import { ResourceKind } from "../resource.js";
/**
 * Serialize an {@link AccessRule} to its wire JSON shape, replacing any lifted
 * Resource references (`group.id`, `service_token.token_id`,
 * `*.identity_provider_id`, `login_method.id`) with the resource's `id`.
 *
 * @internal
 */
export function serializeAccessRule(rule) {
    const entries = Object.entries(rule);
    if (entries.length !== 1) {
        throw new Error(`Invalid AccessRule: expected exactly one key, got ${entries.length}`);
    }
    const [key, value] = entries[0];
    if (typeof value !== "object" || value === null) {
        return { [key]: value };
    }
    const serialized = {};
    for (const [field, fieldValue] of Object.entries(value)) {
        serialized[field] = isResourceRef(fieldValue)
            ? fieldValue.id
            : fieldValue;
    }
    return { [key]: serialized };
}
/**
 * True for Alchemy Resource objects (carry the {@link ResourceKind} symbol),
 * false for plain literal values — including future rule shapes that may nest
 * literal config objects.
 */
function isResourceRef(value) {
    return (!!value &&
        typeof value === "object" &&
        !Array.isArray(value) &&
        value[ResourceKind] !== undefined);
}
//# sourceMappingURL=access-rule.js.map