clawdlets 0.3.4 → 0.4.0

package/{node_modules → vendor}/@clawdlets/core/dist/assets/opentofu/main.tf

@@ -19,10 +19,6 @@ removed {
   }
 }
 
-variable "hcloud_token" {
-  type = string
-}
-
 variable "host_name" {
   type = string
 }
@@ -74,9 +70,7 @@ variable "location" {
   default = "nbg1"
 }
 
-provider "hcloud" {
-  token = var.hcloud_token
-}
+provider "hcloud" {}
 
 module "clawdbot_fleet_host" {
   source        = "./modules/bot_host"

package/{node_modules → vendor}/@clawdlets/core/dist/doctor/deploy-checks.js

@@ -4,7 +4,7 @@ import YAML from "yaml";
 import { getHostEncryptedAgeKeyFile, getHostExtraFilesDir, getHostExtraFilesKeyPath, getHostRemoteSecretsDir, getHostSecretsDir, } from "../repo-layout.js";
 import { getHostAgeKeySopsCreationRulePathRegex, getHostAgeKeySopsCreationRulePathSuffix, getHostSecretsSopsCreationRulePathRegex, getHostSecretsSopsCreationRulePathSuffix } from "../lib/sops-rules.js";
 import { validateHostSecretsYamlFiles } from "../lib/secrets-policy.js";
-import { buildFleetSecretsPlan } from "../lib/fleet-secrets.js";
+import { buildFleetSecretsPlan } from "../lib/fleet-secrets-plan.js";
 import { capture } from "../lib/run.js";
 import { looksLikeSshKeyContents, normalizeSshPublicKey } from "../lib/ssh.js";
 import { getSshExposureMode, isPublicSshExposure, loadClawdletsConfig, } from "../lib/clawdlets-config.js";
@@ -17,6 +17,7 @@ import { agePublicKeyFromIdentityFile } from "../lib/age-keygen.js";
 import { sopsDecryptYamlFile } from "../lib/sops.js";
 import { getSopsCreationRuleAgeRecipients } from "../lib/sops-config.js";
 import { readYamlScalarFromMapping } from "../lib/yaml-scalar.js";
+import { mapWithConcurrency } from "../lib/concurrency.js";
 export async function addDeployChecks(params) {
     const host = params.host.trim() || "clawdbot-fleet-host";
     const scope = params.scope;
@@ -220,20 +221,6 @@ export async function addDeployChecks(params) {
             label: "remote secrets dir",
             detail: getHostRemoteSecretsDir(host),
         });
-        {
-            const garnixPrivate = clawdletsHostCfg.cache?.garnix?.private || null;
-            const enabled = Boolean(garnixPrivate?.enable);
-            if (enabled) {
-                const secretName = String(garnixPrivate?.netrcSecret || "garnix_netrc").trim();
-                if (!secretName) {
-                    push({ status: "missing", label: "garnix netrc secret", detail: "(unset; expected cache.garnix.private.netrcSecret)" });
-                }
-                else {
-                    const f = path.join(secretsLocalDir, `${secretName}.yaml`);
-                    push({ status: fs.existsSync(f) ? "ok" : "missing", label: `secret: ${secretName}`, detail: fs.existsSync(f) ? undefined : f });
-                }
-            }
-        }
         let secretsPlan = null;
         try {
             if (clawdletsCfg)
@@ -245,9 +232,9 @@ export async function addDeployChecks(params) {
         }
         if (secretsPlan && secretsPlan.missingSecretConfig.length > 0) {
             for (const m of secretsPlan.missingSecretConfig.slice(0, 10)) {
-                const detail = m.kind === "discord"
-                    ? `missing for bot=${m.bot} (set fleet.bots.${m.bot}.profile.discordTokenSecret)`
-                    : `missing for bot=${m.bot} (provider=${m.provider}, model=${m.model}); set fleet.modelSecrets.${m.provider}`;
+                const detail = m.kind === "envVar"
+                    ? `missing mapping bot=${m.bot} envVar=${m.envVar} (set fleet.secretEnv.${m.envVar} or fleet.bots.${m.bot}.profile.secretEnv.${m.envVar})`
+                    : `invalid secret file scope=${m.scope}${m.bot ? ` bot=${m.bot}` : ""} id=${m.fileId} targetPath=${m.targetPath} (${m.message})`;
                 push({
                     status: "missing",
                     label: "fleet secrets",
@@ -263,13 +250,12 @@ export async function addDeployChecks(params) {
             }
         }
         const botsForSecrets = secretsPlan?.bots?.length ? secretsPlan.bots : params.fleetBots || [];
-        const envSecretsForHost = secretsPlan?.secretNamesAll || [];
+        const hostSecretNamesRequired = secretsPlan?.hostSecretNamesRequired || ["admin_password_hash"];
+        const secretNamesAll = secretsPlan?.secretNamesAll || [];
         if (botsForSecrets.length > 0) {
-            const tailnetMode = String(clawdletsHostCfg?.tailnet?.mode || "none");
             const required = Array.from(new Set([
