/**
 * @license
 *
 * Copyright 2026 Adobe. All rights reserved.
 * This file is licensed to you under the Apache License, Version 2.0 (the "License");
 * you may not use this file except in compliance with the License. You may obtain a copy
 * of the License at http://www.apache.org/licenses/LICENSE-2.0
 *
 * Unless required by applicable law or agreed to in writing, software distributed under
 * the License is distributed on an "AS IS" BASIS, WITHOUT WARRANTIES OR REPRESENTATIONS
 * OF ANY KIND, either express or implied. See the License for the specific language
 * governing permissions and limitations under the License.
 */

import * as v from "valibot";
import { InferOutput } from "valibot";
//#region source/lib/ims-auth/types.d.ts
/** Defines the headers required for IMS authentication. */
type ImsAuthHeaders = {
  Authorization: string;
  "x-api-key"?: string;
};
/** Defines an authentication provider for Adobe IMS. */
type ImsAuthProvider = {
  getAccessToken: () => Promise<string> | string;
  getHeaders: () => Promise<ImsAuthHeaders> | ImsAuthHeaders;
};
//#endregion
//#region source/lib/ims-auth/forwarding.d.ts
declare const ForwardedImsAuthSourceSchema: v.VariantSchema<"from", [v.ObjectSchema<{
  readonly from: v.LiteralSchema<"headers", undefined>;
  readonly headers: v.RecordSchema<v.StringSchema<undefined>, v.OptionalSchema<v.StringSchema<undefined>, undefined>, undefined>;
}, undefined>, v.ObjectSchema<{
  readonly from: v.LiteralSchema<"getter", undefined>;
  readonly getHeaders: v.CustomSchema<() => ImsAuthHeaders | Promise<ImsAuthHeaders>, v.ErrorMessage<v.CustomIssue> | undefined>;
}, undefined>, v.ObjectSchema<{
  readonly from: v.LiteralSchema<"params", undefined>;
  readonly params: v.LooseObjectSchema<{
    readonly AIO_COMMERCE_AUTH_IMS_TOKEN: v.StringSchema<`Expected a string value for '${string}'`>;
    readonly AIO_COMMERCE_AUTH_IMS_API_KEY: v.OptionalSchema<v.StringSchema<`Expected a string value for '${string}'`>, undefined>;
  }, undefined>;
}, undefined>], undefined>;
/**
 * Discriminated union for different sources of forwarded IMS auth credentials.
 *
 * - `headers`: Extract credentials from a raw headers object (e.g. an HTTP request).
 * - `getter`: Use a function that returns IMS auth headers (sync or async).
 * - `params`: Read credentials from a params object using `AIO_COMMERCE_AUTH_IMS_TOKEN` and `AIO_COMMERCE_AUTH_IMS_API_KEY` keys.
 */
type ForwardedImsAuthSource = v.InferOutput<typeof ForwardedImsAuthSourceSchema>;
/**
 * Creates an {@link ImsAuthProvider} by forwarding authentication credentials from various sources.
 *
 * @param source The source of the credentials to forward, as a {@link ForwardedImsAuthSource}.
 * @returns An {@link ImsAuthProvider} instance that returns the forwarded access token and headers.
 *
 * @throws {CommerceSdkValidationError} If the source object is invalid.
 * @throws {CommerceSdkValidationError} If `from: "headers"` is used and the `Authorization` header is missing.
 * @throws {CommerceSdkValidationError} If `from: "headers"` is used and the `Authorization` header is not in Bearer token format.
 * @throws {CommerceSdkValidationError} If `from: "params"` is used and `AIO_COMMERCE_AUTH_IMS_TOKEN` is missing or empty.
 *
 * @example
 * ```typescript
 * import { getForwardedImsAuthProvider } from "@adobe/aio-commerce-lib-auth";
 *
 * // From raw headers (e.g. from an HTTP request).
