aquaman-proxy 0.14.0 → 0.15.0

package/dist/openclaw/channel-routing.js

@@ -0,0 +1,152 @@
+/**
+ * Channel egress routing for the OpenClaw Gateway (v0.15.0+).
+ *
+ * The plugin's `globalThis.fetch` interceptor covered channel traffic until
+ * OpenClaw moved each channel onto its own undici dispatcher. Verified on
+ * 2026.7.33 and 2026.9.1: Telegram, Discord and Matrix build a dispatcher per
+ * request and never consult the global fetch, so the interceptor sees nothing
+ * and the channel token is used straight from openclaw.json.
+ *
+ * Routing therefore has to use whatever endpoint override the host exposes.
+ * Telegram has one (`channels.telegram.apiRoot`, a documented reverse-proxy
+ * and self-hosted Bot API knob), so it is pointed at the loopback listener.
+ * No other bundled channel has an equivalent: Discord and Slack expose none,
+ * and Matrix, Mattermost and Nextcloud Talk already point at the user's own
+ * server rather than a vendor API. Those stay at-rest-only, and
+ * `aquaman openclaw doctor` says so instead of implying coverage.
+ *
+ * The Bot API has no auth header: the token IS the `/bot<TOKEN>` path segment.
+ * So the placeholder we write as `botToken` is the loopback token, and the
+ * daemon accepts it from that segment (see findUrlPathCredentialSlot).
+ */
+/** Channels whose endpoint the host lets us override. */
+export const CHANNEL_ROUTING_SUPPORTED = ['telegram'];
+/**
+ * Channels aquaman can store credentials for but cannot route on OpenClaw,
+ * because the host exposes no endpoint override for them. Used by doctor to
+ * report the gap rather than let it look like coverage.
+ */
+export const CHANNEL_ROUTING_UNSUPPORTED = [
+    'discord', 'slack', 'matrix', 'mattermost', 'line', 'twitch', 'telnyx',
+    'zalo', 'twilio', 'bluebubbles', 'nextcloud-talk', 'msteams', 'feishu',
+    'googlechat'
+];
+/**
+ * The URL OpenClaw should call for a channel, given the proxy's loopback
+ * origin. Telegram's client appends `/bot<TOKEN>/<method>` and, for media,
+ * `/file/bot<TOKEN>/<file_path>` — both land on our `/telegram` route.
+ */
+export function loopbackChannelBaseUrl(service, origin) {
+    // Trim trailing slashes without a regex: /\/+$/ backtracks polynomially on
+    // an origin ending in many slashes (CodeQL js/polynomial-redos).
+    let base = origin;
+    while (base.length > 0 && base.endsWith('/'))
+        base = base.slice(0, -1);
+    if (service === 'telegram')
+        return `${base}/telegram`;
+    return null;
+}
+/** An apiRoot aquaman owns, as opposed to a self-hosted Bot API server. */
+function isAquamanChannelBaseUrl(value) {
+    if (typeof value !== 'string')
+        return false;
+    return /^http:\/\/(127\.0\.0\.1|localhost|\[::1\]):\d+\/[a-z0-9-]+\/?$/.test(value);
+}
+/**
+ * Merge channel egress routing into a parsed openclaw.json object.
+ * Mutates `config` in place (matching the CLI's existing merge style) and is
+ * idempotent.
+ *
+ * Wiring a channel is all-or-nothing: a half-wired channel (our apiRoot, their
+ * token, or ours with an empty vault) is a broken bot, so anything unexpected
+ * means the channel is left exactly as it was and reported.
+ */
+export function wireChannelRouting(config, options) {
+    let changed = false;
+    const routedChannels = [];
+    const skipped = [];
+    const channels = config.channels;
+    if (!channels || typeof channels !== 'object') {
+        return { changed, routedChannels, skipped };
+    }
+    for (const channel of CHANNEL_ROUTING_SUPPORTED) {
+        const entry = channels[channel];
+        // Not configured at all: nothing to route, and nothing worth reporting.
+        if (!entry || typeof entry !== 'object')
+            continue;
+        // Multi-account channels map several bot tokens onto one service name,
+        // which the vault's single `telegram/bot_token` cannot represent.
+        const accounts = entry.accounts;
+        if (accounts && typeof accounts === 'object' && Object.keys(accounts).length > 0) {
+            skipped.push({ channel, reason: 'multi-account' });
+            continue;
+        }
+        // tokenFile and TELEGRAM_BOT_TOKEN are separate sources whose precedence
+        // over a config token we would be guessing at. Leave them alone.
+        if (typeof entry.tokenFile === 'string' && entry.tokenFile) {
+            skipped.push({ channel, reason: 'token-file' });
+            continue;
+        }
+        const desiredBase = loopbackChannelBaseUrl(channel, options.loopbackOrigin);
+        if (!desiredBase) {
+            skipped.push({ channel, reason: 'unroutable' });
+            continue;
+        }
+        // A self-hosted Bot API server or a regional reverse proxy. Routing
+        // through us would send their traffic to Telegram instead.
+        const currentBase = entry.apiRoot;
+        if (currentBase !== undefined && !isAquamanChannelBaseUrl(currentBase)) {
+            skipped.push({ channel, reason: 'user-endpoint' });
+            continue;
+        }
+        // Without the real token in the vault the proxy has nothing to inject, and
+        // overwriting their working token would take the bot down.
+        if (!options.hasVaultCredential(channel)) {
+            skipped.push({ channel, reason: 'no-vault-credential' });
+            continue;
+        }
+        if (currentBase !== desiredBase) {
+            entry.apiRoot = desiredBase;
+            changed = true;
+        }
+        if (entry.botToken !== options.loopbackToken) {
+            entry.botToken = options.loopbackToken;
+            changed = true;
+        }
+        routedChannels.push(channel);
+    }
+    return { changed, routedChannels, skipped };
+}
+/** Read-only status for `aquaman openclaw doctor`. */
+export function channelRoutingStatus(config, options) {
+    const routed = [];
+    const notRouted = [];
+    const unroutable = [];
+    const channels = config?.channels;
+    if (!channels || typeof channels !== 'object')
+        return { routed, notRouted, unroutable };
+    for (const channel of CHANNEL_ROUTING_SUPPORTED) {
+        const entry = channels[channel];
+        if (!entry || typeof entry !== 'object')
+            continue;
+        if (isAquamanChannelBaseUrl(entry.apiRoot)) {
+            routed.push(channel);
+        }
+        else if (entry.apiRoot !== undefined) {
+            notRouted.push({ channel, reason: 'user-endpoint' });
+        }
+        else if (!options.hasVaultCredential(channel)) {
+            notRouted.push({ channel, reason: 'no-vault-credential' });
+        }
+        else {
+            notRouted.push({ channel, reason: 'not-wired' });
+        }
+    }
+    for (const channel of CHANNEL_ROUTING_UNSUPPORTED) {
+        const entry = channels[channel];
+        if (entry && typeof entry === 'object')
+            unroutable.push(channel);
+    }
+    return { routed, notRouted, unroutable };
+}
+//# sourceMappingURL=channel-routing.js.map

package/dist/openclaw/channel-routing.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"channel-routing.js","sourceRoot":"","sources":["../../src/openclaw/channel-routing.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AAEH,yDAAyD;AACzD,MAAM,CAAC,MAAM,yBAAyB,GAAG,CAAC,UAAU,CAAU,CAAC;AAE/D;;;;GAIG;AACH,MAAM,CAAC,MAAM,2BAA2B,GAAG;IACzC,SAAS,EAAE,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,EAAE,QAAQ,EAAE,QAAQ;IACtE,MAAM,EAAE,QAAQ,EAAE,aAAa,EAAE,gBAAgB,EAAE,SAAS,EAAE,QAAQ;IACtE,YAAY;CACJ,CAAC;AAEX;;;;GAIG;AACH,MAAM,UAAU,sBAAsB,CAAC,OAAe,EAAE,MAAc;IACpE,2EAA2E;IAC3E,iEAAiE;IACjE,IAAI,IAAI,GAAG,MAAM,CAAC;IAClB,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACvE,IAAI,OAAO,KAAK,UAAU;QAAE,OAAO,GAAG,IAAI,WAAW,CAAC;IACtD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,2EAA2E;AAC3E,SAAS,uBAAuB,CAAC,KAAc;IAC7C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,OAAO,gEAAgE,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACtF,CAAC;AAiCD;;;;;;;;GAQG;AACH,MAAM,UAAU,kBAAkB,CAChC,MAA2B,EAC3B,OAA8B;IAE9B,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,cAAc,GAAa,EAAE,CAAC;IACpC,MAAM,OAAO,GAAkB,EAAE,CAAC;IAElC,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC;IACjC,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,EAAE,CAAC;QAC9C,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC;IAC9C,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,yBAAyB,EAAE,CAAC;QAChD,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QAChC,wEAAwE;QACxE,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,SAAS;QAElD,uEAAuE;QACvE,kEAAkE;QAClE,MAAM,QAAQ,GAAG,KAAK,CAAC,QAAQ,CAAC;QAChC,IAAI,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ,IAAI,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YACjF,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;YACnD,SAAS;QACX,CAAC;QAED,yEAAyE;QACzE,iEAAiE;QACjE,IAAI,OAAO,KAAK,CAAC,SAAS,KAAK,QAAQ,IAAI,KAAK,CAAC,SAAS,EAAE,CAAC;YAC3D,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;YAChD,SAAS;QACX,CAAC;QAED,MAAM,WAAW,GAAG,sBAAsB,CAAC,OAAO,EAAE,OAAO,CAAC,cAAc,CAAC,CAAC;QAC5E,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,YAAY,EAAE,CAAC,CAAC;YAChD,SAAS;QACX,CAAC;QAED,oEAAoE;QACpE,2DAA2D;QAC3D,MAAM,WAAW,GAAG,KAAK,CAAC,OAAO,CAAC;QAClC,IAAI,WAAW,KAAK,SAAS,IAAI,CAAC,uBAAuB,CAAC,WAAW,CAAC,EAAE,CAAC;YACvE,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;YACnD,SAAS;QACX,CAAC;QAED,2EAA2E;QAC3E,2DAA2D;QAC3D,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;YACzC,OAAO,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAC;YACzD,SAAS;QACX,CAAC;QAED,IAAI,WAAW,KAAK,WAAW,EAAE,CAAC;YAChC,KAAK,CAAC,OAAO,GAAG,WAAW,CAAC;YAC5B,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;QACD,IAAI,KAAK,CAAC,QAAQ,KAAK,OAAO,CAAC,aAAa,EAAE,CAAC;YAC7C,KAAK,CAAC,QAAQ,GAAG,OAAO,CAAC,aAAa,CAAC;YACvC,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;QACD,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,OAAO,EAAE,CAAC;AAC9C,CAAC;AAeD,sDAAsD;AACtD,MAAM,UAAU,oBAAoB,CAClC,MAA2B,EAC3B,OAA0D;IAE1D,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,MAAM,SAAS,GAAkB,EAAE,CAAC;IACpC,MAAM,UAAU,GAAa,EAAE,CAAC;IAEhC,MAAM,QAAQ,GAAG,MAAM,EAAE,QAAQ,CAAC;IAClC,IAAI,CAAC,QAAQ,IAAI,OAAO,QAAQ,KAAK,QAAQ;QAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;IAExF,KAAK,MAAM,OAAO,IAAI,yBAAyB,EAAE,CAAC;QAChD,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,SAAS;QAClD,IAAI,uBAAuB,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC;YAC3C,MAAM,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACvB,CAAC;aAAM,IAAI,KAAK,CAAC,OAAO,KAAK,SAAS,EAAE,CAAC;YACvC,SAAS,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,EAAE,CAAC,CAAC;QACvD,CAAC;aAAM,IAAI,CAAC,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,CAAC;YAChD,SAAS,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,qBAAqB,EAAE,CAAC,CAAC;QAC7D,CAAC;aAAM,CAAC;YACN,SAAS,CAAC,IAAI,CAAC,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,CAAC,CAAC;QACnD,CAAC;IACH,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,2BAA2B,EAAE,CAAC;QAClD,MAAM,KAAK,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;QAChC,IAAI,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ;YAAE,UAAU,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACnE,CAAC;IAED,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,UAAU,EAAE,CAAC;AAC3C,CAAC"}

