@nextclaw/service 0.2.13 → 0.2.14

package/dist/controllers/commands/remote-command.controller.js

@@ -0,0 +1,176 @@
+import { buildPlatformApiBaseErrorMessage, resolvePlatformApiBase } from "../../utils/remote/platform-api-base.utils.js";
+import { buildNextclawConfiguredRemoteState, createNextclawRemoteConnector, createNextclawRemoteStatusStore, hasRunningNextclawManagedService, resolveNextclawRemoteStatusSnapshot } from "../../utils/remote/remote-runtime-support.utils.js";
+import { localUiDiscoveryService } from "../../services/ui/local-ui-discovery.service.js";
+import { getConfigPath, loadConfig, saveConfig } from "@nextclaw/core";
+import { readPlatformSessionTokenState } from "@nextclaw/remote";
+import { hostname } from "node:os";
+//#region src/controllers/commands/remote-command.controller.ts
+function normalizeOptionalString(value) {
+	if (typeof value !== "string") return;
+	const trimmed = value.trim();
+	return trimmed.length > 0 ? trimmed : void 0;
+}
+function resolveConfiguredLocalOrigin(config) {
+	return localUiDiscoveryService.resolveLocalOrigin(config);
+}
+async function probeLocalUi(localOrigin) {
+	try {
+		const response = await fetch(`${localOrigin}/api/health`);
+		if (!response.ok) return {
+			ok: false,
+			detail: `health returned ${response.status}`
+		};
+		return {
+			ok: true,
+			detail: "health endpoint returned ok"
+		};
+	} catch (error) {
+		return {
+			ok: false,
+			detail: error instanceof Error ? error.message : String(error)
+		};
+	}
+}
+function describePlatformTokenCheck(token) {
+	const tokenState = readPlatformSessionTokenState(token);
+	if (tokenState.valid) return {
+		name: "platform-token",
+		ok: true,
+		detail: "platform session token configured"
+	};
+	if (tokenState.reason === "expired") return {
+		name: "platform-token",
+		ok: false,
+		detail: "platform session token expired; run remote browser login or \"nextclaw login\" again"
+	};
+	if (tokenState.reason === "malformed") return {
+		name: "platform-token",
+		ok: false,
+		detail: "platform session token invalid; run remote browser login or \"nextclaw login\" again"
+	};
+	return {
+		name: "platform-token",
+		ok: false,
+		detail: "run remote browser login or \"nextclaw login\" first"
+	};
+}
+var RemoteCommands = class {
+	constructor(deps = {}) {
+		this.deps = deps;
+	}
+	updateConfig(params = {}) {
+		const config = loadConfig(getConfigPath());
+		const nextEnabled = typeof params.enabled === "boolean" ? params.enabled : config.remote.enabled;
+		const nextPlatformApiBase = typeof params.apiBase === "string" ? params.apiBase.trim() : config.remote.platformApiBase;
+		const nextDeviceName = typeof params.name === "string" ? params.name.trim() : config.remote.deviceName;
+		const next = {
+			...config,
+			remote: {
+				...config.remote,
+				enabled: nextEnabled,
+				platformApiBase: nextPlatformApiBase,
+				deviceName: nextDeviceName
+			}
+		};
+		saveConfig(next);
+		return {
+			changed: config.remote.enabled !== next.remote.enabled || config.remote.platformApiBase !== next.remote.platformApiBase || config.remote.deviceName !== next.remote.deviceName,
+			config: next
+		};
+	}
+	enableConfig(opts = {}) {
+		return this.updateConfig({
+			enabled: true,
+			apiBase: typeof opts.apiBase === "string" ? opts.apiBase : void 0,
+			name: typeof opts.name === "string" ? opts.name : void 0
+		});
+	}
+	disableConfig() {
+		return this.updateConfig({ enabled: false });
+	}
+	async connect(opts = {}) {
+		await createNextclawRemoteConnector().run({
+			...opts,
+			mode: "foreground"
+		});
+	}
+	getStatusView() {
+		const config = loadConfig(getConfigPath());
+		const snapshot = resolveNextclawRemoteStatusSnapshot(config);
+		const resolvedLocalOrigin = snapshot.runtime?.localOrigin ?? this.deps.currentLocalOrigin ?? resolveConfiguredLocalOrigin(config);
+		return {
+			configuredEnabled: snapshot.configuredEnabled,
+			runtime: snapshot.runtime,
+			localOrigin: resolvedLocalOrigin,
+			deviceName: snapshot.runtime?.deviceName ?? normalizeOptionalString(config.remote.deviceName) ?? hostname(),
+			platformBase: snapshot.runtime?.platformBase ?? normalizeOptionalString(config.remote.platformApiBase) ?? normalizeOptionalString(config.providers.nextclaw?.apiBase) ?? null
+		};
+	}
+	async status(opts = {}) {
+		const view = this.getStatusView();
+		if (opts.json) {
+			console.log(JSON.stringify(view, null, 2));
+			return;
+		}
+		const runtime = view.runtime;
+		console.log("NextClaw Remote Status");
+		console.log(`Enabled: ${view.configuredEnabled ? "yes" : "no"}`);
+		console.log(`Mode: ${runtime?.mode ?? "service"}`);
+		console.log(`State: ${runtime?.state ?? "disabled"}`);
+		console.log(`Device: ${view.deviceName}`);
+		console.log(`Platform: ${view.platformBase ?? "not set"}`);
+		console.log(`Local origin: ${runtime?.localOrigin ?? view.localOrigin}`);
+		if (runtime?.deviceId) console.log(`Device ID: ${runtime.deviceId}`);
+		if (runtime?.lastConnectedAt) console.log(`Last connected: ${runtime.lastConnectedAt}`);
+		if (runtime?.lastError) console.log(`Last error: ${runtime.lastError}`);
+	}
+	async getDoctorView() {
+		const config = loadConfig(getConfigPath());
+		const snapshot = resolveNextclawRemoteStatusSnapshot(config);
+		const localOrigin = snapshot.runtime?.localOrigin ?? this.deps.currentLocalOrigin ?? resolveConfiguredLocalOrigin(config);
+		const localUi = await probeLocalUi(localOrigin);
+		const token = normalizeOptionalString(config.providers.nextclaw?.apiKey);
+		const platformApiBase = normalizeOptionalString(config.remote.platformApiBase) ?? normalizeOptionalString(config.providers.nextclaw?.apiBase);
