// AUTO-GENERATED by scripts/generate.ts from .generated-specs. Do not edit.
import * as S from "@distilled.cloud/core/schema";
import * as API from "@distilled.cloud/core/api";
import * as T from "../traits.ts";
import {
  CloudflareProtocol,
  CloudflarePaginatedProtocol,
  type CloudflareOpError,
  type CloudflareOpContext,
} from "../protocol.ts";
import { cloudflarePaginate, ResultInfo } from "../pagination.ts";
import { CloudflareError, CloudflareRateLimited } from "../errors.ts";
import * as Retry from "../retry.ts";

export type { CloudflareOpError, CloudflareOpContext };

/** Fallback camelCase→wire mapping for opaque content (mined from the distilled SDK). */
const KEY_DICTIONARY: Record<string, string | ReadonlyArray<string>> = {
  bundleMethod: "bundle_method",
  createdOn: "created_on",
  customCsrId: "custom_csr_id",
  expiresOn: "expires_on",
  geoRestrictions: "geo_restrictions",
  keylessServer: "keyless_server",
  modifiedOn: "modified_on",
  perPage: "per_page",
  policyRestrictions: "policy_restrictions",
  privateIp: "private_ip",
  privateKey: "private_key",
  resultInfo: "result_info",
  totalCount: "total_count",
  uploadedOn: "uploaded_on",
  vnetId: "vnet_id",
  zoneId: "zone_id",
};

export class CustomCertificateNotFound
  extends /*@__PURE__*/ T.applyErrorMatchers(
    /*@__PURE__*/ S.TaggedError<CustomCertificateNotFound>()(
      "CustomCertificateNotFound",
      {
        code: S.Number,
        message: S.String,
      },
    ),
    [
      { status: 404 },
      { code: 1002, message: { includes: "Invalid certificate" } },
    ],
  ) {}

export class Forbidden
  extends /*@__PURE__*/ T.applyErrorMatchers(
    /*@__PURE__*/ S.TaggedError<Forbidden>()("Forbidden", {
      code: S.Number,
      message: S.String,
    }),
    [{ status: 403 }],
  ) {}

export class PlanLevelNotAllowed
  extends /*@__PURE__*/ T.applyErrorMatchers(
    /*@__PURE__*/ S.TaggedError<PlanLevelNotAllowed>()("PlanLevelNotAllowed", {
      code: S.Number,
      message: S.String,
    }),
    [{ code: 1011 }],
  ) {}

export class ZoneNotFound
  extends /*@__PURE__*/ T.applyErrorMatchers(
    /*@__PURE__*/ S.TaggedError<ZoneNotFound>()("ZoneNotFound", {
      code: S.Number,
      message: S.String,
    }),
    [{ status: 400, message: { includes: "Cannot find a valid zone" } }],
  ) {}

export type CreateRequestBundleMethod = "ubiquitous" | "optimal" | "force";
export const CreateRequestBundleMethod = /*@__PURE__*/ S.String;

export type CreateRequestDeploy = "staging" | "production";
export const CreateRequestDeploy = /*@__PURE__*/ S.String;

export type CreateRequestGeoRestrictionsLabel =
  | "us"
  | "eu"
  | "highest_security";
export const CreateRequestGeoRestrictionsLabel = /*@__PURE__*/ S.String;

export interface CreateRequestGeoRestrictions {
  label?: CreateRequestGeoRestrictionsLabel | (string & {});
}
export const CreateRequestGeoRestrictions = /*@__PURE__*/ S.suspend(() =>
  S.Struct({
    label: S.optional(CreateRequestGeoRestrictionsLabel),
  }),
).annotate({
  identifier: "CreateRequestGeoRestrictions",
}) as any as S.Schema<CreateRequestGeoRestrictions>;

export type CreateRequestType = "legacy_custom" | "sni_custom";
export const CreateRequestType = /*@__PURE__*/ S.String;

export interface CreateCustomCertificateRequest {
  /** Identifier. */
  zoneId: string;
  /** The zone's SSL certificate or certificate and the intermediate(s). */
  certificate: string;
  /** A ubiquitous bundle has the highest probability of being verified everywhere, even by clients using outdated or unusual trust stores. An optimal bundle uses the shortest chain and newest intermediates. And the force bundle verifies the chain, but does not otherwise modify it. */
  bundleMethod?: CreateRequestBundleMethod | (string & {});
  /** The identifier for the Custom CSR that was used. */
  customCsrId?: string;
  /** The environment to deploy the certificate to, defaults to production. */
  deploy?: CreateRequestDeploy | (string & {});
  /** Specify the region where your private key can be held locally for optimal TLS performance. HTTPS connections to any excluded data center will still be fully encrypted, but will incur some latency while Keyless SSL is used to complete the handshake with the nearest allowed data center. Options allow distribution to only to U.S. data centers, only to E.U. data centers, or only to highest security data centers. Default distribution is to all Cloudflare datacenters, for optimal performance. */
  geoRestrictions?: CreateRequestGeoRestrictions;
  /** Specify the policy that determines the region where your private key will be held locally. HTTPS connections to any excluded data center will still be fully encrypted, but will incur some latency while Keyless SSL is used to complete the handshake with the nearest allowed data center. Any combination of countries, specified by their two letter country code (https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2#Officially_assigned_code_elements) can be chosen, such as 'country: IN', as well as 'region: EU' which refers to the EU region. If there are too few data centers satisfying the policy, it will be rejected. */
  policy?: string;
  /** The zone's private key. Not required if custom_csr_id is provided, in which case the private key is retrieved from the CSR record held by Cloudflare. */
  privateKey?: string;
  /** The type 'legacy_custom' enables support for legacy clients which do not include SNI in the TLS handshake. */
  type?: CreateRequestType | (string & {});
}
export const CreateCustomCertificateRequest = /*@__PURE__*/ S.suspend(() =>
  S.Struct({
    zoneId: S.String.pipe(T.Label("zone_id")),
    certificate: S.String,
    bundleMethod: S.optional(
      CreateRequestBundleMethod.pipe(T.Body("bundle_method")),
    ),
    customCsrId: S.optional(S.String.pipe(T.Body("custom_csr_id"))),
    deploy: S.optional(CreateRequestDeploy),
    geoRestrictions: S.optional(
      CreateRequestGeoRestrictions.pipe(T.Body("geo_restrictions")),
    ),
    policy: S.optional(S.String),
    privateKey: S.optional(S.String.pipe(T.Body("private_key"))),
    type: S.optional(CreateRequestType),
  })
    .pipe(
      T.Http({
        method: "POST",
        uri: "/zones/{zone_id}/custom_certificates",
        code: 200,
      }),
    )
    .pipe(T.KeyDictionary(KEY_DICTIONARY)),
).annotate({
  identifier: "CreateCustomCertificateRequest",
}) as any as S.Schema<CreateCustomCertificateRequest>;

export type CreateResponseBundleMethod = "ubiquitous" | "optimal" | "force";
export const CreateResponseBundleMethod = /*@__PURE__*/ S.String;

export type CreateResponseGeoRestrictionsLabel =
  | "us"
  | "eu"
  | "highest_security";
export const CreateResponseGeoRestrictionsLabel = /*@__PURE__*/ S.String;

export interface CreateResponseGeoRestrictions {
  label?: CreateResponseGeoRestrictionsLabel | null;
}
export const CreateResponseGeoRestrictions = /*@__PURE__*/ S.suspend(() =>
  S.Struct({
    label: S.optional(S.NullOr(CreateResponseGeoRestrictionsLabel)),
  }),
).annotate({
  identifier: "CreateResponseGeoRestrictions",
}) as any as S.Schema<CreateResponseGeoRestrictions>;

