@ouro.bot/cli 0.1.0-alpha.465 → 0.1.0-alpha.467

package/dist/heart/daemon/vault-items.js

@@ -0,0 +1,56 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PORKBUN_OPS_COMPATIBILITY_ALIAS = exports.PORKBUN_OPS_CREDENTIAL_PREFIX = void 0;
+exports.isVaultItemTemplate = isVaultItemTemplate;
+exports.normalizeVaultItemName = normalizeVaultItemName;
+exports.normalizeVaultItemFieldName = normalizeVaultItemFieldName;
+exports.vaultItemTemplateSecretFields = vaultItemTemplateSecretFields;
+exports.normalizePorkbunOpsAccount = normalizePorkbunOpsAccount;
+exports.porkbunOpsCredentialItemName = porkbunOpsCredentialItemName;
+exports.porkbunOpsAccountFromItemName = porkbunOpsAccountFromItemName;
+exports.requireVaultItemSecret = requireVaultItemSecret;
+exports.PORKBUN_OPS_CREDENTIAL_PREFIX = "ops/registrars/porkbun/accounts";
+exports.PORKBUN_OPS_COMPATIBILITY_ALIAS = "vault ops porkbun";
+const VAULT_ITEM_NAME_FORBIDDEN = /[\r\n\t]/;
+const VAULT_ITEM_FIELD_FORBIDDEN = /[\r\n\t=]/;
+const PORKBUN_OPS_ACCOUNT_FORBIDDEN = /[\/\r\n\t]/;
+function isVaultItemTemplate(value) {
+    return value === "porkbun-api";
+}
+function normalizeVaultItemName(item) {
+    const normalized = item?.trim() ?? "";
+    if (!normalized || VAULT_ITEM_NAME_FORBIDDEN.test(normalized) || normalized.startsWith("/") || normalized.endsWith("/")) {
+        throw new Error("Vault item name/path must be non-empty, relative, and free of control characters.");
+    }
+    return normalized;
+}
+function normalizeVaultItemFieldName(field) {
+    const normalized = field?.trim() ?? "";
+    if (!normalized || VAULT_ITEM_FIELD_FORBIDDEN.test(normalized)) {
+        throw new Error("Vault item field names must be non-empty and free of control characters or '='.");
+    }
+    return normalized;
+}
+function vaultItemTemplateSecretFields(_template) {
+    return ["apiKey", "secretApiKey"];
+}
+function normalizePorkbunOpsAccount(account) {
+    const normalized = account?.trim() ?? "";
+    if (!normalized || PORKBUN_OPS_ACCOUNT_FORBIDDEN.test(normalized)) {
+        throw new Error("Porkbun account must be a non-empty account label without slashes or control characters.");
+    }
+    return normalized;
+}
+function porkbunOpsCredentialItemName(account) {
+    return `${exports.PORKBUN_OPS_CREDENTIAL_PREFIX}/${normalizePorkbunOpsAccount(account)}`;
+}
+function porkbunOpsAccountFromItemName(itemName) {
+    const prefix = `${exports.PORKBUN_OPS_CREDENTIAL_PREFIX}/`;
+    return itemName.startsWith(prefix) ? itemName.slice(prefix.length) : undefined;
+}
+function requireVaultItemSecret(value, label) {
+    const trimmed = value.trim();
+    if (!trimmed)
+        throw new Error(`${label} cannot be blank`);
+    return trimmed;
+}

