openclaw/dist/provider-auth-availability-BUrlw84-.js

Multi-channel AI gateway with extensible messaging integrations

import { v as resolveDefaultAgentDir } from "./agent-scope-config-DcbEhP0R.js";
import { m as loadAuthProfileStoreWithoutExternalProfiles, o as findPersistedAuthProfileCredential, p as loadAuthProfileStoreForSecretsRuntime, r as ensureAuthProfileStore } from "./store-F1B2duCT.js";
import "./profiles-DOTqXcYA.js";
import { n as listProfilesForProvider } from "./profile-list-DyfWX-d2.js";
import { a as resolveAuthProfileOrder } from "./order-CC2RBzI5.js";
import { c as isNonSecretApiKeyMarker } from "./model-auth-markers-jBKQn38x.js";
import { t as resolveEnvApiKey } from "./model-auth-env-Dq9W4xg9.js";
import { n as externalCliDiscoveryForProviderAuth } from "./external-cli-discovery-CbeZXk1q.js";
import { r as resolveStoredCredentialReadOnlyAvailability } from "./read-only-availability-B6QkpQJd.js";
import { S as resolveUsableCustomProviderApiKey, _ as resolveProviderConfig, b as resolveProviderEntryApiKeyProfileReference, l as profileTypeToAuthMode, m as resolveDirectProviderCredentialMode } from "./model-auth-provider-config-C_kr_q2g.js";
import { n as resolveManagedSecretRefRuntimeProviderAuth } from "./model-auth-runtime-config-DpvTPuUl.js";
//#region src/plugins/provider-auth-availability.ts
/**
* Checks whether a provider has usable config/env auth or matching local auth profiles.
*/
function isProviderApiKeyConfigured(params) {
	const agentDir = params.agentDir?.trim();
	if (params.acceptsApiKey) {
		const { acceptsApiKey, ...availability } = params;
		if (!isProviderApiKeyConfigured(availability)) return false;
		const providerConfig = resolveProviderConfig(params.cfg, params.provider);
		const authoredApiKey = providerConfig?.apiKey;
		const store = agentDir ? ensureAuthProfileStore(agentDir, { allowKeychainPrompt: false }) : void 0;
		let profile = typeof authoredApiKey === "string" ? store?.profiles[authoredApiKey.trim()] : void 0;
		if (!profile && store && providerConfig?.auth !== "api-key") {
			const [profileId] = listUsableProviderAuthProfileIds(availability).profileIds;
			profile = profileId ? store.profiles[profileId] : void 0;
		}
		if (profile) {
			const credential = profile.type === "oauth" ? profile.access : profile.type === "token" ? profile.token ?? (profile.tokenRef?.source === "env" ? process.env[profile.tokenRef.id] : void 0) : profile.key ?? (profile.keyRef?.source === "env" ? process.env[profile.keyRef.id] : void 0);
			return credential === void 0 || acceptsApiKey(credential);
		}
		const configParams = {
			cfg: params.cfg,
			provider: params.provider
		};
		const configKey = resolveManagedSecretRefRuntimeProviderAuth(configParams)?.apiKey ?? resolveUsableCustomProviderApiKey(configParams)?.apiKey;
		const selectedKey = providerConfig?.auth === "api-key" && authoredApiKey !== void 0 ? configKey : resolveEnvApiKey(params.provider, process.env, { config: params.cfg })?.apiKey ?? configKey;
		return selectedKey === void 0 || acceptsApiKey(selectedKey);
	}
	if (params.cfg) {
		const allowsCredentialMode = (mode) => !params.profileTypes?.length || params.profileTypes.some((profileType) => profileTypeToAuthMode(profileType) === mode);
		const authoredApiKey = resolveProviderConfig(params.cfg, params.provider)?.apiKey;
		const profileId = typeof authoredApiKey === "string" ? authoredApiKey.trim() : void 0;
		if (agentDir && profileId) {
			const credential = findPersistedAuthProfileCredential({
				agentDir,
				profileId
			});
			if (credential) {
				const binding = resolveProviderEntryApiKeyProfileReference({
					cfg: params.cfg,
					provider: params.provider,
					store: {
						version: 1,
						profiles: { [profileId]: credential }
					}
				});
				if (binding.kind === "profile-incompatible") return false;
				if (binding.kind === "profile") return allowsCredentialMode(binding.mode) && resolveStoredCredentialReadOnlyAvailability({