package/dist/openclaw/integration.d.ts

@@ -31,6 +31,24 @@ export declare function parseCalendarVersion(version: string | undefined | null)
  * unparseable versions return false (assume the legacy JSON path still works).
  */
 export declare function authProfilesAreSqliteOnly(version: string | undefined | null): boolean;
+/**
+ * OpenClaw >= 2026.8.1 (the "OpenClaw 2.0" line) finished the SQLite-only
+ * auth-profile move (openclaw/openclaw#114033): a legacy `auth-profiles.json`
+ * beside the SQLite store now BLOCKS those providers with
+ * AUTH_PROFILE_MIGRATION_REQUIRED ("requires legacy credential migration; run
+ * openclaw doctor --fix") instead of being ignored. Verified on 2026.9.1; on
+ * 2026.7.33 the file is still just ignored.
+ */
+export declare function legacyAuthProfilesBlockProviders(version: string | undefined | null): boolean;
+/**
+ * OpenClaw >= 2026.8.1 gates third-party plugin install/enable on capability
+ * consent (#130168/#131301/#134183): non-interactively that's
+ * `--accept-capabilities`, and npm/local sources also need `--force`
+ * (#102197). A `clawhub:` source needs only the consent flag. 2026.7.33
+ * accepts a bare `openclaw plugins install aquaman-plugin` (and rejects the
+ * unknown flags), so this gates which command setup runs.
+ */
+export declare function pluginInstallNeedsCapabilityConsent(version: string | undefined | null): boolean;
 export declare class OpenClawIntegration {
     private config;
     private services;

package/dist/openclaw/integration.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"integration.d.ts","sourceRoot":"","sources":["../../src/openclaw/integration.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAS,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAE9D,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAErE,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,gFAAgF;AAChF,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GACjC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAQjC;AAED;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,OAAO,CAOrF;AAED,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,QAAQ,CAAkB;gBAEtB,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,aAAa,EAAE;IAK5D;;OAEG;IACG,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;IAkC7C;;;;OAIG;IACG,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAI1D;;OAEG;IACG,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IAmBtE;;OAEG;IACG,cAAc,CAAC,OAAO,GAAE,aAAkB,GAAG,OAAO,CAAC,YAAY,CAAC;IAwBxE;;OAEG;IACG,gBAAgB,IAAI,OAAO,CAAC,MAAM,CAAC;CAI1C;AAED,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,aAAa,EACrB,QAAQ,EAAE,aAAa,EAAE,GACxB,mBAAmB,CAErB"}
+{"version":3,"file":"integration.d.ts","sourceRoot":"","sources":["../../src/openclaw/integration.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAGH,OAAO,EAAS,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAE9D,OAAO,KAAK,EAAE,aAAa,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAErE,MAAM,WAAW,YAAY;IAC3B,SAAS,EAAE,OAAO,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC;CACf;AAED,MAAM,WAAW,aAAa;IAC5B,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,GAAG,CAAC,EAAE,MAAM,CAAC;IACb,YAAY,CAAC,EAAE,OAAO,CAAC;CACxB;AAED,gFAAgF;AAChF,wBAAgB,oBAAoB,CAClC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GACjC,CAAC,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,GAAG,IAAI,CAQjC;AAED;;;;;;;;;GASG;AACH,wBAAgB,yBAAyB,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,OAAO,CAOrF;AAWD;;;;;;;GAOG;AACH,wBAAgB,gCAAgC,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,OAAO,CAE5F;AAED;;;;;;;GAOG;AACH,wBAAgB,mCAAmC,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,OAAO,CAE/F;AAED,qBAAa,mBAAmB;IAC9B,OAAO,CAAC,MAAM,CAAgB;IAC9B,OAAO,CAAC,QAAQ,CAAkB;gBAEtB,MAAM,EAAE,aAAa,EAAE,QAAQ,EAAE,aAAa,EAAE;IAK5D;;OAEG;IACG,cAAc,IAAI,OAAO,CAAC,YAAY,CAAC;IAkC7C;;;;OAIG;IACG,iBAAiB,IAAI,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAI1D;;OAEG;IACG,kBAAkB,CAAC,GAAG,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,GAAG,OAAO,CAAC,MAAM,CAAC;IAmBtE;;OAEG;IACG,cAAc,CAAC,OAAO,GAAE,aAAkB,GAAG,OAAO,CAAC,YAAY,CAAC;IAwBxE;;OAEG;IACG,gBAAgB,IAAI,OAAO,CAAC,MAAM,CAAC;CAI1C;AAED,wBAAgB,yBAAyB,CACvC,MAAM,EAAE,aAAa,EACrB,QAAQ,EAAE,aAAa,EAAE,GACxB,mBAAmB,CAErB"}

package/dist/openclaw/integration.js

@@ -43,6 +43,38 @@ export function authProfilesAreSqliteOnly(version) {
         return m > 6;
     return d >= 5;
 }
+function calendarAtLeast(version, min) {
+    const parts = parseCalendarVersion(version);
+    if (!parts)
+        return false;
+    for (let i = 0; i < 3; i++) {
+        if (parts[i] !== min[i])
+            return parts[i] > min[i];
+    }
+    return true;
+}
+/**
+ * OpenClaw >= 2026.8.1 (the "OpenClaw 2.0" line) finished the SQLite-only
+ * auth-profile move (openclaw/openclaw#114033): a legacy `auth-profiles.json`
+ * beside the SQLite store now BLOCKS those providers with
+ * AUTH_PROFILE_MIGRATION_REQUIRED ("requires legacy credential migration; run
+ * openclaw doctor --fix") instead of being ignored. Verified on 2026.9.1; on
+ * 2026.7.33 the file is still just ignored.
+ */
+export function legacyAuthProfilesBlockProviders(version) {
+    return calendarAtLeast(version, [2026, 8, 1]);
+}
+/**
+ * OpenClaw >= 2026.8.1 gates third-party plugin install/enable on capability
+ * consent (#130168/#131301/#134183): non-interactively that's
+ * `--accept-capabilities`, and npm/local sources also need `--force`
+ * (#102197). A `clawhub:` source needs only the consent flag. 2026.7.33
+ * accepts a bare `openclaw plugins install aquaman-plugin` (and rejects the
+ * unknown flags), so this gates which command setup runs.
+ */
+export function pluginInstallNeedsCapabilityConsent(version) {
+    return calendarAtLeast(version, [2026, 8, 1]);
+}
 export class OpenClawIntegration {
     config;
     services;