-                ...(tailnetMode === "tailscale" ? ["tailscale_auth_key"] : []),
-                "admin_password_hash",
-                ...envSecretsForHost,
+                ...hostSecretNamesRequired,
+                ...secretNamesAll,
             ]));
             for (const secretName of required) {
                 const f = path.join(secretsLocalDir, `${secretName}.yaml`);
@@ -283,37 +269,47 @@ export async function addDeployChecks(params) {
         else {
             push({ status: "warn", label: "required secrets", detail: "(fleet bots list missing; cannot validate per-bot secrets)" });
         }
-        if (secretsPlan && secretsPlan.secretNamesRequired.length > 0 && params.sopsAgeKeyFile && fs.existsSync(params.sopsAgeKeyFile)) {
+        const requiredForValues = Array.from(new Set([
+            ...(secretsPlan?.hostSecretNamesRequired || []),
+            ...(secretsPlan?.secretNamesRequired || []),
+        ]));
+        if (requiredForValues.length > 0 && params.sopsAgeKeyFile && fs.existsSync(params.sopsAgeKeyFile)) {
             const nix = { nixBin: params.nixBin, cwd: params.repoRoot, dryRun: false, env: process.env };
-            for (const secretName of secretsPlan.secretNamesRequired) {
-                const filePath = path.join(secretsLocalDir, `${secretName}.yaml`);
-                if (!fs.existsSync(filePath))
-                    continue;
-                try {
-                    const decrypted = await sopsDecryptYamlFile({
-                        filePath,
-                        configPath: params.layout.sopsConfigPath,
-                        ageKeyFile: params.sopsAgeKeyFile,
-                        nix,
-                    });
-                    const v = readYamlScalarFromMapping({ yamlText: decrypted, key: secretName }) || "";
-                    const value = v.trim();
-                    if (!value) {
-                        push({ status: "missing", label: `secret value: ${secretName}`, detail: "(empty)" });
-                        continue;
+            const checks = await mapWithConcurrency({
+                items: requiredForValues,
+                concurrency: 4,
+                fn: async (secretName) => {
+                    const filePath = path.join(secretsLocalDir, `${secretName}.yaml`);
+                    if (!fs.existsSync(filePath))
+                        return null;
+                    try {
+                        const decrypted = await sopsDecryptYamlFile({
+                            filePath,
+                            configPath: params.layout.sopsConfigPath,
+                            ageKeyFile: params.sopsAgeKeyFile,
+                            nix,
+                        });
+                        const v = readYamlScalarFromMapping({ yamlText: decrypted, key: secretName }) || "";
+                        const value = v.trim();
+                        if (!value)
+                            return { status: "missing", label: `secret value: ${secretName}`, detail: "(empty)" };
+                        if (value === "<OPTIONAL>" || isPlaceholderSecretValue(value)) {
+                            return { status: "missing", label: `secret value: ${secretName}`, detail: `(placeholder: ${value})` };
+                        }
+                        return { status: "ok", label: `secret value: ${secretName}` };
                     }
-                    if (value === "<OPTIONAL>" || isPlaceholderSecretValue(value)) {
-                        push({ status: "missing", label: `secret value: ${secretName}`, detail: `(placeholder: ${value})` });
-                        continue;
+                    catch (e) {
+                        return { status: "warn", label: `secret value: ${secretName}`, detail: String(e?.message || e) };
                     }
-                    push({ status: "ok", label: `secret value: ${secretName}` });
-                }
-                catch (e) {
-                    push({ status: "warn", label: `secret value: ${secretName}`, detail: String(e?.message || e) });
-                }
+                },
+            });
+            for (const c of checks) {
+                if (!c)
+                    continue;
+                push(c);
             }
         }
-        else if (secretsPlan && secretsPlan.secretNamesRequired.length > 0) {
+        else if (requiredForValues.length > 0) {
             push({
                 status: "warn",
                 label: "required secrets",

