paperclip-plugin-telegram 0.7.1 → 0.8.0

package/dist/secret-ref-validation.js

@@ -5,11 +5,43 @@ const FIELDS = [
     { key: "transcriptionApiKeyRef", required: false },
 ];
 export function isValidSecretRef(value) {
-    return typeof value === "string" && UUID_RE.test(value.trim());
+    if (typeof value === "string")
+        return UUID_RE.test(value.trim());
+    if (typeof value === "object" && value !== null) {
+        const record = value;
+        return (record.type === "secret_ref" &&
+            typeof record.secretId === "string" &&
+            UUID_RE.test(record.secretId.trim()));
+    }
+    return false;
+}
+/**
+ * Coerce a secret ref into the shape THIS host accepts before calling
+ * ctx.secrets.resolve().
+ *
+ * Refs reach us in both shapes: config validated by a current host holds
+ * `{ type: "secret_ref", secretId }`, while refs persisted earlier — notably
+ * the board-access state written by the Board Access panel — hold a bare UUID
+ * string. Hosts that require the object form reject the bare string with
+ * "Invalid secret reference for plugin: <uuid>. Use { type: "secret_ref" ... }",
+ * which surfaces to the user as an unexplained 403 from whatever the token was
+ * needed for.
+ *
+ * Passing the object through unchanged keeps older hosts working, since they
+ * accept it as an opaque ref.
+ */
+export function normalizeSecretRef(value) {
+    if (typeof value === "string") {
+        const trimmed = value.trim();
+        return UUID_RE.test(trimmed) ? { type: "secret_ref", secretId: trimmed } : null;
+    }
+    return isValidSecretRef(value) ? value : null;
 }
 function describeBadValue(value) {
     if (value === undefined || value === null)
         return "<empty>";
+    if (typeof value === "object")
+        return "<object>";
     if (typeof value !== "string")
         return `<${typeof value}>`;
     const trimmed = value.trim();

package/dist/secret-ref-validation.js.map

@@ -1 +1 @@
-{"version":3,"file":"secret-ref-validation.js","sourceRoot":"","sources":["../src/secret-ref-validation.ts"],"names":[],"mappings":"AAMA,MAAM,OAAO,GAAG,iEAAiE,CAAC;AAElF,MAAM,MAAM,GAAG;IACb,EAAE,GAAG,EAAE,qBAAqB,EAAE,QAAQ,EAAE,IAAI,EAAE;IAC9C,EAAE,GAAG,EAAE,2BAA2B,EAAE,QAAQ,EAAE,KAAK,EAAE;IACrD,EAAE,GAAG,EAAE,wBAAwB,EAAE,QAAQ,EAAE,KAAK,EAAE;CAC1C,CAAC;AAEX,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,OAAO,OAAO,KAAK,KAAK,QAAQ,IAAI,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;AACjE,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,OAAO,KAAK,GAAG,CAAC;IAC1D,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,gBAAgB,CAAC;IAClD,iEAAiE;IACjE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;IAC1E,OAAO,IAAI,MAAM,GAAG,CAAC;AACvB,CAAC;AAED,SAAS,UAAU,CAAC,GAAW,EAAE,KAAc;IAC7C,OAAO;QACL,GAAG,GAAG,yCAAyC;QAC/C,mEAAmE;QACnE,OAAO,gBAAgB,CAAC,KAAK,CAAC,GAAG;QACjC,uGAAuG;QACvG,sEAAsE;KACvE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,MAAuB;IAC7D,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,MAAM,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,MAAM,SAAS,GACb,KAAK,KAAK,SAAS;YACnB,KAAK,KAAK,IAAI;YACd,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;QAE3D,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,QAAQ;gBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,eAAe,CAAC,CAAC;YACjD,SAAS;QACX,CAAC;QAED,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}
