@gaodefa/daocore 2026.5.51 → 2026.5.53

package/dist/runtime-api.actions-C2-n4QQ5.d.ts

@@ -1,23 +0,0 @@
-import { n as DiscordChannelEdit, r as DiscordChannelMove, t as DiscordChannelCreate } from "./send.types-DywwIqYK.js";
-//#region extensions/discord/src/actions/runtime.moderation-shared.d.ts
-type DiscordModerationAction = "timeout" | "kick" | "ban";
-type DiscordModerationCommand = {
-  action: DiscordModerationAction;
-  guildId: string;
-  userId: string;
-  durationMinutes?: number;
-  until?: string;
-  reason?: string;
-  deleteMessageDays?: number;
-};
-declare function isDiscordModerationAction(action: string): action is DiscordModerationAction;
-declare function requiredGuildPermissionForModerationAction(action: DiscordModerationAction): bigint;
-declare function readDiscordModerationCommand(action: string, params: Record<string, unknown>): DiscordModerationCommand;
-//#endregion
-//#region extensions/discord/src/actions/runtime.shared.d.ts
-declare function readDiscordParentIdParam(params: Record<string, unknown>): string | null | undefined;
-declare function readDiscordChannelCreateParams(params: Record<string, unknown>): DiscordChannelCreate;
-declare function readDiscordChannelEditParams(params: Record<string, unknown>): DiscordChannelEdit;
-declare function readDiscordChannelMoveParams(params: Record<string, unknown>): DiscordChannelMove;
-//#endregion
-export { DiscordModerationAction as a, readDiscordModerationCommand as c, readDiscordParentIdParam as i, requiredGuildPermissionForModerationAction as l, readDiscordChannelEditParams as n, DiscordModerationCommand as o, readDiscordChannelMoveParams as r, isDiscordModerationAction as s, readDiscordChannelCreateParams as t };

package/dist/runtime-api.actions-CuYXLj2I.js

@@ -1,3 +0,0 @@
-import "./runtime-CD6WyVpL.js";
-import "./channel-actions-DMH2vVzJ.js";
-export {};

package/dist/runtime-api.monitor-BPMqlEBC.js

@@ -1,6 +0,0 @@
-import "./allow-list-BcPKAZym.js";
-import "./provider-D3O0zKex.js";
-import "./message-utils-BG2BCBdr.js";
-import "./threading-CfCR-cPo.js";
-import "./message-handler-PdqXVaqc.js";
-export {};

package/dist/runtime-api.send-cXGaIwD8.js

@@ -1,4 +0,0 @@
-import "./outbound-session-route-DIvKTIer.js";
-import "./send.components-CdYNwUR8.js";
-import "./send-BZbyJL0A.js";
-export {};

package/dist/runtime-api.send-t0FX9tXf.d.ts

@@ -1,38 +0,0 @@
-import { r as DaoCoreConfig } from "./types.daocore-kp8IyikH.js";
-import { S as MarkdownTableMode } from "./types.base-tQh4FMBR.js";
-import { t as OutboundMediaAccess } from "./load-options-CTuppEe4.js";
-import { f as ChunkMode } from "./outbound.types-B2wXms-j.js";
-import { t as RequestClient } from "./rest-CE8PF7Nu.js";
-import { d as DiscordComponentBuildResult, h as DiscordComponentMessageSpec } from "./components-D9TlXmrM.js";
-import { v as DiscordSendResult } from "./send.types-DywwIqYK.js";
-
-//#region extensions/discord/src/send.components.d.ts
-type DiscordComponentSendOpts = {
-  cfg: DaoCoreConfig;
-  accountId?: string;
-  token?: string;
-  rest?: RequestClient;
-  silent?: boolean;
-  replyTo?: string;
-  sessionKey?: string;
-  agentId?: string;
-  mediaUrl?: string;
-  mediaAccess?: OutboundMediaAccess;
-  mediaLocalRoots?: readonly string[];
-  mediaReadFile?: (filePath: string) => Promise<Buffer>;
-  filename?: string;
-  textLimit?: number;
-  maxLinesPerMessage?: number;
-  tableMode?: MarkdownTableMode;
-  chunkMode?: ChunkMode;
-  suppressEmbeds?: boolean;
-};
-declare function registerBuiltDiscordComponentMessage(params: {
-  buildResult: DiscordComponentBuildResult;
-  messageId: string;
-  ttlMs?: number;
-}): void;
-declare function sendDiscordComponentMessage(to: string, spec: DiscordComponentMessageSpec, opts: DiscordComponentSendOpts): Promise<DiscordSendResult>;
-declare function editDiscordComponentMessage(to: string, messageId: string, spec: DiscordComponentMessageSpec, opts: DiscordComponentSendOpts): Promise<DiscordSendResult>;
-//#endregion
-export { registerBuiltDiscordComponentMessage as n, sendDiscordComponentMessage as r, editDiscordComponentMessage as t };