package/dist/heart/outlook/readers/mail.js

@@ -5,6 +5,7 @@ exports.readMailMessageView = readMailMessageView;
 const runtime_1 = require("../../../nerves/runtime");
 const file_store_1 = require("../../../mailroom/file-store");
 const reader_1 = require("../../../mailroom/reader");
+const core_1 = require("../../../mailroom/core");
 const OUTLOOK_MAIL_LIST_LIMIT = 50;
 const OUTLOOK_MAIL_COUNT_LIMIT = 500;
 const OUTLOOK_MAIL_BODY_LIMIT = 12_000;
@@ -92,13 +93,27 @@ function buildFolders(messages, outbound) {
         { id: "native", label: "Native", count: messages.filter((message) => message.compartmentKind === "native").length },
     ];
     const sourceCounts = new Map();
+    const sourceOwnerCounts = new Map();
     for (const message of messages) {
         if (!message.source)
             continue;
         sourceCounts.set(message.source, (sourceCounts.get(message.source) ?? 0) + 1);
+        const owner = message.ownerEmail ?? "";
+        const ownerCounts = sourceOwnerCounts.get(message.source) ?? new Map();
+        ownerCounts.set(owner, (ownerCounts.get(owner) ?? 0) + 1);
+        sourceOwnerCounts.set(message.source, ownerCounts);
     }
     for (const [source, count] of [...sourceCounts.entries()].sort((a, b) => a[0].localeCompare(b[0]))) {
-        folders.push({ id: `source:${source}`, label: source.toUpperCase(), count });
+        const ownerCounts = sourceOwnerCounts.get(source);
+        if (!ownerCounts || ownerCounts.size <= 1) {
+            folders.push({ id: `source:${source}`, label: source.toUpperCase(), count });
+            continue;
+        }
+        for (const [owner, ownerCount] of [...ownerCounts.entries()].sort((a, b) => a[0].localeCompare(b[0]))) {
+            const ownerLabel = owner || "unknown owner";
+            const ownerId = owner || "unknown-owner";
+            folders.push({ id: `source:${source}:${ownerId}`, label: `${source.toUpperCase()} / ${ownerLabel}`, count: ownerCount });
+        }
     }
     return folders;
 }
@@ -123,6 +138,10 @@ function outboundRecord(record) {
     return {
         id: record.id,
         status: record.status,
+        mailboxRole: record.mailboxRole ?? "agent-native-mailbox",
+        sendAuthority: record.sendAuthority ?? "agent-native",
+        ownerEmail: record.ownerEmail ?? null,
+        source: record.source ?? null,
         from: record.from,
         to: record.to,
         cc: record.cc,
@@ -152,9 +171,22 @@ function accessEntries(entries) {
         threadId: entry.threadId ?? null,
         tool: entry.tool,
         reason: entry.reason,
+        mailboxRole: entry.mailboxRole ?? null,
+        compartmentKind: entry.compartmentKind ?? null,
+        ownerEmail: entry.ownerEmail ?? null,
+        source: entry.source ?? null,
         accessedAt: entry.accessedAt,
     }));
 }
+function accessProvenance(message) {
+    const provenance = (0, core_1.describeMailProvenance)(message);
+    return {
+        mailboxRole: provenance.mailboxRole,
+        compartmentKind: message.compartmentKind,
+        ownerEmail: provenance.ownerEmail,
+        source: provenance.source,
+    };
+}
 function emitMailRead(agentName, mode, status) {
     (0, runtime_1.emitNervesEvent)({
         component: "heart",
@@ -238,6 +270,7 @@ async function readMailMessageView(agentName, messageId) {
             messageId,
             tool: "outlook_mail_message",
             reason: "outlook read-only message body",
+            ...accessProvenance(decrypted),
         });
         const body = decrypted.private.text.length > OUTLOOK_MAIL_BODY_LIMIT
             ? decrypted.private.text.slice(0, OUTLOOK_MAIL_BODY_LIMIT)

package/dist/mailroom/attention.js

@@ -74,6 +74,14 @@ function displaySender(candidate) {
     }
     return candidate.senderEmail;
 }
+function candidateCompartmentKind(candidate) {
+    return candidate.ownerEmail || candidate.source ? "delegated" : "native";
+}
+function candidateMailboxRole(candidate) {
+    return candidateCompartmentKind(candidate) === "delegated"
+        ? "delegated-human-mailbox"
+        : "agent-native-mailbox";
+}
 function renderAttentionContent(candidate) {
     return [
         "[Mail Screener]",
@@ -92,6 +100,7 @@ function renderAttentionContent(candidate) {
     ].filter(Boolean).join("\n");
 }
 function queuedSummary(candidate, queuedAt) {
+    const compartmentKind = candidateCompartmentKind(candidate);
     return {
         candidateId: candidate.id,
         messageId: candidate.messageId,
@@ -99,6 +108,10 @@ function queuedSummary(candidate, queuedAt) {
         senderDisplay: candidate.senderDisplay,
         recipient: candidate.recipient,
         placement: candidate.placement,
+        mailboxRole: candidateMailboxRole(candidate),
+        compartmentKind,
+        ownerEmail: candidate.ownerEmail ?? null,
+        source: candidate.source ?? null,
         queuedAt,
     };
 }

