aquaman-proxy 0.13.0 → 0.14.0

package/dist/hermes/config-writer.js

@@ -38,6 +38,12 @@ export function generateHermesEnv(config) {
     const host = config.host || '127.0.0.1';
     const base = `http://${host}:${config.port}`;
     const env = {};
+    // Always wire the loopback origin + token explicitly. The Hermes secret
+    // source (aquaman-hermes plugin, Hermes >= 0.18.1) reads these to resolve
+    // `aquaman://service/key` bindings via the token-gated /broker/resolve
+    // endpoint — independent of which providers are proxied below.
+    env['AQUAMAN_LOOPBACK_URL'] = base;
+    env['AQUAMAN_LOOPBACK_TOKEN'] = config.token;
     for (const service of config.services) {
         if (!SAFE_SERVICE_NAME.test(service))
             continue;
@@ -103,6 +109,31 @@ export function writeHermesEnv(env, filePath) {
     }
     fs.writeFileSync(filePath, merged, { mode: 0o600 });
 }
+/**
+ * Hermes >= 0.17 "managed scope": a root-owned /etc/hermes/.env is loaded LAST
+ * with override=true, beating both ~/.hermes/.env and shell exports. If an
+ * admin pins any of the env vars aquaman manages, the proxy is silently
+ * bypassed for those keys. Returns the managed keys that file shadows (empty
+ * when the file is absent/unreadable). `managedEnvPath` is parameterized for
+ * tests; production callers use the default.
+ */
+export const HERMES_MANAGED_ENV_PATH = '/etc/hermes/.env';
+export function managedScopeShadowedKeys(ourEnv, managedEnvPath = HERMES_MANAGED_ENV_PATH) {
+    let content;
+    try {
+        content = fs.readFileSync(managedEnvPath, 'utf-8');
+    }
+    catch {
+        return []; // absent or unreadable (non-root) — nothing to warn about
+    }
+    const pinned = new Set();
+    for (const line of content.split('\n')) {
+        const m = line.match(/^\s*(?:export\s+)?([A-Za-z_][A-Za-z0-9_]*)\s*=/);
+        if (m)
+            pinned.add(m[1]);
+    }
+    return Object.keys(ourEnv).filter((k) => pinned.has(k));
+}
 /** Format env vars for display (dry-run / export output). */
 export function formatHermesEnvForDisplay(env) {
     return Object.entries(env)