+{"version":3,"file":"secret-ref-validation.js","sourceRoot":"","sources":["../src/secret-ref-validation.ts"],"names":[],"mappings":"AAMA,MAAM,OAAO,GAAG,iEAAiE,CAAC;AAElF,MAAM,MAAM,GAAG;IACb,EAAE,GAAG,EAAE,qBAAqB,EAAE,QAAQ,EAAE,IAAI,EAAE;IAC9C,EAAE,GAAG,EAAE,2BAA2B,EAAE,QAAQ,EAAE,KAAK,EAAE;IACrD,EAAE,GAAG,EAAE,wBAAwB,EAAE,QAAQ,EAAE,KAAK,EAAE;CAC1C,CAAC;AAWX,MAAM,UAAU,gBAAgB,CAAC,KAAc;IAC7C,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,OAAO,CAAC,IAAI,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;IACjE,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,KAAK,IAAI,EAAE,CAAC;QAChD,MAAM,MAAM,GAAG,KAA+C,CAAC;QAC/D,OAAO,CACL,MAAM,CAAC,IAAI,KAAK,YAAY;YAC5B,OAAO,MAAM,CAAC,QAAQ,KAAK,QAAQ;YACnC,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,CACrC,CAAC;IACJ,CAAC;IACD,OAAO,KAAK,CAAC;AACf,CAAC;AAED;;;;;;;;;;;;;;GAcG;AACH,MAAM,UAAU,kBAAkB,CAAC,KAAc;IAC/C,IAAI,OAAO,KAAK,KAAK,QAAQ,EAAE,CAAC;QAC9B,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;QAC7B,OAAO,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,YAAY,EAAE,QAAQ,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC;IAClF,CAAC;IACD,OAAO,gBAAgB,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,IAAI,CAAC;AAChD,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAc;IACtC,IAAI,KAAK,KAAK,SAAS,IAAI,KAAK,KAAK,IAAI;QAAE,OAAO,SAAS,CAAC;IAC5D,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,UAAU,CAAC;IACjD,IAAI,OAAO,KAAK,KAAK,QAAQ;QAAE,OAAO,IAAI,OAAO,KAAK,GAAG,CAAC;IAC1D,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;QAAE,OAAO,gBAAgB,CAAC;IAClD,iEAAiE;IACjE,MAAM,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,EAAE,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,KAAK,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC;IAC1E,OAAO,IAAI,MAAM,GAAG,CAAC;AACvB,CAAC;AAED,SAAS,UAAU,CAAC,GAAW,EAAE,KAAc;IAC7C,OAAO;QACL,GAAG,GAAG,yCAAyC;QAC/C,mEAAmE;QACnE,OAAO,gBAAgB,CAAC,KAAK,CAAC,GAAG;QACjC,uGAAuG;QACvG,sEAAsE;KACvE,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AACd,CAAC;AAED,MAAM,UAAU,uBAAuB,CAAC,MAAuB;IAC7D,MAAM,MAAM,GAAa,EAAE,CAAC;IAC5B,KAAK,MAAM,EAAE,GAAG,EAAE,QAAQ,EAAE,IAAI,MAAM,EAAE,CAAC;QACvC,MAAM,KAAK,GAAG,MAAM,CAAC,GAAG,CAAC,CAAC;QAC1B,MAAM,SAAS,GACb,KAAK,KAAK,SAAS;YACnB,KAAK,KAAK,IAAI;YACd,CAAC,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,IAAI,EAAE,CAAC,MAAM,KAAK,CAAC,CAAC,CAAC;QAE3D,IAAI,SAAS,EAAE,CAAC;YACd,IAAI,QAAQ;gBAAE,MAAM,CAAC,IAAI,CAAC,GAAG,GAAG,eAAe,CAAC,CAAC;YACjD,SAAS;QACX,CAAC;QAED,IAAI,CAAC,gBAAgB,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7B,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,GAAG,EAAE,KAAK,CAAC,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/ui/index.js

@@ -345,14 +345,23 @@ async function fetchBoardAccessIdentity(boardApiToken) {
     });
     return getIdentityLabel(identity);
 }
-async function fetchPluginConfig() {
-    const record = await fetchHostJson(`/api/plugins/${encodeURIComponent(TELEGRAM_PLUGIN_ID)}/config`);
+function pluginConfigPath(companyId) {
+    const base = `/api/plugins/${encodeURIComponent(TELEGRAM_PLUGIN_ID)}/config`;
+    const scopedCompanyId = companyId?.trim();
+    return scopedCompanyId ? `${base}?companyId=${encodeURIComponent(scopedCompanyId)}` : base;
+}
+async function fetchPluginConfig(companyId) {
+    const record = await fetchHostJson(pluginConfigPath(companyId));
     return record?.configJson && typeof record.configJson === "object" ? record.configJson : {};
 }
-async function savePluginConfig(configJson) {
-    await fetchHostJson(`/api/plugins/${encodeURIComponent(TELEGRAM_PLUGIN_ID)}/config`, {
+async function fetchCompanySecrets(companyId) {
+    return fetchHostJson(`/api/companies/${encodeURIComponent(companyId)}/secrets`);
+}
+async function savePluginConfig(configJson, companyId) {
+    const scopedCompanyId = companyId?.trim();
+    await fetchHostJson(pluginConfigPath(), {
         method: "POST",
-        body: JSON.stringify({ configJson }),
+        body: JSON.stringify(scopedCompanyId ? { configJson, companyId: scopedCompanyId } : { configJson }),
     });
 }
 async function resolveOrCreateCompanySecret(companyId, name, value) {
@@ -426,7 +435,7 @@ export function TelegramSettingsPage({ context }) {
             setRoutingLoading(true);
             setRoutingMessage(null);
