profiles

type APIKeyCredential struct {
	// Key is the API key value.
	Key string `json:"key,omitempty"`

	// KeyRef is a vault reference for the key (e.g., "vault://OPENAI_API_KEY").
	KeyRef string `json:"key_ref,omitempty"`
}

type AuthMode string

type AuthProfile struct {
	// ID is the unique profile identifier (provider:name).
	ID ProfileID `json:"id"`

	// Provider is the authentication provider (e.g., "google", "openai").
	Provider string `json:"provider"`

	// Name is the profile name (e.g., "default", "work", "personal").
	Name string `json:"name"`

	// Mode is the authentication method.
	Mode AuthMode `json:"mode"`

	// Priority determines fallback order (higher = tried first).
	Priority int `json:"priority,omitempty"`

	// Enabled indicates if this profile is active.
	Enabled bool `json:"enabled"`

	// CreatedAt is when the profile was created.
	CreatedAt time.Time `json:"created_at"`

	// UpdatedAt is when the profile was last updated.
	UpdatedAt time.Time `json:"updated_at"`

	// LastUsedAt is when the profile was last successfully used.
	LastUsedAt *time.Time `json:"last_used_at,omitempty"`

	// LastError is the last error message if authentication failed.
	LastError string `json:"last_error,omitempty"`

	// LastErrorAt is when the last error occurred.
	LastErrorAt *time.Time `json:"last_error_at,omitempty"`

	// Credential data based on Mode.
	APIKey *APIKeyCredential `json:"api_key,omitempty"`
	OAuth  *OAuthCredential  `json:"oauth,omitempty"`
	Token  *TokenCredential  `json:"token,omitempty"`
}

type FailureReason string

type FallbackChain struct {
	// contains filtered or unexported fields
}

type MultiResolver struct {
	// contains filtered or unexported fields
}

type OAuthCredential struct {
	// Provider identifies the OAuth provider.
	Provider string `json:"provider"`

	// ProfileName is the name of this profile (e.g., "work", "personal").
	ProfileName string `json:"profile_name"`

	// AccessToken is the OAuth access token.
	AccessToken string `json:"access_token"`

	// RefreshToken is used to obtain new access tokens.
	RefreshToken string `json:"refresh_token"`

	// ExpiresAt is when the access token expires.
	ExpiresAt time.Time `json:"expires_at"`

	// Email is the user's email associated with the OAuth account.
	Email string `json:"email,omitempty"`

	// ClientID is the OAuth client ID.
	ClientID string `json:"client_id,omitempty"`

	// Scopes are the OAuth scopes granted.
	Scopes []string `json:"scopes,omitempty"`

	// Metadata contains provider-specific data.
	Metadata map[string]string `json:"metadata,omitempty"`
}

type OAuthEndpoint struct {
	AuthURL  string   `json:"auth_url,omitempty"`
	TokenURL string   `json:"token_url,omitempty"`
	Scopes   []string `json:"scopes,omitempty"`
}

type OAuthManager interface {
	GetValidToken(provider string) (*oauth.OAuthCredential, error)
	SaveCredential(cred *oauth.OAuthCredential) error
}

type OAuthTokenRefresher interface {
	// RefreshToken refreshes an OAuth token for a provider.
	RefreshToken(provider, refreshToken string) (*oauth.OAuthCredential, error)
}

type ProfileAddArgs struct {
	Provider string `json:"provider"`           // e.g., "google", "openai"
	Name     string `json:"name"`               // e.g., "work", "personal"
	Mode     string `json:"mode"`               // "api_key", "oauth", "token"
	APIKey   string `json:"api_key,omitempty"`  // For API key mode
	Token    string `json:"token,omitempty"`    // For token mode
	Priority int    `json:"priority,omitempty"` // Higher = tried first
}

type ProfileAddResult struct {
	Success   bool   `json:"success"`
	ProfileID string `json:"profile_id,omitempty"`
	Error     string `json:"error,omitempty"`
}

type ProfileCooldownConfig struct {
	RateLimitSeconds    int                                 `yaml:"rate_limit_seconds"`    // Default: 30
	BillingBackoffHours float64                             `yaml:"billing_backoff_hours"` // Default: 5
	BillingMaxHours     float64                             `yaml:"billing_max_hours"`     // Default: 24
	FailureWindowHours  float64                             `yaml:"failure_window_hours"`  // Default: 24
	ByProvider          map[string]ProviderCooldownOverride `yaml:"by_provider"`
}

