@pixelzx/genesis 2026.6.27 → 2026.6.28

package/dist/command-secret-gateway-96Lg7d56.js

@@ -1,528 +0,0 @@
-import { i as formatErrorMessage } from "./errors-CufR9eHH.js";
-import { a as normalizeLowercaseStringOrEmpty } from "./string-coerce-DPP_aYVc.js";
-import { a as coerceSecretRef, p as resolveSecretInputRef } from "./types.secrets-BbgGt42I.js";
-import { a as resolveSecretRefValue } from "./resolve-DFimFdgC.js";
-import { n as resolveManifestContractOwnerPluginId } from "./manifest-registry-CUSRRX5s.js";
-import { i as setPathExistingStrict, n as getPath } from "./path-utils-CJ35S4Ql.js";
-import { r as discoverConfigSecretTargetsByIds } from "./target-registry-BrTvhqBU.js";
-import { i as GATEWAY_CLIENT_NAMES, r as GATEWAY_CLIENT_MODES } from "./client-info-CjxzJxIU.js";
-import { zt as validateSecretsResolveResult } from "./protocol-zDWsuAk7.js";
-import { r as callGateway } from "./call-D1wMcFp1.js";
-import { r as isExpectedResolvedSecretValue, t as assertExpectedResolvedSecretValue } from "./secret-value-B-Ge_gY8.js";
-import { n as collectConfigAssignments, t as resolveRuntimeWebTools } from "./runtime-web-tools-DlattYEh.js";
-import { r as createResolverContext } from "./runtime-shared-CZpCel0D.js";
-//#region src/secrets/command-config.ts
-function analyzeCommandSecretAssignmentsFromSnapshot(params) {
-	const defaults = params.sourceConfig.secrets?.defaults;
-	const assignments = [];
-	const diagnostics = [];
-	const unresolved = [];
-	const inactive = [];
-	for (const target of discoverConfigSecretTargetsByIds(params.sourceConfig, params.targetIds)) {
-		if (params.allowedPaths && !params.allowedPaths.has(target.path)) continue;
-		const { explicitRef, ref } = resolveSecretInputRef({
-			value: target.value,
-			refValue: target.refValue,
-			defaults
-		});
-		const inlineCandidateRef = explicitRef ? coerceSecretRef(target.value, defaults) : null;
-		if (!ref) continue;
-		const resolved = getPath(params.resolvedConfig, target.pathSegments);
-		if (!isExpectedResolvedSecretValue(resolved, target.entry.expectedResolvedValue)) {
-			if (params.inactiveRefPaths?.has(target.path)) {
-				diagnostics.push(`${target.path}: secret ref is configured on an inactive surface; skipping command-time assignment.`);
-				inactive.push({
-					path: target.path,
-					pathSegments: [...target.pathSegments]
-				});
-				continue;
-			}
-			unresolved.push({
-				path: target.path,
-				pathSegments: [...target.pathSegments]
-			});
-			continue;
-		}
-		assignments.push({
-			path: target.path,
-			pathSegments: [...target.pathSegments],
-			value: resolved
-		});
-		if (target.entry.secretShape === "sibling_ref" && explicitRef && inlineCandidateRef) diagnostics.push(`${target.path}: both inline and sibling ref were present; sibling ref took precedence.`);
-	}
-	return {
-		assignments,
-		diagnostics,
-		unresolved,
-		inactive
-	};
-}
-function collectCommandSecretAssignmentsFromSnapshot(params) {
-	const analyzed = analyzeCommandSecretAssignmentsFromSnapshot({
-		sourceConfig: params.sourceConfig,
-		resolvedConfig: params.resolvedConfig,
-		targetIds: params.targetIds,
-		inactiveRefPaths: params.inactiveRefPaths,
-		allowedPaths: params.allowedPaths
-	});
-	if (analyzed.unresolved.length > 0) throw new Error(`${params.commandName}: ${analyzed.unresolved[0]?.path ?? "target"} is unresolved in the active runtime snapshot.`);
-	return {
-		assignments: analyzed.assignments,
-		diagnostics: analyzed.diagnostics
-	};
-}
-//#endregion
-//#region src/cli/command-secret-gateway.ts
-const WEB_RUNTIME_SECRET_TARGET_ID_PREFIXES = ["tools.web.search", "plugins.entries."];
-const WEB_RUNTIME_SECRET_PATH_PREFIXES = ["tools.web.search.", "plugins.entries."];
-const commandSecretGatewayDeps = {
-	analyzeCommandSecretAssignmentsFromSnapshot,
-	collectConfigAssignments,
-	discoverConfigSecretTargetsByIds,
-	resolveManifestContractOwnerPluginId,
-	resolveRuntimeWebTools
-};
