@spacebar_ai/moldclaw-core 2026.3.14 → 2026.3.16

package/dist/gateway-install-token-CJYFJBaC.js

@@ -0,0 +1,163 @@
+import { DE as loadAuthProfileStoreForSecretsRuntime } from "./auth-profiles-9zZdaXJK.js";
+import { f as readConfigFileSnapshot, gn as collectConfigServiceEnvVars, y as writeConfigFile } from "./io-C6XifaT4.js";
+import { a as hasConfiguredSecretInput, d as resolveSecretInputRef } from "./types.secrets-Bojc4omL.js";
+import { u as secretRefKey } from "./ref-contract-RPkB754Q.js";
+import { i as resolveSecretRefValues } from "./resolve-BbsCHGLY.js";
+import { m as resolveGatewayAuth } from "./config-CMhKplgO.js";
+import { t as formatCliCommand } from "./command-format-DIDjlImI.js";
+import { d as readGatewayTokenEnv } from "./credentials-yYt6VWCq.js";
+import { ct as hasAmbiguousGatewayAuthModeConfig } from "./routes-BZtqNrBf.js";
+import { l as resolveGatewayLaunchAgentLabel } from "./constants-WvU01Mp_.js";
+import { n as resolveDaemonInstallRuntimeInputs, r as resolveGatewayProgramArguments, t as emitDaemonInstallRuntimeWarning } from "./daemon-install-plan.shared-B0aOTaiV.js";
+import { l as buildServiceEnvironment } from "./runtime-paths-DPdaWILN.js";
+import { m as randomToken } from "./onboard-helpers-ChMWfUnl.js";
+//#region src/commands/daemon-install-helpers.ts
+function collectAuthProfileServiceEnvVars(params) {
+	const authStore = params.authStore ?? loadAuthProfileStoreForSecretsRuntime();
+	const entries = {};
+	for (const credential of Object.values(authStore.profiles)) {
+		const ref = credential.type === "api_key" ? credential.keyRef : credential.type === "token" ? credential.tokenRef : void 0;
+		if (!ref || ref.source !== "env") continue;
+		const value = params.env[ref.id]?.trim();
+		if (!value) continue;
+		entries[ref.id] = value;
+	}
+	return entries;
+}
+async function buildGatewayInstallPlan(params) {
+	const { devMode, nodePath } = await resolveDaemonInstallRuntimeInputs({
+		env: params.env,
+		runtime: params.runtime,
+		devMode: params.devMode,
+		nodePath: params.nodePath
+	});
+	const { programArguments, workingDirectory } = await resolveGatewayProgramArguments({
+		port: params.port,
+		dev: devMode,
+		runtime: params.runtime,
+		nodePath
+	});
+	await emitDaemonInstallRuntimeWarning({
+		env: params.env,
+		runtime: params.runtime,
+		programArguments,
+		warn: params.warn,
+		title: "Gateway runtime"
+	});
+	const serviceEnvironment = buildServiceEnvironment({
+		env: params.env,
+		port: params.port,
+		launchdLabel: process.platform === "darwin" ? resolveGatewayLaunchAgentLabel(params.env.MOLDCLAW_PROFILE) : void 0
+	});
+	const environment = {
+		...collectConfigServiceEnvVars(params.config),
+		...collectAuthProfileServiceEnvVars({
+			env: params.env,
+			authStore: params.authStore
+		})
+	};
+	Object.assign(environment, serviceEnvironment);
+	return {
+		programArguments,
+		workingDirectory,
+		environment
+	};
+}
+function gatewayInstallErrorHint(platform = process.platform) {
+	return platform === "win32" ? "Tip: native Windows now falls back to a per-user Startup-folder login item when Scheduled Task creation is denied; if install still fails, rerun from an elevated PowerShell or skip service install." : `Tip: rerun \`${formatCliCommand("moldclaw gateway install")}\` after fixing the error.`;
+}
+//#endregion
+//#region src/gateway/auth-install-policy.ts