package/dist/mailroom/core.js

@@ -42,6 +42,7 @@ exports.decryptMailPayload = decryptMailPayload;
 exports.encryptJsonForMailKey = encryptJsonForMailKey;
 exports.decryptMailJson = decryptMailJson;
 exports.resolveMailAddress = resolveMailAddress;
+exports.describeMailProvenance = describeMailProvenance;
 exports.buildStoredMailMessage = buildStoredMailMessage;
 exports.decryptStoredMailMessage = decryptStoredMailMessage;
 exports.provisionMailboxRegistry = provisionMailboxRegistry;
@@ -237,6 +238,32 @@ function resolveMailAddress(registry, address) {
         defaultPlacement: grant.defaultPlacement,
     };
 }
+function describeMailProvenance(message) {
+    if (message.compartmentKind === "delegated") {
+        const ownerEmail = message.ownerEmail ?? null;
+        const source = message.source ?? null;
+        const ownerLabel = ownerEmail ?? "unknown owner";
+        const sourceLabel = source ?? "unknown source";
+        return {
+            mailboxRole: "delegated-human-mailbox",
+            mailboxLabel: `${ownerLabel} / ${sourceLabel} delegated to ${message.agentId}`,
+            agentId: message.agentId,
+            ownerEmail,
+            source,
+            recipient: message.recipient,
+            sendAsHumanAllowed: false,
+        };
+    }
+    return {
+        mailboxRole: "agent-native-mailbox",
+        mailboxLabel: `${message.recipient} (native agent mail)`,
+        agentId: message.agentId,
+        ownerEmail: null,
+        source: null,
+        recipient: message.recipient,
+        sendAsHumanAllowed: false,
+    };
+}
 function addressList(values) {
     /* v8 ignore next -- parsedAddressList filters undefined top-level values; this guards malformed address-group entries. @preserve */
     return (values ?? [])

package/dist/mailroom/outbound.js

@@ -96,6 +96,10 @@ async function createMailDraft(input) {
         id: draftId(),
         agentId: input.agentId,
         status: "draft",
+        mailboxRole: "agent-native-mailbox",
+        sendAuthority: "agent-native",
+        ownerEmail: null,
+        source: null,
         from: (0, core_1.normalizeMailAddress)(input.from),
         to,
         cc: normalizeList(input.cc ?? []),

package/dist/nerves/coverage/file-completeness.js

@@ -63,7 +63,7 @@ const DISPATCH_EXEMPT_PATTERNS = [
     "daemon/cli-parse",
     "daemon/cli-render",
     "daemon/cli-help",
-    "daemon/porkbun-ops",
+    "daemon/vault-items",
     // Shared utility modules: pure helpers consumed by modules that own observability.
     "arc/json-store",
     "repertoire/api-client",

