@qqbrowser/openclaw-qbot 0.0.148 → 0.10.1

package/dist/runtime-status-DszMjvJK.js

@@ -1,2 +1 @@
 function e({status:e,pid:t,state:n,details:r=[]}){let i=e??`unknown`,a=[];t&&a.push(`pid ${t}`),n&&n.toLowerCase()!==i&&a.push(`state ${n}`);for(let e of r)e&&a.push(e);return a.length>0?`${i} (${a.join(`, `)})`:i}export{e as t};
-//# sourceMappingURL=runtime-status-DszMjvJK.js.map

package/dist/runtime-web-tools-BYhCkBV8.js

@@ -1,2 +1 @@
 import{Wi as e,cu as t,do as n,fo as r,lo as i,po as a}from"./auth-profiles-C8rZRS0X.js";import{d as o,i as s}from"./types.secrets-D4tbc3Wq.js";import{jt as c}from"./plugins-DNlgeTTc.js";import{isDeepStrictEqual as l}from"node:util";function u(e){return/^\d+$/.test(e)}function d(e){return u(e)?`array`:`object`}function f(e,t,n){if(!Array.isArray(e))return null;if(!u(t))throw Error(`Invalid array index segment "${t}" at ${n.join(`.`)}.`);return{array:e,index:Number.parseInt(t,10)}}function p(e){if(e.segments.length===0)throw Error(`Target path is empty.`);let t=e.root;for(let n=0;n<e.segments.length-1;n+=1){let i=e.segments[n]??``;if(Array.isArray(t)){if(!u(i))throw Error(`Invalid array index segment "${i}" at ${e.segments.join(`.`)}.`);let r=Number.parseInt(i,10);if(e.requireExistingSegment&&(r<0||r>=t.length))throw Error(`Path segment does not exist at ${e.segments.slice(0,n+1).join(`.`)}.`);t=t[r];continue}if(!r(t))throw Error(`Invalid path shape at ${e.segments.slice(0,n).join(`.`)||`<root>`}.`);if(e.requireExistingSegment&&!Object.prototype.hasOwnProperty.call(t,i))throw Error(`Path segment does not exist at ${e.segments.slice(0,n+1).join(`.`)}.`);t=t[i]}return t}function m(e,t){if(t.length===0)return;let n=e;for(let e of t){if(Array.isArray(n)){if(!u(e))return;n=n[Number.parseInt(e,10)];continue}if(!r(n))return;n=n[e]}return n}function h(e,t,n){if(t.length===0)throw Error(`Target path is empty.`);let i=e,a=!1;for(let e=0;e<t.length-1;e+=1){let n=t[e]??``,o=d(t[e+1]??``);if(Array.isArray(i)){if(!u(n))throw Error(`Invalid array index segment "${n}" at ${t.join(`.`)}.`);let s=Number.parseInt(n,10),c=i[s];if(c==null)i[s]=o===`array`?[]:{},a=!0;else if(o===`array`?!Array.isArray(c):!r(c))throw Error(`Invalid path shape at ${t.slice(0,e+1).join(`.`)}.`);i=i[s];continue}if(!r(i))throw Error(`Invalid path shape at ${t.slice(0,e).join(`.`)||`<root>`}.`);let s=i[n];if(s==null)i[n]=o===`array`?[]:{},a=!0;else if(o===`array`?!Array.isArray(s):!r(s))throw Error(`Invalid path shape at ${t.slice(0,e+1).join(`.`)}.`);i=i[n]}let o=t[t.length-1]??``,s=f(i,o,t);if(s)return l(s.array[s.index],n)||(s.array[s.index]=n,a=!0),a;if(!r(i))throw Error(`Invalid path shape at ${t.slice(0,-1).join(`.`)||`<root>`}.`);return l(i[o],n)||(i[o]=n,a=!0),a}function g(e,t,n){let i=p({root:e,segments:t,requireExistingSegment:!0}),a=t[t.length-1]??``,o=f(i,a,t);if(o){if(o.index<0||o.index>=o.array.length)throw Error(`Path segment does not exist at ${t.join(`.`)}.`);return l(o.array[o.index],n)?!1:(o.array[o.index]=n,!0)}if(!r(i))throw Error(`Invalid path shape at ${t.slice(0,-1).join(`.`)||`<root>`}.`);if(!Object.prototype.hasOwnProperty.call(i,a))throw Error(`Path segment does not exist at ${t.join(`.`)}.`);return l(i[a],n)?!1:(i[a]=n,!0)}function _(e,t){let n=p({root:e,segments:t,requireExistingSegment:!1}),i=t[t.length-1]??``,a=f(n,i,t);if(a)return a.index<0||a.index>=a.array.length?!1:(a.array.splice(a.index,1),!0);if(!r(n))throw Error(`Invalid path shape at ${t.slice(0,-1).join(`.`)||`<root>`}.`);return Object.prototype.hasOwnProperty.call(n,i)?(delete n[i],!0):!1}function v(e,t){return t===`string`?n(e):n(e)||r(e)}function ee(e,t){return t===`string`?n(e):n(e)||r(e)&&Object.keys(e).length>0}function y(e){if(!v(e.value,e.expected))throw Error(e.errorMessage)}const b=`secret_input`,x=`sibling_ref`,te=[{id:`auth-profiles.api_key.key`,targetType:`auth-profiles.api_key.key`,configFile:`auth-profiles.json`,pathPattern:`profiles.*.key`,refPathPattern:`profiles.*.keyRef`,secretShape:x,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0,authProfileType:`api_key`},{id:`auth-profiles.token.token`,targetType:`auth-profiles.token.token`,configFile:`auth-profiles.json`,pathPattern:`profiles.*.token`,refPathPattern:`profiles.*.tokenRef`,secretShape:x,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0,authProfileType:`token`},{id:`agents.defaults.memorySearch.remote.apiKey`,targetType:`agents.defaults.memorySearch.remote.apiKey`,configFile:`openclaw.json`,pathPattern:`agents.defaults.memorySearch.remote.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`agents.list[].memorySearch.remote.apiKey`,targetType:`agents.list[].memorySearch.remote.apiKey`,configFile:`openclaw.json`,pathPattern:`agents.list[].memorySearch.remote.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.bluebubbles.accounts.*.password`,targetType:`channels.bluebubbles.accounts.*.password`,configFile:`openclaw.json`,pathPattern:`channels.bluebubbles.accounts.*.password`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.bluebubbles.password`,targetType:`channels.bluebubbles.password`,configFile:`openclaw.json`,pathPattern:`channels.bluebubbles.password`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.discord.accounts.*.pluralkit.token`,targetType:`channels.discord.accounts.*.pluralkit.token`,configFile:`openclaw.json`,pathPattern:`channels.discord.accounts.*.pluralkit.token`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.discord.accounts.*.token`,targetType:`channels.discord.accounts.*.token`,configFile:`openclaw.json`,pathPattern:`channels.discord.accounts.*.token`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.discord.accounts.*.voice.tts.elevenlabs.apiKey`,targetType:`channels.discord.accounts.*.voice.tts.elevenlabs.apiKey`,configFile:`openclaw.json`,pathPattern:`channels.discord.accounts.*.voice.tts.elevenlabs.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.discord.accounts.*.voice.tts.openai.apiKey`,targetType:`channels.discord.accounts.*.voice.tts.openai.apiKey`,configFile:`openclaw.json`,pathPattern:`channels.discord.accounts.*.voice.tts.openai.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.discord.pluralkit.token`,targetType:`channels.discord.pluralkit.token`,configFile:`openclaw.json`,pathPattern:`channels.discord.pluralkit.token`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.discord.token`,targetType:`channels.discord.token`,configFile:`openclaw.json`,pathPattern:`channels.discord.token`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.discord.voice.tts.elevenlabs.apiKey`,targetType:`channels.discord.voice.tts.elevenlabs.apiKey`,configFile:`openclaw.json`,pathPattern:`channels.discord.voice.tts.elevenlabs.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.discord.voice.tts.openai.apiKey`,targetType:`channels.discord.voice.tts.openai.apiKey`,configFile:`openclaw.json`,pathPattern:`channels.discord.voice.tts.openai.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.feishu.accounts.*.appSecret`,targetType:`channels.feishu.accounts.*.appSecret`,configFile:`openclaw.json`,pathPattern:`channels.feishu.accounts.*.appSecret`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.feishu.accounts.*.verificationToken`,targetType:`channels.feishu.accounts.*.verificationToken`,configFile:`openclaw.json`,pathPattern:`channels.feishu.accounts.*.verificationToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.feishu.appSecret`,targetType:`channels.feishu.appSecret`,configFile:`openclaw.json`,pathPattern:`channels.feishu.appSecret`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.feishu.verificationToken`,targetType:`channels.feishu.verificationToken`,configFile:`openclaw.json`,pathPattern:`channels.feishu.verificationToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.googlechat.accounts.*.serviceAccount`,targetType:`channels.googlechat.serviceAccount`,targetTypeAliases:[`channels.googlechat.accounts.*.serviceAccount`],configFile:`openclaw.json`,pathPattern:`channels.googlechat.accounts.*.serviceAccount`,refPathPattern:`channels.googlechat.accounts.*.serviceAccountRef`,secretShape:x,expectedResolvedValue:`string-or-object`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0,accountIdPathSegmentIndex:3},{id:`channels.googlechat.serviceAccount`,targetType:`channels.googlechat.serviceAccount`,configFile:`openclaw.json`,pathPattern:`channels.googlechat.serviceAccount`,refPathPattern:`channels.googlechat.serviceAccountRef`,secretShape:x,expectedResolvedValue:`string-or-object`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.irc.accounts.*.nickserv.password`,targetType:`channels.irc.accounts.*.nickserv.password`,configFile:`openclaw.json`,pathPattern:`channels.irc.accounts.*.nickserv.password`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.irc.accounts.*.password`,targetType:`channels.irc.accounts.*.password`,configFile:`openclaw.json`,pathPattern:`channels.irc.accounts.*.password`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.irc.nickserv.password`,targetType:`channels.irc.nickserv.password`,configFile:`openclaw.json`,pathPattern:`channels.irc.nickserv.password`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.irc.password`,targetType:`channels.irc.password`,configFile:`openclaw.json`,pathPattern:`channels.irc.password`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.mattermost.accounts.*.botToken`,targetType:`channels.mattermost.accounts.*.botToken`,configFile:`openclaw.json`,pathPattern:`channels.mattermost.accounts.*.botToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.mattermost.botToken`,targetType:`channels.mattermost.botToken`,configFile:`openclaw.json`,pathPattern:`channels.mattermost.botToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.matrix.accounts.*.password`,targetType:`channels.matrix.accounts.*.password`,configFile:`openclaw.json`,pathPattern:`channels.matrix.accounts.*.password`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.matrix.password`,targetType:`channels.matrix.password`,configFile:`openclaw.json`,pathPattern:`channels.matrix.password`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.msteams.appPassword`,targetType:`channels.msteams.appPassword`,configFile:`openclaw.json`,pathPattern:`channels.msteams.appPassword`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.nextcloud-talk.accounts.*.apiPassword`,targetType:`channels.nextcloud-talk.accounts.*.apiPassword`,configFile:`openclaw.json`,pathPattern:`channels.nextcloud-talk.accounts.*.apiPassword`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.nextcloud-talk.accounts.*.botSecret`,targetType:`channels.nextcloud-talk.accounts.*.botSecret`,configFile:`openclaw.json`,pathPattern:`channels.nextcloud-talk.accounts.*.botSecret`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.nextcloud-talk.apiPassword`,targetType:`channels.nextcloud-talk.apiPassword`,configFile:`openclaw.json`,pathPattern:`channels.nextcloud-talk.apiPassword`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.nextcloud-talk.botSecret`,targetType:`channels.nextcloud-talk.botSecret`,configFile:`openclaw.json`,pathPattern:`channels.nextcloud-talk.botSecret`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.slack.accounts.*.appToken`,targetType:`channels.slack.accounts.*.appToken`,configFile:`openclaw.json`,pathPattern:`channels.slack.accounts.*.appToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.slack.accounts.*.botToken`,targetType:`channels.slack.accounts.*.botToken`,configFile:`openclaw.json`,pathPattern:`channels.slack.accounts.*.botToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.slack.accounts.*.signingSecret`,targetType:`channels.slack.accounts.*.signingSecret`,configFile:`openclaw.json`,pathPattern:`channels.slack.accounts.*.signingSecret`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.slack.accounts.*.userToken`,targetType:`channels.slack.accounts.*.userToken`,configFile:`openclaw.json`,pathPattern:`channels.slack.accounts.*.userToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.slack.appToken`,targetType:`channels.slack.appToken`,configFile:`openclaw.json`,pathPattern:`channels.slack.appToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.slack.botToken`,targetType:`channels.slack.botToken`,configFile:`openclaw.json`,pathPattern:`channels.slack.botToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.slack.signingSecret`,targetType:`channels.slack.signingSecret`,configFile:`openclaw.json`,pathPattern:`channels.slack.signingSecret`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.slack.userToken`,targetType:`channels.slack.userToken`,configFile:`openclaw.json`,pathPattern:`channels.slack.userToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.telegram.accounts.*.botToken`,targetType:`channels.telegram.accounts.*.botToken`,configFile:`openclaw.json`,pathPattern:`channels.telegram.accounts.*.botToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.telegram.accounts.*.webhookSecret`,targetType:`channels.telegram.accounts.*.webhookSecret`,configFile:`openclaw.json`,pathPattern:`channels.telegram.accounts.*.webhookSecret`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.telegram.botToken`,targetType:`channels.telegram.botToken`,configFile:`openclaw.json`,pathPattern:`channels.telegram.botToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.telegram.webhookSecret`,targetType:`channels.telegram.webhookSecret`,configFile:`openclaw.json`,pathPattern:`channels.telegram.webhookSecret`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.zalo.accounts.*.botToken`,targetType:`channels.zalo.accounts.*.botToken`,configFile:`openclaw.json`,pathPattern:`channels.zalo.accounts.*.botToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.zalo.accounts.*.webhookSecret`,targetType:`channels.zalo.accounts.*.webhookSecret`,configFile:`openclaw.json`,pathPattern:`channels.zalo.accounts.*.webhookSecret`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.zalo.botToken`,targetType:`channels.zalo.botToken`,configFile:`openclaw.json`,pathPattern:`channels.zalo.botToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.zalo.webhookSecret`,targetType:`channels.zalo.webhookSecret`,configFile:`openclaw.json`,pathPattern:`channels.zalo.webhookSecret`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`cron.webhookToken`,targetType:`cron.webhookToken`,configFile:`openclaw.json`,pathPattern:`cron.webhookToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`gateway.auth.token`,targetType:`gateway.auth.token`,configFile:`openclaw.json`,pathPattern:`gateway.auth.token`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`gateway.auth.password`,targetType:`gateway.auth.password`,configFile:`openclaw.json`,pathPattern:`gateway.auth.password`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`gateway.remote.password`,targetType:`gateway.remote.password`,configFile:`openclaw.json`,pathPattern:`gateway.remote.password`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`gateway.remote.token`,targetType:`gateway.remote.token`,configFile:`openclaw.json`,pathPattern:`gateway.remote.token`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`messages.tts.elevenlabs.apiKey`,targetType:`messages.tts.elevenlabs.apiKey`,configFile:`openclaw.json`,pathPattern:`messages.tts.elevenlabs.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`messages.tts.openai.apiKey`,targetType:`messages.tts.openai.apiKey`,configFile:`openclaw.json`,pathPattern:`messages.tts.openai.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`models.providers.*.apiKey`,targetType:`models.providers.apiKey`,targetTypeAliases:[`models.providers.*.apiKey`],configFile:`openclaw.json`,pathPattern:`models.providers.*.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0,providerIdPathSegmentIndex:2,trackProviderShadowing:!0},{id:`models.providers.*.headers.*`,targetType:`models.providers.headers`,targetTypeAliases:[`models.providers.*.headers.*`],configFile:`openclaw.json`,pathPattern:`models.providers.*.headers.*`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0,providerIdPathSegmentIndex:2},{id:`skills.entries.*.apiKey`,targetType:`skills.entries.apiKey`,targetTypeAliases:[`skills.entries.*.apiKey`],configFile:`openclaw.json`,pathPattern:`skills.entries.*.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`talk.apiKey`,targetType:`talk.apiKey`,configFile:`openclaw.json`,pathPattern:`talk.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`talk.providers.*.apiKey`,targetType:`talk.providers.*.apiKey`,configFile:`openclaw.json`,pathPattern:`talk.providers.*.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`tools.web.fetch.firecrawl.apiKey`,targetType:`tools.web.fetch.firecrawl.apiKey`,configFile:`openclaw.json`,pathPattern:`tools.web.fetch.firecrawl.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`tools.web.search.apiKey`,targetType:`tools.web.search.apiKey`,configFile:`openclaw.json`,pathPattern:`tools.web.search.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`tools.web.search.gemini.apiKey`,targetType:`tools.web.search.gemini.apiKey`,configFile:`openclaw.json`,pathPattern:`tools.web.search.gemini.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`tools.web.search.grok.apiKey`,targetType:`tools.web.search.grok.apiKey`,configFile:`openclaw.json`,pathPattern:`tools.web.search.grok.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`tools.web.search.kimi.apiKey`,targetType:`tools.web.search.kimi.apiKey`,configFile:`openclaw.json`,pathPattern:`tools.web.search.kimi.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`tools.web.search.perplexity.apiKey`,targetType:`tools.web.search.perplexity.apiKey`,configFile:`openclaw.json`,pathPattern:`tools.web.search.perplexity.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0}];function S(e){return e.filter(e=>e.kind===`wildcard`||e.kind===`array`).length}function C(e){return a(e).map(t=>{if(t===`*`)return{kind:`wildcard`};if(t.endsWith(`[]`)){let n=t.slice(0,-2).trim();if(!n)throw Error(`Invalid target path pattern: ${e}`);return{kind:`array`,field:n}}return{kind:`literal`,value:t}})}function ne(e){let t=C(e.pathPattern),n=S(t),r=e.refPathPattern?C(e.refPathPattern):void 0,i=r?S(r):0;if(e.secretShape===`sibling_ref`&&!r)throw Error(`Missing refPathPattern for sibling_ref target: ${e.id}`);if(r&&i!==n)throw Error(`Mismatched wildcard shape for target ref path: ${e.id}`);return{...e,pathTokens:t,pathDynamicTokenCount:n,refPathTokens:r,refPathDynamicTokenCount:i}}function re(e,t){let n=[],r=0;for(let i of t){if(i.kind===`literal`){if(e[r]!==i.value)return null;r+=1;continue}if(i.kind===`wildcard`){let t=e[r];if(!t)return null;n.push(t),r+=1;continue}if(e[r]!==i.field)return null;let t=e[r+1];if(!t||!/^\d+$/.test(t))return null;n.push(t),r+=2}return r===e.length?{captures:n}:null}function ie(e,t){let n=[],r=0;for(let i of e){if(i.kind===`literal`){n.push(i.value);continue}if(i.kind===`wildcard`){let e=t[r];if(!e)return null;n.push(e),r+=1;continue}let e=t[r];if(!e||!/^\d+$/.test(e))return null;n.push(i.field,e),r+=1}return r===t.length?n:null}function ae(e,t){let n=[],i=(e,a,o,s)=>{let c=t[a];if(!c){n.push({segments:o,captures:s,value:e});return}let l=a===t.length-1;if(c.kind===`literal`){if(!r(e))return;if(l){n.push({segments:[...o,c.value],captures:s,value:e[c.value]});return}if(!Object.prototype.hasOwnProperty.call(e,c.value))return;i(e[c.value],a+1,[...o,c.value],s);return}if(c.kind===`wildcard`){if(!r(e))return;for(let[t,r]of Object.entries(e)){if(l){n.push({segments:[...o,t],captures:[...s,t],value:r});continue}i(r,a+1,[...o,t],[...s,t])}return}if(!r(e))return;let u=e[c.field];if(Array.isArray(u))for(let e=0;e<u.length;e+=1){let t=u[e],r=String(e);if(l){n.push({segments:[...o,c.field,r],captures:[...s,r],value:t});continue}i(t,a+1,[...o,c.field,r],[...s,r])}};return i(e,0,[],[]),n}const w=te.map(ne),oe=w.filter(e=>e.configFile===`openclaw.json`),se=w.filter(e=>e.configFile===`auth-profiles.json`);function ce(){let e=new Map,t=(t,n)=>{let r=e.get(t);if(r){r.push(n);return}e.set(t,[n])};for(let e of w){t(e.targetType,e);for(let n of e.targetTypeAliases??[])t(n,e)}return e}const le=ce(),ue=new Set(w.map(e=>e.id));function de(){let e=new Map;for(let t of oe){let n=e.get(t.id);if(n){n.push(t);continue}e.set(t.id,[t])}return e}const fe=de();function pe(){let e=new Map;for(let t of se){let n=e.get(t.id);if(n){n.push(t);continue}e.set(t.id,[t])}return e}const me=pe();function T(e){return e===void 0?null:new Set(Array.from(e).map(e=>e.trim()).filter(e=>e.length>0))}function E(e){return e.allowedTargetIds===null?e.defaultEntries:Array.from(e.allowedTargetIds).flatMap(t=>e.entriesById.get(t)??[])}function D(e,t){let n=[],r=new Set;for(let i of t){let t=ae(e,i.pathTokens);for(let a of t){let t=O(i,a.segments,a.captures);if(!t)continue;let o=`${i.id}:${t.pathSegments.join(`.`)}`;if(r.has(o))continue;r.add(o);let s=t.refPathSegments?m(e,t.refPathSegments):void 0;n.push({entry:i,path:t.pathSegments.join(`.`),pathSegments:t.pathSegments,...t.refPathSegments?{refPathSegments:t.refPathSegments,refPath:t.refPathSegments.join(`.`)}:{},value:a.value,...t.providerId?{providerId:t.providerId}:{},...t.accountId?{accountId:t.accountId}:{},...t.refPathSegments?{refValue:s}:{}})}}return n}function O(e,t,n){let r=e.providerIdPathSegmentIndex===void 0?void 0:t[e.providerIdPathSegmentIndex],i=e.accountIdPathSegmentIndex===void 0?void 0:t[e.accountIdPathSegmentIndex],a=e.refPathTokens?ie(e.refPathTokens,n):void 0;return e.refPathTokens&&!a?null:{entry:e,pathSegments:t,...a?{refPathSegments:a}:{},...r?{providerId:r}:{},...i?{accountId:i}:{}}}function he(){return w.map(e=>({id:e.id,targetType:e.targetType,...e.targetTypeAliases?{targetTypeAliases:[...e.targetTypeAliases]}:{},configFile:e.configFile,pathPattern:e.pathPattern,...e.refPathPattern?{refPathPattern:e.refPathPattern}:{},secretShape:e.secretShape,expectedResolvedValue:e.expectedResolvedValue,includeInPlan:e.includeInPlan,includeInConfigure:e.includeInConfigure,includeInAudit:e.includeInAudit,...e.providerIdPathSegmentIndex===void 0?{}:{providerIdPathSegmentIndex:e.providerIdPathSegmentIndex},...e.accountIdPathSegmentIndex===void 0?{}:{accountIdPathSegmentIndex:e.accountIdPathSegmentIndex},...e.authProfileType?{authProfileType:e.authProfileType}:{},...e.trackProviderShadowing?{trackProviderShadowing:!0}:{}}))}function ge(e){return typeof e==`string`&&le.has(e)}function _e(e){return typeof e==`string`&&ue.has(e)}function ve(e){let t=le.get(e.type);if(!t||t.length===0)return null;for(let n of t){if(!n.includeInPlan)continue;let t=re(e.pathSegments,n.pathTokens);if(!t)continue;let r=O(n,e.pathSegments,t.captures);if(r&&!(e.providerId&&e.providerId.trim().length>0&&(!r.providerId||r.providerId!==e.providerId))&&!(e.accountId&&e.accountId.trim().length>0&&(!r.accountId||r.accountId!==e.accountId)))return r}return null}function ye(e){return k(e)}function k(e,t){return D(e,E({allowedTargetIds:T(t),defaultEntries:oe,entriesById:fe}))}function be(e){return xe(e)}function xe(e,t){return D(e,E({allowedTargetIds:T(t),defaultEntries:se,entriesById:me}))}function Se(){return w.filter(e=>e.configFile===`auth-profiles.json`&&e.includeInAudit)}function A(e){let t=e.sourceConfig.secrets?.defaults,n=[],r=[],i=[],a=[];for(let c of k(e.sourceConfig,e.targetIds)){if(e.allowedPaths&&!e.allowedPaths.has(c.path))continue;let{explicitRef:l,ref:u}=o({value:c.value,refValue:c.refValue,defaults:t}),d=l?s(c.value,t):null;if(!u)continue;let f=m(e.resolvedConfig,c.pathSegments);if(!v(f,c.entry.expectedResolvedValue)){if(e.inactiveRefPaths?.has(c.path)){r.push(`${c.path}: secret ref is configured on an inactive surface; skipping command-time assignment.`),a.push({path:c.path,pathSegments:[...c.pathSegments]});continue}i.push({path:c.path,pathSegments:[...c.pathSegments]});continue}n.push({path:c.path,pathSegments:[...c.pathSegments],value:f}),c.entry.secretShape===`sibling_ref`&&l&&d&&r.push(`${c.path}: both inline and sibling ref were present; sibling ref took precedence.`)}return{assignments:n,diagnostics:r,unresolved:i,inactive:a}}function Ce(e){let t=A({sourceConfig:e.sourceConfig,resolvedConfig:e.resolvedConfig,targetIds:e.targetIds,inactiveRefPaths:e.inactiveRefPaths,allowedPaths:e.allowedPaths});if(t.unresolved.length>0)throw Error(`${e.commandName}: ${t.unresolved[0]?.path??`target`} is unresolved in the active runtime snapshot.`);return{assignments:t.assignments,diagnostics:t.diagnostics}}function we(e){return{sourceConfig:e.sourceConfig,env:e.env,cache:{},warnings:[],warningKeys:new Set,assignments:[]}}function j(e,t){e.assignments.push(t)}function M(e,t){let n=`${t.code}:${t.path}:${t.message}`;e.warningKeys.has(n)||(e.warningKeys.add(n),e.warnings.push(t))}function N(e){M(e.context,{code:`SECRETS_REF_IGNORED_INACTIVE_SURFACE`,path:e.path,message:e.details&&e.details.trim().length>0?`${e.path}: ${e.details}`:`${e.path}: secret ref is configured on an inactive surface; skipping resolution until it becomes active.`})}function P(e){let t=s(e.value,e.defaults);if(t){if(e.active===!1){N({context:e.context,path:e.path,details:e.inactiveReason});return}j(e.context,{ref:t,path:e.path,expected:e.expected,apply:e.apply})}}function Te(e){for(let t of e.assignments){let n=c(t.ref);if(!e.resolved.has(n))throw Error(`Secret reference "${n}" resolved to no value.`);let r=e.resolved.get(n);y({value:r,expected:t.expected,errorMessage:t.expected===`string`?`${t.path} resolved to a non-string or empty value.`:`${t.path} resolved to an unsupported value type.`}),t.apply(r)}}function F(e,t){return Object.prototype.hasOwnProperty.call(e,t)}function I(e){return r(e)?e.enabled!==!1:!0}function Ee(e,t){return I(e)&&I(t)}function L(e){let t=e.tts.elevenlabs;r(t)&&P({value:t.apiKey,path:`${e.pathPrefix}.elevenlabs.apiKey`,expected:`string`,defaults:e.defaults,context:e.context,active:e.active,inactiveReason:e.inactiveReason,apply:e=>{t.apiKey=e}});let n=e.tts.openai;r(n)&&P({value:n.apiKey,path:`${e.pathPrefix}.openai.apiKey`,expected:`string`,defaults:e.defaults,context:e.context,active:e.active,inactiveReason:e.inactiveReason,apply:e=>{n.apiKey=e}})}function R(e){let t=I(e),n=e.accounts;if(!r(n)||Object.keys(n).length===0)return{hasExplicitAccounts:!1,channelEnabled:t,accounts:[{accountId:`default`,account:e,enabled:t}]};let i=[];for(let[t,a]of Object.entries(n))r(a)&&i.push({accountId:t,account:a,enabled:Ee(e,a)});return{hasExplicitAccounts:!0,channelEnabled:t,accounts:i}}function z(e,t){return e.channelEnabled?e.hasExplicitAccounts?e.accounts.some(({account:e,enabled:n})=>n&&!F(e,t)):!0:!1}function B(e){return typeof e==`string`?e.trim():``}function V(e,t){return B(e).length>0||s(e,t)!==null}function H(e){if(P({value:e.channel[e.field],path:`channels.${e.channelKey}.${e.field}`,expected:`string`,defaults:e.defaults,context:e.context,active:z(e.surface,e.field),inactiveReason:e.topInactiveReason,apply:t=>{e.channel[e.field]=t}}),e.surface.hasExplicitAccounts)for(let{accountId:t,account:n,enabled:r}of e.surface.accounts)F(n,e.field)&&P({value:n[e.field],path:`channels.${e.channelKey}.accounts.${t}.${e.field}`,expected:`string`,defaults:e.defaults,context:e.context,active:r,inactiveReason:e.accountInactiveReason,apply:t=>{n[e.field]=t}})}function De(e){let t=e.config.channels;if(!r(t))return;let n=t.telegram;if(!r(n))return;let i=R(n),a=typeof n.tokenFile==`string`?n.tokenFile.trim():``,o=i.channelEnabled?i.hasExplicitAccounts?i.accounts.some(({account:t,enabled:n})=>{if(!n||a.length>0)return!1;let r=V(t.botToken,e.defaults),i=typeof t.tokenFile==`string`&&t.tokenFile.trim().length>0;return!r&&!i}):a.length===0:!1;if(P({value:n.botToken,path:`channels.telegram.botToken`,expected:`string`,defaults:e.defaults,context:e.context,active:o,inactiveReason:`no enabled Telegram surface inherits this top-level botToken (tokenFile is configured).`,apply:e=>{n.botToken=e}}),i.hasExplicitAccounts)for(let{accountId:t,account:n,enabled:r}of i.accounts){if(!F(n,`botToken`))continue;let i=typeof n.tokenFile==`string`?n.tokenFile.trim():``;P({value:n.botToken,path:`channels.telegram.accounts.${t}.botToken`,expected:`string`,defaults:e.defaults,context:e.context,active:r&&i.length===0,inactiveReason:`Telegram account is disabled or tokenFile is configured.`,apply:e=>{n.botToken=e}})}let s=typeof n.webhookUrl==`string`?n.webhookUrl.trim():``,c=i.channelEnabled?i.hasExplicitAccounts?i.accounts.some(({account:e,enabled:t})=>t&&!F(e,`webhookSecret`)&&(F(e,`webhookUrl`)?typeof e.webhookUrl==`string`&&e.webhookUrl.trim().length>0:s.length>0)):s.length>0:!1;if(P({value:n.webhookSecret,path:`channels.telegram.webhookSecret`,expected:`string`,defaults:e.defaults,context:e.context,active:c,inactiveReason:`no enabled Telegram webhook surface inherits this top-level webhookSecret (webhook mode is not active).