+function shouldRequireGatewayTokenForInstall(cfg, _env) {
+	const mode = cfg.gateway?.auth?.mode;
+	if (mode === "token") return true;
+	if (mode === "password" || mode === "none" || mode === "trusted-proxy") return false;
+	if (hasConfiguredSecretInput(cfg.gateway?.auth?.password, cfg.secrets?.defaults)) return false;
+	const configServiceEnv = collectConfigServiceEnvVars(cfg);
+	if (Boolean(configServiceEnv.MOLDCLAW_GATEWAY_PASSWORD?.trim() || configServiceEnv.MOLDCLAW_GATEWAY_PASSWORD?.trim())) return false;
+	return true;
+}
+//#endregion
+//#region src/commands/gateway-install-token.ts
+function formatAmbiguousGatewayAuthModeReason() {
+	return ["gateway.auth.token and gateway.auth.password are both configured while gateway.auth.mode is unset.", `Set ${formatCliCommand("moldclaw config set gateway.auth.mode token")} or ${formatCliCommand("moldclaw config set gateway.auth.mode password")}.`].join(" ");
+}
+async function resolveGatewayInstallToken(options) {
+	const cfg = options.config;
+	const warnings = [];
+	const tokenRef = resolveSecretInputRef({
+		value: cfg.gateway?.auth?.token,
+		defaults: cfg.secrets?.defaults
+	}).ref;
+	const tokenRefConfigured = Boolean(tokenRef);
+	const configToken = tokenRef || typeof cfg.gateway?.auth?.token !== "string" ? void 0 : cfg.gateway.auth.token.trim() || void 0;
+	const explicitToken = options.explicitToken?.trim() || void 0;
+	const envToken = readGatewayTokenEnv(options.env);
+	if (hasAmbiguousGatewayAuthModeConfig(cfg)) return {
+		token: void 0,
+		tokenRefConfigured,
+		unavailableReason: formatAmbiguousGatewayAuthModeReason(),
+		warnings
+	};
+	const resolvedAuth = resolveGatewayAuth({
+		authConfig: cfg.gateway?.auth,
+		tailscaleMode: cfg.gateway?.tailscale?.mode ?? "off"
+	});
+	const needsToken = shouldRequireGatewayTokenForInstall(cfg, options.env) && !resolvedAuth.allowTailscale;
+	let token = explicitToken || configToken || (tokenRef ? void 0 : envToken);
+	let unavailableReason;
+	if (tokenRef && !token && needsToken) try {
+		const value = (await resolveSecretRefValues([tokenRef], {
+			config: cfg,
+			env: options.env
+		})).get(secretRefKey(tokenRef));
+		if (typeof value !== "string" || value.trim().length === 0) throw new Error("gateway.auth.token resolved to an empty or non-string value.");
+		warnings.push("gateway.auth.token is SecretRef-managed; install will not persist a resolved token in service environment. Ensure the SecretRef is resolvable in the daemon runtime context.");
+	} catch (err) {
+		unavailableReason = `gateway.auth.token SecretRef is configured but unresolved (${String(err)}).`;
+	}
+	const allowAutoGenerate = options.autoGenerateWhenMissing ?? false;
+	const persistGeneratedToken = options.persistGeneratedToken ?? false;
+	if (!token && needsToken && !tokenRef && allowAutoGenerate) {
+		token = randomToken();
+		warnings.push(persistGeneratedToken ? "No gateway token found. Auto-generated one and saving to config." : "No gateway token found. Auto-generated one for this run without saving to config.");
+		if (persistGeneratedToken) try {
+			const snapshot = await readConfigFileSnapshot();
+			if (snapshot.exists && !snapshot.valid) warnings.push("Warning: config file exists but is invalid; skipping token persistence.");
+			else {
+				const baseConfig = snapshot.exists ? snapshot.config : {};
+				const existingTokenRef = resolveSecretInputRef({
