@pixelzx/genesis 2026.5.5-1 → 2026.5.5-2

package/dist/runtime-web-tools-BizCqA0v.js

@@ -0,0 +1,1477 @@
+import { a as normalizeLowercaseStringOrEmpty, s as normalizeOptionalLowercaseString } from "./string-coerce-C1IzJjqi.js";
+import { l as isRecord } from "./utils-DaGfogP-.js";
+import { p as resolveSecretInputRef } from "./types.secrets-ews2W8BF.js";
+import { t as createGatewayCredentialPlan } from "./credential-planner-Bf6MFQ6Y.js";
+import { u as secretRefKey } from "./ref-contract-GkHI8jyU.js";
+import "./shared-DqD6V-gu.js";
+import { o as resolveSecretRefValues } from "./resolve-DeAojonS.js";
+import { n as getBootstrapChannelSecrets } from "./bootstrap-registry-SI4Dal73.js";
+import { l as resolveEnableState, o as normalizePluginsConfig } from "./config-state-C9Af4Gv_.js";
+import { b as resolveAgentWorkspaceDir, x as resolveDefaultAgentId } from "./agent-scope-CDjZLqNk.js";
+import { t as loadBundledChannelSecretContractApi } from "./channel-contract-api-DQ_37geL.js";
+import { n as resolvePluginConfigContractsById, t as collectPluginConfigContractMatches } from "./config-contracts-oGLZWnG-.js";
+import { n as normalizeSecretInput } from "./normalize-secret-input-CNeH9Ebc.js";
+import { i as resolveBundledExplicitWebSearchProvidersFromPublicArtifacts, r as resolveBundledExplicitWebFetchProvidersFromPublicArtifacts } from "./web-provider-public-artifacts.explicit-DSdz_m4K.js";
+import { a as createLazyRuntimeSurface, i as createLazyRuntimeNamedExport } from "./lazy-runtime-02MY_g6C.js";
+import { n as resolvePluginCapabilityProviders } from "./capability-provider-runtime-CbDYH0sM.js";
+import { i as normalizeMediaProviderId, n as resolveEffectiveMediaEntryCapabilities, r as resolveImageCapableConfigProviderIds, t as resolveConfiguredMediaEntryCapabilities } from "./entry-capabilities-BXBmag_1.js";
+import { c as pushInactiveSurfaceWarning, l as pushWarning, n as collectSecretInputAssignment } from "./runtime-shared-BsGf2M6x.js";
+import { t as collectTtsApiKeyAssignments } from "./runtime-config-collectors-tts-036qaPgs.js";
+import { o as sortWebFetchProvidersForAutoDetect, r as sortWebSearchProvidersForAutoDetect } from "./web-search-providers.shared-CjslHciM.js";
+//#region src/secrets/runtime-config-collectors-channels.ts
+function collectChannelConfigAssignments(params) {
+	const channelIds = Object.keys(params.config.channels ?? {});
+	if (channelIds.length === 0) return;
+	for (const channelId of channelIds) (loadBundledChannelSecretContractApi(channelId)?.collectRuntimeConfigAssignments ?? getBootstrapChannelSecrets(channelId)?.collectRuntimeConfigAssignments)?.(params);
+}
+//#endregion
+//#region src/media-understanding/provider-capability-registry.ts
+function mergeProviderCapabilities(registry, provider) {
+	const normalizedKey = normalizeMediaProviderId(provider.id);
+	const existing = registry.get(normalizedKey);
+	registry.set(normalizedKey, { capabilities: provider.capabilities ?? existing?.capabilities });
+}
+function buildMediaUnderstandingCapabilityRegistry(cfg) {
+	const registry = /* @__PURE__ */ new Map();
+	for (const provider of resolvePluginCapabilityProviders({
+		key: "mediaUnderstandingProviders",
+		cfg
+	})) mergeProviderCapabilities(registry, provider);
+	for (const normalizedKey of resolveImageCapableConfigProviderIds(cfg)) if (!registry.has(normalizedKey)) mergeProviderCapabilities(registry, {
+		id: normalizedKey,
+		capabilities: ["image"]
+	});
+	return registry;
+}
+//#endregion
+//#region src/secrets/runtime-gateway-auth-surfaces.ts
+const GATEWAY_AUTH_SURFACE_PATHS = [
+	"gateway.auth.token",
+	"gateway.auth.password",
+	"gateway.remote.token",
+	"gateway.remote.password"
+];
+function formatAuthMode(mode) {
+	return mode ?? "unset";
+}
+function describeRemoteConfiguredSurface(parts) {
+	const reasons = [];
+	if (parts.remoteMode) reasons.push("gateway.mode is \"remote\"");
+	if (parts.remoteUrlConfigured) reasons.push("gateway.remote.url is configured");
+	if (parts.tailscaleRemoteExposure) reasons.push("gateway.tailscale.mode is \"serve\" or \"funnel\"");
+	return reasons.join("; ");
+}
+function createState(params) {
+	return {
+		path: params.path,
+		active: params.active,
+		reason: params.reason,
+		hasSecretRef: params.hasSecretRef
+	};
+}
+function evaluateGatewayAuthSurfaceStates(params) {
+	const gateway = params.config.gateway;
+	if (!isRecord(gateway)) return {
+		"gateway.auth.token": createState({
+			path: "gateway.auth.token",
+			active: false,
+			reason: "gateway configuration is not set.",
+			hasSecretRef: false
+		}),
+		"gateway.auth.password": createState({
+			path: "gateway.auth.password",
+			active: false,
+			reason: "gateway configuration is not set.",
+			hasSecretRef: false
+		}),
+		"gateway.remote.token": createState({
+			path: "gateway.remote.token",
+			active: false,
+			reason: "gateway configuration is not set.",
+			hasSecretRef: false
+		}),
+		"gateway.remote.password": createState({
+			path: "gateway.remote.password",
+			active: false,
+			reason: "gateway configuration is not set.",
+			hasSecretRef: false
+		})
+	};
+	const auth = isRecord(gateway?.auth) ? gateway.auth : void 0;
+	const remote = isRecord(gateway?.remote) ? gateway.remote : void 0;
+	const plan = createGatewayCredentialPlan({
+		config: params.config,
+		env: params.env,
+		defaults: params.defaults
+	});
+	const authPasswordReason = (() => {
+		if (!auth) return "gateway.auth is not configured.";
+		if (plan.passwordCanWin) return plan.authMode === "password" ? "gateway.auth.mode is \"password\"." : "no token source can win, so password auth can win.";
+		if (plan.authMode === "token" || plan.authMode === "none" || plan.authMode === "trusted-proxy") return `gateway.auth.mode is "${plan.authMode}".`;
+		if (plan.envToken) return "gateway token env var is configured.";
+		if (plan.localToken.configured) return "gateway.auth.token is configured.";
+		if (plan.remoteToken.configured) return "gateway.remote.token is configured.";
+		return "token auth can win.";
+	})();
+	const authTokenReason = (() => {
+		if (!auth) return "gateway.auth is not configured.";
+		if (plan.authMode === "token") return plan.envToken ? "gateway token env var is configured." : "gateway.auth.mode is \"token\".";
+		if (plan.authMode === "password" || plan.authMode === "none" || plan.authMode === "trusted-proxy") return `gateway.auth.mode is "${plan.authMode}".`;
+		if (plan.envToken) return "gateway token env var is configured.";
+		if (plan.envPassword) return "gateway password env var is configured.";
+		if (plan.localPassword.configured) return "gateway.auth.password is configured.";
+		return "token auth can win (mode is unset and no password source is configured).";