package/dist/runtime-api.threads-DF6EqVSY.js

@@ -1,2 +0,0 @@
-import "./thread-bindings-BJJr5qB6.js";
-export {};

package/dist/runtime-channel-B2dCbld0.js

@@ -1,2 +0,0 @@
-import { t as createRuntimeChannel } from "./runtime-channel-BfzwZ133.js";
-export { createRuntimeChannel };

package/dist/runtime-channel-BfzwZ133.js

@@ -1,150 +0,0 @@
-import { u as resolveStorePath } from "./paths-8MFrTNIB.js";
-import { a as readSessionUpdatedAt, l as updateLastRoute, o as recordSessionMetaFromInbound } from "./store-C4uyNaPD.js";
-import "./sessions-4ZNlAnYc.js";
-import { a as settleReplyDispatcher, i as dispatchReplyFromConfig, o as withReplyDispatcher } from "./dispatch-kxJ95i3A.js";
-import { n as resolveChannelGroupRequireMention, t as resolveChannelGroupPolicy } from "./group-policy-CRl_OjIo.js";
-import { i as resolveAgentRoute, t as buildAgentSessionKey } from "./resolve-route-C0-Q-Gjg.js";
-import { t as resolveCommandAuthorizedFromAuthorizers } from "./command-gating-BZR3snoF.js";
-import { a as readChannelAllowFromStore, d as upsertChannelPairingRequest } from "./pairing-store-D6kKcRDP.js";
-import { n as resolveInboundMentionDecision, t as implicitMentionKindWhen } from "./mention-gating-3P8aSD7o.js";
-import { u as saveMediaBuffer } from "./store-53qCOCD8.js";
-import { a as saveRemoteMedia, i as readRemoteMediaBuffer, o as saveResponseMedia, r as fetchRemoteMedia } from "./fetch-CThiKx3T.js";
-import { i as resolveHumanDelayConfig, r as resolveEffectiveMessagesConfig } from "./identity-ZuObO2Tn.js";
-import { a as chunkText, c as resolveTextChunkLimit, i as chunkMarkdownTextWithMode, o as chunkTextWithMode, r as chunkMarkdownText, s as resolveChunkMode, t as chunkByNewline } from "./chunk-DeZRGIEM.js";
-import { t as loadChannelOutboundAdapter } from "./load-ftGhHqtw.js";
-import { n as shouldHandleTextCommands } from "./commands-text-routing-BEyXBSW7.js";
-import "./commands-registry-be38KiNc.js";
-import { i as matchesMentionWithExplicit, n as buildMentionRegexes, r as matchesMentionPatterns } from "./mentions-CMXP1js-.js";
-import { n as createReplyDispatcherWithTyping } from "./reply-dispatcher-84jjdXt5.js";
-import { t as finalizeInboundContext } from "./inbound-context-Cg0uCtqQ.js";
-import { t as dispatchReplyWithBufferedBlockDispatcher } from "./provider-dispatcher-CYuX21il.js";
-import { i as shouldComputeCommandAuthorized, r as isControlCommandMessage, t as hasControlCommand } from "./command-detection-caGZdgm3.js";
-import { a as resolveEnvelopeFormatOptions, r as formatInboundEnvelope, t as formatAgentEnvelope } from "./envelope-DUI2KFD9.js";
-import { n as resolveInboundDebounceMs, t as createInboundDebouncer } from "./inbound-debounce-DQpLvByk.js";
-import { i as shouldAckReaction, n as removeAckReactionAfterReply, r as removeAckReactionHandleAfterReply, t as createAckReactionHandle } from "./ack-reactions-BceP3SaE.js";
-import { n as setChannelConversationBindingMaxAgeBySessionKey, t as setChannelConversationBindingIdleTimeoutBySessionKey } from "./conversation-bindings-bTV9etcN.js";
-import { t as recordInboundSession } from "./session-DDNzwYpl.js";
-import { a as runPreparedChannelTurn, i as runChannelTurn, n as dispatchAssembledChannelTurn, o as runResolvedChannelTurn, s as buildChannelInboundEventContext } from "./kernel-DJoytLM8.js";
-import { t as resolveMarkdownTableMode } from "./markdown-tables-BEjHxS3n.js";
-import { n as recordChannelActivity, t as getChannelActivity } from "./channel-activity-eMQlJ3BE.js";