package/dist/repertoire/tools-credential.js

@@ -72,6 +72,11 @@ function optionalTrimmedText(value, fieldName) {
     const trimmed = value.trim();
     return trimmed.length > 0 ? trimmed : undefined;
 }
+function resolveVaultItemArg(args, legacyFieldName = "domain") {
+    if (args.item !== undefined)
+        return requireTrimmedText(args.item, "item");
+    return requireTrimmedText(args[legacyFieldName], legacyFieldName);
+}
 function parsePasswordLength(value) {
     if (value === undefined || value === null || value === "")
         return DEFAULT_PASSWORD_LENGTH;
@@ -127,13 +132,17 @@ exports.credentialToolDefinitions = [
             type: "function",
             function: {
                 name: "credential_get",
-                description: "Get credential metadata for a domain. Returns username, notes, and creation date. Never returns passwords — the credential gateway handles secret injection internally.",
+                description: "Get credential metadata for a vault item name/path. Returns username, notes, and creation date. Never returns passwords — the credential gateway handles secret injection internally.",
                 parameters: {
                     type: "object",
                     properties: {
+                        item: {
+                            type: "string",
+                            description: "Vault item name/path to look up (e.g. 'airbnb.com' or 'ops/porkbun/account')",
+                        },
                         domain: {
                             type: "string",
-                            description: "Domain to look up (e.g. 'airbnb.com', 'api.openweathermap.org')",
+                            description: "compatibility alias for item when the vault item name is a service domain",
                         },
                     },
                     required: ["domain"],
@@ -141,17 +150,18 @@ exports.credentialToolDefinitions = [
             },
         },
         handler: async (args) => {
+            const itemName = resolveVaultItemArg(args);
             (0, runtime_1.emitNervesEvent)({
                 component: "repertoire",
                 event: "repertoire.credential_tool_call",
                 message: "credential_get invoked",
-                meta: { tool: "credential_get", domain: args.domain },
+                meta: { tool: "credential_get", domain: itemName, item: itemName },
             });
             try {
                 const store = (0, credential_access_1.getCredentialStore)();
-                const meta = await store.get(args.domain);
+                const meta = await store.get(itemName);
                 if (!meta) {
-                    return `No credential found for "${args.domain}".`;
+                    return `No credential found for "${itemName}".`;
                 }
                 return JSON.stringify(meta, null, 2);
             }
@@ -220,13 +230,17 @@ exports.credentialToolDefinitions = [
             type: "function",
             function: {
                 name: "credential_store",
-                description: "Store credentials the agent acquired or just used successfully during signup. Prefer credential_generate_password for new passwords, then call this tool once the site accepts the exact password. Stored passwords are never returned later — only metadata is visible.",
+                description: "Store credentials in a vault item name/path after the agent acquired or just used them successfully. Prefer credential_generate_password for new passwords, then call this tool once the site accepts the exact password. Stored passwords are never returned later — only metadata is visible.",
                 parameters: {
                     type: "object",
                     properties: {
+                        item: {
+                            type: "string",
+                            description: "Vault item name/path to store under; domains are examples, not the schema",
+                        },
                         domain: {
                             type: "string",
-                            description: "Domain these credentials are for (e.g. 'airbnb.com')",
+                            description: "compatibility alias for item when the vault item name is a service domain",
                         },
                         username: {
                             type: "string",
@@ -238,7 +252,7 @@ exports.credentialToolDefinitions = [
                         },
                         notes: {
                             type: "string",
-                            description: "Optional notes about this credential",
+                            description: "Optional human/agent orientation notes about this credential; not parsed by code",
                         },
                     },
                     required: ["domain", "username", "password"],
@@ -250,14 +264,15 @@ exports.credentialToolDefinitions = [
             let username = "";
             let password = "";
             let notes;
+            const itemNameForEvent = typeof args.item === "string" && args.item.trim() ? args.item.trim() : args.domain;
             (0, runtime_1.emitNervesEvent)({
                 component: "repertoire",
                 event: "repertoire.credential_tool_call",
                 message: "credential_store invoked",
-                meta: { tool: "credential_store", domain: args.domain },
+                meta: { tool: "credential_store", domain: itemNameForEvent, item: itemNameForEvent },
             });
             try {
-                domain = requireTrimmedText(args.domain, "domain");
+                domain = resolveVaultItemArg(args);
                 username = requireTrimmedText(args.username, "username");
                 password = requireNonBlankSecret(args.password, "password");
                 notes = optionalTrimmedText(args.notes, "notes");
@@ -281,13 +296,13 @@ exports.credentialToolDefinitions = [
             type: "function",
             function: {
                 name: "credential_list",
-                description: "List stored credential domains. Returns metadata only (domain, username, notes, creation date). Never returns passwords.",
+                description: "List stored vault items. Returns metadata only (item/domain name, username, notes, creation date). Never returns passwords.",
                 parameters: {
                     type: "object",
                     properties: {
                         search: {
                             type: "string",
-                            description: "Optional search filter to match against domain names",
+                            description: "Optional search filter to match against vault item names/paths",
                         },
                     },
                 },
@@ -323,13 +338,17 @@ exports.credentialToolDefinitions = [
             type: "function",
             function: {
                 name: "credential_delete",
-                description: "Delete stored credentials for a domain.",
+                description: "Delete stored credentials for a vault item name/path.",
                 parameters: {
                     type: "object",
                     properties: {
+                        item: {
+                            type: "string",
+                            description: "Vault item name/path whose credentials should be deleted",
+                        },
                         domain: {
                             type: "string",
-                            description: "Domain whose credentials should be deleted",
+                            description: "compatibility alias for item when the vault item name is a service domain",
                         },
                     },
                     required: ["domain"],
@@ -344,12 +363,13 @@ exports.credentialToolDefinitions = [
                 meta: { tool: "credential_delete", domain: args.domain },
             });
             try {
+                const itemName = resolveVaultItemArg(args);
                 const store = (0, credential_access_1.getCredentialStore)();
-                const deleted = await store.delete(args.domain);
+                const deleted = await store.delete(itemName);
                 if (deleted) {
-                    return `Credentials for "${args.domain}" deleted.`;
+                    return `Credentials for "${itemName}" deleted.`;
                 }
-                return `No credential found for "${args.domain}".`;
+                return `No credential found for "${itemName}".`;
             }
             catch (err) {
                 /* v8 ignore next -- defensive: store.delete wraps errors @preserve */