export type CreateResponseHostsList = Array<string>;
export const CreateResponseHostsList = /*@__PURE__*/ S.Array(
  S.String,
) as any as S.Schema<CreateResponseHostsList>;

export type CreateResponseKeylessServerPermissionsList = Array<string>;
export const CreateResponseKeylessServerPermissionsList = /*@__PURE__*/ S.Array(
  S.String,
) as any as S.Schema<CreateResponseKeylessServerPermissionsList>;

export type CreateResponseKeylessServerStatus = "active" | "deleted";
export const CreateResponseKeylessServerStatus = /*@__PURE__*/ S.String;

export interface CreateResponseKeylessServerTunnel {
  /** Private IP of the Key Server Host. */
  privateIp: string;
  /** Cloudflare Tunnel Virtual Network ID. */
  vnetId: string;
}
export const CreateResponseKeylessServerTunnel = /*@__PURE__*/ S.suspend(() =>
  S.Struct({
    privateIp: S.String.pipe(T.Body("private_ip")),
    vnetId: S.String.pipe(T.Body("vnet_id")),
  }),
).annotate({
  identifier: "CreateResponseKeylessServerTunnel",
}) as any as S.Schema<CreateResponseKeylessServerTunnel>;

export interface CreateResponseKeylessServer {
  /** Keyless certificate identifier tag. */
  id: string;
  /** When the Keyless SSL was created. */
  createdOn: string;
  /** Whether or not the Keyless SSL is on or off. */
  enabled: boolean;
  /** The keyless SSL name. */
  host: string;
  /** When the Keyless SSL was last modified. */
  modifiedOn: string;
  /** The keyless SSL name. */
  name: string;
  /** Available permissions for the Keyless SSL for the current user requesting the item. */
  permissions: CreateResponseKeylessServerPermissionsList;
  /** The keyless SSL port used to communicate between Cloudflare and the client's Keyless SSL server. */
  port: number;
  /** Status of the Keyless SSL. */
  status: CreateResponseKeylessServerStatus;
  /** Configuration for using Keyless SSL through a Cloudflare Tunnel. */
  tunnel?: CreateResponseKeylessServerTunnel | null;
}
export const CreateResponseKeylessServer = /*@__PURE__*/ S.suspend(() =>
  S.Struct({
    id: S.String,
    createdOn: S.String.pipe(T.Body("created_on")),
    enabled: S.Boolean,
    host: S.String,
    modifiedOn: S.String.pipe(T.Body("modified_on")),
    name: S.String,
    permissions: CreateResponseKeylessServerPermissionsList,
    port: S.Number,
    status: CreateResponseKeylessServerStatus,
    tunnel: S.optional(S.NullOr(CreateResponseKeylessServerTunnel)),
  }),
).annotate({
  identifier: "CreateResponseKeylessServer",
}) as any as S.Schema<CreateResponseKeylessServer>;

export type CreateResponseStatus =
  | "active"
  | "expired"
  | "deleted"
  | "pending"
  | "initializing";
export const CreateResponseStatus = /*@__PURE__*/ S.String;

/** Unwrapped `result` payload of the Cloudflare v4 response envelope. */
export interface CreateCustomCertificateResponse {
  /** Identifier. */
  id: string;
  /** Identifier. */
  zoneId: string;
  /** A ubiquitous bundle has the highest probability of being verified everywhere, even by clients using outdated or unusual trust stores. An optimal bundle uses the shortest chain and newest intermediates. And the force bundle verifies the chain, but does not otherwise modify it. */
  bundleMethod?: CreateResponseBundleMethod | null;
  /** The identifier for the Custom CSR that was used. */
  customCsrId?: string | null;
  /** When the certificate from the authority expires. */
  expiresOn?: string | null;
  /** Specify the region where your private key can be held locally for optimal TLS performance. HTTPS connections to any excluded data center will still be fully encrypted, but will incur some latency while Keyless SSL is used to complete the handshake with the nearest allowed data center. Options allow distribution to only to U.S. data centers, only to E.U. data centers, or only to highest security data centers. Default distribution is to all Cloudflare datacenters, for optimal performance. */
  geoRestrictions?: CreateResponseGeoRestrictions | null;
  hosts?: CreateResponseHostsList | null;
  /** The certificate authority that issued the certificate. */
  issuer?: string | null;
  keylessServer?: CreateResponseKeylessServer | null;
  /** When the certificate was last modified. */
  modifiedOn?: string | null;
  /** The policy restrictions returned by the API. This field is returned in responses */
  policyRestrictions?: string | null;
  /** The order/priority in which the certificate will be used in a request. The higher priority will break ties across overlapping 'legacy_custom' certificates, but 'legacy_custom' certificates will always supercede 'sni_custom' certificates. */
  priority?: number | null;
  /** The type of hash used for the certificate. */
  signature?: string | null;
  /** Status of the zone's custom SSL. */
  status?: CreateResponseStatus | null;
  /** When the certificate was uploaded to Cloudflare. */
  uploadedOn?: string | null;
}
export const CreateCustomCertificateResponse = /*@__PURE__*/ S.suspend(() =>
  S.Struct({
    id: S.String,
    zoneId: S.String.pipe(T.Body("zone_id")),
    bundleMethod: S.optional(
      S.NullOr(CreateResponseBundleMethod).pipe(T.Body("bundle_method")),
    ),
    customCsrId: S.optional(S.NullOr(S.String).pipe(T.Body("custom_csr_id"))),
    expiresOn: S.optional(S.NullOr(S.String).pipe(T.Body("expires_on"))),
    geoRestrictions: S.optional(
      S.NullOr(CreateResponseGeoRestrictions).pipe(T.Body("geo_restrictions")),
    ),
    hosts: S.optional(S.NullOr(CreateResponseHostsList)),
    issuer: S.optional(S.NullOr(S.String)),
    keylessServer: S.optional(
      S.NullOr(CreateResponseKeylessServer).pipe(T.Body("keyless_server")),
    ),
    modifiedOn: S.optional(S.NullOr(S.String).pipe(T.Body("modified_on"))),
    policyRestrictions: S.optional(
      S.NullOr(S.String).pipe(T.Body("policy_restrictions")),
    ),
    priority: S.optional(S.NullOr(S.Number)),
    signature: S.optional(S.NullOr(S.String)),
    status: S.optional(S.NullOr(CreateResponseStatus)),
    uploadedOn: S.optional(S.NullOr(S.String).pipe(T.Body("uploaded_on"))),
  }).pipe(T.KeyDictionary(KEY_DICTIONARY)),
).annotate({
  identifier: "CreateCustomCertificateResponse",
}) as any as S.Schema<CreateCustomCertificateResponse>;

export interface DeleteCustomCertificateRequest {
  /** Identifier. */
  zoneId: string;
  /** Identifier. */
  customCertificateId: string;
}
export const DeleteCustomCertificateRequest = /*@__PURE__*/ S.suspend(() =>
  S.Struct({
    zoneId: S.String.pipe(T.Label("zone_id")),
    customCertificateId: S.String.pipe(T.Label("custom_certificate_id")),
  })
    .pipe(
      T.Http({
        method: "DELETE",
        uri: "/zones/{zone_id}/custom_certificates/{custom_certificate_id}",
        code: 200,
      }),
    )
    .pipe(T.KeyDictionary(KEY_DICTIONARY)),
).annotate({
  identifier: "DeleteCustomCertificateRequest",
}) as any as S.Schema<DeleteCustomCertificateRequest>;