`,apply:e=>{n.webhookSecret=e}}),i.hasExplicitAccounts)for(let{accountId:t,account:n,enabled:r}of i.accounts){if(!F(n,`webhookSecret`))continue;let i=F(n,`webhookUrl`)?typeof n.webhookUrl==`string`?n.webhookUrl.trim():``:s;P({value:n.webhookSecret,path:`channels.telegram.accounts.${t}.webhookSecret`,expected:`string`,defaults:e.defaults,context:e.context,active:r&&i.length>0,inactiveReason:`Telegram account is disabled or webhook mode is not active for this account.`,apply:e=>{n.webhookSecret=e}})}}function Oe(e){let t=e.config.channels;if(!r(t))return;let n=t.slack;if(!r(n))return;let i=R(n),a=n.mode===`http`||n.mode===`socket`?n.mode:`socket`;for(let t of[`botToken`,`userToken`])H({channelKey:`slack`,field:t,channel:n,surface:i,defaults:e.defaults,context:e.context,topInactiveReason:`no enabled account inherits this top-level Slack ${t}.`,accountInactiveReason:`Slack account is disabled.`});let o=i.channelEnabled?i.hasExplicitAccounts?i.accounts.some(({account:e,enabled:t})=>!t||F(e,`appToken`)?!1:(e.mode===`http`||e.mode===`socket`?e.mode:a)!==`http`):a!==`http`:!1;P({value:n.appToken,path:`channels.slack.appToken`,expected:`string`,defaults:e.defaults,context:e.context,active:o,inactiveReason:`no enabled Slack socket-mode surface inherits this top-level appToken.`,apply:e=>{n.appToken=e}});let s=i.channelEnabled?i.hasExplicitAccounts?i.accounts.some(({account:e,enabled:t})=>!t||F(e,`signingSecret`)?!1:(e.mode===`http`||e.mode===`socket`?e.mode:a)===`http`):a===`http`:!1;if(P({value:n.signingSecret,path:`channels.slack.signingSecret`,expected:`string`,defaults:e.defaults,context:e.context,active:s,inactiveReason:`no enabled Slack HTTP-mode surface inherits this top-level signingSecret.`,apply:e=>{n.signingSecret=e}}),i.hasExplicitAccounts)for(let{accountId:t,account:n,enabled:r}of i.accounts){let i=n.mode===`http`||n.mode===`socket`?n.mode:a;F(n,`appToken`)&&P({value:n.appToken,path:`channels.slack.accounts.${t}.appToken`,expected:`string`,defaults:e.defaults,context:e.context,active:r&&i!==`http`,inactiveReason:`Slack account is disabled or not running in socket mode.`,apply:e=>{n.appToken=e}}),F(n,`signingSecret`)&&P({value:n.signingSecret,path:`channels.slack.accounts.${t}.signingSecret`,expected:`string`,defaults:e.defaults,context:e.context,active:r&&i===`http`,inactiveReason:`Slack account is disabled or not running in HTTP mode.`,apply:e=>{n.signingSecret=e}})}}function ke(e){let t=e.config.channels;if(!r(t))return;let n=t.discord;if(!r(n))return;let i=R(n);if(H({channelKey:`discord`,field:`token`,channel:n,surface:i,defaults:e.defaults,context:e.context,topInactiveReason:`no enabled account inherits this top-level Discord token.`,accountInactiveReason:`Discord account is disabled.`}),r(n.pluralkit)){let t=n.pluralkit;P({value:t.token,path:`channels.discord.pluralkit.token`,expected:`string`,defaults:e.defaults,context:e.context,active:z(i,`pluralkit`)&&I(t),inactiveReason:`no enabled Discord surface inherits this top-level PluralKit config or PluralKit is disabled.`,apply:e=>{t.token=e}})}if(r(n.voice)&&r(n.voice.tts)&&L({tts:n.voice.tts,pathPrefix:`channels.discord.voice.tts`,defaults:e.defaults,context:e.context,active:z(i,`voice`)&&I(n.voice),inactiveReason:`no enabled Discord surface inherits this top-level voice config or voice is disabled.`}),i.hasExplicitAccounts)for(let{accountId:t,account:n,enabled:a}of i.accounts){if(F(n,`pluralkit`)&&r(n.pluralkit)){let r=n.pluralkit;P({value:r.token,path:`channels.discord.accounts.${t}.pluralkit.token`,expected:`string`,defaults:e.defaults,context:e.context,active:a&&I(r),inactiveReason:`Discord account is disabled or PluralKit is disabled for this account.`,apply:e=>{r.token=e}})}F(n,`voice`)&&r(n.voice)&&r(n.voice.tts)&&L({tts:n.voice.tts,pathPrefix:`channels.discord.accounts.${t}.voice.tts`,defaults:e.defaults,context:e.context,active:a&&I(n.voice),inactiveReason:`Discord account is disabled or voice is disabled for this account.`})}}function Ae(e){let t=e.config.channels;if(!r(t))return;let n=t.irc;if(!r(n))return;let i=R(n);if(H({channelKey:`irc`,field:`password`,channel:n,surface:i,defaults:e.defaults,context:e.context,topInactiveReason:`no enabled account inherits this top-level IRC password.`,accountInactiveReason:`IRC account is disabled.`}),r(n.nickserv)){let t=n.nickserv;P({value:t.password,path:`channels.irc.nickserv.password`,expected:`string`,defaults:e.defaults,context:e.context,active:z(i,`nickserv`)&&I(t),inactiveReason:`no enabled account inherits this top-level IRC nickserv config or NickServ is disabled.`,apply:e=>{t.password=e}})}if(i.hasExplicitAccounts){for(let{accountId:t,account:n,enabled:a}of i.accounts)if(F(n,`nickserv`)&&r(n.nickserv)){let r=n.nickserv;P({value:r.password,path:`channels.irc.accounts.${t}.nickserv.password`,expected:`string`,defaults:e.defaults,context:e.context,active:a&&I(r),inactiveReason:`IRC account is disabled or NickServ is disabled for this account.`,apply:e=>{r.password=e}})}}}function je(e){let t=e.config.channels;if(!r(t))return;let n=t.bluebubbles;r(n)&&H({channelKey:`bluebubbles`,field:`password`,channel:n,surface:R(n),defaults:e.defaults,context:e.context,topInactiveReason:`no enabled account inherits this top-level BlueBubbles password.`,accountInactiveReason:`BlueBubbles account is disabled.`})}function Me(e){let t=e.config.channels;if(!r(t))return;let n=t.msteams;r(n)&&P({value:n.appPassword,path:`channels.msteams.appPassword`,expected:`string`,defaults:e.defaults,context:e.context,active:n.enabled!==!1,inactiveReason:`Microsoft Teams channel is disabled.`,apply:e=>{n.appPassword=e}})}function Ne(e){let t=e.config.channels;if(!r(t))return;let n=t.mattermost;r(n)&&H({channelKey:`mattermost`,field:`botToken`,channel:n,surface:R(n),defaults:e.defaults,context:e.context,topInactiveReason:`no enabled account inherits this top-level Mattermost botToken.`,accountInactiveReason:`Mattermost account is disabled.`})}function Pe(e){let t=e.config.channels;if(!r(t))return;let n=t.matrix;if(!r(n))return;let i=R(n),a=B(e.context.env.MATRIX_ACCESS_TOKEN).length>0,o=V(n.accessToken,e.defaults),s=i.channelEnabled?i.hasExplicitAccounts?i.accounts.some(({account:t,enabled:n})=>n&&!F(t,`password`)&&!V(t.accessToken,e.defaults)&&!(o||a)):!(o||a):!1;if(P({value:n.password,path:`channels.matrix.password`,expected:`string`,defaults:e.defaults,context:e.context,active:s,inactiveReason:`no enabled Matrix surface inherits this top-level password (an accessToken is configured).`,apply:e=>{n.password=e}}),i.hasExplicitAccounts)for(let{accountId:t,account:n,enabled:r}of i.accounts){if(!F(n,`password`))continue;let i=V(n.accessToken,e.defaults),s=!F(n,`accessToken`)&&(o||a);P({value:n.password,path:`channels.matrix.accounts.${t}.password`,expected:`string`,defaults:e.defaults,context:e.context,active:r&&!(i||s),inactiveReason:`Matrix account is disabled or an accessToken is configured.`,apply:e=>{n.password=e}})}}function Fe(e){let t=e.config.channels;if(!r(t))return;let n=t.zalo;if(!r(n))return;let i=R(n),a=i.channelEnabled?i.hasExplicitAccounts?i.accounts.some(({account:e,enabled:t})=>t&&!F(e,`botToken`)):!0:!1;P({value:n.botToken,path:`channels.zalo.botToken`,expected:`string`,defaults:e.defaults,context:e.context,active:a,inactiveReason:`no enabled Zalo surface inherits this top-level botToken.`,apply:e=>{n.botToken=e}});let o=B(n.webhookUrl),s=i.channelEnabled?i.hasExplicitAccounts?i.accounts.some(({account:e,enabled:t})=>!t||F(e,`webhookSecret`)?!1:(F(e,`webhookUrl`)?B(e.webhookUrl):o).length>0):o.length>0:!1;if(P({value:n.webhookSecret,path:`channels.zalo.webhookSecret`,expected:`string`,defaults:e.defaults,context:e.context,active:s,inactiveReason:`no enabled Zalo webhook surface inherits this top-level webhookSecret (webhook mode is not active).`,apply:e=>{n.webhookSecret=e}}),i.hasExplicitAccounts){for(let{accountId:t,account:n,enabled:r}of i.accounts)if(F(n,`botToken`)&&P({value:n.botToken,path:`channels.zalo.accounts.${t}.botToken`,expected:`string`,defaults:e.defaults,context:e.context,active:r,inactiveReason:`Zalo account is disabled.`,apply:e=>{n.botToken=e}}),F(n,`webhookSecret`)){let i=F(n,`webhookUrl`)?B(n.webhookUrl):o;P({value:n.webhookSecret,path:`channels.zalo.accounts.${t}.webhookSecret`,expected:`string`,defaults:e.defaults,context:e.context,active:r&&i.length>0,inactiveReason:`Zalo account is disabled or webhook mode is not active for this account.`,apply:e=>{n.webhookSecret=e}})}}}function Ie(e){let t=e.config.channels;if(!r(t))return;let n=t.feishu;if(!r(n))return;let i=R(n);H({channelKey:`feishu`,field:`appSecret`,channel:n,surface:i,defaults:e.defaults,context:e.context,topInactiveReason:`no enabled account inherits this top-level Feishu appSecret.`,accountInactiveReason:`Feishu account is disabled.`});let a=B(n.connectionMode)===`webhook`?`webhook`:`websocket`,o=i.channelEnabled?i.hasExplicitAccounts?i.accounts.some(({account:e,enabled:t})=>!t||F(e,`verificationToken`)?!1:(F(e,`connectionMode`)?B(e.connectionMode):a)===`webhook`):a===`webhook`:!1;if(P({value:n.verificationToken,path:`channels.feishu.verificationToken`,expected:`string`,defaults:e.defaults,context:e.context,active:o,inactiveReason:`no enabled Feishu webhook-mode surface inherits this top-level verificationToken.`,apply:e=>{n.verificationToken=e}}),i.hasExplicitAccounts)for(let{accountId:t,account:n,enabled:r}of i.accounts){if(!F(n,`verificationToken`))continue;let i=F(n,`connectionMode`)?B(n.connectionMode):a;P({value:n.verificationToken,path:`channels.feishu.accounts.${t}.verificationToken`,expected:`string`,defaults:e.defaults,context:e.context,active:r&&i===`webhook`,inactiveReason:`Feishu account is disabled or not running in webhook mode.`,apply:e=>{n.verificationToken=e}})}}function Le(e){let t=e.config.channels;if(!r(t))return;let n=t[`nextcloud-talk`];if(!r(n))return;let i=R(n),a=i.channelEnabled?i.hasExplicitAccounts?i.accounts.some(({account:e,enabled:t})=>t&&!F(e,`botSecret`)):!0:!1;P({value:n.botSecret,path:`channels.nextcloud-talk.botSecret`,expected:`string`,defaults:e.defaults,context:e.context,active:a,inactiveReason:`no enabled Nextcloud Talk surface inherits this top-level botSecret.`,apply:e=>{n.botSecret=e}});let o=i.channelEnabled?i.hasExplicitAccounts?i.accounts.some(({account:e,enabled:t})=>t&&!F(e,`apiPassword`)):!0:!1;if(P({value:n.apiPassword,path:`channels.nextcloud-talk.apiPassword`,expected:`string`,defaults:e.defaults,context:e.context,active:o,inactiveReason:`no enabled Nextcloud Talk surface inherits this top-level apiPassword.`,apply:e=>{n.apiPassword=e}}),i.hasExplicitAccounts)for(let{accountId:t,account:n,enabled:r}of i.accounts)F(n,`botSecret`)&&P({value:n.botSecret,path:`channels.nextcloud-talk.accounts.${t}.botSecret`,expected:`string`,defaults:e.defaults,context:e.context,active:r,inactiveReason:`Nextcloud Talk account is disabled.`,apply:e=>{n.botSecret=e}}),F(n,`apiPassword`)&&P({value:n.apiPassword,path:`channels.nextcloud-talk.accounts.${t}.apiPassword`,expected:`string`,defaults:e.defaults,context:e.context,active:r,inactiveReason:`Nextcloud Talk account is disabled.`,apply:e=>{n.apiPassword=e}})}function U(e){let{explicitRef:t,ref:n}=o({value:e.target.serviceAccount,refValue:e.target.serviceAccountRef,defaults:e.defaults});if(n){if(e.active===!1){N({context:e.context,path:`${e.path}.serviceAccount`,details:e.inactiveReason});return}t&&e.target.serviceAccount!==void 0&&!s(e.target.serviceAccount,e.defaults)&&M(e.context,{code:`SECRETS_REF_OVERRIDES_PLAINTEXT`,path:e.path,message:`${e.path}: serviceAccountRef is set; runtime will ignore plaintext serviceAccount.`}),j(e.context,{ref:n,path:`${e.path}.serviceAccount`,expected:`string-or-object`,apply:t=>{e.target.serviceAccount=t}})}}function Re(e){let t=e.googleChat,n=R(t),r=n.channelEnabled?n.hasExplicitAccounts?n.accounts.some(({account:e,enabled:t})=>t&&!F(e,`serviceAccount`)&&!F(e,`serviceAccountRef`)):!0:!1;if(U({target:e.googleChat,path:`channels.googlechat`,defaults:e.defaults,context:e.context,active:r,inactiveReason:`no enabled account inherits this top-level Google Chat serviceAccount.`}),n.hasExplicitAccounts)for(let{accountId:t,account:r,enabled:i}of n.accounts)!F(r,`serviceAccount`)&&!F(r,`serviceAccountRef`)||U({target:r,path:`channels.googlechat.accounts.${t}`,defaults:e.defaults,context:e.context,active:i,inactiveReason:`Google Chat account is disabled.`})}function ze(e){let t=e.config.channels?.googlechat;t&&Re({googleChat:t,defaults:e.defaults,context:e.context}),De(e),Oe(e),ke(e),Ae(e),je(e),Ne(e),Pe(e),Me(e),Le(e),Ie(e),Fe(e)}const Be=[`gateway.auth.token`,`gateway.auth.password`,`gateway.remote.token`,`gateway.remote.password`];function Ve(e){return e??`unset`}function He(e){let t=[];return e.remoteMode&&t.push(`gateway.mode is "remote"`),e.remoteUrlConfigured&&t.push(`gateway.remote.url is configured`),e.tailscaleRemoteExposure&&t.push(`gateway.tailscale.mode is "serve" or "funnel"`),t.join(`; `)}function W(e){return{path:e.path,active:e.active,reason:e.reason,hasSecretRef:e.hasSecretRef}}function Ue(t){let n=t.config.gateway;if(!r(n))return{"gateway.auth.token":W({path:`gateway.auth.token`,active:!1,reason:`gateway configuration is not set.`,hasSecretRef:!1}),"gateway.auth.password":W({path:`gateway.auth.password`,active:!1,reason:`gateway configuration is not set.`,hasSecretRef:!1}),"gateway.remote.token":W({path:`gateway.remote.token`,active:!1,reason:`gateway configuration is not set.`,hasSecretRef:!1}),"gateway.remote.password":W({path:`gateway.remote.password`,active:!1,reason:`gateway configuration is not set.`,hasSecretRef:!1})};let i=r(n?.auth)?n.auth:void 0,a=r(n?.remote)?n.remote:void 0,o=e({config:t.config,env:t.env,includeLegacyEnv:!0,defaults:t.defaults}),s=i?o.passwordCanWin?o.authMode===`password`?`gateway.auth.mode is "password".`:`no token source can win, so password auth can win.`:o.authMode===`token`||o.authMode===`none`||o.authMode===`trusted-proxy`?`gateway.auth.mode is "${o.authMode}".`:o.envToken?`gateway token env var is configured.`:o.localToken.configured?`gateway.auth.token is configured.`:o.remoteToken.configured?`gateway.remote.token is configured.`:`token auth can win.`:`gateway.auth is not configured.`,c=i?o.authMode===`token`?o.envToken?`gateway token env var is configured.`:`gateway.auth.mode is "token".`:o.authMode===`password`||o.authMode===`none`||o.authMode===`trusted-proxy`?`gateway.auth.mode is "${o.authMode}".`:o.envToken?`gateway token env var is configured.`:o.envPassword?`gateway password env var is configured.`:o.localPassword.configured?`gateway.auth.password is configured.`:`token auth can win (mode is unset and no password source is configured).`:`gateway.auth is not configured.`,l=He({remoteMode:o.remoteMode,remoteUrlConfigured:o.remoteUrlConfigured,tailscaleRemoteExposure:o.tailscaleRemoteExposure}),u=a?o.remoteConfiguredSurface?`remote surface is active: ${l}.`:o.remoteTokenFallbackActive?`local token auth can win and no env/auth token is configured.`:o.localTokenCanWin?o.envToken?`gateway token env var is configured.`:o.localToken.configured?`gateway.auth.token is configured.`:`remote token fallback is not active.`:`token auth cannot win with gateway.auth.mode="${Ve(o.authMode)}".`:`gateway.remote is not configured.`,d=a?o.remoteConfiguredSurface?`remote surface is active: ${l}.`:o.remotePasswordFallbackActive?`password auth can win and no env/auth password is configured.`:o.passwordCanWin?o.envPassword?`gateway password env var is configured.`:o.localPassword.configured?`gateway.auth.password is configured.`:`remote password fallback is not active.`:o.authMode===`token`||o.authMode===`none`||o.authMode===`trusted-proxy`?`password auth cannot win with gateway.auth.mode="${o.authMode}".`:`a token source can win, so password auth cannot win.`:`gateway.remote is not configured.`;return{"gateway.auth.token":W({path:`gateway.auth.token`,active:o.localTokenSurfaceActive,reason:c,hasSecretRef:o.localToken.hasSecretRef}),"gateway.auth.password":W({path:`gateway.auth.password`,active:o.passwordCanWin,reason:s,hasSecretRef:o.localPassword.hasSecretRef}),"gateway.remote.token":W({path:`gateway.remote.token`,active:o.remoteTokenActive,reason:u,hasSecretRef:o.remoteToken.hasSecretRef}),"gateway.remote.password":W({path:`gateway.remote.password`,active:o.remotePasswordActive,reason:d,hasSecretRef:o.remotePassword.hasSecretRef})}}function We(e){for(let[t,n]of Object.entries(e.providers)){let i=n.enabled!==!1;P({value:n.apiKey,path:`models.providers.${t}.apiKey`,expected:`string`,defaults:e.defaults,context:e.context,active:i,inactiveReason:`provider is disabled.`,apply:e=>{n.apiKey=e}});let a=r(n.headers)?n.headers:void 0;if(a)for(let[n,r]of Object.entries(a))P({value:r,path:`models.providers.${t}.headers.${n}`,expected:`string`,defaults:e.defaults,context:e.context,active:i,inactiveReason:`provider is disabled.`,apply:e=>{a[n]=e}})}}function Ge(e){for(let[t,n]of Object.entries(e.entries))P({value:n.apiKey,path:`skills.entries.${t}.apiKey`,expected:`string`,defaults:e.defaults,context:e.context,active:n.enabled!==!1,inactiveReason:`skill entry is disabled.`,apply:e=>{n.apiKey=e}})}function Ke(e){let t=e.config.agents;if(!r(t))return;let n=r(t.defaults)?t.defaults:void 0,i=r(n?.memorySearch)?n.memorySearch:void 0,a=i?.enabled!==!1,o=Array.isArray(t.list)?t.list:[],s=!1;for(let e of o){if(!r(e)||e.enabled===!1)continue;let t=r(e.memorySearch)?e.memorySearch:void 0;if(t?.enabled===!1)continue;if(!t||!Object.prototype.hasOwnProperty.call(t,`remote`)){s=!0;continue}let n=r(t.remote)?t.remote:void 0;if(!n||!Object.prototype.hasOwnProperty.call(n,`apiKey`)){s=!0;continue}}if(i&&r(i.remote)){let t=i.remote;P({value:t.apiKey,path:`agents.defaults.memorySearch.remote.apiKey`,expected:`string`,defaults:e.defaults,context:e.context,active:a&&(s||o.length===0),inactiveReason:s?void 0:`all enabled agents override memorySearch.remote.apiKey.`,apply:e=>{t.apiKey=e}})}o.forEach((t,n)=>{if(!r(t))return;let i=r(t.memorySearch)?t.memorySearch:void 0;if(!i)return;let a=r(i.remote)?i.remote:void 0;if(!a||!Object.prototype.hasOwnProperty.call(a,`apiKey`))return;let o=t.enabled!==!1&&i.enabled!==!1;P({value:a.apiKey,path:`agents.list.${n}.memorySearch.remote.apiKey`,expected:`string`,defaults:e.defaults,context:e.context,active:o,inactiveReason:`agent or memorySearch override is disabled.`,apply:e=>{a.apiKey=e}})})}function qe(e){let t=e.config.talk;if(!r(t))return;P({value:t.apiKey,path:`talk.apiKey`,expected:`string`,defaults:e.defaults,context:e.context,apply:e=>{t.apiKey=e}});let n=t.providers;if(r(n))for(let[t,i]of Object.entries(n))r(i)&&P({value:i.apiKey,path:`talk.providers.${t}.apiKey`,expected:`string`,defaults:e.defaults,context:e.context,apply:e=>{i.apiKey=e}})}function Je(e){let t=e.config.gateway;if(!r(t))return;let n=r(t.auth)?t.auth:void 0,i=r(t.remote)?t.remote:void 0,a=Ue({config:e.config,env:e.context.env,defaults:e.defaults});n&&(P({value:n.token,path:`gateway.auth.token`,expected:`string`,defaults:e.defaults,context:e.context,active:a[`gateway.auth.token`].active,inactiveReason:a[`gateway.auth.token`].reason,apply:e=>{n.token=e}}),P({value:n.password,path:`gateway.auth.password`,expected:`string`,defaults:e.defaults,context:e.context,active:a[`gateway.auth.password`].active,inactiveReason:a[`gateway.auth.password`].reason,apply:e=>{n.password=e}})),i&&(P({value:i.token,path:`gateway.remote.token`,expected:`string`,defaults:e.defaults,context:e.context,active:a[`gateway.remote.token`].active,inactiveReason:a[`gateway.remote.token`].reason,apply:e=>{i.token=e}}),P({value:i.password,path:`gateway.remote.password`,expected:`string`,defaults:e.defaults,context:e.context,active:a[`gateway.remote.password`].active,inactiveReason:a[`gateway.remote.password`].reason,apply:e=>{i.password=e}}))}function Ye(e){let t=e.config.messages;!r(t)||!r(t.tts)||L({tts:t.tts,pathPrefix:`messages.tts`,defaults:e.defaults,context:e.context})}function Xe(e){let t=e.config.cron;r(t)&&P({value:t.webhookToken,path:`cron.webhookToken`,expected:`string`,defaults:e.defaults,context:e.context,apply:e=>{t.webhookToken=e}})}function Ze(e){let t=e.config.models?.providers;t&&We({providers:t,defaults:e.defaults,context:e.context});let n=e.config.skills?.entries;n&&Ge({entries:n,defaults:e.defaults,context:e.context}),Ke(e),qe(e),Je(e),Ye(e),Xe(e)}function Qe(e){let t=e.context.sourceConfig.secrets?.defaults;Ze({config:e.config,defaults:t,context:e.context}),ze({config:e.config,defaults:t,context:e.context})}const G=[`brave`,`gemini`,`grok`,`kimi`,`perplexity`],$e=`https://api.perplexity.ai`,K=`https://openrouter.ai/api/v1`,et=[`pplx-`],tt=[`sk-or-`];function q(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}function nt(e){if(typeof e!=`string`)return;let t=e.trim().toLowerCase();if(t===`brave`||t===`gemini`||t===`grok`||t===`kimi`||t===`perplexity`)return t}function J(e,n){for(let r of n){let n=t(e[r]);if(n)return{value:n,envVar:r}}return{}}function Y(e){return e.kind===`non-string`?`${e.path} SecretRef resolved to a non-string value.`:e.kind===`empty`?`${e.path} SecretRef resolved to an empty value.`:`${e.path} SecretRef is unresolved (${e.refLabel}).`}async function rt(e){let{ref:n}=o({value:e.value,defaults:e.defaults});if(!n){let n=t(e.value);if(n)return{value:n,source:`config`,secretRefConfigured:!1,fallbackUsedAfterRefFailure:!1};let r=J(e.context.env,e.envVars);return r.value?{value:r.value,source:`env`,fallbackEnvVar:r.envVar,secretRefConfigured:!1,fallbackUsedAfterRefFailure:!1}:{source:`missing`,secretRefConfigured:!1,fallbackUsedAfterRefFailure:!1}}let r=`${n.source}:${n.provider}:${n.id}`,a,s;try{let o=(await i([n],{config:e.sourceConfig,env:e.context.env,cache:e.context.cache})).get(c(n));typeof o==`string`?(a=t(o),a||(s=Y({path:e.path,kind:`empty`,refLabel:r}))):s=Y({path:e.path,kind:`non-string`,refLabel:r})}catch{s=Y({path:e.path,kind:`unresolved`,refLabel:r})}if(a)return{value:a,source:`secretRef`,secretRefConfigured:!0,fallbackUsedAfterRefFailure:!1};let l=J(e.context.env,e.envVars);return l.value?{value:l.value,source:`env`,fallbackEnvVar:l.envVar,unresolvedRefReason:s,secretRefConfigured:!0,fallbackUsedAfterRefFailure:!0}:{source:`missing`,unresolvedRefReason:s,secretRefConfigured:!0,fallbackUsedAfterRefFailure:!1}}function it(e){if(!e)return;let t=e.toLowerCase();if(et.some(e=>t.startsWith(e)))return`direct`;if(tt.some(e=>t.startsWith(e)))return`openrouter`}function at(e){let t=q(e.configValue)?e.configValue:void 0,n=typeof t?.baseUrl==`string`?t.baseUrl.trim():``,r=typeof t?.model==`string`?t.model.trim():``,i=(()=>{if(n)return n;if(e.keySource===`env`){if(e.fallbackEnvVar===`PERPLEXITY_API_KEY`)return $e;if(e.fallbackEnvVar===`OPENROUTER_API_KEY`)return K}return(e.keySource===`config`||e.keySource===`secretRef`)&&e.keyValue?it(e.keyValue)===`openrouter`?K:$e:K})(),a=!!(n||r),o=(()=>{try{return new URL(i).hostname.toLowerCase()===`api.perplexity.ai`}catch{return!1}})();return a||!o?`chat_completions`:`search_api`}function X(e,t){let n=e[t];if(q(n))return n;let r={};return e[t]=r,r}function Z(e){let t=X(X(X(e.resolvedConfig,`tools`),`web`),`search`);if(e.provider===`brave`){t.apiKey=e.value;return}let n=X(t,e.provider);n.apiKey=e.value}function ot(e){let t=X(X(X(X(e.resolvedConfig,`tools`),`web`),`fetch`),`firecrawl`);t.apiKey=e.value}function st(e){return e===`brave`?[`BRAVE_API_KEY`]:e===`gemini`?[`GEMINI_API_KEY`]:e===`grok`?[`XAI_API_KEY`]:e===`kimi`?[`KIMI_API_KEY`,`MOONSHOT_API_KEY`]:[`PERPLEXITY_API_KEY`,`OPENROUTER_API_KEY`]}function Q(e,t){if(t===`brave`)return e.apiKey;let n=e[t];if(q(n))return n.apiKey}function $(e,t){return!!o({value:e,defaults:t}).ref}async function ct(e){let n=e.sourceConfig.secrets?.defaults,r=[],i=q(e.sourceConfig.tools)?e.sourceConfig.tools:void 0,a=q(i?.web)?i.web:void 0,o=q(a?.search)?a.search:void 0,s={providerSource:`none`,diagnostics:[]},c=o?.enabled!==!1,l=typeof o?.provider==`string`?o.provider.trim().toLowerCase():``,u=nt(l);if(l&&!u){let t={code:`WEB_SEARCH_PROVIDER_INVALID_AUTODETECT`,message:`tools.web.search.provider is "${l}". Falling back to auto-detect precedence.`,path:`tools.web.search.provider`};r.push(t),s.diagnostics.push(t),M(e.context,{code:`WEB_SEARCH_PROVIDER_INVALID_AUTODETECT`,path:`tools.web.search.provider`,message:t.message})}if(u&&(s.providerConfigured=u,s.providerSource=`configured`),c&&o){let t=u?[u]:[...G],i=[],a,c;for(let l of t){let t=l===`brave`?`tools.web.search.apiKey`:`tools.web.search.${l}.apiKey`,d=Q(o,l),f=await rt({sourceConfig:e.sourceConfig,context:e.context,defaults:n,value:d,path:t,envVars:st(l)});if(f.secretRefConfigured&&f.fallbackUsedAfterRefFailure){let n={code:`WEB_SEARCH_KEY_UNRESOLVED_FALLBACK_USED`,message:`${t} SecretRef could not be resolved; using ${f.fallbackEnvVar??`env fallback`}. `+(f.unresolvedRefReason??``).trim(),path:t};r.push(n),s.diagnostics.push(n),M(e.context,{code:`WEB_SEARCH_KEY_UNRESOLVED_FALLBACK_USED`,path:t,message:n.message})}if(f.secretRefConfigured&&!f.value&&f.unresolvedRefReason&&i.push({provider:l,path:t,reason:f.unresolvedRefReason}),u){a=l,c=f,f.value&&Z({resolvedConfig:e.resolvedConfig,provider:l,value:f.value});break}if(f.value){a=l,c=f,Z({resolvedConfig:e.resolvedConfig,provider:l,value:f.value});break}}if(u){let t=i[0];if(t){let n={code:`WEB_SEARCH_KEY_UNRESOLVED_NO_FALLBACK`,message:t.reason,path:t.path};throw r.push(n),s.diagnostics.push(n),M(e.context,{code:`WEB_SEARCH_KEY_UNRESOLVED_NO_FALLBACK`,path:t.path,message:t.reason}),Error(`[WEB_SEARCH_KEY_UNRESOLVED_NO_FALLBACK] ${t.reason}`)}}else{if(!a&&i.length>0){let t=i[0],n={code:`WEB_SEARCH_KEY_UNRESOLVED_NO_FALLBACK`,message:t.reason,path:t.path};throw r.push(n),s.diagnostics.push(n),M(e.context,{code:`WEB_SEARCH_KEY_UNRESOLVED_NO_FALLBACK`,path:t.path,message:t.reason}),Error(`[WEB_SEARCH_KEY_UNRESOLVED_NO_FALLBACK] ${t.reason}`)}if(a){let e={code:`WEB_SEARCH_AUTODETECT_SELECTED`,message:`tools.web.search auto-detected provider "${a}" from available credentials.`,path:`tools.web.search.provider`};r.push(e),s.diagnostics.push(e)}}a&&(s.selectedProvider=a,s.selectedProviderKeySource=c?.source,u||(s.providerSource=`auto-detect`),a===`perplexity`&&(s.perplexityTransport=at({keyValue:c?.value,keySource:c?.source??`missing`,fallbackEnvVar:c?.fallbackEnvVar,configValue:o.perplexity})))}if(c&&o&&!u&&s.selectedProvider)for(let t of G){if(t===s.selectedProvider)continue;let r=t===`brave`?`tools.web.search.apiKey`:`tools.web.search.${t}.apiKey`;$(Q(o,t),n)&&N({context:e.context,path:r,details:`tools.web.search auto-detected provider is "${s.selectedProvider}".`})}else if(o&&!c)for(let t of G){let r=t===`brave`?`tools.web.search.apiKey`:`tools.web.search.${t}.apiKey`;$(Q(o,t),n)&&N({context:e.context,path:r,details:`tools.web.search is disabled.`})}if(c&&o&&u)for(let t of G){if(t===u)continue;let r=t===`brave`?`tools.web.search.apiKey`:`tools.web.search.${t}.apiKey`;$(Q(o,t),n)&&N({context:e.context,path:r,details:`tools.web.search.provider is "${u}".`})}let d=q(a?.fetch)?a.fetch:void 0,f=q(d?.firecrawl)?d.firecrawl:void 0,p=d?.enabled!==!1,m=f?.enabled!==!1,h=!!(p&&m),g=`tools.web.fetch.firecrawl.apiKey`,_={source:`missing`,secretRefConfigured:!1,fallbackUsedAfterRefFailure:!1},v=[];if(h){if(_=await rt({sourceConfig:e.sourceConfig,context:e.context,defaults:n,value:f?.apiKey,path:g,envVars:[`FIRECRAWL_API_KEY`]}),_.value&&ot({resolvedConfig:e.resolvedConfig,value:_.value}),_.secretRefConfigured){if(_.fallbackUsedAfterRefFailure){let t={code:`WEB_FETCH_FIRECRAWL_KEY_UNRESOLVED_FALLBACK_USED`,message:`${g} SecretRef could not be resolved; using ${_.fallbackEnvVar??`env fallback`}. `+(_.unresolvedRefReason??``).trim(),path:g};r.push(t),v.push(t),M(e.context,{code:`WEB_FETCH_FIRECRAWL_KEY_UNRESOLVED_FALLBACK_USED`,path:g,message:t.message})}if(!_.value&&_.unresolvedRefReason){let t={code:`WEB_FETCH_FIRECRAWL_KEY_UNRESOLVED_NO_FALLBACK`,message:_.unresolvedRefReason,path:g};throw r.push(t),v.push(t),M(e.context,{code:`WEB_FETCH_FIRECRAWL_KEY_UNRESOLVED_NO_FALLBACK`,path:g,message:_.unresolvedRefReason}),Error(`[WEB_FETCH_FIRECRAWL_KEY_UNRESOLVED_NO_FALLBACK] ${_.unresolvedRefReason}`)}}}else if($(f?.apiKey,n))N({context:e.context,path:g,details:p?`tools.web.fetch.firecrawl.enabled is false.`:`tools.web.fetch is disabled.`}),_={source:`secretRef`,secretRefConfigured:!0,fallbackUsedAfterRefFailure:!1};else{let n=t(f?.apiKey);if(n)_={value:n,source:`config`,secretRefConfigured:!1,fallbackUsedAfterRefFailure:!1};else{let t=J(e.context.env,[`FIRECRAWL_API_KEY`]);t.value&&(_={value:t.value,source:`env`,fallbackEnvVar:t.envVar,secretRefConfigured:!1,fallbackUsedAfterRefFailure:!1})}}return{search:s,fetch:{firecrawl:{active:h,apiKeySource:_.source,diagnostics:v}},diagnostics:r}}export{m as C,_ as S,g as T,he as _,Te as a,ee as b,M as c,be as d,ye as f,Se as g,ge as h,Ue as i,A as l,_e as m,Qe as n,we as o,k as p,Be as r,j as s,ct as t,Ce as u,ve as v,h as w,v as x,y};
-//# sourceMappingURL=runtime-web-tools-BYhCkBV8.js.map

