From d565c2cc343f4814e7999b8281b168e8310c5016 Mon Sep 17 00:00:00 2001
From: Peter Steinberger <steipete@gmail.com>
Date: Fri, 17 Apr 2026 16:28:15 +0100
Subject: [PATCH] perf: add lightweight secret input runtime

---
 extensions/matrix/src/account-selection.ts | 2 +-
 package.json                               | 4 ++++
 scripts/lib/plugin-sdk-entrypoints.json    | 1 +
 src/plugin-sdk/secret-input-runtime.ts     | 6 ++++++
 4 files changed, 12 insertions(+), 1 deletion(-)

diff --git a/extensions/matrix/src/account-selection.ts b/extensions/matrix/src/account-selection.ts
index 1ef021e1fe2..05597085a6e 100644
--- a/extensions/matrix/src/account-selection.ts
+++ b/extensions/matrix/src/account-selection.ts
@@ -10,7 +10,7 @@ import {
   normalizeOptionalAccountId,
 } from "openclaw/plugin-sdk/account-id";
 import type { OpenClawConfig } from "openclaw/plugin-sdk/config-runtime";
-import { hasConfiguredSecretInput } from "openclaw/plugin-sdk/secret-input";
+import { hasConfiguredSecretInput } from "openclaw/plugin-sdk/secret-input-runtime";
 import { normalizeOptionalString } from "openclaw/plugin-sdk/string-coerce-runtime";
 import {
   resolveMatrixAccountStringValues,
diff --git a/package.json b/package.json
index cba1a2943bf..077917bc926 100644
--- a/package.json
+++ b/package.json
@@ -1084,6 +1084,10 @@
       "types": "./dist/plugin-sdk/secret-input.d.ts",
       "default": "./dist/plugin-sdk/secret-input.js"
     },
+    "./plugin-sdk/secret-input-runtime": {
+      "types": "./dist/plugin-sdk/secret-input-runtime.d.ts",
+      "default": "./dist/plugin-sdk/secret-input-runtime.js"
+    },
     "./plugin-sdk/channel-status": {
       "types": "./dist/plugin-sdk/channel-status.d.ts",
       "default": "./dist/plugin-sdk/channel-status.js"
diff --git a/scripts/lib/plugin-sdk-entrypoints.json b/scripts/lib/plugin-sdk-entrypoints.json
index c00ac7223f1..1ae4f1822a0 100644
--- a/scripts/lib/plugin-sdk-entrypoints.json
+++ b/scripts/lib/plugin-sdk-entrypoints.json
@@ -257,6 +257,7 @@
   "param-readers",
   "provider-zai-endpoint",
   "secret-input",
+  "secret-input-runtime",
   "channel-status",
   "status-helpers",
   "speech",
diff --git a/src/plugin-sdk/secret-input-runtime.ts b/src/plugin-sdk/secret-input-runtime.ts
index f0dff88987d..079ea26bdd4 100644
--- a/src/plugin-sdk/secret-input-runtime.ts
+++ b/src/plugin-sdk/secret-input-runtime.ts
@@ -1,5 +1,11 @@
 export {
+  coerceSecretRef,
   hasConfiguredSecretInput,
+  isSecretRef,
   normalizeResolvedSecretInputString,
   normalizeSecretInputString,
+  resolveSecretInputString,
+  type SecretInput,
+  type SecretInputStringResolution,
+  type SecretInputStringResolutionMode,
 } from "../config/types.secrets.js";