             try {
-                const config = await fetchPluginConfig();
+                const config = await fetchPluginConfig(companyId);
                 if (cancelled)
                     return;
                 const nextRoutingConfig = extractRoutingConfig(config);
@@ -452,14 +461,14 @@ export function TelegramSettingsPage({ context }) {
         return () => {
             cancelled = true;
         };
-    }, []);
+    }, [companyId]);
     useEffect(() => {
         let cancelled = false;
         async function loadProactiveConfig() {
             setProactiveLoading(true);
             setProactiveMessage(null);
             try {
-                const config = await fetchPluginConfig();
+                const config = await fetchPluginConfig(companyId);
                 if (cancelled)
                     return;
                 const nextProactiveConfig = extractProactiveConfig(config);
@@ -485,14 +494,14 @@ export function TelegramSettingsPage({ context }) {
         return () => {
             cancelled = true;
         };
-    }, []);
+    }, [companyId]);
     useEffect(() => {
         let cancelled = false;
         async function loadEscalationConfig() {
             setEscalationLoading(true);
             setEscalationMessage(null);
             try {
-                const config = await fetchPluginConfig();
+                const config = await fetchPluginConfig(companyId);
                 if (cancelled)
                     return;
                 const nextEscalationConfig = extractEscalationConfig(config);
@@ -518,14 +527,14 @@ export function TelegramSettingsPage({ context }) {
         return () => {
             cancelled = true;
         };
-    }, []);
+    }, [companyId]);
     useEffect(() => {
         let cancelled = false;
         async function loadMediaConfig() {
             setMediaLoading(true);
             setMediaMessage(null);
             try {
-                const config = await fetchPluginConfig();
+                const config = await fetchPluginConfig(companyId);
                 if (cancelled)
                     return;
                 const nextMediaConfig = extractMediaConfig(config);
@@ -551,14 +560,14 @@ export function TelegramSettingsPage({ context }) {
         return () => {
             cancelled = true;
         };
-    }, []);
+    }, [companyId]);
     useEffect(() => {
         let cancelled = false;
         async function loadAccessConfig() {
             setAccessLoading(true);
             setAccessMessage(null);
             try {
-                const config = await fetchPluginConfig();
+                const config = await fetchPluginConfig(companyId);
                 if (cancelled)
                     return;
                 const nextAccessConfig = extractAccessConfig(config);
@@ -584,14 +593,14 @@ export function TelegramSettingsPage({ context }) {
         return () => {
             cancelled = true;
         };
-    }, []);
+    }, [companyId]);
     useEffect(() => {
         let cancelled = false;
         async function loadConnectionConfig() {
             setConnectionLoading(true);
             setConnectionMessage(null);
             try {
-                const config = await fetchPluginConfig();
+                const config = await fetchPluginConfig(companyId);
                 if (cancelled)
                     return;
                 const nextConnectionConfig = extractConnectionConfig(config);
@@ -617,14 +626,14 @@ export function TelegramSettingsPage({ context }) {
         return () => {
             cancelled = true;
         };
-    }, []);
+    }, [companyId]);
     useEffect(() => {
         let cancelled = false;
         async function loadBoardConfig() {
             setBoardConfigLoading(true);
