import { a as parseAccessGroupAllowFromEntry, t as ACCESS_GROUP_ALLOW_FROM_PREFIX } from "./allow-from-BXARLg0R.js";
import { a as SecretResolverWarningCode, c as createResolverContext, d as isEnabledFlag, f as pushAssignment, h as SecretRefResolveCache, i as SecretResolverWarning, l as hasOwnProperty, m as pushWarning, n as SecretAssignment, o as applyResolvedAssignments, p as pushInactiveSurfaceWarning, r as SecretDefaults, s as collectSecretInputAssignment, t as ResolverContext, u as isChannelAccountEffectivelyEnabled } from "./runtime-shared-BA_NGYnR.js";
import { a as SecretTargetExpected, i as SecretTargetConfigFile, n as DiscoveredConfigSecretTarget, o as SecretTargetRegistryEntry, r as ResolvedPlanTarget, s as SecretTargetShape, t as AuthProfileType } from "./target-registry-types-CaFs7qTE.js";
import { a as resolveAccessGroupAllowFromMatches, i as expandAllowFromWithAccessGroups, n as AccessGroupMembershipResolver, o as resolveAccessGroupAllowFromState, r as ResolvedAccessGroupAllowFromState, t as AccessGroupMembershipLookup } from "./access-groups-Cz8ioqkR.js";
import { c as isRecord } from "./utils-DSrjARXN.js";
import { S as resolvePinnedHostnameWithPolicy, a as SsrFBlockedError, g as isPrivateNetworkAllowedByPolicy, o as SsrFPolicy, p as isBlockedHostnameOrIp, t as LookupFn, v as matchesHostnameAllowlist } from "./ssrf-skjEI_i5.js";
import { a as getHookType, c as HookExternalContentSource, d as resolveHookExternalContentSource, i as detectSuspiciousPatterns, l as isExternalHookSession, n as WrapExternalContentOptions, o as wrapExternalContent, r as buildSafeExternalPrompt, s as wrapWebContent, t as ExternalContentSource, u as mapHookExternalContentSource } from "./external-content-BpqxkZzw.js";
import { a as formatErrorMessage, i as extractErrorCode } from "./errors-D0VpUbWO.js";
import { a as filterSupplementalContextItems, i as evaluateSupplementalContextVisibility, n as ContextVisibilityDecisionReason, o as shouldIncludeSupplementalContext, r as ContextVisibilityKind, t as ContextVisibilityDecision } from "./context-visibility-DBQDziqz.js";
import { i as generateSecureToken } from "./secure-random-C6rj1jbz.js";
import { a as resolveDmAllowState, c as resolveDmGroupAccessWithLists, d as resolvePinnedMainDmOwnerFromAllowlist, i as readStoreAllowFromForDmPolicy, l as resolveEffectiveAllowFromLists, n as DmGroupAccessDecision, o as resolveDmGroupAccessDecision, r as DmGroupAccessReasonCode, s as resolveDmGroupAccessWithCommandGate, t as DM_GROUP_ACCESS_REASON, u as resolveOpenDmAllowlistAccess } from "./dm-policy-shared-ClY4ljRn.js";
import { a as collectNestedChannelFieldAssignments, c as getChannelSurface, d as normalizeSecretStringValue, f as resolveChannelAccountSurface, i as collectConditionalChannelFieldAssignments, l as hasConfiguredSecretInputValue, n as ChannelAccountPredicate, o as collectSimpleChannelFieldAssignments, r as ChannelAccountSurface, s as getChannelRecord, t as ChannelAccountEntry, u as isBaseFieldActiveForChannelSurface } from "./channel-secret-basic-runtime-DLYke2tK.js";
import { a as parseEnvValue, c as writeJsonFileSecure, i as parseDotPath, l as writeTextFileAtomic, n as isNonEmptyString, o as readTextFileIfExists, r as normalizePositiveInt, s as toDotPath, t as ensureDirForFile } from "./shared-Ry8G5o-u.js";
import { t as collectNestedChannelTtsAssignments } from "./channel-secret-tts-runtime-Btsl06Fm.js";
import { r as resolvePreferredOpenClawTmpDir } from "./tmp-openclaw-dir-DRV57vdI.js";
import { a as hasProxyEnvConfigured } from "./proxy-env-_52KyQvo.js";
