@distilled.cloud/stackit 0.0.0-placeholder → 1.0.0-rc.13

package/src/services/cdn.ts

@@ -0,0 +1,2736 @@
+// AUTO-GENERATED by scripts/generate.ts from .generated-specs (specs/spec-mirror-stackit). Do not edit.
+import * as S from "@distilled.cloud/core/schema";
+import * as Redacted from "effect/Redacted";
+import * as API from "@distilled.cloud/core/api";
+import * as C from "@distilled.cloud/core/category";
+import * as T from "../traits.ts";
+import {
+  StackitProtocol,
+  type StackitOpError,
+  type StackitOpContext,
+} from "../protocol.ts";
+import { UnknownStackitError } from "../errors.ts";
+import * as Retry from "../retry.ts";
+
+export type { StackitOpError, StackitOpContext };
+
+export class BadRequest
+  extends /*@__PURE__*/ T.applyErrorMatchers(
+    /*@__PURE__*/ S.TaggedError<BadRequest>()("BadRequest", {
+      code: S.Number,
+      message: S.String,
+    }).pipe(C.withBadRequestError),
+    [{ status: 400 }],
+  ) {}
+
+export class NotFound
+  extends /*@__PURE__*/ T.applyErrorMatchers(
+    /*@__PURE__*/ S.TaggedError<NotFound>()("NotFound", {
+      code: S.Number,
+      message: S.String,
+    }).pipe(C.withBadRequestError),
+    [{ status: 404 }],
+  ) {}
+
+export class UnprocessableEntity
+  extends /*@__PURE__*/ T.applyErrorMatchers(
+    /*@__PURE__*/ S.TaggedError<UnprocessableEntity>()("UnprocessableEntity", {
+      code: S.Number,
+      message: S.String,
+    }).pipe(C.withBadRequestError),
+    [{ status: 422 }],
+  ) {}
+
+export type HttpBackendCreateGeofencingValueList = Array<string>;
+export const HttpBackendCreateGeofencingValueList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<HttpBackendCreateGeofencingValueList>;
+
+/** An object mapping multiple alternative origins to country codes. Any request from one of those country codes will route to the alternative origin. Do note that country codes may only be used once. You cannot have a country be assigned to multiple alternative origins. */
+export type HttpBackendCreateGeofencingMap = {
+  [key: string]: HttpBackendCreateGeofencingValueList | undefined;
+};
+export const HttpBackendCreateGeofencingMap = /*@__PURE__*/ S.Record(
+  S.String,
+  HttpBackendCreateGeofencingValueList,
+) as any as S.Schema<HttpBackendCreateGeofencingMap>;
+
+/** Headers that will be sent with every request to the configured origin. **WARNING**: Do not store sensitive values in the headers. The configuration is stored as plain text. */
+export type HttpBackendCreateOriginRequestHeadersMap = {
+  [key: string]: string | undefined;
+};
+export const HttpBackendCreateOriginRequestHeadersMap = /*@__PURE__*/ S.Record(
+  S.String,
+  S.String,
+) as any as S.Schema<HttpBackendCreateOriginRequestHeadersMap>;
+
+/** Defines the type of content origin. For this schema, it must be set to `http`. */
+export type HttpBackendCreateType = "http";
+export const HttpBackendCreateType = /*@__PURE__*/ S.String;
+
+export interface HttpBackendCreate {
+  /** An object mapping multiple alternative origins to country codes. Any request from one of those country codes will route to the alternative origin. Do note that country codes may only be used once. You cannot have a country be assigned to multiple alternative origins. */
+  geofencing?: HttpBackendCreateGeofencingMap;
+  /** Headers that will be sent with every request to the configured origin. **WARNING**: Do not store sensitive values in the headers. The configuration is stored as plain text. */
+  originRequestHeaders?: HttpBackendCreateOriginRequestHeadersMap;
+  /** The origin of the content that should be made available through the CDN. Note that the path and query parameters are ignored. Ports are allowed. If no protocol is provided, `https` is assumed. So `www.example.com:1234/somePath?q=123` is normalized to `https://www.example.com:1234` */
+  originUrl: string;
+  /** Defines the type of content origin. For this schema, it must be set to `http`. */
+  type: HttpBackendCreateType;
+}
+export const HttpBackendCreate = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    geofencing: S.optional(HttpBackendCreateGeofencingMap),
+    originRequestHeaders: S.optional(HttpBackendCreateOriginRequestHeadersMap),
+    originUrl: S.String,
+    type: HttpBackendCreateType,
+  }),
+).annotate({
+  identifier: "HttpBackendCreate",
+}) as any as S.Schema<HttpBackendCreate>;
+
+export interface BucketCredentials {
+  accessKeyId: string | Redacted.Redacted<string>;
+  secretAccessKey: string | Redacted.Redacted<string>;
+}
+export const BucketCredentials = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    accessKeyId: S.String.pipe(T.SensitiveValue({})),
+    secretAccessKey: S.String.pipe(T.SensitiveValue({})),
+  }),
+).annotate({
+  identifier: "BucketCredentials",
+}) as any as S.Schema<BucketCredentials>;
+
+/** Defines the type of content origin. For this schema, it must be set to `bucket`. */
+export type BucketBackendCreateType = "bucket";
+export const BucketBackendCreateType = /*@__PURE__*/ S.String;
+
+export interface BucketBackendCreate {
+  /** The fully qualified URL of your cloud storage bucket (for example, `https://s3.eu-central-1.amazonaws.com/my-bucket`). */
+  bucketUrl: string;
+  credentials: BucketCredentials;
+  /** The cloud provider region where your storage bucket is located (for example, `us-west-1` for AWS or `eu01` for STACKIT). */
+  region: string;