             setBoardConfigMessage(null);
             try {
-                const config = await fetchPluginConfig();
+                const config = await fetchPluginConfig(companyId);
                 if (cancelled)
                     return;
                 const nextBoardConfig = extractBoardConfig(config);
@@ -650,7 +659,7 @@ export function TelegramSettingsPage({ context }) {
         return () => {
             cancelled = true;
         };
-    }, []);
+    }, [companyId]);
     function updateRoutingField(key, value) {
         setRoutingConfig((current) => ({ ...current, [key]: value }));
         setRoutingMessage(null);
@@ -683,9 +692,9 @@ export function TelegramSettingsPage({ context }) {
         setBoardConfigSaving(true);
         setBoardConfigMessage(null);
         try {
-            const currentConfig = await fetchPluginConfig();
+            const currentConfig = await fetchPluginConfig(companyId);
             const nextConfig = { ...currentConfig, ...boardConfig };
-            await savePluginConfig(nextConfig);
+            await savePluginConfig(nextConfig, companyId);
             setBoardSnapshot(boardConfig);
             setBoardConfigMessage({
                 tone: "success",
@@ -708,9 +717,9 @@ export function TelegramSettingsPage({ context }) {
         setAccessSaving(true);
         setAccessMessage(null);
         try {
-            const currentConfig = await fetchPluginConfig();
+            const currentConfig = await fetchPluginConfig(companyId);
             const nextConfig = { ...currentConfig, ...accessConfig };
-            await savePluginConfig(nextConfig);
+            await savePluginConfig(nextConfig, companyId);
             setAccessSnapshot(accessConfig);
             setAccessMessage({
                 tone: "success",
@@ -733,9 +742,9 @@ export function TelegramSettingsPage({ context }) {
         setRoutingSaving(true);
         setRoutingMessage(null);
         try {
-            const currentConfig = await fetchPluginConfig();
+            const currentConfig = await fetchPluginConfig(companyId);
             const nextConfig = { ...currentConfig, ...routingConfig };
-            await savePluginConfig(nextConfig);
+            await savePluginConfig(nextConfig, companyId);
             setRoutingSnapshot(routingConfig);
             setRoutingMessage({
                 tone: "success",
@@ -758,9 +767,9 @@ export function TelegramSettingsPage({ context }) {
         setConnectionSaving(true);
         setConnectionMessage(null);
         try {
-            const currentConfig = await fetchPluginConfig();
+            const currentConfig = await fetchPluginConfig(companyId);
             const nextConfig = { ...currentConfig, ...connectionConfig };
-            await savePluginConfig(nextConfig);
+            await savePluginConfig(nextConfig, companyId);
             setConnectionSnapshot(connectionConfig);
             setConnectionMessage({
                 tone: "success",
@@ -783,9 +792,9 @@ export function TelegramSettingsPage({ context }) {
         setMediaSaving(true);
         setMediaMessage(null);
         try {
-            const currentConfig = await fetchPluginConfig();
+            const currentConfig = await fetchPluginConfig(companyId);
             const nextConfig = { ...currentConfig, ...mediaConfig };
-            await savePluginConfig(nextConfig);
+            await savePluginConfig(nextConfig, companyId);
             setMediaSnapshot(mediaConfig);
             setMediaMessage({
                 tone: "success",
@@ -808,9 +817,9 @@ export function TelegramSettingsPage({ context }) {
         setEscalationSaving(true);
         setEscalationMessage(null);
         try {
-            const currentConfig = await fetchPluginConfig();
+            const currentConfig = await fetchPluginConfig(companyId);
