
+      /\bset\b.*\b(key|token|secret|password|credential|api)/i,
+      /\bmy\b.*\b(key|token|secret|api)\b.*\bis\b/i,
+      /\buse\b.*\b(key|token|this)\b/i,
+      /\bstore\b.*\b(key|token|secret)/i,
+      /\bconfigure\b.*\b(key|token|secret)/i,
+      /\bsave\b.*\b(key|token|secret)/i,
+      /sk-[a-zA-Z0-9]+/i,
+      // OpenAI key pattern
+      /sk-ant-[a-zA-Z0-9]+/i,
+      // Anthropic key pattern
+      /gsk_[a-zA-Z0-9]+/i
+      // Groq key pattern
+    ];
+    const hasIntent = setPatterns.some((pattern) => pattern.test(text));
+    if (!hasIntent) {
+      return false;
+    }
+    const secretsService = runtime.getService(SECRETS_SERVICE_TYPE);
+    return secretsService !== null;
+  },
+  handler: async (runtime, message, state, _options, callback) => {
+    logger7.info("[SetSecret] Processing secret set request");
+    const secretsService = runtime.getService(SECRETS_SERVICE_TYPE);
+    if (!secretsService) {
+      if (callback) {
+        await callback({
+          text: "Secret management is not available. Please ensure the secrets plugin is properly configured.",
+          action: "SET_SECRET"
+        });
+      }
+      return { success: false, text: "Secrets service not available" };
+    }
+    const currentState = state ?? await runtime.composeState(message);
+    let extracted;
+    try {
+      const prompt = composePromptFromState({
+        state: currentState,
+        template: extractSecretsTemplate
+      });
+      const result = await runtime.useModel(ModelType.OBJECT_SMALL, {
+        prompt
+      });
+      const secretsArray = Array.isArray(result.secrets) ? result.secrets : [];
+      extracted = {
+        secrets: secretsArray.filter(
+          (s) => s !== null && typeof s === "object"
+        ).map((s) => ({
+          key: String(s.key || ""),
+          value: String(s.value || ""),
+          description: s.description ? String(s.description) : void 0,
+          type: s.type
+        })).filter((s) => s.key && s.value),
+        level: result.level
+      };
+    } catch (error) {
+      const errorMessage = error instanceof Error ? error.message : String(error);
+      logger7.error(`[SetSecret] Failed to extract secrets: ${errorMessage}`);
+      if (callback) {
+        await callback({
+          text: 'I had trouble understanding the secret you wanted to set. Could you please provide it in a clearer format? For example: "Set my OPENAI_API_KEY to sk-..."',
+          action: "SET_SECRET"
+        });
+      }
+      return { success: false, text: "Failed to extract secrets from message" };
+    }
+    if (!extracted.secrets || extracted.secrets.length === 0) {
+      if (callback) {
+        await callback({
+          text: `I couldn't find any secrets to set in your message. Please provide a key and value, like: "Set my OPENAI_API_KEY to sk-..."`,
+          action: "SET_SECRET"
+        });
+      }
+      return { success: false, text: "No secrets found in message" };
+    }
+    const level = extracted.level ?? "global";
+    const context = {
+      level,
+      agentId: runtime.agentId,
+      worldId: level === "world" ? message.roomId : void 0,
+      userId: level === "user" ? message.entityId : void 0,
+      requesterId: message.entityId
+    };
+    const results = [];
+    for (const secret of extracted.secrets) {
+      const key = secret.key.toUpperCase().replace(/[^A-Z0-9_]/g, "_");
+      const validationMethod = inferValidationStrategy(key);
+      try {
+        const success = await secretsService.set(key, secret.value, context, {
+          type: secret.type ?? "secret",
+          description: secret.description ?? `Secret set via conversation`,
+          validationMethod,
+          encrypted: true
+        });
+        results.push({ key, success });
+        if (success) {
+          logger7.info(`[SetSecret] Successfully set secret: ${key}`);
+        }
+      } catch (error) {
+        const errorMessage = error instanceof Error ? error.message : "Unknown error";
+        results.push({ key, success: false, error: errorMessage });
+        logger7.error(
+          `[SetSecret] Failed to set secret ${key}: ${errorMessage}`
+        );
+      }
+    }
+    const successful = results.filter((r) => r.success);
+    const failed = results.filter((r) => !r.success);
+    let responseText;
+    if (successful.length > 0 && failed.length === 0) {
+      const keys = successful.map((r) => r.key).join(", ");
+      responseText = successful.length === 1 ? `I've securely stored your ${keys}. It's now available for use.` : `I've securely stored ${successful.length} secrets: ${keys}. They're now available for use.`;
+    } else if (successful.length === 0 && failed.length > 0) {
+      const errors = failed.map((r) => `${r.key}: ${r.error}`).join("; ");
+      responseText = `I wasn't able to store the secret(s). ${errors}`;
+    } else {
+      const successKeys = successful.map((r) => r.key).join(", ");
+      const failedKeys = failed.map((r) => r.key).join(", ");
+      responseText = `I stored ${successful.length} secret(s) (${successKeys}), but ${failed.length} failed (${failedKeys}).`;
+    }
+    if (callback) {
+      await callback({
+        text: responseText,
+        action: "SET_SECRET"
+      });
+    }
+    return { success: successful.length > 0, text: responseText };
+  },
+  examples: [
+    [
+      {
+        name: "{{user1}}",
+        content: { text: "Set my OpenAI API key to sk-abc123xyz789" }
+      },
+      {
+        name: "{{agent}}",
+        content: {
+          text: "I've securely stored your OPENAI_API_KEY. It's now available for use.",
+          action: "SET_SECRET"
+        }
+      }
+    ],
+    [
+      {
+        name: "{{user1}}",
+        content: { text: "My Anthropic key is sk-ant-secret123" }
+      },
+      {
+        name: "{{agent}}",
+        content: {
+          text: "I've securely stored your ANTHROPIC_API_KEY. It's now available for use.",
+          action: "SET_SECRET"
+        }
+      }
+    ],
+    [
+      {
+        name: "{{user1}}",
+        content: { text: "Use this Discord bot token: MTIz.abc.xyz" }
+      },
+      {
+        name: "{{agent}}",
+        content: {
+          text: "I've securely stored your DISCORD_BOT_TOKEN. It's now available for use.",
+          action: "SET_SECRET"
+        }
+      }
+    ]
+  ]
+};
+
+// src/actions/manage-secret.ts
+import {
+  ModelType as ModelType2,
+  logger as logger8,
+  composePromptFromState as composePromptFromState2
+} from "@elizaos/core";
+var extractOperationTemplate = `You are helping manage secrets for an AI agent.
+
+Determine what operation the user wants to perform:
+- get: Retrieve a secret value
+- set: Store a new secret
+- delete: Remove a secret
+- list: Show all available secrets (without values)
+- check: Check if a secret exists
+
+Common patterns:
+- "What is my OpenAI key?" -> operation: get, key: OPENAI_API_KEY
+- "Do I have a Discord token set?" -> operation: check, key: DISCORD_BOT_TOKEN
+- "Show me my secrets" -> operation: list
+- "Delete my old API key" -> operation: delete
+- "Remove TWITTER_API_KEY" -> operation: delete, key: TWITTER_API_KEY
+- "Set my key to sk-..." -> operation: set, key: <infer>, value: sk-...
