/*
 * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
 */

import * as z from "zod/v3";
import { remap as remap$ } from "../lib/primitives.js";
import { safeParse } from "../lib/schemas.js";
import { ClosedEnum } from "../types/enums.js";
import { Result as SafeParseResult } from "../types/fp.js";
import * as types from "../types/primitives.js";
import { SDKValidationError } from "./sdkvalidationerror.js";

/**
 * The signing algorithm to use for the issuer. EdDSA is not accepted for new issuers.
 */
export const Algorithm = {
  Rs256: "RS256",
  Rs384: "RS384",
  Rs512: "RS512",
  Ps256: "PS256",
  Ps384: "PS384",
  Ps512: "PS512",
  Es256: "ES256",
  Es384: "ES384",
  Es512: "ES512",
} as const;
/**
 * The signing algorithm to use for the issuer. EdDSA is not accepted for new issuers.
 */
export type Algorithm = ClosedEnum<typeof Algorithm>;

export type Policy2 = {
  kind: "connex-grant";
  /**
   * The Connex client ID for the Connex grant policy.
   */
  clientId: string;
  /**
   * The claims that KMS should include in signed JWTs for this policy.
   */
  tokenClaims?: { [k: string]: any } | undefined;
};

export type Policy1 = {
  kind: "project-grant";
  /**
   * The team ID for the project grant policy.
   */
  teamId: string;
  /**
   * The project ID for the project grant policy.
   */
  projectId: string;
  /**
   * The environments for the project grant policy. Each entry is a system environment (production, preview, development) or a custom environment ID (env_...).
   */
  environments: Array<string>;
  /**
   * The claims that KMS should include in signed JWTs for this policy.
   */
  tokenClaims?: { [k: string]: any } | undefined;
};

export type CreateKmsIssuerPolicy = Policy1 | Policy2;

export type CreateKmsIssuerRequestBody = {
  /**
   * The name of the issuer.
   */
  name: string;
  /**
   * The signing algorithm to use for the issuer. EdDSA is not accepted for new issuers.
   */
  algorithm?: Algorithm | undefined;
  /**
   * A JSON Schema used to validate the resolved token claims when signing tokens for this issuer.
   */
  claimsSchema?: { [k: string]: any } | undefined;
  policy?: Policy1 | Policy2 | undefined;
  /**
   * The PEM-encoded private key to use for the issuer.
   */
  importKey?: string | undefined;
  /**
   * The key id to use as the imported key's JWT/JWKS `kid`. Only allowed when `importKey` is provided. Not required to be unique; the addressable key id is the server-minted `keyId` returned in the response.
   */
  importKeyId?: string | undefined;
};

export type CreateKmsIssuerRequest = {
  /**
   * The Team identifier to perform the request on behalf of.
   */
  teamId?: string | undefined;
  /**
   * The Team slug to perform the request on behalf of.
   */
  slug?: string | undefined;
  requestBody?: CreateKmsIssuerRequestBody | undefined;
};

export const CreateKmsIssuerAlgorithm = {
  Es256: "ES256",
  Es384: "ES384",
  Es512: "ES512",
  EdDSA: "EdDSA",
  Ps256: "PS256",
  Ps384: "PS384",
  Ps512: "PS512",
  Rs256: "RS256",
  Rs384: "RS384",
  Rs512: "RS512",
} as const;
export type CreateKmsIssuerAlgorithm = ClosedEnum<
  typeof CreateKmsIssuerAlgorithm
>;

export const CreateKmsIssuerOrigin = {
  External: "external",
  Vercel: "vercel",
} as const;
export type CreateKmsIssuerOrigin = ClosedEnum<typeof CreateKmsIssuerOrigin>;

export const CreateKmsIssuerStatus = {
  Active: "active",
  Pending: "pending",
  Revoking: "revoking",
} as const;
export type CreateKmsIssuerStatus = ClosedEnum<typeof CreateKmsIssuerStatus>;

export type CreateKmsIssuerPublicKey = {
  kty?: string | undefined;
  kid?: string | undefined;
  alg?: string | undefined;
  use?: string | undefined;
  keyOps?: Array<string> | undefined;
  /**
   * The X.509 certificate chain (RFC 7517 §4.7). Each entry is the base64 DER (not base64url) of a certificate. For keys minted with a stored certificate this holds the single self-signed cert as `[x5c]`.
   */
  x5c?: Array<string> | undefined;
  /**
   * The base64url SHA-256 thumbprint of the DER certificate in `x5c[0]` (RFC 7517 §4.9).
   */
  x5tNumberS256?: string | undefined;
};