package/dist/hermes/config-writer.js.map

@@ -1 +1 @@
-{"version":3,"file":"config-writer.js","sourceRoot":"","sources":["../../src/hermes/config-writer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,4DAA4D;AAC5D,MAAM,iBAAiB,GAAG,wBAAwB,CAAC;AAEnD,sEAAsE;AACtE,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAU,CAAC;AAa1E;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAuB;IACvD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,WAAW,CAAC;IACxC,MAAM,IAAI,GAAG,UAAU,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;IAC7C,MAAM,GAAG,GAA2B,EAAE,CAAC;IAEvC,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACtC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,SAAS;QAE/C,QAAQ,OAAO,EAAE,CAAC;YAChB,KAAK,WAAW;gBACd,GAAG,CAAC,oBAAoB,CAAC,GAAG,GAAG,IAAI,YAAY,CAAC;gBAChD,GAAG,CAAC,mBAAmB,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;gBACxC,MAAM;YACR,KAAK,QAAQ;gBACX,GAAG,CAAC,iBAAiB,CAAC,GAAG,GAAG,IAAI,YAAY,CAAC;gBAC7C,GAAG,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;gBACrC,MAAM;YACR;gBACE,gEAAgE;gBAChE,4DAA4D;gBAC5D,MAAM;QACV,CAAC;IACH,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,mBAAmB,CAAC,QAAkB;IACpD,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAE,yBAA+C,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC7E,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,GAA2B,EAAE,QAAgB;IAC1E,MAAM,MAAM,GAAG,2BAA2B,CAAC;IAC3C,MAAM,SAAS,GAAG,2BAA2B,CAAC;IAE9C,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC/C,CAAC;IAED,iCAAiC;IACjC,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACvC,IAAI,KAAK,KAAK,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,GAAG,GAAG,KAAK,EAAE,CAAC;QAC9C,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAChG,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;SAC7B,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;SAC5B,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,KAAK,GAAG,GAAG,MAAM,KAAK,IAAI,KAAK,SAAS,IAAI,CAAC;IAEnD,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QACtC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,MAAM,GAAG,KAAK;QAC9C,CAAC,CAAC,KAAK,CAAC;IAEV,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACtD,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,yBAAyB,CAAC,GAA2B;IACnE,OAAO,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;SACvB,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;SAC9B,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC"}
+{"version":3,"file":"config-writer.js","sourceRoot":"","sources":["../../src/hermes/config-writer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AAEH,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAElC,4DAA4D;AAC5D,MAAM,iBAAiB,GAAG,wBAAwB,CAAC;AAEnD,sEAAsE;AACtE,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAU,CAAC;AAa1E;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,MAAuB;IACvD,MAAM,IAAI,GAAG,MAAM,CAAC,IAAI,IAAI,WAAW,CAAC;IACxC,MAAM,IAAI,GAAG,UAAU,IAAI,IAAI,MAAM,CAAC,IAAI,EAAE,CAAC;IAC7C,MAAM,GAAG,GAA2B,EAAE,CAAC;IAEvC,wEAAwE;IACxE,0EAA0E;IAC1E,uEAAuE;IACvE,+DAA+D;IAC/D,GAAG,CAAC,sBAAsB,CAAC,GAAG,IAAI,CAAC;IACnC,GAAG,CAAC,wBAAwB,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;IAE7C,KAAK,MAAM,OAAO,IAAI,MAAM,CAAC,QAAQ,EAAE,CAAC;QACtC,IAAI,CAAC,iBAAiB,CAAC,IAAI,CAAC,OAAO,CAAC;YAAE,SAAS;QAE/C,QAAQ,OAAO,EAAE,CAAC;YAChB,KAAK,WAAW;gBACd,GAAG,CAAC,oBAAoB,CAAC,GAAG,GAAG,IAAI,YAAY,CAAC;gBAChD,GAAG,CAAC,mBAAmB,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;gBACxC,MAAM;YACR,KAAK,QAAQ;gBACX,GAAG,CAAC,iBAAiB,CAAC,GAAG,GAAG,IAAI,YAAY,CAAC;gBAC7C,GAAG,CAAC,gBAAgB,CAAC,GAAG,MAAM,CAAC,KAAK,CAAC;gBACrC,MAAM;YACR;gBACE,gEAAgE;gBAChE,4DAA4D;gBAC5D,MAAM;QACV,CAAC;IACH,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,qFAAqF;AACrF,MAAM,UAAU,mBAAmB,CAAC,QAAkB;IACpD,OAAO,QAAQ,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAE,yBAA+C,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC;AAC5F,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,MAAM,QAAQ,GAAG,OAAO,CAAC,GAAG,CAAC,aAAa,CAAC,IAAI,IAAI,CAAC,IAAI,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC;IAC7E,OAAO,IAAI,CAAC,IAAI,CAAC,QAAQ,EAAE,MAAM,CAAC,CAAC;AACrC,CAAC;AAED;;;;GAIG;AACH,MAAM,UAAU,cAAc,CAAC,GAA2B,EAAE,QAAgB;IAC1E,MAAM,MAAM,GAAG,2BAA2B,CAAC;IAC3C,MAAM,SAAS,GAAG,2BAA2B,CAAC;IAE9C,IAAI,OAAO,GAAG,EAAE,CAAC;IACjB,IAAI,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC5B,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,QAAQ,EAAE,OAAO,CAAC,CAAC;IAC/C,CAAC;IAED,iCAAiC;IACjC,MAAM,KAAK,GAAG,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACtC,MAAM,GAAG,GAAG,OAAO,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IACvC,IAAI,KAAK,KAAK,CAAC,CAAC,IAAI,GAAG,KAAK,CAAC,CAAC,IAAI,GAAG,GAAG,KAAK,EAAE,CAAC;QAC9C,OAAO,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,KAAK,CAAC,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,GAAG,GAAG,SAAS,CAAC,MAAM,CAAC,CAAC;IAChG,CAAC;IAED,MAAM,IAAI,GAAG,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;SAC7B,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;SAC5B,IAAI,CAAC,IAAI,CAAC,CAAC;IACd,MAAM,KAAK,GAAG,GAAG,MAAM,KAAK,IAAI,KAAK,SAAS,IAAI,CAAC;IAEnD,MAAM,MAAM,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC,MAAM,GAAG,CAAC;QACtC,CAAC,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,EAAE,EAAE,CAAC,GAAG,MAAM,GAAG,KAAK;QAC9C,CAAC,CAAC,KAAK,CAAC;IAEV,MAAM,GAAG,GAAG,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;QACxB,EAAE,CAAC,SAAS,CAAC,GAAG,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;IACtD,CAAC;IACD,EAAE,CAAC,aAAa,CAAC,QAAQ,EAAE,MAAM,EAAE,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,CAAC;AACtD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,CAAC,MAAM,uBAAuB,GAAG,kBAAkB,CAAC;AAE1D,MAAM,UAAU,wBAAwB,CACtC,MAA8B,EAC9B,iBAAyB,uBAAuB;IAEhD,IAAI,OAAe,CAAC;IACpB,IAAI,CAAC;QACH,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,cAAc,EAAE,OAAO,CAAC,CAAC;IACrD,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC,CAAC,0DAA0D;IACvE,CAAC;IACD,MAAM,MAAM,GAAG,IAAI,GAAG,EAAU,CAAC;IACjC,KAAK,MAAM,IAAI,IAAI,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;QACvE,IAAI,CAAC;YAAE,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;IAC1B,CAAC;IACD,OAAO,MAAM,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;AAC1D,CAAC;AAED,6DAA6D;AAC7D,MAAM,UAAU,yBAAyB,CAAC,GAA2B;IACnE,OAAO,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC;SACvB,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;SAC9B,IAAI,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC"}

