// AUTO-GENERATED by scripts/generate.ts from .generated-specs. Do not edit.
import * as S from "@distilled.cloud/core/schema";
import * as API from "@distilled.cloud/core/api";
import * as T from "../traits.ts";
import {
  CloudflareProtocol,
  CloudflarePaginatedProtocol,
  type CloudflareOpError,
  type CloudflareOpContext,
} from "../protocol.ts";
import { cloudflarePaginate, ResultInfo } from "../pagination.ts";
import { CloudflareError, CloudflareRateLimited } from "../errors.ts";
import * as Retry from "../retry.ts";

export type { CloudflareOpError, CloudflareOpContext };

/** Fallback camelCase→wire mapping for opaque content (mined from the distilled SDK). */
const KEY_DICTIONARY: Record<string, string | ReadonlyArray<string>> = {
  expiresOn: "expires_on",
  perPage: "per_page",
  requestType: "request_type",
  requestedValidity: "requested_validity",
  resultInfo: "result_info",
  revokedAt: "revoked_at",
  totalCount: "total_count",
};

export class CertificateAlreadyRevoked
  extends /*@__PURE__*/ T.applyErrorMatchers(
    /*@__PURE__*/ S.TaggedError<CertificateAlreadyRevoked>()(
      "CertificateAlreadyRevoked",
      {
        code: S.Number,
        message: S.String,
      },
    ),
    [{ code: 1014 }],
  ) {}

export class CertificateNotFound
  extends /*@__PURE__*/ T.applyErrorMatchers(
    /*@__PURE__*/ S.TaggedError<CertificateNotFound>()("CertificateNotFound", {
      code: S.Number,
      message: S.String,
    }),
    [{ code: 1101 }],
  ) {}

export class CertificateRevocationFailed
  extends /*@__PURE__*/ T.applyErrorMatchers(
    /*@__PURE__*/ S.TaggedError<CertificateRevocationFailed>()(
      "CertificateRevocationFailed",
      {
        code: S.Number,
        message: S.String,
      },
    ),
    [{ code: 1000 }],
  ) {}

export class Forbidden
  extends /*@__PURE__*/ T.applyErrorMatchers(
    /*@__PURE__*/ S.TaggedError<Forbidden>()("Forbidden", {
      code: S.Number,
      message: S.String,
    }),
    [{ status: 403 }],
  ) {}

export class HostnameNotAuthorized
  extends /*@__PURE__*/ T.applyErrorMatchers(
    /*@__PURE__*/ S.TaggedError<HostnameNotAuthorized>()(
      "HostnameNotAuthorized",
      {
        code: S.Number,
        message: S.String,
      },
    ),
    [{ code: 1010 }],
  ) {}

export type CreateRequestHostnamesList = Array<string>;
export const CreateRequestHostnamesList = /*@__PURE__*/ S.Array(
  S.String,
) as any as S.Schema<CreateRequestHostnamesList>;

export type CreateRequestRequestType =
  | "origin-rsa"
  | "origin-ecc"
  | "keyless-certificate";
export const CreateRequestRequestType = /*@__PURE__*/ S.String;

export type CreateRequestRequestedValidity =
  | 7
  | 30
  | 90
  | 365
  | 730
  | 1095
  | 5475;
export const CreateRequestRequestedValidity = /*@__PURE__*/ S.Number;