package/dist/runtime-web-tools-C4F6aaRh.js

@@ -1,2 +1 @@
 import{Ds as e,Os as t,Ts as n,ao as r,ks as i,lu as a}from"./model-selection-BLbnMb5E.js";import{d as o,i as s}from"./types.secrets-C-5U96pc.js";import{jt as c}from"./plugins-CYLrFT4h.js";import{isDeepStrictEqual as l}from"node:util";function u(e){return/^\d+$/.test(e)}function d(e){return u(e)?`array`:`object`}function f(e,t,n){if(!Array.isArray(e))return null;if(!u(t))throw Error(`Invalid array index segment "${t}" at ${n.join(`.`)}.`);return{array:e,index:Number.parseInt(t,10)}}function p(e){if(e.segments.length===0)throw Error(`Target path is empty.`);let n=e.root;for(let r=0;r<e.segments.length-1;r+=1){let i=e.segments[r]??``;if(Array.isArray(n)){if(!u(i))throw Error(`Invalid array index segment "${i}" at ${e.segments.join(`.`)}.`);let t=Number.parseInt(i,10);if(e.requireExistingSegment&&(t<0||t>=n.length))throw Error(`Path segment does not exist at ${e.segments.slice(0,r+1).join(`.`)}.`);n=n[t];continue}if(!t(n))throw Error(`Invalid path shape at ${e.segments.slice(0,r).join(`.`)||`<root>`}.`);if(e.requireExistingSegment&&!Object.prototype.hasOwnProperty.call(n,i))throw Error(`Path segment does not exist at ${e.segments.slice(0,r+1).join(`.`)}.`);n=n[i]}return n}function m(e,n){if(n.length===0)return;let r=e;for(let e of n){if(Array.isArray(r)){if(!u(e))return;r=r[Number.parseInt(e,10)];continue}if(!t(r))return;r=r[e]}return r}function h(e,n,r){if(n.length===0)throw Error(`Target path is empty.`);let i=e,a=!1;for(let e=0;e<n.length-1;e+=1){let r=n[e]??``,o=d(n[e+1]??``);if(Array.isArray(i)){if(!u(r))throw Error(`Invalid array index segment "${r}" at ${n.join(`.`)}.`);let s=Number.parseInt(r,10),c=i[s];if(c==null)i[s]=o===`array`?[]:{},a=!0;else if(o===`array`?!Array.isArray(c):!t(c))throw Error(`Invalid path shape at ${n.slice(0,e+1).join(`.`)}.`);i=i[s];continue}if(!t(i))throw Error(`Invalid path shape at ${n.slice(0,e).join(`.`)||`<root>`}.`);let s=i[r];if(s==null)i[r]=o===`array`?[]:{},a=!0;else if(o===`array`?!Array.isArray(s):!t(s))throw Error(`Invalid path shape at ${n.slice(0,e+1).join(`.`)}.`);i=i[r]}let o=n[n.length-1]??``,s=f(i,o,n);if(s)return l(s.array[s.index],r)||(s.array[s.index]=r,a=!0),a;if(!t(i))throw Error(`Invalid path shape at ${n.slice(0,-1).join(`.`)||`<root>`}.`);return l(i[o],r)||(i[o]=r,a=!0),a}function g(e,n,r){let i=p({root:e,segments:n,requireExistingSegment:!0}),a=n[n.length-1]??``,o=f(i,a,n);if(o){if(o.index<0||o.index>=o.array.length)throw Error(`Path segment does not exist at ${n.join(`.`)}.`);return l(o.array[o.index],r)?!1:(o.array[o.index]=r,!0)}if(!t(i))throw Error(`Invalid path shape at ${n.slice(0,-1).join(`.`)||`<root>`}.`);if(!Object.prototype.hasOwnProperty.call(i,a))throw Error(`Path segment does not exist at ${n.join(`.`)}.`);return l(i[a],r)?!1:(i[a]=r,!0)}function _(e,n){let r=p({root:e,segments:n,requireExistingSegment:!1}),i=n[n.length-1]??``,a=f(r,i,n);if(a)return a.index<0||a.index>=a.array.length?!1:(a.array.splice(a.index,1),!0);if(!t(r))throw Error(`Invalid path shape at ${n.slice(0,-1).join(`.`)||`<root>`}.`);return Object.prototype.hasOwnProperty.call(r,i)?(delete r[i],!0):!1}function v(n,r){return r===`string`?e(n):e(n)||t(n)}function ee(n,r){return r===`string`?e(n):e(n)||t(n)&&Object.keys(n).length>0}function y(e){if(!v(e.value,e.expected))throw Error(e.errorMessage)}const b=`secret_input`,x=`sibling_ref`,te=[{id:`auth-profiles.api_key.key`,targetType:`auth-profiles.api_key.key`,configFile:`auth-profiles.json`,pathPattern:`profiles.*.key`,refPathPattern:`profiles.*.keyRef`,secretShape:x,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0,authProfileType:`api_key`},{id:`auth-profiles.token.token`,targetType:`auth-profiles.token.token`,configFile:`auth-profiles.json`,pathPattern:`profiles.*.token`,refPathPattern:`profiles.*.tokenRef`,secretShape:x,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0,authProfileType:`token`},{id:`agents.defaults.memorySearch.remote.apiKey`,targetType:`agents.defaults.memorySearch.remote.apiKey`,configFile:`openclaw.json`,pathPattern:`agents.defaults.memorySearch.remote.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`agents.list[].memorySearch.remote.apiKey`,targetType:`agents.list[].memorySearch.remote.apiKey`,configFile:`openclaw.json`,pathPattern:`agents.list[].memorySearch.remote.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.bluebubbles.accounts.*.password`,targetType:`channels.bluebubbles.accounts.*.password`,configFile:`openclaw.json`,pathPattern:`channels.bluebubbles.accounts.*.password`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.bluebubbles.password`,targetType:`channels.bluebubbles.password`,configFile:`openclaw.json`,pathPattern:`channels.bluebubbles.password`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.discord.accounts.*.pluralkit.token`,targetType:`channels.discord.accounts.*.pluralkit.token`,configFile:`openclaw.json`,pathPattern:`channels.discord.accounts.*.pluralkit.token`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.discord.accounts.*.token`,targetType:`channels.discord.accounts.*.token`,configFile:`openclaw.json`,pathPattern:`channels.discord.accounts.*.token`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.discord.accounts.*.voice.tts.elevenlabs.apiKey`,targetType:`channels.discord.accounts.*.voice.tts.elevenlabs.apiKey`,configFile:`openclaw.json`,pathPattern:`channels.discord.accounts.*.voice.tts.elevenlabs.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.discord.accounts.*.voice.tts.openai.apiKey`,targetType:`channels.discord.accounts.*.voice.tts.openai.apiKey`,configFile:`openclaw.json`,pathPattern:`channels.discord.accounts.*.voice.tts.openai.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.discord.pluralkit.token`,targetType:`channels.discord.pluralkit.token`,configFile:`openclaw.json`,pathPattern:`channels.discord.pluralkit.token`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.discord.token`,targetType:`channels.discord.token`,configFile:`openclaw.json`,pathPattern:`channels.discord.token`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.discord.voice.tts.elevenlabs.apiKey`,targetType:`channels.discord.voice.tts.elevenlabs.apiKey`,configFile:`openclaw.json`,pathPattern:`channels.discord.voice.tts.elevenlabs.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.discord.voice.tts.openai.apiKey`,targetType:`channels.discord.voice.tts.openai.apiKey`,configFile:`openclaw.json`,pathPattern:`channels.discord.voice.tts.openai.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.feishu.accounts.*.appSecret`,targetType:`channels.feishu.accounts.*.appSecret`,configFile:`openclaw.json`,pathPattern:`channels.feishu.accounts.*.appSecret`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.feishu.accounts.*.verificationToken`,targetType:`channels.feishu.accounts.*.verificationToken`,configFile:`openclaw.json`,pathPattern:`channels.feishu.accounts.*.verificationToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.feishu.appSecret`,targetType:`channels.feishu.appSecret`,configFile:`openclaw.json`,pathPattern:`channels.feishu.appSecret`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.feishu.verificationToken`,targetType:`channels.feishu.verificationToken`,configFile:`openclaw.json`,pathPattern:`channels.feishu.verificationToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.googlechat.accounts.*.serviceAccount`,targetType:`channels.googlechat.serviceAccount`,targetTypeAliases:[`channels.googlechat.accounts.*.serviceAccount`],configFile:`openclaw.json`,pathPattern:`channels.googlechat.accounts.*.serviceAccount`,refPathPattern:`channels.googlechat.accounts.*.serviceAccountRef`,secretShape:x,expectedResolvedValue:`string-or-object`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0,accountIdPathSegmentIndex:3},{id:`channels.googlechat.serviceAccount`,targetType:`channels.googlechat.serviceAccount`,configFile:`openclaw.json`,pathPattern:`channels.googlechat.serviceAccount`,refPathPattern:`channels.googlechat.serviceAccountRef`,secretShape:x,expectedResolvedValue:`string-or-object`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.irc.accounts.*.nickserv.password`,targetType:`channels.irc.accounts.*.nickserv.password`,configFile:`openclaw.json`,pathPattern:`channels.irc.accounts.*.nickserv.password`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.irc.accounts.*.password`,targetType:`channels.irc.accounts.*.password`,configFile:`openclaw.json`,pathPattern:`channels.irc.accounts.*.password`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.irc.nickserv.password`,targetType:`channels.irc.nickserv.password`,configFile:`openclaw.json`,pathPattern:`channels.irc.nickserv.password`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.irc.password`,targetType:`channels.irc.password`,configFile:`openclaw.json`,pathPattern:`channels.irc.password`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.mattermost.accounts.*.botToken`,targetType:`channels.mattermost.accounts.*.botToken`,configFile:`openclaw.json`,pathPattern:`channels.mattermost.accounts.*.botToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.mattermost.botToken`,targetType:`channels.mattermost.botToken`,configFile:`openclaw.json`,pathPattern:`channels.mattermost.botToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.matrix.accounts.*.password`,targetType:`channels.matrix.accounts.*.password`,configFile:`openclaw.json`,pathPattern:`channels.matrix.accounts.*.password`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.matrix.password`,targetType:`channels.matrix.password`,configFile:`openclaw.json`,pathPattern:`channels.matrix.password`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.msteams.appPassword`,targetType:`channels.msteams.appPassword`,configFile:`openclaw.json`,pathPattern:`channels.msteams.appPassword`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.nextcloud-talk.accounts.*.apiPassword`,targetType:`channels.nextcloud-talk.accounts.*.apiPassword`,configFile:`openclaw.json`,pathPattern:`channels.nextcloud-talk.accounts.*.apiPassword`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.nextcloud-talk.accounts.*.botSecret`,targetType:`channels.nextcloud-talk.accounts.*.botSecret`,configFile:`openclaw.json`,pathPattern:`channels.nextcloud-talk.accounts.*.botSecret`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.nextcloud-talk.apiPassword`,targetType:`channels.nextcloud-talk.apiPassword`,configFile:`openclaw.json`,pathPattern:`channels.nextcloud-talk.apiPassword`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.nextcloud-talk.botSecret`,targetType:`channels.nextcloud-talk.botSecret`,configFile:`openclaw.json`,pathPattern:`channels.nextcloud-talk.botSecret`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.slack.accounts.*.appToken`,targetType:`channels.slack.accounts.*.appToken`,configFile:`openclaw.json`,pathPattern:`channels.slack.accounts.*.appToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.slack.accounts.*.botToken`,targetType:`channels.slack.accounts.*.botToken`,configFile:`openclaw.json`,pathPattern:`channels.slack.accounts.*.botToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.slack.accounts.*.signingSecret`,targetType:`channels.slack.accounts.*.signingSecret`,configFile:`openclaw.json`,pathPattern:`channels.slack.accounts.*.signingSecret`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.slack.accounts.*.userToken`,targetType:`channels.slack.accounts.*.userToken`,configFile:`openclaw.json`,pathPattern:`channels.slack.accounts.*.userToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.slack.appToken`,targetType:`channels.slack.appToken`,configFile:`openclaw.json`,pathPattern:`channels.slack.appToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.slack.botToken`,targetType:`channels.slack.botToken`,configFile:`openclaw.json`,pathPattern:`channels.slack.botToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.slack.signingSecret`,targetType:`channels.slack.signingSecret`,configFile:`openclaw.json`,pathPattern:`channels.slack.signingSecret`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.slack.userToken`,targetType:`channels.slack.userToken`,configFile:`openclaw.json`,pathPattern:`channels.slack.userToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.telegram.accounts.*.botToken`,targetType:`channels.telegram.accounts.*.botToken`,configFile:`openclaw.json`,pathPattern:`channels.telegram.accounts.*.botToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.telegram.accounts.*.webhookSecret`,targetType:`channels.telegram.accounts.*.webhookSecret`,configFile:`openclaw.json`,pathPattern:`channels.telegram.accounts.*.webhookSecret`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.telegram.botToken`,targetType:`channels.telegram.botToken`,configFile:`openclaw.json`,pathPattern:`channels.telegram.botToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.telegram.webhookSecret`,targetType:`channels.telegram.webhookSecret`,configFile:`openclaw.json`,pathPattern:`channels.telegram.webhookSecret`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.zalo.accounts.*.botToken`,targetType:`channels.zalo.accounts.*.botToken`,configFile:`openclaw.json`,pathPattern:`channels.zalo.accounts.*.botToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.zalo.accounts.*.webhookSecret`,targetType:`channels.zalo.accounts.*.webhookSecret`,configFile:`openclaw.json`,pathPattern:`channels.zalo.accounts.*.webhookSecret`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.zalo.botToken`,targetType:`channels.zalo.botToken`,configFile:`openclaw.json`,pathPattern:`channels.zalo.botToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`channels.zalo.webhookSecret`,targetType:`channels.zalo.webhookSecret`,configFile:`openclaw.json`,pathPattern:`channels.zalo.webhookSecret`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`cron.webhookToken`,targetType:`cron.webhookToken`,configFile:`openclaw.json`,pathPattern:`cron.webhookToken`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`gateway.auth.token`,targetType:`gateway.auth.token`,configFile:`openclaw.json`,pathPattern:`gateway.auth.token`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`gateway.auth.password`,targetType:`gateway.auth.password`,configFile:`openclaw.json`,pathPattern:`gateway.auth.password`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`gateway.remote.password`,targetType:`gateway.remote.password`,configFile:`openclaw.json`,pathPattern:`gateway.remote.password`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`gateway.remote.token`,targetType:`gateway.remote.token`,configFile:`openclaw.json`,pathPattern:`gateway.remote.token`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`messages.tts.elevenlabs.apiKey`,targetType:`messages.tts.elevenlabs.apiKey`,configFile:`openclaw.json`,pathPattern:`messages.tts.elevenlabs.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`messages.tts.openai.apiKey`,targetType:`messages.tts.openai.apiKey`,configFile:`openclaw.json`,pathPattern:`messages.tts.openai.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`models.providers.*.apiKey`,targetType:`models.providers.apiKey`,targetTypeAliases:[`models.providers.*.apiKey`],configFile:`openclaw.json`,pathPattern:`models.providers.*.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0,providerIdPathSegmentIndex:2,trackProviderShadowing:!0},{id:`models.providers.*.headers.*`,targetType:`models.providers.headers`,targetTypeAliases:[`models.providers.*.headers.*`],configFile:`openclaw.json`,pathPattern:`models.providers.*.headers.*`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0,providerIdPathSegmentIndex:2},{id:`skills.entries.*.apiKey`,targetType:`skills.entries.apiKey`,targetTypeAliases:[`skills.entries.*.apiKey`],configFile:`openclaw.json`,pathPattern:`skills.entries.*.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`talk.apiKey`,targetType:`talk.apiKey`,configFile:`openclaw.json`,pathPattern:`talk.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`talk.providers.*.apiKey`,targetType:`talk.providers.*.apiKey`,configFile:`openclaw.json`,pathPattern:`talk.providers.*.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`tools.web.fetch.firecrawl.apiKey`,targetType:`tools.web.fetch.firecrawl.apiKey`,configFile:`openclaw.json`,pathPattern:`tools.web.fetch.firecrawl.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`tools.web.search.apiKey`,targetType:`tools.web.search.apiKey`,configFile:`openclaw.json`,pathPattern:`tools.web.search.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`tools.web.search.gemini.apiKey`,targetType:`tools.web.search.gemini.apiKey`,configFile:`openclaw.json`,pathPattern:`tools.web.search.gemini.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`tools.web.search.grok.apiKey`,targetType:`tools.web.search.grok.apiKey`,configFile:`openclaw.json`,pathPattern:`tools.web.search.grok.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`tools.web.search.kimi.apiKey`,targetType:`tools.web.search.kimi.apiKey`,configFile:`openclaw.json`,pathPattern:`tools.web.search.kimi.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0},{id:`tools.web.search.perplexity.apiKey`,targetType:`tools.web.search.perplexity.apiKey`,configFile:`openclaw.json`,pathPattern:`tools.web.search.perplexity.apiKey`,secretShape:b,expectedResolvedValue:`string`,includeInPlan:!0,includeInConfigure:!0,includeInAudit:!0}];function S(e){return e.filter(e=>e.kind===`wildcard`||e.kind===`array`).length}function C(e){return i(e).map(t=>{if(t===`*`)return{kind:`wildcard`};if(t.endsWith(`[]`)){let n=t.slice(0,-2).trim();if(!n)throw Error(`Invalid target path pattern: ${e}`);return{kind:`array`,field:n}}return{kind:`literal`,value:t}})}function ne(e){let t=C(e.pathPattern),n=S(t),r=e.refPathPattern?C(e.refPathPattern):void 0,i=r?S(r):0;if(e.secretShape===`sibling_ref`&&!r)throw Error(`Missing refPathPattern for sibling_ref target: ${e.id}`);if(r&&i!==n)throw Error(`Mismatched wildcard shape for target ref path: ${e.id}`);return{...e,pathTokens:t,pathDynamicTokenCount:n,refPathTokens:r,refPathDynamicTokenCount:i}}function re(e,t){let n=[],r=0;for(let i of t){if(i.kind===`literal`){if(e[r]!==i.value)return null;r+=1;continue}if(i.kind===`wildcard`){let t=e[r];if(!t)return null;n.push(t),r+=1;continue}if(e[r]!==i.field)return null;let t=e[r+1];if(!t||!/^\d+$/.test(t))return null;n.push(t),r+=2}return r===e.length?{captures:n}:null}function ie(e,t){let n=[],r=0;for(let i of e){if(i.kind===`literal`){n.push(i.value);continue}if(i.kind===`wildcard`){let e=t[r];if(!e)return null;n.push(e),r+=1;continue}let e=t[r];if(!e||!/^\d+$/.test(e))return null;n.push(i.field,e),r+=1}return r===t.length?n:null}function ae(e,n){let r=[],i=(e,a,o,s)=>{let c=n[a];if(!c){r.push({segments:o,captures:s,value:e});return}let l=a===n.length-1;if(c.kind===`literal`){if(!t(e))return;if(l){r.push({segments:[...o,c.value],captures:s,value:e[c.value]});return}if(!Object.prototype.hasOwnProperty.call(e,c.value))return;i(e[c.value],a+1,[...o,c.value],s);return}if(c.kind===`wildcard`){if(!t(e))return;for(let[t,n]of Object.entries(e)){if(l){r.push({segments:[...o,t],captures:[...s,t],value:n});continue}i(n,a+1,[...o,t],[...s,t])}return}if(!t(e))return;let u=e[c.field];if(Array.isArray(u))for(let e=0;e<u.length;e+=1){let t=u[e],n=String(e);if(l){r.push({segments:[...o,c.field,n],captures:[...s,n],value:t});continue}i(t,a+1,[...o,c.field,n],[...s,n])}};return i(e,0,[],[]),r}const w=te.map(ne),oe=w.filter(e=>e.configFile===`openclaw.json`),se=w.filter(e=>e.configFile===`auth-profiles.json`);function ce(){let e=new Map,t=(t,n)=>{let r=e.get(t);if(r){r.push(n);return}e.set(t,[n])};for(let e of w){t(e.targetType,e);for(let n of e.targetTypeAliases??[])t(n,e)}return e}const le=ce(),ue=new Set(w.map(e=>e.id));function de(){let e=new Map;for(let t of oe){let n=e.get(t.id);if(n){n.push(t);continue}e.set(t.id,[t])}return e}const fe=de();function pe(){let e=new Map;for(let t of se){let n=e.get(t.id);if(n){n.push(t);continue}e.set(t.id,[t])}return e}const me=pe();function T(e){return e===void 0?null:new Set(Array.from(e).map(e=>e.trim()).filter(e=>e.length>0))}function E(e){return e.allowedTargetIds===null?e.defaultEntries:Array.from(e.allowedTargetIds).flatMap(t=>e.entriesById.get(t)??[])}function D(e,t){let n=[],r=new Set;for(let i of t){let t=ae(e,i.pathTokens);for(let a of t){let t=O(i,a.segments,a.captures);if(!t)continue;let o=`${i.id}:${t.pathSegments.join(`.`)}`;if(r.has(o))continue;r.add(o);let s=t.refPathSegments?m(e,t.refPathSegments):void 0;n.push({entry:i,path:t.pathSegments.join(`.`),pathSegments:t.pathSegments,...t.refPathSegments?{refPathSegments:t.refPathSegments,refPath:t.refPathSegments.join(`.`)}:{},value:a.value,...t.providerId?{providerId:t.providerId}:{},...t.accountId?{accountId:t.accountId}:{},...t.refPathSegments?{refValue:s}:{}})}}return n}function O(e,t,n){let r=e.providerIdPathSegmentIndex===void 0?void 0:t[e.providerIdPathSegmentIndex],i=e.accountIdPathSegmentIndex===void 0?void 0:t[e.accountIdPathSegmentIndex],a=e.refPathTokens?ie(e.refPathTokens,n):void 0;return e.refPathTokens&&!a?null:{entry:e,pathSegments:t,...a?{refPathSegments:a}:{},...r?{providerId:r}:{},...i?{accountId:i}:{}}}function he(){return w.map(e=>({id:e.id,targetType:e.targetType,...e.targetTypeAliases?{targetTypeAliases:[...e.targetTypeAliases]}:{},configFile:e.configFile,pathPattern:e.pathPattern,...e.refPathPattern?{refPathPattern:e.refPathPattern}:{},secretShape:e.secretShape,expectedResolvedValue:e.expectedResolvedValue,includeInPlan:e.includeInPlan,includeInConfigure:e.includeInConfigure,includeInAudit:e.includeInAudit,...e.providerIdPathSegmentIndex===void 0?{}:{providerIdPathSegmentIndex:e.providerIdPathSegmentIndex},...e.accountIdPathSegmentIndex===void 0?{}:{accountIdPathSegmentIndex:e.accountIdPathSegmentIndex},...e.authProfileType?{authProfileType:e.authProfileType}:{},...e.trackProviderShadowing?{trackProviderShadowing:!0}:{}}))}function ge(e){return typeof e==`string`&&le.has(e)}function _e(e){return typeof e==`string`&&ue.has(e)}function ve(e){let t=le.get(e.type);if(!t||t.length===0)return null;for(let n of t){if(!n.includeInPlan)continue;let t=re(e.pathSegments,n.pathTokens);if(!t)continue;let r=O(n,e.pathSegments,t.captures);if(r&&!(e.providerId&&e.providerId.trim().length>0&&(!r.providerId||r.providerId!==e.providerId))&&!(e.accountId&&e.accountId.trim().length>0&&(!r.accountId||r.accountId!==e.accountId)))return r}return null}function ye(e){return k(e)}function k(e,t){return D(e,E({allowedTargetIds:T(t),defaultEntries:oe,entriesById:fe}))}function be(e){return xe(e)}function xe(e,t){return D(e,E({allowedTargetIds:T(t),defaultEntries:se,entriesById:me}))}function Se(){return w.filter(e=>e.configFile===`auth-profiles.json`&&e.includeInAudit)}function A(e){let t=e.sourceConfig.secrets?.defaults,n=[],r=[],i=[],a=[];for(let c of k(e.sourceConfig,e.targetIds)){if(e.allowedPaths&&!e.allowedPaths.has(c.path))continue;let{explicitRef:l,ref:u}=o({value:c.value,refValue:c.refValue,defaults:t}),d=l?s(c.value,t):null;if(!u)continue;let f=m(e.resolvedConfig,c.pathSegments);if(!v(f,c.entry.expectedResolvedValue)){if(e.inactiveRefPaths?.has(c.path)){r.push(`${c.path}: secret ref is configured on an inactive surface; skipping command-time assignment.`),a.push({path:c.path,pathSegments:[...c.pathSegments]});continue}i.push({path:c.path,pathSegments:[...c.pathSegments]});continue}n.push({path:c.path,pathSegments:[...c.pathSegments],value:f}),c.entry.secretShape===`sibling_ref`&&l&&d&&r.push(`${c.path}: both inline and sibling ref were present; sibling ref took precedence.`)}return{assignments:n,diagnostics:r,unresolved:i,inactive:a}}function Ce(e){let t=A({sourceConfig:e.sourceConfig,resolvedConfig:e.resolvedConfig,targetIds:e.targetIds,inactiveRefPaths:e.inactiveRefPaths,allowedPaths:e.allowedPaths});if(t.unresolved.length>0)throw Error(`${e.commandName}: ${t.unresolved[0]?.path??`target`} is unresolved in the active runtime snapshot.`);return{assignments:t.assignments,diagnostics:t.diagnostics}}function we(e){return{sourceConfig:e.sourceConfig,env:e.env,cache:{},warnings:[],warningKeys:new Set,assignments:[]}}function j(e,t){e.assignments.push(t)}function M(e,t){let n=`${t.code}:${t.path}:${t.message}`;e.warningKeys.has(n)||(e.warningKeys.add(n),e.warnings.push(t))}function N(e){M(e.context,{code:`SECRETS_REF_IGNORED_INACTIVE_SURFACE`,path:e.path,message:e.details&&e.details.trim().length>0?`${e.path}: ${e.details}`:`${e.path}: secret ref is configured on an inactive surface; skipping resolution until it becomes active.`})}function P(e){let t=s(e.value,e.defaults);if(t){if(e.active===!1){N({context:e.context,path:e.path,details:e.inactiveReason});return}j(e.context,{ref:t,path:e.path,expected:e.expected,apply:e.apply})}}function Te(e){for(let t of e.assignments){let n=c(t.ref);if(!e.resolved.has(n))throw Error(`Secret reference "${n}" resolved to no value.`);let r=e.resolved.get(n);y({value:r,expected:t.expected,errorMessage:t.expected===`string`?`${t.path} resolved to a non-string or empty value.`:`${t.path} resolved to an unsupported value type.`}),t.apply(r)}}function F(e,t){return Object.prototype.hasOwnProperty.call(e,t)}function I(e){return t(e)?e.enabled!==!1:!0}function Ee(e,t){return I(e)&&I(t)}function L(e){let n=e.tts.elevenlabs;t(n)&&P({value:n.apiKey,path:`${e.pathPrefix}.elevenlabs.apiKey`,expected:`string`,defaults:e.defaults,context:e.context,active:e.active,inactiveReason:e.inactiveReason,apply:e=>{n.apiKey=e}});let r=e.tts.openai;t(r)&&P({value:r.apiKey,path:`${e.pathPrefix}.openai.apiKey`,expected:`string`,defaults:e.defaults,context:e.context,active:e.active,inactiveReason:e.inactiveReason,apply:e=>{r.apiKey=e}})}function R(e){let n=I(e),r=e.accounts;if(!t(r)||Object.keys(r).length===0)return{hasExplicitAccounts:!1,channelEnabled:n,accounts:[{accountId:`default`,account:e,enabled:n}]};let i=[];for(let[n,a]of Object.entries(r))t(a)&&i.push({accountId:n,account:a,enabled:Ee(e,a)});return{hasExplicitAccounts:!0,channelEnabled:n,accounts:i}}function z(e,t){return e.channelEnabled?e.hasExplicitAccounts?e.accounts.some(({account:e,enabled:n})=>n&&!F(e,t)):!0:!1}function B(e){return typeof e==`string`?e.trim():``}function V(e,t){return B(e).length>0||s(e,t)!==null}function H(e){if(P({value:e.channel[e.field],path:`channels.${e.channelKey}.${e.field}`,expected:`string`,defaults:e.defaults,context:e.context,active:z(e.surface,e.field),inactiveReason:e.topInactiveReason,apply:t=>{e.channel[e.field]=t}}),e.surface.hasExplicitAccounts)for(let{accountId:t,account:n,enabled:r}of e.surface.accounts)F(n,e.field)&&P({value:n[e.field],path:`channels.${e.channelKey}.accounts.${t}.${e.field}`,expected:`string`,defaults:e.defaults,context:e.context,active:r,inactiveReason:e.accountInactiveReason,apply:t=>{n[e.field]=t}})}function De(e){let n=e.config.channels;if(!t(n))return;let r=n.telegram;if(!t(r))return;let i=R(r),a=typeof r.tokenFile==`string`?r.tokenFile.trim():``,o=i.channelEnabled?i.hasExplicitAccounts?i.accounts.some(({account:t,enabled:n})=>{if(!n||a.length>0)return!1;let r=V(t.botToken,e.defaults),i=typeof t.tokenFile==`string`&&t.tokenFile.trim().length>0;return!r&&!i}):a.length===0:!1;if(P({value:r.botToken,path:`channels.telegram.botToken`,expected:`string`,defaults:e.defaults,context:e.context,active:o,inactiveReason:`no enabled Telegram surface inherits this top-level botToken (tokenFile is configured).`,apply:e=>{r.botToken=e}}),i.hasExplicitAccounts)for(let{accountId:t,account:n,enabled:r}of i.accounts){if(!F(n,`botToken`))continue;let i=typeof n.tokenFile==`string`?n.tokenFile.trim():``;P({value:n.botToken,path:`channels.telegram.accounts.${t}.botToken`,expected:`string`,defaults:e.defaults,context:e.context,active:r&&i.length===0,inactiveReason:`Telegram account is disabled or tokenFile is configured.`,apply:e=>{n.botToken=e}})}let s=typeof r.webhookUrl==`string`?r.webhookUrl.trim():``,c=i.channelEnabled?i.hasExplicitAccounts?i.accounts.some(({account:e,enabled:t})=>t&&!F(e,`webhookSecret`)&&(F(e,`webhookUrl`)?typeof e.webhookUrl==`string`&&e.webhookUrl.trim().length>0:s.length>0)):s.length>0:!1;if(P({value:r.webhookSecret,path:`channels.telegram.webhookSecret`,expected:`string`,defaults:e.defaults,context:e.context,active:c,inactiveReason:`no enabled Telegram webhook surface inherits this top-level webhookSecret (webhook mode is not active).`,apply:e=>{r.webhookSecret=e}}),i.hasExplicitAccounts)for(let{accountId:t,account:n,enabled:r}of i.accounts){if(!F(n,`webhookSecret`))continue;let i=F(n,`webhookUrl`)?typeof n.webhookUrl==`string`?n.webhookUrl.trim():``:s;P({value:n.webhookSecret,path:`channels.telegram.accounts.