@vibe-lark/larkpal 0.1.84 → 0.1.86

package/dist/resolve-C33B7eeu-BNvYTl6k.mjs

@@ -0,0 +1,1041 @@
+import { o as normalizeLowercaseStringOrEmpty } from "./home-dir-C44RaPME-CBRS4HLP.mjs";
+import { l as resolveUserPath, s as isRecord } from "./bundled-dir-U738ay4K-DXK0q_TV.mjs";
+import { l as isPathInside } from "./io-CH2g3vsv-BOGlLlB8.mjs";
+import { Mt as formatErrorMessage, ft as SINGLE_VALUE_FILE_REF_ID, gt as secretRefKey, ht as resolveDefaultSecretProviderAlias, mt as isValidExecSecretRefId, pt as formatExecSecretRefIdValidationMessage } from "./bundled-compat-BpaDaAAu-D7oazKjD.mjs";
+import { m as runExec } from "./runtime-snapshot-C54O1-gI-40cbyi7P.mjs";
+import "node:fs";
+import path from "node:path";
+import fs$1 from "node:fs/promises";
+import os from "node:os";
+import { spawn } from "node:child_process";
+//#region node_modules/.pnpm/openclaw@2026.4.22_@napi-rs+canvas@0.1.99/node_modules/openclaw/dist/audit-fs-DNqHeAl9.js
+const INHERIT_FLAGS = new Set([
+	"I",
+	"OI",
+	"CI",
+	"IO",
+	"NP"
+]);
+const WORLD_PRINCIPALS = new Set([
+	"everyone",
+	"users",
+	"builtin\\users",
+	"authenticated users",
+	"nt authority\\authenticated users"
+]);
+const TRUSTED_BASE = new Set([
+	"nt authority\\system",
+	"system",
+	"builtin\\administrators",
+	"creator owner",
+	"autorite nt\\système",
+	"nt-autorität\\system",
+	"autoridad nt\\system",
+	"autoridade nt\\system"
+]);
+const WORLD_SUFFIXES = ["\\users", "\\authenticated users"];
+const TRUSTED_SUFFIXES = [
+	"\\administrators",
+	"\\system",
+	"\\système"
+];
+const SID_RE = /^\*?s-\d+-\d+(-\d+)+$/i;
+const TRUSTED_SIDS = new Set([
+	"s-1-5-18",
+	"s-1-5-32-544",
+	"s-1-5-80-956008885-3418522649-1831038044-1853292631-2271478464"
+]);
+const WORLD_SIDS = new Set([
+	"s-1-1-0",
+	"s-1-5-11",
+	"s-1-5-32-545"
+]);
+const STATUS_PREFIXES = [
+	"successfully processed",
+	"processed",
+	"failed processing",
+	"no mapping between account names"
+];
+const normalize = (value) => normalizeLowercaseStringOrEmpty(value);
+function normalizeSid(value) {
+	const normalized = normalize(value);
+	return normalized.startsWith("*") ? normalized.slice(1) : normalized;
+}
+function resolveWindowsUserPrincipal(env) {
+	const username = env?.USERNAME?.trim() || os.userInfo().username?.trim();
+	if (!username) return null;
+	const domain = env?.USERDOMAIN?.trim();
+	return domain ? `${domain}\\${username}` : username;
+}
+function buildTrustedPrincipals(env) {
+	const trusted = new Set(TRUSTED_BASE);
+	const principal = resolveWindowsUserPrincipal(env);
+	if (principal) {
+		trusted.add(normalize(principal));
+		const userOnly = principal.split("\\").at(-1);
+		if (userOnly) trusted.add(normalize(userOnly));
+	}
+	const userSid = normalizeSid(env?.USERSID ?? "");
+	if (userSid && SID_RE.test(userSid) && !WORLD_SIDS.has(userSid)) trusted.add(userSid);
+	return trusted;
+}
+function classifyPrincipal(principal, trustedPrincipals) {
+	const normalized = normalize(principal);
+	if (SID_RE.test(normalized)) {
+		const sid = normalizeSid(normalized);
+		if (WORLD_SIDS.has(sid)) return "world";
+		if (TRUSTED_SIDS.has(sid) || trustedPrincipals.has(sid)) return "trusted";
+		return "group";
+	}
+	if (trustedPrincipals.has(normalized) || TRUSTED_SUFFIXES.some((suffix) => normalized.endsWith(suffix))) return "trusted";
+	if (WORLD_PRINCIPALS.has(normalized) || WORLD_SUFFIXES.some((suffix) => normalized.endsWith(suffix))) return "world";
+	const stripped = normalized.normalize("NFD").replace(/[\u0300-\u036f]/g, "");
+	if (stripped !== normalized && (TRUSTED_BASE.has(stripped) || TRUSTED_SUFFIXES.some((suffix) => {
+		const strippedSuffix = suffix.normalize("NFD").replace(/[\u0300-\u036f]/g, "");
+		return stripped.endsWith(strippedSuffix);
+	}))) return "trusted";
+	return "group";
+}
+function rightsFromTokens(tokens) {
+	const upper = tokens.join("").toUpperCase();
+	const canWrite = upper.includes("F") || upper.includes("M") || upper.includes("W") || upper.includes("D");
+	return {
+		canRead: upper.includes("F") || upper.includes("M") || upper.includes("R"),
+		canWrite
+	};
+}
+function isStatusLine(lowerLine) {
+	return STATUS_PREFIXES.some((prefix) => lowerLine.startsWith(prefix));
+}
+function stripTargetPrefix(params) {
+	if (params.lowerLine.startsWith(params.lowerTarget)) return params.trimmedLine.slice(params.normalizedTarget.length).trim();
