"use strict";
/**
 * Identity and credential access for proxy activities.
 *
 * Activities call `getActivityIdentity()` to read the principal
 * injected by the activity interceptor and to resolve provider
 * credentials (OAuth tokens, API keys) via the credential cascade.
 *
 * @example Single-identity — activity runs as the invoking user or bot
 * ```typescript
 * import { getActivityIdentity } from '../services/iam/activity';
 *
 * export async function sendEmail(input: { to: string; body: string }) {
 *   const identity = getActivityIdentity();
 *   const gmailToken = await identity.getCredential('google');
 *   // identity.principal has id, type, roles, displayName
 * }
 * ```
 *
 * @example Dual-identity — bot executes but needs the invoking user's credential
 * ```typescript
 * export async function readUserMail(input: { query: string }) {
 *   const identity = getActivityIdentity();
 *   // getCredential checks the bot first, then falls back to the
 *   // human invoker's stored token (e.g., their Gmail OAuth)
 *   const gmailToken = await identity.getCredential('google');
 *   // identity.initiatingPrincipal has the human's profile
 * }
 * ```
 */
Object.defineProperty(exports, "__esModule", { value: true });
exports.getActivityIdentity = getActivityIdentity;
const context_1 = require("./context");
const credentials_1 = require("./credentials");
/**
 * Returns the identity context for the current proxy activity,
 * or `null` when called outside an interceptor-wrapped context
 * (e.g., cron-invoked or agent-triggered workflows).
 */
function getActivityIdentity() {
    const ctx = (0, context_1.getToolContext)();
    if (!ctx)
        return null;
    return {
        principal: ctx.principal,
        initiatingPrincipal: ctx.initiatingPrincipal,
        scopes: ctx.credentials.scopes,
        toolContext: ctx,
        async getCredential(provider, label) {
            const resolved = await (0, credentials_1.resolveCredential)(ctx.principal, provider, label, {
                fallbackPrincipal: ctx.initiatingPrincipal,
            });
            if (!resolved) {
                throw new credentials_1.MissingCredentialError(provider);
            }
            return resolved.value;
        },
    };
}
