@vibe-lark/larkpal 0.1.85 → 0.1.86

package/dist/model-auth-env-oyg2Hexc-DU_rOUU5.mjs

@@ -0,0 +1,1306 @@
+import { c as normalizeOptionalString } from "./home-dir-C44RaPME-CBRS4HLP.mjs";
+import { a as resolveOAuthPath, o as resolveStateDir } from "./paths-D92DjaZ--CTOESW2b.mjs";
+import { l as resolveUserPath } from "./bundled-dir-U738ay4K-DXK0q_TV.mjs";
+import { c as resolveProviderIdForAuth, o as listKnownProviderAuthEnvVarNames, s as resolveProviderAuthEnvVarCandidates, t as getShellEnvAppliedKeys } from "./io-CH2g3vsv-BOGlLlB8.mjs";
+import { St as createSubsystemLogger, bt as normalizeSecretInputString, l as normalizeProviderId, vt as coerceSecretRef } from "./bundled-compat-BpaDaAAu-D7oazKjD.mjs";
+import { o as loadPluginManifestRegistry } from "./manifest-registry-_hxKCS2K-CZdeyN0f.mjs";
+import { t as DEFAULT_AGENT_ID } from "./session-key-Cn2QoOyX-CuHbJMgR.mjs";
+import { r as isPidAlive, t as resolveProcessScopedMap } from "./process-scoped-map-B2cWkYET-CXwUZ8CZ.mjs";
+import { n as saveJsonFile, t as loadJsonFile } from "./json-file-BQRNuxmK-DhJM5NsG.mjs";
+import { p as resolvePluginSetupProvider } from "./plugin-auto-enable-DdH3n9V8-DsA1isaF.mjs";
+import { E as resolveExternalAuthProfilesWithPlugins } from "./provider-runtime-CT50mNIX-BwEV6GyO.mjs";
+import fs from "node:fs";
+import path from "node:path";
+import fs$1 from "node:fs/promises";
+import os from "node:os";
+import "node:child_process";
+import { createHash } from "node:crypto";
+//#region node_modules/.pnpm/openclaw@2026.4.22_@napi-rs+canvas@0.1.99/node_modules/openclaw/dist/file-lock-7-B8nAS7.js
+const HELD_LOCKS = resolveProcessScopedMap(Symbol.for("openclaw.fileLockHeldLocks"));
+const CLEANUP_REGISTERED_KEY = Symbol.for("openclaw.fileLockCleanupRegistered");
+function releaseAllLocksSync() {
+	for (const [normalizedFile, held] of HELD_LOCKS) {
+		held.handle.close().catch(() => void 0);
+		rmLockPathSync(held.lockPath);
+		HELD_LOCKS.delete(normalizedFile);
+	}
+}
+function rmLockPathSync(lockPath) {
+	try {
+		fs.rmSync(lockPath, { force: true });
+	} catch {}
+}
+function ensureExitCleanupRegistered() {
+	const proc = process;
+	if (proc[CLEANUP_REGISTERED_KEY]) return;
+	proc[CLEANUP_REGISTERED_KEY] = true;
+	process.on("exit", releaseAllLocksSync);
+}
+function computeDelayMs(retries, attempt) {
+	const base = Math.min(retries.maxTimeout, Math.max(retries.minTimeout, retries.minTimeout * retries.factor ** attempt));
+	const jitter = retries.randomize ? 1 + Math.random() : 1;
+	return Math.min(retries.maxTimeout, Math.round(base * jitter));
+}
+async function readLockPayload(lockPath) {
+	try {
+		const raw = await fs$1.readFile(lockPath, "utf8");
+		const parsed = JSON.parse(raw);
+		if (typeof parsed.pid !== "number" || typeof parsed.createdAt !== "string") return null;
+		return {
+			pid: parsed.pid,
+			createdAt: parsed.createdAt
+		};
+	} catch {
+		return null;
+	}
+}
+async function resolveNormalizedFilePath(filePath) {
+	const resolved = path.resolve(filePath);
+	const dir = path.dirname(resolved);
+	await fs$1.mkdir(dir, { recursive: true });
+	try {
+		const realDir = await fs$1.realpath(dir);
+		return path.join(realDir, path.basename(resolved));
+	} catch {
+		return resolved;
+	}
+}
+async function isStaleLock(lockPath, staleMs) {
+	const payload = await readLockPayload(lockPath);
+	if (payload?.pid && !isPidAlive(payload.pid)) return true;
+	if (payload?.createdAt) {
+		const createdAt = Date.parse(payload.createdAt);
+		if (!Number.isFinite(createdAt) || Date.now() - createdAt > staleMs) return true;
+	}
+	try {
+		const stat = await fs$1.stat(lockPath);
+		return Date.now() - stat.mtimeMs > staleMs;
+	} catch {
+		return true;
+	}
+}
+const FILE_LOCK_TIMEOUT_ERROR_CODE = "file_lock_timeout";
+function createFileLockTimeoutError(normalizedFile, lockPath) {
+	const error = /* @__PURE__ */ new Error(`file lock timeout for ${normalizedFile}`);
+	return Object.assign(error, {
+		code: FILE_LOCK_TIMEOUT_ERROR_CODE,
+		lockPath
+	});
+}
+async function releaseHeldLock(normalizedFile) {
+	const current = HELD_LOCKS.get(normalizedFile);
+	if (!current) return;
+	current.count -= 1;
+	if (current.count > 0) return;
+	HELD_LOCKS.delete(normalizedFile);
+	await current.handle.close().catch(() => void 0);
+	await fs$1.rm(current.lockPath, { force: true }).catch(() => void 0);
+}
+/** Acquire a re-entrant process-local file lock backed by a `.lock` sidecar file. */
+async function acquireFileLock(filePath, options) {
+	ensureExitCleanupRegistered();
+	const normalizedFile = await resolveNormalizedFilePath(filePath);
+	const lockPath = `${normalizedFile}.lock`;
+	const held = HELD_LOCKS.get(normalizedFile);
+	if (held) {
+		held.count += 1;
+		return {
+			lockPath,
+			release: () => releaseHeldLock(normalizedFile)
+		};
+	}
+	for (let attempt = 0; attempt <= options.retries.retries; attempt += 1) try {
+		const handle = await fs$1.open(lockPath, "wx");
+		await handle.writeFile(JSON.stringify({
+			pid: process.pid,
+			createdAt: (/* @__PURE__ */ new Date()).toISOString()
+		}, null, 2), "utf8");
+		HELD_LOCKS.set(normalizedFile, {
+			count: 1,
+			handle,
+			lockPath
+		});
+		return {
+			lockPath,
+			release: () => releaseHeldLock(normalizedFile)
+		};
+	} catch (err) {
+		if (err.code !== "EEXIST") throw err;
+		if (await isStaleLock(lockPath, options.stale)) {
+			await fs$1.rm(lockPath, { force: true }).catch(() => void 0);
+			continue;
+		}
+		if (attempt >= options.retries.retries) break;
+		await new Promise((resolve) => setTimeout(resolve, computeDelayMs(options.retries, attempt)));
+	}
+	throw createFileLockTimeoutError(normalizedFile, lockPath);
+}
+/** Run an async callback while holding a file lock, always releasing the lock afterward. */
+async function withFileLock(filePath, options, fn) {
+	const lock = await acquireFileLock(filePath, options);
+	try {
+		return await fn();
+	} finally {
+		await lock.release();
+	}
+}
+//#endregion
+//#region node_modules/.pnpm/openclaw@2026.4.22_@napi-rs+canvas@0.1.99/node_modules/openclaw/dist/agent-paths-yYk0N-bh.js
+function resolveOpenClawAgentDir(env = process.env) {
+	const override = env.OPENCLAW_AGENT_DIR?.trim() || env.PI_CODING_AGENT_DIR?.trim();
+	if (override) return resolveUserPath(override, env);
+	return resolveUserPath(path.join(resolveStateDir(env), "agents", DEFAULT_AGENT_ID, "agent"), env);
+}
+//#endregion
+//#region node_modules/.pnpm/openclaw@2026.4.22_@napi-rs+canvas@0.1.99/node_modules/openclaw/dist/source-check-80U6FTE-.js
+const AUTH_PROFILE_FILENAME = "auth-profiles.json";
+const AUTH_STATE_FILENAME = "auth-state.json";
+const LEGACY_AUTH_FILENAME = "auth.json";
+function resolveAuthStorePath(agentDir) {
+	const resolved = resolveUserPath(agentDir ?? resolveOpenClawAgentDir());
+	return path.join(resolved, AUTH_PROFILE_FILENAME);
+}
+function resolveLegacyAuthStorePath(agentDir) {
+	const resolved = resolveUserPath(agentDir ?? resolveOpenClawAgentDir());
+	return path.join(resolved, LEGACY_AUTH_FILENAME);
+}
+function resolveAuthStatePath(agentDir) {
+	const resolved = resolveUserPath(agentDir ?? resolveOpenClawAgentDir());
+	return path.join(resolved, AUTH_STATE_FILENAME);
+}
+function resolveAuthStorePathForDisplay(agentDir) {
+	const pathname = resolveAuthStorePath(agentDir);
+	return pathname.startsWith("~") ? pathname : resolveUserPath(pathname);
+}
+/**
+* Resolve the path of the cross-agent, per-profile OAuth refresh coordination
+* lock. The filename hashes `provider\0profileId` so it is filesystem-safe
+* for arbitrary unicode/control-character inputs and always bounded in
+* length. The NUL separator makes it impossible to collide two distinct
+* `(provider, profileId)` pairs by string concatenation.