+  /** Defines the type of content origin. For this schema, it must be set to `bucket`. */
+  type: BucketBackendCreateType;
+}
+export const BucketBackendCreate = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    bucketUrl: S.String,
+    credentials: BucketCredentials,
+    region: S.String,
+    type: BucketBackendCreateType,
+  }),
+).annotate({
+  identifier: "BucketBackendCreate",
+}) as any as S.Schema<BucketBackendCreate>;
+
+/** Configuration for the content origin backend. */
+export type CreateDistributionRequestBackend =
+  | HttpBackendCreate
+  | BucketBackendCreate;
+export const CreateDistributionRequestBackend =
+  /*@__PURE__*/ S.Unknown as any as S.Schema<CreateDistributionRequestBackend>;
+
+/** Restricts access to your content based on country. We use the ISO 3166-1 alpha-2 standard for country codes (e.g., DE, ES, GB). This setting blocks users from the specified countries. */
+export type CreateDistributionRequestBlockedCountriesList = Array<string>;
+export const CreateDistributionRequestBlockedCountriesList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<CreateDistributionRequestBlockedCountriesList>;
+
+/** Restricts access to your content by specifying a list of blocked IPv4 addresses. This feature enhances security and privacy by preventing these addresses from accessing your distribution. */
+export type CreateDistributionRequestBlockedIpsList = Array<string>;
+export const CreateDistributionRequestBlockedIpsList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<CreateDistributionRequestBlockedIpsList>;
+
+/** HTTP request header names whose values participate in the cache key. Each entry multiplies the number of cache variants by the number of distinct values observed for that header. */
+export type CacheConfigCreateCacheKeyHeadersList = Array<string>;
+export const CacheConfigCreateCacheKeyHeadersList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<CacheConfigCreateCacheKeyHeadersList>;
+
+/** Allowlist of query-string parameter names that participate in the cache key when `queryStringVaryEnabled` is true. Ignored while `queryStringVaryEnabled` is false, but still stored so it can be re-activated without losing the list. */
+export type CacheConfigCreateQueryStringVaryParametersList = Array<string>;
+export const CacheConfigCreateQueryStringVaryParametersList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<CacheConfigCreateQueryStringVaryParametersList>;
+
+/** Groups the cache options that influence how the CDN builds its cache key on distribution creation. **Cache cardinality warning:** enabling query-string vary produces one cache entry per unique query-string combination (**unbounded** when `queryStringVaryParameters` is empty). Each entry in `cacheKeyHeaders` multiplies the number of cache variants by the number of distinct values observed for that header. Use these settings sparingly. `queryStringVaryParameters` is stored independently of `queryStringVaryEnabled` so that this feature can be toggled on and off without losing the configured allowlist. Only `queryStringVaryEnabled` gates whether the parameter allowlist actually varies the cache. **Optimizer interaction:** when the Optimizer is enabled, the CDN automatically enables query-string vary for image responses regardless of this setting. */
+export interface CacheConfigCreate {
+  /** HTTP request header names whose values participate in the cache key. Each entry multiplies the number of cache variants by the number of distinct values observed for that header. */
+  cacheKeyHeaders?: CacheConfigCreateCacheKeyHeadersList;
+  /** When true, the CDN varies its cache by the request query string. If `queryStringVaryParameters` is empty, every unique query-string combination produces its own cache entry; if non-empty, only the listed parameters influence the cache key. */
+  queryStringVaryEnabled?: boolean;
+  /** Allowlist of query-string parameter names that participate in the cache key when `queryStringVaryEnabled` is true. Ignored while `queryStringVaryEnabled` is false, but still stored so it can be re-activated without losing the list. */
+  queryStringVaryParameters?: CacheConfigCreateQueryStringVaryParametersList;
+}
+export const CacheConfigCreate = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    cacheKeyHeaders: S.optional(CacheConfigCreateCacheKeyHeadersList),
+    queryStringVaryEnabled: S.optional(S.Boolean),
+    queryStringVaryParameters: S.optional(
+      CacheConfigCreateQueryStringVaryParametersList,
+    ),
+  }),
+).annotate({
+  identifier: "CacheConfigCreate",
+}) as any as S.Schema<CacheConfigCreate>;
+
+/** Labels are key-value string pairs that can be attached to a distribution. */
+export type CreateDistributionRequestLabelsMap = {
+  [key: string]: string | undefined;
+};
+export const CreateDistributionRequestLabelsMap = /*@__PURE__*/ S.Record(
+  S.String,
+  S.String,
+) as any as S.Schema<CreateDistributionRequestLabelsMap>;
+
+/** The authentication credentials required for the CDN to push logs to your Loki instance. */
+export interface LokiLogSinkCredentials {
+  /** The password corresponding to your username. */
+  password: string | Redacted.Redacted<string>;
+  /** The username used to authenticate against your Loki instance. */
+  username: string;
+}
+export const LokiLogSinkCredentials = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    password: S.String.pipe(T.SensitiveValue({})),
