// AUTO-GENERATED by scripts/generate.ts from .generated-specs. Do not edit.
import * as S from "@distilled.cloud/core/schema";
import * as API from "@distilled.cloud/core/api";
import * as T from "../traits.ts";
import {
  CloudflareProtocol,
  CloudflarePaginatedProtocol,
  type CloudflareOpError,
  type CloudflareOpContext,
} from "../protocol.ts";
import { cloudflarePaginate, ResultInfo } from "../pagination.ts";
import { CloudflareError, CloudflareRateLimited } from "../errors.ts";
import * as Retry from "../retry.ts";

export type { CloudflareOpError, CloudflareOpContext };

/** Fallback camelCase→wire mapping for opaque content (mined from the distilled SDK). */
const KEY_DICTIONARY: Record<string, string | ReadonlyArray<string>> = {
  expiresOn: "expires_on",
  privateKey: "private_key",
  serialNumber: "serial_number",
  updatedAt: "updated_at",
  uploadedOn: "uploaded_on",
};

export class CertificateAlreadyDeleted
  extends /*@__PURE__*/ T.applyErrorMatchers(
    /*@__PURE__*/ S.TaggedError<CertificateAlreadyDeleted>()(
      "CertificateAlreadyDeleted",
      {
        code: S.Number,
        message: S.String,
      },
    ),
    [{ status: 400, message: { includes: "already deleted" } }],
  ) {}

export class CertificateAlreadyExists
  extends /*@__PURE__*/ T.applyErrorMatchers(
    /*@__PURE__*/ S.TaggedError<CertificateAlreadyExists>()(
      "CertificateAlreadyExists",
      {
        code: S.Number,
        message: S.String,
      },
    ),
    [{ code: 1471, message: { includes: "already exists" } }],
  ) {}

export class CertificateNotFound
  extends /*@__PURE__*/ T.applyErrorMatchers(
    /*@__PURE__*/ S.TaggedError<CertificateNotFound>()("CertificateNotFound", {
      code: S.Number,
      message: S.String,
    }),
    [
      { code: 1472, message: { includes: "Certificate not found" } },
      { status: 404 },
    ],
  ) {}

export interface CreateMtlsCertificateRequest {
  /** Identifier. */
  accountId: string;
  /** Indicates whether the certificate is a CA or leaf certificate. */
  ca: boolean;
  /** The uploaded root CA certificate. */
  certificates: string;
  /** Optional unique name for the certificate. Only used for human readability. */
  name?: string;
  /** The private key for the certificate. This field is only needed for specific use cases such as using a custom certificate with Zero Trust's block page. */
  privateKey?: string;
}
export const CreateMtlsCertificateRequest = /*@__PURE__*/ S.suspend(() =>
  S.Struct({
    accountId: S.String.pipe(T.Label("account_id")),
    ca: S.Boolean,
    certificates: S.String,
    name: S.optional(S.String),
    privateKey: S.optional(S.String.pipe(T.Body("private_key"))),
  })
    .pipe(
      T.Http({
        method: "POST",
        uri: "/accounts/{account_id}/mtls_certificates",
        code: 200,
      }),
    )
    .pipe(T.KeyDictionary(KEY_DICTIONARY)),
).annotate({
  identifier: "CreateMtlsCertificateRequest",
}) as any as S.Schema<CreateMtlsCertificateRequest>;

export type CreateResponseType =
  | "custom"
  | "gateway_managed"
  | "access_managed";
export const CreateResponseType = /*@__PURE__*/ S.String;

