// AUTO-GENERATED by scripts/generate.ts from .generated-specs. Do not edit.
import * as S from "@distilled.cloud/core/schema";
import * as API from "@distilled.cloud/core/api";
import * as T from "../traits.ts";
import {
  CloudflareProtocol,
  CloudflarePaginatedProtocol,
  type CloudflareOpError,
  type CloudflareOpContext,
} from "../protocol.ts";
import { cloudflarePaginate, ResultInfo } from "../pagination.ts";
import { CloudflareError, CloudflareRateLimited } from "../errors.ts";
import * as Retry from "../retry.ts";

export type { CloudflareOpError, CloudflareOpContext };

/** Fallback camelCase→wire mapping for opaque content (mined from the distilled SDK). */
const KEY_DICTIONARY: Record<string, string | ReadonlyArray<string>> = {
  certificateAuthority: "certificate_authority",
  commonName: "common_name",
  expiresOn: "expires_on",
  fingerprintSha256: "fingerprint_sha256",
  issuedOn: "issued_on",
  organizationalUnit: "organizational_unit",
  perPage: "per_page",
  resultInfo: "result_info",
  serialNumber: "serial_number",
  totalCount: "total_count",
  validityDays: "validity_days",
};

export class ClientCertificateAlreadyRevoked
  extends /*@__PURE__*/ T.applyErrorMatchers(
    /*@__PURE__*/ S.TaggedError<ClientCertificateAlreadyRevoked>()(
      "ClientCertificateAlreadyRevoked",
      {
        code: S.Number,
        message: S.String,
      },
    ),
    [{ code: 1407, message: { includes: "already deleted" } }],
  ) {}

export class ClientCertificateNotFound
  extends /*@__PURE__*/ T.applyErrorMatchers(
    /*@__PURE__*/ S.TaggedError<ClientCertificateNotFound>()(
      "ClientCertificateNotFound",
      {
        code: S.Number,
        message: S.String,
      },
    ),
    [
      { code: 1415, message: { includes: "Invalid Certificate ID" } },
      { status: 404 },
    ],
  ) {}

export class Forbidden
  extends /*@__PURE__*/ T.applyErrorMatchers(
    /*@__PURE__*/ S.TaggedError<Forbidden>()("Forbidden", {
      code: S.Number,
      message: S.String,
    }),
    [{ status: 403 }],
  ) {}

export interface CreateClientCertificateRequest {
  /** Identifier. */
  zoneId: string;
  /** The Certificate Signing Request (CSR). Must be newline-encoded. */
  csr: string;
  /** The number of days the Client Certificate will be valid after the issued_on date. */
  validityDays: number;
}
export const CreateClientCertificateRequest = /*@__PURE__*/ S.suspend(() =>
  S.Struct({
    zoneId: S.String.pipe(T.Label("zone_id")),
    csr: S.String,
    validityDays: S.Number.pipe(T.Body("validity_days")),
  })
    .pipe(
      T.Http({
        method: "POST",
        uri: "/zones/{zone_id}/client_certificates",
        code: 200,
      }),
    )
    .pipe(T.KeyDictionary(KEY_DICTIONARY)),
).annotate({
  identifier: "CreateClientCertificateRequest",
}) as any as S.Schema<CreateClientCertificateRequest>;

export interface CreateResponseCertificateAuthority {
  id?: string | null;
  name?: string | null;
}
export const CreateResponseCertificateAuthority = /*@__PURE__*/ S.suspend(() =>
  S.Struct({
    id: S.optional(S.NullOr(S.String)),
    name: S.optional(S.NullOr(S.String)),
  }),
).annotate({
  identifier: "CreateResponseCertificateAuthority",
}) as any as S.Schema<CreateResponseCertificateAuthority>;

export type CreateResponseStatus =
  | "active"
  | "pending_reactivation"
  | "pending_revocation"
  | "revoked";
export const CreateResponseStatus = /*@__PURE__*/ S.String;