+	if (params.lowerLine.startsWith(params.quotedLower)) return params.trimmedLine.slice(params.quotedTarget.length).trim();
+	return params.trimmedLine;
+}
+function parseAceEntry(entry) {
+	if (!entry || !entry.includes("(")) return null;
+	const idx = entry.indexOf(":");
+	if (idx === -1) return null;
+	const principal = entry.slice(0, idx).trim();
+	const rawRights = entry.slice(idx + 1).trim();
+	const tokens = rawRights.match(/\(([^)]+)\)/g)?.map((token) => token.slice(1, -1).trim()).filter(Boolean) ?? [];
+	if (tokens.some((token) => token.toUpperCase() === "DENY")) return null;
+	const rights = tokens.filter((token) => !INHERIT_FLAGS.has(token.toUpperCase()));
+	if (rights.length === 0) return null;
+	const { canRead, canWrite } = rightsFromTokens(rights);
+	return {
+		principal,
+		rights,
+		rawRights,
+		canRead,
+		canWrite
+	};
+}
+function parseIcaclsOutput(output, targetPath) {
+	const entries = [];
+	const normalizedTarget = targetPath.trim();
+	const lowerTarget = normalizedTarget.toLowerCase();
+	const quotedTarget = `"${normalizedTarget}"`;
+	const quotedLower = quotedTarget.toLowerCase();
+	for (const rawLine of output.split(/\r?\n/)) {
+		const line = rawLine.trimEnd();
+		if (!line.trim()) continue;
+		const trimmed = line.trim();
+		const lower = trimmed.toLowerCase();
+		if (isStatusLine(lower)) continue;
+		const parsed = parseAceEntry(stripTargetPrefix({
+			trimmedLine: trimmed,
+			lowerLine: lower,
+			normalizedTarget,
+			lowerTarget,
+			quotedTarget,
+			quotedLower
+		}));
+		if (!parsed) continue;
+		entries.push(parsed);
+	}
+	return entries;
+}
+function summarizeWindowsAcl(entries, env) {
+	const trustedPrincipals = buildTrustedPrincipals(env);
+	const trusted = [];
+	const untrustedWorld = [];
+	const untrustedGroup = [];
+	for (const entry of entries) {
+		const classification = classifyPrincipal(entry.principal, trustedPrincipals);
+		if (classification === "trusted") trusted.push(entry);
+		else if (classification === "world") untrustedWorld.push(entry);
+		else untrustedGroup.push(entry);
+	}
+	return {
+		trusted,
+		untrustedWorld,
+		untrustedGroup
+	};
+}
+async function resolveCurrentUserSid(exec) {
+	try {
+		const { stdout, stderr } = await exec("whoami", [
+			"/user",
+			"/fo",
+			"csv",
+			"/nh"
+		]);
+		const match = `${stdout}\n${stderr}`.match(/\*?S-\d+-\d+(?:-\d+)+/i);
+		return match ? normalizeSid(match[0]) : null;
+	} catch (err) {
+		console.warn("[windows-acl] resolveCurrentUserSid failed:", String(err));
+		return null;
+	}
+}
+async function inspectWindowsAcl(targetPath, opts) {
+	const exec = opts?.exec ?? runExec;
+	try {
+		const { stdout, stderr } = await exec("icacls", [targetPath, "/sid"]);
+		const entries = parseIcaclsOutput(`${stdout}\n${stderr}`.trim(), targetPath);
+		let effectiveEnv = opts?.env;
+		let { trusted, untrustedWorld, untrustedGroup } = summarizeWindowsAcl(entries, effectiveEnv);
+		if (!effectiveEnv?.USERSID && untrustedGroup.some((entry) => SID_RE.test(normalize(entry.principal)))) {
+			const currentUserSid = await resolveCurrentUserSid(exec);
+			if (currentUserSid) {
+				effectiveEnv = {
+					...effectiveEnv,
+					USERSID: currentUserSid
+				};
+				({trusted, untrustedWorld, untrustedGroup} = summarizeWindowsAcl(entries, effectiveEnv));
+			}
+		}
+		return {
+			ok: true,
+			entries,
+			trusted,
+			untrustedWorld,
+			untrustedGroup
+		};
+	} catch (err) {
+		return {
+			ok: false,
+			entries: [],
+			trusted: [],
+			untrustedWorld: [],
+			untrustedGroup: [],
+			error: String(err)
+		};
+	}
+}
+function formatWindowsAclSummary(summary) {
+	if (!summary.ok) return "unknown";
+	const untrusted = [...summary.untrustedWorld, ...summary.untrustedGroup];
+	if (untrusted.length === 0) return "trusted-only";
+	return untrusted.map((entry) => `${entry.principal}:${entry.rawRights}`).join(", ");
+}
+async function safeStat(targetPath) {
+	try {
+		const lst = await fs$1.lstat(targetPath);
+		return {
+			ok: true,
+			isSymlink: lst.isSymbolicLink(),
+			isDir: lst.isDirectory(),
+			mode: typeof lst.mode === "number" ? lst.mode : null,
+			uid: typeof lst.uid === "number" ? lst.uid : null,
+			gid: typeof lst.gid === "number" ? lst.gid : null
+		};
+	} catch (err) {
+		return {
+			ok: false,
+			isSymlink: false,