export type SigningKeys = {
  /**
   * The server-minted, unique record identifier. Use this to address the key on the activate / certificate endpoints.
   */
  keyId: string;
  /**
   * The caller-supplied key id (imported keys only), used as the JWT/JWKS `kid`. Not unique across an issuer's keys; omitted for generated keys.
   */
  importKeyId?: string | undefined;
  issuerId: string;
  algorithm: string;
  status: CreateKmsIssuerStatus;
  publicKey?: CreateKmsIssuerPublicKey | undefined;
  publicKeyFingerprint?: string | undefined;
  /**
   * The public key in SPKI PEM form, ready to render. Present whenever the key has public key material. Derived from `publicKey`; the embedded certificate members (`x5c`/`x5t#S256`) do not affect it.
   */
  publicKeyPem?: string | undefined;
  /**
   * The stored X.509 certificate (from `publicKey.x5c[0]`) in PEM form, ready to render. Present only for keys created with a stored certificate; omitted for keys created before certificates were stored.
   */
  certificatePem?: string | undefined;
  createdAt: string;
  updatedAt: string;
  revokeAt?: string | undefined;
  activateAt?: string | undefined;
  /**
   * When the key became the active signer. Present for active and revoking keys (and absent for pending keys and rows predating this field).
   */
  activatedAt?: string | undefined;
};

export type Policies2 = {
  kind: "connex-grant";
  clientId: string;
  tokenClaims?: { [k: string]: any } | undefined;
  createdAt: string;
  updatedAt: string;
};

export type Policies1 = {
  kind: "project-grant";
  teamId: string;
  projectId: string;
  /**
   * Environments whose OIDC tokens this grant authorizes. Each entry is either a system environment slug (`production`, `preview`, `development`) or a custom environment ID (prefixed `env_`). Custom environments are matched against the token's `custom_environment_id` claim (the stable ID); system environments against its `environment` claim.
   */
  environments: Array<string>;
  tokenClaims?: { [k: string]: any } | undefined;
  createdAt: string;
  updatedAt: string;
};

export type Policies = Policies1 | Policies2;

export type CreateKmsIssuerResponseBody = {
  id: string;
  ownerId: string;
  name: string;
  algorithm: CreateKmsIssuerAlgorithm;
  origin: CreateKmsIssuerOrigin;
  managedBy?: string | undefined;
  claimsSchema?: { [k: string]: any } | undefined;
  createdAt: string;
  updatedAt: string;
  signingKeys: Array<SigningKeys>;
  policies: Array<Policies1 | Policies2>;
};

/** @internal */
export const Algorithm$outboundSchema: z.ZodNativeEnum<typeof Algorithm> = z
  .nativeEnum(Algorithm);

/** @internal */
export type Policy2$Outbound = {
  kind: "connex-grant";
  clientId: string;
  tokenClaims?: { [k: string]: any } | undefined;
};

/** @internal */
export const Policy2$outboundSchema: z.ZodType<
  Policy2$Outbound,
  z.ZodTypeDef,
  Policy2
> = z.object({
  kind: z.literal("connex-grant"),
  clientId: z.string(),
  tokenClaims: z.record(z.any()).optional(),
});

export function policy2ToJSON(policy2: Policy2): string {
  return JSON.stringify(Policy2$outboundSchema.parse(policy2));
}

/** @internal */
export type Policy1$Outbound = {
  kind: "project-grant";
  teamId: string;
  projectId: string;
  environments: Array<string>;
  tokenClaims?: { [k: string]: any } | undefined;
};

/** @internal */
export const Policy1$outboundSchema: z.ZodType<
  Policy1$Outbound,
  z.ZodTypeDef,
  Policy1
> = z.object({
  kind: z.literal("project-grant"),
  teamId: z.string(),
  projectId: z.string(),
  environments: z.array(z.string()),
  tokenClaims: z.record(z.any()).optional(),
});

export function policy1ToJSON(policy1: Policy1): string {
  return JSON.stringify(Policy1$outboundSchema.parse(policy1));
}

/** @internal */
export type CreateKmsIssuerPolicy$Outbound =
  | Policy1$Outbound
  | Policy2$Outbound;