export interface CreateOriginCaCertificateRequest {
  /** The Certificate Signing Request (CSR). Must be newline-encoded. */
  csr: string;
  /** Array of hostnames or wildcard names bound to the certificate. */
  hostnames: CreateRequestHostnamesList;
  /** Signature type desired on certificate ("origin-rsa" (rsa), "origin-ecc" (ecdsa), or "keyless-certificate" (for Keyless SSL servers). */
  requestType: CreateRequestRequestType | (string & {});
  /** The number of days for which the certificate should be valid. */
  requestedValidity?: CreateRequestRequestedValidity | (number & {});
}
export const CreateOriginCaCertificateRequest = /*@__PURE__*/ S.suspend(() =>
  S.Struct({
    csr: S.String,
    hostnames: CreateRequestHostnamesList,
    requestType: CreateRequestRequestType.pipe(T.Body("request_type")),
    requestedValidity: S.optional(
      CreateRequestRequestedValidity.pipe(T.Body("requested_validity")),
    ),
  })
    .pipe(T.Http({ method: "POST", uri: "/certificates", code: 200 }))
    .pipe(T.KeyDictionary(KEY_DICTIONARY)),
).annotate({
  identifier: "CreateOriginCaCertificateRequest",
}) as any as S.Schema<CreateOriginCaCertificateRequest>;

export type CreateResponseHostnamesList = Array<string>;
export const CreateResponseHostnamesList = /*@__PURE__*/ S.Array(
  S.String,
) as any as S.Schema<CreateResponseHostnamesList>;

export type CreateResponseRequestType =
  | "origin-rsa"
  | "origin-ecc"
  | "keyless-certificate";
export const CreateResponseRequestType = /*@__PURE__*/ S.String;

export type CreateResponseRequestedValidity =
  | 7
  | 30
  | 90
  | 365
  | 730
  | 1095
  | 5475;
export const CreateResponseRequestedValidity = /*@__PURE__*/ S.Number;

/** Unwrapped `result` payload of the Cloudflare v4 response envelope. */
export interface CreateOriginCaCertificateResponse {
  /** The Certificate Signing Request (CSR). Must be newline-encoded. */
  csr: string;
  /** Array of hostnames or wildcard names bound to the certificate. */
  hostnames: CreateResponseHostnamesList;
  /** Signature type desired on certificate ("origin-rsa" (rsa), "origin-ecc" (ecdsa), or "keyless-certificate" (for Keyless SSL servers). */
  requestType: CreateResponseRequestType;
  /** The number of days for which the certificate should be valid. */
  requestedValidity: CreateResponseRequestedValidity;
  /** Identifier. */
  id?: string | null;
  /** The Origin CA certificate. Will be newline-encoded. */
  certificate?: string | null;
  /** When the certificate will expire. */
  expiresOn?: string | null;
  /** When the certificate was revoked; absent while the certificate is live. */
  revokedAt?: string | null;
}
export const CreateOriginCaCertificateResponse = /*@__PURE__*/ S.suspend(() =>
  S.Struct({
    csr: S.String,
    hostnames: CreateResponseHostnamesList,
    requestType: CreateResponseRequestType.pipe(T.Body("request_type")),
    requestedValidity: CreateResponseRequestedValidity.pipe(
      T.Body("requested_validity"),
    ),
    id: S.optional(S.NullOr(S.String)),
    certificate: S.optional(S.NullOr(S.String)),
    expiresOn: S.optional(S.NullOr(S.String).pipe(T.Body("expires_on"))),
    revokedAt: S.optional(S.NullOr(S.String).pipe(T.Body("revoked_at"))),
  }).pipe(T.KeyDictionary(KEY_DICTIONARY)),
).annotate({
  identifier: "CreateOriginCaCertificateResponse",
}) as any as S.Schema<CreateOriginCaCertificateResponse>;

export interface DeleteOriginCaCertificateRequest {
  /** Identifier. */
  certificateId: string;
}
export const DeleteOriginCaCertificateRequest = /*@__PURE__*/ S.suspend(() =>
  S.Struct({
    certificateId: S.String.pipe(T.Label("certificate_id")),
  })
    .pipe(
      T.Http({
        method: "DELETE",
        uri: "/certificates/{certificate_id}",
        code: 200,
      }),
    )
    .pipe(T.KeyDictionary(KEY_DICTIONARY)),
).annotate({
  identifier: "DeleteOriginCaCertificateRequest",
}) as any as S.Schema<DeleteOriginCaCertificateRequest>;