-function pluginIdFromRuntimeWebPath(path) {
-	return /^plugins\.entries\.([^.]+)\.config\.(webSearch|webFetch)\.apiKey$/.exec(path)?.[1];
-}
-function normalizeCommandSecretResolutionMode(mode) {
-	if (!mode || mode === "enforce_resolved" || mode === "strict") return "enforce_resolved";
-	if (mode === "read_only_status" || mode === "summary") return "read_only_status";
-	return "read_only_operational";
-}
-function enforcesResolvedSecrets(mode) {
-	return mode === "enforce_resolved";
-}
-function dedupeDiagnostics(entries) {
-	const seen = /* @__PURE__ */ new Set();
-	const ordered = [];
-	for (const entry of entries) {
-		const trimmed = entry.trim();
-		if (!trimmed || seen.has(trimmed)) continue;
-		seen.add(trimmed);
-		ordered.push(trimmed);
-	}
-	return ordered;
-}
-function targetsRuntimeWebPath(path) {
-	return WEB_RUNTIME_SECRET_PATH_PREFIXES.some((prefix) => path.startsWith(prefix));
-}
-function classifyRuntimeWebTargetPathState(params) {
-	if (params.path === "tools.web.search.apiKey") return params.config.tools?.web?.search?.enabled !== false ? "active" : "inactive";
-	const pluginId = pluginIdFromRuntimeWebPath(params.path);
-	if (pluginId) {
-		if (params.path.endsWith(".config.webFetch.apiKey")) {
-			const fetch = params.config.tools?.web?.fetch;
-			if (fetch?.enabled === false) return "inactive";
-			const configuredProvider = normalizeLowercaseStringOrEmpty(fetch?.provider);
-			if (!configuredProvider) return "active";
-			return commandSecretGatewayDeps.resolveManifestContractOwnerPluginId({
-				contract: "webFetchProviders",
-				value: configuredProvider,
-				origin: "bundled",
-				config: params.config
-			}) === pluginId ? "active" : "inactive";
-		}
-		const search = params.config.tools?.web?.search;
-		if (search?.enabled === false) return "inactive";
-		const configuredProvider = normalizeLowercaseStringOrEmpty(search?.provider);
-		if (!configuredProvider) return "active";
-		return commandSecretGatewayDeps.resolveManifestContractOwnerPluginId({
-			contract: "webSearchProviders",
-			value: configuredProvider,
-			origin: "bundled",
-			config: params.config
-		}) === pluginId ? "active" : "inactive";
-	}
-	const match = /^tools\.web\.search\.([^.]+)\.apiKey$/.exec(params.path);
-	if (!match) return "unknown";
-	const search = params.config.tools?.web?.search;
-	if (search?.enabled === false) return "inactive";
-	const configuredProvider = normalizeLowercaseStringOrEmpty(search?.provider);
-	if (!configuredProvider) return "active";
-	return configuredProvider === match[1] ? "active" : "inactive";
-}
-function describeInactiveRuntimeWebTargetPath(params) {
-	if (params.path === "tools.web.search.apiKey") return params.config.tools?.web?.search?.enabled === false ? "tools.web.search is disabled." : void 0;
-	const pluginId = pluginIdFromRuntimeWebPath(params.path);
-	if (pluginId) {
-		if (params.path.endsWith(".config.webFetch.apiKey")) {
-			const fetch = params.config.tools?.web?.fetch;
-			if (fetch?.enabled === false) return "tools.web.fetch is disabled.";
-			const configuredProvider = normalizeLowercaseStringOrEmpty(fetch?.provider);
-			if (configuredProvider) return `tools.web.fetch.provider is "${configuredProvider}".`;
-			return;
-		}
-		const search = params.config.tools?.web?.search;
-		if (search?.enabled === false) return "tools.web.search is disabled.";
-		const configuredProvider = normalizeLowercaseStringOrEmpty(search?.provider);
-		const configuredPluginId = configuredProvider ? commandSecretGatewayDeps.resolveManifestContractOwnerPluginId({
-			contract: "webSearchProviders",
-			value: configuredProvider,
-			origin: "bundled",
-			config: params.config
-		}) : void 0;
-		if (configuredPluginId && configuredPluginId !== pluginId) return `tools.web.search.provider is "${configuredProvider}".`;
-		return;
-	}
-	const match = /^tools\.web\.search\.([^.]+)\.apiKey$/.exec(params.path);
-	if (!match) return;