+		const checks = [
+			{
+				name: "remote-enabled",
+				ok: snapshot.configuredEnabled,
+				detail: snapshot.configuredEnabled ? "enabled in config" : "disabled in config"
+			},
+			describePlatformTokenCheck(token),
+			{
+				name: "platform-api-base",
+				ok: Boolean(platformApiBase),
+				detail: platformApiBase ?? "set remote.platformApiBase or login with --api-base"
+			},
+			{
+				name: "local-ui",
+				ok: localUi.ok,
+				detail: `${localOrigin} (${localUi.detail})`
+			},
+			{
+				name: "service-runtime",
+				ok: snapshot.runtime?.state === "connected",
+				detail: snapshot.runtime ? snapshot.runtime.state : "no managed remote runtime detected"
+			}
+		];
+		return {
+			generatedAt: (/* @__PURE__ */ new Date()).toISOString(),
+			checks,
+			snapshot
+		};
+	}
+	async doctor(opts = {}) {
+		const report = await this.getDoctorView();
+		if (opts.json) {
+			console.log(JSON.stringify(report, null, 2));
+			return;
+		}
+		console.log("NextClaw Remote Doctor");
+		for (const check of report.checks) console.log(`${check.ok ? "✓" : "✗"} ${check.name}: ${check.detail}`);
+	}
+};
+//#endregion
+export { RemoteCommands, buildNextclawConfiguredRemoteState, buildPlatformApiBaseErrorMessage, createNextclawRemoteConnector, createNextclawRemoteStatusStore, hasRunningNextclawManagedService, resolveNextclawRemoteStatusSnapshot, resolvePlatformApiBase };
+
+//# sourceMappingURL=remote-command.controller.js.map

package/dist/controllers/commands/remote-command.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"remote-command.controller.js","names":[],"sources":["../../../src/controllers/commands/remote-command.controller.ts"],"sourcesContent":["import { getConfigPath, loadConfig, saveConfig, type Config } from \"@nextclaw/core\";\nimport {\n  readPlatformSessionTokenState,\n  type RemoteConnectCommandOptions,\n  type RemoteDoctorCommandOptions,\n  type RemoteEnableCommandOptions,\n  type RemoteStatusCommandOptions,\n  type RemoteStatusSnapshot\n} from \"@nextclaw/remote\";\nimport { hostname } from \"node:os\";\nimport { localUiDiscoveryService } from \"@nextclaw-service/services/ui/local-ui-discovery.service.js\";\nimport { createNextclawRemoteConnector, resolveNextclawRemoteStatusSnapshot } from \"@nextclaw-service/utils/remote/remote-runtime-support.utils.js\";\n\nexport {\n  buildNextclawConfiguredRemoteState,\n  createNextclawRemoteConnector,\n  createNextclawRemoteStatusStore,\n  hasRunningNextclawManagedService,\n  resolveNextclawRemoteStatusSnapshot\n} from \"@nextclaw-service/utils/remote/remote-runtime-support.utils.js\";\nexport {\n  buildPlatformApiBaseErrorMessage,\n  resolvePlatformApiBase\n} from \"@nextclaw-service/utils/remote/platform-api-base.utils.js\";\n\ntype RemoteConfigChange = {\n  changed: boolean;\n  config: Config;\n};\n\nexport type RemoteCommandStatusView = {\n  configuredEnabled: boolean;\n  runtime: RemoteStatusSnapshot[\"runtime\"];\n  localOrigin: string;\n  deviceName: string;\n  platformBase: string | null;\n};\n\nexport type RemoteCommandDoctorCheck = {\n  name: string;\n  ok: boolean;\n  detail: string;\n};\n\nexport type RemoteCommandDoctorView = {\n  generatedAt: string;\n  checks: RemoteCommandDoctorCheck[];\n  snapshot: RemoteStatusSnapshot;\n};\n\nfunction normalizeOptionalString(value: unknown): string | undefined {\n  if (typeof value !== \"string\") {\n    return undefined;\n  }\n  const trimmed = value.trim();\n  return trimmed.length > 0 ? trimmed : undefined;\n}\n\nfunction resolveConfiguredLocalOrigin(config: Config): string {\n  return localUiDiscoveryService.resolveLocalOrigin(config);\n}\n\nasync function probeLocalUi(localOrigin: string): Promise<{ ok: boolean; detail: string }> {\n  try {\n    const response = await fetch(`${localOrigin}/api/health`);\n    if (!response.ok) {\n      return { ok: false, detail: `health returned ${response.status}` };\n    }\n    return { ok: true, detail: \"health endpoint returned ok\" };\n  } catch (error) {\n    return {\n      ok: false,\n      detail: error instanceof Error ? error.message : String(error)\n    };\n  }\n}\n\nfunction describePlatformTokenCheck(token: string | undefined): RemoteCommandDoctorCheck {\n  const tokenState = readPlatformSessionTokenState(token);\n  if (tokenState.valid) {\n    return {\n      name: \"platform-token\",\n      ok: true,\n      detail: \"platform session token configured\"\n    };\n  }\n  if (tokenState.reason === \"expired\") {\n    return {\n      name: \"platform-token\",\n      ok: false,\n      detail: 'platform session token expired; run remote browser login or \"nextclaw login\" again'\n    };\n  }\n  if (tokenState.reason === \"malformed\") {\n    return {\n      name: \"platform-token\",\n      ok: false,\n      detail: 'platform session token invalid; run remote browser login or \"nextclaw login\" again'\n    };\n  }\n  return {\n    name: \"platform-token\",\n    ok: false,\n    detail: 'run remote browser login or \"nextclaw login\" first'\n  };\n}\n\nexport class RemoteCommands {\n  constructor(private readonly deps: { currentLocalOrigin?: string } = {}) {}\n\n  updateConfig(params: {\n    enabled?: boolean;\n    apiBase?: string;\n    name?: string;\n  } = {}): RemoteConfigChange {\n    const config = loadConfig(getConfigPath());\n    const nextEnabled = typeof params.enabled === \"boolean\" ? params.enabled : config.remote.enabled;\n    const nextPlatformApiBase =\n      typeof params.apiBase === \"string\" ? params.apiBase.trim() : config.remote.platformApiBase;\n    const nextDeviceName =\n      typeof params.name === \"string\" ? params.name.trim() : config.remote.deviceName;\n    const next: Config = {\n      ...config,\n      remote: {\n        ...config.remote,\n        enabled: nextEnabled,\n        platformApiBase: nextPlatformApiBase,\n        deviceName: nextDeviceName\n      }\n    };\n    saveConfig(next);\n    return {\n      changed:\n        config.remote.enabled !