@qqbrowser/openclaw-qbot 0.0.127 → 0.0.129

package/dist/runtime-web-tools-BWv0X5qp.js

@@ -1 +1 @@
-import{Wi as e,cu as t,do as n,fo as r,lo as i,po as a}from"./auth-profiles-BhXA8Jy2.js";import{d as o,i as s}from"./types.secrets-D4tbc3Wq.js";import{jt as c}from"./plugins-DNlgeTTc.js";import{isDeepStrictEqual as l}from"node:util";function u(e){return/^\d+$/.test(e)}function d(e){return u(e)?`array`:`object`}function f(e,t,n){if(!Array.isArray(e))return null;if(!u(t))throw Error(`Invalid array index segment "${t}" at ${n.join(`.`)}.`);return{array:e,index:Number.parseInt(t,10)}}function p(e){if(e.segments.length===0)throw Error(`Target path is empty.`);let t=e.root;for(let n=0;n<e.segments.length-1;n+=1){let i=e.segments[n]??``;if(Array.isArray(t)){if(!u(i))throw Error(`Invalid array index segment "${i}" at ${e.segments.join(`.`)}.`);let r=Number.parseInt(i,10);if(e.requireExistingSegment&&(r<0||r>=t.length))throw Error(`Path segment does not exist at ${e.segments.slice(0,n+1).join(`.`)}.`);t=t[r];continue}if(!r(t))throw Error(`Invalid path shape at ${e.segments.slice(0,n).join(`.`)||`<root>`}.`);if(e.requireExistingSegment&&!Object.prototype.hasOwnProperty.call(t,i))throw Error(`Path segment does not exist at ${e.segments.slice(0,n+1).join(`.`)}.`);t=t[i]}return t}function m(e,t){if(t.length===0)return;let n=e;for(let e of t){if(Array.isArray(n)){if(!u(e))return;n=n[Number.parseInt(e,10)];continue}if(!r(n))return;n=n[e]}return n}function h(e,t,n){if(t.length===0)throw Error(`Target path is empty.`);let i=e,a=!1;for(let e=0;e<t.length-1;e+=1){let n=t[e]??``,o=d(t[e+1]??``);if(Array.isArray(i)){if(!u(n))throw Error(`Invalid array index segment "${n}" at ${t.join(`.`)}.`);let s=Number.parseInt(n,10),c=i[s];if(c==null)i[s]=o===`array`?[]:{},a=!0;else if(o===`array`?!Array.isArray(c):!r(c))throw Error(`Invalid path shape at ${t.slice(0,e+1).join(`.`)}.`);i=i[s];continue}if(!r(i))throw Error(`Invalid path shape at ${t.slice(0,e).join(`.`)||`<root>`}.`);let s=i[n];if(s==null)i[n]=o===`array`?[]:{},a=!0;else if(o===`array`?!Array.isArray(s):!r(s))throw Error(`Invalid path shape at ${t.slice(0,e+1).join(`.`)}.`);i=i[n]}let o=t[t.length-1]??``,s=f(i,o,t);if(s)return l(s.array[s.index],n)||(s.array[s.index]=n,a=!0),a;if(!r(i))throw Error(`Invalid path shape at ${t.slice(0,-1).join(`.`)||`<root>`}.`);return l(i[o],n)||(i[o]=n,a=!0),a}function g(e,t,n){let i=p({root:e,segments:t,requireExistingSegment:!0}),a=t[t.length-1]??``,o=f(i,a,t);if(o){if(o.index<0||o.index>=o.array.length)throw Error(`Path segment does not exist at ${t.join(`.`)}.`);return l(o.array[o.index],n)?!1:(o.array[o.index]=n,!0)}if(!r(i))throw Error(`Invalid path shape at ${t.slice(0,-1).join(`.`)||`<root>`}.`);if(!Object.prototype.hasOwnProperty.call(i,a))throw Error(`Path segment does not exist at ${t.join(`.`)}.`);return l(i[a],n)?!1:(i[a]=n,!0)}function _(e,t){let n=p({root:e,segments:t,requireExistingSegment:!1}),i=t[t.length-1]??``,a=f(n,i,t);if(a)return a.index<0||a.index>=a.array.length?!1:(a.array.splice(a.index,1),!0);if(!r(n))throw Error(`Invalid path shape at ${t.slice(0,-1).join(`.`)||`<root>`}.`);return Object.prototype.hasOwnProperty.call(n,i)?(delete n[i],!0):!1}function v(e,t){return t===`string`?n(e):n(e)||r(e)}function ee(e,t){return t===`string`?n(e):n(e)||r(e)&&Object.keys(e).length>0}function y(e){if(!v(e.value,e.expected))throw Error(e.errorMessage)}const b=`secret_input`,x=`sibling_ref`,te=[{id:`auth-profiles.api_key.key`,targetType:`auth-profiles.api_key.key`,configFile:`auth-profiles.json`,pathPattern:`profiles.*.key`,refPathPattern:`profiles.*.keyRef`,secretShape:x,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0,authProfileType:`api_key`},{id:`auth-profiles.token.token`,targetType:`auth-profiles.token.token`,configFile:`auth-profiles.json`,pathPattern:`profiles.*.token`,refPathPattern:`profiles.*.tokenRef`,secretShape:x,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0,authProfileType:`token`},{id:`agents.defaults.memorySearch.remote.apiKey`,targetType:`agents.defaults.memorySearch.remote.apiKey`,configFile:`openclaw.json`,pathPattern:`agents.defaults.memorySearch.remote.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`agents.list[].memorySearch.remote.apiKey`,targetType:`agents.list[].memorySearch.remote.apiKey`,configFile:`openclaw.json`,pathPattern:`agents.list[].memorySearch.remote.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.bluebubbles.accounts.*.password`,targetType:`channels.bluebubbles.accounts.*.password`,configFile:`openclaw.json`,pathPattern:`channels.bluebubbles.accounts.*.password`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.bluebubbles.password`,targetType:`channels.bluebubbles.password`,configFile:`openclaw.json`,pathPattern:`channels.bluebubbles.password`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.discord.accounts.*.pluralkit.token`,targetType:`channels.discord.accounts.*.pluralkit.token`,configFile:`openclaw.json`,pathPattern:`channels.discord.accounts.*.pluralkit.token`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.discord.accounts.*.token`,targetType:`channels.discord.accounts.*.token`,configFile:`openclaw.json`,pathPattern:`channels.discord.accounts.*.token`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.discord.accounts.*.voice.tts.elevenlabs.apiKey`,targetType:`channels.discord.accounts.*.voice.tts.elevenlabs.apiKey`,configFile:`openclaw.json`,pathPattern:`channels.discord.accounts.*.voice.tts.elevenlabs.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.discord.accounts.*.voice.tts.openai.apiKey`,targetType:`channels.discord.accounts.*.voice.tts.openai.apiKey`,configFile:`openclaw.json`,pathPattern:`channels.discord.accounts.*.voice.tts.openai.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.discord.pluralkit.token`,targetType:`channels.discord.pluralkit.token`,configFile:`openclaw.json`,pathPattern:`channels.discord.pluralkit.token`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.discord.token`,targetType:`channels.discord.token`,configFile:`openclaw.json`,pathPattern:`channels.discord.token`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.discord.voice.tts.elevenlabs.apiKey`,targetType:`channels.discord.voice.tts.elevenlabs.apiKey`,configFile:`openclaw.json`,pathPattern:`channels.discord.voice.tts.elevenlabs.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.discord.voice.tts.openai.apiKey`,targetType:`channels.discord.voice.tts.openai.apiKey`,configFile:`openclaw.json`,pathPattern:`channels.discord.voice.tts.openai.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.feishu.accounts.*.appSecret`,targetType:`channels.feishu.accounts.*.appSecret`,configFile:`openclaw.json`,pathPattern:`channels.feishu.accounts.*.appSecret`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.feishu.accounts.*.verificationToken`,targetType:`channels.feishu.accounts.*.verificationToken`,configFile:`openclaw.json`,pathPattern:`channels.feishu.accounts.*.verificationToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.feishu.appSecret`,targetType:`channels.feishu.appSecret`,configFile:`openclaw.json`,pathPattern:`channels.feishu.appSecret`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.feishu.verificationToken`,targetType:`channels.feishu.verificationToken`,configFile:`openclaw.json`,pathPattern:`channels.feishu.verificationToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.googlechat.accounts.*.serviceAccount`,targetType:`channels.googlechat.serviceAccount`,targetTypeAliases:[`channels.googlechat.accounts.*.serviceAccount`],configFile:`openclaw.json`,pathPattern:`channels.googlechat.accounts.*.serviceAccount`,refPathPattern:`channels.googlechat.accounts.*.serviceAccountRef`,secretShape:x,expectedResolvedValue:`string-or-object`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0,accountIdPathSegmentIndex:3},{id:`channels.googlechat.serviceAccount`,targetType:`channels.googlechat.serviceAccount`,configFile:`openclaw.json`,pathPattern:`channels.googlechat.serviceAccount`,refPathPattern:`channels.googlechat.serviceAccountRef`,secretShape:x,expectedResolvedValue:`string-or-object`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.irc.accounts.*.nickserv.password`,targetType:`channels.irc.accounts.*.nickserv.password`,configFile:`openclaw.json`,pathPattern:`channels.irc.accounts.*.nickserv.password`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.irc.accounts.*.password`,targetType:`channels.irc.accounts.*.password`,configFile:`openclaw.json`,pathPattern:`channels.irc.accounts.*.password`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.irc.nickserv.password`,targetType:`channels.irc.nickserv.password`,configFile:`openclaw.json`,pathPattern:`channels.irc.nickserv.password`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.irc.password`,targetType:`channels.irc.password`,configFile:`openclaw.json`,pathPattern:`channels.irc.password`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.mattermost.accounts.*.botToken`,targetType:`channels.mattermost.accounts.*.botToken`,configFile:`openclaw.json`,pathPattern:`channels.mattermost.accounts.*.botToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.mattermost.botToken`,targetType:`channels.mattermost.botToken`,configFile:`openclaw.json`,pathPattern:`channels.mattermost.botToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.matrix.accounts.*.password`,targetType:`channels.matrix.accounts.*.password`,configFile:`openclaw.json`,pathPattern:`channels.matrix.accounts.*.password`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.matrix.password`,targetType:`channels.matrix.password`,configFile:`openclaw.json`,pathPattern:`channels.matrix.password`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.msteams.appPassword`,targetType:`channels.msteams.appPassword`,configFile:`openclaw.json`,pathPattern:`channels.msteams.appPassword`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.nextcloud-talk.accounts.*.apiPassword`,targetType:`channels.nextcloud-talk.accounts.*.apiPassword`,configFile:`openclaw.json`,pathPattern:`channels.nextcloud-talk.accounts.*.apiPassword`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.nextcloud-talk.accounts.*.botSecret`,targetType:`channels.nextcloud-talk.accounts.*.botSecret`,configFile:`openclaw.json`,pathPattern:`channels.nextcloud-talk.accounts.*.botSecret`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.nextcloud-talk.apiPassword`,targetType:`channels.nextcloud-talk.apiPassword`,configFile:`openclaw.json`,pathPattern:`channels.nextcloud-talk.apiPassword`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.nextcloud-talk.botSecret`,targetType:`channels.nextcloud-talk.botSecret`,configFile:`openclaw.json`,pathPattern:`channels.nextcloud-talk.botSecret`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.slack.accounts.*.appToken`,targetType:`channels.slack.accounts.*.appToken`,configFile:`openclaw.json`,pathPattern:`channels.slack.accounts.*.appToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.slack.accounts.*.botToken`,targetType:`channels.slack.accounts.*.botToken`,configFile:`openclaw.json`,pathPattern:`channels.slack.accounts.*.botToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.slack.accounts.*.signingSecret`,targetType:`channels.slack.accounts.*.signingSecret`,configFile:`openclaw.json`,pathPattern:`channels.slack.accounts.*.signingSecret`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.slack.accounts.*.userToken`,targetType:`channels.slack.accounts.*.userToken`,configFile:`openclaw.json`,pathPattern:`channels.slack.accounts.*.userToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.slack.appToken`,targetType:`channels.slack.appToken`,configFile:`openclaw.json`,pathPattern:`channels.slack.appToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.slack.botToken`,targetType:`channels.slack.botToken`,configFile:`openclaw.json`,pathPattern:`channels.slack.botToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.slack.signingSecret`,targetType:`channels.slack.signingSecret`,configFile:`openclaw.json`,pathPattern:`channels.slack.signingSecret`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.slack.userToken`,targetType:`channels.slack.userToken`,configFile:`openclaw.json`,pathPattern:`channels.slack.userToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.telegram.accounts.*.botToken`,targetType:`channels.telegram.accounts.*.botToken`,configFile:`openclaw.json`,pathPattern:`channels.telegram.accounts.*.botToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.telegram.accounts.*.webhookSecret`,targetType:`channels.telegram.accounts.*.webhookSecret`,configFile:`openclaw.json`,pathPattern:`channels.telegram.accounts.*.webhookSecret`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.telegram.botToken`,targetType:`channels.telegram.botToken`,configFile:`openclaw.json`,pathPattern:`channels.telegram.botToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.telegram.webhookSecret`,targetType:`channels.telegram.webhookSecret`,configFile:`openclaw.json`,pathPattern:`channels.telegram.webhookSecret`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.zalo.accounts.*.botToken`,targetType:`channels.zalo.accounts.*.botToken`,configFile:`openclaw.json`,pathPattern:`channels.zalo.accounts.*.botToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.zalo.accounts.*.webhookSecret`,targetType:`channels.zalo.accounts.*.webhookSecret`,configFile:`openclaw.json`,pathPattern:`channels.zalo.accounts.*.webhookSecret`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.zalo.botToken`,targetType:`channels.zalo.botToken`,configFile:`openclaw.json`,pathPattern:`channels.zalo.botToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.zalo.webhookSecret`,targetType:`channels.zalo.webhookSecret`,configFile:`openclaw.json`,pathPattern:`channels.zalo.webhookSecret`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`cron.webhookToken`,targetType:`cron.webhookToken`,configFile:`openclaw.json`,pathPattern:`cron.webhookToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`gateway.auth.token`,targetType:`gateway.auth.token`,configFile:`openclaw.json`,pathPattern:`gateway.auth.token`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`gateway.auth.password`,targetType:`gateway.auth.password`,configFile:`openclaw.json`,pathPattern:`gateway.auth.password`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`gateway.remote.password`,targetType:`gateway.remote.password`,configFile:`openclaw.json`,pathPattern:`gateway.remote.password`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`gateway.remote.token`,targetType:`gateway.remote.token`,configFile:`openclaw.json`,pathPattern:`gateway.remote.token`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`messages.tts.elevenlabs.apiKey`,targetType:`messages.tts.elevenlabs.apiKey`,configFile:`openclaw.json`,pathPattern:`messages.tts.elevenlabs.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`messages.tts.openai.apiKey`,targetType:`messages.tts.openai.apiKey`,configFile:`openclaw.json`,pathPattern:`messages.tts.openai.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`models.providers.*.apiKey`,targetType:`models.providers.apiKey`,targetTypeAliases:[`models.providers.*.apiKey`],configFile:`openclaw.json`,pathPattern:`models.providers.*.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0,providerIdPathSegmentIndex:2,trackProviderShadowing:!0},{id:`models.providers.*.headers.*`,targetType:`models.providers.headers`,targetTypeAliases:[`models.providers.*.headers.*`],configFile:`openclaw.json`,pathPattern:`models.providers.*.headers.*`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0,providerIdPathSegmentIndex:2},{id:`skills.entries.*.apiKey`,targetType:`skills.entries.apiKey`,targetTypeAliases:[`skills.entries.*.apiKey`],configFile:`openclaw.json`,pathPattern:`skills.entries.*.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`talk.apiKey`,targetType:`talk.apiKey`,configFile:`openclaw.json`,pathPattern:`talk.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`talk.providers.*.apiKey`,targetType:`talk.providers.*.apiKey`,configFile:`openclaw.json`,pathPattern:`talk.providers.*.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`tools.web.fetch.firecrawl.apiKey`,targetType:`tools.web.fetch.firecrawl.apiKey`,configFile:`openclaw.json`,pathPattern:`tools.web.fetch.firecrawl.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`tools.web.search.apiKey`,targetType:`tools.web.search.apiKey`,configFile:`openclaw.json`,pathPattern:`tools.web.search.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`tools.web.search.gemini.apiKey`,targetType:`tools.web.search.gemini.apiKey`,configFile:`openclaw.json`,pathPattern:`tools.web.search.gemini.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`tools.web.search.grok.apiKey`,targetType:`tools.web.search.grok.apiKey`,configFile:`openclaw.json`,pathPattern:`tools.web.search.grok.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`tools.web.search.kimi.apiKey`,targetType:`tools.web.search.kimi.apiKey`,configFile:`openclaw.json`,pathPattern:`tools.web.search.kimi.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`tools.web.search.perplexity.apiKey`,targetType:`tools.web.search.perplexity.apiKey`,configFile:`openclaw.json`,pathPattern:`tools.web.search.perplexity.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0}];function S(e){return e.filter(e=>e.kind===`wildcard`||e.kind===`array`).length}function C(e){return a(e).map(t=>{if(t===`*`)return{kind:`wildcard`};if(t.endsWith(`[]`)){let n=t.slice(0,-2).trim();if(!n)throw Error(`Invalid target path pattern: ${e}`);return{kind:`array`,field:n}}return{kind:`literal`,value:t}})}function ne(e){let t=C(e.pathPattern),n=S(t),r=e.refPathPattern?C(e.refPathPattern):void 0,i=r?S(r):0;if(e.secretShape===`sibling_ref`&&!r)throw Error(`Missing refPathPattern for sibling_ref target: ${e.id}`);if(r&&i!==n)throw Error(`Mismatched wildcard shape for target ref path: ${e.id}`);return{...e,pathTokens:t,pathDynamicTokenCount:n,refPathTokens:r,refPathDynamicTokenCount:i}}function re(e,t){let n=[],r=0;for(let i of t){if(i.kind===`literal`){if(e[r]!==i.value)return null;r+=1;continue}if(i.kind===`wildcard`){let t=e[r];if(!t)return null;n.push(t),r+=1;continue}if(e[r]!==i.field)return null;let t=e[r+1];if(!t||!/^\d+$/.test(t))return null;n.push(t),r+=2}return r===e.length?{captures:n}:null}function ie(e,t){let n=[],r=0;for(let i of e){if(i.kind===`literal`){n.push(i.value);continue}if(i.kind===`wildcard`){let e=t[r];if(!e)return null;n.push(e),r+=1;continue}let e=t[r];if(!e||!/^\d+$/.test(e))return null;n.push(i.field,e),r+=1}return r===t.length?n:null}function ae(e,t){let n=[],i=(e,a,o,s)=>{let c=t[a];if(!c){n.push({segments:o,captures:s,value:e});return}let l=a===t.length-1;if(c.kind===`literal`){if(!r(e))return;if(l){n.push({segments:[...o,c.value],captures:s,value:e[c.value]});return}if(!Object.prototype.hasOwnProperty.call(e,c.value))return;i(e[c.value],a+1,[...o,c.value],s);return}if(c.kind===`wildcard`){if(!r(e))return;for(let[t,r]of Object.entries(e)){if(l){n.push({segments:[...o,t],captures:[...s,t],value:r});continue}i(r,a+1,[...o,t],[...s,t])}return}if(!r(e))return;let u=e[c.field];if(Array.isArray(u))for(let e=0;e<u.length;e+=1){let t=u[e],r=String(e);if(l){n.push({segments:[...o,c.field,r],captures:[...s,r],value:t});continue}i(t,a+1,[...o,c.field,r],[...s,r])}};return i(e,0,[],[]),n}const w=te.map(ne),oe=w.filter(e=>e.configFile===`openclaw.json`),se=w.filter(e=>e.configFile===`auth-profiles.json`);function ce(){let e=new Map,t=(t,n)=>{let r=e.get(t);if(r){r.push(n);return}e.set(t,[n])};for(let e of w){t(e.targetType,e);for(let n of e.targetTypeAliases??[])t(n,e)}return e}const le=ce(),ue=new Set(w.map(e=>e.id));function de(){let e=new Map;for(let t of oe){let n=e.get(t.id);if(n){n.push(t);continue}e.set(t.id,[t])}return e}const fe=de();function pe(){let e=new Map;for(let t of se){let n=e.get(t.id);if(n){n.push(t);continue}e.set(t.id,[t])}return e}const me=pe();function T(e){return e===void 0?null:new Set(Array.from(e).map(e=>e.trim()).filter(e=>e.length>0))}function E(e){return e.allowedTargetIds===null?e.defaultEntries:Array.from(e.allowedTargetIds).flatMap(t=>e.entriesById.get(t)??[])}function D(e,t){let n=[],r=new Set;for(let i of t){let t=ae(e,i.pathTokens);for(let a of t){let t=O(i,a.segments,a.captures);if(!t)continue;let o=`${i.id}:${t.pathSegments.join(`.`)}`;if(r.has(o))continue;r.add(o);let s=t.refPathSegments?m(e,t.refPathSegments):void 0;n.push({entry:i,path:t.pathSegments.join(`.`),pathSegments:t.pathSegments,...t.refPathSegments?{refPathSegments:t.refPathSegments,refPath:t.refPathSegments.join(`.`)}:{},value:a.value,...t.providerId?{providerId:t.providerId}:{},...t.accountId?{accountId:t.accountId}:{},...t.refPathSegments?{refValue:s}:{}})}}return n}function O(e,t,n){let r=e.providerIdPathSegmentIndex===void 0?void 0:t[e.providerIdPathSegmentIndex],i=e.accountIdPathSegmentIndex===void 0?void 0:t[e.accountIdPathSegmentIndex],a=e.refPathTokens?ie(e.refPathTokens,n):void 0;return e.refPathTokens&&!a?null:{entry:e,pathSegments:t,...a?{refPathSegments:a}:{},...r?{providerId:r}:{},...i?{accountId:i}:{}}}function he(){return w.map(e=>({id:e.id,targetType:e.targetType,...e.targetTypeAliases?{targetTypeAliases:[...e.targetTypeAliases]}:{},configFile:e.configFile,pathPattern:e.pathPattern,...e.refPathPattern?{refPathPattern:e.refPathPattern}:{},secretShape:e.secretShape,expectedResolvedValue:e.expectedResolvedValue,includeInPlan:e.includeInPlan,includeInConfigure:e.includeInConfigure,includeInAudit:e.includeInAudit,...e.providerIdPathSegmentIndex===void 0?{}:{providerIdPathSegmentIndex:e.providerIdPathSegmentIndex},...e.accountIdPathSegmentIndex===void 0?{}:{accountIdPathSegmentIndex:e.accountIdPathSegmentIndex},...e.authProfileType?{authProfileType:e.authProfileType}:{},...e.trackProviderShadowing?{trackProviderShadowing:!0}:{}}))}function ge(e){return typeof e==`string`&&le.has(e)}function _e(e){return typeof e==`string`&&ue.has(e)}function ve(e){let t=le.get(e.type);if(!t||t.length===0)return null;for(let n of t){if(!n.includeInPlan)continue;let t=re(e.pathSegments,n.pathTokens);if(!t)continue;let r=O(n,e.pathSegments,t.captures);if(r&&!(e.providerId&&e.providerId.trim().length>0&&(!r.providerId||r.providerId!==e.providerId))&&!(e.accountId&&e.accountId.trim().length>0&&(!r.accountId||r.accountId!==e.accountId)))return r}return null}function ye(e){return k(e)}function k(e,t){return D(e,E({allowedTargetIds:T(t),defaultEntries:oe,entriesById:fe}))}function be(e){return xe(e)}function xe(e,t){return D(e,E({allowedTargetIds:T(t),defaultEntries:se,entriesById:me}))}function Se(){return w.filter(e=>e.configFile===`auth-profiles.json`&&e.includeInAudit)}function A(e){let t=e.sourceConfig.secrets?.defaults,n=[],r=[],i=[],a=[];for(let c of k(e.sourceConfig,e.targetIds)){if(e.allowedPaths&&!e.allowedPaths.has(c.path))continue;let{explicitRef:l,ref:u}=o({value:c.value,refValue:c.refValue,defaults:t}),d=l?s(c.value,t):null;if(!u)continue;let f=m(e.resolvedConfig,c.pathSegments);if(!v(f,c.entry.expectedResolvedValue)){if(e.inactiveRefPaths?.has(c.path)){r.push(`${c.path}: secret ref is configured on an inactive surface; skipping command-time assignment.`),a.push({path:c.path,pathSegments:[...c.pathSegments]});continue}i.push({path:c.path,pathSegments:[...c.pathSegments]});continue}n.push({path:c.path,pathSegments:[...c.pathSegments],value:f}),c.entry.secretShape===`sibling_ref`&&l&&d&&r.push(`${c.path}: both inline and sibling ref were present; sibling ref took precedence.`)}return{assignments:n,diagnostics:r,unresolved:i,inactive:a}}function Ce(e){let t=A({sourceConfig:e.sourceConfig,resolvedConfig:e.resolvedConfig,targetIds:e.targetIds,inactiveRefPaths:e.inactiveRefPaths,allowedPaths:e.allowedPaths});if(t.unresolved.length>0)throw Error(`${e.commandName}: ${t.unresolved[0]?.path??`target`} is unresolved in the active runtime snapshot.`);return{assignments:t.assignments,diagnostics:t.diagnostics}}function we(e){return{sourceConfig:e.sourceConfig,env:e.env,cache:{},warnings:[],warningKeys:new Set,assignments:[]}}function j(e,t){e.assignments.push(t)}function M(e,t){let n=`${t.code}:${t.path}:${t.message}`;e.warningKeys.has(n)||(e.warningKeys.add(n),e.warnings.push(t))}function N(e){M(e.context,{code:`SECRETS_REF_IGNORED_INACTIVE_SURFACE`,path:e.path,message:e.details&&e.details.trim().length>0?`${e.path}: ${e.details}`:`${e.path}: secret ref is configured on an inactive surface; skipping resolution until it becomes active.`})}function P(e){let t=s(e.value,e.defaults);if(t){if(e.active===!1){N({context:e.context,path:e.path,details:e.inactiveReason});return}j(e.context,{ref:t,path:e.path,expected:e.expected,apply:e.apply})}}function Te(e){for(let t of e.assignments){let n=c(t.ref);if(!e.resolved.has(n))throw Error(`Secret reference "${n}" resolved to no value.`);let r=e.resolved.get(n);y({value:r,expected:t.expected,errorMessage:t.expected===`string`?`${t.path} resolved to a non-string or empty value.`:`${t.path} resolved to an unsupported value type.`}),t.apply(r)}}function F(e,t){return Object.prototype.hasOwnProperty.call(e,t)}function I(e){return r(e)?e.enabled!==!1:!0}function Ee(e,t){return I(e)&&I(t)}function L(e){let t=e.tts.elevenlabs;r(t)&&P({value:t.apiKey,path:`${e.pathPrefix}.elevenlabs.apiKey`,expected:`string`,defaults:e.defaults,context:e.context,active:e.active,inactiveReason:e.inactiveReason,apply:e=>{t.apiKey=e}});let n=e.tts.openai;r(n)&&P({value:n.apiKey,path:`${e.pathPrefix}.openai.apiKey`,expected:`string`,defaults:e.defaults,context:e.context,active:e.active,inactiveReason:e.inactiveReason,apply:e=>{n.apiKey=e}})}function R(e){let t=I(e),n=e.accounts;if(!r(n)||Object.keys(n).length===0)return{hasExplicitAccounts:!1,channelEnabled:t,accounts:[{accountId:`default`,account:e,enabled:t}]};let i=[];for(let[t,a]of Object.entries(n))r(a)&&i.push({accountId:t,account:a,enabled:Ee(e,a)});return{hasExplicitAccounts:!0,channelEnabled:t,accounts:i}}function z(e,t){return e.channelEnabled?e.hasExplicitAccounts?e.accounts.some(({account:e,enabled:n})=>n&&!F(e,t)):!0:!1}function B(e){return typeof e==`string`?e.trim():``}function V(e,t){return B(e).length>0||s(e,t)!==null}function H(e){if(P({value:e.channel[e.field],path:`channels.${e.channelKey}.${e.field}`,expected:`string`,defaults:e.defaults,context:e.context,active:z(e.surface,e.field),inactiveReason:e.topInactiveReason,apply:t=>{e.channel[e.field]=t}}),e.surface.hasExplicitAccounts)for(let{accountId:t,account:n,enabled:r}of e.surface.accounts)F(n,e.field)&&P({value:n[e.field],path:`channels.${e.channelKey}.accounts.${t}.${e.field}`,expected:`string`,defaults:e.defaults,context:e.context,active:r,inactiveReason:e.accountInactiveReason,apply:t=>{n[e.field]=t}})}function De(e){let t=e.config.channels;if(!r(t))return;let n=t.telegram;if(!r(n))return;let i=R(n),a=typeof n.tokenFile==`string`?n.tokenFile.trim():``,o=i.channelEnabled?i.hasExplicitAccounts?i.accounts.some(({account:t,enabled:n})=>{if(!n||a.length>0)return!1;let r=V(t.botToken,e.defaults),i=typeof t.tokenFile==`string`&&t.tokenFile.trim().length>0;return!r&&!i}):a.length===0:!1;if(P({value:n.botToken,path:`channels.telegram.botToken`,expected:`string`,defaults:e.defaults,context:e.context,active:o,inactiveReason:`no enabled Telegram surface inherits this top-level botToken (tokenFile is configured).`,apply:e=>{n.botToken=e}}),i.hasExplicitAccounts)for(let{accountId:t,account:n,enabled:r}of i.accounts){if(!F(n,`botToken`))continue;let i=typeof n.tokenFile==`string`?n.tokenFile.trim():``;P({value:n.botToken,path:`channels.telegram.accounts.${t}.botToken`,expected:`string`,defaults:e.defaults,context:e.context,active:r&&i.length===0,inactiveReason:`Telegram account is disabled or tokenFile is configured.`,apply:e=>{n.botToken=e}})}let s=typeof n.webhookUrl==`string`?n.webhookUrl.trim():``,c=i.channelEnabled?i.hasExplicitAccounts?i.accounts.some(({account:e,enabled:t})=>t&&!F(e,`webhookSecret`)&&(F(e,`webhookUrl`)?typeof e.webhookUrl==`string`&&e.webhookUrl.trim().length>0:s.length>0)):s.length>0:!1;if(P({value:n.webhookSecret,path:`channels.telegram.webhookSecret`,expected:`string`,defaults:e.defaults,context:e.context,active:c,inactiveReason:`no enabled Telegram webhook surface inherits this top-level webhookSecret (webhook mode is not active).`,apply:e=>{n.webhookSecret=e}}),i.hasExplicitAccounts)for(let{accountId:t,account:n,enabled:r}of i.accounts){if(!F(n,`webhookSecret`))continue;let i=F(n,`webhookUrl`)?typeof n.webhookUrl==`string`?n.webhookUrl.trim():``:s;P({value:n.webhookSecret,path:`channels.telegram.accounts.