${t}.webhookSecret`,expected:`string`,defaults:e.defaults,context:e.context,active:r&&i.length>0,inactiveReason:`Telegram account is disabled or webhook mode is not active for this account.`,apply:e=>{n.webhookSecret=e}})}}function Oe(e){let n=e.config.channels;if(!t(n))return;let r=n.slack;if(!t(r))return;let i=R(r),a=r.mode===`http`||r.mode===`socket`?r.mode:`socket`;for(let t of[`botToken`,`userToken`])H({channelKey:`slack`,field:t,channel:r,surface:i,defaults:e.defaults,context:e.context,topInactiveReason:`no enabled account inherits this top-level Slack ${t}.`,accountInactiveReason:`Slack account is disabled.`});let o=i.channelEnabled?i.hasExplicitAccounts?i.accounts.some(({account:e,enabled:t})=>!t||F(e,`appToken`)?!1:(e.mode===`http`||e.mode===`socket`?e.mode:a)!==`http`):a!==`http`:!1;P({value:r.appToken,path:`channels.slack.appToken`,expected:`string`,defaults:e.defaults,context:e.context,active:o,inactiveReason:`no enabled Slack socket-mode surface inherits this top-level appToken.`,apply:e=>{r.appToken=e}});let s=i.channelEnabled?i.hasExplicitAccounts?i.accounts.some(({account:e,enabled:t})=>!t||F(e,`signingSecret`)?!1:(e.mode===`http`||e.mode===`socket`?e.mode:a)===`http`):a===`http`:!1;if(P({value:r.signingSecret,path:`channels.slack.signingSecret`,expected:`string`,defaults:e.defaults,context:e.context,active:s,inactiveReason:`no enabled Slack HTTP-mode surface inherits this top-level signingSecret.`,apply:e=>{r.signingSecret=e}}),i.hasExplicitAccounts)for(let{accountId:t,account:n,enabled:r}of i.accounts){let i=n.mode===`http`||n.mode===`socket`?n.mode:a;F(n,`appToken`)&&P({value:n.appToken,path:`channels.slack.accounts.${t}.appToken`,expected:`string`,defaults:e.defaults,context:e.context,active:r&&i!==`http`,inactiveReason:`Slack account is disabled or not running in socket mode.`,apply:e=>{n.appToken=e}}),F(n,`signingSecret`)&&P({value:n.signingSecret,path:`channels.slack.accounts.${t}.signingSecret`,expected:`string`,defaults:e.defaults,context:e.context,active:r&&i===`http`,inactiveReason:`Slack account is disabled or not running in HTTP mode.`,apply:e=>{n.signingSecret=e}})}}function ke(e){let n=e.config.channels;if(!t(n))return;let r=n.discord;if(!t(r))return;let i=R(r);if(H({channelKey:`discord`,field:`token`,channel:r,surface:i,defaults:e.defaults,context:e.context,topInactiveReason:`no enabled account inherits this top-level Discord token.`,accountInactiveReason:`Discord account is disabled.`}),t(r.pluralkit)){let t=r.pluralkit;P({value:t.token,path:`channels.discord.pluralkit.token`,expected:`string`,defaults:e.defaults,context:e.context,active:z(i,`pluralkit`)&&I(t),inactiveReason:`no enabled Discord surface inherits this top-level PluralKit config or PluralKit is disabled.`,apply:e=>{t.token=e}})}if(t(r.voice)&&t(r.voice.tts)&&L({tts:r.voice.tts,pathPrefix:`channels.discord.voice.tts`,defaults:e.defaults,context:e.context,active:z(i,`voice`)&&I(r.voice),inactiveReason:`no enabled Discord surface inherits this top-level voice config or voice is disabled.`}),i.hasExplicitAccounts)for(let{accountId:n,account:r,enabled:a}of i.accounts){if(F(r,`pluralkit`)&&t(r.pluralkit)){let t=r.pluralkit;P({value:t.token,path:`channels.discord.accounts.${n}.pluralkit.token`,expected:`string`,defaults:e.defaults,context:e.context,active:a&&I(t),inactiveReason:`Discord account is disabled or PluralKit is disabled for this account.`,apply:e=>{t.token=e}})}F(r,`voice`)&&t(r.voice)&&t(r.voice.tts)&&L({tts:r.voice.tts,pathPrefix:`channels.discord.accounts.${n}.voice.tts`,defaults:e.defaults,context:e.context,active:a&&I(r.voice),inactiveReason:`Discord account is disabled or voice is disabled for this account.`})}}function Ae(e){let n=e.config.channels;if(!t(n))return;let r=n.irc;if(!t(r))return;let i=R(r);if(H({channelKey:`irc`,field:`password`,channel:r,surface:i,defaults:e.defaults,context:e.context,topInactiveReason:`no enabled account inherits this top-level IRC password.`,accountInactiveReason:`IRC account is disabled.`}),t(r.nickserv)){let t=r.nickserv;P({value:t.password,path:`channels.irc.nickserv.password`,expected:`string`,defaults:e.defaults,context:e.context,active:z(i,`nickserv`)&&I(t),inactiveReason:`no enabled account inherits this top-level IRC nickserv config or NickServ is disabled.`,apply:e=>{t.password=e}})}if(i.hasExplicitAccounts){for(let{accountId:n,account:r,enabled:a}of i.accounts)if(F(r,`nickserv`)&&t(r.nickserv)){let t=r.nickserv;P({value:t.password,path:`channels.irc.accounts.${n}.nickserv.password`,expected:`string`,defaults:e.defaults,context:e.context,active:a&&I(t),inactiveReason:`IRC account is disabled or NickServ is disabled for this account.`,apply:e=>{t.password=e}})}}}function je(e){let n=e.config.channels;if(!t(n))return;let r=n.bluebubbles;t(r)&&H({channelKey:`bluebubbles`,field:`password`,channel:r,surface:R(r),defaults:e.defaults,context:e.context,topInactiveReason:`no enabled account inherits this top-level BlueBubbles password.`,accountInactiveReason:`BlueBubbles account is disabled.`})}function Me(e){let n=e.config.channels;if(!t(n))return;let r=n.msteams;t(r)&&P({value:r.appPassword,path:`channels.msteams.appPassword`,expected:`string`,defaults:e.defaults,context:e.context,active:r.enabled!==!1,inactiveReason:`Microsoft Teams channel is disabled.`,apply:e=>{r.appPassword=e}})}function Ne(e){let n=e.config.channels;if(!t(n))return;let r=n.mattermost;t(r)&&H({channelKey:`mattermost`,field:`botToken`,channel:r,surface:R(r),defaults:e.defaults,context:e.context,topInactiveReason:`no enabled account inherits this top-level Mattermost botToken.`,accountInactiveReason:`Mattermost account is disabled.`})}function Pe(e){let n=e.config.channels;if(!t(n))return;let r=n.matrix;if(!t(r))return;let i=R(r),a=B(e.context.env.MATRIX_ACCESS_TOKEN).length>0,o=V(r.accessToken,e.defaults),s=i.channelEnabled?i.hasExplicitAccounts?i.accounts.some(({account:t,enabled:n})=>n&&!F(t,`password`)&&!V(t.accessToken,e.defaults)&&!(o||a)):!(o||a):!1;if(P({value:r.password,path:`channels.matrix.password`,expected:`string`,defaults:e.defaults,context:e.context,active:s,inactiveReason:`no enabled Matrix surface inherits this top-level password (an accessToken is configured).`,apply:e=>{r.password=e}}),i.hasExplicitAccounts)for(let{accountId:t,account:n,enabled:r}of i.accounts){if(!F(n,`password`))continue;let i=V(n.accessToken,e.defaults),s=!F(n,`accessToken`)&&(o||a);P({value:n.password,path:`channels.matrix.accounts.${t}.password`,expected:`string`,defaults:e.defaults,context:e.context,active:r&&!(i||s),inactiveReason:`Matrix account is disabled or an accessToken is configured.`,apply:e=>{n.password=e}})}}function Fe(e){let n=e.config.channels;if(!t(n))return;let r=n.zalo;if(!t(r))return;let i=R(r),a=i.channelEnabled?i.hasExplicitAccounts?i.accounts.some(({account:e,enabled:t})=>t&&!F(e,`botToken`)):!0:!1;P({value:r.botToken,path:`channels.zalo.botToken`,expected:`string`,defaults:e.defaults,context:e.context,active:a,inactiveReason:`no enabled Zalo surface inherits this top-level botToken.`,apply:e=>{r.botToken=e}});let o=B(r.webhookUrl),s=i.channelEnabled?i.hasExplicitAccounts?i.accounts.some(({account:e,enabled:t})=>!t||F(e,`webhookSecret`)?!1:(F(e,`webhookUrl`)?B(e.webhookUrl):o).length>0):o.length>0:!1;if(P({value:r.webhookSecret,path:`channels.zalo.webhookSecret`,expected:`string`,defaults:e.defaults,context:e.context,active:s,inactiveReason:`no enabled Zalo webhook surface inherits this top-level webhookSecret (webhook mode is not active).`,apply:e=>{r.webhookSecret=e}}),i.hasExplicitAccounts){for(let{accountId:t,account:n,enabled:r}of i.accounts)if(F(n,`botToken`)&&P({value:n.botToken,path:`channels.zalo.accounts.${t}.botToken`,expected:`string`,defaults:e.defaults,context:e.context,active:r,inactiveReason:`Zalo account is disabled.`,apply:e=>{n.botToken=e}}),F(n,`webhookSecret`)){let i=F(n,`webhookUrl`)?B(n.webhookUrl):o;P({value:n.webhookSecret,path:`channels.zalo.accounts.${t}.webhookSecret`,expected:`string`,defaults:e.defaults,context:e.context,active:r&&i.length>0,inactiveReason:`Zalo account is disabled or webhook mode is not active for this account.`,apply:e=>{n.webhookSecret=e}})}}}function Ie(e){let n=e.config.channels;if(!t(n))return;let r=n.feishu;if(!t(r))return;let i=R(r);H({channelKey:`feishu`,field:`appSecret`,channel:r,surface:i,defaults:e.defaults,context:e.context,topInactiveReason:`no enabled account inherits this top-level Feishu appSecret.`,accountInactiveReason:`Feishu account is disabled.`});let a=B(r.connectionMode)===`webhook`?`webhook`:`websocket`,o=i.channelEnabled?i.hasExplicitAccounts?i.accounts.some(({account:e,enabled:t})=>!t||F(e,`verificationToken`)?!1:(F(e,`connectionMode`)?B(e.connectionMode):a)===`webhook`):a===`webhook`:!1;if(P({value:r.verificationToken,path:`channels.feishu.verificationToken`,expected:`string`,defaults:e.defaults,context:e.context,active:o,inactiveReason:`no enabled Feishu webhook-mode surface inherits this top-level verificationToken.`,apply:e=>{r.verificationToken=e}}),i.hasExplicitAccounts)for(let{accountId:t,account:n,enabled:r}of i.accounts){if(!F(n,`verificationToken`))continue;let i=F(n,`connectionMode`)?B(n.connectionMode):a;P({value:n.verificationToken,path:`channels.feishu.accounts.${t}.verificationToken`,expected:`string`,defaults:e.defaults,context:e.context,active:r&&i===`webhook`,inactiveReason:`Feishu account is disabled or not running in webhook mode.`,apply:e=>{n.verificationToken=e}})}}function Le(e){let n=e.config.channels;if(!t(n))return;let r=n[`nextcloud-talk`];if(!t(r))return;let i=R(r),a=i.channelEnabled?i.hasExplicitAccounts?i.accounts.some(({account:e,enabled:t})=>t&&!F(e,`botSecret`)):!0:!1;P({value:r.botSecret,path:`channels.nextcloud-talk.botSecret`,expected:`string`,defaults:e.defaults,context:e.context,active:a,inactiveReason:`no enabled Nextcloud Talk surface inherits this top-level botSecret.`,apply:e=>{r.botSecret=e}});let o=i.channelEnabled?i.hasExplicitAccounts?i.accounts.some(({account:e,enabled:t})=>t&&!F(e,`apiPassword`)):!0:!1;if(P({value:r.apiPassword,path:`channels.nextcloud-talk.apiPassword`,expected:`string`,defaults:e.defaults,context:e.context,active:o,inactiveReason:`no enabled Nextcloud Talk surface inherits this top-level apiPassword.`,apply:e=>{r.apiPassword=e}}),i.hasExplicitAccounts)for(let{accountId:t,account:n,enabled:r}of i.accounts)F(n,`botSecret`)&&P({value:n.botSecret,path:`channels.nextcloud-talk.accounts.${t}.botSecret`,expected:`string`,defaults:e.defaults,context:e.context,active:r,inactiveReason:`Nextcloud Talk account is disabled.`,apply:e=>{n.botSecret=e}}),F(n,`apiPassword`)&&P({value:n.apiPassword,path:`channels.nextcloud-talk.accounts.${t}.apiPassword`,expected:`string`,defaults:e.defaults,context:e.context,active:r,inactiveReason:`Nextcloud Talk account is disabled.`,apply:e=>{n.apiPassword=e}})}function U(e){let{explicitRef:t,ref:n}=o({value:e.target.serviceAccount,refValue:e.target.serviceAccountRef,defaults:e.defaults});if(n){if(e.active===!1){N({context:e.context,path:`${e.path}.serviceAccount`,details:e.inactiveReason});return}t&&e.target.serviceAccount!==void 0&&!s(e.target.serviceAccount,e.defaults)&&M(e.context,{code:`SECRETS_REF_OVERRIDES_PLAINTEXT`,path:e.path,message:`${e.path}: serviceAccountRef is set; runtime will ignore plaintext serviceAccount.`}),j(e.context,{ref:n,path:`${e.path}.serviceAccount`,expected:`string-or-object`,apply:t=>{e.target.serviceAccount=t}})}}function Re(e){let t=e.googleChat,n=R(t),r=n.channelEnabled?n.hasExplicitAccounts?n.accounts.some(({account:e,enabled:t})=>t&&!F(e,`serviceAccount`)&&!F(e,`serviceAccountRef`)):!0:!1;if(U({target:e.googleChat,path:`channels.googlechat`,defaults:e.defaults,context:e.context,active:r,inactiveReason:`no enabled account inherits this top-level Google Chat serviceAccount.`}),n.hasExplicitAccounts)for(let{accountId:t,account:r,enabled:i}of n.accounts)!F(r,`serviceAccount`)&&!F(r,`serviceAccountRef`)||U({target:r,path:`channels.googlechat.accounts.${t}`,defaults:e.defaults,context:e.context,active:i,inactiveReason:`Google Chat account is disabled.`})}function ze(e){let t=e.config.channels?.googlechat;t&&Re({googleChat:t,defaults:e.defaults,context:e.context}),De(e),Oe(e),ke(e),Ae(e),je(e),Ne(e),Pe(e),Me(e),Le(e),Ie(e),Fe(e)}const Be=[`gateway.auth.token`,`gateway.auth.password`,`gateway.remote.token`,`gateway.remote.password`];function Ve(e){return e??`unset`}function He(e){let t=[];return e.remoteMode&&t.push(`gateway.mode is "remote"`),e.remoteUrlConfigured&&t.push(`gateway.remote.url is configured`),e.tailscaleRemoteExposure&&t.push(`gateway.tailscale.mode is "serve" or "funnel"`),t.join(`; `)}function W(e){return{path:e.path,active:e.active,reason:e.reason,hasSecretRef:e.hasSecretRef}}function Ue(e){let n=e.config.gateway;if(!t(n))return{"gateway.auth.token":W({path:`gateway.auth.token`,active:!1,reason:`gateway configuration is not set.`,hasSecretRef:!1}),"gateway.auth.password":W({path:`gateway.auth.password`,active:!1,reason:`gateway configuration is not set.`,hasSecretRef:!1}),"gateway.remote.token":W({path:`gateway.remote.token`,active:!1,reason:`gateway configuration is not set.`,hasSecretRef:!1}),"gateway.remote.password":W({path:`gateway.remote.password`,active:!1,reason:`gateway configuration is not set.`,hasSecretRef:!1})};let i=t(n?.auth)?n.auth:void 0,a=t(n?.remote)?n.remote:void 0,o=r({config:e.config,env:e.env,includeLegacyEnv:!0,defaults:e.defaults}),s=i?o.passwordCanWin?o.authMode===`password`?`gateway.auth.mode is "password".`:`no token source can win, so password auth can win.`:o.authMode===`token`||o.authMode===`none`||o.authMode===`trusted-proxy`?`gateway.auth.mode is "${o.authMode}".`:o.envToken?`gateway token env var is configured.`:o.localToken.configured?`gateway.auth.token is configured.`:o.remoteToken.configured?`gateway.remote.token is configured.`:`token auth can win.`:`gateway.auth is not configured.`,c=i?o.authMode===`token`?o.envToken?`gateway token env var is configured.`:`gateway.auth.mode is "token".`:o.authMode===`password`||o.authMode===`none`||o.authMode===`trusted-proxy`?`gateway.auth.mode is "${o.authMode}".`:o.envToken?`gateway token env var is configured.`:o.envPassword?`gateway password env var is configured.`:o.localPassword.configured?`gateway.auth.password is configured.`:`token auth can win (mode is unset and no password source is configured).`:`gateway.auth is not configured.`,l=He({remoteMode:o.remoteMode,remoteUrlConfigured:o.remoteUrlConfigured,tailscaleRemoteExposure:o.tailscaleRemoteExposure}),u=a?o.remoteConfiguredSurface?`remote surface is active: ${l}.`:o.remoteTokenFallbackActive?`local token auth can win and no env/auth token is configured.`:o.localTokenCanWin?o.envToken?`gateway token env var is configured.`:o.localToken.configured?`gateway.auth.token is configured.`:`remote token fallback is not active.`:`token auth cannot win with gateway.auth.mode="${Ve(o.authMode)}".`:`gateway.remote is not configured.`,d=a?o.remoteConfiguredSurface?`remote surface is active: ${l}.`:o.remotePasswordFallbackActive?`password auth can win and no env/auth password is configured.`:o.passwordCanWin?o.envPassword?`gateway password env var is configured.`:o.localPassword.configured?`gateway.auth.password is configured.`:`remote password fallback is not active.`:o.authMode===`token`||o.authMode===`none`||o.authMode===`trusted-proxy`?`password auth cannot win with gateway.auth.mode="${o.authMode}".`:`a token source can win, so password auth cannot win.`:`gateway.remote is not configured.`;return{"gateway.auth.token":W({path:`gateway.auth.token`,active:o.localTokenSurfaceActive,reason:c,hasSecretRef:o.localToken.hasSecretRef}),"gateway.auth.password":W({path:`gateway.auth.password`,active:o.passwordCanWin,reason:s,hasSecretRef:o.localPassword.hasSecretRef}),"gateway.remote.token":W({path:`gateway.remote.token`,active:o.remoteTokenActive,reason:u,hasSecretRef:o.remoteToken.hasSecretRef}),"gateway.remote.password":W({path:`gateway.remote.password`,active:o.remotePasswordActive,reason:d,hasSecretRef:o.remotePassword.hasSecretRef})}}function We(e){for(let[n,r]of Object.entries(e.providers)){let i=r.enabled!==!1;P({value:r.apiKey,path:`models.providers.${n}.apiKey`,expected:`string`,defaults:e.defaults,context:e.context,active:i,inactiveReason:`provider is disabled.`,apply:e=>{r.apiKey=e}});let a=t(r.headers)?r.headers:void 0;if(a)for(let[t,r]of Object.entries(a))P({value:r,path:`models.providers.${n}.headers.${t}`,expected:`string`,defaults:e.defaults,context:e.context,active:i,inactiveReason:`provider is disabled.`,apply:e=>{a[t]=e}})}}function Ge(e){for(let[t,n]of Object.entries(e.entries))P({value:n.apiKey,path:`skills.entries.${t}.apiKey`,expected:`string`,defaults:e.defaults,context:e.context,active:n.enabled!==!1,inactiveReason:`skill entry is disabled.`,apply:e=>{n.apiKey=e}})}function Ke(e){let n=e.config.agents;if(!t(n))return;let r=t(n.defaults)?n.defaults:void 0,i=t(r?.memorySearch)?r.memorySearch:void 0,a=i?.enabled!==!1,o=Array.isArray(n.list)?n.list:[],s=!1;for(let e of o){if(!t(e)||e.enabled===!1)continue;let n=t(e.memorySearch)?e.memorySearch:void 0;if(n?.enabled===!1)continue;if(!n||!Object.prototype.hasOwnProperty.call(n,`remote`)){s=!0;continue}let r=t(n.remote)?n.remote:void 0;if(!r||!Object.prototype.hasOwnProperty.call(r,`apiKey`)){s=!0;continue}}if(i&&t(i.remote)){let t=i.remote;P({value:t.apiKey,path:`agents.defaults.memorySearch.remote.apiKey`,expected:`string`,defaults:e.defaults,context:e.context,active:a&&(s||o.length===0),inactiveReason:s?void 0:`all enabled agents override memorySearch.remote.apiKey.`,apply:e=>{t.apiKey=e}})}o.forEach((n,r)=>{if(!t(n))return;let i=t(n.memorySearch)?n.memorySearch:void 0;if(!i)return;let a=t(i.remote)?i.remote:void 0;if(!a||!Object.prototype.hasOwnProperty.call(a,`apiKey`))return;let o=n.enabled!==!1&&i.enabled!==!1;P({value:a.apiKey,path:`agents.list.${r}.memorySearch.remote.apiKey`,expected:`string`,defaults:e.defaults,context:e.context,active:o,inactiveReason:`agent or memorySearch override is disabled.`,apply:e=>{a.apiKey=e}})})}function qe(e){let n=e.config.talk;if(!t(n))return;P({value:n.apiKey,path:`talk.apiKey`,expected:`string`,defaults:e.defaults,context:e.context,apply:e=>{n.apiKey=e}});let r=n.providers;if(t(r))for(let[n,i]of Object.entries(r))t(i)&&P({value:i.apiKey,path:`talk.providers.${n}.apiKey`,expected:`string`,defaults:e.defaults,context:e.context,apply:e=>{i.apiKey=e}})}function Je(e){let n=e.config.gateway;if(!t(n))return;let r=t(n.auth)?n.auth:void 0,i=t(n.remote)?n.remote:void 0,a=Ue({config:e.config,env:e.context.env,defaults:e.defaults});r&&(P({value:r.token,path:`gateway.auth.token`,expected:`string`,defaults:e.defaults,context:e.context,active:a[`gateway.auth.token`].active,inactiveReason:a[`gateway.auth.token`].reason,apply:e=>{r.token=e}}),P({value:r.password,path:`gateway.auth.password`,expected:`string`,defaults:e.defaults,context:e.context,active:a[`gateway.auth.password`].active,inactiveReason:a[`gateway.auth.password`].reason,apply:e=>{r.password=e}})),i&&(P({value:i.token,path:`gateway.remote.token`,expected:`string`,defaults:e.defaults,context:e.context,active:a[`gateway.remote.token`].active,inactiveReason:a[`gateway.remote.token`].reason,apply:e=>{i.token=e}}),P({value:i.password,path:`gateway.remote.password`,expected:`string`,defaults:e.defaults,context:e.context,active:a[`gateway.remote.password`].active,inactiveReason:a[`gateway.remote.password`].reason,apply:e=>{i.password=e}}))}function Ye(e){let n=e.config.messages;!t(n)||!t(n.tts)||L({tts:n.tts,pathPrefix:`messages.tts`,defaults:e.defaults,context:e.context})}function Xe(e){let n=e.config.cron;t(n)&&P({value:n.webhookToken,path:`cron.webhookToken`,expected:`string`,defaults:e.defaults,context:e.context,apply:e=>{n.webhookToken=e}})}function Ze(e){let t=e.config.models?.providers;t&&We({providers:t,defaults:e.defaults,context:e.context});let n=e.config.skills?.entries;n&&Ge({entries:n,defaults:e.defaults,context:e.context}),Ke(e),qe(e),Je(e),Ye(e),Xe(e)}function Qe(e){let t=e.context.sourceConfig.secrets?.defaults;Ze({config:e.config,defaults:t,context:e.context}),ze({config:e.config,defaults:t,context:e.context})}const G=[`brave`,`gemini`,`grok`,`kimi`,`perplexity`],$e=`https://api.perplexity.ai`,K=`https://openrouter.ai/api/v1`,et=[`pplx-`],tt=[`sk-or-`];function q(e){return typeof e==`object`&&!!e&&!Array.isArray(e)}function nt(e){if(typeof e!=`string`)return;let t=e.trim().toLowerCase();if(t===`brave`||t===`gemini`||t===`grok`||t===`kimi`||t===`perplexity`)return t}function J(e,t){for(let n of t){let t=a(e[n]);if(t)return{value:t,envVar:n}}return{}}function Y(e){return e.kind===`non-string`?`${e.path} SecretRef resolved to a non-string value.`:e.kind===`empty`?`${e.path} SecretRef resolved to an empty value.`:`${e.path} SecretRef is unresolved (${e.refLabel}).`}async function rt(e){let{ref:t}=o({value:e.value,defaults:e.defaults});if(!t){let t=a(e.value);if(t)return{value:t,source:`config`,secretRefConfigured:!1,fallbackUsedAfterRefFailure:!1};let n=J(e.context.env,e.envVars);return n.value?{value:n.value,source:`env`,fallbackEnvVar:n.envVar,secretRefConfigured:!1,fallbackUsedAfterRefFailure:!1}:{source:`missing`,secretRefConfigured:!1,fallbackUsedAfterRefFailure:!1}}let r=`${t.source}:${t.provider}:${t.id}`,i,s;try{let o=(await n([t],{config:e.sourceConfig,env:e.context.env,cache:e.context.cache})).get(c(t));typeof o==`string`?(i=a(o),i||(s=Y({path:e.path,kind:`empty`,refLabel:r}))):s=Y({path:e.path,kind:`non-string`,refLabel:r})}catch{s=Y({path:e.path,kind:`unresolved`,refLabel:r})}if(i)return{value:i,source:`secretRef`,secretRefConfigured:!0,fallbackUsedAfterRefFailure:!1};let l=J(e.context.env,e.envVars);return l.value?{value:l.value,source:`env`,fallbackEnvVar:l.envVar,unresolvedRefReason:s,secretRefConfigured:!0,fallbackUsedAfterRefFailure:!0}:{source:`missing`,unresolvedRefReason:s,secretRefConfigured:!0,fallbackUsedAfterRefFailure:!1}}function it(e){if(!e)return;let t=e.toLowerCase();if(et.some(e=>t.startsWith(e)))return`direct`;if(tt.some(e=>t.startsWith(e)))return`openrouter`}function at(e){let t=q(e.configValue)?e.configValue:void 0,n=typeof t?.baseUrl==`string`?t.baseUrl.trim():``,r=typeof t?.model==`string`?t.model.trim():``,i=(()=>{if(n)return n;if(e.keySource===`env`){if(e.fallbackEnvVar===`PERPLEXITY_API_KEY`)return $e;if(e.fallbackEnvVar===`OPENROUTER_API_KEY`)return K}return(e.keySource===`config`||e.keySource===`secretRef`)&&e.keyValue?it(e.keyValue)===`openrouter`?K:$e:K})(),a=!!(n||r),o=(()=>{try{return new URL(i).hostname.toLowerCase()===`api.perplexity.ai`}catch{return!1}})();return a||!o?`chat_completions`:`search_api`}function X(e,t){let n=e[t];if(q(n))return n;let r={};return e[t]=r,r}function Z(e){let t=X(X(X(e.resolvedConfig,`tools`),`web`),`search`);if(e.provider===`brave`){t.apiKey=e.value;return}let n=X(t,e.provider);n.apiKey=e.value}function ot(e){let t=X(X(X(X(e.resolvedConfig,`tools`),`web`),`fetch`),`firecrawl`);t.apiKey=e.value}function st(e){return e===`brave`?[`BRAVE_API_KEY`]:e===`gemini`?[`GEMINI_API_KEY`]:e===`grok`?[`XAI_API_KEY`]:e===`kimi`?[`KIMI_API_KEY`,`MOONSHOT_API_KEY`]:[`PERPLEXITY_API_KEY`,`OPENROUTER_API_KEY`]}function Q(e,t){if(t===`brave`)return e.apiKey;let n=e[t];if(q(n))return n.apiKey}function $(e,t){return!!o({value:e,defaults:t}).ref}async function ct(e){let t=e.sourceConfig.secrets?.defaults,n=[],r=q(e.sourceConfig.tools)?e.sourceConfig.tools:void 0,i=q(r?.web)?r.web:void 0,o=q(i?.search)?i.search:void 0,s={providerSource:`none`,diagnostics:[]},c=o?.enabled!==!1,l=typeof o?.provider==`string`?o.provider.trim().toLowerCase():``,u=nt(l);if(l&&!u){let t={code:`WEB_SEARCH_PROVIDER_INVALID_AUTODETECT`,message:`tools.web.search.provider is "${l}". Falling back to auto-detect precedence.`,path:`tools.web.search.provider`};n.push(t),s.diagnostics.push(t),M(e.context,{code:`WEB_SEARCH_PROVIDER_INVALID_AUTODETECT`,path:`tools.web.search.provider`,message:t.message})}if(u&&(s.providerConfigured=u,s.providerSource=`configured`),c&&o){let r=u?[u]:[...G],i=[],a,c;for(let l of r){let r=l===`brave`?`tools.web.search.apiKey`:`tools.web.search.${l}.apiKey`,d=Q(o,l),f=await rt({sourceConfig:e.sourceConfig,context:e.context,defaults:t,value:d,path:r,envVars:st(l)});if(f.secretRefConfigured&&f.fallbackUsedAfterRefFailure){let t={code:`WEB_SEARCH_KEY_UNRESOLVED_FALLBACK_USED`,message:`${r} SecretRef could not be resolved; using ${f.fallbackEnvVar??`env fallback`}. `+(f.unresolvedRefReason??``).trim(),path:r};n.push(t),s.diagnostics.push(t),M(e.context,{code:`WEB_SEARCH_KEY_UNRESOLVED_FALLBACK_USED`,path:r,message:t.message})}if(f.secretRefConfigured&&!f.value&&f.unresolvedRefReason&&i.push({provider:l,path:r,reason:f.unresolvedRefReason}),u){a=l,c=f,f.value&&Z({resolvedConfig:e.resolvedConfig,provider:l,value:f.value});break}if(f.value){a=l,c=f,Z({resolvedConfig:e.resolvedConfig,provider:l,value:f.value});break}}if(u){let t=i[0];if(t){let r={code:`WEB_SEARCH_KEY_UNRESOLVED_NO_FALLBACK`,message:t.reason,path:t.path};throw n.push(r),s.diagnostics.push(r),M(e.context,{code:`WEB_SEARCH_KEY_UNRESOLVED_NO_FALLBACK`,path:t.path,message:t.reason}),Error(`[WEB_SEARCH_KEY_UNRESOLVED_NO_FALLBACK] ${t.reason}`)}}else{if(!a&&i.length>0){let t=i[0],r={code:`WEB_SEARCH_KEY_UNRESOLVED_NO_FALLBACK`,message:t.reason,path:t.path};throw n.push(r),s.diagnostics.push(r),M(e.context,{code:`WEB_SEARCH_KEY_UNRESOLVED_NO_FALLBACK`,path:t.path,message:t.reason}),Error(`[WEB_SEARCH_KEY_UNRESOLVED_NO_FALLBACK] ${t.reason}`)}if(a){let e={code:`WEB_SEARCH_AUTODETECT_SELECTED`,message:`tools.web.search auto-detected provider "${a}" from available credentials.`,path:`tools.web.search.provider`};n.push(e),s.diagnostics.push(e)}}a&&(s.selectedProvider=a,s.selectedProviderKeySource=c?.source,u||(s.providerSource=`auto-detect`),a===`perplexity`&&(s.perplexityTransport=at({keyValue:c?.value,keySource:c?.source??`missing`,fallbackEnvVar:c?.fallbackEnvVar,configValue:o.perplexity})))}if(c&&o&&!u&&s.selectedProvider)for(let n of G){if(n===s.selectedProvider)continue;let r=n===`brave`?`tools.web.search.apiKey`:`tools.web.search.${n}.apiKey`;$(Q(o,n),t)&&N({context:e.context,path:r,details:`tools.web.search auto-detected provider is "${s.selectedProvider}".`})}else if(o&&!c)for(let n of G){let r=n===`brave`?`tools.web.search.apiKey`:`tools.web.search.${n}.apiKey`;$(Q(o,n),t)&&N({context:e.context,path:r,details:`tools.web.search is disabled.`})}if(c&&o&&u)for(let n of G){if(n===u)continue;let r=n===`brave`?`tools.web.search.apiKey`:`tools.web.search.${n}.apiKey`;$(Q(o,n),t)&&N({context:e.context,path:r,details:`tools.web.search.provider is "${u}".`})}let d=q(i?.fetch)?i.fetch:void 0,f=q(d?.firecrawl)?d.firecrawl:void 0,p=d?.enabled!==!1,m=f?.enabled!==!1,h=!!(p&&m),g=`tools.web.fetch.firecrawl.apiKey`,_={source:`missing`,secretRefConfigured:!1,fallbackUsedAfterRefFailure:!1},v=[];if(h){if(_=await rt({sourceConfig:e.sourceConfig,context:e.context,defaults:t,value:f?.apiKey,path:g,envVars:[`FIRECRAWL_API_KEY`]}),_.value&&ot({resolvedConfig:e.resolvedConfig,value:_.value}),_.secretRefConfigured){if(_.fallbackUsedAfterRefFailure){let t={code:`WEB_FETCH_FIRECRAWL_KEY_UNRESOLVED_FALLBACK_USED`,message:`${g} SecretRef could not be resolved; using ${_.fallbackEnvVar??`env fallback`}. `+(_.unresolvedRefReason??``).trim(),path:g};n.push(t),v.push(t),M(e.context,{code:`WEB_FETCH_FIRECRAWL_KEY_UNRESOLVED_FALLBACK_USED`,path:g,message:t.message})}if(!_.value&&_.unresolvedRefReason){let t={code:`WEB_FETCH_FIRECRAWL_KEY_UNRESOLVED_NO_FALLBACK`,message:_.unresolvedRefReason,path:g};throw n.push(t),v.push(t),M(e.context,{code:`WEB_FETCH_FIRECRAWL_KEY_UNRESOLVED_NO_FALLBACK`,path:g,message:_.unresolvedRefReason}),Error(`[WEB_FETCH_FIRECRAWL_KEY_UNRESOLVED_NO_FALLBACK] ${_.unresolvedRefReason}`)}}}else if($(f?.apiKey,t))N({context:e.context,path:g,details:p?`tools.web.fetch.firecrawl.enabled is false.`:`tools.web.fetch is disabled.`}),_={source:`secretRef`,secretRefConfigured:!0,fallbackUsedAfterRefFailure:!1};else{let t=a(f?.apiKey);if(t)_={value:t,source:`config`,secretRefConfigured:!1,fallbackUsedAfterRefFailure:!1};else{let t=J(e.context.env,[`FIRECRAWL_API_KEY`]);t.value&&(_={value:t.value,source:`env`,fallbackEnvVar:t.envVar,secretRefConfigured:!1,fallbackUsedAfterRefFailure:!1})}}return{search:s,fetch:{firecrawl:{active:h,apiKeySource:_.source,diagnostics:v}},diagnostics:n}}export{m as C,_ as S,g as T,he as _,Te as a,ee as b,M as c,be as d,ye as f,Se as g,ge as h,Ue as i,A as l,_e as m,Qe as n,we as o,k as p,Be as r,j as s,ct as t,Ce as u,ve as v,h as w,v as x,y};
-//# sourceMappingURL=runtime-web-tools-C4F6aaRh.js.map

