perf(secrets): narrow channel secret-ref imports

docs/.generated/plugin-sdk-api-baseline.sha256

@@ -1,2 +1,2 @@
-1aafbd4e24b950c3386f5f1641e498a0060590ea6279ec5628ef0c9d62a62169  plugin-sdk-api-baseline.json
-479743ab748836a98e53797328d1831d6698ceff513a52a2dbb47a3ec183a085  plugin-sdk-api-baseline.jsonl
+2375f50cfc8f29df7de7ec84d72ea654ef6eb203204f295fc287a11d63ed2cdb  plugin-sdk-api-baseline.json
+103ee7cf995fe6a0a3d109ad4bb785d342fa1eba83e3295dee3a5ee0bb315b4a  plugin-sdk-api-baseline.jsonl

docs/plugins/sdk-overview.md

@@ -157,6 +157,7 @@ explicitly promotes one as public.
     | `plugin-sdk/command-surface` | Command-body normalization and command-surface helpers |
     | `plugin-sdk/allow-from` | `formatAllowFromLowercase` |
     | `plugin-sdk/channel-secret-runtime` | Narrow secret-contract collection helpers for channel/plugin secret surfaces |
+    | `plugin-sdk/secret-ref-runtime` | Narrow `coerceSecretRef` and SecretRef typing helpers for secret-contract/config parsing |
     | `plugin-sdk/security-runtime` | Shared trust, DM gating, external-content, and secret-collection helpers |
     | `plugin-sdk/ssrf-policy` | Host allowlist and private-network SSRF policy helpers |
     | `plugin-sdk/ssrf-runtime` | Pinned-dispatcher, SSRF-guarded fetch, and SSRF policy helpers |

extensions/bluebubbles/secret-contract-api.ts

@@ -0,0 +1,4 @@
+export {
+  collectRuntimeConfigAssignments,
+  secretTargetRegistryEntries,
+} from "./src/secret-contract.js";

extensions/googlechat/src/secret-contract.ts

@@ -9,7 +9,7 @@ import {
   type SecretDefaults,
   type SecretTargetRegistryEntry,
 } from "openclaw/plugin-sdk/channel-secret-runtime";
-import { coerceSecretRef } from "openclaw/plugin-sdk/provider-auth";
+import { coerceSecretRef } from "openclaw/plugin-sdk/secret-ref-runtime";
 
 type GoogleChatAccountLike = {
   serviceAccount?: unknown;

package.json

@@ -264,6 +264,10 @@
       "types": "./dist/plugin-sdk/channel-secret-runtime.d.ts",
       "default": "./dist/plugin-sdk/channel-secret-runtime.js"
     },
+    "./plugin-sdk/secret-ref-runtime": {
+      "types": "./dist/plugin-sdk/secret-ref-runtime.d.ts",
+      "default": "./dist/plugin-sdk/secret-ref-runtime.js"
+    },
     "./plugin-sdk/security-runtime": {
       "types": "./dist/plugin-sdk/security-runtime.d.ts",
       "default": "./dist/plugin-sdk/security-runtime.js"

scripts/lib/plugin-sdk-entrypoints.json

@@ -55,6 +55,7 @@
   "speech-core",
   "plugin-runtime",
   "channel-secret-runtime",
+  "secret-ref-runtime",
   "security-runtime",
   "gateway-runtime",
   "github-copilot-login",

src/plugin-sdk/secret-ref-runtime.ts

@@ -0,0 +1,4 @@
+// Narrow shared secret-ref helpers for plugin config and secret-contract paths.
+
+export { coerceSecretRef } from "../config/types.secrets.js";
+export type { SecretInput, SecretRef } from "../config/types.secrets.js";