${t}.webhookSecret`,expected:`string`,defaults:e.defaults,context:e.context,active:r&&i.length>0,inactiveReason:`Telegram account is disabled or webhook mode is not active for this account.`,apply:e=>{n.webhookSecret=e}})}}function Oe(e){let t=e.config.channels;if(!r(t))return;let n=t.slack;if(!r(n))return;let i=R(n),a=n.mode===`http`||n.mode===`socket`?n.mode:`socket`;for(let t of[`botToken`,`userToken`])H({channelKey:`slack`,field:t,channel:n,surface:i,defaults:e.defaults,context:e.context,topInactiveReason:`no enabled account inherits this top-level Slack ${t}.`,accountInactiveReason:`Slack account is disabled.`});let o=i.channelEnabled?i.hasExplicitAccounts?i.accounts.some(({account:e,enabled:t})=>!t||F(e,`appToken`)?!1:(e.mode===`http`||e.mode===`socket`?e.mode:a)!==`http`):a!==`http`:!1;P({value:n.appToken,path:`channels.slack.appToken`,expected:`string`,defaults:e.defaults,context:e.context,active:o,inactiveReason:`no enabled Slack socket-mode surface inherits this top-level appToken.`,apply:e=>{n.appToken=e}});let s=i.channelEnabled?i.hasExplicitAccounts?i.accounts.some(({account:e,enabled:t})=>!t||F(e,`signingSecret`)?!1:(e.mode===`http`||e.mode===`socket`?e.mode:a)===`http`):a===`http`:!1;if(P({value:n.signingSecret,path:`channels.slack.signingSecret`,expected:`string`,defaults:e.defaults,context:e.context,active:s,inactiveReason:`no enabled Slack HTTP-mode surface inherits this top-level signingSecret.`,apply:e=>{n.signingSecret=e}}),i.hasExplicitAccounts)for(let{accountId:t,account:n,enabled:r}of i.accounts){let i=n.mode===`http`||n.mode===`socket`?n.mode:a;F(n,`appToken`)&&P({value:n.appToken,path:`channels.slack.accounts.${t}.appToken`,expected:`string`,defaults:e.defaults,context:e.context,active:r&&i!==`http`,inactiveReason:`Slack account is disabled or not running in socket mode.`,apply:e=>{n.appToken=e}}),F(n,`signingSecret`)&&P({value:n.signingSecret,path:`channels.slack.accounts.${t}.signingSecret`,expected:`string`,defaults:e.defaults,context:e.context,active:r&&i===`http`,inactiveReason:`Slack account is disabled or not running in HTTP mode.`,apply:e=>{n.signingSecret=e}})}}function ke(e){let t=e.config.channels;if(!r(t))return;let n=t.discord;if(!r(n))return;let i=R(n);if(H({channelKey:`discord`,field:`token`,channel:n,surface:i,defaults:e.defaults,context:e.context,topInactiveReason:`no enabled account inherits this top-level Discord token.`,accountInactiveReason:`Discord account is disabled.`}),r(n.pluralkit)){let t=n.pluralkit;P({value:t.token,path:`channels.discord.pluralkit.token`,expected:`string`,defaults:e.defaults,context:e.context,active:z(i,`pluralkit`)&&I(t),inactiveReason:`no enabled Discord surface inherits this top-level PluralKit config or PluralKit is disabled.`,apply:e=>{t.token=e}})}if(r(n.voice)&&r(n.voice.tts)&&L({tts:n.voice.tts,pathPrefix:`channels.discord.voice.tts`,defaults:e.defaults,context:e.context,active:z(i,`voice`)&&I(n.voice),inactiveReason:`no enabled Discord surface inherits this top-level voice config or voice is disabled.`}),i.hasExplicitAccounts)for(let{accountId:t,account:n,enabled:a}of i.accounts){if(F(n,`pluralkit`)&&r(n.pluralkit)){let r=n.pluralkit;P({value:r.token,path:`channels.discord.accounts.${t}.pluralkit.token`,expected:`string`,defaults:e.defaults,context:e.context,active:a&&I(r),inactiveReason:`Discord account is disabled or PluralKit is disabled for this account.`,apply:e=>{r.token=e}})}F(n,`voice`)&&r(n.voice)&&r(n.voice.tts)&&L({tts:n.voice.tts,pathPrefix:`channels.discord.accounts.${t}.voice.tts`,defaults:e.defaults,context:e.context,active:a&&I(n.voice),inactiveReason:`Discord account is disabled or voice is disabled for this account.`})}}function Ae(e){let t=e.config.channels;if(!r(t))return;let n=t.irc;if(!r(n))return;let i=R(n);if(H({channelKey:`irc`,field:`password`,channel:n,surface:i,defaults:e.defaults,context:e.context,topInactiveReason:`no enabled account inherits this top-level IRC password.`,accountInactiveReason:`IRC account is disabled.`}),r(n.nickserv)){let t=n.nickserv;P({value:t.password,path:`channels.irc.nickserv.password`,expected:`string`,defaults:e.defaults,context:e.context,active:z(i,`nickserv`)&&I(t),inactiveReason:`no enabled account inherits this top-level IRC nickserv config or NickServ is disabled.`,apply:e=>{t.password=e}})}if(i.hasExplicitAccounts){for(let{accountId:t,account:n,enabled:a}of i.accounts)if(F(n,`nickserv`)&&r(n.nickserv)){let r=n.nickserv;P({value:r.password,path:`channels.irc.accounts.${t}.nickserv.password`,expected:`string`,defaults:e.defaults,context:e.context,active:a&&I(r),inactiveReason:`IRC account is disabled or NickServ is disabled for this account.`,apply:e=>{r.password=e}})}}}function je(e){let t=e.config.channels;if(!r(t))return;let n=t.bluebubbles;r(n)&&H({channelKey:`bluebubbles`,field:`password`,channel:n,surface:R(n),defaults:e.defaults,context:e.context,topInactiveReason:`no enabled account inherits this top-level BlueBubbles password.`,accountInactiveReason:`BlueBubbles account is disabled.`})}function Me(e){let t=e.config.channels;if(!r(t))return;let n=t.msteams;r(n)&&P({value:n.appPassword,path:`channels.msteams.appPassword`,expected:`string`,defaults:e.defaults,context:e.context,active:n.enabled!==!1,inactiveReason:`Microsoft Teams channel is disabled.`,apply:e=>{n.appPassword=e}})}function Ne(e){let t=e.config.channels;if(!r(t))return;let n=t.mattermost;r(n)&&H({channelKey:`mattermost`,field:`botToken`,channel:n,surface:R(n),defaults:e.defaults,context:e.context,topInactiveReason:`no enabled account inherits this top-level Mattermost botToken.`,accountInactiveReason:`Mattermost account is disabled.`})}function Pe(e){let t=e.config.channels;if(!r(t))return;let n=t.matrix;if(!r(n))return;let i=R(n),a=B(e.context.env.MATRIX_ACCESS_TOKEN).length>0,o=V(n.accessToken,e.defaults),s=i.channelEnabled?i.hasExplicitAccounts?i.accounts.some(({account:t,enabled:n})=>n&&!F(t,`password`)&&!V(t.accessToken,e.defaults)&&!(o||a)):!(o||a):!1;if(P({value:n.password,path:`channels.matrix.password`,expected:`string`,defaults:e.defaults,context:e.context,active:s,inactiveReason:`no enabled Matrix surface inherits this top-level password (an accessToken is configured).`,apply:e=>{n.password=e}}),i.hasExplicitAccounts)for(let{accountId:t,account:n,enabled:r}of i.accounts){if(!F(n,`password`))continue;let i=V(n.accessToken,e.defaults),s=!F(n,`accessToken`)&&(o||a);P({value:n.password,path:`channels.matrix.accounts.${t}.password`,expected:`string`,defaults:e.defaults,context:e.context,active:r&&!(i||s),inactiveReason:`Matrix account is disabled or an accessToken is configured.`,apply:e=>{n.password=e}})}}function Fe(e){let t=e.config.channels;if(!r(t))return;let n=t.zalo;if(!r(n))return;let i=R(n),a=i.channelEnabled?i.hasExplicitAccounts?i.accounts.some(({account:e,enabled:t})=>t&&!F(e,`botToken`)):!0:!1;P({value:n.botToken,path:`channels.zalo.botToken`,expected:`string`,defaults:e.defaults,context:e.context,active:a,inactiveReason:`no enabled Zalo surface inherits this top-level botToken.`,apply:e=>{n.botToken=e}});let o=B(n.webhookUrl),s=i.channelEnabled?i.hasExplicitAccounts?i.accounts.some(({account:e,enabled:t})=>!t||F(e,`webhookSecret`)?!1:(F(e,`webhookUrl`)?B(e.webhookUrl):o).length>0):o.length>0:!1;if(P({value:n.webhookSecret,path:`channels.zalo.webhookSecret`,expected:`string`,defaults:e.defaults,context:e.context,active:s,inactiveReason:`no enabled Zalo webhook surface inherits this top-level webhookSecret (webhook mode is not active).`,apply:e=>{n.webhookSecret=e}}),i.hasExplicitAccounts){for(let{accountId:t,account:n,enabled:r}of i.accounts)if(F(n,`botToken`)&&P({value:n.botToken,path:`channels.zalo.accounts.${t}.botToken`,expected:`string`,defaults:e.defaults,context:e.context,active:r,inactiveReason:`Zalo account is disabled.`,apply:e=>{n.botToken=e}}),F(n,`webhookSecret`)){let i=F(n,`webhookUrl`)?B(n.webhookUrl):o;P({value:n.webhookSecret,path:`channels.zalo.accounts.${t}.webhookSecret`,expected:`string`,defaults:e.defaults,context:e.context,active:r&&i.length>0,inactiveReason:`Zalo account is disabled or webhook mode is not active for this account.`,apply:e=>{n.webhookSecret=e}})}}}function Ie(e){let t=e.config.channels;if(!r(t))return;let n=t.feishu;if(!r(n))return;let i=R(n);H({channelKey:`feishu`,field:`appSecret`,channel:n,surface:i,defaults:e.defaults,context:e.context,topInactiveReason:`no enabled account inherits this top-level Feishu appSecret.`,accountInactiveReason:`Feishu account is disabled.`});let a=B(n.connectionMode)===`webhook`?`webhook`:`websocket`,o=i.channelEnabled?i.hasExplicitAccounts?i.accounts.some(({account:e,enabled:t})=>!t||F(e,`verificationToken`)?!1:(F(e,`connectionMode`)?B(e.connectionMode):a)===`webhook`):a===`webhook`:!1;if(P({value:n.verificationToken,path:`channels.feishu.verificationToken`,expected:`string`,defaults:e.defaults,context:e.context,active:o,inactiveReason:`no enabled Feishu webhook-mode surface inherits this top-level verificationToken.`,apply:e=>{n.verificationToken=e}}),i.hasExplicitAccounts)for(let{accountId:t,account:n,enabled:r}of i.accounts){if(!F(n,`verificationToken`))continue;let i=F(n,`connectionMode`)?B(n.connectionMode):a;P({value:n.verificationToken,path:`channels.feishu.accounts.${t}.verificationToken`,expected:`string`,defaults:e.defaults,context:e.context,active:r&&i===`webhook`,inactiveReason:`Feishu account is disabled or not running in webhook mode.`,apply:e=>{n.verificationToken=e}})}}function Le(e){let t=e.config.channels;if(!r(t))return;let n=t[`nextcloud-talk`];if(!r(n))return;let i=R(n),a=i.channelEnabled?i.hasExplicitAccounts?i.accounts.some(({account:e,enabled:t})=>t&&!F(e,`botSecret`)):!0:!1;P({value:n.botSecret,path:`channels.nextcloud-talk.botSecret`,expected:`string`,defaults:e.defaults,context:e.context,active:a,inactiveReason:`no enabled Nextcloud Talk surface inherits this top-level botSecret.`,apply:e=>{n.botSecret=e}});let o=i.channelEnabled?i.hasExplicitAccounts?i.accounts.some(({account:e,enabled:t})=>t&&!F(e,`apiPassword`)):!0:!1;if(P({value:n.apiPassword,path:`channels.nextcloud-talk.apiPassword`,expected:`string`,defaults:e.defaults,context:e.context,active:o,inactiveReason:`no enabled Nextcloud Talk surface inherits this top-level apiPassword.`,apply:e=>{n.apiPassword=e}}),i.hasExplicitAccounts)for(let{accountId:t,account:n,enabled:r}of i.accounts)F(n,`botSecret`)&&P({value:n.botSecret,path:`channels.nextcloud-talk.accounts.${t}.botSecret`,expected:`string`,defaults:e.defaults,context:e.context,active:r,inactiveReason:`Nextcloud Talk account is disabled.`,apply:e=>{n.botSecret=e}}),F(n,`apiPassword`)&&P({value:n.apiPassword,path:`channels.nextcloud-talk.accounts.${t}.apiPassword`,expected:`string`,defaults:e.defaults,context:e.context,active:r,inactiveReason:`Nextcloud Talk account is disabled.`,apply:e=>{n.apiPassword=e}})}function U(e){let{explicitRef:t,ref:n}=o({value:e.target.serviceAccount,refValue:e.target.serviceAccountRef,defaults:e.defaults});if(n){if(e.active===!1){N({context:e.context,path:`${e.path}.serviceAccount`,details:e.inactiveReason});return}t&&e.target.serviceAccount!==void 0&&!s(e.target.serviceAccount,e.defaults)&&M(e.context,{code:`SECRETS_REF_OVERRIDES_PLAINTEXT`,path:e.path,message:`${e.path}: serviceAccountRef is set; runtime will ignore plaintext serviceAccount.`}),j(e.context,{ref:n,path:`${e.path}.serviceAccount`,expected:`string-or-object`,apply:t=>{e.target.serviceAccount=t}})}}function Re(e){let t=e.googleChat,n=R(t),r=n.channelEnabled?n.hasExplicitAccounts?n.accounts.some(({account:e,enabled:t})=>t&&!F(e,`serviceAccount`)&&!F(e,`serviceAccountRef`)):!0:!1;if(U({target:e.googleChat,path:`channels.googlechat`,defaults:e.defaults,context:e.context,active:r,inactiveReason:`no enabled account inherits this top-level Google Chat serviceAccount.`}),n.hasExplicitAccounts)for(let{accountId:t,account:r,enabled:i}of n.accounts)!F(r,`serviceAccount`)&&!F(r,`serviceAccountRef`)||U({target:r,path:`channels.googlechat.accounts.${t}`,defaults:e.defaults,context:e.context,active:i,inactiveReason:`Google Chat account is disabled.`})}function ze(e){let t=e.config.channels?.googlechat;t&&Re({googleChat:t,defaults:e.defaults,context:e.context}),De(e),Oe(e),ke(e),Ae(e),je(e),Ne(e),Pe(e),Me(e),Le(e),Ie(e),Fe(e)}const Be=[`gateway.auth.token`,`gateway.auth.password`,`gateway.remote.token`,`gateway.remote.password`];function Ve(e){return e??`unset`}function He(e){let t=[];return e.remoteMode&&t.push(`gateway.mode is "remote"`),e.remoteUrlConfigured&&t.push(`gateway.remote.url is configured`),e.tailscaleRemoteExposure&&t.push(`gateway.tailscale.mode is "serve" or "funnel"`),t.join(`; `)}function W(e){return{path:e.path,active:e.active,reason:e.reason,hasSecretRef:e.hasSecretRef}}function Ue(t){let n=t.config.gateway;if(!r(n))return{"gateway.auth.token":W({path:`gateway.auth.token`,active:!1,reason:`gateway configuration is not set.`,hasSecretRef:!1}),"gateway.auth.password":W({path:`gateway.auth.password`,active:!1,reason:`gateway configuration is not set.`,hasSecretRef:!1}),"gateway.remote.token":W({path:`gateway.remote.token`,active:!1,reason:`gateway configuration is not set.`,hasSecretRef:!1}),"gateway.remote.password":W({path:`gateway.remote.password`,active:!1,reason:`gateway configuration is not set.`,hasSecretRef:!1})};let i=r(n?.auth)?n.auth:void 0,a=r(n?.remote)?n.remote:void 0,o=e({config:t.config,env:t.env,includeLegacyEnv:!0,defaults:t.defaults}),s=i?o.passwordCanWin?o.authMode===`password`?`gateway.auth.mode is "password".`:`no token source can win, so password auth can win.`:o.authMode===`token`||o.authMode===`none`||o.authMode===`trusted-proxy`?`gateway.auth.mode is "${o.authMode}".`:o.envToken?`gateway token env var is configured.`:o.localToken.configured?`gateway.auth.token is configured.`:o.remoteToken.configured?`gateway.remote.token is configured.`:`token auth can win.`:`gateway.auth is not configured.`,c=i?o.authMode===`token`?o.envToken?`gateway token env var is configured.`:`gateway.auth.mode is "token".`:o.authMode===`password`||o.authMode===`none`||o.authMode===`trusted-proxy`?`gateway.auth.mode is "${o.authMode}".`:o.envToken?`gateway token env var is configured.`:o.envPassword?`gateway password env var is configured.`:o.localPassword.configured?`gateway.auth.password is configured.`:`token auth can win (mode is unset and no password source is configured).`:`gateway.auth is not configured.`,l=He({remoteMode:o.remoteMode,remoteUrlConfigured:o.remoteUrlConfigured,tailscaleRemoteExposure:o.tailscaleRemoteExposure}),u=a?o.remoteConfiguredSurface?`remote surface is active: ${l}.`:o.remoteTokenFallbackActive?`local token auth can win and no env/auth token is configured.`:o.localTokenCanWin?o.envToken?`gateway token env var is configured.`:o.localToken.configured?`gateway.auth.token is configured.`:`remote token fallback is not active.`:`token auth cannot win with gateway.auth.mode="${Ve(o.authMode)}".`:`gateway.remote is not configured.`,d=a?o.remoteConfiguredSurface?`remote surface is active: ${l}.`:o.remotePasswordFallbackActive?`password auth can win and no env/auth password is configured.`:o.passwordCanWin?o.envPassword?`gateway password env var is configured.`:o.localPassword.configured?`gateway.auth.password is configured.`:`remote password fallback is not active.`:o.authMode===`token`||o.authMode===`none`||o.authMode===`trusted-proxy`?`password auth cannot win with gateway.auth.mode="${o.authMode}".`:`a token source can win, so password auth cannot win.`:`gateway.remote is not configured.`;return{"gateway.auth.token":W({path:`gateway.auth.token`,active:o.localTokenSurfaceActive,reason:c,hasSecretRef:o.localToken.hasSecretRef}),"gateway.auth.password":W({path:`gateway.auth.password`,active:o.passwordCanWin,reason:s,hasSecretRef:o.localPassword.hasSecretRef}),"gateway.remote.token":W({path:`gateway.remote.token`,active:o.remoteTokenActive,reason:u,hasSecretRef:o.remoteToken.hasSecretRef}),"gateway.remote.password":W({path:`gateway.remote.password`,active:o.remotePasswordActive,reason:d,hasSecretRef:o.remotePassword.hasSecretRef})}}function We(e){for(let[t,n]of Object.entries(e.providers)){let i=n.enabled!==!1;P({value:n.apiKey,path:`models.providers.${t}.apiKey`,expected:`string`,defaults:e.defaults,context:e.context,active:i,inactiveReason:`provider is disabled.`,apply:e=>{n.apiKey=e}});let a=r(n.headers)?n.headers:void 0;if(a)for(let[n,r]of Object.entries(a))P({value:r,path:`models.providers.${t}.headers.${n}`,expected:`string`,defaults:e.defaults,context:e.context,active:i,inactiveReason:`provider is disabled.`,apply:e=>{a[n]=e}})}}function Ge(e){for(let[t,n]of Object.entries(e.entries))P({value:n.apiKey,path:`skills.entries.${t}.apiKey`,expected:`string`,defaults:e.defaults,context:e.context,active:n.enabled!==!1,inactiveReason:`skill entry is disabled.`,apply:e=>{n.apiKey=e}})}function Ke(e){let t=e.config.agents;if(!r(t))return;let n=r(t.defaults)?t.defaults:void 0,i=r(n?.memorySearch)?n.memorySearch:void 0,a=i?.enabled!==!1,o=Array.isArray(t.list)?t.list:[],s=!1;for(let e of o){if(!r(e)||e.enabled===!1)continue;let t=r(e.memorySearch)?e.memorySearch:void 0;if(t?.enabled===!1)continue;if(!t||!Object.prototype.hasOwnProperty.call(t,`remote`)){s=!0;continue}let n=r(t.remote)?t.remote:void 0;if(!n||!Object.prototype.hasOwnProperty.call(n,`apiKey`)){s=!0;continue}}if(i&&r(i.remote)){let t=i.remote;P({value:t.apiKey,path:`agents.defaults.memorySearch.remote.apiKey`,expected:`string`,defaults:e.defaults,context:e.context,active:a&&(s||o.length===0),inactiveReason:s?void 0:`all enabled agents override memorySearch.remote.apiKey.`,apply:e=>{t.apiKey=e}})}o.forEach((t,n)=>{if(!r(t))return;let i=r(t.memorySearch)?t.memorySearch:void 0;if(!i)return;let a=r(i.remote)?i.remote:void 0;if(!a||!Object.prototype.hasOwnProperty.call(a,`apiKey`))return;let o=t.enabled!==!1&&i.enabled!==!1;P({value:a.apiKey,path:`agents.list.${n}.memorySearch.remote.apiKey`,expected:`string`,defaults:e.defaults,context:e.context,active:o,inactiveReason:`agent or memorySearch override is disabled.`,apply:e=>{a.apiKey=e}})})}function qe(e){let t=e.config.talk;if(!r(t))return;P({value:t.apiKey,path:`talk.apiKey`,expected:`string`,defaults:e.defaults,context:e.context,apply:e=>{t.apiKey=e}});let n=t.providers;if(r(n))for(let[t,i]of Object.entries(n))r(i)&&P({value:i.apiKey,path:`talk.providers.${t}.apiKey`,expected:`string`,defaults:e.defaults,context:e.context,apply:e=>{i.apiKey=e}})}function Je(e){let t=e.config.gateway;if(!r(t))return;let n=r(t.auth)?t.auth:void 0,i=r(t.remote)?t.remote:void 0,a=Ue({config:e.config,env:e.context.env,defaults:e.defaults});n&&(P({value:n.token,path:`gateway.auth.token`,expected:`string`,defaults:e.defaults,context:e.context,active:a[`gateway.auth.token`].active,inactiveReason:a[`gateway.auth.token`].reason,apply:e=>{n.token=e}}),P({value:n.password,path:`gateway.auth.password`,expected:`string`,defaults:e.defaults,context:e.context,active:a[`gateway.auth.password`].active,inactiveReason:a[`gateway.auth.password`].reason,apply:e=>{n.password=e}})),i&&(P({value:i.token,path:`gateway.remote.token`,expected:`string`,defaults:e.defaults,context:e.context,active:a[`gateway.remote.token`].active,inactiveReason:a[`gateway.remote.token`].reason,apply:e=>{i.token=e}}),P({value:i.password,path:`gateway.remote.password`,expected:`string`,defaults:e.defaults,context:e.context,active:a[`gateway.remote.password`].active,inactiveReason:a[`gateway.remote.password`].reason,apply:e=>{i.password=e}}))}function Ye(e){let t=e.config.messages;!r(t)||!r(t.tts)||L({tts:t.tts,pathPrefix:`messages.tts`,defaults:e.defaults,context:e.context})}function Xe(e){let t=e.config.cron;r(t)&&P({value:t.webhookToken,path:`cron.webhookToken`,expected:`string`,defaults:e.defaults,context:e.context,apply:e=>{t.webhookToken=e}})}function Ze(e){let t=e.config.models?.providers;t&&We({providers:t,defaults:e.defaults,context:e.context});let n=e.config.skills?.entries;n&&Ge({entries:n,defaults:e.defaults,context:e.context}),Ke(e),qe(e),Je(e),Ye(e),Xe(e)}function Qe(e){let t=e.context.sourceConfig.secrets?.defaults;Ze({config:e.config,defaults:t,context:e.context}),ze({config:e.config,defaults:t,context:e.context})}const G=[`brave`,`gemini`,`grok`,`kimi`,`perplexity`],$e=`https://api.perplexity.ai`,K=`https://openrouter.ai/api/v1`,et=[`pplx-`],tt=[`sk-or-`];function q(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}function nt(e){if(typeof e!=`string`)return;let t=e.trim().toLowerCase();if(t===`brave`||t===`gemini`||t===`grok`||t===`kimi`||t===`perplexity`)return t}function J(e,n){for(let r of n){let n=t(e[r]);if(n)return{value:n,envVar:r}}return{}}function Y(e){return e.kind===`non-string`?`${e.path} SecretRef resolved to a non-string value.`:e.kind===`empty`?`${e.path} SecretRef resolved to an empty value.`:`${e.path} SecretRef is unresolved (${e.refLabel}).`}async function rt(e){let{ref:n}=o({value:e.value,defaults:e.defaults});if(!n){let n=t(e.value);if(n)return{value:n,source:`config`,secretRefConfigured:!1,fallbackUsedAfterRefFailure:!1};let r=J(e.context.env,e.envVars);return r.value?{value:r.value,source:`env`,fallbackEnvVar:r.envVar,secretRefConfigured:!1,fallbackUsedAfterRefFailure:!1}:{source:`missing`,secretRefConfigured:!1,fallbackUsedAfterRefFailure:!1}}let r=`${n.source}:${n.provider}:${n.id}`,a,s;try{let o=(await i([n],{config:e.sourceConfig,env:e.context.env,cache:e.context.cache})).get(c(n));typeof o==`string`?(a=t(o),a||(s=Y({path:e.path,kind:`empty`,refLabel:r}))):s=Y({path:e.path,kind:`non-string`,refLabel:r})}catch{s=Y({path:e.path,kind:`unresolved`,refLabel:r})}if(a)return{value:a,source:`secretRef`,secretRefConfigured:!0,fallbackUsedAfterRefFailure:!1};let l=J(e.context.env,e.envVars);return l.value?{value:l.value,source:`env`,fallbackEnvVar:l.envVar,unresolvedRefReason:s,secretRefConfigured:!0,fallbackUsedAfterRefFailure:!0}:{source:`missing`,unresolvedRefReason:s,secretRefConfigured:!0,fallbackUsedAfterRefFailure:!1}}function it(e){if(!e)return;let t=e.toLowerCase();if(et.some(e=>t.startsWith(e)))return`direct`;if(tt.some(e=>t.startsWith(e)))return`openrouter`}function at(e){let t=q(e.configValue)?e.configValue:void 0,n=typeof t?.baseUrl==`string`?t.baseUrl.trim():``,r=typeof t?.model==`string`?t.model.trim():``,i=(()=>{if(n)return n;if(e.keySource===`env`){if(e.fallbackEnvVar===`PERPLEXITY_API_KEY`)return $e;if(e.fallbackEnvVar===`OPENROUTER_API_KEY`)return K}return(e.keySource===`config`||e.keySource===`secretRef`)&&e.keyValue?it(e.keyValue)===`openrouter`?K:$e:K})(),a=!!(n||r),o=(()=>{try{return new URL(i).hostname.toLowerCase()===`api.perplexity.ai`}catch{return!1}})();return a||!o?`chat_completions`:`search_api`}function X(e,t){let n=e[t];if(q(n))return n;let r={};return e[t]=r,r}function Z(e){let t=X(X(X(e.resolvedConfig,`tools`),`web`),`search`);if(e.provider===`brave`){t.apiKey=e.value;return}let n=X(t,e.provider);n.apiKey=e.value}function ot(e){let t=X(X(X(X(e.resolvedConfig,`tools`),`web`),`fetch`),`firecrawl`);t.apiKey=e.value}function st(e){return e===`brave`?[`BRAVE_API_KEY`]:e===`gemini`?[`GEMINI_API_KEY`]:e===`grok`?[`XAI_API_KEY`]:e===`kimi`?[`KIMI_API_KEY`,`MOONSHOT_API_KEY`]:[`PERPLEXITY_API_KEY`,`OPENROUTER_API_KEY`]}function Q(e,t){if(t===`brave`)return e.apiKey;let n=e[t];if(q(n))return n.apiKey}function $(e,t){return!!o({value:e,defaults:t}).ref}async function ct(e){let n=e.sourceConfig.secrets?.defaults,r=[],i=q(e.sourceConfig.tools)?e.sourceConfig.tools:void 0,a=q(i?.web)?i.web:void 0,o=q(a?.search)?a.search:void 0,s={providerSource:`none`,diagnostics:[]},c=o?.enabled!==!1,l=typeof o?.provider==`string`?o.provider.trim().toLowerCase():``,u=nt(l);if(l&&!u){let t={code:`WEB_SEARCH_PROVIDER_INVALID_AUTODETECT`,message:`tools.web.search.provider is "${l}". Falling back to auto-detect precedence.`,path:`tools.web.search.provider`};r.push(t),s.diagnostics.push(t),M(e.context,{code:`WEB_SEARCH_PROVIDER_INVALID_AUTODETECT`,path:`tools.web.search.provider`,message:t.message})}if(u&&(s.providerConfigured=u,s.providerSource=`configured`),c&&o){let t=u?[u]:[...G],i=[],a,c;for(let l of t){let t=l===`brave`?`tools.web.search.apiKey`:`tools.web.search.${l}.apiKey`,d=Q(o,l),f=await rt({sourceConfig:e.sourceConfig,context:e.context,defaults:n,value:d,path:t,envVars:st(l)});if(f.secretRefConfigured&&f.fallbackUsedAfterRefFailure){let n={code:`WEB_SEARCH_KEY_UNRESOLVED_FALLBACK_USED`,message:`${t} SecretRef could not be resolved; using ${f.fallbackEnvVar??`env fallback`}. `+(f.unresolvedRefReason??``).trim(),path:t};r.push(n),s.diagnostics.push(n),M(e.context,{code:`WEB_SEARCH_KEY_UNRESOLVED_FALLBACK_USED`,path:t,message:n.message})}if(f.secretRefConfigured&&!f.value&&f.unresolvedRefReason&&i.push({provider:l,path:t,reason:f.unresolvedRefReason}),u){a=l,c=f,f.value&&Z({resolvedConfig:e.resolvedConfig,provider:l,value:f.value});break}if(f.value){a=l,c=f,Z({resolvedConfig:e.resolvedConfig,provider:l,value:f.value});break}}if(u){let t=i[0];if(t){let n={code:`WEB_SEARCH_KEY_UNRESOLVED_NO_FALLBACK`,message:t.reason,path:t.path};throw r.push(n),s.diagnostics.push(n),M(e.context,{code:`WEB_SEARCH_KEY_UNRESOLVED_NO_FALLBACK`,path:t.path,message:t.reason}),Error(`[WEB_SEARCH_KEY_UNRESOLVED_NO_FALLBACK] ${t.reason}`)}}else{if(!a&&i.length>0){let t=i[0],n={code:`WEB_SEARCH_KEY_UNRESOLVED_NO_FALLBACK`,message:t.reason,path:t.path};throw r.push(n),s.diagnostics.push(n),M(e.context,{code:`WEB_SEARCH_KEY_UNRESOLVED_NO_FALLBACK`,path:t.path,message:t.reason}),Error(`[WEB_SEARCH_KEY_UNRESOLVED_NO_FALLBACK] ${t.reason}`)}if(a){let e={code:`WEB_SEARCH_AUTODETECT_SELECTED`,message:`tools.web.search auto-detected provider "${a}" from available credentials.`,path:`tools.web.search.provider`};r.push(e),s.diagnostics.push(e)}}a&&(s.selectedProvider=a,s.selectedProviderKeySource=c?.source,u||(s.providerSource=`auto-detect`),a===`perplexity`&&(s.perplexityTransport=at({keyValue:c?.value,keySource:c?.source??`missing`,fallbackEnvVar:c?.fallbackEnvVar,configValue:o.perplexity})))}if(c&&o&&!u&&s.selectedProvider)for(let t of G){if(t===s.selectedProvider)continue;let r=t===`brave`?`tools.web.search.apiKey`:`tools.web.search.${t}.apiKey`;$(Q(o,t),n)&&N({context:e.context,path:r,details:`tools.web.search auto-detected provider is "${s.selectedProvider}".`})}else if(o&&!c)for(let t of G){let r=t===`brave`?`tools.web.search.apiKey`:`tools.web.search.${t}.apiKey`;$(Q(o,t),n)&&N({context:e.context,path:r,details:`tools.web.search is disabled.`})}if(c&&o&&u)for(let t of G){if(t===u)continue;let r=t===`brave`?`tools.web.search.apiKey`:`tools.web.search.${t}.apiKey`;$(Q(o,t),n)&&N({context:e.context,path:r,details:`tools.web.search.provider is "${u}".`})}let d=q(a?.fetch)?a.fetch:void 0,f=q(d?.firecrawl)?d.firecrawl:void 0,p=d?.enabled!==!1,m=f?.enabled!==!1,h=!!(p&&m),g=`tools.web.fetch.firecrawl.apiKey`,_={source:`missing`,secretRefConfigured:!1,fallbackUsedAfterRefFailure:!1},v=[];if(h){if(_=await rt({sourceConfig:e.sourceConfig,context:e.context,defaults:n,value:f?.apiKey,path:g,envVars:[`FIRECRAWL_API_KEY`]}),_.value&&ot({resolvedConfig:e.resolvedConfig,value:_.value}),_.secretRefConfigured){if(_.fallbackUsedAfterRefFailure){let t={code:`WEB_FETCH_FIRECRAWL_KEY_UNRESOLVED_FALLBACK_USED`,message:`${g} SecretRef could not be resolved; using ${_.fallbackEnvVar??`env fallback`}. `+(_.unresolvedRefReason??``).trim(),path:g};r.push(t),v.push(t),M(e.context,{code:`WEB_FETCH_FIRECRAWL_KEY_UNRESOLVED_FALLBACK_USED`,path:g,message:t.message})}if(!_.value&&_.unresolvedRefReason){let t={code:`WEB_FETCH_FIRECRAWL_KEY_UNRESOLVED_NO_FALLBACK`,message:_.unresolvedRefReason,path:g};throw r.push(t),v.push(t),M(e.context,{code:`WEB_FETCH_FIRECRAWL_KEY_UNRESOLVED_NO_FALLBACK`,path:g,message:_.unresolvedRefReason}),Error(`[WEB_FETCH_FIRECRAWL_KEY_UNRESOLVED_NO_FALLBACK] ${_.unresolvedRefReason}`)}}}else if($(f?.apiKey,n))N({context:e.context,path:g,details:p?`tools.web.fetch.firecrawl.enabled is false.`:`tools.web.fetch is disabled.`}),_={source:`secretRef`,secretRefConfigured:!0,fallbackUsedAfterRefFailure:!1};else{let n=t(f?.apiKey);if(n)_={value:n,source:`config`,secretRefConfigured:!1,fallbackUsedAfterRefFailure:!1};else{let t=J(e.context.env,[`FIRECRAWL_API_KEY`]);t.value&&(_={value:t.value,source:`env`,fallbackEnvVar:t.envVar,secretRefConfigured:!1,fallbackUsedAfterRefFailure:!1})}}return{search:s,fetch:{firecrawl:{active:h,apiKeySource:_.source,diagnostics:v}},diagnostics:r}}export{m as C,_ as S,g as T,he as _,Te as a,ee as b,M as c,be as d,ye as f,Se as g,ge as h,Ue as i,A as l,_e as m,Qe as n,we as o,k as p,Be as r,j as s,ct as t,Ce as u,ve as v,h as w,v as x,y};
