openclaw/dist/auth-token-store-ref-CbHjl3AP.mjs

Multi-channel AI gateway with extensible messaging integrations

import { l as normalizeOptionalString } from "./string-coerce-1VuiLaaR.mjs";
import { h as resolveDefaultSecretProviderAlias } from "./ref-contract-Bfd9_-Lp.mjs";
import { r as assertSecretStoreValue } from "./secret-store-validation-DiqaFVNK.mjs";
import { a as readSecretStoreValue, l as writeSecretStoreEntry } from "./secret-store-CnrQoIoy.mjs";
import { t as randomToken } from "./random-token-Sl4a6KEQ.mjs";
//#region src/gateway/auth-token-store-ref.ts
/** Store entry name for the gateway token; mirrors the documented env-var contract. */
const GATEWAY_AUTH_TOKEN_STORE_NAME = "OPENCLAW_GATEWAY_TOKEN";
const GATEWAY_AUTH_TOKEN_STORE_SCOPE = { kind: "team" };
async function readStoredGatewayToken() {
	const existing = await readSecretStoreValue({
		scope: GATEWAY_AUTH_TOKEN_STORE_SCOPE,
		name: GATEWAY_AUTH_TOKEN_STORE_NAME
	});
	return existing.ok ? normalizeOptionalString(existing.value) : void 0;
}
/**
* Provisions the gateway token in the secret store and returns the ref config points at.
*
* Omit `token` when setup has no value of its own: an existing store entry then wins so
* reruns never rotate a token already paired with clients or a running service, and a
* fresh one is minted otherwise. A supplied token always wins, which also migrates a
* previously persisted plaintext token without invalidating it. The store write stays
* ahead of the config write on purpose — a ref persisted without its value would leave
* the gateway unauthenticatable, while an entry whose config write later fails is simply
* picked up by the next run.
*/
async function provisionGatewayTokenStoreRef(params) {
	const stored = params.token ? void 0 : await readStoredGatewayToken();
	const token = params.token ?? stored ?? randomToken();
	assertSecretStoreValue(token, "secret", GATEWAY_AUTH_TOKEN_STORE_NAME);
	if (token !== stored) await writeSecretStoreEntry({
		scope: GATEWAY_AUTH_TOKEN_STORE_SCOPE,
		name: GATEWAY_AUTH_TOKEN_STORE_NAME,
		value: token,
		kind: "secret",
		updatedBy: "setup"
	});
	return {
		ref: {
			source: "store",
			provider: resolveDefaultSecretProviderAlias(params.config, "store", { preferFirstProviderForSource: true }),
			id: GATEWAY_AUTH_TOKEN_STORE_NAME
		},
		token
	};
}
//#endregion
export { provisionGatewayTokenStoreRef as t };