-import { t as convertMarkdownTables } from "./tables-BROr40GK.js";
-import { t as buildPairingReply } from "./pairing-messages-pWPTNHYH.js";
-import { t as createChannelRuntimeContextRegistry } from "./channel-runtime-contexts-CgJ4peET.js";
-//#region src/plugins/runtime/runtime-channel.ts
-function createRuntimeChannel() {
-	return {
-		text: {
-			chunkByNewline,
-			chunkMarkdownText,
-			chunkMarkdownTextWithMode,
-			chunkText,
-			chunkTextWithMode,
-			resolveChunkMode,
-			resolveTextChunkLimit,
-			hasControlCommand,
-			resolveMarkdownTableMode,
-			convertMarkdownTables
-		},
-		reply: {
-			dispatchReplyWithBufferedBlockDispatcher,
-			createReplyDispatcherWithTyping,
-			resolveEffectiveMessagesConfig,
-			resolveHumanDelayConfig,
-			dispatchReplyFromConfig,
-			withReplyDispatcher,
-			settleReplyDispatcher,
-			finalizeInboundContext,
-			formatAgentEnvelope,
-			/** @deprecated Prefer `BodyForAgent` + structured user-context blocks (do not build plaintext envelopes for prompts). */
-			formatInboundEnvelope,
-			resolveEnvelopeFormatOptions
-		},
-		routing: {
-			buildAgentSessionKey,
-			resolveAgentRoute
-		},
-		pairing: {
-			buildPairingReply,
-			readAllowFromStore: ({ channel, accountId, env }) => readChannelAllowFromStore(channel, env, accountId),
-			upsertPairingRequest: ({ channel, id, accountId, meta, env, pairingAdapter }) => upsertChannelPairingRequest({
-				channel,
-				id,
-				accountId,
-				meta,
-				env,
-				pairingAdapter
-			})
-		},
-		media: {
-			readRemoteMediaBuffer,
-			fetchRemoteMedia,
-			saveRemoteMedia,
-			saveResponseMedia,
-			saveMediaBuffer
-		},
-		activity: {
-			record: recordChannelActivity,
-			get: getChannelActivity
-		},
-		session: {
-			resolveStorePath,
-			readSessionUpdatedAt,
-			recordSessionMetaFromInbound,
-			recordInboundSession,
-			updateLastRoute
-		},
-		mentions: {
-			buildMentionRegexes,
-			matchesMentionPatterns,
-			matchesMentionWithExplicit,
-			implicitMentionKindWhen,
-			resolveInboundMentionDecision
-		},
-		reactions: {
-			createAckReactionHandle,
-			shouldAckReaction,
-			removeAckReactionAfterReply,
-			removeAckReactionHandleAfterReply
-		},
-		groups: {
-			resolveGroupPolicy: resolveChannelGroupPolicy,
-			resolveRequireMention: resolveChannelGroupRequireMention
-		},
-		debounce: {
-			createInboundDebouncer,
-			resolveInboundDebounceMs
-		},
-		commands: {
-			resolveCommandAuthorizedFromAuthorizers,
-			isControlCommandMessage,
-			shouldComputeCommandAuthorized,
-			shouldHandleTextCommands
-		},
-		outbound: { loadAdapter: loadChannelOutboundAdapter },
-		turn: {
-			run: runChannelTurn,
-			runAssembled: dispatchAssembledChannelTurn,
-			runResolved: runResolvedChannelTurn,
-			buildContext: buildChannelInboundEventContext,
-			runPrepared: runPreparedChannelTurn,
-			dispatchAssembled: dispatchAssembledChannelTurn
-		},
-		threadBindings: {
-			setIdleTimeoutBySessionKey: ({ channelId, targetSessionKey, accountId, idleTimeoutMs }) => setChannelConversationBindingIdleTimeoutBySessionKey({
-				channelId,
-				targetSessionKey,
-				accountId,
-				idleTimeoutMs
-			}),
-			setMaxAgeBySessionKey: ({ channelId, targetSessionKey, accountId, maxAgeMs }) => setChannelConversationBindingMaxAgeBySessionKey({
-				channelId,
-				targetSessionKey,
-				accountId,
-				maxAgeMs
-			})
-		},
-		runtimeContexts: createChannelRuntimeContextRegistry()
-	};
-}
-//#endregion
-export { createRuntimeChannel as t };