+import{Wi as e,cu as t,do as n,fo as r,lo as i,po as a}from"./auth-profiles-BhXA8Jy2.js";import{d as o,i as s}from"./types.secrets-D4tbc3Wq.js";import{jt as c}from"./plugins-DNlgeTTc.js";import{isDeepStrictEqual as l}from"node:util";function u(e){return/^\d+$/.test(e)}function d(e){return u(e)?`array`:`object`}function f(e,t,n){if(!Array.isArray(e))return null;if(!u(t))throw Error(`Invalid array index segment "${t}" at ${n.join(`.`)}.`);return{array:e,index:Number.parseInt(t,10)}}function p(e){if(e.segments.length===0)throw Error(`Target path is empty.`);let t=e.root;for(let n=0;n<e.segments.length-1;n+=1){let i=e.segments[n]??``;if(Array.isArray(t)){if(!u(i))throw Error(`Invalid array index segment "${i}" at ${e.segments.join(`.`)}.`);let r=Number.parseInt(i,10);if(e.requireExistingSegment&&(r<0||r>=t.length))throw Error(`Path segment does not exist at ${e.segments.slice(0,n+1).join(`.`)}.`);t=t[r];continue}if(!r(t))throw Error(`Invalid path shape at ${e.segments.slice(0,n).join(`.`)||`<root>`}.`);if(e.requireExistingSegment&&!Object.prototype.hasOwnProperty.call(t,i))throw Error(`Path segment does not exist at ${e.segments.slice(0,n+1).join(`.`)}.`);t=t[i]}return t}function m(e,t){if(t.length===0)return;let n=e;for(let e of t){if(Array.isArray(n)){if(!u(e))return;n=n[Number.parseInt(e,10)];continue}if(!r(n))return;n=n[e]}return n}function h(e,t,n){if(t.length===0)throw Error(`Target path is empty.`);let i=e,a=!1;for(let e=0;e<t.length-1;e+=1){let n=t[e]??``,o=d(t[e+1]??``);if(Array.isArray(i)){if(!u(n))throw Error(`Invalid array index segment "${n}" at ${t.join(`.`)}.`);let s=Number.parseInt(n,10),c=i[s];if(c==null)i[s]=o===`array`?[]:{},a=!0;else if(o===`array`?!Array.isArray(c):!r(c))throw Error(`Invalid path shape at ${t.slice(0,e+1).join(`.`)}.`);i=i[s];continue}if(!r(i))throw Error(`Invalid path shape at ${t.slice(0,e).join(`.`)||`<root>`}.`);let s=i[n];if(s==null)i[n]=o===`array`?[]:{},a=!0;else if(o===`array`?!Array.isArray(s):!r(s))throw Error(`Invalid path shape at ${t.slice(0,e+1).join(`.`)}.`);i=i[n]}let o=t[t.length-1]??``,s=f(i,o,t);if(s)return l(s.array[s.index],n)||(s.array[s.index]=n,a=!0),a;if(!r(i))throw Error(`Invalid path shape at ${t.slice(0,-1).join(`.`)||`<root>`}.`);return l(i[o],n)||(i[o]=n,a=!0),a}function g(e,t,n){let i=p({root:e,segments:t,requireExistingSegment:!0}),a=t[t.length-1]??``,o=f(i,a,t);if(o){if(o.index<0||o.index>=o.array.length)throw Error(`Path segment does not exist at ${t.join(`.`)}.`);return l(o.array[o.index],n)?!1:(o.array[o.index]=n,!0)}if(!r(i))throw Error(`Invalid path shape at ${t.slice(0,-1).join(`.`)||`<root>`}.`);if(!Object.prototype.hasOwnProperty.call(i,a))throw Error(`Path segment does not exist at ${t.join(`.`)}.`);return l(i[a],n)?!1:(i[a]=n,!0)}function _(e,t){let n=p({root:e,segments:t,requireExistingSegment:!1}),i=t[t.length-1]??``,a=f(n,i,t);if(a)return a.index<0||a.index>=a.array.length?!1:(a.array.splice(a.index,1),!0);if(!r(n))throw Error(`Invalid path shape at ${t.slice(0,-1).join(`.`)||`<root>`}.`);return Object.prototype.hasOwnProperty.call(n,i)?(delete n[i],!0):!1}function v(e,t){return t===`string`?n(e):n(e)||r(e)}function ee(e,t){return t===`string`?n(e):n(e)||r(e)&&Object.keys(e).length>0}function y(e){if(!v(e.value,e.expected))throw Error(e.errorMessage)}const b=`secret_input`,x=`sibling_ref`,te=[{id:`auth-profiles.api_key.key`,targetType:`auth-profiles.api_key.key`,configFile:`auth-profiles.json`,pathPattern:`profiles.*.key`,refPathPattern:`profiles.*.keyRef`,secretShape:x,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0,authProfileType:`api_key`},{id:`auth-profiles.token.token`,targetType:`auth-profiles.token.token`,configFile:`auth-profiles.json`,pathPattern:`profiles.*.token`,refPathPattern:`profiles.*.tokenRef`,secretShape:x,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0,authProfileType:`token`},{id:`agents.defaults.memorySearch.remote.apiKey`,targetType:`agents.defaults.memorySearch.remote.apiKey`,configFile:`openclaw.json`,pathPattern:`agents.defaults.memorySearch.remote.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`agents.list[].memorySearch.remote.apiKey`,targetType:`agents.list[].memorySearch.remote.apiKey`,configFile:`openclaw.json`,pathPattern:`agents.list[].memorySearch.remote.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.bluebubbles.accounts.*.password`,targetType:`channels.bluebubbles.accounts.*.password`,configFile:`openclaw.json`,pathPattern:`channels.bluebubbles.accounts.*.password`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.bluebubbles.password`,targetType:`channels.bluebubbles.password`,configFile:`openclaw.json`,pathPattern:`channels.bluebubbles.password`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.discord.accounts.*.pluralkit.token`,targetType:`channels.discord.accounts.*.pluralkit.token`,configFile:`openclaw.json`,pathPattern:`channels.discord.accounts.*.pluralkit.token`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.discord.accounts.*.token`,targetType:`channels.discord.accounts.*.token`,configFile:`openclaw.json`,pathPattern:`channels.discord.accounts.*.token`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.discord.accounts.*.voice.tts.elevenlabs.apiKey`,targetType:`channels.discord.accounts.*.voice.tts.elevenlabs.apiKey`,configFile:`openclaw.json`,pathPattern:`channels.discord.accounts.*.voice.tts.elevenlabs.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.discord.accounts.*.voice.tts.openai.apiKey`,targetType:`channels.discord.accounts.*.voice.tts.openai.apiKey`,configFile:`openclaw.json`,pathPattern:`channels.discord.accounts.*.voice.tts.openai.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.discord.pluralkit.token`,targetType:`channels.discord.pluralkit.token`,configFile:`openclaw.json`,pathPattern:`channels.discord.pluralkit.token`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.discord.token`,targetType:`channels.discord.token`,configFile:`openclaw.json`,pathPattern:`channels.discord.token`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.discord.voice.tts.elevenlabs.apiKey`,targetType:`channels.discord.voice.tts.elevenlabs.apiKey`,configFile:`openclaw.json`,pathPattern:`channels.discord.voice.tts.elevenlabs.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.discord.voice.tts.openai.apiKey`,targetType:`channels.discord.voice.tts.openai.apiKey`,configFile:`openclaw.json`,pathPattern:`channels.discord.voice.tts.openai.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.feishu.accounts.*.appSecret`,targetType:`channels.feishu.accounts.*.appSecret`,configFile:`openclaw.json`,pathPattern:`channels.feishu.accounts.*.appSecret`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.feishu.accounts.*.verificationToken`,targetType:`channels.feishu.accounts.*.verificationToken`,configFile:`openclaw.json`,pathPattern:`channels.feishu.accounts.*.verificationToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.feishu.appSecret`,targetType:`channels.feishu.appSecret`,configFile:`openclaw.json`,pathPattern:`channels.feishu.appSecret`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.feishu.verificationToken`,targetType:`channels.feishu.verificationToken`,configFile:`openclaw.json`,pathPattern:`channels.feishu.verificationToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.googlechat.accounts.*.serviceAccount`,targetType:`channels.googlechat.serviceAccount`,targetTypeAliases:[`channels.googlechat.accounts.*.serviceAccount`],configFile:`openclaw.json`,pathPattern:`channels.googlechat.accounts.*.serviceAccount`,refPathPattern:`channels.googlechat.accounts.*.serviceAccountRef`,secretShape:x,expectedResolvedValue:`string-or-object`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0,accountIdPathSegmentIndex:3},{id:`channels.googlechat.serviceAccount`,targetType:`channels.googlechat.serviceAccount`,configFile:`openclaw.json`,pathPattern:`channels.googlechat.serviceAccount`,refPathPattern:`channels.googlechat.serviceAccountRef`,secretShape:x,expectedResolvedValue:`string-or-object`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.irc.accounts.*.nickserv.password`,targetType:`channels.irc.accounts.*.nickserv.password`,configFile:`openclaw.json`,pathPattern:`channels.irc.accounts.*.nickserv.password`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.irc.accounts.*.password`,targetType:`channels.irc.accounts.*.password`,configFile:`openclaw.json`,pathPattern:`channels.irc.accounts.*.password`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.irc.nickserv.password`,targetType:`channels.irc.nickserv.password`,configFile:`openclaw.json`,pathPattern:`channels.irc.nickserv.password`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.irc.password`,targetType:`channels.irc.password`,configFile:`openclaw.json`,pathPattern:`channels.irc.password`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.mattermost.accounts.*.botToken`,targetType:`channels.mattermost.accounts.*.botToken`,configFile:`openclaw.json`,pathPattern:`channels.mattermost.accounts.*.botToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.mattermost.botToken`,targetType:`channels.mattermost.botToken`,configFile:`openclaw.json`,pathPattern:`channels.mattermost.botToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.matrix.accounts.*.password`,targetType:`channels.matrix.accounts.*.password`,configFile:`openclaw.json`,pathPattern:`channels.matrix.accounts.*.password`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.matrix.password`,targetType:`channels.matrix.password`,configFile:`openclaw.json`,pathPattern:`channels.matrix.password`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.msteams.appPassword`,targetType:`channels.msteams.appPassword`,configFile:`openclaw.json`,pathPattern:`channels.msteams.appPassword`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.nextcloud-talk.accounts.*.apiPassword`,targetType:`channels.nextcloud-talk.accounts.*.apiPassword`,configFile:`openclaw.json`,pathPattern:`channels.nextcloud-talk.accounts.*.apiPassword`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.nextcloud-talk.accounts.*.botSecret`,targetType:`channels.nextcloud-talk.accounts.*.botSecret`,configFile:`openclaw.json`,pathPattern:`channels.nextcloud-talk.accounts.*.botSecret`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.nextcloud-talk.apiPassword`,targetType:`channels.nextcloud-talk.apiPassword`,configFile:`openclaw.json`,pathPattern:`channels.nextcloud-talk.apiPassword`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.nextcloud-talk.botSecret`,targetType:`channels.nextcloud-talk.botSecret`,configFile:`openclaw.json`,pathPattern:`channels.nextcloud-talk.botSecret`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.slack.accounts.*.appToken`,targetType:`channels.slack.accounts.*.appToken`,configFile:`openclaw.json`,pathPattern:`channels.slack.accounts.*.appToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.slack.accounts.*.botToken`,targetType:`channels.slack.accounts.*.botToken`,configFile:`openclaw.json`,pathPattern:`channels.slack.accounts.*.botToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.slack.accounts.*.signingSecret`,targetType:`channels.slack.accounts.*.signingSecret`,configFile:`openclaw.json`,pathPattern:`channels.slack.accounts.*.signingSecret`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.slack.accounts.*.userToken`,targetType:`channels.slack.accounts.*.userToken`,configFile:`openclaw.json`,pathPattern:`channels.slack.accounts.*.userToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.slack.appToken`,targetType:`channels.slack.appToken`,configFile:`openclaw.json`,pathPattern:`channels.slack.appToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.slack.botToken`,targetType:`channels.slack.botToken`,configFile:`openclaw.json`,pathPattern:`channels.slack.botToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.slack.signingSecret`,targetType:`channels.slack.signingSecret`,configFile:`openclaw.json`,pathPattern:`channels.slack.signingSecret`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.slack.userToken`,targetType:`channels.slack.userToken`,configFile:`openclaw.json`,pathPattern:`channels.slack.userToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.telegram.accounts.*.botToken`,targetType:`channels.telegram.accounts.*.botToken`,configFile:`openclaw.json`,pathPattern:`channels.telegram.accounts.*.botToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.telegram.accounts.*.webhookSecret`,targetType:`channels.telegram.accounts.*.webhookSecret`,configFile:`openclaw.json`,pathPattern:`channels.telegram.accounts.*.webhookSecret`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.telegram.botToken`,targetType:`channels.telegram.botToken`,configFile:`openclaw.json`,pathPattern:`channels.telegram.botToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.telegram.webhookSecret`,targetType:`channels.telegram.webhookSecret`,configFile:`openclaw.json`,pathPattern:`channels.telegram.webhookSecret`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.zalo.accounts.*.botToken`,targetType:`channels.zalo.accounts.*.botToken`,configFile:`openclaw.json`,pathPattern:`channels.zalo.accounts.*.botToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.zalo.accounts.*.webhookSecret`,targetType:`channels.zalo.accounts.*.webhookSecret`,configFile:`openclaw.json`,pathPattern:`channels.zalo.accounts.*.webhookSecret`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.zalo.botToken`,targetType:`channels.zalo.botToken`,configFile:`openclaw.json`,pathPattern:`channels.zalo.botToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.zalo.webhookSecret`,targetType:`channels.zalo.webhookSecret`,configFile:`openclaw.json`,pathPattern:`channels.zalo.webhookSecret`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`cron.webhookToken`,targetType:`cron.webhookToken`,configFile:`openclaw.json`,pathPattern:`cron.webhookToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`gateway.auth.token`,targetType:`gateway.auth.token`,configFile:`openclaw.json`,pathPattern:`gateway.auth.token`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`gateway.auth.password`,targetType:`gateway.auth.password`,configFile:`openclaw.json`,pathPattern:`gateway.auth.password`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`gateway.remote.password`,targetType:`gateway.remote.password`,configFile:`openclaw.json`,pathPattern:`gateway.remote.password`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`gateway.remote.token`,targetType:`gateway.remote.token`,configFile:`openclaw.json`,pathPattern:`gateway.remote.token`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`messages.tts.elevenlabs.apiKey`,targetType:`messages.tts.elevenlabs.apiKey`,configFile:`openclaw.json`,pathPattern:`messages.tts.elevenlabs.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`messages.tts.openai.apiKey`,targetType:`messages.tts.openai.apiKey`,configFile:`openclaw.json`,pathPattern:`messages.tts.openai.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`models.providers.*.apiKey`,targetType:`models.providers.apiKey`,targetTypeAliases:[`models.providers.*.apiKey`],configFile:`openclaw.json`,pathPattern:`models.providers.*.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0,providerIdPathSegmentIndex:2,trackProviderShadowing:!0},{id:`models.providers.*.headers.*`,targetType:`models.providers.headers`,targetTypeAliases:[`models.providers.*.headers.*`],configFile:`openclaw.json`,pathPattern:`models.providers.*.headers.*`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0,providerIdPathSegmentIndex:2},{id:`skills.entries.*.apiKey`,targetType:`skills.entries.apiKey`,targetTypeAliases:[`skills.entries.*.apiKey`],configFile:`openclaw.json`,pathPattern:`skills.entries.*.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`talk.apiKey`,targetType:`talk.apiKey`,configFile:`openclaw.json`,pathPattern:`talk.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`talk.providers.*.apiKey`,targetType:`talk.providers.*.apiKey`,configFile:`openclaw.json`,pathPattern:`talk.providers.*.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`tools.web.fetch.firecrawl.apiKey`,targetType:`tools.web.fetch.firecrawl.apiKey`,configFile:`openclaw.json`,pathPattern:`tools.web.fetch.firecrawl.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`tools.web.search.apiKey`,targetType:`tools.web.search.apiKey`,configFile:`openclaw.json`,pathPattern:`tools.web.search.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`tools.web.search.gemini.apiKey`,targetType:`tools.web.search.gemini.apiKey`,configFile:`openclaw.json`,pathPattern:`tools.web.search.gemini.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`tools.web.search.grok.apiKey`,targetType:`tools.web.search.grok.apiKey`,configFile:`openclaw.json`,pathPattern:`tools.web.search.grok.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`tools.web.search.kimi.apiKey`,targetType:`tools.web.search.kimi.apiKey`,configFile:`openclaw.json`,pathPattern:`tools.web.search.kimi.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`tools.web.search.perplexity.apiKey`,targetType:`tools.web.search.perplexity.apiKey`,configFile:`openclaw.json`,pathPattern:`tools.web.search.perplexity.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0}];function S(e){return e.filter(e=>e.kind===`wildcard`||e.kind===`array`).length}function C(e){return a(e).map(t=>{if(t===`*`)return{kind:`wildcard`};if(t.endsWith(`[]`)){let n=t.slice(0,-2).trim();if(!n)throw Error(`Invalid target path pattern: ${e}`);return{kind:`array`,field:n}}return{kind:`literal`,value:t}})}function ne(e){let t=C(e.pathPattern),n=S(t),r=e.refPathPattern?C(e.refPathPattern):void 0,i=r?S(r):0;if(e.secretShape===`sibling_ref`&&!r)throw Error(`Missing refPathPattern for sibling_ref target: ${e.id}`);if(r&&i!==n)throw Error(`Mismatched wildcard shape for target ref path: ${e.id}`);return{...e,pathTokens:t,pathDynamicTokenCount:n,refPathTokens:r,refPathDynamicTokenCount:i}}function re(e,t){let n=[],r=0;for(let i of t){if(i.kind===`literal`){if(e[r]!==i.value)return null;r+=1;continue}if(i.kind===`wildcard`){let t=e[r];if(!t)return null;n.push(t),r+=1;continue}if(e[r]!==i.field)return null;let t=e[r+1];if(!t||!/^\d+$/.test(t))return null;n.push(t),r+=2}return r===e.length?{captures:n}:null}function ie(e,t){let n=[],r=0;for(let i of e){if(i.kind===`literal`){n.push(i.value);continue}if(i.kind===`wildcard`){let e=t[r];if(!e)return null;n.push(e),r+=1;continue}let e=t[r];if(!e||!/^\d+$/.test(e))return null;n.push(i.field,e),r+=1}return r===t.length?n:null}function ae(e,t){let n=[],i=(e,a,o,s)=>{let c=t[a];if(!c){n.push({segments:o,captures:s,value:e});return}let l=a===t.length-1;if(c.kind===`literal`){if(!r(e))return;if(l){n.push({segments:[...o,c.value],captures:s,value:e[c.value]});return}if(!Object.prototype.hasOwnProperty.call(e,c.value))return;i(e[c.value],a+1,[...o,c.value],s);return}if(c.kind===`wildcard`){if(!r(e))return;for(let[t,r]of Object.entries(e)){if(l){n.push({segments:[...o,t],captures:[...s,t],value:r});continue}i(r,a+1,[...o,t],[...s,t])}return}if(!r(e))return;let u=e[c.field];if(Array.isArray(u))for(let e=0;e<u.length;e+=1){let t=u[e],r=String(e);if(l){n.push({segments:[...o,c.field,r],captures:[...s,r],value:t});continue}i(t,a+1,[...o,c.field,r],[...s,r])}};return i(e,0,[],[]),n}const w=te.map(ne),oe=w.filter(e=>e.configFile===`openclaw.json`),se=w.filter(e=>e.configFile===`auth-profiles.json`);function ce(){let e=new Map,t=(t,n)=>{let r=e.get(t);if(r){r.push(n);return}e.set(t,[n])};for(let e of w){t(e.targetType,e);for(let n of e.targetTypeAliases??[])t(n,e)}return e}const le=ce(),ue=new Set(w.map(e=>e.id));function de(){let e=new Map;for(let t of oe){let n=e.get(t.id);if(n){n.push(t);continue}e.set(t.id,[t])}return e}const fe=de();function pe(){let e=new Map;for(let t of se){let n=e.get(t.id);if(n){n.push(t);continue}e.set(t.id,[t])}return e}const me=pe();function T(e){return e===void 0?null:new Set(Array.from(e).map(e=>e.trim()).filter(e=>e.length>0))}function E(e){return e.allowedTargetIds===null?e.defaultEntries:Array.from(e.allowedTargetIds).flatMap(t=>e.entriesById.get(t)??[])}function D(e,t){let n=[],r=new Set;for(let i of t){let t=ae(e,i.pathTokens);for(let a of t){let t=O(i,a.segments,a.captures);if(!t)continue;let o=`${i.id}:${t.pathSegments.join(`.`)}`;if(r.has(o))continue;r.add(o);let s=t.refPathSegments?m(e,t.refPathSegments):void 0;n.push({entry:i,path:t.pathSegments.join(`.`),pathSegments:t.pathSegments,...t.refPathSegments?{refPathSegments:t.refPathSegments,refPath:t.refPathSegments.join(`.`)}:{},value:a.value,...t.providerId?{providerId:t.providerId}:{},...t.accountId?{accountId:t.accountId}:{},...t.refPathSegments?{refValue:s}:{}})}}return n}function O(e,t,n){let r=e.providerIdPathSegmentIndex===void 0?void 0:t[e.providerIdPathSegmentIndex],i=e.accountIdPathSegmentIndex===void 0?void 0:t[e.accountIdPathSegmentIndex],a=e.refPathTokens?ie(e.refPathTokens,n):void 0;return e.refPathTokens&&!a?null:{entry:e,pathSegments:t,...a?{refPathSegments:a}:{},...r?{providerId:r}:{},...i?{accountId:i}:{}}}function he(){return w.map(e=>({id:e.id,targetType:e.targetType,...e.targetTypeAliases?{targetTypeAliases:[...e.targetTypeAliases]}:{},configFile:e.configFile,pathPattern:e.pathPattern,...e.refPathPattern?{refPathPattern:e.refPathPattern}:{},secretShape:e.secretShape,expectedResolvedValue:e.expectedResolvedValue,includeInPlan:e.includeInPlan,includeInConfigure:e.includeInConfigure,includeInAudit:e.includeInAudit,...e.providerIdPathSegmentIndex===void 0?{}:{providerIdPathSegmentIndex:e.providerIdPathSegmentIndex},...e.accountIdPathSegmentIndex===void 0?{}:{accountIdPathSegmentIndex:e.accountIdPathSegmentIndex},...e.authProfileType?{authProfileType:e.authProfileType}:{},...e.trackProviderShadowing?{trackProviderShadowing:!0}:{}}))}function ge(e){return typeof e==`string`&&le.has(e)}function _e(e){return typeof e==`string`&&ue.has(e)}function ve(e){let t=le.get(e.type);if(!t||t.length===0)return null;for(let n of t){if(!n.includeInPlan)continue;let t=re(e.pathSegments,n.pathTokens);if(!t)continue;let r=O(n,e.pathSegments,t.captures);if(r&&!(e.providerId&&e.providerId.trim().length>0&&(!r.providerId||r.providerId!==e.providerId))&&!(e.accountId&&e.accountId.trim().length>0&&(!r.accountId||r.accountId!==e.accountId)))return r}return null}function ye(e){return k(e)}function k(e,t){return D(e,E({allowedTargetIds:T(t),defaultEntries:oe,entriesById:fe}))}function be(e){return xe(e)}function xe(e,t){return D(e,E({allowedTargetIds:T(t),defaultEntries:se,entriesById:me}))}function Se(){return w.filter(e=>e.configFile===`auth-profiles.json`&&e.includeInAudit)}function A(e){let t=e.sourceConfig.secrets?.defaults,n=[],r=[],i=[],a=[];for(let c of k(e.sourceConfig,e.targetIds)){if(e.allowedPaths&&!e.allowedPaths.has(c.path))continue;let{explicitRef:l,ref:u}=o({value:c.value,refValue:c.refValue,defaults:t}),d=l?s(c.value,t):null;if(!u)continue;let f=m(e.resolvedConfig,c.pathSegments);if(!v(f,c.entry.expectedResolvedValue)){if(e.inactiveRefPaths?.has(c.path)){r.push(`${c.path}: secret ref is configured on an inactive surface; skipping command-time assignment.`),a.push({path:c.path,pathSegments:[...c.pathSegments]});continue}i.push({path:c.path,pathSegments:[...c.pathSegments]});continue}n.push({path:c.path,pathSegments:[...c.pathSegments],value:f}),c.entry.secretShape===`sibling_ref`&&l&&d&&r.push(`${c.path}: both inline and sibling ref were present; sibling ref took precedence.`)}return{assignments:n,diagnostics:r,unresolved:i,inactive:a}}function Ce(e){let t=A({sourceConfig:e.sourceConfig,resolvedConfig:e.resolvedConfig,targetIds:e.targetIds,inactiveRefPaths:e.inactiveRefPaths,allowedPaths:e.allowedPaths});if(t.unresolved.length>0)throw Error(`${e.commandName}: ${t.unresolved[0]?.path??`target`} is unresolved in the active runtime snapshot.`);return{assignments:t.assignments,diagnostics:t.diagnostics}}function we(e){return{sourceConfig:e.sourceConfig,env:e.env,cache:{},warnings:[],warningKeys:new Set,assignments:[]}}function j(e,t){e.assignments.push(t)}function M(e,t){let n=`${t.code}:${t.path}:${t.message}`;e.warningKeys.has(n)||(e.warningKeys.add(n),e.warnings.push(t))}function N(e){M(e.context,{code:`SECRETS_REF_IGNORED_INACTIVE_SURFACE`,path:e.path,message:e.details&&e.details.trim().length>0?`${e.path}: ${e.details}`:`${e.path}: secret ref is configured on an inactive surface; skipping resolution until it becomes active.`})}function P(e){let t=s(e.value,e.defaults);if(t){if(e.active===!1){N({context:e.context,path:e.path,details:e.inactiveReason});return}j(e.context,{ref:t,path:e.path,expected:e.expected,apply:e.apply})}}function Te(e){for(let t of e.assignments){let n=c(t.ref);if(!e.resolved.has(n))throw Error(`Secret reference "${n}" resolved to no value.`);let r=e.resolved.get(n);y({value:r,expected:t.expected,errorMessage:t.expected===`string`?`${t.path} resolved to a non-string or empty value.`:`${t.path} resolved to an unsupported value type.`}),t.apply(r)}}function F(e,t){return Object.prototype.hasOwnProperty.call(e,t)}function I(e){return r(e)?e.enabled!==!1:!0}function Ee(e,t){return I(e)&&I(t)}function L(e){let t=e.tts.elevenlabs;r(t)&&P({value:t.apiKey,path:`${e.pathPrefix}.elevenlabs.apiKey`,expected:`string`,defaults:e.defaults,context:e.context,active:e.active,inactiveReason:e.inactiveReason,apply:e=>{t.apiKey=e}});let n=e.tts.openai;r(n)&&P({value:n.apiKey,path:`${e.pathPrefix}.openai.apiKey`,expected:`string`,defaults:e.defaults,context:e.context,active:e.active,inactiveReason:e.inactiveReason,apply:e=>{n.apiKey=e}})}function R(e){let t=I(e),n=e.accounts;if(!r(n)||Object.keys(n).length===0)return{hasExplicitAccounts:!1,channelEnabled:t,accounts:[{accountId:`default`,account:e,enabled:t}]};let i=[];for(let[t,a]of Object.entries(n))r(a)&&i.push({accountId:t,account:a,enabled:Ee(e,a)});return{hasExplicitAccounts:!0,channelEnabled:t,accounts:i}}function z(e,t){return e.channelEnabled?e.hasExplicitAccounts?e.accounts.some(({account:e,enabled:n})=>n&&!F(e,t)):!0:!1}function B(e){return typeof e==`string`?e.trim():``}function V(e,t){return B(e).length>0||s(e,t)!==null}function H(e){if(P({value:e.channel[e.field],path:`channels.${e.channelKey}.${e.field}`,expected:`string`,defaults:e.defaults,context:e.context,active:z(e.surface,e.field),inactiveReason:e.topInactiveReason,apply:t=>{e.channel[e.field]=t}}),e.surface.hasExplicitAccounts)for(let{accountId:t,account:n,enabled:r}of e.surface.accounts)F(n,e.field)&&P({value:n[e.field],path:`channels.${e.channelKey}.accounts.${t}.${e.field}`,expected:`string`,defaults:e.defaults,context:e.context,active:r,inactiveReason:e.accountInactiveReason,apply:t=>{n[e.field]=t}})}function De(e){let t=e.config.channels;if(!r(t))return;let n=t.telegram;if(!r(n))return;let i=R(n),a=typeof n.tokenFile==`string`?n.tokenFile.trim():``,o=i.channelEnabled?i.hasExplicitAccounts?i.accounts.some(({account:t,enabled:n})=>{if(!n||a.length>0)return!1;let r=V(t.botToken,e.defaults),i=typeof t.tokenFile==`string`&&t.tokenFile.trim().length>0;return!r&&!i}):a.length===0:!1;if(P({value:n.botToken,path:`channels.telegram.botToken`,expected:`string`,defaults:e.defaults,context:e.context,active:o,inactiveReason:`no enabled Telegram surface inherits this top-level botToken (tokenFile is configured).`,apply:e=>{n.botToken=e}}),i.hasExplicitAccounts)for(let{accountId:t,account:n,enabled:r}of i.accounts){if(!F(n,`botToken`))continue;let i=typeof n.tokenFile==`string`?n.tokenFile.trim():``;P({value:n.botToken,path:`channels.telegram.accounts.${t}.botToken`,expected:`string`,defaults:e.defaults,context:e.context,active:r&&i.length===0,inactiveReason:`Telegram account is disabled or tokenFile is configured.`,apply:e=>{n.botToken=e}})}let s=typeof n.webhookUrl==`string`?n.webhookUrl.trim():``,c=i.channelEnabled?i.hasExplicitAccounts?i.accounts.some(({account:e,enabled:t})=>t&&!F(e,`webhookSecret`)&&(F(e,`webhookUrl`)?typeof e.webhookUrl==`string`&&e.webhookUrl.trim().length>0:s.length>0)):s.length>0:!1;if(P({value:n.webhookSecret,path:`channels.telegram.webhookSecret`,expected:`string`,defaults:e.defaults,context:e.context,active:c,inactiveReason:`no enabled Telegram webhook surface inherits this top-level webhookSecret (webhook mode is not active).`,apply:e=>{n.webhookSecret=e}}),i.hasExplicitAccounts)for(let{accountId:t,account:n,enabled:r}of i.accounts){if(!F(n,`webhookSecret`))continue;let i=F(n,`webhookUrl`)?typeof n.webhookUrl==`string`?n.webhookUrl.trim():``:s;P({value:n.webhookSecret,path:`channels.telegram.accounts.