/** @internal */
export const CreateKmsIssuerPolicy$outboundSchema: z.ZodType<
  CreateKmsIssuerPolicy$Outbound,
  z.ZodTypeDef,
  CreateKmsIssuerPolicy
> = z.union([
  z.lazy(() => Policy1$outboundSchema),
  z.lazy(() => Policy2$outboundSchema),
]);

export function createKmsIssuerPolicyToJSON(
  createKmsIssuerPolicy: CreateKmsIssuerPolicy,
): string {
  return JSON.stringify(
    CreateKmsIssuerPolicy$outboundSchema.parse(createKmsIssuerPolicy),
  );
}

/** @internal */
export type CreateKmsIssuerRequestBody$Outbound = {
  name: string;
  algorithm: string;
  claimsSchema?: { [k: string]: any } | undefined;
  policy?: Policy1$Outbound | Policy2$Outbound | undefined;
  importKey?: string | undefined;
  importKeyId?: string | undefined;
};

/** @internal */
export const CreateKmsIssuerRequestBody$outboundSchema: z.ZodType<
  CreateKmsIssuerRequestBody$Outbound,
  z.ZodTypeDef,
  CreateKmsIssuerRequestBody
> = z.object({
  name: z.string(),
  algorithm: Algorithm$outboundSchema.default("RS512"),
  claimsSchema: z.record(z.any()).optional(),
  policy: z.union([
    z.lazy(() => Policy1$outboundSchema),
    z.lazy(() => Policy2$outboundSchema),
  ]).optional(),
  importKey: z.string().optional(),
  importKeyId: z.string().optional(),
});

export function createKmsIssuerRequestBodyToJSON(
  createKmsIssuerRequestBody: CreateKmsIssuerRequestBody,
): string {
  return JSON.stringify(
    CreateKmsIssuerRequestBody$outboundSchema.parse(createKmsIssuerRequestBody),
  );
}

/** @internal */
export type CreateKmsIssuerRequest$Outbound = {
  teamId?: string | undefined;
  slug?: string | undefined;
  RequestBody?: CreateKmsIssuerRequestBody$Outbound | undefined;
};

/** @internal */
export const CreateKmsIssuerRequest$outboundSchema: z.ZodType<
  CreateKmsIssuerRequest$Outbound,
  z.ZodTypeDef,
  CreateKmsIssuerRequest
> = z.object({
  teamId: z.string().optional(),
  slug: z.string().optional(),
  requestBody: z.lazy(() => CreateKmsIssuerRequestBody$outboundSchema)
    .optional(),
}).transform((v) => {
  return remap$(v, {
    requestBody: "RequestBody",
  });
});

export function createKmsIssuerRequestToJSON(
  createKmsIssuerRequest: CreateKmsIssuerRequest,
): string {
  return JSON.stringify(
    CreateKmsIssuerRequest$outboundSchema.parse(createKmsIssuerRequest),
  );
}

/** @internal */
export const CreateKmsIssuerAlgorithm$inboundSchema: z.ZodNativeEnum<
  typeof CreateKmsIssuerAlgorithm
> = z.nativeEnum(CreateKmsIssuerAlgorithm);

/** @internal */
export const CreateKmsIssuerOrigin$inboundSchema: z.ZodNativeEnum<
  typeof CreateKmsIssuerOrigin
> = z.nativeEnum(CreateKmsIssuerOrigin);

/** @internal */
export const CreateKmsIssuerStatus$inboundSchema: z.ZodNativeEnum<
  typeof CreateKmsIssuerStatus
> = z.nativeEnum(CreateKmsIssuerStatus);

/** @internal */
export const CreateKmsIssuerPublicKey$inboundSchema: z.ZodType<
  CreateKmsIssuerPublicKey,
  z.ZodTypeDef,
  unknown
> = z.object({
  kty: types.optional(types.string()),
  kid: types.optional(types.string()),
  alg: types.optional(types.string()),
  use: types.optional(types.string()),
  key_ops: types.optional(z.array(types.string())),
  x5c: types.optional(z.array(types.string())),
  "x5t#S256": types.optional(types.string()),
}).transform((v) => {
  return remap$(v, {
    "key_ops": "keyOps",
    "x5t#S256": "x5tNumberS256",
  });
});

export function createKmsIssuerPublicKeyFromJSON(
  jsonString: string,
): SafeParseResult<CreateKmsIssuerPublicKey, SDKValidationError> {
  return safeParse(
    jsonString,
    (x) => CreateKmsIssuerPublicKey$inboundSchema.parse(JSON.parse(x)),
    `Failed to parse 'CreateKmsIssuerPublicKey' from JSON`,
  );
}

