@distilled.cloud/acme 0.0.0-placeholder → 1.0.0-rc.13

package/src/services/acme.ts

@@ -0,0 +1,1140 @@
+// AUTO-GENERATED by scripts/generate.ts from manual-specs/acme.json (hand-authored Smithy, RFC 8555). Do not edit.
+import * as S from "@distilled.cloud/core/schema";
+import * as API from "@distilled.cloud/core/api";
+import * as C from "@distilled.cloud/core/category";
+import * as T from "../traits.ts";
+import {
+  AcmeProtocol,
+  type AcmeOpError,
+  type AcmeOpContext,
+} from "../protocol.ts";
+import * as Retry from "../retry.ts";
+
+export type { AcmeOpError, AcmeOpContext };
+
+/** onlyReturnExisting was set and no account matches this key. */
+export class AcmeAccountDoesNotExist
+  extends /*@__PURE__*/ T.applyErrorMatchers(
+    /*@__PURE__*/ S.TaggedError<AcmeAccountDoesNotExist>()(
+      "AcmeAccountDoesNotExist",
+      {
+        code: S.Number,
+        message: S.String,
+        type: S.String,
+        detail: S.String,
+      },
+    ),
+    [
+      {
+        message: {
+          matches: "^urn:ietf:params:acme:error:accountDoesNotExist$",
+        },
+      },
+    ],
+  ) {}
+
+export class AcmeAlreadyRevoked
+  extends /*@__PURE__*/ T.applyErrorMatchers(
+    /*@__PURE__*/ S.TaggedError<AcmeAlreadyRevoked>()("AcmeAlreadyRevoked", {
+      code: S.Number,
+      message: S.String,
+      type: S.String,
+      detail: S.String,
+    }),
+    [{ message: { matches: "^urn:ietf:params:acme:error:alreadyRevoked$" } }],
+  ) {}
+
+export class AcmeBadCsr
+  extends /*@__PURE__*/ T.applyErrorMatchers(
+    /*@__PURE__*/ S.TaggedError<AcmeBadCsr>()("AcmeBadCsr", {
+      code: S.Number,
+      message: S.String,
+      type: S.String,
+      detail: S.String,
+    }),
+    [{ message: { matches: "^urn:ietf:params:acme:error:badCSR$" } }],
+  ) {}
+
+/** The anti-replay nonce was rejected. The protocol retries at most twice using the rejection's nonce before surfacing this error. */
+export class AcmeBadNonce
+  extends /*@__PURE__*/ T.applyErrorMatchers(
+    /*@__PURE__*/ S.TaggedError<AcmeBadNonce>()("AcmeBadNonce", {
+      code: S.Number,
+      message: S.String,
+      type: S.String,
+      detail: S.String,
+    }),
+    [{ message: { matches: "^urn:ietf:params:acme:error:badNonce$" } }],
+  ) {}
+
+export class AcmeBadPublicKey
+  extends /*@__PURE__*/ T.applyErrorMatchers(
+    /*@__PURE__*/ S.TaggedError<AcmeBadPublicKey>()("AcmeBadPublicKey", {
+      code: S.Number,
+      message: S.String,
+      type: S.String,
+      detail: S.String,
+    }),
+    [{ message: { matches: "^urn:ietf:params:acme:error:badPublicKey$" } }],
+  ) {}
+
+export class AcmeBadRevocationReason
+  extends /*@__PURE__*/ T.applyErrorMatchers(
+    /*@__PURE__*/ S.TaggedError<AcmeBadRevocationReason>()(
+      "AcmeBadRevocationReason",
+      {
+        code: S.Number,
+        message: S.String,
+        type: S.String,
+        detail: S.String,
+      },
+    ),
+    [
+      {
+        message: {
+          matches: "^urn:ietf:params:acme:error:badRevocationReason$",
+        },
+      },
+    ],
+  ) {}
+
+export class AcmeBadSignatureAlgorithm
+  extends /*@__PURE__*/ T.applyErrorMatchers(
+    /*@__PURE__*/ S.TaggedError<AcmeBadSignatureAlgorithm>()(
+      "AcmeBadSignatureAlgorithm",
+      {
+        code: S.Number,
+        message: S.String,
+        type: S.String,
+        detail: S.String,
+      },
+    ),
+    [
+      {
+        message: {
+          matches: "^urn:ietf:params:acme:error:badSignatureAlgorithm$",
+        },
+      },
+    ],
+  ) {}
+
+/** A CAA record forbids this CA from issuing for the identifier. */
+export class AcmeCaa
+  extends /*@__PURE__*/ T.applyErrorMatchers(
+    /*@__PURE__*/ S.TaggedError<AcmeCaa>()("AcmeCaa", {
+      code: S.Number,
+      message: S.String,
+      type: S.String,
+      detail: S.String,
+    }),
+    [{ message: { matches: "^urn:ietf:params:acme:error:caa$" } }],
+  ) {}
+
+export class AcmeConnection
+  extends /*@__PURE__*/ T.applyErrorMatchers(
+    /*@__PURE__*/ S.TaggedError<AcmeConnection>()("AcmeConnection", {
+      code: S.Number,
+      message: S.String,
+      type: S.String,
+      detail: S.String,
+    }),