${t}.webhookSecret`,expected:`string`,defaults:e.defaults,context:e.context,active:r&&i.length>0,inactiveReason:`Telegram account is disabled or webhook mode is not active for this account.`,apply:e=>{n.webhookSecret=e}})}}function Oe(e){let t=e.config.channels;if(!r(t))return;let n=t.slack;if(!r(n))return;let i=R(n),a=n.mode===`http`||n.mode===`socket`?n.mode:`socket`;for(let t of[`botToken`,`userToken`])H({channelKey:`slack`,field:t,channel:n,surface:i,defaults:e.defaults,context:e.context,topInactiveReason:`no enabled account inherits this top-level Slack ${t}.`,accountInactiveReason:`Slack account is disabled.`});let o=i.channelEnabled?i.hasExplicitAccounts?i.accounts.some(({account:e,enabled:t})=>!t||F(e,`appToken`)?!1:(e.mode===`http`||e.mode===`socket`?e.mode:a)!==`http`):a!==`http`:!1;P({value:n.appToken,path:`channels.slack.appToken`,expected:`string`,defaults:e.defaults,context:e.context,active:o,inactiveReason:`no enabled Slack socket-mode surface inherits this top-level appToken.`,apply:e=>{n.appToken=e}});let s=i.channelEnabled?i.hasExplicitAccounts?i.accounts.some(({account:e,enabled:t})=>!t||F(e,`signingSecret`)?!1:(e.mode===`http`||e.mode===`socket`?e.mode:a)===`http`):a===`http`:!1;if(P({value:n.signingSecret,path:`channels.slack.signingSecret`,expected:`string`,defaults:e.defaults,context:e.context,active:s,inactiveReason:`no enabled Slack HTTP-mode surface inherits this top-level signingSecret.`,apply:e=>{n.signingSecret=e}}),i.hasExplicitAccounts)for(let{accountId:t,account:n,enabled:r}of i.accounts){let i=n.mode===`http`||n.mode===`socket`?n.mode:a;F(n,`appToken`)&&P({value:n.appToken,path:`channels.slack.accounts.${t}.appToken`,expected:`string`,defaults:e.defaults,context:e.context,active:r&&i!==`http`,inactiveReason:`Slack account is disabled or not running in socket mode.`,apply:e=>{n.appToken=e}}),F(n,`signingSecret`)&&P({value:n.signingSecret,path:`channels.slack.accounts.${t}.signingSecret`,expected:`string`,defaults:e.defaults,context:e.context,active:r&&i===`http`,inactiveReason:`Slack account is disabled or not running in HTTP mode.`,apply:e=>{n.signingSecret=e}})}}function ke(e){let t=e.config.channels;if(!r(t))return;let n=t.discord;if(!r(n))return;let i=R(n);if(H({channelKey:`discord`,field:`token`,channel:n,surface:i,defaults:e.defaults,context:e.context,topInactiveReason:`no enabled account inherits this top-level Discord token.`,accountInactiveReason:`Discord account is disabled.`}),r(n.pluralkit)){let t=n.pluralkit;P({value:t.token,path:`channels.discord.pluralkit.token`,expected:`string`,defaults:e.defaults,context:e.context,active:z(i,`pluralkit`)&&I(t),inactiveReason:`no enabled Discord surface inherits this top-level PluralKit config or PluralKit is disabled.`,apply:e=>{t.token=e}})}if(r(n.voice)&&r(n.voice.tts)&&L({tts:n.voice.tts,pathPrefix:`channels.discord.voice.tts`,defaults:e.defaults,context:e.context,active:z(i,`voice`)&&I(n.voice),inactiveReason:`no enabled Discord surface inherits this top-level voice config or voice is disabled.`}),i.hasExplicitAccounts)for(let{accountId:t,account:n,enabled:a}of i.accounts){if(F(n,`pluralkit`)&&r(n.pluralkit)){let r=n.pluralkit;P({value:r.token,path:`channels.discord.accounts.${t}.pluralkit.token`,expected:`string`,defaults:e.defaults,context:e.context,active:a&&I(r),inactiveReason:`Discord account is disabled or PluralKit is disabled for this account.`,apply:e=>{r.token=e}})}F(n,`voice`)&&r(n.voice)&&r(n.voice.tts)&&L({tts:n.voice.tts,pathPrefix:`channels.discord.accounts.${t}.voice.tts`,defaults:e.defaults,context:e.context,active:a&&I(n.voice),inactiveReason:`Discord account is disabled or voice is disabled for this account.`})}}function Ae(e){let t=e.config.channels;if(!r(t))return;let n=t.irc;if(!r(n))return;let i=R(n);if(H({channelKey:`irc`,field:`password`,channel:n,surface:i,defaults:e.defaults,context:e.context,topInactiveReason:`no enabled account inherits this top-level IRC password.`,accountInactiveReason:`IRC account is disabled.`}),r(n.nickserv)){let t=n.nickserv;P({value:t.password,path:`channels.irc.nickserv.password`,expected:`string`,defaults:e.defaults,context:e.context,active:z(i,`nickserv`)&&I(t),inactiveReason:`no enabled account inherits this top-level IRC nickserv config or NickServ is disabled.`,apply:e=>{t.password=e}})}if(i.hasExplicitAccounts){for(let{accountId:t,account:n,enabled:a}of i.accounts)if(F(n,`nickserv`)&&r(n.nickserv)){let r=n.nickserv;P({value:r.password,path:`channels.irc.accounts.${t}.nickserv.password`,expected:`string`,defaults:e.defaults,context:e.context,active:a&&I(r),inactiveReason:`IRC account is disabled or NickServ is disabled for this account.`,apply:e=>{r.password=e}})}}}function je(e){let t=e.config.channels;if(!r(t))return;let n=t.bluebubbles;r(n)&&H({channelKey:`bluebubbles`,field:`password`,channel:n,surface:R(n),defaults:e.defaults,context:e.context,topInactiveReason:`no enabled account inherits this top-level BlueBubbles password.`,accountInactiveReason:`BlueBubbles account is disabled.`})}function Me(e){let t=e.config.channels;if(!r(t))return;let n=t.msteams;r(n)&&P({value:n.appPassword,path:`channels.msteams.appPassword`,expected:`string`,defaults:e.defaults,context:e.context,active:n.enabled!==!1,inactiveReason:`Microsoft Teams channel is disabled.`,apply:e=>{n.appPassword=e}})}function Ne(e){let t=e.config.channels;if(!r(t))return;let n=t.mattermost;r(n)&&H({channelKey:`mattermost`,field:`botToken`,channel:n,surface:R(n),defaults:e.defaults,context:e.context,topInactiveReason:`no enabled account inherits this top-level Mattermost botToken.`,accountInactiveReason:`Mattermost account is disabled.`})}function Pe(e){let t=e.config.channels;if(!r(t))return;let n=t.matrix;if(!r(n))return;let i=R(n),a=B(e.context.env.MATRIX_ACCESS_TOKEN).length>0,o=V(n.accessToken,e.defaults),s=i.channelEnabled?i.hasExplicitAccounts?i.accounts.some(({account:t,enabled:n})=>n&&!F(t,`password`)&&!V(t.accessToken,e.defaults)&&!(o||a)):!(o||a):!1;if(P({value:n.password,path:`channels.matrix.password`,expected:`string`,defaults:e.defaults,context:e.context,active:s,inactiveReason:`no enabled Matrix surface inherits this top-level password (an accessToken is configured).`,apply:e=>{n.password=e}}),i.hasExplicitAccounts)for(let{accountId:t,account:n,enabled:r}of i.accounts){if(!F(n,`password`))continue;let i=V(n.accessToken,e.defaults),s=!F(n,`accessToken`)&&(o||a);P({value:n.password,path:`channels.matrix.accounts.${t}.password`,expected:`string`,defaults:e.defaults,context:e.context,active:r&&!(i||s),inactiveReason:`Matrix account is disabled or an accessToken is configured.`,apply:e=>{n.password=e}})}}function Fe(e){let t=e.config.channels;if(!r(t))return;let n=t.zalo;if(!r(n))return;let i=R(n),a=i.channelEnabled?i.hasExplicitAccounts?i.accounts.some(({account:e,enabled:t})=>t&&!F(e,`botToken`)):!0:!1;P({value:n.botToken,path:`channels.zalo.botToken`,expected:`string`,defaults:e.defaults,context:e.context,active:a,inactiveReason:`no enabled Zalo surface inherits this top-level botToken.`,apply:e=>{n.botToken=e}});let o=B(n.webhookUrl),s=i.channelEnabled?i.hasExplicitAccounts?i.accounts.some(({account:e,enabled:t})=>!t||F(e,`webhookSecret`)?!1:(F(e,`webhookUrl`)?B(e.webhookUrl):o).length>0):o.length>0:!1;if(P({value:n.webhookSecret,path:`channels.zalo.webhookSecret`,expected:`string`,defaults:e.defaults,context:e.context,active:s,inactiveReason:`no enabled Zalo webhook surface inherits this top-level webhookSecret (webhook mode is not active).`,apply:e=>{n.webhookSecret=e}}),i.hasExplicitAccounts){for(let{accountId:t,account:n,enabled:r}of i.accounts)if(F(n,`botToken`)&&P({value:n.botToken,path:`channels.zalo.accounts.${t}.botToken`,expected:`string`,defaults:e.defaults,context:e.context,active:r,inactiveReason:`Zalo account is disabled.`,apply:e=>{n.botToken=e}}),F(n,`webhookSecret`)){let i=F(n,`webhookUrl`)?B(n.webhookUrl):o;P({value:n.webhookSecret,path:`channels.zalo.accounts.${t}.webhookSecret`,expected:`string`,defaults:e.defaults,context:e.context,active:r&&i.length>0,inactiveReason:`Zalo account is disabled or webhook mode is not active for this account.`,apply:e=>{n.webhookSecret=e}})}}}function Ie(e){let t=e.config.channels;if(!r(t))return;let n=t.feishu;if(!r(n))return;let i=R(n);H({channelKey:`feishu`,field:`appSecret`,channel:n,surface:i,defaults:e.defaults,context:e.context,topInactiveReason:`no enabled account inherits this top-level Feishu appSecret.`,accountInactiveReason:`Feishu account is disabled.`});let a=B(n.connectionMode)===`webhook`?`webhook`:`websocket`,o=i.channelEnabled?i.hasExplicitAccounts?i.accounts.some(({account:e,enabled:t})=>!t||F(e,`verificationToken`)?!1:(F(e,`connectionMode`)?B(e.connectionMode):a)===`webhook`):a===`webhook`:!1;if(P({value:n.verificationToken,path:`channels.feishu.verificationToken`,expected:`string`,defaults:e.defaults,context:e.context,active:o,inactiveReason:`no enabled Feishu webhook-mode surface inherits this top-level verificationToken.`,apply:e=>{n.verificationToken=e}}),i.hasExplicitAccounts)for(let{accountId:t,account:n,enabled:r}of i.accounts){if(!F(n,`verificationToken`))continue;let i=F(n,`connectionMode`)?B(n.connectionMode):a;P({value:n.verificationToken,path:`channels.feishu.accounts.${t}.verificationToken`,expected:`string`,defaults:e.defaults,context:e.context,active:r&&i===`webhook`,inactiveReason:`Feishu account is disabled or not running in webhook mode.`,apply:e=>{n.verificationToken=e}})}}function Le(e){let t=e.config.channels;if(!r(t))return;let n=t[`nextcloud-talk`];if(!r(n))return;let i=R(n),a=i.channelEnabled?i.hasExplicitAccounts?i.accounts.some(({account:e,enabled:t})=>t&&!F(e,`botSecret`)):!0:!1;P({value:n.botSecret,path:`channels.nextcloud-talk.botSecret`,expected:`string`,defaults:e.defaults,context:e.context,active:a,inactiveReason:`no enabled Nextcloud Talk surface inherits this top-level botSecret.`,apply:e=>{n.botSecret=e}});let o=i.channelEnabled?i.hasExplicitAccounts?i.accounts.some(({account:e,enabled:t})=>t&&!F(e,`apiPassword`)):!0:!1;if(P({value:n.apiPassword,path:`channels.nextcloud-talk.apiPassword`,expected:`string`,defaults:e.defaults,context:e.context,active:o,inactiveReason:`no enabled Nextcloud Talk surface inherits this top-level apiPassword.`,apply:e=>{n.apiPassword=e}}),i.hasExplicitAccounts)for(let{accountId:t,account:n,enabled:r}of i.accounts)F(n,`botSecret`)&&P({value:n.botSecret,path:`channels.nextcloud-talk.accounts.${t}.botSecret`,expected:`string`,defaults:e.defaults,context:e.context,active:r,inactiveReason:`Nextcloud Talk account is disabled.`,apply:e=>{n.botSecret=e}}),F(n,`apiPassword`)&&P({value:n.apiPassword,path:`channels.nextcloud-talk.accounts.${t}.apiPassword`,expected:`string`,defaults:e.defaults,context:e.context,active:r,inactiveReason:`Nextcloud Talk account is disabled.`,apply:e=>{n.apiPassword=e}})}function U(e){let{explicitRef:t,ref:n}=o({value:e.target.serviceAccount,refValue:e.target.serviceAccountRef,defaults:e.defaults});if(n){if(e.active===!1){N({context:e.context,path:`${e.path}.serviceAccount`,details:e.inactiveReason});return}t&&e.target.serviceAccount!==void 0&&!s(e.target.serviceAccount,e.defaults)&&M(e.context,{code:`SECRETS_REF_OVERRIDES_PLAINTEXT`,path:e.path,message:`${e.path}: serviceAccountRef is set; runtime will ignore plaintext serviceAccount.`}),j(e.context,{ref:n,path:`${e.path}.serviceAccount`,expected:`string-or-object`,apply:t=>{e.target.serviceAccount=t}})}}function Re(e){let t=e.googleChat,n=R(t),r=n.channelEnabled?n.hasExplicitAccounts?n.accounts.some(({account:e,enabled:t})=>t&&!F(e,`serviceAccount`)&&!F(e,`serviceAccountRef`)):!0:!1;if(U({target:e.googleChat,path:`channels.googlechat`,defaults:e.defaults,context:e.context,active:r,inactiveReason:`no enabled account inherits this top-level Google Chat serviceAccount.`}),n.hasExplicitAccounts)for(let{accountId:t,account:r,enabled:i}of n.accounts)!F(r,`serviceAccount`)&&!F(r,`serviceAccountRef`)||U({target:r,path:`channels.googlechat.accounts.${t}`,defaults:e.defaults,context:e.context,active:i,inactiveReason:`Google Chat account is disabled.`})}function ze(e){let t=e.config.channels?.googlechat;t&&Re({googleChat:t,defaults:e.defaults,context:e.context}),De(e),Oe(e),ke(e),Ae(e),je(e),Ne(e),Pe(e),Me(e),Le(e),Ie(e),Fe(e)}const Be=[`gateway.auth.token`,`gateway.auth.password`,`gateway.remote.token`,`gateway.remote.password`];function Ve(e){return e??`unset`}function He(e){let t=[];return e.remoteMode&&t.push(`gateway.mode is "remote"`),e.remoteUrlConfigured&&t.push(`gateway.remote.url is configured`),e.tailscaleRemoteExposure&&t.push(`gateway.tailscale.mode is "serve" or "funnel"`),t.join(`; `)}function W(e){return{path:e.path,active:e.active,reason:e.reason,hasSecretRef:e.hasSecretRef}}function Ue(t){let n=t.config.gateway;if(!r(n))return{"gateway.auth.token":W({path:`gateway.auth.token`,active:!1,reason:`gateway configuration is not set.`,hasSecretRef:!1}),"gateway.auth.password":W({path:`gateway.auth.password`,active:!1,reason:`gateway configuration is not set.`,hasSecretRef:!1}),"gateway.remote.token":W({path:`gateway.remote.token`,active:!1,reason:`gateway configuration is not set.`,hasSecretRef:!1}),"gateway.remote.password":W({path:`gateway.remote.password`,active:!1,reason:`gateway configuration is not set.`,hasSecretRef:!1})};let i=r(n?.auth)?n.auth:void 0,a=r(n?.remote)?n.remote:void 0,o=e({config:t.config,env:t.env,includeLegacyEnv:!0,defaults:t.defaults}),s=i?o.passwordCanWin?o.authMode===`password`?`gateway.auth.mode is "password".`:`no token source can win, so password auth can win.`:o.authMode===`token`||o.authMode===`none`||o.authMode===`trusted-proxy`?`gateway.auth.mode is "${o.authMode}".`:o.envToken?`gateway token env var is configured.`:o.localToken.configured?`gateway.auth.token is configured.`:o.remoteToken.configured?`gateway.remote.token is configured.`:`token auth can win.`:`gateway.auth is not configured.`,c=i?o.authMode===`token`?o.envToken?`gateway token env var is configured.`:`gateway.auth.mode is "token".`:o.authMode===`password`||o.authMode===`none`||o.authMode===`trusted-proxy`?`gateway.auth.mode is "${o.authMode}".`:o.envToken?`gateway token env var is configured.`:o.envPassword?`gateway password env var is configured.`:o.localPassword.configured?`gateway.auth.password is configured.`:`token auth can win (mode is unset and no password source is configured).`:`gateway.auth is not configured.`,l=He({remoteMode:o.remoteMode,remoteUrlConfigured:o.remoteUrlConfigured,tailscaleRemoteExposure:o.tailscaleRemoteExposure}),u=a?o.remoteConfiguredSurface?`remote surface is active: ${l}.`:o.remoteTokenFallbackActive?`local token auth can win and no env/auth token is configured.`:o.localTokenCanWin?o.envToken?`gateway token env var is configured.`:o.localToken.configured?`gateway.auth.token is configured.`:`remote token fallback is not active.`:`token auth cannot win with gateway.auth.mode="${Ve(o.authMode)}".`:`gateway.remote is not configured.`,d=a?o.remoteConfiguredSurface?`remote surface is active: ${l}.`:o.remotePasswordFallbackActive?`password auth can win and no env/auth password is configured.`:o.passwordCanWin?o.envPassword?`gateway password env var is configured.`:o.localPassword.configured?`gateway.auth.password is configured.`:`remote password fallback is not active.`:o.authMode===`token`||o.authMode===`none`||o.authMode===`trusted-proxy`?`password auth cannot win with gateway.auth.mode="${o.authMode}".`:`a token source can win, so password auth cannot win.`:`gateway.remote is not configured.`;return{"gateway.auth.token":W({path:`gateway.auth.token`,active:o.localTokenSurfaceActive,reason:c,hasSecretRef:o.localToken.hasSecretRef}),"gateway.auth.password":W({path:`gateway.auth.password`,active:o.passwordCanWin,reason:s,hasSecretRef:o.localPassword.hasSecretRef}),"gateway.remote.token":W({path:`gateway.remote.token`,active:o.remoteTokenActive,reason:u,hasSecretRef:o.remoteToken.hasSecretRef}),"gateway.remote.password":W({path:`gateway.remote.password`,active:o.remotePasswordActive,reason:d,hasSecretRef:o.remotePassword.hasSecretRef})}}function We(e){for(let[t,n]of Object.entries(e.providers)){let i=n.enabled!==!1;P({value:n.apiKey,path:`models.providers.${t}.apiKey`,expected:`string`,defaults:e.defaults,context:e.context,active:i,inactiveReason:`provider is disabled.`,apply:e=>{n.apiKey=e}});let a=r(n.headers)?n.headers:void 0;if(a)for(let[n,r]of Object.entries(a))P({value:r,path:`models.providers.${t}.headers.${n}`,expected:`string`,defaults:e.defaults,context:e.context,active:i,inactiveReason:`provider is disabled.`,apply:e=>{a[n]=e}})}}function Ge(e){for(let[t,n]of Object.entries(e.entries))P({value:n.apiKey,path:`skills.entries.${t}.apiKey`,expected:`string`,defaults:e.defaults,context:e.context,active:n.enabled!==!1,inactiveReason:`skill entry is disabled.`,apply:e=>{n.apiKey=e}})}function Ke(e){let t=e.config.agents;if(!r(t))return;let n=r(t.defaults)?t.defaults:void 0,i=r(n?.memorySearch)?n.memorySearch:void 0,a=i?.enabled!==!1,o=Array.isArray(t.list)?t.list:[],s=!1;for(let e of o){if(!r(e)||e.enabled===!1)continue;let t=r(e.memorySearch)?e.memorySearch:void 0;if(t?.enabled===!1)continue;if(!t||!Object.prototype.hasOwnProperty.call(t,`remote`)){s=!0;continue}let n=r(t.remote)?t.remote:void 0;if(!n||!Object.prototype.hasOwnProperty.call(n,`apiKey`)){s=!0;continue}}if(i&&r(i.remote)){let t=i.remote;P({value:t.apiKey,path:`agents.defaults.memorySearch.remote.apiKey`,expected:`string`,defaults:e.defaults,context:e.context,active:a&&(s||o.length===0),inactiveReason:s?void 0:`all enabled agents override memorySearch.remote.apiKey.`,apply:e=>{t.apiKey=e}})}o.forEach((t,n)=>{if(!r(t))return;let i=r(t.memorySearch)?t.memorySearch:void 0;if(!i)return;let a=r(i.remote)?i.remote:void 0;if(!a||!Object.prototype.hasOwnProperty.call(a,`apiKey`))return;let o=t.enabled!==!1&&i.enabled!==!1;P({value:a.apiKey,path:`agents.list.${n}.memorySearch.remote.apiKey`,expected:`string`,defaults:e.defaults,context:e.context,active:o,inactiveReason:`agent or memorySearch override is disabled.`,apply:e=>{a.apiKey=e}})})}function qe(e){let t=e.config.talk;if(!r(t))return;P({value:t.apiKey,path:`talk.apiKey`,expected:`string`,defaults:e.defaults,context:e.context,apply:e=>{t.apiKey=e}});let n=t.providers;if(r(n))for(let[t,i]of Object.entries(n))r(i)&&P({value:i.apiKey,path:`talk.providers.${t}.apiKey`,expected:`string`,defaults:e.defaults,context:e.context,apply:e=>{i.apiKey=e}})}function Je(e){let t=e.config.gateway;if(!r(t))return;let n=r(t.auth)?t.auth:void 0,i=r(t.remote)?t.remote:void 0,a=Ue({config:e.config,env:e.context.env,defaults:e.defaults});n&&(P({value:n.token,path:`gateway.auth.token`,expected:`string`,defaults:e.defaults,context:e.context,active:a[`gateway.auth.token`].active,inactiveReason:a[`gateway.auth.token`].reason,apply:e=>{n.token=e}}),P({value:n.password,path:`gateway.auth.password`,expected:`string`,defaults:e.defaults,context:e.context,active:a[`gateway.auth.password`].active,inactiveReason:a[`gateway.auth.password`].reason,apply:e=>{n.password=e}})),i&&(P({value:i.token,path:`gateway.remote.token`,expected:`string`,defaults:e.defaults,context:e.context,active:a[`gateway.remote.token`].active,inactiveReason:a[`gateway.remote.token`].reason,apply:e=>{i.token=e}}),P({value:i.password,path:`gateway.remote.password`,expected:`string`,defaults:e.defaults,context:e.context,active:a[`gateway.remote.password`].active,inactiveReason:a[`gateway.remote.password`].reason,apply:e=>{i.password=e}}))}function Ye(e){let t=e.config.messages;!r(t)||!r(t.tts)||L({tts:t.tts,pathPrefix:`messages.tts`,defaults:e.defaults,context:e.context})}function Xe(e){let t=e.config.cron;r(t)&&P({value:t.webhookToken,path:`cron.webhookToken`,expected:`string`,defaults:e.defaults,context:e.context,apply:e=>{t.webhookToken=e}})}function Ze(e){let t=e.config.models?.providers;t&&We({providers:t,defaults:e.defaults,context:e.context});let n=e.config.skills?.entries;n&&Ge({entries:n,defaults:e.defaults,context:e.context}),Ke(e),qe(e),Je(e),Ye(e),Xe(e)}function Qe(e){let t=e.context.sourceConfig.secrets?.defaults;Ze({config:e.config,defaults:t,context:e.context}),ze({config:e.config,defaults:t,context:e.context})}const G=[`brave`,`gemini`,`grok`,`kimi`,`perplexity`],$e=`https://api.perplexity.ai`,K=`https://openrouter.ai/api/v1`,et=[`pplx-`],tt=[`sk-or-`];function q(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}function nt(e){if(typeof e!=`string`)return;let t=e.trim().toLowerCase();if(t===`brave`||t===`gemini`||t===`grok`||t===`kimi`||t===`perplexity`)return t}function J(e,n){for(let r of n){let n=t(e[r]);if(n)return{value:n,envVar:r}}return{}}function Y(e){return e.kind===`non-string`?`${e.path} SecretRef resolved to a non-string value.`:e.kind===`empty`?`${e.path} SecretRef resolved to an empty value.`:`${e.path} SecretRef is unresolved (${e.refLabel}).`}async function rt(e){let{ref:n}=o({value:e.value,defaults:e.defaults});if(!n){let n=t(e.value);if(n)return{value:n,source:`config`,secretRefConfigured:!1,fallbackUsedAfterRefFailure:!1};let r=J(e.context.env,e.envVars);return r.value?{value:r.value,source:`env`,fallbackEnvVar:r.envVar,secretRefConfigured:!1,fallbackUsedAfterRefFailure:!1}:{source:`missing`,secretRefConfigured:!1,fallbackUsedAfterRefFailure:!1}}let r=`${n.source}:${n.provider}:${n.id}`,a,s;try{let o=(await i([n],{config:e.sourceConfig,env:e.context.env,cache:e.context.cache})).get(c(n));typeof o==`string`?(a=t(o),a||(s=Y({path:e.path,kind:`empty`,refLabel:r}))):s=Y({path:e.path,kind:`non-string`,refLabel:r})}catch{s=Y({path:e.path,kind:`unresolved`,refLabel:r})}if(a)return{value:a,source:`secretRef`,secretRefConfigured:!0,fallbackUsedAfterRefFailure:!1};let l=J(e.context.env,e.envVars);return l.value?{value:l.value,source:`env`,fallbackEnvVar:l.envVar,unresolvedRefReason:s,secretRefConfigured:!0,fallbackUsedAfterRefFailure:!0}:{source:`missing`,unresolvedRefReason:s,secretRefConfigured:!0,fallbackUsedAfterRefFailure:!1}}function it(e){if(!e)return;let t=e.toLowerCase();if(et.some(e=>t.startsWith(e)))return`direct`;if(tt.some(e=>t.startsWith(e)))return`openrouter`}function at(e){let t=q(e.configValue)?e.configValue:void 0,n=typeof t?.baseUrl==`string`?t.baseUrl.trim():``,r=typeof t?.model==`string`?t.model.trim():``,i=(()=>{if(n)return n;if(e.keySource===`env`){if(e.fallbackEnvVar===`PERPLEXITY_API_KEY`)return $e;if(e.fallbackEnvVar===`OPENROUTER_API_KEY`)return K}return(e.keySource===`config`||e.keySource===`secretRef`)&&e.keyValue?it(e.keyValue)===`openrouter`?K:$e:K})(),a=!!(n||r),o=(()=>{try{return new URL(i).hostname.toLowerCase()===`api.perplexity.ai`}catch{return!1}})();return a||!o?`chat_completions`:`search_api`}function X(e,t){let n=e[t];if(q(n))return n;let r={};return e[t]=r,r}function Z(e){let t=X(X(X(e.resolvedConfig,`tools`),`web`),`search`);if(e.provider===`brave`){t.apiKey=e.value;return}let n=X(t,e.provider);n.apiKey=e.value}function ot(e){let t=X(X(X(X(e.resolvedConfig,`tools`),`web`),`fetch`),`firecrawl`);t.apiKey=e.value}function st(e){return e===`brave`?[`BRAVE_API_KEY`]:e===`gemini`?[`GEMINI_API_KEY`]:e===`grok`?[`XAI_API_KEY`]:e===`kimi`?[`KIMI_API_KEY`,`MOONSHOT_API_KEY`]:[`PERPLEXITY_API_KEY`,`OPENROUTER_API_KEY`]}function Q(e,t){if(t===`brave`)return e.apiKey;let n=e[t];if(q(n))return n.apiKey}function $(e,t){return!!o({value:e,defaults:t}).ref}async function ct(e){let n=e.sourceConfig.secrets?.defaults,r=[],i=q(e.sourceConfig.tools)?e.sourceConfig.tools:void 0,a=q(i?.web)?i.web:void 0,o=q(a?.search)?a.search:void 0,s={providerSource:`none`,diagnostics:[]},c=o?.enabled!==!1,l=typeof o?.provider==`string`?o.provider.trim().toLowerCase():``,u=nt(l);if(l&&!u){let t={code:`WEB_SEARCH_PROVIDER_INVALID_AUTODETECT`,message:`tools.web.search.provider is "${l}". Falling back to auto-detect precedence.`,path:`tools.web.search.provider`};r.push(t),s.diagnostics.push(t),M(e.context,{code:`WEB_SEARCH_PROVIDER_INVALID_AUTODETECT`,path:`tools.web.search.provider`,message:t.message})}if(u&&(s.providerConfigured=u,s.providerSource=`configured`),c&&o){let t=u?[u]:[...G],i=[],a,c;for(let l of t){let t=l===`brave`?`tools.web.search.apiKey`:`tools.web.search.${l}.apiKey`,d=Q(o,l),f=await rt({sourceConfig:e.sourceConfig,context:e.context,defaults:n,value:d,path:t,envVars:st(l)});if(f.secretRefConfigured&&f.fallbackUsedAfterRefFailure){let n={code:`WEB_SEARCH_KEY_UNRESOLVED_FALLBACK_USED`,message:`${t} SecretRef could not be resolved; using ${f.fallbackEnvVar??`env fallback`}. `+(f.unresolvedRefReason??``).trim(),path:t};r.push(n),s.diagnostics.push(n),M(e.context,{code:`WEB_SEARCH_KEY_UNRESOLVED_FALLBACK_USED`,path:t,message:n.message})}if(f.secretRefConfigured&&!f.value&&f.unresolvedRefReason&&i.push({provider:l,path:t,reason:f.unresolvedRefReason}),u){a=l,c=f,f.value&&Z({resolvedConfig:e.resolvedConfig,provider:l,value:f.value});break}if(f.value){a=l,c=f,Z({resolvedConfig:e.resolvedConfig,provider:l,value:f.value});break}}if(u){let t=i[0];if(t){let n={code:`WEB_SEARCH_KEY_UNRESOLVED_NO_FALLBACK`,message:t.reason,path:t.path};throw r.push(n),s.diagnostics.push(n),M(e.context,{code:`WEB_SEARCH_KEY_UNRESOLVED_NO_FALLBACK`,path:t.path,message:t.reason}),Error(`[WEB_SEARCH_KEY_UNRESOLVED_NO_FALLBACK] ${t.reason}`)}}else{if(!a&&i.length>0){let t=i[0],n={code:`WEB_SEARCH_KEY_UNRESOLVED_NO_FALLBACK`,message:t.reason,path:t.path};throw r.push(n),s.diagnostics.push(n),M(e.context,{code:`WEB_SEARCH_KEY_UNRESOLVED_NO_FALLBACK`,path:t.path,message:t.reason}),Error(`[WEB_SEARCH_KEY_UNRESOLVED_NO_FALLBACK] ${t.reason}`)}if(a){let e={code:`WEB_SEARCH_AUTODETECT_SELECTED`,message:`tools.web.search auto-detected provider "${a}" from available credentials.`,path:`tools.web.search.provider`};r.push(e),s.diagnostics.push(e)}}a&&(s.selectedProvider=a,s.selectedProviderKeySource=c?.source,u||(s.providerSource=`auto-detect`),a===`perplexity`&&(s.perplexityTransport=at({keyValue:c?.value,keySource:c?.source??`missing`,fallbackEnvVar:c?.fallbackEnvVar,configValue:o.perplexity})))}if(c&&o&&!u&&s.selectedProvider)for(let t of G){if(t===s.selectedProvider)continue;let r=t===`brave`?`tools.web.search.apiKey`:`tools.web.search.${t}.apiKey`;$(Q(o,t),n)&&N({context:e.context,path:r,details:`tools.web.search auto-detected provider is "${s.selectedProvider}".`})}else if(o&&!c)for(let t of G){let r=t===`brave`?`tools.web.search.apiKey`:`tools.web.search.${t}.apiKey`;$(Q(o,t),n)&&N({context:e.context,path:r,details:`tools.web.search is disabled.`})}if(c&&o&&u)for(let t of G){if(t===u)continue;let r=t===`brave`?`tools.web.search.apiKey`:`tools.web.search.${t}.apiKey`;$(Q(o,t),n)&&N({context:e.context,path:r,details:`tools.web.search.provider is "${u}".`})}let d=q(a?.fetch)?a.fetch:void 0,f=q(d?.firecrawl)?d.firecrawl:void 0,p=d?.enabled!==!1,m=f?.enabled!==!1,h=!!(p&&m),g=`tools.web.fetch.firecrawl.apiKey`,_={source:`missing`,secretRefConfigured:!1,fallbackUsedAfterRefFailure:!1},v=[];if(h){if(_=await rt({sourceConfig:e.sourceConfig,context:e.context,defaults:n,value:f?.apiKey,path:g,envVars:[`FIRECRAWL_API_KEY`]}),_.value&&ot({resolvedConfig:e.resolvedConfig,value:_.value}),_.secretRefConfigured){if(_.fallbackUsedAfterRefFailure){let t={code:`WEB_FETCH_FIRECRAWL_KEY_UNRESOLVED_FALLBACK_USED`,message:`${g} SecretRef could not be resolved; using ${_.fallbackEnvVar??`env fallback`}. `+(_.unresolvedRefReason??``).trim(),path:g};r.push(t),v.push(t),M(e.context,{code:`WEB_FETCH_FIRECRAWL_KEY_UNRESOLVED_FALLBACK_USED`,path:g,message:t.message})}if(!_.value&&_.unresolvedRefReason){let t={code:`WEB_FETCH_FIRECRAWL_KEY_UNRESOLVED_NO_FALLBACK`,message:_.unresolvedRefReason,path:g};throw r.push(t),v.push(t),M(e.context,{code:`WEB_FETCH_FIRECRAWL_KEY_UNRESOLVED_NO_FALLBACK`,path:g,message:_.unresolvedRefReason}),Error(`[WEB_FETCH_FIRECRAWL_KEY_UNRESOLVED_NO_FALLBACK] ${_.unresolvedRefReason}`)}}}else if($(f?.apiKey,n))N({context:e.context,path:g,details:p?`tools.web.fetch.firecrawl.enabled is false.`:`tools.web.fetch is disabled.`}),_={source:`secretRef`,secretRefConfigured:!0,fallbackUsedAfterRefFailure:!1};else{let n=t(f?.apiKey);if(n)_={value:n,source:`config`,secretRefConfigured:!1,fallbackUsedAfterRefFailure:!1};else{let t=J(e.context.env,[`FIRECRAWL_API_KEY`]);t.value&&(_={value:t.value,source:`env`,fallbackEnvVar:t.envVar,secretRefConfigured:!1,fallbackUsedAfterRefFailure:!1})}}return{search:s,fetch:{firecrawl:{active:h,apiKeySource:_.source,diagnostics:v}},diagnostics:r}}export{m as C,_ as S,g as T,he as _,Te as a,ee as b,M as c,be as d,ye as f,Se as g,ge as h,Ue as i,A as l,_e as m,Qe as n,we as o,k as p,Be as r,j as s,ct as t,Ce as u,ve as v,h as w,v as x,y};