+			isDir: false,
+			mode: null,
+			uid: null,
+			gid: null,
+			error: String(err)
+		};
+	}
+}
+async function inspectPathPermissions(targetPath, opts) {
+	const st = await safeStat(targetPath);
+	if (!st.ok) return {
+		ok: false,
+		isSymlink: false,
+		isDir: false,
+		mode: null,
+		bits: null,
+		source: "unknown",
+		worldWritable: false,
+		groupWritable: false,
+		worldReadable: false,
+		groupReadable: false,
+		error: st.error
+	};
+	let effectiveMode = st.mode;
+	let effectiveIsDir = st.isDir;
+	if (st.isSymlink) try {
+		const target = await fs$1.stat(targetPath);
+		effectiveMode = typeof target.mode === "number" ? target.mode : st.mode;
+		effectiveIsDir = target.isDirectory();
+	} catch {}
+	const bits = modeBits(effectiveMode);
+	if ((opts?.platform ?? process.platform) === "win32") {
+		const acl = await inspectWindowsAcl(targetPath, {
+			env: opts?.env,
+			exec: opts?.exec
+		});
+		if (!acl.ok) return {
+			ok: true,
+			isSymlink: st.isSymlink,
+			isDir: effectiveIsDir,
+			mode: effectiveMode,
+			bits,
+			source: "unknown",
+			worldWritable: false,
+			groupWritable: false,
+			worldReadable: false,
+			groupReadable: false,
+			error: acl.error
+		};
+		return {
+			ok: true,
+			isSymlink: st.isSymlink,
+			isDir: effectiveIsDir,
+			mode: effectiveMode,
+			bits,
+			source: "windows-acl",
+			worldWritable: acl.untrustedWorld.some((entry) => entry.canWrite),
+			groupWritable: acl.untrustedGroup.some((entry) => entry.canWrite),
+			worldReadable: acl.untrustedWorld.some((entry) => entry.canRead),
+			groupReadable: acl.untrustedGroup.some((entry) => entry.canRead),
+			aclSummary: formatWindowsAclSummary(acl)
+		};
+	}
+	return {
+		ok: true,
+		isSymlink: st.isSymlink,
+		isDir: effectiveIsDir,
+		mode: effectiveMode,
+		bits,
+		source: "posix",
+		worldWritable: isWorldWritable(bits),
+		groupWritable: isGroupWritable(bits),
+		worldReadable: isWorldReadable(bits),
+		groupReadable: isGroupReadable(bits)
+	};
+}
+function modeBits(mode) {
+	if (mode == null) return null;
+	return mode & 511;
+}
+function isWorldWritable(bits) {
+	if (bits == null) return false;
+	return (bits & 2) !== 0;
+}
+function isGroupWritable(bits) {
+	if (bits == null) return false;
+	return (bits & 16) !== 0;
+}
+function isWorldReadable(bits) {
+	if (bits == null) return false;
+	return (bits & 4) !== 0;
+}
+function isGroupReadable(bits) {
+	if (bits == null) return false;
+	return (bits & 32) !== 0;
+}
+//#endregion
+//#region node_modules/.pnpm/openclaw@2026.4.22_@napi-rs+canvas@0.1.99/node_modules/openclaw/dist/run-with-concurrency-jYHyKOXI.js
+async function runTasksWithConcurrency(params) {
+	const { tasks, limit, onTaskError } = params;
+	const errorMode = params.errorMode ?? "continue";
+	if (tasks.length === 0) return {
+		results: [],
+		firstError: void 0,
+		hasError: false
+	};
+	const resolvedLimit = Math.max(1, Math.min(limit, tasks.length));
+	const results = Array.from({ length: tasks.length });
+	let next = 0;
+	let firstError = void 0;
+	let hasError = false;
+	const workers = Array.from({ length: resolvedLimit }, async () => {
+		while (true) {
+			if (errorMode === "stop" && hasError) return;
+			const index = next;
+			next += 1;
+			if (index >= tasks.length) return;
+			try {
+				results[index] = await tasks[index]();
+			} catch (error) {
+				if (!hasError) {
+					firstError = error;
+					hasError = true;
+				}
+				onTaskError?.(error, index);
+				if (errorMode === "stop") return;
+			}
+		}
+	});
+	await Promise.allSettled(workers);
+	return {
+		results,
+		firstError,
+		hasError
+	};
+}
+//#endregion
+//#region node_modules/.pnpm/openclaw@2026.4.22_@napi-rs+canvas@0.1.99/node_modules/openclaw/dist/json-pointer-DC9QXazO.js
+function failOrUndefined(params) {
+	if (params.onMissing === "throw") throw new Error(params.message);
+}
+function isJsonObject(value) {
+	return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function decodeJsonPointerToken(token) {
+	return token.replace(/~1/g, "/").replace(/~0/g, "~");
+}
+function readJsonPointer(root, pointer, options = {}) {
+	const onMissing = options.onMissing ?? "throw";
+	if (!pointer.startsWith("/")) return failOrUndefined({
+		onMissing,
+		message: "File-backed secret ids must be absolute JSON pointers (for example: \"/providers/openai/apiKey\")."
