openclaw/dist/models-config.providers.discovery-auth.runtime-BznvhD7J.js

Multi-channel AI gateway with extensible messaging integrations

import { s as coerceSecretRef } from "./types.secrets-kC0nOetj.js";
import { f as secretRefKey } from "./ref-contract-D92DqQ-r.js";
import { n as resolveApiKeyForProfile } from "./oauth-BNreHOU-.js";
import { t as resolveAuthProfileSecretOwnerId } from "./runtime-auth-profile-owner-DA1NOJfL.js";
import { n as SecretSurfaceUnavailableError } from "./runtime-degraded-state-D5EZZ925.js";
//#region src/agents/models-config.providers.discovery-auth.runtime.ts
/** Prepares transient auth facts without changing synchronous catalog callback contracts. */
async function prepareProviderDiscoveryAuth({ agentDir, authStore, resolveProviderApiKey, resolveProviderAuth }, config) {
	const profiles = /* @__PURE__ */ new Map();
	for (const [profileId, credential] of Object.entries(authStore.profiles)) {
		const field = credential.type === "api_key" ? "key" : "token";
		const ref = coerceSecretRef(credential.type === "api_key" ? credential.keyRef : credential.type === "token" ? credential.tokenRef : void 0, config?.secrets?.defaults);
		if (!ref || ref.source === "env") continue;
		try {
			const resolved = await resolveApiKeyForProfile({
				cfg: config,
				store: authStore,
				profileId,
				agentDir,
				allowProfileFallback: false
			});
			if (!resolved) throw new SecretSurfaceUnavailableError({
				ownerKind: "account",
				ownerId: resolveAuthProfileSecretOwnerId({
					agentDir,
					profileId
				}),
				state: "unavailable",
				paths: [`auth-profiles.${profileId}.${field}`],
				refKeys: [secretRefKey(ref)],
				reason: "resolved secret value was invalid"
			});
			profiles.set(profileId, () => resolved.apiKey);
		} catch (error) {
			profiles.set(profileId, () => {
				throw error;
			});
		}
	}
	const enrich = (auth) => {
		const resolve = auth.profileId ? profiles.get(auth.profileId) : void 0;
		return resolve ? {
			...auth,
			discoveryApiKey: resolve()
		} : auth;
	};
	return {
		resolveProviderApiKey: (provider) => enrich(resolveProviderApiKey(provider)),
		resolveProviderAuth: (provider, options) => enrich(resolveProviderAuth(provider, options))
	};
}
//#endregion
export { prepareProviderDiscoveryAuth };