package/dist/runtime-web-tools-CCIXUISf.js

@@ -1 +1 @@
-import{Ds as e,Os as t,Ts as n,ao as r,ks as i,lu as a}from"./model-selection-I1ctjFOB.js";import{d as o,i as s}from"./types.secrets-C-5U96pc.js";import{jt as c}from"./plugins-CYLrFT4h.js";import{isDeepStrictEqual as l}from"node:util";function u(e){return/^\d+$/.test(e)}function d(e){return u(e)?`array`:`object`}function f(e,t,n){if(!Array.isArray(e))return null;if(!u(t))throw Error(`Invalid array index segment "${t}" at ${n.join(`.`)}.`);return{array:e,index:Number.parseInt(t,10)}}function p(e){if(e.segments.length===0)throw Error(`Target path is empty.`);let n=e.root;for(let r=0;r<e.segments.length-1;r+=1){let i=e.segments[r]??``;if(Array.isArray(n)){if(!u(i))throw Error(`Invalid array index segment "${i}" at ${e.segments.join(`.`)}.`);let t=Number.parseInt(i,10);if(e.requireExistingSegment&&(t<0||t>=n.length))throw Error(`Path segment does not exist at ${e.segments.slice(0,r+1).join(`.`)}.`);n=n[t];continue}if(!t(n))throw Error(`Invalid path shape at ${e.segments.slice(0,r).join(`.`)||`<root>`}.`);if(e.requireExistingSegment&&!Object.prototype.hasOwnProperty.call(n,i))throw Error(`Path segment does not exist at ${e.segments.slice(0,r+1).join(`.`)}.`);n=n[i]}return n}function m(e,n){if(n.length===0)return;let r=e;for(let e of n){if(Array.isArray(r)){if(!u(e))return;r=r[Number.parseInt(e,10)];continue}if(!t(r))return;r=r[e]}return r}function h(e,n,r){if(n.length===0)throw Error(`Target path is empty.`);let i=e,a=!1;for(let e=0;e<n.length-1;e+=1){let r=n[e]??``,o=d(n[e+1]??``);if(Array.isArray(i)){if(!u(r))throw Error(`Invalid array index segment "${r}" at ${n.join(`.`)}.`);let s=Number.parseInt(r,10),c=i[s];if(c==null)i[s]=o===`array`?[]:{},a=!0;else if(o===`array`?!Array.isArray(c):!t(c))throw Error(`Invalid path shape at ${n.slice(0,e+1).join(`.`)}.`);i=i[s];continue}if(!t(i))throw Error(`Invalid path shape at ${n.slice(0,e).join(`.`)||`<root>`}.`);let s=i[r];if(s==null)i[r]=o===`array`?[]:{},a=!0;else if(o===`array`?!Array.isArray(s):!t(s))throw Error(`Invalid path shape at ${n.slice(0,e+1).join(`.`)}.`);i=i[r]}let o=n[n.length-1]??``,s=f(i,o,n);if(s)return l(s.array[s.index],r)||(s.array[s.index]=r,a=!0),a;if(!t(i))throw Error(`Invalid path shape at ${n.slice(0,-1).join(`.`)||`<root>`}.`);return l(i[o],r)||(i[o]=r,a=!0),a}function g(e,n,r){let i=p({root:e,segments:n,requireExistingSegment:!0}),a=n[n.length-1]??``,o=f(i,a,n);if(o){if(o.index<0||o.index>=o.array.length)throw Error(`Path segment does not exist at ${n.join(`.`)}.`);return l(o.array[o.index],r)?!1:(o.array[o.index]=r,!0)}if(!t(i))throw Error(`Invalid path shape at ${n.slice(0,-1).join(`.`)||`<root>`}.`);if(!Object.prototype.hasOwnProperty.call(i,a))throw Error(`Path segment does not exist at ${n.join(`.`)}.`);return l(i[a],r)?!1:(i[a]=r,!0)}function _(e,n){let r=p({root:e,segments:n,requireExistingSegment:!1}),i=n[n.length-1]??``,a=f(r,i,n);if(a)return a.index<0||a.index>=a.array.length?!1:(a.array.splice(a.index,1),!0);if(!t(r))throw Error(`Invalid path shape at ${n.slice(0,-1).join(`.`)||`<root>`}.`);return Object.prototype.hasOwnProperty.call(r,i)?(delete r[i],!0):!1}function v(n,r){return r===`string`?e(n):e(n)||t(n)}function ee(n,r){return r===`string`?e(n):e(n)||t(n)&&Object.keys(n).length>0}function y(e){if(!v(e.value,e.expected))throw Error(e.errorMessage)}const b=`secret_input`,x=`sibling_ref`,te=[{id:`auth-profiles.api_key.key`,targetType:`auth-profiles.api_key.key`,configFile:`auth-profiles.json`,pathPattern:`profiles.*.key`,refPathPattern:`profiles.*.keyRef`,secretShape:x,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0,authProfileType:`api_key`},{id:`auth-profiles.token.token`,targetType:`auth-profiles.token.token`,configFile:`auth-profiles.json`,pathPattern:`profiles.*.token`,refPathPattern:`profiles.*.tokenRef`,secretShape:x,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0,authProfileType:`token`},{id:`agents.defaults.memorySearch.remote.apiKey`,targetType:`agents.defaults.memorySearch.remote.apiKey`,configFile:`openclaw.json`,pathPattern:`agents.defaults.memorySearch.remote.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`agents.list[].memorySearch.remote.apiKey`,targetType:`agents.list[].memorySearch.remote.apiKey`,configFile:`openclaw.json`,pathPattern:`agents.list[].memorySearch.remote.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.bluebubbles.accounts.*.password`,targetType:`channels.bluebubbles.accounts.*.password`,configFile:`openclaw.json`,pathPattern:`channels.bluebubbles.accounts.*.password`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.bluebubbles.password`,targetType:`channels.bluebubbles.password`,configFile:`openclaw.json`,pathPattern:`channels.bluebubbles.password`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.discord.accounts.*.pluralkit.token`,targetType:`channels.discord.accounts.*.pluralkit.token`,configFile:`openclaw.json`,pathPattern:`channels.discord.accounts.*.pluralkit.token`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.discord.accounts.*.token`,targetType:`channels.discord.accounts.*.token`,configFile:`openclaw.json`,pathPattern:`channels.discord.accounts.*.token`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.discord.accounts.*.voice.tts.elevenlabs.apiKey`,targetType:`channels.discord.accounts.*.voice.tts.elevenlabs.apiKey`,configFile:`openclaw.json`,pathPattern:`channels.discord.accounts.*.voice.tts.elevenlabs.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.discord.accounts.*.voice.tts.openai.apiKey`,targetType:`channels.discord.accounts.*.voice.tts.openai.apiKey`,configFile:`openclaw.json`,pathPattern:`channels.discord.accounts.*.voice.tts.openai.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.discord.pluralkit.token`,targetType:`channels.discord.pluralkit.token`,configFile:`openclaw.json`,pathPattern:`channels.discord.pluralkit.token`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.discord.token`,targetType:`channels.discord.token`,configFile:`openclaw.json`,pathPattern:`channels.discord.token`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.discord.voice.tts.elevenlabs.apiKey`,targetType:`channels.discord.voice.tts.elevenlabs.apiKey`,configFile:`openclaw.json`,pathPattern:`channels.discord.voice.tts.elevenlabs.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.discord.voice.tts.openai.apiKey`,targetType:`channels.discord.voice.tts.openai.apiKey`,configFile:`openclaw.json`,pathPattern:`channels.discord.voice.tts.openai.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.feishu.accounts.*.appSecret`,targetType:`channels.feishu.accounts.*.appSecret`,configFile:`openclaw.json`,pathPattern:`channels.feishu.accounts.*.appSecret`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.feishu.accounts.*.verificationToken`,targetType:`channels.feishu.accounts.*.verificationToken`,configFile:`openclaw.json`,pathPattern:`channels.feishu.accounts.*.verificationToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.feishu.appSecret`,targetType:`channels.feishu.appSecret`,configFile:`openclaw.json`,pathPattern:`channels.feishu.appSecret`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.feishu.verificationToken`,targetType:`channels.feishu.verificationToken`,configFile:`openclaw.json`,pathPattern:`channels.feishu.verificationToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.googlechat.accounts.*.serviceAccount`,targetType:`channels.googlechat.serviceAccount`,targetTypeAliases:[`channels.googlechat.accounts.*.serviceAccount`],configFile:`openclaw.json`,pathPattern:`channels.googlechat.accounts.*.serviceAccount`,refPathPattern:`channels.googlechat.accounts.*.serviceAccountRef`,secretShape:x,expectedResolvedValue:`string-or-object`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0,accountIdPathSegmentIndex:3},{id:`channels.googlechat.serviceAccount`,targetType:`channels.googlechat.serviceAccount`,configFile:`openclaw.json`,pathPattern:`channels.googlechat.serviceAccount`,refPathPattern:`channels.googlechat.serviceAccountRef`,secretShape:x,expectedResolvedValue:`string-or-object`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.irc.accounts.*.nickserv.password`,targetType:`channels.irc.accounts.*.nickserv.password`,configFile:`openclaw.json`,pathPattern:`channels.irc.accounts.*.nickserv.password`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.irc.accounts.*.password`,targetType:`channels.irc.accounts.*.password`,configFile:`openclaw.json`,pathPattern:`channels.irc.accounts.*.password`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.irc.nickserv.password`,targetType:`channels.irc.nickserv.password`,configFile:`openclaw.json`,pathPattern:`channels.irc.nickserv.password`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.irc.password`,targetType:`channels.irc.password`,configFile:`openclaw.json`,pathPattern:`channels.irc.password`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.mattermost.accounts.*.botToken`,targetType:`channels.mattermost.accounts.*.botToken`,configFile:`openclaw.json`,pathPattern:`channels.mattermost.accounts.*.botToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.mattermost.botToken`,targetType:`channels.mattermost.botToken`,configFile:`openclaw.json`,pathPattern:`channels.mattermost.botToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.matrix.accounts.*.password`,targetType:`channels.matrix.accounts.*.password`,configFile:`openclaw.json`,pathPattern:`channels.matrix.accounts.*.password`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.matrix.password`,targetType:`channels.matrix.password`,configFile:`openclaw.json`,pathPattern:`channels.matrix.password`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.msteams.appPassword`,targetType:`channels.msteams.appPassword`,configFile:`openclaw.json`,pathPattern:`channels.msteams.appPassword`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.nextcloud-talk.accounts.*.apiPassword`,targetType:`channels.nextcloud-talk.accounts.*.apiPassword`,configFile:`openclaw.json`,pathPattern:`channels.nextcloud-talk.accounts.*.apiPassword`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.nextcloud-talk.accounts.*.botSecret`,targetType:`channels.nextcloud-talk.accounts.*.botSecret`,configFile:`openclaw.json`,pathPattern:`channels.nextcloud-talk.accounts.*.botSecret`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.nextcloud-talk.apiPassword`,targetType:`channels.nextcloud-talk.apiPassword`,configFile:`openclaw.json`,pathPattern:`channels.nextcloud-talk.apiPassword`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.nextcloud-talk.botSecret`,targetType:`channels.nextcloud-talk.botSecret`,configFile:`openclaw.json`,pathPattern:`channels.nextcloud-talk.botSecret`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.slack.accounts.*.appToken`,targetType:`channels.slack.accounts.*.appToken`,configFile:`openclaw.json`,pathPattern:`channels.slack.accounts.*.appToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.slack.accounts.*.botToken`,targetType:`channels.slack.accounts.*.botToken`,configFile:`openclaw.json`,pathPattern:`channels.slack.accounts.*.botToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.slack.accounts.*.signingSecret`,targetType:`channels.slack.accounts.*.signingSecret`,configFile:`openclaw.json`,pathPattern:`channels.slack.accounts.*.signingSecret`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.slack.accounts.*.userToken`,targetType:`channels.slack.accounts.*.userToken`,configFile:`openclaw.json`,pathPattern:`channels.slack.accounts.*.userToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.slack.appToken`,targetType:`channels.slack.appToken`,configFile:`openclaw.json`,pathPattern:`channels.slack.appToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.slack.botToken`,targetType:`channels.slack.botToken`,configFile:`openclaw.json`,pathPattern:`channels.slack.botToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.slack.signingSecret`,targetType:`channels.slack.signingSecret`,configFile:`openclaw.json`,pathPattern:`channels.slack.signingSecret`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.slack.userToken`,targetType:`channels.slack.userToken`,configFile:`openclaw.json`,pathPattern:`channels.slack.userToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.telegram.accounts.*.botToken`,targetType:`channels.telegram.accounts.*.botToken`,configFile:`openclaw.json`,pathPattern:`channels.telegram.accounts.*.botToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.telegram.accounts.*.webhookSecret`,targetType:`channels.telegram.accounts.*.webhookSecret`,configFile:`openclaw.json`,pathPattern:`channels.telegram.accounts.*.webhookSecret`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.telegram.botToken`,targetType:`channels.telegram.botToken`,configFile:`openclaw.json`,pathPattern:`channels.telegram.botToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.telegram.webhookSecret`,targetType:`channels.telegram.webhookSecret`,configFile:`openclaw.json`,pathPattern:`channels.telegram.webhookSecret`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.zalo.accounts.*.botToken`,targetType:`channels.zalo.accounts.*.botToken`,configFile:`openclaw.json`,pathPattern:`channels.zalo.accounts.*.botToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.zalo.accounts.*.webhookSecret`,targetType:`channels.zalo.accounts.*.webhookSecret`,configFile:`openclaw.json`,pathPattern:`channels.zalo.accounts.*.webhookSecret`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.zalo.botToken`,targetType:`channels.zalo.botToken`,configFile:`openclaw.json`,pathPattern:`channels.zalo.botToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.zalo.webhookSecret`,targetType:`channels.zalo.webhookSecret`,configFile:`openclaw.json`,pathPattern:`channels.zalo.webhookSecret`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`cron.webhookToken`,targetType:`cron.webhookToken`,configFile:`openclaw.json`,pathPattern:`cron.webhookToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`gateway.auth.token`,targetType:`gateway.auth.token`,configFile:`openclaw.json`,pathPattern:`gateway.auth.token`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`gateway.auth.password`,targetType:`gateway.auth.password`,configFile:`openclaw.json`,pathPattern:`gateway.auth.password`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`gateway.remote.password`,targetType:`gateway.remote.password`,configFile:`openclaw.json`,pathPattern:`gateway.remote.password`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`gateway.remote.token`,targetType:`gateway.remote.token`,configFile:`openclaw.json`,pathPattern:`gateway.remote.token`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`messages.tts.elevenlabs.apiKey`,targetType:`messages.tts.elevenlabs.apiKey`,configFile:`openclaw.json`,pathPattern:`messages.tts.elevenlabs.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`messages.tts.openai.apiKey`,targetType:`messages.tts.openai.apiKey`,configFile:`openclaw.json`,pathPattern:`messages.tts.openai.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`models.providers.*.apiKey`,targetType:`models.providers.apiKey`,targetTypeAliases:[`models.providers.*.apiKey`],configFile:`openclaw.json`,pathPattern:`models.providers.*.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0,providerIdPathSegmentIndex:2,trackProviderShadowing:!0},{id:`models.providers.*.headers.*`,targetType:`models.providers.headers`,targetTypeAliases:[`models.providers.*.headers.*`],configFile:`openclaw.json`,pathPattern:`models.providers.*.headers.*`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0,providerIdPathSegmentIndex:2},{id:`skills.entries.*.apiKey`,targetType:`skills.entries.apiKey`,targetTypeAliases:[`skills.entries.*.apiKey`],configFile:`openclaw.json`,pathPattern:`skills.entries.*.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`talk.apiKey`,targetType:`talk.apiKey`,configFile:`openclaw.json`,pathPattern:`talk.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`talk.providers.*.apiKey`,targetType:`talk.providers.*.apiKey`,configFile:`openclaw.json`,pathPattern:`talk.providers.*.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`tools.web.fetch.firecrawl.apiKey`,targetType:`tools.web.fetch.firecrawl.apiKey`,configFile:`openclaw.json`,pathPattern:`tools.web.fetch.firecrawl.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`tools.web.search.apiKey`,targetType:`tools.web.search.apiKey`,configFile:`openclaw.json`,pathPattern:`tools.web.search.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`tools.web.search.gemini.apiKey`,targetType:`tools.web.search.gemini.apiKey`,configFile:`openclaw.json`,pathPattern:`tools.web.search.gemini.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`tools.web.search.grok.apiKey`,targetType:`tools.web.search.grok.apiKey`,configFile:`openclaw.json`,pathPattern:`tools.web.search.grok.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`tools.web.search.kimi.apiKey`,targetType:`tools.web.search.kimi.apiKey`,configFile:`openclaw.json`,pathPattern:`tools.web.search.kimi.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`tools.web.search.perplexity.apiKey`,targetType:`tools.web.search.perplexity.apiKey`,configFile:`openclaw.json`,pathPattern:`tools.web.search.perplexity.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0}];function S(e){return e.filter(e=>e.kind===`wildcard`||e.kind===`array`).length}function C(e){return i(e).map(t=>{if(t===`*`)return{kind:`wildcard`};if(t.endsWith(`[]`)){let n=t.slice(0,-2).trim();if(!n)throw Error(`Invalid target path pattern: ${e}`);return{kind:`array`,field:n}}return{kind:`literal`,value:t}})}function ne(e){let t=C(e.pathPattern),n=S(t),r=e.refPathPattern?C(e.refPathPattern):void 0,i=r?S(r):0;if(e.secretShape===`sibling_ref`&&!r)throw Error(`Missing refPathPattern for sibling_ref target: ${e.id}`);if(r&&i!==n)throw Error(`Mismatched wildcard shape for target ref path: ${e.id}`);return{...e,pathTokens:t,pathDynamicTokenCount:n,refPathTokens:r,refPathDynamicTokenCount:i}}function re(e,t){let n=[],r=0;for(let i of t){if(i.kind===`literal`){if(e[r]!==i.value)return null;r+=1;continue}if(i.kind===`wildcard`){let t=e[r];if(!t)return null;n.push(t),r+=1;continue}if(e[r]!==i.field)return null;let t=e[r+1];if(!t||!/^\d+$/.test(t))return null;n.push(t),r+=2}return r===e.length?{captures:n}:null}function ie(e,t){let n=[],r=0;for(let i of e){if(i.kind===`literal`){n.push(i.value);continue}if(i.kind===`wildcard`){let e=t[r];if(!e)return null;n.push(e),r+=1;continue}let e=t[r];if(!e||!/^\d+$/.test(e))return null;n.push(i.field,e),r+=1}return r===t.length?n:null}function ae(e,n){let r=[],i=(e,a,o,s)=>{let c=n[a];if(!c){r.push({segments:o,captures:s,value:e});return}let l=a===n.length-1;if(c.kind===`literal`){if(!t(e))return;if(l){r.push({segments:[...o,c.value],captures:s,value:e[c.value]});return}if(!Object.prototype.hasOwnProperty.call(e,c.value))return;i(e[c.value],a+1,[...o,c.value],s);return}if(c.kind===`wildcard`){if(!t(e))return;for(let[t,n]of Object.entries(e)){if(l){r.push({segments:[...o,t],captures:[...s,t],value:n});continue}i(n,a+1,[...o,t],[...s,t])}return}if(!t(e))return;let u=e[c.field];if(Array.isArray(u))for(let e=0;e<u.length;e+=1){let t=u[e],n=String(e);if(l){r.push({segments:[...o,c.field,n],captures:[...s,n],value:t});continue}i(t,a+1,[...o,c.field,n],[...s,n])}};return i(e,0,[],[]),r}const w=te.map(ne),oe=w.filter(e=>e.configFile===`openclaw.json`),se=w.filter(e=>e.configFile===`auth-profiles.json`);function ce(){let e=new Map,t=(t,n)=>{let r=e.get(t);if(r){r.push(n);return}e.set(t,[n])};for(let e of w){t(e.targetType,e);for(let n of e.targetTypeAliases??[])t(n,e)}return e}const le=ce(),ue=new Set(w.map(e=>e.id));function de(){let e=new Map;for(let t of oe){let n=e.get(t.id);if(n){n.push(t);continue}e.set(t.id,[t])}return e}const fe=de();function pe(){let e=new Map;for(let t of se){let n=e.get(t.id);if(n){n.push(t);continue}e.set(t.id,[t])}return e}const me=pe();function T(e){return e===void 0?null:new Set(Array.from(e).map(e=>e.trim()).filter(e=>e.length>0))}function E(e){return e.allowedTargetIds===null?e.defaultEntries:Array.from(e.allowedTargetIds).flatMap(t=>e.entriesById.get(t)??[])}function D(e,t){let n=[],r=new Set;for(let i of t){let t=ae(e,i.pathTokens);for(let a of t){let t=O(i,a.segments,a.captures);if(!t)continue;let o=`${i.id}:${t.pathSegments.join(`.`)}`;if(r.has(o))continue;r.add(o);let s=t.refPathSegments?m(e,t.refPathSegments):void 0;n.push({entry:i,path:t.pathSegments.join(`.`),pathSegments:t.pathSegments,...t.refPathSegments?{refPathSegments:t.refPathSegments,refPath:t.refPathSegments.join(`.`)}:{},value:a.value,...t.providerId?{providerId:t.providerId}:{},...t.accountId?{accountId:t.accountId}:{},...t.refPathSegments?{refValue:s}:{}})}}return n}function O(e,t,n){let r=e.providerIdPathSegmentIndex===void 0?void 0:t[e.providerIdPathSegmentIndex],i=e.accountIdPathSegmentIndex===void 0?void 0:t[e.accountIdPathSegmentIndex],a=e.refPathTokens?ie(e.refPathTokens,n):void 0;return e.refPathTokens&&!a?null:{entry:e,pathSegments:t,...a?{refPathSegments:a}:{},...r?{providerId:r}:{},...i?{accountId:i}:{}}}function he(){return w.map(e=>({id:e.id,targetType:e.targetType,...e.targetTypeAliases?{targetTypeAliases:[...e.targetTypeAliases]}:{},configFile:e.configFile,pathPattern:e.pathPattern,...e.refPathPattern?{refPathPattern:e.refPathPattern}:{},secretShape:e.secretShape,expectedResolvedValue:e.expectedResolvedValue,includeInPlan:e.includeInPlan,includeInConfigure:e.includeInConfigure,includeInAudit:e.includeInAudit,...e.providerIdPathSegmentIndex===void 0?{}:{providerIdPathSegmentIndex:e.providerIdPathSegmentIndex},...e.accountIdPathSegmentIndex===void 0?{}:{accountIdPathSegmentIndex:e.accountIdPathSegmentIndex},...e.authProfileType?{authProfileType:e.authProfileType}:{},...e.trackProviderShadowing?{trackProviderShadowing:!0}:{}}))}function ge(e){return typeof e==`string`&&le.has(e)}function _e(e){return typeof e==`string`&&ue.has(e)}function ve(e){let t=le.get(e.type);if(!t||t.length===0)return null;for(let n of t){if(!n.includeInPlan)continue;let t=re(e.pathSegments,n.pathTokens);if(!t)continue;let r=O(n,e.pathSegments,t.captures);if(r&&!(e.providerId&&e.providerId.trim().length>0&&(!r.providerId||r.providerId!==e.providerId))&&!(e.accountId&&e.accountId.trim().length>0&&(!r.accountId||r.accountId!==e.accountId)))return r}return null}function ye(e){return k(e)}function k(e,t){return D(e,E({allowedTargetIds:T(t),defaultEntries:oe,entriesById:fe}))}function be(e){return xe(e)}function xe(e,t){return D(e,E({allowedTargetIds:T(t),defaultEntries:se,entriesById:me}))}function Se(){return w.filter(e=>e.configFile===`auth-profiles.json`&&e.includeInAudit)}function A(e){let t=e.sourceConfig.secrets?.defaults,n=[],r=[],i=[],a=[];for(let c of k(e.sourceConfig,e.targetIds)){if(e.allowedPaths&&!e.allowedPaths.has(c.path))continue;let{explicitRef:l,ref:u}=o({value:c.value,refValue:c.refValue,defaults:t}),d=l?s(c.value,t):null;if(!u)continue;let f=m(e.resolvedConfig,c.pathSegments);if(!v(f,c.entry.expectedResolvedValue)){if(e.inactiveRefPaths?.has(c.path)){r.push(`${c.path}: secret ref is configured on an inactive surface; skipping command-time assignment.`),a.push({path:c.path,pathSegments:[...c.pathSegments]});continue}i.push({path:c.path,pathSegments:[...c.pathSegments]});continue}n.push({path:c.path,pathSegments:[...c.pathSegments],value:f}),c.entry.secretShape===`sibling_ref`&&l&&d&&r.push(`${c.path}: both inline and sibling ref were present; sibling ref took precedence.`)}return{assignments:n,diagnostics:r,unresolved:i,inactive:a}}function Ce(e){let t=A({sourceConfig:e.sourceConfig,resolvedConfig:e.resolvedConfig,targetIds:e.targetIds,inactiveRefPaths:e.inactiveRefPaths,allowedPaths:e.allowedPaths});if(t.unresolved.length>0)throw Error(`${e.commandName}: ${t.unresolved[0]?.path??`target`} is unresolved in the active runtime snapshot.`);return{assignments:t.assignments,diagnostics:t.diagnostics}}function we(e){return{sourceConfig:e.sourceConfig,env:e.env,cache:{},warnings:[],warningKeys:new Set,assignments:[]}}function j(e,t){e.assignments.push(t)}function M(e,t){let n=`${t.code}:${t.path}:${t.message}`;e.warningKeys.has(n)||(e.warningKeys.add(n),e.warnings.push(t))}function N(e){M(e.context,{code:`SECRETS_REF_IGNORED_INACTIVE_SURFACE`,path:e.path,message:e.details&&e.details.trim().length>0?`${e.path}: ${e.details}`:`${e.path}: secret ref is configured on an inactive surface; skipping resolution until it becomes active.`})}function P(e){let t=s(e.value,e.defaults);if(t){if(e.active===!1){N({context:e.context,path:e.path,details:e.inactiveReason});return}j(e.context,{ref:t,path:e.path,expected:e.expected,apply:e.apply})}}function Te(e){for(let t of e.assignments){let n=c(t.ref);if(!e.resolved.has(n))throw Error(`Secret reference "${n}" resolved to no value.`);let r=e.resolved.get(n);y({value:r,expected:t.expected,errorMessage:t.expected===`string`?`${t.path} resolved to a non-string or empty value.`:`${t.path} resolved to an unsupported value type.`}),t.apply(r)}}function F(e,t){return Object.prototype.hasOwnProperty.call(e,t)}function I(e){return t(e)?e.enabled!==!1:!0}function Ee(e,t){return I(e)&&I(t)}function L(e){let n=e.tts.elevenlabs;t(n)&&P({value:n.apiKey,path:`${e.pathPrefix}.elevenlabs.apiKey`,expected:`string`,defaults:e.defaults,context:e.context,active:e.active,inactiveReason:e.inactiveReason,apply:e=>{n.apiKey=e}});let r=e.tts.openai;t(r)&&P({value:r.apiKey,path:`${e.pathPrefix}.openai.apiKey`,expected:`string`,defaults:e.defaults,context:e.context,active:e.active,inactiveReason:e.inactiveReason,apply:e=>{r.apiKey=e}})}function R(e){let n=I(e),r=e.accounts;if(!t(r)||Object.keys(r).length===0)return{hasExplicitAccounts:!1,channelEnabled:n,accounts:[{accountId:`default`,account:e,enabled:n}]};let i=[];for(let[n,a]of Object.entries(r))t(a)&&i.push({accountId:n,account:a,enabled:Ee(e,a)});return{hasExplicitAccounts:!0,channelEnabled:n,accounts:i}}function z(e,t){return e.channelEnabled?e.hasExplicitAccounts?e.accounts.some(({account:e,enabled:n})=>n&&!F(e,t)):!0:!1}function B(e){return typeof e==`string`?e.trim():``}function V(e,t){return B(e).length>0||s(e,t)!==null}function H(e){if(P({value:e.channel[e.field],path:`channels.${e.channelKey}.${e.field}`,expected:`string`,defaults:e.defaults,context:e.context,active:z(e.surface,e.field),inactiveReason:e.topInactiveReason,apply:t=>{e.channel[e.field]=t}}),e.surface.hasExplicitAccounts)for(let{accountId:t,account:n,enabled:r}of e.surface.accounts)F(n,e.field)&&P({value:n[e.field],path:`channels.${e.channelKey}.accounts.${t}.${e.field}`,expected:`string`,defaults:e.defaults,context:e.context,active:r,inactiveReason:e.accountInactiveReason,apply:t=>{n[e.field]=t}})}function De(e){let n=e.config.channels;if(!t(n))return;let r=n.telegram;if(!t(r))return;let i=R(r),a=typeof r.tokenFile==`string`?r.tokenFile.trim():``,o=i.channelEnabled?i.hasExplicitAccounts?i.accounts.some(({account:t,enabled:n})=>{if(!n||a.length>0)return!1;let r=V(t.botToken,e.defaults),i=typeof t.tokenFile==`string`&&t.tokenFile.trim().length>0;return!r&&!i}):a.length===0:!1;if(P({value:r.botToken,path:`channels.telegram.botToken`,expected:`string`,defaults:e.defaults,context:e.context,active:o,inactiveReason:`no enabled Telegram surface inherits this top-level botToken (tokenFile is configured).`,apply:e=>{r.botToken=e}}),i.hasExplicitAccounts)for(let{accountId:t,account:n,enabled:r}of i.accounts){if(!F(n,`botToken`))continue;let i=typeof n.tokenFile==`string`?n.tokenFile.trim():``;P({value:n.botToken,path:`channels.telegram.accounts.${t}.botToken`,expected:`string`,defaults:e.defaults,context:e.context,active:r&&i.length===0,inactiveReason:`Telegram account is disabled or tokenFile is configured.`,apply:e=>{n.botToken=e}})}let s=typeof r.webhookUrl==`string`?r.webhookUrl.trim():``,c=i.channelEnabled?i.hasExplicitAccounts?i.accounts.some(({account:e,enabled:t})=>t&&!F(e,`webhookSecret`)&&(F(e,`webhookUrl`)?typeof e.webhookUrl==`string`&&e.webhookUrl.trim().length>0:s.length>0)):s.length>0:!1;if(P({value:r.webhookSecret,path:`channels.telegram.webhookSecret`,expected:`string`,defaults:e.defaults,context:e.context,active:c,inactiveReason:`no enabled Telegram webhook surface inherits this top-level webhookSecret (webhook mode is not active).`,apply:e=>{r.webhookSecret=e}}),i.hasExplicitAccounts)for(let{accountId:t,account:n,enabled:r}of i.accounts){if(!F(n,`webhookSecret`))continue;let i=F(n,`webhookUrl`)?typeof n.webhookUrl==`string`?n.webhookUrl.trim():``:s;P({value:n.webhookSecret,path:`channels.telegram.accounts.