import * as z from "zod/v3";
import { ClosedEnum } from "../types/enums.js";
import { Result as SafeParseResult } from "../types/fp.js";
import { SDKValidationError } from "./sdkvalidationerror.js";
/**
 * The signing algorithm to use for the issuer. EdDSA is not accepted for new issuers.
 */
export declare const Algorithm: {
    readonly Rs256: "RS256";
    readonly Rs384: "RS384";
    readonly Rs512: "RS512";
    readonly Ps256: "PS256";
    readonly Ps384: "PS384";
    readonly Ps512: "PS512";
    readonly Es256: "ES256";
    readonly Es384: "ES384";
    readonly Es512: "ES512";
};
/**
 * The signing algorithm to use for the issuer. EdDSA is not accepted for new issuers.
 */
export type Algorithm = ClosedEnum<typeof Algorithm>;
export type Policy2 = {
    kind: "connex-grant";
    /**
     * The Connex client ID for the Connex grant policy.
     */
    clientId: string;
    /**
     * The claims that KMS should include in signed JWTs for this policy.
     */
    tokenClaims?: {
        [k: string]: any;
    } | undefined;
};
export type Policy1 = {
    kind: "project-grant";
    /**
     * The team ID for the project grant policy.
     */
    teamId: string;
    /**
     * The project ID for the project grant policy.
     */
    projectId: string;
    /**
     * The environments for the project grant policy. Each entry is a system environment (production, preview, development) or a custom environment ID (env_...).
     */
    environments: Array<string>;
    /**
     * The claims that KMS should include in signed JWTs for this policy.
     */
    tokenClaims?: {
        [k: string]: any;
    } | undefined;
};
export type CreateKmsIssuerPolicy = Policy1 | Policy2;
export type CreateKmsIssuerRequestBody = {
    /**
     * The name of the issuer.
     */
    name: string;
    /**
     * The signing algorithm to use for the issuer. EdDSA is not accepted for new issuers.
     */
    algorithm?: Algorithm | undefined;
    /**
     * A JSON Schema used to validate the resolved token claims when signing tokens for this issuer.
     */
    claimsSchema?: {
        [k: string]: any;
    } | undefined;
    policy?: Policy1 | Policy2 | undefined;
    /**
     * The PEM-encoded private key to use for the issuer.
     */
    importKey?: string | undefined;
    /**
     * The key id to use as the imported key's JWT/JWKS `kid`. Only allowed when `importKey` is provided. Not required to be unique; the addressable key id is the server-minted `keyId` returned in the response.
     */
    importKeyId?: string | undefined;
};
export type CreateKmsIssuerRequest = {
    /**
     * The Team identifier to perform the request on behalf of.
     */
    teamId?: string | undefined;
    /**
     * The Team slug to perform the request on behalf of.
     */
    slug?: string | undefined;
    requestBody?: CreateKmsIssuerRequestBody | undefined;
};
export declare const CreateKmsIssuerAlgorithm: {
    readonly Es256: "ES256";
    readonly Es384: "ES384";
    readonly Es512: "ES512";
    readonly EdDSA: "EdDSA";
    readonly Ps256: "PS256";
    readonly Ps384: "PS384";
    readonly Ps512: "PS512";
    readonly Rs256: "RS256";
    readonly Rs384: "RS384";
    readonly Rs512: "RS512";
};
export type CreateKmsIssuerAlgorithm = ClosedEnum<typeof CreateKmsIssuerAlgorithm>;
export declare const CreateKmsIssuerOrigin: {
    readonly External: "external";
    readonly Vercel: "vercel";
};
export type CreateKmsIssuerOrigin = ClosedEnum<typeof CreateKmsIssuerOrigin>;
export declare const CreateKmsIssuerStatus: {
    readonly Active: "active";
    readonly Pending: "pending";
    readonly Revoking: "revoking";
};
export type CreateKmsIssuerStatus = ClosedEnum<typeof CreateKmsIssuerStatus>;
export type CreateKmsIssuerPublicKey = {
    kty?: string | undefined;
    kid?: string | undefined;
    alg?: string | undefined;
    use?: string | undefined;
    keyOps?: Array<string> | undefined;
    /**
     * The X.509 certificate chain (RFC 7517 §4.7). Each entry is the base64 DER (not base64url) of a certificate. For keys minted with a stored certificate this holds the single self-signed cert as `[x5c]`.