/** Unwrapped `result` payload of the Cloudflare v4 response envelope. */
export interface CreateClientCertificateResponse {
  /** Identifier. */
  id?: string | null;
  /** The Client Certificate PEM. */
  certificate?: string | null;
  /** Certificate Authority used to issue the Client Certificate. */
  certificateAuthority?: CreateResponseCertificateAuthority | null;
  /** Common Name of the Client Certificate. */
  commonName?: string | null;
  /** Country, provided by the CSR. */
  country?: string | null;
  /** The Certificate Signing Request (CSR). Must be newline-encoded. */
  csr?: string | null;
  /** Date that the Client Certificate expires. */
  expiresOn?: string | null;
  /** Unique identifier of the Client Certificate. */
  fingerprintSha256?: string | null;
  /** Date that the Client Certificate was issued by the Certificate Authority. */
  issuedOn?: string | null;
  /** Location, provided by the CSR. */
  location?: string | null;
  /** Organization, provided by the CSR. */
  organization?: string | null;
  /** Organizational Unit, provided by the CSR. */
  organizationalUnit?: string | null;
  /** The serial number on the created Client Certificate. */
  serialNumber?: string | null;
  /** The type of hash used for the Client Certificate.. */
  signature?: string | null;
  /** Subject Key Identifier. */
  ski?: string | null;
  /** State, provided by the CSR. */
  state?: string | null;
  /** Client Certificates may be active or revoked, and the pending_reactivation or pending_revocation represent in-progress asynchronous transitions. */
  status?: CreateResponseStatus | null;
  /** The number of days the Client Certificate will be valid after the issued_on date. */
  validityDays?: number | null;
}
export const CreateClientCertificateResponse = /*@__PURE__*/ S.suspend(() =>
  S.Struct({
    id: S.optional(S.NullOr(S.String)),
    certificate: S.optional(S.NullOr(S.String)),
    certificateAuthority: S.optional(
      S.NullOr(CreateResponseCertificateAuthority).pipe(
        T.Body("certificate_authority"),
      ),
    ),
    commonName: S.optional(S.NullOr(S.String).pipe(T.Body("common_name"))),
    country: S.optional(S.NullOr(S.String)),
    csr: S.optional(S.NullOr(S.String)),
    expiresOn: S.optional(S.NullOr(S.String).pipe(T.Body("expires_on"))),
    fingerprintSha256: S.optional(
      S.NullOr(S.String).pipe(T.Body("fingerprint_sha256")),
    ),
    issuedOn: S.optional(S.NullOr(S.String).pipe(T.Body("issued_on"))),
    location: S.optional(S.NullOr(S.String)),
    organization: S.optional(S.NullOr(S.String)),
    organizationalUnit: S.optional(
      S.NullOr(S.String).pipe(T.Body("organizational_unit")),
    ),
    serialNumber: S.optional(S.NullOr(S.String).pipe(T.Body("serial_number"))),
    signature: S.optional(S.NullOr(S.String)),
    ski: S.optional(S.NullOr(S.String)),
    state: S.optional(S.NullOr(S.String)),
    status: S.optional(S.NullOr(CreateResponseStatus)),
    validityDays: S.optional(S.NullOr(S.Number).pipe(T.Body("validity_days"))),
  }).pipe(T.KeyDictionary(KEY_DICTIONARY)),
).annotate({
  identifier: "CreateClientCertificateResponse",
}) as any as S.Schema<CreateClientCertificateResponse>;

export interface DeleteClientCertificateRequest {
  /** Identifier. */
  zoneId: string;
  /** Identifier. */
  clientCertificateId: string;
}
export const DeleteClientCertificateRequest = /*@__PURE__*/ S.suspend(() =>
  S.Struct({
    zoneId: S.String.pipe(T.Label("zone_id")),
    clientCertificateId: S.String.pipe(T.Label("client_certificate_id")),
  })
    .pipe(
      T.Http({
        method: "DELETE",
        uri: "/zones/{zone_id}/client_certificates/{client_certificate_id}",
        code: 200,
      }),
    )
    .pipe(T.KeyDictionary(KEY_DICTIONARY)),
).annotate({
  identifier: "DeleteClientCertificateRequest",
}) as any as S.Schema<DeleteClientCertificateRequest>;