package/dist/runtime-doctor-_yVIDUi3.d.ts

@@ -1,48 +0,0 @@
-import { i as CompatMutationResult } from "./dm-access-BKMuakaH.js";
-
-//#region src/config/channel-compat-normalization.d.ts
-type LegacyStreamingAliasOptions = {
-  resolvedMode: string;
-  includePreviewChunk?: boolean;
-  resolvedNativeTransport?: unknown;
-  offModeLegacyNotice?: (pathPrefix: string) => string;
-};
-type NormalizeLegacyChannelAccountParams = {
-  account: Record<string, unknown>;
-  accountId: string;
-  pathPrefix: string;
-  changes: string[];
-};
-declare function asObjectRecord(value: unknown): Record<string, unknown> | null;
-declare function hasLegacyAccountStreamingAliases(value: unknown, match: (entry: unknown) => boolean): boolean;
-declare function normalizeLegacyStreamingAliases(params: {
-  entry: Record<string, unknown>;
-  pathPrefix: string;
-  changes: string[];
-} & LegacyStreamingAliasOptions): CompatMutationResult;
-declare function normalizeLegacyChannelAliases(params: {
-  entry: Record<string, unknown>;
-  pathPrefix: string;
-  changes: string[];
-  normalizeDm?: boolean;
-  rootDmPromoteAllowFrom?: boolean;
-  normalizeAccountDm?: boolean;
-  resolveStreamingOptions: (entry: Record<string, unknown>) => LegacyStreamingAliasOptions;
-  normalizeAccountExtra?: (params: NormalizeLegacyChannelAccountParams) => CompatMutationResult;
-}): CompatMutationResult;
-declare function hasLegacyStreamingAliases(value: unknown, options?: {
-  includePreviewChunk?: boolean;
-  includeNativeTransport?: boolean;
-}): boolean;
-//#endregion
-//#region src/plugins/doctor-session-route-state-owner-types.d.ts
-type DoctorSessionRouteStateOwner = {
-  id: string;
-  label: string;
-  providerIds?: readonly string[];
-  runtimeIds?: readonly string[];
-  cliSessionKeys?: readonly string[];
-  authProfilePrefixes?: readonly string[];
-};
-//#endregion
-export { hasLegacyAccountStreamingAliases as a, normalizeLegacyStreamingAliases as c, asObjectRecord as i, LegacyStreamingAliasOptions as n, hasLegacyStreamingAliases as o, NormalizeLegacyChannelAccountParams as r, normalizeLegacyChannelAliases as s, DoctorSessionRouteStateOwner as t };

package/dist/runtime-embedded-pi.runtime-Bz4-Me2g.js

@@ -1,2 +0,0 @@
-import { t as runEmbeddedPiAgent } from "./pi-embedded-BGYOawy9.js";
-export { runEmbeddedPiAgent as runEmbeddedAgent, runEmbeddedPiAgent };

