import { b as ensureAuthProfileStore, c as resolveApiKeyForProfile, h as listProfilesForProvider, n as resolveAuthProfileOrder, w as resolveAuthStorePathForDisplay } from "./auth-profiles-Ce7R_25e.js";
import { t as formatCliCommand } from "./command-format-BzjsXBTi.js";
import { u as normalizeProviderId, x as getProviderAdapter } from "./model-selection-7wdmO-Iw.js";
import { n as normalizeSecretInput, t as normalizeOptionalSecretInput } from "./normalize-secret-input-DjGU5EXe.js";
import { t as getShellEnvAppliedKeys } from "./shell-env-Dc3iU7HK.js";
import path from "node:path";
import { getEnvApiKey } from "@mariozechner/pi-ai";

//#region src/agents/model-auth.ts
const AWS_BEARER_ENV = "AWS_BEARER_TOKEN_BEDROCK";
const AWS_ACCESS_KEY_ENV = "AWS_ACCESS_KEY_ID";
const AWS_SECRET_KEY_ENV = "AWS_SECRET_ACCESS_KEY";
const AWS_PROFILE_ENV = "AWS_PROFILE";
function resolveProviderConfig(cfg, provider) {
	const providers = cfg?.models?.providers ?? {};
	const direct = providers[provider];
	if (direct) return direct;
	const normalized = normalizeProviderId(provider);
	if (normalized === provider) return Object.entries(providers).find(([key]) => normalizeProviderId(key) === normalized)?.[1];
	return providers[normalized] ?? Object.entries(providers).find(([key]) => normalizeProviderId(key) === normalized)?.[1];
}
function getCustomProviderApiKey(cfg, provider) {
	return normalizeOptionalSecretInput(resolveProviderConfig(cfg, provider)?.apiKey);
}
function resolveProviderAuthOverride(cfg, provider) {
	const auth = resolveProviderConfig(cfg, provider)?.auth;
	if (auth === "api-key" || auth === "aws-sdk" || auth === "oauth" || auth === "token") return auth;
}
function resolveEnvSourceLabel(params) {
	return `${params.envVars.some((envVar) => params.applied.has(envVar)) ? "shell env: " : "env: "}${params.label}`;
}
function resolveAwsSdkEnvVarName(env = process.env) {
	if (env[AWS_BEARER_ENV]?.trim()) return AWS_BEARER_ENV;
	if (env[AWS_ACCESS_KEY_ENV]?.trim() && env[AWS_SECRET_KEY_ENV]?.trim()) return AWS_ACCESS_KEY_ENV;
	if (env[AWS_PROFILE_ENV]?.trim()) return AWS_PROFILE_ENV;
}
function resolveAwsSdkAuthInfo() {
	const applied = new Set(getShellEnvAppliedKeys());
	if (process.env[AWS_BEARER_ENV]?.trim()) return {
		mode: "aws-sdk",
		source: resolveEnvSourceLabel({
			applied,
			envVars: [AWS_BEARER_ENV],
			label: AWS_BEARER_ENV
		})
	};
	if (process.env[AWS_ACCESS_KEY_ENV]?.trim() && process.env[AWS_SECRET_KEY_ENV]?.trim()) return {
		mode: "aws-sdk",
		source: resolveEnvSourceLabel({
			applied,
			envVars: [AWS_ACCESS_KEY_ENV, AWS_SECRET_KEY_ENV],
			label: `${AWS_ACCESS_KEY_ENV} + ${AWS_SECRET_KEY_ENV}`
		})
	};
	if (process.env[AWS_PROFILE_ENV]?.trim()) return {
		mode: "aws-sdk",
		source: resolveEnvSourceLabel({
			applied,
			envVars: [AWS_PROFILE_ENV],
			label: AWS_PROFILE_ENV
		})
	};
	return {
		mode: "aws-sdk",
		source: "aws-sdk default chain"
	};
}
async function resolveApiKeyForProvider(params) {
	const { provider, cfg, profileId, preferredProfile } = params;
	const store = params.store ?? ensureAuthProfileStore(params.agentDir);
	if (profileId) {
		const resolved = await resolveApiKeyForProfile({
			cfg,
			store,
			profileId,
			agentDir: params.agentDir