/** Unwrapped `result` payload of the Cloudflare v4 response envelope. */
export interface CreateMtlsCertificateResponse {
  /** Identifier. */
  id?: string | null;
  /** Indicates whether the certificate is a CA or leaf certificate. */
  ca?: boolean | null;
  /** The uploaded root CA certificate. */
  certificates?: string | null;
  /** When the certificate expires. */
  expiresOn?: string | null;
  /** The certificate authority that issued the certificate. */
  issuer?: string | null;
  /** Optional unique name for the certificate. Only used for human readability. */
  name?: string | null;
  /** The certificate serial number. */
  serialNumber?: string | null;
  /** The type of hash used for the certificate. */
  signature?: string | null;
  /** The type of the certificate, indicating how it was created and who manages it. */
  type?: CreateResponseType | null;
  /** This is the time the certificate was updated. */
  updatedAt?: string | null;
  /** This is the time the certificate was uploaded. */
  uploadedOn?: string | null;
}
export const CreateMtlsCertificateResponse = /*@__PURE__*/ S.suspend(() =>
  S.Struct({
    id: S.optional(S.NullOr(S.String)),
    ca: S.optional(S.NullOr(S.Boolean)),
    certificates: S.optional(S.NullOr(S.String)),
    expiresOn: S.optional(S.NullOr(S.String).pipe(T.Body("expires_on"))),
    issuer: S.optional(S.NullOr(S.String)),
    name: S.optional(S.NullOr(S.String)),
    serialNumber: S.optional(S.NullOr(S.String).pipe(T.Body("serial_number"))),
    signature: S.optional(S.NullOr(S.String)),
    type: S.optional(S.NullOr(CreateResponseType)),
    updatedAt: S.optional(S.NullOr(S.String).pipe(T.Body("updated_at"))),
    uploadedOn: S.optional(S.NullOr(S.String).pipe(T.Body("uploaded_on"))),
  }).pipe(T.KeyDictionary(KEY_DICTIONARY)),
).annotate({
  identifier: "CreateMtlsCertificateResponse",
}) as any as S.Schema<CreateMtlsCertificateResponse>;

export interface DeleteMtlsCertificateRequest {
  /** Identifier. */
  accountId: string;
  /** Identifier. */
  mtlsCertificateId: string;
}
export const DeleteMtlsCertificateRequest = /*@__PURE__*/ S.suspend(() =>
  S.Struct({
    accountId: S.String.pipe(T.Label("account_id")),
    mtlsCertificateId: S.String.pipe(T.Label("mtls_certificate_id")),
  })
    .pipe(
      T.Http({
        method: "DELETE",
        uri: "/accounts/{account_id}/mtls_certificates/{mtls_certificate_id}",
        code: 200,
      }),
    )
    .pipe(T.KeyDictionary(KEY_DICTIONARY)),
).annotate({
  identifier: "DeleteMtlsCertificateRequest",
}) as any as S.Schema<DeleteMtlsCertificateRequest>;

export type DeleteResponseType =
  | "custom"
  | "gateway_managed"
  | "access_managed";
export const DeleteResponseType = /*@__PURE__*/ S.String;

/** Unwrapped `result` payload of the Cloudflare v4 response envelope. */
export interface DeleteMtlsCertificateResponse {
  /** Identifier. */
  id?: string | null;
  /** Indicates whether the certificate is a CA or leaf certificate. */
  ca?: boolean | null;
  /** The uploaded root CA certificate. */
  certificates?: string | null;
  /** When the certificate expires. */
  expiresOn?: string | null;
  /** The certificate authority that issued the certificate. */
  issuer?: string | null;
  /** Optional unique name for the certificate. Only used for human readability. */
  name?: string | null;
  /** The certificate serial number. */
  serialNumber?: string | null;
  /** The type of hash used for the certificate. */
  signature?: string | null;
  /** The type of the certificate, indicating how it was created and who manages it. */
  type?: DeleteResponseType | null;
  /** This is the time the certificate was uploaded. */
  uploadedOn?: string | null;
}
export const DeleteMtlsCertificateResponse = /*@__PURE__*/ S.suspend(() =>
  S.Struct({
    id: S.optional(S.NullOr(S.String)),
    ca: S.optional(S.NullOr(S.Boolean)),
    certificates: S.optional(S.NullOr(S.String)),
    expiresOn: S.optional(S.NullOr(S.String).pipe(T.Body("expires_on"))),
    issuer: S.optional(S.NullOr(S.String)),
    name: S.optional(S.NullOr(S.String)),
    serialNumber: S.optional(S.NullOr(S.String).pipe(T.Body("serial_number"))),
    signature: S.optional(S.NullOr(S.String)),
    type: S.optional(S.NullOr(DeleteResponseType)),
    uploadedOn: S.optional(S.NullOr(S.String).pipe(T.Body("uploaded_on"))),
  }).pipe(T.KeyDictionary(KEY_DICTIONARY)),
).annotate({
  identifier: "DeleteMtlsCertificateResponse",
}) as any as S.Schema<DeleteMtlsCertificateResponse>;