package/dist/sandbox-cli-BR0Lsru-.js

@@ -6,4 +6,3 @@ Containers to be recreated:
 Containers will be automatically recreated when the agent is next used.`)}async function V(e,t){let n=e.browser?[]:await m().catch(()=>[]),r=e.browser?await l().catch(()=>[]):[];if(e.json){t.log(JSON.stringify({containers:n,browsers:r},null,2));return}e.browser?L(r,t):I(n,t),R(n,r,t)}async function H(e,t){if(!U(e,t))return;let n=await W(e);if(n.containers.length+n.browsers.length===0){t.log(`No containers found matching the criteria.`);return}if(z(n.containers,n.browsers,t),!e.force&&!await K()){t.log(`Cancelled.`);return}let r=await q(n,t);B(r,t),r.failCount>0&&t.exit(1)}function U(e,t){return!e.all&&!e.session&&!e.agent?(t.error(`Please specify --all, --session <key>, or --agent <id>`),t.exit(1),!1):[e.all,e.session,e.agent].filter(Boolean).length>1?(t.error(`Please specify only one of: --all, --session, --agent`),t.exit(1),!1):!0}async function W(e){let t=await m().catch(()=>[]),n=await l().catch(()=>[]),r=e.browser?[]:t,i=e.browser?n:[];if(e.session)r=r.filter(t=>t.sessionKey===e.session),i=i.filter(t=>t.sessionKey===e.session);else if(e.agent){let t=G(e.agent);r=r.filter(t),i=i.filter(t)}return{containers:r,browsers:i}}function G(e){let t=`agent:${e}`;return e=>e.sessionKey===t||e.sessionKey.startsWith(`${t}:`)}async function K(){let e=await D({message:`This will stop and remove these containers. Continue?`,initialValue:!1});return e!==!1&&e!==Symbol.for(`clack:cancel`)}async function q(e,t){t.log(`
 Removing containers...
 `);let n=0,r=0;for(let i of e.containers)(await J(i.containerName,u,t)).success?n++:r++;for(let i of e.browsers)(await J(i.containerName,p,t)).success?n++:r++;return{successCount:n,failCount:r}}async function J(e,t,n){try{return await t(e),n.log(`✓ Removed ${e}`),{success:!0}}catch(t){return n.error(`✗ Failed to remove ${e}: ${String(t)}`),{success:!1}}}const Y={main:[[`openclaw sandbox list`,`List all sandbox containers.`],[`openclaw sandbox list --browser`,`List only browser containers.`],[`openclaw sandbox recreate --all`,`Recreate all containers.`],[`openclaw sandbox recreate --session main`,`Recreate a specific session.`],[`openclaw sandbox recreate --agent mybot`,`Recreate agent containers.`],[`openclaw sandbox explain`,`Explain effective sandbox config.`]],list:[[`openclaw sandbox list`,`List all sandbox containers.`],[`openclaw sandbox list --browser`,`List only browser containers.`],[`openclaw sandbox list --json`,`JSON output.`]],recreate:[[`openclaw sandbox recreate --all`,`Recreate all containers.`],[`openclaw sandbox recreate --session main`,`Recreate a specific session.`],[`openclaw sandbox recreate --agent mybot`,`Recreate a specific agent (includes sub-agents).`],[`openclaw sandbox recreate --browser --all`,`Recreate only browser containers.`],[`openclaw sandbox recreate --all --force`,`Skip confirmation.`]],explain:[[`openclaw sandbox explain`,`Show effective sandbox config.`],[`openclaw sandbox explain --session agent:main:main`,`Explain a specific session.`],[`openclaw sandbox explain --agent work`,`Explain an agent sandbox.`],[`openclaw sandbox explain --json`,`JSON output.`]]};function X(e){return async t=>{try{await e(t,r)}catch(e){r.error(String(e)),r.exit(1)}}}function Z(t){let n=t.command(`sandbox`).description(`Manage sandbox containers (Docker-based agent isolation)`).addHelpText(`after`,()=>`\n${e.heading(`Examples:`)}\n${E(Y.main)}\n`).addHelpText(`after`,()=>`\n${e.muted(`Docs:`)} ${T(`/cli/sandbox`,`docs.openclaw.ai/cli/sandbox`)}\n`).action(()=>{n.help({error:!0})});n.command(`list`).description(`List sandbox containers and their status`).option(`--json`,`Output result as JSON`,!1).option(`--browser`,`List browser containers only`,!1).addHelpText(`after`,()=>`\n${e.heading(`Examples:`)}\n${E(Y.list)}\n\n${e.heading(`Output includes:`)}\n${e.muted(`- Container name and status (running/stopped)`)}\n${e.muted(`- Docker image and whether it matches current config`)}\n${e.muted(`- Age (time since creation)`)}\n${e.muted(`- Idle time (time since last use)`)}\n${e.muted(`- Associated session/agent ID`)}`).action(X(e=>V({browser:!!e.browser,json:!!e.json},r))),n.command(`recreate`).description(`Remove containers to force recreation with updated config`).option(`--all`,`Recreate all sandbox containers`,!1).option(`--session <key>`,`Recreate container for specific session`).option(`--agent <id>`,`Recreate containers for specific agent`).option(`--browser`,`Only recreate browser containers`,!1).option(`--force`,`Skip confirmation prompt`,!1).addHelpText(`after`,()=>`\n${e.heading(`Examples:`)}\n${E(Y.recreate)}\n\n${e.heading(`Why use this?`)}\n${e.muted(`After updating Docker images or sandbox configuration, existing containers continue running with old settings.`)}\n${e.muted(`This command removes them so they'll be recreated automatically with current config when next needed.`)}\n\n${e.heading(`Filter options:`)}\n${e.muted(`  --all          Remove all sandbox containers`)}\n${e.muted(`  --session      Remove container for specific session key`)}\n${e.muted(`  --agent        Remove containers for agent (includes agent:id:* variants)`)}\n\n${e.heading(`Modifiers:`)}\n${e.muted(`  --browser      Only affect browser containers (not regular sandbox)`)}\n${e.muted(`  --force        Skip confirmation prompt`)}`).action(X(e=>H({all:!!e.all,session:e.session,agent:e.agent,browser:!!e.browser,force:!!e.force},r))),n.command(`explain`).description(`Explain effective sandbox/tool policy for a session/agent`).option(`--session <key>`,`Session key to inspect (defaults to agent main)`).option(`--agent <id>`,`Agent id to inspect (defaults to derived agent)`).option(`--json`,`Output result as JSON`,!1).addHelpText(`after`,()=>`\n${e.heading(`Examples:`)}\n${E(Y.explain)}\n`).action(X(e=>j({session:e.session,agent:e.agent,json:!!e.json},r)))}export{Z as registerSandboxCli};
-//# sourceMappingURL=sandbox-cli-BR0Lsru-.js.map

package/dist/sandbox-cli-Jo5nYeug.js

@@ -6,4 +6,3 @@ Containers to be recreated:
 Containers will be automatically recreated when the agent is next used.`)}async function V(e,t){let n=e.browser?[]:await p().catch(()=>[]),r=e.browser?await a().catch(()=>[]):[];if(e.json){t.log(JSON.stringify({containers:n,browsers:r},null,2));return}e.browser?L(r,t):I(n,t),R(n,r,t)}async function H(e,t){if(!U(e,t))return;let n=await W(e);if(n.containers.length+n.browsers.length===0){t.log(`No containers found matching the criteria.`);return}if(z(n.containers,n.browsers,t),!e.force&&!await K()){t.log(`Cancelled.`);return}let r=await q(n,t);B(r,t),r.failCount>0&&t.exit(1)}function U(e,t){return!e.all&&!e.session&&!e.agent?(t.error(`Please specify --all, --session <key>, or --agent <id>`),t.exit(1),!1):[e.all,e.session,e.agent].filter(Boolean).length>1?(t.error(`Please specify only one of: --all, --session, --agent`),t.exit(1),!1):!0}async function W(e){let t=await p().catch(()=>[]),n=await a().catch(()=>[]),r=e.browser?[]:t,i=e.browser?n:[];if(e.session)r=r.filter(t=>t.sessionKey===e.session),i=i.filter(t=>t.sessionKey===e.session);else if(e.agent){let t=G(e.agent);r=r.filter(t),i=i.filter(t)}return{containers:r,browsers:i}}function G(e){let t=`agent:${e}`;return e=>e.sessionKey===t||e.sessionKey.startsWith(`${t}:`)}async function K(){let e=await D({message:`This will stop and remove these containers. Continue?`,initialValue:!1});return e!==!1&&e!==Symbol.for(`clack:cancel`)}async function q(e,t){t.log(`
 Removing containers...
 `);let n=0,r=0;for(let i of e.containers)(await J(i.containerName,o,t)).success?n++:r++;for(let i of e.browsers)(await J(i.containerName,l,t)).success?n++:r++;return{successCount:n,failCount:r}}async function J(e,t,n){try{return await t(e),n.log(`✓ Removed ${e}`),{success:!0}}catch(t){return n.error(`✗ Failed to remove ${e}: ${String(t)}`),{success:!1}}}const Y={main:[[`openclaw sandbox list`,`List all sandbox containers.`],[`openclaw sandbox list --browser`,`List only browser containers.`],[`openclaw sandbox recreate --all`,`Recreate all containers.`],[`openclaw sandbox recreate --session main`,`Recreate a specific session.`],[`openclaw sandbox recreate --agent mybot`,`Recreate agent containers.`],[`openclaw sandbox explain`,`Explain effective sandbox config.`]],list:[[`openclaw sandbox list`,`List all sandbox containers.`],[`openclaw sandbox list --browser`,`List only browser containers.`],[`openclaw sandbox list --json`,`JSON output.`]],recreate:[[`openclaw sandbox recreate --all`,`Recreate all containers.`],[`openclaw sandbox recreate --session main`,`Recreate a specific session.`],[`openclaw sandbox recreate --agent mybot`,`Recreate a specific agent (includes sub-agents).`],[`openclaw sandbox recreate --browser --all`,`Recreate only browser containers.`],[`openclaw sandbox recreate --all --force`,`Skip confirmation.`]],explain:[[`openclaw sandbox explain`,`Show effective sandbox config.`],[`openclaw sandbox explain --session agent:main:main`,`Explain a specific session.`],[`openclaw sandbox explain --agent work`,`Explain an agent sandbox.`],[`openclaw sandbox explain --json`,`JSON output.`]]};function X(e){return async t=>{try{await e(t,r)}catch(e){r.error(String(e)),r.exit(1)}}}function Z(t){let n=t.command(`sandbox`).description(`Manage sandbox containers (Docker-based agent isolation)`).addHelpText(`after`,()=>`\n${e.heading(`Examples:`)}\n${E(Y.main)}\n`).addHelpText(`after`,()=>`\n${e.muted(`Docs:`)} ${T(`/cli/sandbox`,`docs.openclaw.ai/cli/sandbox`)}\n`).action(()=>{n.help({error:!0})});n.command(`list`).description(`List sandbox containers and their status`).option(`--json`,`Output result as JSON`,!1).option(`--browser`,`List browser containers only`,!1).addHelpText(`after`,()=>`\n${e.heading(`Examples:`)}\n${E(Y.list)}\n\n${e.heading(`Output includes:`)}\n${e.muted(`- Container name and status (running/stopped)`)}\n${e.muted(`- Docker image and whether it matches current config`)}\n${e.muted(`- Age (time since creation)`)}\n${e.muted(`- Idle time (time since last use)`)}\n${e.muted(`- Associated session/agent ID`)}`).action(X(e=>V({browser:!!e.browser,json:!!e.json},r))),n.command(`recreate`).description(`Remove containers to force recreation with updated config`).option(`--all`,`Recreate all sandbox containers`,!1).option(`--session <key>`,`Recreate container for specific session`).option(`--agent <id>`,`Recreate containers for specific agent`).option(`--browser`,`Only recreate browser containers`,!1).option(`--force`,`Skip confirmation prompt`,!1).addHelpText(`after`,()=>`\n${e.heading(`Examples:`)}\n${E(Y.recreate)}\n\n${e.heading(`Why use this?`)}\n${e.muted(`After updating Docker images or sandbox configuration, existing containers continue running with old settings.`)}\n${e.muted(`This command removes them so they'll be recreated automatically with current config when next needed.`)}\n\n${e.heading(`Filter options:`)}\n${e.muted(`  --all          Remove all sandbox containers`)}\n${e.muted(`  --session      Remove container for specific session key`)}\n${e.muted(`  --agent        Remove containers for agent (includes agent:id:* variants)`)}\n\n${e.heading(`Modifiers:`)}\n${e.muted(`  --browser      Only affect browser containers (not regular sandbox)`)}\n${e.muted(`  --force        Skip confirmation prompt`)}`).action(X(e=>H({all:!!e.all,session:e.session,agent:e.agent,browser:!!e.browser,force:!!e.force},r))),n.command(`explain`).description(`Explain effective sandbox/tool policy for a session/agent`).option(`--session <key>`,`Session key to inspect (defaults to agent main)`).option(`--agent <id>`,`Agent id to inspect (defaults to derived agent)`).option(`--json`,`Output result as JSON`,!1).addHelpText(`after`,()=>`\n${e.heading(`Examples:`)}\n${E(Y.explain)}\n`).action(X(e=>j({session:e.session,agent:e.agent,json:!!e.json},r)))}export{Z as registerSandboxCli};
-//# sourceMappingURL=sandbox-cli-Jo5nYeug.js.map

package/dist/scan-paths-C13EseXp.js

@@ -1,2 +1 @@
 import e from"node:fs";import t from"node:path";function n(e,n){let r=t.resolve(e),i=t.resolve(n),a=t.relative(r,i);return a===``||!a.startsWith(`..${t.sep}`)&&a!==`..`&&!t.isAbsolute(a)}function r(t){try{return e.realpathSync(t)}catch{return null}}function i(e,t,i){if(!n(e,t))return!1;let a=r(e),o=r(t);return!a||!o?i?.requireRealpath!==!0:n(a,o)}function a(e){return e.split(/[\\/]+/).filter(Boolean).some(e=>e===`node_modules`||e.startsWith(`.`)&&e!==`.`&&e!==`..`)}export{n,i as r,a as t};
-//# sourceMappingURL=scan-paths-C13EseXp.js.map

package/dist/scan-paths-CWtvWW40.js

@@ -1,2 +1 @@
 import e from"node:path";import t from"node:fs";function n(t,n){let r=e.resolve(t),i=e.resolve(n),a=e.relative(r,i);return a===``||!a.startsWith(`..${e.sep}`)&&a!==`..`&&!e.isAbsolute(a)}function r(e){try{return t.realpathSync(e)}catch{return null}}function i(e,t,i){if(!n(e,t))return!1;let a=r(e),o=r(t);return!a||!o?i?.requireRealpath!==!0:n(a,o)}function a(e){return e.split(/[\\/]+/).filter(Boolean).some(e=>e===`node_modules`||e.startsWith(`.`)&&e!==`.`&&e!==`..`)}export{n,i as r,a as t};
-//# sourceMappingURL=scan-paths-CWtvWW40.js.map

package/dist/search-manager-CV2YsAym.js

@@ -1,2 +1 @@
 import{t as e}from"./rolldown-runtime-CNxR59P3.js";import{t}from"./subsystem-BLbY429l.js";import{d as n}from"./agent-scope-DAWJwFfl.js";import{v as r}from"./utils-CGdo13HV.js";import{n as i,t as a}from"./parse-duration-XTjMKl8s.js";import o from"node:path";const s={maxResults:6,maxSnippetChars:700,maxInjectedChars:4e3,timeoutMs:4e3},c={enabled:!1,serverName:`qmd`,startDaemon:!0},l={default:`deny`,rules:[{action:`allow`,match:{chatType:`direct`}}]};function u(e){return e.toLowerCase().replace(/[^a-z0-9-]+/g,`-`).replace(/^-+|-+$/g,``)||`collection`}function d(e,t){return`${e}-${u(t)}`}function f(e,t){let n=u(e);if(!t.has(n))return t.add(n),n;let r=2;for(;t.has(`${n}-${r}`);)r+=1;let i=`${n}-${r}`;return t.add(i),i}function p(e,t){let n=e.trim();if(!n)throw Error(`path required`);return n.startsWith(`~`)||o.isAbsolute(n)?o.normalize(r(n)):o.normalize(o.resolve(t,n))}function m(e){let t=e?.trim();if(!t)return a(`5m`,{defaultUnit:`m`});try{return a(t,{defaultUnit:`m`})}catch{return a(`5m`,{defaultUnit:`m`})}}function h(e){let t=e?.trim();if(!t)return a(`60m`,{defaultUnit:`m`});try{return a(t,{defaultUnit:`m`})}catch{return a(`60m`,{defaultUnit:`m`})}}function g(e){return typeof e==`number`&&Number.isFinite(e)&&e>=0?Math.floor(e):15e3}function _(e,t){return typeof e==`number`&&Number.isFinite(e)&&e>0?Math.floor(e):t}function v(e){let t={...s};return e?.maxResults&&e.maxResults>0&&(t.maxResults=Math.floor(e.maxResults)),e?.maxSnippetChars&&e.maxSnippetChars>0&&(t.maxSnippetChars=Math.floor(e.maxSnippetChars)),e?.maxInjectedChars&&e.maxInjectedChars>0&&(t.maxInjectedChars=Math.floor(e.maxInjectedChars)),e?.timeoutMs&&e.timeoutMs>0&&(t.timeoutMs=Math.floor(e.timeoutMs)),t}function y(e){return e===`search`||e===`vsearch`||e===`query`?e:`search`}function b(e,t){let n=!!e?.enabled,r=e?.exportDir?.trim();return{enabled:n,exportDir:r?p(r,t):void 0,retentionDays:e?.retentionDays&&e.retentionDays>0?Math.floor(e.retentionDays):void 0}}function x(e,t,n,r){if(!e?.length)return[];let i=[];return e.forEach((e,a)=>{let o=e?.path?.trim();if(!o)return;let s;try{s=p(o,t)}catch{return}let c=e.pattern?.trim()||`**/*.md`,l=f(d(e.name?.trim()||`custom-${a+1}`,r),n);i.push({name:l,path:s,pattern:c,kind:`custom`})}),i}function S(e){let t={...c};return e?(e.enabled!==void 0&&(t.enabled=e.enabled),typeof e.serverName==`string`&&e.serverName.trim()&&(t.serverName=e.serverName.trim()),e.startDaemon!==void 0&&(t.startDaemon=e.startDaemon),t.enabled&&e.startDaemon===void 0&&(t.startDaemon=!0),t):t}function C(e,t,n,r){return e?[{path:t,pattern:`MEMORY.md`,base:`memory-root`},{path:t,pattern:`memory.md`,base:`memory-alt`},{path:o.join(t,`memory`),pattern:`**/*.md`,base:`memory-dir`}].map(e=>({name:f(d(e.base,r),n),path:e.path,pattern:e.pattern,kind:`memory`})):[]}function w(e){let t=e.cfg.memory?.backend??`builtin`,r=e.cfg.memory?.citations??`auto`;if(t!==`qmd`)return{backend:`builtin`,citations:r};let a=n(e.cfg,e.agentId),o=e.cfg.memory?.qmd,s=o?.includeDefaultMemory!==!1,c=new Set,u=[...C(s,a,c,e.agentId),...x(o?.paths,a,c,e.agentId)],d=o?.command?.trim()||`qmd`;return{backend:`qmd`,citations:r,qmd:{command:i(d)?.[0]||d.split(/\s+/)[0]||`qmd`,mcporter:S(o?.mcporter),searchMode:y(o?.searchMode),collections:u,includeDefaultMemory:s,sessions:b(o?.sessions,a),update:{intervalMs:m(o?.update?.interval),debounceMs:g(o?.update?.debounceMs),onBoot:o?.update?.onBoot!==!1,waitForBootSync:o?.update?.waitForBootSync===!0,embedIntervalMs:h(o?.update?.embedInterval),commandTimeoutMs:_(o?.update?.commandTimeoutMs,3e4),updateTimeoutMs:_(o?.update?.updateTimeoutMs,12e4),embedTimeoutMs:_(o?.update?.embedTimeoutMs,12e4)},limits:v(o?.limits),scope:o?.scope??l}}}var T=e({closeAllMemorySearchManagers:()=>j,getMemorySearchManager:()=>A});const E=t(`memory`),D=new Map;let O=null;function k(){return O??=import(`./manager-runtime-CoaA2Cm_.js`),O}async function A(e){let t=w(e);if(t.backend===`qmd`&&t.qmd){let n=e.purpose===`status`,r;if(!n){r=N(e.agentId,t.qmd);let n=D.get(r);if(n)return{manager:n}}try{let{QmdMemoryManager:i}=await import(`./qmd-manager-DSQ_mDCl.js`),a=await i.create({cfg:e.cfg,agentId:e.agentId,resolved:t,mode:n?`status`:`full`});if(a){if(n)return{manager:a};let t=new M({primary:a,fallbackFactory:async()=>{let{MemoryIndexManager:t}=await k();return await t.get(e)}},()=>{r&&D.delete(r)});return r&&D.set(r,t),{manager:t}}}catch(e){let t=e instanceof Error?e.message:String(e);E.warn(`qmd memory unavailable; falling back to builtin: ${t}`)}}try{let{MemoryIndexManager:t}=await k();return{manager:await t.get(e)}}catch(e){return{manager:null,error:e instanceof Error?e.message:String(e)}}}async function j(){let e=Array.from(D.values());D.clear();for(let t of e)try{await t.close?.()}catch(e){E.warn(`failed to close qmd memory manager: ${String(e)}`)}if(O!==null){let{closeAllMemoryIndexManagers:e}=await k();await e()}}var M=class{constructor(e,t){this.deps=e,this.onClose=t,this.fallback=null,this.primaryFailed=!1,this.cacheEvicted=!1}async search(e,t){if(!this.primaryFailed)try{return await this.deps.primary.search(e,t)}catch(e){this.primaryFailed=!0,this.lastError=e instanceof Error?e.message:String(e),E.warn(`qmd memory failed; switching to builtin index: ${this.lastError}`),await this.deps.primary.close?.().catch(()=>{}),this.evictCacheEntry()}let n=await this.ensureFallback();if(n)return await n.search(e,t);throw Error(this.lastError??`memory search unavailable`)}async readFile(e){if(!this.primaryFailed)return await this.deps.primary.readFile(e);let t=await this.ensureFallback();if(t)return await t.readFile(e);throw Error(this.lastError??`memory read unavailable`)}status(){if(!this.primaryFailed)return this.deps.primary.status();let e=this.fallback?.status(),t={from:`qmd`,reason:this.lastError??`unknown`};if(e){let n=e.custom??{};return{...e,fallback:t,custom:{...n,fallback:{disabled:!0,reason:this.lastError??`unknown`}}}}let n=this.deps.primary.status(),r=n.custom??{};return{...n,fallback:t,custom:{...r,fallback:{disabled:!0,reason:this.lastError??`unknown`}}}}async sync(e){if(!this.primaryFailed){await this.deps.primary.sync?.(e);return}await(await this.ensureFallback())?.sync?.(e)}async probeEmbeddingAvailability(){if(!this.primaryFailed)return await this.deps.primary.probeEmbeddingAvailability();let e=await this.ensureFallback();return e?await e.probeEmbeddingAvailability():{ok:!1,error:this.lastError??`memory embeddings unavailable`}}async probeVectorAvailability(){return this.primaryFailed?await(await this.ensureFallback())?.probeVectorAvailability()??!1:await this.deps.primary.probeVectorAvailability()}async close(){await this.deps.primary.close?.(),await this.fallback?.close?.(),this.evictCacheEntry()}async ensureFallback(){if(this.fallback)return this.fallback;let e;try{if(e=await this.deps.fallbackFactory(),!e)return E.warn(`memory fallback requested but builtin index is unavailable`),null}catch(e){let t=e instanceof Error?e.message:String(e);return E.warn(`memory fallback unavailable: ${t}`),null}return this.fallback=e,this.fallback}evictCacheEntry(){this.cacheEvicted||(this.cacheEvicted=!0,this.onClose?.())}};function N(e,t){return`${e}:${JSON.stringify(t)}`}export{T as n,w as r,A as t};
-//# sourceMappingURL=search-manager-CV2YsAym.js.map

package/dist/secret-file-C7JffiM_.js

@@ -1,2 +1 @@
 import{C as e,S as t}from"./plugins-CYLrFT4h.js";const n=t;function r(t,r){return e(t,r,{maxBytes:n,rejectSymlink:!0})}export{r as t};
-//# sourceMappingURL=secret-file-C7JffiM_.js.map