+					value: baseConfig.gateway?.auth?.token,
+					defaults: baseConfig.secrets?.defaults
+				}).ref;
+				const baseConfigToken = existingTokenRef || typeof baseConfig.gateway?.auth?.token !== "string" ? void 0 : baseConfig.gateway.auth.token.trim() || void 0;
+				if (!existingTokenRef && !baseConfigToken) await writeConfigFile({
+					...baseConfig,
+					gateway: {
+						...baseConfig.gateway,
+						auth: {
+							...baseConfig.gateway?.auth,
+							mode: baseConfig.gateway?.auth?.mode ?? "token",
+							token
+						}
+					}
+				});
+				else if (baseConfigToken) token = baseConfigToken;
+				else {
+					token = void 0;
+					warnings.push("Warning: gateway.auth.token is SecretRef-managed; skipping plaintext token persistence.");
+				}
+			}
+		} catch (err) {
+			warnings.push(`Warning: could not persist token to config: ${String(err)}`);
+		}
+	}
+	return {
+		token,
+		tokenRefConfigured,
+		unavailableReason,
+		warnings
+	};
+}
+//#endregion
+export { buildGatewayInstallPlan as n, gatewayInstallErrorHint as r, resolveGatewayInstallToken as t };

package/dist/gateway-rpc-CroQg9MB.js

@@ -0,0 +1,26 @@
+import { _ as GATEWAY_CLIENT_MODES, v as GATEWAY_CLIENT_NAMES } from "./message-channel-CKeDAoOT.js";
+import { n as callGateway } from "./call-DYFR7oGy.js";
+import { n as withProgress } from "./progress-BQSTKUhd.js";
+//#region src/cli/gateway-rpc.ts
+function addGatewayClientOptions(cmd) {
+	return cmd.option("--url <url>", "Gateway WebSocket URL (defaults to gateway.remote.url when configured)").option("--token <token>", "Gateway token (if required)").option("--timeout <ms>", "Timeout in ms", "30000").option("--expect-final", "Wait for final response (agent)", false);
+}
+async function callGatewayFromCli(method, opts, params, extra) {
+	const showProgress = extra?.progress ?? opts.json !== true;
+	return await withProgress({
+		label: `Gateway ${method}`,
+		indeterminate: true,
+		enabled: showProgress
+	}, async () => await callGateway({
+		url: opts.url,
+		token: opts.token,
+		method,
+		params,
+		expectFinal: extra?.expectFinal ?? Boolean(opts.expectFinal),
+		timeoutMs: Number(opts.timeout ?? 1e4),
+		clientName: GATEWAY_CLIENT_NAMES.CLI,
+		mode: GATEWAY_CLIENT_MODES.CLI
+	}));
+}
+//#endregion
+export { callGatewayFromCli as n, addGatewayClientOptions as t };

package/dist/gateway-runtime-D9FRZqKP.js

@@ -0,0 +1,69 @@
+import { _ as GATEWAY_CLIENT_MODES, v as GATEWAY_CLIENT_NAMES } from "./message-channel-CKeDAoOT.js";
+import { u as GatewayClient } from "./method-scopes-Du8ODGFW.js";
+import { l as resolveGatewayCredentialsWithSecretInputs, t as buildGatewayConnectionDetails } from "./call-DYFR7oGy.js";
+//#region src/gateway/channel-status-patches.ts
+function createConnectedChannelStatusPatch(at = Date.now()) {
+	return {
+		connected: true,
+		lastConnectedAt: at,
+		lastEventAt: at
+	};
+}
+//#endregion
+//#region src/gateway/connection-auth.ts
+function toGatewayCredentialOptions(params) {
+	return {
+		cfg: params.cfg,
+		env: params.env,
+		explicitAuth: params.explicitAuth,
+		urlOverride: params.urlOverride,
+		urlOverrideSource: params.urlOverrideSource,
+		modeOverride: params.modeOverride,
+		includeLegacyEnv: params.includeLegacyEnv,
+		localTokenPrecedence: params.localTokenPrecedence,
+		localPasswordPrecedence: params.localPasswordPrecedence,
+		remoteTokenPrecedence: params.remoteTokenPrecedence,