 * const provider1 = getForwardedImsAuthProvider({
 *   from: "headers",
 *   headers: params.__ow_headers,
 * });
 *
 * // From async getter (e.g. fetch from secret manager)
 * const provider2 = getForwardedImsAuthProvider({
 *   from: "getter",
 *   getHeaders: async () => {
 *     const token = await secretManager.getSecret("ims-token");
 *     return { Authorization: `Bearer ${token}` };
 *   },
 * });
 *
 * // From a params object (using AIO_COMMERCE_AUTH_IMS_TOKEN and AIO_COMMERCE_AUTH_IMS_API_KEY keys)
 * const provider3 = getForwardedImsAuthProvider({
 *   from: "params",
 *   params: actionParams,
 * });
 *
 * // Use the provider
 * const token = await provider1.getAccessToken();
 * const headers = await provider1.getHeaders();
 * ```
 */
declare function getForwardedImsAuthProvider(source: v.InferInput<typeof ForwardedImsAuthSourceSchema>): ImsAuthProvider;
/**
 * Creates an {@link ImsAuthProvider} by forwarding authentication credentials from runtime action parameters.
 *
 * This function automatically detects the source of credentials by trying multiple strategies in order:
 * 1. **Params token** - Looks for `AIO_COMMERCE_AUTH_IMS_TOKEN` (and optionally `AIO_COMMERCE_AUTH_IMS_API_KEY`) in the params object
 * 2. **HTTP headers** - Falls back to extracting the `Authorization` header from `__ow_headers`
 *
 * Use this function when building actions that receive authenticated requests and need to forward
 * those credentials to downstream services (proxy pattern).
 *
 * @param params The runtime action parameters object. Can contain either:
 *   - `AIO_COMMERCE_AUTH_IMS_TOKEN` and optionally `AIO_COMMERCE_AUTH_IMS_API_KEY` for direct token forwarding
 *   - `__ow_headers` with an `Authorization` header for HTTP request forwarding
 * @returns An {@link ImsAuthProvider} instance that returns the forwarded access token and headers.
 *
 * @throws {Error} If neither a valid token param nor Authorization header is found.
 *
 * @example
 * ```typescript
 * import { forwardImsAuthProvider } from "@adobe/aio-commerce-lib-auth";
 *
 * export async function main(params: Record<string, unknown>) {
 *   // Automatically detects credentials from params or headers
 *   const authProvider = forwardImsAuthProvider(params);
 *
 *   // Get the access token
 *   const token = await authProvider.getAccessToken();
 *
 *   // Get headers for downstream API requests
 *   const headers = await authProvider.getHeaders();
 *   // {
 *   //   Authorization: "Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9...",
 *   //   "x-api-key": "my-api-key" // Only if available
 *   // }
 *
 *   // Use the forwarded credentials in downstream API calls
 *   const response = await fetch("https://api.adobe.io/some-endpoint", {
 *     headers,
 *   });
 *
 *   return { statusCode: 200, body: await response.json() };
 * }
 * ```
 */
declare function forwardImsAuthProvider(params: Record<string, unknown>): ImsAuthProvider;
//#endregion
//#region source/lib/ims-auth/schema.d.ts
/** Validation schema for IMS auth environment values. */
declare const ImsAuthEnvSchema: import("valibot").PicklistSchema<["prod", "stage"], undefined>;
/** Defines the schema to validate the necessary parameters for the IMS auth service. */
declare const ImsAuthParamsSchema: import("valibot").ObjectSchema<{
  readonly clientId: import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<`Expected a string value for the IMS auth parameter ${string}`>, import("valibot").NonEmptyAction<string, `Expected a non-empty string value for the IMS auth parameter ${string}`>]>;
  readonly clientSecrets: import("valibot").SchemaWithPipe<readonly [import("valibot").ArraySchema<import("valibot").StringSchema<undefined>, `Expected a string array value for the IMS auth parameter ${string}`>, import("valibot").MinLengthAction<string[], number, `Expected at least ${number} items for the IMS auth parameter ${string}`>]>;
  readonly context: import("valibot").SchemaWithPipe<readonly [import("valibot").OptionalSchema<import("valibot").StringSchema<undefined>, undefined>]>;
  readonly environment: import("valibot").SchemaWithPipe<readonly [import("valibot").OptionalSchema<import("valibot").PicklistSchema<["prod", "stage"], undefined>, undefined>]>;
  readonly imsOrgId: import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<`Expected a string value for the IMS auth parameter ${string}`>, import("valibot").NonEmptyAction<string, `Expected a non-empty string value for the IMS auth parameter ${string}`>]>;
  readonly scopes: import("valibot").SchemaWithPipe<readonly [import("valibot").ArraySchema<import("valibot").StringSchema<undefined>, `Expected a string array value for the IMS auth parameter ${string}`>, import("valibot").MinLengthAction<string[], number, `Expected at least ${number} items for the IMS auth parameter ${string}`>]>;
  readonly technicalAccountEmail: import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<"Expected a string value for the IMS auth parameter technicalAccountEmail">, import("valibot").EmailAction<string, "Expected a valid email format for technicalAccountEmail">]>;
  readonly technicalAccountId: import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<`Expected a string value for the IMS auth parameter ${string}`>, import("valibot").NonEmptyAction<string, `Expected a non-empty string value for the IMS auth parameter ${string}`>]>;
}, undefined>;
/** Defines the parameters for the IMS auth service. */
type ImsAuthParams = InferOutput<typeof ImsAuthParamsSchema>;
/** Defines the environments accepted by the IMS auth service. */
type ImsAuthEnv = InferOutput<typeof ImsAuthEnvSchema>;
//#endregion
//#region source/lib/ims-auth/provider.d.ts
/**
 * Type guard to check if a value is an ImsAuthProvider instance.