${t}.webhookSecret`,expected:`string`,defaults:e.defaults,context:e.context,active:r&&i.length>0,inactiveReason:`Telegram account is disabled or webhook mode is not active for this account.`,apply:e=>{n.webhookSecret=e}})}}function Oe(e){let n=e.config.channels;if(!t(n))return;let r=n.slack;if(!t(r))return;let i=R(r),a=r.mode===`http`||r.mode===`socket`?r.mode:`socket`;for(let t of[`botToken`,`userToken`])H({channelKey:`slack`,field:t,channel:r,surface:i,defaults:e.defaults,context:e.context,topInactiveReason:`no enabled account inherits this top-level Slack ${t}.`,accountInactiveReason:`Slack account is disabled.`});let o=i.channelEnabled?i.hasExplicitAccounts?i.accounts.some(({account:e,enabled:t})=>!t||F(e,`appToken`)?!1:(e.mode===`http`||e.mode===`socket`?e.mode:a)!==`http`):a!==`http`:!1;P({value:r.appToken,path:`channels.slack.appToken`,expected:`string`,defaults:e.defaults,context:e.context,active:o,inactiveReason:`no enabled Slack socket-mode surface inherits this top-level appToken.`,apply:e=>{r.appToken=e}});let s=i.channelEnabled?i.hasExplicitAccounts?i.accounts.some(({account:e,enabled:t})=>!t||F(e,`signingSecret`)?!1:(e.mode===`http`||e.mode===`socket`?e.mode:a)===`http`):a===`http`:!1;if(P({value:r.signingSecret,path:`channels.slack.signingSecret`,expected:`string`,defaults:e.defaults,context:e.context,active:s,inactiveReason:`no enabled Slack HTTP-mode surface inherits this top-level signingSecret.`,apply:e=>{r.signingSecret=e}}),i.hasExplicitAccounts)for(let{accountId:t,account:n,enabled:r}of i.accounts){let i=n.mode===`http`||n.mode===`socket`?n.mode:a;F(n,`appToken`)&&P({value:n.appToken,path:`channels.slack.accounts.${t}.appToken`,expected:`string`,defaults:e.defaults,context:e.context,active:r&&i!==`http`,inactiveReason:`Slack account is disabled or not running in socket mode.`,apply:e=>{n.appToken=e}}),F(n,`signingSecret`)&&P({value:n.signingSecret,path:`channels.slack.accounts.${t}.signingSecret`,expected:`string`,defaults:e.defaults,context:e.context,active:r&&i===`http`,inactiveReason:`Slack account is disabled or not running in HTTP mode.`,apply:e=>{n.signingSecret=e}})}}function ke(e){let n=e.config.channels;if(!t(n))return;let r=n.discord;if(!t(r))return;let i=R(r);if(H({channelKey:`discord`,field:`token`,channel:r,surface:i,defaults:e.defaults,context:e.context,topInactiveReason:`no enabled account inherits this top-level Discord token.`,accountInactiveReason:`Discord account is disabled.`}),t(r.pluralkit)){let t=r.pluralkit;P({value:t.token,path:`channels.discord.pluralkit.token`,expected:`string`,defaults:e.defaults,context:e.context,active:z(i,`pluralkit`)&&I(t),inactiveReason:`no enabled Discord surface inherits this top-level PluralKit config or PluralKit is disabled.`,apply:e=>{t.token=e}})}if(t(r.voice)&&t(r.voice.tts)&&L({tts:r.voice.tts,pathPrefix:`channels.discord.voice.tts`,defaults:e.defaults,context:e.context,active:z(i,`voice`)&&I(r.voice),inactiveReason:`no enabled Discord surface inherits this top-level voice config or voice is disabled.`}),i.hasExplicitAccounts)for(let{accountId:n,account:r,enabled:a}of i.accounts){if(F(r,`pluralkit`)&&t(r.pluralkit)){let t=r.pluralkit;P({value:t.token,path:`channels.discord.accounts.${n}.pluralkit.token`,expected:`string`,defaults:e.defaults,context:e.context,active:a&&I(t),inactiveReason:`Discord account is disabled or PluralKit is disabled for this account.`,apply:e=>{t.token=e}})}F(r,`voice`)&&t(r.voice)&&t(r.voice.tts)&&L({tts:r.voice.tts,pathPrefix:`channels.discord.accounts.${n}.voice.tts`,defaults:e.defaults,context:e.context,active:a&&I(r.voice),inactiveReason:`Discord account is disabled or voice is disabled for this account.`})}}function Ae(e){let n=e.config.channels;if(!t(n))return;let r=n.irc;if(!t(r))return;let i=R(r);if(H({channelKey:`irc`,field:`password`,channel:r,surface:i,defaults:e.defaults,context:e.context,topInactiveReason:`no enabled account inherits this top-level IRC password.`,accountInactiveReason:`IRC account is disabled.`}),t(r.nickserv)){let t=r.nickserv;P({value:t.password,path:`channels.irc.nickserv.password`,expected:`string`,defaults:e.defaults,context:e.context,active:z(i,`nickserv`)&&I(t),inactiveReason:`no enabled account inherits this top-level IRC nickserv config or NickServ is disabled.`,apply:e=>{t.password=e}})}if(i.hasExplicitAccounts){for(let{accountId:n,account:r,enabled:a}of i.accounts)if(F(r,`nickserv`)&&t(r.nickserv)){let t=r.nickserv;P({value:t.password,path:`channels.irc.accounts.${n}.nickserv.password`,expected:`string`,defaults:e.defaults,context:e.context,active:a&&I(t),inactiveReason:`IRC account is disabled or NickServ is disabled for this account.`,apply:e=>{t.password=e}})}}}function je(e){let n=e.config.channels;if(!t(n))return;let r=n.bluebubbles;t(r)&&H({channelKey:`bluebubbles`,field:`password`,channel:r,surface:R(r),defaults:e.defaults,context:e.context,topInactiveReason:`no enabled account inherits this top-level BlueBubbles password.`,accountInactiveReason:`BlueBubbles account is disabled.`})}function Me(e){let n=e.config.channels;if(!t(n))return;let r=n.msteams;t(r)&&P({value:r.appPassword,path:`channels.msteams.appPassword`,expected:`string`,defaults:e.defaults,context:e.context,active:r.enabled!==!1,inactiveReason:`Microsoft Teams channel is disabled.`,apply:e=>{r.appPassword=e}})}function Ne(e){let n=e.config.channels;if(!t(n))return;let r=n.mattermost;t(r)&&H({channelKey:`mattermost`,field:`botToken`,channel:r,surface:R(r),defaults:e.defaults,context:e.context,topInactiveReason:`no enabled account inherits this top-level Mattermost botToken.`,accountInactiveReason:`Mattermost account is disabled.`})}function Pe(e){let n=e.config.channels;if(!t(n))return;let r=n.matrix;if(!t(r))return;let i=R(r),a=B(e.context.env.MATRIX_ACCESS_TOKEN).length>0,o=V(r.accessToken,e.defaults),s=i.channelEnabled?i.hasExplicitAccounts?i.accounts.some(({account:t,enabled:n})=>n&&!F(t,`password`)&&!V(t.accessToken,e.defaults)&&!(o||a)):!(o||a):!1;if(P({value:r.password,path:`channels.matrix.password`,expected:`string`,defaults:e.defaults,context:e.context,active:s,inactiveReason:`no enabled Matrix surface inherits this top-level password (an accessToken is configured).`,apply:e=>{r.password=e}}),i.hasExplicitAccounts)for(let{accountId:t,account:n,enabled:r}of i.accounts){if(!F(n,`password`))continue;let i=V(n.accessToken,e.defaults),s=!F(n,`accessToken`)&&(o||a);P({value:n.password,path:`channels.matrix.accounts.${t}.password`,expected:`string`,defaults:e.defaults,context:e.context,active:r&&!(i||s),inactiveReason:`Matrix account is disabled or an accessToken is configured.`,apply:e=>{n.password=e}})}}function Fe(e){let n=e.config.channels;if(!t(n))return;let r=n.zalo;if(!t(r))return;let i=R(r),a=i.channelEnabled?i.hasExplicitAccounts?i.accounts.some(({account:e,enabled:t})=>t&&!F(e,`botToken`)):!0:!1;P({value:r.botToken,path:`channels.zalo.botToken`,expected:`string`,defaults:e.defaults,context:e.context,active:a,inactiveReason:`no enabled Zalo surface inherits this top-level botToken.`,apply:e=>{r.botToken=e}});let o=B(r.webhookUrl),s=i.channelEnabled?i.hasExplicitAccounts?i.accounts.some(({account:e,enabled:t})=>!t||F(e,`webhookSecret`)?!1:(F(e,`webhookUrl`)?B(e.webhookUrl):o).length>0):o.length>0:!1;if(P({value:r.webhookSecret,path:`channels.zalo.webhookSecret`,expected:`string`,defaults:e.defaults,context:e.context,active:s,inactiveReason:`no enabled Zalo webhook surface inherits this top-level webhookSecret (webhook mode is not active).`,apply:e=>{r.webhookSecret=e}}),i.hasExplicitAccounts){for(let{accountId:t,account:n,enabled:r}of i.accounts)if(F(n,`botToken`)&&P({value:n.botToken,path:`channels.zalo.accounts.${t}.botToken`,expected:`string`,defaults:e.defaults,context:e.context,active:r,inactiveReason:`Zalo account is disabled.`,apply:e=>{n.botToken=e}}),F(n,`webhookSecret`)){let i=F(n,`webhookUrl`)?B(n.webhookUrl):o;P({value:n.webhookSecret,path:`channels.zalo.accounts.${t}.webhookSecret`,expected:`string`,defaults:e.defaults,context:e.context,active:r&&i.length>0,inactiveReason:`Zalo account is disabled or webhook mode is not active for this account.`,apply:e=>{n.webhookSecret=e}})}}}function Ie(e){let n=e.config.channels;if(!t(n))return;let r=n.feishu;if(!t(r))return;let i=R(r);H({channelKey:`feishu`,field:`appSecret`,channel:r,surface:i,defaults:e.defaults,context:e.context,topInactiveReason:`no enabled account inherits this top-level Feishu appSecret.`,accountInactiveReason:`Feishu account is disabled.`});let a=B(r.connectionMode)===`webhook`?`webhook`:`websocket`,o=i.channelEnabled?i.hasExplicitAccounts?i.accounts.some(({account:e,enabled:t})=>!t||F(e,`verificationToken`)?!1:(F(e,`connectionMode`)?B(e.connectionMode):a)===`webhook`):a===`webhook`:!1;if(P({value:r.verificationToken,path:`channels.feishu.verificationToken`,expected:`string`,defaults:e.defaults,context:e.context,active:o,inactiveReason:`no enabled Feishu webhook-mode surface inherits this top-level verificationToken.`,apply:e=>{r.verificationToken=e}}),i.hasExplicitAccounts)for(let{accountId:t,account:n,enabled:r}of i.accounts){if(!F(n,`verificationToken`))continue;let i=F(n,`connectionMode`)?B(n.connectionMode):a;P({value:n.verificationToken,path:`channels.feishu.accounts.${t}.verificationToken`,expected:`string`,defaults:e.defaults,context:e.context,active:r&&i===`webhook`,inactiveReason:`Feishu account is disabled or not running in webhook mode.`,apply:e=>{n.verificationToken=e}})}}function Le(e){let n=e.config.channels;if(!t(n))return;let r=n[`nextcloud-talk`];if(!t(r))return;let i=R(r),a=i.channelEnabled?i.hasExplicitAccounts?i.accounts.some(({account:e,enabled:t})=>t&&!F(e,`botSecret`)):!0:!1;P({value:r.botSecret,path:`channels.nextcloud-talk.botSecret`,expected:`string`,defaults:e.defaults,context:e.context,active:a,inactiveReason:`no enabled Nextcloud Talk surface inherits this top-level botSecret.`,apply:e=>{r.botSecret=e}});let o=i.channelEnabled?i.hasExplicitAccounts?i.accounts.some(({account:e,enabled:t})=>t&&!F(e,`apiPassword`)):!0:!1;if(P({value:r.apiPassword,path:`channels.nextcloud-talk.apiPassword`,expected:`string`,defaults:e.defaults,context:e.context,active:o,inactiveReason:`no enabled Nextcloud Talk surface inherits this top-level apiPassword.`,apply:e=>{r.apiPassword=e}}),i.hasExplicitAccounts)for(let{accountId:t,account:n,enabled:r}of i.accounts)F(n,`botSecret`)&&P({value:n.botSecret,path:`channels.nextcloud-talk.accounts.${t}.botSecret`,expected:`string`,defaults:e.defaults,context:e.context,active:r,inactiveReason:`Nextcloud Talk account is disabled.`,apply:e=>{n.botSecret=e}}),F(n,`apiPassword`)&&P({value:n.apiPassword,path:`channels.nextcloud-talk.accounts.${t}.apiPassword`,expected:`string`,defaults:e.defaults,context:e.context,active:r,inactiveReason:`Nextcloud Talk account is disabled.`,apply:e=>{n.apiPassword=e}})}function U(e){let{explicitRef:t,ref:n}=o({value:e.target.serviceAccount,refValue:e.target.serviceAccountRef,defaults:e.defaults});if(n){if(e.active===!1){N({context:e.context,path:`${e.path}.serviceAccount`,details:e.inactiveReason});return}t&&e.target.serviceAccount!==void 0&&!s(e.target.serviceAccount,e.defaults)&&M(e.context,{code:`SECRETS_REF_OVERRIDES_PLAINTEXT`,path:e.path,message:`${e.path}: serviceAccountRef is set; runtime will ignore plaintext serviceAccount.`}),j(e.context,{ref:n,path:`${e.path}.serviceAccount`,expected:`string-or-object`,apply:t=>{e.target.serviceAccount=t}})}}function Re(e){let t=e.googleChat,n=R(t),r=n.channelEnabled?n.hasExplicitAccounts?n.accounts.some(({account:e,enabled:t})=>t&&!F(e,`serviceAccount`)&&!F(e,`serviceAccountRef`)):!0:!1;if(U({target:e.googleChat,path:`channels.googlechat`,defaults:e.defaults,context:e.context,active:r,inactiveReason:`no enabled account inherits this top-level Google Chat serviceAccount.`}),n.hasExplicitAccounts)for(let{accountId:t,account:r,enabled:i}of n.accounts)!F(r,`serviceAccount`)&&!F(r,`serviceAccountRef`)||U({target:r,path:`channels.googlechat.accounts.${t}`,defaults:e.defaults,context:e.context,active:i,inactiveReason:`Google Chat account is disabled.`})}function ze(e){let t=e.config.channels?.googlechat;t&&Re({googleChat:t,defaults:e.defaults,context:e.context}),De(e),Oe(e),ke(e),Ae(e),je(e),Ne(e),Pe(e),Me(e),Le(e),Ie(e),Fe(e)}const Be=[`gateway.auth.token`,`gateway.auth.password`,`gateway.remote.token`,`gateway.remote.password`];function Ve(e){return e??`unset`}function He(e){let t=[];return e.remoteMode&&t.push(`gateway.mode is "remote"`),e.remoteUrlConfigured&&t.push(`gateway.remote.url is configured`),e.tailscaleRemoteExposure&&t.push(`gateway.tailscale.mode is "serve" or "funnel"`),t.join(`; `)}function W(e){return{path:e.path,active:e.active,reason:e.reason,hasSecretRef:e.hasSecretRef}}function Ue(e){let n=e.config.gateway;if(!t(n))return{"gateway.auth.token":W({path:`gateway.auth.token`,active:!1,reason:`gateway configuration is not set.`,hasSecretRef:!1}),"gateway.auth.password":W({path:`gateway.auth.password`,active:!1,reason:`gateway configuration is not set.`,hasSecretRef:!1}),"gateway.remote.token":W({path:`gateway.remote.token`,active:!1,reason:`gateway configuration is not set.`,hasSecretRef:!1}),"gateway.remote.password":W({path:`gateway.remote.password`,active:!1,reason:`gateway configuration is not set.`,hasSecretRef:!1})};let i=t(n?.auth)?n.auth:void 0,a=t(n?.remote)?n.remote:void 0,o=r({config:e.config,env:e.env,includeLegacyEnv:!0,defaults:e.defaults}),s=i?o.passwordCanWin?o.authMode===`password`?`gateway.auth.mode is "password".`:`no token source can win, so password auth can win.`:o.authMode===`token`||o.authMode===`none`||o.authMode===`trusted-proxy`?`gateway.auth.mode is "${o.authMode}".`:o.envToken?`gateway token env var is configured.`:o.localToken.configured?`gateway.auth.token is configured.`:o.remoteToken.configured?`gateway.remote.token is configured.`:`token auth can win.`:`gateway.auth is not configured.`,c=i?o.authMode===`token`?o.envToken?`gateway token env var is configured.`:`gateway.auth.mode is "token".`:o.authMode===`password`||o.authMode===`none`||o.authMode===`trusted-proxy`?`gateway.auth.mode is "${o.authMode}".`:o.envToken?`gateway token env var is configured.`:o.envPassword?`gateway password env var is configured.`:o.localPassword.configured?`gateway.auth.password is configured.`:`token auth can win (mode is unset and no password source is configured).`:`gateway.auth is not configured.`,l=He({remoteMode:o.remoteMode,remoteUrlConfigured:o.remoteUrlConfigured,tailscaleRemoteExposure:o.tailscaleRemoteExposure}),u=a?o.remoteConfiguredSurface?`remote surface is active: ${l}.`:o.remoteTokenFallbackActive?`local token auth can win and no env/auth token is configured.`:o.localTokenCanWin?o.envToken?`gateway token env var is configured.`:o.localToken.configured?`gateway.auth.token is configured.`:`remote token fallback is not active.`:`token auth cannot win with gateway.auth.mode="${Ve(o.authMode)}".`:`gateway.remote is not configured.`,d=a?o.remoteConfiguredSurface?`remote surface is active: ${l}.`:o.remotePasswordFallbackActive?`password auth can win and no env/auth password is configured.`:o.passwordCanWin?o.envPassword?`gateway password env var is configured.`:o.localPassword.configured?`gateway.auth.password is configured.`:`remote password fallback is not active.`:o.authMode===`token`||o.authMode===`none`||o.authMode===`trusted-proxy`?`password auth cannot win with gateway.auth.mode="${o.authMode}".`:`a token source can win, so password auth cannot win.`:`gateway.remote is not configured.`;return{"gateway.auth.token":W({path:`gateway.auth.token`,active:o.localTokenSurfaceActive,reason:c,hasSecretRef:o.localToken.hasSecretRef}),"gateway.auth.password":W({path:`gateway.auth.password`,active:o.passwordCanWin,reason:s,hasSecretRef:o.localPassword.hasSecretRef}),"gateway.remote.token":W({path:`gateway.remote.token`,active:o.remoteTokenActive,reason:u,hasSecretRef:o.remoteToken.hasSecretRef}),"gateway.remote.password":W({path:`gateway.remote.password`,active:o.remotePasswordActive,reason:d,hasSecretRef:o.remotePassword.hasSecretRef})}}function We(e){for(let[n,r]of Object.entries(e.providers)){let i=r.enabled!==!1;P({value:r.apiKey,path:`models.providers.${n}.apiKey`,expected:`string`,defaults:e.defaults,context:e.context,active:i,inactiveReason:`provider is disabled.`,apply:e=>{r.apiKey=e}});let a=t(r.headers)?r.headers:void 0;if(a)for(let[t,r]of Object.entries(a))P({value:r,path:`models.providers.${n}.headers.${t}`,expected:`string`,defaults:e.defaults,context:e.context,active:i,inactiveReason:`provider is disabled.`,apply:e=>{a[t]=e}})}}function Ge(e){for(let[t,n]of Object.entries(e.entries))P({value:n.apiKey,path:`skills.entries.${t}.apiKey`,expected:`string`,defaults:e.defaults,context:e.context,active:n.enabled!==!1,inactiveReason:`skill entry is disabled.`,apply:e=>{n.apiKey=e}})}function Ke(e){let n=e.config.agents;if(!t(n))return;let r=t(n.defaults)?n.defaults:void 0,i=t(r?.memorySearch)?r.memorySearch:void 0,a=i?.enabled!==!1,o=Array.isArray(n.list)?n.list:[],s=!1;for(let e of o){if(!t(e)||e.enabled===!1)continue;let n=t(e.memorySearch)?e.memorySearch:void 0;if(n?.enabled===!1)continue;if(!n||!Object.prototype.hasOwnProperty.call(n,`remote`)){s=!0;continue}let r=t(n.remote)?n.remote:void 0;if(!r||!Object.prototype.hasOwnProperty.call(r,`apiKey`)){s=!0;continue}}if(i&&t(i.remote)){let t=i.remote;P({value:t.apiKey,path:`agents.defaults.memorySearch.remote.apiKey`,expected:`string`,defaults:e.defaults,context:e.context,active:a&&(s||o.length===0),inactiveReason:s?void 0:`all enabled agents override memorySearch.remote.apiKey.`,apply:e=>{t.apiKey=e}})}o.forEach((n,r)=>{if(!t(n))return;let i=t(n.memorySearch)?n.memorySearch:void 0;if(!i)return;let a=t(i.remote)?i.remote:void 0;if(!a||!Object.prototype.hasOwnProperty.call(a,`apiKey`))return;let o=n.enabled!==!1&&i.enabled!==!1;P({value:a.apiKey,path:`agents.list.${r}.memorySearch.remote.apiKey`,expected:`string`,defaults:e.defaults,context:e.context,active:o,inactiveReason:`agent or memorySearch override is disabled.`,apply:e=>{a.apiKey=e}})})}function qe(e){let n=e.config.talk;if(!t(n))return;P({value:n.apiKey,path:`talk.apiKey`,expected:`string`,defaults:e.defaults,context:e.context,apply:e=>{n.apiKey=e}});let r=n.providers;if(t(r))for(let[n,i]of Object.entries(r))t(i)&&P({value:i.apiKey,path:`talk.providers.${n}.apiKey`,expected:`string`,defaults:e.defaults,context:e.context,apply:e=>{i.apiKey=e}})}function Je(e){let n=e.config.gateway;if(!t(n))return;let r=t(n.auth)?n.auth:void 0,i=t(n.remote)?n.remote:void 0,a=Ue({config:e.config,env:e.context.env,defaults:e.defaults});r&&(P({value:r.token,path:`gateway.auth.token`,expected:`string`,defaults:e.defaults,context:e.context,active:a[`gateway.auth.token`].active,inactiveReason:a[`gateway.auth.token`].reason,apply:e=>{r.token=e}}),P({value:r.password,path:`gateway.auth.password`,expected:`string`,defaults:e.defaults,context:e.context,active:a[`gateway.auth.password`].active,inactiveReason:a[`gateway.auth.password`].reason,apply:e=>{r.password=e}})),i&&(P({value:i.token,path:`gateway.remote.token`,expected:`string`,defaults:e.defaults,context:e.context,active:a[`gateway.remote.token`].active,inactiveReason:a[`gateway.remote.token`].reason,apply:e=>{i.token=e}}),P({value:i.password,path:`gateway.remote.password`,expected:`string`,defaults:e.defaults,context:e.context,active:a[`gateway.remote.password`].active,inactiveReason:a[`gateway.remote.password`].reason,apply:e=>{i.password=e}}))}function Ye(e){let n=e.config.messages;!t(n)||!t(n.tts)||L({tts:n.tts,pathPrefix:`messages.tts`,defaults:e.defaults,context:e.context})}function Xe(e){let n=e.config.cron;t(n)&&P({value:n.webhookToken,path:`cron.webhookToken`,expected:`string`,defaults:e.defaults,context:e.context,apply:e=>{n.webhookToken=e}})}function Ze(e){let t=e.config.models?.providers;t&&We({providers:t,defaults:e.defaults,context:e.context});let n=e.config.skills?.entries;n&&Ge({entries:n,defaults:e.defaults,context:e.context}),Ke(e),qe(e),Je(e),Ye(e),Xe(e)}function Qe(e){let t=e.context.sourceConfig.secrets?.defaults;Ze({config:e.config,defaults:t,context:e.context}),ze({config:e.config,defaults:t,context:e.context})}const G=[`brave`,`gemini`,`grok`,`kimi`,`perplexity`],$e=`https://api.perplexity.ai`,K=`https://openrouter.ai/api/v1`,et=[`pplx-`],tt=[`sk-or-`];function q(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}function nt(e){if(typeof e!=`string`)return;let t=e.trim().toLowerCase();if(t===`brave`||t===`gemini`||t===`grok`||t===`kimi`||t===`perplexity`)return t}function J(e,t){for(let n of t){let t=a(e[n]);if(t)return{value:t,envVar:n}}return{}}function Y(e){return e.kind===`non-string`?`${e.path} SecretRef resolved to a non-string value.`:e.kind===`empty`?`${e.path} SecretRef resolved to an empty value.`:`${e.path} SecretRef is unresolved (${e.refLabel}).`}async function rt(e){let{ref:t}=o({value:e.value,defaults:e.defaults});if(!t){let t=a(e.value);if(t)return{value:t,source:`config`,secretRefConfigured:!1,fallbackUsedAfterRefFailure:!1};let n=J(e.context.env,e.envVars);return n.value?{value:n.value,source:`env`,fallbackEnvVar:n.envVar,secretRefConfigured:!1,fallbackUsedAfterRefFailure:!1}:{source:`missing`,secretRefConfigured:!1,fallbackUsedAfterRefFailure:!1}}let r=`${t.source}:${t.provider}:${t.id}`,i,s;try{let o=(await n([t],{config:e.sourceConfig,env:e.context.env,cache:e.context.cache})).get(c(t));typeof o==`string`?(i=a(o),i||(s=Y({path:e.path,kind:`empty`,refLabel:r}))):s=Y({path:e.path,kind:`non-string`,refLabel:r})}catch{s=Y({path:e.path,kind:`unresolved`,refLabel:r})}if(i)return{value:i,source:`secretRef`,secretRefConfigured:!0,fallbackUsedAfterRefFailure:!1};let l=J(e.context.env,e.envVars);return l.value?{value:l.value,source:`env`,fallbackEnvVar:l.envVar,unresolvedRefReason:s,secretRefConfigured:!0,fallbackUsedAfterRefFailure:!0}:{source:`missing`,unresolvedRefReason:s,secretRefConfigured:!0,fallbackUsedAfterRefFailure:!1}}function it(e){if(!e)return;let t=e.toLowerCase();if(et.some(e=>t.startsWith(e)))return`direct`;if(tt.some(e=>t.startsWith(e)))return`openrouter`}function at(e){let t=q(e.configValue)?e.configValue:void 0,n=typeof t?.baseUrl==`string`?t.baseUrl.trim():``,r=typeof t?.model==`string`?t.model.trim():``,i=(()=>{if(n)return n;if(e.keySource===`env`){if(e.fallbackEnvVar===`PERPLEXITY_API_KEY`)return $e;if(e.fallbackEnvVar===`OPENROUTER_API_KEY`)return K}return(e.keySource===`config`||e.keySource===`secretRef`)&&e.keyValue?it(e.keyValue)===`openrouter`?K:$e:K})(),a=!!(n||r),o=(()=>{try{return new URL(i).hostname.toLowerCase()===`api.perplexity.ai`}catch{return!1}})();return a||!o?`chat_completions`:`search_api`}function X(e,t){let n=e[t];if(q(n))return n;let r={};return e[t]=r,r}function Z(e){let t=X(X(X(e.resolvedConfig,`tools`),`web`),`search`);if(e.provider===`brave`){t.apiKey=e.value;return}let n=X(t,e.provider);n.apiKey=e.value}function ot(e){let t=X(X(X(X(e.resolvedConfig,`tools`),`web`),`fetch`),`firecrawl`);t.apiKey=e.value}function st(e){return e===`brave`?[`BRAVE_API_KEY`]:e===`gemini`?[`GEMINI_API_KEY`]:e===`grok`?[`XAI_API_KEY`]:e===`kimi`?[`KIMI_API_KEY`,`MOONSHOT_API_KEY`]:[`PERPLEXITY_API_KEY`,`OPENROUTER_API_KEY`]}function Q(e,t){if(t===`brave`)return e.apiKey;let n=e[t];if(q(n))return n.apiKey}function $(e,t){return!!o({value:e,defaults:t}).ref}async function ct(e){let t=e.sourceConfig.secrets?.defaults,n=[],r=q(e.sourceConfig.tools)?e.sourceConfig.tools:void 0,i=q(r?.web)?r.web:void 0,o=q(i?.search)?i.search:void 0,s={providerSource:`none`,diagnostics:[]},c=o?.enabled!==!1,l=typeof o?.provider==`string`?o.provider.trim().toLowerCase():``,u=nt(l);if(l&&!u){let t={code:`WEB_SEARCH_PROVIDER_INVALID_AUTODETECT`,message:`tools.web.search.provider is "${l}". Falling back to auto-detect precedence.`,path:`tools.web.search.provider`};n.push(t),s.diagnostics.push(t),M(e.context,{code:`WEB_SEARCH_PROVIDER_INVALID_AUTODETECT`,path:`tools.web.search.provider`,message:t.message})}if(u&&(s.providerConfigured=u,s.providerSource=`configured`),c&&o){let r=u?[u]:[...G],i=[],a,c;for(let l of r){let r=l===`brave`?`tools.web.search.apiKey`:`tools.web.search.${l}.apiKey`,d=Q(o,l),f=await rt({sourceConfig:e.sourceConfig,context:e.context,defaults:t,value:d,path:r,envVars:st(l)});if(f.secretRefConfigured&&f.fallbackUsedAfterRefFailure){let t={code:`WEB_SEARCH_KEY_UNRESOLVED_FALLBACK_USED`,message:`${r} SecretRef could not be resolved; using ${f.fallbackEnvVar??`env fallback`}. `+(f.unresolvedRefReason??``).trim(),path:r};n.push(t),s.diagnostics.push(t),M(e.context,{code:`WEB_SEARCH_KEY_UNRESOLVED_FALLBACK_USED`,path:r,message:t.message})}if(f.secretRefConfigured&&!f.value&&f.unresolvedRefReason&&i.push({provider:l,path:r,reason:f.unresolvedRefReason}),u){a=l,c=f,f.value&&Z({resolvedConfig:e.resolvedConfig,provider:l,value:f.value});break}if(f.value){a=l,c=f,Z({resolvedConfig:e.resolvedConfig,provider:l,value:f.value});break}}if(u){let t=i[0];if(t){let r={code:`WEB_SEARCH_KEY_UNRESOLVED_NO_FALLBACK`,message:t.reason,path:t.path};throw n.push(r),s.diagnostics.push(r),M(e.context,{code:`WEB_SEARCH_KEY_UNRESOLVED_NO_FALLBACK`,path:t.path,message:t.reason}),Error(`[WEB_SEARCH_KEY_UNRESOLVED_NO_FALLBACK] ${t.reason}`)}}else{if(!a&&i.length>0){let t=i[0],r={code:`WEB_SEARCH_KEY_UNRESOLVED_NO_FALLBACK`,message:t.reason,path:t.path};throw n.push(r),s.diagnostics.push(r),M(e.context,{code:`WEB_SEARCH_KEY_UNRESOLVED_NO_FALLBACK`,path:t.path,message:t.reason}),Error(`[WEB_SEARCH_KEY_UNRESOLVED_NO_FALLBACK] ${t.reason}`)}if(a){let e={code:`WEB_SEARCH_AUTODETECT_SELECTED`,message:`tools.web.search auto-detected provider "${a}" from available credentials.`,path:`tools.web.search.provider`};n.push(e),s.diagnostics.push(e)}}a&&(s.selectedProvider=a,s.selectedProviderKeySource=c?.source,u||(s.providerSource=`auto-detect`),a===`perplexity`&&(s.perplexityTransport=at({keyValue:c?.value,keySource:c?.source??`missing`,fallbackEnvVar:c?.fallbackEnvVar,configValue:o.perplexity})))}if(c&&o&&!u&&s.selectedProvider)for(let n of G){if(n===s.selectedProvider)continue;let r=n===`brave`?`tools.web.search.apiKey`:`tools.web.search.${n}.apiKey`;$(Q(o,n),t)&&N({context:e.context,path:r,details:`tools.web.search auto-detected provider is "${s.selectedProvider}".`})}else if(o&&!c)for(let n of G){let r=n===`brave`?`tools.web.search.apiKey`:`tools.web.search.${n}.apiKey`;$(Q(o,n),t)&&N({context:e.context,path:r,details:`tools.web.search is disabled.`})}if(c&&o&&u)for(let n of G){if(n===u)continue;let r=n===`brave`?`tools.web.search.apiKey`:`tools.web.search.${n}.apiKey`;$(Q(o,n),t)&&N({context:e.context,path:r,details:`tools.web.search.provider is "${u}".`})}let d=q(i?.fetch)?i.fetch:void 0,f=q(d?.firecrawl)?d.firecrawl:void 0,p=d?.enabled!==!1,m=f?.enabled!==!1,h=!!(p&&m),g=`tools.web.fetch.firecrawl.apiKey`,_={source:`missing`,secretRefConfigured:!1,fallbackUsedAfterRefFailure:!1},v=[];if(h){if(_=await rt({sourceConfig:e.sourceConfig,context:e.context,defaults:t,value:f?.apiKey,path:g,envVars:[`FIRECRAWL_API_KEY`]}),_.value&&ot({resolvedConfig:e.resolvedConfig,value:_.value}),_.secretRefConfigured){if(_.fallbackUsedAfterRefFailure){let t={code:`WEB_FETCH_FIRECRAWL_KEY_UNRESOLVED_FALLBACK_USED`,message:`${g} SecretRef could not be resolved; using ${_.fallbackEnvVar??`env fallback`}. `+(_.unresolvedRefReason??``).trim(),path:g};n.push(t),v.push(t),M(e.context,{code:`WEB_FETCH_FIRECRAWL_KEY_UNRESOLVED_FALLBACK_USED`,path:g,message:t.message})}if(!_.value&&_.unresolvedRefReason){let t={code:`WEB_FETCH_FIRECRAWL_KEY_UNRESOLVED_NO_FALLBACK`,message:_.unresolvedRefReason,path:g};throw n.push(t),v.push(t),M(e.context,{code:`WEB_FETCH_FIRECRAWL_KEY_UNRESOLVED_NO_FALLBACK`,path:g,message:_.unresolvedRefReason}),Error(`[WEB_FETCH_FIRECRAWL_KEY_UNRESOLVED_NO_FALLBACK] ${_.unresolvedRefReason}`)}}}else if($(f?.apiKey,t))N({context:e.context,path:g,details:p?`tools.web.fetch.firecrawl.enabled is false.`:`tools.web.fetch is disabled.`}),_={source:`secretRef`,secretRefConfigured:!0,fallbackUsedAfterRefFailure:!1};else{let t=a(f?.apiKey);if(t)_={value:t,source:`config`,secretRefConfigured:!1,fallbackUsedAfterRefFailure:!1};else{let t=J(e.context.env,[`FIRECRAWL_API_KEY`]);t.value&&(_={value:t.value,source:`env`,fallbackEnvVar:t.envVar,secretRefConfigured:!1,fallbackUsedAfterRefFailure:!1})}}return{search:s,fetch:{firecrawl:{active:h,apiKeySource:_.source,diagnostics:v}},diagnostics:n}}export{m as C,_ as S,g as T,he as _,Te as a,ee as b,M as c,be as d,ye as f,Se as g,ge as h,Ue as i,A as l,_e as m,Qe as n,we as o,k as p,Be as r,j as s,ct as t,Ce as u,ve as v,h as w,v as x,y};