+	})();
+	const remoteSurfaceReason = describeRemoteConfiguredSurface({
+		remoteMode: plan.remoteMode,
+		remoteUrlConfigured: plan.remoteUrlConfigured,
+		tailscaleRemoteExposure: plan.tailscaleRemoteExposure
+	});
+	const remoteTokenReason = (() => {
+		if (!remote) return "gateway.remote is not configured.";
+		if (plan.remoteConfiguredSurface) return `remote surface is active: ${remoteSurfaceReason}.`;
+		if (plan.remoteTokenFallbackActive) return "local token auth can win and no env/auth token is configured.";
+		if (!plan.localTokenCanWin) return `token auth cannot win with gateway.auth.mode="${formatAuthMode(plan.authMode)}".`;
+		if (plan.envToken) return "gateway token env var is configured.";
+		if (plan.localToken.configured) return "gateway.auth.token is configured.";
+		return "remote token fallback is not active.";
+	})();
+	const remotePasswordReason = (() => {
+		if (!remote) return "gateway.remote is not configured.";
+		if (plan.remoteConfiguredSurface) return `remote surface is active: ${remoteSurfaceReason}.`;
+		if (plan.remotePasswordFallbackActive) return "password auth can win and no env/auth password is configured.";
+		if (!plan.passwordCanWin) {
+			if (plan.authMode === "token" || plan.authMode === "none" || plan.authMode === "trusted-proxy") return `password auth cannot win with gateway.auth.mode="${plan.authMode}".`;
+			return "a token source can win, so password auth cannot win.";
+		}
+		if (plan.envPassword) return "gateway password env var is configured.";
+		if (plan.localPassword.configured) return "gateway.auth.password is configured.";
+		return "remote password fallback is not active.";
+	})();
+	return {
+		"gateway.auth.token": createState({
+			path: "gateway.auth.token",
+			active: plan.localTokenSurfaceActive,
+			reason: authTokenReason,
+			hasSecretRef: plan.localToken.hasSecretRef
+		}),
+		"gateway.auth.password": createState({
+			path: "gateway.auth.password",
+			active: plan.passwordCanWin,
+			reason: authPasswordReason,
+			hasSecretRef: plan.localPassword.hasSecretRef
+		}),
+		"gateway.remote.token": createState({
+			path: "gateway.remote.token",
+			active: plan.remoteTokenActive,
+			reason: remoteTokenReason,
+			hasSecretRef: plan.remoteToken.hasSecretRef
+		}),
+		"gateway.remote.password": createState({
+			path: "gateway.remote.password",
+			active: plan.remotePasswordActive,
+			reason: remotePasswordReason,
+			hasSecretRef: plan.remotePassword.hasSecretRef
+		})
+	};
+}
+//#endregion
+//#region src/secrets/runtime-config-collectors-core.ts
+function collectModelProviderAssignments(params) {
+	for (const [providerId, provider] of Object.entries(params.providers)) {
+		const providerIsActive = provider.enabled !== false;
+		collectSecretInputAssignment({
+			value: provider.apiKey,
+			path: `models.providers.${providerId}.apiKey`,
+			expected: "string",
+			defaults: params.defaults,
+			context: params.context,
+			active: providerIsActive,
+			inactiveReason: "provider is disabled.",
+			apply: (value) => {
+				provider.apiKey = value;
+			}
+		});
+		const headers = isRecord(provider.headers) ? provider.headers : void 0;
+		if (headers) for (const [headerKey, headerValue] of Object.entries(headers)) collectSecretInputAssignment({
+			value: headerValue,
+			path: `models.providers.${providerId}.headers.${headerKey}`,
+			expected: "string",
+			defaults: params.defaults,
+			context: params.context,
+			active: providerIsActive,
+			inactiveReason: "provider is disabled.",
+			apply: (value) => {
+				headers[headerKey] = value;
+			}
+		});
+		const request = isRecord(provider.request) ? provider.request : void 0;
+		if (request) collectProviderRequestAssignments({
+			request,
+			pathPrefix: `models.providers.${providerId}.request`,
+			defaults: params.defaults,
+			context: params.context,
+			active: providerIsActive,
+			inactiveReason: "provider is disabled.",
+			collectTransportSecrets: true
+		});
+	}
+}
+function collectSkillAssignments(params) {
+	for (const [skillKey, entry] of Object.entries(params.entries)) collectSecretInputAssignment({
+		value: entry.apiKey,
+		path: `skills.entries.${skillKey}.apiKey`,
+		expected: "string",
+		defaults: params.defaults,
+		context: params.context,
+		active: entry.enabled !== false,
+		inactiveReason: "skill entry is disabled.",
+		apply: (value) => {
+			entry.apiKey = value;
+		}
+	});
+}
+function collectAgentMemorySearchAssignments(params) {
+	const agents = params.config.agents;
+	if (!isRecord(agents)) return;
+	const defaultsConfig = isRecord(agents.defaults) ? agents.defaults : void 0;
+	const defaultsMemorySearch = isRecord(defaultsConfig?.memorySearch) ? defaultsConfig.memorySearch : void 0;
+	const defaultsEnabled = defaultsMemorySearch?.enabled !== false;
+	const list = Array.isArray(agents.list) ? agents.list : [];
+	let hasEnabledAgentWithoutOverride = false;
+	for (const rawAgent of list) {
+		if (!isRecord(rawAgent)) continue;
+		if (rawAgent.enabled === false) continue;
+		const memorySearch = isRecord(rawAgent.memorySearch) ? rawAgent.memorySearch : void 0;
+		if (memorySearch?.enabled === false) continue;
+		if (!memorySearch || !Object.prototype.hasOwnProperty.call(memorySearch, "remote")) {
+			hasEnabledAgentWithoutOverride = true;
+			continue;
+		}
+		const remote = isRecord(memorySearch.remote) ? memorySearch.remote : void 0;
+		if (!remote || !Object.prototype.hasOwnProperty.call(remote, "apiKey")) {
+			hasEnabledAgentWithoutOverride = true;
+			continue;
+		}
+	}
+	if (defaultsMemorySearch && isRecord(defaultsMemorySearch.remote)) {
+		const remote = defaultsMemorySearch.remote;
+		collectSecretInputAssignment({
+			value: remote.apiKey,
+			path: "agents.defaults.memorySearch.remote.apiKey",
+			expected: "string",
+			defaults: params.defaults,
+			context: params.context,
+			active: defaultsEnabled && (hasEnabledAgentWithoutOverride || list.length === 0),
+			inactiveReason: hasEnabledAgentWithoutOverride ? void 0 : "all enabled agents override memorySearch.remote.apiKey.",
+			apply: (value) => {
+				remote.apiKey = value;
+			}
+		});
+	}
+	list.forEach((rawAgent, index) => {
+		if (!isRecord(rawAgent)) return;
+		const memorySearch = isRecord(rawAgent.memorySearch) ? rawAgent.memorySearch : void 0;
+		if (!memorySearch) return;
+		const remote = isRecord(memorySearch.remote) ? memorySearch.remote : void 0;
+		if (!remote || !Object.prototype.hasOwnProperty.call(remote, "apiKey")) return;
+		const enabled = rawAgent.enabled !== false && memorySearch.enabled !== false;
+		collectSecretInputAssignment({
+			value: remote.apiKey,
+			path: `agents.list.${index}.memorySearch.remote.apiKey`,