package/dist/index.d.ts

@@ -12,7 +12,8 @@ export { type AuthMode, type OAuthConfig, type ServiceRegistryOptions, ServiceRe
 export { OAuthTokenCache, createOAuthTokenCache } from './oauth-token-cache.js';
 export { type EnvConfig, generateOpenClawEnv, writeEnvFile, appendToShellRc, formatEnvForDisplay } from './openclaw/env-writer.js';
 export { type OpenClawInfo, type LaunchOptions, OpenClawIntegration, createOpenClawIntegration, parseCalendarVersion, authProfilesAreSqliteOnly } from './openclaw/integration.js';
-export { type HermesEnvConfig, HERMES_SUPPORTED_SERVICES, generateHermesEnv, hermesWiredServices, getHermesEnvPath, writeHermesEnv, formatHermesEnvForDisplay } from './hermes/config-writer.js';
+export { type SecretRefRef, type SecretRefWiringResult, type SecretRefWiringStatus, SECRETREF_PLUGIN_ID, SECRETREF_INTEGRATION_ID, SECRETREF_PROVIDER_ALIAS, SECRETREF_SUPPORTED_PROVIDERS, supportsSecretRefIntegrations, buildProviderRef, wireSecretRefProviders, secretRefWiringStatus } from './openclaw/secretref.js';
+export { type HermesEnvConfig, HERMES_SUPPORTED_SERVICES, generateHermesEnv, hermesWiredServices, getHermesEnvPath, writeHermesEnv, formatHermesEnvForDisplay, managedScopeShadowedKeys, HERMES_MANAGED_ENV_PATH } from './hermes/config-writer.js';
 export { type HermesInfo, type HermesIntegrationOptions, HermesIntegration, createHermesIntegration, detectHermes } from './hermes/integration.js';
 export { type PolicyRule, type ServicePolicy, type PolicyConfig, matchPathPattern, matchPolicy, loadPolicyFromConfig, validatePolicyConfig, getDefaultPolicyPresets } from './request-policy.js';
 export * from './core/index.js';

package/dist/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EACL,KAAK,sBAAsB,EAC3B,KAAK,WAAW,EAChB,eAAe,EACf,qBAAqB,EACrB,KAAK,iBAAiB,EACvB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,KAAK,sBAAsB,EAC3B,eAAe,EACf,qBAAqB,EACtB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EACL,eAAe,EACf,qBAAqB,EACtB,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EACL,KAAK,SAAS,EACd,mBAAmB,EACnB,YAAY,EACZ,eAAe,EACf,mBAAmB,EACpB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,mBAAmB,EACnB,yBAAyB,EACzB,oBAAoB,EACpB,yBAAyB,EAC1B,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EACL,KAAK,eAAe,EACpB,yBAAyB,EACzB,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,EAChB,cAAc,EACd,yBAAyB,EAC1B,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,KAAK,UAAU,EACf,KAAK,wBAAwB,EAC7B,iBAAiB,EACjB,uBAAuB,EACvB,YAAY,EACb,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EACL,KAAK,UAAU,EACf,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,gBAAgB,EAChB,WAAW,EACX,oBAAoB,EACpB,oBAAoB,EACpB,uBAAuB,EACxB,MAAM,qBAAqB,CAAC;AAG7B,cAAc,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAGH,OAAO,EACL,KAAK,sBAAsB,EAC3B,KAAK,WAAW,EAChB,eAAe,EACf,qBAAqB,EACrB,KAAK,iBAAiB,EACvB,MAAM,aAAa,CAAC;AAGrB,OAAO,EACL,KAAK,QAAQ,EACb,KAAK,WAAW,EAChB,KAAK,sBAAsB,EAC3B,eAAe,EACf,qBAAqB,EACtB,MAAM,uBAAuB,CAAC;AAG/B,OAAO,EACL,eAAe,EACf,qBAAqB,EACtB,MAAM,wBAAwB,CAAC;AAGhC,OAAO,EACL,KAAK,SAAS,EACd,mBAAmB,EACnB,YAAY,EACZ,eAAe,EACf,mBAAmB,EACpB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,mBAAmB,EACnB,yBAAyB,EACzB,oBAAoB,EACpB,yBAAyB,EAC1B,MAAM,2BAA2B,CAAC;AAGnC,OAAO,EACL,KAAK,YAAY,EACjB,KAAK,qBAAqB,EAC1B,KAAK,qBAAqB,EAC1B,mBAAmB,EACnB,wBAAwB,EACxB,wBAAwB,EACxB,6BAA6B,EAC7B,6BAA6B,EAC7B,gBAAgB,EAChB,sBAAsB,EACtB,qBAAqB,EACtB,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EACL,KAAK,eAAe,EACpB,yBAAyB,EACzB,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,EAChB,cAAc,EACd,yBAAyB,EACzB,wBAAwB,EACxB,uBAAuB,EACxB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EACL,KAAK,UAAU,EACf,KAAK,wBAAwB,EAC7B,iBAAiB,EACjB,uBAAuB,EACvB,YAAY,EACb,MAAM,yBAAyB,CAAC;AAGjC,OAAO,EACL,KAAK,UAAU,EACf,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,gBAAgB,EAChB,WAAW,EACX,oBAAoB,EACpB,oBAAoB,EACpB,uBAAuB,EACxB,MAAM,qBAAqB,CAAC;AAG7B,cAAc,iBAAiB,CAAC"}

package/dist/index.js

@@ -16,8 +16,10 @@ export { OAuthTokenCache, createOAuthTokenCache } from './oauth-token-cache.js';
 // OpenClaw Integration
 export { generateOpenClawEnv, writeEnvFile, appendToShellRc, formatEnvForDisplay } from './openclaw/env-writer.js';
 export { OpenClawIntegration, createOpenClawIntegration, parseCalendarVersion, authProfilesAreSqliteOnly } from './openclaw/integration.js';
+// OpenClaw SecretRef provider-integration wiring (v0.14.0+)
+export { SECRETREF_PLUGIN_ID, SECRETREF_INTEGRATION_ID, SECRETREF_PROVIDER_ALIAS, SECRETREF_SUPPORTED_PROVIDERS, supportsSecretRefIntegrations, buildProviderRef, wireSecretRefProviders, secretRefWiringStatus } from './openclaw/secretref.js';
 // Hermes Integration (v0.13.0+)
-export { HERMES_SUPPORTED_SERVICES, generateHermesEnv, hermesWiredServices, getHermesEnvPath, writeHermesEnv, formatHermesEnvForDisplay } from './hermes/config-writer.js';
+export { HERMES_SUPPORTED_SERVICES, generateHermesEnv, hermesWiredServices, getHermesEnvPath, writeHermesEnv, formatHermesEnvForDisplay, managedScopeShadowedKeys, HERMES_MANAGED_ENV_PATH } from './hermes/config-writer.js';
 export { HermesIntegration, createHermesIntegration, detectHermes } from './hermes/integration.js';
 // Request Policy
 export { matchPathPattern, matchPolicy, loadPolicyFromConfig, validatePolicyConfig, getDefaultPolicyPresets } from './request-policy.js';

