import * as z from "zod/v3";
import { ClosedEnum } from "../types/enums.js";
import { Result as SafeParseResult } from "../types/fp.js";
import { SDKValidationError } from "./sdkvalidationerror.js";
/**
 * Whether the new key is activated automatically after its public key has propagated, or manually via the activate endpoint. Defaults to `automatic`.
 */
export declare const Activation: {
    readonly Automatic: "automatic";
    readonly Manual: "manual";
};
/**
 * Whether the new key is activated automatically after its public key has propagated, or manually via the activate endpoint. Defaults to `automatic`.
 */
export type Activation = ClosedEnum<typeof Activation>;
/**
 * Deprecated. The ISO date string or timestamp when the previous signing key should stop being used. Converted to a relative grace and applied at activation, not creation. Prefer revokePreviousAfterHours.
 */
export type RevokePreviousAt = string | number;
export type CreateKmsSigningKeyRequestBody = {
    /**
     * Whether the new key is activated automatically after its public key has propagated, or manually via the activate endpoint. Defaults to `automatic`.
     */
    activation?: Activation | undefined;
    /**
     * For automatic activation, how many hours after activation the previous signing key should stop being used. Defaults to a 1 hour grace period so already-issued tokens keep verifying.
     */
    revokePreviousAfterHours?: number | undefined;
    /**
     * Deprecated. The ISO date string or timestamp when the previous signing key should stop being used. Converted to a relative grace and applied at activation, not creation. Prefer revokePreviousAfterHours.
     */
    revokePreviousAt?: string | number | undefined;
    /**
     * The PEM-encoded private key to use for the issuer.
     */
    importKey?: string | undefined;
    /**
     * The key id to use as the imported key's JWT/JWKS `kid`. Only allowed when `importKey` is provided. Not required to be unique; the addressable key id is the server-minted `keyId` returned in the response.
     */
    importKeyId?: string | undefined;
};
export type CreateKmsSigningKeyRequest = {
    /**
     * The ID of the issuer.
     */
    issuerId: string;
    /**
     * The Team identifier to perform the request on behalf of.
     */
    teamId?: string | undefined;
    /**
     * The Team slug to perform the request on behalf of.
     */
    slug?: string | undefined;
    requestBody?: CreateKmsSigningKeyRequestBody | undefined;
};
export declare const CreateKmsSigningKeyStatus: {
    readonly Active: "active";
    readonly Pending: "pending";
    readonly Revoking: "revoking";
};
export type CreateKmsSigningKeyStatus = ClosedEnum<typeof CreateKmsSigningKeyStatus>;
export type PublicKey = {
    kty?: string | undefined;
    kid?: string | undefined;
    alg?: string | undefined;
    use?: string | undefined;
    keyOps?: Array<string> | undefined;
    /**
     * The X.509 certificate chain (RFC 7517 §4.7). Each entry is the base64 DER (not base64url) of a certificate. For keys minted with a stored certificate this holds the single self-signed cert as `[x5c]`.
     */
    x5c?: Array<string> | undefined;
    /**
     * The base64url SHA-256 thumbprint of the DER certificate in `x5c[0]` (RFC 7517 §4.9).
     */
    x5tNumberS256?: string | undefined;
};
export type CreateKmsSigningKeyResponseBody = {
    /**
     * The server-minted, unique record identifier. Use this to address the key on the activate / certificate endpoints.
     */
    keyId: string;
    /**
     * The caller-supplied key id (imported keys only), used as the JWT/JWKS `kid`. Not unique across an issuer's keys; omitted for generated keys.
     */
    importKeyId?: string | undefined;
    issuerId: string;
    algorithm: string;
    status: CreateKmsSigningKeyStatus;
    publicKey?: PublicKey | undefined;
    publicKeyFingerprint?: string | undefined;
    /**
     * The public key in SPKI PEM form, ready to render. Present whenever the key has public key material. Derived from `publicKey`; the embedded certificate members (`x5c`/`x5t#S256`) do not affect it.
     */
    publicKeyPem?: string | undefined;
    /**
     * The stored X.509 certificate (from `publicKey.x5c[0]`) in PEM form, ready to render. Present only for keys created with a stored certificate; omitted for keys created before certificates were stored.
     */
    certificatePem?: string | undefined;
    createdAt: string;
    updatedAt: string;
    revokeAt?: string | undefined;
    activateAt?: string | undefined;
    /**
     * When the key became the active signer. Present for active and revoking keys (and absent for pending keys and rows predating this field).
     */
    activatedAt?: string | undefined;
};
/** @internal */
export declare const Activation$outboundSchema: z.ZodNativeEnum<typeof Activation>;
/** @internal */
export type RevokePreviousAt$Outbound = string | number;
/** @internal */
export declare const RevokePreviousAt$outboundSchema: z.ZodType<RevokePreviousAt$Outbound, z.ZodTypeDef, RevokePreviousAt>;
export declare function revokePreviousAtToJSON(revokePreviousAt: RevokePreviousAt): string;
/** @internal */
export type CreateKmsSigningKeyRequestBody$Outbound = {
    activation?: string | undefined;
    revokePreviousAfterHours?: number | undefined;
    revokePreviousAt?: string | number | undefined;
    importKey?: string | undefined;
    importKeyId?: string | undefined;
};
/** @internal */
export declare const CreateKmsSigningKeyRequestBody$outboundSchema: z.ZodType<CreateKmsSigningKeyRequestBody$Outbound, z.ZodTypeDef, CreateKmsSigningKeyRequestBody>;
export declare function createKmsSigningKeyRequestBodyToJSON(createKmsSigningKeyRequestBody: CreateKmsSigningKeyRequestBody): string;
/** @internal */
export type CreateKmsSigningKeyRequest$Outbound = {
    issuerId: string;
    teamId?: string | undefined;
    slug?: string | undefined;
    RequestBody?: CreateKmsSigningKeyRequestBody$Outbound | undefined;
};
/** @internal */
export declare const CreateKmsSigningKeyRequest$outboundSchema: z.ZodType<CreateKmsSigningKeyRequest$Outbound, z.ZodTypeDef, CreateKmsSigningKeyRequest>;
export declare function createKmsSigningKeyRequestToJSON(createKmsSigningKeyRequest: CreateKmsSigningKeyRequest): string;
/** @internal */
export declare const CreateKmsSigningKeyStatus$inboundSchema: z.ZodNativeEnum<typeof CreateKmsSigningKeyStatus>;
/** @internal */
export declare const PublicKey$inboundSchema: z.ZodType<PublicKey, z.ZodTypeDef, unknown>;
export declare function publicKeyFromJSON(jsonString: string): SafeParseResult<PublicKey, SDKValidationError>;
/** @internal */
export declare const CreateKmsSigningKeyResponseBody$inboundSchema: z.ZodType<CreateKmsSigningKeyResponseBody, z.ZodTypeDef, unknown>;
export declare function createKmsSigningKeyResponseBodyFromJSON(jsonString: string): SafeParseResult<CreateKmsSigningKeyResponseBody, SDKValidationError>;
//# sourceMappingURL=createkmssigningkeyop.d.ts.map