+    [{ message: { matches: "^urn:ietf:params:acme:error:connection$" } }],
+  ) {}
+
+/** The CA could not resolve the identifier (DNS-01 record missing or not propagated). */
+export class AcmeDns
+  extends /*@__PURE__*/ T.applyErrorMatchers(
+    /*@__PURE__*/ S.TaggedError<AcmeDns>()("AcmeDns", {
+      code: S.Number,
+      message: S.String,
+      type: S.String,
+      detail: S.String,
+    }),
+    [{ message: { matches: "^urn:ietf:params:acme:error:dns$" } }],
+  ) {}
+
+/** This CA needs an External Account Binding on newAccount (ZeroSSL, Google Trust Services). */
+export class AcmeExternalAccountRequired
+  extends /*@__PURE__*/ T.applyErrorMatchers(
+    /*@__PURE__*/ S.TaggedError<AcmeExternalAccountRequired>()(
+      "AcmeExternalAccountRequired",
+      {
+        code: S.Number,
+        message: S.String,
+        type: S.String,
+        detail: S.String,
+      },
+    ),
+    [
+      {
+        message: {
+          matches: "^urn:ietf:params:acme:error:externalAccountRequired$",
+        },
+      },
+    ],
+  ) {}
+
+export class AcmeIncorrectResponse
+  extends /*@__PURE__*/ T.applyErrorMatchers(
+    /*@__PURE__*/ S.TaggedError<AcmeIncorrectResponse>()(
+      "AcmeIncorrectResponse",
+      {
+        code: S.Number,
+        message: S.String,
+        type: S.String,
+        detail: S.String,
+      },
+    ),
+    [
+      {
+        message: { matches: "^urn:ietf:params:acme:error:incorrectResponse$" },
+      },
+    ],
+  ) {}
+
+export class AcmeInvalidContact
+  extends /*@__PURE__*/ T.applyErrorMatchers(
+    /*@__PURE__*/ S.TaggedError<AcmeInvalidContact>()("AcmeInvalidContact", {
+      code: S.Number,
+      message: S.String,
+      type: S.String,
+      detail: S.String,
+    }),
+    [{ message: { matches: "^urn:ietf:params:acme:error:invalidContact$" } }],
+  ) {}
+
+export class AcmeMalformed
+  extends /*@__PURE__*/ T.applyErrorMatchers(
+    /*@__PURE__*/ S.TaggedError<AcmeMalformed>()("AcmeMalformed", {
+      code: S.Number,
+      message: S.String,
+      type: S.String,
+      detail: S.String,
+    }),
+    [{ message: { matches: "^urn:ietf:params:acme:error:malformed$" } }],
+  ) {}
+
+/** finalize was called before every authorization was valid. */
+export class AcmeOrderNotReady
+  extends /*@__PURE__*/ T.applyErrorMatchers(
+    /*@__PURE__*/ S.TaggedError<AcmeOrderNotReady>()("AcmeOrderNotReady", {
+      code: S.Number,
+      message: S.String,
+      type: S.String,
+      detail: S.String,
+    }),
+    [{ message: { matches: "^urn:ietf:params:acme:error:orderNotReady$" } }],
+  ) {}
+
+/** The CA's rate limit was hit; `retryAfter` carries its hint when the CA sends one. */
+export class AcmeRateLimited
+  extends /*@__PURE__*/ T.applyErrorMatchers(
+    /*@__PURE__*/ S.TaggedError<AcmeRateLimited>()("AcmeRateLimited", {
+      retryAfter: S.optional(S.Duration),
+      code: S.Number,
+      message: S.String,
+      type: S.String,
+      detail: S.String,
+    }).pipe(C.withThrottlingError, C.withRetryableError),
+    [{ message: { matches: "^urn:ietf:params:acme:error:rateLimited$" } }],
+  ) {}
+
+/** The CA will not issue for this identifier (policy, blocklist). */
+export class AcmeRejectedIdentifier
+  extends /*@__PURE__*/ T.applyErrorMatchers(
+    /*@__PURE__*/ S.TaggedError<AcmeRejectedIdentifier>()(
+      "AcmeRejectedIdentifier",
+      {
+        code: S.Number,
+        message: S.String,
+        type: S.String,
+        detail: S.String,
+      },
+    ),
+    [
+      {
+        message: { matches: "^urn:ietf:params:acme:error:rejectedIdentifier$" },
+      },
+    ],
+  ) {}
+
+export class AcmeServerInternal
+  extends /*@__PURE__*/ T.applyErrorMatchers(
+    /*@__PURE__*/ S.TaggedError<AcmeServerInternal>()("AcmeServerInternal", {
+      code: S.Number,
+      message: S.String,
+      type: S.String,
+      detail: S.String,
+    }).pipe(C.withRetryableError),
+    [{ message: { matches: "^urn:ietf:params:acme:error:serverInternal$" } }],
+  ) {}
+
+export class AcmeTls
+  extends /*@__PURE__*/ T.applyErrorMatchers(
+    /*@__PURE__*/ S.TaggedError<AcmeTls>()("AcmeTls", {
+      code: S.Number,
+      message: S.String,