+
+{{recentMessages}}
+
+Extract the operation, key (if applicable), value (if applicable), and level from the user's message.`;
+var manageSecretAction = {
+  name: "MANAGE_SECRET",
+  similes: [
+    "SECRET_MANAGEMENT",
+    "HANDLE_SECRET",
+    "SECRET_OPERATION",
+    "GET_SECRET",
+    "DELETE_SECRET",
+    "LIST_SECRETS",
+    "CHECK_SECRET"
+  ],
+  description: "Manage secrets - get, set, delete, or list secrets at various levels",
+  validate: async (runtime, message, state) => {
+    const text = message.content.text?.toLowerCase() ?? "";
+    const patterns = [
+      /\b(get|show|what|retrieve)\b.*\b(secret|key|token|credential)/i,
+      /\b(delete|remove|clear)\b.*\b(secret|key|token|credential)/i,
+      /\b(list|show)\b.*\b(secrets|keys|tokens|credentials)/i,
+      /\bdo i have\b.*\b(secret|key|token)/i,
+      /\b(check|is)\b.*\b(secret|key|token)\b.*\b(set|configured)/i,
+      /\bmy secrets\b/i,
+      /\bwhat secrets\b/i
+    ];
+    const hasIntent = patterns.some((pattern) => pattern.test(text));
+    if (!hasIntent) {
+      return false;
+    }
+    const secretsService = runtime.getService(SECRETS_SERVICE_TYPE);
+    return secretsService !== null;
+  },
+  handler: async (runtime, message, state, _options, callback) => {
+    logger8.info("[ManageSecret] Processing secret management request");
+    const secretsService = runtime.getService(SECRETS_SERVICE_TYPE);
+    if (!secretsService) {
+      if (callback) {
+        await callback({
+          text: "Secret management is not available.",
+          action: "MANAGE_SECRET"
+        });
+      }
+      return { success: false, text: "Secrets service not available" };
+    }
+    const currentState = state ?? await runtime.composeState(message);
+    let operation;
+    try {
+      const prompt = composePromptFromState2({
+        state: currentState,
+        template: extractOperationTemplate
+      });
+      const result = await runtime.useModel(ModelType2.OBJECT_SMALL, {
+        prompt
+      });
+      operation = {
+        operation: result.operation || "list",
+        key: result.key ? String(result.key) : void 0,
+        value: result.value ? String(result.value) : void 0,
+        level: result.level,
+        description: result.description ? String(result.description) : void 0,
+        type: result.type
+      };
+    } catch (error) {
+      const errorMessage = error instanceof Error ? error.message : String(error);
+      logger8.error(
+        `[ManageSecret] Failed to extract operation: ${errorMessage}`
+      );
+      if (callback) {
+        await callback({
+          text: "I had trouble understanding what you want to do with secrets. Could you be more specific?",
+          action: "MANAGE_SECRET"
+        });
+      }
+      return {
+        success: false,
+        text: "Failed to extract operation from message"
+      };
+    }
+    const level = operation.level ?? "global";
+    const context = {
+      level,
+      agentId: runtime.agentId,
+      worldId: level === "world" ? message.roomId : void 0,
+      userId: level === "user" ? message.entityId : void 0,
+      requesterId: message.entityId
+    };
+    let responseText;
+    switch (operation.operation) {
+      case "get": {
+        if (!operation.key) {
+          responseText = "Please specify which secret you want to retrieve.";
+          break;
+        }
+        const key = operation.key.toUpperCase().replace(/[^A-Z0-9_]/g, "_");
+        const value = await secretsService.get(key, context);
+        if (value) {
+          const maskedValue = maskSecretValue(value);
+          responseText = `Your ${key} is set to: ${maskedValue}`;
+        } else {
+          responseText = `I don't have a ${key} stored. Would you like to set one?`;
+        }
+        break;
+      }
+      case "set": {
+        if (!operation.key || !operation.value) {
+          responseText = "Please provide both a key and value to set a secret.";
+          break;
+        }
+        const key = operation.key.toUpperCase().replace(/[^A-Z0-9_]/g, "_");
+        try {
+          const success = await secretsService.set(
+            key,
+            operation.value,
+            context,
+            {
+              type: operation.type ?? "secret",
+              description: operation.description ?? "Set via conversation",
+              encrypted: true
+            }
+          );
+          if (success) {
+            responseText = `I've securely stored your ${key}.`;
+          } else {
+            responseText = `Failed to store ${key}. Please try again.`;
+          }
+        } catch (error) {
+          responseText = `Error storing ${key}: ${error instanceof Error ? error.message : "Unknown error"}`;
+        }
+        break;
+      }
+      case "delete": {
+        if (!operation.key) {
+          responseText = "Please specify which secret you want to delete.";
+          break;
+        }
+        const key = operation.key.toUpperCase().replace(/[^A-Z0-9_]/g, "_");
+        const deleted = await secretsService.delete(key, context);
+        if (deleted) {
+          responseText = `I've deleted your ${key}.`;
+        } else {
+          responseText = `I couldn't find a ${key} to delete.`;
+        }
+        break;
+      }
+      case "list": {
+        const metadata = await secretsService.list(context);
+        const keys = Object.keys(metadata);
+        if (keys.length === 0) {
+          responseText = `You don't have any ${level} secrets stored yet.`;
+        } else {
+          const secretList = keys.map((key) => {
+            const config = metadata[key];
+            const status = config.status === "valid" ? "\u2713" : "\u26A0";
+            return `\u2022 ${key} ${status}`;
+          }).join("\n");
+          responseText = `Here are your ${level} secrets:
+${secretList}`;
+        }
+        break;
+      }
+      case "check": {
+        if (!operation.key) {
+          responseText = "Please specify which secret you want to check.";
+          break;
+        }
+        const key = operation.key.toUpperCase().replace(/[^A-Z0-9_]/g, "_");
+        const exists = await secretsService.exists(key, context);
+        if (exists) {
+          const config = await secretsService.getConfig(key, context);
+          const status = config?.status === "valid" ? "valid" : config?.status ?? "unknown";
+          responseText = `Yes, ${key} is set and its status is: ${status}.`;
+        } else {
+          responseText = `No, ${key} is not set. Would you like to configure it?`;
+        }
+        break;
+      }
+      default:
+        responseText = "I'm not sure what operation you want to perform. You can get, set, delete, list, or check secrets.";
+    }
+    if (callback) {
+      await callback({