/** Unwrapped `result` payload of the Cloudflare v4 response envelope. */
export interface DeleteCustomCertificateResponse {
  /** Identifier. */
  id?: string | null;
}
export const DeleteCustomCertificateResponse = /*@__PURE__*/ S.suspend(() =>
  S.Struct({
    id: S.optional(S.NullOr(S.String)),
  }).pipe(T.KeyDictionary(KEY_DICTIONARY)),
).annotate({
  identifier: "DeleteCustomCertificateResponse",
}) as any as S.Schema<DeleteCustomCertificateResponse>;

export interface GetCustomCertificateRequest {
  /** Identifier. */
  zoneId: string;
  /** Identifier. */
  customCertificateId: string;
}
export const GetCustomCertificateRequest = /*@__PURE__*/ S.suspend(() =>
  S.Struct({
    zoneId: S.String.pipe(T.Label("zone_id")),
    customCertificateId: S.String.pipe(T.Label("custom_certificate_id")),
  })
    .pipe(
      T.Http({
        method: "GET",
        uri: "/zones/{zone_id}/custom_certificates/{custom_certificate_id}",
        code: 200,
      }),
    )
    .pipe(T.KeyDictionary(KEY_DICTIONARY)),
).annotate({
  identifier: "GetCustomCertificateRequest",
}) as any as S.Schema<GetCustomCertificateRequest>;

export type GetResponseBundleMethod = "ubiquitous" | "optimal" | "force";
export const GetResponseBundleMethod = /*@__PURE__*/ S.String;

export type GetResponseGeoRestrictionsLabel = "us" | "eu" | "highest_security";
export const GetResponseGeoRestrictionsLabel = /*@__PURE__*/ S.String;

export interface GetResponseGeoRestrictions {
  label?: GetResponseGeoRestrictionsLabel | null;
}
export const GetResponseGeoRestrictions = /*@__PURE__*/ S.suspend(() =>
  S.Struct({
    label: S.optional(S.NullOr(GetResponseGeoRestrictionsLabel)),
  }),
).annotate({
  identifier: "GetResponseGeoRestrictions",
}) as any as S.Schema<GetResponseGeoRestrictions>;

export type GetResponseHostsList = Array<string>;
export const GetResponseHostsList = /*@__PURE__*/ S.Array(
  S.String,
) as any as S.Schema<GetResponseHostsList>;

export type GetResponseKeylessServerPermissionsList = Array<string>;
export const GetResponseKeylessServerPermissionsList = /*@__PURE__*/ S.Array(
  S.String,
) as any as S.Schema<GetResponseKeylessServerPermissionsList>;

export type GetResponseKeylessServerStatus = "active" | "deleted";
export const GetResponseKeylessServerStatus = /*@__PURE__*/ S.String;

export type GetResponseKeylessServerTunnel = CreateResponseKeylessServerTunnel;
export const GetResponseKeylessServerTunnel = CreateResponseKeylessServerTunnel;

export interface GetResponseKeylessServer {
  /** Keyless certificate identifier tag. */
  id: string;
  /** When the Keyless SSL was created. */
  createdOn: string;
  /** Whether or not the Keyless SSL is on or off. */
  enabled: boolean;
  /** The keyless SSL name. */
  host: string;
  /** When the Keyless SSL was last modified. */
  modifiedOn: string;
  /** The keyless SSL name. */
  name: string;
  /** Available permissions for the Keyless SSL for the current user requesting the item. */
  permissions: GetResponseKeylessServerPermissionsList;
  /** The keyless SSL port used to communicate between Cloudflare and the client's Keyless SSL server. */
  port: number;
  /** Status of the Keyless SSL. */
  status: GetResponseKeylessServerStatus;
  /** Configuration for using Keyless SSL through a Cloudflare Tunnel. */
  tunnel?: CreateResponseKeylessServerTunnel | null;
}
export const GetResponseKeylessServer = /*@__PURE__*/ S.suspend(() =>
  S.Struct({
    id: S.String,
    createdOn: S.String.pipe(T.Body("created_on")),
    enabled: S.Boolean,
    host: S.String,
    modifiedOn: S.String.pipe(T.Body("modified_on")),
    name: S.String,
    permissions: GetResponseKeylessServerPermissionsList,
    port: S.Number,
    status: GetResponseKeylessServerStatus,
    tunnel: S.optional(S.NullOr(CreateResponseKeylessServerTunnel)),
  }),
).annotate({
  identifier: "GetResponseKeylessServer",
}) as any as S.Schema<GetResponseKeylessServer>;

export type GetResponseStatus =
  | "active"
  | "expired"
  | "deleted"
  | "pending"
  | "initializing";
export const GetResponseStatus = /*@__PURE__*/ S.String;

/** Unwrapped `result` payload of the Cloudflare v4 response envelope. */
export interface GetCustomCertificateResponse {
  /** Identifier. */
  id: string;
  /** Identifier. */
  zoneId: string;
  /** A ubiquitous bundle has the highest probability of being verified everywhere, even by clients using outdated or unusual trust stores. An optimal bundle uses the shortest chain and newest intermediates. And the force bundle verifies the chain, but does not otherwise modify it. */
  bundleMethod?: GetResponseBundleMethod | null;
  /** The identifier for the Custom CSR that was used. */
  customCsrId?: string | null;
  /** When the certificate from the authority expires. */
  expiresOn?: string | null;
  /** Specify the region where your private key can be held locally for optimal TLS performance. HTTPS connections to any excluded data center will still be fully encrypted, but will incur some latency while Keyless SSL is used to complete the handshake with the nearest allowed data center. Options allow distribution to only to U.S. data centers, only to E.U. data centers, or only to highest security data centers. Default distribution is to all Cloudflare datacenters, for optimal performance. */
  geoRestrictions?: GetResponseGeoRestrictions | null;
  hosts?: GetResponseHostsList | null;
  /** The certificate authority that issued the certificate. */
  issuer?: string | null;
  keylessServer?: GetResponseKeylessServer | null;
  /** When the certificate was last modified. */
  modifiedOn?: string | null;
  /** The policy restrictions returned by the API. This field is returned in responses */
  policyRestrictions?: string | null;
  /** The order/priority in which the certificate will be used in a request. The higher priority will break ties across overlapping 'legacy_custom' certificates, but 'legacy_custom' certificates will always supercede 'sni_custom' certificates. */
  priority?: number | null;
  /** The type of hash used for the certificate. */
  signature?: string | null;
  /** Status of the zone's custom SSL. */
  status?: GetResponseStatus | null;
  /** When the certificate was uploaded to Cloudflare. */
  uploadedOn?: string | null;
}
export const GetCustomCertificateResponse = /*@__PURE__*/ S.suspend(() =>
  S.Struct({
    id: S.String,
    zoneId: S.String.pipe(T.Body("zone_id")),
    bundleMethod: S.optional(
      S.NullOr(GetResponseBundleMethod).pipe(T.Body("bundle_method")),
    ),
    customCsrId: S.optional(S.NullOr(S.String).pipe(T.Body("custom_csr_id"))),
    expiresOn: S.optional(S.NullOr(S.String).pipe(T.Body("expires_on"))),
    geoRestrictions: S.optional(
      S.NullOr(GetResponseGeoRestrictions).pipe(T.Body("geo_restrictions")),
    ),
    hosts: S.optional(S.NullOr(GetResponseHostsList)),
    issuer: S.optional(S.NullOr(S.String)),
    keylessServer: S.optional(
      S.NullOr(GetResponseKeylessServer).pipe(T.Body("keyless_server")),
    ),
    modifiedOn: S.optional(S.NullOr(S.String).pipe(T.Body("modified_on"))),
    policyRestrictions: S.optional(
      S.NullOr(S.String).pipe(T.Body("policy_restrictions")),
    ),
    priority: S.optional(S.NullOr(S.Number)),
    signature: S.optional(S.NullOr(S.String)),
    status: S.optional(S.NullOr(GetResponseStatus)),
    uploadedOn: S.optional(S.NullOr(S.String).pipe(T.Body("uploaded_on"))),
  }).pipe(T.KeyDictionary(KEY_DICTIONARY)),
).annotate({
  identifier: "GetCustomCertificateResponse",
}) as any as S.Schema<GetCustomCertificateResponse>;