package/dist/openclaw/integration.js.map

@@ -1 +1 @@
-{"version":3,"file":"integration.js","sourceRoot":"","sources":["../../src/openclaw/integration.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAe1G,gFAAgF;AAChF,MAAM,UAAU,oBAAoB,CAClC,OAAkC;IAElC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,4EAA4E;IAC5E,yEAAyE;IACzE,IAAI,OAAO,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAC/C,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAkC;IAC1E,MAAM,KAAK,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC;IACxB,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAChC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1B,OAAO,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,MAAM,OAAO,mBAAmB;IACtB,MAAM,CAAgB;IACtB,QAAQ,CAAkB;IAElC,YAAY,MAAqB,EAAE,QAAyB;QAC1D,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc;QAClB,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,IAAI,UAAU,CAAC;QAEjE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC,WAAW,CAAC,EAAE;gBAC5C,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;aAClC,CAAC,CAAC;YAEH,IAAI,MAAM,GAAG,EAAE,CAAC;YAEhB,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;gBAC/B,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC5B,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBACpB,OAAO,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;YAChC,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBACxB,IAAI,IAAI,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;oBACzB,qDAAqD;oBACrD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;oBAC1D,OAAO,CAAC;wBACN,SAAS,EAAE,IAAI;wBACf,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;wBACzC,IAAI,EAAE,UAAU;qBACjB,CAAC,CAAC;gBACL,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;gBAChC,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,iBAAiB;QACrB,OAAO,mBAAmB,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC1D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,kBAAkB,CAAC,GAA2B;QAClD,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;YAC1C,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,CAAC,CAAC;gBACzD,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;gBAC3B,OAAO,OAAO,CAAC;YACjB,CAAC;YAED,KAAK,UAAU,CAAC,CAAC,CAAC;gBAChB,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC;YAC9B,CAAC;YAED,KAAK,KAAK,CAAC;YACX;gBACE,6CAA6C;gBAC7C,OAAO,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAAC,UAAyB,EAAE;QAC9C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAEzC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CACb,gEAAgE;gBAChE,oDAAoD,CACrD,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAE3C,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,IAAI,UAAU,CAAC;QACjE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;QAEhC,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE;YACnC,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE;YACjC,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE;YAC/B,KAAK,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC;SAC5E,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB;QACpB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC3C,OAAO,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAClC,CAAC;CACF;AAED,MAAM,UAAU,yBAAyB,CACvC,MAAqB,EACrB,QAAyB;IAEzB,OAAO,IAAI,mBAAmB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AACnD,CAAC"}
+{"version":3,"file":"integration.js","sourceRoot":"","sources":["../../src/openclaw/integration.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,IAAI,MAAM,WAAW,CAAC;AAClC,OAAO,EAAE,KAAK,EAAqB,MAAM,oBAAoB,CAAC;AAC9D,OAAO,EAAE,mBAAmB,EAAE,YAAY,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,iBAAiB,CAAC;AAe1G,gFAAgF;AAChF,MAAM,UAAU,oBAAoB,CAClC,OAAkC;IAElC,IAAI,CAAC,OAAO;QAAE,OAAO,IAAI,CAAC;IAC1B,4EAA4E;IAC5E,yEAAyE;IACzE,IAAI,OAAO,CAAC,MAAM,GAAG,EAAE;QAAE,OAAO,IAAI,CAAC;IACrC,MAAM,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,qBAAqB,CAAC,CAAC;IAC/C,IAAI,CAAC,CAAC;QAAE,OAAO,IAAI,CAAC;IACpB,OAAO,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACpD,CAAC;AAED;;;;;;;;;GASG;AACH,MAAM,UAAU,yBAAyB,CAAC,OAAkC;IAC1E,MAAM,KAAK,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC;IACxB,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAChC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1B,OAAO,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAED,SAAS,eAAe,CAAC,OAAkC,EAAE,GAA6B;IACxF,MAAM,KAAK,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QAC3B,IAAI,KAAK,CAAC,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC,CAAC;IACpD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,gCAAgC,CAAC,OAAkC;IACjF,OAAO,eAAe,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAChD,CAAC;AAED;;;;;;;GAOG;AACH,MAAM,UAAU,mCAAmC,CAAC,OAAkC;IACpF,OAAO,eAAe,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;AAChD,CAAC;AAED,MAAM,OAAO,mBAAmB;IACtB,MAAM,CAAgB;IACtB,QAAQ,CAAkB;IAElC,YAAY,MAAqB,EAAE,QAAyB;QAC1D,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,QAAQ,GAAG,QAAQ,CAAC;IAC3B,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc;QAClB,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,IAAI,UAAU,CAAC;QAEjE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,EAAE;YAC7B,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,EAAE,CAAC,WAAW,CAAC,EAAE;gBAC5C,KAAK,EAAE,CAAC,QAAQ,EAAE,MAAM,EAAE,MAAM,CAAC;aAClC,CAAC,CAAC;YAEH,IAAI,MAAM,GAAG,EAAE,CAAC;YAEhB,IAAI,CAAC,MAAM,EAAE,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;gBAC/B,MAAM,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;YAC5B,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,GAAG,EAAE;gBACpB,OAAO,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;YAChC,CAAC,CAAC,CAAC;YAEH,IAAI,CAAC,EAAE,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,EAAE;gBACxB,IAAI,IAAI,KAAK,CAAC,IAAI,MAAM,EAAE,CAAC;oBACzB,qDAAqD;oBACrD,MAAM,KAAK,GAAG,MAAM,CAAC,KAAK,CAAC,6BAA6B,CAAC,CAAC;oBAC1D,OAAO,CAAC;wBACN,SAAS,EAAE,IAAI;wBACf,OAAO,EAAE,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,IAAI,EAAE;wBACzC,IAAI,EAAE,UAAU;qBACjB,CAAC,CAAC;gBACL,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,EAAE,SAAS,EAAE,KAAK,EAAE,CAAC,CAAC;gBAChC,CAAC;YACH,CAAC,CAAC,CAAC;QACL,CAAC,CAAC,CAAC;IACL,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,iBAAiB;QACrB,OAAO,mBAAmB,CAAC,EAAE,QAAQ,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,CAAC;IAC1D,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,kBAAkB,CAAC,GAA2B;QAClD,QAAQ,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,YAAY,EAAE,CAAC;YAC1C,KAAK,QAAQ,CAAC,CAAC,CAAC;gBACd,MAAM,OAAO,GAAG,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,CAAC,CAAC;gBACzD,YAAY,CAAC,GAAG,EAAE,OAAO,CAAC,CAAC;gBAC3B,OAAO,OAAO,CAAC;YACjB,CAAC;YAED,KAAK,UAAU,CAAC,CAAC,CAAC;gBAChB,OAAO,eAAe,CAAC,GAAG,CAAC,CAAC;YAC9B,CAAC;YAED,KAAK,KAAK,CAAC;YACX;gBACE,6CAA6C;gBAC7C,OAAO,mBAAmB,CAAC,GAAG,CAAC,CAAC;QACpC,CAAC;IACH,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,cAAc,CAAC,UAAyB,EAAE;QAC9C,MAAM,IAAI,GAAG,MAAM,IAAI,CAAC,cAAc,EAAE,CAAC;QAEzC,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YACpB,MAAM,IAAI,KAAK,CACb,gEAAgE;gBAChE,oDAAoD,CACrD,CAAC;QACJ,CAAC;QAED,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAE3C,MAAM,UAAU,GAAG,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,UAAU,IAAI,UAAU,CAAC;QACjE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;QAEhC,MAAM,IAAI,GAAG,KAAK,CAAC,UAAU,EAAE,IAAI,EAAE;YACnC,GAAG,EAAE,OAAO,CAAC,GAAG,IAAI,OAAO,CAAC,GAAG,EAAE;YACjC,GAAG,EAAE,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,GAAG,GAAG,EAAE;YAC/B,KAAK,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,CAAC,SAAS,EAAE,SAAS,EAAE,SAAS,CAAC;SAC5E,CAAC,CAAC;QAEH,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;OAEG;IACH,KAAK,CAAC,gBAAgB;QACpB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,iBAAiB,EAAE,CAAC;QAC3C,OAAO,mBAAmB,CAAC,GAAG,CAAC,CAAC;IAClC,CAAC;CACF;AAED,MAAM,UAAU,yBAAyB,CACvC,MAAqB,EACrB,QAAyB;IAEzB,OAAO,IAAI,mBAAmB,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;AACnD,CAAC"}

package/dist/openclaw/secretref.d.ts

@@ -21,11 +21,20 @@
  * configure-flow scrubs (`scrubAuthProfilesForProviderTargets` deletes
  * plaintext keys but preserves valid refs).
  *
- * The resolver returns the static `aquaman-proxy-managed` placeholder; the
- * proxy strips whatever key the gateway presents and injects the real
- * credential upstream. Keys never enter the gateway process — the SecretRef
- * integration changes how the *placeholder* reaches the gateway, not the
- * isolation boundary.
+ * v0.15.0 also writes `models.providers.<svc>.baseUrl` pointing at aquaman's
+ * loopback listener. OpenClaw's model calls go through its own transport with
+ * its own undici dispatcher: it ignores the `aquaman.local` sentinel (its DNS
+ * lookup fails) and never calls `globalThis.fetch`, so the plugin's
+ * interceptor cannot see provider traffic (verified on 2026.7.33 and
+ * 2026.9.1). A loopback `baseUrl` is OpenClaw's documented local-provider
+ * pattern: the configured `scheme://host:port` origin is trusted for the
+ * guarded fetch path, plain HTTP included.
+ *
+ * The resolver returns the loopback token (falling back to the static
+ * `aquaman-proxy-managed` placeholder when no listener is configured); the
+ * proxy checks the token, strips it, and injects the real credential
+ * upstream. Keys never enter the gateway process — the token is a capability
+ * to reach the local proxy, not a credential.
  */
 export declare const SECRETREF_PLUGIN_ID = "aquaman-plugin";
 export declare const SECRETREF_INTEGRATION_ID = "aquaman";
@@ -47,12 +56,28 @@ export interface SecretRefRef {
     id: string;
 }
 export declare function buildProviderRef(service: string): SecretRefRef;
+/**
+ * The URL OpenClaw should call for a provider, given the proxy's loopback
+ * origin (`http://127.0.0.1:<port>`). Path shapes match what each provider
+ * client appends, exactly as on the Hermes path: the Anthropic client adds
+ * `/v1/messages` to `<origin>/anthropic`, and the OpenAI-compatible client
+ * adds `/chat/completions` to `<origin>/openai/v1`.
+ */
+export declare function loopbackProviderBaseUrl(service: string, origin: string): string | null;
 export interface SecretRefWiringResult {
     changed: boolean;
     /** Providers whose apiKey now points at the aquaman SecretRef. */
     wiredProviders: string[];
     /** Providers requested but skipped (unsupported by the resolver today). */
     skippedProviders: string[];
+    /** Providers whose baseUrl now points at the loopback listener. */
+    baseUrlProviders: string[];
+    /** Providers left alone because the user set their own baseUrl. */
+    keptUserBaseUrl: string[];
+}
+export interface SecretRefWiringOptions {
+    /** `http://127.0.0.1:<port>` — when given, providers also get a baseUrl. */
+    loopbackOrigin?: string;
 }
 /**
  * Merge the aquaman SecretRef wiring into a parsed openclaw.json object.
@@ -60,7 +85,7 @@ export interface SecretRefWiringResult {
  * idempotent, and never overwrites a provider apiKey the user set to
  * something other than an aquaman ref or the legacy placeholder.
  */
-export declare function wireSecretRefProviders(config: Record<string, any>, services: string[]): SecretRefWiringResult;
+export declare function wireSecretRefProviders(config: Record<string, any>, services: string[], options?: SecretRefWiringOptions): SecretRefWiringResult;
 export interface SecretRefWiringStatus {
     /** secrets.providers.aquaman points at the plugin integration. */
     providerConfigured: boolean;
@@ -68,6 +93,10 @@ export interface SecretRefWiringStatus {
     wiredProviders: string[];
     /** Requested + supported providers not yet wired. */
     missingProviders: string[];
+    /** Providers whose baseUrl points at a loopback aquaman listener. */
+    baseUrlProviders: string[];
+    /** Wired providers still calling the upstream directly (proxy bypassed). */
+    missingBaseUrl: string[];
 }
 /** Read-only status check for `aquaman openclaw doctor`. */
 export declare function secretRefWiringStatus(config: Record<string, any>, services: string[]): SecretRefWiringStatus;