 *
 * @param provider The value to check.
 * @returns `true` if the value is an ImsAuthProvider, `false` otherwise.
 *
 * @example
 * ```typescript
 * import { getImsAuthProvider, isImsAuthProvider } from "@adobe/aio-commerce-lib-auth";
 *
 * // Imagine you have an object that it's not strictly typed as ImsAuthProvider.
 * const provider = getImsAuthProvider({ ... }) as unknown;
 *
 * if (isImsAuthProvider(provider)) {
 *   // TypeScript knows provider is ImsAuthProvider
 *   const token = await provider.getAccessToken();
 * }
 * ```
 */
declare function isImsAuthProvider(provider: unknown): provider is ImsAuthProvider;
/**
 * Creates an {@link ImsAuthProvider} based on the provided configuration.
 * @param authParams An {@link ImsAuthParams} parameter that contains the configuration for the {@link ImsAuthProvider}.
 * @returns An {@link ImsAuthProvider} instance that can be used to get access token and auth headers.
 * @example
 * ```typescript
 * const config = {
 *   clientId: "your-client-id",
 *   clientSecrets: ["your-client-secret"],
 *   technicalAccountId: "your-technical-account-id",
 *   technicalAccountEmail: "your-account@example.com",
 *   imsOrgId: "your-ims-org-id@AdobeOrg",
 *   scopes: ["AdobeID", "openid"],
 *   environment: "prod",
 *   context: "my-app-context"
 * };
 *
 * const authProvider = getImsAuthProvider(config);
 *
 * // Get access token
 * const token = await authProvider.getAccessToken();
 * console.log(token); // "eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9..."
 *
 * // Get headers for API requests
 * const headers = await authProvider.getHeaders();
 * console.log(headers);
 * // {
 * //   Authorization: "Bearer eyJ0eXAiOiJKV1QiLCJhbGciOiJSUzI1NiJ9...",
 * //   "x-api-key": "your-client-id"
 * // }
 *
 * // Use headers in API calls
 * const response = await fetch('https://api.adobe.io/some-endpoint', {
 *   headers: await authProvider.getHeaders()
 * });
 * ```
 */
declare function getImsAuthProvider(authParams: ImsAuthParams): {
  getAccessToken: () => Promise<string>;
  getHeaders: () => Promise<ImsAuthHeaders>;
};
//#endregion
//#region source/lib/ims-auth/utils.d.ts
/**
 * Asserts the provided configuration for an {@link ImsAuthProvider}.
 * @param config The configuration to validate.
 * @throws {CommerceSdkValidationError} If the configuration is invalid.
 * @example
 * ```typescript
 * const config = {
 *   clientId: "your-client-id",
 *   clientSecrets: ["your-client-secret"],
 *   technicalAccountId: "your-technical-account-id",
 *   technicalAccountEmail: "your-account@example.com",
 *   imsOrgId: "your-ims-org-id@AdobeOrg",
 *   scopes: ["AdobeID", "openid"],
 *   environment: "prod", // or "stage"
 *   context: "my-app-context"
 * };
 *
 * // This will validate the config and throw if invalid
 * assertImsAuthParams(config);
 *```
 * @example
 * ```typescript
 * // Example of a failing assert:
 * try {
 *   assertImsAuthParams({
 *     clientId: "valid-client-id",
 *     // Missing required fields like clientSecrets, technicalAccountId, etc.