					credential: binding.credential,
					cfg: params.cfg,
					env: process.env
				}) === true;
			}
		}
		const configured = resolveUsableCustomProviderApiKey({
			cfg: params.cfg,
			provider: params.provider
		});
		if (configured?.apiKey && !isNonSecretApiKeyMarker(configured.apiKey) && allowsCredentialMode(resolveDirectProviderCredentialMode({
			cfg: params.cfg,
			provider: params.provider,
			inferredMode: "api-key"
		}))) return true;
		const managed = resolveManagedSecretRefRuntimeProviderAuth({
			cfg: params.cfg,
			provider: params.provider
		});
		if (managed?.apiKey && allowsCredentialMode(managed.mode)) return true;
	}
	if (resolveEnvApiKey(params.provider)?.apiKey) return true;
	if (!agentDir) return false;
	const store = ensureAuthProfileStore(agentDir, { allowKeychainPrompt: false });
	const profileIds = listProfilesForProvider(store, params.provider);
	if (!params.profileTypes?.length) return profileIds.length > 0;
	const allowedTypes = new Set(params.profileTypes);
	return profileIds.some((profileId) => {
		const type = store.profiles[profileId]?.type;
		return type !== void 0 && allowedTypes.has(type);
	});
}
/**
* Lists auth profile ids usable for a provider without throwing on missing stores or keychain access.
*/
function listUsableProviderAuthProfileIds(params) {
	try {
		const { agentDir, profileIds, store } = resolveUsableProviderAuthProfiles(params);
		return {
			agentDir,
			profileIds: filterAuthProfileIdsByType(store, profileIds, params)
		};
	} catch {
		return {
			agentDir: "",
			profileIds: []
		};
	}
}
/**
* Checks whether any usable auth profile exists for a provider.
*/
function isProviderAuthProfileConfigured(params) {
	return listUsableProviderAuthProfileIds(params).profileIds.length > 0;
}
/**
* Resolves the first usable auth-profile API key for a provider in configured profile order.
*/
async function resolveProviderAuthProfileApiKey(params) {
	const { resolveApiKeyForProfile } = await import("./oauth-B87O-OWH.js");
	const { agentDir, profileIds, store } = resolveUsableProviderAuthProfiles(params);
	if (!agentDir || profileIds.length === 0) return;
	for (const profileId of filterAuthProfileIdsByType(store, profileIds, params)) {
		const resolved = await resolveApiKeyForProfile({
			cfg: params.cfg,
			store,
			agentDir,
			profileId
		});
		if (resolved?.apiKey) return resolved.apiKey;
	}
}
function resolveUsableProviderAuthProfiles(params) {
	const agentDir = params.agentDir?.trim() || resolveDefaultAgentDir(params.cfg ?? {});
	const externalCli = params.includeExternalCliAuth ? externalCliDiscoveryForProviderAuth({
		cfg: params.cfg,
		provider: params.provider,
		allowKeychainPrompt: params.allowKeychainPrompt
	}) : void 0;
	const store = externalCli ? loadAuthProfileStoreForSecretsRuntime(agentDir, { externalCli }) : loadAuthProfileStoreForSecretsRuntime(agentDir);
	const profileIds = resolveAuthProfileOrder({
		cfg: params.cfg,
		store,
		provider: params.provider
	});
	if (profileIds.length > 0) return {
		agentDir,
		profileIds,
		store
	};
	const fallbackStore = loadAuthProfileStoreWithoutExternalProfiles(agentDir, { allowKeychainPrompt: params.allowKeychainPrompt ?? false });
	return {
		agentDir,
		profileIds: resolveAuthProfileOrder({
			cfg: params.cfg,
			store: fallbackStore,
			provider: params.provider
		}),
		store: fallbackStore
	};
}
function filterAuthProfileIdsByType(store, profileIds, params) {
	if (!params.profileTypes?.length) return [...profileIds];
	const allowedTypes = new Set(params.profileTypes);
	return profileIds.filter((profileId) => {
		const type = store.profiles[profileId]?.type;
		return type !== void 0 && allowedTypes.has(type);
	});
}
//#endregion
export { resolveProviderAuthProfileApiKey as i, isProviderAuthProfileConfigured as n, listUsableProviderAuthProfileIds as r, isProviderApiKeyConfigured as t };