package/dist/openclaw/secretref.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secretref.d.ts","sourceRoot":"","sources":["../../src/openclaw/secretref.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAIH,eAAO,MAAM,mBAAmB,mBAAmB,CAAC;AACpD,eAAO,MAAM,wBAAwB,YAAY,CAAC;AAClD,eAAO,MAAM,wBAAwB,YAAY,CAAC;AAElD,yDAAyD;AACzD,eAAO,MAAM,6BAA6B,kCAAmC,CAAC;AAE9E;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,OAAO,CAOzF;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,CAE9D;AAWD,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,kEAAkE;IAClE,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,2EAA2E;IAC3E,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,QAAQ,EAAE,MAAM,EAAE,GACjB,qBAAqB,CAkDvB;AAED,MAAM,WAAW,qBAAqB;IACpC,kEAAkE;IAClE,kBAAkB,EAAE,OAAO,CAAC;IAC5B,sDAAsD;IACtD,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,qDAAqD;IACrD,gBAAgB,EAAE,MAAM,EAAE,CAAC;CAC5B;AAED,4DAA4D;AAC5D,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,QAAQ,EAAE,MAAM,EAAE,GACjB,qBAAqB,CAkBvB"}
+{"version":3,"file":"secretref.d.ts","sourceRoot":"","sources":["../../src/openclaw/secretref.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAIH,eAAO,MAAM,mBAAmB,mBAAmB,CAAC;AACpD,eAAO,MAAM,wBAAwB,YAAY,CAAC;AAClD,eAAO,MAAM,wBAAwB,YAAY,CAAC;AAElD,yDAAyD;AACzD,eAAO,MAAM,6BAA6B,kCAAmC,CAAC;AAE9E;;;;;;;GAOG;AACH,wBAAgB,6BAA6B,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,GAAG,IAAI,GAAG,OAAO,CAOzF;AAED,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;IACjB,EAAE,EAAE,MAAM,CAAC;CACZ;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,YAAY,CAE9D;AAED;;;;;;GAMG;AACH,wBAAgB,uBAAuB,CAAC,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAQtF;AAoBD,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAC;IACjB,kEAAkE;IAClE,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,2EAA2E;IAC3E,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,mEAAmE;IACnE,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,mEAAmE;IACnE,eAAe,EAAE,MAAM,EAAE,CAAC;CAC3B;AAED,MAAM,WAAW,sBAAsB;IACrC,4EAA4E;IAC5E,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;;;;GAKG;AACH,wBAAgB,sBAAsB,CACpC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,QAAQ,EAAE,MAAM,EAAE,EAClB,OAAO,GAAE,sBAA2B,GACnC,qBAAqB,CAsEvB;AAED,MAAM,WAAW,qBAAqB;IACpC,kEAAkE;IAClE,kBAAkB,EAAE,OAAO,CAAC;IAC5B,sDAAsD;IACtD,cAAc,EAAE,MAAM,EAAE,CAAC;IACzB,qDAAqD;IACrD,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,qEAAqE;IACrE,gBAAgB,EAAE,MAAM,EAAE,CAAC;IAC3B,4EAA4E;IAC5E,cAAc,EAAE,MAAM,EAAE,CAAC;CAC1B;AAED,4DAA4D;AAC5D,wBAAgB,qBAAqB,CACnC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EAC3B,QAAQ,EAAE,MAAM,EAAE,GACjB,qBAAqB,CA2BvB"}

package/dist/openclaw/secretref.js

@@ -21,11 +21,20 @@
  * configure-flow scrubs (`scrubAuthProfilesForProviderTargets` deletes
  * plaintext keys but preserves valid refs).
  *
- * The resolver returns the static `aquaman-proxy-managed` placeholder; the
- * proxy strips whatever key the gateway presents and injects the real
- * credential upstream. Keys never enter the gateway process — the SecretRef
- * integration changes how the *placeholder* reaches the gateway, not the
- * isolation boundary.
+ * v0.15.0 also writes `models.providers.<svc>.baseUrl` pointing at aquaman's
+ * loopback listener. OpenClaw's model calls go through its own transport with
+ * its own undici dispatcher: it ignores the `aquaman.local` sentinel (its DNS
+ * lookup fails) and never calls `globalThis.fetch`, so the plugin's
+ * interceptor cannot see provider traffic (verified on 2026.7.33 and
+ * 2026.9.1). A loopback `baseUrl` is OpenClaw's documented local-provider
+ * pattern: the configured `scheme://host:port` origin is trusted for the
+ * guarded fetch path, plain HTTP included.
+ *
+ * The resolver returns the loopback token (falling back to the static
+ * `aquaman-proxy-managed` placeholder when no listener is configured); the
+ * proxy checks the token, strips it, and injects the real credential
+ * upstream. Keys never enter the gateway process — the token is a capability
+ * to reach the local proxy, not a credential.
  */
 import { parseCalendarVersion } from './integration.js';
 export const SECRETREF_PLUGIN_ID = 'aquaman-plugin';
@@ -55,6 +64,32 @@ export function supportsSecretRefIntegrations(version) {
 export function buildProviderRef(service) {
     return { source: 'exec', provider: SECRETREF_PROVIDER_ALIAS, id: `${service}/api_key` };
 }
+/**
+ * The URL OpenClaw should call for a provider, given the proxy's loopback
+ * origin (`http://127.0.0.1:<port>`). Path shapes match what each provider
+ * client appends, exactly as on the Hermes path: the Anthropic client adds
+ * `/v1/messages` to `<origin>/anthropic`, and the OpenAI-compatible client
+ * adds `/chat/completions` to `<origin>/openai/v1`.
+ */
+export function loopbackProviderBaseUrl(service, origin) {
+    // Trim trailing slashes without a regex: /\/+$/ backtracks polynomially on
+    // an origin ending in many slashes (CodeQL js/polynomial-redos).
+    let base = origin;
+    while (base.length > 0 && base.endsWith('/'))
+        base = base.slice(0, -1);
+    if (service === 'anthropic')
+        return `${base}/anthropic`;
+    if (service === 'openai')
+        return `${base}/openai/v1`;
+    return null;
+}
+/** A baseUrl aquaman owns: our loopback shape, or the retired sentinel host. */
+function isAquamanBaseUrl(value) {
+    if (typeof value !== 'string')
+        return false;
+    return (/^http:\/\/(127\.0\.0\.1|localhost|\[::1\]):\d+\/(anthropic|openai)(\/v1)?\/?$/.test(value) ||
+        /^http:\/\/aquaman\.local\//.test(value));
+}
 function isAquamanRef(value) {
     return (typeof value === 'object' &&
         value !== null &&
@@ -67,10 +102,12 @@ function isAquamanRef(value) {
  * idempotent, and never overwrites a provider apiKey the user set to
  * something other than an aquaman ref or the legacy placeholder.
  */
-export function wireSecretRefProviders(config, services) {
+export function wireSecretRefProviders(config, services, options = {}) {
     let changed = false;
     const wiredProviders = [];
     const skippedProviders = [];
+    const baseUrlProviders = [];
+    const keptUserBaseUrl = [];
     if (!config.secrets)
         config.secrets = {};
     if (!config.secrets.providers)
@@ -113,8 +150,26 @@ export function wireSecretRefProviders(config, services) {
             changed = true;
         }
         wiredProviders.push(service);
+        // Route the provider at the loopback listener. Without this, OpenClaw's
+        // transport calls the real upstream directly and the proxy never sees it.
+        const desiredBase = options.loopbackOrigin
+            ? loopbackProviderBaseUrl(service, options.loopbackOrigin)
+            : null;
+        if (desiredBase) {
+            const currentBase = providerEntry.baseUrl;
+            if (currentBase !== undefined && !isAquamanBaseUrl(currentBase)) {
+                keptUserBaseUrl.push(service);
+            }
+            else {
+                if (currentBase !== desiredBase) {
+                    providerEntry.baseUrl = desiredBase;
+                    changed = true;
+                }
+                baseUrlProviders.push(service);
+            }
+        }
     }
-    return { changed, wiredProviders, skippedProviders };
+    return { changed, wiredProviders, skippedProviders, baseUrlProviders, keptUserBaseUrl };
 }
 /** Read-only status check for `aquaman openclaw doctor`. */
 export function secretRefWiringStatus(config, services) {
@@ -124,16 +179,26 @@ export function secretRefWiringStatus(config, services) {
         provider?.pluginIntegration?.integrationId === SECRETREF_INTEGRATION_ID;
     const wiredProviders = [];
     const missingProviders = [];
+    const baseUrlProviders = [];
+    const missingBaseUrl = [];
     for (const service of services) {
         if (!SECRETREF_SUPPORTED_PROVIDERS.includes(service))
             continue;
         if (isAquamanRef(config?.models?.providers?.[service]?.apiKey)) {
             wiredProviders.push(service);
+            // A wired apiKey with no loopback baseUrl means OpenClaw's transport
+            // still calls the upstream directly and the proxy is bypassed.
+            if (isAquamanBaseUrl(config?.models?.providers?.[service]?.baseUrl)) {
+                baseUrlProviders.push(service);
+            }
+            else {
+                missingBaseUrl.push(service);
+            }
         }
         else {
             missingProviders.push(service);
         }
     }
-    return { providerConfigured, wiredProviders, missingProviders };
+    return { providerConfigured, wiredProviders, missingProviders, baseUrlProviders, missingBaseUrl };
 }
 //# sourceMappingURL=secretref.js.map