+        text: responseText,
+        action: "MANAGE_SECRET"
+      });
+    }
+    return { success: true, text: responseText };
+  },
+  examples: [
+    [
+      {
+        name: "{{user1}}",
+        content: { text: "What secrets do I have?" }
+      },
+      {
+        name: "{{agent}}",
+        content: {
+          text: "Here are your global secrets:\n\u2022 OPENAI_API_KEY \u2713\n\u2022 ANTHROPIC_API_KEY \u2713",
+          action: "MANAGE_SECRET"
+        }
+      }
+    ],
+    [
+      {
+        name: "{{user1}}",
+        content: { text: "Do I have a Discord token set?" }
+      },
+      {
+        name: "{{agent}}",
+        content: {
+          text: "No, DISCORD_BOT_TOKEN is not set. Would you like to configure it?",
+          action: "MANAGE_SECRET"
+        }
+      }
+    ],
+    [
+      {
+        name: "{{user1}}",
+        content: { text: "Delete my old Twitter API key" }
+      },
+      {
+        name: "{{agent}}",
+        content: {
+          text: "I've deleted your TWITTER_API_KEY.",
+          action: "MANAGE_SECRET"
+        }
+      }
+    ]
+  ]
+};
+function maskSecretValue(value) {
+  if (value.length <= 8) {
+    return "****";
+  }
+  const visibleStart = value.slice(0, 4);
+  const visibleEnd = value.slice(-4);
+  const maskedLength = Math.min(value.length - 8, 20);
+  const mask = "*".repeat(maskedLength);
+  return `${visibleStart}${mask}${visibleEnd}`;
+}
+
+// src/providers/secrets-status.ts
+import {
+  logger as logger9
+} from "@elizaos/core";
+var secretsStatusProvider = {
+  name: "SECRETS_STATUS",
+  description: "Provides information about configured secrets and their status",
+  get: async (runtime, message, state) => {
+    const secretsService = runtime.getService(SECRETS_SERVICE_TYPE);
+    if (!secretsService) {
+      return { text: "" };
+    }
+    try {
+      const globalSecrets = await secretsService.list({
+        level: "global",
+        agentId: runtime.agentId
+      });
+      const secretKeys = Object.keys(globalSecrets);
+      if (secretKeys.length === 0) {
+        return {
+          text: `[Secrets Status]
+No secrets are currently configured. The agent may need API keys or other credentials to access certain services.`
+        };
+      }
+      const valid = [];
+      const missing = [];
+      const invalid = [];
+      for (const [key, config] of Object.entries(globalSecrets)) {
+        switch (config.status) {
+          case "valid":
+            valid.push(key);
+            break;
+          case "missing":
+            missing.push(key);
+            break;
+          case "invalid":
+          case "expired":
+          case "revoked":
+            invalid.push(key);
+            break;
+          default:
+            valid.push(key);
+        }
+      }
+      const lines = ["[Secrets Status]"];
+      if (valid.length > 0) {
+        lines.push(`Configured secrets: ${valid.join(", ")}`);
+      }
+      if (invalid.length > 0) {
+        lines.push(`Invalid/expired secrets: ${invalid.join(", ")}`);
+      }
+      if (missing.length > 0) {
+        lines.push(`Missing required secrets: ${missing.join(", ")}`);
+      }
+      const activatorService = runtime.getService(
+        PLUGIN_ACTIVATOR_SERVICE_TYPE
+      );
+      if (activatorService) {
+        const pendingPlugins = activatorService.getPendingPlugins();
+        if (pendingPlugins.length > 0) {
+          lines.push(
+            `Plugins waiting for secrets: ${pendingPlugins.join(", ")}`
+          );
+          const requiredSecrets = activatorService.getRequiredSecrets();
+          if (requiredSecrets.size > 0) {
+            lines.push(
+              `Secrets needed for pending plugins: ${Array.from(requiredSecrets).join(", ")}`
+            );
+          }
+        }
+      }
+      return { text: lines.join("\n") };
+    } catch (error) {
+      const errorMsg = error instanceof Error ? error.message : String(error);
+      logger9.error(
+        `[SecretsStatusProvider] Error getting secrets status: ${errorMsg}`
+      );
+      return { text: "" };
+    }
+  }
+};
+var secretsInfoProvider = {
+  name: "SECRETS_INFO",
+  description: "Provides detailed secret information based on conversation context",
+  get: async (runtime, message, state) => {
+    const secretsService = runtime.getService(SECRETS_SERVICE_TYPE);
+    if (!secretsService) {
+      return { text: "" };
+    }
+    const text = message.content.text?.toLowerCase() ?? "";
+    const isAboutSecrets = /\b(secret|key|token|credential|api|password|configure)\b/i.test(text);
+    if (!isAboutSecrets) {
+      return { text: "" };
+    }
+    try {
+      const globalSecrets = await secretsService.list({
+        level: "global",
+        agentId: runtime.agentId
+      });
+      const secretCount = Object.keys(globalSecrets).length;
+      if (secretCount === 0) {
+        return {
+          text: `[Secrets Info]
+No secrets configured. User can set secrets by saying things like "Set my OPENAI_API_KEY to sk-..."`
+        };
+      }
+      const lines = ["[Secrets Info]"];
+      lines.push(`Total configured secrets: ${secretCount}`);
+      const byType = {};
+      for (const [key, config] of Object.entries(globalSecrets)) {
+        const type = config.type ?? "secret";
+        if (!byType[type]) {
+          byType[type] = [];
+        }
+        byType[type].push(key);
+      }
+      for (const [type, keys] of Object.entries(byType)) {
+        lines.push(`${type}: ${keys.join(", ")}`);
+      }
+      const commonSecrets = [
+        "OPENAI_API_KEY",
+        "ANTHROPIC_API_KEY",
+        "DISCORD_BOT_TOKEN",
+        "TELEGRAM_BOT_TOKEN",
+        "TWITTER_API_KEY"
+      ];
+      const missingCommon = commonSecrets.filter((key) => !globalSecrets[key]);
+      if (missingCommon.length > 0 && missingCommon.length < commonSecrets.length) {
+        lines.push(`Common secrets not set: ${missingCommon.join(", ")}`);
+      }
+      return { text: lines.join("\n") };
+    } catch (error) {
+      const errorMsg = error instanceof Error ? error.message : String(error);
+      logger9.error(`[SecretsInfoProvider] Error: ${errorMsg}`);
+      return { text: "" };
+    }
+  }
+};
+
+// src/onboarding/config.ts
+var DEFAULT_ONBOARDING_MESSAGES = {
+  welcome: [
+    "Hi! I need to collect some information to get set up. Is now a good time?",
+    "Hey there! I need to configure a few things. Do you have a moment?",
+    "Hello! Could we take a few minutes to get everything set up?"
+  ],
+  askSetting: "I need your {{settingName}}. {{usageDescription}}",
+  settingUpdated: "Got it! I've saved your {{settingName}}.",
+  allComplete: "Great! All required settings have been configured. You're all set!",
+  error: "I had trouble understanding that. Could you try again?"