+      type: S.String,
+      detail: S.String,
+    }),
+    [{ message: { matches: "^urn:ietf:params:acme:error:tls$" } }],
+  ) {}
+
+export class AcmeUnauthorized
+  extends /*@__PURE__*/ T.applyErrorMatchers(
+    /*@__PURE__*/ S.TaggedError<AcmeUnauthorized>()("AcmeUnauthorized", {
+      code: S.Number,
+      message: S.String,
+      type: S.String,
+      detail: S.String,
+    }),
+    [{ message: { matches: "^urn:ietf:params:acme:error:unauthorized$" } }],
+  ) {}
+
+export class AcmeUnsupportedContact
+  extends /*@__PURE__*/ T.applyErrorMatchers(
+    /*@__PURE__*/ S.TaggedError<AcmeUnsupportedContact>()(
+      "AcmeUnsupportedContact",
+      {
+        code: S.Number,
+        message: S.String,
+        type: S.String,
+        detail: S.String,
+      },
+    ),
+    [
+      {
+        message: { matches: "^urn:ietf:params:acme:error:unsupportedContact$" },
+      },
+    ],
+  ) {}
+
+export class AcmeUnsupportedIdentifier
+  extends /*@__PURE__*/ T.applyErrorMatchers(
+    /*@__PURE__*/ S.TaggedError<AcmeUnsupportedIdentifier>()(
+      "AcmeUnsupportedIdentifier",
+      {
+        code: S.Number,
+        message: S.String,
+        type: S.String,
+        detail: S.String,
+      },
+    ),
+    [
+      {
+        message: {
+          matches: "^urn:ietf:params:acme:error:unsupportedIdentifier$",
+        },
+      },
+    ],
+  ) {}
+
+/** The CA needs a human step (new terms of service, a subscriber agreement); `detail` says what. */
+export class AcmeUserActionRequired
+  extends /*@__PURE__*/ T.applyErrorMatchers(
+    /*@__PURE__*/ S.TaggedError<AcmeUserActionRequired>()(
+      "AcmeUserActionRequired",
+      {
+        code: S.Number,
+        message: S.String,
+        type: S.String,
+        detail: S.String,
+      },
+    ),
+    [
+      {
+        message: { matches: "^urn:ietf:params:acme:error:userActionRequired$" },
+      },
+    ],
+  ) {}
+
+export interface DeactivateAuthorizationRequest {
+  /** Absolute URL of the resource, as returned by the CA. */
+  url: string;
+  /** Always `deactivated`. */
+  status: string;
+}
+export const DeactivateAuthorizationRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    url: S.String.pipe(T.Label()),
+    status: S.String,
+  }).pipe(
+    T.Http({ method: "POST", uri: "/authz/{url}/deactivate", code: 200 }),
+  ),
+).annotate({
+  identifier: "DeactivateAuthorizationRequest",
+}) as any as S.Schema<DeactivateAuthorizationRequest>;
+
+export interface Identifier {
+  /** `dns` (RFC 8555) or `ip` (RFC 8738). */
+  type: string;
+  value: string;
+}
+export const Identifier = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    type: S.String,
+    value: S.String,
+  }),
+).annotate({ identifier: "Identifier" }) as any as S.Schema<Identifier>;
+
+export interface Subproblem {
+  type?: string;
+  detail?: string;
+  identifier?: Identifier;
+}
+export const Subproblem = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    type: S.optional(S.String),
+    detail: S.optional(S.String),
+    identifier: S.optional(Identifier),
+  }),
+).annotate({ identifier: "Subproblem" }) as any as S.Schema<Subproblem>;
+
+export type ProblemSubproblemsList = Array<Subproblem>;
+export const ProblemSubproblemsList = /*@__PURE__*/ S.Array(
+  Subproblem,
+) as any as S.Schema<ProblemSubproblemsList>;
+
+/** RFC 7807 problem document (RFC 8555 §6.7). */
+export interface Problem {
+  type?: string;
+  detail?: string;
+  status?: number;
+  instance?: string;
+  identifier?: Identifier;
+  subproblems?: ProblemSubproblemsList;
+}
+export const Problem = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    type: S.optional(S.String),
+    detail: S.optional(S.String),
+    status: S.optional(S.Number),
+    instance: S.optional(S.String),
+    identifier: S.optional(Identifier),
+    subproblems: S.optional(ProblemSubproblemsList),
+  }),
+).annotate({ identifier: "Problem" }) as any as S.Schema<Problem>;
+
+/** RFC 8555 §8 */
+export interface Challenge {
+  /** dns-01 | http-01 | tls-alpn-01 */
+  type: string;
+  url: string;
+  /** pending | processing | valid | invalid */
+  status: string;
+  validated?: string;