/** @internal */
export const SigningKeys$inboundSchema: z.ZodType<
  SigningKeys,
  z.ZodTypeDef,
  unknown
> = z.object({
  keyId: types.string(),
  importKeyId: types.optional(types.string()),
  issuerId: types.string(),
  algorithm: types.string(),
  status: CreateKmsIssuerStatus$inboundSchema,
  publicKey: types.optional(
    z.lazy(() => CreateKmsIssuerPublicKey$inboundSchema),
  ),
  publicKeyFingerprint: types.optional(types.string()),
  publicKeyPem: types.optional(types.string()),
  certificatePem: types.optional(types.string()),
  createdAt: types.string(),
  updatedAt: types.string(),
  revokeAt: types.optional(types.string()),
  activateAt: types.optional(types.string()),
  activatedAt: types.optional(types.string()),
});

export function signingKeysFromJSON(
  jsonString: string,
): SafeParseResult<SigningKeys, SDKValidationError> {
  return safeParse(
    jsonString,
    (x) => SigningKeys$inboundSchema.parse(JSON.parse(x)),
    `Failed to parse 'SigningKeys' from JSON`,
  );
}

/** @internal */
export const Policies2$inboundSchema: z.ZodType<
  Policies2,
  z.ZodTypeDef,
  unknown
> = z.object({
  kind: types.literal("connex-grant"),
  clientId: types.string(),
  tokenClaims: types.optional(z.record(z.any())),
  createdAt: types.string(),
  updatedAt: types.string(),
});

export function policies2FromJSON(
  jsonString: string,
): SafeParseResult<Policies2, SDKValidationError> {
  return safeParse(
    jsonString,
    (x) => Policies2$inboundSchema.parse(JSON.parse(x)),
    `Failed to parse 'Policies2' from JSON`,
  );
}

/** @internal */
export const Policies1$inboundSchema: z.ZodType<
  Policies1,
  z.ZodTypeDef,
  unknown
> = z.object({
  kind: types.literal("project-grant"),
  teamId: types.string(),
  projectId: types.string(),
  environments: z.array(types.string()),
  tokenClaims: types.optional(z.record(z.any())),
  createdAt: types.string(),
  updatedAt: types.string(),
});

export function policies1FromJSON(
  jsonString: string,
): SafeParseResult<Policies1, SDKValidationError> {
  return safeParse(
    jsonString,
    (x) => Policies1$inboundSchema.parse(JSON.parse(x)),
    `Failed to parse 'Policies1' from JSON`,
  );
}

/** @internal */
export const Policies$inboundSchema: z.ZodType<
  Policies,
  z.ZodTypeDef,
  unknown
> = z.union([
  z.lazy(() => Policies1$inboundSchema),
  z.lazy(() => Policies2$inboundSchema),
]);

export function policiesFromJSON(
  jsonString: string,
): SafeParseResult<Policies, SDKValidationError> {
  return safeParse(
    jsonString,
    (x) => Policies$inboundSchema.parse(JSON.parse(x)),
    `Failed to parse 'Policies' from JSON`,
  );
}

/** @internal */
export const CreateKmsIssuerResponseBody$inboundSchema: z.ZodType<
  CreateKmsIssuerResponseBody,
  z.ZodTypeDef,
  unknown
> = z.object({
  id: types.string(),
  ownerId: types.string(),
  name: types.string(),
  algorithm: CreateKmsIssuerAlgorithm$inboundSchema,
  origin: CreateKmsIssuerOrigin$inboundSchema,
  managedBy: types.optional(types.string()),
  claimsSchema: types.optional(z.record(z.any())),
  createdAt: types.string(),
  updatedAt: types.string(),
  signingKeys: z.array(z.lazy(() => SigningKeys$inboundSchema)),
  policies: z.array(
    z.union([
      z.lazy(() => Policies1$inboundSchema),
      z.lazy(() => Policies2$inboundSchema),
    ]),
  ),
});

export function createKmsIssuerResponseBodyFromJSON(
  jsonString: string,
): SafeParseResult<CreateKmsIssuerResponseBody, SDKValidationError> {
  return safeParse(
    jsonString,
    (x) => CreateKmsIssuerResponseBody$inboundSchema.parse(JSON.parse(x)),
    `Failed to parse 'CreateKmsIssuerResponseBody' from JSON`,
  );
}