+*
+* This lock is the serialization point that prevents the `refresh_token_reused`
+* storm when N agents share one OAuth profile (see issue #26322): every agent
+* that attempts a refresh acquires this same file lock, so only one HTTP
+* refresh is in-flight at a time and peers can adopt the resulting fresh
+* credentials instead of racing against a single-use refresh token.
+*
+* The key intentionally includes `provider` so that two profiles that
+* happen to share a `profileId` across providers (operator-renamed profile,
+* test fixture, etc.) do not needlessly serialize against each other.
+*/
+function resolveOAuthRefreshLockPath(provider, profileId) {
+	const hash = createHash("sha256");
+	hash.update(provider, "utf8");
+	hash.update("\0", "utf8");
+	hash.update(profileId, "utf8");
+	const safeId = `sha256-${hash.digest("hex")}`;
+	return path.join(resolveStateDir(), "locks", "oauth-refresh", safeId);
+}
+const runtimeAuthStoreSnapshots = /* @__PURE__ */ new Map();
+function resolveRuntimeStoreKey(agentDir) {
+	return resolveAuthStorePath(agentDir);
+}
+function cloneAuthProfileStore$1(store) {
+	return structuredClone(store);
+}
+function getRuntimeAuthProfileStoreSnapshot(agentDir) {
+	const store = runtimeAuthStoreSnapshots.get(resolveRuntimeStoreKey(agentDir));
+	return store ? cloneAuthProfileStore$1(store) : void 0;
+}
+function hasRuntimeAuthProfileStoreSnapshot(agentDir) {
+	return runtimeAuthStoreSnapshots.has(resolveRuntimeStoreKey(agentDir));
+}
+function setRuntimeAuthProfileStoreSnapshot(store, agentDir) {
+	runtimeAuthStoreSnapshots.set(resolveRuntimeStoreKey(agentDir), cloneAuthProfileStore$1(store));
+}
+//#endregion
+//#region node_modules/.pnpm/openclaw@2026.4.22_@napi-rs+canvas@0.1.99/node_modules/openclaw/dist/store-DvC8xs3S.js
+const MINIMAX_CLI_PROFILE_ID = "minimax-portal:minimax-cli";
+const AUTH_STORE_LOCK_OPTIONS = {
+	retries: {
+		retries: 10,
+		factor: 2,
+		minTimeout: 100,
+		maxTimeout: 1e4,
+		randomize: true
+	},
+	stale: 3e4
+};
+const OAUTH_REFRESH_LOCK_OPTIONS = {
+	retries: {
+		retries: 20,
+		factor: 2,
+		minTimeout: 100,
+		maxTimeout: 1e4,
+		randomize: true
+	},
+	stale: 18e4
+};
+const OAUTH_REFRESH_CALL_TIMEOUT_MS = 12e4;
+const EXTERNAL_CLI_SYNC_TTL_MS = 900 * 1e3;
+const log$1 = createSubsystemLogger("agents/auth-profiles");
+createSubsystemLogger("agents/auth-profiles");
+const MINIMAX_CLI_CREDENTIALS_RELATIVE_PATH = ".minimax/oauth_creds.json";
+let minimaxCliCache = null;
+function resolveMiniMaxCliCredentialsPath(homeDir) {
+	const baseDir = homeDir ?? resolveUserPath("~");
+	return path.join(baseDir, MINIMAX_CLI_CREDENTIALS_RELATIVE_PATH);
+}
+function readFileMtimeMs(filePath) {
+	try {
+		return fs.statSync(filePath).mtimeMs;
+	} catch {
+		return null;
+	}
+}
+function readCachedCliCredential(options) {
+	const { ttlMs, cache, cacheKey, read, setCache, readSourceFingerprint } = options;
+	if (ttlMs <= 0) return read();
+	const now = Date.now();
+	const sourceFingerprint = readSourceFingerprint?.();
+	if (cache && cache.cacheKey === cacheKey && cache.sourceFingerprint === sourceFingerprint && now - cache.readAt < ttlMs) return cache.value;
+	const value = read();
+	const cachedSourceFingerprint = readSourceFingerprint?.();
+	if (!readSourceFingerprint || cachedSourceFingerprint === sourceFingerprint) setCache({
+		value,
+		readAt: now,
+		cacheKey,
+		sourceFingerprint: cachedSourceFingerprint
+	});
+	else setCache(null);
+	return value;
+}
+function readPortalCliOauthCredentials(credPath, provider) {
+	const raw = loadJsonFile(credPath);
+	if (!raw || typeof raw !== "object") return null;
+	const data = raw;
+	const accessToken = data.access_token;
+	const refreshToken = data.refresh_token;
+	const expiresAt = data.expiry_date;
+	if (typeof accessToken !== "string" || !accessToken) return null;
+	if (typeof refreshToken !== "string" || !refreshToken) return null;
+	if (typeof expiresAt !== "number" || !Number.isFinite(expiresAt)) return null;
+	return {
+		type: "oauth",
+		provider,
+		access: accessToken,
+		refresh: refreshToken,
+		expires: expiresAt
+	};
+}
+function readMiniMaxCliCredentials(options) {
+	return readPortalCliOauthCredentials(resolveMiniMaxCliCredentialsPath(options?.homeDir), "minimax-portal");
+}
+function readMiniMaxCliCredentialsCached(options) {
+	const credPath = resolveMiniMaxCliCredentialsPath(options?.homeDir);
+	return readCachedCliCredential({
+		ttlMs: options?.ttlMs ?? 0,
+		cache: minimaxCliCache,
+		cacheKey: credPath,
+		read: () => readMiniMaxCliCredentials({ homeDir: options?.homeDir }),
+		setCache: (next) => {
+			minimaxCliCache = next;
+		},
+		readSourceFingerprint: () => readFileMtimeMs(credPath)
+	});
+}
+function resolveTokenExpiryState(expires, now = Date.now(), opts) {
+	if (expires === void 0) return "missing";
+	if (typeof expires !== "number") return "invalid_expires";
+	if (!Number.isFinite(expires) || expires <= 0) return "invalid_expires";
+	const remainingMs = expires - now;
+	if (remainingMs <= 0) return "expired";
+	const expiringWithinMs = Math.max(0, opts?.expiringWithinMs ?? 0);
+	if (expiringWithinMs > 0 && remainingMs <= expiringWithinMs) return "expiring";
+	return "valid";
+}
+function hasUsableOAuthCredential$1(credential, opts) {
+	if (!credential || credential.type !== "oauth") return false;
+	if (typeof credential.access !== "string" || credential.access.trim().length === 0) return false;
+	const now = opts?.now ?? Date.now();
+	const refreshMarginMs = Math.max(0, opts?.refreshMarginMs ?? 3e5);
+	return resolveTokenExpiryState(credential.expires, now, { expiringWithinMs: refreshMarginMs }) === "valid";
+}
+function hasConfiguredSecretRef(value) {
+	return coerceSecretRef(value) !== null;
+}
+function hasConfiguredSecretString(value) {
+	return normalizeSecretInputString(value) !== void 0;
+}
+function evaluateStoredCredentialEligibility(params) {
+	const now = params.now ?? Date.now();
+	const credential = params.credential;
+	if (credential.type === "api_key") {
+		const hasKey = hasConfiguredSecretString(credential.key);
+		const hasKeyRef = hasConfiguredSecretRef(credential.keyRef);
+		if (!hasKey && !hasKeyRef) return {
+			eligible: false,
+			reasonCode: "missing_credential"
+		};
+		return {
+			eligible: true,
+			reasonCode: "ok"
+		};
+	}
+	if (credential.type === "token") {