+  token?: string;
+  error?: Problem;
+}
+export const Challenge = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    type: S.String,
+    url: S.String,
+    status: S.String,
+    validated: S.optional(S.String),
+    token: S.optional(S.String),
+    error: S.optional(Problem),
+  }),
+).annotate({ identifier: "Challenge" }) as any as S.Schema<Challenge>;
+
+export type AuthorizationChallengesList = Array<Challenge>;
+export const AuthorizationChallengesList = /*@__PURE__*/ S.Array(
+  Challenge,
+) as any as S.Schema<AuthorizationChallengesList>;
+
+/** RFC 8555 §7.1.4 */
+export interface Authorization {
+  identifier: Identifier;
+  /** pending | valid | invalid | deactivated | expired | revoked */
+  status: string;
+  expires?: string;
+  challenges: AuthorizationChallengesList;
+  wildcard?: boolean;
+}
+export const Authorization = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    identifier: Identifier,
+    status: S.String,
+    expires: S.optional(S.String),
+    challenges: AuthorizationChallengesList,
+    wildcard: S.optional(S.Boolean),
+  }),
+).annotate({ identifier: "Authorization" }) as any as S.Schema<Authorization>;
+
+export interface DownloadCertificateRequest {
+  /** Absolute URL of the resource, as returned by the CA. */
+  url: string;
+}
+export const DownloadCertificateRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    url: S.String.pipe(T.Label()),
+  }).pipe(T.Http({ method: "POST", uri: "/cert/{url}", code: 200 })),
+).annotate({
+  identifier: "DownloadCertificateRequest",
+}) as any as S.Schema<DownloadCertificateRequest>;
+
+/** Alternate chain URLs from `Link: <url>;rel="alternate"` headers. */
+export type CertificateChainAlternatesList = Array<string>;
+export const CertificateChainAlternatesList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<CertificateChainAlternatesList>;
+
+export interface CertificateChain {
+  /** PEM certificate chain (`application/pem-certificate-chain`), leaf first. */
+  chain: string;
+  /** Alternate chain URLs from `Link: <url>;rel="alternate"` headers. */
+  alternates?: CertificateChainAlternatesList;
+}
+export const CertificateChain = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    chain: S.String,
+    alternates: S.optional(CertificateChainAlternatesList),
+  }),
+).annotate({
+  identifier: "CertificateChain",
+}) as any as S.Schema<CertificateChain>;
+
+export interface FinalizeOrderRequest {
+  /** Absolute URL of the resource, as returned by the CA. */
+  url: string;
+  /** base64url DER PKCS#10 CSR. */
+  csr: string;
+}
+export const FinalizeOrderRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    url: S.String.pipe(T.Label()),
+    csr: S.String,
+  }).pipe(T.Http({ method: "POST", uri: "/finalize/{url}", code: 200 })),
+).annotate({
+  identifier: "FinalizeOrderRequest",
+}) as any as S.Schema<FinalizeOrderRequest>;
+
+export type OrderResponseIdentifiersList = Array<Identifier>;
+export const OrderResponseIdentifiersList = /*@__PURE__*/ S.Array(
+  Identifier,
+) as any as S.Schema<OrderResponseIdentifiersList>;
+
+export type OrderResponseAuthorizationsList = Array<string>;
+export const OrderResponseAuthorizationsList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<OrderResponseAuthorizationsList>;
+
+/** RFC 8555 §7.1.3, plus the `Location` header as `location`. */
+export interface OrderResponse {
+  /** pending | ready | processing | valid | invalid */
+  status: string;
+  expires?: string;
+  identifiers: OrderResponseIdentifiersList;
+  notBefore?: string;
+  notAfter?: string;
+  error?: Problem;
+  authorizations: OrderResponseAuthorizationsList;
+  finalize: string;
+  certificate?: string;
+  /** The order URL (`Location` header). */
+  location?: string;
+}
+export const OrderResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    status: S.String,
+    expires: S.optional(S.String),
+    identifiers: OrderResponseIdentifiersList,
+    notBefore: S.optional(S.String),
+    notAfter: S.optional(S.String),
+    error: S.optional(Problem),
+    authorizations: OrderResponseAuthorizationsList,
+    finalize: S.String,
+    certificate: S.optional(S.String),