+    username: S.String,
+  }),
+).annotate({
+  identifier: "LokiLogSinkCredentials",
+}) as any as S.Schema<LokiLogSinkCredentials>;
+
+/** Defines the type of the log sink. For Grafana Loki, this must be set to `loki`. */
+export type LokiLogSinkCreateType = "loki";
+export const LokiLogSinkCreateType = /*@__PURE__*/ S.String;
+
+export interface LokiLogSinkCreate {
+  credentials: LokiLogSinkCredentials;
+  /** The fully qualified URL where the CDN should push logs to your Loki instance (for example, `https://loki.example.com/loki/api/v1/push`). */
+  pushUrl: string;
+  /** Defines the type of the log sink. For Grafana Loki, this must be set to `loki`. */
+  type: LokiLogSinkCreateType;
+}
+export const LokiLogSinkCreate = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    credentials: LokiLogSinkCredentials,
+    pushUrl: S.String,
+    type: LokiLogSinkCreateType,
+  }),
+).annotate({
+  identifier: "LokiLogSinkCreate",
+}) as any as S.Schema<LokiLogSinkCreate>;
+
+/** Defines bearer token authentication. */
+export type OtlpLogSinkBearerCredentialsType = "bearer";
+export const OtlpLogSinkBearerCredentialsType = /*@__PURE__*/ S.String;
+
+/** Bearer token authentication credentials for OTLP. */
+export interface OtlpLogSinkBearerCredentials {
+  /** The bearer token used to authenticate against your OTLP endpoint. */
+  token: string;
+  /** Defines bearer token authentication. */
+  type: OtlpLogSinkBearerCredentialsType;
+}
+export const OtlpLogSinkBearerCredentials = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    token: S.String,
+    type: OtlpLogSinkBearerCredentialsType,
+  }),
+).annotate({
+  identifier: "OtlpLogSinkBearerCredentials",
+}) as any as S.Schema<OtlpLogSinkBearerCredentials>;
+
+/** Defines basic authentication. */
+export type OtlpLogSinkBasicCredentialsType = "basic";
+export const OtlpLogSinkBasicCredentialsType = /*@__PURE__*/ S.String;
+
+/** Basic authentication credentials for OTLP. */
+export interface OtlpLogSinkBasicCredentials {
+  /** The password corresponding to your username. */
+  password: string | Redacted.Redacted<string>;
+  /** Defines basic authentication. */
+  type: OtlpLogSinkBasicCredentialsType;
+  /** The username used to authenticate against your OTLP endpoint. */
+  username: string;
+}
+export const OtlpLogSinkBasicCredentials = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    password: S.String.pipe(T.SensitiveValue({})),
+    type: OtlpLogSinkBasicCredentialsType,
+    username: S.String,
+  }),
+).annotate({
+  identifier: "OtlpLogSinkBasicCredentials",
+}) as any as S.Schema<OtlpLogSinkBasicCredentials>;
+
+/** The authentication credentials required for the CDN to push logs to your OTLP endpoint. */
+export type OtlpLogSinkCreateCredentials =
+  | OtlpLogSinkBearerCredentials
+  | OtlpLogSinkBasicCredentials;
+export const OtlpLogSinkCreateCredentials =
+  /*@__PURE__*/ S.Unknown as any as S.Schema<OtlpLogSinkCreateCredentials>;
+
+/** Defines the type of the log sink. */
+export type OtlpLogSinkCreateType = "otlp";
+export const OtlpLogSinkCreateType = /*@__PURE__*/ S.String;
+
+export interface OtlpLogSinkCreate {
+  /** The authentication credentials required for the CDN to push logs to your OTLP endpoint. */
+  credentials: OtlpLogSinkCreateCredentials;
+  /** The fully qualified URL where the CDN should push logs to your OTLP endpoint (for example, `https://otlp.example.com/otlp/v1/logs`). */
+  pushUrl: string;
+  /** Defines the type of the log sink. */
+  type: OtlpLogSinkCreateType;
+}
+export const OtlpLogSinkCreate = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    credentials: OtlpLogSinkCreateCredentials,
+    pushUrl: S.String,
+    type: OtlpLogSinkCreateType,
+  }),
+).annotate({
+  identifier: "OtlpLogSinkCreate",
+}) as any as S.Schema<OtlpLogSinkCreate>;
+
+export type CreateDistributionRequestLogSink =
+  | LokiLogSinkCreate
+  | OtlpLogSinkCreate;
+export const CreateDistributionRequestLogSink =
+  /*@__PURE__*/ S.Unknown as any as S.Schema<CreateDistributionRequestLogSink>;
+
+/** Optimizer is paid feature, a real-time on the fly image manipulation and optimization service that automatically optimizes your images for faster image delivery. */
+export interface Optimizer {
+  /** Determines if the optimizer should be enabled for this distribution and incurs a monthly fee */
+  enabled: boolean;
+}
+export const Optimizer = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    enabled: S.Boolean,
+  }),
+).annotate({ identifier: "Optimizer" }) as any as S.Schema<Optimizer>;
+
+/** Defines how multiple matchers within this rule are combined (ALL, ANY, NONE). Defaults to ANY. */
+export type MatchCondition = "ANY" | "ALL" | "NONE";
+export const MatchCondition = /*@__PURE__*/ S.String;
+
+/** A list of glob patterns to match against the request path. At least one value is required. Examples: "/shop/*" or "*\/img/*" */
+export type MatcherValuesList = Array<string>;
+export const MatcherValuesList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<MatcherValuesList>;
+
+/** A matcher containing a list of string values to compare against the request path. */
+export interface Matcher {
+  valueMatchCondition?: MatchCondition | (string & {});
+  /** A list of glob patterns to match against the request path. At least one value is required. Examples: "/shop/*" or "*\/img/*" */
+  values: MatcherValuesList;