export type DeleteResponseCertificateAuthority =
  CreateResponseCertificateAuthority;
export const DeleteResponseCertificateAuthority =
  CreateResponseCertificateAuthority;

export type DeleteResponseStatus =
  | "active"
  | "pending_reactivation"
  | "pending_revocation"
  | "revoked";
export const DeleteResponseStatus = /*@__PURE__*/ S.String;

/** Unwrapped `result` payload of the Cloudflare v4 response envelope. */
export interface DeleteClientCertificateResponse {
  /** Identifier. */
  id?: string | null;
  /** The Client Certificate PEM. */
  certificate?: string | null;
  /** Certificate Authority used to issue the Client Certificate. */
  certificateAuthority?: CreateResponseCertificateAuthority | null;
  /** Common Name of the Client Certificate. */
  commonName?: string | null;
  /** Country, provided by the CSR. */
  country?: string | null;
  /** The Certificate Signing Request (CSR). Must be newline-encoded. */
  csr?: string | null;
  /** Date that the Client Certificate expires. */
  expiresOn?: string | null;
  /** Unique identifier of the Client Certificate. */
  fingerprintSha256?: string | null;
  /** Date that the Client Certificate was issued by the Certificate Authority. */
  issuedOn?: string | null;
  /** Location, provided by the CSR. */
  location?: string | null;
  /** Organization, provided by the CSR. */
  organization?: string | null;
  /** Organizational Unit, provided by the CSR. */
  organizationalUnit?: string | null;
  /** The serial number on the created Client Certificate. */
  serialNumber?: string | null;
  /** The type of hash used for the Client Certificate.. */
  signature?: string | null;
  /** Subject Key Identifier. */
  ski?: string | null;
  /** State, provided by the CSR. */
  state?: string | null;
  /** Client Certificates may be active or revoked, and the pending_reactivation or pending_revocation represent in-progress asynchronous transitions. */
  status?: DeleteResponseStatus | null;
  /** The number of days the Client Certificate will be valid after the issued_on date. */
  validityDays?: number | null;
}
export const DeleteClientCertificateResponse = /*@__PURE__*/ S.suspend(() =>
  S.Struct({
    id: S.optional(S.NullOr(S.String)),
    certificate: S.optional(S.NullOr(S.String)),
    certificateAuthority: S.optional(
      S.NullOr(CreateResponseCertificateAuthority).pipe(
        T.Body("certificate_authority"),
      ),
    ),
    commonName: S.optional(S.NullOr(S.String).pipe(T.Body("common_name"))),
    country: S.optional(S.NullOr(S.String)),
    csr: S.optional(S.NullOr(S.String)),
    expiresOn: S.optional(S.NullOr(S.String).pipe(T.Body("expires_on"))),
    fingerprintSha256: S.optional(
      S.NullOr(S.String).pipe(T.Body("fingerprint_sha256")),
    ),
    issuedOn: S.optional(S.NullOr(S.String).pipe(T.Body("issued_on"))),
    location: S.optional(S.NullOr(S.String)),
    organization: S.optional(S.NullOr(S.String)),
    organizationalUnit: S.optional(
      S.NullOr(S.String).pipe(T.Body("organizational_unit")),
    ),
    serialNumber: S.optional(S.NullOr(S.String).pipe(T.Body("serial_number"))),
    signature: S.optional(S.NullOr(S.String)),
    ski: S.optional(S.NullOr(S.String)),
    state: S.optional(S.NullOr(S.String)),
    status: S.optional(S.NullOr(DeleteResponseStatus)),
    validityDays: S.optional(S.NullOr(S.Number).pipe(T.Body("validity_days"))),
  }).pipe(T.KeyDictionary(KEY_DICTIONARY)),
).annotate({
  identifier: "DeleteClientCertificateResponse",
}) as any as S.Schema<DeleteClientCertificateResponse>;