== next.remote.enabled ||\n        config.remote.platformApiBase !== next.remote.platformApiBase ||\n        config.remote.deviceName !== next.remote.deviceName,\n      config: next\n    };\n  }\n\n  enableConfig(opts: RemoteEnableCommandOptions = {}): RemoteConfigChange {\n    return this.updateConfig({\n      enabled: true,\n      apiBase: typeof opts.apiBase === \"string\" ? opts.apiBase : undefined,\n      name: typeof opts.name === \"string\" ? opts.name : undefined\n    });\n  }\n\n  disableConfig(): RemoteConfigChange {\n    return this.updateConfig({ enabled: false });\n  }\n\n  async connect(opts: RemoteConnectCommandOptions = {}): Promise<void> {\n    const connector = createNextclawRemoteConnector();\n    await connector.run({\n      ...opts,\n      mode: \"foreground\"\n    });\n  }\n\n  getStatusView(): RemoteCommandStatusView {\n    const config = loadConfig(getConfigPath());\n    const snapshot = resolveNextclawRemoteStatusSnapshot(config);\n    const resolvedLocalOrigin =\n      snapshot.runtime?.localOrigin ??\n      this.deps.currentLocalOrigin ??\n      resolveConfiguredLocalOrigin(config);\n    return {\n      configuredEnabled: snapshot.configuredEnabled,\n      runtime: snapshot.runtime,\n      localOrigin: resolvedLocalOrigin,\n      deviceName: snapshot.runtime?.deviceName ?? normalizeOptionalString(config.remote.deviceName) ?? hostname(),\n      platformBase:\n        snapshot.runtime?.platformBase ??\n        normalizeOptionalString(config.remote.platformApiBase) ??\n        normalizeOptionalString(config.providers.nextclaw?.apiBase) ??\n        null\n    };\n  }\n\n  async status(opts: RemoteStatusCommandOptions = {}): Promise<void> {\n    const view = this.getStatusView();\n\n    if (opts.json) {\n      console.log(JSON.stringify(view, null, 2));\n      return;\n    }\n\n    const runtime = view.runtime;\n    console.log(\"NextClaw Remote Status\");\n    console.log(`Enabled: ${view.configuredEnabled ? \"yes\" : \"no\"}`);\n    console.log(`Mode: ${runtime?.mode ?? \"service\"}`);\n    console.log(`State: ${runtime?.state ?? \"disabled\"}`);\n    console.log(`Device: ${view.deviceName}`);\n    console.log(`Platform: ${view.platformBase ?? \"not set\"}`);\n    console.log(`Local origin: ${runtime?.localOrigin ?? view.localOrigin}`);\n    if (runtime?.deviceId) {\n      console.log(`Device ID: ${runtime.deviceId}`);\n    }\n    if (runtime?.lastConnectedAt) {\n      console.log(`Last connected: ${runtime.lastConnectedAt}`);\n    }\n    if (runtime?.lastError) {\n      console.log(`Last error: ${runtime.lastError}`);\n    }\n  }\n\n  async getDoctorView(): Promise<RemoteCommandDoctorView> {\n    const config = loadConfig(getConfigPath());\n    const snapshot = resolveNextclawRemoteStatusSnapshot(config);\n    const localOrigin =\n      snapshot.runtime?.localOrigin ??\n      this.deps.currentLocalOrigin ??\n      resolveConfiguredLocalOrigin(config);\n    const localUi = await probeLocalUi(localOrigin);\n    const token = normalizeOptionalString(config.providers.nextclaw?.apiKey);\n    const platformApiBase =\n      normalizeOptionalString(config.remote.platformApiBase) ??\n      normalizeOptionalString(config.providers.nextclaw?.apiBase);\n    const checks = [\n      {\n        name: \"remote-enabled\",\n        ok: snapshot.configuredEnabled,\n        detail: snapshot.configuredEnabled ? \"enabled in config\" : \"disabled in config\"\n      },\n      describePlatformTokenCheck(token),\n      {\n        name: \"platform-api-base\",\n        ok: Boolean(platformApiBase),\n        detail: platformApiBase ?? \"set remote.platformApiBase or login with --api-base\"\n      },\n      {\n        name: \"local-ui\",\n        ok: localUi.ok,\n        detail: `${localOrigin} (${localUi.detail})`\n      },\n      {\n        name: \"service-runtime\",\n        ok: snapshot.runtime?.state === \"connected\",\n        detail: snapshot.runtime ? snapshot.runtime.state : \"no managed remote runtime detected\"\n      }\n    ];\n    return {\n      generatedAt: new Date().toISOString(),\n      checks,\n      snapshot\n    };\n  }\n\n  async doctor(opts: RemoteDoctorCommandOptions = {}): Promise<void> {\n    const report = await this.getDoctorView();\n\n    if (opts.json) {\n      console.log(JSON.stringify(report, null, 2));\n      return;\n    }\n\n    console.log(\"NextClaw Remote Doctor\");\n    for (const check of report.checks) {\n      console.log(`${check.ok ? \"✓\" : \"✗\"} ${check.name}: ${check.detail}`);\n    }\n  }\n}\n"],"mappings":";;;;;;;AAkDA,SAAS,wBAAwB,OAAoC;AACnE,KAAI,OAAO,UAAU,SACnB;CAEF,MAAM,UAAU,MAAM,MAAM;AAC5B,QAAO,QAAQ,SAAS,IAAI,UAAU,KAAA;;AAGxC,SAAS,6BAA6B,QAAwB;AAC5D,QAAO,wBAAwB,mBAAmB,OAAO;;AAG3D,eAAe,aAAa,aAA+D;AACzF,KAAI;EACF,MAAM,WAAW,MAAM,MAAM,GAAG,YAAY,aAAa;AACzD,MAAI,CAAC,SAAS,GACZ,QAAO;GAAE,IAAI;GAAO,QAAQ,mBAAmB,SAAS;GAAU;AAEpE,SAAO;GAAE,IAAI;GAAM,QAAQ;GAA+B;UACnD,OAAO;AACd,SAAO;GACL,IAAI;GACJ,QAAQ,iBAAiB,QAAQ,MAAM,UAAU,OAAO,MAAM;GAC/D;;;AAIL,SAAS,2BAA2B,OAAqD;CACvF,MAAM,aAAa,8BAA8B,MAAM;AACvD,KAAI,WAAW,MACb,QAAO;EACL,MAAM;EACN,IAAI;EACJ,QAAQ;EACT;AAEH,KAAI,WAAW,WAAW,UACxB,QAAO;EACL,MAAM;EACN,IAAI;EACJ,QAAQ;EACT;AAEH,KAAI,WAAW,WAAW,YACxB,QAAO;EACL,MAAM;EACN,IAAI;EACJ,QAAQ;EACT;AAEH,QAAO;EACL,MAAM;EACN,IAAI;EACJ,QAAQ;EACT;;AAGH,IAAa,iBAAb,MAA4B;CAC1B,YAAY,OAAyD,EAAE,EAAE;AAA5C,OAAA,OAAA;;CAE7B,aAAa,SAIT,EAAE,EAAsB;EAC1B,MAAM,SAAS,WAAW,eAAe,CAAC;EAC1C,MAAM,cAAc,OAAO,OAAO,YAAY,YAAY,OAAO,UAAU,OAAO,OAAO;EACzF,MAAM,sBACJ,OAAO,OAAO,YAAY,WAAW,OAAO,QAAQ,MAAM,GAAG,OAAO,OAAO;EAC7E,MAAM,iBACJ,OAAO,OAAO,SAAS,WAAW,OAAO,KAAK,MAAM,GAAG,OAAO,OAAO;EACvE,MAAM,OAAe;GACnB,GAAG;GACH,QAAQ;IACN,GAAG,OAAO;IACV,SAAS;IACT,iBAAiB;IACjB,YAAY;IACb;GACF;AACD,aAAW,KAAK;AAChB,SAAO;GACL,SACE,OAAO,OAAO,YAAY,KAAK,OAAO,WACtC,OAAO,OAAO,oBAAoB,KAAK,OAAO,mBAC9C,OAAO,OAAO,eAAe,KAAK,OAAO;GAC3C,QAAQ;GACT;;CAGH,aAAa,OAAmC,EAAE,EAAsB;AACtE,SAAO,KAAK,aAAa;GACvB,SAAS;GACT,SAAS,OAAO,KAAK,YAAY,WAAW,KAAK,UAAU,KAAA;GAC3D,MAAM,OAAO,KAAK,SAAS,WAAW,KAAK,OAAO,KAAA;GACnD,CAAC;;CAGJ,gBAAoC;AAClC,SAAO,KAAK,aAAa,EAAE,SAAS,OAAO,CAAC;;CAG9C,MAAM,QAAQ,OAAoC,EAAE,EAAiB;AAEnE,QADkB,+BAA+B,CACjC,IAAI;GAClB,GAAG;GACH,MAAM;GACP,CAAC;;CAGJ,gBAAyC;EACvC,MAAM,SAAS,WAAW,eAAe,CAAC;EAC1C,MAAM,WAAW,oCAAoC,OAAO;EAC5D,MAAM,sBACJ,SAAS,SAAS,eAClB,KAAK,KAAK,sBACV,6BAA6B,OAAO;AACtC,SAAO;GACL,mBAAmB,SAAS;GAC5B,SAAS,SAAS;GAClB,aAAa;GACb,YAAY,SAAS,SAAS,cAAc,wBAAwB,OAAO,OAAO,WAAW,IAAI,UAAU;GAC3G,cACE,SAAS,SAAS,gBAClB,wBAAwB,OAAO,OAAO,gBAAgB,IACtD,wBAAwB,OAAO,UAAU,UAAU,QAAQ,IAC3D;GACH;;CAGH,MAAM,OAAO,OAAmC,EAAE,EAAiB;EACjE,MAAM,OAAO,KAAK,eAAe;AAEjC,MAAI,KAAK,MAAM;AACb,WAAQ,IAAI,KAAK,UAAU,MAAM,MAAM,EAAE,CAAC;AAC1C;;EAGF,MAAM,UAAU,KAAK;AACrB,UAAQ,IAAI,yBAAyB;AACrC,UAAQ,IAAI,YAAY,KAAK,oBAAoB,QAAQ,OAAO;AAChE,UAAQ,IAAI,SAAS,SAAS,QAAQ,YAAY;AAClD,UAAQ,IAAI,UAAU,SAAS,SAAS,aAAa;AACrD,UAAQ,IAAI,WAAW,KAAK,aAAa;AACzC,UAAQ,IAAI,aAAa,KAAK,gBAAgB,YAAY;AAC1D,UAAQ,IAAI,iBAAiB,SAAS,eAAe,KAAK,cAAc;AACxE,MAAI,SAAS,SACX,SAAQ,IAAI,cAAc,QAAQ,WAAW;AAE/C,MAAI,SAAS,gBACX,SAAQ,IAAI,mBAAmB,QAAQ,kBAAkB;AAE3D,MAAI,SAAS,UACX,SAAQ,IAAI,eAAe,QAAQ,YAAY;;CAInD,MAAM,gBAAkD;EACtD,MAAM,SAAS,WAAW,eAAe,CAAC;EAC1C,MAAM,WAAW,oCAAoC,OAAO;EAC5D,MAAM,cACJ,SAAS,SAAS,eAClB,KAAK,KAAK,sBACV,6BAA6B,OAAO;EACtC,MAAM,UAAU,MAAM,aAAa,YAAY;EAC/C,MAAM,QAAQ,wBAAwB,OAAO,UAAU,UAAU,OAAO;EACxE,MAAM,kBACJ,wBAAwB,OAAO,OAAO,gBAAgB,IACtD,wBAAwB,OAAO,UAAU,UAAU,QAAQ;EAC7D,MAAM,SAAS;GACb;IACE,MAAM;IACN,IAAI,SAAS;IACb,QAAQ,SAAS,oBAAoB,sBAAsB;IAC5D;GACD,2BAA2B,MAAM;GACjC;IACE,MAAM;IACN,IAAI,QAAQ,gBAAgB;IAC5B,QAAQ,mBAAmB;IAC5B;GACD;IACE,MAAM;IACN,IAAI,QAAQ;IACZ,QAAQ,GAAG,YAAY,IAAI,QAAQ,OAAO;IAC3C;GACD;IACE,MAAM;IACN,IAAI,SAAS,SAAS,UAAU;IAChC,QAAQ,SAAS,UAAU,SAAS,QAAQ,QAAQ;IACrD;GACF;AACD,SAAO;GACL,8BAAa,IAAI,MAAM,EAAC,aAAa;GACrC;GACA;GACD;;CAGH,MAAM,OAAO,OAAmC,EAAE,EAAiB;EACjE,MAAM,SAAS,MAAM,KAAK,eAAe;AAEzC,MAAI,KAAK,MAAM;AACb,WAAQ,IAAI,KAAK,UAAU,QAAQ,MAAM,EAAE,CAAC;AAC5C;;AAGF,UAAQ,IAAI,yBAAyB;AACrC,OAAK,MAAM,SAAS,OAAO,OACzB,SAAQ,IAAI,GAAG,MAAM,KAAK,MAAM,IAAI,GAAG,MAAM,KAAK,IAAI,MAAM,SAAS"}

package/dist/controllers/commands/restart-command.controller.d.ts

@@ -0,0 +1,21 @@
+import { StartCommandOptions } from "../../types/cli.types.js";
+import { ManagedServiceManager } from "../../managers/managed-service.manager.js";
+import { StartCommands } from "./start-command.controller.js";
+
+//#region src/controllers/commands/restart-command.controller.d.ts
+declare class RestartCommands {
+  private readonly deps;
+  constructor(deps: {
+    runtimeCommandService: ManagedServiceManager;
+    startCommands: StartCommands;
+    forcedPublicHost: string;
+    writeRestartSentinelFromExecContext: (reason: string) => Promise<void>;
+  });
+  run: (opts: StartCommandOptions) => Promise<void>;
+  private restartForegroundRuntime;
+  private resolveAdoptableForegroundRuntimePid;
+  private isAdoptableNextclawRuntimeCommand;
+}
+//#endregion
+export { RestartCommands };
+//# sourceMappingURL=restart-command.controller.d.ts.map

package/dist/controllers/commands/restart-command.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"restart-command.controller.d.ts","names":[],"sources":["../../../src/controllers/commands/restart-command.controller.ts"],"mappings":";;;;;cAUa,eAAA;EAAA,iBAEQ,IAAA;cAAA,IAAA;IACf,qBAAA,EAAuB,qBAAA;IACvB,aAAA,EAAe,aAAA;IACf,gBAAA;IACA,mCAAA,GAAsC,MAAA,aAAmB,OAAA;EAAA;EAI7D,GAAA,GAAa,IAAA,EAAM,mBAAA,KAAsB,OAAA;EAAA,QAuDjC,wBAAA;EAAA,QA6BA,oCAAA;EAAA,QAQA,iCAAA;AAAA"}

package/dist/controllers/commands/restart-command.controller.js

@@ -0,0 +1,90 @@
+import { findListeningProcessByPort, isProcessRunning, resolveUiConfig, waitForExit } from "../../utils/cli.utils.js";
+import { localUiRuntimeStore } from "../../stores/local-ui-runtime.store.js";
+import { managedServiceStateStore } from "../../stores/managed-service-state.store.js";
+import { describeUnmanagedHealthyTargetMessage } from "../../utils/service-port-probe.utils.js";
+import "../../managers/managed-service.manager.js";
+import { resolveManagedServiceUiOverrides } from "../../utils/runtime-helpers.utils.js";
+import { APP_NAME, loadConfig } from "@nextclaw/core";
+//#region src/controllers/commands/restart-command.controller.ts
+var RestartCommands = class {
+	constructor(deps) {
+		this.deps = deps;
+	}
+	run = async (opts) => {
+		await this.deps.writeRestartSentinelFromExecContext("cli.restart");
+		const uiOverrides = resolveManagedServiceUiOverrides({
+			uiPort: opts.uiPort,
+			forcedPublicHost: this.deps.forcedPublicHost
+		});
+		const targetUi = resolveUiConfig(loadConfig(), uiOverrides);
+		const state = managedServiceStateStore.read();
+		if (state && isProcessRunning(state.pid)) {
+			console.log(`Restarting ${APP_NAME}...`);
+			await this.deps.runtimeCommandService.stopService();
+		} else {
+			const foregroundRuntime = localUiRuntimeStore.read();
+			const foregroundMatchesTarget = Boolean(foregroundRuntime && isProcessRunning(foregroundRuntime.pid) && foregroundRuntime.uiPort === targetUi.port);
+			if (foregroundRuntime && foregroundMatchesTarget) {