		});
		if (!resolved) throw new Error(`No credentials found for profile "${profileId}".`);
		const mode = store.profiles[profileId]?.type;
		return {
			apiKey: resolved.apiKey,
			profileId,
			source: `profile:${profileId}`,
			mode: mode === "oauth" ? "oauth" : mode === "token" ? "token" : "api-key"
		};
	}
	const authOverride = resolveProviderAuthOverride(cfg, provider);
	if (authOverride === "aws-sdk") return resolveAwsSdkAuthInfo();
	const order = resolveAuthProfileOrder({
		cfg,
		store,
		provider,
		preferredProfile
	});
	for (const candidate of order) try {
		const resolved = await resolveApiKeyForProfile({
			cfg,
			store,
			profileId: candidate,
			agentDir: params.agentDir
		});
		if (resolved) {
			const mode = store.profiles[candidate]?.type;
			return {
				apiKey: resolved.apiKey,
				profileId: candidate,
				source: `profile:${candidate}`,
				mode: mode === "oauth" ? "oauth" : mode === "token" ? "token" : "api-key"
			};
		}
	} catch {}
	const envResolved = resolveEnvApiKey(provider);
	if (envResolved) return {
		apiKey: envResolved.apiKey,
		source: envResolved.source,
		mode: envResolved.source.includes("OAUTH_TOKEN") ? "oauth" : "api-key"
	};
	const customKey = getCustomProviderApiKey(cfg, provider);
	if (customKey) return {
		apiKey: customKey,
		source: "models.json",
		mode: "api-key"
	};
	const normalized = normalizeProviderId(provider);
	if (authOverride === void 0 && normalized === "amazon-bedrock") return resolveAwsSdkAuthInfo();
	for (const sibling of getProviderAdapter(provider).conflictingOAuthProviders?.() ?? []) if (listProfilesForProvider(store, sibling).length > 0) throw new Error(`No API key found for provider "${provider}". You are authenticated with "${sibling}" via OAuth. Use ${sibling}/<model> for OAuth-backed access, or set the corresponding API key env var to use ${provider}/<model>.`);
	const authStorePath = resolveAuthStorePathForDisplay(params.agentDir);
	const resolvedAgentDir = path.dirname(authStorePath);
	throw new Error([
		`No API key found for provider "${provider}".`,
		`Auth store: ${authStorePath} (agentDir: ${resolvedAgentDir}).`,
		`Configure auth for this agent (${formatCliCommand("symi agents add <id>")}) or copy auth-profiles.json from the main agentDir.`
	].join(" "));
}
function resolveEnvApiKey(provider) {
	const normalized = normalizeProviderId(provider);
	const applied = new Set(getShellEnvAppliedKeys());
	const pick = (envVar) => {
		const value = normalizeOptionalSecretInput(process.env[envVar]);
		if (!value) return null;
		return {
			apiKey: value,
			source: applied.has(envVar) ? `shell env: ${envVar}` : `env: ${envVar}`
		};
	};
	if (normalized === "github-copilot") return pick("COPILOT_GITHUB_TOKEN") ?? pick("GH_TOKEN") ?? pick("GITHUB_TOKEN");
	if (normalized === "anthropic") return pick("ANTHROPIC_OAUTH_TOKEN") ?? pick("ANTHROPIC_API_KEY");
	if (normalized === "chutes") return pick("CHUTES_OAUTH_TOKEN") ?? pick("CHUTES_API_KEY");
	if (normalized === "zai") return pick("ZAI_API_KEY") ?? pick("Z_AI_API_KEY");
	if (normalized === "google-vertex") {
		const envKey = getEnvApiKey(normalized);
		if (!envKey) return null;
		return {
			apiKey: envKey,
			source: "gcloud adc"
		};
	}
