/*
 * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
 */

import * as z from "zod/v3";
import { remap as remap$ } from "../lib/primitives.js";
import { safeParse } from "../lib/schemas.js";
import { ClosedEnum } from "../types/enums.js";
import { Result as SafeParseResult } from "../types/fp.js";
import * as types from "../types/primitives.js";
import { smartUnion } from "../types/smartUnion.js";
import { SDKValidationError } from "./sdkvalidationerror.js";

/**
 * Whether the new key is activated automatically after its public key has propagated, or manually via the activate endpoint. Defaults to `automatic`.
 */
export const Activation = {
  Automatic: "automatic",
  Manual: "manual",
} as const;
/**
 * Whether the new key is activated automatically after its public key has propagated, or manually via the activate endpoint. Defaults to `automatic`.
 */
export type Activation = ClosedEnum<typeof Activation>;

/**
 * Deprecated. The ISO date string or timestamp when the previous signing key should stop being used. Converted to a relative grace and applied at activation, not creation. Prefer revokePreviousAfterHours.
 */
export type RevokePreviousAt = string | number;

export type CreateKmsSigningKeyRequestBody = {
  /**
   * Whether the new key is activated automatically after its public key has propagated, or manually via the activate endpoint. Defaults to `automatic`.
   */
  activation?: Activation | undefined;
  /**
   * For automatic activation, how many hours after activation the previous signing key should stop being used. Defaults to a 1 hour grace period so already-issued tokens keep verifying.
   */
  revokePreviousAfterHours?: number | undefined;
  /**
   * Deprecated. The ISO date string or timestamp when the previous signing key should stop being used. Converted to a relative grace and applied at activation, not creation. Prefer revokePreviousAfterHours.
   */
  revokePreviousAt?: string | number | undefined;
  /**
   * The PEM-encoded private key to use for the issuer.
   */
  importKey?: string | undefined;
  /**
   * The key id to use as the imported key's JWT/JWKS `kid`. Only allowed when `importKey` is provided. Not required to be unique; the addressable key id is the server-minted `keyId` returned in the response.
   */
  importKeyId?: string | undefined;
};

export type CreateKmsSigningKeyRequest = {
  /**
   * The ID of the issuer.
   */
  issuerId: string;
  /**
   * The Team identifier to perform the request on behalf of.
   */
  teamId?: string | undefined;
  /**
   * The Team slug to perform the request on behalf of.
   */
  slug?: string | undefined;
  requestBody?: CreateKmsSigningKeyRequestBody | undefined;
};

export const CreateKmsSigningKeyStatus = {
  Active: "active",
  Pending: "pending",
  Revoking: "revoking",
} as const;
export type CreateKmsSigningKeyStatus = ClosedEnum<
  typeof CreateKmsSigningKeyStatus
>;

export type PublicKey = {
  kty?: string | undefined;
  kid?: string | undefined;
  alg?: string | undefined;
  use?: string | undefined;
  keyOps?: Array<string> | undefined;
  /**
   * The X.509 certificate chain (RFC 7517 §4.7). Each entry is the base64 DER (not base64url) of a certificate. For keys minted with a stored certificate this holds the single self-signed cert as `[x5c]`.
   */
  x5c?: Array<string> | undefined;
  /**
   * The base64url SHA-256 thumbprint of the DER certificate in `x5c[0]` (RFC 7517 §4.9).
   */
  x5tNumberS256?: string | undefined;
};

export type CreateKmsSigningKeyResponseBody = {
  /**
   * The server-minted, unique record identifier. Use this to address the key on the activate / certificate endpoints.
   */
  keyId: string;
  /**
   * The caller-supplied key id (imported keys only), used as the JWT/JWKS `kid`. Not unique across an issuer's keys; omitted for generated keys.
   */
  importKeyId?: string | undefined;
  issuerId: string;
  algorithm: string;
  status: CreateKmsSigningKeyStatus;
  publicKey?: PublicKey | undefined;
  publicKeyFingerprint?: string | undefined;
  /**
   * The public key in SPKI PEM form, ready to render. Present whenever the key has public key material. Derived from `publicKey`; the embedded certificate members (`x5c`/`x5t#S256`) do not affect it.
   */
  publicKeyPem?: string | undefined;
  /**
   * The stored X.509 certificate (from `publicKey.x5c[0]`) in PEM form, ready to render. Present only for keys created with a stored certificate; omitted for keys created before certificates were stored.
   */
  certificatePem?: string | undefined;
  createdAt: string;
  updatedAt: string;
  revokeAt?: string | undefined;
  activateAt?: string | undefined;
  /**
   * When the key became the active signer. Present for active and revoking keys (and absent for pending keys and rows predating this field).
   */
  activatedAt?: string | undefined;
};

/** @internal */
export const Activation$outboundSchema: z.ZodNativeEnum<typeof Activation> = z
  .nativeEnum(Activation);

/** @internal */
export type RevokePreviousAt$Outbound = string | number;