+			expected: "string",
+			defaults: params.defaults,
+			context: params.context,
+			active: enabled,
+			inactiveReason: "agent or memorySearch override is disabled.",
+			apply: (value) => {
+				remote.apiKey = value;
+			}
+		});
+	});
+}
+function collectTalkAssignments(params) {
+	const talk = params.config.talk;
+	if (!isRecord(talk)) return;
+	collectSecretInputAssignment({
+		value: talk.apiKey,
+		path: "talk.apiKey",
+		expected: "string",
+		defaults: params.defaults,
+		context: params.context,
+		apply: (value) => {
+			talk.apiKey = value;
+		}
+	});
+	const providers = talk.providers;
+	if (!isRecord(providers)) return;
+	for (const [providerId, providerConfig] of Object.entries(providers)) {
+		if (!isRecord(providerConfig)) continue;
+		collectSecretInputAssignment({
+			value: providerConfig.apiKey,
+			path: `talk.providers.${providerId}.apiKey`,
+			expected: "string",
+			defaults: params.defaults,
+			context: params.context,
+			apply: (value) => {
+				providerConfig.apiKey = value;
+			}
+		});
+	}
+}
+function collectGatewayAssignments(params) {
+	const gateway = params.config.gateway;
+	if (!isRecord(gateway)) return;
+	const auth = isRecord(gateway.auth) ? gateway.auth : void 0;
+	const remote = isRecord(gateway.remote) ? gateway.remote : void 0;
+	const gatewaySurfaceStates = evaluateGatewayAuthSurfaceStates({
+		config: params.config,
+		env: params.context.env,
+		defaults: params.defaults
+	});
+	if (auth) {
+		collectSecretInputAssignment({
+			value: auth.token,
+			path: "gateway.auth.token",
+			expected: "string",
+			defaults: params.defaults,
+			context: params.context,
+			active: gatewaySurfaceStates["gateway.auth.token"].active,
+			inactiveReason: gatewaySurfaceStates["gateway.auth.token"].reason,
+			apply: (value) => {
+				auth.token = value;
+			}
+		});
+		collectSecretInputAssignment({
+			value: auth.password,
+			path: "gateway.auth.password",
+			expected: "string",
+			defaults: params.defaults,
+			context: params.context,
+			active: gatewaySurfaceStates["gateway.auth.password"].active,
+			inactiveReason: gatewaySurfaceStates["gateway.auth.password"].reason,
+			apply: (value) => {
+				auth.password = value;
+			}
+		});
+	}
+	if (remote) {
+		collectSecretInputAssignment({
+			value: remote.token,
+			path: "gateway.remote.token",
+			expected: "string",
+			defaults: params.defaults,
+			context: params.context,
+			active: gatewaySurfaceStates["gateway.remote.token"].active,
+			inactiveReason: gatewaySurfaceStates["gateway.remote.token"].reason,
+			apply: (value) => {
+				remote.token = value;
+			}
+		});
+		collectSecretInputAssignment({
+			value: remote.password,
+			path: "gateway.remote.password",
+			expected: "string",
+			defaults: params.defaults,
+			context: params.context,
+			active: gatewaySurfaceStates["gateway.remote.password"].active,
+			inactiveReason: gatewaySurfaceStates["gateway.remote.password"].reason,
+			apply: (value) => {
+				remote.password = value;
+			}
+		});
+	}
+}
+function collectProviderRequestAssignments(params) {
+	const headers = isRecord(params.request.headers) ? params.request.headers : void 0;
+	if (headers) for (const [headerKey, headerValue] of Object.entries(headers)) collectSecretInputAssignment({
+		value: headerValue,
+		path: `${params.pathPrefix}.headers.${headerKey}`,
+		expected: "string",
+		defaults: params.defaults,
+		context: params.context,
+		active: params.active,
+		inactiveReason: params.inactiveReason,
+		apply: (value) => {
+			headers[headerKey] = value;
+		}
+	});
+	const auth = isRecord(params.request.auth) ? params.request.auth : void 0;
+	if (auth) {
+		collectSecretInputAssignment({
+			value: auth.token,
+			path: `${params.pathPrefix}.auth.token`,
+			expected: "string",
+			defaults: params.defaults,
+			context: params.context,
+			active: params.active,
+			inactiveReason: params.inactiveReason,
+			apply: (value) => {
+				auth.token = value;
+			}
+		});
+		collectSecretInputAssignment({
+			value: auth.value,
+			path: `${params.pathPrefix}.auth.value`,
+			expected: "string",
+			defaults: params.defaults,
+			context: params.context,
+			active: params.active,
+			inactiveReason: params.inactiveReason,
+			apply: (value) => {
+				auth.value = value;
+			}
+		});
+	}
+	const collectTlsAssignments = (tls, pathPrefix) => {
+		if (!tls) return;
+		for (const key of [
+			"ca",
+			"cert",
+			"key",
+			"passphrase"
+		]) collectSecretInputAssignment({
+			value: tls[key],
+			path: `${pathPrefix}.${key}`,
+			expected: "string",
+			defaults: params.defaults,
+			context: params.context,
+			active: params.active,
+			inactiveReason: params.inactiveReason,
+			apply: (value) => {
+				tls[key] = value;
+			}
+		});
+	};
+	if (params.collectTransportSecrets !== false) {
+		collectTlsAssignments(isRecord(params.request.tls) ? params.request.tls : void 0, `${params.pathPrefix}.tls`);
+		const proxy = isRecord(params.request.proxy) ? params.request.proxy : void 0;
+		collectTlsAssignments(isRecord(proxy?.tls) ? proxy.tls : void 0, `${params.pathPrefix}.proxy.tls`);
+	}
+}
+function collectMediaRequestAssignments(params) {
+	const tools = isRecord(params.config.tools) ? params.config.tools : void 0;
+	const media = isRecord(tools?.media) ? tools.media : void 0;
+	if (!media) return;
+	let providerRegistry;
+	const getProviderRegistry = () => {
+		providerRegistry ??= buildMediaUnderstandingCapabilityRegistry(params.config);
+		return providerRegistry;
+	};
+	const capabilityKeys = [
+		"audio",
+		"image",
+		"video"
+	];
+	const isCapabilityEnabled = (capability) => (isRecord(media[capability]) ? media[capability] : void 0)?.enabled !== false;
+	const collectModelAssignments = (models, pathPrefix, resolveActivity) => {
+		if (!Array.isArray(models)) return;
+		models.forEach((rawModel, index) => {
+			if (!isRecord(rawModel) || !isRecord(rawModel.request)) return;
+			const { active, inactiveReason } = resolveActivity(rawModel);
+			collectProviderRequestAssignments({
+				request: rawModel.request,
+				pathPrefix: `${pathPrefix}.${index}.request`,
+				defaults: params.defaults,
+				context: params.context,
+				active,
+				inactiveReason
+			});
+		});
+	};
+	collectModelAssignments(media.models, "tools.media.models", (rawModel) => {
+		const entry = rawModel;
+		const capabilities = resolveConfiguredMediaEntryCapabilities(entry) ?? resolveEffectiveMediaEntryCapabilities({
+			entry,
+			source: "shared",
+			providerRegistry: getProviderRegistry()
+		});
+		if (!capabilities || capabilities.length === 0) return {
+			active: false,
+			inactiveReason: "shared media model does not declare capabilities and none could be inferred from its provider."