package/dist/sanitize-outbound-52UJkVc2.js

@@ -1,127 +0,0 @@
-import { a as normalizeLowercaseStringOrEmpty, c as normalizeOptionalString } from "./string-coerce-DyL154ka.js";
-import { l as normalizeE164 } from "./utils-CNnMhEDp.js";
-import { i as stripAssistantInternalScaffolding } from "./assistant-visible-text-BoF6Ixue.js";
-import "./string-coerce-runtime-DcopKqDR.js";
-import "./core-D9SaX41X.js";
-import "./media-runtime-CPXTkSQr.js";
-import "./text-chunking-ObhJDe8L.js";
-import "./account-resolution-DvO8jOO3.js";
-import "./status-helpers-nyf_mfYa.js";
-import "./channel-status-1yY-1IXP.js";
-import { c as parseIMessageTarget, o as normalizeIMessageHandle$1 } from "./targets-ByhFAk_l.js";
-//#region extensions/imessage/src/normalize.ts
-const SERVICE_PREFIXES = [
-	"imessage:",
-	"sms:",
-	"auto:"
-];
-const CHAT_TARGET_PREFIX_RE = /^(chat_id:|chatid:|chat:|chat_guid:|chatguid:|guid:|chat_identifier:|chatidentifier:|chatident:)/i;
-function looksLikeHandleOrPhoneTarget(params) {
-	const trimmed = params.raw.trim();
-	if (!trimmed) return false;
-	if (params.prefixPattern.test(trimmed)) return true;
-	if (trimmed.includes("@")) return true;
-	return (params.phonePattern ?? /^\+?\d{3,}$/).test(trimmed);
-}
-function normalizeIMessageHandle(raw) {
-	const trimmed = raw.trim();
-	if (!trimmed) return "";
-	const lowered = normalizeLowercaseStringOrEmpty(trimmed);
-	if (lowered.startsWith("imessage:")) return normalizeIMessageHandle(trimmed.slice(9));
-	if (lowered.startsWith("sms:")) return normalizeIMessageHandle(trimmed.slice(4));
-	if (lowered.startsWith("auto:")) return normalizeIMessageHandle(trimmed.slice(5));
-	if (CHAT_TARGET_PREFIX_RE.test(trimmed)) {
-		const prefix = trimmed.match(CHAT_TARGET_PREFIX_RE)?.[0];
-		if (!prefix) return "";
-		const value = trimmed.slice(prefix.length).trim();
-		return `${normalizeLowercaseStringOrEmpty(prefix)}${value}`;
-	}
-	if (trimmed.includes("@")) return normalizeLowercaseStringOrEmpty(trimmed);
-	const normalized = normalizeE164(trimmed);
-	if (normalized) return normalized;
-	return trimmed.replace(/\s+/g, "");
-}
-function normalizeIMessageMessagingTarget(raw) {
-	const trimmed = normalizeOptionalString(raw);
-	if (!trimmed) return;
-	const lower = normalizeLowercaseStringOrEmpty(trimmed);
-	for (const prefix of SERVICE_PREFIXES) if (lower.startsWith(prefix)) {
-		const normalizedHandle = normalizeIMessageHandle(trimmed.slice(prefix.length).trim());
-		if (!normalizedHandle) return;
-		if (CHAT_TARGET_PREFIX_RE.test(normalizedHandle)) return normalizedHandle;
-		return `${prefix}${normalizedHandle}`;
-	}
-	return normalizeIMessageHandle(trimmed) || void 0;
-}
-function looksLikeIMessageTargetId(raw) {
-	const trimmed = normalizeOptionalString(raw);
-	if (!trimmed) return false;
-	if (CHAT_TARGET_PREFIX_RE.test(trimmed)) return true;
-	return looksLikeHandleOrPhoneTarget({
-		raw: trimmed,
-		prefixPattern: /^(imessage:|sms:|auto:)/i
-	});
-}
-//#endregion
-//#region extensions/imessage/src/conversation-id-core.ts
-function normalizeIMessageAcpConversationId(conversationId) {
-	const trimmed = conversationId.trim();
-	if (!trimmed) return null;
-	try {
-		const parsed = parseIMessageTarget(trimmed);
-		if (parsed.kind === "handle") {
-			const handle = normalizeIMessageHandle$1(parsed.to);
-			return handle ? { conversationId: handle } : null;
-		}
-		if (parsed.kind === "chat_id") return { conversationId: String(parsed.chatId) };
-		if (parsed.kind === "chat_guid") return { conversationId: parsed.chatGuid };
-		return { conversationId: parsed.chatIdentifier };
-	} catch {
-		const handle = normalizeIMessageHandle$1(trimmed);
-		return handle ? { conversationId: handle } : null;
-	}
-}
-function matchIMessageAcpConversation(params) {
-	const binding = normalizeIMessageAcpConversationId(params.bindingConversationId);
-	const conversation = normalizeIMessageAcpConversationId(params.conversationId);
-	if (!binding || !conversation) return null;
-	if (binding.conversationId !== conversation.conversationId) return null;
-	return {
-		conversationId: conversation.conversationId,
-		matchPriority: 2
-	};
-}
-function resolveIMessageConversationIdFromTarget(target) {
-	return normalizeIMessageAcpConversationId(target)?.conversationId;
-}
-//#endregion
-//#region extensions/imessage/src/conversation-id.ts
-function resolveIMessageInboundConversationId(params) {
-	if (params.isGroup) return params.chatId != null && Number.isFinite(params.chatId) ? String(params.chatId) : void 0;
-	return normalizeIMessageHandle$1(params.sender) || void 0;
-}
-//#endregion
-//#region extensions/imessage/src/monitor/sanitize-outbound.ts
-/**
-* Patterns that indicate assistant-internal metadata leaked into text.
-* These must never reach a user-facing channel.
-*/
-const INTERNAL_SEPARATOR_RE = /(?:#\+){2,}#?/g;
-const ASSISTANT_ROLE_MARKER_RE = /\bassistant\s+to\s*=\s*\w+/gi;
-const ROLE_TURN_MARKER_RE = /\b(?:user|system|assistant)\s*:\s*$/gm;
-/**
-* Strip all assistant-internal scaffolding from outbound text before delivery.
-* Applies reasoning/thinking tag removal, memory tag removal, and
-* model-specific internal separator stripping.
-*/
-function sanitizeOutboundText(text) {
-	if (!text) return text;
-	let cleaned = stripAssistantInternalScaffolding(text);
-	cleaned = cleaned.replace(INTERNAL_SEPARATOR_RE, "");
-	cleaned = cleaned.replace(ASSISTANT_ROLE_MARKER_RE, "");
-	cleaned = cleaned.replace(ROLE_TURN_MARKER_RE, "");
-	cleaned = cleaned.replace(/\n{3,}/g, "\n\n").trim();
-	return cleaned;
-}
-//#endregion
-export { resolveIMessageConversationIdFromTarget as a, normalizeIMessageAcpConversationId as i, resolveIMessageInboundConversationId as n, looksLikeIMessageTargetId as o, matchIMessageAcpConversation as r, normalizeIMessageMessagingTarget as s, sanitizeOutboundText as t };