package/dist/repertoire/tools-mail.js

@@ -125,10 +125,29 @@ function renderAccessLog(entries) {
         .reverse()
         .map((entry) => {
         const target = entry.messageId ? `message=${entry.messageId}` : entry.threadId ? `thread=${entry.threadId}` : "mailbox";
-        return `- ${entry.accessedAt} ${entry.tool} ${target} reason="${entry.reason}"`;
+        const provenance = renderAccessLogProvenance(entry);
+        return `- ${entry.accessedAt} ${entry.tool} ${target}${provenance} reason="${entry.reason}"`;
     })
         .join("\n");
 }
+function renderAccessLogProvenance(entry) {
+    if (entry.mailboxRole === "delegated-human-mailbox") {
+        return ` delegated human mailbox: ${entry.ownerEmail ?? "unknown owner"} / ${entry.source ?? "unknown source"}`;
+    }
+    if (entry.mailboxRole === "agent-native-mailbox") {
+        return " native agent mailbox";
+    }
+    return "";
+}
+function accessProvenance(message) {
+    const provenance = (0, core_1.describeMailProvenance)(message);
+    return {
+        mailboxRole: provenance.mailboxRole,
+        compartmentKind: message.compartmentKind,
+        ownerEmail: provenance.ownerEmail,
+        source: provenance.source,
+    };
+}
 function renderSourceGrantStatus(config, agentId) {
     if (!config.registryPath) {
         return [
@@ -597,6 +616,7 @@ exports.mailToolDefinitions = [
                 messageId,
                 tool: "mail_thread",
                 reason: args.reason,
+                ...accessProvenance(message),
             });
             const maxChars = numberArg(args.max_chars, 2000, 200, 6000);
             const body = decrypted.private.text.length > maxChars
@@ -717,6 +737,7 @@ exports.mailToolDefinitions = [
                 messageId,
                 tool: "mail_decide",
                 reason,
+                ...accessProvenance(message),
             });
             const senderPolicyLine = persistSenderPolicyForDecision({
                 registryPath: resolved.config.registryPath,