type ProfileDeleteArgs struct {
	ProfileID string `json:"profile_id"` // Format: "provider:name"
}

type ProfileDeleteResult struct {
	Success bool   `json:"success"`
	Error   string `json:"error,omitempty"`
}

type ProfileEnableArgs struct {
	ProfileID string `json:"profile_id"`
	Enable    bool   `json:"enable"`
}

type ProfileEnableResult struct {
	Success bool   `json:"success"`
	Error   string `json:"error,omitempty"`
}

type ProfileExportArgs struct {
	ProfileID string `json:"profile_id"`
}

type ProfileExportResult struct {
	Success bool            `json:"success"`
	Data    json.RawMessage `json:"data,omitempty"`
	Mode    string          `json:"mode,omitempty"`
	Error   string          `json:"error,omitempty"`
}

type ProfileID string

type ProfileImportArgs struct {
	Provider string          `json:"provider"`
	Name     string          `json:"name"`
	Mode     string          `json:"mode"`
	Data     json.RawMessage `json:"data"` // Provider-specific credential data
}

type ProfileImportResult struct {
	Success   bool   `json:"success"`
	ProfileID string `json:"profile_id,omitempty"`
	Error     string `json:"error,omitempty"`
}

type ProfileListArgs struct {
	Provider string `json:"provider,omitempty"` // Filter by provider (optional)
	Mode     string `json:"mode,omitempty"`     // Filter by mode (optional)
	Enabled  *bool  `json:"enabled,omitempty"`  // Filter by enabled status (optional)
}

type ProfileListItem struct {
	ID         string    `json:"id"`
	Provider   string    `json:"provider"`
	Name       string    `json:"name"`
	Mode       string    `json:"mode"`
	Enabled    bool      `json:"enabled"`
	Valid      bool      `json:"valid"`
	Expired    bool      `json:"expired,omitempty"`
	Email      string    `json:"email,omitempty"`
	Priority   int       `json:"priority,omitempty"`
	LastUsedAt time.Time `json:"last_used_at,omitempty"`
	LastError  string    `json:"last_error,omitempty"`
}

type ProfileListResult struct {
	Profiles []ProfileListItem `json:"profiles"`
	Total    int               `json:"total"`
}

type ProfileManager interface {
	// Get retrieves a profile by ID.
	Get(id ProfileID) (*AuthProfile, bool)

	// GetByProvider retrieves profiles for a provider, sorted by preference.
	GetByProvider(provider string, preference ProfilePreference) []*AuthProfile

	// Save stores a profile.
	Save(profile *AuthProfile) error

	// Delete removes a profile.
	Delete(id ProfileID) error

	// List returns all profiles.
	List() []*AuthProfile

	// Resolve resolves a profile based on options, with automatic fallback.
	Resolve(opts ResolutionOptions) *ProfileResolutionResult

	// MarkUsed updates the last used timestamp for a profile.
	MarkUsed(id ProfileID)

	// MarkError records an error for a profile.
	MarkError(id ProfileID, err error)

	// MarkFailure records a categorized failure and applies cooldown/disable.
	MarkFailure(id ProfileID, reason FailureReason)

	// IsInCooldown returns true if the profile is currently in cooldown or disabled.
	IsInCooldown(id ProfileID) bool

	// ClearExpiredCooldowns resets cooldown/disabled state for profiles whose windows have passed.
	ClearExpiredCooldowns()
}

type ProfilePreference string

type ProfileResolutionResult struct {
	// Profile is the resolved profile (nil if not found).
	Profile *AuthProfile

	// Credential is the resolved credential string (API key, token, or OAuth access token).
	Credential string

	// Provider is the provider name.
	Provider string

	// Email is the associated email (for OAuth).
	Email string

	// Error if resolution failed.
	Error error

	// AttemptedProfiles lists profiles that were tried.
	AttemptedProfiles []ProfileID
}

type ProfileSetPriorityArgs struct {
	ProfileID string `json:"profile_id"`
	Priority  int    `json:"priority"`
}

type ProfileSetPriorityResult struct {
	Success bool   `json:"success"`
	Error   string `json:"error,omitempty"`
}

type ProfileStore struct {
	Version    int                           `json:"version"`
	Profiles   map[string]*AuthProfile       `json:"profiles"`              // key is "provider:name"
	UsageStats map[string]*ProfileUsageStats `json:"usage_stats,omitempty"` // key is "provider:name"
	LastGood   map[string]string             `json:"last_good,omitempty"`   // provider → profileID of last successful call
}