export interface GetAssociationRequest {
  /** Identifier. */
  accountId: string;
  /** Identifier. */
  mtlsCertificateId: string;
}
export const GetAssociationRequest = /*@__PURE__*/ S.suspend(() =>
  S.Struct({
    accountId: S.String.pipe(T.Label("account_id")),
    mtlsCertificateId: S.String.pipe(T.Label("mtls_certificate_id")),
  })
    .pipe(
      T.Http({
        method: "GET",
        uri: "/accounts/{account_id}/mtls_certificates/{mtls_certificate_id}/associations",
        code: 200,
      }),
    )
    .pipe(T.KeyDictionary(KEY_DICTIONARY)),
).annotate({
  identifier: "GetAssociationRequest",
}) as any as S.Schema<GetAssociationRequest>;

export interface AssociationsGetResultItem {
  /** The service using the certificate. */
  service?: string | null;
  /** Certificate deployment status for the given service. */
  status?: string | null;
}
export const AssociationsGetResultItem = /*@__PURE__*/ S.suspend(() =>
  S.Struct({
    service: S.optional(S.NullOr(S.String)),
    status: S.optional(S.NullOr(S.String)),
  }),
).annotate({
  identifier: "AssociationsGetResultItem",
}) as any as S.Schema<AssociationsGetResultItem>;

export type AssociationsGetResultList = Array<AssociationsGetResultItem>;
export const AssociationsGetResultList = /*@__PURE__*/ S.Array(
  AssociationsGetResultItem,
) as any as S.Schema<AssociationsGetResultList>;

export interface GetAssociationResponse {
  /** The unwrapped `result` payload of the v4 response envelope. */
  result: AssociationsGetResultList;
  /** Pagination info from the envelope's `result_info`. */
  resultInfo?: ResultInfo | null;
}
export const GetAssociationResponse = /*@__PURE__*/ S.suspend(() =>
  S.Struct({
    result: AssociationsGetResultList.pipe(T.EnvelopePayload()),
    resultInfo: S.optional(S.NullOr(ResultInfo).pipe(T.ResultInfo())),
  }).pipe(T.KeyDictionary(KEY_DICTIONARY)),
).annotate({
  identifier: "GetAssociationResponse",
}) as any as S.Schema<GetAssociationResponse>;

export interface GetMtlsCertificateRequest {
  /** Identifier. */
  accountId: string;
  /** Identifier. */
  mtlsCertificateId: string;
}
export const GetMtlsCertificateRequest = /*@__PURE__*/ S.suspend(() =>
  S.Struct({
    accountId: S.String.pipe(T.Label("account_id")),
    mtlsCertificateId: S.String.pipe(T.Label("mtls_certificate_id")),
  })
    .pipe(
      T.Http({
        method: "GET",
        uri: "/accounts/{account_id}/mtls_certificates/{mtls_certificate_id}",
        code: 200,
      }),
    )
    .pipe(T.KeyDictionary(KEY_DICTIONARY)),
).annotate({
  identifier: "GetMtlsCertificateRequest",
}) as any as S.Schema<GetMtlsCertificateRequest>;

export type GetResponseType = "custom" | "gateway_managed" | "access_managed";
export const GetResponseType = /*@__PURE__*/ S.String;

/** Unwrapped `result` payload of the Cloudflare v4 response envelope. */
export interface GetMtlsCertificateResponse {
  /** Identifier. */
  id?: string | null;
  /** Indicates whether the certificate is a CA or leaf certificate. */
  ca?: boolean | null;
  /** The uploaded root CA certificate. */
  certificates?: string | null;
  /** When the certificate expires. */
  expiresOn?: string | null;
  /** The certificate authority that issued the certificate. */
  issuer?: string | null;
  /** Optional unique name for the certificate. Only used for human readability. */
  name?: string | null;
  /** The certificate serial number. */
  serialNumber?: string | null;
  /** The type of hash used for the certificate. */
  signature?: string | null;
  /** The type of the certificate, indicating how it was created and who manages it. */
  type?: GetResponseType | null;
  /** This is the time the certificate was uploaded. */
  uploadedOn?: string | null;
}
export const GetMtlsCertificateResponse = /*@__PURE__*/ S.suspend(() =>
  S.Struct({
    id: S.optional(S.NullOr(S.String)),
    ca: S.optional(S.NullOr(S.Boolean)),
    certificates: S.optional(S.NullOr(S.String)),
    expiresOn: S.optional(S.NullOr(S.String).pipe(T.Body("expires_on"))),
    issuer: S.optional(S.NullOr(S.String)),
    name: S.optional(S.NullOr(S.String)),
    serialNumber: S.optional(S.NullOr(S.String).pipe(T.Body("serial_number"))),
    signature: S.optional(S.NullOr(S.String)),
    type: S.optional(S.NullOr(GetResponseType)),
    uploadedOn: S.optional(S.NullOr(S.String).pipe(T.Body("uploaded_on"))),
  }).pipe(T.KeyDictionary(KEY_DICTIONARY)),
).annotate({
  identifier: "GetMtlsCertificateResponse",
}) as any as S.Schema<GetMtlsCertificateResponse>;