+};
+var COMMON_API_KEY_SETTINGS = {
+  OPENAI_API_KEY: {
+    name: "OpenAI API Key",
+    description: "API key for OpenAI services (GPT models)",
+    usageDescription: 'Your OpenAI API key starts with "sk-"',
+    secret: true,
+    public: false,
+    required: false,
+    dependsOn: [],
+    validationMethod: "openai",
+    type: "api_key",
+    envVar: "OPENAI_API_KEY"
+  },
+  ANTHROPIC_API_KEY: {
+    name: "Anthropic API Key",
+    description: "API key for Anthropic services (Claude models)",
+    usageDescription: 'Your Anthropic API key starts with "sk-ant-"',
+    secret: true,
+    public: false,
+    required: false,
+    dependsOn: [],
+    validationMethod: "anthropic",
+    type: "api_key",
+    envVar: "ANTHROPIC_API_KEY"
+  },
+  GROQ_API_KEY: {
+    name: "Groq API Key",
+    description: "API key for Groq inference services",
+    usageDescription: 'Your Groq API key starts with "gsk_"',
+    secret: true,
+    public: false,
+    required: false,
+    dependsOn: [],
+    validationMethod: "groq",
+    type: "api_key",
+    envVar: "GROQ_API_KEY"
+  },
+  GOOGLE_API_KEY: {
+    name: "Google API Key",
+    description: "API key for Google AI services (Gemini)",
+    usageDescription: "Your Google API key for Gemini models",
+    secret: true,
+    public: false,
+    required: false,
+    dependsOn: [],
+    validationMethod: "google",
+    type: "api_key",
+    envVar: "GOOGLE_API_KEY"
+  },
+  DISCORD_TOKEN: {
+    name: "Discord Bot Token",
+    description: "Bot token for Discord integration",
+    usageDescription: "Your Discord bot token from the developer portal",
+    secret: true,
+    public: false,
+    required: false,
+    dependsOn: [],
+    validationMethod: "discord",
+    type: "token",
+    envVar: "DISCORD_TOKEN"
+  },
+  TELEGRAM_BOT_TOKEN: {
+    name: "Telegram Bot Token",
+    description: "Bot token for Telegram integration",
+    usageDescription: "Your Telegram bot token from @BotFather",
+    secret: true,
+    public: false,
+    required: false,
+    dependsOn: [],
+    validationMethod: "telegram",
+    type: "token",
+    envVar: "TELEGRAM_BOT_TOKEN"
+  },
+  TWITTER_USERNAME: {
+    name: "Twitter Username",
+    description: "Twitter/X username for posting",
+    usageDescription: "The Twitter username (without @)",
+    secret: false,
+    public: true,
+    required: false,
+    dependsOn: [],
+    type: "credential"
+  },
+  TWITTER_PASSWORD: {
+    name: "Twitter Password",
+    description: "Twitter/X account password",
+    usageDescription: "The password for your Twitter account",
+    secret: true,
+    public: false,
+    required: false,
+    dependsOn: ["TWITTER_USERNAME"],
+    type: "credential"
+  },
+  TWITTER_EMAIL: {
+    name: "Twitter Email",
+    description: "Email associated with Twitter account",
+    usageDescription: "The email address linked to your Twitter account",
+    secret: false,
+    public: false,
+    required: false,
+    dependsOn: ["TWITTER_USERNAME"],
+    type: "credential",
+    validation: (value) => /^[^\s@]+@[^\s@]+\.[^\s@]+$/.test(value)
+  },
+  TWITTER_2FA_SECRET: {
+    name: "Twitter 2FA Secret",
+    description: "2FA secret for Twitter account",
+    usageDescription: "The 2FA/TOTP secret (if 2FA is enabled)",
+    secret: true,
+    public: false,
+    required: false,
+    dependsOn: ["TWITTER_USERNAME", "TWITTER_PASSWORD"],
+    type: "credential"
+  }
+};
+function createOnboardingConfig(requiredKeys, optionalKeys = [], customSettings = {}) {
+  const settings = {};
+  for (const key of requiredKeys) {
+    const common = COMMON_API_KEY_SETTINGS[key] || {};
+    const custom = customSettings[key] || {};
+    settings[key] = {
+      name: custom.name || common.name || key,
+      description: custom.description || common.description || `Configure ${key}`,
+      usageDescription: custom.usageDescription || common.usageDescription,
+      secret: custom.secret ?? common.secret ?? true,
+      public: custom.public ?? common.public ?? false,
+      required: true,
+      dependsOn: custom.dependsOn || common.dependsOn || [],
+      validationMethod: custom.validationMethod || common.validationMethod,
+      type: custom.type || common.type || "api_key",
+      envVar: custom.envVar || common.envVar || key,
+      value: null,
+      ...custom
+    };
+  }
+  for (const key of optionalKeys) {
+    const common = COMMON_API_KEY_SETTINGS[key] || {};
+    const custom = customSettings[key] || {};
+    settings[key] = {
+      name: custom.name || common.name || key,
+      description: custom.description || common.description || `Configure ${key}`,
+      usageDescription: custom.usageDescription || common.usageDescription,
+      secret: custom.secret ?? common.secret ?? true,
+      public: custom.public ?? common.public ?? false,
+      required: false,
+      dependsOn: custom.dependsOn || common.dependsOn || [],
+      validationMethod: custom.validationMethod || common.validationMethod,
+      type: custom.type || common.type || "api_key",
+      envVar: custom.envVar || common.envVar || key,
+      value: null,
+      ...custom
+    };
+  }
+  return { settings };
+}
+function getUnconfiguredRequired(config) {
+  return Object.entries(config.settings).filter(
+    ([_, setting]) => setting.required && setting.value === null
+  );
+}
+function getUnconfiguredOptional(config) {
+  return Object.entries(config.settings).filter(
+    ([_, setting]) => !setting.required && setting.value === null
+  );
+}
+function isOnboardingComplete(config) {
+  return getUnconfiguredRequired(config).length === 0;
+}
+function getNextSetting(config) {
+  const unconfigured = getUnconfiguredRequired(config);
+  for (const [key, setting] of unconfigured) {
+    const dependenciesMet = setting.dependsOn.every((dep) => {
+      const depSetting = config.settings[dep];
+      return depSetting && depSetting.value !== null;
+    });
+    const isVisible = !setting.visibleIf || setting.visibleIf(config.settings);
+    if (dependenciesMet && isVisible) {
+      return [key, setting];
+    }
+  }
+  const optionalUnconfigured = getUnconfiguredOptional(config);
+  for (const [key, setting] of optionalUnconfigured) {
+    const dependenciesMet = setting.dependsOn.every((dep) => {
+      const depSetting = config.settings[dep];
+      return depSetting && depSetting.value !== null;
+    });
+    const isVisible = !setting.visibleIf || setting.visibleIf(config.settings);
+    if (dependenciesMet && isVisible) {
+      return [key, setting];
+    }
+  }
+  return null;
+}
+function generateSettingPrompt(key, setting, agentName) {
+  const required = setting.required ? "(Required)" : "(Optional)";
+  const usage = setting.usageDescription || setting.description;
+  return `${agentName} needs to collect the ${setting.name} ${required}.
+Description: ${usage}
+Ask the user for their ${setting.name} in a natural, conversational way.`;
+}
+
+// src/onboarding/service.ts
+import { Service as Service3, logger as logger10 } from "@elizaos/core";
+var ONBOARDING_SERVICE_TYPE = "SECRETS_ONBOARDING";
+var OnboardingService = class _OnboardingService extends Service3 {
+  static serviceType = ONBOARDING_SERVICE_TYPE;
+  capabilityDescription = "Manage secrets onboarding across chat platforms";
+  secretsService = null;
+  sessions = /* @__PURE__ */ new Map();
+  constructor(runtime) {
+    super(runtime);
+  }
+  /**
+   * Start the service
+   */
+  static async start(runtime) {
+    const service = new _OnboardingService(runtime);
+    await service.initialize();
+    return service;
+  }
+  /**
+   * Initialize the service
+   */
+  async initialize() {
+    logger10.info("[OnboardingService] Starting");
+    this.secretsService = this.runtime.getService("SECRETS");
+    this.registerEvents();
+    logger10.info("[OnboardingService] Started");
+  }
+  async stop() {
+    logger10.info("[OnboardingService] Stopping");
+    this.sessions.clear();
+    logger10.info("[OnboardingService] Stopped");
+  }
+  /**
+   * Register platform-specific event handlers.