+		const hasToken = hasConfiguredSecretString(credential.token);
+		const hasTokenRef = hasConfiguredSecretRef(credential.tokenRef);
+		if (!hasToken && !hasTokenRef) return {
+			eligible: false,
+			reasonCode: "missing_credential"
+		};
+		const expiryState = resolveTokenExpiryState(credential.expires, now);
+		if (expiryState === "invalid_expires") return {
+			eligible: false,
+			reasonCode: "invalid_expires"
+		};
+		if (expiryState === "expired") return {
+			eligible: false,
+			reasonCode: "expired"
+		};
+		return {
+			eligible: true,
+			reasonCode: "ok"
+		};
+	}
+	if (normalizeSecretInputString(credential.access) === void 0 && normalizeSecretInputString(credential.refresh) === void 0) return {
+		eligible: false,
+		reasonCode: "missing_credential"
+	};
+	return {
+		eligible: true,
+		reasonCode: "ok"
+	};
+}
+function areOAuthCredentialsEquivalent(a, b) {
+	if (!a || a.type !== "oauth") return false;
+	return a.provider === b.provider && a.access === b.access && a.refresh === b.refresh && a.expires === b.expires && a.email === b.email && a.enterpriseUrl === b.enterpriseUrl && a.projectId === b.projectId && a.accountId === b.accountId && a.idToken === b.idToken;
+}
+function hasNewerStoredOAuthCredential(existing, incoming) {
+	return Boolean(existing && existing.provider === incoming.provider && Number.isFinite(existing.expires) && (!Number.isFinite(incoming.expires) || existing.expires > incoming.expires));
+}
+function shouldReplaceStoredOAuthCredential(existing, incoming) {
+	if (!existing || existing.type !== "oauth") return true;
+	if (areOAuthCredentialsEquivalent(existing, incoming)) return false;
+	return !hasNewerStoredOAuthCredential(existing, incoming);
+}
+function hasUsableOAuthCredential(credential, now = Date.now()) {
+	return hasUsableOAuthCredential$1(credential, { now });
+}
+function normalizeAuthIdentityToken$1(value) {
+	const trimmed = value?.trim();
+	return trimmed ? trimmed : void 0;
+}
+function normalizeAuthEmailToken$1(value) {
+	return normalizeAuthIdentityToken$1(value)?.toLowerCase();
+}
+function hasOAuthIdentity(credential) {
+	return normalizeAuthIdentityToken$1(credential.accountId) !== void 0 || normalizeAuthEmailToken$1(credential.email) !== void 0;
+}
+function hasMatchingOAuthIdentity(existing, incoming) {
+	const existingAccountId = normalizeAuthIdentityToken$1(existing.accountId);
+	const incomingAccountId = normalizeAuthIdentityToken$1(incoming.accountId);
+	if (existingAccountId !== void 0 && incomingAccountId !== void 0) return existingAccountId === incomingAccountId;
+	const existingEmail = normalizeAuthEmailToken$1(existing.email);
+	const incomingEmail = normalizeAuthEmailToken$1(incoming.email);
+	if (existingEmail !== void 0 && incomingEmail !== void 0) return existingEmail === incomingEmail;
+	return false;
+}
+function isSafeToAdoptBootstrapOAuthIdentity(existing, incoming) {
+	if (!existing || existing.type !== "oauth") return true;
+	if (existing.provider !== incoming.provider) return false;
+	if (areOAuthCredentialsEquivalent(existing, incoming)) return true;
+	if (!hasOAuthIdentity(existing)) return true;
+	return hasMatchingOAuthIdentity(existing, incoming);
+}
+function isSafeToAdoptMainStoreOAuthIdentity(existing, incoming) {
+	if (!existing || existing.type !== "oauth") return false;
+	if (existing.provider !== incoming.provider) return false;
+	if (areOAuthCredentialsEquivalent(existing, incoming)) return true;
+	if (!hasOAuthIdentity(existing)) return true;
+	return hasMatchingOAuthIdentity(existing, incoming);
+}
+function shouldBootstrapFromExternalCliCredential(params) {
+	const now = params.now ?? Date.now();
+	if (hasUsableOAuthCredential(params.existing, now)) return false;
+	return hasUsableOAuthCredential(params.imported, now);
+}
+function overlayRuntimeExternalOAuthProfiles(store, profiles) {
+	const externalProfiles = Array.from(profiles);
+	if (externalProfiles.length === 0) return store;
+	const next = structuredClone(store);
+	for (const profile of externalProfiles) next.profiles[profile.profileId] = profile.credential;
+	return next;
+}
+function shouldPersistRuntimeExternalOAuthProfile(params) {
+	for (const profile of params.profiles) {
+		if (profile.profileId !== params.profileId) continue;
+		if (profile.persistence === "persisted") return true;
+		return !areOAuthCredentialsEquivalent(profile.credential, params.credential);
+	}
+	return true;
+}
+function normalizeAuthIdentityToken(value) {
+	const trimmed = value?.trim();
+	return trimmed ? trimmed : void 0;
+}
+function normalizeAuthEmailToken(value) {
+	return normalizeAuthIdentityToken(value)?.toLowerCase();
+}
+function isSafeToUseExternalCliCredential(existing, imported) {
+	if (!existing) return true;
+	if (existing.provider !== imported.provider) return false;
+	const existingAccountId = normalizeAuthIdentityToken(existing.accountId);
+	const importedAccountId = normalizeAuthIdentityToken(imported.accountId);
+	const existingEmail = normalizeAuthEmailToken(existing.email);
+	const importedEmail = normalizeAuthEmailToken(imported.email);
+	if (existingAccountId !== void 0 && importedAccountId !== void 0) return existingAccountId === importedAccountId;
+	if (existingEmail !== void 0 && importedEmail !== void 0) return existingEmail === importedEmail;
+	if (existingAccountId !== void 0 || existingEmail !== void 0) return false;
+	return true;
+}
+const EXTERNAL_CLI_SYNC_PROVIDERS = [{
+	profileId: MINIMAX_CLI_PROFILE_ID,
+	provider: "minimax-portal",
+	readCredentials: () => readMiniMaxCliCredentialsCached({ ttlMs: EXTERNAL_CLI_SYNC_TTL_MS })
+}];
+function resolveExternalCliSyncProvider(params) {
+	const provider = EXTERNAL_CLI_SYNC_PROVIDERS.find((entry) => entry.profileId === params.profileId);
+	if (!provider) return null;
+	if (params.credential && provider.provider !== params.credential.provider) return null;
+	return provider;
+}
+function readExternalCliBootstrapCredential(params) {
+	const provider = resolveExternalCliSyncProvider(params);
+	if (!provider) return null;
+	return provider.readCredentials();
+}
+const readManagedExternalCliCredential = readExternalCliBootstrapCredential;
+function resolveExternalCliAuthProfiles(store) {
+	const profiles = [];
+	const now = Date.now();
+	for (const providerConfig of EXTERNAL_CLI_SYNC_PROVIDERS) {