+		remotePasswordPrecedence: params.remotePasswordPrecedence,
+		remoteTokenFallback: params.remoteTokenFallback,
+		remotePasswordFallback: params.remotePasswordFallback
+	};
+}
+async function resolveGatewayConnectionAuth(params) {
+	return await resolveGatewayCredentialsWithSecretInputs({
+		config: params.config,
+		...toGatewayCredentialOptions({
+			...params,
+			cfg: params.config
+		})
+	});
+}
+//#endregion
+//#region src/gateway/operator-approvals-client.ts
+async function createOperatorApprovalsGatewayClient(params) {
+	const { url: gatewayUrl, urlSource } = buildGatewayConnectionDetails({
+		config: params.config,
+		url: params.gatewayUrl
+	});
+	const gatewayUrlOverrideSource = urlSource === "cli --url" ? "cli" : urlSource === "env MOLDCLAW_GATEWAY_URL" ? "env" : void 0;
+	const auth = await resolveGatewayConnectionAuth({
+		config: params.config,
+		env: process.env,
+		urlOverride: gatewayUrlOverrideSource ? gatewayUrl : void 0,
+		urlOverrideSource: gatewayUrlOverrideSource
+	});
+	return new GatewayClient({
+		url: gatewayUrl,
+		token: auth.token,
+		password: auth.password,
+		clientName: GATEWAY_CLIENT_NAMES.GATEWAY_CLIENT,
+		clientDisplayName: params.clientDisplayName,
+		mode: GATEWAY_CLIENT_MODES.BACKEND,
+		scopes: ["operator.approvals"],
+		onEvent: params.onEvent,
+		onHelloOk: params.onHelloOk,
+		onConnectError: params.onConnectError,
+		onClose: params.onClose
+	});
+}
+//#endregion
+export { resolveGatewayConnectionAuth as n, createConnectedChannelStatusPatch as r, createOperatorApprovalsGatewayClient as t };

package/dist/googlechat-CBCkerAy.js

@@ -0,0 +1,307 @@
+import { t as formatDocsLink } from "./links-C5I443Xb.js";
+import { Ew as applySetupAccountConfigPatch, HC as createAccountListHelpers, Mg as splitSetupEntries, Ow as createPatchedAccountSetupAdapter, cg as addWildcardAllowFrom, kw as migrateBaseNameToDefaultAccount, ug as mergeAllowFromEntries } from "./auth-profiles-9zZdaXJK.js";
+import { n as normalizeAccountId } from "./account-id-O4Og6DrK.js";
+import { o as isSecretRef } from "./types.secrets-Bojc4omL.js";
+const googlechatSetupAdapter = createPatchedAccountSetupAdapter({
+	channelKey: "googlechat",
+	validateInput: ({ accountId, input }) => {
+		if (input.useEnv && accountId !== "default") return "GOOGLE_CHAT_SERVICE_ACCOUNT env vars can only be used for the default account.";
+		if (!input.useEnv && !input.token && !input.tokenFile) return "Google Chat requires --token (service account JSON) or --token-file.";
+		return null;
+	},
+	buildPatch: (input) => {
+		const patch = input.useEnv ? {} : input.tokenFile ? { serviceAccountFile: input.tokenFile } : input.token ? { serviceAccount: input.token } : {};
+		const audienceType = input.audienceType?.trim();
+		const audience = input.audience?.trim();
+		const webhookPath = input.webhookPath?.trim();
+		const webhookUrl = input.webhookUrl?.trim();
+		return {
+			...patch,
+			...audienceType ? { audienceType } : {},
+			...audience ? { audience } : {},
+			...webhookPath ? { webhookPath } : {},
+			...webhookUrl ? { webhookUrl } : {}
+		};
+	}
+});
+//#endregion
+//#region extensions/googlechat/src/accounts.ts
+const ENV_SERVICE_ACCOUNT$1 = "GOOGLE_CHAT_SERVICE_ACCOUNT";
+const ENV_SERVICE_ACCOUNT_FILE$1 = "GOOGLE_CHAT_SERVICE_ACCOUNT_FILE";
+const { listAccountIds: listGoogleChatAccountIds, resolveDefaultAccountId: resolveDefaultGoogleChatAccountId } = createAccountListHelpers("googlechat");