package/dist/secret-file-D60EFEOe.js

@@ -1,2 +1 @@
 import{C as e,S as t}from"./plugins-DNlgeTTc.js";const n=t;function r(t,r){return e(t,r,{maxBytes:n,rejectSymlink:!0})}export{r as t};
-//# sourceMappingURL=secret-file-D60EFEOe.js.map

package/dist/secret-file-DuWm26jS.js

@@ -1,2 +1 @@
 import{o as e}from"./utils-R-mFyVJi.js";import t from"node:fs";const n=new Set([`__proto__`,`prototype`,`constructor`]);function r(e){return n.has(e)}const i=`default`,a=/^[a-z0-9][a-z0-9_-]{0,63}$/i,o=/[^a-z0-9_-]+/g,s=/^-+/,c=/-+$/,l=new Map,u=new Map;function d(e){return a.test(e)?e.toLowerCase():e.toLowerCase().replace(o,`-`).replace(s,``).replace(c,``).slice(0,64)}function f(e){let t=d(e);if(!(!t||r(t)))return t}function p(e){let t=(e??``).trim();if(!t)return i;let n=l.get(t);if(n)return n;let r=f(t)||`default`;return h(l,t,r),r}function m(e){let t=(e??``).trim();if(!t)return;if(u.has(t))return u.get(t);let n=f(t)||void 0;return h(u,t,n),n}function h(e,t,n){if(e.set(t,n),e.size<=512)return;let r=e.keys().next();r.done||e.delete(r.value)}function g(e){return e===0||e===0n}function _(e,t,n=process.platform){return e.ino===t.ino?e.dev===t.dev?!0:n===`win32`&&(g(e.dev)||g(t.dev)):!1}function v(e){let t=typeof e==`object`&&e&&`code`in e?String(e.code):``;return t===`ENOENT`||t===`ENOTDIR`||t===`ELOOP`}function y(e,t){return _(e,t)}function b(e){let n=e.ioFs??t,r=e.allowedType??`file`,i=n.constants.O_RDONLY|(typeof n.constants.O_NOFOLLOW==`number`?n.constants.O_NOFOLLOW:0),a=null;try{if(e.rejectPathSymlink&&n.lstatSync(e.filePath).isSymbolicLink())return{ok:!1,reason:`validation`};let t=e.resolvedPath??n.realpathSync(e.filePath),o=n.lstatSync(t);if(!x(o,r)||e.rejectHardlinks&&o.isFile()&&o.nlink>1||e.maxBytes!==void 0&&o.isFile()&&o.size>e.maxBytes)return{ok:!1,reason:`validation`};a=n.openSync(t,i);let s=n.fstatSync(a);if(!x(s,r)||e.rejectHardlinks&&s.isFile()&&s.nlink>1||e.maxBytes!==void 0&&s.isFile()&&s.size>e.maxBytes||!y(o,s))return{ok:!1,reason:`validation`};let c={ok:!0,path:t,fd:a,stat:s};return a=null,c}catch(e){return v(e)?{ok:!1,reason:`path`,error:e}:{ok:!1,reason:`io`,error:e}}finally{a!==null&&n.closeSync(a)}}function x(e,t){return t===`directory`?e.isDirectory():e.isFile()}function S(n,r,i={}){let a=e(n.trim());if(!a)return{ok:!1,message:`${r} file path is empty.`};let o=i.maxBytes??16384,s;try{s=t.lstatSync(a)}catch(e){return{ok:!1,resolvedPath:a,error:e,message:`Failed to inspect ${r} file at ${a}: ${String(e)}`}}if(i.rejectSymlink&&s.isSymbolicLink())return{ok:!1,resolvedPath:a,message:`${r} file at ${a} must not be a symlink.`};if(!s.isFile())return{ok:!1,resolvedPath:a,message:`${r} file at ${a} must be a regular file.`};if(s.size>o)return{ok:!1,resolvedPath:a,message:`${r} file at ${a} exceeds ${o} bytes.`};let c=b({filePath:a,rejectPathSymlink:i.rejectSymlink,maxBytes:o});if(!c.ok){let e=c.reason===`validation`?Error(`security validation failed`):c.error;return{ok:!1,resolvedPath:a,error:e,message:`Failed to read ${r} file at ${a}: ${String(e)}`}}try{let e=t.readFileSync(c.fd,`utf8`).trim();return e?{ok:!0,secret:e,resolvedPath:a}:{ok:!1,resolvedPath:a,message:`${r} file at ${a} is empty.`}}catch(e){return{ok:!1,resolvedPath:a,error:e,message:`Failed to read ${r} file at ${a}: ${String(e)}`}}finally{t.closeSync(c.fd)}}function C(e,t,n={}){if(!e?.trim())return;let r=S(e,t,n);return r.ok?r.secret:void 0}export{p as a,i,b as n,m as o,_ as r,r as s,C as t};
-//# sourceMappingURL=secret-file-DuWm26jS.js.map

package/dist/secrets-cli-B8kwyZFo.js

@@ -3,4 +3,3 @@ import{A as e,p as t,v as n}from"./subsystem-BLbY429l.js";import{g as r}from"./p
 `);return{nextRaw:o||s.length===0?`${s}${s.endsWith(`
 `)?``:`
 `}`:s,removed:a}}function Be(e){let t=p(e.config.secrets?.providers)?structuredClone(e.config.secrets?.providers):{},n=!1;for(let r of e.deletes??[])Object.prototype.hasOwnProperty.call(t,r)&&(delete t[r],n=!0);for(let[r,i]of Object.entries(e.upserts??{})){let e=t[r];P(e,i)||(t[r]=structuredClone(i),n=!0)}return n?(e.config.secrets??={},Object.keys(t).length===0?(`providers`in e.config.secrets&&delete e.config.secrets.providers,!0):(e.config.secrets.providers=t,!0)):!1}async function Ve(e){let{snapshot:t,writeOptions:n}=await R({env:e.env}).readConfigFileSnapshotForWrite();if(!t.valid)throw Error(`Cannot apply secrets plan: config is invalid.`);let i=Pe(e.plan.options),a=structuredClone(t.config),o=r(e.env,j.homedir),s=new Set,c=[],l=C(t.path);Be({config:a,upserts:e.plan.providerUpserts,deletes:e.plan.providerDeletes})&&s.add(l);let u=He({planTargets:e.plan.targets,nextConfig:a,stateDir:o,authStoreByPath:new Map,changedFiles:s});u.configChanged&&s.add(l);let d=Ue({nextConfig:a,stateDir:o,providerTargets:u.providerTargets,scrubbedValues:u.scrubbedValues,authStoreByPath:u.authStoreByPath,changedFiles:s,warnings:c,enabled:i.scrubAuthProfilesForProviderTargets}),f=Ye({stateDir:o,changedFiles:s,enabled:i.scrubLegacyAuthJson}),p=Xe({env:e.env,scrubbedValues:u.scrubbedValues,changedFiles:s,enabled:i.scrubEnv});return await Ze({env:e.env,nextConfig:a,resolvedTargets:u.resolvedTargets,authStoreByPath:d}),{nextConfig:a,configPath:l,configWriteOptions:n,authStoreByPath:d,authJsonByPath:f,envRawByPath:p,changedFiles:s,warnings:c}}function He(e){let t=e.planTargets.map(e=>({target:e,resolved:Re(e)})),n=new Set,r=new Set,i=!1;for(let{target:a,resolved:o}of t){if(o.entry.configFile===`auth-profiles.json`){if(Je({target:a,resolved:o,nextConfig:e.nextConfig,stateDir:e.stateDir,authStoreByPath:e.authStoreByPath,scrubbedValues:n})){let t=String(a.agentId??``).trim();if(!t)throw Error(`Missing required agentId for auth-profiles target ${a.path}.`);e.changedFiles.add(Ke({nextConfig:e.nextConfig,stateDir:e.stateDir,agentId:t}))}continue}let t=o.pathSegments;if(o.entry.secretShape===`sibling_ref`){let r=D(e.nextConfig,t);u(r)&&n.add(r.trim());let s=o.refPathSegments;if(!s)throw Error(`Missing sibling ref path for target ${a.type}.`);let c=O(e.nextConfig,s,a.ref),l=ue(e.nextConfig,t);(c||l)&&(i=!0);continue}let c=D(e.nextConfig,t);u(c)&&n.add(c.trim()),O(e.nextConfig,t,a.ref)&&(i=!0),o.entry.trackProviderShadowing&&o.providerId&&r.add(s(o.providerId))}return{resolvedTargets:t,scrubbedValues:n,providerTargets:r,configChanged:i,authStoreByPath:e.authStoreByPath}}function Ue(e){if(!e.enabled||e.providerTargets.size===0)return e.authStoreByPath;for(let t of V(e.nextConfig,e.stateDir)){let n=e.authStoreByPath.get(t)??U(t).value;if(!n||!p(n.profiles))continue;let r=structuredClone(n),i=!1;for(let n of De(r.profiles)){let r=s(n.provider);if(e.providerTargets.has(r)){if(n.kind===`api_key`||n.kind===`token`){u(n.value)&&e.scrubbedValues.add(n.value.trim()),n.valueField in n.profile&&(delete n.profile[n.valueField],i=!0),n.refField in n.profile&&(delete n.profile[n.refField],i=!0);continue}n.kind===`oauth`&&(n.hasAccess||n.hasRefresh)&&e.warnings.push(`Provider "${r}" has OAuth credentials in ${t}; those still take precedence and are out of scope for static SecretRef migration.`)}}i&&(e.authStoreByPath.set(t,r),e.changedFiles.add(t))}return e.authStoreByPath}function We(e){let t=e?structuredClone(e):{};return p(t.profiles)||(t.profiles={}),(typeof t.version!=`number`||!Number.isFinite(t.version))&&(t.version=1),t}function Ge(e){let t=String(e.target.agentId??``).trim();if(!t)throw Error(`Missing required agentId for auth-profiles target ${e.target.path}.`);let n=Ke({nextConfig:e.nextConfig,stateDir:e.stateDir,agentId:t}),r=e.authStoreByPath.get(n)??U(n).value,i=We(p(r)?r:void 0);return e.authStoreByPath.set(n,i),{path:n,store:i}}function W(e){return e}function Ke(e){let t=x(e.agentId),n=ie(e.nextConfig,t)?.agentDir?.trim();return n?C(a(n)):M.join(C(e.stateDir),`agents`,t,`agent`,`auth-profiles.json`)}function qe(e){let t=!1,n=e.resolved.pathSegments.slice(0,2),r=n[1];if(!r)throw Error(`Invalid auth profile target path: ${e.target.path}`);let i=D(e.store,n),a=e.resolved.entry.authProfileType;if(p(i)){if(a&&typeof i.type==`string`&&i.type!==a)throw Error(`Auth profile "${r}" type mismatch for ${e.target.path}: expected "${a}", got "${i.type}".`);if(!u(i.provider)&&u(e.target.authProfileProvider)){let r=O(W(e.store),[...n,`provider`],e.target.authProfileProvider);t||=r}return t}if(!a)throw Error(`Auth profile target ${e.target.path} is missing auth profile type metadata.`);let o=String(e.target.authProfileProvider??``).trim();if(!o)throw Error(`Cannot create auth profile "${r}" for ${e.target.path} without authProfileProvider.`);let s=O(W(e.store),n,{type:a,provider:o});return t||=s,t}function Je(e){if(e.resolved.entry.configFile!==`auth-profiles.json`)return!1;let{store:t}=Ge({target:e.target,nextConfig:e.nextConfig,stateDir:e.stateDir,authStoreByPath:e.authStoreByPath}),n=qe({target:e.target,resolved:e.resolved,store:t}),r=e.resolved.pathSegments;if(e.resolved.entry.secretShape===`sibling_ref`){let i=D(t,r);u(i)&&e.scrubbedValues.add(i.trim());let a=e.resolved.refPathSegments;if(!a)throw Error(`Missing sibling ref path for auth-profiles target ${e.target.path}.`);let o=O(W(t),a,e.target.ref),s=ue(W(t),r);return n=n||o||s,n}let i=D(t,r);u(i)&&e.scrubbedValues.add(i.trim());let a=O(W(t),r,e.target.ref);return n||=a,n}function Ye(e){let t=new Map;if(!e.enabled)return t;for(let n of H(e.stateDir)){let r=U(n).value;if(!r)continue;let i=!1,a=structuredClone(r);for(let[e,t]of Object.entries(a))p(t)&&t.type===`api_key`&&u(t.key)&&(delete a[e],i=!0);i&&(t.set(n,a),e.changedFiles.add(n))}return t}function Xe(e){let t=new Map;if(!e.enabled||e.scrubbedValues.size===0)return t;let n=M.join(S(e.env,j.homedir),`.env`);if(!N.existsSync(n))return t;let r=N.readFileSync(n,`utf8`),i=ze(r,e.scrubbedValues,new Set(A()));return i.removed>0&&i.nextRaw!==r&&(t.set(n,i.nextRaw),e.changedFiles.add(n)),t}async function Ze(e){let t={};for(let{target:n,resolved:r}of e.resolvedTargets)k({value:await l(n.ref,{config:e.nextConfig,env:e.env,cache:t}),expected:r.entry.expectedResolvedValue,errorMessage:r.entry.expectedResolvedValue===`string`?`Ref ${n.ref.source}:${n.ref.provider}:${n.ref.id} is not a non-empty string.`:`Ref ${n.ref.source}:${n.ref.provider}:${n.ref.id} is not string/object.`});let n=new Map;for(let[t,r]of e.authStoreByPath.entries())n.set(C(t),r);await ve({config:e.nextConfig,env:e.env,loadAuthStore:e=>{let t=C(a(e)),r=n.get(t);return r?structuredClone(r):o(e)}})}function Qe(e){if(!N.existsSync(e))return{existed:!1,content:``,mode:384};let t=N.statSync(e);return{existed:!0,content:N.readFileSync(e,`utf8`),mode:t.mode&511}}function $e(e,t){if(!t.existed){N.existsSync(e)&&N.rmSync(e,{force:!0});return}m(e,t.content,t.mode||384)}function et(e,t){return{path:e,content:`${JSON.stringify(t,null,2)}\n`,mode:384}}async function G(e){let t=e.env??process.env,n=await Ve({plan:e.plan,env:t}),r=[...n.changedFiles].toSorted();if(!e.write)return{mode:`dry-run`,changed:r.length>0,changedFiles:r,warningCount:n.warnings.length,warnings:n.warnings};if(r.length===0)return{mode:`write`,changed:!1,changedFiles:[],warningCount:n.warnings.length,warnings:n.warnings};let i=R({env:t}),a=new Map,o=e=>{a.has(e)||a.set(e,Qe(e))};o(n.configPath);let s=[];for(let[e,t]of n.authStoreByPath.entries())o(e),s.push(et(e,t));for(let[e,t]of n.authJsonByPath.entries())o(e),s.push(et(e,t));for(let[e,t]of n.envRawByPath.entries())o(e),s.push({path:e,content:t,mode:384});try{await i.writeConfigFile(n.nextConfig,n.configWriteOptions);for(let e of s)m(e.path,e.content,e.mode)}catch(e){for(let[e,t]of a.entries())try{$e(e,t)}catch{}throw Error(`Secrets apply failed: ${String(e)}`,{cause:e})}return{mode:`write`,changed:r.length>0,changedFiles:r,warningCount:n.warnings.length,warnings:n.warnings}}const tt=new Set([`authorization`,`proxy-authorization`,`x-api-key`,`api-key`,`apikey`,`x-auth-token`,`auth-token`,`x-access-token`,`access-token`,`x-secret-key`,`secret-key`]),nt=[`api-key`,`apikey`,`token`,`secret`,`password`,`credential`];function rt(e){let t=e.trim().toLowerCase();return t?tt.has(t)?!0:nt.some(e=>t.includes(e)):!1}function K(e,t){e.findings.push(t)}function it(e,t,n){let r=s(t),i=e.configProviderRefPaths.get(r);if(i){i.push(n);return}e.configProviderRefPaths.set(r,[n])}function q(e,t,n){let r=s(t),i=e.authProviderState.get(r);if(i){i.hasUsableStaticOrOAuth=!0,i.modes.add(n);return}e.authProviderState.set(r,{hasUsableStaticOrOAuth:!0,modes:new Set([n])})}function at(e){if(!N.existsSync(e.envPath))return;e.collector.filesScanned.add(e.envPath);let t=new Set(A()),n=N.readFileSync(e.envPath,`utf8`).split(/\r?\n/);for(let r of n){let n=r.match(/^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/);if(!n)continue;let i=n[1]??``;t.has(i)&&B(n[2]??``)&&K(e.collector,{code:`PLAINTEXT_FOUND`,severity:`warn`,file:e.envPath,jsonPath:`$env.${i}`,message:`Potential secret found in .env (${i}).`})}}function ot(e){let t=e.config.secrets?.defaults;for(let n of pe(e.config)){if(!n.entry.includeInAudit)continue;let{ref:r}=w({value:n.value,refValue:n.refValue,defaults:t});if(r){e.collector.refAssignments.push({file:e.configPath,path:n.path,ref:r,expected:n.entry.expectedResolvedValue,provider:n.providerId}),n.entry.trackProviderShadowing&&n.providerId&&it(e.collector,n.providerId,n.path);continue}let i=de(n.value,n.entry.expectedResolvedValue);n.entry.id===`models.providers.*.headers.*`&&!rt(n.pathSegments.at(-1)??``)||i&&K(e.collector,{code:`PLAINTEXT_FOUND`,severity:`warn`,file:e.configPath,jsonPath:n.path,message:`${n.path} is stored as plaintext.`,provider:n.providerId})}}function st(e){if(!N.existsSync(e.authStorePath))return;e.collector.filesScanned.add(e.authStorePath);let t=U(e.authStorePath);if(t.error){K(e.collector,{code:`REF_UNRESOLVED`,severity:`error`,file:e.authStorePath,jsonPath:`<root>`,message:`Invalid JSON in auth-profiles store: ${t.error}`});return}let n=t.value;if(!(!n||!p(n.profiles)))for(let t of De(n.profiles)){if(t.kind===`api_key`||t.kind===`token`){let{ref:n}=w({value:t.value,refValue:t.refValue,defaults:e.defaults});n&&(e.collector.refAssignments.push({file:e.authStorePath,path:`profiles.${t.profileId}.${t.valueField}`,ref:n,expected:`string`,provider:t.provider}),q(e.collector,t.provider,t.kind)),u(t.value)&&(K(e.collector,{code:`PLAINTEXT_FOUND`,severity:`warn`,file:e.authStorePath,jsonPath:`profiles.${t.profileId}.${t.valueField}`,message:t.kind===`api_key`?`Auth profile API key is stored as plaintext.`:`Auth profile token is stored as plaintext.`,provider:t.provider,profileId:t.profileId}),q(e.collector,t.provider,t.kind));continue}(t.hasAccess||t.hasRefresh)&&(K(e.collector,{code:`LEGACY_RESIDUE`,severity:`info`,file:e.authStorePath,jsonPath:`profiles.${t.profileId}`,message:`OAuth credentials are present (out of scope for static SecretRef migration).`,provider:t.provider,profileId:t.profileId}),q(e.collector,t.provider,`oauth`))}}function ct(e){for(let t of H(e.stateDir)){e.collector.filesScanned.add(t);let n=U(t);if(n.error){K(e.collector,{code:`REF_UNRESOLVED`,severity:`error`,file:t,jsonPath:`<root>`,message:`Invalid JSON in legacy auth.json: ${n.error}`});continue}let r=n.value;if(r)for(let[n,i]of Object.entries(r))p(i)&&i.type===`api_key`&&u(i.key)&&K(e.collector,{code:`LEGACY_RESIDUE`,severity:`warn`,file:t,jsonPath:n,message:`Legacy auth.json contains static api_key credentials.`,provider:n})}}function lt(e){if(!N.existsSync(e.modelsJsonPath))return;e.collector.filesScanned.add(e.modelsJsonPath);let t=U(e.modelsJsonPath,{requireRegularFile:!0,maxBytes:5242880});if(t.error){K(e.collector,{code:`REF_UNRESOLVED`,severity:`error`,file:e.modelsJsonPath,jsonPath:`<root>`,message:`Invalid JSON in models.json: ${t.error}`});return}let n=t.value;if(!(!n||!p(n.providers)))for(let[t,r]of Object.entries(n.providers)){if(!p(r))continue;let n=r.apiKey;ae(n)?K(e.collector,{code:`REF_UNRESOLVED`,severity:`error`,file:e.modelsJsonPath,jsonPath:`providers.${t}.apiKey`,message:`models.json contains an unresolved SecretRef object; regenerate models.json.`,provider:t}):u(n)&&!f(n)&&K(e.collector,{code:`PLAINTEXT_FOUND`,severity:`warn`,file:e.modelsJsonPath,jsonPath:`providers.${t}.apiKey`,message:`models.json provider apiKey is stored as plaintext.`,provider:t});let i=p(r.headers)?r.headers:void 0;if(i)for(let[n,r]of Object.entries(i)){let i=`providers.${t}.headers.${n}`;if(ae(r)){K(e.collector,{code:`REF_UNRESOLVED`,severity:`error`,file:e.modelsJsonPath,jsonPath:i,message:`models.json contains an unresolved SecretRef object for provider headers; regenerate models.json.`,provider:t});continue}u(r)&&(ne(r)||rt(n)&&K(e.collector,{code:`PLAINTEXT_FOUND`,severity:`warn`,file:e.modelsJsonPath,jsonPath:i,message:`models.json provider header value is stored as plaintext.`,provider:t}))}}}async function ut(e){let t={},n=new Map;for(let t of e.collector.refAssignments){let e=`${t.ref.source}:${t.ref.provider}`,r=n.get(e);r||(r=new Map,n.set(e,r)),r.set(T(t.ref),t.ref)}let r=new Map,i=new Map;for(let a of n.values()){let n=[...a.values()],o=n[0]?.provider;try{let i=await ee(n,{config:e.config,env:e.env,cache:t});for(let[e,t]of i.entries())r.set(e,t);continue}catch(e){if(o&&g(e)){for(let t of n)i.set(T(t),e);continue}}let s=await le({tasks:n.map(n=>async()=>({key:T(n),resolved:await l(n,{config:e.config,env:e.env,cache:t})})),limit:Math.min(8,n.length),errorMode:`continue`,onTaskError:(e,t)=>{let r=n[t];r&&i.set(T(r),e)}});for(let e of s.results)e&&r.set(e.key,e.resolved)}for(let t of e.collector.refAssignments){let n=T(t.ref),a=i.get(n);if(a){K(e.collector,{code:`REF_UNRESOLVED`,severity:`error`,file:t.file,jsonPath:t.path,message:`Failed to resolve ${t.ref.source}:${t.ref.provider}:${t.ref.id} (${v(a)}).`,provider:t.provider});continue}if(!r.has(n)){K(e.collector,{code:`REF_UNRESOLVED`,severity:`error`,file:t.file,jsonPath:t.path,message:`Failed to resolve ${t.ref.source}:${t.ref.provider}:${t.ref.id} (resolved value is missing).`,provider:t.provider});continue}_e(r.get(n),t.expected)||K(e.collector,{code:`REF_UNRESOLVED`,severity:`error`,file:t.file,jsonPath:t.path,message:t.expected===`string`?`Failed to resolve ${t.ref.source}:${t.ref.provider}:${t.ref.id} (resolved value is not a non-empty string).`:`Failed to resolve ${t.ref.source}:${t.ref.provider}:${t.ref.id} (resolved value is not a string/object).`,provider:t.provider})}}function dt(e){for(let[t,n]of e.configProviderRefPaths.entries()){let r=e.authProviderState.get(t);if(!r?.hasUsableStaticOrOAuth)continue;let i=[...r.modes].join(`/`);for(let r of n)K(e,{code:`REF_SHADOWED`,severity:`warn`,file:`openclaw.json`,jsonPath:r,message:`Auth profile credentials (${i}) take precedence for provider "${t}", so this config ref may never be used.`,provider:t})}}function ft(e){return{plaintextCount:e.filter(e=>e.code===`PLAINTEXT_FOUND`).length,unresolvedRefCount:e.filter(e=>e.code===`REF_UNRESOLVED`).length,shadowedRefCount:e.filter(e=>e.code===`REF_SHADOWED`).length,legacyResidueCount:e.filter(e=>e.code===`LEGACY_RESIDUE`).length}}async function pt(e={}){let t=e.env??process.env,n=await R({env:t}).readConfigFileSnapshot(),i=C(n.path),a=n.valid?n.config.secrets?.defaults:void 0,o={findings:[],refAssignments:[],configProviderRefPaths:new Map,authProviderState:new Map,filesScanned:new Set([i])},s=r(t,j.homedir),c=M.join(S(t,j.homedir),`.env`),l=n.valid?n.config:{};if(n.valid){ot({config:l,configPath:i,collector:o});for(let e of V(l,s))st({authStorePath:e,collector:o,defaults:a});for(let e of Le(l,s,t))lt({modelsJsonPath:e,collector:o});await ut({collector:o,config:l,env:t}),dt(o)}else K(o,{code:`REF_UNRESOLVED`,severity:`error`,file:i,jsonPath:`<root>`,message:`Config is invalid; cannot validate secret references reliably.`});at({envPath:c,collector:o}),ct({stateDir:s,collector:o});let u=ft(o.findings);return{version:1,status:u.unresolvedRefCount>0?`unresolved`:o.findings.length>0?`findings`:`clean`,filesScanned:[...o.filesScanned].toSorted(),summary:u,findings:o.findings}}function mt(e,t){return e.summary.unresolvedRefCount>0?2:t&&e.findings.length>0?1:0}function ht(e){return p(e.secrets?.providers)?e.secrets.providers:{}}function gt(e){return e.configFile===`auth-profiles.json`?