resolver.ts

import type { Config } from '../config/schema';
import type { ResolvedCredential } from './types';
import { loadCredentials } from './credentials';
import { ensureFreshToken } from './refresh';
import { CLIError } from '../errors/base';
import { ExitCode } from '../errors/codes';
import { buildNoCredentialsHint } from './hints';

export async function resolveCredential(config: Config): Promise<ResolvedCredential> {
  // 1. Explicit API key (--api-key takes precedence over MINIMAX_API_KEY)
  if (config.apiKey) {
    return {
      token: config.apiKey,
      method: 'api-key',
      source: config.apiKeySource ?? 'flag',
    };
  }

  // 2. OAuth credentials in config file
  const oauth = await loadCredentials();
  if (oauth) {
    const token = await ensureFreshToken(oauth);
    return { token, method: 'oauth', source: 'config.json' };
  }

  // 3. API key from config file
  if (config.fileApiKey) {
    return { token: config.fileApiKey, method: 'api-key', source: 'config.json' };
  }

  throw new CLIError(
    'No credentials found.',
    ExitCode.AUTH,
    buildNoCredentialsHint(config.configPath),
  );
}