+   */
+  registerEvents() {
+    this.runtime.registerEvent("DISCORD_WORLD_JOINED", async (params) => {
+      const server = params.server;
+      if (server) {
+        logger10.info(`[OnboardingService] Discord world joined: ${server.id}`);
+      }
+    });
+    this.runtime.registerEvent("DISCORD_SERVER_CONNECTED", async (params) => {
+      const server = params.server;
+      if (server) {
+        logger10.info(
+          `[OnboardingService] Discord server connected: ${server.id}`
+        );
+      }
+    });
+    this.runtime.registerEvent("TELEGRAM_WORLD_JOINED", async (params) => {
+      const typedParams = params;
+      if (typedParams.world && typedParams.chat && typedParams.entities && typedParams.botUsername) {
+        logger10.info(
+          `[OnboardingService] Telegram world joined: ${typedParams.world.id}`
+        );
+        await this.startTelegramOnboarding(
+          typedParams.world,
+          typedParams.chat,
+          typedParams.entities,
+          typedParams.botUsername
+        );
+      }
+    });
+  }
+  /**
+   * Initialize onboarding for a world with the given config.
+   */
+  async initializeOnboarding(world, config) {
+    logger10.info(
+      `[OnboardingService] Initializing onboarding for world: ${world.id}`
+    );
+    if (!world.metadata) {
+      world.metadata = {};
+    }
+    const settingsState = {};
+    for (const [key, setting] of Object.entries(config.settings)) {
+      settingsState[key] = {
+        ...setting,
+        value: null
+      };
+    }
+    const metadata = world.metadata;
+    metadata["settings"] = settingsState;
+    metadata.onboardingConfig = config;
+    await this.runtime.updateWorld(world);
+    logger10.info(
+      `[OnboardingService] Onboarding initialized for world: ${world.id}`
+    );
+  }
+  /**
+   * Start onboarding via DM (Discord).
+   */
+  async startDiscordOnboardingDM(serverId, ownerId, worldId, config) {
+    const messages = config.messages?.welcome || DEFAULT_ONBOARDING_MESSAGES.welcome;
+    const _randomMessage = messages[Math.floor(Math.random() * messages.length)];
+    logger10.info(
+      `[OnboardingService] Discord DM onboarding started - server: ${serverId}, owner: ${ownerId}, world: ${worldId}`
+    );
+  }
+  /**
+   * Start onboarding via deep link (Telegram).
+   */
+  async startTelegramOnboarding(world, chat, entities, botUsername) {
+    let ownerId = null;
+    let ownerUsername = null;
+    for (const entity of entities) {
+      if (entity.metadata?.telegram?.adminTitle === "Owner") {
+        ownerId = entity.metadata.telegram.id;
+        ownerUsername = entity.metadata.telegram.username;
+        break;
+      }
+    }
+    if (!ownerId) {
+      logger10.warn("[OnboardingService] No owner found for Telegram group");
+      return;
+    }
+    const telegramService = this.runtime.getService("telegram");
+    if (telegramService?.messageManager) {
+      const deepLinkMessage = [
+        `Hello @${ownerUsername}! Could we take a few minutes to get everything set up?`,
+        `Please click this link to start chatting with me: https://t.me/${botUsername}?start=onboarding`
+      ].join(" ");
+      await telegramService.messageManager.sendMessage(chat.id, {
+        text: deepLinkMessage
+      });
+      logger10.info(
+        `[OnboardingService] Sent Telegram deep link - chatId: ${chat.id}, ownerId: ${ownerId}`
+      );
+    }
+  }
+  /**
+   * Start a new onboarding session.
+   */
+  async startSession(worldId, userId, roomId, config, platform = "other", mode = "conversational") {
+    const session = {
+      worldId,
+      userId,
+      roomId,
+      config,
+      currentSettingKey: null,
+      startedAt: Date.now(),
+      lastActivityAt: Date.now(),
+      platform,
+      mode
+    };
+    this.sessions.set(roomId, session);
+    logger10.info(
+      `[OnboardingService] Session started - roomId: ${roomId}, worldId: ${worldId}, userId: ${userId}`
+    );
+    return session;
+  }
+  /**
+   * Get an active session by room ID.
+   */
+  getSession(roomId) {
+    return this.sessions.get(roomId) || null;
+  }
+  /**
+   * Process a user message during onboarding.
+   */
+  async processMessage(roomId, message) {
+    const session = this.sessions.get(roomId);
+    if (!session) {
+      return { shouldRespond: false };
+    }
+    session.lastActivityAt = Date.now();
+    const unconfigured = getUnconfiguredRequired(session.config);
+    if (unconfigured.length === 0) {
+      return {
+        shouldRespond: true,
+        response: session.config.messages?.allComplete || DEFAULT_ONBOARDING_MESSAGES.allComplete,
+        complete: true
+      };
+    }
+    const text = message.content?.text || "";
+    const currentSetting = session.currentSettingKey ? session.config.settings[session.currentSettingKey] : null;
+    if (currentSetting && text.trim()) {
+      const value = text.trim();
+      if (currentSetting.validation && !currentSetting.validation(value)) {
+        return {
+          shouldRespond: true,
+          response: `That doesn't look like a valid ${currentSetting.name}. ${currentSetting.usageDescription || "Please try again."}`
+        };
+      }
+      if (this.secretsService) {
+        const context = {
+          level: "world",
+          agentId: this.runtime.agentId,
+          worldId: session.worldId,
+          userId: session.userId
+        };
+        await this.secretsService.set(
+          session.currentSettingKey,
+          value,
+          context,
+          {
+            description: currentSetting.description,
+            type: currentSetting.type,
+            encrypted: currentSetting.secret
+          }
+        );
+      }
+      session.config.settings[session.currentSettingKey].value = value;
+      if (isOnboardingComplete(session.config)) {
+        this.sessions.delete(roomId);
+        return {
+          shouldRespond: true,
+          response: session.config.messages?.allComplete || DEFAULT_ONBOARDING_MESSAGES.allComplete,
+          updatedKey: session.currentSettingKey,
+          complete: true
+        };
+      }
+      const next2 = getNextSetting(session.config);
+      if (next2) {
+        const [nextKey, nextSetting] = next2;
+        session.currentSettingKey = nextKey;
+        const askMessage = (session.config.messages?.askSetting || DEFAULT_ONBOARDING_MESSAGES.askSetting).replace("{{settingName}}", nextSetting.name).replace(
+          "{{usageDescription}}",
+          nextSetting.usageDescription || nextSetting.description
+        );
+        return {
+          shouldRespond: true,
+          response: `${session.config.messages?.settingUpdated || DEFAULT_ONBOARDING_MESSAGES.settingUpdated.replace("{{settingName}}", currentSetting.name)}
+
+${askMessage}`,
+          updatedKey: session.currentSettingKey
+        };
+      }
+    }
+    const next = getNextSetting(session.config);
+    if (next) {
+      const [nextKey, nextSetting] = next;
+      session.currentSettingKey = nextKey;
+      const askMessage = (session.config.messages?.askSetting || DEFAULT_ONBOARDING_MESSAGES.askSetting).replace("{{settingName}}", nextSetting.name).replace(
+        "{{usageDescription}}",
+        nextSetting.usageDescription || nextSetting.description
+      );
+      return {
+        shouldRespond: true,
+        response: askMessage
+      };
+    }
+    return { shouldRespond: false };
+  }
+  /**
+   * End an onboarding session.