+		};
+		return {
+			active: capabilities.some((capability) => isCapabilityEnabled(capability)),
+			inactiveReason: `all configured media capabilities for this shared model are disabled: ${capabilities.join(", ")}.`
+		};
+	});
+	for (const capability of capabilityKeys) {
+		const section = isRecord(media[capability]) ? media[capability] : void 0;
+		const active = isCapabilityEnabled(capability);
+		const inactiveReason = `${capability} media understanding is disabled.`;
+		if (section && isRecord(section.request)) collectProviderRequestAssignments({
+			request: section.request,
+			pathPrefix: `tools.media.${capability}.request`,
+			defaults: params.defaults,
+			context: params.context,
+			active,
+			inactiveReason
+		});
+		collectModelAssignments(section?.models, `tools.media.${capability}.models`, (rawModel) => ({
+			active: active && (() => {
+				const configuredCapabilities = resolveConfiguredMediaEntryCapabilities(rawModel);
+				return configuredCapabilities ? configuredCapabilities.includes(capability) : true;
+			})(),
+			inactiveReason: active ? `${capability} media model is filtered out by its configured capabilities.` : inactiveReason
+		}));
+	}
+}
+function collectMessagesTtsAssignments(params) {
+	const messages = params.config.messages;
+	if (!isRecord(messages) || !isRecord(messages.tts)) return;
+	collectTtsApiKeyAssignments({
+		tts: messages.tts,
+		pathPrefix: "messages.tts",
+		defaults: params.defaults,
+		context: params.context
+	});
+}
+function collectCronAssignments(params) {
+	const cron = params.config.cron;
+	if (!isRecord(cron)) return;
+	collectSecretInputAssignment({
+		value: cron.webhookToken,
+		path: "cron.webhookToken",
+		expected: "string",
+		defaults: params.defaults,
+		context: params.context,
+		apply: (value) => {
+			cron.webhookToken = value;
+		}
+	});
+}
+function collectSandboxSshAssignments(params) {
+	const agents = isRecord(params.config.agents) ? params.config.agents : void 0;
+	if (!agents) return;
+	const defaultsAgent = isRecord(agents.defaults) ? agents.defaults : void 0;
+	const defaultsSandbox = isRecord(defaultsAgent?.sandbox) ? defaultsAgent.sandbox : void 0;
+	const defaultsSsh = isRecord(defaultsSandbox?.ssh) ? defaultsSandbox.ssh : void 0;
+	const defaultsBackend = typeof defaultsSandbox?.backend === "string" ? defaultsSandbox.backend : void 0;
+	const defaultsMode = typeof defaultsSandbox?.mode === "string" ? defaultsSandbox.mode : void 0;
+	const inheritedDefaultsUsage = {
+		identityData: false,
+		certificateData: false,
+		knownHostsData: false
+	};
+	(Array.isArray(agents.list) ? agents.list : []).forEach((rawAgent, index) => {
+		const agentRecord = isRecord(rawAgent) ? rawAgent : null;
+		if (!agentRecord || agentRecord.enabled === false) return;
+		const sandbox = isRecord(agentRecord.sandbox) ? agentRecord.sandbox : void 0;
+		const ssh = isRecord(sandbox?.ssh) ? sandbox.ssh : void 0;
+		const effectiveBackend = (typeof sandbox?.backend === "string" ? sandbox.backend : void 0) ?? defaultsBackend ?? "docker";
+		const effectiveMode = (typeof sandbox?.mode === "string" ? sandbox.mode : void 0) ?? defaultsMode ?? "off";
+		const active = normalizeOptionalLowercaseString(effectiveBackend) === "ssh" && effectiveMode !== "off";
+		for (const key of [
+			"identityData",
+			"certificateData",
+			"knownHostsData"
+		]) if (ssh && Object.prototype.hasOwnProperty.call(ssh, key)) collectSecretInputAssignment({
+			value: ssh[key],
+			path: `agents.list.${index}.sandbox.ssh.${key}`,
+			expected: "string",
+			defaults: params.defaults,
+			context: params.context,
+			active,
+			inactiveReason: "sandbox SSH backend is not active for this agent.",
+			apply: (value) => {
+				ssh[key] = value;
+			}
+		});
+		else if (active) inheritedDefaultsUsage[key] = true;
+	});
+	if (!defaultsSsh) return;
+	const defaultsActive = normalizeOptionalLowercaseString(defaultsBackend) === "ssh" && defaultsMode !== "off" || inheritedDefaultsUsage.identityData || inheritedDefaultsUsage.certificateData || inheritedDefaultsUsage.knownHostsData;
+	for (const key of [
+		"identityData",
+		"certificateData",
+		"knownHostsData"
+	]) collectSecretInputAssignment({
+		value: defaultsSsh[key],
+		path: `agents.defaults.sandbox.ssh.${key}`,
+		expected: "string",
+		defaults: params.defaults,
+		context: params.context,
+		active: defaultsActive || inheritedDefaultsUsage[key],
+		inactiveReason: "sandbox SSH backend is not active.",
+		apply: (value) => {
+			defaultsSsh[key] = value;
+		}
+	});
+}
+function collectCoreConfigAssignments(params) {
+	const providers = params.config.models?.providers;
+	if (providers) collectModelProviderAssignments({
+		providers,
+		defaults: params.defaults,
+		context: params.context
+	});
+	const skillEntries = params.config.skills?.entries;
+	if (skillEntries) collectSkillAssignments({
+		entries: skillEntries,
+		defaults: params.defaults,
+		context: params.context
+	});
+	collectAgentMemorySearchAssignments(params);
+	collectTalkAssignments(params);
+	collectGatewayAssignments(params);
+	collectSandboxSshAssignments(params);
+	collectMessagesTtsAssignments(params);
+	collectCronAssignments(params);
+	collectMediaRequestAssignments(params);
+}
+//#endregion
+//#region src/secrets/runtime-config-collectors-plugins.ts
+/**
+* Walk manifest-declared plugin config SecretRef surfaces and collect
+* assignments for runtime materialization. Plugin-owned metadata controls which
+* config paths support SecretRefs and whether bundled plugins stay inactive on
+* that surface until explicitly enabled.
+*
+* When `loadablePluginOrigins` is provided, entries whose ID is not in the map
+* are treated as inactive (stale config entries for plugins that are no longer
+* installed). This prevents resolution failures for SecretRefs belonging to
+* non-loadable plugins from blocking startup or preflight validation.
+*/
+function collectPluginConfigAssignments(params) {
+	const entries = params.config.plugins?.entries;
+	if (!isRecord(entries)) return;
+	const normalizedConfig = normalizePluginsConfig(params.config.plugins);
+	const workspaceDir = resolveAgentWorkspaceDir(params.config, resolveDefaultAgentId(params.config));
+	const pluginSecretInputs = new Map([...resolvePluginConfigContractsById({
+		config: params.config,
+		workspaceDir,
+		env: params.context.env,
+		cache: true,
+		fallbackToBundledMetadata: false,
+		pluginIds: Object.keys(entries)
+	}).entries()].flatMap(([pluginId, metadata]) => {
+		const secretInputs = metadata.configContracts.secretInputs;
+		if (!secretInputs?.paths.length) return [];
+		return [[pluginId, {
+			origin: metadata.origin,
+			bundledDefaultEnabled: secretInputs.bundledDefaultEnabled,
+			paths: secretInputs.paths
+		}]];
+	}));
+	for (const [pluginId, entry] of Object.entries(entries)) {
+		const secretInputs = pluginSecretInputs.get(pluginId);
+		if (!secretInputs) continue;
+		if (!isRecord(entry)) continue;
+		const pluginConfig = entry.config;
+		if (!isRecord(pluginConfig)) continue;
+		const pluginOrigin = params.loadablePluginOrigins?.get(pluginId);
+		if (params.loadablePluginOrigins && !pluginOrigin) {
+			collectConfiguredPluginSecretAssignments({
+				pluginId,
+				pluginConfig,
+				secretPaths: secretInputs.paths,
+				active: false,
+				inactiveReason: "plugin is not loadable (stale config entry).",
+				defaults: params.defaults,
+				context: params.context
+			});
+			continue;
+		}
+		const resolvedOrigin = pluginOrigin ?? secretInputs.origin;
+		const enableState = resolveEnableState(pluginId, resolvedOrigin, normalizedConfig, resolvedOrigin === "bundled" ? secretInputs.bundledDefaultEnabled : void 0);
+		collectConfiguredPluginSecretAssignments({