export interface GetClientCertificateRequest {
  /** Identifier. */
  zoneId: string;
  /** Identifier. */
  clientCertificateId: string;
}
export const GetClientCertificateRequest = /*@__PURE__*/ S.suspend(() =>
  S.Struct({
    zoneId: S.String.pipe(T.Label("zone_id")),
    clientCertificateId: S.String.pipe(T.Label("client_certificate_id")),
  })
    .pipe(
      T.Http({
        method: "GET",
        uri: "/zones/{zone_id}/client_certificates/{client_certificate_id}",
        code: 200,
      }),
    )
    .pipe(T.KeyDictionary(KEY_DICTIONARY)),
).annotate({
  identifier: "GetClientCertificateRequest",
}) as any as S.Schema<GetClientCertificateRequest>;

export type GetResponseCertificateAuthority =
  CreateResponseCertificateAuthority;
export const GetResponseCertificateAuthority =
  CreateResponseCertificateAuthority;

export type GetResponseStatus =
  | "active"
  | "pending_reactivation"
  | "pending_revocation"
  | "revoked";
export const GetResponseStatus = /*@__PURE__*/ S.String;

/** Unwrapped `result` payload of the Cloudflare v4 response envelope. */
export interface GetClientCertificateResponse {
  /** Identifier. */
  id?: string | null;
  /** The Client Certificate PEM. */
  certificate?: string | null;
  /** Certificate Authority used to issue the Client Certificate. */
  certificateAuthority?: CreateResponseCertificateAuthority | null;
  /** Common Name of the Client Certificate. */
  commonName?: string | null;
  /** Country, provided by the CSR. */
  country?: string | null;
  /** The Certificate Signing Request (CSR). Must be newline-encoded. */
  csr?: string | null;
  /** Date that the Client Certificate expires. */
  expiresOn?: string | null;
  /** Unique identifier of the Client Certificate. */
  fingerprintSha256?: string | null;
  /** Date that the Client Certificate was issued by the Certificate Authority. */
  issuedOn?: string | null;
  /** Location, provided by the CSR. */
  location?: string | null;
  /** Organization, provided by the CSR. */
  organization?: string | null;
  /** Organizational Unit, provided by the CSR. */
  organizationalUnit?: string | null;
  /** The serial number on the created Client Certificate. */
  serialNumber?: string | null;
  /** The type of hash used for the Client Certificate.. */
  signature?: string | null;
  /** Subject Key Identifier. */
  ski?: string | null;
  /** State, provided by the CSR. */
  state?: string | null;
  /** Client Certificates may be active or revoked, and the pending_reactivation or pending_revocation represent in-progress asynchronous transitions. */
  status?: GetResponseStatus | null;
  /** The number of days the Client Certificate will be valid after the issued_on date. */
  validityDays?: number | null;
}
export const GetClientCertificateResponse = /*@__PURE__*/ S.suspend(() =>
  S.Struct({
    id: S.optional(S.NullOr(S.String)),
    certificate: S.optional(S.NullOr(S.String)),
    certificateAuthority: S.optional(
      S.NullOr(CreateResponseCertificateAuthority).pipe(
        T.Body("certificate_authority"),
      ),
    ),
    commonName: S.optional(S.NullOr(S.String).pipe(T.Body("common_name"))),
    country: S.optional(S.NullOr(S.String)),
    csr: S.optional(S.NullOr(S.String)),
    expiresOn: S.optional(S.NullOr(S.String).pipe(T.Body("expires_on"))),
    fingerprintSha256: S.optional(
      S.NullOr(S.String).pipe(T.Body("fingerprint_sha256")),
    ),
    issuedOn: S.optional(S.NullOr(S.String).pipe(T.Body("issued_on"))),
    location: S.optional(S.NullOr(S.String)),
    organization: S.optional(S.NullOr(S.String)),
    organizationalUnit: S.optional(
      S.NullOr(S.String).pipe(T.Body("organizational_unit")),
    ),
    serialNumber: S.optional(S.NullOr(S.String).pipe(T.Body("serial_number"))),
    signature: S.optional(S.NullOr(S.String)),
    ski: S.optional(S.NullOr(S.String)),
    state: S.optional(S.NullOr(S.String)),
    status: S.optional(S.NullOr(GetResponseStatus)),
    validityDays: S.optional(S.NullOr(S.Number).pipe(T.Body("validity_days"))),
  }).pipe(T.KeyDictionary(KEY_DICTIONARY)),
).annotate({
  identifier: "GetClientCertificateResponse",
}) as any as S.Schema<GetClientCertificateResponse>;