package/dist/openclaw/secretref.js.map

@@ -1 +1 @@
-{"version":3,"file":"secretref.js","sourceRoot":"","sources":["../../src/openclaw/secretref.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAExD,MAAM,CAAC,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;AACpD,MAAM,CAAC,MAAM,wBAAwB,GAAG,SAAS,CAAC;AAClD,MAAM,CAAC,MAAM,wBAAwB,GAAG,SAAS,CAAC;AAElD,yDAAyD;AACzD,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAU,CAAC;AAE9E;;;;;;;GAOG;AACH,MAAM,UAAU,6BAA6B,CAAC,OAAkC;IAC9E,MAAM,KAAK,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC;IACxB,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAChC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1B,OAAO,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAQD,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,wBAAwB,EAAE,EAAE,EAAE,GAAG,OAAO,UAAU,EAAE,CAAC;AAC1F,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACb,KAAsB,CAAC,MAAM,KAAK,MAAM;QACxC,KAAsB,CAAC,QAAQ,KAAK,wBAAwB,CAC9D,CAAC;AACJ,CAAC;AAUD;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAA2B,EAC3B,QAAkB;IAElB,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,cAAc,GAAa,EAAE,CAAC;IACpC,MAAM,gBAAgB,GAAa,EAAE,CAAC;IAEtC,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,CAAC,OAAO,GAAG,EAAE,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS;QAAE,MAAM,CAAC,OAAO,CAAC,SAAS,GAAG,EAAE,CAAC;IAC7D,MAAM,eAAe,GAAG;QACtB,MAAM,EAAE,MAAM;QACd,iBAAiB,EAAE;YACjB,QAAQ,EAAE,mBAAmB;YAC7B,aAAa,EAAE,wBAAwB;SACxC;KACF,CAAC;IACF,MAAM,gBAAgB,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAC;IAC5E,IAAI,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,EAAE,CAAC;QACzE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,wBAAwB,CAAC,GAAG,eAAe,CAAC;QACrE,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAE,6BAAmD,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5E,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC/B,SAAS;QACX,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC;QACvC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS;YAAE,MAAM,CAAC,MAAM,CAAC,SAAS,GAAG,EAAE,CAAC;QAC3D,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC;YAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QAE7E,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACvD,MAAM,UAAU,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC;QAErC,MAAM,mBAAmB,GAAG,OAAO,KAAK,uBAAuB,CAAC;QAChE,MAAM,WAAW,GACf,OAAO,KAAK,SAAS,IAAI,CAAC,mBAAmB,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAE1E,IAAI,WAAW,EAAE,CAAC;YAChB,oDAAoD;YACpD,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC/B,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3D,aAAa,CAAC,MAAM,GAAG,UAAU,CAAC;YAClC,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;QACD,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IAC/B,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,CAAC;AACvD,CAAC;AAWD,4DAA4D;AAC5D,MAAM,UAAU,qBAAqB,CACnC,MAA2B,EAC3B,QAAkB;IAElB,MAAM,QAAQ,GAAG,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,wBAAwB,CAAC,CAAC;IACxE,MAAM,kBAAkB,GACtB,QAAQ,EAAE,MAAM,KAAK,MAAM;QAC3B,QAAQ,EAAE,iBAAiB,EAAE,QAAQ,KAAK,mBAAmB;QAC7D,QAAQ,EAAE,iBAAiB,EAAE,aAAa,KAAK,wBAAwB,CAAC;IAE1E,MAAM,cAAc,GAAa,EAAE,CAAC;IACpC,MAAM,gBAAgB,GAAa,EAAE,CAAC;IACtC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAE,6BAAmD,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QACtF,IAAI,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC;YAC/D,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAC/B,CAAC;aAAM,CAAC;YACN,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IACD,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,gBAAgB,EAAE,CAAC;AAClE,CAAC"}
+{"version":3,"file":"secretref.js","sourceRoot":"","sources":["../../src/openclaw/secretref.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,EAAE,oBAAoB,EAAE,MAAM,kBAAkB,CAAC;AAExD,MAAM,CAAC,MAAM,mBAAmB,GAAG,gBAAgB,CAAC;AACpD,MAAM,CAAC,MAAM,wBAAwB,GAAG,SAAS,CAAC;AAClD,MAAM,CAAC,MAAM,wBAAwB,GAAG,SAAS,CAAC;AAElD,yDAAyD;AACzD,MAAM,CAAC,MAAM,6BAA6B,GAAG,CAAC,WAAW,EAAE,QAAQ,CAAU,CAAC;AAE9E;;;;;;;GAOG;AACH,MAAM,UAAU,6BAA6B,CAAC,OAAkC;IAC9E,MAAM,KAAK,GAAG,oBAAoB,CAAC,OAAO,CAAC,CAAC;IAC5C,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IACzB,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,GAAG,KAAK,CAAC;IACxB,IAAI,CAAC,KAAK,IAAI;QAAE,OAAO,CAAC,GAAG,IAAI,CAAC;IAChC,IAAI,CAAC,KAAK,CAAC;QAAE,OAAO,CAAC,GAAG,CAAC,CAAC;IAC1B,OAAO,CAAC,IAAI,CAAC,CAAC;AAChB,CAAC;AAQD,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,wBAAwB,EAAE,EAAE,EAAE,GAAG,OAAO,UAAU,EAAE,CAAC;AAC1F,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,uBAAuB,CAAC,OAAe,EAAE,MAAc;IACrE,2EAA2E;IAC3E,iEAAiE;IACjE,IAAI,IAAI,GAAG,MAAM,CAAC;IAClB,OAAO,IAAI,CAAC,MAAM,GAAG,CAAC,IAAI,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC;IACvE,IAAI,OAAO,KAAK,WAAW;QAAE,OAAO,GAAG,IAAI,YAAY,CAAC;IACxD,IAAI,OAAO,KAAK,QAAQ;QAAE,OAAO,GAAG,IAAI,YAAY,CAAC;IACrD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,gFAAgF;AAChF,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,KAAK,CAAC;IAC5C,OAAO,CACL,+EAA+E,CAAC,IAAI,CAAC,KAAK,CAAC;QAC3F,4BAA4B,CAAC,IAAI,CAAC,KAAK,CAAC,CACzC,CAAC;AACJ,CAAC;AAED,SAAS,YAAY,CAAC,KAAc;IAClC,OAAO,CACL,OAAO,KAAK,KAAK,QAAQ;QACzB,KAAK,KAAK,IAAI;QACb,KAAsB,CAAC,MAAM,KAAK,MAAM;QACxC,KAAsB,CAAC,QAAQ,KAAK,wBAAwB,CAC9D,CAAC;AACJ,CAAC;AAmBD;;;;;GAKG;AACH,MAAM,UAAU,sBAAsB,CACpC,MAA2B,EAC3B,QAAkB,EAClB,UAAkC,EAAE;IAEpC,IAAI,OAAO,GAAG,KAAK,CAAC;IACpB,MAAM,cAAc,GAAa,EAAE,CAAC;IACpC,MAAM,gBAAgB,GAAa,EAAE,CAAC;IACtC,MAAM,gBAAgB,GAAa,EAAE,CAAC;IACtC,MAAM,eAAe,GAAa,EAAE,CAAC;IAErC,IAAI,CAAC,MAAM,CAAC,OAAO;QAAE,MAAM,CAAC,OAAO,GAAG,EAAE,CAAC;IACzC,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,SAAS;QAAE,MAAM,CAAC,OAAO,CAAC,SAAS,GAAG,EAAE,CAAC;IAC7D,MAAM,eAAe,GAAG;QACtB,MAAM,EAAE,MAAM;QACd,iBAAiB,EAAE;YACjB,QAAQ,EAAE,mBAAmB;YAC7B,aAAa,EAAE,wBAAwB;SACxC;KACF,CAAC;IACF,MAAM,gBAAgB,GAAG,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,wBAAwB,CAAC,CAAC;IAC5E,IAAI,IAAI,CAAC,SAAS,CAAC,gBAAgB,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,EAAE,CAAC;QACzE,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,wBAAwB,CAAC,GAAG,eAAe,CAAC;QACrE,OAAO,GAAG,IAAI,CAAC;IACjB,CAAC;IAED,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAE,6BAAmD,CAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,CAAC;YAC5E,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC/B,SAAS;QACX,CAAC;QACD,IAAI,CAAC,MAAM,CAAC,MAAM;YAAE,MAAM,CAAC,MAAM,GAAG,EAAE,CAAC;QACvC,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS;YAAE,MAAM,CAAC,MAAM,CAAC,SAAS,GAAG,EAAE,CAAC;QAC3D,IAAI,CAAC,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC;YAAE,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,GAAG,EAAE,CAAC;QAE7E,MAAM,aAAa,GAAG,MAAM,CAAC,MAAM,CAAC,SAAS,CAAC,OAAO,CAAC,CAAC;QACvD,MAAM,UAAU,GAAG,gBAAgB,CAAC,OAAO,CAAC,CAAC;QAC7C,MAAM,OAAO,GAAG,aAAa,CAAC,MAAM,CAAC;QAErC,MAAM,mBAAmB,GAAG,OAAO,KAAK,uBAAuB,CAAC;QAChE,MAAM,WAAW,GACf,OAAO,KAAK,SAAS,IAAI,CAAC,mBAAmB,IAAI,CAAC,YAAY,CAAC,OAAO,CAAC,CAAC;QAE1E,IAAI,WAAW,EAAE,CAAC;YAChB,oDAAoD;YACpD,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC/B,SAAS;QACX,CAAC;QACD,IAAI,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,KAAK,IAAI,CAAC,SAAS,CAAC,UAAU,CAAC,EAAE,CAAC;YAC3D,aAAa,CAAC,MAAM,GAAG,UAAU,CAAC;YAClC,OAAO,GAAG,IAAI,CAAC;QACjB,CAAC;QACD,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QAE7B,wEAAwE;QACxE,0EAA0E;QAC1E,MAAM,WAAW,GAAG,OAAO,CAAC,cAAc;YACxC,CAAC,CAAC,uBAAuB,CAAC,OAAO,EAAE,OAAO,CAAC,cAAc,CAAC;YAC1D,CAAC,CAAC,IAAI,CAAC;QACT,IAAI,WAAW,EAAE,CAAC;YAChB,MAAM,WAAW,GAAG,aAAa,CAAC,OAAO,CAAC;YAC1C,IAAI,WAAW,KAAK,SAAS,IAAI,CAAC,gBAAgB,CAAC,WAAW,CAAC,EAAE,CAAC;gBAChE,eAAe,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAChC,CAAC;iBAAM,CAAC;gBACN,IAAI,WAAW,KAAK,WAAW,EAAE,CAAC;oBAChC,aAAa,CAAC,OAAO,GAAG,WAAW,CAAC;oBACpC,OAAO,GAAG,IAAI,CAAC;gBACjB,CAAC;gBACD,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACjC,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,OAAO,EAAE,cAAc,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,eAAe,EAAE,CAAC;AAC1F,CAAC;AAeD,4DAA4D;AAC5D,MAAM,UAAU,qBAAqB,CACnC,MAA2B,EAC3B,QAAkB;IAElB,MAAM,QAAQ,GAAG,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC,wBAAwB,CAAC,CAAC;IACxE,MAAM,kBAAkB,GACtB,QAAQ,EAAE,MAAM,KAAK,MAAM;QAC3B,QAAQ,EAAE,iBAAiB,EAAE,QAAQ,KAAK,mBAAmB;QAC7D,QAAQ,EAAE,iBAAiB,EAAE,aAAa,KAAK,wBAAwB,CAAC;IAE1E,MAAM,cAAc,GAAa,EAAE,CAAC;IACpC,MAAM,gBAAgB,GAAa,EAAE,CAAC;IACtC,MAAM,gBAAgB,GAAa,EAAE,CAAC;IACtC,MAAM,cAAc,GAAa,EAAE,CAAC;IACpC,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,IAAI,CAAE,6BAAmD,CAAC,QAAQ,CAAC,OAAO,CAAC;YAAE,SAAS;QACtF,IAAI,YAAY,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC,EAAE,CAAC;YAC/D,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC7B,qEAAqE;YACrE,+DAA+D;YAC/D,IAAI,gBAAgB,CAAC,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC,EAAE,CAAC;gBACpE,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YACjC,CAAC;iBAAM,CAAC;gBACN,cAAc,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;YAC/B,CAAC;QACH,CAAC;aAAM,CAAC;YACN,gBAAgB,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACjC,CAAC;IACH,CAAC;IACD,OAAO,EAAE,kBAAkB,EAAE,cAAc,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,cAAc,EAAE,CAAC;AACpG,CAAC"}