+			pluginId,
+			pluginConfig,
+			secretPaths: secretInputs.paths,
+			active: enableState.enabled,
+			inactiveReason: enableState.reason ?? "plugin is disabled.",
+			defaults: params.defaults,
+			context: params.context
+		});
+	}
+}
+function collectConfiguredPluginSecretAssignments(params) {
+	const seenPaths = /* @__PURE__ */ new Set();
+	for (const secretPath of params.secretPaths) for (const match of collectPluginConfigContractMatches({
+		root: params.pluginConfig,
+		pathPattern: secretPath.path
+	})) {
+		const fullPath = `plugins.entries.${params.pluginId}.config.${match.path}`;
+		if (seenPaths.has(fullPath)) continue;
+		seenPaths.add(fullPath);
+		collectSecretInputAssignment({
+			value: match.value,
+			path: fullPath,
+			expected: secretPath.expected ?? "string",
+			defaults: params.defaults,
+			context: params.context,
+			active: params.active,
+			inactiveReason: `plugin "${params.pluginId}": ${params.inactiveReason}`,
+			apply: createPluginConfigAssignmentApply(params.pluginConfig, match.path)
+		});
+	}
+}
+function createPluginConfigAssignmentApply(pluginConfig, relativePath) {
+	return (value) => {
+		const segments = relativePath.replace(/\[(\d+)\]/g, ".$1").split(".").map((segment) => segment.trim()).filter(Boolean);
+		if (segments.length === 0) return;
+		let current = pluginConfig;
+		for (const segment of segments.slice(0, -1)) {
+			if (Array.isArray(current)) {
+				const index = Number.parseInt(segment, 10);
+				current = Number.isInteger(index) ? current[index] : void 0;
+				continue;
+			}
+			current = isRecord(current) ? current[segment] : void 0;
+		}
+		const finalSegment = segments.at(-1);
+		if (!finalSegment) return;
+		if (Array.isArray(current)) {
+			const index = Number.parseInt(finalSegment, 10);
+			if (Number.isInteger(index) && index >= 0 && index < current.length) current[index] = value;
+			return;
+		}
+		if (isRecord(current)) current[finalSegment] = value;
+	};
+}
+//#endregion
+//#region src/secrets/runtime-config-collectors.ts
+function collectConfigAssignments(params) {
+	const defaults = params.context.sourceConfig.secrets?.defaults;
+	collectCoreConfigAssignments({
+		config: params.config,
+		defaults,
+		context: params.context
+	});
+	collectChannelConfigAssignments({
+		config: params.config,
+		defaults,
+		context: params.context
+	});
+	collectPluginConfigAssignments({
+		config: params.config,
+		defaults,
+		context: params.context,
+		loadablePluginOrigins: params.loadablePluginOrigins
+	});
+}
+//#endregion
+//#region src/secrets/runtime-web-tools.shared.ts
+const loadResolveManifestContractOwnerPluginId = createLazyRuntimeNamedExport(() => import("./runtime-web-tools-manifest.runtime-1oKyHCqf.js"), "resolveManifestContractOwnerPluginId");
+function pushInactiveProviderCredentialWarnings(params) {
+	for (const provider of params.selection.providers) {
+		if (provider.id === params.skipProviderId) continue;
+		const value = params.selection.readConfiguredCredential({
+			provider,
+			config: params.selection.sourceConfig,
+			toolConfig: params.selection.toolConfig
+		});
+		if (!params.selection.hasConfiguredSecretRef(value, params.selection.defaults)) continue;
+		for (const path of params.selection.inactivePathsForProvider(provider)) pushInactiveSurfaceWarning({
+			context: params.selection.context,
+			path,
+			details: params.details
+		});
+	}
+}
+function ensureObject(target, key) {
+	const current = target[key];
+	if (isRecord(current)) return current;
+	const next = {};
+	target[key] = next;
+	return next;
+}
+function normalizeKnownProvider(value, providers) {
+	const normalized = normalizeOptionalLowercaseString(value);
+	if (!normalized) return;
+	if (providers.some((provider) => provider.id === normalized)) return normalized;
+}
+function hasConfiguredSecretRef(value, defaults) {
+	return Boolean(resolveSecretInputRef({
+		value,
+		defaults
+	}).ref);
+}
+async function resolveRuntimeWebProviderSurface(params) {
+	let configuredBundledPluginId = params.configuredBundledPluginIdHint;
+	if (!configuredBundledPluginId && params.rawProvider) configuredBundledPluginId = (await loadResolveManifestContractOwnerPluginId())({
+		contract: params.contract,
+		value: params.rawProvider,
+		origin: "bundled",
+		config: params.sourceConfig,
+		env: {
+			...process.env,
+			...params.context.env
+		}
+	});
+	let allProviders = params.sortProviders(await params.resolveProviders({ configuredBundledPluginId }));
+	if (params.rawProvider && params.configuredBundledPluginIdHint && configuredBundledPluginId && !allProviders.some((provider) => provider.id === params.rawProvider)) configuredBundledPluginId = void 0;
+	if (params.rawProvider && !configuredBundledPluginId) {
+		configuredBundledPluginId = (await loadResolveManifestContractOwnerPluginId())({
+			contract: params.contract,
+			value: params.rawProvider,
+			origin: "bundled",
+			config: params.sourceConfig,
+			env: {
+				...process.env,
+				...params.context.env
+			}
+		});
+		allProviders = params.sortProviders(await params.resolveProviders({ configuredBundledPluginId }));
+	}
+	const hasConfiguredSurface = Boolean(params.toolConfig) || allProviders.some((provider) => {
+		if (params.ignoreKeylessProvidersForConfiguredSurface && provider.requiresCredential === false) return false;
+		return params.readConfiguredCredential({
+			provider,
+			config: params.sourceConfig,
+			toolConfig: params.toolConfig
+		}) !== void 0;
+	});
+	const providers = hasConfiguredSurface || !params.emptyProvidersWhenSurfaceMissing ? allProviders : [];
+	const configuredProvider = normalizeKnownProvider(params.rawProvider, params.normalizeConfiguredProviderAgainstActiveProviders ? providers : allProviders);
+	if (params.rawProvider && !configuredProvider) {
+		const diagnostic = {
+			code: params.invalidAutoDetectCode,
+			message: `${params.providerPath} is "${params.rawProvider}". Falling back to auto-detect precedence.`,
+			path: params.providerPath
+		};
+		params.diagnostics.push(diagnostic);
+		params.metadataDiagnostics.push(diagnostic);
+		pushWarning(params.context, {
+			code: params.invalidAutoDetectCode,
+			path: params.providerPath,
+			message: diagnostic.message
+		});
+	}
+	return {
+		providers,
+		configuredProvider,
+		enabled: hasConfiguredSurface && (!isRecord(params.toolConfig) || params.toolConfig.enabled !== false),
+		hasConfiguredSurface
+	};
+}
+async function resolveRuntimeWebProviderSelection(params) {
+	if (params.configuredProvider) {
+		params.metadata.providerConfigured = params.configuredProvider;
+		params.metadata.providerSource = "configured";
+	}
+	if (params.enabled) {
+		const candidates = params.configuredProvider ? params.providers.filter((provider) => provider.id === params.configuredProvider) : params.providers;
+		const unresolvedWithoutFallback = [];
+		let selectedProvider;
+		let selectedResolution;
+		let keylessFallbackProvider;
+		for (const provider of candidates) {
+			if (provider.requiresCredential === false) {
+				if (params.deferKeylessFallback && !params.configuredProvider) {
+					keylessFallbackProvider ||= provider;
+					continue;
+				}
+				selectedProvider = provider.id;
+				selectedResolution = {
+					source: "missing",
+					secretRefConfigured: false,
+					fallbackUsedAfterRefFailure: false
+				};
+				break;
+			}
+			const path = params.inactivePathsForProvider(provider)[0] ?? "";
+			const value = params.readConfiguredCredential({
+				provider,
+				config: params.sourceConfig,
+				toolConfig: params.toolConfig
+			});
+			const resolution = await params.resolveSecretInput({
+				value,
+				path,
+				envVars: "envVars" in provider && Array.isArray(provider.envVars) ? provider.envVars : []