package/dist/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,SAAS;AACT,OAAO,EAGL,eAAe,EACf,qBAAqB,EAEtB,MAAM,aAAa,CAAC;AAErB,mBAAmB;AACnB,OAAO,EAIL,eAAe,EACf,qBAAqB,EACtB,MAAM,uBAAuB,CAAC;AAE/B,oBAAoB;AACpB,OAAO,EACL,eAAe,EACf,qBAAqB,EACtB,MAAM,wBAAwB,CAAC;AAEhC,uBAAuB;AACvB,OAAO,EAEL,mBAAmB,EACnB,YAAY,EACZ,eAAe,EACf,mBAAmB,EACpB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAGL,mBAAmB,EACnB,yBAAyB,EACzB,oBAAoB,EACpB,yBAAyB,EAC1B,MAAM,2BAA2B,CAAC;AAEnC,gCAAgC;AAChC,OAAO,EAEL,yBAAyB,EACzB,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,EAChB,cAAc,EACd,yBAAyB,EAC1B,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAGL,iBAAiB,EACjB,uBAAuB,EACvB,YAAY,EACb,MAAM,yBAAyB,CAAC;AAEjC,iBAAiB;AACjB,OAAO,EAIL,gBAAgB,EAChB,WAAW,EACX,oBAAoB,EACpB,oBAAoB,EACpB,uBAAuB,EACxB,MAAM,qBAAqB,CAAC;AAE7B,kCAAkC;AAClC,cAAc,iBAAiB,CAAC"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../src/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,SAAS;AACT,OAAO,EAGL,eAAe,EACf,qBAAqB,EAEtB,MAAM,aAAa,CAAC;AAErB,mBAAmB;AACnB,OAAO,EAIL,eAAe,EACf,qBAAqB,EACtB,MAAM,uBAAuB,CAAC;AAE/B,oBAAoB;AACpB,OAAO,EACL,eAAe,EACf,qBAAqB,EACtB,MAAM,wBAAwB,CAAC;AAEhC,uBAAuB;AACvB,OAAO,EAEL,mBAAmB,EACnB,YAAY,EACZ,eAAe,EACf,mBAAmB,EACpB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAGL,mBAAmB,EACnB,yBAAyB,EACzB,oBAAoB,EACpB,yBAAyB,EAC1B,MAAM,2BAA2B,CAAC;AAEnC,4DAA4D;AAC5D,OAAO,EAIL,mBAAmB,EACnB,wBAAwB,EACxB,wBAAwB,EACxB,6BAA6B,EAC7B,6BAA6B,EAC7B,gBAAgB,EAChB,sBAAsB,EACtB,qBAAqB,EACtB,MAAM,yBAAyB,CAAC;AAEjC,gCAAgC;AAChC,OAAO,EAEL,yBAAyB,EACzB,iBAAiB,EACjB,mBAAmB,EACnB,gBAAgB,EAChB,cAAc,EACd,yBAAyB,EACzB,wBAAwB,EACxB,uBAAuB,EACxB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAGL,iBAAiB,EACjB,uBAAuB,EACvB,YAAY,EACb,MAAM,yBAAyB,CAAC;AAEjC,iBAAiB;AACjB,OAAO,EAIL,gBAAgB,EAChB,WAAW,EACX,oBAAoB,EACpB,oBAAoB,EACpB,uBAAuB,EACxB,MAAM,qBAAqB,CAAC;AAE7B,kCAAkC;AAClC,cAAc,iBAAiB,CAAC"}

package/dist/openclaw/integration.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"integration.d.ts","sourceRoot":"","sources":["../../src/openclaw/integration.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAIH,OAAO,EAAS,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAE9D,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAErE,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,gFAAgF;AAChF,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GACjC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAKjC;AAED;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,OAAO,CAOrF;AAED,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,QAAQ,CAAkB;gBAEtB,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,aAAa,EAAE;IAK5D;;OAEG;IACG,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;IAkC7C;;;;OAIG;IACG,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAI1D;;OAEG;IACG,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IAmBtE;;OAEG;IACG,cAAc,CAAC,OAAO,GAAE,aAAkB,GAAG,OAAO,CAAC,YAAY,CAAC;IAwBxE;;OAEG;IACG,gBAAgB,IAAI,OAAO,CAAC,MAAM,CAAC;CAI1C;AAED,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,aAAa,EACrB,QAAQ,EAAE,aAAa,EAAE,GACxB,mBAAmB,CAErB"}
+{"version":3,"file":"integration.d.ts","sourceRoot":"","sources":["../../src/openclaw/integration.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAS,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAE9D,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAErE,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,gFAAgF;AAChF,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GACjC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAQjC;AAED;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,OAAO,CAOrF;AAED,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,QAAQ,CAAkB;gBAEtB,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,aAAa,EAAE;IAK5D;;OAEG;IACG,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;IAkC7C;;;;OAIG;IACG,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAI1D;;OAEG;IACG,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IAmBtE;;OAEG;IACG,cAAc,CAAC,OAAO,GAAE,aAAkB,GAAG,OAAO,CAAC,YAAY,CAAC;IAwBxE;;OAEG;IACG,gBAAgB,IAAI,OAAO,CAAC,MAAM,CAAC;CAI1C;AAED,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,aAAa,EACrB,QAAQ,EAAE,aAAa,EAAE,GACxB,mBAAmB,CAErB"}