+		const creds = providerConfig.readCredentials();
+		if (!creds) continue;
+		const existing = store.profiles[providerConfig.profileId];
+		const existingOAuth = existing?.type === "oauth" && existing.provider === providerConfig.provider ? existing : void 0;
+		if (existing && !existingOAuth) {
+			log$1.debug("kept explicit local auth over external cli bootstrap", {
+				profileId: providerConfig.profileId,
+				provider: providerConfig.provider,
+				localType: existing.type,
+				localProvider: existing.provider
+			});
+			continue;
+		}
+		if (existingOAuth && !isSafeToUseExternalCliCredential(existingOAuth, creds)) {
+			log$1.warn("refused external cli oauth bootstrap: identity mismatch", {
+				profileId: providerConfig.profileId,
+				provider: providerConfig.provider
+			});
+			continue;
+		}
+		if (existingOAuth && !isSafeToAdoptBootstrapOAuthIdentity(existingOAuth, creds) && !areOAuthCredentialsEquivalent(existingOAuth, creds)) {
+			log$1.warn("refused external cli oauth bootstrap: identity mismatch or missing binding", {
+				profileId: providerConfig.profileId,
+				provider: providerConfig.provider
+			});
+			continue;
+		}
+		if (!shouldBootstrapFromExternalCliCredential({
+			existing: existingOAuth,
+			imported: creds,
+			now
+		})) {
+			if (existingOAuth) log$1.debug("kept usable local oauth over external cli bootstrap", {
+				profileId: providerConfig.profileId,
+				provider: providerConfig.provider,
+				localExpires: existingOAuth.expires,
+				externalExpires: creds.expires
+			});
+			continue;
+		}
+		log$1.debug("used external cli oauth bootstrap because local oauth was missing or unusable", {
+			profileId: providerConfig.profileId,
+			provider: providerConfig.provider,
+			localExpires: existingOAuth?.expires,
+			externalExpires: creds.expires
+		});
+		profiles.push({
+			profileId: providerConfig.profileId,
+			credential: creds
+		});
+	}
+	return profiles;
+}
+let resolveExternalAuthProfilesForRuntime;
+function normalizeExternalAuthProfile(profile) {
+	if (!profile?.profileId || !profile.credential) return null;
+	return {
+		...profile,
+		persistence: profile.persistence ?? "runtime-only"
+	};
+}
+function resolveExternalAuthProfileMap(params) {
+	const env = params.env ?? process.env;
+	const profiles = (resolveExternalAuthProfilesForRuntime ?? resolveExternalAuthProfilesWithPlugins)({
+		env,
+		context: {
+			config: void 0,
+			agentDir: params.agentDir,
+			workspaceDir: void 0,
+			env,
+			store: params.store
+		}
+	});
+	const resolved = /* @__PURE__ */ new Map();
+	const cliProfiles = resolveExternalCliAuthProfiles?.(params.store) ?? [];
+	for (const profile of cliProfiles) resolved.set(profile.profileId, {
+		profileId: profile.profileId,
+		credential: profile.credential,
+		persistence: "runtime-only"
+	});
+	for (const rawProfile of profiles) {
+		const profile = normalizeExternalAuthProfile(rawProfile);
+		if (!profile) continue;
+		resolved.set(profile.profileId, profile);
+	}
+	return resolved;
+}
+function listRuntimeExternalAuthProfiles(params) {
+	return Array.from(resolveExternalAuthProfileMap({
+		store: params.store,
+		agentDir: params.agentDir,
+		env: params.env
+	}).values());
+}
+function overlayExternalAuthProfiles(store, params) {
+	return overlayRuntimeExternalOAuthProfiles(store, listRuntimeExternalAuthProfiles({
+		store,
+		agentDir: params?.agentDir,
+		env: params?.env
+	}));
+}
+function shouldPersistExternalAuthProfile(params) {
+	const profiles = listRuntimeExternalAuthProfiles({
+		store: params.store,
+		agentDir: params.agentDir,
+		env: params.env
+	});
+	return shouldPersistRuntimeExternalOAuthProfile({
+		profileId: params.profileId,
+		credential: params.credential,
+		profiles
+	});
+}
+function ensureAuthStoreFile(pathname) {
+	if (fs.existsSync(pathname)) return;
+	saveJsonFile(pathname, {
+		version: 1,
+		profiles: {}
+	});
+}
+function normalizeAuthProfileOrder(raw) {
+	if (!raw || typeof raw !== "object") return;
+	const normalized = Object.entries(raw).reduce((acc, [provider, value]) => {
+		if (!Array.isArray(value)) return acc;
+		const list = value.map((entry) => normalizeOptionalString(entry) ?? "").filter(Boolean);
+		if (list.length > 0) acc[provider] = list;
+		return acc;
+	}, {});
+	return Object.keys(normalized).length > 0 ? normalized : void 0;
+}
+function coerceAuthProfileState(raw) {
+	if (!raw || typeof raw !== "object") return {};
+	const record = raw;
+	return {
+		order: normalizeAuthProfileOrder(record.order),
+		lastGood: record.lastGood && typeof record.lastGood === "object" ? record.lastGood : void 0,
+		usageStats: record.usageStats && typeof record.usageStats === "object" ? record.usageStats : void 0
+	};
+}
+function mergeAuthProfileState(base, override) {
+	const mergeRecord = (left, right) => {
+		if (!left && !right) return;
+		if (!left) return { ...right };
+		if (!right) return { ...left };
+		return {
+			...left,
+			...right
+		};
+	};
+	return {
+		order: mergeRecord(base.order, override.order),
+		lastGood: mergeRecord(base.lastGood, override.lastGood),
+		usageStats: mergeRecord(base.usageStats, override.usageStats)
+	};
+}
+function loadPersistedAuthProfileState(agentDir) {
+	return coerceAuthProfileState(loadJsonFile(resolveAuthStatePath(agentDir)));
+}
+function buildPersistedAuthProfileState(store) {
+	const state = coerceAuthProfileState(store);
+	if (!state.order && !state.lastGood && !state.usageStats) return null;
+	return {
+		version: 1,
+		...state.order ? { order: state.order } : {},
+		...state.lastGood ? { lastGood: state.lastGood } : {},
+		...state.usageStats ? { usageStats: state.usageStats } : {}
+	};
+}
+function savePersistedAuthProfileState(store, agentDir) {
+	const payload = buildPersistedAuthProfileState(store);
+	const statePath = resolveAuthStatePath(agentDir);
+	if (!payload) {
+		try {
+			fs.unlinkSync(statePath);
+		} catch (error) {
+			if (error?.code !== "ENOENT") throw error;
+		}
+		return null;
+	}
+	saveJsonFile(statePath, payload);
+	return payload;
+}
+const AUTH_PROFILE_TYPES = new Set([
+	"api_key",
+	"oauth",
+	"token"
+]);
+function normalizeSecretBackedField(params) {
+	const value = params.entry[params.valueField];
+	if (value == null || typeof value === "string") return;
+	const ref = coerceSecretRef(value);