+			});
+			if (resolution.secretRefConfigured && resolution.fallbackUsedAfterRefFailure) {
+				const diagnostic = {
+					code: params.fallbackUsedCode,
+					message: `${path} SecretRef could not be resolved; using ${resolution.fallbackEnvVar ?? "env fallback"}. ` + (resolution.unresolvedRefReason ?? "").trim(),
+					path
+				};
+				params.diagnostics.push(diagnostic);
+				params.metadata.diagnostics.push(diagnostic);
+				pushWarning(params.context, {
+					code: params.fallbackUsedCode,
+					path,
+					message: diagnostic.message
+				});
+			}
+			if (resolution.secretRefConfigured && !resolution.value && resolution.unresolvedRefReason) unresolvedWithoutFallback.push({
+				provider: provider.id,
+				path,
+				reason: resolution.unresolvedRefReason
+			});
+			if (params.configuredProvider) {
+				selectedProvider = provider.id;
+				selectedResolution = resolution;
+				if (resolution.value) params.setResolvedCredential({
+					resolvedConfig: params.resolvedConfig,
+					provider,
+					value: resolution.value
+				});
+				break;
+			}
+			if (resolution.value) {
+				selectedProvider = provider.id;
+				selectedResolution = resolution;
+				params.setResolvedCredential({
+					resolvedConfig: params.resolvedConfig,
+					provider,
+					value: resolution.value
+				});
+				break;
+			}
+		}
+		if (!selectedProvider && keylessFallbackProvider) {
+			selectedProvider = keylessFallbackProvider.id;
+			selectedResolution = {
+				source: "missing",
+				secretRefConfigured: false,
+				fallbackUsedAfterRefFailure: false
+			};
+		}
+		const failUnresolvedNoFallback = (unresolved) => {
+			const diagnostic = {
+				code: params.noFallbackCode,
+				message: unresolved.reason,
+				path: unresolved.path
+			};
+			params.diagnostics.push(diagnostic);
+			params.metadata.diagnostics.push(diagnostic);
+			pushWarning(params.context, {
+				code: params.noFallbackCode,
+				path: unresolved.path,
+				message: unresolved.reason
+			});
+			throw new Error(`[${params.noFallbackCode}] ${unresolved.reason}`);
+		};
+		if (params.configuredProvider) {
+			const unresolved = unresolvedWithoutFallback[0];
+			if (unresolved) failUnresolvedNoFallback(unresolved);
+		} else {
+			if (!selectedProvider && unresolvedWithoutFallback.length > 0) failUnresolvedNoFallback(unresolvedWithoutFallback[0]);
+			if (selectedProvider) {
+				const selectedDetails = params.providers.find((entry) => entry.id === selectedProvider)?.requiresCredential === false ? `${params.scopePath} auto-detected keyless provider "${selectedProvider}" as the default fallback.` : `${params.scopePath} auto-detected provider "${selectedProvider}" from available credentials.`;
+				const diagnostic = {
+					code: params.autoDetectSelectedCode,
+					message: selectedDetails,
+					path: `${params.scopePath}.provider`
+				};
+				params.diagnostics.push(diagnostic);
+				params.metadata.diagnostics.push(diagnostic);
+			}
+		}
+		if (selectedProvider) {
+			params.metadata.selectedProvider = selectedProvider;
+			params.metadata.selectedProviderKeySource = selectedResolution?.source;
+			if (!params.configuredProvider) params.metadata.providerSource = "auto-detect";
+			const provider = params.providers.find((entry) => entry.id === selectedProvider);
+			if (provider && params.mergeRuntimeMetadata) await params.mergeRuntimeMetadata({
+				provider,
+				metadata: params.metadata,
+				toolConfig: params.toolConfig,
+				selectedResolution
+			});
+		}
+	}
+	if (params.enabled && !params.configuredProvider && params.metadata.selectedProvider) pushInactiveProviderCredentialWarnings({
+		selection: params,
+		skipProviderId: params.metadata.selectedProvider,
+		details: `${params.scopePath} auto-detected provider is "${params.metadata.selectedProvider}".`
+	});
+	else if (params.toolConfig && !params.enabled) pushInactiveProviderCredentialWarnings({
+		selection: params,
+		details: `${params.scopePath} is disabled.`
+	});
+	if (params.enabled && params.toolConfig && params.configuredProvider) pushInactiveProviderCredentialWarnings({
+		selection: params,
+		skipProviderId: params.configuredProvider,
+		details: `${params.scopePath}.provider is "${params.configuredProvider}".`
+	});
+}
+//#endregion
+//#region src/secrets/runtime-web-tools.ts
+const loadRuntimeWebToolsFallbackProviders = createLazyRuntimeSurface(() => import("./runtime-web-tools-fallback.runtime-CYAGzwsD.js"), ({ runtimeWebToolsFallbackProviders }) => runtimeWebToolsFallbackProviders);
+const loadRuntimeWebToolsPublicArtifacts = createLazyRuntimeSurface(() => import("./runtime-web-tools-public-artifacts.runtime-BEIpqp-m.js"), (mod) => mod);
+const loadRuntimeWebToolsManifest = createLazyRuntimeSurface(() => import("./runtime-web-tools-manifest.runtime-1oKyHCqf.js"), (mod) => mod);
+function hasPluginScopedWebToolConfig(config, key) {
+	const entries = config.plugins?.entries;
+	if (!entries) return false;
+	return Object.values(entries).some((entry) => {
+		if (!isRecord(entry)) return false;
+		const pluginConfig = isRecord(entry.config) ? entry.config : void 0;
+		return Boolean(pluginConfig?.[key]);
+	});
+}
+function inferSingleBundledPluginScopedWebToolConfigOwner(config, key) {
+	const entries = config.plugins?.entries;
+	if (!entries) return;
+	const matches = [];
+	for (const [pluginId, entry] of Object.entries(entries)) {
+		if (!isRecord(entry) || entry.enabled === false) continue;
+		if (!isRecord((isRecord(entry.config) ? entry.config : void 0)?.[key])) continue;
+		matches.push(pluginId);
+		if (matches.length > 1) return;
+	}
+	return matches[0];
+}
+function inferExactBundledPluginScopedWebToolConfigOwner(params) {
+	const entry = params.config.plugins?.entries?.[params.pluginId];
+	if (!isRecord(entry) || entry.enabled === false) return;
+	return isRecord((isRecord(entry.config) ? entry.config : void 0)?.[params.key]) ? params.pluginId : void 0;
+}
+async function hasCustomWebSearchPluginRisk(params) {
+	const plugins = params.config.plugins;
+	if (!plugins) return false;
+	if (Array.isArray(plugins.load?.paths) && plugins.load.paths.length > 0) return true;
+	if (plugins.installs && Object.keys(plugins.installs).length > 0) return true;
+	const { resolveManifestContractPluginIds } = await loadRuntimeWebToolsManifest();
+	const bundledPluginIds = new Set(resolveManifestContractPluginIds({
+		contract: "webSearchProviders",
+		origin: "bundled",
+		config: params.config,
+		env: params.env
+	}));
+	const hasNonBundledPluginId = (pluginId) => !bundledPluginIds.has(pluginId.trim());
+	if (Array.isArray(plugins.allow) && plugins.allow.some(hasNonBundledPluginId)) return true;
+	if (Array.isArray(plugins.deny) && plugins.deny.some(hasNonBundledPluginId)) return true;
+	if (plugins.entries && Object.keys(plugins.entries).some(hasNonBundledPluginId)) return true;
+	return false;
+}
+function readNonEmptyEnvValue(env, names) {
+	for (const envVar of names) {
+		const value = normalizeSecretInput(env[envVar]);
+		if (value) return {
+			value,
+			envVar
+		};
+	}
+	return {};
+}
+function buildUnresolvedReason(params) {
+	if (params.kind === "non-string") return `${params.path} SecretRef resolved to a non-string value.`;
+	if (params.kind === "empty") return `${params.path} SecretRef resolved to an empty value.`;
+	return `${params.path} SecretRef is unresolved (${params.refLabel}).`;
+}
+async function resolveSecretInputWithEnvFallback(params) {
+	const { ref } = resolveSecretInputRef({
+		value: params.value,
+		defaults: params.defaults
+	});
+	if (!ref) {
+		const configValue = normalizeSecretInput(params.value);
+		if (configValue) return {
+			value: configValue,
+			source: "config",
+			secretRefConfigured: false,