/** Unwrapped `result` payload of the Cloudflare v4 response envelope. */
export interface DeleteOriginCaCertificateResponse {
  /** Identifier. */
  id?: string | null;
  /** When the certificate was revoked. */
  revokedAt?: string | null;
}
export const DeleteOriginCaCertificateResponse = /*@__PURE__*/ S.suspend(() =>
  S.Struct({
    id: S.optional(S.NullOr(S.String)),
    revokedAt: S.optional(S.NullOr(S.String).pipe(T.Body("revoked_at"))),
  }).pipe(T.KeyDictionary(KEY_DICTIONARY)),
).annotate({
  identifier: "DeleteOriginCaCertificateResponse",
}) as any as S.Schema<DeleteOriginCaCertificateResponse>;

export interface GetOriginCaCertificateRequest {
  /** Identifier. */
  certificateId: string;
}
export const GetOriginCaCertificateRequest = /*@__PURE__*/ S.suspend(() =>
  S.Struct({
    certificateId: S.String.pipe(T.Label("certificate_id")),
  })
    .pipe(
      T.Http({
        method: "GET",
        uri: "/certificates/{certificate_id}",
        code: 200,
      }),
    )
    .pipe(T.KeyDictionary(KEY_DICTIONARY)),
).annotate({
  identifier: "GetOriginCaCertificateRequest",
}) as any as S.Schema<GetOriginCaCertificateRequest>;

export type GetResponseHostnamesList = Array<string>;
export const GetResponseHostnamesList = /*@__PURE__*/ S.Array(
  S.String,
) as any as S.Schema<GetResponseHostnamesList>;

export type GetResponseRequestType =
  | "origin-rsa"
  | "origin-ecc"
  | "keyless-certificate";
export const GetResponseRequestType = /*@__PURE__*/ S.String;

export type GetResponseRequestedValidity =
  | 7
  | 30
  | 90
  | 365
  | 730
  | 1095
  | 5475;
export const GetResponseRequestedValidity = /*@__PURE__*/ S.Number;

/** Unwrapped `result` payload of the Cloudflare v4 response envelope. */
export interface GetOriginCaCertificateResponse {
  /** The Certificate Signing Request (CSR). Must be newline-encoded. */
  csr: string;
  /** Array of hostnames or wildcard names bound to the certificate. */
  hostnames: GetResponseHostnamesList;
  /** Signature type desired on certificate ("origin-rsa" (rsa), "origin-ecc" (ecdsa), or "keyless-certificate" (for Keyless SSL servers). */
  requestType: GetResponseRequestType;
  /** The number of days for which the certificate should be valid. */
  requestedValidity: GetResponseRequestedValidity;
  /** Identifier. */
  id?: string | null;
  /** The Origin CA certificate. Will be newline-encoded. */
  certificate?: string | null;
  /** When the certificate will expire. */
  expiresOn?: string | null;
  /** When the certificate was revoked; absent while the certificate is live. */
  revokedAt?: string | null;
}
export const GetOriginCaCertificateResponse = /*@__PURE__*/ S.suspend(() =>
  S.Struct({
    csr: S.String,
    hostnames: GetResponseHostnamesList,
    requestType: GetResponseRequestType.pipe(T.Body("request_type")),
    requestedValidity: GetResponseRequestedValidity.pipe(
      T.Body("requested_validity"),
    ),
    id: S.optional(S.NullOr(S.String)),
    certificate: S.optional(S.NullOr(S.String)),
    expiresOn: S.optional(S.NullOr(S.String).pipe(T.Body("expires_on"))),
    revokedAt: S.optional(S.NullOr(S.String).pipe(T.Body("revoked_at"))),
  }).pipe(T.KeyDictionary(KEY_DICTIONARY)),
).annotate({
  identifier: "GetOriginCaCertificateResponse",
}) as any as S.Schema<GetOriginCaCertificateResponse>;