+function resolveAccountConfig(cfg, accountId) {
+	const accounts = cfg.channels?.["googlechat"]?.accounts;
+	if (!accounts || typeof accounts !== "object") return;
+	return accounts[accountId];
+}
+function mergeGoogleChatAccountConfig(cfg, accountId) {
+	const { accounts: _ignored, defaultAccount: _ignored2, ...base } = cfg.channels?.["googlechat"] ?? {};
+	const defaultAccountConfig = resolveAccountConfig(cfg, "default") ?? {};
+	const account = resolveAccountConfig(cfg, accountId) ?? {};
+	if (accountId === "default") return {
+		...base,
+		...defaultAccountConfig
+	};
+	const { enabled: _ignoredEnabled, dangerouslyAllowNameMatching: _ignoredDangerouslyAllowNameMatching, serviceAccount: _ignoredServiceAccount, serviceAccountRef: _ignoredServiceAccountRef, serviceAccountFile: _ignoredServiceAccountFile, ...defaultAccountShared } = defaultAccountConfig;
+	return {
+		...defaultAccountShared,
+		...base,
+		...account
+	};
+}
+function parseServiceAccount(value) {
+	if (value && typeof value === "object") {
+		if (isSecretRef(value)) return null;
+		return value;
+	}
+	if (typeof value !== "string") return null;
+	const trimmed = value.trim();
+	if (!trimmed) return null;
+	try {
+		return JSON.parse(trimmed);
+	} catch {
+		return null;
+	}
+}
+function resolveCredentialsFromConfig(params) {
+	const { account, accountId } = params;
+	const inline = parseServiceAccount(account.serviceAccount);
+	if (inline) return {
+		credentials: inline,
+		source: "inline"
+	};
+	if (isSecretRef(account.serviceAccount)) throw new Error(`channels.googlechat.accounts.${accountId}.serviceAccount: unresolved SecretRef "${account.serviceAccount.source}:${account.serviceAccount.provider}:${account.serviceAccount.id}". Resolve this command against an active gateway runtime snapshot before reading it.`);
+	if (isSecretRef(account.serviceAccountRef)) throw new Error(`channels.googlechat.accounts.${accountId}.serviceAccount: unresolved SecretRef "${account.serviceAccountRef.source}:${account.serviceAccountRef.provider}:${account.serviceAccountRef.id}". Resolve this command against an active gateway runtime snapshot before reading it.`);
+	const file = account.serviceAccountFile?.trim();
+	if (file) return {
+		credentialsFile: file,
+		source: "file"
+	};
+	if (accountId === "default") {
+		const envJson = process.env[ENV_SERVICE_ACCOUNT$1];
+		const envInline = parseServiceAccount(envJson);
+		if (envInline) return {
+			credentials: envInline,
+			source: "env"
+		};
+		const envFile = process.env[ENV_SERVICE_ACCOUNT_FILE$1]?.trim();
+		if (envFile) return {
+			credentialsFile: envFile,
+			source: "env"
+		};
+	}
+	return { source: "none" };
+}
+function resolveGoogleChatAccount(params) {
+	const accountId = normalizeAccountId(params.accountId);
+	const baseEnabled = params.cfg.channels?.["googlechat"]?.enabled !== false;
+	const merged = mergeGoogleChatAccountConfig(params.cfg, accountId);
+	const accountEnabled = merged.enabled !== false;
+	const enabled = baseEnabled && accountEnabled;
+	const credentials = resolveCredentialsFromConfig({
+		accountId,
+		account: merged
+	});
+	return {
+		accountId,
+		name: merged.name?.trim() || void 0,
+		enabled,
+		config: merged,
+		credentialSource: credentials.source,
+		credentials: credentials.credentials,
+		credentialsFile: credentials.credentialsFile