             const nextConfig = { ...currentConfig, ...escalationConfig };
-            await savePluginConfig(nextConfig);
+            await savePluginConfig(nextConfig, companyId);
             setEscalationSnapshot(escalationConfig);
             setEscalationMessage({
                 tone: "success",
@@ -833,9 +842,9 @@ export function TelegramSettingsPage({ context }) {
         setProactiveSaving(true);
         setProactiveMessage(null);
         try {
-            const currentConfig = await fetchPluginConfig();
+            const currentConfig = await fetchPluginConfig(companyId);
             const nextConfig = { ...currentConfig, ...proactiveConfig };
-            await savePluginConfig(nextConfig);
+            await savePluginConfig(nextConfig, companyId);
             setProactiveSnapshot(proactiveConfig);
             setProactiveMessage({
                 tone: "success",
@@ -929,7 +938,7 @@ export function TelegramSettingsPage({ context }) {
                     display: "grid",
                     gap: 18,
                     padding: 18,
-                }, children: [_jsxs("div", { style: { display: "grid", gap: 4 }, children: [_jsx("h2", { style: { fontSize: 18, fontWeight: 700, lineHeight: "28px", margin: 0 }, children: "Connection & URLs" }), _jsx("p", { style: { color: "#6b7280", margin: 0 }, children: "Core connection values used by the Telegram worker. Save the bot token as a Paperclip secret and paste its secret UUID here." })] }), _jsxs("div", { style: { display: "grid", gap: 12 }, children: [_jsx(TextField, { disabled: connectionLoading || connectionSaving, label: "Telegram bot token secret ref", onChange: (value) => updateConnectionField("telegramBotTokenRef", value), placeholder: "Secret UUID from Paperclip settings", value: connectionConfig.telegramBotTokenRef, children: "Secret UUID for your Telegram bot token from @BotFather. The plugin resolves this secret before polling Telegram." }), _jsx(TextField, { disabled: connectionLoading || connectionSaving, label: "Paperclip API URL", onChange: (value) => updateConnectionField("paperclipBaseUrl", value), placeholder: "http://localhost:3100", value: connectionConfig.paperclipBaseUrl, children: "Internal Paperclip API URL used by the plugin for actions such as approvals and comments. Keep localhost for same-server deployments." }), _jsx(TextField, { disabled: connectionLoading || connectionSaving, label: "Paperclip public URL", onChange: (value) => updateConnectionField("paperclipPublicUrl", value), placeholder: "https://paperclip.example.com", value: connectionConfig.paperclipPublicUrl, children: "Public URL used in Telegram links. Leave empty to fall back to the API URL." })] }), connectionMessage ? _jsx(NoticeBlock, { notice: connectionMessage }) : null, _jsxs("div", { style: { display: "flex", gap: 10, justifyContent: "flex-end" }, children: [_jsx("button", { disabled: connectionLoading || connectionSaving, onClick: () => {
+                }, children: [_jsxs("div", { style: { display: "grid", gap: 4 }, children: [_jsx("h2", { style: { fontSize: 18, fontWeight: 700, lineHeight: "28px", margin: 0 }, children: "Connection & URLs" }), _jsx("p", { style: { color: "#6b7280", margin: 0 }, children: "Core connection values used by the Telegram worker. Select company secrets for sensitive values; secret values are never shown here." })] }), _jsxs("div", { style: { display: "grid", gap: 12 }, children: [_jsx(SecretRefField, { companyId: companyId, disabled: connectionLoading || connectionSaving, label: "Telegram bot token secret ref", onChange: (value) => updateConnectionField("telegramBotTokenRef", value), placeholder: "Secret UUID fallback", value: connectionConfig.telegramBotTokenRef, children: "Select the company secret that stores your Telegram bot