"""
Credential Store - Production-ready credential management for Hive.

This module provides secure credential storage with:
- Key-vault structure: Credentials as objects with multiple keys
- Template-based usage: {{cred.key}} patterns for injection
- Bipartisan model: Store stores values, tools define usage
- Provider system: Extensible lifecycle management (refresh, validate)
- Multiple backends: Encrypted files, env vars

Quick Start:
    from core.framework.credentials import CredentialStore, CredentialObject

    # Create store with encrypted storage
    store = CredentialStore.with_encrypted_storage()  # defaults to ~/.hive/credentials

    # Get a credential
    api_key = store.get("brave_search")

    # Resolve templates in headers
    headers = store.resolve_headers({
        "Authorization": "Bearer {{github_oauth.access_token}}"
    })

    # Save a new credential
    store.save_credential(CredentialObject(
        id="my_api",
        keys={"api_key": CredentialKey(name="api_key", value=SecretStr("xxx"))}
    ))

For OAuth2 support:
    from core.framework.credentials.oauth2 import BaseOAuth2Provider, OAuth2Config

For Aden server sync:
    from core.framework.credentials.aden import (
        AdenCredentialClient,
        AdenClientConfig,
        AdenSyncProvider,
    )

"""

from .key_storage import (
    delete_aden_api_key,
    generate_and_save_credential_key,
    load_aden_api_key,
    load_credential_key,
    save_aden_api_key,
    save_credential_key,
)
from .models import (
    CredentialDecryptionError,
    CredentialError,
    CredentialExpiredError,
    CredentialKey,
    CredentialKeyNotFoundError,
    CredentialNotFoundError,
    CredentialObject,
    CredentialRefreshError,
    CredentialType,
    CredentialUsageSpec,
    CredentialValidationError,
)
from .provider import (
    BearerTokenProvider,
    CredentialProvider,
    StaticProvider,
)
from .setup import (
    CredentialSetupSession,
    MissingCredential,
    SetupResult,
    load_agent_nodes,
    run_credential_setup_cli,
)
from .storage import (
    CompositeStorage,
    CredentialStorage,
    EncryptedFileStorage,
    EnvVarStorage,
    InMemoryStorage,
)
from .store import CredentialStore
from .template import TemplateResolver
from .validation import (
    CredentialStatus,
    CredentialValidationResult,
    compute_unavailable_tools,
    ensure_credential_key_env,
    validate_agent_credentials,
)

# Aden sync components (lazy import to avoid httpx dependency when not needed)
# Usage: from core.framework.credentials.aden import AdenSyncProvider
# Or: from core.framework.credentials import AdenSyncProvider
try:
    from .aden import (
        AdenCachedStorage,
        AdenClientConfig,
        AdenCredentialClient,
        AdenSyncProvider,
    )

    _ADEN_AVAILABLE = True
except ImportError:
    _ADEN_AVAILABLE = False

# Local credential registry (named API key accounts with identity metadata)
try:
    from .local import LocalAccountInfo, LocalCredentialRegistry

    _LOCAL_AVAILABLE = True
except ImportError:
    _LOCAL_AVAILABLE = False

__all__ = [
    # Main store
    "CredentialStore",
    # Models
    "CredentialObject",
    "CredentialKey",
    "CredentialType",
    "CredentialUsageSpec",
    # Providers
    "CredentialProvider",
    "StaticProvider",
    "BearerTokenProvider",
    # Storage backends
    "CredentialStorage",
    "EncryptedFileStorage",
    "EnvVarStorage",
    "InMemoryStorage",
    "CompositeStorage",
    # Template resolution
    "TemplateResolver",
    # Exceptions
    "CredentialError",
    "CredentialNotFoundError",
    "CredentialKeyNotFoundError",
    "CredentialRefreshError",
    "CredentialExpiredError",
    "CredentialValidationError",
    "CredentialDecryptionError",
    # Key storage (bootstrap credentials)
    "load_credential_key",
    "save_credential_key",
    "generate_and_save_credential_key",
    "load_aden_api_key",
    "save_aden_api_key",
    "delete_aden_api_key",
    # Validation
    "ensure_credential_key_env",
    "validate_agent_credentials",
    "compute_unavailable_tools",
    "CredentialStatus",
    "CredentialValidationResult",
    # Interactive setup
    "CredentialSetupSession",
    "MissingCredential",
    "SetupResult",
    "load_agent_nodes",
    "run_credential_setup_cli",
    # Aden sync (optional - requires httpx)
    "AdenSyncProvider",
    "AdenCredentialClient",
    "AdenClientConfig",
    "AdenCachedStorage",
    # Local credential registry (optional - requires cryptography)
    "LocalCredentialRegistry",
    "LocalAccountInfo",
]

# Track Aden availability for runtime checks
ADEN_AVAILABLE = _ADEN_AVAILABLE
LOCAL_AVAILABLE = _LOCAL_AVAILABLE