export type ListRequestType = "custom" | "gateway_managed" | "access_managed";
export const ListRequestType = /*@__PURE__*/ S.String;

export type ListRequestTypeList = Array<ListRequestType | (string & {})>;
export const ListRequestTypeList = /*@__PURE__*/ S.Array(
  ListRequestType,
) as any as S.Schema<ListRequestTypeList>;

export interface ListMtlsCertificatesRequest {
  /** Identifier. */
  accountId: string;
  /** Filters results by certificate type. Multiple types can be comma-separated. */
  type?: ListRequestTypeList;
}
export const ListMtlsCertificatesRequest = /*@__PURE__*/ S.suspend(() =>
  S.Struct({
    accountId: S.String.pipe(T.Label("account_id")),
    type: S.optional(ListRequestTypeList.pipe(T.Query())),
  })
    .pipe(
      T.Http({
        method: "GET",
        uri: "/accounts/{account_id}/mtls_certificates",
        code: 200,
      }),
    )
    .pipe(T.KeyDictionary(KEY_DICTIONARY)),
).annotate({
  identifier: "ListMtlsCertificatesRequest",
}) as any as S.Schema<ListMtlsCertificatesRequest>;

export type ListResultItemType =
  | "custom"
  | "gateway_managed"
  | "access_managed";
export const ListResultItemType = /*@__PURE__*/ S.String;

export interface ListResultItem {
  /** Identifier. */
  id?: string | null;
  /** Indicates whether the certificate is a CA or leaf certificate. */
  ca?: boolean | null;
  /** The uploaded root CA certificate. */
  certificates?: string | null;
  /** When the certificate expires. */
  expiresOn?: string | null;
  /** The certificate authority that issued the certificate. */
  issuer?: string | null;
  /** Optional unique name for the certificate. Only used for human readability. */
  name?: string | null;
  /** The certificate serial number. */
  serialNumber?: string | null;
  /** The type of hash used for the certificate. */
  signature?: string | null;
  /** The type of the certificate, indicating how it was created and who manages it. */
  type?: ListResultItemType | null;
  /** This is the time the certificate was uploaded. */
  uploadedOn?: string | null;
}
export const ListResultItem = /*@__PURE__*/ S.suspend(() =>
  S.Struct({
    id: S.optional(S.NullOr(S.String)),
    ca: S.optional(S.NullOr(S.Boolean)),
    certificates: S.optional(S.NullOr(S.String)),
    expiresOn: S.optional(S.NullOr(S.String).pipe(T.Body("expires_on"))),
    issuer: S.optional(S.NullOr(S.String)),
    name: S.optional(S.NullOr(S.String)),
    serialNumber: S.optional(S.NullOr(S.String).pipe(T.Body("serial_number"))),
    signature: S.optional(S.NullOr(S.String)),
    type: S.optional(S.NullOr(ListResultItemType)),
    uploadedOn: S.optional(S.NullOr(S.String).pipe(T.Body("uploaded_on"))),
  }),
).annotate({ identifier: "ListResultItem" }) as any as S.Schema<ListResultItem>;

export type ListResultList = Array<ListResultItem>;
export const ListResultList = /*@__PURE__*/ S.Array(
  ListResultItem,
) as any as S.Schema<ListResultList>;

export interface ListMtlsCertificatesResponse {
  /** The unwrapped `result` payload of the v4 response envelope. */
  result: ListResultList;
  /** Pagination info from the envelope's `result_info`. */
  resultInfo?: ResultInfo | null;
}
export const ListMtlsCertificatesResponse = /*@__PURE__*/ S.suspend(() =>
  S.Struct({
    result: ListResultList.pipe(T.EnvelopePayload()),
    resultInfo: S.optional(S.NullOr(ResultInfo).pipe(T.ResultInfo())),
  }).pipe(T.KeyDictionary(KEY_DICTIONARY)),
).annotate({
  identifier: "ListMtlsCertificatesResponse",
}) as any as S.Schema<ListMtlsCertificatesResponse>;