     */
    x5c?: Array<string> | undefined;
    /**
     * The base64url SHA-256 thumbprint of the DER certificate in `x5c[0]` (RFC 7517 §4.9).
     */
    x5tNumberS256?: string | undefined;
};
export type SigningKeys = {
    /**
     * The server-minted, unique record identifier. Use this to address the key on the activate / certificate endpoints.
     */
    keyId: string;
    /**
     * The caller-supplied key id (imported keys only), used as the JWT/JWKS `kid`. Not unique across an issuer's keys; omitted for generated keys.
     */
    importKeyId?: string | undefined;
    issuerId: string;
    algorithm: string;
    status: CreateKmsIssuerStatus;
    publicKey?: CreateKmsIssuerPublicKey | undefined;
    publicKeyFingerprint?: string | undefined;
    /**
     * The public key in SPKI PEM form, ready to render. Present whenever the key has public key material. Derived from `publicKey`; the embedded certificate members (`x5c`/`x5t#S256`) do not affect it.
     */
    publicKeyPem?: string | undefined;
    /**
     * The stored X.509 certificate (from `publicKey.x5c[0]`) in PEM form, ready to render. Present only for keys created with a stored certificate; omitted for keys created before certificates were stored.
     */
    certificatePem?: string | undefined;
    createdAt: string;
    updatedAt: string;
    revokeAt?: string | undefined;
    activateAt?: string | undefined;
    /**
     * When the key became the active signer. Present for active and revoking keys (and absent for pending keys and rows predating this field).
     */
    activatedAt?: string | undefined;
};
export type Policies2 = {
    kind: "connex-grant";
    clientId: string;
    tokenClaims?: {
        [k: string]: any;
    } | undefined;
    createdAt: string;
    updatedAt: string;
};
export type Policies1 = {
    kind: "project-grant";
    teamId: string;
    projectId: string;
    /**
     * Environments whose OIDC tokens this grant authorizes. Each entry is either a system environment slug (`production`, `preview`, `development`) or a custom environment ID (prefixed `env_`). Custom environments are matched against the token's `custom_environment_id` claim (the stable ID); system environments against its `environment` claim.
     */
    environments: Array<string>;
    tokenClaims?: {
        [k: string]: any;
    } | undefined;
    createdAt: string;
    updatedAt: string;
};
export type Policies = Policies1 | Policies2;
export type CreateKmsIssuerResponseBody = {
    id: string;
    ownerId: string;
    name: string;
    algorithm: CreateKmsIssuerAlgorithm;
    origin: CreateKmsIssuerOrigin;
    managedBy?: string | undefined;
    claimsSchema?: {
        [k: string]: any;
    } | undefined;
    createdAt: string;
    updatedAt: string;
    signingKeys: Array<SigningKeys>;
    policies: Array<Policies1 | Policies2>;
};
/** @internal */
export declare const Algorithm$outboundSchema: z.ZodNativeEnum<typeof Algorithm>;
/** @internal */
export type Policy2$Outbound = {
    kind: "connex-grant";
    clientId: string;
    tokenClaims?: {
        [k: string]: any;
    } | undefined;
};
/** @internal */
export declare const Policy2$outboundSchema: z.ZodType<Policy2$Outbound, z.ZodTypeDef, Policy2>;
export declare function policy2ToJSON(policy2: Policy2): string;
/** @internal */
export type Policy1$Outbound = {
    kind: "project-grant";
    teamId: string;
    projectId: string;
    environments: Array<string>;
    tokenClaims?: {
        [k: string]: any;