+   */
+  endSession(roomId) {
+    this.sessions.delete(roomId);
+    logger10.info(`[OnboardingService] Session ended - roomId: ${roomId}`);
+  }
+  /**
+   * Get the onboarding status for a world.
+   */
+  async getOnboardingStatus(worldId) {
+    const world = await this.runtime.getWorld(worldId);
+    if (!world?.metadata?.settings) {
+      return {
+        initialized: false,
+        complete: false,
+        configuredCount: 0,
+        requiredCount: 0,
+        missingRequired: []
+      };
+    }
+    const settings = world.metadata.settings;
+    const entries = Object.entries(settings);
+    const required = entries.filter(([_, s]) => s.required);
+    const configured = required.filter(([_, s]) => s.value !== null);
+    const missing = required.filter(([_, s]) => s.value === null).map(([k, _]) => k);
+    return {
+      initialized: true,
+      complete: missing.length === 0,
+      configuredCount: configured.length,
+      requiredCount: required.length,
+      missingRequired: missing
+    };
+  }
+  /**
+   * Generate the SETTINGS provider context for LLM.
+   */
+  generateSettingsContext(config, isOnboarding, agentName) {
+    const entries = Object.entries(config.settings);
+    const unconfigured = getUnconfiguredRequired(config);
+    const settingsList = entries.map(([key, setting]) => {
+      const status = setting.value !== null ? "Configured" : "Not set";
+      const required = setting.required ? "(Required)" : "(Optional)";
+      const value = setting.secret && setting.value ? "****************" : setting.value || "Not set";
+      return `${key}: ${value} ${required}
+(${setting.name}) ${setting.usageDescription || setting.description}`;
+    }).join("\n\n");
+    const validKeys = `Valid setting keys: ${entries.map(([k, _]) => k).join(", ")}`;
+    if (isOnboarding && unconfigured.length > 0) {
+      return `# PRIORITY TASK: Onboarding
+
+${agentName} needs to help the user configure ${unconfigured.length} required settings:
+
+${settingsList}
+
+${validKeys}
+
+Instructions for ${agentName}:
+- Only update settings if the user is clearly responding to a setting you are currently asking about.
+- If the user's reply clearly maps to a setting and a valid value, you **must** call the UPDATE_SETTINGS action.
+- Never hallucinate settings or respond with values not listed above.
+- Prioritize configuring required settings before optional ones.`;
+    }
+    return `## Current Configuration
+${unconfigured.length > 0 ? `IMPORTANT: ${unconfigured.length} required settings still need configuration.
+
+` : "All required settings are configured.\n\n"}${settingsList}`;
+  }
+};
+
+// src/onboarding/provider.ts
+import { ChannelType as ChannelType2, logger as logger11 } from "@elizaos/core";
+function formatSettingValue(setting, isOnboarding) {
+  if (setting.value === null || setting.value === void 0) {
+    return "Not set";
+  }
+  if (setting.secret && !isOnboarding) {
+    return "****************";
+  }
+  return String(setting.value);
+}
+function generateStatusMessage(settings, isOnboarding, agentName, senderName) {
+  const entries = Object.entries(settings);
+  const formattedSettings = entries.map(([key, setting]) => {
+    if (setting.visibleIf && !setting.visibleIf(settings)) {
+      return null;
+    }
+    return {
+      key,
+      name: setting.name,
+      value: formatSettingValue(setting, isOnboarding),
+      description: setting.description,
+      usageDescription: setting.usageDescription || setting.description,
+      required: setting.required,
+      configured: setting.value !== null
+    };
+  }).filter(Boolean);
+  const requiredUnconfigured = formattedSettings.filter(
+    (s) => s?.required && !s.configured
+  ).length;
+  if (isOnboarding) {
+    const settingsList = formattedSettings.map((s) => {
+      if (!s) return "";
+      const label = s.required ? "(Required)" : "(Optional)";
+      return `${s.key}: ${s.value} ${label}
+(${s.name}) ${s.usageDescription}`;
+    }).filter(Boolean).join("\n\n");
+    const validKeys = `Valid setting keys: ${entries.map(([k]) => k).join(", ")}`;
+    const instructions = `Instructions for ${agentName}:
+- Only update settings if the user is clearly responding to a setting you are currently asking about.
+- If the user's reply clearly maps to a setting and a valid value, you **must** call the UPDATE_SETTINGS action with the correct key and value.
+- Never hallucinate settings or respond with values not listed above.
+- Do not call UPDATE_SETTINGS just because onboarding started. Only update when the user provides a specific value.
+- Answer setting-related questions using only the name, description, and value from the list.`;
+    if (requiredUnconfigured > 0) {
+      const name = senderName || "user";
+      return `# PRIORITY TASK: Onboarding with ${name}
+
+${agentName} needs to help the user configure ${requiredUnconfigured} required settings:
+
+${settingsList}
+
+${validKeys}
+
+${instructions}
+
+- Prioritize configuring required settings before optional ones.`;
+    }
+    return `All required settings have been configured. Here's the current configuration:
+
+${settingsList}
+
+${validKeys}
+
+${instructions}`;
+  }
+  return `## Current Configuration
+
+${requiredUnconfigured > 0 ? `IMPORTANT!: ${requiredUnconfigured} required settings still need configuration. ${agentName} should get onboarded with the OWNER as soon as possible.
+
+` : "All required settings are configured.\n\n"}${formattedSettings.map((s) => {
+    if (!s) return "";
+    return `### ${s.name}
+**Value:** ${s.value}
+**Description:** ${s.description}`;
+  }).filter(Boolean).join("\n\n")}`;
+}
+var onboardingSettingsProvider = {
+  name: "ONBOARDING_SETTINGS",
+  description: "Current onboarding settings status for secrets collection",
+  get: async (runtime, message, state) => {
+    const room = await runtime.getRoom(message.roomId);
+    if (!room) {
+      logger11.debug("[OnboardingSettingsProvider] No room found");
+      return {
+        data: { settings: [] },
+        values: { settings: "Error: Room not found" },
+        text: "Error: Room not found"
+      };
+    }
+    if (!room.worldId) {
+      logger11.debug("[OnboardingSettingsProvider] No world ID for room");
+      return {
+        data: { settings: [] },
+        values: { settings: "Room has no associated world." },
+        text: "Room has no associated world."
+      };
+    }
+    const isOnboarding = room.type === ChannelType2.DM;
+    const world = await runtime.getWorld(room.worldId);
+    if (!world) {
+      logger11.debug("[OnboardingSettingsProvider] No world found");
+      return {
+        data: { settings: [] },
+        values: { settings: "Error: World not found" },
+        text: "Error: World not found"
+      };
+    }
+    const worldSettings = world.metadata?.settings;
+    if (!worldSettings) {
+      if (isOnboarding) {
+        return {
+          data: { settings: [] },
+          values: {
+            settings: "No settings configured for this world. Use initializeOnboarding to set up."
+          },
+          text: "No settings configured for this world."