package/{node_modules → vendor}/@clawdlets/core/dist/doctor/repo-checks.js

@@ -147,6 +147,19 @@ async function evalWheelAccess(params) {
         return null;
     }
 }
+function getClawdletsRevFromFlakeLock(repoRoot) {
+    const flakeLockPath = path.join(repoRoot, "flake.lock");
+    if (!fs.existsSync(flakeLockPath))
+        return null;
+    try {
+        const lock = JSON.parse(fs.readFileSync(flakeLockPath, "utf8"));
+        const rev = lock?.nodes?.clawdlets?.locked?.rev;
+        return typeof rev === "string" && rev.trim() ? rev.trim() : null;
+    }
+    catch {
+        return null;
+    }
+}
 export async function addRepoChecks(params) {
     const { repoRoot, layout } = params;
     let fleet = null;
@@ -157,6 +170,31 @@ export async function addRepoChecks(params) {
         label: "repo root",
         detail: repoRoot,
     });
+    // Check clawdlets input in flake.lock (informational)
+    {
+        const flakeRev = getClawdletsRevFromFlakeLock(repoRoot);
+        if (flakeRev) {
+            params.push({
+                scope: "repo",
+                status: "ok",
+                label: "clawdlets flake input",
+                detail: `rev: ${flakeRev.slice(0, 12)}...`,
+            });
+        }
+        else {
+            const flakeLockExists = fs.existsSync(path.join(repoRoot, "flake.lock"));
+            if (flakeLockExists) {
+                // flake.lock exists but no clawdlets input - might be a different project type
+                params.push({
+                    scope: "repo",
+                    status: "warn",
+                    label: "clawdlets flake input",
+                    detail: "(no clawdlets input found in flake.lock)",
+                });
+            }
+            // If flake.lock doesn't exist, skip this check silently (test environments, etc.)
+        }
+    }
     params.push({
         scope: "repo",
         status: fs.existsSync(layout.opentofuDir) ? "ok" : "warn",

package/vendor/@clawdlets/core/dist/lib/clawdbot-config-invariants.d.ts

@@ -0,0 +1,19 @@
+import type { ClawdletsConfig } from "./clawdlets-config.js";
+export type ClawdbotInvariantWarning = {
+    bot: string;
+    path: string;
+    message: string;
+    expected?: unknown;
+    actual?: unknown;
+};
+export declare function buildClawdbotBotConfig(params: {
+    config: ClawdletsConfig;
+    bot: string;
+}): {
+    bot: string;
+    base: Record<string, unknown>;
+    merged: Record<string, unknown>;
+    invariants: Record<string, unknown>;
+    warnings: ClawdbotInvariantWarning[];
+};
+//# sourceMappingURL=clawdbot-config-invariants.d.ts.map