+import{Ds as e,Os as t,Ts as n,ao as r,ks as i,lu as a}from"./model-selection-I1ctjFOB.js";import{d as o,i as s}from"./types.secrets-C-5U96pc.js";import{jt as c}from"./plugins-CYLrFT4h.js";import{isDeepStrictEqual as l}from"node:util";function u(e){return/^\d+$/.test(e)}function d(e){return u(e)?`array`:`object`}function f(e,t,n){if(!Array.isArray(e))return null;if(!u(t))throw Error(`Invalid array index segment "${t}" at ${n.join(`.`)}.`);return{array:e,index:Number.parseInt(t,10)}}function p(e){if(e.segments.length===0)throw Error(`Target path is empty.`);let n=e.root;for(let r=0;r<e.segments.length-1;r+=1){let i=e.segments[r]??``;if(Array.isArray(n)){if(!u(i))throw Error(`Invalid array index segment "${i}" at ${e.segments.join(`.`)}.`);let t=Number.parseInt(i,10);if(e.requireExistingSegment&&(t<0||t>=n.length))throw Error(`Path segment does not exist at ${e.segments.slice(0,r+1).join(`.`)}.`);n=n[t];continue}if(!t(n))throw Error(`Invalid path shape at ${e.segments.slice(0,r).join(`.`)||`<root>`}.`);if(e.requireExistingSegment&&!Object.prototype.hasOwnProperty.call(n,i))throw Error(`Path segment does not exist at ${e.segments.slice(0,r+1).join(`.`)}.`);n=n[i]}return n}function m(e,n){if(n.length===0)return;let r=e;for(let e of n){if(Array.isArray(r)){if(!u(e))return;r=r[Number.parseInt(e,10)];continue}if(!t(r))return;r=r[e]}return r}function h(e,n,r){if(n.length===0)throw Error(`Target path is empty.`);let i=e,a=!1;for(let e=0;e<n.length-1;e+=1){let r=n[e]??``,o=d(n[e+1]??``);if(Array.isArray(i)){if(!u(r))throw Error(`Invalid array index segment "${r}" at ${n.join(`.`)}.`);let s=Number.parseInt(r,10),c=i[s];if(c==null)i[s]=o===`array`?[]:{},a=!0;else if(o===`array`?!Array.isArray(c):!t(c))throw Error(`Invalid path shape at ${n.slice(0,e+1).join(`.`)}.`);i=i[s];continue}if(!t(i))throw Error(`Invalid path shape at ${n.slice(0,e).join(`.`)||`<root>`}.`);let s=i[r];if(s==null)i[r]=o===`array`?[]:{},a=!0;else if(o===`array`?!Array.isArray(s):!t(s))throw Error(`Invalid path shape at ${n.slice(0,e+1).join(`.`)}.`);i=i[r]}let o=n[n.length-1]??``,s=f(i,o,n);if(s)return l(s.array[s.index],r)||(s.array[s.index]=r,a=!0),a;if(!t(i))throw Error(`Invalid path shape at ${n.slice(0,-1).join(`.`)||`<root>`}.`);return l(i[o],r)||(i[o]=r,a=!0),a}function g(e,n,r){let i=p({root:e,segments:n,requireExistingSegment:!0}),a=n[n.length-1]??``,o=f(i,a,n);if(o){if(o.index<0||o.index>=o.array.length)throw Error(`Path segment does not exist at ${n.join(`.`)}.`);return l(o.array[o.index],r)?!1:(o.array[o.index]=r,!0)}if(!t(i))throw Error(`Invalid path shape at ${n.slice(0,-1).join(`.`)||`<root>`}.`);if(!Object.prototype.hasOwnProperty.call(i,a))throw Error(`Path segment does not exist at ${n.join(`.`)}.`);return l(i[a],r)?!1:(i[a]=r,!0)}function _(e,n){let r=p({root:e,segments:n,requireExistingSegment:!1}),i=n[n.length-1]??``,a=f(r,i,n);if(a)return a.index<0||a.index>=a.array.length?!1:(a.array.splice(a.index,1),!0);if(!t(r))throw Error(`Invalid path shape at ${n.slice(0,-1).join(`.`)||`<root>`}.`);return Object.prototype.hasOwnProperty.call(r,i)?(delete r[i],!0):!1}function v(n,r){return r===`string`?e(n):e(n)||t(n)}function ee(n,r){return r===`string`?e(n):e(n)||t(n)&&Object.keys(n).length>0}function y(e){if(!v(e.value,e.expected))throw Error(e.errorMessage)}const b=`secret_input`,x=`sibling_ref`,te=[{id:`auth-profiles.api_key.key`,targetType:`auth-profiles.api_key.key`,configFile:`auth-profiles.json`,pathPattern:`profiles.*.key`,refPathPattern:`profiles.*.keyRef`,secretShape:x,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0,authProfileType:`api_key`},{id:`auth-profiles.token.token`,targetType:`auth-profiles.token.token`,configFile:`auth-profiles.json`,pathPattern:`profiles.*.token`,refPathPattern:`profiles.*.tokenRef`,secretShape:x,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0,authProfileType:`token`},{id:`agents.defaults.memorySearch.remote.apiKey`,targetType:`agents.defaults.memorySearch.remote.apiKey`,configFile:`openclaw.json`,pathPattern:`agents.defaults.memorySearch.remote.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`agents.list[].memorySearch.remote.apiKey`,targetType:`agents.list[].memorySearch.remote.apiKey`,configFile:`openclaw.json`,pathPattern:`agents.list[].memorySearch.remote.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.bluebubbles.accounts.*.password`,targetType:`channels.bluebubbles.accounts.*.password`,configFile:`openclaw.json`,pathPattern:`channels.bluebubbles.accounts.*.password`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.bluebubbles.password`,targetType:`channels.bluebubbles.password`,configFile:`openclaw.json`,pathPattern:`channels.bluebubbles.password`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.discord.accounts.*.pluralkit.token`,targetType:`channels.discord.accounts.*.pluralkit.token`,configFile:`openclaw.json`,pathPattern:`channels.discord.accounts.*.pluralkit.token`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.discord.accounts.*.token`,targetType:`channels.discord.accounts.*.token`,configFile:`openclaw.json`,pathPattern:`channels.discord.accounts.*.token`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.discord.accounts.*.voice.tts.elevenlabs.apiKey`,targetType:`channels.discord.accounts.*.voice.tts.elevenlabs.apiKey`,configFile:`openclaw.json`,pathPattern:`channels.discord.accounts.*.voice.tts.elevenlabs.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.discord.accounts.*.voice.tts.openai.apiKey`,targetType:`channels.discord.accounts.*.voice.tts.openai.apiKey`,configFile:`openclaw.json`,pathPattern:`channels.discord.accounts.*.voice.tts.openai.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.discord.pluralkit.token`,targetType:`channels.discord.pluralkit.token`,configFile:`openclaw.json`,pathPattern:`channels.discord.pluralkit.token`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.discord.token`,targetType:`channels.discord.token`,configFile:`openclaw.json`,pathPattern:`channels.discord.token`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.discord.voice.tts.elevenlabs.apiKey`,targetType:`channels.discord.voice.tts.elevenlabs.apiKey`,configFile:`openclaw.json`,pathPattern:`channels.discord.voice.tts.elevenlabs.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.discord.voice.tts.openai.apiKey`,targetType:`channels.discord.voice.tts.openai.apiKey`,configFile:`openclaw.json`,pathPattern:`channels.discord.voice.tts.openai.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.feishu.accounts.*.appSecret`,targetType:`channels.feishu.accounts.*.appSecret`,configFile:`openclaw.json`,pathPattern:`channels.feishu.accounts.*.appSecret`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.feishu.accounts.*.verificationToken`,targetType:`channels.feishu.accounts.*.verificationToken`,configFile:`openclaw.json`,pathPattern:`channels.feishu.accounts.*.verificationToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.feishu.appSecret`,targetType:`channels.feishu.appSecret`,configFile:`openclaw.json`,pathPattern:`channels.feishu.appSecret`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.feishu.verificationToken`,targetType:`channels.feishu.verificationToken`,configFile:`openclaw.json`,pathPattern:`channels.feishu.verificationToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.googlechat.accounts.*.serviceAccount`,targetType:`channels.googlechat.serviceAccount`,targetTypeAliases:[`channels.googlechat.accounts.*.serviceAccount`],configFile:`openclaw.json`,pathPattern:`channels.googlechat.accounts.*.serviceAccount`,refPathPattern:`channels.googlechat.accounts.*.serviceAccountRef`,secretShape:x,expectedResolvedValue:`string-or-object`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0,accountIdPathSegmentIndex:3},{id:`channels.googlechat.serviceAccount`,targetType:`channels.googlechat.serviceAccount`,configFile:`openclaw.json`,pathPattern:`channels.googlechat.serviceAccount`,refPathPattern:`channels.googlechat.serviceAccountRef`,secretShape:x,expectedResolvedValue:`string-or-object`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.irc.accounts.*.nickserv.password`,targetType:`channels.irc.accounts.*.nickserv.password`,configFile:`openclaw.json`,pathPattern:`channels.irc.accounts.*.nickserv.password`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.irc.accounts.*.password`,targetType:`channels.irc.accounts.*.password`,configFile:`openclaw.json`,pathPattern:`channels.irc.accounts.*.password`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.irc.nickserv.password`,targetType:`channels.irc.nickserv.password`,configFile:`openclaw.json`,pathPattern:`channels.irc.nickserv.password`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.irc.password`,targetType:`channels.irc.password`,configFile:`openclaw.json`,pathPattern:`channels.irc.password`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.mattermost.accounts.*.botToken`,targetType:`channels.mattermost.accounts.*.botToken`,configFile:`openclaw.json`,pathPattern:`channels.mattermost.accounts.*.botToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.mattermost.botToken`,targetType:`channels.mattermost.botToken`,configFile:`openclaw.json`,pathPattern:`channels.mattermost.botToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.matrix.accounts.*.password`,targetType:`channels.matrix.accounts.*.password`,configFile:`openclaw.json`,pathPattern:`channels.matrix.accounts.*.password`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.matrix.password`,targetType:`channels.matrix.password`,configFile:`openclaw.json`,pathPattern:`channels.matrix.password`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.msteams.appPassword`,targetType:`channels.msteams.appPassword`,configFile:`openclaw.json`,pathPattern:`channels.msteams.appPassword`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.nextcloud-talk.accounts.*.apiPassword`,targetType:`channels.nextcloud-talk.accounts.*.apiPassword`,configFile:`openclaw.json`,pathPattern:`channels.nextcloud-talk.accounts.*.apiPassword`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.nextcloud-talk.accounts.*.botSecret`,targetType:`channels.nextcloud-talk.accounts.*.botSecret`,configFile:`openclaw.json`,pathPattern:`channels.nextcloud-talk.accounts.*.botSecret`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.nextcloud-talk.apiPassword`,targetType:`channels.nextcloud-talk.apiPassword`,configFile:`openclaw.json`,pathPattern:`channels.nextcloud-talk.apiPassword`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.nextcloud-talk.botSecret`,targetType:`channels.nextcloud-talk.botSecret`,configFile:`openclaw.json`,pathPattern:`channels.nextcloud-talk.botSecret`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.slack.accounts.*.appToken`,targetType:`channels.slack.accounts.*.appToken`,configFile:`openclaw.json`,pathPattern:`channels.slack.accounts.*.appToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.slack.accounts.*.botToken`,targetType:`channels.slack.accounts.*.botToken`,configFile:`openclaw.json`,pathPattern:`channels.slack.accounts.*.botToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.slack.accounts.*.signingSecret`,targetType:`channels.slack.accounts.*.signingSecret`,configFile:`openclaw.json`,pathPattern:`channels.slack.accounts.*.signingSecret`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.slack.accounts.*.userToken`,targetType:`channels.slack.accounts.*.userToken`,configFile:`openclaw.json`,pathPattern:`channels.slack.accounts.*.userToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.slack.appToken`,targetType:`channels.slack.appToken`,configFile:`openclaw.json`,pathPattern:`channels.slack.appToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.slack.botToken`,targetType:`channels.slack.botToken`,configFile:`openclaw.json`,pathPattern:`channels.slack.botToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.slack.signingSecret`,targetType:`channels.slack.signingSecret`,configFile:`openclaw.json`,pathPattern:`channels.slack.signingSecret`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.slack.userToken`,targetType:`channels.slack.userToken`,configFile:`openclaw.json`,pathPattern:`channels.slack.userToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.telegram.accounts.*.botToken`,targetType:`channels.telegram.accounts.*.botToken`,configFile:`openclaw.json`,pathPattern:`channels.telegram.accounts.*.botToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.telegram.accounts.*.webhookSecret`,targetType:`channels.telegram.accounts.*.webhookSecret`,configFile:`openclaw.json`,pathPattern:`channels.telegram.accounts.*.webhookSecret`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.telegram.botToken`,targetType:`channels.telegram.botToken`,configFile:`openclaw.json`,pathPattern:`channels.telegram.botToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.telegram.webhookSecret`,targetType:`channels.telegram.webhookSecret`,configFile:`openclaw.json`,pathPattern:`channels.telegram.webhookSecret`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.zalo.accounts.*.botToken`,targetType:`channels.zalo.accounts.*.botToken`,configFile:`openclaw.json`,pathPattern:`channels.zalo.accounts.*.botToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.zalo.accounts.*.webhookSecret`,targetType:`channels.zalo.accounts.*.webhookSecret`,configFile:`openclaw.json`,pathPattern:`channels.zalo.accounts.*.webhookSecret`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.zalo.botToken`,targetType:`channels.zalo.botToken`,configFile:`openclaw.json`,pathPattern:`channels.zalo.botToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.zalo.webhookSecret`,targetType:`channels.zalo.webhookSecret`,configFile:`openclaw.json`,pathPattern:`channels.zalo.webhookSecret`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`cron.webhookToken`,targetType:`cron.webhookToken`,configFile:`openclaw.json`,pathPattern:`cron.webhookToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`gateway.auth.token`,targetType:`gateway.auth.token`,configFile:`openclaw.json`,pathPattern:`gateway.auth.token`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`gateway.auth.password`,targetType:`gateway.auth.password`,configFile:`openclaw.json`,pathPattern:`gateway.auth.password`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`gateway.remote.password`,targetType:`gateway.remote.password`,configFile:`openclaw.json`,pathPattern:`gateway.remote.password`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`gateway.remote.token`,targetType:`gateway.remote.token`,configFile:`openclaw.json`,pathPattern:`gateway.remote.token`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`messages.tts.elevenlabs.apiKey`,targetType:`messages.tts.elevenlabs.apiKey`,configFile:`openclaw.json`,pathPattern:`messages.tts.elevenlabs.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`messages.tts.openai.apiKey`,targetType:`messages.tts.openai.apiKey`,configFile:`openclaw.json`,pathPattern:`messages.tts.openai.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`models.providers.*.apiKey`,targetType:`models.providers.apiKey`,targetTypeAliases:[`models.providers.*.apiKey`],configFile:`openclaw.json`,pathPattern:`models.providers.*.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0,providerIdPathSegmentIndex:2,trackProviderShadowing:!0},{id:`models.providers.*.headers.*`,targetType:`models.providers.headers`,targetTypeAliases:[`models.providers.*.headers.*`],configFile:`openclaw.json`,pathPattern:`models.providers.*.headers.*`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0,providerIdPathSegmentIndex:2},{id:`skills.entries.*.apiKey`,targetType:`skills.entries.apiKey`,targetTypeAliases:[`skills.entries.*.apiKey`],configFile:`openclaw.json`,pathPattern:`skills.entries.*.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`talk.apiKey`,targetType:`talk.apiKey`,configFile:`openclaw.json`,pathPattern:`talk.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`talk.providers.*.apiKey`,targetType:`talk.providers.*.apiKey`,configFile:`openclaw.json`,pathPattern:`talk.providers.*.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`tools.web.fetch.firecrawl.apiKey`,targetType:`tools.web.fetch.firecrawl.apiKey`,configFile:`openclaw.json`,pathPattern:`tools.web.fetch.firecrawl.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`tools.web.search.apiKey`,targetType:`tools.web.search.apiKey`,configFile:`openclaw.json`,pathPattern:`tools.web.search.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`tools.web.search.gemini.apiKey`,targetType:`tools.web.search.gemini.apiKey`,configFile:`openclaw.json`,pathPattern:`tools.web.search.gemini.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`tools.web.search.grok.apiKey`,targetType:`tools.web.search.grok.apiKey`,configFile:`openclaw.json`,pathPattern:`tools.web.search.grok.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`tools.web.search.kimi.apiKey`,targetType:`tools.web.search.kimi.apiKey`,configFile:`openclaw.json`,pathPattern:`tools.web.search.kimi.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`tools.web.search.perplexity.apiKey`,targetType:`tools.web.search.perplexity.apiKey`,configFile:`openclaw.json`,pathPattern:`tools.web.search.perplexity.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0}];function S(e){return e.filter(e=>e.kind===`wildcard`||e.kind===`array`).length}function C(e){return i(e).map(t=>{if(t===`*`)return{kind:`wildcard`};if(t.endsWith(`[]`)){let n=t.slice(0,-2).trim();if(!n)throw Error(`Invalid target path pattern: ${e}`);return{kind:`array`,field:n}}return{kind:`literal`,value:t}})}function ne(e){let t=C(e.pathPattern),n=S(t),r=e.refPathPattern?C(e.refPathPattern):void 0,i=r?S(r):0;if(e.secretShape===`sibling_ref`&&!r)throw Error(`Missing refPathPattern for sibling_ref target: ${e.id}`);if(r&&i!==n)throw Error(`Mismatched wildcard shape for target ref path: ${e.id}`);return{...e,pathTokens:t,pathDynamicTokenCount:n,refPathTokens:r,refPathDynamicTokenCount:i}}function re(e,t){let n=[],r=0;for(let i of t){if(i.kind===`literal`){if(e[r]!==i.value)return null;r+=1;continue}if(i.kind===`wildcard`){let t=e[r];if(!t)return null;n.push(t),r+=1;continue}if(e[r]!==i.field)return null;let t=e[r+1];if(!t||!/^\d+$/.test(t))return null;n.push(t),r+=2}return r===e.length?{captures:n}:null}function ie(e,t){let n=[],r=0;for(let i of e){if(i.kind===`literal`){n.push(i.value);continue}if(i.kind===`wildcard`){let e=t[r];if(!e)return null;n.push(e),r+=1;continue}let e=t[r];if(!e||!/^\d+$/.test(e))return null;n.push(i.field,e),r+=1}return r===t.length?n:null}function ae(e,n){let r=[],i=(e,a,o,s)=>{let c=n[a];if(!c){r.push({segments:o,captures:s,value:e});return}let l=a===n.length-1;if(c.kind===`literal`){if(!t(e))return;if(l){r.push({segments:[...o,c.value],captures:s,value:e[c.value]});return}if(!Object.prototype.hasOwnProperty.call(e,c.value))return;i(e[c.value],a+1,[...o,c.value],s);return}if(c.kind===`wildcard`){if(!t(e))return;for(let[t,n]of Object.entries(e)){if(l){r.push({segments:[...o,t],captures:[...s,t],value:n});continue}i(n,a+1,[...o,t],[...s,t])}return}if(!t(e))return;let u=e[c.field];if(Array.isArray(u))for(let e=0;e<u.length;e+=1){let t=u[e],n=String(e);if(l){r.push({segments:[...o,c.field,n],captures:[...s,n],value:t});continue}i(t,a+1,[...o,c.field,n],[...s,n])}};return i(e,0,[],[]),r}const w=te.map(ne),oe=w.filter(e=>e.configFile===`openclaw.json`),se=w.filter(e=>e.configFile===`auth-profiles.json`);function ce(){let e=new Map,t=(t,n)=>{let r=e.get(t);if(r){r.push(n);return}e.set(t,[n])};for(let e of w){t(e.targetType,e);for(let n of e.targetTypeAliases??[])t(n,e)}return e}const le=ce(),ue=new Set(w.map(e=>e.id));function de(){let e=new Map;for(let t of oe){let n=e.get(t.id);if(n){n.push(t);continue}e.set(t.id,[t])}return e}const fe=de();function pe(){let e=new Map;for(let t of se){let n=e.get(t.id);if(n){n.push(t);continue}e.set(t.id,[t])}return e}const me=pe();function T(e){return e===void 0?null:new Set(Array.from(e).map(e=>e.trim()).filter(e=>e.length>0))}function E(e){return e.allowedTargetIds===null?e.defaultEntries:Array.from(e.allowedTargetIds).flatMap(t=>e.entriesById.get(t)??[])}function D(e,t){let n=[],r=new Set;for(let i of t){let t=ae(e,i.pathTokens);for(let a of t){let t=O(i,a.segments,a.captures);if(!t)continue;let o=`${i.id}:${t.pathSegments.join(`.`)}`;if(r.has(o))continue;r.add(o);let s=t.refPathSegments?m(e,t.refPathSegments):void 0;n.push({entry:i,path:t.pathSegments.join(`.`),pathSegments:t.pathSegments,...t.refPathSegments?{refPathSegments:t.refPathSegments,refPath:t.refPathSegments.join(`.`)}:{},value:a.value,...t.providerId?{providerId:t.providerId}:{},...t.accountId?{accountId:t.accountId}:{},...t.refPathSegments?{refValue:s}:{}})}}return n}function O(e,t,n){let r=e.providerIdPathSegmentIndex===void 0?void 0:t[e.providerIdPathSegmentIndex],i=e.accountIdPathSegmentIndex===void 0?void 0:t[e.accountIdPathSegmentIndex],a=e.refPathTokens?ie(e.refPathTokens,n):void 0;return e.refPathTokens&&!a?null:{entry:e,pathSegments:t,...a?{refPathSegments:a}:{},...r?{providerId:r}:{},...i?{accountId:i}:{}}}function he(){return w.map(e=>({id:e.id,targetType:e.targetType,...e.targetTypeAliases?{targetTypeAliases:[...e.targetTypeAliases]}:{},configFile:e.configFile,pathPattern:e.pathPattern,...e.refPathPattern?{refPathPattern:e.refPathPattern}:{},secretShape:e.secretShape,expectedResolvedValue:e.expectedResolvedValue,includeInPlan:e.includeInPlan,includeInConfigure:e.includeInConfigure,includeInAudit:e.includeInAudit,...e.providerIdPathSegmentIndex===void 0?{}:{providerIdPathSegmentIndex:e.providerIdPathSegmentIndex},...e.accountIdPathSegmentIndex===void 0?{}:{accountIdPathSegmentIndex:e.accountIdPathSegmentIndex},...e.authProfileType?{authProfileType:e.authProfileType}:{},...e.trackProviderShadowing?{trackProviderShadowing:!0}:{}}))}function ge(e){return typeof e==`string`&&le.has(e)}function _e(e){return typeof e==`string`&&ue.has(e)}function ve(e){let t=le.get(e.type);if(!t||t.length===0)return null;for(let n of t){if(!n.includeInPlan)continue;let t=re(e.pathSegments,n.pathTokens);if(!t)continue;let r=O(n,e.pathSegments,t.captures);if(r&&!(e.providerId&&e.providerId.trim().length>0&&(!r.providerId||r.providerId!==e.providerId))&&!(e.accountId&&e.accountId.trim().length>0&&(!r.accountId||r.accountId!==e.accountId)))return r}return null}function ye(e){return k(e)}function k(e,t){return D(e,E({allowedTargetIds:T(t),defaultEntries:oe,entriesById:fe}))}function be(e){return xe(e)}function xe(e,t){return D(e,E({allowedTargetIds:T(t),defaultEntries:se,entriesById:me}))}function Se(){return w.filter(e=>e.configFile===`auth-profiles.json`&&e.includeInAudit)}function A(e){let t=e.sourceConfig.secrets?.defaults,n=[],r=[],i=[],a=[];for(let c of k(e.sourceConfig,e.targetIds)){if(e.allowedPaths&&!e.allowedPaths.has(c.path))continue;let{explicitRef:l,ref:u}=o({value:c.value,refValue:c.refValue,defaults:t}),d=l?s(c.value,t):null;if(!u)continue;let f=m(e.resolvedConfig,c.pathSegments);if(!v(f,c.entry.expectedResolvedValue)){if(e.inactiveRefPaths?.has(c.path)){r.push(`${c.path}: secret ref is configured on an inactive surface; skipping command-time assignment.`),a.push({path:c.path,pathSegments:[...c.pathSegments]});continue}i.push({path:c.path,pathSegments:[...c.pathSegments]});continue}n.push({path:c.path,pathSegments:[...c.pathSegments],value:f}),c.entry.secretShape===`sibling_ref`&&l&&d&&r.push(`${c.path}: both inline and sibling ref were present; sibling ref took precedence.`)}return{assignments:n,diagnostics:r,unresolved:i,inactive:a}}function Ce(e){let t=A({sourceConfig:e.sourceConfig,resolvedConfig:e.resolvedConfig,targetIds:e.targetIds,inactiveRefPaths:e.inactiveRefPaths,allowedPaths:e.allowedPaths});if(t.unresolved.length>0)throw Error(`${e.commandName}: ${t.unresolved[0]?.path??`target`} is unresolved in the active runtime snapshot.`);return{assignments:t.assignments,diagnostics:t.diagnostics}}function we(e){return{sourceConfig:e.sourceConfig,env:e.env,cache:{},warnings:[],warningKeys:new Set,assignments:[]}}function j(e,t){e.assignments.push(t)}function M(e,t){let n=`${t.code}:${t.path}:${t.message}`;e.warningKeys.has(n)||(e.warningKeys.add(n),e.warnings.push(t))}function N(e){M(e.context,{code:`SECRETS_REF_IGNORED_INACTIVE_SURFACE`,path:e.path,message:e.details&&e.details.trim().length>0?`${e.path}: ${e.details}`:`${e.path}: secret ref is configured on an inactive surface; skipping resolution until it becomes active.`})}function P(e){let t=s(e.value,e.defaults);if(t){if(e.active===!1){N({context:e.context,path:e.path,details:e.inactiveReason});return}j(e.context,{ref:t,path:e.path,expected:e.expected,apply:e.apply})}}function Te(e){for(let t of e.assignments){let n=c(t.ref);if(!e.resolved.has(n))throw Error(`Secret reference "${n}" resolved to no value.`);let r=e.resolved.get(n);y({value:r,expected:t.expected,errorMessage:t.expected===`string`?`${t.path} resolved to a non-string or empty value.`:`${t.path} resolved to an unsupported value type.`}),t.apply(r)}}function F(e,t){return Object.prototype.hasOwnProperty.call(e,t)}function I(e){return t(e)?e.enabled!==!1:!0}function Ee(e,t){return I(e)&&I(t)}function L(e){let n=e.tts.elevenlabs;t(n)&&P({value:n.apiKey,path:`${e.pathPrefix}.elevenlabs.apiKey`,expected:`string`,defaults:e.defaults,context:e.context,active:e.active,inactiveReason:e.inactiveReason,apply:e=>{n.apiKey=e}});let r=e.tts.openai;t(r)&&P({value:r.apiKey,path:`${e.pathPrefix}.openai.apiKey`,expected:`string`,defaults:e.defaults,context:e.context,active:e.active,inactiveReason:e.inactiveReason,apply:e=>{r.apiKey=e}})}function R(e){let n=I(e),r=e.accounts;if(!t(r)||Object.keys(r).length===0)return{hasExplicitAccounts:!1,channelEnabled:n,accounts:[{accountId:`default`,account:e,enabled:n}]};let i=[];for(let[n,a]of Object.entries(r))t(a)&&i.push({accountId:n,account:a,enabled:Ee(e,a)});return{hasExplicitAccounts:!0,channelEnabled:n,accounts:i}}function z(e,t){return e.channelEnabled?e.hasExplicitAccounts?e.accounts.some(({account:e,enabled:n})=>n&&!F(e,t)):!0:!1}function B(e){return typeof e==`string`?e.trim():``}function V(e,t){return B(e).length>0||s(e,t)!==null}function H(e){if(P({value:e.channel[e.field],path:`channels.${e.channelKey}.${e.field}`,expected:`string`,defaults:e.defaults,context:e.context,active:z(e.surface,e.field),inactiveReason:e.topInactiveReason,apply:t=>{e.channel[e.field]=t}}),e.surface.hasExplicitAccounts)for(let{accountId:t,account:n,enabled:r}of e.surface.accounts)F(n,e.field)&&P({value:n[e.field],path:`channels.${e.channelKey}.accounts.${t}.${e.field}`,expected:`string`,defaults:e.defaults,context:e.context,active:r,inactiveReason:e.accountInactiveReason,apply:t=>{n[e.field]=t}})}function De(e){let n=e.config.channels;if(!t(n))return;let r=n.telegram;if(!t(r))return;let i=R(r),a=typeof r.tokenFile==`string`?r.tokenFile.trim():``,o=i.channelEnabled?i.hasExplicitAccounts?i.accounts.some(({account:t,enabled:n})=>{if(!n||a.length>0)return!1;let r=V(t.botToken,e.defaults),i=typeof t.tokenFile==`string`&&t.tokenFile.trim().length>0;return!r&&!i}):a.length===0:!1;if(P({value:r.botToken,path:`channels.telegram.botToken`,expected:`string`,defaults:e.defaults,context:e.context,active:o,inactiveReason:`no enabled Telegram surface inherits this top-level botToken (tokenFile is configured).`,apply:e=>{r.botToken=e}}),i.hasExplicitAccounts)for(let{accountId:t,account:n,enabled:r}of i.accounts){if(!F(n,`botToken`))continue;let i=typeof n.tokenFile==`string`?n.tokenFile.trim():``;P({value:n.botToken,path:`channels.telegram.accounts.${t}.botToken`,expected:`string`,defaults:e.defaults,context:e.context,active:r&&i.length===0,inactiveReason:`Telegram account is disabled or tokenFile is configured.`,apply:e=>{n.botToken=e}})}let s=typeof r.webhookUrl==`string`?r.webhookUrl.trim():``,c=i.channelEnabled?i.hasExplicitAccounts?i.accounts.some(({account:e,enabled:t})=>t&&!F(e,`webhookSecret`)&&(F(e,`webhookUrl`)?typeof e.webhookUrl==`string`&&e.webhookUrl.trim().length>0:s.length>0)):s.length>0:!1;if(P({value:r.webhookSecret,path:`channels.telegram.webhookSecret`,expected:`string`,defaults:e.defaults,context:e.context,active:c,inactiveReason:`no enabled Telegram webhook surface inherits this top-level webhookSecret (webhook mode is not active).`,apply:e=>{r.webhookSecret=e}}),i.hasExplicitAccounts)for(let{accountId:t,account:n,enabled:r}of i.accounts){if(!F(n,`webhookSecret`))continue;let i=F(n,`webhookUrl`)?typeof n.webhookUrl==`string`?n.webhookUrl.trim():``:s;P({value:n.webhookSecret,path:`channels.telegram.accounts.