+}
+export const Matcher = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    valueMatchCondition: S.optional(MatchCondition),
+    values: MatcherValuesList,
+  }),
+).annotate({ identifier: "Matcher" }) as any as S.Schema<Matcher>;
+
+/** A list of matchers that define when this rule should apply. At least one matcher is required. */
+export type RedirectRuleMatchersList = Array<Matcher>;
+export const RedirectRuleMatchersList = /*@__PURE__*/ S.Array(
+  Matcher,
+) as any as S.Schema<RedirectRuleMatchersList>;
+
+/** The HTTP status code for the redirect. Must be one of 301, 302, 303, 307, or 308. */
+export type RedirectRuleStatusCode = 301 | 302 | 303 | 307 | 308;
+export const RedirectRuleStatusCode = /*@__PURE__*/ S.Number;
+
+/** A single redirect rule defining a source pattern and a target URL. */
+export interface RedirectRule {
+  /** An optional description for the redirect rule. */
+  description?: string;
+  /** A toggle to enable or disable the redirect rule. */
+  enabled?: boolean;
+  /** A list of matchers that define when this rule should apply. At least one matcher is required. */
+  matchers: RedirectRuleMatchersList;
+  ruleMatchCondition?: MatchCondition | (string & {});
+  /** The HTTP status code for the redirect. Must be one of 301, 302, 303, 307, or 308. */
+  statusCode: RedirectRuleStatusCode | (number & {});
+  /** The target URL to redirect to. Must be a valid URI. */
+  targetUrl: string;
+}
+export const RedirectRule = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    description: S.optional(S.String),
+    enabled: S.optional(S.Boolean),
+    matchers: RedirectRuleMatchersList,
+    ruleMatchCondition: S.optional(MatchCondition),
+    statusCode: RedirectRuleStatusCode,
+    targetUrl: S.String,
+  }),
+).annotate({ identifier: "RedirectRule" }) as any as S.Schema<RedirectRule>;
+
+/** A list of redirect rules. The order of rules matters for evaluation. */
+export type RedirectConfigRulesList = Array<RedirectRule>;
+export const RedirectConfigRulesList = /*@__PURE__*/ S.Array(
+  RedirectRule,
+) as any as S.Schema<RedirectConfigRulesList>;
+
+/** A wrapper for a list of redirect rules that allows for redirect settings on a distribution. */
+export interface RedirectConfig {
+  /** A list of redirect rules. The order of rules matters for evaluation. */
+  rules?: RedirectConfigRulesList;
+}
+export const RedirectConfig = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    rules: S.optional(RedirectConfigRulesList),
+  }),
+).annotate({ identifier: "RedirectConfig" }) as any as S.Schema<RedirectConfig>;
+
+/** The following regions exist: - `EU` - Europe - `US` - United States / North America - `AF` - Africa - `SA` - South America - `ASIA` - Asia and Oceania */
+export type Region = "EU" | "US" | "AF" | "SA" | "ASIA";
+export const Region = /*@__PURE__*/ S.String;
+
+/** Define in which regions you would like your content to be cached. */
+export type CreateDistributionRequestRegionsList = Array<
+  Region | (string & {})
+>;
+export const CreateDistributionRequestRegionsList = /*@__PURE__*/ S.Array(
+  Region,
+) as any as S.Schema<CreateDistributionRequestRegionsList>;
+
+/** Configuration for TLS protocol versions. Note: Enabling older TLS versions (1.0, 1.1) is generally discouraged for security reasons. */
+export interface TlsConfig {
+  /** If set to true, the distribution will accept connections using TLS 1.0. */
+  enableTls10: boolean;
+  /** If set to true, the distribution will accept connections using TLS 1.1. */
+  enableTls11: boolean;
+}
+export const TlsConfig = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    enableTls10: S.Boolean,
+    enableTls11: S.Boolean,
+  }),
+).annotate({ identifier: "TlsConfig" }) as any as S.Schema<TlsConfig>;
+
+/** This whitelist restricts which HTTP methods the distribution accepts. Requests using non-whitelisted methods are blocked by the WAF before reaching the origin. Common methods: `GET`, `POST`, `PUT`, `DELETE`, `PATCH`, `HEAD`, `OPTIONS`, `CONNECT`, `TRACE` Validation ensures: 1. At least one method is allowed 2. No duplicate methods (e.g., `GET` appearing twice) 3. Each method is valid per HTTP standards */
+export type WafConfigAllowedHttpMethodsList = Array<string>;
+export const WafConfigAllowedHttpMethodsList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<WafConfigAllowedHttpMethodsList>;
+
+export type WafConfigAllowedHttpVersionsList = Array<string>;
+export const WafConfigAllowedHttpVersionsList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<WafConfigAllowedHttpVersionsList>;
+
+/** This allow list restricts which Content-Type headers are accepted in request bodies. Format: Must be `type/subtype` with no spaces. Common content types: - `application/json` - `application/x-www-form-urlencoded` - `multipart/form-data` - `text/html` - `text/plain` - `application/xml` */
+export type WafConfigAllowedRequestContentTypesList = Array<string>;
+export const WafConfigAllowedRequestContentTypesList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<WafConfigAllowedRequestContentTypesList>;
+
+/** Ids of WAF Collections to mark as disabled */
+export type WafConfigDisabledRuleCollectionIdsList = Array<string>;
+export const WafConfigDisabledRuleCollectionIdsList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<WafConfigDisabledRuleCollectionIdsList>;
+
+/** Ids of WAF Rule Groups to mark as disabled */