+        };
+      }
+      return {
+        data: { settings: [] },
+        values: { settings: "" },
+        text: ""
+      };
+    }
+    const agentName = runtime.character.name ?? "Agent";
+    const senderName = state?.senderName;
+    const output = generateStatusMessage(
+      worldSettings,
+      isOnboarding,
+      agentName,
+      senderName
+    );
+    return {
+      data: { settings: worldSettings },
+      values: { settings: output },
+      text: output
+    };
+  }
+};
+var missingSecretsProvider = {
+  name: "MISSING_SECRETS",
+  description: "Lists secrets that still need to be configured",
+  get: async (runtime, message, _state) => {
+    const room = await runtime.getRoom(message.roomId);
+    if (!room?.worldId) {
+      return {
+        data: { missing: [] },
+        values: { missingSecrets: "" },
+        text: ""
+      };
+    }
+    const world = await runtime.getWorld(room.worldId);
+    if (!world?.metadata?.settings) {
+      return {
+        data: { missing: [] },
+        values: { missingSecrets: "" },
+        text: ""
+      };
+    }
+    const settings = world.metadata.settings;
+    const entries = Object.entries(settings);
+    const missingRequired = entries.filter(([_, s]) => s.required && s.value === null).map(([key, setting]) => ({
+      key,
+      name: setting.name,
+      description: setting.usageDescription || setting.description
+    }));
+    const missingOptional = entries.filter(([_, s]) => !s.required && s.value === null).map(([key, setting]) => ({
+      key,
+      name: setting.name,
+      description: setting.usageDescription || setting.description
+    }));
+    if (missingRequired.length === 0 && missingOptional.length === 0) {
+      return {
+        data: { missing: [] },
+        values: { missingSecrets: "All secrets are configured." },
+        text: "All secrets are configured."
+      };
+    }
+    let output = "";
+    if (missingRequired.length > 0) {
+      output += `Missing required secrets:
+${missingRequired.map((s) => `- ${s.key}: ${s.description}`).join("\n")}
+
+`;
+    }
+    if (missingOptional.length > 0) {
+      output += `Missing optional secrets:
+${missingOptional.map((s) => `- ${s.key}: ${s.description}`).join("\n")}`;
+    }
+    return {
+      data: {
+        missing: [...missingRequired, ...missingOptional],
+        missingRequired,
+        missingOptional
+      },
+      values: { missingSecrets: output.trim() },
+      text: output.trim()
+    };
+  }
+};
+
+// src/onboarding/action.ts
+import { ChannelType as ChannelType3, ModelType as ModelType3, logger as logger12 } from "@elizaos/core";
+async function extractSettingValues(runtime, message, state, settings) {
+  const unconfigured = Object.entries(settings).filter(
+    ([_, s]) => s.value === null
+  );
+  if (unconfigured.length === 0) {
+    return [];
+  }
+  const settingsContext = unconfigured.map(([key, setting]) => {
+    const requiredStr = setting.required ? "Required." : "Optional.";
+    return `${key}: ${setting.description} ${requiredStr}`;
+  }).join("\n");
+  const prompt = `I need to extract settings values from the user's message.
+
+Available settings:
+${settingsContext}
+
+User message: ${state.text || message.content?.text || ""}
+
+For each setting mentioned in the user's message, extract the value.
+
+Only return settings that are clearly mentioned in the user's message.
+If a setting is mentioned but no clear value is provided, do not include it.`;
+  const result = await runtime.useModel(ModelType3.OBJECT_LARGE, {
+    prompt,
+    output: "array",
+    schema: {
+      type: "array",
+      items: {
+        type: "object",
+        properties: {
+          key: { type: "string" },
+          value: { type: "string" }
+        },
+        required: ["key", "value"]
+      }
+    }
+  });
+  if (!result) {
+    return [];
+  }
+  const validUpdates = [];
+  const extractFromResult = (obj) => {
+    if (Array.isArray(obj)) {
+      for (const item of obj) {
+        extractFromResult(item);
+      }
+    } else if (typeof obj === "object" && obj !== null) {
+      for (const [key, value] of Object.entries(obj)) {
+        if (settings[key] && typeof value !== "object") {
+          validUpdates.push({ key, value });
+        } else {
+          extractFromResult(value);
+        }
+      }
+    }
+  };
+  extractFromResult(result);
+  return validUpdates;
+}
+async function processSettingUpdates(runtime, world, settings, updates, secretsService) {
+  if (!updates.length) {
+    return { updatedAny: false, messages: [] };
+  }
+  const messages = [];
+  let updatedAny = false;
+  const updatedSettings = { ...settings };
+  for (const update of updates) {
+    const setting = updatedSettings[update.key];
+    if (!setting) continue;
+    if (setting.dependsOn?.length) {
+      const dependenciesMet = setting.dependsOn.every((dep) => {
+        const depSetting = updatedSettings[dep];
+        return depSetting && depSetting.value !== null;
+      });
+      if (!dependenciesMet) {
+        messages.push(`Cannot update ${setting.name} - dependencies not met`);
+        continue;
+      }
+    }
+    const valueStr = String(update.value);
+    if (setting.validation && !setting.validation(valueStr)) {
+      messages.push(`Invalid value for ${setting.name}`);
+      continue;
+    }
+    if (setting.validationMethod) {
+      const validation = await validateSecret(
+        update.key,
+        valueStr,
+        setting.validationMethod
+      );
+      if (!validation.isValid) {
+        messages.push(
+          `Validation failed for ${setting.name}: ${validation.error}`
+        );
+        continue;
+      }
+    }
+    updatedSettings[update.key] = {
+      ...setting,
+      value: valueStr
+    };
+    if (secretsService) {
+      const context = {
+        level: "world",
+        agentId: runtime.agentId,
+        worldId: world.id
+      };
+      await secretsService.set(update.key, valueStr, context, {
+        description: setting.description,
+        type: setting.type,
+        encrypted: setting.secret
+      });
+    }
+    messages.push(`Updated ${setting.name} successfully`);
+    updatedAny = true;
+    if (setting.onSetAction) {
+      const actionMessage = setting.onSetAction(update.value);
+      if (actionMessage) {
+        messages.push(actionMessage);
+      }
+    }
+  }
+  if (updatedAny) {
+    if (!world.metadata) {
+      world.metadata = {};
+    }
+    world.metadata["settings"] = updatedSettings;
+    await runtime.updateWorld(world);
+  }
+  return { updatedAny, messages };
+}
+function getNextRequiredSetting(settings) {
+  const entries = Object.entries(settings);
+  for (const [key, setting] of entries) {
+    if (!setting.required || setting.value !== null) continue;
+    const dependenciesMet = (setting.dependsOn || []).every((dep) => {
+      const depSetting = settings[dep];
+      return depSetting && depSetting.value !== null;
+    });
+    if (dependenciesMet) {
+      return [key, setting];
+    }
+  }
+  return null;
+}
+function countUnconfiguredRequired(settings) {
+  return Object.values(settings).filter((s) => s.required && s.value === null).length;
+}
+var updateSettingsAction = {
+  name: "UPDATE_SETTINGS",