package/dist/openclaw/integration.js

@@ -13,6 +13,10 @@ import { generateOpenClawEnv, writeEnvFile, appendToShellRc, formatEnvForDisplay
 export function parseCalendarVersion(version) {
     if (!version)
         return null;
+    // Length guard: the unanchored match below backtracks quadratically on long
+    // digit runs, and no real version string comes anywhere near this bound.
+    if (version.length > 64)
+        return null;
     const m = version.match(/(\d+)\.(\d+)\.(\d+)/);
     if (!m)
         return null;

package/dist/openclaw/integration.js.map

@@ -1 +1 @@
-{"version":3,"file":"integration.js","sourceRoot":"","sources":["../../src/openclaw/integration.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAe1G,gFAAgF;AAChF,MAAM,UAAU,oBAAoB,CAClC,OAAkC;IAElC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAC/C,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAkC;IAC1E,MAAM,KAAK,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC;IACxB,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAChC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1B,OAAO,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,MAAM,OAAO,mBAAmB;IACtB,MAAM,CAAgB;IACtB,QAAQ,CAAkB;IAElC,YAAY,MAAqB,EAAE,QAAyB;QAC1D,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc;QAClB,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,IAAI,UAAU,CAAC;QAEjE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC,WAAW,CAAC,EAAE;gBAC5C,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;aAClC,CAAC,CAAC;YAEH,IAAI,MAAM,GAAG,EAAE,CAAC;YAEhB,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;gBAC/B,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC5B,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBACpB,OAAO,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;YAChC,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBACxB,IAAI,IAAI,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;oBACzB,qDAAqD;oBACrD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;oBAC1D,OAAO,CAAC;wBACN,SAAS,EAAE,IAAI;wBACf,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;wBACzC,IAAI,EAAE,UAAU;qBACjB,CAAC,CAAC;gBACL,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;gBAChC,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,iBAAiB;QACrB,OAAO,mBAAmB,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC1D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,kBAAkB,CAAC,GAA2B;QAClD,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;YAC1C,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,CAAC,CAAC;gBACzD,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;gBAC3B,OAAO,OAAO,CAAC;YACjB,CAAC;YAED,KAAK,UAAU,CAAC,CAAC,CAAC;gBAChB,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC;YAC9B,CAAC;YAED,KAAK,KAAK,CAAC;YACX;gBACE,6CAA6C;gBAC7C,OAAO,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAAC,UAAyB,EAAE;QAC9C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAEzC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CACb,gEAAgE;gBAChE,oDAAoD,CACrD,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAE3C,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,IAAI,UAAU,CAAC;QACjE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;QAEhC,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE;YACnC,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE;YACjC,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE;YAC/B,KAAK,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC;SAC5E,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB;QACpB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC3C,OAAO,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAClC,CAAC;CACF;AAED,MAAM,UAAU,yBAAyB,CACvC,MAAqB,EACrB,QAAyB;IAEzB,OAAO,IAAI,mBAAmB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AACnD,CAAC"}
+{"version":3,"file":"integration.js","sourceRoot":"","sources":["../../src/openclaw/integration.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAe1G,gFAAgF;AAChF,MAAM,UAAU,oBAAoB,CAClC,OAAkC;IAElC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,4EAA4E;IAC5E,yEAAyE;IACzE,IAAI,OAAO,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAC/C,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAkC;IAC1E,MAAM,KAAK,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC;IACxB,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAChC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1B,OAAO,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,MAAM,OAAO,mBAAmB;IACtB,MAAM,CAAgB;IACtB,QAAQ,CAAkB;IAElC,YAAY,MAAqB,EAAE,QAAyB;QAC1D,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc;QAClB,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,IAAI,UAAU,CAAC;QAEjE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC,WAAW,CAAC,EAAE;gBAC5C,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;aAClC,CAAC,CAAC;YAEH,IAAI,MAAM,GAAG,EAAE,CAAC;YAEhB,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;gBAC/B,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC5B,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBACpB,OAAO,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;YAChC,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBACxB,IAAI,IAAI,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;oBACzB,qDAAqD;oBACrD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;oBAC1D,OAAO,CAAC;wBACN,SAAS,EAAE,IAAI;wBACf,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;wBACzC,IAAI,EAAE,UAAU;qBACjB,CAAC,CAAC;gBACL,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;gBAChC,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,iBAAiB;QACrB,OAAO,mBAAmB,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC1D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,kBAAkB,CAAC,GAA2B;QAClD,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;YAC1C,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,CAAC,CAAC;gBACzD,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;gBAC3B,OAAO,OAAO,CAAC;YACjB,CAAC;YAED,KAAK,UAAU,CAAC,CAAC,CAAC;gBAChB,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC;YAC9B,CAAC;YAED,KAAK,KAAK,CAAC;YACX;gBACE,6CAA6C;gBAC7C,OAAO,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAAC,UAAyB,EAAE;QAC9C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAEzC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CACb,gEAAgE;gBAChE,oDAAoD,CACrD,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAE3C,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,IAAI,UAAU,CAAC;QACjE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;QAEhC,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE;YACnC,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE;YACjC,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE;YAC/B,KAAK,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC;SAC5E,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB;QACpB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC3C,OAAO,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAClC,CAAC;CACF;AAED,MAAM,UAAU,yBAAyB,CACvC,MAAqB,EACrB,QAAyB;IAEzB,OAAO,IAAI,mBAAmB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AACnD,CAAC"}