+export type WafConfigDisabledRuleGroupIdsList = Array<string>;
+export const WafConfigDisabledRuleGroupIdsList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<WafConfigDisabledRuleGroupIdsList>;
+
+/** Ids of WAF Rules that are **explicitly** disabled for this distribution. */
+export type WafConfigDisabledRuleIdsList = Array<string>;
+export const WafConfigDisabledRuleIdsList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<WafConfigDisabledRuleIdsList>;
+
+/** Ids of WAF Collections to mark as enabled */
+export type WafConfigEnabledRuleCollectionIdsList = Array<string>;
+export const WafConfigEnabledRuleCollectionIdsList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<WafConfigEnabledRuleCollectionIdsList>;
+
+/** Ids of WAF Rule Groups to mark as enabled */
+export type WafConfigEnabledRuleGroupIdsList = Array<string>;
+export const WafConfigEnabledRuleGroupIdsList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<WafConfigEnabledRuleGroupIdsList>;
+
+/** Ids of the WAF rules that are **explicitly** enabled for this distribution. If this rule is in a disabled / log Only RuleGroup or Collection, it will be enabled regardless as `enabledRuleIds` overrides those in specificity. Do note that rules can also be enabled because a Rulegroup or Collection is enabled. **DO NOT** use this property to find all active rules. Instead, pass `?withWafStatus=true` as a query parameter to `GetDistribution` or `ListDistributions`. This will expose the `waf` Property on distribution Level. From there you can `$.waf.enabledRules.map(e => e.id)` to get a list of all enabled rules. */
+export type WafConfigEnabledRuleIdsList = Array<string>;
+export const WafConfigEnabledRuleIdsList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<WafConfigEnabledRuleIdsList>;
+
+/** Ids of WAF Collections to mark as log Only. */
+export type WafConfigLogOnlyRuleCollectionIdsList = Array<string>;
+export const WafConfigLogOnlyRuleCollectionIdsList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<WafConfigLogOnlyRuleCollectionIdsList>;
+
+/** Ids of WAF Rule Groups to mark as log Only. */
+export type WafConfigLogOnlyRuleGroupIdsList = Array<string>;
+export const WafConfigLogOnlyRuleGroupIdsList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<WafConfigLogOnlyRuleGroupIdsList>;
+
+/** Ids of WAF Rules that are **explicitly** marked as Log Only for this distribution. */
+export type WafConfigLogOnlyRuleIdsList = Array<string>;
+export const WafConfigLogOnlyRuleIdsList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<WafConfigLogOnlyRuleIdsList>;
+
+/** - `ENABLED`: The WAF actively inspects and blocks malicious requests. - `DISABLED`: The WAF is completely off. No inspection occurs. - `LOG_ONLY`: The WAF inspects requests and logs matches but never blocks. */
+export type WafMode = "DISABLED" | "ENABLED" | "LOG_ONLY";
+export const WafMode = /*@__PURE__*/ S.String;
+
+/** The paranoia level defines how aggressively the WAF should action on requests. It ranges from `L1` (least strict, lowest chance of false positives) to `L4` (most strict, highest chance of false positives). A higher paranoia level is more effective at catching attacks but can also block legitimate traffic. */
+export type WafParanoiaLevel = "L1" | "L2" | "L3" | "L4";
+export const WafParanoiaLevel = /*@__PURE__*/ S.String;
+
+/** Enable or disable the Premium WAF. Do note that enabling the Premium WAF will cause additional fees. Some features are gated behind the Premium WAF, like additional, **premium-only rules** and the ability to create **custom rules** (not yet implemented) */
+export type WafType = "FREE" | "PREMIUM";
+export const WafType = /*@__PURE__*/ S.String;
+
+/** Configuration of the WAF of a distribution A WAF Config always contains a WAF Mode and Type. If a WAF was never enabled, most of the properties are not present. To **enable** the WAF for your Distribution, you must set the `mode` to `ENABLED` or `LOG_ONLY`. This causes the other properties to be populated. ## Rules There are 9 properties used to control which Rules are enabled, disabled or set to Log-Only. These properties can be grouped in 3 groups of 3. Each of these groups varies in specificity: Rules are more specific than Rule Groups, which in turn are more specific than Collections. More specific definitions override more generic definitions. ### Collections - `enabledRuleCollectionIds` - `disabledRuleCollectionIds` - `logOnlyRuleCollectionIds` These are the least specific selectors. As of 2025, only two collections exist: - `@builtin/crs/response`, containing all Rules regarding Responses - `@builtin/crs/request`, containing all Rules regarding Requests More collections may be added in the future ### Rule Groups - `enabledRuleGroupIds` - `disabledRuleGroupIds` - `logOnlyRuleGroupIds` These are more specific than Collections and will override their selector. You can find all available Rule Groups by calling the `ListWafCollections` Operation. ### Rules - `enabledRuleIds` - `disabledRuleIds` - `logOnlyRuleGds` Being the most specific selectors, these will override both Collection and Rule Group selectors. You can find all available Rule Groups by calling the `ListWafCollections` Operation. ### TIP: Review resolved config If you call `GetDistribution` with `?withWafStatus=true`, you get back a resolved WAF Rules Config which contains a `waf` property which you can inspect to see why a Rule is either enabled, disabled or logOnly. */