package/dist/request-policy.d.ts

@@ -53,4 +53,11 @@ export declare function validatePolicyConfig(policy: PolicyConfig): {
  * with specific denies for dangerous admin/billing/send endpoints.
  */
 export declare function getDefaultPolicyPresets(): Record<string, ServicePolicy>;
+/**
+ * Known-ineffective rule shapes: deny rules written against a path that real
+ * upstream traffic never has. Returns human-readable warnings (empty when
+ * fine). These came from our own pre-0.15.0 presets, which `aquaman setup`
+ * persisted into users' config.yaml, so they outlive the preset fix.
+ */
+export declare function lintPolicyConfig(config: PolicyConfig): string[];
 //# sourceMappingURL=request-policy.d.ts.map

package/dist/request-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"request-policy.d.ts","sourceRoot":"","sources":["../src/request-policy.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,aAAa;IAC5B,aAAa,EAAE,OAAO,GAAG,MAAM,CAAC;IAChC,KAAK,EAAE,UAAU,EAAE,CAAC;CACrB;AAED,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;AAEzD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAM1E;AAuCD;;;;;;GAMG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,YAAY,GACnB;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,UAAU,CAAA;CAAE,CAqBhD;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CAAE,GAAG,YAAY,CAe3F;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,YAAY,GAAG;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAoB/F;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAgCvE"}
+{"version":3,"file":"request-policy.d.ts","sourceRoot":"","sources":["../src/request-policy.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,MAAM,WAAW,UAAU;IACzB,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,OAAO,GAAG,MAAM,CAAC;CAC1B;AAED,MAAM,WAAW,aAAa;IAC5B,aAAa,EAAE,OAAO,GAAG,MAAM,CAAC;IAChC,KAAK,EAAE,UAAU,EAAE,CAAC;CACrB;AAED,MAAM,MAAM,YAAY,GAAG,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAAC;AAEzD;;;;;;;GAOG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,GAAG,OAAO,CAM1E;AAuCD;;;;;;GAMG;AACH,wBAAgB,WAAW,CACzB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,MAAM,EACrB,MAAM,EAAE,YAAY,GACnB;IAAE,OAAO,EAAE,OAAO,CAAC;IAAC,WAAW,CAAC,EAAE,UAAU,CAAA;CAAE,CAqBhD;AAED;;;GAGG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CAAE,GAAG,YAAY,CAe3F;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAAC,MAAM,EAAE,YAAY,GAAG;IAAE,KAAK,EAAE,OAAO,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAA;CAAE,CAoB/F;AAED;;;GAGG;AACH,wBAAgB,uBAAuB,IAAI,MAAM,CAAC,MAAM,EAAE,aAAa,CAAC,CAwCvE;AAED;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,MAAM,EAAE,YAAY,GAAG,MAAM,EAAE,CAoB/D"}

package/dist/request-policy.js

@@ -142,17 +142,46 @@ export function getDefaultPolicyPresets() {
         gmail: {
             defaultAction: 'allow',
             rules: [
-                // Gmail send: POST /gmail/v1/users/{userId}/messages/send
+                // Gmail send. Policy paths are the upstream API's full path after the
+                // service prefix, and Gmail's REST path is /gmail/v1/users/{userId}/...
+                { method: 'POST', path: '/gmail/v1/users/*/messages/send', action: 'deny' },
+                // Pre-0.15.0 form, kept so configs written with it keep matching.
                 { method: 'POST', path: '/v1/users/*/messages/send', action: 'deny' },
             ]
         },
         slack: {
             defaultAction: 'allow',
             rules: [
-                // Slack admin methods: /admin.users.list, /admin.conversations.create, etc.
+                // Slack admin methods. Real Slack Web API traffic arrives as
+                // /api/admin.users.list (the interceptor keeps the full slack.com
+                // path; the proxy doesn't prepend the upstream's base path). Through
+                // v0.14.x this preset only had '/admin.*', which never matched a
+                // working request (verified against slack.com 2026-09-18).
+                { method: '*', path: '/api/admin.*', action: 'deny' },
                 { method: '*', path: '/admin.*', action: 'deny' },
             ]
         }
     };
 }
+/**
+ * Known-ineffective rule shapes: deny rules written against a path that real
+ * upstream traffic never has. Returns human-readable warnings (empty when
+ * fine). These came from our own pre-0.15.0 presets, which `aquaman setup`
+ * persisted into users' config.yaml, so they outlive the preset fix.
+ */
+export function lintPolicyConfig(config) {
+    const warnings = [];
+    const denies = (svc) => (config[svc]?.rules ?? []).filter(r => r.action === 'deny').map(r => r.path);
+    const slack = denies('slack');
+    if (slack.includes('/admin.*') && !slack.some(p => p.startsWith('/api/'))) {
+        warnings.push("slack: deny rule '/admin.*' never matches real Slack traffic, which arrives as /api/admin.*. " +
+            "Add a rule for path '/api/admin.*' (the v0.15.0 preset has both).");
+    }
+    const gmail = denies('gmail');
+    if (gmail.includes('/v1/users/*/messages/send') && !gmail.some(p => p.startsWith('/gmail/'))) {
+        warnings.push("gmail: deny rule '/v1/users/*/messages/send' doesn't match Gmail's real path /gmail/v1/users/*/messages/send. " +
+            "Add a rule for that path (the v0.15.0 preset has both).");
+    }
+    return warnings;
+}
 //# sourceMappingURL=request-policy.js.map