export type ListRequestMatch = "any" | "all";
export const ListRequestMatch = /*@__PURE__*/ S.String;

export type ListRequestStatus =
  | "active"
  | "expired"
  | "deleted"
  | "pending"
  | "initializing";
export const ListRequestStatus = /*@__PURE__*/ S.String;

export interface ListCustomCertificatesRequest {
  /** Identifier. */
  zoneId: string;
  /** Whether to match all search requirements or at least one (any). */
  match?: ListRequestMatch | (string & {});
  /** Page number of paginated results. */
  page?: number;
  /** Number of zones per page. */
  perPage?: number;
  /** Status of the zone's custom SSL. */
  status?: ListRequestStatus | (string & {});
}
export const ListCustomCertificatesRequest = /*@__PURE__*/ S.suspend(() =>
  S.Struct({
    zoneId: S.String.pipe(T.Label("zone_id")),
    match: S.optional(ListRequestMatch.pipe(T.Query())),
    page: S.optional(S.Number.pipe(T.Query())),
    perPage: S.optional(S.Number.pipe(T.Query("per_page"))),
    status: S.optional(ListRequestStatus.pipe(T.Query())),
  })
    .pipe(
      T.Http({
        method: "GET",
        uri: "/zones/{zone_id}/custom_certificates",
        code: 200,
      }),
    )
    .pipe(T.KeyDictionary(KEY_DICTIONARY)),
).annotate({
  identifier: "ListCustomCertificatesRequest",
}) as any as S.Schema<ListCustomCertificatesRequest>;

export type ListResultItemBundleMethod = "ubiquitous" | "optimal" | "force";
export const ListResultItemBundleMethod = /*@__PURE__*/ S.String;

export type ListResultItemGeoRestrictionsLabel =
  | "us"
  | "eu"
  | "highest_security";
export const ListResultItemGeoRestrictionsLabel = /*@__PURE__*/ S.String;

export interface ListResultItemGeoRestrictions {
  label?: ListResultItemGeoRestrictionsLabel | null;
}
export const ListResultItemGeoRestrictions = /*@__PURE__*/ S.suspend(() =>
  S.Struct({
    label: S.optional(S.NullOr(ListResultItemGeoRestrictionsLabel)),
  }),
).annotate({
  identifier: "ListResultItemGeoRestrictions",
}) as any as S.Schema<ListResultItemGeoRestrictions>;

export type ListResultItemHostsList = Array<string>;
export const ListResultItemHostsList = /*@__PURE__*/ S.Array(
  S.String,
) as any as S.Schema<ListResultItemHostsList>;

export type ListResultItemKeylessServerPermissionsList = Array<string>;
export const ListResultItemKeylessServerPermissionsList = /*@__PURE__*/ S.Array(
  S.String,
) as any as S.Schema<ListResultItemKeylessServerPermissionsList>;

export type ListResultItemKeylessServerStatus = "active" | "deleted";
export const ListResultItemKeylessServerStatus = /*@__PURE__*/ S.String;

export type ListResultItemKeylessServerTunnel =
  CreateResponseKeylessServerTunnel;
export const ListResultItemKeylessServerTunnel =
  CreateResponseKeylessServerTunnel;

export interface ListResultItemKeylessServer {
  /** Keyless certificate identifier tag. */
  id: string;
  /** When the Keyless SSL was created. */
  createdOn: string;
  /** Whether or not the Keyless SSL is on or off. */
  enabled: boolean;
  /** The keyless SSL name. */
  host: string;
  /** When the Keyless SSL was last modified. */
  modifiedOn: string;
  /** The keyless SSL name. */
  name: string;
  /** Available permissions for the Keyless SSL for the current user requesting the item. */
  permissions: ListResultItemKeylessServerPermissionsList;
  /** The keyless SSL port used to communicate between Cloudflare and the client's Keyless SSL server. */
  port: number;
  /** Status of the Keyless SSL. */
  status: ListResultItemKeylessServerStatus;
  /** Configuration for using Keyless SSL through a Cloudflare Tunnel. */
  tunnel?: CreateResponseKeylessServerTunnel | null;
}
export const ListResultItemKeylessServer = /*@__PURE__*/ S.suspend(() =>
  S.Struct({
    id: S.String,
    createdOn: S.String.pipe(T.Body("created_on")),
    enabled: S.Boolean,
    host: S.String,
    modifiedOn: S.String.pipe(T.Body("modified_on")),
    name: S.String,
    permissions: ListResultItemKeylessServerPermissionsList,
    port: S.Number,
    status: ListResultItemKeylessServerStatus,
    tunnel: S.optional(S.NullOr(CreateResponseKeylessServerTunnel)),
  }),
).annotate({
  identifier: "ListResultItemKeylessServer",
}) as any as S.Schema<ListResultItemKeylessServer>;

export type ListResultItemStatus =
  | "active"
  | "expired"
  | "deleted"
  | "pending"
  | "initializing";
export const ListResultItemStatus = /*@__PURE__*/ S.String;

