// src/auth/passthrough.ts
var ANTHROPIC_API_KEY_RE = /^sk-ant-api[A-Za-z0-9_-]{20,}$/;
function isAnthropicApiKey(key) {
  return ANTHROPIC_API_KEY_RE.test(key);
}
function isAnthropicOAuthToken(value) {
  return typeof value === "string" && value.startsWith("sk-ant-oat");
}
var PASSTHROUGH_ROUTE_PATTERNS = [
  // Agents
  /^\/anthropic\/v1\/agents$/,
  /^\/anthropic\/v1\/agents\/[^/]+$/,
  // Sessions + sub-resources
  /^\/anthropic\/v1\/sessions$/,
  /^\/anthropic\/v1\/sessions\/[^/]+$/,
  /^\/anthropic\/v1\/sessions\/[^/]+\/archive$/,
  /^\/anthropic\/v1\/sessions\/[^/]+\/events$/,
  /^\/anthropic\/v1\/sessions\/[^/]+\/events\/stream$/,
  // Vaults + entries + credentials
  /^\/anthropic\/v1\/vaults$/,
  /^\/anthropic\/v1\/vaults\/[^/]+$/,
  /^\/anthropic\/v1\/vaults\/[^/]+\/entries$/,
  /^\/anthropic\/v1\/vaults\/[^/]+\/entries\/[^/]+$/,
  /^\/anthropic\/v1\/vaults\/[^/]+\/credentials$/,
  /^\/anthropic\/v1\/vaults\/[^/]+\/credentials\/[^/]+$/,
  // Environments
  /^\/anthropic\/v1\/environments$/,
  /^\/anthropic\/v1\/environments\/[^/]+$/,
  /^\/anthropic\/v1\/environments\/[^/]+\/archive$/,
  // Files
  /^\/anthropic\/v1\/files$/,
  /^\/anthropic\/v1\/files\/[^/]+$/,
  /^\/anthropic\/v1\/files\/[^/]+\/content$/,
  // Messages API — escape hatch for features Managed Agents doesn't
  // expose (tool_choice forcing, assistant prefill). A passthrough
  // caller can mix `/anthropic/v1/sessions/*` (Managed Agents) and
  // `/anthropic/v1/messages` (raw Messages API) under one base URL +
  // one sk-ant-api* key. Forwards to `api.anthropic.com/v1/messages`
  // unchanged — gateway adds nothing, strips nothing.
  /^\/anthropic\/v1\/messages$/,
  /^\/anthropic\/v1\/messages\/count_tokens$/
];
function isPassthroughAllowedPath(pathname) {
  return PASSTHROUGH_ROUTE_PATTERNS.some((re) => re.test(pathname));
}

export {
  isAnthropicApiKey,
  isAnthropicOAuthToken,
  isPassthroughAllowedPath
};