	if (normalized === "opencode") return pick("OPENCODE_API_KEY") ?? pick("OPENCODE_ZEN_API_KEY");
	if (normalized === "qwen-portal") return pick("QWEN_OAUTH_TOKEN") ?? pick("QWEN_PORTAL_API_KEY");
	if (normalized === "volcengine" || normalized === "volcengine-plan") return pick("VOLCANO_ENGINE_API_KEY");
	if (normalized === "byteplus" || normalized === "byteplus-plan") return pick("BYTEPLUS_API_KEY");
	if (normalized === "minimax-portal") return pick("MINIMAX_OAUTH_TOKEN") ?? pick("MINIMAX_API_KEY");
	if (normalized === "kimi-coding") return pick("KIMI_API_KEY") ?? pick("KIMICODE_API_KEY");
	if (normalized === "huggingface") return pick("HUGGINGFACE_HUB_TOKEN") ?? pick("HF_TOKEN");
	const envVar = {
		openai: "OPENAI_API_KEY",
		google: "GEMINI_API_KEY",
		voyage: "VOYAGE_API_KEY",
		groq: "GROQ_API_KEY",
		deepgram: "DEEPGRAM_API_KEY",
		cerebras: "CEREBRAS_API_KEY",
		xai: "XAI_API_KEY",
		openrouter: "OPENROUTER_API_KEY",
		litellm: "LITELLM_API_KEY",
		"vercel-ai-gateway": "AI_GATEWAY_API_KEY",
		"cloudflare-ai-gateway": "CLOUDFLARE_AI_GATEWAY_API_KEY",
		moonshot: "MOONSHOT_API_KEY",
		minimax: "MINIMAX_API_KEY",
		nvidia: "NVIDIA_API_KEY",
		xiaomi: "XIAOMI_API_KEY",
		synthetic: "SYNTHETIC_API_KEY",
		venice: "VENICE_API_KEY",
		mistral: "MISTRAL_API_KEY",
		opencode: "OPENCODE_API_KEY",
		together: "TOGETHER_API_KEY",
		qianfan: "QIANFAN_API_KEY",
		ollama: "OLLAMA_API_KEY",
		vllm: "VLLM_API_KEY"
	}[normalized];
	if (!envVar) return null;
	return pick(envVar);
}
function resolveModelAuthMode(provider, cfg, store) {
	const resolved = provider?.trim();
	if (!resolved) return;
	const authOverride = resolveProviderAuthOverride(cfg, resolved);
	if (authOverride === "aws-sdk") return "aws-sdk";
	const authStore = store ?? ensureAuthProfileStore();
	const profiles = listProfilesForProvider(authStore, resolved);
	if (profiles.length > 0) {
		const modes = new Set(profiles.map((id) => authStore.profiles[id]?.type).filter((mode) => Boolean(mode)));
		if ([
			"oauth",
			"token",
			"api_key"
		].filter((k) => modes.has(k)).length >= 2) return "mixed";
		if (modes.has("oauth")) return "oauth";
		if (modes.has("token")) return "token";
		if (modes.has("api_key")) return "api-key";
	}
	if (authOverride === void 0 && normalizeProviderId(resolved) === "amazon-bedrock") return "aws-sdk";
	const envKey = resolveEnvApiKey(resolved);
	if (envKey?.apiKey) return envKey.source.includes("OAUTH_TOKEN") ? "oauth" : "api-key";
	if (getCustomProviderApiKey(cfg, resolved)) return "api-key";
	return "unknown";
}
async function getApiKeyForModel(params) {
	return resolveApiKeyForProvider({
		provider: params.model.provider,
		cfg: params.cfg,
		profileId: params.profileId,
		preferredProfile: params.preferredProfile,
		store: params.store,
		agentDir: params.agentDir
	});
}
function requireApiKey(auth, provider) {
	const key = normalizeSecretInput(auth.apiKey);
	if (key) return key;
	throw new Error(`No API key resolved for provider "${provider}" (auth mode: ${auth.mode}).`);
}

//#endregion
export { resolveAwsSdkEnvVarName as a, resolveApiKeyForProvider as i, getCustomProviderApiKey as n, resolveEnvApiKey as o, requireApiKey as r, resolveModelAuthMode as s, getApiKeyForModel as t };