package/vendor/@clawdlets/core/dist/lib/clawdbot-config-invariants.js

@@ -0,0 +1,130 @@
+import { getAtPath } from "./object-path.js";
+const DEFAULT_GATEWAY_PORT_BASE = 18789;
+const DEFAULT_GATEWAY_PORT_STRIDE = 20;
+const DEFAULT_STATE_DIR_BASE = "/srv/clawdbot";
+const DEFAULT_COMMANDS = { native: "auto", nativeSkills: "auto" };
+function isPlainObject(value) {
+    return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function toCleanString(value) {
+    if (typeof value !== "string")
+        return undefined;
+    const trimmed = value.trim();
+    return trimmed ? trimmed : undefined;
+}
+function toCleanNumber(value) {
+    if (typeof value === "number" && Number.isFinite(value))
+        return value;
+    if (typeof value === "string") {
+        const parsed = Number(value);
+        if (Number.isFinite(parsed))
+            return parsed;
+    }
+    return undefined;
+}
+function toCleanBoolean(value) {
+    if (typeof value === "boolean")
+        return value;
+    return undefined;
+}
+function deepMerge(base, override) {
+    const out = structuredClone(base);
+    for (const [key, value] of Object.entries(override)) {
+        if (isPlainObject(value) && isPlainObject(out[key])) {
+            out[key] = deepMerge(out[key], value);
+            continue;
+        }
+        out[key] = structuredClone(value);
+    }
+    return out;
+}
+function resolveBotIndex(config, bot) {
+    const bots = Array.isArray(config.fleet.botOrder) ? config.fleet.botOrder : [];
+    const index = bots.indexOf(bot);
+    if (index === -1)
+        throw new Error(`bot not found in fleet.botOrder: ${bot}`);
+    return index;
+}
+function resolveGatewayPort(params) {
+    const override = toCleanNumber(params.profile["gatewayPort"]);
+    if (override != null)
+        return Math.floor(override);
+    const index = resolveBotIndex(params.config, params.bot);
+    return DEFAULT_GATEWAY_PORT_BASE + index * DEFAULT_GATEWAY_PORT_STRIDE;
+}
+function resolveWorkspaceDir(params) {
+    const workspace = isPlainObject(params.profile["workspace"]) ? params.profile["workspace"] : {};
+    const dir = toCleanString(workspace["dir"]);
+    if (dir)
+        return dir;
+    return `${DEFAULT_STATE_DIR_BASE}/${params.bot}/workspace`;
+}
+function resolveSkipBootstrap(params) {
+    const override = toCleanBoolean(params.profile["skipBootstrap"]);
+    if (override != null)
+        return override;
+    const workspace = isPlainObject(params.profile["workspace"]) ? params.profile["workspace"] : {};
+    const seedDir = workspace["seedDir"];
+    return seedDir != null && String(seedDir).trim() !== "";
+}
+function warnOverrides(params) {
+    const existing = getAtPath(params.base, params.path);
+    if (existing === undefined)
+        return null;
+    const pathLabel = params.path.join(".");
+    const message = `clawdbot.${pathLabel} is managed by clawdlets invariants and will be overwritten`;
+    return {
+        bot: params.bot,
+        path: pathLabel,
+        message,
+        expected: params.expected,
+        actual: existing,
+    };
+}
+export function buildClawdbotBotConfig(params) {
+    const botCfg = params.config.fleet.bots?.[params.bot];
+    const botCfgObj = isPlainObject(botCfg) ? botCfg : {};
+    const profile = isPlainObject(botCfgObj["profile"]) ? botCfgObj["profile"] : {};
+    const base = isPlainObject(botCfgObj["clawdbot"]) ? botCfgObj["clawdbot"] : {};
+    const baseWithDefaults = deepMerge({ commands: DEFAULT_COMMANDS }, base);
+    const gatewayPort = resolveGatewayPort({ config: params.config, bot: params.bot, profile });
+    const workspaceDir = resolveWorkspaceDir({ bot: params.bot, profile });
+    const skipBootstrap = resolveSkipBootstrap({ profile });
+    const invariants = {
+        gateway: {
+            mode: "local",
+            bind: "loopback",
+            port: gatewayPort,
+            auth: {
+                mode: "token",
+                token: "${CLAWDBOT_GATEWAY_TOKEN}",
+            },
+        },
+        agents: {
+            defaults: {
+                workspace: workspaceDir,
+                skipBootstrap,
+            },
+        },
+    };
+    const warnings = [];
+    const warn = (path, expected) => {
+        const w = warnOverrides({ bot: params.bot, base, path, expected });
+        if (w)
+            warnings.push(w);
+    };
+    warn(["gateway", "mode"], "local");
+    warn(["gateway", "bind"], "loopback");
+    warn(["gateway", "port"], gatewayPort);
+    warn(["gateway", "auth"], { mode: "token", token: "${CLAWDBOT_GATEWAY_TOKEN}" });
+    warn(["agents", "defaults", "workspace"], workspaceDir);
+    warn(["agents", "defaults", "skipBootstrap"], skipBootstrap);
+    return {
+        bot: params.bot,
+        base,
+        merged: deepMerge(baseWithDefaults, invariants),
+        invariants,
+        warnings,
+    };
+}
+//# sourceMappingURL=clawdbot-config-invariants.js.map

package/vendor/@clawdlets/core/dist/lib/clawdbot-schema-validate.d.ts

@@ -0,0 +1,6 @@
+export type ClawdbotSchemaValidation = {
+    ok: boolean;
+    errors: string[];
+};
+export declare function validateClawdbotConfig(value: unknown): ClawdbotSchemaValidation;
+//# sourceMappingURL=clawdbot-schema-validate.d.ts.map

