import { readFileSync } from 'node:fs';

// Resolve a vault_path-style secret reference. v1 supports:
//   env:NAME   -> process.env.NAME
//   file:/path -> file contents (trimmed)
//   <raw>      -> returned as-is
// Vaultwarden item-id resolution is a future swap (see spec).
export function resolveSecret(spec) {
  if (!spec) return null;
  if (spec.startsWith('env:')) {
    return process.env[spec.slice(4)] ?? null;
  }
  if (spec.startsWith('file:')) {
    try { return readFileSync(spec.slice(5), 'utf8').trim(); }
    catch { return null; }
  }
  return spec;
}