-	const search = params.config.tools?.web?.search;
-	if (search?.enabled === false) return "tools.web.search is disabled.";
-	const configuredProvider = normalizeLowercaseStringOrEmpty(search?.provider);
-	if (configuredProvider && configuredProvider !== match[1]) return `tools.web.search.provider is "${configuredProvider}".`;
-}
-function targetsRuntimeWebResolution(params) {
-	if (params.allowedPaths) {
-		for (const path of params.allowedPaths) if (targetsRuntimeWebPath(path)) return true;
-		return false;
-	}
-	for (const targetId of params.targetIds) if (WEB_RUNTIME_SECRET_TARGET_ID_PREFIXES.some((prefix) => targetId.startsWith(prefix))) return true;
-	return false;
-}
-function collectConfiguredTargetRefPaths(params) {
-	const defaults = params.config.secrets?.defaults;
-	const configuredTargetRefPaths = /* @__PURE__ */ new Set();
-	for (const target of commandSecretGatewayDeps.discoverConfigSecretTargetsByIds(params.config, params.targetIds)) {
-		if (params.allowedPaths && !params.allowedPaths.has(target.path)) continue;
-		const { ref } = resolveSecretInputRef({
-			value: target.value,
-			refValue: target.refValue,
-			defaults
-		});
-		if (ref) configuredTargetRefPaths.add(target.path);
-	}
-	return configuredTargetRefPaths;
-}
-function classifyConfiguredTargetRefs(params) {
-	if (params.configuredTargetRefPaths.size === 0) return {
-		hasActiveConfiguredRef: false,
-		hasUnknownConfiguredRef: false,
-		diagnostics: []
-	};
-	const context = createResolverContext({
-		sourceConfig: params.config,
-		env: process.env
-	});
-	commandSecretGatewayDeps.collectConfigAssignments({
-		config: structuredClone(params.config),
-		context
-	});
-	const activePaths = new Set(context.assignments.map((assignment) => assignment.path));
-	const inactiveWarningsByPath = /* @__PURE__ */ new Map();
-	for (const warning of context.warnings) {
-		if (warning.code !== "SECRETS_REF_IGNORED_INACTIVE_SURFACE") continue;
-		inactiveWarningsByPath.set(warning.path, warning.message);
-	}
-	const diagnostics = /* @__PURE__ */ new Set();
-	let hasActiveConfiguredRef = false;
-	let hasUnknownConfiguredRef = false;
-	for (const path of params.configuredTargetRefPaths) {
-		if (activePaths.has(path)) {
-			hasActiveConfiguredRef = true;
-			continue;
-		}
-		const inactiveWarning = inactiveWarningsByPath.get(path);
-		if (inactiveWarning) {
-			diagnostics.add(inactiveWarning);
-			continue;
-		}
-		hasUnknownConfiguredRef = true;
-	}
-	return {
-		hasActiveConfiguredRef,
-		hasUnknownConfiguredRef,
-		diagnostics: [...diagnostics]
-	};
-}
-function parseGatewaySecretsResolveResult(payload) {
-	if (!validateSecretsResolveResult(payload)) throw new Error("gateway returned invalid secrets.resolve payload.");
-	const parsed = payload;
-	return {
-		assignments: parsed.assignments ?? [],
-		diagnostics: (parsed.diagnostics ?? []).filter((entry) => entry.trim().length > 0),
-		inactiveRefPaths: (parsed.inactiveRefPaths ?? []).filter((entry) => entry.trim().length > 0)
-	};
-}
-function collectInactiveSurfacePathsFromDiagnostics(diagnostics) {
-	const paths = /* @__PURE__ */ new Set();
-	for (const entry of diagnostics) {
-		const markerIndex = entry.indexOf(": secret ref is configured on an inactive surface;");
-		if (markerIndex <= 0) continue;
-		const path = entry.slice(0, markerIndex).trim();
-		if (path.length > 0) paths.add(path);
-	}
-	return paths;
-}
-function isUnsupportedSecretsResolveError(err) {
-	const message = normalizeLowercaseStringOrEmpty(formatErrorMessage(err));
-	if (!message.includes("secrets.resolve")) return false;
-	return message.includes("does not support required method") || message.includes("unknown method") || message.includes("method not found") || message.includes("invalid request");
-}
-function isDirectRuntimeWebTargetPath(path) {
-	return /^plugins\.entries\.[^.]+\.config\.(webSearch|webFetch)\.apiKey$/.test(path) || /^tools\.web\.search\.[^.]+\.apiKey$/.test(path);