type ProfileTestArgs struct {
	ProfileID string `json:"profile_id"`
}

type ProfileTestResult struct {
	Success   bool          `json:"success"`
	Valid     bool          `json:"valid"`
	Expired   bool          `json:"expired,omitempty"`
	Email     string        `json:"email,omitempty"`
	Error     string        `json:"error,omitempty"`
	ExpiresIn time.Duration `json:"expires_in,omitempty"`
}

type ProfileTools struct {
	// contains filtered or unexported fields
}

type ProfileUsageStats struct {
	LastUsed       *time.Time            `json:"last_used,omitempty"`
	CooldownUntil  *time.Time            `json:"cooldown_until,omitempty"`
	DisabledUntil  *time.Time            `json:"disabled_until,omitempty"`
	DisabledReason FailureReason         `json:"disabled_reason,omitempty"`
	ErrorCount     int                   `json:"error_count,omitempty"`
	FailureCounts  map[FailureReason]int `json:"failure_counts,omitempty"`
	LastFailureAt  *time.Time            `json:"last_failure_at,omitempty"`
}

type ProviderCooldownOverride struct {
	RateLimitSeconds    int     `yaml:"rate_limit_seconds"`
	BillingBackoffHours float64 `yaml:"billing_backoff_hours"`
}

type ProviderInfo struct {
	Name        string   `json:"name"`
	Label       string   `json:"label"`
	Description string   `json:"description"`
	Modes       []string `json:"modes"`
	EnvKey      string   `json:"env_key,omitempty"`
	Website     string   `json:"website,omitempty"`
}

type ProviderMetadata struct {
	// Name is the provider identifier.
	Name string `json:"name"`

	// Label is a human-readable name.
	Label string `json:"label"`

	// Description explains what the provider is for.
	Description string `json:"description"`

	// Modes lists the supported authentication modes.
	Modes []AuthMode `json:"modes"`

	// EnvKey is the environment variable name for API keys.
	EnvKey string `json:"env_key,omitempty"`

	// Website is the URL for obtaining credentials.
	Website string `json:"website,omitempty"`

	// Scopes are the default OAuth scopes.
	Scopes []string `json:"scopes,omitempty"`

	// OAuthEndpoint contains OAuth endpoint configuration.
	OAuthEndpoint OAuthEndpoint `json:"oauth_endpoint,omitempty"`

	// ParentProvider indicates this is a child of another provider.
	ParentProvider string `json:"parent_provider,omitempty"`
}

type ProvidersListResult struct {
	Providers []ProviderInfo `json:"providers"`
}

type ResolutionOptions struct {
	// Provider is the required provider (e.g., "google", "openai").
	Provider string

	// PreferredProfile is a specific profile name to use (optional).
	PreferredProfile string

	// Preference indicates how to select between multiple profiles.
	Preference ProfilePreference

	// RequireValid requires the profile to have valid (non-expired) credentials.
	RequireValid bool

	// Mode restricts to a specific authentication mode (optional).
	Mode AuthMode
}

type Resolver struct {
	// contains filtered or unexported fields
}

type ResolverConfig struct {
	Store             ProfileManager
	OAuthManager      OAuthManager
	Logger            *slog.Logger
	DefaultPreference ProfilePreference
}

type StoreConfig struct {
	// Vault is the encrypted vault interface.
	Vault VaultInterface

	// OAuthManager is the OAuth token manager.
	OAuthManager OAuthManager

	// Logger for logging operations.
	Logger *slog.Logger

	// CachePath is an optional path to cache decrypted profiles.
	// If empty, no disk cache is used.
	CachePath string

	// CooldownConfig allows overriding default cooldown durations.
	// If nil, hardcoded defaults are used.
	CooldownConfig *ProfileCooldownConfig
}

type TokenCredential struct {
	// Token is the bearer token value.
	Token string `json:"token,omitempty"`

	// TokenRef is a vault reference for the token.
	TokenRef string `json:"token_ref,omitempty"`

	// ExpiresAt is when the token expires (optional).
	ExpiresAt *time.Time `json:"expires_at,omitempty"`
}

type VaultInterface interface {
	Get(name string) (string, error)
	Set(name, value string) error
	Has(name string) bool
	Delete(name string) error
	IsUnlocked() bool
}