+	if (ref && !coerceSecretRef(params.entry[params.refField])) params.entry[params.refField] = ref;
+	delete params.entry[params.valueField];
+}
+function normalizeRawCredentialEntry(raw) {
+	const entry = { ...raw };
+	if (!("type" in entry) && typeof entry["mode"] === "string") entry["type"] = entry["mode"];
+	if (!("key" in entry) && typeof entry["apiKey"] === "string") entry["key"] = entry["apiKey"];
+	normalizeSecretBackedField({
+		entry,
+		valueField: "key",
+		refField: "keyRef"
+	});
+	normalizeSecretBackedField({
+		entry,
+		valueField: "token",
+		refField: "tokenRef"
+	});
+	return entry;
+}
+function parseCredentialEntry(raw, fallbackProvider) {
+	if (!raw || typeof raw !== "object") return {
+		ok: false,
+		reason: "non_object"
+	};
+	const typed = normalizeRawCredentialEntry(raw);
+	if (!AUTH_PROFILE_TYPES.has(typed.type)) return {
+		ok: false,
+		reason: "invalid_type"
+	};
+	const provider = typed.provider ?? fallbackProvider;
+	if (typeof provider !== "string" || provider.trim().length === 0) return {
+		ok: false,
+		reason: "missing_provider"
+	};
+	return {
+		ok: true,
+		credential: {
+			...typed,
+			provider
+		}
+	};
+}
+function warnRejectedCredentialEntries(source, rejected) {
+	if (rejected.length === 0) return;
+	const reasons = rejected.reduce((acc, current) => {
+		acc[current.reason] = (acc[current.reason] ?? 0) + 1;
+		return acc;
+	}, {});
+	log$1.warn("ignored invalid auth profile entries during store load", {
+		source,
+		dropped: rejected.length,
+		reasons,
+		keys: rejected.slice(0, 10).map((entry) => entry.key)
+	});
+}
+function coerceLegacyAuthStore(raw) {
+	if (!raw || typeof raw !== "object") return null;
+	const record = raw;
+	if ("profiles" in record) return null;
+	const entries = {};
+	const rejected = [];
+	for (const [key, value] of Object.entries(record)) {
+		const parsed = parseCredentialEntry(value, key);
+		if (!parsed.ok) {
+			rejected.push({
+				key,
+				reason: parsed.reason
+			});
+			continue;
+		}
+		entries[key] = parsed.credential;
+	}
+	warnRejectedCredentialEntries("auth.json", rejected);
+	return Object.keys(entries).length > 0 ? entries : null;
+}
+function coercePersistedAuthProfileStore(raw) {
+	if (!raw || typeof raw !== "object") return null;
+	const record = raw;
+	if (!record.profiles || typeof record.profiles !== "object") return null;
+	const profiles = record.profiles;
+	const normalized = {};
+	const rejected = [];
+	for (const [key, value] of Object.entries(profiles)) {
+		const parsed = parseCredentialEntry(value);
+		if (!parsed.ok) {
+			rejected.push({
+				key,
+				reason: parsed.reason
+			});
+			continue;
+		}
+		normalized[key] = parsed.credential;
+	}
+	warnRejectedCredentialEntries("auth-profiles.json", rejected);
+	return {
+		version: Number(record.version ?? 1),
+		profiles: normalized,
+		...coerceAuthProfileState(record)
+	};
+}
+function mergeRecord(base, override) {
+	if (!base && !override) return;
+	if (!base) return { ...override };
+	if (!override) return { ...base };
+	return {
+		...base,
+		...override
+	};
+}
+function dedupeMergedProfileOrder(profileIds) {
+	return Array.from(new Set(profileIds));
+}
+function hasComparableOAuthIdentityConflict(existing, candidate) {
+	const existingAccountId = normalizeAuthIdentityToken$1(existing.accountId);
+	const candidateAccountId = normalizeAuthIdentityToken$1(candidate.accountId);
+	if (existingAccountId !== void 0 && candidateAccountId !== void 0 && existingAccountId !== candidateAccountId) return true;
+	const existingEmail = normalizeAuthEmailToken$1(existing.email);
+	const candidateEmail = normalizeAuthEmailToken$1(candidate.email);
+	return existingEmail !== void 0 && candidateEmail !== void 0 && existingEmail !== candidateEmail;
+}
+function isLegacyDefaultOAuthProfile(profileId, credential) {
+	return profileId === `${normalizeProviderId(credential.provider)}:default`;
+}
+function isNewerUsableOAuthCredential(existing, candidate) {
+	if (!hasUsableOAuthCredential(candidate)) return false;
+	if (!hasUsableOAuthCredential(existing)) return true;
+	return Number.isFinite(candidate.expires) && (!Number.isFinite(existing.expires) || candidate.expires > existing.expires);
+}
+function findMainStoreOAuthReplacement(params) {
+	const providerKey = normalizeProviderId(params.legacyCredential.provider);
+	const candidates = Object.entries(params.base.profiles).flatMap(([profileId, credential]) => {
+		if (profileId === params.legacyProfileId || credential.type !== "oauth" || normalizeProviderId(credential.provider) !== providerKey) return [];
+		return [[profileId, credential]];
+	}).filter(([, credential]) => isNewerUsableOAuthCredential(params.legacyCredential, credential)).toSorted(([leftId, leftCredential], [rightId, rightCredential]) => {
+		const leftExpires = Number.isFinite(leftCredential.expires) ? leftCredential.expires : 0;
+		const rightExpires = Number.isFinite(rightCredential.expires) ? rightCredential.expires : 0;
+		if (rightExpires !== leftExpires) return rightExpires - leftExpires;
+		return leftId.localeCompare(rightId);
+	});
+	const exactIdentityCandidates = candidates.filter(([, credential]) => isSafeToAdoptMainStoreOAuthIdentity(params.legacyCredential, credential));
+	if (exactIdentityCandidates.length > 0) {
+		if (!hasOAuthIdentity(params.legacyCredential) && exactIdentityCandidates.length > 1) return;
+		return exactIdentityCandidates[0]?.[0];
+	}
+	if (hasUsableOAuthCredential(params.legacyCredential)) return;
+	const fallbackCandidates = candidates.filter(([, credential]) => !hasComparableOAuthIdentityConflict(params.legacyCredential, credential));
+	if (fallbackCandidates.length !== 1) return;
+	return fallbackCandidates[0]?.[0];
+}
+function replaceMergedProfileReferences(params) {
+	const { store, base, replacements } = params;
+	if (replacements.size === 0) return store;
+	const profiles = { ...store.profiles };
+	for (const [legacyProfileId, replacementProfileId] of replacements) {
+		const baseCredential = base.profiles[legacyProfileId];
+		if (baseCredential) profiles[legacyProfileId] = baseCredential;
+		else delete profiles[legacyProfileId];
+		const replacementBaseCredential = base.profiles[replacementProfileId];
+		const replacementCredential = profiles[replacementProfileId];