token from @BotFather. The plugin resolves this secret before polling Telegram." }), _jsx(TextField, { disabled: connectionLoading || connectionSaving, label: "Paperclip API URL", onChange: (value) => updateConnectionField("paperclipBaseUrl", value), placeholder: "http://localhost:3100", value: connectionConfig.paperclipBaseUrl, children: "Internal Paperclip API URL used by the plugin for actions such as approvals and comments. Keep localhost for same-server deployments." }), _jsx(TextField, { disabled: connectionLoading || connectionSaving, label: "Paperclip public URL", onChange: (value) => updateConnectionField("paperclipPublicUrl", value), placeholder: "https://paperclip.example.com", value: connectionConfig.paperclipPublicUrl, children: "Public URL used in Telegram links. Leave empty to fall back to the API URL." })] }), connectionMessage ? _jsx(NoticeBlock, { notice: connectionMessage }) : null, _jsxs("div", { style: { display: "flex", gap: 10, justifyContent: "flex-end" }, children: [_jsx("button", { disabled: connectionLoading || connectionSaving, onClick: () => {
                                     setConnectionConfig(connectionSnapshot);
                                     setConnectionMessage(null);
                                 }, style: {
@@ -993,7 +1002,7 @@ export function TelegramSettingsPage({ context }) {
                                     fontWeight: 700,
                                     minWidth: 190,
                                     padding: "10px 14px",
-                                }, type: "button", children: connecting ? "Waiting for approval..." : configured ? "Reconnect board access" : "Connect board access" })] }), _jsxs("div", { style: { borderTop: "1px solid #e5e7eb", display: "grid", gap: 12, paddingTop: 14 }, children: [_jsx(TextField, { disabled: boardConfigLoading || boardConfigSaving, label: "Board API token secret ref fallback", onChange: (value) => updateBoardField("paperclipBoardApiTokenRef", value), placeholder: "Optional Paperclip secret UUID", value: boardConfig.paperclipBoardApiTokenRef, children: "Optional manual fallback for approval buttons and /approve. The Board Access Connection above is preferred because it creates and tracks the company-scoped secret for you." }), boardConfigMessage ? _jsx(NoticeBlock, { notice: boardConfigMessage }) : null, _jsxs("div", { style: { display: "flex", gap: 10, justifyContent: "flex-end" }, children: [_jsx("button", { disabled: boardConfigLoading || boardConfigSaving, onClick: () => {
+                                }, type: "button", children: connecting ? "Waiting for approval..." : configured ? "Reconnect board access" : "Connect board access" })] }), _jsxs("div", { style: { borderTop: "1px solid #e5e7eb", display: "grid", gap: 12, paddingTop: 14 }, children: [_jsx(SecretRefField, { companyId: companyId, disabled: boardConfigLoading || boardConfigSaving, label: "Board API token secret ref fallback", onChange: (value) => updateBoardField("paperclipBoardApiTokenRef", value), placeholder: "Optional secret UUID fallback", value: boardConfig.paperclipBoardApiTokenRef, children: "Optional manual fallback for approval buttons and /approve. The Board Access Connection above is preferred because it creates and tracks the company-scoped secret for you." }), boardConfigMessage ? _jsx(NoticeBlock, { notice: boardConfigMessage }) : null, _jsxs("div", { style: { display: "flex", gap: 10, justifyContent: "flex-end" }, children: [_jsx("button", { disabled: boardConfigLoading || boardConfigSaving, onClick: () => {
                                             setBoardConfig(boardSnapshot);
                                             setBoardConfigMessage(null);
                                         }, style: {
@@ -1132,7 +1141,7 @@ export function TelegramSettingsPage({ context }) {