+				if (!await this.restartForegroundRuntime(foregroundRuntime.pid)) return;
+				await this.deps.startCommands.run(opts);
+				return;
+			}
+			if (state) {
+				managedServiceStateStore.clear();
+				console.log("Service state was stale and has been cleaned up.");
+			}
+			const unmanagedHealthyServiceMessage = await describeUnmanagedHealthyTargetMessage({ uiOverrides });
+			if (unmanagedHealthyServiceMessage) {
+				const adoptedRuntimePid = this.resolveAdoptableForegroundRuntimePid(targetUi.port);
+				if (adoptedRuntimePid) {
+					if (!await this.restartForegroundRuntime(adoptedRuntimePid)) return;
+					await this.deps.startCommands.run(opts);
+					return;
+				}
+				console.error(`Error: Cannot restart ${APP_NAME} because the target UI/API port is already served by a healthy unmanaged instance.`);
+				console.error(unmanagedHealthyServiceMessage);
+				return;
+			}
+			if (!state) console.log("No running service found. Starting a new service.");
+		}
+		await this.deps.startCommands.run(opts);
+	};
+	restartForegroundRuntime = async (pid) => {
+		console.log(`Restarting ${APP_NAME} foreground runtime (PID ${pid})...`);
+		try {
+			process.kill(pid, "SIGTERM");
+		} catch (error) {
+			console.error(`Failed to stop foreground runtime: ${String(error)}`);
+			return false;
+		}
+		if (!await waitForExit(pid, 3e3)) {
+			try {
+				process.kill(pid, "SIGKILL");
+			} catch (error) {
+				console.error(`Failed to force stop foreground runtime: ${String(error)}`);
+				return false;
+			}
+			if (!await waitForExit(pid, 2e3)) {
+				console.error(`Failed to stop foreground runtime PID ${pid}.`);
+				return false;
+			}
+		}
+		localUiRuntimeStore.clearIfOwnedByProcess(pid);
+		console.log(`✓ ${APP_NAME} foreground runtime stopped`);
+		return true;
+	};
+	resolveAdoptableForegroundRuntimePid = (port) => {
+		const listeningProcess = findListeningProcessByPort(port);
+		if (!listeningProcess || !isProcessRunning(listeningProcess.pid)) return null;
+		return this.isAdoptableNextclawRuntimeCommand(listeningProcess.command) ? listeningProcess.pid : null;
+	};
+	isAdoptableNextclawRuntimeCommand = (command) => {
+		const normalized = command?.trim() ?? "";
+		if (!normalized) return false;
+		return /\bserve\b/.test(normalized) && (normalized.includes("/dist/cli/app/index.js") || normalized.includes("/src/cli/app/index.js") || normalized.includes("/runtime/dist/cli/app/index.js"));
+	};
+};
+//#endregion
+export { RestartCommands };
+
+//# sourceMappingURL=restart-command.controller.js.map

package/dist/controllers/commands/restart-command.controller.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"restart-command.controller.js","names":[],"sources":["../../../src/controllers/commands/restart-command.controller.ts"],"sourcesContent":["import { APP_NAME, loadConfig } from \"@nextclaw/core\";\nimport { managedServiceStateStore } from \"@nextclaw-service/stores/managed-service-state.store.js\";\nimport { localUiRuntimeStore } from \"@nextclaw-service/stores/local-ui-runtime.store.js\";\nimport { findListeningProcessByPort, isProcessRunning, resolveUiConfig, waitForExit } from \"@nextclaw-service/utils/cli.utils.js\";\nimport { resolveManagedServiceUiOverrides } from \"@nextclaw-service/utils/runtime-helpers.utils.js\";\nimport { describeUnmanagedHealthyTargetMessage } from \"@nextclaw-service/managers/managed-service.manager.js\";\nimport type { ManagedServiceManager } from \"@nextclaw-service/managers/managed-service.manager.js\";\nimport type { StartCommandOptions } from \"@nextclaw-service/types/cli.types.js\";\nimport type { StartCommands } from \"@nextclaw-service/controllers/commands/start-command.controller.js\";\n\nexport class RestartCommands {\n  constructor(\n    private readonly deps: {\n      runtimeCommandService: ManagedServiceManager;\n      startCommands: StartCommands;\n      forcedPublicHost: string;\n      writeRestartSentinelFromExecContext: (reason: string) => Promise<void>;\n    }\n  ) {}\n\n  run = async (opts: StartCommandOptions): Promise<void> => {\n    await this.deps.writeRestartSentinelFromExecContext(\"cli.restart\");\n    const uiOverrides = resolveManagedServiceUiOverrides({\n      uiPort: opts.uiPort,\n      forcedPublicHost: this.deps.forcedPublicHost\n    });\n    const targetUi = resolveUiConfig(loadConfig(), uiOverrides);\n\n    const state = managedServiceStateStore.read();\n    if (state && isProcessRunning(state.pid)) {\n      console.log(`Restarting ${APP_NAME}...`);\n      await this.deps.runtimeCommandService.stopService();\n    } else {\n      const foregroundRuntime = localUiRuntimeStore.read();\n      const foregroundMatchesTarget = Boolean(\n        foregroundRuntime &&\n        isProcessRunning(foregroundRuntime.pid) &&\n        foregroundRuntime.uiPort === targetUi.port\n      );\n      if (foregroundRuntime && foregroundMatchesTarget) {\n        const restarted = await this.restartForegroundRuntime(foregroundRuntime.pid);\n        if (!restarted) {\n          return;\n        }\n        await this.deps.startCommands.run(opts);\n        return;\n      }\n      if (state) {\n        managedServiceStateStore.clear();\n        console.log(\"Service state was stale and has been cleaned up.\");\n      }\n\n      const unmanagedHealthyServiceMessage = await describeUnmanagedHealthyTargetMessage({ uiOverrides });\n      if (unmanagedHealthyServiceMessage) {\n        const adoptedRuntimePid = this.resolveAdoptableForegroundRuntimePid(targetUi.port);\n        if (adoptedRuntimePid) {\n          const restarted = await this.restartForegroundRuntime(adoptedRuntimePid);\n          if (!restarted) {\n            return;\n          }\n          await this.deps.startCommands.run(opts);\n          return;\n        }\n        console.error(`Error: Cannot restart ${APP_NAME} because the target UI/API port is already served by a healthy unmanaged instance.