openclaw/dist/runtime-prepare.runtime-BFvatQld.js

Multi-channel AI gateway with extensible messaging integrations

import { c as normalizeOptionalLowercaseString } from "./string-coerce-CIXf7egm.js";
import { v as resolveSecretInputRef } from "./types.secrets-kC0nOetj.js";
import { t as isNonEmptyString } from "./shared-CeAc-MzA.js";
import { d as pushWarning, i as createResolverContext, n as collectRuntimeSecretInputAssignment, t as applyResolvedAssignments } from "./runtime-shared-CqbaocQu.js";
import { r as resolveSecretRefValues } from "./resolve-224YoYfx.js";
import { t as resolveAuthProfileSecretOwnerId } from "./runtime-auth-profile-owner-DA1NOJfL.js";
import { t as assertNoOAuthSecretRefPolicyViolations } from "./policy-DzU6nQxS.js";
import { i as resolveAuthProfileEligibility } from "./order-CC2RBzI5.js";
import { t as collectConfigAssignments } from "./runtime-config-collectors-C6FGy6ti.js";
import { a as setSecretAssignmentSource } from "./runtime-owner-assignments-CLf4mfX3.js";
import { t as resolveRuntimeWebTools } from "./runtime-web-tools-DYZFauRm.js";
//#region src/secrets/runtime-auth-collectors.ts
/** Collects auth-profile and OAuth secret refs for runtime preparation. */
function resolveAuthProfileOwnerContract(profile, context) {
	const providerId = normalizeOptionalLowercaseString(profile.provider) ?? profile.provider;
	const configuredProvider = Object.entries(context.sourceConfig.models?.providers ?? {}).find(([candidateId]) => (normalizeOptionalLowercaseString(candidateId) ?? candidateId) === providerId);
	return {
		profile: structuredClone(profile),
		providerId,
		configuredProvider
	};
}
function collectAuthStoreSecretInputAssignment(params) {
	const previousCount = params.context.assignments.length;
	collectRuntimeSecretInputAssignment(params);
	for (const assignment of params.context.assignments.slice(previousCount)) setSecretAssignmentSource(assignment, "auth-store");
}
function collectApiKeyProfileAssignment(params) {
	const ownerContract = resolveAuthProfileOwnerContract(params.profile, params.context);
	const { explicitRef: keyRef, inlineRef: inlineKeyRef, ref: resolvedKeyRef } = resolveSecretInputRef({
		value: params.profile.key,
		refValue: params.profile.keyRef,
		defaults: params.defaults
	});
	if (!resolvedKeyRef) return;
	if (!keyRef && inlineKeyRef) params.profile.keyRef = inlineKeyRef;
	if (keyRef && isNonEmptyString(params.profile.key)) pushWarning(params.context, {
		code: "SECRETS_REF_OVERRIDES_PLAINTEXT",
		path: `${params.agentDir}.auth-profiles.${params.profileId}.key`,
		message: `auth-profiles ${params.profileId}: keyRef is set; runtime will ignore plaintext key.`
	});
	params.profile.key = void 0;
	const eligibility = resolveAuthProfileEligibility({
		cfg: params.context.sourceConfig,
		authAliasLookupParams: params.authAliasLookupParams,
		store: params.store,
		provider: params.profile.provider,
		profileId: params.profileId
	});
	collectAuthStoreSecretInputAssignment({
		value: resolvedKeyRef,
		path: `${params.agentDir}.auth-profiles.${params.profileId}.key`,
		expected: "string",
		defaults: params.defaults,
		context: params.context,
		active: eligibility.eligible,
		inactiveReason: `auth profile is not eligible (${eligibility.reasonCode}); skipping resolution until it becomes eligible.`,
		owner: {
			ownerKind: "account",
			ownerId: resolveAuthProfileSecretOwnerId(params),
			requiredForGateway: false,
			disposition: "isolate",
			contract: ownerContract
		},
		apply: (value) => {
			params.profile.key = String(value);
		},
		applyUnavailable: () => {
			params.profile.key = void 0;
		}
	});
}
function collectTokenProfileAssignment(params) {
	const ownerContract = resolveAuthProfileOwnerContract(params.profile, params.context);
	const { explicitRef: tokenRef, inlineRef: inlineTokenRef, ref: resolvedTokenRef } = resolveSecretInputRef({
		value: params.profile.token,
		refValue: params.profile.tokenRef,
		defaults: params.defaults
	});
	if (!resolvedTokenRef) return;
	if (!tokenRef && inlineTokenRef) params.profile.tokenRef = inlineTokenRef;
	if (tokenRef && isNonEmptyString(params.profile.token)) pushWarning(params.context, {
		code: "SECRETS_REF_OVERRIDES_PLAINTEXT",
		path: `${params.agentDir}.auth-profiles.${params.profileId}.token`,
		message: `auth-profiles ${params.profileId}: tokenRef is set; runtime will ignore plaintext token.`
	});
	params.profile.token = void 0;
	const eligibility = resolveAuthProfileEligibility({
		cfg: params.context.sourceConfig,
		authAliasLookupParams: params.authAliasLookupParams,
		store: params.store,
		provider: params.profile.provider,
		profileId: params.profileId
	});
	collectAuthStoreSecretInputAssignment({
		value: resolvedTokenRef,
		path: `${params.agentDir}.auth-profiles.${params.profileId}.token`,
		expected: "string",
		defaults: params.defaults,
		context: params.context,
		active: eligibility.eligible,
		inactiveReason: `auth profile is not eligible (${eligibility.reasonCode}); skipping resolution until it becomes eligible.`,
		owner: {
			ownerKind: "account",
			ownerId: resolveAuthProfileSecretOwnerId(params),
			requiredForGateway: false,
			disposition: "isolate",
			contract: ownerContract
		},
		apply: (value) => {
			params.profile.token = String(value);
		},
		applyUnavailable: () => {
			params.profile.token = void 0;
		}
	});
}
/** Collects SecretRef assignments from agent auth-profile stores for runtime materialization. */
function collectAuthStoreAssignments(params) {
	assertNoOAuthSecretRefPolicyViolations({
		store: params.store,
		cfg: params.context.sourceConfig,
		context: `auth-profiles ${params.agentDir}`
	});
	const defaults = params.context.sourceConfig.secrets?.defaults;
	const authAliasLookupParams = {
		env: params.context.env,
		...params.context.manifestRegistry ? { metadataSnapshot: params.context.manifestRegistry } : {}
	};
	for (const [profileId, profile] of Object.entries(params.store.profiles)) {
		if (profile.type === "api_key") {
			collectApiKeyProfileAssignment({
				profile,
				profileId,
				store: params.store,
				agentDir: params.agentDir,
				defaults,
				authAliasLookupParams,
				context: params.context
			});
			continue;
		}
		if (profile.type === "token") collectTokenProfileAssignment({
			profile,
			profileId,
			store: params.store,
			agentDir: params.agentDir,
			defaults,
			authAliasLookupParams,
			context: params.context
		});
	}
}
//#endregion
export { applyResolvedAssignments, collectAuthStoreAssignments, collectConfigAssignments, createResolverContext, resolveRuntimeWebTools, resolveSecretRefValues };