import fs from "node:fs";

import path from "node:path";

import type { Api, Model } from "@mariozechner/pi-ai";

import * as PiCodingAgent from "@mariozechner/pi-coding-agent";

applyProviderResolvedModelCompatWithPlugins,

applyProviderResolvedTransportWithPlugin,

normalizeProviderResolvedModelWithPlugin,

resolveProviderSyntheticAuthWithPlugin,

} from "../plugins/provider-runtime.js";

import { resolveRuntimeSyntheticAuthProviderRefs } from "../plugins/synthetic-auth.runtime.js";

import { isRecord } from "../utils.js";

import type { PiCredentialMap } from "./pi-auth-credentials.js";

import {

ensureAuthProfileStore,

loadAuthProfileStoreForSecretsRuntime,

} from "./auth-profiles/store.js";

import { resolveProviderEnvApiKeyCandidates } from "./model-auth-env-vars.js";

import { resolveEnvApiKey } from "./model-auth-env.js";

import { resolvePiCredentialMapFromStore, type PiCredentialMap } from "./pi-auth-credentials.js";

resolvePiCredentialsForDiscovery,

scrubLegacyStaticAuthJsonEntriesForDiscovery,

type DiscoverAuthStorageOptions,

} from "./pi-auth-discovery.js";

import { normalizeProviderId } from "./provider-id.js";

const PiAuthStorageClass = PiCodingAgent.AuthStorage;

return registry;

}

export function scrubLegacyStaticAuthJsonEntriesForDiscovery(pathname: string): void {

if (process.env.OPENCLAW_AUTH_STORE_READONLY === "1") {

return;

}

if (!fs.existsSync(pathname)) {

return;

}

let parsed: unknown;

try {

parsed = JSON.parse(fs.readFileSync(pathname, "utf8")) as unknown;

} catch {

return;

}

if (!isRecord(parsed)) {

return;

}

let changed = false;

for (const [provider, value] of Object.entries(parsed)) {

if (!isRecord(value)) {

continue;

}

if (value.type !== "api_key") {

continue;

}

delete parsed[provider];

changed = true;

}

if (!changed) {

return;

}

if (Object.keys(parsed).length === 0) {

fs.rmSync(pathname, { force: true });

return;

}

fs.writeFileSync(pathname, `${JSON.stringify(parsed, null, 2)}\n`, "utf8");

fs.chmodSync(pathname, 0o600);

}

function createAuthStorage(AuthStorageLike: unknown, path: string, creds: PiCredentialMap) {

const withInMemory = AuthStorageLike as { inMemory?: (data?: unknown) => unknown };

if (typeof withInMemory.inMemory === "function") {

return withRuntimeOverride;

}

export function addEnvBackedPiCredentials(

credentials: PiCredentialMap,

env: NodeJS.ProcessEnv = process.env,

): PiCredentialMap {

const next = { ...credentials };

// pi-coding-agent hides providers from its registry when auth storage lacks

// a matching credential entry. Mirror env-backed provider auth here so

// live/model discovery sees the same providers runtime auth can use.

for (const provider of Object.keys(resolveProviderEnvApiKeyCandidates({ env }))) {

if (next[provider]) {

continue;

}

const resolved = resolveEnvApiKey(provider, env);

if (!resolved?.apiKey) {

continue;

}

next[provider] = {

type: "api_key",

key: resolved.apiKey,

};

}

return next;

}

type DiscoverAuthStorageOptions = {

readOnly?: boolean;

};

export function resolvePiCredentialsForDiscovery(

agentDir: string,

options?: DiscoverAuthStorageOptions,

): PiCredentialMap {

const store =

options?.readOnly === true

? loadAuthProfileStoreForSecretsRuntime(agentDir)

: ensureAuthProfileStore(agentDir, { allowKeychainPrompt: false });

const credentials = addEnvBackedPiCredentials(resolvePiCredentialMapFromStore(store));

for (const provider of resolveRuntimeSyntheticAuthProviderRefs()) {

if (credentials[provider]) {

continue;

}

const resolved = resolveProviderSyntheticAuthWithPlugin({

provider,

context: {

config: undefined,

provider,

providerConfig: undefined,

},

});

const apiKey = resolved?.apiKey?.trim();

if (!apiKey) {

continue;

}

credentials[provider] = {

type: "api_key",

key: apiKey,

};

}

return credentials;

}

// Compatibility helpers for pi-coding-agent 0.50+ (discover* helpers removed).

export function discoverAuthStorage(

agentDir: string,

options,

);

}

export {

addEnvBackedPiCredentials,

resolvePiCredentialsForDiscovery,

scrubLegacyStaticAuthJsonEntriesForDiscovery,

type DiscoverAuthStorageOptions,

} from "./pi-auth-discovery.js";