`);\n        console.error(unmanagedHealthyServiceMessage);\n        return;\n      }\n      if (!state) {\n        console.log(\"No running service found. Starting a new service.\");\n      }\n    }\n\n    await this.deps.startCommands.run(opts);\n  };\n\n  private restartForegroundRuntime = async (pid: number): Promise<boolean> => {\n    console.log(`Restarting ${APP_NAME} foreground runtime (PID ${pid})...`);\n    try {\n      process.kill(pid, \"SIGTERM\");\n    } catch (error) {\n      console.error(`Failed to stop foreground runtime: ${String(error)}`);\n      return false;\n    }\n\n    const stopped = await waitForExit(pid, 3000);\n    if (!stopped) {\n      try {\n        process.kill(pid, \"SIGKILL\");\n      } catch (error) {\n        console.error(`Failed to force stop foreground runtime: ${String(error)}`);\n        return false;\n      }\n      const forcedStopped = await waitForExit(pid, 2000);\n      if (!forcedStopped) {\n        console.error(`Failed to stop foreground runtime PID ${pid}.`);\n        return false;\n      }\n    }\n\n    localUiRuntimeStore.clearIfOwnedByProcess(pid);\n    console.log(`✓ ${APP_NAME} foreground runtime stopped`);\n    return true;\n  };\n\n  private resolveAdoptableForegroundRuntimePid = (port: number): number | null => {\n    const listeningProcess = findListeningProcessByPort(port);\n    if (!listeningProcess || !isProcessRunning(listeningProcess.pid)) {\n      return null;\n    }\n    return this.isAdoptableNextclawRuntimeCommand(listeningProcess.command) ? listeningProcess.pid : null;\n  };\n\n  private isAdoptableNextclawRuntimeCommand = (command: string | null): boolean => {\n    const normalized = command?.trim() ?? \"\";\n    if (!normalized) {\n      return false;\n    }\n    return (\n      /\\bserve\\b/.test(normalized) &&\n      (\n        normalized.includes(\"/dist/cli/app/index.js\") ||\n        normalized.includes(\"/src/cli/app/index.js\") ||\n        normalized.includes(\"/runtime/dist/cli/app/index.js\")\n      )\n    );\n  };\n}\n"],"mappings":";;;;;;;;AAUA,IAAa,kBAAb,MAA6B;CAC3B,YACE,MAMA;AANiB,OAAA,OAAA;;CAQnB,MAAM,OAAO,SAA6C;AACxD,QAAM,KAAK,KAAK,oCAAoC,cAAc;EAClE,MAAM,cAAc,iCAAiC;GACnD,QAAQ,KAAK;GACb,kBAAkB,KAAK,KAAK;GAC7B,CAAC;EACF,MAAM,WAAW,gBAAgB,YAAY,EAAE,YAAY;EAE3D,MAAM,QAAQ,yBAAyB,MAAM;AAC7C,MAAI,SAAS,iBAAiB,MAAM,IAAI,EAAE;AACxC,WAAQ,IAAI,cAAc,SAAS,KAAK;AACxC,SAAM,KAAK,KAAK,sBAAsB,aAAa;SAC9C;GACL,MAAM,oBAAoB,oBAAoB,MAAM;GACpD,MAAM,0BAA0B,QAC9B,qBACA,iBAAiB,kBAAkB,IAAI,IACvC,kBAAkB,WAAW,SAAS,KACvC;AACD,OAAI,qBAAqB,yBAAyB;AAEhD,QAAI,CADc,MAAM,KAAK,yBAAyB,kBAAkB,IAAI,CAE1E;AAEF,UAAM,KAAK,KAAK,cAAc,IAAI,KAAK;AACvC;;AAEF,OAAI,OAAO;AACT,6BAAyB,OAAO;AAChC,YAAQ,IAAI,mDAAmD;;GAGjE,MAAM,iCAAiC,MAAM,sCAAsC,EAAE,aAAa,CAAC;AACnG,OAAI,gCAAgC;IAClC,MAAM,oBAAoB,KAAK,qCAAqC,SAAS,KAAK;AAClF,QAAI,mBAAmB;AAErB,SAAI,CADc,MAAM,KAAK,yBAAyB,kBAAkB,CAEtE;AAEF,WAAM,KAAK,KAAK,cAAc,IAAI,KAAK;AACvC;;AAEF,YAAQ,MAAM,yBAAyB,SAAS,oFAAoF;AACpI,YAAQ,MAAM,+BAA+B;AAC7C;;AAEF,OAAI,CAAC,MACH,SAAQ,IAAI,oDAAoD;;AAIpE,QAAM,KAAK,KAAK,cAAc,IAAI,KAAK;;CAGzC,2BAAmC,OAAO,QAAkC;AAC1E,UAAQ,IAAI,cAAc,SAAS,2BAA2B,IAAI,MAAM;AACxE,MAAI;AACF,WAAQ,KAAK,KAAK,UAAU;WACrB,OAAO;AACd,WAAQ,MAAM,sCAAsC,OAAO,MAAM,GAAG;AACpE,UAAO;;AAIT,MAAI,CADY,MAAM,YAAY,KAAK,IAAK,EAC9B;AACZ,OAAI;AACF,YAAQ,KAAK,KAAK,UAAU;YACrB,OAAO;AACd,YAAQ,MAAM,4CAA4C,OAAO,MAAM,GAAG;AAC1E,WAAO;;AAGT,OAAI,CADkB,MAAM,YAAY,KAAK,IAAK,EAC9B;AAClB,YAAQ,MAAM,yCAAyC,IAAI,GAAG;AAC9D,WAAO;;;AAIX,sBAAoB,sBAAsB,IAAI;AAC9C,UAAQ,IAAI,KAAK,SAAS,6BAA6B;AACvD,SAAO;;CAGT,wCAAgD,SAAgC;EAC9E,MAAM,mBAAmB,2BAA2B,KAAK;AACzD,MAAI,CAAC,oBAAoB,CAAC,iBAAiB,iBAAiB,IAAI,CAC9D,QAAO;AAET,SAAO,KAAK,kCAAkC,iBAAiB,QAAQ,GAAG,iBAAiB,MAAM;;CAGnG,qCAA6C,YAAoC;EAC/E,MAAM,aAAa,SAAS,MAAM,IAAI;AACtC,MAAI,CAAC,WACH,QAAO;AAET,SACE,YAAY,KAAK,WAAW,KAE1B,WAAW,SAAS,yBAAyB,IAC7C,WAAW,SAAS,wBAAwB,IAC5C,WAAW,SAAS,iCAAiC"}

package/dist/controllers/commands/secrets-command.controller.d.ts

@@ -0,0 +1,23 @@
+import { RequestRestartParams, SecretsApplyOptions, SecretsAuditOptions, SecretsConfigureOptions, SecretsReloadOptions } from "../../types/cli.types.js";
+
+//#region src/controllers/commands/secrets-command.controller.d.ts
+declare class SecretsCommands {
+  private deps;
+  constructor(deps: {
+    requestRestart: (params: RequestRestartParams) => Promise<void>;
+  });
+  audit: (opts?: SecretsAuditOptions) => void;
+  configure: (opts: SecretsConfigureOptions) => Promise<void>;
+  apply: (opts: SecretsApplyOptions) => Promise<void>;
+  reload: (opts?: SecretsReloadOptions) => Promise<void>;
+  private removeProvider;
+  private configureProvider;
+  private buildProviderConfig;
+  private applyEnabledPatch;
+  private applyFilePatch;
+  private applySingleRefPatch;
+  private requestRestartForConfigDiff;
+}
+//#endregion
+export { SecretsCommands };
+//# sourceMappingURL=secrets-command.controller.d.ts.map

package/dist/controllers/commands/secrets-command.controller.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secrets-command.controller.d.ts","names":[],"sources":["../../../src/controllers/commands/secrets-command.controller.ts"],"mappings":";;;cAqIa,eAAA;EAAA,QAED,IAAA;cAAA,IAAA;IACN,cAAA,GAAiB,MAAA,EAAQ,oBAAA,KAAyB,OAAA;EAAA;EAItD,KAAA,GAAS,IAAA,GAAM,mBAAA;EAwEf,SAAA,GAAmB,IAAA,EAAM,uBAAA,KAA0B,OAAA;EAgCnD,KAAA,GAAe,IAAA,EAAM,mBAAA,KAAsB,OAAA;EAwB3C,MAAA,GAAgB,IAAA,GAAM,oBAAA,KAA4B,OAAA;EAAA,QAa1C,cAAA;EAAA,QASA,iBAAA;EAAA,QAWA,mBAAA;EAAA,QA2BA,iBAAA;EAAA,QAUA,cAAA;EAAA,QAUA,mBAAA;EAAA,QA4BA,2BAAA;AAAA"}

