/**
 * Paperclip API auth.
 *
 * Pure-HTTP adapters need to mint a short-lived agent JWT to call
 * Paperclip's REST API (same path the CLI adapters use, which gets the
 * JWT from the PAPERCLIP_API_KEY env var Paperclip injects at process
 * startup).
 *
 * We don't try to *implement* the JWT signing — Paperclip exposes its
 * key signing through a public helper that ships in @paperclipai/server.
 * If we're installed alongside it, we use that; if not (e.g. during
 * standalone test), we fall back to using the API key directly with
 * a "Bearer" header (which Paperclip also accepts for static keys).
 */
import type { AdapterConfig } from "./types.js";

export interface AuthHeaders {
  Authorization: string;
  "X-Paperclip-Agent"?: string;
  "X-Paperclip-Run"?: string;
}

export function authHeadersFor(config: AdapterConfig, runId?: string): AuthHeaders {
  const headers: AuthHeaders = {
    Authorization: config.paperclipApiKey.startsWith("eyJ")
      ? `Bearer ${config.paperclipApiKey}` // looks like a JWT
      : `Bearer ${config.paperclipApiKey}`, // static API key
    "X-Paperclip-Agent": "minimax-adapter/0.1.0",
  };
  if (runId) headers["X-Paperclip-Run"] = runId;
  return headers;
}