+	});
+	const tokens = pointer.slice(1).split("/").map((token) => decodeJsonPointerToken(token));
+	let current = root;
+	for (const token of tokens) {
+		if (Array.isArray(current)) {
+			const index = Number.parseInt(token, 10);
+			if (!Number.isFinite(index) || index < 0 || index >= current.length) return failOrUndefined({
+				onMissing,
+				message: `JSON pointer segment "${token}" is out of bounds.`
+			});
+			current = current[index];
+			continue;
+		}
+		if (!isJsonObject(current)) return failOrUndefined({
+			onMissing,
+			message: `JSON pointer segment "${token}" does not exist.`
+		});
+		if (!Object.hasOwn(current, token)) return failOrUndefined({
+			onMissing,
+			message: `JSON pointer segment "${token}" does not exist.`
+		});
+		current = current[token];
+	}
+	return current;
+}
+//#endregion
+//#region node_modules/.pnpm/openclaw@2026.4.22_@napi-rs+canvas@0.1.99/node_modules/openclaw/dist/shared-BBsAgaUp.js
+function isNonEmptyString(value) {
+	return typeof value === "string" && value.trim().length > 0;
+}
+function normalizePositiveInt(value, fallback) {
+	if (typeof value === "number" && Number.isFinite(value)) return Math.max(1, Math.floor(value));
+	return Math.max(1, Math.floor(fallback));
+}
+//#endregion
+//#region node_modules/.pnpm/openclaw@2026.4.22_@napi-rs+canvas@0.1.99/node_modules/openclaw/dist/resolve-C33B7eeu.js
+const DEFAULT_PROVIDER_CONCURRENCY = 4;
+const DEFAULT_MAX_REFS_PER_PROVIDER = 512;
+const DEFAULT_MAX_BATCH_BYTES = 256 * 1024;
+const DEFAULT_FILE_MAX_BYTES = 1024 * 1024;
+const DEFAULT_FILE_TIMEOUT_MS = 5e3;
+const DEFAULT_EXEC_TIMEOUT_MS = 5e3;
+const DEFAULT_EXEC_MAX_OUTPUT_BYTES = 1024 * 1024;
+const WINDOWS_ABS_PATH_PATTERN = /^[A-Za-z]:[\\/]/;
+const WINDOWS_UNC_PATH_PATTERN = /^\\\\[^\\]+\\[^\\]+/;
+var SecretProviderResolutionError = class extends Error {
+	constructor(params) {
+		super(params.message, params.cause !== void 0 ? { cause: params.cause } : void 0);
+		this.scope = "provider";
+		this.name = "SecretProviderResolutionError";
+		this.source = params.source;
+		this.provider = params.provider;
+	}
+};
+var SecretRefResolutionError = class extends Error {
+	constructor(params) {
+		super(params.message, params.cause !== void 0 ? { cause: params.cause } : void 0);
+		this.scope = "ref";
+		this.name = "SecretRefResolutionError";
+		this.source = params.source;
+		this.provider = params.provider;
+		this.refId = params.refId;
+	}
+};
+function isSecretResolutionError(value) {
+	return value instanceof SecretProviderResolutionError || value instanceof SecretRefResolutionError;
+}
+function providerResolutionError(params) {
+	return new SecretProviderResolutionError(params);
+}
+function refResolutionError(params) {
+	return new SecretRefResolutionError(params);
+}
+function throwUnknownProviderResolutionError(params) {
+	if (isSecretResolutionError(params.err)) throw params.err;
+	throw providerResolutionError({
+		source: params.source,
+		provider: params.provider,
+		message: formatErrorMessage(params.err),
+		cause: params.err
+	});
+}
+async function readFileStatOrThrow(pathname, label) {
+	const stat = await safeStat(pathname);
+	if (!stat.ok) throw new Error(`${label} is not readable: ${pathname}`);
+	if (stat.isDir) throw new Error(`${label} must be a file: ${pathname}`);
+	return stat;
+}
+function isAbsolutePathname(value) {
+	return path.isAbsolute(value) || WINDOWS_ABS_PATH_PATTERN.test(value) || WINDOWS_UNC_PATH_PATTERN.test(value);
+}
+function resolveResolutionLimits(config) {
+	const resolution = config.secrets?.resolution;
+	return {
+		maxProviderConcurrency: normalizePositiveInt(resolution?.maxProviderConcurrency, DEFAULT_PROVIDER_CONCURRENCY),
+		maxRefsPerProvider: normalizePositiveInt(resolution?.maxRefsPerProvider, DEFAULT_MAX_REFS_PER_PROVIDER),
+		maxBatchBytes: normalizePositiveInt(resolution?.maxBatchBytes, DEFAULT_MAX_BATCH_BYTES)
+	};
+}
+function toProviderKey(source, provider) {
+	return `${source}:${provider}`;
+}
+function resolveConfiguredProvider(ref, config) {
+	const providerConfig = config.secrets?.providers?.[ref.provider];
+	if (!providerConfig) {
+		if (ref.source === "env" && ref.provider === resolveDefaultSecretProviderAlias(config, "env")) return { source: "env" };
+		throw providerResolutionError({
+			source: ref.source,
+			provider: ref.provider,
+			message: `Secret provider "${ref.provider}" is not configured (ref: ${ref.source}:${ref.provider}:${ref.id}).`
+		});
+	}
+	if (providerConfig.source !== ref.source) throw providerResolutionError({
+		source: ref.source,
+		provider: ref.provider,
+		message: `Secret provider "${ref.provider}" has source "${providerConfig.source}" but ref requests "${ref.source}".`
+	});
+	return providerConfig;
+}
+async function assertSecurePath(params) {
