openclaw/dist/models-config.providers.secrets-CzQJN999.js

Multi-channel AI gateway with extensible messaging integrations

import { r as normalizeProviderId } from "./provider-id-DMd-TDFp.js";
import { f as secretRefKey } from "./ref-contract-D92DqQ-r.js";
import { u as resolveConfigSecretRef } from "./resolution-facts-Dks1tbik.js";
import { n as SecretSurfaceUnavailableError } from "./runtime-degraded-state-D5EZZ925.js";
import { n as listProfilesForProvider } from "./profile-list-DyfWX-d2.js";
import { c as isNonSecretApiKeyMarker, f as resolveNonEnvSecretRefApiKeyMarker, g as resolveProviderEnvAuthLookupMaps, m as resolveOAuthApiKeyMarker, s as isKnownEnvApiKeyMarker } from "./model-auth-markers-jBKQn38x.js";
import { O as resolveProviderSyntheticAuthWithPlugin } from "./provider-runtime-BRJDPNgk.js";
import { a as resolveApiKeyFromCredential, l as toDiscoveryApiKey, o as resolveApiKeyFromProfiles, s as resolveEnvApiKeyVarName } from "./models-config.providers.secret-helpers-DC_SfKyR.js";
//#region src/agents/models-config.providers.secrets.ts
/**
* Provider auth resolution entry points used during model config generation.
* The resolvers return env/profile/config marker values so discovery can prove
* auth availability without writing secret material into generated config.
*/
function resolveAuthProfileStoreInput(input) {
	return typeof input === "function" ? input() : input;
}
/** Create a resolver over the credential map already selected for one lifecycle generation. */
function createProviderApiKeyResolverFromPreparedCredentials(env, credentials, config, workspaceDir) {
	const resolveConfiguredOrEnvironment = createProviderApiKeyResolver(env, {
		version: 1,
		profiles: {}
	}, config, void 0, workspaceDir);
	const getLookupCaches = createProviderAuthLookupCaches(env, config);
	return (provider) => {
		const authProvider = resolveProviderIdForAuthFromCaches(provider, getLookupCaches());
		const credential = credentials[authProvider];
		if (!credential) return resolveConfiguredOrEnvironment(provider);
		if (credential.type === "oauth") return {
			apiKey: resolveOAuthApiKeyMarker(authProvider),
			discoveryApiKey: toDiscoveryApiKey(credential.access)
		};
		if (credential.type === "token") {
			if (!credential.token.trim() || credential.expires !== void 0 && Date.now() >= credential.expires) return resolveConfiguredOrEnvironment(provider);
			return {
				apiKey: credential.token,
				discoveryApiKey: toDiscoveryApiKey(credential.token)
			};
		}
		if (!credential.key.trim()) return resolveConfiguredOrEnvironment(provider);
		return {
			apiKey: credential.key,
			discoveryApiKey: toDiscoveryApiKey(credential.key)
		};
	};
}
function createProviderAuthLookupCaches(env, config) {
	let caches;
	return () => {
		if (!caches) {
			const lookupMaps = resolveProviderEnvAuthLookupMaps({
				config,
				env
			});
			caches = {
				aliasMap: lookupMaps.aliasMap,
				candidateMap: lookupMaps.envCandidateMap,
				authEvidenceMap: lookupMaps.authEvidenceMap
			};
		}
		return caches;
	};
}
function resolveProviderIdForAuthFromCaches(provider, caches) {
	const normalized = normalizeProviderId(provider);
	if (!normalized) return normalized;
	return caches.aliasMap[normalized] ?? normalized;
}
/** Create a resolver that returns redacted API-key markers for provider discovery. */
function createProviderApiKeyResolver(env, authStoreInput, config, sourceConfigForSecrets, workspaceDir, syntheticAuthEnv = env) {
	const getLookupCaches = createProviderAuthLookupCaches(env, config);
	return (provider) => {
		const lookupCaches = getLookupCaches();
		const authProvider = resolveProviderIdForAuthFromCaches(provider, lookupCaches);
		const envVar = resolveEnvApiKeyVarName(authProvider, env, {
			aliasMap: lookupCaches.aliasMap,
			candidateMap: lookupCaches.candidateMap,
			authEvidenceMap: lookupCaches.authEvidenceMap
		});
		if (envVar) return {
			apiKey: envVar,
			discoveryApiKey: toDiscoveryApiKey(env[envVar])
		};
		const fromConfig = resolveConfigBackedProviderAuth({
			provider: authProvider,
			config,
			env,
			sourceConfigForSecrets,
			workspaceDir,
			syntheticAuthEnv
		});
		if (fromConfig?.apiKey) return {
			apiKey: fromConfig.apiKey,
			discoveryApiKey: fromConfig.discoveryApiKey
		};
		const fromProfiles = resolveApiKeyFromProfiles({
			provider: authProvider,
			store: resolveAuthProfileStoreInput(authStoreInput),
			env
		});
		return fromProfiles?.apiKey ? {
			apiKey: fromProfiles.apiKey,
			discoveryApiKey: fromProfiles.discoveryApiKey,
			profileId: fromProfiles.profileId
		} : {
			apiKey: void 0,
			discoveryApiKey: void 0
		};
	};
}
/** Create a resolver that reports provider auth mode and provenance. */