package/vendor/@clawdlets/core/dist/lib/clawdbot-schema-validate.js

@@ -0,0 +1,35 @@
+import { createRequire } from "node:module";
+import { getPinnedClawdbotSchema } from "./clawdbot-schema.js";
+const require = createRequire(import.meta.url);
+const Ajv = require("ajv");
+let cachedValidator = null;
+function formatAjvError(err) {
+    const pathBase = err.instancePath ? err.instancePath.replace(/^\//, "").replaceAll("/", ".") : "(root)";
+    if (err.keyword === "required" && typeof err.params?.missingProperty === "string") {
+        const missing = err.params.missingProperty;
+        return `${pathBase === "(root)" ? missing : `${pathBase}.${missing}`}: ${err.message ?? "required"}`;
+    }
+    return `${pathBase}: ${err.message ?? "invalid"}`;
+}
+function getValidator() {
+    if (cachedValidator)
+        return cachedValidator;
+    const ajv = new Ajv({
+        allErrors: true,
+        strict: false,
+        allowUnionTypes: true,
+        validateFormats: false,
+    });
+    const schema = getPinnedClawdbotSchema().schema;
+    cachedValidator = ajv.compile(schema);
+    return cachedValidator;
+}
+export function validateClawdbotConfig(value) {
+    const validate = getValidator();
+    const ok = Boolean(validate(value));
+    if (ok)
+        return { ok: true, errors: [] };
+    const errors = (validate.errors || []).map(formatAjvError);
+    return { ok: false, errors };
+}
+//# sourceMappingURL=clawdbot-schema-validate.js.map

package/vendor/@clawdlets/core/dist/lib/clawdbot-schema.d.ts

@@ -0,0 +1,9 @@
+export type ClawdbotSchemaArtifact = {
+    schema: Record<string, any>;
+    uiHints: Record<string, any>;
+    version: string;
+    generatedAt: string;
+    clawdbotRev: string;
+};
+export declare function getPinnedClawdbotSchema(): ClawdbotSchemaArtifact;
+//# sourceMappingURL=clawdbot-schema.d.ts.map

package/vendor/@clawdlets/core/dist/lib/clawdbot-schema.js

@@ -0,0 +1,5 @@
+import schemaArtifact from "../assets/clawdbot-config.schema.json" with { type: "json" };
+export function getPinnedClawdbotSchema() {
+    return schemaArtifact;
+}
+//# sourceMappingURL=clawdbot-schema.js.map

package/vendor/@clawdlets/core/dist/lib/clawdlets-config-legacy.d.ts

@@ -0,0 +1,3 @@
+export declare function assertNoLegacyHostKeys(parsed: unknown): void;
+export declare function assertNoLegacyEnvSecrets(parsed: unknown): void;
+//# sourceMappingURL=clawdlets-config-legacy.d.ts.map

