Plugin SDK: harden provider auth seams

extensions/openrouter/index.ts

@@ -4,7 +4,7 @@ import {
   type ProviderResolveDynamicModelContext,
   type ProviderRuntimeModel,
 } from "openclaw/plugin-sdk/core";
-import { createProviderApiKeyAuthMethod } from "openclaw/plugin-sdk/provider-auth";
+import { createProviderApiKeyAuthMethod } from "openclaw/plugin-sdk/provider-auth-api-key";
 import { applyXaiModelCompat, DEFAULT_CONTEXT_TOKENS } from "openclaw/plugin-sdk/provider-models";
 import {
   getOpenRouterModelCapabilities,

extensions/venice/index.ts

@@ -1,5 +1,5 @@
 import { definePluginEntry } from "openclaw/plugin-sdk/core";
-import { createProviderApiKeyAuthMethod } from "openclaw/plugin-sdk/provider-auth";
+import { createProviderApiKeyAuthMethod } from "openclaw/plugin-sdk/provider-auth-api-key";
 import { buildSingleProviderApiKeyCatalog } from "openclaw/plugin-sdk/provider-catalog";
 import { applyXaiModelCompat } from "openclaw/plugin-sdk/provider-models";
 import { applyVeniceConfig, VENICE_DEFAULT_MODEL_REF } from "./onboard.js";

extensions/xai/index.ts

@@ -1,5 +1,5 @@
 import { definePluginEntry } from "openclaw/plugin-sdk/core";
-import { createProviderApiKeyAuthMethod } from "openclaw/plugin-sdk/provider-auth";
+import { createProviderApiKeyAuthMethod } from "openclaw/plugin-sdk/provider-auth-api-key";
 import { buildSingleProviderApiKeyCatalog } from "openclaw/plugin-sdk/provider-catalog";
 import { applyXaiModelCompat } from "openclaw/plugin-sdk/provider-models";
 import { createToolStreamWrapper } from "openclaw/plugin-sdk/provider-stream";

extensions/zai/index.ts

@@ -15,7 +15,7 @@ import {
   type SecretInput,
   upsertAuthProfile,
   validateApiKeyInput,
-} from "openclaw/plugin-sdk/provider-auth";
+} from "openclaw/plugin-sdk/provider-auth-api-key";
 import { DEFAULT_CONTEXT_TOKENS, normalizeModelCompat } from "openclaw/plugin-sdk/provider-models";
 import { createZaiToolStreamWrapper } from "openclaw/plugin-sdk/provider-stream";
 import { fetchZaiUsage, resolveLegacyPiAgentAccessToken } from "openclaw/plugin-sdk/provider-usage";

package.json

@@ -414,6 +414,10 @@
       "types": "./dist/plugin-sdk/provider-auth.d.ts",
       "default": "./dist/plugin-sdk/provider-auth.js"
     },
+    "./plugin-sdk/provider-auth-api-key": {
+      "types": "./dist/plugin-sdk/provider-auth-api-key.d.ts",
+      "default": "./dist/plugin-sdk/provider-auth-api-key.js"
+    },
     "./plugin-sdk/provider-auth-login": {
       "types": "./dist/plugin-sdk/provider-auth-login.d.ts",
       "default": "./dist/plugin-sdk/provider-auth-login.js"

scripts/lib/plugin-sdk-entrypoints.json

@@ -93,6 +93,7 @@
   "json-store",
   "keyed-async-queue",
   "provider-auth",
+  "provider-auth-api-key",
   "provider-auth-login",
   "provider-catalog",
   "provider-models",

src/plugin-sdk/agent-runtime.ts

@@ -1,7 +1,6 @@
 // Public agent/model/runtime helpers for plugins that integrate with core agent flows.
 
 export * from "../agents/agent-scope.js";
-export * from "../agents/auth-profiles.js";
 export * from "../agents/current-time.js";
 export * from "../agents/date-time.js";
 export * from "../agents/defaults.js";
@@ -25,3 +24,52 @@ export * from "../agents/vllm-defaults.js";
 // Intentional public runtime surface: channel plugins use ingress agent helpers directly.
 export * from "../agents/agent-command.js";
 export * from "../tts/tts.js";
+
+export {
+  CLAUDE_CLI_PROFILE_ID,
+  CODEX_CLI_PROFILE_ID,
+  dedupeProfileIds,
+  listProfilesForProvider,
+  markAuthProfileGood,
+  setAuthProfileOrder,
+  upsertAuthProfile,
+  upsertAuthProfileWithLock,
+  repairOAuthProfileIdMismatch,
+  suggestOAuthProfileIdForLegacyDefault,
+  clearRuntimeAuthProfileStoreSnapshots,
+  ensureAuthProfileStore,
+  loadAuthProfileStoreForSecretsRuntime,
+  loadAuthProfileStoreForRuntime,
+  replaceRuntimeAuthProfileStoreSnapshots,
+  loadAuthProfileStore,
+  saveAuthProfileStore,
+  calculateAuthProfileCooldownMs,
+  clearAuthProfileCooldown,
+  clearExpiredCooldowns,
+  getSoonestCooldownExpiry,
+  isProfileInCooldown,
+  markAuthProfileCooldown,
+  markAuthProfileFailure,
+  markAuthProfileUsed,
+  resolveProfilesUnavailableReason,
+  resolveProfileUnusableUntilForDisplay,
+  resolveApiKeyForProfile,
+  resolveAuthProfileDisplayLabel,
+  formatAuthDoctorHint,
+  resolveAuthProfileEligibility,
+  resolveAuthProfileOrder,
+  resolveAuthStorePathForDisplay,
+} from "../agents/auth-profiles.js";
+export type {
+  ApiKeyCredential,
+  AuthCredentialReasonCode,
+  AuthProfileCredential,
+  AuthProfileEligibilityReasonCode,
+  AuthProfileFailureReason,
+  AuthProfileIdRepairResult,
+  AuthProfileStore,
+  OAuthCredential,
+  ProfileUsageStats,
+  TokenCredential,
+  TokenExpiryState,
+} from "../agents/auth-profiles.js";

src/plugin-sdk/provider-auth-api-key.ts

@@ -0,0 +1,21 @@
+// Public API-key onboarding helpers for provider plugins.
+
+export type { OpenClawConfig } from "../config/config.js";
+export type { SecretInput } from "../config/types.secrets.js";
+
+export { upsertAuthProfile } from "../agents/auth-profiles.js";
+export {
+  formatApiKeyPreview,
+  normalizeApiKeyInput,
+  validateApiKeyInput,
+  ensureApiKeyFromOptionEnvOrPrompt,
+  normalizeSecretInputModeInput,
+  promptSecretRefForSetup,
+  resolveSecretInputModeForEnvSelection,
+} from "../plugins/provider-auth-input.js";
+export { applyAuthProfileConfig, buildApiKeyCredential } from "../plugins/provider-auth-helpers.js";
+export { createProviderApiKeyAuthMethod } from "../plugins/provider-api-key-auth.js";
+export {
+  normalizeOptionalSecretInput,
+  normalizeSecretInput,
+} from "../utils/normalize-secret-input.js";