 *   });
 * } catch (error) {
 *   console.error(error.message); // "Invalid ImsAuthProvider configuration"
 *   console.error(error.issues); // Array of validation issues
 * }
 * ```
 */
declare function assertImsAuthParams(config: Record<PropertyKey, unknown>): asserts config is ImsAuthParams;
/**
 * Resolves an {@link ImsAuthParams} from the given App Builder action inputs.
 * @param params The App Builder action inputs to resolve the IMS authentication parameters from.
 * @throws {CommerceSdkValidationError} If the parameters are invalid and cannot be resolved.
 *
 * @example
 * ```typescript
 * // Some App Builder runtime action that needs IMS authentication
 * export function main(params) {
 *   const imsAuthProvider = getImsAuthProvider(resolveImsAuthParams(params));
 *
 *   // Get headers for API requests
 *   const headers = await authProvider.getHeaders();
 *   const response = await fetch('https://api.adobe.io/some-endpoint', {
 *     headers: await authProvider.getHeaders()
 *   });
 * }
 * ```
 */
declare function resolveImsAuthParams(params: Record<string, unknown>): ImsAuthParams;
//#endregion
//#region source/lib/integration-auth/schema.d.ts
/**
 * The HTTP methods supported by Commerce.
 * This is used to determine which headers to include in the signing of the authorization header.
 */
type HttpMethodInput = "GET" | "POST" | "PUT" | "PATCH" | "DELETE";
/**
 * The schema for the Commerce Integration parameters.
 * This is used to validate the parameters passed to the Commerce Integration provider.
 */
declare const IntegrationAuthParamsSchema: import("valibot").NonOptionalSchema<import("valibot").ObjectSchema<{
  readonly accessToken: import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<`Expected a string value for the Commerce Integration parameter ${string}`>, import("valibot").NonEmptyAction<string, `Expected a non-empty string value for the Commerce Integration parameter ${string}`>]>;
  readonly accessTokenSecret: import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<`Expected a string value for the Commerce Integration parameter ${string}`>, import("valibot").NonEmptyAction<string, `Expected a non-empty string value for the Commerce Integration parameter ${string}`>]>;
  readonly consumerKey: import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<`Expected a string value for the Commerce Integration parameter ${string}`>, import("valibot").NonEmptyAction<string, `Expected a non-empty string value for the Commerce Integration parameter ${string}`>]>;
  readonly consumerSecret: import("valibot").SchemaWithPipe<readonly [import("valibot").StringSchema<`Expected a string value for the Commerce Integration parameter ${string}`>, import("valibot").NonEmptyAction<string, `Expected a non-empty string value for the Commerce Integration parameter ${string}`>]>;
}, undefined>, undefined>;
/** Defines the parameters required for Commerce Integration authentication. */
type IntegrationAuthParams = InferOutput<typeof IntegrationAuthParamsSchema>;
//#endregion
//#region source/lib/integration-auth/provider.d.ts
/** Defines the header key used for Commerce Integration authentication. */
type IntegrationAuthHeader = "Authorization";
/** Defines the headers required for Commerce Integration authentication. */
type IntegrationAuthHeaders = Record<IntegrationAuthHeader, string>;
/** Represents a URL for Adobe Commerce endpoints, accepting either string or URL object. */
type AdobeCommerceUrl = string | URL;
/** Defines an authentication provider for Adobe Commerce integrations. */
type IntegrationAuthProvider = {
  getHeaders: (method: HttpMethodInput, url: AdobeCommerceUrl) => IntegrationAuthHeaders;
};
/**
 * Type guard to check if a value is an IntegrationAuthProvider instance.
 *
 * @param provider The value to check.
 * @returns `true` if the value is an IntegrationAuthProvider, `false` otherwise.
 *
 * @example
 * ```typescript
 * import { getIntegrationAuthProvider, isIntegrationAuthProvider } from "@adobe/aio-commerce-lib-auth";
 *
 * // Imagine you have an object that it's not strictly typed as IntegrationAuthProvider.