export interface ListOriginCaCertificatesRequest {
  /** Identifier. */
  zoneId: string;
  /** Limit to the number of records returned. */
  limit?: number;
  /** Offset the results. */
  offset?: number;
  /** Page number of paginated results. */
  page?: number;
  /** Number of records per page. */
  perPage?: number;
}
export const ListOriginCaCertificatesRequest = /*@__PURE__*/ S.suspend(() =>
  S.Struct({
    zoneId: S.String.pipe(T.Query("zone_id")),
    limit: S.optional(S.Number.pipe(T.Query())),
    offset: S.optional(S.Number.pipe(T.Query())),
    page: S.optional(S.Number.pipe(T.Query())),
    perPage: S.optional(S.Number.pipe(T.Query("per_page"))),
  })
    .pipe(T.Http({ method: "GET", uri: "/certificates", code: 200 }))
    .pipe(T.KeyDictionary(KEY_DICTIONARY)),
).annotate({
  identifier: "ListOriginCaCertificatesRequest",
}) as any as S.Schema<ListOriginCaCertificatesRequest>;

export type ListResultItemHostnamesList = Array<string>;
export const ListResultItemHostnamesList = /*@__PURE__*/ S.Array(
  S.String,
) as any as S.Schema<ListResultItemHostnamesList>;

export type ListResultItemRequestType =
  | "origin-rsa"
  | "origin-ecc"
  | "keyless-certificate";
export const ListResultItemRequestType = /*@__PURE__*/ S.String;

export type ListResultItemRequestedValidity =
  | 7
  | 30
  | 90
  | 365
  | 730
  | 1095
  | 5475;
export const ListResultItemRequestedValidity = /*@__PURE__*/ S.Number;

export interface ListResultItem {
  /** The Certificate Signing Request (CSR). Must be newline-encoded. */
  csr: string;
  /** Array of hostnames or wildcard names bound to the certificate. */
  hostnames: ListResultItemHostnamesList;
  /** Signature type desired on certificate ("origin-rsa" (rsa), "origin-ecc" (ecdsa), or "keyless-certificate" (for Keyless SSL servers). */
  requestType: ListResultItemRequestType;
  /** The number of days for which the certificate should be valid. */
  requestedValidity: ListResultItemRequestedValidity;
  /** Identifier. */
  id?: string | null;
  /** The Origin CA certificate. Will be newline-encoded. */
  certificate?: string | null;
  /** When the certificate will expire. */
  expiresOn?: string | null;
  /** When the certificate was revoked; absent while the certificate is live. */
  revokedAt?: string | null;
}
export const ListResultItem = /*@__PURE__*/ S.suspend(() =>
  S.Struct({
    csr: S.String,
    hostnames: ListResultItemHostnamesList,
    requestType: ListResultItemRequestType.pipe(T.Body("request_type")),
    requestedValidity: ListResultItemRequestedValidity.pipe(
      T.Body("requested_validity"),
    ),
    id: S.optional(S.NullOr(S.String)),
    certificate: S.optional(S.NullOr(S.String)),
    expiresOn: S.optional(S.NullOr(S.String).pipe(T.Body("expires_on"))),
    revokedAt: S.optional(S.NullOr(S.String).pipe(T.Body("revoked_at"))),
  }),
).annotate({ identifier: "ListResultItem" }) as any as S.Schema<ListResultItem>;

export type ListResultList = Array<ListResultItem>;
export const ListResultList = /*@__PURE__*/ S.Array(
  ListResultItem,
) as any as S.Schema<ListResultList>;

export interface ListOriginCaCertificatesResponse {
  /** The unwrapped `result` payload of the v4 response envelope. */
  result: ListResultList;
  /** Pagination info from the envelope's `result_info`. */
  resultInfo?: ResultInfo | null;
}
export const ListOriginCaCertificatesResponse = /*@__PURE__*/ S.suspend(() =>
  S.Struct({
    result: ListResultList.pipe(T.EnvelopePayload()),
    resultInfo: S.optional(S.NullOr(ResultInfo).pipe(T.ResultInfo())),
  }).pipe(T.KeyDictionary(KEY_DICTIONARY)),
).annotate({
  identifier: "ListOriginCaCertificatesResponse",
}) as any as S.Schema<ListOriginCaCertificatesResponse>;

