/**
 * Shared TOS (Volcengine Object Storage) credentials and configuration.
 *
 * Three tiers, highest priority first:
 *   1. Per-agent bundle — reserved (currently unused; symmetry with the
 *      other credential modules).
 *   2. Shared in-memory heartbeat cache (`sharedKeys.tosAccessKey*`).
 *   3. Local `config.tosAccessKey*` — written through to disk by the
 *      heartbeat apply path so the agent survives an offline server.
 *
 * `config.imageArchive` is a separate, deliberately per-agent override
 * that selects a different bucket/region/endpoint and is consulted by
 * `resolveTosArchiveConfig` ahead of all three credential tiers above.
 * It is not a "cache" of server-issued credentials and is never
 * overwritten by the heartbeat.
 */
const DEFAULT_TOS_REGION = "cn-beijing";
const DEFAULT_TOS_ENDPOINT = "tos-accelerate.volces.com";
const DEFAULT_TOS_IMAGE_BUCKET = "visionclaw-images";
let bundleTosAccessKeyId;
let bundleTosAccessKeySecret;
let sharedTosAccessKeyId;
let sharedTosAccessKeySecret;
export function setBundleTosCredentials(accessKeyId, accessKeySecret) {
    if (bundleTosAccessKeyId === accessKeyId && bundleTosAccessKeySecret === accessKeySecret) {
        return false;
    }
    bundleTosAccessKeyId = accessKeyId;
    bundleTosAccessKeySecret = accessKeySecret;
    return true;
}
export function setSharedTosCredentials(accessKeyId, accessKeySecret) {
    if (sharedTosAccessKeyId === accessKeyId && sharedTosAccessKeySecret === accessKeySecret) {
        return false;
    }
    sharedTosAccessKeyId = accessKeyId;
    sharedTosAccessKeySecret = accessKeySecret;
    return true;
}
/**
 * Resolve TOS credentials.
 *
 * Precedence:
 *   - `config.imageArchive` (deliberate per-agent override; selects a
 *     different bucket/region/endpoint and is not server-managed)
 *   - bundle > shared > top-level `config.tosAccessKey*`
 */
export function resolveTosCredentials(config) {
    // Per-agent imageArchive override (different bucket/region entirely).
    const ia = config.imageArchive;
    if (ia?.provider === "tos" && ia.tosAccessKeyId && ia.tosAccessKeySecret) {
        return {
            accessKeyId: ia.tosAccessKeyId,
            accessKeySecret: ia.tosAccessKeySecret,
            region: ia.tosRegion,
            endpoint: ia.tosEndpoint,
        };
    }
    // Tier 1: bundle.
    if (bundleTosAccessKeyId && bundleTosAccessKeySecret) {
        return {
            accessKeyId: bundleTosAccessKeyId,
            accessKeySecret: bundleTosAccessKeySecret,
            region: DEFAULT_TOS_REGION,
            endpoint: DEFAULT_TOS_ENDPOINT,
        };
    }
    // Tier 2: shared in-memory cache from heartbeat.
    if (sharedTosAccessKeyId && sharedTosAccessKeySecret) {
        return {
            accessKeyId: sharedTosAccessKeyId,
            accessKeySecret: sharedTosAccessKeySecret,
            region: DEFAULT_TOS_REGION,
            endpoint: DEFAULT_TOS_ENDPOINT,
        };
    }
    // Tier 3: local config cache (write-through; offline survival).
    if (config.tosAccessKeyId && config.tosAccessKeySecret) {
        return {
            accessKeyId: config.tosAccessKeyId,
            accessKeySecret: config.tosAccessKeySecret,
            region: DEFAULT_TOS_REGION,
            endpoint: DEFAULT_TOS_ENDPOINT,
        };
    }
    return undefined;
}
/**
 * Resolve the full TOS archive config for image archiving.
 * Returns undefined if no credentials are available.
 */
export function resolveTosArchiveConfig(config) {
    const creds = resolveTosCredentials(config);
    if (!creds)
        return undefined;
    const ia = config.imageArchive;
    return {
        provider: "tos",
        bucket: ia?.provider === "tos" ? ia.bucket : DEFAULT_TOS_IMAGE_BUCKET,
        ...creds,
    };
}
//# sourceMappingURL=tos-credentials.js.map