export type ListRequestStatus =
  | "all"
  | "active"
  | "pending_reactivation"
  | "pending_revocation"
  | "revoked";
export const ListRequestStatus = /*@__PURE__*/ S.String;

export interface ListClientCertificatesRequest {
  /** Identifier. */
  zoneId: string;
  /** Limit to the number of records returned. */
  limit?: number;
  /** Offset the results. */
  offset?: number;
  /** Page number of paginated results. */
  page?: number;
  /** Number of records per page. */
  perPage?: number;
  /** Client Certitifcate Status to filter results by. */
  status?: ListRequestStatus | (string & {});
}
export const ListClientCertificatesRequest = /*@__PURE__*/ S.suspend(() =>
  S.Struct({
    zoneId: S.String.pipe(T.Label("zone_id")),
    limit: S.optional(S.Number.pipe(T.Query())),
    offset: S.optional(S.Number.pipe(T.Query())),
    page: S.optional(S.Number.pipe(T.Query())),
    perPage: S.optional(S.Number.pipe(T.Query("per_page"))),
    status: S.optional(ListRequestStatus.pipe(T.Query())),
  })
    .pipe(
      T.Http({
        method: "GET",
        uri: "/zones/{zone_id}/client_certificates",
        code: 200,
      }),
    )
    .pipe(T.KeyDictionary(KEY_DICTIONARY)),
).annotate({
  identifier: "ListClientCertificatesRequest",
}) as any as S.Schema<ListClientCertificatesRequest>;

export type ListResultItemCertificateAuthority =
  CreateResponseCertificateAuthority;
export const ListResultItemCertificateAuthority =
  CreateResponseCertificateAuthority;

export type ListResultItemStatus =
  | "active"
  | "pending_reactivation"
  | "pending_revocation"
  | "revoked";
export const ListResultItemStatus = /*@__PURE__*/ S.String;