package/dist/sdk-setup-tools-DzA0rD_t.js

@@ -1,8 +0,0 @@
-import "./runtime-env-BSECk1Nm.js";
-import "./setup-tools-BOGdbXzZ.js";
-import "./media-runtime-CPXTkSQr.js";
-import "./media-mime-j2Nhr7Df.js";
-import "./cli-runtime-DzLh8RWR.js";
-import "./agent-harness-runtime-hAssTrVq.js";
-import "./channel-actions-BEsMIO8Q.js";
-export {};

package/dist/secrets-BzY28DjS.js

@@ -1,113 +0,0 @@
-import { l as loadAuthProfileStoreWithoutExternalProfiles, p as updateAuthProfileStoreWithLock } from "./store-Bo7D4Hg4.js";
-import "./provider-auth-B-d9TlzW.js";
-import "./agent-runtime-DKr0TX79.js";
-import { o as parseEnv, u as readText } from "./helpers-w2CyK9G6.js";
-import { c as HERMES_REASON_SECRET_NO_LONGER_PRESENT, d as hermesItemConflict, f as hermesItemError, h as readHermesSecretDetails, n as HERMES_REASON_AUTH_PROFILE_EXISTS, p as hermesItemSkipped, r as HERMES_REASON_AUTH_PROFILE_WRITE_FAILED, s as HERMES_REASON_MISSING_SECRET_METADATA, u as createHermesSecretItem } from "./items-EdIOLB5m.js";
-//#region extensions/migrate-hermes/secrets.ts
-const SECRET_MAPPINGS = [
-	{
-		envVar: "OPENAI_API_KEY",
-		provider: "openai",
-		profileId: "openai:hermes-import"
-	},
-	{
-		envVar: "ANTHROPIC_API_KEY",
-		provider: "anthropic",
-		profileId: "anthropic:hermes-import"
-	},
-	{
-		envVar: "OPENROUTER_API_KEY",
-		provider: "openrouter",
-		profileId: "openrouter:hermes-import"
-	},
-	{
-		envVar: "GOOGLE_API_KEY",
-		provider: "google",
-		profileId: "google:hermes-import"
-	},
-	{
-		envVar: "GEMINI_API_KEY",
-		provider: "google",
-		profileId: "google:hermes-import"
-	},
-	{
-		envVar: "GROQ_API_KEY",
-		provider: "groq",
-		profileId: "groq:hermes-import"
-	},
-	{
-		envVar: "XAI_API_KEY",
-		provider: "xai",
-		profileId: "xai:hermes-import"
-	},
-	{
-		envVar: "MISTRAL_API_KEY",
-		provider: "mistral",
-		profileId: "mistral:hermes-import"
-	},
-	{
-		envVar: "DEEPSEEK_API_KEY",
-		provider: "deepseek",
-		profileId: "deepseek:hermes-import"
-	}
-];
-async function buildSecretItems(params) {
-	const env = parseEnv(await readText(params.source.envPath));
-	const store = loadAuthProfileStoreWithoutExternalProfiles(params.targets.agentDir);
-	const seenProfiles = /* @__PURE__ */ new Set();
-	const items = [];
-	for (const mapping of SECRET_MAPPINGS) {
-		if (!env[mapping.envVar]?.trim() || seenProfiles.has(mapping.profileId)) continue;
-		seenProfiles.add(mapping.profileId);
-		const existsAlready = Boolean(store.profiles[mapping.profileId]);
-		items.push(createHermesSecretItem({
-			id: `secret:${mapping.provider}`,
-			source: params.source.envPath,
-			target: `${params.targets.agentDir}/auth-profiles.json#${mapping.profileId}`,
-			includeSecrets: params.ctx.includeSecrets,
-			existsAlready: existsAlready && !params.ctx.overwrite,
-			details: {
-				envVar: mapping.envVar,
-				provider: mapping.provider,
-				profileId: mapping.profileId
-			}
-		}));
-	}
-	return items;
-}
-async function applySecretItem(ctx, item, targets) {
-	if (item.status !== "planned") return item;
-	const details = readHermesSecretDetails(item);
-	const source = item.source;
-	if (!details || !source) return hermesItemError(item, HERMES_REASON_MISSING_SECRET_METADATA);
-	const key = parseEnv(await readText(source))[details.envVar]?.trim();
-	if (!key) return hermesItemSkipped(item, HERMES_REASON_SECRET_NO_LONGER_PRESENT);
-	let conflicted = false;
-	let wrote = false;
-	const store = await updateAuthProfileStoreWithLock({
-		agentDir: targets.agentDir,
-		updater: (freshStore) => {
-			if (!ctx.overwrite && freshStore.profiles[details.profileId]) {
-				conflicted = true;
-				return false;
-			}
-			freshStore.profiles[details.profileId] = {
-				type: "api_key",
-				provider: details.provider,
-				key,
-				displayName: "Hermes import"
-			};
-			wrote = true;
-			return true;
-		}
-	});
-	if (conflicted) return hermesItemConflict(item, HERMES_REASON_AUTH_PROFILE_EXISTS);
-	if (!store?.profiles[details.profileId]) return hermesItemError(item, HERMES_REASON_AUTH_PROFILE_WRITE_FAILED);
-	if (!wrote && !ctx.overwrite) return hermesItemConflict(item, HERMES_REASON_AUTH_PROFILE_EXISTS);
-	return {
-		...item,
-		status: "migrated"
-	};
-}
-//#endregion
-export { buildSecretItems as n, applySecretItem as t };