+    location: S.optional(S.String),
+  }),
+).annotate({ identifier: "OrderResponse" }) as any as S.Schema<OrderResponse>;
+
+export interface GetAuthorizationRequest {
+  /** Absolute URL of the resource, as returned by the CA. */
+  url: string;
+}
+export const GetAuthorizationRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    url: S.String.pipe(T.Label()),
+  }).pipe(T.Http({ method: "POST", uri: "/authz/{url}", code: 200 })),
+).annotate({
+  identifier: "GetAuthorizationRequest",
+}) as any as S.Schema<GetAuthorizationRequest>;
+
+export interface GetDirectoryRequest {}
+export const GetDirectoryRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}).pipe(T.Http({ method: "GET", uri: "/directory", code: 200 })),
+).annotate({
+  identifier: "GetDirectoryRequest",
+}) as any as S.Schema<GetDirectoryRequest>;
+
+export type DirectoryMetaCaaIdentitiesList = Array<string>;
+export const DirectoryMetaCaaIdentitiesList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<DirectoryMetaCaaIdentitiesList>;
+
+export interface DirectoryMeta {
+  termsOfService?: string;
+  website?: string;
+  caaIdentities?: DirectoryMetaCaaIdentitiesList;
+  externalAccountRequired?: boolean;
+}
+export const DirectoryMeta = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    termsOfService: S.optional(S.String),
+    website: S.optional(S.String),
+    caaIdentities: S.optional(DirectoryMetaCaaIdentitiesList),
+    externalAccountRequired: S.optional(S.Boolean),
+  }),
+).annotate({ identifier: "DirectoryMeta" }) as any as S.Schema<DirectoryMeta>;
+
+/** RFC 8555 §7.1.1 */
+export interface Directory {
+  newNonce: string;
+  newAccount: string;
+  newOrder: string;
+  newAuthz?: string;
+  revokeCert: string;
+  keyChange?: string;
+  meta?: DirectoryMeta;
+}
+export const Directory = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    newNonce: S.String,
+    newAccount: S.String,
+    newOrder: S.String,
+    newAuthz: S.optional(S.String),
+    revokeCert: S.String,
+    keyChange: S.optional(S.String),
+    meta: S.optional(DirectoryMeta),
+  }),
+).annotate({ identifier: "Directory" }) as any as S.Schema<Directory>;
+
+export interface GetOrderRequest {
+  /** Absolute URL of the resource, as returned by the CA. */
+  url: string;
+}
+export const GetOrderRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    url: S.String.pipe(T.Label()),
+  }).pipe(T.Http({ method: "POST", uri: "/order/{url}", code: 200 })),
+).annotate({
+  identifier: "GetOrderRequest",
+}) as any as S.Schema<GetOrderRequest>;
+
+export type NewAccountRequestContactList = Array<string>;
+export const NewAccountRequestContactList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<NewAccountRequestContactList>;
+
+/** A JWS binding this account to an existing CA account (RFC 8555 §7.3.4). The protocol builds it from the credentials' EAB key when the CA requires one. */
+export interface ExternalAccountBinding {
+  protected: string;
+  payload: string;
+  signature: string;
+}
+export const ExternalAccountBinding = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    protected: S.String,
+    payload: S.String,
+    signature: S.String,
+  }),
+).annotate({
+  identifier: "ExternalAccountBinding",
+}) as any as S.Schema<ExternalAccountBinding>;
+
+export interface NewAccountRequest {
+  contact?: NewAccountRequestContactList;
+  termsOfServiceAgreed?: boolean;
+  onlyReturnExisting?: boolean;
+  externalAccountBinding?: ExternalAccountBinding;
+}
+export const NewAccountRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    contact: S.optional(NewAccountRequestContactList),
+    termsOfServiceAgreed: S.optional(S.Boolean),
+    onlyReturnExisting: S.optional(S.Boolean),
+    externalAccountBinding: S.optional(ExternalAccountBinding),
+  }).pipe(T.Http({ method: "POST", uri: "/newAccount", code: 200 })),
+).annotate({
+  identifier: "NewAccountRequest",
+}) as any as S.Schema<NewAccountRequest>;
+
+export type AccountResponseContactList = Array<string>;
+export const AccountResponseContactList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<AccountResponseContactList>;
+
+/** RFC 8555 §7.1.2, plus the `Location` header as `location`. */