+	if (!isAbsolutePathname(params.targetPath)) throw new Error(`${params.label} must be an absolute path.`);
+	let effectivePath = params.targetPath;
+	let stat = await readFileStatOrThrow(effectivePath, params.label);
+	if (stat.isSymlink) {
+		if (!params.allowSymlinkPath) throw new Error(`${params.label} must not be a symlink: ${effectivePath}`);
+		try {
+			effectivePath = await fs$1.realpath(effectivePath);
+		} catch {
+			throw new Error(`${params.label} symlink target is not readable: ${params.targetPath}`);
+		}
+		if (!isAbsolutePathname(effectivePath)) throw new Error(`${params.label} resolved symlink target must be an absolute path.`);
+		stat = await readFileStatOrThrow(effectivePath, params.label);
+		if (stat.isSymlink) throw new Error(`${params.label} symlink target must not be a symlink: ${effectivePath}`);
+	}
+	if (params.trustedDirs && params.trustedDirs.length > 0) {
+		if (!params.trustedDirs.map((entry) => resolveUserPath(entry)).some((dir) => isPathInside(dir, effectivePath))) throw new Error(`${params.label} is outside trustedDirs: ${effectivePath}`);
+	}
+	if (params.allowInsecurePath) return effectivePath;
+	const perms = await inspectPathPermissions(effectivePath);
+	if (!perms.ok) throw new Error(`${params.label} permissions could not be verified: ${effectivePath}`);
+	const writableByOthers = perms.worldWritable || perms.groupWritable;
+	const readableByOthers = perms.worldReadable || perms.groupReadable;
+	if (writableByOthers || !params.allowReadableByOthers && readableByOthers) throw new Error(`${params.label} permissions are too open: ${effectivePath}`);
+	if (process.platform === "win32" && perms.source === "unknown") throw new Error(`${params.label} ACL verification unavailable on Windows for ${effectivePath}. Set allowInsecurePath=true for this provider to bypass this check when the path is trusted.`);
+	if (process.platform !== "win32" && typeof process.getuid === "function" && stat.uid != null) {
+		const uid = process.getuid();
+		if (stat.uid !== uid) throw new Error(`${params.label} must be owned by the current user (uid=${uid}): ${effectivePath}`);
+	}
+	return effectivePath;
+}
+async function readFileProviderPayload(params) {
+	const cacheKey = params.providerName;
+	const cache = params.cache;
+	const cachedFilePayload = cache?.filePayloadByProvider?.get(cacheKey);
+	if (cachedFilePayload) return await cachedFilePayload;
+	const filePath = resolveUserPath(params.providerConfig.path);
+	const readPromise = (async () => {
+		const secureFilePath = await assertSecurePath({
+			targetPath: filePath,
+			label: `secrets.providers.${params.providerName}.path`
+		});
+		const timeoutMs = normalizePositiveInt(params.providerConfig.timeoutMs, DEFAULT_FILE_TIMEOUT_MS);
+		const maxBytes = normalizePositiveInt(params.providerConfig.maxBytes, DEFAULT_FILE_MAX_BYTES);
+		const abortController = new AbortController();
+		const timeoutErrorMessage = `File provider "${params.providerName}" timed out after ${timeoutMs}ms.`;
+		let timeoutHandle = null;
+		const timeoutPromise = new Promise((_resolve, reject) => {
+			timeoutHandle = setTimeout(() => {
+				abortController.abort();
+				reject(new Error(timeoutErrorMessage));
+			}, timeoutMs);
+		});
+		try {
+			const payload = await Promise.race([fs$1.readFile(secureFilePath, { signal: abortController.signal }), timeoutPromise]);
+			if (payload.byteLength > maxBytes) throw new Error(`File provider "${params.providerName}" exceeded maxBytes (${maxBytes}).`);
+			const text = payload.toString("utf8");
+			if (params.providerConfig.mode === "singleValue") return text.replace(/\r?\n$/, "");
+			const parsed = JSON.parse(text);
+			if (!isRecord(parsed)) throw new Error(`File provider "${params.providerName}" payload is not a JSON object.`);
+			return parsed;
+		} catch (error) {
+			if (error instanceof Error && error.name === "AbortError") throw new Error(timeoutErrorMessage, { cause: error });
+			throw error;
+		} finally {
+			if (timeoutHandle) clearTimeout(timeoutHandle);
+		}
+	})();
+	if (cache) {
+		cache.filePayloadByProvider ??= /* @__PURE__ */ new Map();
+		cache.filePayloadByProvider.set(cacheKey, readPromise);
+	}
+	return await readPromise;
+}
+async function resolveEnvRefs(params) {
+	const resolved = /* @__PURE__ */ new Map();
+	const allowlist = params.providerConfig.allowlist ? new Set(params.providerConfig.allowlist) : null;
+	for (const ref of params.refs) {
+		if (allowlist && !allowlist.has(ref.id)) throw refResolutionError({
+			source: "env",
+			provider: params.providerName,
+			refId: ref.id,
+			message: `Environment variable "${ref.id}" is not allowlisted in secrets.providers.${params.providerName}.allowlist.`
+		});
+		const envValue = params.env[ref.id];
+		if (!isNonEmptyString(envValue)) throw refResolutionError({