+		if (replacementBaseCredential && (!replacementCredential || replacementCredential.type === "oauth" && replacementBaseCredential.type === "oauth" && isNewerUsableOAuthCredential(replacementCredential, replacementBaseCredential))) profiles[replacementProfileId] = replacementBaseCredential;
+	}
+	const order = store.order ? Object.fromEntries(Object.entries(store.order).map(([provider, profileIds]) => [provider, dedupeMergedProfileOrder(profileIds.map((profileId) => replacements.get(profileId) ?? profileId))])) : void 0;
+	const lastGood = store.lastGood ? Object.fromEntries(Object.entries(store.lastGood).map(([provider, profileId]) => [provider, replacements.get(profileId) ?? profileId])) : void 0;
+	const usageStats = store.usageStats ? { ...store.usageStats } : void 0;
+	if (usageStats) for (const legacyProfileId of replacements.keys()) {
+		const baseStats = base.usageStats?.[legacyProfileId];
+		if (baseStats) usageStats[legacyProfileId] = baseStats;
+		else delete usageStats[legacyProfileId];
+	}
+	return {
+		...store,
+		profiles,
+		...order && Object.keys(order).length > 0 ? { order } : { order: void 0 },
+		...lastGood && Object.keys(lastGood).length > 0 ? { lastGood } : { lastGood: void 0 },
+		...usageStats && Object.keys(usageStats).length > 0 ? { usageStats } : { usageStats: void 0 }
+	};
+}
+function reconcileMainStoreOAuthProfileDrift(params) {
+	const replacements = /* @__PURE__ */ new Map();
+	for (const [profileId, credential] of Object.entries(params.override.profiles)) {
+		if (credential.type !== "oauth" || !isLegacyDefaultOAuthProfile(profileId, credential)) continue;
+		const replacementProfileId = findMainStoreOAuthReplacement({
+			base: params.base,
+			legacyProfileId: profileId,
+			legacyCredential: credential
+		});
+		if (replacementProfileId) replacements.set(profileId, replacementProfileId);
+	}
+	return replaceMergedProfileReferences({
+		store: params.merged,
+		base: params.base,
+		replacements
+	});
+}
+function mergeAuthProfileStores(base, override) {
+	if (Object.keys(override.profiles).length === 0 && !override.order && !override.lastGood && !override.usageStats) return base;
+	return reconcileMainStoreOAuthProfileDrift({
+		base,
+		override,
+		merged: {
+			version: Math.max(base.version, override.version ?? base.version),
+			profiles: {
+				...base.profiles,
+				...override.profiles
+			},
+			order: mergeRecord(base.order, override.order),
+			lastGood: mergeRecord(base.lastGood, override.lastGood),
+			usageStats: mergeRecord(base.usageStats, override.usageStats)
+		}
+	});
+}
+function buildPersistedAuthProfileSecretsStore(store, shouldPersistProfile) {
+	return {
+		version: 1,
+		profiles: Object.fromEntries(Object.entries(store.profiles).flatMap(([profileId, credential]) => {
+			if (shouldPersistProfile && !shouldPersistProfile({
+				profileId,
+				credential
+			})) return [];
+			if (credential.type === "api_key" && credential.keyRef && credential.key !== void 0) {
+				const sanitized = { ...credential };
+				delete sanitized.key;
+				return [[profileId, sanitized]];
+			}
+			if (credential.type === "token" && credential.tokenRef && credential.token !== void 0) {
+				const sanitized = { ...credential };
+				delete sanitized.token;
+				return [[profileId, sanitized]];
+			}
+			return [[profileId, credential]];
+		}))
+	};
+}
+function applyLegacyAuthStore(store, legacy) {
+	for (const [provider, cred] of Object.entries(legacy)) {
+		const profileId = `${provider}:default`;
+		const credentialProvider = cred.provider ?? provider;
+		if (cred.type === "api_key") {
+			store.profiles[profileId] = {
+				type: "api_key",
+				provider: credentialProvider,
+				key: cred.key,
+				...cred.email ? { email: cred.email } : {}
+			};
+			continue;
+		}
+		if (cred.type === "token") {
+			store.profiles[profileId] = {
+				type: "token",
+				provider: credentialProvider,
+				token: cred.token,
+				...typeof cred.expires === "number" ? { expires: cred.expires } : {},
+				...cred.email ? { email: cred.email } : {}
+			};
+			continue;
+		}
+		store.profiles[profileId] = {
+			type: "oauth",
+			provider: credentialProvider,
+			access: cred.access,
+			refresh: cred.refresh,
+			expires: cred.expires,
+			...cred.enterpriseUrl ? { enterpriseUrl: cred.enterpriseUrl } : {},
+			...cred.projectId ? { projectId: cred.projectId } : {},
+			...cred.accountId ? { accountId: cred.accountId } : {},
+			...cred.email ? { email: cred.email } : {}
+		};
+	}
+}
+function mergeOAuthFileIntoStore(store) {
+	const oauthRaw = loadJsonFile(resolveOAuthPath());
+	if (!oauthRaw || typeof oauthRaw !== "object") return false;
+	const oauthEntries = oauthRaw;
+	let mutated = false;
+	for (const [provider, creds] of Object.entries(oauthEntries)) {
+		if (!creds || typeof creds !== "object") continue;
+		const profileId = `${provider}:default`;
+		if (store.profiles[profileId]) continue;
+		store.profiles[profileId] = {
+			type: "oauth",
+			provider,
+			...creds
+		};
+		mutated = true;
+	}
+	return mutated;
+}
+function loadPersistedAuthProfileStore(agentDir) {
+	const raw = loadJsonFile(resolveAuthStorePath(agentDir));
+	const store = coercePersistedAuthProfileStore(raw);
+	if (!store) return null;
+	return {
+		...store,
+		...mergeAuthProfileState(coerceAuthProfileState(raw), loadPersistedAuthProfileState(agentDir))
+	};
+}
+function loadLegacyAuthProfileStore(agentDir) {
+	return coerceLegacyAuthStore(loadJsonFile(resolveLegacyAuthStorePath(agentDir)));
+}
+const loadedAuthStoreCache = /* @__PURE__ */ new Map();
+function cloneAuthProfileStore(store) {
+	return structuredClone(store);
+}
+function resolveRuntimeAuthProfileStore(agentDir) {
+	const mainKey = resolveAuthStorePath(void 0);
+	const requestedKey = resolveAuthStorePath(agentDir);
+	const mainStore = getRuntimeAuthProfileStoreSnapshot(void 0);
+	const requestedStore = getRuntimeAuthProfileStoreSnapshot(agentDir);
+	if (!agentDir || requestedKey === mainKey) {
+		if (!mainStore) return null;
+		return mainStore;
+	}
+	if (mainStore && requestedStore) return mergeAuthProfileStores(mainStore, requestedStore);
+	if (requestedStore) return requestedStore;
+	if (mainStore) return mainStore;
+	return null;
+}
+function readAuthStoreMtimeMs(authPath) {
+	try {
+		return fs.statSync(authPath).mtimeMs;
+	} catch {
+		return null;
+	}
+}