+export interface AccountResponse {
+  status: string;
+  contact?: AccountResponseContactList;
+  termsOfServiceAgreed?: boolean;
+  orders?: string;
+  /** The account URL (`Location` header); the `kid` for every later request. */
+  location?: string;
+}
+export const AccountResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    status: S.String,
+    contact: S.optional(AccountResponseContactList),
+    termsOfServiceAgreed: S.optional(S.Boolean),
+    orders: S.optional(S.String),
+    location: S.optional(S.String),
+  }),
+).annotate({
+  identifier: "AccountResponse",
+}) as any as S.Schema<AccountResponse>;
+
+export interface NewNonceRequest {}
+export const NewNonceRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}).pipe(T.Http({ method: "GET", uri: "/newNonce", code: 200 })),
+).annotate({
+  identifier: "NewNonceRequest",
+}) as any as S.Schema<NewNonceRequest>;
+
+export interface NonceResponse {
+  /** The `Replay-Nonce` header. */
+  replayNonce: string;
+}
+export const NonceResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    replayNonce: S.String,
+  }),
+).annotate({ identifier: "NonceResponse" }) as any as S.Schema<NonceResponse>;
+
+export type NewOrderRequestIdentifiersList = Array<Identifier>;
+export const NewOrderRequestIdentifiersList = /*@__PURE__*/ S.Array(
+  Identifier,
+) as any as S.Schema<NewOrderRequestIdentifiersList>;
+
+export interface NewOrderRequest {
+  identifiers: NewOrderRequestIdentifiersList;
+  notBefore?: string;
+  notAfter?: string;
+}
+export const NewOrderRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    identifiers: NewOrderRequestIdentifiersList,
+    notBefore: S.optional(S.String),
+    notAfter: S.optional(S.String),
+  }).pipe(T.Http({ method: "POST", uri: "/newOrder", code: 200 })),
+).annotate({
+  identifier: "NewOrderRequest",
+}) as any as S.Schema<NewOrderRequest>;
+
+export interface RespondChallengeRequest {
+  /** Absolute URL of the resource, as returned by the CA. */
+  url: string;
+}
+export const RespondChallengeRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    url: S.String.pipe(T.Label()),
+  }).pipe(T.Http({ method: "POST", uri: "/challenge/{url}", code: 200 })),
+).annotate({
+  identifier: "RespondChallengeRequest",
+}) as any as S.Schema<RespondChallengeRequest>;
+
+export interface RevokeCertificateRequest {
+  /** base64url DER of the certificate to revoke. */
+  certificate: string;
+  /** RFC 5280 CRLReason code. */
+  reason?: number;
+}
+export const RevokeCertificateRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    certificate: S.String,
+    reason: S.optional(S.Number),
+  }).pipe(T.Http({ method: "POST", uri: "/revokeCert", code: 200 })),
+).annotate({
+  identifier: "RevokeCertificateRequest",
+}) as any as S.Schema<RevokeCertificateRequest>;
+
+export interface RevokeCertificateResponse {}
+export const RevokeCertificateResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "RevokeCertificateResponse",
+}) as any as S.Schema<RevokeCertificateResponse>;
+
+export type UpdateAccountRequestContactList = Array<string>;
+export const UpdateAccountRequestContactList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<UpdateAccountRequestContactList>;
+
+export interface UpdateAccountRequest {
+  /** Absolute URL of the resource, as returned by the CA. */
+  url: string;
+  contact?: UpdateAccountRequestContactList;
+  /** `deactivated` to deactivate the account. */
+  status?: string;
+}
+export const UpdateAccountRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    url: S.String.pipe(T.Label()),
+    contact: S.optional(UpdateAccountRequestContactList),
+    status: S.optional(S.String),
+  }).pipe(T.Http({ method: "POST", uri: "/account/{url}", code: 200 })),
+).annotate({
+  identifier: "UpdateAccountRequest",
+}) as any as S.Schema<UpdateAccountRequest>;
+
+export type DeactivateAuthorizationError =
+  | AcmeAccountDoesNotExist
+  | AcmeBadNonce
+  | AcmeMalformed
+  | AcmeRateLimited
+  | AcmeServerInternal
+  | AcmeUnauthorized
+  | AcmeOpError;
+/** Deactivate the authorization at `url` */
+export const deactivateAuthorization: API.OperationMethod<
