// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.

import { APIResource } from '../core/resource';
import * as Shared from './shared';
import * as CompletionsAPI from './chat/completions';
import { APIPromise } from '../core/api-promise';
import { CursorPage, type CursorPageParams, PagePromise } from '../core/pagination';
import { buildHeaders } from '../internal/headers';
import { RequestOptions } from '../internal/request-options';
import { path } from '../internal/utils/path';

export class Secrets extends APIResource {
  /**
   * Create an account-level secret.
   *
   * The secret value is stored in the cloud provider's secret store. SGP only stores
   * metadata (key name, description, audit info). The value is never returned by any
   * API. Returns 409 if a secret with the same key already exists.
   *
   * @deprecated
   */
  create(body: SecretCreateParams, options?: RequestOptions): APIPromise<CloudSecret> {
    return this._client.post('/v5/sgp/secrets', { body, ...options });
  }

  /**
   * Get a single secret's metadata by ID. The value is never returned.
   *
   * @deprecated
   */
  retrieve(secretID: string, options?: RequestOptions): APIPromise<CloudSecret> {
    return this._client.get(path`/v5/sgp/secrets/${secretID}`, options);
  }

  /**
   * Update an existing secret's description and/or value.
   *
   * If value is provided, the cloud provider secret is updated. The secret value is
   * never returned by any API.
   *
   * @deprecated
   */
  update(secretID: string, body: SecretUpdateParams, options?: RequestOptions): APIPromise<CloudSecret> {
    return this._client.patch(path`/v5/sgp/secrets/${secretID}`, { body, ...options });
  }

  /**
   * List secret metadata for the account. Values are never returned.
   *
   * @deprecated
   */
  list(
    query: SecretListParams | null | undefined = {},
    options?: RequestOptions,
  ): PagePromise<CloudSecretsCursorPage, CloudSecret> {
    return this._client.getAPIList('/v5/sgp/secrets', CursorPage<CloudSecret>, { query, ...options });
  }

  /**
   * Delete a secret from both the cloud provider and SGP metadata.
   *
   * @deprecated
   */
  delete(secretID: string, options?: RequestOptions): APIPromise<void> {
    return this._client.delete(path`/v5/sgp/secrets/${secretID}`, {
      ...options,
      headers: buildHeaders([{ Accept: '*/*' }, options?.headers]),
    });
  }
}

export type CloudSecretsCursorPage = CursorPage<CloudSecret>;

/**
 * API response model for a secret. Never includes the secret value.
 */
export interface CloudSecret {
  /**
   * The unique identifier of the entity.
   */
  id: string;

  /**
   * The ID of the account that owns the given entity.
   */
  account_id: string;

  /**
   * Full path in the cloud secret store.
   */
  cloud_secret_path: string;

  /**
   * The date and time when the entity was created in ISO format.
   */
  created_at: string;

  /**
   * The identity that created the entity.
   */
  created_by: Shared.Identity;

  /**
   * Secret name, e.g. OPENAI_API_KEY.
   */
  key: string;

  /**
   * Optional human-readable description of the secret.
   */
  description?: string;

  object?: 'sgp_cloud_secret';

  /**
   * Timestamp of last update.
   */
  updated_at?: string;

  /**
   * User who last updated the secret.
   */
  updated_by?: string;
}

export interface SecretCreateParams {
  /**
   * Secret name (e.g. openai-api-key). Must be lowercase alphanumeric with hyphens
   * (no dots or underscores), so it maps 1:1 to a valid secret name on every cloud
   * backend (AWS / Azure Key Vault / GCP Secret Manager).
   */
  key: string;

  /**
   * The secret value to store
   */
  value: string;

  /**
   * Optional human-readable description
   */
  description?: string;
}

export interface SecretUpdateParams {
  /**
   * Updated human-readable description
   */
  description?: string;

  /**
   * Updated secret value to store in cloud provider
   */
  value?: string;
}

export interface SecretListParams extends CursorPageParams {
  sort_by?: string;

  sort_order?: CompletionsAPI.SortOrder;
}

export declare namespace Secrets {
  export {
    type CloudSecret as CloudSecret,
    type CloudSecretsCursorPage as CloudSecretsCursorPage,
    type SecretCreateParams as SecretCreateParams,
    type SecretUpdateParams as SecretUpdateParams,
    type SecretListParams as SecretListParams,
  };
}