+	};
+}
+function listEnabledGoogleChatAccounts(cfg) {
+	return listGoogleChatAccountIds(cfg).map((accountId) => resolveGoogleChatAccount({
+		cfg,
+		accountId
+	})).filter((account) => account.enabled);
+}
+//#endregion
+//#region extensions/googlechat/src/setup-surface.ts
+const channel = "googlechat";
+const ENV_SERVICE_ACCOUNT = "GOOGLE_CHAT_SERVICE_ACCOUNT";
+const ENV_SERVICE_ACCOUNT_FILE = "GOOGLE_CHAT_SERVICE_ACCOUNT_FILE";
+const USE_ENV_FLAG = "__googlechatUseEnv";
+const AUTH_METHOD_FLAG = "__googlechatAuthMethod";
+function setGoogleChatDmPolicy(cfg, policy) {
+	const allowFrom = policy === "open" ? addWildcardAllowFrom(cfg.channels?.googlechat?.dm?.allowFrom) : void 0;
+	return {
+		...cfg,
+		channels: {
+			...cfg.channels,
+			googlechat: {
+				...cfg.channels?.googlechat,
+				dm: {
+					...cfg.channels?.googlechat?.dm,
+					policy,
+					...allowFrom ? { allowFrom } : {}
+				}
+			}
+		}
+	};
+}
+async function promptAllowFrom(params) {
+	const current = params.cfg.channels?.googlechat?.dm?.allowFrom ?? [];
+	const entry = await params.prompter.text({
+		message: "Google Chat allowFrom (users/<id> or raw email; avoid users/<email>)",
+		placeholder: "users/123456789, name@example.com",
+		initialValue: current[0] ? String(current[0]) : void 0,
+		validate: (value) => String(value ?? "").trim() ? void 0 : "Required"
+	});
+	const unique = mergeAllowFromEntries(void 0, splitSetupEntries(String(entry)));
+	return {
+		...params.cfg,
+		channels: {
+			...params.cfg.channels,
+			googlechat: {
+				...params.cfg.channels?.googlechat,
+				enabled: true,
+				dm: {
+					...params.cfg.channels?.googlechat?.dm,
+					policy: "allowlist",
+					allowFrom: unique
+				}
+			}
+		}
+	};
+}
+const googlechatDmPolicy = {
+	label: "Google Chat",
+	channel,
+	policyKey: "channels.googlechat.dm.policy",
+	allowFromKey: "channels.googlechat.dm.allowFrom",
+	getCurrent: (cfg) => cfg.channels?.googlechat?.dm?.policy ?? "pairing",
+	setPolicy: (cfg, policy) => setGoogleChatDmPolicy(cfg, policy),
+	promptAllowFrom
+};
+const googlechatSetupWizard = {
+	channel,
+	status: {
+		configuredLabel: "configured",
+		unconfiguredLabel: "needs service account",
+		configuredHint: "configured",
+		unconfiguredHint: "needs auth",
+		resolveConfigured: ({ cfg }) => listGoogleChatAccountIds(cfg).some((accountId) => resolveGoogleChatAccount({
+			cfg,
+			accountId
+		}).credentialSource !== "none"),
+		resolveStatusLines: ({ cfg }) => {
+			return [`Google Chat: ${listGoogleChatAccountIds(cfg).some((accountId) => resolveGoogleChatAccount({
+				cfg,
+				accountId
+			}).credentialSource !== "none") ? "configured" : "needs service account"}`];
+		}
+	},
+	introNote: {
+		title: "Google Chat setup",
+		lines: [
+			"Google Chat apps use service-account auth and an HTTPS webhook.",
+			"Set the Chat API scopes in your service account and configure the Chat app URL.",
+			"Webhook verification requires audience type + audience value.",
+			`Docs: ${formatDocsLink("/channels/googlechat", "googlechat")}`
+		]
+	},
+	prepare: async ({ cfg, accountId, credentialValues, prompter }) => {
+		if (accountId === "default" && (Boolean(process.env[ENV_SERVICE_ACCOUNT]) || Boolean(process.env[ENV_SERVICE_ACCOUNT_FILE]))) {
+			if (await prompter.confirm({
+				message: "Use GOOGLE_CHAT_SERVICE_ACCOUNT env vars?",
+				initialValue: true
+			})) return {