+export interface WafConfig {
+  /** This whitelist restricts which HTTP methods the distribution accepts. Requests using non-whitelisted methods are blocked by the WAF before reaching the origin. Common methods: `GET`, `POST`, `PUT`, `DELETE`, `PATCH`, `HEAD`, `OPTIONS`, `CONNECT`, `TRACE` Validation ensures: 1. At least one method is allowed 2. No duplicate methods (e.g., `GET` appearing twice) 3. Each method is valid per HTTP standards */
+  allowedHttpMethods?: WafConfigAllowedHttpMethodsList;
+  allowedHttpVersions?: WafConfigAllowedHttpVersionsList;
+  /** This allow list restricts which Content-Type headers are accepted in request bodies. Format: Must be `type/subtype` with no spaces. Common content types: - `application/json` - `application/x-www-form-urlencoded` - `multipart/form-data` - `text/html` - `text/plain` - `application/xml` */
+  allowedRequestContentTypes?: WafConfigAllowedRequestContentTypesList;
+  /** Ids of WAF Collections to mark as disabled */
+  disabledRuleCollectionIds?: WafConfigDisabledRuleCollectionIdsList;
+  /** Ids of WAF Rule Groups to mark as disabled */
+  disabledRuleGroupIds?: WafConfigDisabledRuleGroupIdsList;
+  /** Ids of WAF Rules that are **explicitly** disabled for this distribution. */
+  disabledRuleIds?: WafConfigDisabledRuleIdsList;
+  /** Ids of WAF Collections to mark as enabled */
+  enabledRuleCollectionIds?: WafConfigEnabledRuleCollectionIdsList;
+  /** Ids of WAF Rule Groups to mark as enabled */
+  enabledRuleGroupIds?: WafConfigEnabledRuleGroupIdsList;
+  /** Ids of the WAF rules that are **explicitly** enabled for this distribution. If this rule is in a disabled / log Only RuleGroup or Collection, it will be enabled regardless as `enabledRuleIds` overrides those in specificity. Do note that rules can also be enabled because a Rulegroup or Collection is enabled. **DO NOT** use this property to find all active rules. Instead, pass `?withWafStatus=true` as a query parameter to `GetDistribution` or `ListDistributions`. This will expose the `waf` Property on distribution Level. From there you can `$.waf.enabledRules.map(e => e.id)` to get a list of all enabled rules. */
+  enabledRuleIds: WafConfigEnabledRuleIdsList;
+  /** Ids of WAF Collections to mark as log Only. */
+  logOnlyRuleCollectionIds?: WafConfigLogOnlyRuleCollectionIdsList;
+  /** Ids of WAF Rule Groups to mark as log Only. */
+  logOnlyRuleGroupIds?: WafConfigLogOnlyRuleGroupIdsList;
+  /** Ids of WAF Rules that are **explicitly** marked as Log Only for this distribution. */
+  logOnlyRuleIds?: WafConfigLogOnlyRuleIdsList;
+  mode: WafMode | (string & {});
+  paranoiaLevel?: WafParanoiaLevel | (string & {});
+  type: WafType | (string & {});
+}
+export const WafConfig = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    allowedHttpMethods: S.optional(WafConfigAllowedHttpMethodsList),
+    allowedHttpVersions: S.optional(WafConfigAllowedHttpVersionsList),
+    allowedRequestContentTypes: S.optional(
+      WafConfigAllowedRequestContentTypesList,
+    ),
+    disabledRuleCollectionIds: S.optional(
+      WafConfigDisabledRuleCollectionIdsList,
+    ),
+    disabledRuleGroupIds: S.optional(WafConfigDisabledRuleGroupIdsList),
+    disabledRuleIds: S.optional(WafConfigDisabledRuleIdsList),
+    enabledRuleCollectionIds: S.optional(WafConfigEnabledRuleCollectionIdsList),
+    enabledRuleGroupIds: S.optional(WafConfigEnabledRuleGroupIdsList),
+    enabledRuleIds: WafConfigEnabledRuleIdsList,
+    logOnlyRuleCollectionIds: S.optional(WafConfigLogOnlyRuleCollectionIdsList),
+    logOnlyRuleGroupIds: S.optional(WafConfigLogOnlyRuleGroupIdsList),
+    logOnlyRuleIds: S.optional(WafConfigLogOnlyRuleIdsList),
+    mode: WafMode,
+    paranoiaLevel: S.optional(WafParanoiaLevel),
+    type: WafType,
+  }),
+).annotate({ identifier: "WafConfig" }) as any as S.Schema<WafConfig>;
+
+export interface CreateDistributionRequest {
+  /** Your STACKIT Project Id */
+  projectId: string;
+  /** Configuration for the content origin backend. */
+  backend: CreateDistributionRequestBackend;
+  /** Restricts access to your content based on country. We use the ISO 3166-1 alpha-2 standard for country codes (e.g., DE, ES, GB). This setting blocks users from the specified countries. */
+  blockedCountries?: CreateDistributionRequestBlockedCountriesList;
+  /** Restricts access to your content by specifying a list of blocked IPv4 addresses. This feature enhances security and privacy by preventing these addresses from accessing your distribution. */
+  blockedIps?: CreateDistributionRequestBlockedIpsList;
+  cacheConfig?: CacheConfigCreate;
+  /** Sets the default cache duration for the distribution. The default cache duration is applied when a 'Cache-Control' header is not presented in the origin's response. We use ISO8601 duration format for cache duration (e.g. P1DT2H30M) */
+  defaultCacheDuration?: string;
+  /** Enabling this allows the 'Host' header to be passed through to the origin. */
+  forwardHostHeader?: boolean;
+  /** While optional, it is greatly encouraged to provide an `intentId`. This is used to deduplicate requests. If multiple POST-Requests with the same `intentId` for a given `projectId` are received, all but the first request are dropped. */
+  intentId?: string;
+  /** Labels are key-value string pairs that can be attached to a distribution. */