package/vendor/@clawdlets/core/dist/lib/clawdlets-config-legacy.js

@@ -0,0 +1,64 @@
+export function assertNoLegacyHostKeys(parsed) {
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+        return;
+    const hostsRaw = parsed.hosts;
+    if (!hostsRaw || typeof hostsRaw !== "object" || Array.isArray(hostsRaw))
+        return;
+    for (const [host, hostCfg] of Object.entries(hostsRaw)) {
+        if (!hostCfg || typeof hostCfg !== "object" || Array.isArray(hostCfg))
+            continue;
+        if ("publicSsh" in hostCfg) {
+            throw new Error(`legacy host config key publicSsh found for ${host}; use sshExposure.mode`);
+        }
+        if ("opentofu" in hostCfg) {
+            throw new Error(`legacy host config key opentofu found for ${host}; use provisioning`);
+        }
+    }
+}
+export function assertNoLegacyEnvSecrets(parsed) {
+    if (!parsed || typeof parsed !== "object" || Array.isArray(parsed))
+        return;
+    const fleet = parsed.fleet;
+    if (fleet && typeof fleet === "object" && !Array.isArray(fleet)) {
+        if ("envSecrets" in fleet) {
+            throw new Error("fleet.envSecrets was removed; use fleet.secretEnv (ENV_VAR -> sops secret name)");
+        }
+        if ("modelSecrets" in fleet) {
+            throw new Error("fleet.modelSecrets was removed; use fleet.secretEnv (e.g. OPENAI_API_KEY -> openai_api_key)");
+        }
+        if ("guildId" in fleet) {
+            throw new Error("fleet.guildId was removed; configure Discord in clawdbot config (fleet.bots.<bot>.clawdbot)");
+        }
+        const bots = fleet.bots;
+        if (bots && typeof bots === "object" && !Array.isArray(bots)) {
+            for (const [bot, botCfg] of Object.entries(bots)) {
+                if (!botCfg || typeof botCfg !== "object" || Array.isArray(botCfg))
+                    continue;
+                const profile = botCfg.profile;
+                if (profile && typeof profile === "object" && !Array.isArray(profile)) {
+                    if ("envSecrets" in profile) {
+                        throw new Error(`fleet.bots.${bot}.profile.envSecrets was removed; use profile.secretEnv (ENV_VAR -> sops secret name)`);
+                    }
+                    if ("discordTokenSecret" in profile) {
+                        throw new Error(`fleet.bots.${bot}.profile.discordTokenSecret was removed; use profile.secretEnv.DISCORD_BOT_TOKEN`);
+                    }
+                    if ("modelSecrets" in profile) {
+                        throw new Error(`fleet.bots.${bot}.profile.modelSecrets was removed; use profile.secretEnv (OPENAI_API_KEY/ANTHROPIC_API_KEY/etc)`);
+                    }
+                    const skills = profile.skills;
+                    const entries = skills?.entries;
+                    if (entries && typeof entries === "object" && !Array.isArray(entries)) {
+                        for (const [skill, entry] of Object.entries(entries)) {
+                            if (!entry || typeof entry !== "object" || Array.isArray(entry))
+                                continue;
+                            if ("envSecrets" in entry) {
+                                throw new Error(`fleet.bots.${bot}.profile.skills.entries.${skill}.envSecrets was removed; use apiKeySecret or inline config`);
+                            }
+                        }
+                    }
+                }
+            }
+        }
+    }
+}
+//# sourceMappingURL=clawdlets-config-legacy.js.map

package/vendor/@clawdlets/core/dist/lib/clawdlets-config-migrate.d.ts

@@ -0,0 +1,8 @@
+export type MigrateToV9Result = {
+    ok: true;
+    changed: boolean;
+    warnings: string[];
+    migrated: unknown;
+};
+export declare function migrateClawdletsConfigToV9(raw: unknown): MigrateToV9Result;
+//# sourceMappingURL=clawdlets-config-migrate.d.ts.map