+			source: "env",
+			provider: params.providerName,
+			refId: ref.id,
+			message: `Environment variable "${ref.id}" is missing or empty.`
+		});
+		resolved.set(ref.id, envValue);
+	}
+	return resolved;
+}
+async function resolveFileRefs(params) {
+	let payload;
+	try {
+		payload = await readFileProviderPayload({
+			providerName: params.providerName,
+			providerConfig: params.providerConfig,
+			cache: params.cache
+		});
+	} catch (err) {
+		throwUnknownProviderResolutionError({
+			source: "file",
+			provider: params.providerName,
+			err
+		});
+	}
+	const mode = params.providerConfig.mode ?? "json";
+	const resolved = /* @__PURE__ */ new Map();
+	if (mode === "singleValue") {
+		for (const ref of params.refs) {
+			if (ref.id !== "value") throw refResolutionError({
+				source: "file",
+				provider: params.providerName,
+				refId: ref.id,
+				message: `singleValue file provider "${params.providerName}" expects ref id "${SINGLE_VALUE_FILE_REF_ID}".`
+			});
+			resolved.set(ref.id, payload);
+		}
+		return resolved;
+	}
+	for (const ref of params.refs) try {
+		resolved.set(ref.id, readJsonPointer(payload, ref.id, { onMissing: "throw" }));
+	} catch (err) {
+		throw refResolutionError({
+			source: "file",
+			provider: params.providerName,
+			refId: ref.id,
+			message: formatErrorMessage(err),
+			cause: err
+		});
+	}
+	return resolved;
+}
+function isIgnorableStdinWriteError(error) {
+	if (typeof error !== "object" || error === null || !("code" in error)) return false;
+	const code = String(error.code);
+	return code === "EPIPE" || code === "ERR_STREAM_DESTROYED";
+}
+async function runExecResolver(params) {
+	return await new Promise((resolve, reject) => {
+		const child = spawn(params.command, params.args, {
+			cwd: params.cwd,
+			env: params.env,
+			stdio: [
+				"pipe",
+				"pipe",
+				"pipe"
+			],
+			shell: false,
+			windowsHide: true
+		});
+		let settled = false;
+		let stdout = "";
+		let stderr = "";
+		let timedOut = false;
+		let noOutputTimedOut = false;
+		let outputBytes = 0;
+		let noOutputTimer = null;
+		const timeoutTimer = setTimeout(() => {
+			timedOut = true;
+			child.kill("SIGKILL");
+		}, params.timeoutMs);
+		const clearTimers = () => {
+			clearTimeout(timeoutTimer);
+			if (noOutputTimer) {
+				clearTimeout(noOutputTimer);
+				noOutputTimer = null;
+			}
+		};
+		const armNoOutputTimer = () => {
+			if (noOutputTimer) clearTimeout(noOutputTimer);
+			noOutputTimer = setTimeout(() => {
+				noOutputTimedOut = true;
+				child.kill("SIGKILL");
+			}, params.noOutputTimeoutMs);
+		};
+		const append = (chunk, target) => {
+			const text = typeof chunk === "string" ? chunk : chunk.toString("utf8");
+			outputBytes += Buffer.byteLength(text, "utf8");
+			if (outputBytes > params.maxOutputBytes) {
+				child.kill("SIGKILL");
+				if (!settled) {
+					settled = true;
+					clearTimers();
+					reject(/* @__PURE__ */ new Error(`Exec provider output exceeded maxOutputBytes (${params.maxOutputBytes}).`));
+				}
+				return;
+			}
+			if (target === "stdout") stdout += text;
+			else stderr += text;
+			armNoOutputTimer();
+		};
+		armNoOutputTimer();
+		child.on("error", (error) => {
+			if (settled) return;
+			settled = true;
+			clearTimers();
+			reject(error);
+		});
+		child.stdout?.on("data", (chunk) => append(chunk, "stdout"));
+		child.stderr?.on("data", (chunk) => append(chunk, "stderr"));
+		child.on("close", (code, signal) => {
+			if (settled) return;
+			settled = true;
+			clearTimers();
+			resolve({
+				stdout,
+				stderr,
+				code,
+				signal,
+				termination: noOutputTimedOut ? "no-output-timeout" : timedOut ? "timeout" : "exit"
+			});
+		});
+		const handleStdinError = (error) => {
+			if (isIgnorableStdinWriteError(error) || settled) return;
+			settled = true;
+			clearTimers();
+			reject(error instanceof Error ? error : new Error(String(error)));
+		};
+		child.stdin?.on("error", handleStdinError);
+		try {
+			child.stdin?.end(params.input);
+		} catch (error) {
+			handleStdinError(error);
+		}
+	});
+}
+function parseExecValues(params) {
+	const trimmed = params.stdout.trim();
+	if (!trimmed) throw providerResolutionError({
+		source: "exec",
+		provider: params.providerName,
+		message: `Exec provider "${params.providerName}" returned empty stdout.`
+	});
+	let parsed;
+	if (!params.jsonOnly && params.ids.length === 1) try {
+		parsed = JSON.parse(trimmed);
+	} catch {
+		return { [params.ids[0]]: trimmed };
+	}
+	else try {
+		parsed = JSON.parse(trimmed);
+	} catch {
+		throw providerResolutionError({
+			source: "exec",
+			provider: params.providerName,
+			message: `Exec provider "${params.providerName}" returned invalid JSON.`
+		});
+	}
+	if (!isRecord(parsed)) {