+				cfg: applySetupAccountConfigPatch({
+					cfg,
+					channelKey: channel,
+					accountId,
+					patch: {}
+				}),
+				credentialValues: {
+					...credentialValues,
+					[USE_ENV_FLAG]: "1"
+				}
+			};
+		}
+		const method = await prompter.select({
+			message: "Google Chat auth method",
+			options: [{
+				value: "file",
+				label: "Service account JSON file"
+			}, {
+				value: "inline",
+				label: "Paste service account JSON"
+			}],
+			initialValue: "file"
+		});
+		return { credentialValues: {
+			...credentialValues,
+			[USE_ENV_FLAG]: "0",
+			[AUTH_METHOD_FLAG]: String(method)
+		} };
+	},
+	credentials: [],
+	textInputs: [{
+		inputKey: "tokenFile",
+		message: "Service account JSON path",
+		placeholder: "/path/to/service-account.json",
+		shouldPrompt: ({ credentialValues }) => credentialValues[USE_ENV_FLAG] !== "1" && credentialValues[AUTH_METHOD_FLAG] === "file",
+		validate: ({ value }) => String(value ?? "").trim() ? void 0 : "Required",
+		normalizeValue: ({ value }) => String(value).trim(),
+		applySet: async ({ cfg, accountId, value }) => applySetupAccountConfigPatch({
+			cfg,
+			channelKey: channel,
+			accountId,
+			patch: { serviceAccountFile: value }
+		})
+	}, {
+		inputKey: "token",
+		message: "Service account JSON (single line)",
+		placeholder: "{\"type\":\"service_account\", ... }",
+		shouldPrompt: ({ credentialValues }) => credentialValues[USE_ENV_FLAG] !== "1" && credentialValues[AUTH_METHOD_FLAG] === "inline",
+		validate: ({ value }) => String(value ?? "").trim() ? void 0 : "Required",
+		normalizeValue: ({ value }) => String(value).trim(),
+		applySet: async ({ cfg, accountId, value }) => applySetupAccountConfigPatch({
+			cfg,
+			channelKey: channel,
+			accountId,
+			patch: { serviceAccount: value }
+		})
+	}],
+	finalize: async ({ cfg, accountId, prompter }) => {
+		const account = resolveGoogleChatAccount({
+			cfg,
+			accountId
+		});
+		const audienceType = await prompter.select({
+			message: "Webhook audience type",
+			options: [{
+				value: "app-url",
+				label: "App URL (recommended)"
+			}, {
+				value: "project-number",
+				label: "Project number"
+			}],
+			initialValue: account.config.audienceType === "project-number" ? "project-number" : "app-url"
+		});
+		const audience = await prompter.text({
+			message: audienceType === "project-number" ? "Project number" : "App URL",
+			placeholder: audienceType === "project-number" ? "1234567890" : "https://your.host/googlechat",
+			initialValue: account.config.audience || void 0,
+			validate: (value) => String(value ?? "").trim() ? void 0 : "Required"
+		});
+		return { cfg: migrateBaseNameToDefaultAccount({
+			cfg: applySetupAccountConfigPatch({
+				cfg,
+				channelKey: channel,
+				accountId,
+				patch: {
+					audienceType,
+					audience: String(audience).trim()
+				}
+			}),
+			channelKey: channel
+		}) };
+	},
+	dmPolicy: googlechatDmPolicy
+};
+//#endregion
+export { resolveGoogleChatAccount as a, resolveDefaultGoogleChatAccountId as i, listEnabledGoogleChatAccounts as n, googlechatSetupAdapter as o, listGoogleChatAccountIds as r, googlechatSetupWizard as t };

package/dist/googlechat-CSUNieHX.d.ts

@@ -0,0 +1,12 @@
+import { eO as ChannelSetupWizard, xi as ChannelSetupAdapter } from "./types-DBhDdMQd.js";
+
+//#region src/infra/outbound/target-errors.d.ts
+declare function missingTargetError(provider: string, hint?: string): Error;