-}
-async function resolveCommandSecretRefsLocally(params) {
-	const sourceConfig = params.config;
-	const resolvedConfig = structuredClone(params.config);
-	const context = createResolverContext({
-		sourceConfig,
-		env: process.env
-	});
-	const localResolutionDiagnostics = [];
-	const discoveredTargets = commandSecretGatewayDeps.discoverConfigSecretTargetsByIds(sourceConfig, params.targetIds).filter((target) => !params.allowedPaths || params.allowedPaths.has(target.path));
-	const runtimeWebTargets = discoveredTargets.filter((target) => targetsRuntimeWebPath(target.path));
-	commandSecretGatewayDeps.collectConfigAssignments({
-		config: structuredClone(params.config),
-		context
-	});
-	if (targetsRuntimeWebResolution({
-		targetIds: params.targetIds,
-		allowedPaths: params.allowedPaths
-	}) && !runtimeWebTargets.every((target) => isDirectRuntimeWebTargetPath(target.path))) try {
-		await commandSecretGatewayDeps.resolveRuntimeWebTools({
-			sourceConfig,
-			resolvedConfig,
-			context
-		});
-	} catch (error) {
-		if (enforcesResolvedSecrets(params.mode)) throw error;
-		localResolutionDiagnostics.push(`${params.commandName}: failed to resolve web tool secrets locally (${formatErrorMessage(error)}).`);
-	}
-	const inactiveRefPaths = new Set(context.warnings.filter((warning) => warning.code === "SECRETS_REF_IGNORED_INACTIVE_SURFACE").filter((warning) => !params.allowedPaths || params.allowedPaths.has(warning.path)).map((warning) => warning.path));
-	const runtimeWebActivePaths = /* @__PURE__ */ new Set();
-	const runtimeWebInactiveDiagnostics = [];
-	for (const target of runtimeWebTargets) {
-		const runtimeState = classifyRuntimeWebTargetPathState({
-			config: sourceConfig,
-			path: target.path
-		});
-		if (runtimeState === "inactive") {
-			inactiveRefPaths.add(target.path);
-			const inactiveDetail = describeInactiveRuntimeWebTargetPath({
-				config: sourceConfig,
-				path: target.path
-			});
-			if (inactiveDetail) runtimeWebInactiveDiagnostics.push(`${target.path}: ${inactiveDetail}`);
-			continue;
-		}
-		if (runtimeState === "active") runtimeWebActivePaths.add(target.path);
-	}
-	const inactiveWarningDiagnostics = context.warnings.filter((warning) => warning.code === "SECRETS_REF_IGNORED_INACTIVE_SURFACE").filter((warning) => !params.allowedPaths || params.allowedPaths.has(warning.path)).map((warning) => warning.message);
-	const activePaths = new Set(context.assignments.map((assignment) => assignment.path));
-	for (const target of discoveredTargets) await resolveTargetSecretLocally({
-		target,
-		sourceConfig,
-		resolvedConfig,
-		env: context.env,
-		cache: context.cache,
-		activePaths,
-		runtimeWebActivePaths,
-		inactiveRefPaths,
-		mode: params.mode,
-		commandName: params.commandName,
-		localResolutionDiagnostics
-	});
-	const analyzed = commandSecretGatewayDeps.analyzeCommandSecretAssignmentsFromSnapshot({
-		sourceConfig,
-		resolvedConfig,
-		targetIds: params.targetIds,
-		inactiveRefPaths,
-		...params.allowedPaths ? { allowedPaths: params.allowedPaths } : {}
-	});
-	const targetStatesByPath = buildTargetStatesByPath({
-		analyzed,
-		resolvedState: "resolved_local"
-	});
-	if (!enforcesResolvedSecrets(params.mode) && analyzed.unresolved.length > 0) scrubUnresolvedAssignments(resolvedConfig, analyzed.unresolved);
-	else if (analyzed.unresolved.length > 0) throw new Error(`${params.commandName}: ${analyzed.unresolved[0]?.path ?? "target"} is unresolved in the active runtime snapshot.`);
-	return {
-		resolvedConfig,
-		diagnostics: dedupeDiagnostics([
-			...params.preflightDiagnostics,
-			...runtimeWebInactiveDiagnostics,
-			...inactiveWarningDiagnostics,
-			...filterInactiveSurfaceDiagnostics({
-				diagnostics: analyzed.diagnostics,
-				inactiveRefPaths
-			}),
-			...localResolutionDiagnostics,
-			...buildUnresolvedDiagnostics(params.commandName, analyzed.unresolved, params.mode)
-		]),
-		targetStatesByPath,