export type CreateMtlsCertificateError =
  | CertificateAlreadyExists
  | CloudflareOpError;
/** Upload a certificate that you want to use with mTLS-enabled Cloudflare services, such as Bring Your Own CA (BYO-CA) for mTLS. To create certificates issued by the Cloudflare managed CA, use the [Create Client Certificate endpoint](/api/resources/client_certificates/methods/create/). */
export const createMtlsCertificate: API.OperationMethod<
  CreateMtlsCertificateRequest,
  CreateMtlsCertificateResponse,
  CreateMtlsCertificateError,
  CloudflareOpContext
> = /*@__PURE__*/ API.make(() => ({
  input: CreateMtlsCertificateRequest,
  output: CreateMtlsCertificateResponse,
  errors: [CertificateAlreadyExists, CloudflareRateLimited, CloudflareError],
  protocol: CloudflareProtocol,
  retry: Retry.Retry,
}));

export type DeleteMtlsCertificateError =
  | CertificateNotFound
  | CertificateAlreadyDeleted
  | CloudflareOpError;
/** Deletes the mTLS certificate unless the certificate is in use by one or more Cloudflare services. */
export const deleteMtlsCertificate: API.OperationMethod<
  DeleteMtlsCertificateRequest,
  DeleteMtlsCertificateResponse,
  DeleteMtlsCertificateError,
  CloudflareOpContext
> = /*@__PURE__*/ API.make(() => ({
  input: DeleteMtlsCertificateRequest,
  output: DeleteMtlsCertificateResponse,
  errors: [
    CertificateNotFound,
    CertificateAlreadyDeleted,
    CloudflareRateLimited,
    CloudflareError,
  ],
  protocol: CloudflareProtocol,
  retry: Retry.Retry,
}));

export type GetAssociationError = CloudflareOpError;
/** Lists all active associations between the certificate and Cloudflare services. */
export const getAssociation: API.PaginatedOperationMethod<
  GetAssociationRequest,
  GetAssociationResponse,
  GetAssociationError,
  CloudflareOpContext,
  AssociationsGetResultItem
> = /*@__PURE__*/ API.makePaginated(
  () => ({
    input: GetAssociationRequest,
    output: GetAssociationResponse,
    errors: [CloudflareRateLimited, CloudflareError],
    protocol: CloudflarePaginatedProtocol,
    retry: Retry.Retry,
    pagination: { mode: "single", items: "result" } as const,
  }),
  cloudflarePaginate,
) as any;

export type GetMtlsCertificateError = CertificateNotFound | CloudflareOpError;
/** Fetches a single mTLS certificate uploaded to your account. To get a certificate issued by the Cloudflare managed CA, use the [Client Certificate Details endpoint](/api/resources/client_certificates/methods/get/). */
export const getMtlsCertificate: API.OperationMethod<
  GetMtlsCertificateRequest,
  GetMtlsCertificateResponse,
  GetMtlsCertificateError,
  CloudflareOpContext
> = /*@__PURE__*/ API.make(() => ({
  input: GetMtlsCertificateRequest,
  output: GetMtlsCertificateResponse,
  errors: [CertificateNotFound, CloudflareRateLimited, CloudflareError],
  protocol: CloudflareProtocol,
  retry: Retry.Retry,
}));

export type ListMtlsCertificatesError = CloudflareOpError;
/** Lists all mTLS certificates uploaded to your account, such as Bring Your Own CA (BYO-CA) for mTLS. To list certificates issued by the Cloudflare managed CA, use the [List Client Certificates endpoint](/api/resources/client_certificates/methods/list/). */
export const listMtlsCertificates: API.PaginatedOperationMethod<
  ListMtlsCertificatesRequest,
  ListMtlsCertificatesResponse,
  ListMtlsCertificatesError,
  CloudflareOpContext,
  ListResultItem
> = /*@__PURE__*/ API.makePaginated(
  () => ({
    input: ListMtlsCertificatesRequest,
    output: ListMtlsCertificatesResponse,
    errors: [CloudflareRateLimited, CloudflareError],
    protocol: CloudflarePaginatedProtocol,
    retry: Retry.Retry,
    pagination: { mode: "single", items: "result" } as const,
  }),
  cloudflarePaginate,
) as any;