+		if (!params.jsonOnly && params.ids.length === 1 && typeof parsed === "string") return { [params.ids[0]]: parsed };
+		throw providerResolutionError({
+			source: "exec",
+			provider: params.providerName,
+			message: `Exec provider "${params.providerName}" response must be an object.`
+		});
+	}
+	if (parsed.protocolVersion !== 1) throw providerResolutionError({
+		source: "exec",
+		provider: params.providerName,
+		message: `Exec provider "${params.providerName}" protocolVersion must be 1.`
+	});
+	const responseValues = parsed.values;
+	if (!isRecord(responseValues)) throw providerResolutionError({
+		source: "exec",
+		provider: params.providerName,
+		message: `Exec provider "${params.providerName}" response missing "values".`
+	});
+	const responseErrors = isRecord(parsed.errors) ? parsed.errors : null;
+	const out = {};
+	for (const id of params.ids) {
+		if (responseErrors && id in responseErrors) {
+			const entry = responseErrors[id];
+			if (isRecord(entry) && typeof entry.message === "string" && entry.message.trim()) throw refResolutionError({
+				source: "exec",
+				provider: params.providerName,
+				refId: id,
+				message: `Exec provider "${params.providerName}" failed for id "${id}" (${entry.message.trim()}).`
+			});
+			throw refResolutionError({
+				source: "exec",
+				provider: params.providerName,
+				refId: id,
+				message: `Exec provider "${params.providerName}" failed for id "${id}".`
+			});
+		}
+		if (!(id in responseValues)) throw refResolutionError({
+			source: "exec",
+			provider: params.providerName,
+			refId: id,
+			message: `Exec provider "${params.providerName}" response missing id "${id}".`
+		});
+		out[id] = responseValues[id];
+	}
+	return out;
+}
+async function resolveExecRefs(params) {
+	const ids = [...new Set(params.refs.map((ref) => ref.id))];
+	if (ids.length > params.limits.maxRefsPerProvider) throw providerResolutionError({
+		source: "exec",
+		provider: params.providerName,
+		message: `Exec provider "${params.providerName}" exceeded maxRefsPerProvider (${params.limits.maxRefsPerProvider}).`
+	});
+	const commandPath = resolveUserPath(params.providerConfig.command);
+	let secureCommandPath;
+	try {
+		secureCommandPath = await assertSecurePath({
+			targetPath: commandPath,
+			label: `secrets.providers.${params.providerName}.command`,
+			trustedDirs: params.providerConfig.trustedDirs,
+			allowInsecurePath: params.providerConfig.allowInsecurePath,
+			allowReadableByOthers: true,
+			allowSymlinkPath: params.providerConfig.allowSymlinkCommand
+		});
+	} catch (err) {
+		throwUnknownProviderResolutionError({
+			source: "exec",
+			provider: params.providerName,
+			err
+		});
+	}
+	const requestPayload = {
+		protocolVersion: 1,
+		provider: params.providerName,
+		ids
+	};
+	const input = JSON.stringify(requestPayload);
+	if (Buffer.byteLength(input, "utf8") > params.limits.maxBatchBytes) throw providerResolutionError({
+		source: "exec",
+		provider: params.providerName,
+		message: `Exec provider "${params.providerName}" request exceeded maxBatchBytes (${params.limits.maxBatchBytes}).`
+	});
+	const childEnv = {};
+	for (const key of params.providerConfig.passEnv ?? []) {
+		const value = params.env[key];
+		if (value !== void 0) childEnv[key] = value;
+	}
+	for (const [key, value] of Object.entries(params.providerConfig.env ?? {})) childEnv[key] = value;
+	const timeoutMs = normalizePositiveInt(params.providerConfig.timeoutMs, DEFAULT_EXEC_TIMEOUT_MS);
+	const noOutputTimeoutMs = normalizePositiveInt(params.providerConfig.noOutputTimeoutMs, timeoutMs);
+	const maxOutputBytes = normalizePositiveInt(params.providerConfig.maxOutputBytes, DEFAULT_EXEC_MAX_OUTPUT_BYTES);
+	const jsonOnly = params.providerConfig.jsonOnly ?? true;
+	let result;
+	try {
+		result = await runExecResolver({
+			command: secureCommandPath,
+			args: params.providerConfig.args ?? [],
+			cwd: path.dirname(secureCommandPath),
+			env: childEnv,
+			input,
+			timeoutMs,
+			noOutputTimeoutMs,
+			maxOutputBytes
+		});
+	} catch (err) {
+		throwUnknownProviderResolutionError({
+			source: "exec",
+			provider: params.providerName,
+			err
+		});
+	}
+	if (result.termination === "timeout") throw providerResolutionError({
+		source: "exec",
+		provider: params.providerName,
+		message: `Exec provider "${params.providerName}" timed out after ${timeoutMs}ms.`
+	});
+	if (result.termination === "no-output-timeout") throw providerResolutionError({
+		source: "exec",
+		provider: params.providerName,
+		message: `Exec provider "${params.providerName}" produced no output for ${noOutputTimeoutMs}ms.`
+	});
+	if (result.code !== 0) throw providerResolutionError({
+		source: "exec",
+		provider: params.providerName,
+		message: `Exec provider "${params.providerName}" exited with code ${String(result.code)}.`
+	});
+	let values;
+	try {
