openclaw/dist/cli-execution-auth-Bmv6hc3N.mjs

Multi-channel AI gateway with extensible messaging integrations

import { o as resolveAuthProfileOrderWithMetadata } from "./order-C69p83pK.mjs";
import { o as loadAuthProfileStoreForRuntime } from "./store-runtime-DPTEKEq5.mjs";
import { a as resolveCliBackendConfig, s as resolveCliRuntimeCanonicalProvider } from "./cli-backends-CMl10xFW.mjs";
import { t as resolveBundledCliBackendAuthPolicy } from "./cli-backend-auth-policy-BJQR9lNK.mjs";
//#region src/agents/cli-execution-auth.ts
const GOOGLE_GEMINI_CLI_PROVIDER_ID = "google-gemini-cli";
const GOOGLE_PROVIDER_ID = "google";
const CLAUDE_CLI_PROVIDER_ID = "claude-cli";
var CliExecutionAuthProfileError = class extends Error {
	constructor(..._args) {
		super(..._args);
		this.name = "CliExecutionAuthProfileError";
	}
};
function cliBackendAcceptsAuthProfileForwarding(params) {
	const backend = resolveCliBackendConfig(params.provider, params.config, { agentId: params.agentId });
	return backend?.id === GOOGLE_GEMINI_CLI_PROVIDER_ID || backend?.id === CLAUDE_CLI_PROVIDER_ID;
}
/**
* Preserve the session account unless the user selects another or it was removed.
* A user-locked profile must fail closed rather than run as another user.
*/
function selectCliExecutionAuthProfile(params) {
	const { store } = params;
	const selectedAuthProfileId = params.selected?.authProfileId?.trim();
	const hasExplicitSelection = selectedAuthProfileId && params.selected?.authProfileIdSource !== "auto";
	const sessionAuthProfileId = params.sessionBinding?.authProfileId?.trim();
	const nativeAuthProfileIds = resolveBundledCliBackendAuthPolicy(params.cliExecutionProvider)?.nativeAuthProfileIds;
	if (!hasExplicitSelection && params.sessionBinding && !sessionAuthProfileId) return;
	const retainedProfileId = hasExplicitSelection ? selectedAuthProfileId : sessionAuthProfileId && (store.profiles[sessionAuthProfileId] || nativeAuthProfileIds?.includes(sessionAuthProfileId)) ? sessionAuthProfileId : void 0;
	const nativeProfileId = retainedProfileId ?? selectedAuthProfileId;
	if (nativeProfileId && nativeAuthProfileIds?.includes(nativeProfileId)) return;
	const canonicalProvider = resolveCliRuntimeCanonicalProvider({
		runtime: params.cliExecutionProvider,
		config: params.config,
		includeSetupRegistry: true,
		metadataSnapshot: params.metadataSnapshot
	});
	const acceptsCredential = (credential, explicitSelection) => credential.provider === params.cliExecutionProvider || credential.provider === canonicalProvider && (params.cliExecutionProvider === CLAUDE_CLI_PROVIDER_ID ? explicitSelection || credential.type !== "api_key" : params.cliExecutionProvider === GOOGLE_GEMINI_CLI_PROVIDER_ID && credential.type === "api_key");
	if (retainedProfileId) {
		const credential = store.profiles[retainedProfileId];
		if (!credential) throw new CliExecutionAuthProfileError(`No credentials found for profile "${retainedProfileId}".`);
		if (acceptsCredential(credential, true)) return {
			profileId: retainedProfileId,
			provider: credential.provider
		};
		throw new CliExecutionAuthProfileError(`CLI backend "${params.cliExecutionProvider}" cannot use auth profile "${retainedProfileId}" owned by "${credential.provider}".`);
	}
	const providers = [params.cliExecutionProvider];
	if (canonicalProvider && (params.cliExecutionProvider === CLAUDE_CLI_PROVIDER_ID || params.cliExecutionProvider === GOOGLE_GEMINI_CLI_PROVIDER_ID && params.authProfileProvider === GOOGLE_PROVIDER_ID)) providers.push(canonicalProvider);
	for (const provider of providers) {
		const order = resolveAuthProfileOrderWithMetadata({
			cfg: params.config,
			store,
			provider,
			preferredProfile: selectedAuthProfileId,
			readinessMode: params.readinessMode,
			authAliasLookupParams: { metadataSnapshot: params.metadataSnapshot }
		});
		for (const profileId of order.profileIds) {
			const credential = store.profiles[profileId];
			if (credential && acceptsCredential(credential, false) && !nativeAuthProfileIds?.includes(profileId)) return {
				profileId,
				provider: credential.provider
			};
		}
		if (order.hasExplicitOrder) return;
	}
}
function resolveCliExecutionAuthProfileId(params) {
	const loadStore = params.loadAuthProfileStoreForRuntime ?? loadAuthProfileStoreForRuntime;
	const selected = params.selected?.authProfileId?.trim();
	const store = loadStore(params.agentDir, {
		readOnly: true,
		allowKeychainPrompt: false,
		externalCliProviderIds: [params.cliExecutionProvider],
		profileId: selected && params.selected?.authProfileIdSource !== "auto" ? selected : params.sessionBinding?.authProfileId?.trim() ?? selected
	});
	return selectCliExecutionAuthProfile({
		...params,
		store
	})?.profileId;
}
//#endregion
export { resolveCliExecutionAuthProfileId as n, selectCliExecutionAuthProfile as r, cliBackendAcceptsAuthProfileForwarding as t };