-		hadUnresolvedTargets: analyzed.unresolved.length > 0
-	};
-}
-function buildTargetStatesByPath(params) {
-	const states = {};
-	for (const assignment of params.analyzed.assignments) states[assignment.path] = params.resolvedState;
-	for (const entry of params.analyzed.inactive) states[entry.path] = "inactive_surface";
-	for (const entry of params.analyzed.unresolved) states[entry.path] = "unresolved";
-	return states;
-}
-function buildUnresolvedDiagnostics(commandName, unresolved, mode) {
-	if (enforcesResolvedSecrets(mode)) return [];
-	return unresolved.map((entry) => `${commandName}: ${entry.path} is unavailable in this command path; continuing with degraded read-only config.`);
-}
-function scrubUnresolvedAssignments(config, unresolved) {
-	for (const entry of unresolved) setPathExistingStrict(config, entry.pathSegments, void 0);
-}
-function filterInactiveSurfaceDiagnostics(params) {
-	return params.diagnostics.filter((entry) => {
-		const markerIndex = entry.indexOf(": secret ref is configured on an inactive surface;");
-		if (markerIndex <= 0) return true;
-		const path = entry.slice(0, markerIndex).trim();
-		return !params.inactiveRefPaths.has(path);
-	});
-}
-async function resolveTargetSecretLocally(params) {
-	const defaults = params.sourceConfig.secrets?.defaults;
-	const { ref } = resolveSecretInputRef({
-		value: params.target.value,
-		refValue: params.target.refValue,
-		defaults
-	});
-	if (!ref || params.inactiveRefPaths.has(params.target.path) || !params.activePaths.has(params.target.path) && !params.runtimeWebActivePaths.has(params.target.path)) return;
-	try {
-		const resolved = await resolveSecretRefValue(ref, {
-			config: params.sourceConfig,
-			env: params.env,
-			cache: params.cache
-		});
-		assertExpectedResolvedSecretValue({
-			value: resolved,
-			expected: params.target.entry.expectedResolvedValue,
-			errorMessage: params.target.entry.expectedResolvedValue === "string" ? `${params.target.path} resolved to a non-string or empty value.` : `${params.target.path} resolved to an unsupported value type.`
-		});
-		setPathExistingStrict(params.resolvedConfig, params.target.pathSegments, resolved);
-	} catch (error) {
-		if (!enforcesResolvedSecrets(params.mode)) params.localResolutionDiagnostics.push(`${params.commandName}: failed to resolve ${params.target.path} locally (${formatErrorMessage(error)}).`);
-	}
-}
-async function resolveCommandSecretRefsViaGateway(params) {
-	const mode = normalizeCommandSecretResolutionMode(params.mode);
-	const configuredTargetRefPaths = collectConfiguredTargetRefPaths({
-		config: params.config,
-		targetIds: params.targetIds,
-		allowedPaths: params.allowedPaths
-	});
-	if (configuredTargetRefPaths.size === 0) return {
-		resolvedConfig: params.config,
-		diagnostics: [],
-		targetStatesByPath: {},
-		hadUnresolvedTargets: false
-	};
-	const preflight = classifyConfiguredTargetRefs({
-		config: params.config,
-		configuredTargetRefPaths
-	});
-	if (!preflight.hasActiveConfiguredRef && !preflight.hasUnknownConfiguredRef) return {
-		resolvedConfig: params.config,
-		diagnostics: preflight.diagnostics,
-		targetStatesByPath: {},
-		hadUnresolvedTargets: false
-	};
-	let payload;
-	try {
-		payload = await callGateway({
-			config: params.config,
-			method: "secrets.resolve",
-			requiredMethods: ["secrets.resolve"],
-			params: {
-				commandName: params.commandName,
-				targetIds: [...params.targetIds]
-			},
-			timeoutMs: 3e4,
-			clientName: GATEWAY_CLIENT_NAMES.CLI,
-			mode: GATEWAY_CLIENT_MODES.CLI
-		});
-	} catch (err) {
-		try {
-			const fallback = await resolveCommandSecretRefsLocally({
-				config: params.config,
-				commandName: params.commandName,
-				targetIds: params.targetIds,
-				preflightDiagnostics: preflight.diagnostics,
-				mode,
-				allowedPaths: params.allowedPaths
-			});