export interface ListResultItem {
  /** Identifier. */
  id?: string | null;
  /** The Client Certificate PEM. */
  certificate?: string | null;
  /** Certificate Authority used to issue the Client Certificate. */
  certificateAuthority?: CreateResponseCertificateAuthority | null;
  /** Common Name of the Client Certificate. */
  commonName?: string | null;
  /** Country, provided by the CSR. */
  country?: string | null;
  /** The Certificate Signing Request (CSR). Must be newline-encoded. */
  csr?: string | null;
  /** Date that the Client Certificate expires. */
  expiresOn?: string | null;
  /** Unique identifier of the Client Certificate. */
  fingerprintSha256?: string | null;
  /** Date that the Client Certificate was issued by the Certificate Authority. */
  issuedOn?: string | null;
  /** Location, provided by the CSR. */
  location?: string | null;
  /** Organization, provided by the CSR. */
  organization?: string | null;
  /** Organizational Unit, provided by the CSR. */
  organizationalUnit?: string | null;
  /** The serial number on the created Client Certificate. */
  serialNumber?: string | null;
  /** The type of hash used for the Client Certificate.. */
  signature?: string | null;
  /** Subject Key Identifier. */
  ski?: string | null;
  /** State, provided by the CSR. */
  state?: string | null;
  /** Client Certificates may be active or revoked, and the pending_reactivation or pending_revocation represent in-progress asynchronous transitions. */
  status?: ListResultItemStatus | null;
  /** The number of days the Client Certificate will be valid after the issued_on date. */
  validityDays?: number | null;
}
export const ListResultItem = /*@__PURE__*/ S.suspend(() =>
  S.Struct({
    id: S.optional(S.NullOr(S.String)),
    certificate: S.optional(S.NullOr(S.String)),
    certificateAuthority: S.optional(
      S.NullOr(CreateResponseCertificateAuthority).pipe(
        T.Body("certificate_authority"),
      ),
    ),
    commonName: S.optional(S.NullOr(S.String).pipe(T.Body("common_name"))),
    country: S.optional(S.NullOr(S.String)),
    csr: S.optional(S.NullOr(S.String)),
    expiresOn: S.optional(S.NullOr(S.String).pipe(T.Body("expires_on"))),
    fingerprintSha256: S.optional(
      S.NullOr(S.String).pipe(T.Body("fingerprint_sha256")),
    ),
    issuedOn: S.optional(S.NullOr(S.String).pipe(T.Body("issued_on"))),
    location: S.optional(S.NullOr(S.String)),
    organization: S.optional(S.NullOr(S.String)),
    organizationalUnit: S.optional(
      S.NullOr(S.String).pipe(T.Body("organizational_unit")),
    ),
    serialNumber: S.optional(S.NullOr(S.String).pipe(T.Body("serial_number"))),
    signature: S.optional(S.NullOr(S.String)),
    ski: S.optional(S.NullOr(S.String)),
    state: S.optional(S.NullOr(S.String)),
    status: S.optional(S.NullOr(ListResultItemStatus)),
    validityDays: S.optional(S.NullOr(S.Number).pipe(T.Body("validity_days"))),
  }),
).annotate({ identifier: "ListResultItem" }) as any as S.Schema<ListResultItem>;

export type ListResultList = Array<ListResultItem>;
export const ListResultList = /*@__PURE__*/ S.Array(
  ListResultItem,
) as any as S.Schema<ListResultList>;

export interface ListClientCertificatesResponse {
  /** The unwrapped `result` payload of the v4 response envelope. */
  result: ListResultList;
  /** Pagination info from the envelope's `result_info`. */
  resultInfo?: ResultInfo | null;
}
export const ListClientCertificatesResponse = /*@__PURE__*/ S.suspend(() =>
  S.Struct({
    result: ListResultList.pipe(T.EnvelopePayload()),
    resultInfo: S.optional(S.NullOr(ResultInfo).pipe(T.ResultInfo())),
  }).pipe(T.KeyDictionary(KEY_DICTIONARY)),
).annotate({
  identifier: "ListClientCertificatesResponse",
}) as any as S.Schema<ListClientCertificatesResponse>;

export interface PatchClientCertificateRequest {
  /** Identifier. */
  zoneId: string;
  /** Identifier. */
  clientCertificateId: string;
  reactivate?: boolean;
}
export const PatchClientCertificateRequest = /*@__PURE__*/ S.suspend(() =>
  S.Struct({
    zoneId: S.String.pipe(T.Label("zone_id")),
    clientCertificateId: S.String.pipe(T.Label("client_certificate_id")),
    reactivate: S.optional(S.Boolean),
  })
    .pipe(
      T.Http({
        method: "PATCH",
        uri: "/zones/{zone_id}/client_certificates/{client_certificate_id}",
        code: 200,
      }),
    )
    .pipe(T.KeyDictionary(KEY_DICTIONARY)),
).annotate({
  identifier: "PatchClientCertificateRequest",
}) as any as S.Schema<PatchClientCertificateRequest>;

export type EditResponseCertificateAuthority =
  CreateResponseCertificateAuthority;
export const EditResponseCertificateAuthority =
  CreateResponseCertificateAuthority;

export type EditResponseStatus =
  | "active"
  | "pending_reactivation"
  | "pending_revocation"
  | "revoked";
export const EditResponseStatus = /*@__PURE__*/ S.String;