+		values = parseExecValues({
+			providerName: params.providerName,
+			ids,
+			stdout: result.stdout,
+			jsonOnly
+		});
+	} catch (err) {
+		throwUnknownProviderResolutionError({
+			source: "exec",
+			provider: params.providerName,
+			err
+		});
+	}
+	const resolved = /* @__PURE__ */ new Map();
+	for (const id of ids) resolved.set(id, values[id]);
+	return resolved;
+}
+async function resolveProviderRefs(params) {
+	try {
+		if (params.providerConfig.source === "env") return await resolveEnvRefs({
+			refs: params.refs,
+			providerName: params.providerName,
+			providerConfig: params.providerConfig,
+			env: params.options.env ?? process.env
+		});
+		if (params.providerConfig.source === "file") return await resolveFileRefs({
+			refs: params.refs,
+			providerName: params.providerName,
+			providerConfig: params.providerConfig,
+			cache: params.options.cache
+		});
+		if (params.providerConfig.source === "exec") return await resolveExecRefs({
+			refs: params.refs,
+			providerName: params.providerName,
+			providerConfig: params.providerConfig,
+			env: params.options.env ?? process.env,
+			limits: params.limits
+		});
+		throw providerResolutionError({
+			source: params.source,
+			provider: params.providerName,
+			message: `Unsupported secret provider source "${String(params.providerConfig.source)}".`
+		});
+	} catch (err) {
+		return throwUnknownProviderResolutionError({
+			source: params.source,
+			provider: params.providerName,
+			err
+		});
+	}
+}
+async function resolveSecretRefValues(refs, options) {
+	if (refs.length === 0) return /* @__PURE__ */ new Map();
+	const limits = resolveResolutionLimits(options.config);
+	const uniqueRefs = /* @__PURE__ */ new Map();
+	for (const ref of refs) {
+		const id = ref.id.trim();
+		if (!id) throw new Error("Secret reference id is empty.");
+		if (ref.source === "exec" && !isValidExecSecretRefId(id)) throw new Error(`${formatExecSecretRefIdValidationMessage()} (ref: ${ref.source}:${ref.provider}:${id}).`);
+		uniqueRefs.set(secretRefKey(ref), {
+			...ref,
+			id
+		});
+	}
+	const grouped = /* @__PURE__ */ new Map();
+	for (const ref of uniqueRefs.values()) {
+		const key = toProviderKey(ref.source, ref.provider);
+		const existing = grouped.get(key);
+		if (existing) {
+			existing.refs.push(ref);
+			continue;
+		}
+		grouped.set(key, {
+			source: ref.source,
+			providerName: ref.provider,
+			refs: [ref]
+		});
+	}
+	const taskResults = await runTasksWithConcurrency({
+		tasks: [...grouped.values()].map((group) => async () => {
+			if (group.refs.length > limits.maxRefsPerProvider) throw providerResolutionError({
+				source: group.source,
+				provider: group.providerName,
+				message: `Secret provider "${group.providerName}" exceeded maxRefsPerProvider (${limits.maxRefsPerProvider}).`
+			});
+			const providerConfig = resolveConfiguredProvider(group.refs[0], options.config);
+			return {
+				group,
+				values: await resolveProviderRefs({
+					refs: group.refs,
+					source: group.source,
+					providerName: group.providerName,
+					providerConfig,
+					options,
+					limits
+				})
+			};
+		}),
+		limit: limits.maxProviderConcurrency,
+		errorMode: "stop"
+	});
+	if (taskResults.hasError) throw taskResults.firstError;
+	const resolved = /* @__PURE__ */ new Map();
+	for (const result of taskResults.results) for (const ref of result.group.refs) {
+		if (!result.values.has(ref.id)) throw refResolutionError({
+			source: result.group.source,
+			provider: result.group.providerName,
+			refId: ref.id,
+			message: `Secret provider "${result.group.providerName}" did not return id "${ref.id}".`
+		});
+		resolved.set(secretRefKey(ref), result.values.get(ref.id));
+	}
+	return resolved;
+}
+async function resolveSecretRefValue(ref, options) {
+	const cache = options.cache;
+	const key = secretRefKey(ref);
+	const cachedResolvedValue = cache?.resolvedByRefKey?.get(key);
+	if (cachedResolvedValue) return await cachedResolvedValue;
+	const promise = (async () => {
+		const resolved = await resolveSecretRefValues([ref], options);
+		if (!resolved.has(key)) throw refResolutionError({
+			source: ref.source,
+			provider: ref.provider,
+			refId: ref.id,
+			message: `Secret reference "${key}" resolved to no value.`
+		});
+		return resolved.get(key);
+	})();
+	if (cache) {
+		cache.resolvedByRefKey ??= /* @__PURE__ */ new Map();
+		cache.resolvedByRefKey.set(key, promise);
+	}
+	return await promise;
+}
+async function resolveSecretRefString(ref, options) {
+	const resolved = await resolveSecretRefValue(ref, options);
+	if (!isNonEmptyString(resolved)) throw new Error(`Secret reference "${ref.source}:${ref.provider}:${ref.id}" resolved to a non-string or empty value.`);
+	return resolved;
+}
+//#endregion
+export { resolveSecretRefString as t };