                     display: "grid",
                     gap: 18,
                     padding: 18,
-                }, children: [_jsxs("div", { style: { display: "grid", gap: 4 }, children: [_jsx("h2", { style: { fontSize: 18, fontWeight: 700, lineHeight: "28px", margin: 0 }, children: "Media Intake / Brief Agent" }), _jsx("p", { style: { color: "#6b7280", margin: 0 }, children: "Routes Telegram voice, audio, documents, and photos either to a Brief Agent intake flow or to active agent sessions inside forum topics." })] }), _jsxs("div", { style: { display: "grid", gap: 12 }, children: [_jsx(TextField, { disabled: mediaLoading || mediaSaving, label: "Transcription API key secret ref", onChange: (value) => updateMediaField("transcriptionApiKeyRef", value), placeholder: "OpenAI API key secret UUID", value: mediaConfig.transcriptionApiKeyRef, children: "Secret UUID for the OpenAI API key used to transcribe voice and audio before routing media to the Brief Agent or an active topic agent session." }), _jsx(TextField, { disabled: mediaLoading || mediaSaving, label: "Brief Agent ID", onChange: (value) => updateMediaField("briefAgentId", value), placeholder: "Paperclip agent ID", value: mediaConfig.briefAgentId, children: "Agent ID that processes media intake briefs. Leave empty to disable the dedicated Brief Agent intake flow." }), _jsx(ArrayField, { disabled: mediaLoading || mediaSaving, emptyValueLabel: "No intake chat IDs configured", label: "Brief Agent intake chat IDs", newItemLabel: "Add intake chat ID", onChange: (value) => updateMediaField("briefAgentChatIds", value), placeholder: "-1003800613668", value: mediaConfig.briefAgentChatIds, children: "Telegram chat IDs where media is routed to the Brief Agent. Media in other chats goes to active agent sessions when a matching forum topic session exists." })] }), mediaMessage ? _jsx(NoticeBlock, { notice: mediaMessage }) : null, _jsxs("div", { style: { display: "flex", gap: 10, justifyContent: "flex-end" }, children: [_jsx("button", { disabled: mediaLoading || mediaSaving, onClick: () => {
+                }, children: [_jsxs("div", { style: { display: "grid", gap: 4 }, children: [_jsx("h2", { style: { fontSize: 18, fontWeight: 700, lineHeight: "28px", margin: 0 }, children: "Media Intake / Brief Agent" }), _jsx("p", { style: { color: "#6b7280", margin: 0 }, children: "Routes Telegram voice, audio, documents, and photos either to a Brief Agent intake flow or to active agent sessions inside forum topics." })] }), _jsxs("div", { style: { display: "grid", gap: 12 }, children: [_jsx(SecretRefField, { companyId: companyId, disabled: mediaLoading || mediaSaving, label: "OpenAI transcription secret", onChange: (value) => updateMediaField("transcriptionApiKeyRef", value), placeholder: "OpenAI API key secret UUID fallback", value: mediaConfig.transcriptionApiKeyRef, children: "Select the company secret used for audio transcription. Secret values are never shown to the plugin UI." }), _jsx(TextField, { disabled: mediaLoading || mediaSaving, label: "Brief Agent ID", onChange: (value) => updateMediaField("briefAgentId", value), placeholder: "Paperclip agent ID", value: mediaConfig.briefAgentId, children: "Agent ID that processes media intake briefs. Leave empty to disable the dedicated Brief Agent intake flow." }), _jsx(ArrayField, { disabled: mediaLoading || mediaSaving, emptyValueLabel: "No intake chat IDs configured", label: "Brief Agent intake chat IDs", newItemLabel: "Add intake chat ID", onChange: (value) => updateMediaField("briefAgentChatIds", value), placeholder: "-1003800613668", value: mediaConfig.briefAgentChatIds, children: "Telegram chat IDs where media is routed to the Brief Agent. Media in other chats goes to active agent sessions when a matching forum topic session exists." })] }), mediaMessage ? _jsx(NoticeBlock, { notice: mediaMessage }) : null, _jsxs("div", { style: { display: "flex", gap: 10, justifyContent: "flex-end" }, children: [_jsx("button", { disabled: mediaLoading || mediaSaving, onClick: () => {