export interface ListResultItem {
  /** Identifier. */
  id: string;
  /** Identifier. */
  zoneId: string;
  /** A ubiquitous bundle has the highest probability of being verified everywhere, even by clients using outdated or unusual trust stores. An optimal bundle uses the shortest chain and newest intermediates. And the force bundle verifies the chain, but does not otherwise modify it. */
  bundleMethod?: ListResultItemBundleMethod | null;
  /** The identifier for the Custom CSR that was used. */
  customCsrId?: string | null;
  /** When the certificate from the authority expires. */
  expiresOn?: string | null;
  /** Specify the region where your private key can be held locally for optimal TLS performance. HTTPS connections to any excluded data center will still be fully encrypted, but will incur some latency while Keyless SSL is used to complete the handshake with the nearest allowed data center. Options allow distribution to only to U.S. data centers, only to E.U. data centers, or only to highest security data centers. Default distribution is to all Cloudflare datacenters, for optimal performance. */
  geoRestrictions?: ListResultItemGeoRestrictions | null;
  hosts?: ListResultItemHostsList | null;
  /** The certificate authority that issued the certificate. */
  issuer?: string | null;
  keylessServer?: ListResultItemKeylessServer | null;
  /** When the certificate was last modified. */
  modifiedOn?: string | null;
  /** The policy restrictions returned by the API. This field is returned in responses */
  policyRestrictions?: string | null;
  /** The order/priority in which the certificate will be used in a request. The higher priority will break ties across overlapping 'legacy_custom' certificates, but 'legacy_custom' certificates will always supercede 'sni_custom' certificates. */
  priority?: number | null;
  /** The type of hash used for the certificate. */
  signature?: string | null;
  /** Status of the zone's custom SSL. */
  status?: ListResultItemStatus | null;
  /** When the certificate was uploaded to Cloudflare. */
  uploadedOn?: string | null;
}
export const ListResultItem = /*@__PURE__*/ S.suspend(() =>
  S.Struct({
    id: S.String,
    zoneId: S.String.pipe(T.Body("zone_id")),
    bundleMethod: S.optional(
      S.NullOr(ListResultItemBundleMethod).pipe(T.Body("bundle_method")),
    ),
    customCsrId: S.optional(S.NullOr(S.String).pipe(T.Body("custom_csr_id"))),
    expiresOn: S.optional(S.NullOr(S.String).pipe(T.Body("expires_on"))),
    geoRestrictions: S.optional(
      S.NullOr(ListResultItemGeoRestrictions).pipe(T.Body("geo_restrictions")),
    ),
    hosts: S.optional(S.NullOr(ListResultItemHostsList)),
    issuer: S.optional(S.NullOr(S.String)),
    keylessServer: S.optional(
      S.NullOr(ListResultItemKeylessServer).pipe(T.Body("keyless_server")),
    ),
    modifiedOn: S.optional(S.NullOr(S.String).pipe(T.Body("modified_on"))),
    policyRestrictions: S.optional(
      S.NullOr(S.String).pipe(T.Body("policy_restrictions")),
    ),
    priority: S.optional(S.NullOr(S.Number)),
    signature: S.optional(S.NullOr(S.String)),
    status: S.optional(S.NullOr(ListResultItemStatus)),
    uploadedOn: S.optional(S.NullOr(S.String).pipe(T.Body("uploaded_on"))),
  }),
).annotate({ identifier: "ListResultItem" }) as any as S.Schema<ListResultItem>;

export type ListResultList = Array<ListResultItem>;
export const ListResultList = /*@__PURE__*/ S.Array(
  ListResultItem,
) as any as S.Schema<ListResultList>;

export interface ListCustomCertificatesResponse {
  /** The unwrapped `result` payload of the v4 response envelope. */
  result: ListResultList;
  /** Pagination info from the envelope's `result_info`. */
  resultInfo?: ResultInfo | null;
}
export const ListCustomCertificatesResponse = /*@__PURE__*/ S.suspend(() =>
  S.Struct({
    result: ListResultList.pipe(T.EnvelopePayload()),
    resultInfo: S.optional(S.NullOr(ResultInfo).pipe(T.ResultInfo())),
  }).pipe(T.KeyDictionary(KEY_DICTIONARY)),
).annotate({
  identifier: "ListCustomCertificatesResponse",
}) as any as S.Schema<ListCustomCertificatesResponse>;

export type EditRequestBundleMethod = "ubiquitous" | "optimal" | "force";
export const EditRequestBundleMethod = /*@__PURE__*/ S.String;

export type EditRequestDeploy = "staging" | "production";
export const EditRequestDeploy = /*@__PURE__*/ S.String;

export type EditRequestGeoRestrictionsLabel = "us" | "eu" | "highest_security";
export const EditRequestGeoRestrictionsLabel = /*@__PURE__*/ S.String;

export interface EditRequestGeoRestrictions {
  label?: EditRequestGeoRestrictionsLabel | (string & {});
}
export const EditRequestGeoRestrictions = /*@__PURE__*/ S.suspend(() =>
  S.Struct({
    label: S.optional(EditRequestGeoRestrictionsLabel),
  }),
).annotate({
  identifier: "EditRequestGeoRestrictions",
}) as any as S.Schema<EditRequestGeoRestrictions>;

export interface PatchCustomCertificateRequest {
  /** Identifier. */
  zoneId: string;
  /** Identifier. */
  customCertificateId: string;
  /** A ubiquitous bundle has the highest probability of being verified everywhere, even by clients using outdated or unusual trust stores. An optimal bundle uses the shortest chain and newest intermediates. And the force bundle verifies the chain, but does not otherwise modify it. */
  bundleMethod?: EditRequestBundleMethod | (string & {});
  /** The zone's SSL certificate or certificate and the intermediate(s). */
  certificate?: string;
  /** The identifier for the Custom CSR that was used. */
  customCsrId?: string;
  /** The environment to deploy the certificate to, defaults to production. */
  deploy?: EditRequestDeploy | (string & {});
  /** Specify the region where your private key can be held locally for optimal TLS performance. HTTPS connections to any excluded data center will still be fully encrypted, but will incur some latency while Keyless SSL is used to complete the handshake with the nearest allowed data center. Options allow distribution to only to U.S. data centers, only to E.U. data centers, or only to highest security data centers. Default distribution is to all Cloudflare datacenters, for optimal performance. */
  geoRestrictions?: EditRequestGeoRestrictions;
  /** Specify the policy that determines the region where your private key will be held locally. HTTPS connections to any excluded data center will still be fully encrypted, but will incur some latency while Keyless SSL is used to complete the handshake with the nearest allowed data center. Any combination of countries, specified by their two letter country code (https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2#Officially_assigned_code_elements) can be chosen, such as 'country: IN', as well as 'region: EU' which refers to the EU region. If there are too few data centers satisfying the policy, it will be rejected. */
  policy?: string;
  /** The zone's private key. Not required if custom_csr_id is provided, in which case the private key is retrieved from the CSR record held by Cloudflare. */
  privateKey?: string;
}
export const PatchCustomCertificateRequest = /*@__PURE__*/ S.suspend(() =>
  S.Struct({
    zoneId: S.String.pipe(T.Label("zone_id")),
    customCertificateId: S.String.pipe(T.Label("custom_certificate_id")),
    bundleMethod: S.optional(
      EditRequestBundleMethod.pipe(T.Body("bundle_method")),
    ),
    certificate: S.optional(S.String),
    customCsrId: S.optional(S.String.pipe(T.Body("custom_csr_id"))),
    deploy: S.optional(EditRequestDeploy),
    geoRestrictions: S.optional(
      EditRequestGeoRestrictions.pipe(T.Body("geo_restrictions")),
    ),
    policy: S.optional(S.String),
    privateKey: S.optional(S.String.pipe(T.Body("private_key"))),
  })
    .pipe(
      T.Http({
        method: "PATCH",
        uri: "/zones/{zone_id}/custom_certificates/{custom_certificate_id}",
        code: 200,
      }),
    )
    .pipe(T.KeyDictionary(KEY_DICTIONARY)),
).annotate({
  identifier: "PatchCustomCertificateRequest",
}) as any as S.Schema<PatchCustomCertificateRequest>;

export type EditResponseBundleMethod = "ubiquitous" | "optimal" | "force";
export const EditResponseBundleMethod = /*@__PURE__*/ S.String;

export type EditResponseGeoRestrictionsLabel = "us" | "eu" | "highest_security";
export const EditResponseGeoRestrictionsLabel = /*@__PURE__*/ S.String;

export interface EditResponseGeoRestrictions {
  label?: EditResponseGeoRestrictionsLabel | null;
}
export const EditResponseGeoRestrictions = /*@__PURE__*/ S.suspend(() =>
  S.Struct({
    label: S.optional(S.NullOr(EditResponseGeoRestrictionsLabel)),
  }),
).annotate({
  identifier: "EditResponseGeoRestrictions",
}) as any as S.Schema<EditResponseGeoRestrictions>;