+function readCachedAuthProfileStore(params) {
+	const cached = loadedAuthStoreCache.get(params.authPath);
+	if (!cached || cached.authMtimeMs !== params.authMtimeMs || cached.stateMtimeMs !== params.stateMtimeMs) return null;
+	if (Date.now() - cached.syncedAtMs >= 9e5) return null;
+	return cloneAuthProfileStore(cached.store);
+}
+function writeCachedAuthProfileStore(params) {
+	loadedAuthStoreCache.set(params.authPath, {
+		authMtimeMs: params.authMtimeMs,
+		stateMtimeMs: params.stateMtimeMs,
+		syncedAtMs: Date.now(),
+		store: cloneAuthProfileStore(params.store)
+	});
+}
+async function updateAuthProfileStoreWithLock(params) {
+	const authPath = resolveAuthStorePath(params.agentDir);
+	ensureAuthStoreFile(authPath);
+	try {
+		return await withFileLock(authPath, AUTH_STORE_LOCK_OPTIONS, async () => {
+			const store = loadAuthProfileStoreForAgent(params.agentDir);
+			if (params.updater(store)) saveAuthProfileStore(store, params.agentDir);
+			return store;
+		});
+	} catch {
+		return null;
+	}
+}
+function loadAuthProfileStoreForAgent(agentDir, options) {
+	const readOnly = options?.readOnly === true;
+	const authPath = resolveAuthStorePath(agentDir);
+	const statePath = resolveAuthStatePath(agentDir);
+	const authMtimeMs = readAuthStoreMtimeMs(authPath);
+	const stateMtimeMs = readAuthStoreMtimeMs(statePath);
+	if (!readOnly) {
+		const cached = readCachedAuthProfileStore({
+			authPath,
+			authMtimeMs,
+			stateMtimeMs
+		});
+		if (cached) return cached;
+	}
+	const asStore = loadPersistedAuthProfileStore(agentDir);
+	if (asStore) {
+		if (!readOnly) writeCachedAuthProfileStore({
+			authPath,
+			authMtimeMs: readAuthStoreMtimeMs(authPath),
+			stateMtimeMs: readAuthStoreMtimeMs(statePath),
+			store: asStore
+		});
+		return asStore;
+	}
+	if (agentDir && !readOnly) {
+		const mainStore = loadPersistedAuthProfileStore();
+		if (mainStore && Object.keys(mainStore.profiles).length > 0) {
+			saveJsonFile(authPath, buildPersistedAuthProfileSecretsStore(mainStore));
+			log$1.info("inherited auth-profiles from main agent", { agentDir });
+			const inherited = {
+				version: mainStore.version,
+				profiles: { ...mainStore.profiles }
+			};
+			writeCachedAuthProfileStore({
+				authPath,
+				authMtimeMs: readAuthStoreMtimeMs(authPath),
+				stateMtimeMs: readAuthStoreMtimeMs(statePath),
+				store: inherited
+			});
+			return inherited;
+		}
+	}
+	const legacy = loadLegacyAuthProfileStore(agentDir);
+	const store = {
+		version: 1,
+		profiles: {}
+	};
+	if (legacy) applyLegacyAuthStore(store, legacy);
+	const mergedOAuth = mergeOAuthFileIntoStore(store);
+	const forceReadOnly = process.env.OPENCLAW_AUTH_STORE_READONLY === "1";
+	const shouldWrite = !readOnly && !forceReadOnly && (legacy !== null || mergedOAuth);
+	if (shouldWrite) saveAuthProfileStore(store, agentDir);
+	if (shouldWrite && legacy !== null) {
+		const legacyPath = resolveLegacyAuthStorePath(agentDir);
+		try {
+			fs.unlinkSync(legacyPath);
+		} catch (err) {
+			if (err?.code !== "ENOENT") log$1.warn("failed to delete legacy auth.json after migration", {
+				err,
+				legacyPath
+			});
+		}
+	}
+	if (!readOnly) writeCachedAuthProfileStore({
+		authPath,
+		authMtimeMs: readAuthStoreMtimeMs(authPath),
+		stateMtimeMs: readAuthStoreMtimeMs(statePath),
+		store
+	});
+	return store;
+}
+function loadAuthProfileStoreForRuntime(agentDir, options) {
+	const store = loadAuthProfileStoreForAgent(agentDir, options);
+	const authPath = resolveAuthStorePath(agentDir);
+	const mainAuthPath = resolveAuthStorePath();
+	if (!agentDir || authPath === mainAuthPath) return overlayExternalAuthProfiles(store, { agentDir });
+	return overlayExternalAuthProfiles(mergeAuthProfileStores(loadAuthProfileStoreForAgent(void 0, options), store), { agentDir });
+}
+function loadAuthProfileStoreForSecretsRuntime(agentDir) {
+	return loadAuthProfileStoreForRuntime(agentDir, {
+		readOnly: true,
+		allowKeychainPrompt: false
+	});
+}
+function ensureAuthProfileStore(agentDir, options) {
+	return overlayExternalAuthProfiles(ensureAuthProfileStoreWithoutExternalProfiles(agentDir, options), { agentDir });
+}
+function ensureAuthProfileStoreWithoutExternalProfiles(agentDir, options) {
+	const runtimeStore = resolveRuntimeAuthProfileStore(agentDir);
+	if (runtimeStore) return runtimeStore;
+	const store = loadAuthProfileStoreForAgent(agentDir, options);
+	const authPath = resolveAuthStorePath(agentDir);
+	const mainAuthPath = resolveAuthStorePath();
+	if (!agentDir || authPath === mainAuthPath) return store;
+	return mergeAuthProfileStores(loadAuthProfileStoreForAgent(void 0, options), store);
+}
+function saveAuthProfileStore(store, agentDir, options) {
+	const authPath = resolveAuthStorePath(agentDir);
+	const statePath = resolveAuthStatePath(agentDir);
+	saveJsonFile(authPath, buildPersistedAuthProfileSecretsStore(store, ({ profileId, credential }) => {
+		if (credential.type !== "oauth") return true;
+		if (options?.filterExternalAuthProfiles === false) return true;
+		return shouldPersistExternalAuthProfile({
+			store,
+			profileId,
+			credential,
+			agentDir
+		});
+	}));
+	savePersistedAuthProfileState(store, agentDir);
+	const runtimeStore = cloneAuthProfileStore(store);
+	writeCachedAuthProfileStore({
+		authPath,
+		authMtimeMs: readAuthStoreMtimeMs(authPath),
+		stateMtimeMs: readAuthStoreMtimeMs(statePath),
+		store: runtimeStore
+	});
+	if (hasRuntimeAuthProfileStoreSnapshot(agentDir)) setRuntimeAuthProfileStoreSnapshot(runtimeStore, agentDir);
+}
+//#endregion
+//#region node_modules/.pnpm/openclaw@2026.4.22_@napi-rs+canvas@0.1.99/node_modules/openclaw/dist/normalize-secret-input-k9H_9vvf.js
+/**
+* Secret normalization for copy/pasted credentials.
+*
+* Common footgun: line breaks (especially `\r`) embedded in API keys/tokens.
+* We strip line breaks anywhere, then trim whitespace at the ends.
+*
+* Another frequent source of runtime failures is rich-text/Unicode artifacts
+* (smart punctuation, box-drawing chars, etc.) pasted into API keys. These can
+* break HTTP header construction (`ByteString` violations). Drop non-Latin1
+* code points so malformed keys fail as auth errors instead of crashing request
+* setup.
+*
+* Intentionally does NOT remove ordinary spaces inside the string to avoid
+* silently altering "Bearer <token>" style values.
