@openclaw/clickclack 2026.7.2-beta.3 → 2026.7.2-beta.5

package/dist/runtime-api.js

@@ -1,4 +1,4 @@
-import { a as createClickClackClient, m as resolveClickClackAccount } from "./setup-surface-CNjp76Xx.js";
-import { a as setClickClackRuntime, r as parseClickClackTarget } from "./channel-CEYthZ9N.js";
-import "./api.js";
-export { createClickClackClient, parseClickClackTarget, resolveClickClackAccount, setClickClackRuntime };
+import { d as createClickClackClient, x as resolveClickClackAccount } from "./setup-surface-CD6MUC1g.js";
+import { D as setClickClackRuntime, r as parseClickClackTarget } from "./channel-DfcFlLjC.js";
+import { t as registerClickClackDiscussions } from "./runtime-api-D1H9vheM.js";
+export { createClickClackClient, parseClickClackTarget, registerClickClackDiscussions, resolveClickClackAccount, setClickClackRuntime };

package/dist/{setup-claim-BUWvZjtu.js → setup-claim-BFU16zoo.js}

@@ -1,5 +1,6 @@
+import { a as buildClickClackSetupClaimUrl, o as isClickClackSetupLoopbackHost, s as requireClickClackSetupApiBaseUrl } from "./setup-surface-CD6MUC1g.js";
 import { createProviderOperationDeadline, readProviderJsonResponse, readResponseTextLimited, resolveProviderOperationTimeoutMs } from "openclaw/plugin-sdk/provider-http";
-import { fetchWithSsrFGuard, isPrivateOrLoopbackHost, resolvePinnedHostnameWithPolicy, ssrfPolicyFromHttpBaseUrlAllowedHostname } from "openclaw/plugin-sdk/ssrf-runtime";
+import { fetchWithSsrFGuard, resolvePinnedHostnameWithPolicy, ssrfPolicyFromHttpBaseUrlAllowedHostname } from "openclaw/plugin-sdk/ssrf-runtime";
 import { withTimeout } from "openclaw/plugin-sdk/text-utility-runtime";
 //#region extensions/clickclack/src/setup-claim.ts
 const CLICKCLACK_ERROR_BODY_LIMIT_BYTES = 8 * 1024;
@@ -20,7 +21,7 @@ function requireString(record, key, label) {
 	if (typeof value !== "string" || !value.trim()) throw new Error(`ClickClack setup code claim returned invalid ${label}.${key}`);
 	return value;
 }
-function parseClickClackSetupCodeClaim(value) {
+function parseClickClackSetupCodeClaim(value, expectedClaimUrl) {
 	const claim = requireRecord(value, "response");
 	const bot = requireRecord(claim.bot, "bot");
 	const workspace = requireRecord(claim.workspace, "workspace");
@@ -31,7 +32,23 @@ function parseClickClackSetupCodeClaim(value) {
 	if (defaultTo !== void 0 && typeof defaultTo !== "string") throw new Error("ClickClack setup code claim returned invalid defaults.defaultTo");
 	if (allowFrom !== void 0 && (!Array.isArray(allowFrom) || !allowFrom.every((entry) => typeof entry === "string"))) throw new Error("ClickClack setup code claim returned invalid defaults.allowFrom");
 	if (agentActivity !== void 0 && typeof agentActivity !== "boolean") throw new Error("ClickClack setup code claim returned invalid defaults.agentActivity");
+	const contractVersion = claim.contract_version;
+	const apiBaseUrlValue = claim.api_base_url;
+	const hasContractMetadata = contractVersion !== void 0 || apiBaseUrlValue !== void 0;
+	if (expectedClaimUrl && !hasContractMetadata) throw new Error("ClickClack setup code claim returned a legacy response for an exact endpoint");
+	let contract = {};
+	if (hasContractMetadata) {
+		if (contractVersion !== 1 || typeof apiBaseUrlValue !== "string") throw new Error("ClickClack setup code claim returned invalid v1 contract metadata");
+		const apiBaseUrl = requireClickClackSetupApiBaseUrl(apiBaseUrlValue, "setup code claim response.api_base_url");
+		const canonicalClaimUrl = buildClickClackSetupClaimUrl(apiBaseUrl);
+		if (expectedClaimUrl && expectedClaimUrl !== canonicalClaimUrl) throw new Error("ClickClack setup code claim returned an API base that does not match the claim URL");
+		contract = {
+			contract_version: 1,
+			api_base_url: apiBaseUrl
+		};
+	}
 	return {
+		...contract,
 		token: requireString(claim, "token", "response"),
 		bot: {
 			id: requireString(bot, "id", "bot"),
@@ -53,30 +70,35 @@ function parseClickClackSetupCodeClaim(value) {
 }
 /** Claims a one-time setup code without sending any existing bot credential. */