export type EditResponseHostsList = Array<string>;
export const EditResponseHostsList = /*@__PURE__*/ S.Array(
  S.String,
) as any as S.Schema<EditResponseHostsList>;

export type EditResponseKeylessServerPermissionsList = Array<string>;
export const EditResponseKeylessServerPermissionsList = /*@__PURE__*/ S.Array(
  S.String,
) as any as S.Schema<EditResponseKeylessServerPermissionsList>;

export type EditResponseKeylessServerStatus = "active" | "deleted";
export const EditResponseKeylessServerStatus = /*@__PURE__*/ S.String;

export type EditResponseKeylessServerTunnel = CreateResponseKeylessServerTunnel;
export const EditResponseKeylessServerTunnel =
  CreateResponseKeylessServerTunnel;

export interface EditResponseKeylessServer {
  /** Keyless certificate identifier tag. */
  id: string;
  /** When the Keyless SSL was created. */
  createdOn: string;
  /** Whether or not the Keyless SSL is on or off. */
  enabled: boolean;
  /** The keyless SSL name. */
  host: string;
  /** When the Keyless SSL was last modified. */
  modifiedOn: string;
  /** The keyless SSL name. */
  name: string;
  /** Available permissions for the Keyless SSL for the current user requesting the item. */
  permissions: EditResponseKeylessServerPermissionsList;
  /** The keyless SSL port used to communicate between Cloudflare and the client's Keyless SSL server. */
  port: number;
  /** Status of the Keyless SSL. */
  status: EditResponseKeylessServerStatus;
  /** Configuration for using Keyless SSL through a Cloudflare Tunnel. */
  tunnel?: CreateResponseKeylessServerTunnel | null;
}
export const EditResponseKeylessServer = /*@__PURE__*/ S.suspend(() =>
  S.Struct({
    id: S.String,
    createdOn: S.String.pipe(T.Body("created_on")),
    enabled: S.Boolean,
    host: S.String,
    modifiedOn: S.String.pipe(T.Body("modified_on")),
    name: S.String,
    permissions: EditResponseKeylessServerPermissionsList,
    port: S.Number,
    status: EditResponseKeylessServerStatus,
    tunnel: S.optional(S.NullOr(CreateResponseKeylessServerTunnel)),
  }),
).annotate({
  identifier: "EditResponseKeylessServer",
}) as any as S.Schema<EditResponseKeylessServer>;

export type EditResponseStatus =
  | "active"
  | "expired"
  | "deleted"
  | "pending"
  | "initializing";
export const EditResponseStatus = /*@__PURE__*/ S.String;

/** Unwrapped `result` payload of the Cloudflare v4 response envelope. */
export interface PatchCustomCertificateResponse {
  /** Identifier. */
  id: string;
  /** Identifier. */
  zoneId: string;
  /** A ubiquitous bundle has the highest probability of being verified everywhere, even by clients using outdated or unusual trust stores. An optimal bundle uses the shortest chain and newest intermediates. And the force bundle verifies the chain, but does not otherwise modify it. */
  bundleMethod?: EditResponseBundleMethod | null;
  /** The identifier for the Custom CSR that was used. */
  customCsrId?: string | null;
  /** When the certificate from the authority expires. */
  expiresOn?: string | null;
  /** Specify the region where your private key can be held locally for optimal TLS performance. HTTPS connections to any excluded data center will still be fully encrypted, but will incur some latency while Keyless SSL is used to complete the handshake with the nearest allowed data center. Options allow distribution to only to U.S. data centers, only to E.U. data centers, or only to highest security data centers. Default distribution is to all Cloudflare datacenters, for optimal performance. */
  geoRestrictions?: EditResponseGeoRestrictions | null;
  hosts?: EditResponseHostsList | null;
  /** The certificate authority that issued the certificate. */
  issuer?: string | null;
  keylessServer?: EditResponseKeylessServer | null;
  /** When the certificate was last modified. */
  modifiedOn?: string | null;
  /** The policy restrictions returned by the API. This field is returned in responses */
  policyRestrictions?: string | null;
  /** The order/priority in which the certificate will be used in a request. The higher priority will break ties across overlapping 'legacy_custom' certificates, but 'legacy_custom' certificates will always supercede 'sni_custom' certificates. */
  priority?: number | null;
  /** The type of hash used for the certificate. */
  signature?: string | null;
  /** Status of the zone's custom SSL. */
  status?: EditResponseStatus | null;
  /** When the certificate was uploaded to Cloudflare. */
  uploadedOn?: string | null;
}
export const PatchCustomCertificateResponse = /*@__PURE__*/ S.suspend(() =>
  S.Struct({
    id: S.String,
    zoneId: S.String.pipe(T.Body("zone_id")),
    bundleMethod: S.optional(
      S.NullOr(EditResponseBundleMethod).pipe(T.Body("bundle_method")),
    ),
    customCsrId: S.optional(S.NullOr(S.String).pipe(T.Body("custom_csr_id"))),
    expiresOn: S.optional(S.NullOr(S.String).pipe(T.Body("expires_on"))),
    geoRestrictions: S.optional(
      S.NullOr(EditResponseGeoRestrictions).pipe(T.Body("geo_restrictions")),
    ),
    hosts: S.optional(S.NullOr(EditResponseHostsList)),
    issuer: S.optional(S.NullOr(S.String)),
    keylessServer: S.optional(
      S.NullOr(EditResponseKeylessServer).pipe(T.Body("keyless_server")),
    ),
    modifiedOn: S.optional(S.NullOr(S.String).pipe(T.Body("modified_on"))),
    policyRestrictions: S.optional(
      S.NullOr(S.String).pipe(T.Body("policy_restrictions")),
    ),
    priority: S.optional(S.NullOr(S.Number)),
    signature: S.optional(S.NullOr(S.String)),
    status: S.optional(S.NullOr(EditResponseStatus)),
    uploadedOn: S.optional(S.NullOr(S.String).pipe(T.Body("uploaded_on"))),
  }).pipe(T.KeyDictionary(KEY_DICTIONARY)),
).annotate({
  identifier: "PatchCustomCertificateResponse",
}) as any as S.Schema<PatchCustomCertificateResponse>;

export interface PrioritizeUpdateRequestCertificatesItem {
  /** Identifier. */
  id?: string;
  /** The order/priority in which the certificate will be used in a request. The higher priority will break ties across overlapping 'legacy_custom' certificates, but 'legacy_custom' certificates will always supercede 'sni_custom' certificates. */
  priority?: number;
}
export const PrioritizeUpdateRequestCertificatesItem = /*@__PURE__*/ S.suspend(
  () =>
    S.Struct({
      id: S.optional(S.String),
      priority: S.optional(S.Number),
    }),
).annotate({
  identifier: "PrioritizeUpdateRequestCertificatesItem",
}) as any as S.Schema<PrioritizeUpdateRequestCertificatesItem>;

export type PrioritizeUpdateRequestCertificatesList =
  Array<PrioritizeUpdateRequestCertificatesItem>;
export const PrioritizeUpdateRequestCertificatesList = /*@__PURE__*/ S.Array(
  PrioritizeUpdateRequestCertificatesItem,
) as any as S.Schema<PrioritizeUpdateRequestCertificatesList>;