package/dist/openclaw/secretref.d.ts

@@ -0,0 +1,74 @@
+/**
+ * OpenClaw SecretRef provider-integration wiring (v0.14.0+).
+ *
+ * OpenClaw's canonical credential surface is the SecretRef (upstream
+ * openclaw/openclaw#82326, shipped 2026-05-29; docs call auth-profiles.json
+ * "not a runtime format"). The aquaman plugin declares a
+ * `secretProviderIntegrations.aquaman` exec resolver in its manifest
+ * (`packages/plugin/openclaw.plugin.json` → `dist/secrets-resolver.mjs`),
+ * and this module writes the config side into `~/.openclaw/openclaw.json`:
+ *
+ *   secrets.providers.aquaman = {
+ *     source: "exec",
+ *     pluginIntegration: { pluginId: "aquaman-plugin", integrationId: "aquaman" }
+ *   }
+ *   models.providers.<svc>.apiKey = { source: "exec", provider: "aquaman", id: "<svc>/api_key" }
+ *
+ * Config-level refs are used deliberately instead of auth-profile
+ * keyRef/tokenRef: openclaw.json is runtime-read on every version, so this
+ * avoids the SQLite ingestion step (`openclaw doctor --fix`) that the legacy
+ * placeholder flow requires on ≥ 2026.6.5 — and SecretRefs survive the
+ * configure-flow scrubs (`scrubAuthProfilesForProviderTargets` deletes
+ * plaintext keys but preserves valid refs).
+ *
+ * The resolver returns the static `aquaman-proxy-managed` placeholder; the
+ * proxy strips whatever key the gateway presents and injects the real
+ * credential upstream. Keys never enter the gateway process — the SecretRef
+ * integration changes how the *placeholder* reaches the gateway, not the
+ * isolation boundary.
+ */
+export declare const SECRETREF_PLUGIN_ID = "aquaman-plugin";
+export declare const SECRETREF_INTEGRATION_ID = "aquaman";
+export declare const SECRETREF_PROVIDER_ALIAS = "aquaman";
+/** Providers the exec resolver serves refs for today. */
+export declare const SECRETREF_SUPPORTED_PROVIDERS: readonly ["anthropic", "openai"];
+/**
+ * SecretRef provider integrations shipped with the 2026.6.x line (merged
+ * upstream 2026-05-29). 2026.6.5 is the safe floor — it is also the
+ * auth-profiles→SQLite boundary (`authProfilesAreSqliteOnly`), so on every
+ * version where the legacy JSON placeholder stopped being runtime-read,
+ * SecretRef wiring is available as the replacement. Unknown/unparseable
+ * versions return false (conservative: keep the legacy flow).
+ */
+export declare function supportsSecretRefIntegrations(version: string | undefined | null): boolean;
+export interface SecretRefRef {
+    source: 'exec';
+    provider: string;
+    id: string;
+}
+export declare function buildProviderRef(service: string): SecretRefRef;
+export interface SecretRefWiringResult {
+    changed: boolean;
+    /** Providers whose apiKey now points at the aquaman SecretRef. */
+    wiredProviders: string[];
+    /** Providers requested but skipped (unsupported by the resolver today). */
+    skippedProviders: string[];
+}
+/**
+ * Merge the aquaman SecretRef wiring into a parsed openclaw.json object.
+ * Mutates `config` in place (mirrors the CLI's existing merge style),
+ * idempotent, and never overwrites a provider apiKey the user set to
+ * something other than an aquaman ref or the legacy placeholder.
+ */
+export declare function wireSecretRefProviders(config: Record<string, any>, services: string[]): SecretRefWiringResult;
+export interface SecretRefWiringStatus {
+    /** secrets.providers.aquaman points at the plugin integration. */
+    providerConfigured: boolean;
+    /** Providers whose apiKey is an aquaman SecretRef. */
+    wiredProviders: string[];
+    /** Requested + supported providers not yet wired. */
+    missingProviders: string[];
+}
+/** Read-only status check for `aquaman openclaw doctor`. */
+export declare function secretRefWiringStatus(config: Record<string, any>, services: string[]): SecretRefWiringStatus;
+//# sourceMappingURL=secretref.d.ts.map

package/dist/openclaw/secretref.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secretref.d.ts","sourceRoot":"","sources":["../../src/openclaw/secretref.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAIH,eAAO,MAAM,mBAAmB,mBAAmB,CAAC;AACpD,eAAO,MAAM,wBAAwB,YAAY,CAAC;AAClD,eAAO,MAAM,wBAAwB,YAAY,CAAC;AAElD,yDAAyD;AACzD,eAAO,MAAM,6BAA6B,kCAAmC,CAAC;AAE9E;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,OAAO,CAOzF;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,CAE9D;AAWD,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,kEAAkE;IAClE,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,2EAA2E;IAC3E,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,QAAQ,EAAE,MAAM,EAAE,GACjB,qBAAqB,CAkDvB;AAED,MAAM,WAAW,qBAAqB;IACpC,kEAAkE;IAClE,kBAAkB,EAAE,OAAO,CAAC;IAC5B,sDAAsD;IACtD,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,qDAAqD;IACrD,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED,4DAA4D;AAC5D,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,QAAQ,EAAE,MAAM,EAAE,GACjB,qBAAqB,CAkBvB"}

