"use strict";
/* Socket Lib - Built with rolldown */
Object.defineProperty(exports, Symbol.toStringTag, { value: 'Module' });
const require_secrets_keychain = require('./keychain.js');

//#region src/secrets/find.ts
/**
* @file Resolve a secret from the canonical fleet precedence order: process env
*   → OS keychain. Returns the value + the source it came from so the caller
*   can log which slot won. Why a helper instead of inlining: every consumer of
*   the fleet's Socket API token does the same dance — check
*   `process.env.SOCKET_API_TOKEN`, fall back to a legacy env-var alias, fall
*   back to `readSecret({...})` from the keychain. Tools drift on the exact
*   order and on which aliases they consider. This helper centralizes the
*   precedence so a token check in socket-cli, socket-mcp, depot, and ad-hoc
*   scripts all behave the same way. Not included: `.env` file parsing. Hosts
*   that want `.env` support should pre-populate `process.env` from `.env`
*   themselves (e.g. with `dotenv.config()` at process start). Folding `.env`
*   reads into this helper would couple the secrets API to a config-file parser
*   that's better lived at the application boundary. Prompt minimization: every
*   keychain read short-circuits through the process-scoped cache in
*   `./_internal.ts`. So calling `resolve` multiple times in one process spawns
*   at most one `security` (macOS) / `secret-tool` (Linux) / `powershell`
*   (Windows) per `{service, account}` pair. Combined with macOS's `-A -T ''`
*   ACL (set by `writeSecret`), this means: at most one Keychain auth prompt
*   across a process's entire lifetime — and zero prompts when the env-var path
*   covers the read.
*/
/**
* Pull a non-empty string from `process.env[name]`. Returns `undefined` for
* missing or empty values so the caller can fall through to the next source
* without distinguishing the two cases.
*/
function readEnv(name) {
	const value = process.env[name];
	if (typeof value !== "string") return;
	const trimmed = value.trim();
	return trimmed ? trimmed : void 0;
}
/**
* Resolve a secret following the canonical env → keychain order. Returns
* `undefined` when neither source has the value — the caller's signal to prompt
* the user or surface a setup hint.
*/
async function resolve(opts) {
	const { accounts, allowEnvOnly, service } = opts;
	for (let i = 0, { length } = accounts; i < length; i += 1) {
		const account = accounts[i];
		const fromEnv = readEnv(account);
		if (fromEnv) return {
			value: fromEnv,
			source: "env",
			account
		};
	}
	if (allowEnvOnly) return;
	for (let i = 0, { length } = accounts; i < length; i += 1) {
		const account = accounts[i];
		const fromKeychain = await require_secrets_keychain.readSecret({
			service,
			account
		});
		if (fromKeychain) return {
			value: fromKeychain,
			source: "keychain",
			account
		};
	}
}
/**
* Sync variant for non-async callers (hook initializers, schema validators that
* run before any `await` machinery exists).
*/
function resolveSync(opts) {
	const { accounts, allowEnvOnly, service } = opts;
	for (let i = 0, { length } = accounts; i < length; i += 1) {
		const account = accounts[i];
		const fromEnv = readEnv(account);
		if (fromEnv) return {
			value: fromEnv,
			source: "env",
			account
		};
	}
	if (allowEnvOnly) return;
	for (let i = 0, { length } = accounts; i < length; i += 1) {
		const account = accounts[i];
		const fromKeychain = require_secrets_keychain.readSecretSync({
			service,
			account
		});
		if (fromKeychain) return {
			value: fromKeychain,
			source: "keychain",
			account
		};
	}
}

//#endregion
exports.readEnv = readEnv;
exports.resolve = resolve;
exports.resolveSync = resolveSync;