/**
 * Builds pipes' own SecretsBackend set for vehicle-client-pi's generic /secrets
 * menu: the local credential-profile directory every `pipes login` writes
 * to (github/gitlab/jenkins profiles, including the gh-CLI-sourced ones),
 * plus the two static-token env vars pipes' adapters fall back to.
 *
 *
 * Not registered as its own top-level `/secrets` Pi command: pi-enigma
 * already owns that command name, and Pi has no per-extension command
 * namespacing -- two extensions registering the same name would collide.
 * Exposed instead as a "Secrets" entry inside pipes' own `/pipes` menu.
 */
import { dirname } from "node:path";
import { resolvePipesPaths } from "@danypops/pipes";
import type { SecretsBackend } from "@danypops/vehicle-client-pi/secrets-backend";
import { createEnvSecretsBackend } from "@danypops/vehicle-client-pi/secrets-backend-env";
import { createLocalSecretsBackend } from "@danypops/vehicle-client-pi/secrets-backend-local";

export interface BuildPipesSecretsBackendsOptions {
	env?: Record<string, string | undefined>;
	home?: string;
	uid?: number;
}

export function buildPipesSecretsBackends(options: BuildPipesSecretsBackendsOptions = {}): SecretsBackend[] {
	const env = options.env ?? process.env;
	const credentialsDir = dirname(resolvePipesPaths({ env, home: options.home, uid: options.uid }).token);
	return [
		createLocalSecretsBackend({ dir: credentialsDir }),
		createEnvSecretsBackend({ github: "GITHUB_TOKEN", gitlab: "GITLAB_TOKEN" }, env),
	];
}