/**
 * Google Drive adapter — service-account auth (W0207).
 *
 * Resolves credentials from three env vars in precedence order:
 * 1. `AILF_GOOGLE_DRIVE_SERVICE_ACCOUNT_JSON` — raw JSON string
 * 2. `AILF_GOOGLE_DRIVE_SERVICE_ACCOUNT_PATH` — path to a credentials file
 * 3. `GOOGLE_APPLICATION_CREDENTIALS` — Google's standard ADC env var
 *
 * No OAuth user flow — v1 is service-account only.
 */
import { GoogleAuth } from "google-auth-library";
/** Scope granted to the constructed credential. */
export const DRIVE_READONLY_SCOPE = "https://www.googleapis.com/auth/drive.readonly";
/**
 * Construct a `GoogleAuth` instance for the Drive `readonly` scope from
 * service-account credentials.
 *
 * Throws a clear error citing all three accepted env vars when nothing is
 * configured. Invalid JSON in `AILF_GOOGLE_DRIVE_SERVICE_ACCOUNT_JSON`
 * surfaces as a parse error at construction time.
 */
export function loadGoogleAuth(env = process.env) {
    const rawJson = env.AILF_GOOGLE_DRIVE_SERVICE_ACCOUNT_JSON;
    if (rawJson) {
        const credentials = JSON.parse(rawJson);
        return new GoogleAuth({
            credentials,
            scopes: [DRIVE_READONLY_SCOPE],
        });
    }
    const path = env.AILF_GOOGLE_DRIVE_SERVICE_ACCOUNT_PATH ??
        env.GOOGLE_APPLICATION_CREDENTIALS;
    if (path) {
        return new GoogleAuth({
            keyFile: path,
            scopes: [DRIVE_READONLY_SCOPE],
        });
    }
    throw new Error("Google Drive auth: no service-account credentials found. Set one of:\n" +
        "  AILF_GOOGLE_DRIVE_SERVICE_ACCOUNT_JSON  (raw JSON)\n" +
        "  AILF_GOOGLE_DRIVE_SERVICE_ACCOUNT_PATH  (path to credentials file)\n" +
        "  GOOGLE_APPLICATION_CREDENTIALS          (Google ADC file path)");
}