    } | undefined;
};
/** @internal */
export declare const Policy1$outboundSchema: z.ZodType<Policy1$Outbound, z.ZodTypeDef, Policy1>;
export declare function policy1ToJSON(policy1: Policy1): string;
/** @internal */
export type CreateKmsIssuerPolicy$Outbound = Policy1$Outbound | Policy2$Outbound;
/** @internal */
export declare const CreateKmsIssuerPolicy$outboundSchema: z.ZodType<CreateKmsIssuerPolicy$Outbound, z.ZodTypeDef, CreateKmsIssuerPolicy>;
export declare function createKmsIssuerPolicyToJSON(createKmsIssuerPolicy: CreateKmsIssuerPolicy): string;
/** @internal */
export type CreateKmsIssuerRequestBody$Outbound = {
    name: string;
    algorithm: string;
    claimsSchema?: {
        [k: string]: any;
    } | undefined;
    policy?: Policy1$Outbound | Policy2$Outbound | undefined;
    importKey?: string | undefined;
    importKeyId?: string | undefined;
};
/** @internal */
export declare const CreateKmsIssuerRequestBody$outboundSchema: z.ZodType<CreateKmsIssuerRequestBody$Outbound, z.ZodTypeDef, CreateKmsIssuerRequestBody>;
export declare function createKmsIssuerRequestBodyToJSON(createKmsIssuerRequestBody: CreateKmsIssuerRequestBody): string;
/** @internal */
export type CreateKmsIssuerRequest$Outbound = {
    teamId?: string | undefined;
    slug?: string | undefined;
    RequestBody?: CreateKmsIssuerRequestBody$Outbound | undefined;
};
/** @internal */
export declare const CreateKmsIssuerRequest$outboundSchema: z.ZodType<CreateKmsIssuerRequest$Outbound, z.ZodTypeDef, CreateKmsIssuerRequest>;
export declare function createKmsIssuerRequestToJSON(createKmsIssuerRequest: CreateKmsIssuerRequest): string;
/** @internal */
export declare const CreateKmsIssuerAlgorithm$inboundSchema: z.ZodNativeEnum<typeof CreateKmsIssuerAlgorithm>;
/** @internal */
export declare const CreateKmsIssuerOrigin$inboundSchema: z.ZodNativeEnum<typeof CreateKmsIssuerOrigin>;
/** @internal */
export declare const CreateKmsIssuerStatus$inboundSchema: z.ZodNativeEnum<typeof CreateKmsIssuerStatus>;
/** @internal */
export declare const CreateKmsIssuerPublicKey$inboundSchema: z.ZodType<CreateKmsIssuerPublicKey, z.ZodTypeDef, unknown>;
export declare function createKmsIssuerPublicKeyFromJSON(jsonString: string): SafeParseResult<CreateKmsIssuerPublicKey, SDKValidationError>;
/** @internal */
export declare const SigningKeys$inboundSchema: z.ZodType<SigningKeys, z.ZodTypeDef, unknown>;
export declare function signingKeysFromJSON(jsonString: string): SafeParseResult<SigningKeys, SDKValidationError>;
/** @internal */
export declare const Policies2$inboundSchema: z.ZodType<Policies2, z.ZodTypeDef, unknown>;
export declare function policies2FromJSON(jsonString: string): SafeParseResult<Policies2, SDKValidationError>;
/** @internal */
export declare const Policies1$inboundSchema: z.ZodType<Policies1, z.ZodTypeDef, unknown>;
export declare function policies1FromJSON(jsonString: string): SafeParseResult<Policies1, SDKValidationError>;
/** @internal */
export declare const Policies$inboundSchema: z.ZodType<Policies, z.ZodTypeDef, unknown>;
export declare function policiesFromJSON(jsonString: string): SafeParseResult<Policies, SDKValidationError>;
/** @internal */
export declare const CreateKmsIssuerResponseBody$inboundSchema: z.ZodType<CreateKmsIssuerResponseBody, z.ZodTypeDef, unknown>;
export declare function createKmsIssuerResponseBodyFromJSON(jsonString: string): SafeParseResult<CreateKmsIssuerResponseBody, SDKValidationError>;
//# sourceMappingURL=createkmsissuerop.d.ts.map