export interface PutPrioritizeRequest {
  /** Identifier. */
  zoneId: string;
  /** Array of ordered certificates. */
  certificates: PrioritizeUpdateRequestCertificatesList;
}
export const PutPrioritizeRequest = /*@__PURE__*/ S.suspend(() =>
  S.Struct({
    zoneId: S.String.pipe(T.Label("zone_id")),
    certificates: PrioritizeUpdateRequestCertificatesList,
  })
    .pipe(
      T.Http({
        method: "PUT",
        uri: "/zones/{zone_id}/custom_certificates/prioritize",
        code: 200,
      }),
    )
    .pipe(T.KeyDictionary(KEY_DICTIONARY)),
).annotate({
  identifier: "PutPrioritizeRequest",
}) as any as S.Schema<PutPrioritizeRequest>;

export type PrioritizeUpdateResultItemBundleMethod =
  | "ubiquitous"
  | "optimal"
  | "force";
export const PrioritizeUpdateResultItemBundleMethod = /*@__PURE__*/ S.String;

export type PrioritizeUpdateResultItemGeoRestrictionsLabel =
  | "us"
  | "eu"
  | "highest_security";
export const PrioritizeUpdateResultItemGeoRestrictionsLabel =
  /*@__PURE__*/ S.String;

export interface PrioritizeUpdateResultItemGeoRestrictions {
  label?: PrioritizeUpdateResultItemGeoRestrictionsLabel | null;
}
export const PrioritizeUpdateResultItemGeoRestrictions =
  /*@__PURE__*/ S.suspend(() =>
    S.Struct({
      label: S.optional(
        S.NullOr(PrioritizeUpdateResultItemGeoRestrictionsLabel),
      ),
    }),
  ).annotate({
    identifier: "PrioritizeUpdateResultItemGeoRestrictions",
  }) as any as S.Schema<PrioritizeUpdateResultItemGeoRestrictions>;

export type PrioritizeUpdateResultItemHostsList = Array<string>;
export const PrioritizeUpdateResultItemHostsList = /*@__PURE__*/ S.Array(
  S.String,
) as any as S.Schema<PrioritizeUpdateResultItemHostsList>;

export type PrioritizeUpdateResultItemKeylessServerPermissionsList =
  Array<string>;
export const PrioritizeUpdateResultItemKeylessServerPermissionsList =
  /*@__PURE__*/ S.Array(
    S.String,
  ) as any as S.Schema<PrioritizeUpdateResultItemKeylessServerPermissionsList>;

export type PrioritizeUpdateResultItemKeylessServerStatus =
  | "active"
  | "deleted";
export const PrioritizeUpdateResultItemKeylessServerStatus =
  /*@__PURE__*/ S.String;

export type PrioritizeUpdateResultItemKeylessServerTunnel =
  CreateResponseKeylessServerTunnel;
export const PrioritizeUpdateResultItemKeylessServerTunnel =
  CreateResponseKeylessServerTunnel;

export interface PrioritizeUpdateResultItemKeylessServer {
  /** Keyless certificate identifier tag. */
  id: string;
  /** When the Keyless SSL was created. */
  createdOn: string;
  /** Whether or not the Keyless SSL is on or off. */
  enabled: boolean;
  /** The keyless SSL name. */
  host: string;
  /** When the Keyless SSL was last modified. */
  modifiedOn: string;
  /** The keyless SSL name. */
  name: string;
  /** Available permissions for the Keyless SSL for the current user requesting the item. */
  permissions: PrioritizeUpdateResultItemKeylessServerPermissionsList;
  /** The keyless SSL port used to communicate between Cloudflare and the client's Keyless SSL server. */
  port: number;
  /** Status of the Keyless SSL. */
  status: PrioritizeUpdateResultItemKeylessServerStatus;
  /** Configuration for using Keyless SSL through a Cloudflare Tunnel. */
  tunnel?: CreateResponseKeylessServerTunnel | null;
}
export const PrioritizeUpdateResultItemKeylessServer = /*@__PURE__*/ S.suspend(
  () =>
    S.Struct({
      id: S.String,
      createdOn: S.String.pipe(T.Body("created_on")),
      enabled: S.Boolean,
      host: S.String,
      modifiedOn: S.String.pipe(T.Body("modified_on")),
      name: S.String,
      permissions: PrioritizeUpdateResultItemKeylessServerPermissionsList,
      port: S.Number,
      status: PrioritizeUpdateResultItemKeylessServerStatus,
      tunnel: S.optional(S.NullOr(CreateResponseKeylessServerTunnel)),
    }),
).annotate({
  identifier: "PrioritizeUpdateResultItemKeylessServer",
}) as any as S.Schema<PrioritizeUpdateResultItemKeylessServer>;

export type PrioritizeUpdateResultItemStatus =
  | "active"
  | "expired"
  | "deleted"
  | "pending"
  | "initializing";
export const PrioritizeUpdateResultItemStatus = /*@__PURE__*/ S.String;

export interface PrioritizeUpdateResultItem {
  /** Identifier. */
  id: string;
  /** Identifier. */
  zoneId: string;
  /** A ubiquitous bundle has the highest probability of being verified everywhere, even by clients using outdated or unusual trust stores. An optimal bundle uses the shortest chain and newest intermediates. And the force bundle verifies the chain, but does not otherwise modify it. */
  bundleMethod?: PrioritizeUpdateResultItemBundleMethod | null;
  /** The identifier for the Custom CSR that was used. */
  customCsrId?: string | null;
  /** When the certificate from the authority expires. */
  expiresOn?: string | null;
  /** Specify the region where your private key can be held locally for optimal TLS performance. HTTPS connections to any excluded data center will still be fully encrypted, but will incur some latency while Keyless SSL is used to complete the handshake with the nearest allowed data center. Options allow distribution to only to U.S. data centers, only to E.U. data centers, or only to highest security data centers. Default distribution is to all Cloudflare datacenters, for optimal performance. */
  geoRestrictions?: PrioritizeUpdateResultItemGeoRestrictions | null;
  hosts?: PrioritizeUpdateResultItemHostsList | null;
  /** The certificate authority that issued the certificate. */
  issuer?: string | null;
  keylessServer?: PrioritizeUpdateResultItemKeylessServer | null;
  /** When the certificate was last modified. */
  modifiedOn?: string | null;
  /** The policy restrictions returned by the API. This field is returned in responses */
  policyRestrictions?: string | null;
  /** The order/priority in which the certificate will be used in a request. The higher priority will break ties across overlapping 'legacy_custom' certificates, but 'legacy_custom' certificates will always supercede 'sni_custom' certificates. */
  priority?: number | null;
  /** The type of hash used for the certificate. */
  signature?: string | null;
  /** Status of the zone's custom SSL. */
  status?: PrioritizeUpdateResultItemStatus | null;
  /** When the certificate was uploaded to Cloudflare. */
  uploadedOn?: string | null;
}
export const PrioritizeUpdateResultItem = /*@__PURE__*/ S.suspend(() =>
  S.Struct({
    id: S.String,
    zoneId: S.String.pipe(T.Body("zone_id")),
    bundleMethod: S.optional(
      S.NullOr(PrioritizeUpdateResultItemBundleMethod).pipe(
        T.Body("bundle_method"),
      ),
    ),
    customCsrId: S.optional(S.NullOr(S.String).pipe(T.Body("custom_csr_id"))),
    expiresOn: S.optional(S.NullOr(S.String).pipe(T.Body("expires_on"))),
    geoRestrictions: S.optional(
      S.NullOr(PrioritizeUpdateResultItemGeoRestrictions).pipe(
        T.Body("geo_restrictions"),
      ),
    ),
    hosts: S.optional(S.NullOr(PrioritizeUpdateResultItemHostsList)),
    issuer: S.optional(S.NullOr(S.String)),
    keylessServer: S.optional(
      S.NullOr(PrioritizeUpdateResultItemKeylessServer).pipe(
        T.Body("keyless_server"),
      ),
    ),
    modifiedOn: S.optional(S.NullOr(S.String).pipe(T.Body("modified_on"))),
    policyRestrictions: S.optional(
      S.NullOr(S.String).pipe(T.Body("policy_restrictions")),
    ),
    priority: S.optional(S.NullOr(S.Number)),
    signature: S.optional(S.NullOr(S.String)),
    status: S.optional(S.NullOr(PrioritizeUpdateResultItemStatus)),
    uploadedOn: S.optional(S.NullOr(S.String).pipe(T.Body("uploaded_on"))),
  }),
).annotate({
  identifier: "PrioritizeUpdateResultItem",
}) as any as S.Schema<PrioritizeUpdateResultItem>;