package/dist/senses/mail.js

@@ -113,22 +113,28 @@ async function startMailSenseApp(options) {
     if (!resolved.ok) {
         throw new Error(resolved.error);
     }
-    if (!resolved.config.registryPath) {
+    const hostedReaderOnly = resolved.storeKind === "azure-blob" && !resolved.config.registryPath;
+    if (!resolved.config.registryPath && !hostedReaderOnly) {
         throw new Error(`missing mailroom.registryPath for ${options.agentName}; agent-runnable repair: 'ouro connect mail --agent ${options.agentName}'`);
     }
-    const registry = readRegistry(resolved.config.registryPath);
     const host = resolved.config.host ?? "127.0.0.1";
-    const ingress = (options.startIngress ?? smtp_ingress_1.startMailroomIngress)({
-        registry,
-        store: resolved.store,
-        smtpPort: validPort(resolved.config.smtpPort),
-        httpPort: validPort(resolved.config.httpPort),
-        host,
-    });
-    await Promise.all([
-        waitForListening(ingress.smtp),
-        waitForListening(ingress.health),
-    ]);
+    const ingress = hostedReaderOnly
+        ? null
+        : (options.startIngress ?? smtp_ingress_1.startMailroomIngress)({
+            registry: readRegistry(resolved.config.registryPath),
+            store: resolved.store,
+            smtpPort: validPort(resolved.config.smtpPort),
+            httpPort: validPort(resolved.config.httpPort),
+            host,
+        });
+    if (ingress) {
+        await Promise.all([
+            waitForListening(ingress.smtp),
+            waitForListening(ingress.health),
+        ]);
+    }
+    const activeSmtpPort = () => ingress ? serverPort(ingress.smtp) : null;
+    const activeHttpPort = () => ingress ? serverPort(ingress.health) : null;
     const runtimePath = runtimeStatePath(options.agentName);
     const attentionPath = attentionStatePath(options.agentName);
     let lastScanAt = null;
@@ -150,8 +156,8 @@ async function startMailSenseApp(options) {
                 agentName: options.agentName,
                 status: "running",
                 mailboxAddress: resolved.config.mailboxAddress,
-                smtpPort: serverPort(ingress.smtp),
-                httpPort: serverPort(ingress.health),
+                smtpPort: activeSmtpPort(),
+                httpPort: activeHttpPort(),
                 host,
                 storeKind: resolved.storeKind,
                 storeLabel: resolved.storeLabel,
@@ -182,30 +188,32 @@ async function startMailSenseApp(options) {
         meta: {
             agentName: options.agentName,
             mailboxAddress: resolved.config.mailboxAddress,
-            smtpPort: serverPort(ingress.smtp),
-            httpPort: serverPort(ingress.health),
+            smtpPort: activeSmtpPort(),
+            httpPort: activeHttpPort(),
             intervalMs,
         },
     });
     return {
         runtimeStatePath: runtimePath,
         attentionStatePath: attentionPath,
-        smtpPort: serverPort(ingress.smtp),
-        httpPort: serverPort(ingress.health),
+        smtpPort: activeSmtpPort(),
+        httpPort: activeHttpPort(),
         async stop() {
             ;
             (options.clearIntervalFn ?? ((activeTimer) => clearInterval(activeTimer)))(timer);
-            await Promise.all([
-                closeServer(ingress.smtp),
-                closeServer(ingress.health),
-            ]);
+            if (ingress) {
+                await Promise.all([
+                    closeServer(ingress.smtp),
+                    closeServer(ingress.health),
+                ]);
+            }
             writeRuntimeState(runtimePath, {
                 schemaVersion: 1,
                 agentName: options.agentName,
                 status: "stopped",
                 mailboxAddress: resolved.config.mailboxAddress,
-                smtpPort: serverPort(ingress.smtp),
-                httpPort: serverPort(ingress.health),
+                smtpPort: activeSmtpPort(),
+                httpPort: activeHttpPort(),
                 host,
                 storeKind: resolved.storeKind,
                 storeLabel: resolved.storeLabel,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ouro.bot/cli",
-  "version": "0.1.0-alpha.465",
+  "version": "0.1.0-alpha.467",
   "main": "dist/heart/daemon/ouro-entry.js",
   "bin": {
     "cli": "dist/heart/daemon/ouro-bot-entry.js",

package/dist/heart/daemon/porkbun-ops.js

@@ -1,25 +0,0 @@
-"use strict";
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.PORKBUN_OPS_CREDENTIAL_PREFIX = exports.PORKBUN_OPS_CREDENTIAL_KIND = void 0;
-exports.normalizePorkbunOpsAccount = normalizePorkbunOpsAccount;
-exports.porkbunOpsCredentialItemName = porkbunOpsCredentialItemName;
-exports.requirePorkbunOpsSecret = requirePorkbunOpsSecret;
-exports.PORKBUN_OPS_CREDENTIAL_KIND = "ops-credential/porkbun";
-exports.PORKBUN_OPS_CREDENTIAL_PREFIX = "ops/registrars/porkbun/accounts";
-const PORKBUN_OPS_ACCOUNT_FORBIDDEN = /[\/\r\n\t]/;
-function normalizePorkbunOpsAccount(account) {
-    const normalized = account?.trim() ?? "";
-    if (!normalized || PORKBUN_OPS_ACCOUNT_FORBIDDEN.test(normalized)) {
-        throw new Error("Porkbun account must be a non-empty account label without slashes or control characters.");
-    }
-    return normalized;
-}
-function porkbunOpsCredentialItemName(account) {
-    return `${exports.PORKBUN_OPS_CREDENTIAL_PREFIX}/${normalizePorkbunOpsAccount(account)}`;
-}
-function requirePorkbunOpsSecret(value, label) {
-    const trimmed = value.trim();
-    if (!trimmed)
-        throw new Error(`${label} cannot be blank`);
-    return trimmed;
-}