-			const fallbackMessage = Object.values(fallback.targetStatesByPath).some((state) => state === "resolved_local") && !fallback.hadUnresolvedTargets ? "resolved command secrets locally." : "attempted local command-secret resolution.";
-			return {
-				resolvedConfig: fallback.resolvedConfig,
-				diagnostics: dedupeDiagnostics([...fallback.diagnostics, `${params.commandName}: gateway secrets.resolve unavailable (${formatErrorMessage(err)}); ${fallbackMessage}`]),
-				targetStatesByPath: fallback.targetStatesByPath,
-				hadUnresolvedTargets: fallback.hadUnresolvedTargets
-			};
-		} catch {}
-		if (isUnsupportedSecretsResolveError(err)) throw new Error(`${params.commandName}: active gateway does not support secrets.resolve (${formatErrorMessage(err)}). Update the gateway or run without SecretRefs.`, { cause: err });
-		throw new Error(`${params.commandName}: failed to resolve secrets from the active gateway snapshot (${formatErrorMessage(err)}). Start the gateway and retry.`, { cause: err });
-	}
-	const parsed = parseGatewaySecretsResolveResult(payload);
-	const resolvedConfig = structuredClone(params.config);
-	for (const assignment of parsed.assignments) {
-		const pathSegments = assignment.pathSegments.filter((segment) => segment.length > 0);
-		if (pathSegments.length === 0) continue;
-		try {
-			setPathExistingStrict(resolvedConfig, pathSegments, assignment.value);
-		} catch (err) {
-			const path = pathSegments.join(".");
-			throw new Error(`${params.commandName}: failed to apply resolved secret assignment at ${path} (${formatErrorMessage(err)}).`, { cause: err });
-		}
-	}
-	const inactiveRefPaths = parsed.inactiveRefPaths.length > 0 ? new Set(parsed.inactiveRefPaths) : collectInactiveSurfacePathsFromDiagnostics(parsed.diagnostics);
-	const analyzed = commandSecretGatewayDeps.analyzeCommandSecretAssignmentsFromSnapshot({
-		sourceConfig: params.config,
-		resolvedConfig,
-		targetIds: params.targetIds,
-		inactiveRefPaths,
-		allowedPaths: params.allowedPaths
-	});
-	let diagnostics = dedupeDiagnostics(parsed.diagnostics);
-	const targetStatesByPath = buildTargetStatesByPath({
-		analyzed,
-		resolvedState: "resolved_gateway"
-	});
-	if (analyzed.unresolved.length > 0) try {
-		const localFallback = await resolveCommandSecretRefsLocally({
-			config: params.config,
-			commandName: params.commandName,
-			targetIds: params.targetIds,
-			preflightDiagnostics: [],
-			mode,
-			allowedPaths: new Set(analyzed.unresolved.map((entry) => entry.path))
-		});
-		for (const unresolved of analyzed.unresolved) {
-			if (localFallback.targetStatesByPath[unresolved.path] !== "resolved_local") continue;
-			setPathExistingStrict(resolvedConfig, unresolved.pathSegments, getPath(localFallback.resolvedConfig, unresolved.pathSegments));
-			targetStatesByPath[unresolved.path] = "resolved_local";
-		}
-		const recoveredPaths = new Set(Object.entries(localFallback.targetStatesByPath).filter(([, state]) => state === "resolved_local").map(([path]) => path));
-		const stillUnresolved = analyzed.unresolved.filter((entry) => !recoveredPaths.has(entry.path));
-		if (stillUnresolved.length > 0) {
-			if (enforcesResolvedSecrets(mode)) throw new Error(`${params.commandName}: ${stillUnresolved[0]?.path ?? "target"} is unresolved in the active runtime snapshot.`);
-			scrubUnresolvedAssignments(resolvedConfig, stillUnresolved);
-			diagnostics = dedupeDiagnostics([
-				...diagnostics,
-				...localFallback.diagnostics,
-				...buildUnresolvedDiagnostics(params.commandName, stillUnresolved, mode)
-			]);
-			for (const unresolved of stillUnresolved) targetStatesByPath[unresolved.path] = "unresolved";
-		} else if (recoveredPaths.size > 0) diagnostics = dedupeDiagnostics([...diagnostics, `${params.commandName}: resolved ${recoveredPaths.size} secret ${recoveredPaths.size === 1 ? "path" : "paths"} locally after the gateway snapshot was incomplete.`]);
-	} catch (error) {
-		if (enforcesResolvedSecrets(mode)) throw error;
-		scrubUnresolvedAssignments(resolvedConfig, analyzed.unresolved);
