"use strict";
Object.defineProperty(exports, "__esModule", { value: true });
exports.bigquerySsoUserCredentialsSchema = exports.databricksOauthU2mUserCredentialsSchema = exports.snowflakeSsoUserCredentialsSchema = void 0;
const zod_1 = require("zod");
const projects_1 = require("./projects");
// Zod schema for validating Snowflake SSO user warehouse credentials
// Requires refreshToken and disallows token field
exports.snowflakeSsoUserCredentialsSchema = zod_1.z
    .object({
    type: zod_1.z.literal(projects_1.WarehouseTypes.SNOWFLAKE),
    user: zod_1.z.string().optional(),
    password: zod_1.z.string().optional(),
    authenticationType: zod_1.z.literal(projects_1.SnowflakeAuthenticationType.SSO),
    refreshToken: zod_1.z.string(),
})
    .strict();
// Zod schema for validating Databricks OAuth U2M user warehouse credentials
// Requires refreshToken and allows optional compatibility fields
exports.databricksOauthU2mUserCredentialsSchema = zod_1.z
    .object({
    type: zod_1.z.literal(projects_1.WarehouseTypes.DATABRICKS),
    authenticationType: zod_1.z.literal(projects_1.DatabricksAuthenticationType.OAUTH_U2M),
    refreshToken: zod_1.z.string(),
    oauthClientId: zod_1.z.string().optional(),
    personalAccessToken: zod_1.z.string().optional(),
    database: zod_1.z.string().optional(),
    serverHostName: zod_1.z.string().optional(),
    httpPath: zod_1.z.string().optional(),
})
    .strict();
// Zod schema for validating BigQuery SSO user warehouse credentials.
// Per-user BigQuery credentials are always SSO ("authorized_user" keyfile),
// so a usable keyfile must carry a non-empty refresh_token. This guards
// against an empty `keyfileContents: {}` being persisted or used, which
// otherwise surfaces as the opaque "does not contain a client_email field".
exports.bigquerySsoUserCredentialsSchema = zod_1.z
    .object({
    type: zod_1.z.literal(projects_1.WarehouseTypes.BIGQUERY),
    keyfileContents: zod_1.z
        .object({ refresh_token: zod_1.z.string().min(1) })
        .passthrough(),
})
    .passthrough();
//# sourceMappingURL=userWarehouseCredentials.js.map