/** @internal */
export const RevokePreviousAt$outboundSchema: z.ZodType<
  RevokePreviousAt$Outbound,
  z.ZodTypeDef,
  RevokePreviousAt
> = smartUnion([z.string(), z.number()]);

export function revokePreviousAtToJSON(
  revokePreviousAt: RevokePreviousAt,
): string {
  return JSON.stringify(
    RevokePreviousAt$outboundSchema.parse(revokePreviousAt),
  );
}

/** @internal */
export type CreateKmsSigningKeyRequestBody$Outbound = {
  activation?: string | undefined;
  revokePreviousAfterHours?: number | undefined;
  revokePreviousAt?: string | number | undefined;
  importKey?: string | undefined;
  importKeyId?: string | undefined;
};

/** @internal */
export const CreateKmsSigningKeyRequestBody$outboundSchema: z.ZodType<
  CreateKmsSigningKeyRequestBody$Outbound,
  z.ZodTypeDef,
  CreateKmsSigningKeyRequestBody
> = z.object({
  activation: Activation$outboundSchema.optional(),
  revokePreviousAfterHours: z.number().optional(),
  revokePreviousAt: smartUnion([z.string(), z.number()]).optional(),
  importKey: z.string().optional(),
  importKeyId: z.string().optional(),
});

export function createKmsSigningKeyRequestBodyToJSON(
  createKmsSigningKeyRequestBody: CreateKmsSigningKeyRequestBody,
): string {
  return JSON.stringify(
    CreateKmsSigningKeyRequestBody$outboundSchema.parse(
      createKmsSigningKeyRequestBody,
    ),
  );
}

/** @internal */
export type CreateKmsSigningKeyRequest$Outbound = {
  issuerId: string;
  teamId?: string | undefined;
  slug?: string | undefined;
  RequestBody?: CreateKmsSigningKeyRequestBody$Outbound | undefined;
};

/** @internal */
export const CreateKmsSigningKeyRequest$outboundSchema: z.ZodType<
  CreateKmsSigningKeyRequest$Outbound,
  z.ZodTypeDef,
  CreateKmsSigningKeyRequest
> = z.object({
  issuerId: z.string(),
  teamId: z.string().optional(),
  slug: z.string().optional(),
  requestBody: z.lazy(() => CreateKmsSigningKeyRequestBody$outboundSchema)
    .optional(),
}).transform((v) => {
  return remap$(v, {
    requestBody: "RequestBody",
  });
});

export function createKmsSigningKeyRequestToJSON(
  createKmsSigningKeyRequest: CreateKmsSigningKeyRequest,
): string {
  return JSON.stringify(
    CreateKmsSigningKeyRequest$outboundSchema.parse(createKmsSigningKeyRequest),
  );
}

/** @internal */
export const CreateKmsSigningKeyStatus$inboundSchema: z.ZodNativeEnum<
  typeof CreateKmsSigningKeyStatus
> = z.nativeEnum(CreateKmsSigningKeyStatus);

/** @internal */
export const PublicKey$inboundSchema: z.ZodType<
  PublicKey,
  z.ZodTypeDef,
  unknown
> = z.object({
  kty: types.optional(types.string()),
  kid: types.optional(types.string()),
  alg: types.optional(types.string()),
  use: types.optional(types.string()),
  key_ops: types.optional(z.array(types.string())),
  x5c: types.optional(z.array(types.string())),
  "x5t#S256": types.optional(types.string()),
}).transform((v) => {
  return remap$(v, {
    "key_ops": "keyOps",
    "x5t#S256": "x5tNumberS256",
  });
});

export function publicKeyFromJSON(
  jsonString: string,
): SafeParseResult<PublicKey, SDKValidationError> {
  return safeParse(
    jsonString,
    (x) => PublicKey$inboundSchema.parse(JSON.parse(x)),
    `Failed to parse 'PublicKey' from JSON`,
  );
}

/** @internal */
export const CreateKmsSigningKeyResponseBody$inboundSchema: z.ZodType<
  CreateKmsSigningKeyResponseBody,
  z.ZodTypeDef,
  unknown
> = z.object({
  keyId: types.string(),
  importKeyId: types.optional(types.string()),
  issuerId: types.string(),
  algorithm: types.string(),
  status: CreateKmsSigningKeyStatus$inboundSchema,
  publicKey: types.optional(z.lazy(() => PublicKey$inboundSchema)),
  publicKeyFingerprint: types.optional(types.string()),
  publicKeyPem: types.optional(types.string()),
  certificatePem: types.optional(types.string()),
  createdAt: types.string(),
  updatedAt: types.string(),
  revokeAt: types.optional(types.string()),
  activateAt: types.optional(types.string()),
  activatedAt: types.optional(types.string()),
});

export function createKmsSigningKeyResponseBodyFromJSON(
  jsonString: string,
): SafeParseResult<CreateKmsSigningKeyResponseBody, SDKValidationError> {
  return safeParse(
    jsonString,
    (x) => CreateKmsSigningKeyResponseBody$inboundSchema.parse(JSON.parse(x)),
    `Failed to parse 'CreateKmsSigningKeyResponseBody' from JSON`,
  );
}