function createProviderAuthResolver(env, authStoreInput, config, sourceConfigForSecrets, workspaceDir, syntheticAuthEnv = env) {
	const getLookupCaches = createProviderAuthLookupCaches(env, config);
	return (provider, options) => {
		const lookupCaches = getLookupCaches();
		const authProvider = resolveProviderIdForAuthFromCaches(provider, lookupCaches);
		const authStore = resolveAuthProfileStoreInput(authStoreInput);
		const ids = listProfilesForProvider(authStore, authProvider);
		let oauthCandidate;
		for (const id of ids) {
			const cred = authStore.profiles[id];
			if (!cred) continue;
			if (cred.type === "oauth") {
				oauthCandidate ??= {
					apiKey: options?.oauthMarker,
					discoveryApiKey: toDiscoveryApiKey(cred.access),
					mode: "oauth",
					source: "profile",
					profileId: id
				};
				continue;
			}
			const resolved = resolveApiKeyFromCredential(cred, env);
			if (!resolved) continue;
			return {
				apiKey: resolved.apiKey,
				discoveryApiKey: resolved.discoveryApiKey,
				mode: cred.type,
				source: "profile",
				profileId: id
			};
		}
		if (oauthCandidate) return oauthCandidate;
		const envVar = resolveEnvApiKeyVarName(authProvider, env, {
			aliasMap: lookupCaches.aliasMap,
			candidateMap: lookupCaches.candidateMap,
			authEvidenceMap: lookupCaches.authEvidenceMap
		});
		if (envVar) return {
			apiKey: envVar,
			discoveryApiKey: toDiscoveryApiKey(env[envVar]),
			mode: "api_key",
			source: "env"
		};
		const fromConfig = resolveConfigBackedProviderAuth({
			provider: authProvider,
			config,
			env,
			sourceConfigForSecrets,
			workspaceDir,
			syntheticAuthEnv
		});
		if (fromConfig) return {
			apiKey: fromConfig.apiKey,
			discoveryApiKey: fromConfig.discoveryApiKey,
			mode: fromConfig.mode,
			source: "none"
		};
		return {
			apiKey: void 0,
			discoveryApiKey: void 0,
			mode: "none",
			source: "none"
		};
	};
}
function resolveConfigBackedProviderAuth(params) {
	const authProvider = params.provider;
	const apiKeyPath = `models.providers.${authProvider}.apiKey`;
	const sourceRef = resolveConfigSecretRef({
		config: params.sourceConfigForSecrets,
		path: apiKeyPath,
		value: params.sourceConfigForSecrets?.models?.providers?.[authProvider]?.apiKey,
		defaults: params.sourceConfigForSecrets?.secrets?.defaults
	});
	if (sourceRef && sourceRef.source !== "env") {
		const discoveryApiKey = params.config?.models?.providers?.[authProvider]?.apiKey;
		if (typeof discoveryApiKey !== "string" || !discoveryApiKey.trim()) throw new SecretSurfaceUnavailableError({
			ownerKind: "provider",
			ownerId: authProvider,
			state: "unavailable",
			paths: [`models.providers.${authProvider}.apiKey`],
			refKeys: [secretRefKey(sourceRef)],
			reason: "secret reference was not materialized by the active runtime"
		});
		return {
			apiKey: resolveNonEnvSecretRefApiKeyMarker(sourceRef.source),
			discoveryApiKey,
			mode: "api_key"
		};
	}
	const apiKey = resolveProviderSyntheticAuthWithPlugin({
		provider: authProvider,
		config: params.config,
		env: params.syntheticAuthEnv ?? params.env,
		workspaceDir: params.workspaceDir,
		context: {
			config: params.config,
			provider: authProvider,
			providerConfig: params.config?.models?.providers?.[authProvider]
		}
	})?.apiKey?.trim();
	if (apiKey) return {
		apiKey: isNonSecretApiKeyMarker(apiKey) ? apiKey : resolveNonEnvSecretRefApiKeyMarker("file"),
		discoveryApiKey: toDiscoveryApiKey(apiKey),
		mode: "api_key"
	};
	const configuredProviderApiKey = (params.config?.models?.providers?.[authProvider])?.apiKey;
	const configuredApiKeyRef = resolveConfigSecretRef({
		config: params.config,
		path: apiKeyPath,
		value: configuredProviderApiKey,
		defaults: params.config?.secrets?.defaults
	});
	if (configuredApiKeyRef) {
		if (configuredApiKeyRef.source === "env") {
			const envVar = configuredApiKeyRef.id.trim();
			const envValue = params.env?.[envVar]?.trim();
			return envValue ? {
				apiKey: envVar,
				discoveryApiKey: toDiscoveryApiKey(envValue),
				mode: "api_key"
			} : void 0;
		}
		return {
			apiKey: resolveNonEnvSecretRefApiKeyMarker(configuredApiKeyRef.source),
			mode: "api_key"
		};
	}
	if (typeof configuredProviderApiKey !== "string") return;
	const configuredApiKey = configuredProviderApiKey.trim();
	if (!configuredApiKey) return;
	if (isKnownEnvApiKeyMarker(configuredApiKey)) {
		const envValue = params.env?.[configuredApiKey]?.trim();
		if (envValue) return {
			apiKey: configuredApiKey,
			discoveryApiKey: toDiscoveryApiKey(envValue),
			mode: "api_key"
		};
		return;
	}
	return {
		apiKey: configuredApiKey,
		discoveryApiKey: toDiscoveryApiKey(configuredApiKey),
		mode: "api_key"
	};
}
//#endregion
export { createProviderApiKeyResolverFromPreparedCredentials as n, createProviderAuthResolver as r, createProviderApiKeyResolver as t };