 async function claimClickClackSetupCode(params) {
-	const baseUrl = params.baseUrl.replace(/\/+$/, "");
-	const parsedBaseUrl = new URL(baseUrl);
+	let parsedClaimUrl;
+	try {
+		parsedClaimUrl = new URL(params.claimUrl);
+	} catch {
+		throw new Error("ClickClack setup code claim URL must be a valid HTTP(S) endpoint.");
+	}
+	if (parsedClaimUrl.protocol !== "http:" && parsedClaimUrl.protocol !== "https:" || parsedClaimUrl.username || parsedClaimUrl.password || parsedClaimUrl.search || parsedClaimUrl.hash || !parsedClaimUrl.pathname.endsWith("/api/bot-setup-codes/claim")) throw new Error("ClickClack setup code claim URL must be a valid HTTP(S) endpoint.");
 	const deadline = createProviderOperationDeadline({
 		label: "ClickClack setup code claim",
 		timeoutMs: CLICKCLACK_SETUP_CODE_CLAIM_TIMEOUT_MS
 	});
 	let pinnedHttpTarget;
-	if (parsedBaseUrl.protocol === "http:") {
+	if (parsedClaimUrl.protocol === "http:") {
 		const resolveTimeoutMs = resolveProviderOperationTimeoutMs({
 			deadline,
 			defaultTimeoutMs: CLICKCLACK_SETUP_CODE_CLAIM_TIMEOUT_MS
 		});
-		const pinned = await withTimeout(resolvePinnedHostnameWithPolicy(parsedBaseUrl.hostname, {
+		const pinned = await withTimeout(resolvePinnedHostnameWithPolicy(parsedClaimUrl.hostname, {
 			lookupFn: params.lookupFn,
 			policy: { dangerouslyAllowPrivateNetwork: true }
 		}), resolveTimeoutMs, { message: `ClickClack setup code claim timed out after ${CLICKCLACK_SETUP_CODE_CLAIM_TIMEOUT_MS}ms` });
-		if (!pinned.addresses.every((address) => isPrivateOrLoopbackHost(address))) throw new Error("ClickClack setup codes require HTTPS unless the server is on a private or loopback network.");
+		if (!pinned.addresses.every((address) => isClickClackSetupLoopbackHost(address))) throw new Error("ClickClack setup codes require HTTPS unless the server is on loopback.");
 		pinnedHttpTarget = {
 			hostname: pinned.hostname,
 			addresses: pinned.addresses
 		};
 	}
 	const { response, release } = await fetchWithSsrFGuard({
-		url: `${baseUrl}/api/bot-setup-codes/claim`,
+		url: params.claimUrl,
 		fetchImpl: params.fetch,
 		init: {
 			method: "POST",
@@ -91,8 +113,8 @@ async function claimClickClackSetupCode(params) {
 			deadline,
 			defaultTimeoutMs: CLICKCLACK_SETUP_CODE_CLAIM_TIMEOUT_MS
 		}),
-		requireHttps: parsedBaseUrl.protocol === "https:",
-		policy: ssrfPolicyFromHttpBaseUrlAllowedHostname(baseUrl),
+		requireHttps: parsedClaimUrl.protocol === "https:",
+		policy: ssrfPolicyFromHttpBaseUrlAllowedHostname(params.claimUrl),
 		lookupFn: params.lookupFn,
 		...pinnedHttpTarget ? { dispatcherPolicy: {
 			mode: "direct",
@@ -105,7 +127,7 @@ async function claimClickClackSetupCode(params) {
 			const detail = await readResponseTextLimited(response, CLICKCLACK_ERROR_BODY_LIMIT_BYTES);
 			throw new ClickClackSetupCodeClaimError(response.status, detail);
 		}
-		return parseClickClackSetupCodeClaim(await readProviderJsonResponse(response, "ClickClack setup code claim", { maxBytes: CLICKCLACK_SETUP_CODE_CLAIM_JSON_LIMIT_BYTES }));
+		return parseClickClackSetupCodeClaim(await readProviderJsonResponse(response, "ClickClack setup code claim", { maxBytes: CLICKCLACK_SETUP_CODE_CLAIM_JSON_LIMIT_BYTES }), params.expectedClaimUrl);
 	} finally {
 		await release();
 	}

package/dist/setup-plugin-api.js

@@ -1,4 +1,4 @@
-import { l as clickClackConfigAdapter, n as clickClackSetupAdapter, s as clickClackConfigSchema, t as clickClackSetupWizard, u as clickClackMeta } from "./setup-surface-CNjp76Xx.js";
+import { _ as clickClackMeta, g as clickClackConfigAdapter, m as clickClackConfigSchema, n as clickClackSetupAdapter, r as clickClackSetupContract, t as clickClackSetupWizard } from "./setup-surface-CD6MUC1g.js";
 //#region extensions/clickclack/src/channel.setup.ts
 const clickClackSetupPlugin = {
 	id: "clickclack",
@@ -12,6 +12,7 @@ const clickClackSetupPlugin = {
 	configSchema: clickClackConfigSchema,
 	config: clickClackConfigAdapter,
 	setup: clickClackSetupAdapter,
+	setupContract: clickClackSetupContract,
 	setupWizard: clickClackSetupWizard
 };
 //#endregion