/** Unwrapped `result` payload of the Cloudflare v4 response envelope. */
export interface PatchClientCertificateResponse {
  /** Identifier. */
  id?: string | null;
  /** The Client Certificate PEM. */
  certificate?: string | null;
  /** Certificate Authority used to issue the Client Certificate. */
  certificateAuthority?: CreateResponseCertificateAuthority | null;
  /** Common Name of the Client Certificate. */
  commonName?: string | null;
  /** Country, provided by the CSR. */
  country?: string | null;
  /** The Certificate Signing Request (CSR). Must be newline-encoded. */
  csr?: string | null;
  /** Date that the Client Certificate expires. */
  expiresOn?: string | null;
  /** Unique identifier of the Client Certificate. */
  fingerprintSha256?: string | null;
  /** Date that the Client Certificate was issued by the Certificate Authority. */
  issuedOn?: string | null;
  /** Location, provided by the CSR. */
  location?: string | null;
  /** Organization, provided by the CSR. */
  organization?: string | null;
  /** Organizational Unit, provided by the CSR. */
  organizationalUnit?: string | null;
  /** The serial number on the created Client Certificate. */
  serialNumber?: string | null;
  /** The type of hash used for the Client Certificate.. */
  signature?: string | null;
  /** Subject Key Identifier. */
  ski?: string | null;
  /** State, provided by the CSR. */
  state?: string | null;
  /** Client Certificates may be active or revoked, and the pending_reactivation or pending_revocation represent in-progress asynchronous transitions. */
  status?: EditResponseStatus | null;
  /** The number of days the Client Certificate will be valid after the issued_on date. */
  validityDays?: number | null;
}
export const PatchClientCertificateResponse = /*@__PURE__*/ S.suspend(() =>
  S.Struct({
    id: S.optional(S.NullOr(S.String)),
    certificate: S.optional(S.NullOr(S.String)),
    certificateAuthority: S.optional(
      S.NullOr(CreateResponseCertificateAuthority).pipe(
        T.Body("certificate_authority"),
      ),
    ),
    commonName: S.optional(S.NullOr(S.String).pipe(T.Body("common_name"))),
    country: S.optional(S.NullOr(S.String)),
    csr: S.optional(S.NullOr(S.String)),
    expiresOn: S.optional(S.NullOr(S.String).pipe(T.Body("expires_on"))),
    fingerprintSha256: S.optional(
      S.NullOr(S.String).pipe(T.Body("fingerprint_sha256")),
    ),
    issuedOn: S.optional(S.NullOr(S.String).pipe(T.Body("issued_on"))),
    location: S.optional(S.NullOr(S.String)),
    organization: S.optional(S.NullOr(S.String)),
    organizationalUnit: S.optional(
      S.NullOr(S.String).pipe(T.Body("organizational_unit")),
    ),
    serialNumber: S.optional(S.NullOr(S.String).pipe(T.Body("serial_number"))),
    signature: S.optional(S.NullOr(S.String)),
    ski: S.optional(S.NullOr(S.String)),
    state: S.optional(S.NullOr(S.String)),
    status: S.optional(S.NullOr(EditResponseStatus)),
    validityDays: S.optional(S.NullOr(S.Number).pipe(T.Body("validity_days"))),
  }).pipe(T.KeyDictionary(KEY_DICTIONARY)),
).annotate({
  identifier: "PatchClientCertificateResponse",
}) as any as S.Schema<PatchClientCertificateResponse>;