package/dist/request-policy.js.map

@@ -1 +1 @@
-{"version":3,"file":"request-policy.js","sourceRoot":"","sources":["../src/request-policy.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAeH;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,OAAe;IAC/D,6CAA6C;IAC7C,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9F,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAE3F,OAAO,aAAa,CAAC,YAAY,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,aAAa,CACpB,OAAiB,EAAE,EAAU,EAC7B,IAAc,EAAE,EAAU;IAE1B,OAAO,EAAE,GAAG,OAAO,CAAC,MAAM,IAAI,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC/C,MAAM,GAAG,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC;QAExB,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,yCAAyC;YACzC,gEAAgE;YAChE,KAAK,IAAI,IAAI,GAAG,EAAE,EAAE,IAAI,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC;gBAChD,IAAI,aAAa,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC;oBAAE,OAAO,IAAI,CAAC;YAC9D,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,6DAA6D;QAC7D,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/C,EAAE,EAAE,CAAC;QACL,EAAE,EAAE,CAAC;IACP,CAAC;IAED,0DAA0D;IAC1D,OAAO,EAAE,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,EAAE,CAAC,KAAK,IAAI;QAAE,EAAE,EAAE,CAAC;IAEzD,OAAO,EAAE,KAAK,OAAO,CAAC,MAAM,IAAI,EAAE,KAAK,IAAI,CAAC,MAAM,CAAC;AACrD,CAAC;AAED,SAAS,YAAY,CAAC,OAAe,EAAE,OAAe;IACpD,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,KAAK,OAAO,CAAC;IAEvD,2CAA2C;IAC3C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAClF,OAAO,IAAI,MAAM,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CACzB,OAAe,EACf,MAAc,EACd,aAAqB,EACrB,MAAoB;IAEpB,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,aAAa,CAAC,KAAK,EAAE,CAAC;QACvC,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,WAAW,EAAE,CAAC;QAChG,IAAI,CAAC,aAAa;YAAE,SAAS;QAE7B,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,CAAC;YAC/C,OAAO;gBACL,OAAO,EAAE,IAAI,CAAC,MAAM,KAAK,OAAO;gBAChC,WAAW,EAAE,IAAI;aAClB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO,EAAE,aAAa,CAAC,aAAa,KAAK,OAAO;KACjD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAwC;IAC3E,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IAE9B,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,KAAK,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1D,MAAM,CAAC,OAAO,CAAC,GAAG;YAChB,aAAa,EAAE,EAAE,CAAC,aAAa,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;YAC7D,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC;gBACzD,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC;gBAC/B,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC;gBAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;aAChD,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;SACT,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAoB;IACvD,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,KAAK,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,IAAI,EAAE,CAAC,aAAa,KAAK,OAAO,IAAI,EAAE,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;YAChE,MAAM,CAAC,IAAI,CAAC,YAAY,OAAO,gCAAgC,EAAE,CAAC,aAAa,gCAAgC,CAAC,CAAC;QACnH,CAAC;QAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACzB,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBACtD,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,OAAO,yBAAyB,IAAI,CAAC,MAAM,gCAAgC,CAAC,CAAC;YACjH,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/B,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,OAAO,eAAe,IAAI,CAAC,IAAI,6BAA6B,CAAC,CAAC;YAClG,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;AAChD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB;IACrC,OAAO;QACL,SAAS,EAAE;YACT,aAAa,EAAE,OAAO;YACtB,KAAK,EAAE;gBACL,mGAAmG;gBACnG,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,sBAAsB,EAAE,MAAM,EAAE,MAAM,EAAE;aAC9D;SACF;QACD,MAAM,EAAE;YACN,aAAa,EAAE,OAAO;YACtB,KAAK,EAAE;gBACL,6EAA6E;gBAC7E,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,qBAAqB,EAAE,MAAM,EAAE,MAAM,EAAE;gBAC5D,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE;aACrD;SACF;QACD,KAAK,EAAE;YACL,aAAa,EAAE,OAAO;YACtB,KAAK,EAAE;gBACL,0DAA0D;gBAC1D,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2BAA2B,EAAE,MAAM,EAAE,MAAM,EAAE;aACtE;SACF;QACD,KAAK,EAAE;YACL,aAAa,EAAE,OAAO;YACtB,KAAK,EAAE;gBACL,4EAA4E;gBAC5E,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE;aAClD;SACF;KACF,CAAC;AACJ,CAAC"}
+{"version":3,"file":"request-policy.js","sourceRoot":"","sources":["../src/request-policy.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAeH;;;;;;;GAOG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe,EAAE,OAAe;IAC/D,6CAA6C;IAC7C,MAAM,YAAY,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9F,MAAM,SAAS,GAAG,OAAO,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;IAE3F,OAAO,aAAa,CAAC,YAAY,EAAE,CAAC,EAAE,SAAS,EAAE,CAAC,CAAC,CAAC;AACtD,CAAC;AAED,SAAS,aAAa,CACpB,OAAiB,EAAE,EAAU,EAC7B,IAAc,EAAE,EAAU;IAE1B,OAAO,EAAE,GAAG,OAAO,CAAC,MAAM,IAAI,EAAE,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC;QAC/C,MAAM,GAAG,GAAG,OAAO,CAAC,EAAE,CAAC,CAAC;QAExB,IAAI,GAAG,KAAK,IAAI,EAAE,CAAC;YACjB,yCAAyC;YACzC,gEAAgE;YAChE,KAAK,IAAI,IAAI,GAAG,EAAE,EAAE,IAAI,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,EAAE,EAAE,CAAC;gBAChD,IAAI,aAAa,CAAC,OAAO,EAAE,EAAE,GAAG,CAAC,EAAE,IAAI,EAAE,IAAI,CAAC;oBAAE,OAAO,IAAI,CAAC;YAC9D,CAAC;YACD,OAAO,KAAK,CAAC;QACf,CAAC;QAED,6DAA6D;QAC7D,IAAI,CAAC,YAAY,CAAC,GAAG,EAAE,IAAI,CAAC,EAAE,CAAC,CAAC;YAAE,OAAO,KAAK,CAAC;QAC/C,EAAE,EAAE,CAAC;QACL,EAAE,EAAE,CAAC;IACP,CAAC;IAED,0DAA0D;IAC1D,OAAO,EAAE,GAAG,OAAO,CAAC,MAAM,IAAI,OAAO,CAAC,EAAE,CAAC,KAAK,IAAI;QAAE,EAAE,EAAE,CAAC;IAEzD,OAAO,EAAE,KAAK,OAAO,CAAC,MAAM,IAAI,EAAE,KAAK,IAAI,CAAC,MAAM,CAAC;AACrD,CAAC;AAED,SAAS,YAAY,CAAC,OAAe,EAAE,OAAe;IACpD,IAAI,OAAO,KAAK,GAAG;QAAE,OAAO,IAAI,CAAC;IACjC,IAAI,CAAC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAC;QAAE,OAAO,OAAO,KAAK,OAAO,CAAC;IAEvD,2CAA2C;IAC3C,MAAM,OAAO,GAAG,OAAO,CAAC,OAAO,CAAC,mBAAmB,EAAE,MAAM,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,IAAI,CAAC,CAAC;IAClF,OAAO,IAAI,MAAM,CAAC,IAAI,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;AAClD,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,WAAW,CACzB,OAAe,EACf,MAAc,EACd,aAAqB,EACrB,MAAoB;IAEpB,MAAM,aAAa,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IACtC,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;IAC3B,CAAC;IAED,KAAK,MAAM,IAAI,IAAI,aAAa,CAAC,KAAK,EAAE,CAAC;QACvC,MAAM,aAAa,GAAG,IAAI,CAAC,MAAM,KAAK,GAAG,IAAI,IAAI,CAAC,MAAM,CAAC,WAAW,EAAE,KAAK,MAAM,CAAC,WAAW,EAAE,CAAC;QAChG,IAAI,CAAC,aAAa;YAAE,SAAS;QAE7B,IAAI,gBAAgB,CAAC,IAAI,CAAC,IAAI,EAAE,aAAa,CAAC,EAAE,CAAC;YAC/C,OAAO;gBACL,OAAO,EAAE,IAAI,CAAC,MAAM,KAAK,OAAO;gBAChC,WAAW,EAAE,IAAI;aAClB,CAAC;QACJ,CAAC;IACH,CAAC;IAED,OAAO;QACL,OAAO,EAAE,aAAa,CAAC,aAAa,KAAK,OAAO;KACjD,CAAC;AACJ,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAwC;IAC3E,IAAI,CAAC,MAAM,CAAC,MAAM;QAAE,OAAO,EAAE,CAAC;IAE9B,MAAM,MAAM,GAAiB,EAAE,CAAC;IAChC,KAAK,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,MAAM,CAAC,EAAE,CAAC;QAC1D,MAAM,CAAC,OAAO,CAAC,GAAG;YAChB,aAAa,EAAE,EAAE,CAAC,aAAa,KAAK,MAAM,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,OAAO;YAC7D,KAAK,EAAE,KAAK,CAAC,OAAO,CAAC,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAM,EAAE,EAAE,CAAC,CAAC;gBACzD,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC,MAAM,IAAI,GAAG,CAAC;gBAC/B,IAAI,EAAE,MAAM,CAAC,CAAC,CAAC,IAAI,IAAI,GAAG,CAAC;gBAC3B,MAAM,EAAE,CAAC,CAAC,MAAM,KAAK,OAAO,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM;aAChD,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE;SACT,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,oBAAoB,CAAC,MAAoB;IACvD,MAAM,MAAM,GAAa,EAAE,CAAC;IAE5B,KAAK,MAAM,CAAC,OAAO,EAAE,EAAE,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC;QACnD,IAAI,EAAE,CAAC,aAAa,KAAK,OAAO,IAAI,EAAE,CAAC,aAAa,KAAK,MAAM,EAAE,CAAC;YAChE,MAAM,CAAC,IAAI,CAAC,YAAY,OAAO,gCAAgC,EAAE,CAAC,aAAa,gCAAgC,CAAC,CAAC;QACnH,CAAC;QAED,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACzC,MAAM,IAAI,GAAG,EAAE,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;YACzB,IAAI,IAAI,CAAC,MAAM,KAAK,OAAO,IAAI,IAAI,CAAC,MAAM,KAAK,MAAM,EAAE,CAAC;gBACtD,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,OAAO,yBAAyB,IAAI,CAAC,MAAM,gCAAgC,CAAC,CAAC;YACjH,CAAC;YACD,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC;gBAC/B,MAAM,CAAC,IAAI,CAAC,QAAQ,CAAC,GAAG,CAAC,SAAS,OAAO,eAAe,IAAI,CAAC,IAAI,6BAA6B,CAAC,CAAC;YAClG,CAAC;QACH,CAAC;IACH,CAAC;IAED,OAAO,EAAE,KAAK,EAAE,MAAM,CAAC,MAAM,KAAK,CAAC,EAAE,MAAM,EAAE,CAAC;AAChD,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,uBAAuB;IACrC,OAAO;QACL,SAAS,EAAE;YACT,aAAa,EAAE,OAAO;YACtB,KAAK,EAAE;gBACL,mGAAmG;gBACnG,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,sBAAsB,EAAE,MAAM,EAAE,MAAM,EAAE;aAC9D;SACF;QACD,MAAM,EAAE;YACN,aAAa,EAAE,OAAO;YACtB,KAAK,EAAE;gBACL,6EAA6E;gBAC7E,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,qBAAqB,EAAE,MAAM,EAAE,MAAM,EAAE;gBAC5D,EAAE,MAAM,EAAE,QAAQ,EAAE,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,MAAM,EAAE;aACrD;SACF;QACD,KAAK,EAAE;YACL,aAAa,EAAE,OAAO;YACtB,KAAK,EAAE;gBACL,sEAAsE;gBACtE,wEAAwE;gBACxE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,iCAAiC,EAAE,MAAM,EAAE,MAAM,EAAE;gBAC3E,kEAAkE;gBAClE,EAAE,MAAM,EAAE,MAAM,EAAE,IAAI,EAAE,2BAA2B,EAAE,MAAM,EAAE,MAAM,EAAE;aACtE;SACF;QACD,KAAK,EAAE;YACL,aAAa,EAAE,OAAO;YACtB,KAAK,EAAE;gBACL,6DAA6D;gBAC7D,kEAAkE;gBAClE,qEAAqE;gBACrE,iEAAiE;gBACjE,2DAA2D;gBAC3D,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,cAAc,EAAE,MAAM,EAAE,MAAM,EAAE;gBACrD,EAAE,MAAM,EAAE,GAAG,EAAE,IAAI,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE;aAClD;SACF;KACF,CAAC;AACJ,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,gBAAgB,CAAC,MAAoB;IACnD,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,MAAM,GAAG,CAAC,GAAW,EAAE,EAAE,CAC7B,CAAC,MAAM,CAAC,GAAG,CAAC,EAAE,KAAK,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,CAAC;IAE/E,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9B,IAAI,KAAK,CAAC,QAAQ,CAAC,UAAU,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAC1E,QAAQ,CAAC,IAAI,CACX,+FAA+F;YAC/F,mEAAmE,CACpE,CAAC;IACJ,CAAC;IACD,MAAM,KAAK,GAAG,MAAM,CAAC,OAAO,CAAC,CAAC;IAC9B,IAAI,KAAK,CAAC,QAAQ,CAAC,2BAA2B,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC,EAAE,CAAC;QAC7F,QAAQ,CAAC,IAAI,CACX,gHAAgH;YAChH,yDAAyD,CAC1D,CAAC;IACJ,CAAC;IACD,OAAO,QAAQ,CAAC;AAClB,CAAC"}