import { B as root, C as findExistingAncestor, D as pathExists, E as openLocalFileSafely, F as resolveAbsolutePathForRead, H as statRegularFile, I as resolveAbsolutePathForWrite, K as withTimeout, L as resolveLocalPathFromRootsSync, M as readRegularFile, N as readRegularFileSync, O as pathExistsSync, S as ensureAbsoluteDirectory, U as statRegularFileSync, a as ExternalFileWriteResult, b as assertAbsolutePathInput, d as ResolvedAbsolutePath, f as ResolvedWritableAbsolutePath, i as ExternalFileWriteOptions, l as OpenResult, n as EnsureAbsoluteDirectoryOptions, o as FsSafeError, q as writeExternalFileWithinRoot, r as EnsureAbsoluteDirectoryResult, s as FsSafeErrorCode, t as AbsolutePathSymlinkPolicy, v as appendRegularFile, x as canonicalPathFromExistingAncestor, y as appendRegularFileSync, z as resolveRegularFileAppendFlags } from "./fs-safe-DGWa_p_W.js";
import { t as normalizeHostname } from "./hostname-Zu_LBkSa.js";
import { d as redactSensitiveText } from "./redact-DCd7iXP8.js";
import { AssertNoSymlinkParentsOptions, WriteSiblingTempFileOptions, WriteSiblingTempFileResult, assertNoSymlinkParents, assertNoSymlinkParentsSync, pathScope, resolveExistingPathsWithinRoot, resolvePathWithinRoot, resolvePathsWithinRoot, resolveStrictExistingPathsWithinRoot, resolveWritablePathWithinRoot, sanitizeUntrustedFileName, writeSiblingTempFile, writeViaSiblingTempPath } from "@openclaw/fs-safe/advanced";
import { MovePathWithCopyFallbackOptions as MovePathWithCopyFallbackOptions$1, ReplaceFileAtomicFileSystem, ReplaceFileAtomicOptions, ReplaceFileAtomicResult, ReplaceFileAtomicSyncFileSystem, ReplaceFileAtomicSyncOptions, replaceFileAtomic as replaceFileAtomic$1, replaceFileAtomicSync } from "@openclaw/fs-safe/atomic";
import { isNotFoundPathError, isPathInside } from "@openclaw/fs-safe/path";
import { FileStore, FileStoreSync } from "@openclaw/fs-safe/store";

//#region src/security/channel-metadata.d.ts
declare function buildUntrustedChannelMetadata(params: {
  source: string;
  label: string;
  entries: Array<string | null | undefined>;
  maxChars?: number;
}): string | undefined;
//#endregion
//#region src/security/safe-regex.d.ts
type SafeRegexRejectReason = "empty" | "unsafe-nested-repetition" | "invalid-regex";
type SafeRegexCompileResult = {
  regex: RegExp;
  source: string;
  flags: string;
  reason: null;
} | {
  regex: null;
  source: string;
  flags: string;
  reason: SafeRegexRejectReason;
};
declare function testRegexWithBoundedInput(regex: RegExp, input: string, maxWindow?: number): boolean;
declare function hasNestedRepetition(source: string): boolean;
declare function compileSafeRegexDetailed(source: string, flags?: string): SafeRegexCompileResult;
declare function compileSafeRegex(source: string, flags?: string): RegExp | null;
//#endregion
//#region src/infra/private-file-store.d.ts
type PrivateFileStore = FileStore;
declare function privateFileStore(rootDir: string): FileStore;
type PrivateFileStoreSync = FileStoreSync;
declare function privateFileStoreSync(rootDir: string): PrivateFileStoreSync;
//#endregion
//#region src/infra/replace-file.d.ts
declare const replaceFileAtomic: typeof replaceFileAtomic$1;
type MovePathWithCopyFallbackOptions = MovePathWithCopyFallbackOptions$1 & {
  sourceHardlinks?: "allow" | "reject";
};
declare function movePathWithCopyFallback(options: MovePathWithCopyFallbackOptions): Promise<void>;
//#endregion
//#region src/infra/ports.d.ts
declare function ensurePortAvailable(port: number): Promise<void>;
//#endregion
//#region src/security/secret-equal.d.ts
declare function safeEqualSecret(provided: string | undefined | null, expected: string | undefined | null): boolean;
//#endregion
//#region src/plugin-sdk/security-runtime.d.ts
declare function openFileWithinRoot(params: {
  rootDir: string;
  relativePath: string;
  rejectHardlinks?: boolean;
  nonBlockingRead?: boolean;
  allowSymlinkTargetWithinRoot?: boolean;
}): Promise<OpenResult>;
declare function writeFileFromPathWithinRoot(params: {
  rootDir: string;
  relativePath: string;
  sourcePath: string;
  mkdir?: boolean;
}): Promise<void>;
//#endregion