+  labels?: CreateDistributionRequestLabelsMap;
+  logSink?: CreateDistributionRequestLogSink;
+  /** Sets the monthly limit of bandwidth in bytes that the pullzone is allowed to use. */
+  monthlyLimitBytes?: number;
+  optimizer?: Optimizer;
+  redirects?: RedirectConfig;
+  /** Define in which regions you would like your content to be cached. */
+  regions: CreateDistributionRequestRegionsList;
+  /** Enable this to prevent origin-level cookies from being forwarded to the end user. */
+  stripResponseCookies?: boolean;
+  tls?: TlsConfig;
+  waf?: WafConfig;
+}
+export const CreateDistributionRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    projectId: S.String.pipe(T.Label()),
+    backend: CreateDistributionRequestBackend,
+    blockedCountries: S.optional(CreateDistributionRequestBlockedCountriesList),
+    blockedIps: S.optional(CreateDistributionRequestBlockedIpsList),
+    cacheConfig: S.optional(CacheConfigCreate),
+    defaultCacheDuration: S.optional(S.String),
+    forwardHostHeader: S.optional(S.Boolean),
+    intentId: S.optional(S.String),
+    labels: S.optional(CreateDistributionRequestLabelsMap),
+    logSink: S.optional(CreateDistributionRequestLogSink),
+    monthlyLimitBytes: S.optional(S.Number),
+    optimizer: S.optional(Optimizer),
+    redirects: S.optional(RedirectConfig),
+    regions: CreateDistributionRequestRegionsList,
+    stripResponseCookies: S.optional(S.Boolean),
+    tls: S.optional(TlsConfig),
+    waf: S.optional(WafConfig),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/v1/projects/{projectId}/distributions",
+      code: 200,
+      baseUrl: "https://cdn.api.stackit.cloud",
+    }),
+  ),
+).annotate({
+  identifier: "CreateDistributionRequest",
+}) as any as S.Schema<CreateDistributionRequest>;
+
+export type HttpBackendGeofencingValueList = Array<string>;
+export const HttpBackendGeofencingValueList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<HttpBackendGeofencingValueList>;
+
+/** An object mapping multiple alternative origins to country codes. Any request from one of those country codes will route to the alternative origin. Do note that country codes may only be used once. You cannot have a country be assigned to multiple alternative origins. */
+export type HttpBackendGeofencingMap = {
+  [key: string]: HttpBackendGeofencingValueList | undefined;
+};
+export const HttpBackendGeofencingMap = /*@__PURE__*/ S.Record(
+  S.String,
+  HttpBackendGeofencingValueList,
+) as any as S.Schema<HttpBackendGeofencingMap>;
+
+/** Headers that will be sent with every request to the configured origin. **WARNING**: Do not store sensitive values in the headers. The configuration is stored as plain text. */
+export type HttpBackendOriginRequestHeadersMap = {
+  [key: string]: string | undefined;
+};
+export const HttpBackendOriginRequestHeadersMap = /*@__PURE__*/ S.Record(
+  S.String,
+  S.String,
+) as any as S.Schema<HttpBackendOriginRequestHeadersMap>;
+
+/** Defines the type of content origin. For this schema, it must be set to `http`. */
+export type HttpBackendType = "http";
+export const HttpBackendType = /*@__PURE__*/ S.String;
+
+export interface HttpBackend {
+  /** An object mapping multiple alternative origins to country codes. Any request from one of those country codes will route to the alternative origin. Do note that country codes may only be used once. You cannot have a country be assigned to multiple alternative origins. */
+  geofencing: HttpBackendGeofencingMap;
+  /** Headers that will be sent with every request to the configured origin. **WARNING**: Do not store sensitive values in the headers. The configuration is stored as plain text. */
+  originRequestHeaders: HttpBackendOriginRequestHeadersMap;
+  /** The origin of the content that should be made available through the CDN. Note that the path and query parameters are ignored. Ports are allowed. If no protocol is provided, `https` is assumed. So `www.example.com:1234/somePath?q=123` is normalized to `https://www.example.com:1234` */
+  originUrl: string;
+  /** Defines the type of content origin. For this schema, it must be set to `http`. */
+  type: HttpBackendType;
+}
+export const HttpBackend = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    geofencing: HttpBackendGeofencingMap,
+    originRequestHeaders: HttpBackendOriginRequestHeadersMap,
+    originUrl: S.String,
+    type: HttpBackendType,
+  }),
+).annotate({ identifier: "HttpBackend" }) as any as S.Schema<HttpBackend>;
+
+/** Defines the type of content origin. For this schema, it must be set to `bucket`. */
+export type BucketBackendType = "bucket";
+export const BucketBackendType = /*@__PURE__*/ S.String;
+
+export interface BucketBackend {
+  /** The fully qualified URL of your cloud storage bucket (for example, `https://s3.eu-central-1.amazonaws.com/my-bucket`). */
+  bucketUrl: string;
+  /** The cloud provider region where your storage bucket is located (for example, `us-west-1` for AWS or `eu01` for STACKIT). */
+  region: string;
+  /** Defines the type of content origin. For this schema, it must be set to `bucket`. */
+  type: BucketBackendType;
+}
+export const BucketBackend = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    bucketUrl: S.String,
+    region: S.String,
+    type: BucketBackendType,
+  }),
+).annotate({ identifier: "BucketBackend" }) as any as S.Schema<BucketBackend>;
+