package/dist/service-registry.d.ts

@@ -32,6 +32,14 @@ export interface ServiceDefinition {
     hostPatterns?: string[];
     /** OAuth client credentials config for authMode 'oauth' */
     oauthConfig?: OAuthConfig;
+    /**
+     * Floor for the upstream idle timeout, in ms. A long-polling API holds the
+     * connection open with no bytes flowing, which the proxy's default 30s idle
+     * timeout would kill mid-poll. The effective timeout is the larger of this
+     * and the configured one, so raising the global still works and lowering it
+     * cannot silently break the service.
+     */
+    minRequestTimeout?: number;
 }
 export interface ServiceRegistryOptions {
     configPath?: string;

package/dist/service-registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service-registry.d.ts","sourceRoot":"","sources":["../src/service-registry.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAOH,MAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG,UAAU,GAAG,OAAO,GAAG,OAAO,GAAG,MAAM,CAAC;AAE1E,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qEAAqE;IACrE,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,+EAA+E;IAC/E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iGAAiG;IACjG,wBAAwB,CAAC,EAAE,MAAM,EAAE,CAAC;IACpC,gFAAgF;IAChF,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/E,yFAAyF;IACzF,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,2DAA2D;IAC3D,WAAW,CAAC,EAAE,WAAW,CAAC;CAC3B;AAED,MAAM,WAAW,sBAAsB;IACrC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAkSD,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAA6C;IAC7D,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,cAAc,CAAU;gBAEpB,OAAO,CAAC,EAAE,sBAAsB;IAM5C,OAAO,CAAC,IAAI;IAYZ,OAAO,CAAC,gBAAgB;IA4BxB,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS;IAIhD,MAAM,IAAI,iBAAiB,EAAE;IAI7B,QAAQ,IAAI,MAAM,EAAE;IAIpB,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI1B;;;OAGG;IACH,WAAW,IAAI,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;IAcnH,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,iBAAiB,CAAC,GAAG;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;IAqDxF;;OAEG;IACH,MAAM,CAAC,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE;IA2CnF;;;OAGG;IACH,YAAY,IAAI,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC;IAYnC;;OAEG;IACH,MAAM,CAAC,sBAAsB,IAAI,MAAM,EAAE;IAIzC;;OAEG;IACH,MAAM,CAAC,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI9C;;OAEG;IACH,MAAM,IAAI,IAAI;IAKd;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,iBAAiB,CAAC,GAAG,IAAI;IAQjE;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,iBAAiB,GAAG,IAAI;CAU3C;AAED,wBAAgB,qBAAqB,CAAC,OAAO,CAAC,EAAE,sBAAsB,GAAG,eAAe,CAEvF"}
+{"version":3,"file":"service-registry.d.ts","sourceRoot":"","sources":["../src/service-registry.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAOH,MAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG,UAAU,GAAG,OAAO,GAAG,OAAO,GAAG,MAAM,CAAC;AAE1E,MAAM,WAAW,WAAW;IAC1B,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,EAAE,MAAM,CAAC;IACpB,eAAe,EAAE,MAAM,CAAC;IACxB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,iBAAiB;IAChC,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,aAAa,EAAE,MAAM,CAAC;IACtB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,qEAAqE;IACrE,QAAQ,CAAC,EAAE,QAAQ,CAAC;IACpB,+EAA+E;IAC/E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,iGAAiG;IACjG,wBAAwB,CAAC,EAAE,MAAM,EAAE,CAAC;IACpC,gFAAgF;IAChF,iBAAiB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE;QAAE,aAAa,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IAC/E,yFAAyF;IACzF,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,2DAA2D;IAC3D,WAAW,CAAC,EAAE,WAAW,CAAC;IAC1B;;;;;;OAMG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,MAAM,WAAW,sBAAsB;IACrC,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,eAAe,CAAC,EAAE,OAAO,CAAC;CAC3B;AAySD,qBAAa,eAAe;IAC1B,OAAO,CAAC,QAAQ,CAA6C;IAC7D,OAAO,CAAC,UAAU,CAAS;IAC3B,OAAO,CAAC,cAAc,CAAU;gBAEpB,OAAO,CAAC,EAAE,sBAAsB;IAM5C,OAAO,CAAC,IAAI;IAYZ,OAAO,CAAC,gBAAgB;IA4BxB,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,iBAAiB,GAAG,SAAS;IAIhD,MAAM,IAAI,iBAAiB,EAAE;IAI7B,QAAQ,IAAI,MAAM,EAAE;IAIpB,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI1B;;;OAGG;IACH,WAAW,IAAI,MAAM,CAAC,MAAM,EAAE;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,MAAM,CAAC;QAAC,aAAa,EAAE,MAAM,CAAA;KAAE,CAAC;IAcnH,eAAe,CAAC,OAAO,EAAE,OAAO,CAAC,iBAAiB,CAAC,GAAG;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,KAAK,CAAC,EAAE,MAAM,CAAA;KAAE;IAqDxF;;OAEG;IACH,MAAM,CAAC,kBAAkB,CAAC,UAAU,EAAE,MAAM,GAAG;QAAE,KAAK,EAAE,OAAO,CAAC;QAAC,MAAM,EAAE,MAAM,EAAE,CAAA;KAAE;IA2CnF;;;OAGG;IACH,YAAY,IAAI,GAAG,CAAC,MAAM,EAAE,MAAM,CAAC;IAYnC;;OAEG;IACH,MAAM,CAAC,sBAAsB,IAAI,MAAM,EAAE;IAIzC;;OAEG;IACH,MAAM,CAAC,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO;IAI9C;;OAEG;IACH,MAAM,IAAI,IAAI;IAKd;;OAEG;IACH,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,CAAC,iBAAiB,CAAC,GAAG,IAAI;IAQjE;;OAEG;IACH,QAAQ,CAAC,OAAO,EAAE,iBAAiB,GAAG,IAAI;CAU3C;AAED,wBAAgB,qBAAqB,CAAC,OAAO,CAAC,EAAE,sBAAsB,GAAG,eAAe,CAEvF"}