export { ACCESS_GROUP_ALLOW_FROM_PREFIX, type AbsolutePathSymlinkPolicy, type AccessGroupMembershipLookup, type AccessGroupMembershipResolver, type AssertNoSymlinkParentsOptions, type AuthProfileType, type ChannelAccountEntry, type ChannelAccountPredicate, type ChannelAccountSurface, ContextVisibilityDecision, ContextVisibilityDecisionReason, ContextVisibilityKind, DM_GROUP_ACCESS_REASON, type DiscoveredConfigSecretTarget, DmGroupAccessDecision, DmGroupAccessReasonCode, type EnsureAbsoluteDirectoryOptions, type EnsureAbsoluteDirectoryResult, ExternalContentSource, type ExternalFileWriteOptions, type ExternalFileWriteResult, FsSafeError, FsSafeError as SafeOpenError, type HookExternalContentSource, type LookupFn, type MovePathWithCopyFallbackOptions, type PrivateFileStore, type ReplaceFileAtomicFileSystem, type ReplaceFileAtomicOptions, type ReplaceFileAtomicResult, type ReplaceFileAtomicSyncFileSystem, type ReplaceFileAtomicSyncOptions, type ResolvedAbsolutePath, type ResolvedAccessGroupAllowFromState, type ResolvedPlanTarget, type ResolvedWritableAbsolutePath, ResolverContext, type FsSafeErrorCode as SafeOpenErrorCode, SafeRegexCompileResult, SafeRegexRejectReason, SecretAssignment, SecretDefaults, type SecretRefResolveCache, SecretResolverWarning, SecretResolverWarningCode, type SecretTargetConfigFile, type SecretTargetExpected, type SecretTargetRegistryEntry, type SecretTargetShape, SsrFBlockedError, type SsrFPolicy, WrapExternalContentOptions, type WriteSiblingTempFileOptions, type WriteSiblingTempFileResult, appendRegularFile, appendRegularFileSync, applyResolvedAssignments, assertAbsolutePathInput, assertNoSymlinkParents, assertNoSymlinkParentsSync, buildSafeExternalPrompt, buildUntrustedChannelMetadata, canonicalPathFromExistingAncestor, collectConditionalChannelFieldAssignments, collectNestedChannelFieldAssignments, collectNestedChannelTtsAssignments, collectSecretInputAssignment, collectSimpleChannelFieldAssignments, compileSafeRegex, compileSafeRegexDetailed, createResolverContext, detectSuspiciousPatterns, ensureAbsoluteDirectory, ensureDirForFile, ensurePortAvailable, evaluateSupplementalContextVisibility, expandAllowFromWithAccessGroups, extractErrorCode, filterSupplementalContextItems, findExistingAncestor, formatErrorMessage, generateSecureToken, getChannelRecord, getChannelSurface, getHookType, hasConfiguredSecretInputValue, hasNestedRepetition, hasOwnProperty, hasProxyEnvConfigured, isBaseFieldActiveForChannelSurface, isBlockedHostnameOrIp, isChannelAccountEffectivelyEnabled, isEnabledFlag, isExternalHookSession, isNonEmptyString, isNotFoundPathError, isPathInside, isPrivateNetworkAllowedByPolicy, isRecord, mapHookExternalContentSource, matchesHostnameAllowlist, movePathWithCopyFallback, normalizeHostname, normalizePositiveInt, normalizeSecretStringValue, openFileWithinRoot, openLocalFileSafely, parseAccessGroupAllowFromEntry, parseDotPath, parseEnvValue, pathExists, pathExistsSync, pathScope, privateFileStore, privateFileStoreSync, pushAssignment, pushInactiveSurfaceWarning, pushWarning, readRegularFile, readRegularFileSync, readStoreAllowFromForDmPolicy, readTextFileIfExists, redactSensitiveText, replaceFileAtomic, replaceFileAtomicSync, resolveAbsolutePathForRead, resolveAbsolutePathForWrite, resolveAccessGroupAllowFromMatches, resolveAccessGroupAllowFromState, resolveChannelAccountSurface, resolveDmAllowState, resolveDmGroupAccessDecision, resolveDmGroupAccessWithCommandGate, resolveDmGroupAccessWithLists, resolveEffectiveAllowFromLists, resolveExistingPathsWithinRoot, resolveHookExternalContentSource, resolveLocalPathFromRootsSync, resolveOpenDmAllowlistAccess, resolvePathWithinRoot, resolvePathsWithinRoot, resolvePinnedHostnameWithPolicy, resolvePinnedMainDmOwnerFromAllowlist, resolvePreferredOpenClawTmpDir, resolveRegularFileAppendFlags, resolveStrictExistingPathsWithinRoot, resolveWritablePathWithinRoot, root, safeEqualSecret, sanitizeUntrustedFileName, shouldIncludeSupplementalContext, statRegularFile, statRegularFileSync, testRegexWithBoundedInput, toDotPath, withTimeout, wrapExternalContent, wrapWebContent, writeExternalFileWithinRoot, writeFileFromPathWithinRoot, writeJsonFileSecure, writeSiblingTempFile, writeTextFileAtomic, writeViaSiblingTempPath };