+			fallbackUsedAfterRefFailure: false
+		};
+		const fallback = readNonEmptyEnvValue(params.context.env, params.envVars);
+		if (fallback.value) return {
+			value: fallback.value,
+			source: "env",
+			fallbackEnvVar: fallback.envVar,
+			secretRefConfigured: false,
+			fallbackUsedAfterRefFailure: false
+		};
+		return {
+			source: "missing",
+			secretRefConfigured: false,
+			fallbackUsedAfterRefFailure: false
+		};
+	}
+	const refLabel = `${ref.source}:${ref.provider}:${ref.id}`;
+	let resolvedFromRef;
+	let unresolvedRefReason;
+	if (params.restrictEnvRefsToEnvVars === true && ref.source === "env" && !params.envVars.includes(ref.id)) unresolvedRefReason = `${params.path} SecretRef env var "${ref.id}" is not allowed.`;
+	else try {
+		const resolvedValue = (await resolveSecretRefValues([ref], {
+			config: params.sourceConfig,
+			env: params.context.env,
+			cache: params.context.cache
+		})).get(secretRefKey(ref));
+		if (typeof resolvedValue !== "string") unresolvedRefReason = buildUnresolvedReason({
+			path: params.path,
+			kind: "non-string",
+			refLabel
+		});
+		else {
+			resolvedFromRef = normalizeSecretInput(resolvedValue);
+			if (!resolvedFromRef) unresolvedRefReason = buildUnresolvedReason({
+				path: params.path,
+				kind: "empty",
+				refLabel
+			});
+		}
+	} catch {
+		unresolvedRefReason = buildUnresolvedReason({
+			path: params.path,
+			kind: "unresolved",
+			refLabel
+		});
+	}
+	if (resolvedFromRef) return {
+		value: resolvedFromRef,
+		source: "secretRef",
+		secretRefConfigured: true,
+		fallbackUsedAfterRefFailure: false
+	};
+	const fallback = readNonEmptyEnvValue(params.context.env, params.envVars);
+	if (fallback.value) return {
+		value: fallback.value,
+		source: "env",
+		fallbackEnvVar: fallback.envVar,
+		unresolvedRefReason,
+		secretRefConfigured: true,
+		fallbackUsedAfterRefFailure: true
+	};
+	return {
+		source: "missing",
+		unresolvedRefReason,
+		secretRefConfigured: true,
+		fallbackUsedAfterRefFailure: false
+	};
+}
+function setResolvedWebSearchApiKey(params) {
+	if (params.provider.setConfiguredCredentialValue) {
+		params.provider.setConfiguredCredentialValue(params.resolvedConfig, params.value);
+		return;
+	}
+	const search = ensureObject(ensureObject(ensureObject(params.resolvedConfig, "tools"), "web"), "search");
+	params.provider.setCredentialValue(search, params.value);
+}
+async function resolveBundledWebSearchProviders(params) {
+	const env = {
+		...process.env,
+		...params.context.env
+	};
+	const onlyPluginIds = params.configuredBundledPluginId !== void 0 ? [params.configuredBundledPluginId] : params.onlyPluginIds && params.onlyPluginIds.length > 0 ? [...new Set(params.onlyPluginIds)].toSorted((left, right) => left.localeCompare(right)) : void 0;
+	if (onlyPluginIds && onlyPluginIds.length > 0) {
+		const bundled = resolveBundledExplicitWebSearchProvidersFromPublicArtifacts({ onlyPluginIds });
+		if (bundled && bundled.length > 0) return bundled;
+		const { resolvePluginWebSearchProviders } = await loadRuntimeWebToolsFallbackProviders();
+		return resolvePluginWebSearchProviders({
+			config: params.sourceConfig,
+			env,
+			bundledAllowlistCompat: true,
+			onlyPluginIds,
+			origin: "bundled"
+		});
+	}
+	if (!params.hasCustomWebSearchPluginRisk) {
+		const { resolveBundledWebSearchProvidersFromPublicArtifacts } = await loadRuntimeWebToolsPublicArtifacts();
+		const bundled = resolveBundledWebSearchProvidersFromPublicArtifacts({
+			config: params.sourceConfig,
+			env,
+			bundledAllowlistCompat: true
+		});
+		if (bundled && bundled.length > 0) return bundled;
+		const { resolvePluginWebSearchProviders } = await loadRuntimeWebToolsFallbackProviders();
+		return resolvePluginWebSearchProviders({
+			config: params.sourceConfig,
+			env,
+			bundledAllowlistCompat: true,
+			origin: "bundled"
+		});
+	}
+	const { resolvePluginWebSearchProviders } = await loadRuntimeWebToolsFallbackProviders();
+	return resolvePluginWebSearchProviders({
+		config: params.sourceConfig,
+		env,
+		bundledAllowlistCompat: true
+	});
+}
+async function resolveBundledWebFetchProviders(params) {
+	const env = {
+		...process.env,
+		...params.context.env
+	};
+	if (params.configuredBundledPluginId) {
+		const bundled = resolveBundledExplicitWebFetchProvidersFromPublicArtifacts({ onlyPluginIds: [params.configuredBundledPluginId] });
+		if (bundled && bundled.length > 0) return bundled;
+		const { resolvePluginWebFetchProviders } = await loadRuntimeWebToolsFallbackProviders();
+		return resolvePluginWebFetchProviders({
+			config: params.sourceConfig,
+			env,
+			bundledAllowlistCompat: true,
+			onlyPluginIds: [params.configuredBundledPluginId],
+			origin: "bundled"
+		});
+	}
+	const { resolveBundledWebFetchProvidersFromPublicArtifacts } = await loadRuntimeWebToolsPublicArtifacts();
+	const bundled = resolveBundledWebFetchProvidersFromPublicArtifacts({
+		config: params.sourceConfig,
+		env,
+		bundledAllowlistCompat: true
+	});
+	if (bundled && bundled.length > 0) return bundled;
+	const { resolvePluginWebFetchProviders } = await loadRuntimeWebToolsFallbackProviders();
+	return resolvePluginWebFetchProviders({
+		config: params.sourceConfig,
+		env,
+		bundledAllowlistCompat: true,
+		origin: "bundled"
+	});
+}
+function readConfiguredProviderCredential(params) {
+	return params.provider.getConfiguredCredentialValue?.(params.config);
+}
+function inactivePathsForProvider(provider) {
+	if (provider.requiresCredential === false) return [];
+	return provider.inactiveSecretPaths?.length ? provider.inactiveSecretPaths : [provider.credentialPath];
+}
+function setResolvedWebFetchApiKey(params) {
+	const fetch = ensureObject(ensureObject(ensureObject(params.resolvedConfig, "tools"), "web"), "fetch");
+	if (params.provider.setConfiguredCredentialValue) {
+		params.provider.setConfiguredCredentialValue(params.resolvedConfig, params.value);
+		return;
+	}
+	params.provider.setCredentialValue(fetch, params.value);
+}
+function readConfiguredFetchProviderCredential(params) {
+	return params.provider.getConfiguredCredentialValue?.(params.config) ?? params.provider.getCredentialValue(params.fetch);
+}
+function inactivePathsForFetchProvider(provider) {
+	if (provider.requiresCredential === false) return [];
+	return provider.inactiveSecretPaths?.length ? provider.inactiveSecretPaths : [provider.credentialPath];
+}
+async function resolveRuntimeWebTools(params) {
+	const defaults = params.sourceConfig.secrets?.defaults;
+	const diagnostics = [];
+	const env = {
+		...process.env,
+		...params.context.env
+	};
+	const sourceTools = isRecord(params.sourceConfig.tools) ? params.sourceConfig.tools : void 0;
+	const sourceWeb = isRecord(sourceTools?.web) ? sourceTools.web : void 0;
+	const resolvedTools = isRecord(params.resolvedConfig.tools) ? params.resolvedConfig.tools : void 0;
+	const resolvedWeb = isRecord(resolvedTools?.web) ? resolvedTools.web : void 0;
+	let hasCustomWebSearchRisk;
+	const getHasCustomWebSearchRisk = () => {
+		hasCustomWebSearchRisk ??= hasCustomWebSearchPluginRisk({
+			config: params.sourceConfig,
+			env
+		});
+		return hasCustomWebSearchRisk;
+	};
+	const legacyXSearchSource = isRecord(sourceWeb?.x_search) ? sourceWeb.x_search : void 0;
+	const legacyXSearchResolved = isRecord(resolvedWeb?.x_search) ? resolvedWeb.x_search : void 0;
+	if (legacyXSearchSource && legacyXSearchResolved && Object.prototype.hasOwnProperty.call(legacyXSearchSource, "apiKey")) {
+		const legacyXSearchSourceRecord = legacyXSearchSource;
+		const legacyXSearchResolvedRecord = legacyXSearchResolved;
+		const resolution = await resolveSecretInputWithEnvFallback({
+			sourceConfig: params.sourceConfig,
+			context: params.context,