`auth-profiles:${e.agentId??``}:${e.path}`:`openclaw:${e.path}`}function _t(e,t){let n=t[1];if(!n)return;let r=e.profiles?.[n];if(!p(r)||typeof r.provider!=`string`)return;let i=r.provider.trim();return i.length>0?i:void 0}function vt(e){let t=e.authoredOpenClawConfig??e.config,n=e=>yt(t,e),r=pe(e.config).filter(e=>e.entry.includeInConfigure).map(t=>{let r=w({value:t.value,refValue:t.refValue,defaults:e.config.secrets?.defaults}),i=n(t.pathSegments),a=t.refPathSegments?n(t.refPathSegments):!1;return{type:t.entry.targetType,path:t.path,pathSegments:[...t.pathSegments],label:t.path,configFile:`openclaw.json`,expectedResolvedValue:t.entry.expectedResolvedValue,...r.ref?{existingRef:r.ref}:{},...i||a?{}:{isDerived:!0},...t.providerId?{providerId:t.providerId}:{},...t.accountId?{accountId:t.accountId}:{}}}),i=e.authProfiles===void 0?[]:fe(e.authProfiles.store).filter(e=>e.entry.includeInConfigure).map(t=>{let n=e.authProfiles;if(!n)throw Error(`Missing auth profile scope for configure candidate discovery.`);let r=_t(n.store,t.pathSegments),i=w({value:t.value,refValue:t.refValue,defaults:e.config.secrets?.defaults});return{type:t.entry.targetType,path:t.path,pathSegments:[...t.pathSegments],label:`${t.path} (auth profile, agent ${n.agentId})`,configFile:`auth-profiles.json`,expectedResolvedValue:t.entry.expectedResolvedValue,...i.ref?{existingRef:i.ref}:{},agentId:n.agentId,...r?{authProfileProvider:r}:{}}});return[...r,...i].toSorted((e,t)=>gt(e).localeCompare(gt(t)))}function yt(e,t){if(t.length===0)return!1;let n=e;for(let e=0;e<t.length;e+=1){let r=t[e]??``;if(Array.isArray(n)){if(!/^\d+$/.test(r))return!1;let i=Number.parseInt(r,10);if(!Number.isFinite(i)||i<0||i>=n.length)return!1;if(e===t.length-1)return!0;n=n[i];continue}if(!p(n)||!Object.prototype.hasOwnProperty.call(n,r))return!1;if(e===t.length-1)return!0;n=n[r]}return!1}function bt(e){let t=ht(e.original),n=ht(e.next),r={},i=[];for(let[e,i]of Object.entries(n)){let n=t[e];P(n,i)||(r[e]=structuredClone(i))}for(let e of Object.keys(t))Object.prototype.hasOwnProperty.call(n,e)||i.push(e);return{upserts:r,deletes:i.toSorted()}}function xt(e){return e.selectedTargets.size>0||Object.keys(e.providerChanges.upserts).length>0||e.providerChanges.deletes.length>0}function St(e){return{version:1,protocolVersion:1,generatedAt:e.generatedAt??new Date().toISOString(),generatedBy:`openclaw secrets configure`,targets:[...e.selectedTargets.values()].map(e=>({type:e.type,path:e.path,pathSegments:[...e.pathSegments],ref:e.ref,...e.agentId?{agentId:e.agentId}:{},...e.providerId?{providerId:e.providerId}:{},...e.accountId?{accountId:e.accountId}:{},...e.authProfileProvider?{authProfileProvider:e.authProfileProvider}:{}})),...Object.keys(e.providerChanges.upserts).length>0?{providerUpserts:e.providerChanges.upserts}:{},...e.providerChanges.deletes.length>0?{providerDeletes:e.providerChanges.deletes}:{},options:{scrubEnv:!0,scrubAuthProfilesForProviderTargets:!0,scrubLegacyAuthJson:!0}}}const Ct=/^[A-Z][A-Z0-9_]{0,127}$/,wt=/^[A-Za-z]:[\\/]/,Tt=/^\\\\[^\\]+\\[^\\]+/;function J(e){return M.isAbsolute(e)||wt.test(e)||Tt.test(e)}function Y(e){return e.split(`,`).map(e=>e.trim()).filter(e=>e.length>0)}function X(e,t){let n=e.trim();if(!n||!/^\d+$/.test(n))return;let r=Number.parseInt(n,10);if(!(!Number.isFinite(r)||r<=0||r>t))return r}function Et(e){return p(e.secrets?.providers)?e.secrets.providers:{}}function Dt(e,t,n){e.secrets??={},p(e.secrets.providers)||(e.secrets.providers={}),e.secrets.providers[t]=n}function Ot(e,t){if(!p(e.secrets?.providers))return!1;let n=e.secrets.providers;if(!Object.prototype.hasOwnProperty.call(n,t))return!1;if(delete n[t],Object.keys(n).length===0&&delete e.secrets?.providers,p(e.secrets?.defaults)){let n=e.secrets.defaults;n?.env===t&&delete n.env,n?.file===t&&delete n.file,n?.exec===t&&delete n.exec,n&&n.env===void 0&&n.file===void 0&&n.exec===void 0&&delete e.secrets?.defaults}return!0}function kt(e){return e.source===`env`?e.allowlist?.length?`env (${e.allowlist.length} allowlisted)`:`env`:e.source===`file`?`file (${e.mode??`json`})`:`exec (${e.jsonOnly===!1?`json+text`:`json`})`}function At(e){let t=t=>Object.values(e.secrets?.providers??{}).some(e=>e?.source===t),n=[{value:`env`,label:`env`}];return t(`file`)&&n.push({value:`file`,label:`file`}),t(`exec`)&&n.push({value:`exec`,label:`exec`}),n}function Z(e,t){if(typeof e==`symbol`)throw Error(t);return e}const jt=/^[A-Za-z0-9:_-]{1,128}$/;function Mt(e){let t=Y(e);for(let e of t)if(!Ct.test(e))return`Invalid env name: ${e}`}async function Nt(e){let t=Z(await L({message:e.message,initialValue:e.initialValue,validate:e=>Mt(String(e??``))}),`Secrets configure cancelled.`);return Y(String(t??``))}async function Q(e){let t=Z(await L({message:e.message,initialValue:e.initialValue===void 0?``:String(e.initialValue),validate:t=>{let n=String(t??``).trim();if(n&&X(n,e.max)===void 0)return`Must be an integer between 1 and ${e.max}`}}),`Secrets configure cancelled.`);return X(String(t??``),e.max)}function $(e){return e.configFile===`auth-profiles.json`?`auth-profiles:${String(e.agentId??``).trim()}:${e.path}`:`openclaw:${e.path}`}function Pt(e,t){return e.some(e=>e.value===t)}function Ft(e){if(typeof e.authProfileProvider==`string`&&e.authProfileProvider.trim())return e.authProfileProvider.trim().toLowerCase();if(typeof e.providerId==`string`&&e.providerId.trim())return e.providerId.trim().toLowerCase()}function It(e){let t=Ft(e);if(!t)return;let n=be[t];if(!(!Array.isArray(n)||n.length===0))return n[0]}function Lt(e,t){let n=new Set(b(e));if(!t)return re(e);let r=x(t);if(n.has(r))return r;let i=[...n].toSorted().join(`, `);throw Error(`Unknown agent id "${t}". Known agents: ${i||`none configured`}.`)}function Rt(e,t){if(!e)return{version:1,profiles:{}};if(!p(e.profiles))throw Error(`Cannot run interactive secrets configure because ${t} is invalid (missing "profiles" object).`);return{version:typeof e.version==`number`&&Number.isFinite(e.version)?e.version:1,profiles:e.profiles,...p(e.order)?{order:e.order}:{},...p(e.lastGood)?{lastGood:e.lastGood}:{},...p(e.usageStats)?{usageStats:e.usageStats}:{}}}function zt(e){let t=a(y(e.config,e.agentId)),n=U(t);if(n.error)throw Error(`Cannot run interactive secrets configure because ${t} could not be read: ${n.error}`);return Rt(n.value,t)}async function Bt(e){let t=Z(await L({message:`Auth profile id`,validate:e=>{let t=String(e??``).trim();if(!t)return`Required`;if(!jt.test(t))return`Use letters/numbers/":"/"_"/"-" only.`}}),`Secrets configure cancelled.`),n=Z(await I({message:`Auth profile credential type`,options:[{value:`api_key`,label:`api_key (key/keyRef)`},{value:`token`,label:`token (token/tokenRef)`}]}),`Secrets configure cancelled.`),r=Z(await L({message:`Provider id`,validate:e=>String(e??``).trim().length>0?void 0:`Required`}),`Secrets configure cancelled.`),i=String(t).trim(),a=String(r).trim();return n===`token`?{type:`auth-profiles.token.token`,path:`profiles.${i}.token`,pathSegments:[`profiles`,i,`token`],label:`profiles.${i}.token (auth profile, agent ${e})`,configFile:`auth-profiles.json`,agentId:e,authProfileProvider:a,expectedResolvedValue:`string`}:{type:`auth-profiles.api_key.key`,path:`profiles.${i}.key`,pathSegments:[`profiles`,i,`key`],label:`profiles.${i}.key (auth profile, agent ${e})`,configFile:`auth-profiles.json`,agentId:e,authProfileProvider:a,expectedResolvedValue:`string`}}async function Vt(e){let t=Z(await L({message:`Provider alias`,initialValue:`default`,validate:t=>{let n=String(t??``).trim();if(!n)return`Required`;if(!E(n))return`Must match /^[a-z][a-z0-9_-]{0,63}$/`;if(e.existingAliases.has(n))return`Alias already exists`}}),`Secrets configure cancelled.`);return String(t).trim()}async function Ht(e){return Z(await I({message:`Provider source`,options:[{value:`env`,label:`env`},{value:`file`,label:`file`},{value:`exec`,label:`exec`}],initialValue:e}),`Secrets configure cancelled.`)}async function Ut(e){let t=await Nt({message:`Env allowlist (comma-separated, blank for unrestricted)`,initialValue:e?.allowlist?.join(`,`)??``});return{source:`env`,...t.length>0?{allowlist:t}:{}}}async function Wt(e){let t=Z(await L({message:`File path (absolute)`,initialValue:e?.path??``,validate:e=>{let t=String(e??``).trim();if(!t)return`Required`;if(!J(t))return`Must be an absolute path`}}),`Secrets configure cancelled.`),n=Z(await I({message:`File mode`,options:[{value:`json`,label:`json`},{value:`singleValue`,label:`singleValue`}],initialValue:e?.mode??`json`}),`Secrets configure cancelled.`),r=await Q({message:`Timeout ms (blank for default)`,initialValue:e?.timeoutMs,max:12e4}),i=await Q({message:`Max bytes (blank for default)`,initialValue:e?.maxBytes,max:20*1024*1024});return{source:`file`,path:String(t).trim(),mode:n,...r?{timeoutMs:r}:{},...i?{maxBytes:i}:{}}}async function Gt(e){let t=e.trim();if(!t)return;let n=JSON.parse(t);if(!Array.isArray(n)||!n.every(e=>typeof e==`string`))throw Error(`args must be a JSON array of strings`);return n}async function Kt(e){let t=Z(await L({message:`Command path (absolute)`,initialValue:e?.command??``,validate:e=>{let t=String(e??``).trim();if(!t)return`Required`;if(!J(t))return`Must be an absolute path`;if(!d(t))return`Command value is not allowed`}}),`Secrets configure cancelled.`),n=Z(await L({message:`Args JSON array (blank for none)`,initialValue:JSON.stringify(e?.args??[]),validate:e=>{let t=String(e??``).trim();if(t)try{let e=JSON.parse(t);return!Array.isArray(e)||!e.every(e=>typeof e==`string`)?`Must be a JSON array of strings`:void 0}catch{return`Must be valid JSON`}}}),`Secrets configure cancelled.`),r=await Q({message:`Timeout ms (blank for default)`,initialValue:e?.timeoutMs,max:12e4}),i=await Q({message:`No-output timeout ms (blank for default)`,initialValue:e?.noOutputTimeoutMs,max:12e4}),a=await Q({message:`Max output bytes (blank for default)`,initialValue:e?.maxOutputBytes,max:20*1024*1024}),o=Z(await F({message:`Require JSON-only response?`,initialValue:e?.jsonOnly??!0}),`Secrets configure cancelled.`),s=await Nt({message:`Pass-through env vars (comma-separated, blank for none)`,initialValue:e?.passEnv?.join(`,`)??``}),c=Z(await L({message:`Trusted dirs (comma-separated absolute paths, blank for none)`,initialValue:e?.trustedDirs?.join(`,`)??``,validate:e=>{let t=Y(String(e??``));for(let e of t)if(!J(e))return`Trusted dir must be absolute: ${e}`}}),`Secrets configure cancelled.`),l=Z(await F({message:`Allow insecure command path checks?`,initialValue:e?.allowInsecurePath??!1}),`Secrets configure cancelled.`),u=Z(await F({message:`Allow symlink command path?`,initialValue:e?.allowSymlinkCommand??!1}),`Secrets configure cancelled.`),f=await Gt(String(n??``)),m=Y(String(c??``));return{source:`exec`,command:String(t).trim(),...f&&f.length>0?{args:f}:{},...r?{timeoutMs:r}:{},...i?{noOutputTimeoutMs:i}:{},...a?{maxOutputBytes:a}:{},...o?{jsonOnly:o}:{jsonOnly:!1},...s.length>0?{passEnv:s}:{},...m.length>0?{trustedDirs:m}:{},...l?{allowInsecurePath:!0}:{},...u?{allowSymlinkCommand:!0}:{},...p(e?.env)?{env:e.env}:{}}}async function qt(e,t){return e===`env`?await Ut(t?.source===`env`?t:void 0):e===`file`?await Wt(t?.source===`file`?t:void 0):await Kt(t?.source===`exec`?t:void 0)}async function Jt(e){for(;;){let t=Et(e),n=Object.entries(t).toSorted(([e],[t])=>e.localeCompare(t)),r=[{value:`add`,label:`Add provider`,hint:`Define a new env/file/exec provider`}];n.length>0&&(r.push({value:`edit`,label:`Edit provider`,hint:`Update an existing provider`}),r.push({value:`remove`,label:`Remove provider`,hint:`Delete a provider alias`})),r.push({value:`continue`,label:`Continue`,hint:`Move to credential mapping`});let i=Z(await I({message:n.length>0?`Configure secret providers`:`Configure secret providers (only env refs are available until file/exec providers are added)`,options:r}),`Secrets configure cancelled.`);if(i===`continue`)return;if(i===`add`){let t=await Ht();Dt(e,await Vt({existingAliases:new Set(n.map(([e])=>e))}),await qt(t));continue}if(i===`edit`){let r=Z(await I({message:`Select provider to edit`,options:n.map(([e,t])=>({value:e,label:e,hint:kt(t)}))}),`Secrets configure cancelled.`),i=t[r];if(!i)continue;let a=await qt(await Ht(i.source),i);P(i,a)||Dt(e,r,a);continue}if(i===`remove`){let t=Z(await I({message:`Select provider to remove`,options:n.map(([e,t])=>({value:e,label:e,hint:kt(t)}))}),`Secrets configure cancelled.`);Z(await F({message:`Remove provider "${t}"?`,initialValue:!1}),`Secrets configure cancelled.`)&&Ot(e,t)}}}async function Yt(e={}){if(!process.stdin.isTTY)throw Error(`secrets configure requires an interactive TTY.`);if(e.providersOnly&&e.skipProviderSetup)throw Error(`Cannot combine --providers-only with --skip-provider-setup.`);let t=e.env??process.env,{snapshot:n}=await R({env:t}).readConfigFileSnapshotForWrite();if(!n.valid)throw Error(`Cannot run interactive secrets configure because config is invalid.`);let r=structuredClone(n.config);e.skipProviderSetup||await Jt(r);let i=bt({original:n.config,next:r}),a=new Map;if(!e.providersOnly){let i=Lt(n.config,e.agentId),o=zt({config:n.config,agentId:i}),s=vt({config:r,authoredOpenClawConfig:n.resolved,authProfiles:{agentId:i,store:o}});if(s.length===0)throw Error(`No configurable secret-bearing fields found for this agent scope.`);let c=At(r),u=s.some(e=>e.isDerived===!0),d=!1;for(;;){let e=d?s:s.filter(e=>e.isDerived!==!0),n=e.map(e=>({value:$(e),label:e.label,hint:[e.configFile===`auth-profiles.json`?`auth-profiles.json`:`openclaw.json`,e.isDerived===!0?`derived`:void 0].filter(Boolean).join(` | `)}));n.push({value:`__create_auth_profile__`,label:`Create auth profile mapping`,hint:`Add a new auth-profiles target for agent ${i}`}),u&&n.push({value:`__toggle_derived__`,label:d?`Hide derived targets`:`Show derived targets`,hint:d?`Show only fields authored directly in config`:`Include normalized/derived aliases`}),a.size>0&&n.unshift({value:`__done__`,label:`Done`,hint:`Finish and run preflight`});let o=Z(await I({message:`Select credential field`,options:n}),`Secrets configure cancelled.`);if(o===`__done__`)break;if(o===`__create_auth_profile__`){let e=await Bt(i),t=$(e),n=s.findIndex(e=>$(e)===t);n>=0?s[n]=e:s.push(e);continue}if(o===`__toggle_derived__`){d=!d;continue}let f=e.find(e=>$(e)===o);if(!f)throw Error(`Unknown configure target: ${o}`);let p=$(f),m=a.get(p)?.ref??f.existingRef,h=Z(await I({message:`Secret source`,options:c,initialValue:m&&Pt(c,m.source)?m.source:void 0}),`Secrets configure cancelled.`),ee=oe(r,h,{preferFirstProviderForSource:!0}),te=Z(await L({message:`Provider alias`,initialValue:m?.source===h?m.provider:ee,validate:e=>{let t=String(e??``).trim();if(!t)return`Required`;if(!E(t))return`Must match /^[a-z][a-z0-9_-]{0,63}$/`}}),`Secrets configure cancelled.`),g=String(te).trim(),_=m?.source===h?m.id:void 0;if(!_&&h===`env`&&(_=It(f)),!_&&h===`file`){let e=r.secrets?.providers?.[g];e?.source===`file`&&e.mode===`singleValue`&&(_=`value`)}let ne=Z(await L({message:`Secret id`,initialValue:_,validate:e=>{let t=String(e??``).trim();if(!t)return`Required`;if(h===`exec`&&!se(t))return ce()}}),`Secrets configure cancelled.`),v={source:h,provider:g,id:String(ne).trim()};k({value:await l(v,{config:r,env:t}),expected:f.expectedResolvedValue,errorMessage:f.expectedResolvedValue===`string`?`Ref ${v.source}:${v.provider}:${v.id} did not resolve to a non-empty string.`:`Ref ${v.source}:${v.provider}:${v.id} did not resolve to a supported value type.`});let y={...f,ref:v};if(a.set(p,y),!Z(await F({message:`Configure another credential?`,initialValue:!0}),`Secrets configure cancelled.`))break}}if(!xt({selectedTargets:a,providerChanges:i}))throw Error(`No secrets changes were selected.`);let o=St({selectedTargets:a,providerChanges:i});return{plan:o,preflight:await G({plan:o,env:t,write:!1})}}function Xt(e){let t=N.readFileSync(e,`utf8`),n=JSON.parse(t);if(!Ne(n))throw Error(`Invalid secrets plan file: ${e}`);return n}function Zt(r){let i=r.command(`secrets`).description(`Secrets runtime controls`).addHelpText(`after`,()=>`\n${e.muted(`Docs:`)} ${ye(`/gateway/security`,`docs.openclaw.ai/gateway/security`)}\n`);Se(i.command(`reload`).description(`Re-resolve secret references and atomically swap runtime snapshot`).option(`--json`,`Output JSON`,!1)).action(async e=>{try{let n=await xe(`secrets.reload`,e,void 0,{expectFinal:!1});if(e.json){t.log(JSON.stringify(n,null,2));return}let r=Number(n?.warningCount??0);if(Number.isFinite(r)&&r>0){t.log(`Secrets reloaded with ${r} warning(s).`);return}t.log(`Secrets reloaded.`)}catch(e){t.error(n(String(e))),t.exit(1)}}),i.command(`audit`).description(`Audit plaintext secrets, unresolved refs, and precedence drift`).option(`--check`,`Exit non-zero when findings are present`,!1).option(`--json`,`Output JSON`,!1).action(async e=>{try{let n=await pt();if(e.json)t.log(JSON.stringify(n,null,2));else if(t.log(`Secrets audit: ${n.status}. plaintext=${n.summary.plaintextCount}, unresolved=${n.summary.unresolvedRefCount}, shadowed=${n.summary.shadowedRefCount}, legacy=${n.summary.legacyResidueCount}.`),n.findings.length>0){for(let e of n.findings.slice(0,20))t.log(`- [${e.code}] ${e.file}:${e.jsonPath} ${e.message}`);n.findings.length>20&&t.log(`... ${n.findings.length-20} more finding(s).`)}let r=mt(n,!!e.check);r!==0&&t.exit(r)}catch(e){t.error(n(String(e))),t.exit(2)}}),i.command(`configure`).description(`Interactive secrets helper (provider setup + SecretRef mapping + preflight)`).option(`--apply`,`Apply changes immediately after preflight`,!1).option(`--yes`,`Skip apply confirmation prompt`,!1).option(`--providers-only`,`Configure secrets.providers only, skip credential mapping`,!1).option(`--skip-provider-setup`,`Skip provider setup and only map credential fields to existing providers`,!1).option(`--agent <id>`,`Agent id for auth-profiles targets (default: configured default agent)`).option(`--plan-out <path>`,`Write generated plan JSON to a file`).option(`--json`,`Output JSON`,!1).action(async e=>{try{let n=await Yt({providersOnly:!!e.providersOnly,skipProviderSetup:!!e.skipProviderSetup,agentId:typeof e.agent==`string`?e.agent:void 0});if(e.planOut&&N.writeFileSync(e.planOut,`${JSON.stringify(n.plan,null,2)}\n`,`utf8`),e.json)t.log(JSON.stringify({plan:n.plan,preflight:n.preflight},null,2));else{if(t.log(`Preflight: changed=${n.preflight.changed}, files=${n.preflight.changedFiles.length}, warnings=${n.preflight.warningCount}.`),n.preflight.warningCount>0)for(let e of n.preflight.warnings)t.log(`- warning: ${e}`);let r=Object.keys(n.plan.providerUpserts??{}).length,i=n.plan.providerDeletes?.length??0;t.log(`Plan: targets=${n.plan.targets.length}, providerUpserts=${r}, providerDeletes=${i}.`),e.planOut&&t.log(`Plan written to ${e.planOut}`)}let r=!!e.apply;if(!r&&!e.json){let e=await F({message:`Apply this plan now?`,initialValue:!0});typeof e==`boolean`&&(r=e)}if(r){if(e.apply&&!e.yes&&!e.json&&await F({message:`This migration is one-way for migrated plaintext values. Continue with apply?`,initialValue:!0})!==!0){t.log(`Apply cancelled.`);return}let r=await G({plan:n.plan,write:!0});if(e.json){t.log(JSON.stringify(r,null,2));return}t.log(r.changed?`Secrets applied. Updated ${r.changedFiles.length} file(s).`:`Secrets apply: no changes.`)}}catch(e){t.error(n(String(e))),t.exit(1)}}),i.command(`apply`).description(`Apply a previously generated secrets plan`).requiredOption(`--from <path>`,`Path to plan JSON`).option(`--dry-run`,`Validate/preflight only`,!1).option(`--json`,`Output JSON`,!1).action(async e=>{try{let n=await G({plan:Xt(e.from),write:!e.dryRun});if(e.json){t.log(JSON.stringify(n,null,2));return}if(e.dryRun){t.log(n.changed?`Secrets apply dry run: ${n.changedFiles.length} file(s) would change.`:`Secrets apply dry run: no changes.`);return}t.log(n.changed?`Secrets applied. Updated ${n.changedFiles.length} file(s).`:`Secrets apply: no changes.`)}catch(e){t.error(n(String(e))),t.exit(1)}})}export{Zt as registerSecretsCli};
-//# sourceMappingURL=secrets-cli-B8kwyZFo.js.map