package/dist/openclaw/secretref.js

@@ -0,0 +1,139 @@
+/**
+ * OpenClaw SecretRef provider-integration wiring (v0.14.0+).
+ *
+ * OpenClaw's canonical credential surface is the SecretRef (upstream
+ * openclaw/openclaw#82326, shipped 2026-05-29; docs call auth-profiles.json
+ * "not a runtime format"). The aquaman plugin declares a
+ * `secretProviderIntegrations.aquaman` exec resolver in its manifest
+ * (`packages/plugin/openclaw.plugin.json` → `dist/secrets-resolver.mjs`),
+ * and this module writes the config side into `~/.openclaw/openclaw.json`:
+ *
+ *   secrets.providers.aquaman = {
+ *     source: "exec",
+ *     pluginIntegration: { pluginId: "aquaman-plugin", integrationId: "aquaman" }
+ *   }
+ *   models.providers.<svc>.apiKey = { source: "exec", provider: "aquaman", id: "<svc>/api_key" }
+ *
+ * Config-level refs are used deliberately instead of auth-profile
+ * keyRef/tokenRef: openclaw.json is runtime-read on every version, so this
+ * avoids the SQLite ingestion step (`openclaw doctor --fix`) that the legacy
+ * placeholder flow requires on ≥ 2026.6.5 — and SecretRefs survive the
+ * configure-flow scrubs (`scrubAuthProfilesForProviderTargets` deletes
+ * plaintext keys but preserves valid refs).
+ *
+ * The resolver returns the static `aquaman-proxy-managed` placeholder; the
+ * proxy strips whatever key the gateway presents and injects the real
+ * credential upstream. Keys never enter the gateway process — the SecretRef
+ * integration changes how the *placeholder* reaches the gateway, not the
+ * isolation boundary.
+ */
+import { parseCalendarVersion } from './integration.js';
+export const SECRETREF_PLUGIN_ID = 'aquaman-plugin';
+export const SECRETREF_INTEGRATION_ID = 'aquaman';
+export const SECRETREF_PROVIDER_ALIAS = 'aquaman';
+/** Providers the exec resolver serves refs for today. */
+export const SECRETREF_SUPPORTED_PROVIDERS = ['anthropic', 'openai'];
+/**
+ * SecretRef provider integrations shipped with the 2026.6.x line (merged
+ * upstream 2026-05-29). 2026.6.5 is the safe floor — it is also the
+ * auth-profiles→SQLite boundary (`authProfilesAreSqliteOnly`), so on every
+ * version where the legacy JSON placeholder stopped being runtime-read,
+ * SecretRef wiring is available as the replacement. Unknown/unparseable
+ * versions return false (conservative: keep the legacy flow).
+ */
+export function supportsSecretRefIntegrations(version) {
+    const parts = parseCalendarVersion(version);
+    if (!parts)
+        return false;
+    const [y, m, d] = parts;
+    if (y !== 2026)
+        return y > 2026;
+    if (m !== 6)
+        return m > 6;
+    return d >= 5;
+}
+export function buildProviderRef(service) {
+    return { source: 'exec', provider: SECRETREF_PROVIDER_ALIAS, id: `${service}/api_key` };
+}
+function isAquamanRef(value) {
+    return (typeof value === 'object' &&
+        value !== null &&
+        value.source === 'exec' &&
+        value.provider === SECRETREF_PROVIDER_ALIAS);
+}
+/**
+ * Merge the aquaman SecretRef wiring into a parsed openclaw.json object.
+ * Mutates `config` in place (mirrors the CLI's existing merge style),
+ * idempotent, and never overwrites a provider apiKey the user set to
+ * something other than an aquaman ref or the legacy placeholder.
+ */
+export function wireSecretRefProviders(config, services) {
+    let changed = false;
+    const wiredProviders = [];
+    const skippedProviders = [];
+    if (!config.secrets)
+        config.secrets = {};
+    if (!config.secrets.providers)
+        config.secrets.providers = {};
+    const desiredProvider = {
+        source: 'exec',
+        pluginIntegration: {
+            pluginId: SECRETREF_PLUGIN_ID,
+            integrationId: SECRETREF_INTEGRATION_ID,
+        },
+    };
+    const existingProvider = config.secrets.providers[SECRETREF_PROVIDER_ALIAS];
+    if (JSON.stringify(existingProvider) !== JSON.stringify(desiredProvider)) {
+        config.secrets.providers[SECRETREF_PROVIDER_ALIAS] = desiredProvider;
+        changed = true;
+    }
+    for (const service of services) {
+        if (!SECRETREF_SUPPORTED_PROVIDERS.includes(service)) {
+            skippedProviders.push(service);
+            continue;
+        }
+        if (!config.models)
+            config.models = {};
+        if (!config.models.providers)
+            config.models.providers = {};
+        if (!config.models.providers[service])
+            config.models.providers[service] = {};
+        const providerEntry = config.models.providers[service];
+        const desiredRef = buildProviderRef(service);
+        const current = providerEntry.apiKey;
+        const isLegacyPlaceholder = current === 'aquaman-proxy-managed';
+        const isUserValue = current !== undefined && !isLegacyPlaceholder && !isAquamanRef(current);
+        if (isUserValue) {
+            // A key the user set themselves — never clobber it.
+            skippedProviders.push(service);
+            continue;
+        }
+        if (JSON.stringify(current) !== JSON.stringify(desiredRef)) {
+            providerEntry.apiKey = desiredRef;
+            changed = true;
+        }
+        wiredProviders.push(service);
+    }
+    return { changed, wiredProviders, skippedProviders };
+}
+/** Read-only status check for `aquaman openclaw doctor`. */
+export function secretRefWiringStatus(config, services) {
+    const provider = config?.secrets?.providers?.[SECRETREF_PROVIDER_ALIAS];
+    const providerConfigured = provider?.source === 'exec' &&
+        provider?.pluginIntegration?.pluginId === SECRETREF_PLUGIN_ID &&
+        provider?.pluginIntegration?.integrationId === SECRETREF_INTEGRATION_ID;
+    const wiredProviders = [];
+    const missingProviders = [];
+    for (const service of services) {
+        if (!SECRETREF_SUPPORTED_PROVIDERS.includes(service))
+            continue;
+        if (isAquamanRef(config?.models?.providers?.[service]?.apiKey)) {
+            wiredProviders.push(service);
+        }
+        else {
+            missingProviders.push(service);
+        }
+    }
+    return { providerConfigured, wiredProviders, missingProviders };
+}
+//# sourceMappingURL=secretref.js.map