package/dist/controllers/commands/secrets-command.controller.js

@@ -0,0 +1,282 @@
+import { getAtConfigPath, parseRequiredConfigPath } from "../../utils/config-path.utils.js";
+import { buildReloadPlan, diffConfigPaths, getConfigPath, loadConfig, resolveConfigSecrets, saveConfig } from "@nextclaw/core";
+import { readFileSync } from "node:fs";
+//#region src/controllers/commands/secrets-command.controller.ts
+const SECRET_SOURCES = [
+	"env",
+	"file",
+	"exec"
+];
+function normalizeSecretSource(value) {
+	if (typeof value !== "string") return null;
+	const normalized = value.trim().toLowerCase();
+	return SECRET_SOURCES.includes(normalized) ? normalized : null;
+}
+function normalizeOptionalString(value) {
+	if (typeof value !== "string") return;
+	return value.trim() || void 0;
+}
+function parseTimeoutMs(value) {
+	if (value === void 0 || value === null || value === "") return;
+	const parsed = Number(value);
+	if (!Number.isFinite(parsed) || parsed <= 0) throw new Error(`invalid timeout: ${String(value)}`);
+	return Math.trunc(parsed);
+}
+function inferProviderAlias(config, ref) {
+	const explicit = normalizeOptionalString(ref.provider);
+	if (explicit) return explicit;
+	const defaultAlias = normalizeOptionalString(config.secrets.defaults[ref.source]);
+	if (defaultAlias) return defaultAlias;
+	return ref.source;
+}
+function summarizeAudit(items) {
+	const ok = items.filter((item) => item.ok).length;
+	return {
+		total: items.length,
+		ok,
+		failed: items.length - ok
+	};
+}
+function parseRefsPatch(raw) {
+	if (!raw || typeof raw !== "object" || Array.isArray(raw)) throw new Error("refs patch must be an object");
+	const output = {};
+	for (const [path, value] of Object.entries(raw)) {
+		if (!value || typeof value !== "object" || Array.isArray(value)) throw new Error(`invalid ref for ${path}`);
+		const source = normalizeSecretSource(value.source);
+		const id = normalizeOptionalString(value.id);
+		const provider = normalizeOptionalString(value.provider);
+		if (!source || !id) throw new Error(`invalid ref for ${path}: source/id is required`);
+		output[path] = {
+			source,
+			...provider ? { provider } : {},
+			id
+		};
+	}
+	return output;
+}
+function parseApplyFile(raw) {
+	const data = JSON.parse(raw);
+	if (!data || typeof data !== "object" || Array.isArray(data)) throw new Error("apply file must be an object");
+	const record = data;
+	if (record.refs || record.providers || record.defaults || Object.prototype.hasOwnProperty.call(record, "enabled")) {
+		const patch = {};
+		if (Object.prototype.hasOwnProperty.call(record, "enabled")) patch.enabled = Boolean(record.enabled);
+		if (record.defaults && typeof record.defaults === "object" && !Array.isArray(record.defaults)) patch.defaults = record.defaults;
+		if (record.providers && typeof record.providers === "object" && !Array.isArray(record.providers)) patch.providers = record.providers;
+		if (record.refs) patch.refs = parseRefsPatch(record.refs);
+		return patch;
+	}
+	return { refs: parseRefsPatch(record) };
+}
+var SecretsCommands = class {
+	constructor(deps) {
+		this.deps = deps;
+	}
+	audit = (opts = {}) => {
+		const config = loadConfig();
+		const configPath = getConfigPath();
+		const refs = config.secrets.refs;
+		const items = [];
+		for (const [path, ref] of Object.entries(refs)) {
+			const provider = inferProviderAlias(config, ref);
+			const scopedConfig = structuredClone(config);
+			scopedConfig.secrets.refs = { [path]: ref };
+			try {
+				const target = getAtConfigPath(resolveConfigSecrets(scopedConfig, { configPath }), parseRequiredConfigPath(path));
+				if (!target.found) {
+					items.push({
+						path,
+						source: ref.source,
+						provider,
+						id: ref.id,
+						ok: false,
+						detail: "resolved but path not found"
+					});
+					continue;
+				}
+				const resolvedValue = target.value;
+				const detail = typeof resolvedValue === "string" ? `resolved (length=${resolvedValue.length})` : `resolved (${typeof resolvedValue})`;
+				items.push({
+					path,
+					source: ref.source,
+					provider,
+					id: ref.id,
+					ok: true,
+					detail
+				});
+			} catch (error) {
+				items.push({
+					path,
+					source: ref.source,
+					provider,
+					id: ref.id,
+					ok: false,
+					detail: String(error)
+				});
+			}
+		}
+		const summary = summarizeAudit(items);
+		if (opts.json) console.log(JSON.stringify({
+			summary,
+			items
+		}, null, 2));
+		else if (!items.length) console.log("No secret refs configured.");
+		else {
+			for (const item of items) {
+				const status = item.ok ? "OK" : "ERROR";
+				console.log(`[${status}] ${item.path} <- ${item.source}:${item.provider}:${item.id} (${item.detail})`);
+			}
+			console.log(`Summary: total=${summary.total}, ok=${summary.ok}, failed=${summary.failed}`);
+		}
+		if (Boolean(opts.strict) && summary.failed > 0) process.exitCode = 1;
+	};
+	configure = async (opts) => {
+		const alias = normalizeOptionalString(opts.provider);
+		if (!alias) throw new Error("provider alias is required");
+		const prevConfig = loadConfig();
+		const nextConfig = structuredClone(prevConfig);
+		const remove = Boolean(opts.remove);
+		if (remove) this.removeProvider(nextConfig, alias);
+		else this.configureProvider(nextConfig, alias, opts);
+		resolveConfigSecrets(nextConfig, { configPath: getConfigPath() });
+		saveConfig(nextConfig);
+		await this.requestRestartForConfigDiff({
+			prevConfig,
+			nextConfig,
+			reason: `secrets.configure ${alias}`,
+			manualMessage: "Secrets provider updated. Restart the gateway if required."
