import { init_sync_provider_auth, resolveProviderApiKeySync } from "../../auth/sync-provider-auth.js";
import { getApiKeySync, init_providers } from "../../providers/index.js";
import { AuthStorage } from "@earendil-works/pi-coding-agent";
//#region src/agent/embedded/xopc-auth-storage.ts
init_sync_provider_auth();
init_providers();
/**
* Resolve API keys the same way as {@link AgentManager} / gateway settings:
* auth-profiles (agent + global), OAuth files, models.json, then env.
*/
function resolveXopcProviderApiKey(providerId) {
	return resolveProviderApiKeySync(providerId) ?? getApiKeySync(providerId);
}
/**
* pi-coding-agent {@link createAgentSession} defaults to `~/.pi/agent/auth.json` and env.
* Gateway / webchat turns use xopc credentials under `XOPC_STATE_DIR` — wire them via fallback.
*/
function createEmbeddedAuthStorage() {
	const auth = AuthStorage.create();
	auth.setFallbackResolver(resolveXopcProviderApiKey);
	return auth;
}
/**
* pi-coding-agent's {@link ModelRegistry.getApiKeyAndHeaders} reads the auth storage with
* `includeFallback: false`, so {@link createEmbeddedAuthStorage}'s fallback resolver alone
* never fires for xopc-managed providers (e.g. `local-qwen` in xopc's `models.json`).
*
* Inject the resolved key as a runtime override (highest-priority, in-memory only) before
* the session starts so request-time auth resolution finds it.
*/
function applyXopcProviderApiKey(auth, providerId) {
	const key = resolveXopcProviderApiKey(providerId);
	if (key && key !== "extension-managed") auth.setRuntimeApiKey(providerId, key);
}
//#endregion
export { applyXopcProviderApiKey, createEmbeddedAuthStorage, resolveXopcProviderApiKey };

//# sourceMappingURL=xopc-auth-storage.js.map