openclaw/dist/gateway-config-D8Qt3r8O.mjs

Multi-channel AI gateway with extensible messaging integrations

import { l as normalizeOptionalString } from "./string-coerce-1VuiLaaR.mjs";
import { a as createGatewayEnvSecretRef } from "./ref-contract-Bfd9_-Lp.mjs";
import { g as resolveSecretInputRef } from "./types.secrets-DD-Q2SS_.mjs";
import { t as formatCliCommand } from "./command-format-DwEdrDKL.mjs";
import { t as randomToken } from "./random-token-Sl4a6KEQ.mjs";
import { s as normalizeGatewayTokenInput } from "./onboard-helpers-CFz2hYf4.mjs";
import { t as validateDottedDecimalIPv4Input } from "./ipv4-o00URD9_.mjs";
import { t as rejectOnboardingOption } from "./onboard-options-D-LP5Q5g.mjs";
import { t as provisionGatewayTokenStoreRef } from "./auth-token-store-ref-CbHjl3AP.mjs";
//#region src/commands/onboard-non-interactive/local/gateway-config.ts
/** Applies gateway CLI options to the pending config and returns normalized runtime settings. */
async function applyNonInteractiveGatewayConfig(params) {
	const { opts, runtime } = params;
	const reject = (message) => {
		rejectOnboardingOption(opts, runtime, message);
		return null;
	};
	const existingGateway = params.nextConfig.gateway;
	const port = opts.gatewayPort ?? params.defaultPort;
	let bind = opts.gatewayBind ?? existingGateway?.bind ?? "loopback";
	const explicitAuthMode = opts.gatewayAuth;
	const hasExplicitTokenAuthInput = opts.gatewayToken !== void 0 || opts.gatewayTokenRefEnv !== void 0;
	let authMode = explicitAuthMode ?? (hasExplicitTokenAuthInput ? "token" : opts.gatewayPassword !== void 0 ? "password" : existingGateway?.auth?.mode) ?? "token";
	const tailscaleMode = opts.tailscale ?? existingGateway?.tailscale?.mode ?? "off";
	if ((opts.gatewayBind !== void 0 || opts.tailscale !== void 0) && tailscaleMode !== "off" && bind !== "loopback") bind = "loopback";
	if (bind === "custom") {
		const customBindHostIssue = validateDottedDecimalIPv4Input(normalizeOptionalString(existingGateway?.customBindHost ?? ""));
		if (customBindHostIssue) return reject(`--gateway-bind custom requires gateway.customBindHost: ${customBindHostIssue}. Set it with ${formatCliCommand("openclaw config set gateway.customBindHost <ipv4>")} and rerun, or run ${formatCliCommand("openclaw onboard")} interactively to be prompted for it.`);
	}
	const changesAuthOrTailscale = explicitAuthMode !== void 0 || hasExplicitTokenAuthInput || opts.tailscale !== void 0;
	if (changesAuthOrTailscale && tailscaleMode === "serve" && authMode === "none") authMode = "token";
	if (changesAuthOrTailscale && tailscaleMode === "funnel" && authMode !== "password") {
		if (authMode === "trusted-proxy") return reject("Tailscale Funnel requires password auth, but the Gateway is configured with \"trusted-proxy\" auth. Re-run with --gateway-auth password to switch, or keep Tailscale exposure off.");
		authMode = "password";
	}
	const nextConfig = params.nextConfig;
	let auth = existingGateway?.auth;
	const explicitGatewayToken = normalizeGatewayTokenInput(opts.gatewayToken);
	const envGatewayToken = normalizeGatewayTokenInput(process.env.OPENCLAW_GATEWAY_TOKEN);
	const existingTokenInput = nextConfig.gateway?.auth?.token;
	const existingTokenRef = resolveSecretInputRef({
		value: existingTokenInput,
		defaults: nextConfig.secrets?.defaults
	}).ref;
	const existingPlaintextToken = normalizeGatewayTokenInput(existingTokenInput);
	const gatewayToken = explicitGatewayToken || existingPlaintextToken || envGatewayToken || void 0;
	const gatewayTokenRefEnv = normalizeOptionalString(opts.gatewayTokenRefEnv ?? "") ?? "";
	if (authMode === "token") {
		auth = {
			...auth,
			mode: "token"
		};
		if (gatewayTokenRefEnv) {
			if (!process.env[gatewayTokenRefEnv]?.trim()) return reject(`Environment variable "${gatewayTokenRefEnv}" is missing or empty. Export it first, then rerun ${formatCliCommand("openclaw onboard --non-interactive")}.`);
			auth.token = createGatewayEnvSecretRef(nextConfig, gatewayTokenRefEnv);
		} else if (explicitGatewayToken || !existingTokenRef) {
			if (opts.secretInputMode !== "ref") auth.token = gatewayToken ?? randomToken();
			else if (!explicitGatewayToken && !existingPlaintextToken && envGatewayToken) auth.token = createGatewayEnvSecretRef(nextConfig, "OPENCLAW_GATEWAY_TOKEN");
			else auth.token = (await provisionGatewayTokenStoreRef({
				config: nextConfig,
				...gatewayToken ? { token: gatewayToken } : {}
			})).ref;
		}
	}
	if (authMode === "password") {
		const input = opts.gatewayPassword;
		const password = input === void 0 ? nextConfig.gateway?.auth?.password ?? normalizeOptionalString(process.env.OPENCLAW_GATEWAY_PASSWORD) : normalizeOptionalString(input);
		if (!password) return reject("Missing --gateway-password for password auth. Pass --gateway-password or use --gateway-auth token.");
		auth = {
			...auth,
			mode: "password",
			...input !== void 0 ? { password: opts.secretInputMode === "ref" ? createGatewayEnvSecretRef(nextConfig, "OPENCLAW_GATEWAY_PASSWORD") : password } : {}
		};
	}
	return {
		nextConfig: {
			...nextConfig,
			gateway: {
				...existingGateway,
				...auth ? { auth } : {},
				port,
				bind,
				tailscale: {
					...existingGateway?.tailscale,
					mode: tailscaleMode
				}
			}
		},
		port,
		bind,
		authMode,
		tailscaleMode
	};
}
//#endregion
export { applyNonInteractiveGatewayConfig as t };