import { z } from 'zod';
import { DatabricksAuthenticationType, SnowflakeAuthenticationType, WarehouseTypes, } from './projects';
// Zod schema for validating Snowflake SSO user warehouse credentials
// Requires refreshToken and disallows token field
export const snowflakeSsoUserCredentialsSchema = z
    .object({
    type: z.literal(WarehouseTypes.SNOWFLAKE),
    user: z.string().optional(),
    password: z.string().optional(),
    authenticationType: z.literal(SnowflakeAuthenticationType.SSO),
    refreshToken: z.string(),
})
    .strict();
// Zod schema for validating Databricks OAuth U2M user warehouse credentials
// Requires refreshToken and allows optional compatibility fields
export const databricksOauthU2mUserCredentialsSchema = z
    .object({
    type: z.literal(WarehouseTypes.DATABRICKS),
    authenticationType: z.literal(DatabricksAuthenticationType.OAUTH_U2M),
    refreshToken: z.string(),
    oauthClientId: z.string().optional(),
    personalAccessToken: z.string().optional(),
    database: z.string().optional(),
    serverHostName: z.string().optional(),
    httpPath: z.string().optional(),
})
    .strict();
// Zod schema for validating BigQuery SSO user warehouse credentials.
// Per-user BigQuery credentials are always SSO ("authorized_user" keyfile),
// so a usable keyfile must carry a non-empty refresh_token. This guards
// against an empty `keyfileContents: {}` being persisted or used, which
// otherwise surfaces as the opaque "does not contain a client_email field".
export const bigquerySsoUserCredentialsSchema = z
    .object({
    type: z.literal(WarehouseTypes.BIGQUERY),
    keyfileContents: z
        .object({ refresh_token: z.string().min(1) })
        .passthrough(),
})
    .passthrough();
//# sourceMappingURL=userWarehouseCredentials.js.map