+*/
+function normalizeSecretInput(value) {
+	if (typeof value !== "string") return "";
+	const collapsed = value.replace(/[\r\n\u2028\u2029]+/g, "");
+	let latin1Only = "";
+	for (const char of collapsed) {
+		const codePoint = char.codePointAt(0);
+		if (typeof codePoint === "number" && codePoint <= 255) latin1Only += char;
+	}
+	return latin1Only.trim();
+}
+function normalizeOptionalSecretInput(value) {
+	const normalized = normalizeSecretInput(value);
+	return normalized ? normalized : void 0;
+}
+//#endregion
+//#region node_modules/.pnpm/openclaw@2026.4.22_@napi-rs+canvas@0.1.99/node_modules/openclaw/dist/model-auth-markers-U2294Wcj.js
+function resolveProviderEnvApiKeyCandidates(params) {
+	return resolveProviderAuthEnvVarCandidates(params);
+}
+resolveProviderEnvApiKeyCandidates();
+function listKnownProviderEnvApiKeyNames() {
+	return listKnownProviderAuthEnvVarNames();
+}
+const OAUTH_API_KEY_MARKER_PREFIX = "oauth:";
+const CUSTOM_LOCAL_AUTH_MARKER = "custom-local";
+const GCP_VERTEX_CREDENTIALS_MARKER = "gcp-vertex-credentials";
+const NON_ENV_SECRETREF_MARKER = "secretref-managed";
+const SECRETREF_ENV_HEADER_MARKER_PREFIX = "secretref-env:";
+const AWS_SDK_ENV_MARKERS = new Set([
+	"AWS_BEARER_TOKEN_BEDROCK",
+	"AWS_ACCESS_KEY_ID",
+	"AWS_PROFILE"
+]);
+const CORE_NON_SECRET_API_KEY_MARKERS = [CUSTOM_LOCAL_AUTH_MARKER, NON_ENV_SECRETREF_MARKER];
+let knownEnvApiKeyMarkersCache;
+let knownNonSecretApiKeyMarkersCache;
+const LEGACY_ENV_API_KEY_MARKERS = [
+	"GOOGLE_API_KEY",
+	"DEEPSEEK_API_KEY",
+	"PERPLEXITY_API_KEY",
+	"FIREWORKS_API_KEY",
+	"NOVITA_API_KEY",
+	"AZURE_OPENAI_API_KEY",
+	"AZURE_API_KEY",
+	"MINIMAX_CODE_PLAN_KEY"
+];
+function listKnownEnvApiKeyMarkers() {
+	knownEnvApiKeyMarkersCache ??= new Set([
+		...listKnownProviderEnvApiKeyNames(),
+		...LEGACY_ENV_API_KEY_MARKERS,
+		...AWS_SDK_ENV_MARKERS
+	]);
+	return knownEnvApiKeyMarkersCache;
+}
+function listKnownNonSecretApiKeyMarkers() {
+	knownNonSecretApiKeyMarkersCache ??= [...new Set([...CORE_NON_SECRET_API_KEY_MARKERS, ...loadPluginManifestRegistry({ cache: true }).plugins.flatMap((plugin) => plugin.origin === "bundled" ? plugin.nonSecretAuthMarkers ?? [] : [])])];
+	return [...knownNonSecretApiKeyMarkersCache];
+}
+function isAwsSdkAuthMarker(value) {
+	return AWS_SDK_ENV_MARKERS.has(value.trim());
+}
+function isKnownEnvApiKeyMarker(value) {
+	const trimmed = value.trim();
+	return listKnownEnvApiKeyMarkers().has(trimmed) && !isAwsSdkAuthMarker(trimmed);
+}
+function isOAuthApiKeyMarker(value) {
+	return value.trim().startsWith(OAUTH_API_KEY_MARKER_PREFIX);
+}
+function resolveNonEnvSecretRefApiKeyMarker(_source) {
+	return NON_ENV_SECRETREF_MARKER;
+}
+function resolveNonEnvSecretRefHeaderValueMarker(_source) {
+	return NON_ENV_SECRETREF_MARKER;
+}
+function resolveEnvSecretRefHeaderValueMarker(envVarName) {
+	return `${SECRETREF_ENV_HEADER_MARKER_PREFIX}${envVarName.trim()}`;
+}
+function isNonSecretApiKeyMarker(value, opts) {
+	const trimmed = value.trim();
+	if (!trimmed) return false;
+	if (isOAuthApiKeyMarker(trimmed) || listKnownNonSecretApiKeyMarkers().includes(trimmed) || isAwsSdkAuthMarker(trimmed)) return true;
+	if (opts?.includeEnvVarName === false) return false;
+	return listKnownEnvApiKeyMarkers().has(trimmed);
+}
+//#endregion
+//#region node_modules/.pnpm/openclaw@2026.4.22_@napi-rs+canvas@0.1.99/node_modules/openclaw/dist/model-auth-env-oyg2Hexc.js
+function hasGoogleVertexAdcCredentials(env) {
+	const explicitCredentialsPath = normalizeOptionalSecretInput(env.GOOGLE_APPLICATION_CREDENTIALS);
+	if (explicitCredentialsPath) return fs.existsSync(explicitCredentialsPath);
+	const homeDir = normalizeOptionalSecretInput(env.HOME) ?? os.homedir();
+	return fs.existsSync(path.join(homeDir, ".config", "gcloud", "application_default_credentials.json"));
+}
+function resolveGoogleVertexEnvApiKey(env) {
+	const explicitApiKey = normalizeOptionalSecretInput(env.GOOGLE_CLOUD_API_KEY);
+	if (explicitApiKey) return explicitApiKey;
+	const hasProject = Boolean(env.GOOGLE_CLOUD_PROJECT || env.GCLOUD_PROJECT);
+	const hasLocation = Boolean(env.GOOGLE_CLOUD_LOCATION);
+	return hasProject && hasLocation && hasGoogleVertexAdcCredentials(env) ? GCP_VERTEX_CREDENTIALS_MARKER : void 0;
+}
+function resolveEnvApiKey(provider, env = process.env) {
+	const normalized = resolveProviderIdForAuth(provider, { env });
+	const candidateMap = resolveProviderEnvApiKeyCandidates({ env });
+	const applied = new Set(getShellEnvAppliedKeys());
+	const pick = (envVar) => {
+		const value = normalizeOptionalSecretInput(env[envVar]);
+		if (!value) return null;
+		return {
+			apiKey: value,
+			source: applied.has(envVar) ? `shell env: ${envVar}` : `env: ${envVar}`
+		};
+	};
+	const candidates = Object.hasOwn(candidateMap, normalized) ? candidateMap[normalized] : void 0;
+	if (Array.isArray(candidates)) {
+		for (const envVar of candidates) {
+			const resolved = pick(envVar);
+			if (resolved) return resolved;
+		}
+		return null;
+	}
+	if (normalized === "google-vertex") {
+		const envKey = resolveGoogleVertexEnvApiKey(env);
+		if (!envKey) return null;
+		return {
+			apiKey: envKey,
+			source: "gcloud adc"
+		};
+	}
+	const setupProvider = resolvePluginSetupProvider({
+		provider: normalized,
+		env
+	});
+	if (setupProvider?.resolveConfigApiKey) {
+		const resolved = setupProvider.resolveConfigApiKey({
+			provider: normalized,
+			env
+		});
+		if (resolved?.trim()) return {
+			apiKey: resolved,
+			source: resolved === "gcp-vertex-credentials" ? "gcloud adc" : "env"
+		};
+	}
+	return null;
+}
+//#endregion
+export { resolveAuthStorePath as A, log$1 as C, shouldBootstrapFromExternalCliCredential as D, saveAuthProfileStore as E, resolveOAuthRefreshLockPath as M, resolveOpenClawAgentDir as N, shouldReplaceStoredOAuthCredential as O, withFileLock as P, loadAuthProfileStoreForSecretsRuntime as S, resolveTokenExpiryState as T, ensureAuthStoreFile as _, isNonSecretApiKeyMarker as a, isSafeToAdoptBootstrapOAuthIdentity as b, resolveNonEnvSecretRefHeaderValueMarker as c, normalizeSecretInput as d, AUTH_STORE_LOCK_OPTIONS as f, ensureAuthProfileStore as g, areOAuthCredentialsEquivalent as h, isKnownEnvApiKeyMarker as i, resolveAuthStorePathForDisplay as j, updateAuthProfileStoreWithLock as k, resolveProviderEnvApiKeyCandidates as l, OAUTH_REFRESH_LOCK_OPTIONS as m, CUSTOM_LOCAL_AUTH_MARKER as n, resolveEnvSecretRefHeaderValueMarker as o, OAUTH_REFRESH_CALL_TIMEOUT_MS as p, NON_ENV_SECRETREF_MARKER as r, resolveNonEnvSecretRefApiKeyMarker as s, resolveEnvApiKey as t, normalizeOptionalSecretInput as u, evaluateStoredCredentialEligibility as v, readManagedExternalCliCredential as w, isSafeToAdoptMainStoreOAuthIdentity as x, hasUsableOAuthCredential as y };