#!/usr/bin/env node
import "./chunk-2H7UOFLK.js";

// src/config/keychain-backend.ts
var KEYCHAIN_SERVICE = "dreamboard-cli";
var KEYCHAIN_ACCOUNT = "session";
var cachedModule;
async function loadKeyringModule() {
  if (cachedModule !== void 0) return cachedModule;
  try {
    const mod = await import("@napi-rs/keyring");
    cachedModule = mod;
  } catch {
    cachedModule = null;
  }
  return cachedModule;
}
function keychainProbe(entry) {
  try {
    entry.getPassword();
    return true;
  } catch {
    return false;
  }
}
function parsePayload(raw) {
  if (raw === null || raw === void 0) return null;
  const trimmed = raw.trim();
  if (trimmed.length === 0) return null;
  try {
    const parsed = JSON.parse(trimmed);
    if (!parsed.accessToken && !parsed.refreshToken) return null;
    return {
      accessToken: parsed.accessToken || void 0,
      refreshToken: parsed.refreshToken || void 0,
      tokenExpiresAt: parsed.tokenExpiresAt || void 0,
      clerkOAuthIssuer: parsed.clerkOAuthIssuer || void 0,
      clerkOAuthClientId: parsed.clerkOAuthClientId || void 0,
      clerkOAuthTokenUrl: parsed.clerkOAuthTokenUrl || void 0,
      environment: parsed.environment || void 0
    };
  } catch {
    return null;
  }
}
function writeFull(entry, creds) {
  if (!creds.accessToken || !creds.refreshToken) {
    throw new Error(
      "Refusing to persist credentials with an empty accessToken or refreshToken."
    );
  }
  const payload = {
    accessToken: creds.accessToken,
    refreshToken: creds.refreshToken,
    tokenExpiresAt: creds.tokenExpiresAt,
    clerkOAuthIssuer: creds.clerkOAuthIssuer,
    clerkOAuthClientId: creds.clerkOAuthClientId,
    clerkOAuthTokenUrl: creds.clerkOAuthTokenUrl,
    environment: creds.environment
  };
  entry.setPassword(JSON.stringify(payload));
}
function writeAccessOnly(entry, accessToken) {
  if (!accessToken) {
    throw new Error("Refusing to persist an empty access token.");
  }
  const payload = { accessToken };
  entry.setPassword(JSON.stringify(payload));
}
function clear(entry) {
  try {
    entry.deletePassword();
  } catch {
  }
}
async function tryKeychainBackend() {
  const mod = await loadKeyringModule();
  if (!mod) {
    return {
      available: false,
      reason: "@napi-rs/keyring is not installed for this platform"
    };
  }
  let entry;
  try {
    entry = new mod.Entry(KEYCHAIN_SERVICE, KEYCHAIN_ACCOUNT);
  } catch (err) {
    return {
      available: false,
      reason: `Failed to construct keyring entry: ${String(err.message ?? err)}`
    };
  }
  if (!keychainProbe(entry)) {
    return {
      available: false,
      reason: "OS keyring is not accessible from this process"
    };
  }
  const backend = {
    name: "keychain",
    async read() {
      try {
        return parsePayload(entry.getPassword());
      } catch (err) {
        const message = String(err.message ?? err);
        if (/no matching entry|not found/i.test(message)) {
          return null;
        }
        throw err;
      }
    },
    async writeFull(creds) {
      writeFull(entry, creds);
    },
    async writeAccessOnly(accessToken) {
      writeAccessOnly(entry, accessToken);
    },
    async clear() {
      clear(entry);
    }
  };
  return { available: true, backend };
}
function _setKeyringModuleForTests(mod) {
  cachedModule = mod;
}
function _resetKeyringModuleForTests() {
  cachedModule = void 0;
}
export {
  _resetKeyringModuleForTests,
  _setKeyringModuleForTests,
  tryKeychainBackend
};
//# sourceMappingURL=keychain-backend-JHTXAKWC.js.map