+		});
+		if (opts.json) {
+			console.log(JSON.stringify({
+				ok: true,
+				providers: nextConfig.secrets.providers,
+				defaults: nextConfig.secrets.defaults
+			}, null, 2));
+			return;
+		}
+		console.log(`Secrets provider ${remove ? "removed" : "configured"}: ${alias}`);
+	};
+	apply = async (opts) => {
+		const prevConfig = loadConfig();
+		const nextConfig = structuredClone(prevConfig);
+		this.applyEnabledPatch(nextConfig, opts);
+		this.applyFilePatch(nextConfig, opts);
+		this.applySingleRefPatch(nextConfig, opts);
+		resolveConfigSecrets(nextConfig, { configPath: getConfigPath() });
+		saveConfig(nextConfig);
+		await this.requestRestartForConfigDiff({
+			prevConfig,
+			nextConfig,
+			reason: "secrets.apply",
+			manualMessage: "Secrets updated. Restart the gateway if required."
+		});
+		if (opts.json) {
+			console.log(JSON.stringify({
+				ok: true,
+				secrets: nextConfig.secrets
+			}, null, 2));
+			return;
+		}
+		console.log("Secrets applied.");
+	};
+	reload = async (opts = {}) => {
+		const config = loadConfig();
+		resolveConfigSecrets(config, { configPath: getConfigPath() });
+		saveConfig(config);
+		if (opts.json) {
+			console.log(JSON.stringify({
+				ok: true,
+				message: "secrets reload signal emitted"
+			}, null, 2));
+			return;
+		}
+		console.log("Secrets reload signal emitted.");
+	};
+	removeProvider = (config, alias) => {
+		delete config.secrets.providers[alias];
+		for (const source of SECRET_SOURCES) if (config.secrets.defaults[source] === alias) delete config.secrets.defaults[source];
+	};
+	configureProvider = (config, alias, opts) => {
+		const source = normalizeSecretSource(opts.source);
+		if (!source) throw new Error("source is required and must be one of env/file/exec");
+		config.secrets.providers[alias] = this.buildProviderConfig(source, opts);
+		if (opts.setDefault) config.secrets.defaults[source] = alias;
+	};
+	buildProviderConfig = (source, opts) => {
+		if (source === "env") return {
+			source,
+			...normalizeOptionalString(opts.prefix) ? { prefix: normalizeOptionalString(opts.prefix) } : {}
+		};
+		if (source === "file") {
+			const path = normalizeOptionalString(opts.path);
+			if (!path) throw new Error("file source requires --path");
+			return {
+				source,
+				path,
+				format: "json"
+			};
+		}
+		const command = normalizeOptionalString(opts.command);
+		if (!command) throw new Error("exec source requires --command");
+		return {
+			source,
+			command,
+			args: Array.isArray(opts.arg) ? opts.arg : [],
+			...normalizeOptionalString(opts.cwd) ? { cwd: normalizeOptionalString(opts.cwd) } : {},
+			timeoutMs: parseTimeoutMs(opts.timeoutMs) ?? 5e3
+		};
+	};
+	applyEnabledPatch = (config, opts) => {
+		const { disable, enable } = opts;
+		if (enable && disable) throw new Error("cannot set --enable and --disable at the same time");
+		if (enable || disable) config.secrets.enabled = Boolean(enable);
+	};
+	applyFilePatch = (config, opts) => {
+		if (!opts.file) return;
+		const { defaults, providers, refs } = parseApplyFile(readFileSync(opts.file, "utf-8"));
+		if (defaults) config.secrets.defaults = defaults;
+		if (providers) config.secrets.providers = providers;
+		if (refs) config.secrets.refs = {
+			...config.secrets.refs,
+			...refs
+		};
+	};
+	applySingleRefPatch = (config, opts) => {
+		if (!opts.path) {
+			if (opts.remove && !opts.file) throw new Error("--remove requires --path");
+			return;
+		}
+		const path = opts.path.trim();
+		if (!path) throw new Error("path is empty");
+		if (opts.remove) {
+			delete config.secrets.refs[path];
+			return;
+		}
+		const source = normalizeSecretSource(opts.source);
+		const id = normalizeOptionalString(opts.id);
+		if (!source || !id) throw new Error("apply single ref requires --source and --id");
+		const provider = normalizeOptionalString(opts.provider);
+		config.secrets.refs[path] = {
+			source,
+			id,
+			...provider ? { provider } : {}
+		};
+	};
+	requestRestartForConfigDiff = async (params) => {
+		const { manualMessage, nextConfig, prevConfig, reason } = params;
+		const changedPaths = diffConfigPaths(prevConfig, nextConfig);
+		if (!changedPaths.length) return;
+		const plan = buildReloadPlan(changedPaths);
+		if (plan.restartRequired.length === 0) return;
+		await this.deps.requestRestart({
+			changedPaths: plan.restartRequired,
+			mode: "notify",
+			reason: `${reason} (${plan.restartRequired.join(", ")})`,
+			manualMessage
+		});
+	};
+};
+//#endregion
+export { SecretsCommands };
+
+//# sourceMappingURL=secrets-command.controller.js.map