+  similes: ["UPDATE_SETTING", "SAVE_SETTING", "SET_CONFIGURATION", "CONFIGURE"],
+  description: "Saves a configuration setting during the onboarding process. Use when onboarding with a world owner or admin.",
+  validate: async (runtime, message, _state) => {
+    if (message.content.channelType !== ChannelType3.DM) {
+      return false;
+    }
+    const room = await runtime.getRoom(message.roomId);
+    if (!room?.worldId) return false;
+    const world = await runtime.getWorld(room.worldId);
+    if (!world?.metadata?.settings) return false;
+    const settings = world.metadata.settings;
+    const hasUnconfigured = Object.values(settings).some(
+      (s) => s.value === null
+    );
+    return hasUnconfigured;
+  },
+  handler: async (runtime, message, state, _options, callback) => {
+    if (!state || !callback) {
+      return {
+        text: "State and callback required",
+        values: { success: false },
+        data: { actionName: "UPDATE_SETTINGS" },
+        success: false
+      };
+    }
+    const room = await runtime.getRoom(message.roomId);
+    if (!room?.worldId) {
+      await callback({ text: "Unable to find room configuration." });
+      return {
+        text: "Room not found",
+        values: { success: false },
+        data: { actionName: "UPDATE_SETTINGS" },
+        success: false
+      };
+    }
+    const world = await runtime.getWorld(room.worldId);
+    if (!world?.metadata?.settings) {
+      await callback({ text: "No settings configured for this world." });
+      return {
+        text: "No settings found",
+        values: { success: false },
+        data: { actionName: "UPDATE_SETTINGS" },
+        success: false
+      };
+    }
+    const settings = world.metadata.settings;
+    const secretsService = runtime.getService(
+      "SECRETS"
+    );
+    logger12.info("[UpdateSettings] Extracting settings from message");
+    const extractedSettings = await extractSettingValues(
+      runtime,
+      message,
+      state,
+      settings
+    );
+    logger12.info(
+      `[UpdateSettings] Extracted ${extractedSettings.length} settings`
+    );
+    const results = await processSettingUpdates(
+      runtime,
+      world,
+      settings,
+      extractedSettings,
+      secretsService
+    );
+    const updatedWorld = await runtime.getWorld(room.worldId);
+    const updatedSettings = updatedWorld?.metadata?.settings;
+    if (results.updatedAny) {
+      const remaining = countUnconfiguredRequired(updatedSettings || settings);
+      if (remaining === 0) {
+        await callback({
+          text: `${results.messages.join("\n")}
+
+All required settings have been configured! You're all set.`,
+          actions: ["ONBOARDING_COMPLETE"]
+        });
+        return {
+          text: "Onboarding complete",
+          values: { success: true, onboardingComplete: true },
+          data: {
+            actionName: "UPDATE_SETTINGS",
+            action: "ONBOARDING_COMPLETE"
+          },
+          success: true
+        };
+      }
+      const next2 = getNextRequiredSetting(updatedSettings || settings);
+      const nextPrompt = next2 ? `
+
+Next, I need your ${next2[1].name}. ${next2[1].usageDescription || next2[1].description}` : "";
+      await callback({
+        text: `${results.messages.join("\n")}${nextPrompt}`,
+        actions: ["SETTING_UPDATED"]
+      });
+      return {
+        text: "Settings updated",
+        values: { success: true, remainingRequired: remaining },
+        data: {
+          actionName: "UPDATE_SETTINGS",
+          action: "SETTING_UPDATED",
+          updated: extractedSettings.map((s) => s.key)
+        },
+        success: true
+      };
+    }
+    const next = getNextRequiredSetting(settings);
+    const prompt = next ? `I couldn't understand that. I need your ${next[1].name}. ${next[1].usageDescription || next[1].description}` : "I couldn't extract any settings from your message. Could you try again?";
+    await callback({
+      text: prompt,
+      actions: ["SETTING_UPDATE_FAILED"]
+    });
+    return {
+      text: "No settings updated",
+      values: { success: false },
+      data: { actionName: "UPDATE_SETTINGS", action: "SETTING_UPDATE_FAILED" },
+      success: false
+    };
+  },
+  examples: [
+    [
+      {
+        name: "{{name1}}",
+        content: {
+          text: "My OpenAI key is sk-abc123def456",
+          source: "discord"
+        }
+      },
+      {
+        name: "{{name2}}",
+        content: {
+          text: "Got it! I've saved your OpenAI API Key. Next, I need your Anthropic API Key.",
+          actions: ["SETTING_UPDATED"],
+          source: "discord"
+        }
+      }
+    ],
+    [
+      {
+        name: "{{name1}}",
+        content: {
+          text: "Here's my Twitter login: @myhandle with password secret123",
+          source: "discord"
+        }
+      },
+      {
+        name: "{{name2}}",
+        content: {
+          text: "Perfect! I've updated your Twitter Username and Twitter Password. We're all set!",
+          actions: ["ONBOARDING_COMPLETE"],
+          source: "discord"
+        }
+      }
+    ]
+  ]
+};
+
+// src/plugin.ts
+var secretsManagerPlugin = {
+  name: "@elizaos/plugin-secrets-manager",
+  description: "Multi-level secret management with encryption, dynamic plugin activation, and conversational onboarding",
+  // Services
+  services: [SecretsService, PluginActivatorService, OnboardingService],
+  // Actions for natural language secret management and onboarding
+  actions: [setSecretAction, manageSecretAction, updateSettingsAction],
+  // Providers for context injection
+  providers: [
+    secretsStatusProvider,
+    secretsInfoProvider,
+    onboardingSettingsProvider,
+    missingSecretsProvider
+  ],
+  // Plugin initialization
+  init: async (config, runtime) => {
+    logger13.info("[SecretsManagerPlugin] Initializing");
+    logger13.info("[SecretsManagerPlugin] Initialized");
+  }
+};
+export {
+  BaseSecretStorage,
+  COMMON_API_KEY_SETTINGS,
+  CharacterSettingsStorage,
+  ComponentSecretStorage,
+  CompositeSecretStorage,
+  DEFAULT_ONBOARDING_MESSAGES,
+  EncryptionError,
+  KeyManager,
+  MAX_ACCESS_LOG_ENTRIES,
+  MemorySecretStorage,
+  ONBOARDING_SERVICE_TYPE,
+  OnboardingService,
+  PLUGIN_ACTIVATOR_SERVICE_TYPE,
+  PermissionDeniedError,
+  PluginActivatorService,
+  SECRETS_SERVICE_TYPE,
+  SECRET_DESCRIPTION_MAX_LENGTH,
+  SECRET_KEY_MAX_LENGTH,
+  SECRET_KEY_PATTERN,
+  SECRET_VALUE_MAX_LENGTH,
+  SecretNotFoundError,
+  SecretsError,
+  SecretsService,
+  StorageError,
+  ValidationError,
+  ValidationStrategies,
+  WorldMetadataStorage,
+  createOnboardingConfig,
+  decrypt,
+  secretsManagerPlugin as default,
+  deriveKeyFromAgentId,
+  deriveKeyPbkdf2,
+  encrypt,
+  generateKey,
+  generateSalt,
+  generateSecureToken,
+  generateSettingPrompt,
+  getNextSetting,
+  getUnconfiguredOptional,
+  getUnconfiguredRequired,
+  inferValidationStrategy,
+  isEncryptedSecret,
+  isOnboardingComplete,
+  manageSecretAction,
+  missingSecretsProvider,
+  onboardingSettingsProvider,
+  registerValidator,
+  secretsInfoProvider,
+  secretsManagerPlugin,
+  secretsStatusProvider,
+  setSecretAction,
+  unregisterValidator,
+  updateSettingsAction,
+  validateSecret
+};
+//# sourceMappingURL=index.js.map