+//#endregion
+//#region extensions/googlechat/src/setup-core.d.ts
+declare const googlechatSetupAdapter: ChannelSetupAdapter;
+//#endregion
+//#region extensions/googlechat/src/setup-surface.d.ts
+declare const googlechatSetupWizard: ChannelSetupWizard;
+//#endregion
+export { googlechatSetupAdapter as n, missingTargetError as r, googlechatSetupWizard as t };

package/dist/group-access-rSvkIglb.d.ts

@@ -0,0 +1,61 @@
+import { l as GroupPolicy } from "./types.base-B_TkkSS8.js";
+
+//#region src/plugin-sdk/group-access.d.ts
+type SenderGroupAccessReason = "allowed" | "disabled" | "empty_allowlist" | "sender_not_allowlisted";
+type SenderGroupAccessDecision = {
+  allowed: boolean;
+  groupPolicy: GroupPolicy;
+  providerMissingFallbackApplied: boolean;
+  reason: SenderGroupAccessReason;
+};
+type GroupRouteAccessReason = "allowed" | "disabled" | "empty_allowlist" | "route_not_allowlisted" | "route_disabled";
+type GroupRouteAccessDecision = {
+  allowed: boolean;
+  groupPolicy: GroupPolicy;
+  reason: GroupRouteAccessReason;
+};
+type MatchedGroupAccessReason = "allowed" | "disabled" | "missing_match_input" | "empty_allowlist" | "not_allowlisted";
+type MatchedGroupAccessDecision = {
+  allowed: boolean;
+  groupPolicy: GroupPolicy;
+  reason: MatchedGroupAccessReason;
+};
+/** Downgrade sender-scoped group policy to open mode when no allowlist is configured. */
+declare function resolveSenderScopedGroupPolicy(params: {
+  groupPolicy: GroupPolicy;
+  groupAllowFrom: string[];
+}): GroupPolicy;
+/** Evaluate route-level group access after policy, route match, and enablement checks. */
+declare function evaluateGroupRouteAccessForPolicy(params: {
+  groupPolicy: GroupPolicy;
+  routeAllowlistConfigured: boolean;
+  routeMatched: boolean;
+  routeEnabled?: boolean;
+}): GroupRouteAccessDecision;
+/** Evaluate generic allowlist match state for channels that compare derived group identifiers. */
+declare function evaluateMatchedGroupAccessForPolicy(params: {
+  groupPolicy: GroupPolicy;
+  allowlistConfigured: boolean;
+  allowlistMatched: boolean;
+  requireMatchInput?: boolean;
+  hasMatchInput?: boolean;
+}): MatchedGroupAccessDecision;
+/** Evaluate sender access for an already-resolved group policy and allowlist. */
+declare function evaluateSenderGroupAccessForPolicy(params: {
+  groupPolicy: GroupPolicy;
+  providerMissingFallbackApplied?: boolean;
+  groupAllowFrom: string[];
+  senderId: string;
+  isSenderAllowed: (senderId: string, allowFrom: string[]) => boolean;
+}): SenderGroupAccessDecision;
+/** Resolve provider fallback policy first, then evaluate sender access against that result. */
+declare function evaluateSenderGroupAccess(params: {
+  providerConfigPresent: boolean;
+  configuredGroupPolicy?: GroupPolicy;
+  defaultGroupPolicy?: GroupPolicy;
+  groupAllowFrom: string[];
+  senderId: string;
+  isSenderAllowed: (senderId: string, allowFrom: string[]) => boolean;
+}): SenderGroupAccessDecision;
+//#endregion
+export { SenderGroupAccessDecision as a, evaluateMatchedGroupAccessForPolicy as c, resolveSenderScopedGroupPolicy as d, MatchedGroupAccessReason as i, evaluateSenderGroupAccess as l, GroupRouteAccessReason as n, SenderGroupAccessReason as o, MatchedGroupAccessDecision as r, evaluateGroupRouteAccessForPolicy as s, GroupRouteAccessDecision as t, evaluateSenderGroupAccessForPolicy as u };