 * const provider = getIntegrationAuthProvider({ ... }) as unknown;
 *
 * if (isIntegrationAuthProvider(provider)) {
 *   // TypeScript knows provider is IntegrationAuthProvider
 *   const headers = provider.getHeaders("GET", "https://api.example.com");
 * }
 * ```
 */
declare function isIntegrationAuthProvider(provider: unknown): provider is IntegrationAuthProvider;
/**
 * Creates an {@link IntegrationAuthProvider} based on the provided configuration.
 * @param authParams The configuration for the integration.
 * @returns An {@link IntegrationAuthProvider} instance that can be used to get auth headers.
 * @example
 * ```typescript
 * const config = {
 *   consumerKey: "your-consumer-key",
 *   consumerSecret: "your-consumer-secret",
 *   accessToken: "your-access-token",
 *   accessTokenSecret: "your-access-token-secret"
 * };
 *
 * const authProvider = getIntegrationAuthProvider(config);
 *
 * // Get OAuth headers for a REST API call
 * const headers = authProvider.getHeaders("GET", "https://your-store.com/rest/V1/products");
 * console.log(headers); // { Authorization: "OAuth oauth_consumer_key=..., oauth_signature=..." }
 *
 * // Can also be used with URL objects
 * const url = new URL("https://your-store.com/rest/V1/customers");
 * const postHeaders = authProvider.getHeaders("POST", url);
 * ```
 */
declare function getIntegrationAuthProvider(authParams: IntegrationAuthParams): IntegrationAuthProvider;
//#endregion
//#region source/lib/integration-auth/utils.d.ts
/**
 * Asserts the provided configuration for an Adobe Commerce {@link IntegrationAuthProvider}.
 * @param config The configuration to validate.
 * @throws {CommerceSdkValidationError} If the configuration is invalid.
 * @example
 * ```typescript
 * const config = {
 *   consumerKey: "your-consumer-key",
 *   consumerSecret: "your-consumer-secret",
 *   accessToken: "your-access-token",
 *   accessTokenSecret: "your-access-token-secret"
 * };
 *
 * // This will validate the config and throw if invalid
 * assertIntegrationAuthParams(config);
 * ```
 * @example
 * ```typescript
 * // Example of a failing assert:
 * try {
 *   assertIntegrationAuthParams({
 *     consumerKey: "valid-consumer-key",
 *     // Missing required fields like consumerSecret, accessToken, accessTokenSecret
 *   });
 * } catch (error) {
 *   console.error(error.message); // "Invalid IntegrationAuthProvider configuration"
 *   console.error(error.issues); // Array of validation issues
 * }
 * ```
 */
declare function assertIntegrationAuthParams(config: Record<PropertyKey, unknown>): asserts config is IntegrationAuthParams;
//#endregion
//#region source/lib/utils.d.ts
/**
 * Automatically detects and resolves authentication parameters from App Builder action inputs.
 * Attempts to resolve IMS authentication first, then falls back to Integration authentication.
 *
 * @param params The App Builder action inputs containing authentication parameters.
 * @throws {CommerceSdkValidationError} If the parameters are invalid.
 * @throws {Error} If neither IMS nor Integration authentication parameters can be resolved.
 * @example
 * ```typescript
 * // Automatic detection (will use IMS if IMS params are present, otherwise Integration)
 * export function main(params) {
 *   const authProvider = resolveAuthParams(params);
 *   console.log(authProvider.strategy); // "ims" or "integration"
 * }
 * ```
 */
declare function resolveAuthParams(params: Record<string, unknown>): {
  strategy: "ims";
  clientId: string;
  clientSecrets: string[];
  context?: string | undefined;
  environment?: "prod" | "stage" | undefined;
  imsOrgId: string;
  scopes: string[];
  technicalAccountEmail: string;
  technicalAccountId: string;
} | {
  strategy: "integration";
  accessToken: string;
  accessTokenSecret: string;
  consumerKey: string;
  consumerSecret: string;
};
//#endregion
export { type ForwardedImsAuthSource, type ImsAuthEnv, type ImsAuthHeaders, type ImsAuthParams, type ImsAuthProvider, type IntegrationAuthParams, type IntegrationAuthProvider, assertImsAuthParams, assertIntegrationAuthParams, forwardImsAuthProvider, getForwardedImsAuthProvider, getImsAuthProvider, getIntegrationAuthProvider, isImsAuthProvider, isIntegrationAuthProvider, resolveAuthParams, resolveImsAuthParams };