-		diagnostics = dedupeDiagnostics([
-			...diagnostics,
-			`${params.commandName}: local fallback after incomplete gateway snapshot failed (${formatErrorMessage(error)}).`,
-			...buildUnresolvedDiagnostics(params.commandName, analyzed.unresolved, mode)
-		]);
-	}
-	return {
-		resolvedConfig,
-		diagnostics,
-		targetStatesByPath,
-		hadUnresolvedTargets: Object.values(targetStatesByPath).includes("unresolved")
-	};
-}
-//#endregion
-export { collectCommandSecretAssignmentsFromSnapshot as n, resolveCommandSecretRefsViaGateway as t };

package/dist/command-status.runtime-Wz0v1rTj.js

@@ -1,87 +0,0 @@
-import { h as listAgentEntries, p as resolveSessionAgentId } from "./agent-scope-BUYwVohk.js";
-import { o as resolveDefaultModelForAgent } from "./model-selection-D-mV4REq.js";
-import { a as loadSessionEntry } from "./session-utils-Dkaj_4dZ.js";
-import { t as resolveDefaultModel } from "./directive-handling.defaults-Bd8tzcyu.js";
-import { n as createModelSelectionState } from "./model-selection-BDK7dEju.js";
-import { t as buildStatusReply } from "./commands-status-OROpaZRA.js";
-import { t as resolveCurrentDirectiveLevels } from "./directive-handling.levels-DCxzxDs5.js";
-//#region src/plugin-sdk/command-status.runtime.ts
-async function resolveDirectStatusReplyForSession(params) {
-	const requestedSessionKey = params.sessionKey.trim();
-	if (!requestedSessionKey) return;
-	const statusLoaded = loadSessionEntry(requestedSessionKey);
-	const statusCfg = statusLoaded.cfg ?? params.cfg;
-	const statusSessionKey = statusLoaded.canonicalKey;
-	const statusEntry = statusLoaded.entry;
-	const statusAgentId = resolveSessionAgentId({
-		sessionKey: statusSessionKey,
-		config: statusCfg
-	});
-	const agentCfg = statusCfg.agents?.defaults;
-	const agentEntry = listAgentEntries(statusCfg).find((entry) => entry.id?.trim().toLowerCase() === statusAgentId);
-	const statusModel = resolveDefaultModelForAgent({
-		cfg: statusCfg,
-		agentId: statusAgentId
-	});
-	const { defaultProvider, defaultModel } = resolveDefaultModel({
-		cfg: statusCfg,
-		agentId: statusAgentId
-	});
-	const selectedProvider = statusEntry?.providerOverride?.trim() || statusEntry?.modelProvider?.trim() || statusModel.provider;
-	const selectedModel = statusEntry?.modelOverride?.trim() || statusEntry?.model?.trim() || statusModel.model;
-	const modelState = await createModelSelectionState({
-		cfg: statusCfg,
-		agentId: statusAgentId,
-		agentCfg,
-		sessionEntry: statusEntry,
-		sessionStore: statusLoaded.store,
-		sessionKey: statusSessionKey,
-		parentSessionKey: statusEntry?.parentSessionKey,
-		storePath: statusLoaded.storePath,
-		defaultProvider,
-		defaultModel,
-		provider: selectedProvider,
-		model: selectedModel,
-		hasModelDirective: false
-	});
-	const { currentThinkLevel, currentFastMode, currentVerboseLevel, currentReasoningLevel, currentElevatedLevel } = await resolveCurrentDirectiveLevels({
-		sessionEntry: statusEntry,
-		agentEntry,
-		agentCfg,
-		resolveDefaultThinkingLevel: () => modelState.resolveDefaultThinkingLevel()
-	});
-	let resolvedReasoningLevel = currentReasoningLevel;
-	const hasAgentReasoningDefault = agentEntry?.reasoningDefault !== void 0 && agentEntry.reasoningDefault !== null;
-	if (!(statusEntry?.reasoningLevel !== void 0 && statusEntry.reasoningLevel !== null || hasAgentReasoningDefault) && resolvedReasoningLevel === "off" && currentThinkLevel === "off") resolvedReasoningLevel = await modelState.resolveDefaultReasoningLevel();
-	return await buildStatusReply({
-		cfg: statusCfg,
-		command: {
-			surface: params.channel,
-			channel: params.channel,
-			ownerList: [],
-			senderIsOwner: params.senderIsOwner,
-			isAuthorizedSender: params.isAuthorizedSender,
-			senderId: params.senderId,
-			rawBodyNormalized: "/status",
-			commandBodyNormalized: "/status"
-		},
-		sessionEntry: statusEntry,
-		sessionKey: statusSessionKey,
