export type AccountId = "local";

// The single account today. Centralized so the gateway and the MCP server agree on
// the registry key (the future multi-account swap touches only resolveAccount).
export const LOCAL_ACCOUNT_ID: AccountId = "local";

// The single future swap-point: credential -> account home. Today it also owns the
// password gate. Returns the account id for a valid secret, or null = unauthorized.
//   - password unset/empty  => auth disabled, any secret (or none) maps to "local"
//   - password set          => secret must match exactly, else null
export function resolveAccount(
  secret: string | undefined,
  password: string | undefined,
): AccountId | null {
  if (password === undefined || password === "") {
    return "local";
  }
  return secret === password ? "local" : null;
}