+			defaults,
+			value: legacyXSearchSourceRecord.apiKey,
+			path: "tools.web.x_search.apiKey",
+			envVars: ["XAI_API_KEY"]
+		});
+		if (resolution.value) legacyXSearchResolvedRecord.apiKey = resolution.value;
+	}
+	const hasPluginWebSearchConfig = hasPluginScopedWebToolConfig(params.sourceConfig, "webSearch");
+	const hasPluginWebFetchConfig = hasPluginScopedWebToolConfig(params.sourceConfig, "webFetch");
+	if (!sourceWeb && !hasPluginWebSearchConfig && !hasPluginWebFetchConfig) return {
+		search: {
+			providerSource: "none",
+			diagnostics: []
+		},
+		fetch: {
+			providerSource: "none",
+			diagnostics: []
+		},
+		diagnostics
+	};
+	const search = isRecord(sourceWeb?.search) ? sourceWeb.search : void 0;
+	const fetch = isRecord(sourceWeb?.fetch) ? sourceWeb.fetch : void 0;
+	if (!search && !fetch && !hasPluginWebSearchConfig && !hasPluginWebFetchConfig) return {
+		search: {
+			providerSource: "none",
+			diagnostics: []
+		},
+		fetch: {
+			providerSource: "none",
+			diagnostics: []
+		},
+		diagnostics
+	};
+	const rawProvider = normalizeLowercaseStringOrEmpty(search?.provider);
+	let configuredBundledWebSearchPluginIdHint;
+	if (hasPluginWebSearchConfig && !await getHasCustomWebSearchRisk()) {
+		if (rawProvider) configuredBundledWebSearchPluginIdHint = inferExactBundledPluginScopedWebToolConfigOwner({
+			config: params.sourceConfig,
+			key: "webSearch",
+			pluginId: rawProvider
+		});
+		configuredBundledWebSearchPluginIdHint ??= inferSingleBundledPluginScopedWebToolConfigOwner(params.sourceConfig, "webSearch");
+	}
+	const searchMetadata = {
+		providerSource: "none",
+		diagnostics: []
+	};
+	if (search || hasPluginWebSearchConfig) {
+		const searchSurface = await resolveRuntimeWebProviderSurface({
+			contract: "webSearchProviders",
+			rawProvider,
+			providerPath: "tools.web.search.provider",
+			toolConfig: search,
+			diagnostics,
+			metadataDiagnostics: searchMetadata.diagnostics,
+			invalidAutoDetectCode: "WEB_SEARCH_PROVIDER_INVALID_AUTODETECT",
+			sourceConfig: params.sourceConfig,
+			context: params.context,
+			configuredBundledPluginIdHint: configuredBundledWebSearchPluginIdHint,
+			resolveProviders: async ({ configuredBundledPluginId }) => resolveBundledWebSearchProviders({
+				sourceConfig: params.sourceConfig,
+				context: params.context,
+				configuredBundledPluginId,
+				hasCustomWebSearchPluginRisk: await getHasCustomWebSearchRisk()
+			}),
+			sortProviders: sortWebSearchProvidersForAutoDetect,
+			readConfiguredCredential: ({ provider, config, toolConfig }) => readConfiguredProviderCredential({
+				provider,
+				config,
+				search: toolConfig
+			}),
+			ignoreKeylessProvidersForConfiguredSurface: true,
+			emptyProvidersWhenSurfaceMissing: true,
+			normalizeConfiguredProviderAgainstActiveProviders: true
+		});
+		await resolveRuntimeWebProviderSelection({
+			scopePath: "tools.web.search",
+			toolConfig: search,
+			enabled: searchSurface.enabled,
+			providers: searchSurface.providers,
+			configuredProvider: searchSurface.configuredProvider,
+			metadata: searchMetadata,
+			diagnostics,
+			sourceConfig: params.sourceConfig,
+			resolvedConfig: params.resolvedConfig,
+			context: params.context,
+			defaults,
+			deferKeylessFallback: true,
+			fallbackUsedCode: "WEB_SEARCH_KEY_UNRESOLVED_FALLBACK_USED",
+			noFallbackCode: "WEB_SEARCH_KEY_UNRESOLVED_NO_FALLBACK",
+			autoDetectSelectedCode: "WEB_SEARCH_AUTODETECT_SELECTED",
+			readConfiguredCredential: ({ provider, config, toolConfig }) => readConfiguredProviderCredential({
+				provider,
+				config,
+				search: toolConfig
+			}),
+			resolveSecretInput: ({ value, path, envVars }) => resolveSecretInputWithEnvFallback({
+				sourceConfig: params.sourceConfig,
+				context: params.context,
+				defaults,
+				value,
+				path,
+				envVars
+			}),
+			setResolvedCredential: ({ resolvedConfig, provider, value }) => setResolvedWebSearchApiKey({
+				resolvedConfig,
+				provider,
+				value
+			}),
+			inactivePathsForProvider,
+			hasConfiguredSecretRef,
+			mergeRuntimeMetadata: async ({ provider, metadata, toolConfig, selectedResolution }) => {
+				if (!provider.resolveRuntimeMetadata) return;
+				Object.assign(metadata, await provider.resolveRuntimeMetadata({
+					config: params.sourceConfig,
+					searchConfig: toolConfig,
+					runtimeMetadata: metadata,
+					resolvedCredential: selectedResolution ? {
+						value: selectedResolution.value,
+						source: selectedResolution.source,
+						fallbackEnvVar: selectedResolution.fallbackEnvVar
+					} : void 0
+				}));
+			}
+		});
+	}
+	const rawFetchProvider = normalizeLowercaseStringOrEmpty(fetch?.provider);
+	const fetchMetadata = {
+		providerSource: "none",
+		diagnostics: []
+	};
+	if (fetch || hasPluginWebFetchConfig) {
+		const fetchSurface = await resolveRuntimeWebProviderSurface({
+			contract: "webFetchProviders",
+			rawProvider: rawFetchProvider,
+			providerPath: "tools.web.fetch.provider",
+			toolConfig: fetch,
+			diagnostics,
+			metadataDiagnostics: fetchMetadata.diagnostics,
+			invalidAutoDetectCode: "WEB_FETCH_PROVIDER_INVALID_AUTODETECT",
+			sourceConfig: params.sourceConfig,
+			context: params.context,
+			resolveProviders: ({ configuredBundledPluginId }) => resolveBundledWebFetchProviders({
+				sourceConfig: params.sourceConfig,
+				context: params.context,
+				configuredBundledPluginId
+			}),
+			sortProviders: sortWebFetchProvidersForAutoDetect,
+			readConfiguredCredential: ({ provider, config, toolConfig }) => readConfiguredFetchProviderCredential({
+				provider,
+				config,
+				fetch: toolConfig
+			})
+		});
+		await resolveRuntimeWebProviderSelection({
+			scopePath: "tools.web.fetch",
+			toolConfig: fetch,
+			enabled: fetchSurface.enabled,
+			providers: fetchSurface.providers,
+			configuredProvider: fetchSurface.configuredProvider,
+			metadata: fetchMetadata,
+			diagnostics,
+			sourceConfig: params.sourceConfig,
+			resolvedConfig: params.resolvedConfig,
+			context: params.context,
+			defaults,
+			deferKeylessFallback: false,
+			fallbackUsedCode: "WEB_FETCH_PROVIDER_KEY_UNRESOLVED_FALLBACK_USED",
+			noFallbackCode: "WEB_FETCH_PROVIDER_KEY_UNRESOLVED_NO_FALLBACK",
+			autoDetectSelectedCode: "WEB_FETCH_AUTODETECT_SELECTED",
+			readConfiguredCredential: ({ provider, config, toolConfig }) => readConfiguredFetchProviderCredential({
+				provider,
+				config,
+				fetch: toolConfig
+			}),
+			resolveSecretInput: ({ value, path, envVars }) => resolveSecretInputWithEnvFallback({
+				sourceConfig: params.sourceConfig,
+				context: params.context,
+				defaults,
+				value,
+				path,
+				envVars,
+				restrictEnvRefsToEnvVars: true
+			}),
+			setResolvedCredential: ({ resolvedConfig, provider, value }) => setResolvedWebFetchApiKey({
+				resolvedConfig,
+				provider,
+				value
+			}),
+			inactivePathsForProvider: inactivePathsForFetchProvider,
+			hasConfiguredSecretRef,
+			mergeRuntimeMetadata: async ({ provider, metadata, toolConfig, selectedResolution }) => {
+				if (!provider.resolveRuntimeMetadata) return;
+				Object.assign(metadata, await provider.resolveRuntimeMetadata({
+					config: params.sourceConfig,
+					fetchConfig: toolConfig,
+					runtimeMetadata: metadata,
+					resolvedCredential: selectedResolution ? {
+						value: selectedResolution.value,
+						source: selectedResolution.source,
+						fallbackEnvVar: selectedResolution.fallbackEnvVar
+					} : void 0
+				}));
+			}
+		});
+	}
+	return {
+		search: searchMetadata,
+		fetch: fetchMetadata,
+		diagnostics
+	};
+}
+//#endregion
+export { evaluateGatewayAuthSurfaceStates as i, collectConfigAssignments as n, GATEWAY_AUTH_SURFACE_PATHS as r, resolveRuntimeWebTools as t };