/**
 * Credentials type definitions
 *
 * The credentials system provides a unified way to authenticate with Zapier APIs.
 * It supports multiple credential types:
 * - String: A token (JWT or API key) used directly
 * - Client credentials: OAuth client ID + secret exchanged for a token
 * - PKCE: OAuth client ID for interactive login (CLI only)
 * - Function: Lazy/dynamic credential resolution
 */
import { z } from "zod";
/**
 * Client credentials for OAuth client_credentials flow.
 * The SDK will exchange these for an access token.
 */
export const ClientCredentialsObjectSchema = z.object({
    type: z.enum(["client_credentials"]).optional().meta({ internal: true }),
    clientId: z
        .string()
        .describe("OAuth client ID for authentication.")
        .meta({ valueHint: "id" }),
    clientSecret: z
        .string()
        .describe("OAuth client secret for authentication.")
        .meta({ valueHint: "secret" }),
    baseUrl: z
        .string()
        .optional()
        .describe("Override authentication base URL.")
        .meta({ valueHint: "url" }),
    scope: z
        .string()
        .optional()
        .describe("Authentication scope.")
        .meta({ internal: true }),
});
/**
 * PKCE credentials for interactive OAuth flow.
 * Only works when @zapier/zapier-sdk-cli is installed (the SDK dynamically
 * imports its `./login` entry point).
 */
export const PkceCredentialsObjectSchema = z.object({
    type: z.enum(["pkce"]).optional().meta({ internal: true }),
    clientId: z
        .string()
        .describe("OAuth client ID for authentication.")
        .meta({ valueHint: "id" }),
    baseUrl: z
        .string()
        .optional()
        .describe("Override authentication base URL.")
        .meta({ valueHint: "url" }),
    scope: z
        .string()
        .optional()
        .describe("Authentication scope.")
        .meta({ internal: true }),
});
/**
 * Union of all credential object types.
 */
export const CredentialsObjectSchema = z.union([
    ClientCredentialsObjectSchema,
    PkceCredentialsObjectSchema,
]);
/**
 * Resolved credentials - what a credentials function must return.
 * Either a string (token) or a credentials object.
 * Functions are not allowed to return other functions.
 */
export const ResolvedCredentialsSchema = z.union([
    z.string().describe("Authentication token.").meta({ valueHint: "token" }),
    CredentialsObjectSchema,
]);
/**
 * Lazy/dynamic credential resolution — a function returning resolved credentials.
 */
export const CredentialsFunctionSchema = z
    .function()
    .input([])
    .output(z.union([ResolvedCredentialsSchema, z.promise(ResolvedCredentialsSchema)]));
/**
 * Credentials can be:
 * - A string (token or API key)
 * - A credentials object (client_credentials or pkce)
 * - A function that returns credentials (sync or async)
 */
export const CredentialsSchema = z.union([
    ResolvedCredentialsSchema,
    CredentialsFunctionSchema,
]);
/**
 * Type guard for client credentials objects.
 */
export function isClientCredentials(credentials) {
    return (typeof credentials === "object" &&
        credentials !== null &&
        "clientId" in credentials &&
        "clientSecret" in credentials);
}
/**
 * Type guard for PKCE credentials objects.
 */
export function isPkceCredentials(credentials) {
    return (typeof credentials === "object" &&
        credentials !== null &&
        "clientId" in credentials &&
        !("clientSecret" in credentials));
}
/**
 * Type guard for credentials objects (either type).
 */
export function isCredentialsObject(credentials) {
    return (typeof credentials === "object" &&
        credentials !== null &&
        "clientId" in credentials);
}
/**
 * Type guard for credentials functions.
 */
export function isCredentialsFunction(credentials) {
    return typeof credentials === "function";
}