package/dist/secrets-cli-BstBe0UA.js

@@ -3,4 +3,3 @@ import{g as e}from"./paths-B4IRk3wi.js";import{A as t,p as n,v as r}from"./subsy
 `);return{nextRaw:o||s.length===0?`${s}${s.endsWith(`
 `)?``:`
 `}`:s,removed:a}}function Ve(e){let t=u(e.config.secrets?.providers)?structuredClone(e.config.secrets?.providers):{},n=!1;for(let r of e.deletes??[])Object.prototype.hasOwnProperty.call(t,r)&&(delete t[r],n=!0);for(let[r,i]of Object.entries(e.upserts??{})){let e=t[r];N(e,i)||(t[r]=structuredClone(i),n=!0)}return n?(e.config.secrets??={},Object.keys(t).length===0?(`providers`in e.config.secrets&&delete e.config.secrets.providers,!0):(e.config.secrets.providers=t,!0)):!1}async function He(t){let{snapshot:n,writeOptions:r}=await L({env:t.env}).readConfigFileSnapshotForWrite();if(!n.valid)throw Error(`Cannot apply secrets plan: config is invalid.`);let i=Fe(t.plan.options),o=structuredClone(n.config),s=e(t.env,j.homedir),c=new Set,l=[],u=a(n.path);Ve({config:o,upserts:t.plan.providerUpserts,deletes:t.plan.providerDeletes})&&c.add(u);let d=Ue({planTargets:t.plan.targets,nextConfig:o,stateDir:s,authStoreByPath:new Map,changedFiles:c});d.configChanged&&c.add(u);let f=We({nextConfig:o,stateDir:s,providerTargets:d.providerTargets,scrubbedValues:d.scrubbedValues,authStoreByPath:d.authStoreByPath,changedFiles:c,warnings:l,enabled:i.scrubAuthProfilesForProviderTargets}),p=Ye({stateDir:s,changedFiles:c,enabled:i.scrubLegacyAuthJson}),m=Xe({env:t.env,scrubbedValues:d.scrubbedValues,changedFiles:c,enabled:i.scrubEnv});return await Ze({env:t.env,nextConfig:o,resolvedTargets:d.resolvedTargets,authStoreByPath:f}),{nextConfig:o,configPath:u,configWriteOptions:r,authStoreByPath:f,authJsonByPath:p,envRawByPath:m,changedFiles:c,warnings:l}}function Ue(e){let t=e.planTargets.map(e=>({target:e,resolved:ze(e)})),n=new Set,r=new Set,i=!1;for(let{target:a,resolved:o}of t){if(o.entry.configFile===`auth-profiles.json`){if(Je({target:a,resolved:o,nextConfig:e.nextConfig,stateDir:e.stateDir,authStoreByPath:e.authStoreByPath,scrubbedValues:n})){let t=String(a.agentId??``).trim();if(!t)throw Error(`Missing required agentId for auth-profiles target ${a.path}.`);e.changedFiles.add(W({nextConfig:e.nextConfig,stateDir:e.stateDir,agentId:t}))}continue}let t=o.pathSegments;if(o.entry.secretShape===`sibling_ref`){let r=E(e.nextConfig,t);s(r)&&n.add(r.trim());let c=o.refPathSegments;if(!c)throw Error(`Missing sibling ref path for target ${a.type}.`);let l=k(e.nextConfig,c,a.ref),u=D(e.nextConfig,t);(l||u)&&(i=!0);continue}let c=E(e.nextConfig,t);s(c)&&n.add(c.trim()),k(e.nextConfig,t,a.ref)&&(i=!0),o.entry.trackProviderShadowing&&o.providerId&&r.add(h(o.providerId))}return{resolvedTargets:t,scrubbedValues:n,providerTargets:r,configChanged:i,authStoreByPath:e.authStoreByPath}}function We(e){if(!e.enabled||e.providerTargets.size===0)return e.authStoreByPath;for(let t of B(e.nextConfig,e.stateDir)){let n=e.authStoreByPath.get(t)??H(t).value;if(!n||!u(n.profiles))continue;let r=structuredClone(n),i=!1;for(let n of Oe(r.profiles)){let r=h(n.provider);if(e.providerTargets.has(r)){if(n.kind===`api_key`||n.kind===`token`){s(n.value)&&e.scrubbedValues.add(n.value.trim()),n.valueField in n.profile&&(delete n.profile[n.valueField],i=!0),n.refField in n.profile&&(delete n.profile[n.refField],i=!0);continue}n.kind===`oauth`&&(n.hasAccess||n.hasRefresh)&&e.warnings.push(`Provider "${r}" has OAuth credentials in ${t}; those still take precedence and are out of scope for static SecretRef migration.`)}}i&&(e.authStoreByPath.set(t,r),e.changedFiles.add(t))}return e.authStoreByPath}function Ge(e){let t=e?structuredClone(e):{};return u(t.profiles)||(t.profiles={}),(typeof t.version!=`number`||!Number.isFinite(t.version))&&(t.version=1),t}function Ke(e){let t=String(e.target.agentId??``).trim();if(!t)throw Error(`Missing required agentId for auth-profiles target ${e.target.path}.`);let n=W({nextConfig:e.nextConfig,stateDir:e.stateDir,agentId:t}),r=e.authStoreByPath.get(n)??H(n).value,i=Ge(u(r)?r:void 0);return e.authStoreByPath.set(n,i),{path:n,store:i}}function U(e){return e}function W(e){let t=oe(e.agentId),n=ae(e.nextConfig,t)?.agentDir?.trim();return n?a(g(n)):M.join(a(e.stateDir),`agents`,t,`agent`,`auth-profiles.json`)}function qe(e){let t=!1,n=e.resolved.pathSegments.slice(0,2),r=n[1];if(!r)throw Error(`Invalid auth profile target path: ${e.target.path}`);let i=E(e.store,n),a=e.resolved.entry.authProfileType;if(u(i)){if(a&&typeof i.type==`string`&&i.type!==a)throw Error(`Auth profile "${r}" type mismatch for ${e.target.path}: expected "${a}", got "${i.type}".`);if(!s(i.provider)&&s(e.target.authProfileProvider)){let r=k(U(e.store),[...n,`provider`],e.target.authProfileProvider);t||=r}return t}if(!a)throw Error(`Auth profile target ${e.target.path} is missing auth profile type metadata.`);let o=String(e.target.authProfileProvider??``).trim();if(!o)throw Error(`Cannot create auth profile "${r}" for ${e.target.path} without authProfileProvider.`);let c=k(U(e.store),n,{type:a,provider:o});return t||=c,t}function Je(e){if(e.resolved.entry.configFile!==`auth-profiles.json`)return!1;let{store:t}=Ke({target:e.target,nextConfig:e.nextConfig,stateDir:e.stateDir,authStoreByPath:e.authStoreByPath}),n=qe({target:e.target,resolved:e.resolved,store:t}),r=e.resolved.pathSegments;if(e.resolved.entry.secretShape===`sibling_ref`){let i=E(t,r);s(i)&&e.scrubbedValues.add(i.trim());let a=e.resolved.refPathSegments;if(!a)throw Error(`Missing sibling ref path for auth-profiles target ${e.target.path}.`);let o=k(U(t),a,e.target.ref),c=D(U(t),r);return n=n||o||c,n}let i=E(t,r);s(i)&&e.scrubbedValues.add(i.trim());let a=k(U(t),r,e.target.ref);return n||=a,n}function Ye(e){let t=new Map;if(!e.enabled)return t;for(let n of V(e.stateDir)){let r=H(n).value;if(!r)continue;let i=!1,a=structuredClone(r);for(let[e,t]of Object.entries(a))u(t)&&t.type===`api_key`&&s(t.key)&&(delete a[e],i=!0);i&&(t.set(n,a),e.changedFiles.add(n))}return t}function Xe(e){let t=new Map;if(!e.enabled||e.scrubbedValues.size===0)return t;let n=M.join(i(e.env,j.homedir),`.env`);if(!A.existsSync(n))return t;let r=A.readFileSync(n,`utf8`),a=Be(r,e.scrubbedValues,new Set(be()));return a.removed>0&&a.nextRaw!==r&&(t.set(n,a.nextRaw),e.changedFiles.add(n)),t}async function Ze(e){let t={};for(let{target:n,resolved:r}of e.resolvedTargets)_e({value:await y(n.ref,{config:e.nextConfig,env:e.env,cache:t}),expected:r.entry.expectedResolvedValue,errorMessage:r.entry.expectedResolvedValue===`string`?`Ref ${n.ref.source}:${n.ref.provider}:${n.ref.id} is not a non-empty string.`:`Ref ${n.ref.source}:${n.ref.provider}:${n.ref.id} is not string/object.`});let n=new Map;for(let[t,r]of e.authStoreByPath.entries())n.set(a(t),r);await ye({config:e.nextConfig,env:e.env,loadAuthStore:e=>{let t=a(g(e)),r=n.get(t);return r?structuredClone(r):m(e)}})}function Qe(e){if(!A.existsSync(e))return{existed:!1,content:``,mode:384};let t=A.statSync(e);return{existed:!0,content:A.readFileSync(e,`utf8`),mode:t.mode&511}}function $e(e,t){if(!t.existed){A.existsSync(e)&&A.rmSync(e,{force:!0});return}l(e,t.content,t.mode||384)}function et(e,t){return{path:e,content:`${JSON.stringify(t,null,2)}\n`,mode:384}}async function G(e){let t=e.env??process.env,n=await He({plan:e.plan,env:t}),r=[...n.changedFiles].toSorted();if(!e.write)return{mode:`dry-run`,changed:r.length>0,changedFiles:r,warningCount:n.warnings.length,warnings:n.warnings};if(r.length===0)return{mode:`write`,changed:!1,changedFiles:[],warningCount:n.warnings.length,warnings:n.warnings};let i=L({env:t}),a=new Map,o=e=>{a.has(e)||a.set(e,Qe(e))};o(n.configPath);let s=[];for(let[e,t]of n.authStoreByPath.entries())o(e),s.push(et(e,t));for(let[e,t]of n.authJsonByPath.entries())o(e),s.push(et(e,t));for(let[e,t]of n.envRawByPath.entries())o(e),s.push({path:e,content:t,mode:384});try{await i.writeConfigFile(n.nextConfig,n.configWriteOptions);for(let e of s)l(e.path,e.content,e.mode)}catch(e){for(let[e,t]of a.entries())try{$e(e,t)}catch{}throw Error(`Secrets apply failed: ${String(e)}`,{cause:e})}return{mode:`write`,changed:r.length>0,changedFiles:r,warningCount:n.warnings.length,warnings:n.warnings}}const tt=new Set([`authorization`,`proxy-authorization`,`x-api-key`,`api-key`,`apikey`,`x-auth-token`,`auth-token`,`x-access-token`,`access-token`,`x-secret-key`,`secret-key`]),nt=[`api-key`,`apikey`,`token`,`secret`,`password`,`credential`];function rt(e){let t=e.trim().toLowerCase();return t?tt.has(t)?!0:nt.some(e=>t.includes(e)):!1}function K(e,t){e.findings.push(t)}function it(e,t,n){let r=h(t),i=e.configProviderRefPaths.get(r);if(i){i.push(n);return}e.configProviderRefPaths.set(r,[n])}function q(e,t,n){let r=h(t),i=e.authProviderState.get(r);if(i){i.hasUsableStaticOrOAuth=!0,i.modes.add(n);return}e.authProviderState.set(r,{hasUsableStaticOrOAuth:!0,modes:new Set([n])})}function at(e){if(!A.existsSync(e.envPath))return;e.collector.filesScanned.add(e.envPath);let t=new Set(be()),n=A.readFileSync(e.envPath,`utf8`).split(/\r?\n/);for(let r of n){let n=r.match(/^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=\s*(.*)$/);if(!n)continue;let i=n[1]??``;t.has(i)&&z(n[2]??``)&&K(e.collector,{code:`PLAINTEXT_FOUND`,severity:`warn`,file:e.envPath,jsonPath:`$env.${i}`,message:`Potential secret found in .env (${i}).`})}}function ot(e){let t=e.config.secrets?.defaults;for(let n of O(e.config)){if(!n.entry.includeInAudit)continue;let{ref:r}=S({value:n.value,refValue:n.refValue,defaults:t});if(r){e.collector.refAssignments.push({file:e.configPath,path:n.path,ref:r,expected:n.entry.expectedResolvedValue,provider:n.providerId}),n.entry.trackProviderShadowing&&n.providerId&&it(e.collector,n.providerId,n.path);continue}let i=de(n.value,n.entry.expectedResolvedValue);n.entry.id===`models.providers.*.headers.*`&&!rt(n.pathSegments.at(-1)??``)||i&&K(e.collector,{code:`PLAINTEXT_FOUND`,severity:`warn`,file:e.configPath,jsonPath:n.path,message:`${n.path} is stored as plaintext.`,provider:n.providerId})}}function st(e){if(!A.existsSync(e.authStorePath))return;e.collector.filesScanned.add(e.authStorePath);let t=H(e.authStorePath);if(t.error){K(e.collector,{code:`REF_UNRESOLVED`,severity:`error`,file:e.authStorePath,jsonPath:`<root>`,message:`Invalid JSON in auth-profiles store: ${t.error}`});return}let n=t.value;if(!(!n||!u(n.profiles)))for(let t of Oe(n.profiles)){if(t.kind===`api_key`||t.kind===`token`){let{ref:n}=S({value:t.value,refValue:t.refValue,defaults:e.defaults});n&&(e.collector.refAssignments.push({file:e.authStorePath,path:`profiles.${t.profileId}.${t.valueField}`,ref:n,expected:`string`,provider:t.provider}),q(e.collector,t.provider,t.kind)),s(t.value)&&(K(e.collector,{code:`PLAINTEXT_FOUND`,severity:`warn`,file:e.authStorePath,jsonPath:`profiles.${t.profileId}.${t.valueField}`,message:t.kind===`api_key`?`Auth profile API key is stored as plaintext.`:`Auth profile token is stored as plaintext.`,provider:t.provider,profileId:t.profileId}),q(e.collector,t.provider,t.kind));continue}(t.hasAccess||t.hasRefresh)&&(K(e.collector,{code:`LEGACY_RESIDUE`,severity:`info`,file:e.authStorePath,jsonPath:`profiles.${t.profileId}`,message:`OAuth credentials are present (out of scope for static SecretRef migration).`,provider:t.provider,profileId:t.profileId}),q(e.collector,t.provider,`oauth`))}}function ct(e){for(let t of V(e.stateDir)){e.collector.filesScanned.add(t);let n=H(t);if(n.error){K(e.collector,{code:`REF_UNRESOLVED`,severity:`error`,file:t,jsonPath:`<root>`,message:`Invalid JSON in legacy auth.json: ${n.error}`});continue}let r=n.value;if(r)for(let[n,i]of Object.entries(r))u(i)&&i.type===`api_key`&&s(i.key)&&K(e.collector,{code:`LEGACY_RESIDUE`,severity:`warn`,file:t,jsonPath:n,message:`Legacy auth.json contains static api_key credentials.`,provider:n})}}function lt(e){if(!A.existsSync(e.modelsJsonPath))return;e.collector.filesScanned.add(e.modelsJsonPath);let t=H(e.modelsJsonPath,{requireRegularFile:!0,maxBytes:5242880});if(t.error){K(e.collector,{code:`REF_UNRESOLVED`,severity:`error`,file:e.modelsJsonPath,jsonPath:`<root>`,message:`Invalid JSON in models.json: ${t.error}`});return}let n=t.value;if(!(!n||!u(n.providers)))for(let[t,r]of Object.entries(n.providers)){if(!u(r))continue;let n=r.apiKey;C(n)?K(e.collector,{code:`REF_UNRESOLVED`,severity:`error`,file:e.modelsJsonPath,jsonPath:`providers.${t}.apiKey`,message:`models.json contains an unresolved SecretRef object; regenerate models.json.`,provider:t}):s(n)&&!_(n)&&K(e.collector,{code:`PLAINTEXT_FOUND`,severity:`warn`,file:e.modelsJsonPath,jsonPath:`providers.${t}.apiKey`,message:`models.json provider apiKey is stored as plaintext.`,provider:t});let i=u(r.headers)?r.headers:void 0;if(i)for(let[n,r]of Object.entries(i)){let i=`providers.${t}.headers.${n}`;if(C(r)){K(e.collector,{code:`REF_UNRESOLVED`,severity:`error`,file:e.modelsJsonPath,jsonPath:i,message:`models.json contains an unresolved SecretRef object for provider headers; regenerate models.json.`,provider:t});continue}s(r)&&(ee(r)||rt(n)&&K(e.collector,{code:`PLAINTEXT_FOUND`,severity:`warn`,file:e.modelsJsonPath,jsonPath:i,message:`models.json provider header value is stored as plaintext.`,provider:t}))}}}async function ut(e){let t={},n=new Map;for(let t of e.collector.refAssignments){let e=`${t.ref.source}:${t.ref.provider}`,r=n.get(e);r||(r=new Map,n.set(e,r)),r.set(w(t.ref),t.ref)}let r=new Map,i=new Map;for(let a of n.values()){let n=[...a.values()],o=n[0]?.provider;try{let i=await f(n,{config:e.config,env:e.env,cache:t});for(let[e,t]of i.entries())r.set(e,t);continue}catch(e){if(o&&d(e)){for(let t of n)i.set(w(t),e);continue}}let s=await ue({tasks:n.map(n=>async()=>({key:w(n),resolved:await y(n,{config:e.config,env:e.env,cache:t})})),limit:Math.min(8,n.length),errorMode:`continue`,onTaskError:(e,t)=>{let r=n[t];r&&i.set(w(r),e)}});for(let e of s.results)e&&r.set(e.key,e.resolved)}for(let t of e.collector.refAssignments){let n=w(t.ref),a=i.get(n);if(a){K(e.collector,{code:`REF_UNRESOLVED`,severity:`error`,file:t.file,jsonPath:t.path,message:`Failed to resolve ${t.ref.source}:${t.ref.provider}:${t.ref.id} (${c(a)}).`,provider:t.provider});continue}if(!r.has(n)){K(e.collector,{code:`REF_UNRESOLVED`,severity:`error`,file:t.file,jsonPath:t.path,message:`Failed to resolve ${t.ref.source}:${t.ref.provider}:${t.ref.id} (resolved value is missing).`,provider:t.provider});continue}ge(r.get(n),t.expected)||K(e.collector,{code:`REF_UNRESOLVED`,severity:`error`,file:t.file,jsonPath:t.path,message:t.expected===`string`?`Failed to resolve ${t.ref.source}:${t.ref.provider}:${t.ref.id} (resolved value is not a non-empty string).`:`Failed to resolve ${t.ref.source}:${t.ref.provider}:${t.ref.id} (resolved value is not a string/object).`,provider:t.provider})}}function dt(e){for(let[t,n]of e.configProviderRefPaths.entries()){let r=e.authProviderState.get(t);if(!r?.hasUsableStaticOrOAuth)continue;let i=[...r.modes].join(`/`);for(let r of n)K(e,{code:`REF_SHADOWED`,severity:`warn`,file:`openclaw.json`,jsonPath:r,message:`Auth profile credentials (${i}) take precedence for provider "${t}", so this config ref may never be used.`,provider:t})}}function ft(e){return{plaintextCount:e.filter(e=>e.code===`PLAINTEXT_FOUND`).length,unresolvedRefCount:e.filter(e=>e.code===`REF_UNRESOLVED`).length,shadowedRefCount:e.filter(e=>e.code===`REF_SHADOWED`).length,legacyResidueCount:e.filter(e=>e.code===`LEGACY_RESIDUE`).length}}async function pt(t={}){let n=t.env??process.env,r=await L({env:n}).readConfigFileSnapshot(),o=a(r.path),s=r.valid?r.config.secrets?.defaults:void 0,c={findings:[],refAssignments:[],configProviderRefPaths:new Map,authProviderState:new Map,filesScanned:new Set([o])},l=e(n,j.homedir),u=M.join(i(n,j.homedir),`.env`),d=r.valid?r.config:{};if(r.valid){ot({config:d,configPath:o,collector:c});for(let e of B(d,l))st({authStorePath:e,collector:c,defaults:s});for(let e of Re(d,l,n))lt({modelsJsonPath:e,collector:c});await ut({collector:c,config:d,env:n}),dt(c)}else K(c,{code:`REF_UNRESOLVED`,severity:`error`,file:o,jsonPath:`<root>`,message:`Config is invalid; cannot validate secret references reliably.`});at({envPath:u,collector:c}),ct({stateDir:l,collector:c});let f=ft(c.findings);return{version:1,status:f.unresolvedRefCount>0?`unresolved`:c.findings.length>0?`findings`:`clean`,filesScanned:[...c.filesScanned].toSorted(),summary:f,findings:c.findings}}function mt(e,t){return e.summary.unresolvedRefCount>0?2:t&&e.findings.length>0?1:0}function ht(e){return u(e.secrets?.providers)?e.secrets.providers:{}}function gt(e){return e.configFile===`auth-profiles.json`?`auth-profiles:${e.agentId??``}:${e.path}`:`openclaw:${e.path}`}function _t(e,t){let n=t[1];if(!n)return;let r=e.profiles?.[n];if(!u(r)||typeof r.provider!=`string`)return;let i=r.provider.trim();return i.length>0?i:void 0}function vt(e){let t=e.authoredOpenClawConfig??e.config,n=e=>yt(t,e),r=O(e.config).filter(e=>e.entry.includeInConfigure).map(t=>{let r=S({value:t.value,refValue:t.refValue,defaults:e.config.secrets?.defaults}),i=n(t.pathSegments),a=t.refPathSegments?n(t.refPathSegments):!1;return{type:t.entry.targetType,path:t.path,pathSegments:[...t.pathSegments],label:t.path,configFile:`openclaw.json`,expectedResolvedValue:t.entry.expectedResolvedValue,...r.ref?{existingRef:r.ref}:{},...i||a?{}:{isDerived:!0},...t.providerId?{providerId:t.providerId}:{},...t.accountId?{accountId:t.accountId}:{}}}),i=e.authProfiles===void 0?[]:fe(e.authProfiles.store).filter(e=>e.entry.includeInConfigure).map(t=>{let n=e.authProfiles;if(!n)throw Error(`Missing auth profile scope for configure candidate discovery.`);let r=_t(n.store,t.pathSegments),i=S({value:t.value,refValue:t.refValue,defaults:e.config.secrets?.defaults});return{type:t.entry.targetType,path:t.path,pathSegments:[...t.pathSegments],label:`${t.path} (auth profile, agent ${n.agentId})`,configFile:`auth-profiles.json`,expectedResolvedValue:t.entry.expectedResolvedValue,...i.ref?{existingRef:i.ref}:{},agentId:n.agentId,...r?{authProfileProvider:r}:{}}});return[...r,...i].toSorted((e,t)=>gt(e).localeCompare(gt(t)))}function yt(e,t){if(t.length===0)return!1;let n=e;for(let e=0;e<t.length;e+=1){let r=t[e]??``;if(Array.isArray(n)){if(!/^\d+$/.test(r))return!1;let i=Number.parseInt(r,10);if(!Number.isFinite(i)||i<0||i>=n.length)return!1;if(e===t.length-1)return!0;n=n[i];continue}if(!u(n)||!Object.prototype.hasOwnProperty.call(n,r))return!1;if(e===t.length-1)return!0;n=n[r]}return!1}function bt(e){let t=ht(e.original),n=ht(e.next),r={},i=[];for(let[e,i]of Object.entries(n)){let n=t[e];N(n,i)||(r[e]=structuredClone(i))}for(let e of Object.keys(t))Object.prototype.hasOwnProperty.call(n,e)||i.push(e);return{upserts:r,deletes:i.toSorted()}}function xt(e){return e.selectedTargets.size>0||Object.keys(e.providerChanges.upserts).length>0||e.providerChanges.deletes.length>0}function St(e){return{version:1,protocolVersion:1,generatedAt:e.generatedAt??new Date().toISOString(),generatedBy:`openclaw secrets configure`,targets:[...e.selectedTargets.values()].map(e=>({type:e.type,path:e.path,pathSegments:[...e.pathSegments],ref:e.ref,...e.agentId?{agentId:e.agentId}:{},...e.providerId?{providerId:e.providerId}:{},...e.accountId?{accountId:e.accountId}:{},...e.authProfileProvider?{authProfileProvider:e.authProfileProvider}:{}})),...Object.keys(e.providerChanges.upserts).length>0?{providerUpserts:e.providerChanges.upserts}:{},...e.providerChanges.deletes.length>0?{providerDeletes:e.providerChanges.deletes}:{},options:{scrubEnv:!0,scrubAuthProfilesForProviderTargets:!0,scrubLegacyAuthJson:!0}}}const Ct=/^[A-Z][A-Z0-9_]{0,127}$/,wt=/^[A-Za-z]:[\\/]/,Tt=/^\\\\[^\\]+\\[^\\]+/;function J(e){return M.isAbsolute(e)||wt.test(e)||Tt.test(e)}function Y(e){return e.split(`,`).map(e=>e.trim()).filter(e=>e.length>0)}function Et(e,t){let n=e.trim();if(!n||!/^\d+$/.test(n))return;let r=Number.parseInt(n,10);if(!(!Number.isFinite(r)||r<=0||r>t))return r}function Dt(e){return u(e.secrets?.providers)?e.secrets.providers:{}}function Ot(e,t,n){e.secrets??={},u(e.secrets.providers)||(e.secrets.providers={}),e.secrets.providers[t]=n}function kt(e,t){if(!u(e.secrets?.providers))return!1;let n=e.secrets.providers;if(!Object.prototype.hasOwnProperty.call(n,t))return!1;if(delete n[t],Object.keys(n).length===0&&delete e.secrets?.providers,u(e.secrets?.defaults)){let n=e.secrets.defaults;n?.env===t&&delete n.env,n?.file===t&&delete n.file,n?.exec===t&&delete n.exec,n&&n.env===void 0&&n.file===void 0&&n.exec===void 0&&delete e.secrets?.defaults}return!0}function At(e){return e.source===`env`?e.allowlist?.length?`env (${e.allowlist.length} allowlisted)`:`env`:e.source===`file`?`file (${e.mode??`json`})`:`exec (${e.jsonOnly===!1?`json+text`:`json`})`}function jt(e){let t=t=>Object.values(e.secrets?.providers??{}).some(e=>e?.source===t),n=[{value:`env`,label:`env`}];return t(`file`)&&n.push({value:`file`,label:`file`}),t(`exec`)&&n.push({value:`exec`,label:`exec`}),n}function X(e,t){if(typeof e==`symbol`)throw Error(t);return e}const Mt=/^[A-Za-z0-9:_-]{1,128}$/;function Nt(e){let t=Y(e);for(let e of t)if(!Ct.test(e))return`Invalid env name: ${e}`}async function Z(e){let t=X(await I({message:e.message,initialValue:e.initialValue,validate:e=>Nt(String(e??``))}),`Secrets configure cancelled.`);return Y(String(t??``))}async function Q(e){let t=X(await I({message:e.message,initialValue:e.initialValue===void 0?``:String(e.initialValue),validate:t=>{let n=String(t??``).trim();if(n&&Et(n,e.max)===void 0)return`Must be an integer between 1 and ${e.max}`}}),`Secrets configure cancelled.`);return Et(String(t??``),e.max)}function $(e){return e.configFile===`auth-profiles.json`?`auth-profiles:${String(e.agentId??``).trim()}:${e.path}`:`openclaw:${e.path}`}function Pt(e,t){return e.some(e=>e.value===t)}function Ft(e){if(typeof e.authProfileProvider==`string`&&e.authProfileProvider.trim())return e.authProfileProvider.trim().toLowerCase();if(typeof e.providerId==`string`&&e.providerId.trim())return e.providerId.trim().toLowerCase()}function It(e){let t=Ft(e);if(!t)return;let n=xe[t];if(!(!Array.isArray(n)||n.length===0))return n[0]}function Lt(e,t){let n=new Set(x(e));if(!t)return ie(e);let r=oe(t);if(n.has(r))return r;let i=[...n].toSorted().join(`, `);throw Error(`Unknown agent id "${t}". Known agents: ${i||`none configured`}.`)}function Rt(e,t){if(!e)return{version:1,profiles:{}};if(!u(e.profiles))throw Error(`Cannot run interactive secrets configure because ${t} is invalid (missing "profiles" object).`);return{version:typeof e.version==`number`&&Number.isFinite(e.version)?e.version:1,profiles:e.profiles,...u(e.order)?{order:e.order}:{},...u(e.lastGood)?{lastGood:e.lastGood}:{},...u(e.usageStats)?{usageStats:e.usageStats}:{}}}function zt(e){let t=g(b(e.config,e.agentId)),n=H(t);if(n.error)throw Error(`Cannot run interactive secrets configure because ${t} could not be read: ${n.error}`);return Rt(n.value,t)}async function Bt(e){let t=X(await I({message:`Auth profile id`,validate:e=>{let t=String(e??``).trim();if(!t)return`Required`;if(!Mt.test(t))return`Use letters/numbers/":"/"_"/"-" only.`}}),`Secrets configure cancelled.`),n=X(await F({message:`Auth profile credential type`,options:[{value:`api_key`,label:`api_key (key/keyRef)`},{value:`token`,label:`token (token/tokenRef)`}]}),`Secrets configure cancelled.`),r=X(await I({message:`Provider id`,validate:e=>String(e??``).trim().length>0?void 0:`Required`}),`Secrets configure cancelled.`),i=String(t).trim(),a=String(r).trim();return n===`token`?{type:`auth-profiles.token.token`,path:`profiles.${i}.token`,pathSegments:[`profiles`,i,`token`],label:`profiles.${i}.token (auth profile, agent ${e})`,configFile:`auth-profiles.json`,agentId:e,authProfileProvider:a,expectedResolvedValue:`string`}:{type:`auth-profiles.api_key.key`,path:`profiles.${i}.key`,pathSegments:[`profiles`,i,`key`],label:`profiles.${i}.key (auth profile, agent ${e})`,configFile:`auth-profiles.json`,agentId:e,authProfileProvider:a,expectedResolvedValue:`string`}}async function Vt(e){let t=X(await I({message:`Provider alias`,initialValue:`default`,validate:t=>{let n=String(t??``).trim();if(!n)return`Required`;if(!T(n))return`Must match /^[a-z][a-z0-9_-]{0,63}$/`;if(e.existingAliases.has(n))return`Alias already exists`}}),`Secrets configure cancelled.`);return String(t).trim()}async function Ht(e){return X(await F({message:`Provider source`,options:[{value:`env`,label:`env`},{value:`file`,label:`file`},{value:`exec`,label:`exec`}],initialValue:e}),`Secrets configure cancelled.`)}async function Ut(e){let t=await Z({message:`Env allowlist (comma-separated, blank for unrestricted)`,initialValue:e?.allowlist?.join(`,`)??``});return{source:`env`,...t.length>0?{allowlist:t}:{}}}async function Wt(e){let t=X(await I({message:`File path (absolute)`,initialValue:e?.path??``,validate:e=>{let t=String(e??``).trim();if(!t)return`Required`;if(!J(t))return`Must be an absolute path`}}),`Secrets configure cancelled.`),n=X(await F({message:`File mode`,options:[{value:`json`,label:`json`},{value:`singleValue`,label:`singleValue`}],initialValue:e?.mode??`json`}),`Secrets configure cancelled.`),r=await Q({message:`Timeout ms (blank for default)`,initialValue:e?.timeoutMs,max:12e4}),i=await Q({message:`Max bytes (blank for default)`,initialValue:e?.maxBytes,max:20*1024*1024});return{source:`file`,path:String(t).trim(),mode:n,...r?{timeoutMs:r}:{},...i?{maxBytes:i}:{}}}async function Gt(e){let t=e.trim();if(!t)return;let n=JSON.parse(t);if(!Array.isArray(n)||!n.every(e=>typeof e==`string`))throw Error(`args must be a JSON array of strings`);return n}async function Kt(e){let t=X(await I({message:`Command path (absolute)`,initialValue:e?.command??``,validate:e=>{let t=String(e??``).trim();if(!t)return`Required`;if(!J(t))return`Must be an absolute path`;if(!re(t))return`Command value is not allowed`}}),`Secrets configure cancelled.`),n=X(await I({message:`Args JSON array (blank for none)`,initialValue:JSON.stringify(e?.args??[]),validate:e=>{let t=String(e??``).trim();if(t)try{let e=JSON.parse(t);return!Array.isArray(e)||!e.every(e=>typeof e==`string`)?`Must be a JSON array of strings`:void 0}catch{return`Must be valid JSON`}}}),`Secrets configure cancelled.`),r=await Q({message:`Timeout ms (blank for default)`,initialValue:e?.timeoutMs,max:12e4}),i=await Q({message:`No-output timeout ms (blank for default)`,initialValue:e?.noOutputTimeoutMs,max:12e4}),a=await Q({message:`Max output bytes (blank for default)`,initialValue:e?.maxOutputBytes,max:20*1024*1024}),o=X(await P({message:`Require JSON-only response?`,initialValue:e?.jsonOnly??!0}),`Secrets configure cancelled.`),s=await Z({message:`Pass-through env vars (comma-separated, blank for none)`,initialValue:e?.passEnv?.join(`,`)??``}),c=X(await I({message:`Trusted dirs (comma-separated absolute paths, blank for none)`,initialValue:e?.trustedDirs?.join(`,`)??``,validate:e=>{let t=Y(String(e??``));for(let e of t)if(!J(e))return`Trusted dir must be absolute: ${e}`}}),`Secrets configure cancelled.`),l=X(await P({message:`Allow insecure command path checks?`,initialValue:e?.allowInsecurePath??!1}),`Secrets configure cancelled.`),d=X(await P({message:`Allow symlink command path?`,initialValue:e?.allowSymlinkCommand??!1}),`Secrets configure cancelled.`),f=await Gt(String(n??``)),p=Y(String(c??``));return{source:`exec`,command:String(t).trim(),...f&&f.length>0?{args:f}:{},...r?{timeoutMs:r}:{},...i?{noOutputTimeoutMs:i}:{},...a?{maxOutputBytes:a}:{},...o?{jsonOnly:o}:{jsonOnly:!1},...s.length>0?{passEnv:s}:{},...p.length>0?{trustedDirs:p}:{},...l?{allowInsecurePath:!0}:{},...d?{allowSymlinkCommand:!0}:{},...u(e?.env)?{env:e.env}:{}}}async function qt(e,t){return e===`env`?await Ut(t?.source===`env`?t:void 0):e===`file`?await Wt(t?.source===`file`?t:void 0):await Kt(t?.source===`exec`?t:void 0)}async function Jt(e){for(;;){let t=Dt(e),n=Object.entries(t).toSorted(([e],[t])=>e.localeCompare(t)),r=[{value:`add`,label:`Add provider`,hint:`Define a new env/file/exec provider`}];n.length>0&&(r.push({value:`edit`,label:`Edit provider`,hint:`Update an existing provider`}),r.push({value:`remove`,label:`Remove provider`,hint:`Delete a provider alias`})),r.push({value:`continue`,label:`Continue`,hint:`Move to credential mapping`});let i=X(await F({message:n.length>0?`Configure secret providers`:`Configure secret providers (only env refs are available until file/exec providers are added)`,options:r}),`Secrets configure cancelled.`);if(i===`continue`)return;if(i===`add`){let t=await Ht();Ot(e,await Vt({existingAliases:new Set(n.map(([e])=>e))}),await qt(t));continue}if(i===`edit`){let r=X(await F({message:`Select provider to edit`,options:n.map(([e,t])=>({value:e,label:e,hint:At(t)}))}),`Secrets configure cancelled.`),i=t[r];if(!i)continue;let a=await qt(await Ht(i.source),i);N(i,a)||Ot(e,r,a);continue}if(i===`remove`){let t=X(await F({message:`Select provider to remove`,options:n.map(([e,t])=>({value:e,label:e,hint:At(t)}))}),`Secrets configure cancelled.`);X(await P({message:`Remove provider "${t}"?`,initialValue:!1}),`Secrets configure cancelled.`)&&kt(e,t)}}}async function Yt(e={}){if(!process.stdin.isTTY)throw Error(`secrets configure requires an interactive TTY.`);if(e.providersOnly&&e.skipProviderSetup)throw Error(`Cannot combine --providers-only with --skip-provider-setup.`);let t=e.env??process.env,{snapshot:n}=await L({env:t}).readConfigFileSnapshotForWrite();if(!n.valid)throw Error(`Cannot run interactive secrets configure because config is invalid.`);let r=structuredClone(n.config);e.skipProviderSetup||await Jt(r);let i=bt({original:n.config,next:r}),a=new Map;if(!e.providersOnly){let i=Lt(n.config,e.agentId),o=zt({config:n.config,agentId:i}),s=vt({config:r,authoredOpenClawConfig:n.resolved,authProfiles:{agentId:i,store:o}});if(s.length===0)throw Error(`No configurable secret-bearing fields found for this agent scope.`);let c=jt(r),l=s.some(e=>e.isDerived===!0),u=!1;for(;;){let e=u?s:s.filter(e=>e.isDerived!==!0),n=e.map(e=>({value:$(e),label:e.label,hint:[e.configFile===`auth-profiles.json`?`auth-profiles.json`:`openclaw.json`,e.isDerived===!0?`derived`:void 0].filter(Boolean).join(` | `)}));n.push({value:`__create_auth_profile__`,label:`Create auth profile mapping`,hint:`Add a new auth-profiles target for agent ${i}`}),l&&n.push({value:`__toggle_derived__`,label:u?`Hide derived targets`:`Show derived targets`,hint:u?`Show only fields authored directly in config`:`Include normalized/derived aliases`}),a.size>0&&n.unshift({value:`__done__`,label:`Done`,hint:`Finish and run preflight`});let o=X(await F({message:`Select credential field`,options:n}),`Secrets configure cancelled.`);if(o===`__done__`)break;if(o===`__create_auth_profile__`){let e=await Bt(i),t=$(e),n=s.findIndex(e=>$(e)===t);n>=0?s[n]=e:s.push(e);continue}if(o===`__toggle_derived__`){u=!u;continue}let d=e.find(e=>$(e)===o);if(!d)throw Error(`Unknown configure target: ${o}`);let f=$(d),p=a.get(f)?.ref??d.existingRef,m=X(await F({message:`Secret source`,options:c,initialValue:p&&Pt(c,p.source)?p.source:void 0}),`Secrets configure cancelled.`),ee=se(r,m,{preferFirstProviderForSource:!0}),h=X(await I({message:`Provider alias`,initialValue:p?.source===m?p.provider:ee,validate:e=>{let t=String(e??``).trim();if(!t)return`Required`;if(!T(t))return`Must match /^[a-z][a-z0-9_-]{0,63}$/`}}),`Secrets configure cancelled.`),g=String(h).trim(),_=p?.source===m?p.id:void 0;if(!_&&m===`env`&&(_=It(d)),!_&&m===`file`){let e=r.secrets?.providers?.[g];e?.source===`file`&&e.mode===`singleValue`&&(_=`value`)}let te=X(await I({message:`Secret id`,initialValue:_,validate:e=>{let t=String(e??``).trim();if(!t)return`Required`;if(m===`exec`&&!ce(t))return le()}}),`Secrets configure cancelled.`),v={source:m,provider:g,id:String(te).trim()};_e({value:await y(v,{config:r,env:t}),expected:d.expectedResolvedValue,errorMessage:d.expectedResolvedValue===`string`?`Ref ${v.source}:${v.provider}:${v.id} did not resolve to a non-empty string.`:`Ref ${v.source}:${v.provider}:${v.id} did not resolve to a supported value type.`});let ne={...d,ref:v};if(a.set(f,ne),!X(await P({message:`Configure another credential?`,initialValue:!0}),`Secrets configure cancelled.`))break}}if(!xt({selectedTargets:a,providerChanges:i}))throw Error(`No secrets changes were selected.`);let o=St({selectedTargets:a,providerChanges:i});return{plan:o,preflight:await G({plan:o,env:t,write:!1})}}function Xt(e){let t=A.readFileSync(e,`utf8`),n=JSON.parse(t);if(!Pe(n))throw Error(`Invalid secrets plan file: ${e}`);return n}function Zt(e){let i=e.command(`secrets`).description(`Secrets runtime controls`).addHelpText(`after`,()=>`\n${t.muted(`Docs:`)} ${ve(`/gateway/security`,`docs.openclaw.ai/gateway/security`)}\n`);Ce(i.command(`reload`).description(`Re-resolve secret references and atomically swap runtime snapshot`).option(`--json`,`Output JSON`,!1)).action(async e=>{try{let t=await Se(`secrets.reload`,e,void 0,{expectFinal:!1});if(e.json){n.log(JSON.stringify(t,null,2));return}let r=Number(t?.warningCount??0);if(Number.isFinite(r)&&r>0){n.log(`Secrets reloaded with ${r} warning(s).`);return}n.log(`Secrets reloaded.`)}catch(e){n.error(r(String(e))),n.exit(1)}}),i.command(`audit`).description(`Audit plaintext secrets, unresolved refs, and precedence drift`).option(`--check`,`Exit non-zero when findings are present`,!1).option(`--json`,`Output JSON`,!1).action(async e=>{try{let t=await pt();if(e.json)n.log(JSON.stringify(t,null,2));else if(n.log(`Secrets audit: ${t.status}. plaintext=${t.summary.plaintextCount}, unresolved=${t.summary.unresolvedRefCount}, shadowed=${t.summary.shadowedRefCount}, legacy=${t.summary.legacyResidueCount}.`),t.findings.length>0){for(let e of t.findings.slice(0,20))n.log(`- [${e.code}] ${e.file}:${e.jsonPath} ${e.message}`);t.findings.length>20&&n.log(`... ${t.findings.length-20} more finding(s).`)}let r=mt(t,!!e.check);r!==0&&n.exit(r)}catch(e){n.error(r(String(e))),n.exit(2)}}),i.command(`configure`).description(`Interactive secrets helper (provider setup + SecretRef mapping + preflight)`).option(`--apply`,`Apply changes immediately after preflight`,!1).option(`--yes`,`Skip apply confirmation prompt`,!1).option(`--providers-only`,`Configure secrets.providers only, skip credential mapping`,!1).option(`--skip-provider-setup`,`Skip provider setup and only map credential fields to existing providers`,!1).option(`--agent <id>`,`Agent id for auth-profiles targets (default: configured default agent)`).option(`--plan-out <path>`,`Write generated plan JSON to a file`).option(`--json`,`Output JSON`,!1).action(async e=>{try{let t=await Yt({providersOnly:!!e.providersOnly,skipProviderSetup:!!e.skipProviderSetup,agentId:typeof e.agent==`string`?e.agent:void 0});if(e.planOut&&A.writeFileSync(e.planOut,`${JSON.stringify(t.plan,null,2)}\n`,`utf8`),e.json)n.log(JSON.stringify({plan:t.plan,preflight:t.preflight},null,2));else{if(n.log(`Preflight: changed=${t.preflight.changed}, files=${t.preflight.changedFiles.length}, warnings=${t.preflight.warningCount}.`),t.preflight.warningCount>0)for(let e of t.preflight.warnings)n.log(`- warning: ${e}`);let r=Object.keys(t.plan.providerUpserts??{}).length,i=t.plan.providerDeletes?.length??0;n.log(`Plan: targets=${t.plan.targets.length}, providerUpserts=${r}, providerDeletes=${i}.`),e.planOut&&n.log(`Plan written to ${e.planOut}`)}let r=!!e.apply;if(!r&&!e.json){let e=await P({message:`Apply this plan now?`,initialValue:!0});typeof e==`boolean`&&(r=e)}if(r){if(e.apply&&!e.yes&&!e.json&&await P({message:`This migration is one-way for migrated plaintext values. Continue with apply?`,initialValue:!0})!==!0){n.log(`Apply cancelled.`);return}let r=await G({plan:t.plan,write:!0});if(e.json){n.log(JSON.stringify(r,null,2));return}n.log(r.changed?`Secrets applied. Updated ${r.changedFiles.length} file(s).`:`Secrets apply: no changes.`)}}catch(e){n.error(r(String(e))),n.exit(1)}}),i.command(`apply`).description(`Apply a previously generated secrets plan`).requiredOption(`--from <path>`,`Path to plan JSON`).option(`--dry-run`,`Validate/preflight only`,!1).option(`--json`,`Output JSON`,!1).action(async e=>{try{let t=await G({plan:Xt(e.from),write:!e.dryRun});if(e.json){n.log(JSON.stringify(t,null,2));return}if(e.dryRun){n.log(t.changed?`Secrets apply dry run: ${t.changedFiles.length} file(s) would change.`:`Secrets apply dry run: no changes.`);return}n.log(t.changed?`Secrets applied. Updated ${t.changedFiles.length} file(s).`:`Secrets apply: no changes.`)}catch(e){n.error(r(String(e))),n.exit(1)}})}export{Zt as registerSecretsCli};
-//# sourceMappingURL=secrets-cli-BstBe0UA.js.map

package/dist/secure-random-D7JQgiK-.js

@@ -1,2 +1 @@
 import{randomBytes as e,randomUUID as t}from"node:crypto";function n(){return t()}function r(t=16){return e(t).toString(`base64url`)}export{n,r as t};
-//# sourceMappingURL=secure-random-D7JQgiK-.js.map