+  DeactivateAuthorizationRequest,
+  Authorization,
+  DeactivateAuthorizationError,
+  AcmeOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: DeactivateAuthorizationRequest,
+  output: Authorization,
+  errors: [
+    AcmeAccountDoesNotExist,
+    AcmeBadNonce,
+    AcmeMalformed,
+    AcmeRateLimited,
+    AcmeServerInternal,
+    AcmeUnauthorized,
+  ],
+  protocol: AcmeProtocol,
+  retry: Retry.Retry,
+}));
+
+export type DownloadCertificateError =
+  | AcmeAccountDoesNotExist
+  | AcmeBadNonce
+  | AcmeMalformed
+  | AcmeRateLimited
+  | AcmeServerInternal
+  | AcmeUnauthorized
+  | AcmeOpError;
+/** Download the PEM certificate chain at `url` (POST-as-GET) */
+export const downloadCertificate: API.OperationMethod<
+  DownloadCertificateRequest,
+  CertificateChain,
+  DownloadCertificateError,
+  AcmeOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: DownloadCertificateRequest,
+  output: CertificateChain,
+  errors: [
+    AcmeAccountDoesNotExist,
+    AcmeBadNonce,
+    AcmeMalformed,
+    AcmeRateLimited,
+    AcmeServerInternal,
+    AcmeUnauthorized,
+  ],
+  protocol: AcmeProtocol,
+  retry: Retry.Retry,
+}));
+
+export type FinalizeOrderError =
+  | AcmeAccountDoesNotExist
+  | AcmeBadCsr
+  | AcmeBadNonce
+  | AcmeMalformed
+  | AcmeOrderNotReady
+  | AcmeRateLimited
+  | AcmeServerInternal
+  | AcmeUnauthorized
+  | AcmeOpError;
+/** Submit the CSR to the order's finalize URL */
+export const finalizeOrder: API.OperationMethod<
+  FinalizeOrderRequest,
+  OrderResponse,
+  FinalizeOrderError,
+  AcmeOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: FinalizeOrderRequest,
+  output: OrderResponse,
+  errors: [
+    AcmeAccountDoesNotExist,
+    AcmeBadCsr,
+    AcmeBadNonce,
+    AcmeMalformed,
+    AcmeOrderNotReady,
+    AcmeRateLimited,
+    AcmeServerInternal,
+    AcmeUnauthorized,
+  ],
+  protocol: AcmeProtocol,
+  retry: Retry.Retry,
+}));
+
+export type GetAuthorizationError =
+  | AcmeAccountDoesNotExist
+  | AcmeBadNonce
+  | AcmeMalformed
+  | AcmeRateLimited
+  | AcmeServerInternal
+  | AcmeUnauthorized
+  | AcmeOpError;
+/** Fetch the authorization at `url` (POST-as-GET) */
+export const getAuthorization: API.OperationMethod<
+  GetAuthorizationRequest,
+  Authorization,
+  GetAuthorizationError,
+  AcmeOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: GetAuthorizationRequest,
+  output: Authorization,
+  errors: [
+    AcmeAccountDoesNotExist,
+    AcmeBadNonce,
+    AcmeMalformed,
+    AcmeRateLimited,
+    AcmeServerInternal,
+    AcmeUnauthorized,
+  ],
+  protocol: AcmeProtocol,
+  retry: Retry.Retry,
+}));
+
+export type GetDirectoryError = AcmeOpError;
+/** Fetch the CA's directory of resource URLs */
+export const getDirectory: API.OperationMethod<
+  GetDirectoryRequest,
+  Directory,
+  GetDirectoryError,
+  AcmeOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: GetDirectoryRequest,
+  output: Directory,
+  errors: [],
+  protocol: AcmeProtocol,
+  retry: Retry.Retry,
+}));
+
+export type GetOrderError =
+  | AcmeAccountDoesNotExist
+  | AcmeBadNonce
+  | AcmeMalformed
+  | AcmeRateLimited
+  | AcmeServerInternal
+  | AcmeUnauthorized
+  | AcmeOpError;
+/** Fetch the order at `url` (POST-as-GET) */
+export const getOrder: API.OperationMethod<
+  GetOrderRequest,
+  OrderResponse,
+  GetOrderError,
+  AcmeOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: GetOrderRequest,
+  output: OrderResponse,
+  errors: [
+    AcmeAccountDoesNotExist,
+    AcmeBadNonce,
+    AcmeMalformed,
+    AcmeRateLimited,
+    AcmeServerInternal,
+    AcmeUnauthorized,
+  ],
+  protocol: AcmeProtocol,
+  retry: Retry.Retry,
+}));
+
+export type NewAccountError =
+  | AcmeAccountDoesNotExist
+  | AcmeBadNonce
+  | AcmeBadPublicKey
+  | AcmeBadSignatureAlgorithm
+  | AcmeExternalAccountRequired
+  | AcmeInvalidContact
+  | AcmeMalformed
+  | AcmeRateLimited
+  | AcmeServerInternal
+  | AcmeUnauthorized
+  | AcmeUnsupportedContact
+  | AcmeUserActionRequired
+  | AcmeOpError;
+/** Create an account, or find the existing account for this key */
+export const newAccount: API.OperationMethod<
+  NewAccountRequest,
+  AccountResponse,
+  NewAccountError,