export type CreateOriginCaCertificateError =
  | HostnameNotAuthorized
  | Forbidden
  | CloudflareOpError;
/** Create an Origin CA certificate. You can use an Origin CA Key as your User Service Key or an API token when calling this endpoint ([see above](#requests)). */
export const createOriginCaCertificate: API.OperationMethod<
  CreateOriginCaCertificateRequest,
  CreateOriginCaCertificateResponse,
  CreateOriginCaCertificateError,
  CloudflareOpContext
> = /*@__PURE__*/ API.make(() => ({
  input: CreateOriginCaCertificateRequest,
  output: CreateOriginCaCertificateResponse,
  errors: [
    HostnameNotAuthorized,
    Forbidden,
    CloudflareRateLimited,
    CloudflareError,
  ],
  protocol: CloudflareProtocol,
  retry: Retry.Retry,
}));

export type DeleteOriginCaCertificateError =
  | CertificateNotFound
  | CertificateAlreadyRevoked
  | CertificateRevocationFailed
  | Forbidden
  | CloudflareOpError;
/** Revoke an existing Origin CA certificate by its serial number. You can use an Origin CA Key as your User Service Key or an API token when calling this endpoint ([see above](#requests)). */
export const deleteOriginCaCertificate: API.OperationMethod<
  DeleteOriginCaCertificateRequest,
  DeleteOriginCaCertificateResponse,
  DeleteOriginCaCertificateError,
  CloudflareOpContext
> = /*@__PURE__*/ API.make(() => ({
  input: DeleteOriginCaCertificateRequest,
  output: DeleteOriginCaCertificateResponse,
  errors: [
    CertificateNotFound,
    CertificateAlreadyRevoked,
    CertificateRevocationFailed,
    Forbidden,
    CloudflareRateLimited,
    CloudflareError,
  ],
  protocol: CloudflareProtocol,
  retry: Retry.Retry,
}));

export type GetOriginCaCertificateError =
  | CertificateNotFound
  | Forbidden
  | CloudflareOpError;
/** Get an existing Origin CA certificate by its serial number. You can use an Origin CA Key as your User Service Key or an API token when calling this endpoint ([see above](#requests)). */
export const getOriginCaCertificate: API.OperationMethod<
  GetOriginCaCertificateRequest,
  GetOriginCaCertificateResponse,
  GetOriginCaCertificateError,
  CloudflareOpContext
> = /*@__PURE__*/ API.make(() => ({
  input: GetOriginCaCertificateRequest,
  output: GetOriginCaCertificateResponse,
  errors: [
    CertificateNotFound,
    Forbidden,
    CloudflareRateLimited,
    CloudflareError,
  ],
  protocol: CloudflareProtocol,
  retry: Retry.Retry,
}));

export type ListOriginCaCertificatesError = Forbidden | CloudflareOpError;
/** List all existing Origin CA certificates for a given zone. You can use an Origin CA Key as your User Service Key or an API token when calling this endpoint ([see above](#requests)). */
export const listOriginCaCertificates: API.PaginatedOperationMethod<
  ListOriginCaCertificatesRequest,
  ListOriginCaCertificatesResponse,
  ListOriginCaCertificatesError,
  CloudflareOpContext,
  ListResultItem
> = /*@__PURE__*/ API.makePaginated(
  () => ({
    input: ListOriginCaCertificatesRequest,
    output: ListOriginCaCertificatesResponse,
    errors: [Forbidden, CloudflareRateLimited, CloudflareError],
    protocol: CloudflarePaginatedProtocol,
    retry: Retry.Retry,
    pagination: {
      mode: "page",
      inputToken: "page",
      outputToken: "resultInfo.page",
      items: "result",
      pageSize: "perPage",
    } as const,
  }),
  cloudflarePaginate,
) as any;