${t}.webhookSecret`,expected:`string`,defaults:e.defaults,context:e.context,active:r&&i.length>0,inactiveReason:`Telegram account is disabled or webhook mode is not active for this account.`,apply:e=>{n.webhookSecret=e}})}}function Oe(e){let n=e.config.channels;if(!t(n))return;let r=n.slack;if(!t(r))return;let i=R(r),a=r.mode===`http`||r.mode===`socket`?r.mode:`socket`;for(let t of[`botToken`,`userToken`])H({channelKey:`slack`,field:t,channel:r,surface:i,defaults:e.defaults,context:e.context,topInactiveReason:`no enabled account inherits this top-level Slack ${t}.`,accountInactiveReason:`Slack account is disabled.`});let o=i.channelEnabled?i.hasExplicitAccounts?i.accounts.some(({account:e,enabled:t})=>!t||F(e,`appToken`)?!1:(e.mode===`http`||e.mode===`socket`?e.mode:a)!==`http`):a!==`http`:!1;P({value:r.appToken,path:`channels.slack.appToken`,expected:`string`,defaults:e.defaults,context:e.context,active:o,inactiveReason:`no enabled Slack socket-mode surface inherits this top-level appToken.`,apply:e=>{r.appToken=e}});let s=i.channelEnabled?i.hasExplicitAccounts?i.accounts.some(({account:e,enabled:t})=>!t||F(e,`signingSecret`)?!1:(e.mode===`http`||e.mode===`socket`?e.mode:a)===`http`):a===`http`:!1;if(P({value:r.signingSecret,path:`channels.slack.signingSecret`,expected:`string`,defaults:e.defaults,context:e.context,active:s,inactiveReason:`no enabled Slack HTTP-mode surface inherits this top-level signingSecret.`,apply:e=>{r.signingSecret=e}}),i.hasExplicitAccounts)for(let{accountId:t,account:n,enabled:r}of i.accounts){let i=n.mode===`http`||n.mode===`socket`?n.mode:a;F(n,`appToken`)&&P({value:n.appToken,path:`channels.slack.accounts.${t}.appToken`,expected:`string`,defaults:e.defaults,context:e.context,active:r&&i!==`http`,inactiveReason:`Slack account is disabled or not running in socket mode.`,apply:e=>{n.appToken=e}}),F(n,`signingSecret`)&&P({value:n.signingSecret,path:`channels.slack.accounts.${t}.signingSecret`,expected:`string`,defaults:e.defaults,context:e.context,active:r&&i===`http`,inactiveReason:`Slack account is disabled or not running in HTTP mode.`,apply:e=>{n.signingSecret=e}})}}function ke(e){let n=e.config.channels;if(!t(n))return;let r=n.discord;if(!t(r))return;let i=R(r);if(H({channelKey:`discord`,field:`token`,channel:r,surface:i,defaults:e.defaults,context:e.context,topInactiveReason:`no enabled account inherits this top-level Discord token.`,accountInactiveReason:`Discord account is disabled.`}),t(r.pluralkit)){let t=r.pluralkit;P({value:t.token,path:`channels.discord.pluralkit.token`,expected:`string`,defaults:e.defaults,context:e.context,active:z(i,`pluralkit`)&&I(t),inactiveReason:`no enabled Discord surface inherits this top-level PluralKit config or PluralKit is disabled.`,apply:e=>{t.token=e}})}if(t(r.voice)&&t(r.voice.tts)&&L({tts:r.voice.tts,pathPrefix:`channels.discord.voice.tts`,defaults:e.defaults,context:e.context,active:z(i,`voice`)&&I(r.voice),inactiveReason:`no enabled Discord surface inherits this top-level voice config or voice is disabled.`}),i.hasExplicitAccounts)for(let{accountId:n,account:r,enabled:a}of i.accounts){if(F(r,`pluralkit`)&&t(r.pluralkit)){let t=r.pluralkit;P({value:t.token,path:`channels.discord.accounts.${n}.pluralkit.token`,expected:`string`,defaults:e.defaults,context:e.context,active:a&&I(t),inactiveReason:`Discord account is disabled or PluralKit is disabled for this account.`,apply:e=>{t.token=e}})}F(r,`voice`)&&t(r.voice)&&t(r.voice.tts)&&L({tts:r.voice.tts,pathPrefix:`channels.discord.accounts.${n}.voice.tts`,defaults:e.defaults,context:e.context,active:a&&I(r.voice),inactiveReason:`Discord account is disabled or voice is disabled for this account.`})}}function Ae(e){let n=e.config.channels;if(!t(n))return;let r=n.irc;if(!t(r))return;let i=R(r);if(H({channelKey:`irc`,field:`password`,channel:r,surface:i,defaults:e.defaults,context:e.context,topInactiveReason:`no enabled account inherits this top-level IRC password.`,accountInactiveReason:`IRC account is disabled.`}),t(r.nickserv)){let t=r.nickserv;P({value:t.password,path:`channels.irc.nickserv.password`,expected:`string`,defaults:e.defaults,context:e.context,active:z(i,`nickserv`)&&I(t),inactiveReason:`no enabled account inherits this top-level IRC nickserv config or NickServ is disabled.`,apply:e=>{t.password=e}})}if(i.hasExplicitAccounts){for(let{accountId:n,account:r,enabled:a}of i.accounts)if(F(r,`nickserv`)&&t(r.nickserv)){let t=r.nickserv;P({value:t.password,path:`channels.irc.accounts.${n}.nickserv.password`,expected:`string`,defaults:e.defaults,context:e.context,active:a&&I(t),inactiveReason:`IRC account is disabled or NickServ is disabled for this account.`,apply:e=>{t.password=e}})}}}function je(e){let n=e.config.channels;if(!t(n))return;let r=n.bluebubbles;t(r)&&H({channelKey:`bluebubbles`,field:`password`,channel:r,surface:R(r),defaults:e.defaults,context:e.context,topInactiveReason:`no enabled account inherits this top-level BlueBubbles password.`,accountInactiveReason:`BlueBubbles account is disabled.`})}function Me(e){let n=e.config.channels;if(!t(n))return;let r=n.msteams;t(r)&&P({value:r.appPassword,path:`channels.msteams.appPassword`,expected:`string`,defaults:e.defaults,context:e.context,active:r.enabled!==!1,inactiveReason:`Microsoft Teams channel is disabled.`,apply:e=>{r.appPassword=e}})}function Ne(e){let n=e.config.channels;if(!t(n))return;let r=n.mattermost;t(r)&&H({channelKey:`mattermost`,field:`botToken`,channel:r,surface:R(r),defaults:e.defaults,context:e.context,topInactiveReason:`no enabled account inherits this top-level Mattermost botToken.`,accountInactiveReason:`Mattermost account is disabled.`})}function Pe(e){let n=e.config.channels;if(!t(n))return;let r=n.matrix;if(!t(r))return;let i=R(r),a=B(e.context.env.MATRIX_ACCESS_TOKEN).length>0,o=V(r.accessToken,e.defaults),s=i.channelEnabled?i.hasExplicitAccounts?i.accounts.some(({account:t,enabled:n})=>n&&!F(t,`password`)&&!V(t.accessToken,e.defaults)&&!(o||a)):!(o||a):!1;if(P({value:r.password,path:`channels.matrix.password`,expected:`string`,defaults:e.defaults,context:e.context,active:s,inactiveReason:`no enabled Matrix surface inherits this top-level password (an accessToken is configured).`,apply:e=>{r.password=e}}),i.hasExplicitAccounts)for(let{accountId:t,account:n,enabled:r}of i.accounts){if(!F(n,`password`))continue;let i=V(n.accessToken,e.defaults),s=!F(n,`accessToken`)&&(o||a);P({value:n.password,path:`channels.matrix.accounts.${t}.password`,expected:`string`,defaults:e.defaults,context:e.context,active:r&&!(i||s),inactiveReason:`Matrix account is disabled or an accessToken is configured.`,apply:e=>{n.password=e}})}}function Fe(e){let n=e.config.channels;if(!t(n))return;let r=n.zalo;if(!t(r))return;let i=R(r),a=i.channelEnabled?i.hasExplicitAccounts?i.accounts.some(({account:e,enabled:t})=>t&&!F(e,`botToken`)):!0:!1;P({value:r.botToken,path:`channels.zalo.botToken`,expected:`string`,defaults:e.defaults,context:e.context,active:a,inactiveReason:`no enabled Zalo surface inherits this top-level botToken.`,apply:e=>{r.botToken=e}});let o=B(r.webhookUrl),s=i.channelEnabled?i.hasExplicitAccounts?i.accounts.some(({account:e,enabled:t})=>!t||F(e,`webhookSecret`)?!1:(F(e,`webhookUrl`)?B(e.webhookUrl):o).length>0):o.length>0:!1;if(P({value:r.webhookSecret,path:`channels.zalo.webhookSecret`,expected:`string`,defaults:e.defaults,context:e.context,active:s,inactiveReason:`no enabled Zalo webhook surface inherits this top-level webhookSecret (webhook mode is not active).`,apply:e=>{r.webhookSecret=e}}),i.hasExplicitAccounts){for(let{accountId:t,account:n,enabled:r}of i.accounts)if(F(n,`botToken`)&&P({value:n.botToken,path:`channels.zalo.accounts.${t}.botToken`,expected:`string`,defaults:e.defaults,context:e.context,active:r,inactiveReason:`Zalo account is disabled.`,apply:e=>{n.botToken=e}}),F(n,`webhookSecret`)){let i=F(n,`webhookUrl`)?B(n.webhookUrl):o;P({value:n.webhookSecret,path:`channels.zalo.accounts.${t}.webhookSecret`,expected:`string`,defaults:e.defaults,context:e.context,active:r&&i.length>0,inactiveReason:`Zalo account is disabled or webhook mode is not active for this account.`,apply:e=>{n.webhookSecret=e}})}}}function Ie(e){let n=e.config.channels;if(!t(n))return;let r=n.feishu;if(!t(r))return;let i=R(r);H({channelKey:`feishu`,field:`appSecret`,channel:r,surface:i,defaults:e.defaults,context:e.context,topInactiveReason:`no enabled account inherits this top-level Feishu appSecret.`,accountInactiveReason:`Feishu account is disabled.`});let a=B(r.connectionMode)===`webhook`?`webhook`:`websocket`,o=i.channelEnabled?i.hasExplicitAccounts?i.accounts.some(({account:e,enabled:t})=>!t||F(e,`verificationToken`)?!1:(F(e,`connectionMode`)?B(e.connectionMode):a)===`webhook`):a===`webhook`:!1;if(P({value:r.verificationToken,path:`channels.feishu.verificationToken`,expected:`string`,defaults:e.defaults,context:e.context,active:o,inactiveReason:`no enabled Feishu webhook-mode surface inherits this top-level verificationToken.`,apply:e=>{r.verificationToken=e}}),i.hasExplicitAccounts)for(let{accountId:t,account:n,enabled:r}of i.accounts){if(!F(n,`verificationToken`))continue;let i=F(n,`connectionMode`)?B(n.connectionMode):a;P({value:n.verificationToken,path:`channels.feishu.accounts.${t}.verificationToken`,expected:`string`,defaults:e.defaults,context:e.context,active:r&&i===`webhook`,inactiveReason:`Feishu account is disabled or not running in webhook mode.`,apply:e=>{n.verificationToken=e}})}}function Le(e){let n=e.config.channels;if(!t(n))return;let r=n[`nextcloud-talk`];if(!t(r))return;let i=R(r),a=i.channelEnabled?i.hasExplicitAccounts?i.accounts.some(({account:e,enabled:t})=>t&&!F(e,`botSecret`)):!0:!1;P({value:r.botSecret,path:`channels.nextcloud-talk.botSecret`,expected:`string`,defaults:e.defaults,context:e.context,active:a,inactiveReason:`no enabled Nextcloud Talk surface inherits this top-level botSecret.`,apply:e=>{r.botSecret=e}});let o=i.channelEnabled?i.hasExplicitAccounts?i.accounts.some(({account:e,enabled:t})=>t&&!F(e,`apiPassword`)):!0:!1;if(P({value:r.apiPassword,path:`channels.nextcloud-talk.apiPassword`,expected:`string`,defaults:e.defaults,context:e.context,active:o,inactiveReason:`no enabled Nextcloud Talk surface inherits this top-level apiPassword.`,apply:e=>{r.apiPassword=e}}),i.hasExplicitAccounts)for(let{accountId:t,account:n,enabled:r}of i.accounts)F(n,`botSecret`)&&P({value:n.botSecret,path:`channels.nextcloud-talk.accounts.${t}.botSecret`,expected:`string`,defaults:e.defaults,context:e.context,active:r,inactiveReason:`Nextcloud Talk account is disabled.`,apply:e=>{n.botSecret=e}}),F(n,`apiPassword`)&&P({value:n.apiPassword,path:`channels.nextcloud-talk.accounts.${t}.apiPassword`,expected:`string`,defaults:e.defaults,context:e.context,active:r,inactiveReason:`Nextcloud Talk account is disabled.`,apply:e=>{n.apiPassword=e}})}function U(e){let{explicitRef:t,ref:n}=o({value:e.target.serviceAccount,refValue:e.target.serviceAccountRef,defaults:e.defaults});if(n){if(e.active===!1){N({context:e.context,path:`${e.path}.serviceAccount`,details:e.inactiveReason});return}t&&e.target.serviceAccount!==void 0&&!s(e.target.serviceAccount,e.defaults)&&M(e.context,{code:`SECRETS_REF_OVERRIDES_PLAINTEXT`,path:e.path,message:`${e.path}: serviceAccountRef is set; runtime will ignore plaintext serviceAccount.`}),j(e.context,{ref:n,path:`${e.path}.serviceAccount`,expected:`string-or-object`,apply:t=>{e.target.serviceAccount=t}})}}function Re(e){let t=e.googleChat,n=R(t),r=n.channelEnabled?n.hasExplicitAccounts?n.accounts.some(({account:e,enabled:t})=>t&&!F(e,`serviceAccount`)&&!F(e,`serviceAccountRef`)):!0:!1;if(U({target:e.googleChat,path:`channels.googlechat`,defaults:e.defaults,context:e.context,active:r,inactiveReason:`no enabled account inherits this top-level Google Chat serviceAccount.`}),n.hasExplicitAccounts)for(let{accountId:t,account:r,enabled:i}of n.accounts)!F(r,`serviceAccount`)&&!F(r,`serviceAccountRef`)||U({target:r,path:`channels.googlechat.accounts.${t}`,defaults:e.defaults,context:e.context,active:i,inactiveReason:`Google Chat account is disabled.`})}function ze(e){let t=e.config.channels?.googlechat;t&&Re({googleChat:t,defaults:e.defaults,context:e.context}),De(e),Oe(e),ke(e),Ae(e),je(e),Ne(e),Pe(e),Me(e),Le(e),Ie(e),Fe(e)}const Be=[`gateway.auth.token`,`gateway.auth.password`,`gateway.remote.token`,`gateway.remote.password`];function Ve(e){return e??`unset`}function He(e){let t=[];return e.remoteMode&&t.push(`gateway.mode is "remote"`),e.remoteUrlConfigured&&t.push(`gateway.remote.url is configured`),e.tailscaleRemoteExposure&&t.push(`gateway.tailscale.mode is "serve" or "funnel"`),t.join(`; `)}function W(e){return{path:e.path,active:e.active,reason:e.reason,hasSecretRef:e.hasSecretRef}}function Ue(e){let n=e.config.gateway;if(!t(n))return{"gateway.auth.token":W({path:`gateway.auth.token`,active:!1,reason:`gateway configuration is not set.`,hasSecretRef:!1}),"gateway.auth.password":W({path:`gateway.auth.password`,active:!1,reason:`gateway configuration is not set.`,hasSecretRef:!1}),"gateway.remote.token":W({path:`gateway.remote.token`,active:!1,reason:`gateway configuration is not set.`,hasSecretRef:!1}),"gateway.remote.password":W({path:`gateway.remote.password`,active:!1,reason:`gateway configuration is not set.`,hasSecretRef:!1})};let i=t(n?.auth)?n.auth:void 0,a=t(n?.remote)?n.remote:void 0,o=r({config:e.config,env:e.env,includeLegacyEnv:!0,defaults:e.defaults}),s=i?o.passwordCanWin?o.authMode===`password`?`gateway.auth.mode is "password".`:`no token source can win, so password auth can win.`:o.authMode===`token`||o.authMode===`none`||o.authMode===`trusted-proxy`?`gateway.auth.mode is "${o.authMode}".`:o.envToken?`gateway token env var is configured.`:o.localToken.configured?`gateway.auth.token is configured.`:o.remoteToken.configured?`gateway.remote.token is configured.`:`token auth can win.`:`gateway.auth is not configured.`,c=i?o.authMode===`token`?o.envToken?`gateway token env var is configured.`:`gateway.auth.mode is "token".`:o.authMode===`password`||o.authMode===`none`||o.authMode===`trusted-proxy`?`gateway.auth.mode is "${o.authMode}".`:o.envToken?`gateway token env var is configured.`:o.envPassword?`gateway password env var is configured.`:o.localPassword.configured?`gateway.auth.password is configured.`:`token auth can win (mode is unset and no password source is configured).`:`gateway.auth is not configured.`,l=He({remoteMode:o.remoteMode,remoteUrlConfigured:o.remoteUrlConfigured,tailscaleRemoteExposure:o.tailscaleRemoteExposure}),u=a?o.remoteConfiguredSurface?`remote surface is active: ${l}.`:o.remoteTokenFallbackActive?`local token auth can win and no env/auth token is configured.`:o.localTokenCanWin?o.envToken?`gateway token env var is configured.`:o.localToken.configured?`gateway.auth.token is configured.`:`remote token fallback is not active.`:`token auth cannot win with gateway.auth.mode="${Ve(o.authMode)}".`:`gateway.remote is not configured.`,d=a?o.remoteConfiguredSurface?`remote surface is active: ${l}.`:o.remotePasswordFallbackActive?`password auth can win and no env/auth password is configured.`:o.passwordCanWin?o.envPassword?`gateway password env var is configured.`:o.localPassword.configured?`gateway.auth.password is configured.`:`remote password fallback is not active.`:o.authMode===`token`||o.authMode===`none`||o.authMode===`trusted-proxy`?`password auth cannot win with gateway.auth.mode="${o.authMode}".`:`a token source can win, so password auth cannot win.`:`gateway.remote is not configured.`;return{"gateway.auth.token":W({path:`gateway.auth.token`,active:o.localTokenSurfaceActive,reason:c,hasSecretRef:o.localToken.hasSecretRef}),"gateway.auth.password":W({path:`gateway.auth.password`,active:o.passwordCanWin,reason:s,hasSecretRef:o.localPassword.hasSecretRef}),"gateway.remote.token":W({path:`gateway.remote.token`,active:o.remoteTokenActive,reason:u,hasSecretRef:o.remoteToken.hasSecretRef}),"gateway.remote.password":W({path:`gateway.remote.password`,active:o.remotePasswordActive,reason:d,hasSecretRef:o.remotePassword.hasSecretRef})}}function We(e){for(let[n,r]of Object.entries(e.providers)){let i=r.enabled!==!1;P({value:r.apiKey,path:`models.providers.${n}.apiKey`,expected:`string`,defaults:e.defaults,context:e.context,active:i,inactiveReason:`provider is disabled.`,apply:e=>{r.apiKey=e}});let a=t(r.headers)?r.headers:void 0;if(a)for(let[t,r]of Object.entries(a))P({value:r,path:`models.providers.${n}.headers.${t}`,expected:`string`,defaults:e.defaults,context:e.context,active:i,inactiveReason:`provider is disabled.`,apply:e=>{a[t]=e}})}}function Ge(e){for(let[t,n]of Object.entries(e.entries))P({value:n.apiKey,path:`skills.entries.${t}.apiKey`,expected:`string`,defaults:e.defaults,context:e.context,active:n.enabled!==!1,inactiveReason:`skill entry is disabled.`,apply:e=>{n.apiKey=e}})}function Ke(e){let n=e.config.agents;if(!t(n))return;let r=t(n.defaults)?n.defaults:void 0,i=t(r?.memorySearch)?r.memorySearch:void 0,a=i?.enabled!==!1,o=Array.isArray(n.list)?n.list:[],s=!1;for(let e of o){if(!t(e)||e.enabled===!1)continue;let n=t(e.memorySearch)?e.memorySearch:void 0;if(n?.enabled===!1)continue;if(!n||!Object.prototype.hasOwnProperty.call(n,`remote`)){s=!0;continue}let r=t(n.remote)?n.remote:void 0;if(!r||!Object.prototype.hasOwnProperty.call(r,`apiKey`)){s=!0;continue}}if(i&&t(i.remote)){let t=i.remote;P({value:t.apiKey,path:`agents.defaults.memorySearch.remote.apiKey`,expected:`string`,defaults:e.defaults,context:e.context,active:a&&(s||o.length===0),inactiveReason:s?void 0:`all enabled agents override memorySearch.remote.apiKey.`,apply:e=>{t.apiKey=e}})}o.forEach((n,r)=>{if(!t(n))return;let i=t(n.memorySearch)?n.memorySearch:void 0;if(!i)return;let a=t(i.remote)?i.remote:void 0;if(!a||!Object.prototype.hasOwnProperty.call(a,`apiKey`))return;let o=n.enabled!==!1&&i.enabled!==!1;P({value:a.apiKey,path:`agents.list.${r}.memorySearch.remote.apiKey`,expected:`string`,defaults:e.defaults,context:e.context,active:o,inactiveReason:`agent or memorySearch override is disabled.`,apply:e=>{a.apiKey=e}})})}function qe(e){let n=e.config.talk;if(!t(n))return;P({value:n.apiKey,path:`talk.apiKey`,expected:`string`,defaults:e.defaults,context:e.context,apply:e=>{n.apiKey=e}});let r=n.providers;if(t(r))for(let[n,i]of Object.entries(r))t(i)&&P({value:i.apiKey,path:`talk.providers.${n}.apiKey`,expected:`string`,defaults:e.defaults,context:e.context,apply:e=>{i.apiKey=e}})}function Je(e){let n=e.config.gateway;if(!t(n))return;let r=t(n.auth)?n.auth:void 0,i=t(n.remote)?n.remote:void 0,a=Ue({config:e.config,env:e.context.env,defaults:e.defaults});r&&(P({value:r.token,path:`gateway.auth.token`,expected:`string`,defaults:e.defaults,context:e.context,active:a[`gateway.auth.token`].active,inactiveReason:a[`gateway.auth.token`].reason,apply:e=>{r.token=e}}),P({value:r.password,path:`gateway.auth.password`,expected:`string`,defaults:e.defaults,context:e.context,active:a[`gateway.auth.password`].active,inactiveReason:a[`gateway.auth.password`].reason,apply:e=>{r.password=e}})),i&&(P({value:i.token,path:`gateway.remote.token`,expected:`string`,defaults:e.defaults,context:e.context,active:a[`gateway.remote.token`].active,inactiveReason:a[`gateway.remote.token`].reason,apply:e=>{i.token=e}}),P({value:i.password,path:`gateway.remote.password`,expected:`string`,defaults:e.defaults,context:e.context,active:a[`gateway.remote.password`].active,inactiveReason:a[`gateway.remote.password`].reason,apply:e=>{i.password=e}}))}function Ye(e){let n=e.config.messages;!t(n)||!t(n.tts)||L({tts:n.tts,pathPrefix:`messages.tts`,defaults:e.defaults,context:e.context})}function Xe(e){let n=e.config.cron;t(n)&&P({value:n.webhookToken,path:`cron.webhookToken`,expected:`string`,defaults:e.defaults,context:e.context,apply:e=>{n.webhookToken=e}})}function Ze(e){let t=e.config.models?.providers;t&&We({providers:t,defaults:e.defaults,context:e.context});let n=e.config.skills?.entries;n&&Ge({entries:n,defaults:e.defaults,context:e.context}),Ke(e),qe(e),Je(e),Ye(e),Xe(e)}function Qe(e){let t=e.context.sourceConfig.secrets?.defaults;Ze({config:e.config,defaults:t,context:e.context}),ze({config:e.config,defaults:t,context:e.context})}const G=[`brave`,`gemini`,`grok`,`kimi`,`perplexity`],$e=`https://api.perplexity.ai`,K=`https://openrouter.ai/api/v1`,et=[`pplx-`],tt=[`sk-or-`];function q(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}function nt(e){if(typeof e!=`string`)return;let t=e.trim().toLowerCase();if(t===`brave`||t===`gemini`||t===`grok`||t===`kimi`||t===`perplexity`)return t}function J(e,t){for(let n of t){let t=a(e[n]);if(t)return{value:t,envVar:n}}return{}}function Y(e){return e.kind===`non-string`?`${e.path} SecretRef resolved to a non-string value.`:e.kind===`empty`?`${e.path} SecretRef resolved to an empty value.`:`${e.path} SecretRef is unresolved (${e.refLabel}).`}async function rt(e){let{ref:t}=o({value:e.value,defaults:e.defaults});if(!t){let t=a(e.value);if(t)return{value:t,source:`config`,secretRefConfigured:!1,fallbackUsedAfterRefFailure:!1};let n=J(e.context.env,e.envVars);return n.value?{value:n.value,source:`env`,fallbackEnvVar:n.envVar,secretRefConfigured:!1,fallbackUsedAfterRefFailure:!1}:{source:`missing`,secretRefConfigured:!1,fallbackUsedAfterRefFailure:!1}}let r=`${t.source}:${t.provider}:${t.id}`,i,s;try{let o=(await n([t],{config:e.sourceConfig,env:e.context.env,cache:e.context.cache})).get(c(t));typeof o==`string`?(i=a(o),i||(s=Y({path:e.path,kind:`empty`,refLabel:r}))):s=Y({path:e.path,kind:`non-string`,refLabel:r})}catch{s=Y({path:e.path,kind:`unresolved`,refLabel:r})}if(i)return{value:i,source:`secretRef`,secretRefConfigured:!0,fallbackUsedAfterRefFailure:!1};let l=J(e.context.env,e.envVars);return l.value?{value:l.value,source:`env`,fallbackEnvVar:l.envVar,unresolvedRefReason:s,secretRefConfigured:!0,fallbackUsedAfterRefFailure:!0}:{source:`missing`,unresolvedRefReason:s,secretRefConfigured:!0,fallbackUsedAfterRefFailure:!1}}function it(e){if(!e)return;let t=e.toLowerCase();if(et.some(e=>t.startsWith(e)))return`direct`;if(tt.some(e=>t.startsWith(e)))return`openrouter`}function at(e){let t=q(e.configValue)?e.configValue:void 0,n=typeof t?.baseUrl==`string`?t.baseUrl.trim():``,r=typeof t?.model==`string`?t.model.trim():``,i=(()=>{if(n)return n;if(e.keySource===`env`){if(e.fallbackEnvVar===`PERPLEXITY_API_KEY`)return $e;if(e.fallbackEnvVar===`OPENROUTER_API_KEY`)return K}return(e.keySource===`config`||e.keySource===`secretRef`)&&e.keyValue?it(e.keyValue)===`openrouter`?K:$e:K})(),a=!!(n||r),o=(()=>{try{return new URL(i).hostname.toLowerCase()===`api.perplexity.ai`}catch{return!1}})();return a||!o?`chat_completions`:`search_api`}function X(e,t){let n=e[t];if(q(n))return n;let r={};return e[t]=r,r}function Z(e){let t=X(X(X(e.resolvedConfig,`tools`),`web`),`search`);if(e.provider===`brave`){t.apiKey=e.value;return}let n=X(t,e.provider);n.apiKey=e.value}function ot(e){let t=X(X(X(X(e.resolvedConfig,`tools`),`web`),`fetch`),`firecrawl`);t.apiKey=e.value}function st(e){return e===`brave`?[`BRAVE_API_KEY`]:e===`gemini`?[`GEMINI_API_KEY`]:e===`grok`?[`XAI_API_KEY`]:e===`kimi`?[`KIMI_API_KEY`,`MOONSHOT_API_KEY`]:[`PERPLEXITY_API_KEY`,`OPENROUTER_API_KEY`]}function Q(e,t){if(t===`brave`)return e.apiKey;let n=e[t];if(q(n))return n.apiKey}function $(e,t){return!!o({value:e,defaults:t}).ref}async function ct(e){let t=e.sourceConfig.secrets?.defaults,n=[],r=q(e.sourceConfig.tools)?e.sourceConfig.tools:void 0,i=q(r?.web)?r.web:void 0,o=q(i?.search)?i.search:void 0,s={providerSource:`none`,diagnostics:[]},c=o?.enabled!==!1,l=typeof o?.provider==`string`?o.provider.trim().toLowerCase():``,u=nt(l);if(l&&!u){let t={code:`WEB_SEARCH_PROVIDER_INVALID_AUTODETECT`,message:`tools.web.search.provider is "${l}". Falling back to auto-detect precedence.`,path:`tools.web.search.provider`};n.push(t),s.diagnostics.push(t),M(e.context,{code:`WEB_SEARCH_PROVIDER_INVALID_AUTODETECT`,path:`tools.web.search.provider`,message:t.message})}if(u&&(s.providerConfigured=u,s.providerSource=`configured`),c&&o){let r=u?[u]:[...G],i=[],a,c;for(let l of r){let r=l===`brave`?`tools.web.search.apiKey`:`tools.web.search.${l}.apiKey`,d=Q(o,l),f=await rt({sourceConfig:e.sourceConfig,context:e.context,defaults:t,value:d,path:r,envVars:st(l)});if(f.secretRefConfigured&&f.fallbackUsedAfterRefFailure){let t={code:`WEB_SEARCH_KEY_UNRESOLVED_FALLBACK_USED`,message:`${r} SecretRef could not be resolved; using ${f.fallbackEnvVar??`env fallback`}. `+(f.unresolvedRefReason??``).trim(),path:r};n.push(t),s.diagnostics.push(t),M(e.context,{code:`WEB_SEARCH_KEY_UNRESOLVED_FALLBACK_USED`,path:r,message:t.message})}if(f.secretRefConfigured&&!f.value&&f.unresolvedRefReason&&i.push({provider:l,path:r,reason:f.unresolvedRefReason}),u){a=l,c=f,f.value&&Z({resolvedConfig:e.resolvedConfig,provider:l,value:f.value});break}if(f.value){a=l,c=f,Z({resolvedConfig:e.resolvedConfig,provider:l,value:f.value});break}}if(u){let t=i[0];if(t){let r={code:`WEB_SEARCH_KEY_UNRESOLVED_NO_FALLBACK`,message:t.reason,path:t.path};throw n.push(r),s.diagnostics.push(r),M(e.context,{code:`WEB_SEARCH_KEY_UNRESOLVED_NO_FALLBACK`,path:t.path,message:t.reason}),Error(`[WEB_SEARCH_KEY_UNRESOLVED_NO_FALLBACK] ${t.reason}`)}}else{if(!a&&i.length>0){let t=i[0],r={code:`WEB_SEARCH_KEY_UNRESOLVED_NO_FALLBACK`,message:t.reason,path:t.path};throw n.push(r),s.diagnostics.push(r),M(e.context,{code:`WEB_SEARCH_KEY_UNRESOLVED_NO_FALLBACK`,path:t.path,message:t.reason}),Error(`[WEB_SEARCH_KEY_UNRESOLVED_NO_FALLBACK] ${t.reason}`)}if(a){let e={code:`WEB_SEARCH_AUTODETECT_SELECTED`,message:`tools.web.search auto-detected provider "${a}" from available credentials.`,path:`tools.web.search.provider`};n.push(e),s.diagnostics.push(e)}}a&&(s.selectedProvider=a,s.selectedProviderKeySource=c?.source,u||(s.providerSource=`auto-detect`),a===`perplexity`&&(s.perplexityTransport=at({keyValue:c?.value,keySource:c?.source??`missing`,fallbackEnvVar:c?.fallbackEnvVar,configValue:o.perplexity})))}if(c&&o&&!u&&s.selectedProvider)for(let n of G){if(n===s.selectedProvider)continue;let r=n===`brave`?`tools.web.search.apiKey`:`tools.web.search.${n}.apiKey`;$(Q(o,n),t)&&N({context:e.context,path:r,details:`tools.web.search auto-detected provider is "${s.selectedProvider}".`})}else if(o&&!c)for(let n of G){let r=n===`brave`?`tools.web.search.apiKey`:`tools.web.search.${n}.apiKey`;$(Q(o,n),t)&&N({context:e.context,path:r,details:`tools.web.search is disabled.`})}if(c&&o&&u)for(let n of G){if(n===u)continue;let r=n===`brave`?`tools.web.search.apiKey`:`tools.web.search.${n}.apiKey`;$(Q(o,n),t)&&N({context:e.context,path:r,details:`tools.web.search.provider is "${u}".`})}let d=q(i?.fetch)?i.fetch:void 0,f=q(d?.firecrawl)?d.firecrawl:void 0,p=d?.enabled!==!1,m=f?.enabled!==!1,h=!!(p&&m),g=`tools.web.fetch.firecrawl.apiKey`,_={source:`missing`,secretRefConfigured:!1,fallbackUsedAfterRefFailure:!1},v=[];if(h){if(_=await rt({sourceConfig:e.sourceConfig,context:e.context,defaults:t,value:f?.apiKey,path:g,envVars:[`FIRECRAWL_API_KEY`]}),_.value&&ot({resolvedConfig:e.resolvedConfig,value:_.value}),_.secretRefConfigured){if(_.fallbackUsedAfterRefFailure){let t={code:`WEB_FETCH_FIRECRAWL_KEY_UNRESOLVED_FALLBACK_USED`,message:`${g} SecretRef could not be resolved; using ${_.fallbackEnvVar??`env fallback`}. `+(_.unresolvedRefReason??``).trim(),path:g};n.push(t),v.push(t),M(e.context,{code:`WEB_FETCH_FIRECRAWL_KEY_UNRESOLVED_FALLBACK_USED`,path:g,message:t.message})}if(!_.value&&_.unresolvedRefReason){let t={code:`WEB_FETCH_FIRECRAWL_KEY_UNRESOLVED_NO_FALLBACK`,message:_.unresolvedRefReason,path:g};throw n.push(t),v.push(t),M(e.context,{code:`WEB_FETCH_FIRECRAWL_KEY_UNRESOLVED_NO_FALLBACK`,path:g,message:_.unresolvedRefReason}),Error(`[WEB_FETCH_FIRECRAWL_KEY_UNRESOLVED_NO_FALLBACK] ${_.unresolvedRefReason}`)}}}else if($(f?.apiKey,t))N({context:e.context,path:g,details:p?`tools.web.fetch.firecrawl.enabled is false.`:`tools.web.fetch is disabled.`}),_={source:`secretRef`,secretRefConfigured:!0,fallbackUsedAfterRefFailure:!1};else{let t=a(f?.apiKey);if(t)_={value:t,source:`config`,secretRefConfigured:!1,fallbackUsedAfterRefFailure:!1};else{let t=J(e.context.env,[`FIRECRAWL_API_KEY`]);t.value&&(_={value:t.value,source:`env`,fallbackEnvVar:t.envVar,secretRefConfigured:!1,fallbackUsedAfterRefFailure:!1})}}return{search:s,fetch:{firecrawl:{active:h,apiKeySource:_.source,diagnostics:v}},diagnostics:n}}export{m as C,_ as S,g as T,he as _,Te as a,ee as b,M as c,be as d,ye as f,Se as g,ge as h,Ue as i,A as l,_e as m,Qe as n,we as o,k as p,Be as r,j as s,ct as t,Ce as u,ve as v,h as w,v as x,y};