package/dist/security-audit-B_x9Bqsd.js

@@ -1,122 +0,0 @@
-import { a as readChannelAllowFromStore } from "./pairing-store-D6kKcRDP.js";
-import { i as normalizeAllowFromList, t as coerceNativeSetting } from "./channel-policy-Be-Ujzjr.js";
-import { n as isDangerousNameMatchingEnabled } from "./dangerous-name-matching-jjAiM0PK.js";
-import { n as resolveNativeCommandsEnabled, r as resolveNativeSkillsEnabled } from "./commands-CJmR93qR.js";
-import "./conversation-runtime-YK1oLoen.js";
-import "./native-command-config-runtime-cXDA9h2f.js";
-import { t as isDiscordMutableAllowEntry } from "./security-doctor-uUo8hTD5.js";
-//#region extensions/discord/src/security-audit.ts
-function normalizeOptionalString(value) {
-	const normalized = value?.trim();
-	return normalized ? normalized : void 0;
-}
-function addDiscordNameBasedEntries(params) {
-	if (!Array.isArray(params.values)) return;
-	for (const value of params.values) {
-		if (!isDiscordMutableAllowEntry(String(value))) continue;
-		const text = normalizeOptionalString(String(value)) ?? "";
-		if (!text) continue;
-		params.target.add(`${params.source}:${text}`);
-	}
-}
-async function collectDiscordSecurityAuditFindings(params) {
-	const findings = [];
-	const discordCfg = params.account.config ?? {};
-	const accountId = normalizeOptionalString(params.accountId) ?? params.account.accountId ?? "default";
-	const dangerousNameMatchingEnabled = isDangerousNameMatchingEnabled(discordCfg);
-	const storeAllowFrom = await readChannelAllowFromStore("discord", process.env, accountId).catch(() => []);
-	const discordNameBasedAllowEntries = /* @__PURE__ */ new Set();
-	const discordPathPrefix = params.orderedAccountIds.length > 1 || params.hasExplicitAccountPath ? `channels.discord.accounts.${accountId}` : "channels.discord";
-	addDiscordNameBasedEntries({
-		target: discordNameBasedAllowEntries,
-		values: discordCfg.allowFrom,
-		source: `${discordPathPrefix}.allowFrom`
-	});
-	addDiscordNameBasedEntries({
-		target: discordNameBasedAllowEntries,
-		values: discordCfg.dm?.allowFrom,
-		source: `${discordPathPrefix}.dm.allowFrom`
-	});
-	addDiscordNameBasedEntries({
-		target: discordNameBasedAllowEntries,
-		values: storeAllowFrom,
-		source: "~/.daocore/credentials/discord-allowFrom.json"
-	});
-	const guildEntries = discordCfg.guilds ?? {};
-	for (const [guildKey, guildValue] of Object.entries(guildEntries)) {
-		if (!guildValue || typeof guildValue !== "object") continue;
-		const guild = guildValue;
-		addDiscordNameBasedEntries({
-			target: discordNameBasedAllowEntries,
-			values: guild.users,
-			source: `${discordPathPrefix}.guilds.${guildKey}.users`
-		});
-		const channels = guild.channels;
-		if (!channels || typeof channels !== "object") continue;
-		for (const [channelKey, channelValue] of Object.entries(channels)) {
-			if (!channelValue || typeof channelValue !== "object") continue;
-			addDiscordNameBasedEntries({
-				target: discordNameBasedAllowEntries,
-				values: channelValue.users,
-				source: `${discordPathPrefix}.guilds.${guildKey}.channels.${channelKey}.users`
-			});
-		}
-	}
-	if (discordNameBasedAllowEntries.size > 0) {
-		const examples = Array.from(discordNameBasedAllowEntries).slice(0, 5);
-		const more = discordNameBasedAllowEntries.size > examples.length ? ` (+${discordNameBasedAllowEntries.size - examples.length} more)` : "";
-		findings.push({
-			checkId: "channels.discord.allowFrom.name_based_entries",
-			severity: dangerousNameMatchingEnabled ? "info" : "warn",
-			title: dangerousNameMatchingEnabled ? "Discord allowlist uses break-glass name/tag matching" : "Discord allowlist contains name or tag entries",