package/vendor/@clawdlets/core/dist/lib/clawdlets-config-migrate.js

@@ -0,0 +1,152 @@
+import { getProviderRequiredEnvVars } from "@clawdlets/shared/lib/llm-provider-env";
+import { assertSafeRecordKey, createNullProtoRecord } from "./safe-record.js";
+function isPlainObject(value) {
+    return Boolean(value) && typeof value === "object" && !Array.isArray(value);
+}
+function toStringRecord(value) {
+    if (!isPlainObject(value))
+        return createNullProtoRecord();
+    const out = createNullProtoRecord();
+    for (const [k, v] of Object.entries(value)) {
+        if (typeof v !== "string")
+            continue;
+        const key = String(k || "").trim();
+        const vv = v.trim();
+        if (!key || !vv)
+            continue;
+        assertSafeRecordKey({ key, context: "migrate string record" });
+        out[key] = vv;
+    }
+    return out;
+}
+function ensureObject(parent, key) {
+    const existing = parent[key];
+    if (isPlainObject(existing))
+        return existing;
+    assertSafeRecordKey({ key, context: "migrate ensureObject" });
+    const next = createNullProtoRecord();
+    parent[key] = next;
+    return next;
+}
+function ensureStringRecord(parent, key) {
+    const existing = parent[key];
+    assertSafeRecordKey({ key, context: "migrate ensureStringRecord" });
+    if (isPlainObject(existing)) {
+        const sanitized = toStringRecord(existing);
+        parent[key] = sanitized;
+        return sanitized;
+    }
+    const next = createNullProtoRecord();
+    parent[key] = next;
+    return next;
+}
+function applyProviderSecretsToEnv(params) {
+    let changed = false;
+    for (const [provider, secretName] of Object.entries(params.providerSecrets)) {
+        const envVars = getProviderRequiredEnvVars(provider);
+        for (const envVar of envVars) {
+            if (!params.env[envVar]) {
+                params.env[envVar] = secretName;
+                changed = true;
+            }
+        }
+    }
+    return changed;
+}
+function ensureDiscordTokenEnvRef(botCfg) {
+    const clawdbot = botCfg["clawdbot"];
+    if (!isPlainObject(clawdbot))
+        return false;
+    const channels = clawdbot["channels"];
+    if (!isPlainObject(channels))
+        return false;
+    const discord = channels["discord"];
+    if (!isPlainObject(discord))
+        return false;
+    const enabled = discord["enabled"];
+    if (enabled === false)
+        return false;
+    const token = discord["token"];
+    if (typeof token === "string" && token.trim())
+        return false;
+    discord["token"] = "${DISCORD_BOT_TOKEN}";
+    return true;
+}
+export function migrateClawdletsConfigToV9(raw) {
+    if (!isPlainObject(raw))
+        throw new Error("invalid config (expected JSON object)");
+    const next = structuredClone(raw);
+    const warnings = [];
+    const schemaVersion = Number(next["schemaVersion"] ?? 0);
+    if (schemaVersion === 9)
+        return { ok: true, changed: false, warnings, migrated: next };
+    if (schemaVersion !== 8)
+        throw new Error(`unsupported schemaVersion: ${schemaVersion} (expected 8)`);
+    let changed = false;
+    next["schemaVersion"] = 9;
+    changed = true;
+    const fleet = ensureObject(next, "fleet");
+    const fleetSecretEnv = ensureStringRecord(fleet, "secretEnv");
+    const fleetSecretFiles = ensureObject(fleet, "secretFiles");
+    void fleetSecretFiles;
+    if ("guildId" in fleet) {
+        delete fleet.guildId;
+        changed = true;
+    }
+    if ("envSecrets" in fleet) {
+        const legacy = toStringRecord(fleet.envSecrets);
+        for (const [envVar, secretName] of Object.entries(legacy)) {
+            if (!fleetSecretEnv[envVar])
+                fleetSecretEnv[envVar] = secretName;
+        }
+        delete fleet.envSecrets;
+        changed = true;
+    }
+    if ("modelSecrets" in fleet) {
+        const legacy = toStringRecord(fleet.modelSecrets);
+        if (applyProviderSecretsToEnv({ env: fleetSecretEnv, providerSecrets: legacy }))
+            changed = true;
+        delete fleet.modelSecrets;
+        changed = true;
+    }
+    const bots = ensureObject(fleet, "bots");
+    for (const [botId, botCfgRaw] of Object.entries(bots)) {
+        if (!isPlainObject(botCfgRaw))
+            continue;
+        const botCfg = botCfgRaw;
+        const profile = ensureObject(botCfg, "profile");
+        const profileSecretEnv = ensureStringRecord(profile, "secretEnv");
+        const profileSecretFiles = ensureObject(profile, "secretFiles");
+        void profileSecretFiles;
+        if ("envSecrets" in profile) {
+            const legacy = toStringRecord(profile.envSecrets);
+            for (const [envVar, secretName] of Object.entries(legacy)) {
+                if (!profileSecretEnv[envVar])
+                    profileSecretEnv[envVar] = secretName;
+            }
+            delete profile.envSecrets;
+            changed = true;
+        }
+        const discordTokenSecret = typeof profile.discordTokenSecret === "string" ? String(profile.discordTokenSecret).trim() : "";
+        if (discordTokenSecret) {
+            if (!profileSecretEnv["DISCORD_BOT_TOKEN"])
+                profileSecretEnv["DISCORD_BOT_TOKEN"] = discordTokenSecret;
+            else if (profileSecretEnv["DISCORD_BOT_TOKEN"] !== discordTokenSecret) {
+                warnings.push(`bot ${botId}: discordTokenSecret differs from profile.secretEnv.DISCORD_BOT_TOKEN; keeping secretEnv`);
+            }
+            delete profile.discordTokenSecret;
+            changed = true;
+            if (ensureDiscordTokenEnvRef(botCfg))
+                changed = true;
+        }
+        if ("modelSecrets" in profile) {
+            const legacy = toStringRecord(profile.modelSecrets);
+            if (applyProviderSecretsToEnv({ env: profileSecretEnv, providerSecrets: legacy }))
+                changed = true;
+            delete profile.modelSecrets;
+            changed = true;
+        }
+    }
+    return { ok: true, changed, warnings, migrated: next };
+}
+//# sourceMappingURL=clawdlets-config-migrate.js.map