package/dist/openclaw/secretref.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secretref.js","sourceRoot":"","sources":["../../src/openclaw/secretref.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAExD,MAAM,CAAC,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;AACpD,MAAM,CAAC,MAAM,wBAAwB,GAAG,SAAS,CAAC;AAClD,MAAM,CAAC,MAAM,wBAAwB,GAAG,SAAS,CAAC;AAElD,yDAAyD;AACzD,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAU,CAAC;AAE9E;;;;;;;GAOG;AACH,MAAM,UAAU,6BAA6B,CAAC,OAAkC;IAC9E,MAAM,KAAK,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC;IACxB,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAChC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1B,OAAO,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAQD,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,wBAAwB,EAAE,EAAE,EAAE,GAAG,OAAO,UAAU,EAAE,CAAC;AAC1F,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACb,KAAsB,CAAC,MAAM,KAAK,MAAM;QACxC,KAAsB,CAAC,QAAQ,KAAK,wBAAwB,CAC9D,CAAC;AACJ,CAAC;AAUD;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAA2B,EAC3B,QAAkB;IAElB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,cAAc,GAAa,EAAE,CAAC;IACpC,MAAM,gBAAgB,GAAa,EAAE,CAAC;IAEtC,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,CAAC,OAAO,GAAG,EAAE,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS;QAAE,MAAM,CAAC,OAAO,CAAC,SAAS,GAAG,EAAE,CAAC;IAC7D,MAAM,eAAe,GAAG;QACtB,MAAM,EAAE,MAAM;QACd,iBAAiB,EAAE;YACjB,QAAQ,EAAE,mBAAmB;YAC7B,aAAa,EAAE,wBAAwB;SACxC;KACF,CAAC;IACF,MAAM,gBAAgB,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAC;IAC5E,IAAI,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,EAAE,CAAC;QACzE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,wBAAwB,CAAC,GAAG,eAAe,CAAC;QACrE,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAE,6BAAmD,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5E,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC/B,SAAS;QACX,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC;QACvC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS;YAAE,MAAM,CAAC,MAAM,CAAC,SAAS,GAAG,EAAE,CAAC;QAC3D,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC;YAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QAE7E,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACvD,MAAM,UAAU,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC;QAErC,MAAM,mBAAmB,GAAG,OAAO,KAAK,uBAAuB,CAAC;QAChE,MAAM,WAAW,GACf,OAAO,KAAK,SAAS,IAAI,CAAC,mBAAmB,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAE1E,IAAI,WAAW,EAAE,CAAC;YAChB,oDAAoD;YACpD,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC/B,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3D,aAAa,CAAC,MAAM,GAAG,UAAU,CAAC;YAClC,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;QACD,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,CAAC;AACvD,CAAC;AAWD,4DAA4D;AAC5D,MAAM,UAAU,qBAAqB,CACnC,MAA2B,EAC3B,QAAkB;IAElB,MAAM,QAAQ,GAAG,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,wBAAwB,CAAC,CAAC;IACxE,MAAM,kBAAkB,GACtB,QAAQ,EAAE,MAAM,KAAK,MAAM;QAC3B,QAAQ,EAAE,iBAAiB,EAAE,QAAQ,KAAK,mBAAmB;QAC7D,QAAQ,EAAE,iBAAiB,EAAE,aAAa,KAAK,wBAAwB,CAAC;IAE1E,MAAM,cAAc,GAAa,EAAE,CAAC;IACpC,MAAM,gBAAgB,GAAa,EAAE,CAAC;IACtC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAE,6BAAmD,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QACtF,IAAI,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC;YAC/D,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC;aAAM,CAAC;YACN,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IACD,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,gBAAgB,EAAE,CAAC;AAClE,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "aquaman-proxy",
-  "version": "0.13.0",
+  "version": "0.14.0",
   "description": "🔱 API key protection for AI agents. Bring your own vault. Credentials stay where you already keep them, never in the agent's memory.",
   "type": "module",
   "main": "dist/index.js",
@@ -52,8 +52,8 @@
     "keytar": "^7.9.0"
   },
   "devDependencies": {
-    "@types/node": "^20.10.0",
-    "tsx": "^4.7.0",
+    "@types/node": "^20.19.43",
+    "tsx": "^4.23.1",
     "typescript": "^5.3.0"
   },
   "files": ["dist", "LICENSE", "README.md"],