-			detail: dangerousNameMatchingEnabled ? `Discord name/tag allowlist matching is explicitly enabled via dangerouslyAllowNameMatching. This mutable-identity mode is operator-selected break-glass behavior and out-of-scope for vulnerability reports by itself. Found: ${examples.join(", ")}${more}.` : `Discord name/tag allowlist matching uses normalized slugs and can collide across users. Found: ${examples.join(", ")}${more}.`,
-			remediation: dangerousNameMatchingEnabled ? "Prefer stable Discord IDs (or <@id>/user:<id>/pk:<id>), then disable dangerouslyAllowNameMatching." : "Prefer stable Discord IDs (or <@id>/user:<id>/pk:<id>) in channels.discord.allowFrom and channels.discord.guilds.*.users, or explicitly opt in with dangerouslyAllowNameMatching=true if you accept the risk."
-		});
-	}
-	const nativeEnabled = resolveNativeCommandsEnabled({
-		providerId: "discord",
-		providerSetting: coerceNativeSetting(discordCfg.commands?.native),
-		globalSetting: params.cfg.commands?.native
-	});
-	const nativeSkillsEnabled = resolveNativeSkillsEnabled({
-		providerId: "discord",
-		providerSetting: coerceNativeSetting(discordCfg.commands?.nativeSkills),
-		globalSetting: params.cfg.commands?.nativeSkills
-	});
-	if (!nativeEnabled && !nativeSkillsEnabled) return findings;
-	const defaultGroupPolicy = params.cfg.channels?.defaults?.groupPolicy;
-	const groupPolicy = discordCfg.groupPolicy ?? defaultGroupPolicy ?? "allowlist";
-	const guildsConfigured = Object.keys(guildEntries).length > 0;
-	const hasAnyUserAllowlist = Object.values(guildEntries).some((guild) => {
-		if (!guild || typeof guild !== "object") return false;
-		const record = guild;
-		if (Array.isArray(record.users) && record.users.length > 0) return true;
-		const channels = record.channels;
-		if (!channels || typeof channels !== "object") return false;
-		return Object.values(channels).some((channel) => {
-			if (!channel || typeof channel !== "object") return false;
-			const channelRecord = channel;
-			return Array.isArray(channelRecord.users) && channelRecord.users.length > 0;
-		});
-	});
-	const dmAllowFromRaw = discordCfg.dm?.allowFrom;
-	const ownerAllowFromConfigured = normalizeAllowFromList([...Array.isArray(dmAllowFromRaw) ? dmAllowFromRaw : [], ...storeAllowFrom]).length > 0;
-	const useAccessGroups = params.cfg.commands?.useAccessGroups !== false;
-	if (!useAccessGroups && groupPolicy !== "disabled" && guildsConfigured && !hasAnyUserAllowlist) findings.push({
-		checkId: "channels.discord.commands.native.unrestricted",
-		severity: "critical",
-		title: "Discord slash commands are unrestricted",
-		detail: "commands.useAccessGroups=false disables sender allowlists for Discord slash commands unless a per-guild/channel users allowlist is configured; with no users allowlist, any user in allowed guild channels can invoke /… commands.",
-		remediation: "Set commands.useAccessGroups=true (recommended), or configure channels.discord.guilds.<id>.users (or channels.discord.guilds.<id>.channels.<channel>.users)."
-	});
-	else if (useAccessGroups && groupPolicy !== "disabled" && guildsConfigured && !ownerAllowFromConfigured && !hasAnyUserAllowlist) findings.push({
-		checkId: "channels.discord.commands.native.no_allowlists",
-		severity: "warn",
-		title: "Discord slash commands have no allowlists",
-		detail: "Discord slash commands are enabled, but neither an owner allowFrom list nor any per-guild/channel users allowlist is configured; /… commands will be rejected for everyone.",
-		remediation: "Add your user id to channels.discord.allowFrom (or approve yourself via pairing), or configure channels.discord.guilds.<id>.users."
-	});
-	return findings;
-}
-//#endregion
-export { collectDiscordSecurityAuditFindings as t };