// src/resolve-auth-token.ts
var resolvedCache = /* @__PURE__ */ new Map();
function cacheKeyForSecretRef(ref) {
  const sortedKeys = Object.keys(ref).sort();
  const stable = {};
  for (const key of sortedKeys) {
    stable[key] = ref[key];
  }
  return JSON.stringify(stable);
}
function isPlainObject(value) {
  return typeof value === "object" && value !== null && !Array.isArray(value);
}
async function resolveAgentAccessAuthToken(value, options = {}) {
  if (value === void 0 || value === null) return void 0;
  if (typeof value === "string") {
    const trimmed = value.trim();
    return trimmed.length > 0 ? trimmed : void 0;
  }
  if (!isPlainObject(value)) {
    throw new Error(
      "unsupported SecretRef shape for agentAccessHttp.authToken \u2014 expected a string or an object with a `source` field (see https://github.com/joshuaswarren/remnic/issues/757)"
    );
  }
  const ref = value;
  if (typeof ref.source !== "string" || ref.source.trim().length === 0) {
    throw new Error(
      "unsupported SecretRef shape for agentAccessHttp.authToken \u2014 missing required `source` field (see https://github.com/joshuaswarren/remnic/issues/757)"
    );
  }
  const cacheKey = cacheKeyForSecretRef(ref);
  const cached = resolvedCache.get(cacheKey);
  if (cached !== void 0) return cached;
  const resolver = options.resolveSecretRef ?? null;
  if (!resolver) {
    throw new Error(
      `cannot resolve agentAccessHttp.authToken SecretRef (source="${ref.source}") \u2014 a SecretRef resolver was not provided. Use a literal string or \${ENV_VAR} expansion in standalone Remnic, or have the host adapter resolve SecretRef objects through its native secret resolver (see https://github.com/joshuaswarren/remnic/issues/757).`
    );
  }
  let resolved;
  try {
    const out = await resolver(ref);
    if (typeof out === "string") {
      const trimmed = out.trim();
      if (trimmed.length > 0) resolved = trimmed;
    }
  } catch (err) {
    throw new Error(
      `failed to resolve agentAccessHttp.authToken SecretRef (source="${ref.source}"): ${err instanceof Error ? err.message : String(err)}`
    );
  }
  if (!resolved) {
    throw new Error(
      `agentAccessHttp.authToken SecretRef resolved to empty value (source="${ref.source}", provider="${ref.provider ?? ""}") \u2014 refusing to start the HTTP bridge with an empty bearer token.`
    );
  }
  resolvedCache.set(cacheKey, resolved);
  return resolved;
}
function isAgentAccessSecretRef(value) {
  if (!isPlainObject(value)) return false;
  const ref = value;
  return typeof ref.source === "string" && ref.source.trim().length > 0;
}
function clearAuthTokenSecretCache() {
  resolvedCache.clear();
}

export {
  resolveAgentAccessAuthToken,
  isAgentAccessSecretRef,
  clearAuthTokenSecretCache
};
//# sourceMappingURL=chunk-MXC3AP5I.js.map