export type CreateClientCertificateError = Forbidden | CloudflareOpError;
/** Create a new API Shield mTLS Client Certificate. */
export const createClientCertificate: API.OperationMethod<
  CreateClientCertificateRequest,
  CreateClientCertificateResponse,
  CreateClientCertificateError,
  CloudflareOpContext
> = /*@__PURE__*/ API.make(() => ({
  input: CreateClientCertificateRequest,
  output: CreateClientCertificateResponse,
  errors: [Forbidden, CloudflareRateLimited, CloudflareError],
  protocol: CloudflareProtocol,
  retry: Retry.Retry,
}));

export type DeleteClientCertificateError =
  | ClientCertificateNotFound
  | ClientCertificateAlreadyRevoked
  | Forbidden
  | CloudflareOpError;
/** Set a API Shield mTLS Client Certificate to pending_revocation status for processing to revoked status. */
export const deleteClientCertificate: API.OperationMethod<
  DeleteClientCertificateRequest,
  DeleteClientCertificateResponse,
  DeleteClientCertificateError,
  CloudflareOpContext
> = /*@__PURE__*/ API.make(() => ({
  input: DeleteClientCertificateRequest,
  output: DeleteClientCertificateResponse,
  errors: [
    ClientCertificateNotFound,
    ClientCertificateAlreadyRevoked,
    Forbidden,
    CloudflareRateLimited,
    CloudflareError,
  ],
  protocol: CloudflareProtocol,
  retry: Retry.Retry,
}));

export type GetClientCertificateError =
  | ClientCertificateNotFound
  | Forbidden
  | CloudflareOpError;
/** Get Details for a single mTLS API Shield Client Certificate. */
export const getClientCertificate: API.OperationMethod<
  GetClientCertificateRequest,
  GetClientCertificateResponse,
  GetClientCertificateError,
  CloudflareOpContext
> = /*@__PURE__*/ API.make(() => ({
  input: GetClientCertificateRequest,
  output: GetClientCertificateResponse,
  errors: [
    ClientCertificateNotFound,
    Forbidden,
    CloudflareRateLimited,
    CloudflareError,
  ],
  protocol: CloudflareProtocol,
  retry: Retry.Retry,
}));

export type ListClientCertificatesError = Forbidden | CloudflareOpError;
/** List all of your Zone's API Shield mTLS Client Certificates by Status and/or using Pagination. */
export const listClientCertificates: API.PaginatedOperationMethod<
  ListClientCertificatesRequest,
  ListClientCertificatesResponse,
  ListClientCertificatesError,
  CloudflareOpContext,
  ListResultItem
> = /*@__PURE__*/ API.makePaginated(
  () => ({
    input: ListClientCertificatesRequest,
    output: ListClientCertificatesResponse,
    errors: [Forbidden, CloudflareRateLimited, CloudflareError],
    protocol: CloudflarePaginatedProtocol,
    retry: Retry.Retry,
    pagination: {
      mode: "page",
      inputToken: "page",
      outputToken: "resultInfo.page",
      items: "result",
      pageSize: "perPage",
    } as const,
  }),
  cloudflarePaginate,
) as any;

export type PatchClientCertificateError =
  | ClientCertificateNotFound
  | Forbidden
  | CloudflareOpError;
/** If a API Shield mTLS Client Certificate is in a pending_revocation state, you may reactivate it with this endpoint. */
export const patchClientCertificate: API.OperationMethod<
  PatchClientCertificateRequest,
  PatchClientCertificateResponse,
  PatchClientCertificateError,
  CloudflareOpContext
> = /*@__PURE__*/ API.make(() => ({
  input: PatchClientCertificateRequest,
  output: PatchClientCertificateResponse,
  errors: [
    ClientCertificateNotFound,
    Forbidden,
    CloudflareRateLimited,
    CloudflareError,
  ],
  protocol: CloudflareProtocol,
  retry: Retry.Retry,
}));