import Foundation /// Resolves Bedrock signing credentials + region for the configured auth mode.////// Shared by the main usage fetch (`BedrockAPIFetchStrategy`) and the daily/// cost-history refresh (`CostUsageFetcher`) so both honor AWS-profile auth/// identically instead of the history path silently requiring static keys.enum BedrockCredentialResolver {    struct Resolved {        let credentials: BedrockAWSSigner.Credentials        let region: String    }     static func resolve(        environment: [String: String],        resolveAWSBinary: ([String: String]) -> String? = { BinaryLocator.resolveAWSBinary(env: $0) },        makeProvider: (String) -> BedrockProfileCredentialProvider = {            BedrockProfileCredentialProvider.live(awsBinaryPath: $0)        }) async throws -> Resolved    {        switch BedrockSettingsReader.authMode(environment: environment) {        case .keys:            guard let accessKeyID = BedrockSettingsReader.accessKeyID(environment: environment),                  let secretAccessKey = BedrockSettingsReader.secretAccessKey(environment: environment)            else {                throw BedrockUsageError.missingCredentials            }            let credentials = BedrockAWSSigner.Credentials(                accessKeyID: accessKeyID,                secretAccessKey: secretAccessKey,                sessionToken: BedrockSettingsReader.sessionToken(environment: environment))            return Resolved(                credentials: credentials,                region: BedrockSettingsReader.region(environment: environment))         case .profile:            guard let profile = BedrockSettingsReader.profile(environment: environment) else {                throw BedrockUsageError.missingCredentials            }            guard let awsBinary = resolveAWSBinary(environment) else {                throw BedrockUsageError.awsCLINotFound            }            let cliEnvironment = Self.profileCLIEnvironment(environment)            let provider = makeProvider(awsBinary)            let credentials = try await provider.exportCredentials(profile: profile, environment: cliEnvironment)            let region = try await Self.resolveRegion(                provider: provider,                profile: profile,                environment: cliEnvironment)            return Resolved(credentials: credentials, region: region)        }    }     private static func profileCLIEnvironment(_ environment: [String: String]) -> [String: String] {        var cliEnvironment = environment        // `--profile` selects the requested profile. Leaving AWS_PROFILE set can        // break assume-role profiles that use `credential_source = Environment`;        // keep the source credential variables themselves available.        cliEnvironment[BedrockSettingsReader.profileKey] = nil        return cliEnvironment    }     private static func resolveRegion(        provider: BedrockProfileCredentialProvider,        profile: String,        environment: [String: String]) async throws -> String    {        if let explicit = BedrockSettingsReader.cleaned(environment[BedrockSettingsReader.regionKeys[0]])            ?? BedrockSettingsReader.cleaned(environment[BedrockSettingsReader.regionKeys[1]])        {            return explicit        }        if let derived = try await provider.resolveRegion(profile: profile, environment: environment) {            return derived        }        return BedrockSettingsReader.defaultRegion    }}