export type PrioritizeUpdateResultList = Array<PrioritizeUpdateResultItem>;
export const PrioritizeUpdateResultList = /*@__PURE__*/ S.Array(
  PrioritizeUpdateResultItem,
) as any as S.Schema<PrioritizeUpdateResultList>;

export interface PutPrioritizeResponse {
  /** The unwrapped `result` payload of the v4 response envelope. */
  result: PrioritizeUpdateResultList;
  /** Pagination info from the envelope's `result_info`. */
  resultInfo?: ResultInfo | null;
}
export const PutPrioritizeResponse = /*@__PURE__*/ S.suspend(() =>
  S.Struct({
    result: PrioritizeUpdateResultList.pipe(T.EnvelopePayload()),
    resultInfo: S.optional(S.NullOr(ResultInfo).pipe(T.ResultInfo())),
  }).pipe(T.KeyDictionary(KEY_DICTIONARY)),
).annotate({
  identifier: "PutPrioritizeResponse",
}) as any as S.Schema<PutPrioritizeResponse>;

export type CreateCustomCertificateError =
  | PlanLevelNotAllowed
  | Forbidden
  | CloudflareOpError;
/** Upload a new SSL certificate for a zone. */
export const createCustomCertificate: API.OperationMethod<
  CreateCustomCertificateRequest,
  CreateCustomCertificateResponse,
  CreateCustomCertificateError,
  CloudflareOpContext
> = /*@__PURE__*/ API.make(() => ({
  input: CreateCustomCertificateRequest,
  output: CreateCustomCertificateResponse,
  errors: [
    PlanLevelNotAllowed,
    Forbidden,
    CloudflareRateLimited,
    CloudflareError,
  ],
  protocol: CloudflareProtocol,
  retry: Retry.Retry,
}));

export type DeleteCustomCertificateError =
  | CustomCertificateNotFound
  | PlanLevelNotAllowed
  | Forbidden
  | CloudflareOpError;
/** Remove a SSL certificate from a zone. */
export const deleteCustomCertificate: API.OperationMethod<
  DeleteCustomCertificateRequest,
  DeleteCustomCertificateResponse,
  DeleteCustomCertificateError,
  CloudflareOpContext
> = /*@__PURE__*/ API.make(() => ({
  input: DeleteCustomCertificateRequest,
  output: DeleteCustomCertificateResponse,
  errors: [
    CustomCertificateNotFound,
    PlanLevelNotAllowed,
    Forbidden,
    CloudflareRateLimited,
    CloudflareError,
  ],
  protocol: CloudflareProtocol,
  retry: Retry.Retry,
}));

export type GetCustomCertificateError =
  | CustomCertificateNotFound
  | PlanLevelNotAllowed
  | Forbidden
  | CloudflareOpError;
/** Retrieves details for a specific custom SSL certificate, including certificate metadata, bundle method, geographic restrictions, and associated keyless server configuration. */
export const getCustomCertificate: API.OperationMethod<
  GetCustomCertificateRequest,
  GetCustomCertificateResponse,
  GetCustomCertificateError,
  CloudflareOpContext
> = /*@__PURE__*/ API.make(() => ({
  input: GetCustomCertificateRequest,
  output: GetCustomCertificateResponse,
  errors: [
    CustomCertificateNotFound,
    PlanLevelNotAllowed,
    Forbidden,
    CloudflareRateLimited,
    CloudflareError,
  ],
  protocol: CloudflareProtocol,
  retry: Retry.Retry,
}));

export type ListCustomCertificatesError =
  | PlanLevelNotAllowed
  | ZoneNotFound
  | Forbidden
  | CloudflareOpError;
/** List, search, and filter all of your custom SSL certificates. The higher priority will break ties across overlapping 'legacy_custom' certificates, but 'legacy_custom' certificates will always supercede 'sni_custom' certificates. */
export const listCustomCertificates: API.PaginatedOperationMethod<
  ListCustomCertificatesRequest,
  ListCustomCertificatesResponse,
  ListCustomCertificatesError,
  CloudflareOpContext,
  ListResultItem
> = /*@__PURE__*/ API.makePaginated(
  () => ({
    input: ListCustomCertificatesRequest,
    output: ListCustomCertificatesResponse,
    errors: [
      PlanLevelNotAllowed,
      ZoneNotFound,
      Forbidden,
      CloudflareRateLimited,
      CloudflareError,
    ],
    protocol: CloudflarePaginatedProtocol,
    retry: Retry.Retry,
    pagination: {
      mode: "page",
      inputToken: "page",
      outputToken: "resultInfo.page",
      items: "result",
      pageSize: "perPage",
    } as const,
  }),
  cloudflarePaginate,
) as any;

export type PatchCustomCertificateError =
  | CustomCertificateNotFound
  | PlanLevelNotAllowed
  | Forbidden
  | CloudflareOpError;
/** Upload a new private key and/or PEM/CRT for the SSL certificate. Note: PATCHing a configuration for sni_custom certificates will result in a new resource id being returned, and the previous one being deleted. */
export const patchCustomCertificate: API.OperationMethod<
  PatchCustomCertificateRequest,
  PatchCustomCertificateResponse,
  PatchCustomCertificateError,
  CloudflareOpContext
> = /*@__PURE__*/ API.make(() => ({
  input: PatchCustomCertificateRequest,
  output: PatchCustomCertificateResponse,
  errors: [
    CustomCertificateNotFound,
    PlanLevelNotAllowed,
    Forbidden,
    CloudflareRateLimited,
    CloudflareError,
  ],
  protocol: CloudflareProtocol,
  retry: Retry.Retry,
}));

export type PutPrioritizeError =
  | PlanLevelNotAllowed
  | Forbidden
  | CloudflareOpError;
/** If a zone has multiple SSL certificates, you can set the order in which they should be used during a request. The higher priority will break ties across overlapping 'legacy_custom' certificates. */
export const putPrioritize: API.PaginatedOperationMethod<
  PutPrioritizeRequest,
  PutPrioritizeResponse,
  PutPrioritizeError,
  CloudflareOpContext,
  PrioritizeUpdateResultItem
> = /*@__PURE__*/ API.makePaginated(
  () => ({
    input: PutPrioritizeRequest,
    output: PutPrioritizeResponse,
    errors: [
      PlanLevelNotAllowed,
      Forbidden,
      CloudflareRateLimited,
      CloudflareError,
    ],
    protocol: CloudflarePaginatedProtocol,
    retry: Retry.Retry,
    pagination: { mode: "single", items: "result" } as const,
  }),
  cloudflarePaginate,
) as any;