-		parentSessionKey: statusEntry?.parentSessionKey,
-		sessionScope: statusCfg.session?.scope,
-		storePath: statusLoaded.storePath,
-		provider: selectedProvider,
-		model: selectedModel,
-		contextTokens: statusEntry?.contextTokens ?? 0,
-		resolvedThinkLevel: currentThinkLevel,
-		resolvedFastMode: currentFastMode,
-		resolvedVerboseLevel: currentVerboseLevel ?? "off",
-		resolvedReasoningLevel,
-		resolvedElevatedLevel: currentElevatedLevel,
-		resolveDefaultThinkingLevel: () => modelState.resolveDefaultThinkingLevel(),
-		isGroup: params.isGroup,
-		defaultGroupActivation: params.defaultGroupActivation
-	});
-}
-//#endregion
-export { resolveDirectStatusReplyForSession };

package/dist/commands-acp-CTKWdZFc.js

@@ -1,77 +0,0 @@
-import { r as logVerbose } from "./globals-wYf9_gv5.js";
-import { a as requireGatewayClientScopeForInternalChannel } from "./command-gates-CUn1Hdn-.js";
-import { C as stopWithText, b as resolveAcpAction, d as COMMAND, x as resolveAcpHelpText } from "./shared-vl8ySAcJ.js";
-//#region src/auto-reply/reply/commands-acp.ts
-let lifecycleHandlersPromise;
-let runtimeOptionHandlersPromise;
-let diagnosticHandlersPromise;
-async function loadAcpActionHandler(action) {
-	if (action === "spawn" || action === "cancel" || action === "steer" || action === "close") {
-		lifecycleHandlersPromise ??= import("./lifecycle-CW2vdQDb.js");
-		const handlers = await lifecycleHandlersPromise;
-		return {
-			spawn: handlers.handleAcpSpawnAction,
-			cancel: handlers.handleAcpCancelAction,
-			steer: handlers.handleAcpSteerAction,
-			close: handlers.handleAcpCloseAction
-		}[action];
-	}
-	if (action === "status" || action === "set-mode" || action === "set" || action === "cwd" || action === "permissions" || action === "timeout" || action === "model" || action === "reset-options") {
-		runtimeOptionHandlersPromise ??= import("./runtime-options-DvpcqD1R.js");
-		const handlers = await runtimeOptionHandlersPromise;
-		return {
-			status: handlers.handleAcpStatusAction,
-			"set-mode": handlers.handleAcpSetModeAction,
-			set: handlers.handleAcpSetAction,
-			cwd: handlers.handleAcpCwdAction,
-			permissions: handlers.handleAcpPermissionsAction,
-			timeout: handlers.handleAcpTimeoutAction,
-			model: handlers.handleAcpModelAction,
-			"reset-options": handlers.handleAcpResetOptionsAction
-		}[action];
-	}
-	diagnosticHandlersPromise ??= import("./diagnostics-3KiMYFlv.js");
-	const handlers = await diagnosticHandlersPromise;
-	return {
-		doctor: handlers.handleAcpDoctorAction,
-		install: async (params, tokens) => handlers.handleAcpInstallAction(params, tokens),
-		sessions: async (params, tokens) => handlers.handleAcpSessionsAction(params, tokens)
-	}[action];
-}
-const ACP_MUTATING_ACTIONS = new Set([
-	"spawn",
-	"cancel",
-	"steer",
-	"close",
-	"status",
-	"set-mode",
-	"set",
-	"cwd",
-	"permissions",
-	"timeout",
-	"model",
-	"reset-options"
-]);
-const handleAcpCommand = async (params, allowTextCommands) => {
-	if (!allowTextCommands) return null;
-	const normalized = params.command.commandBodyNormalized;
-	if (!normalized.startsWith("/acp")) return null;
-	if (!params.command.isAuthorizedSender) {
-		logVerbose(`Ignoring /acp from unauthorized sender: ${params.command.senderId || "<unknown>"}`);
-		return { shouldContinue: false };
-	}
-	const tokens = normalized.slice(COMMAND.length).trim().split(/\s+/).filter(Boolean);
-	const action = resolveAcpAction(tokens);
-	if (action === "help") return stopWithText(resolveAcpHelpText());
-	if (ACP_MUTATING_ACTIONS.has(action)) {
-		const scopeBlock = requireGatewayClientScopeForInternalChannel(params, {
-			label: "/acp",
-			allowedScopes: ["operator.admin"],
-			missingText: "This /acp action requires operator.admin on the internal channel."
-		});
-		if (scopeBlock) return scopeBlock;
-	}
-	return await (await loadAcpActionHandler(action))(params, tokens);
-};
-//#endregion
-export { handleAcpCommand as t };