+  AcmeOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: NewAccountRequest,
+  output: AccountResponse,
+  errors: [
+    AcmeAccountDoesNotExist,
+    AcmeBadNonce,
+    AcmeBadPublicKey,
+    AcmeBadSignatureAlgorithm,
+    AcmeExternalAccountRequired,
+    AcmeInvalidContact,
+    AcmeMalformed,
+    AcmeRateLimited,
+    AcmeServerInternal,
+    AcmeUnauthorized,
+    AcmeUnsupportedContact,
+    AcmeUserActionRequired,
+  ],
+  protocol: AcmeProtocol,
+  retry: Retry.Retry,
+}));
+
+export type NewNonceError = AcmeOpError;
+/** Get a fresh anti-replay nonce (the `Replay-Nonce` header) */
+export const newNonce: API.OperationMethod<
+  NewNonceRequest,
+  NonceResponse,
+  NewNonceError,
+  AcmeOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: NewNonceRequest,
+  output: NonceResponse,
+  errors: [],
+  protocol: AcmeProtocol,
+  retry: Retry.Retry,
+}));
+
+export type NewOrderError =
+  | AcmeAccountDoesNotExist
+  | AcmeBadNonce
+  | AcmeMalformed
+  | AcmeRateLimited
+  | AcmeRejectedIdentifier
+  | AcmeServerInternal
+  | AcmeUnauthorized
+  | AcmeUnsupportedIdentifier
+  | AcmeUserActionRequired
+  | AcmeOpError;
+/** Create an order for a set of identifiers */
+export const newOrder: API.OperationMethod<
+  NewOrderRequest,
+  OrderResponse,
+  NewOrderError,
+  AcmeOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: NewOrderRequest,
+  output: OrderResponse,
+  errors: [
+    AcmeAccountDoesNotExist,
+    AcmeBadNonce,
+    AcmeMalformed,
+    AcmeRateLimited,
+    AcmeRejectedIdentifier,
+    AcmeServerInternal,
+    AcmeUnauthorized,
+    AcmeUnsupportedIdentifier,
+    AcmeUserActionRequired,
+  ],
+  protocol: AcmeProtocol,
+  retry: Retry.Retry,
+}));
+
+export type RespondChallengeError =
+  | AcmeAccountDoesNotExist
+  | AcmeBadNonce
+  | AcmeCaa
+  | AcmeConnection
+  | AcmeDns
+  | AcmeIncorrectResponse
+  | AcmeMalformed
+  | AcmeRateLimited
+  | AcmeServerInternal
+  | AcmeTls
+  | AcmeUnauthorized
+  | AcmeOpError;
+/** Tell the CA the challenge at `url` is ready to be validated */
+export const respondChallenge: API.OperationMethod<
+  RespondChallengeRequest,
+  Challenge,
+  RespondChallengeError,
+  AcmeOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: RespondChallengeRequest,
+  output: Challenge,
+  errors: [
+    AcmeAccountDoesNotExist,
+    AcmeBadNonce,
+    AcmeCaa,
+    AcmeConnection,
+    AcmeDns,
+    AcmeIncorrectResponse,
+    AcmeMalformed,
+    AcmeRateLimited,
+    AcmeServerInternal,
+    AcmeTls,
+    AcmeUnauthorized,
+  ],
+  protocol: AcmeProtocol,
+  retry: Retry.Retry,
+}));
+
+export type RevokeCertificateError =
+  | AcmeAccountDoesNotExist
+  | AcmeAlreadyRevoked
+  | AcmeBadNonce
+  | AcmeBadRevocationReason
+  | AcmeMalformed
+  | AcmeRateLimited
+  | AcmeServerInternal
+  | AcmeUnauthorized
+  | AcmeOpError;
+/** Revoke a certificate */
+export const revokeCertificate: API.OperationMethod<
+  RevokeCertificateRequest,
+  RevokeCertificateResponse,
+  RevokeCertificateError,
+  AcmeOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: RevokeCertificateRequest,
+  output: RevokeCertificateResponse,
+  errors: [
+    AcmeAccountDoesNotExist,
+    AcmeAlreadyRevoked,
+    AcmeBadNonce,
+    AcmeBadRevocationReason,
+    AcmeMalformed,
+    AcmeRateLimited,
+    AcmeServerInternal,
+    AcmeUnauthorized,
+  ],
+  protocol: AcmeProtocol,
+  retry: Retry.Retry,
+}));
+
+export type UpdateAccountError =
+  | AcmeAccountDoesNotExist
+  | AcmeBadNonce
+  | AcmeInvalidContact
+  | AcmeMalformed
+  | AcmeRateLimited
+  | AcmeServerInternal
+  | AcmeUnauthorized
+  | AcmeUnsupportedContact
+  | AcmeOpError;
+/** Update (or deactivate) the account at `url` */
+export const updateAccount: API.OperationMethod<
+  UpdateAccountRequest,
+  AccountResponse,
+  UpdateAccountError,
+  AcmeOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: UpdateAccountRequest,
+  output: AccountResponse,
+  errors: [
+    AcmeAccountDoesNotExist,
+    AcmeBadNonce,
+    AcmeInvalidContact,
+    AcmeMalformed,
+    AcmeRateLimited,
+    AcmeServerInternal,
+    AcmeUnauthorized,
+    AcmeUnsupportedContact,
+  ],
+  protocol: AcmeProtocol,
+  retry: Retry.Retry,
+}));