openclaw/dist/provider-auth-aliases-DhA9c2am.js

Multi-channel AI gateway with extensible messaging integrations

import { c as normalizeOptionalLowercaseString } from "./string-coerce-CIXf7egm.js";
import { r as normalizeProviderId } from "./provider-id-DMd-TDFp.js";
import { l as normalizePluginsConfig } from "./config-state-BkU1frVq.js";
import { n as getCurrentPluginMetadataSnapshot } from "./current-plugin-metadata-snapshot-CmSX4G3W.js";
import { a as loadPluginMetadataSnapshot, f as buildPluginMetadataProviderAuthAliases } from "./plugin-metadata-snapshot-w-4EjxI4.js";
//#region src/plugins/plugin-config-trust.ts
/** Applies workspace plugin allow/deny config before manifest records reach control-plane decisions. */
/** Normalizes plugin ids used in config allow/deny/entry lists. */
function normalizePluginConfigId(id) {
	return normalizeOptionalLowercaseString(id) ?? "";
}
function hasPluginConfigId(list, pluginId) {
	return Array.isArray(list) && list.some((entry) => normalizePluginConfigId(entry) === pluginId);
}
function findPluginConfigEntry(entries, pluginId) {
	if (!entries || typeof entries !== "object" || Array.isArray(entries)) return;
	for (const [key, value] of Object.entries(entries)) {
		if (normalizePluginConfigId(key) !== pluginId) continue;
		return value && typeof value === "object" && !Array.isArray(value) ? value : {};
	}
}
/** Resolves whether workspace plugin config allows one plugin manifest record. */
function isWorkspacePluginAllowedByConfig(params) {
	const pluginsConfig = params.config?.plugins;
	if (pluginsConfig?.enabled === false) return false;
	const pluginId = normalizePluginConfigId(params.plugin.id);
	if (!pluginId || hasPluginConfigId(pluginsConfig?.deny, pluginId)) return false;
	const entry = findPluginConfigEntry(pluginsConfig?.entries, pluginId);
	if (entry?.enabled === false) return false;
	if (entry?.enabled === true || hasPluginConfigId(pluginsConfig?.allow, pluginId)) return true;
	return params.isImplicitlyAllowed?.(pluginId) ?? false;
}
//#endregion
//#region src/agents/provider-auth-aliases.ts
/**
* Provider auth alias resolution.
* Maps deprecated and plugin-defined provider IDs to canonical credential
* providers, with trusted workspace plugin handling and snapshot-owned metadata.
*/
function shouldUsePluginAuthAliases(plugin, params) {
	if (plugin.origin !== "workspace" || params?.includeUntrustedWorkspacePlugins === true) return true;
	return isWorkspacePluginAllowedByConfig({
		config: params?.config,
		isImplicitlyAllowed: (pluginId) => normalizePluginConfigId(params?.config?.plugins?.slots?.contextEngine) === pluginId,
		plugin
	});
}
function resolveProviderAuthAliasCandidates(params) {
	const config = params?.config;
	const context = {
		env: params?.env ?? process.env,
		workspaceDir: params?.workspaceDir
	};
	const lookup = {
		...context,
		allowWorkspaceScopedSnapshot: true
	};
	const snapshot = params?.metadataSnapshot ?? getCurrentPluginMetadataSnapshot({
		...lookup,
		config,
		requireDefaultDiscoveryContext: !config
	}) ?? (config && normalizePluginsConfig(config.plugins).loadPaths.length === 0 ? getCurrentPluginMetadataSnapshot({
		...lookup,
		requireDefaultDiscoveryContext: true
	}) : void 0) ?? loadPluginMetadataSnapshot({
		...context,
		config: config ?? {}
	});
	return snapshot.owners?.providerAuthAliases ?? buildPluginMetadataProviderAuthAliases(snapshot.plugins);
}
/** Resolve canonical auth provider aliases from plugin metadata. */
function resolveProviderAuthAliasMap(params) {
	const allowedPlugins = /* @__PURE__ */ new Map();
	const selected = [];
	for (const [alias, candidates] of resolveProviderAuthAliasCandidates(params)) {
		let preferred;
		let order = Infinity;
		for (const candidate of candidates) {
			const { plugin } = candidate;
			const allowed = allowedPlugins.get(plugin) ?? shouldUsePluginAuthAliases(plugin, params);
			allowedPlugins.set(plugin, allowed);
			if (allowed) {
				preferred ??= candidate;
				order = Math.min(order, candidate.order);
			}
		}
		if (preferred) selected.push({
			alias,
			target: preferred.target,
			order
		});
	}
	const aliases = Object.create(null);
	for (const { alias, target } of selected.toSorted((left, right) => left.order - right.order)) aliases[alias] = target;
	return aliases;
}
/** Resolve the provider ID that should be used for credential lookup. */
function resolveProviderIdForAuth(provider, params) {
	const normalized = normalizeProviderId(provider);
	if (!normalized) return normalized;
	return resolveProviderAuthAliasCandidates(params).get(normalized)?.find((candidate) => shouldUsePluginAuthAliases(candidate.plugin, params))?.target ?? normalized;
}
//#endregion
export { normalizePluginConfigId as i, resolveProviderIdForAuth as n, isWorkspacePluginAllowedByConfig as r, resolveProviderAuthAliasMap as t };