                                     setMediaConfig(mediaSnapshot);
                                     setMediaMessage(null);
                                 }, style: {
@@ -1230,6 +1239,51 @@ function NoticeBlock({ notice }) {
             padding: 12,
         }, children: [_jsx("strong", { children: notice.title }), notice.text ? _jsx("p", { style: { margin: "6px 0 0" }, children: notice.text }) : null] }));
 }
+function SecretRefField({ label, value, placeholder, disabled, companyId, children, onChange, }) {
+    const [secrets, setSecrets] = useState([]);
+    const [loading, setLoading] = useState(false);
+    const [error, setError] = useState(null);
+    useEffect(() => {
+        let cancelled = false;
+        async function loadSecrets() {
+            if (!companyId) {
+                setSecrets([]);
+                return;
+            }
+            setLoading(true);
+            setError(null);
+            try {
+                const nextSecrets = await fetchCompanySecrets(companyId);
+                if (!cancelled) {
+                    setSecrets(nextSecrets.filter((secret) => secret.status !== "deleted"));
+                }
+            }
+            catch (err) {
+                if (!cancelled) {
+                    setError(getErrorMessage(err));
+                }
+            }
+            finally {
+                if (!cancelled) {
+                    setLoading(false);
+                }
+            }
+        }
+        void loadSecrets();
+        return () => {
+            cancelled = true;
+        };
+    }, [companyId]);
+    const selectedValue = secrets.some((secret) => secret.id === value) ? value : "";
+    const fieldDisabled = disabled || loading || !companyId;
+    return (_jsxs("label", { style: { display: "grid", gap: 5 }, children: [_jsx("span", { style: { color: "#4b5563", fontSize: 12, fontWeight: 700 }, children: label }), _jsxs("select", { disabled: fieldDisabled, onChange: (event) => onChange(event.currentTarget.value), style: standardInputStyle, value: selectedValue, children: [_jsx("option", { value: "", children: !companyId
+                            ? "Open inside a company to select a secret"
+                            : loading
+                                ? "Loading company secrets..."
+                                : value && !selectedValue
+                                    ? "Manual UUID selected"
+                                    : "Select a company secret" }), secrets.map((secret) => (_jsxs("option", { value: secret.id, children: [secret.name || secret.key || secret.id, secret.key && secret.key !== secret.name ? ` (${secret.key})` : "", secret.latestVersion ? ` · v${secret.latestVersion}` : ""] }, secret.id)))] }), _jsx("input", { disabled: disabled, onChange: (event) => onChange(event.currentTarget.value), placeholder: placeholder, style: standardInputStyle, type: "text", value: value }), _jsx("span", { style: { color: "#6b7280", fontSize: 12 }, children: children }), error ? _jsxs("span", { style: { color: "#b91c1c", fontSize: 12 }, children: ["Could not load company secrets: ", error] }) : null] }));
+}
 function TextField({ label, value, placeholder, disabled, children, onChange, }) {
     return (_jsxs("label", { style: { display: "grid", gap: 5 }, children: [_jsx("span", { style: { color: "#4b5563", fontSize: 12, fontWeight: 700 }, children: label }), _jsx("input", { disabled: disabled, onChange: (event) => onChange(event.currentTarget.value), placeholder: placeholder, style: {
                     border: "1px solid #d1d5db",