+export type ConfigBackend = HttpBackend | BucketBackend;
+export const ConfigBackend =
+  /*@__PURE__*/ S.Unknown as any as S.Schema<ConfigBackend>;
+
+/** Restricts access to your content based on country. We use the ISO 3166-1 alpha-2 standard for country codes (e.g. DE, ES, GB). This setting blocks users from the specified countries. */
+export type ConfigBlockedCountriesList = Array<string>;
+export const ConfigBlockedCountriesList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<ConfigBlockedCountriesList>;
+
+/** Restricts access to your content by specifying a list of blocked IPv4 addresses. This feature enhances security and privacy by preventing these addresses from accessing your distribution. */
+export type ConfigBlockedIpsList = Array<string>;
+export const ConfigBlockedIpsList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<ConfigBlockedIpsList>;
+
+/** HTTP request header names whose values participate in the cache key. Each entry multiplies the number of cache variants by the number of distinct values observed for that header. */
+export type CacheConfigCacheKeyHeadersList = Array<string>;
+export const CacheConfigCacheKeyHeadersList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<CacheConfigCacheKeyHeadersList>;
+
+/** Allowlist of query-string parameter names that participate in the cache key when `queryStringVaryEnabled` is true. Ignored while `queryStringVaryEnabled` is false, but still stored so it can be re-activated without losing the list. */
+export type CacheConfigQueryStringVaryParametersList = Array<string>;
+export const CacheConfigQueryStringVaryParametersList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<CacheConfigQueryStringVaryParametersList>;
+
+/** Groups the cache options that influence how the CDN builds its cache key. **Cache cardinality warning:** enabling query-string vary produces one cache entry per unique query-string combination (**unbounded** when `queryStringVaryParameters` is empty). Each entry in `cacheKeyHeaders` multiplies the number of cache variants by the number of distinct values observed for that header. Use these settings sparingly. `queryStringVaryParameters` is stored independently of `queryStringVaryEnabled` so that this feature can be toggled on and off without losing the configured allowlist. Only `queryStringVaryEnabled` gates whether the parameter allowlist actually varies the cache. **Optimizer interaction:** when the Optimizer is enabled, the CDN automatically enables query-string vary for image responses regardless of this setting. */
+export interface CacheConfig {
+  /** HTTP request header names whose values participate in the cache key. Each entry multiplies the number of cache variants by the number of distinct values observed for that header. */
+  cacheKeyHeaders: CacheConfigCacheKeyHeadersList;
+  /** When true, the CDN varies its cache by the request query string. If `queryStringVaryParameters` is empty, every unique query-string combination produces its own cache entry; if non-empty, only the listed parameters influence the cache key. */
+  queryStringVaryEnabled: boolean;
+  /** Allowlist of query-string parameter names that participate in the cache key when `queryStringVaryEnabled` is true. Ignored while `queryStringVaryEnabled` is false, but still stored so it can be re-activated without losing the list. */
+  queryStringVaryParameters: CacheConfigQueryStringVaryParametersList;
+}
+export const CacheConfig = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    cacheKeyHeaders: CacheConfigCacheKeyHeadersList,
+    queryStringVaryEnabled: S.Boolean,
+    queryStringVaryParameters: CacheConfigQueryStringVaryParametersList,
+  }),
+).annotate({ identifier: "CacheConfig" }) as any as S.Schema<CacheConfig>;
+
+/** Labels are key-value string pairs that can be attached to a distribution. */
+export type ConfigLabelsMap = { [key: string]: string | undefined };
+export const ConfigLabelsMap = /*@__PURE__*/ S.Record(
+  S.String,
+  S.String,
+) as any as S.Schema<ConfigLabelsMap>;
+
+/** Defines the type of the log sink. */
+export type LokiLogSinkType = "loki";
+export const LokiLogSinkType = /*@__PURE__*/ S.String;
+
+export interface LokiLogSink {
+  /** The fully qualified URL where the CDN should push logs to your Loki instance (for example, `https://loki.example.com/loki/api/v1/push`). */
+  pushUrl: string;
+  /** Defines the type of the log sink. */
+  type: LokiLogSinkType;
+}
+export const LokiLogSink = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    pushUrl: S.String,
+    type: LokiLogSinkType,
+  }),
+).annotate({ identifier: "LokiLogSink" }) as any as S.Schema<LokiLogSink>;
+
+/** Defines the type of the log sink. */
+export type OtlpLogSinkType = "otlp";
+export const OtlpLogSinkType = /*@__PURE__*/ S.String;
+
+export interface OtlpLogSink {
+  /** The fully qualified URL where the CDN should push logs to your OTLP endpoint (for example, `https://otlp.example.com/otlp/v1/logs`). */
+  pushUrl: string;
+  /** Defines the type of the log sink. */
+  type: OtlpLogSinkType;
+}
+export const OtlpLogSink = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    pushUrl: S.String,
+    type: OtlpLogSinkType,
+  }),
+).annotate({ identifier: "OtlpLogSink" }) as any as S.Schema<OtlpLogSink>;
+
+export type ConfigLogSink = LokiLogSink | OtlpLogSink;
+export const ConfigLogSink =
+  /*@__PURE__*/ S.Unknown as any as S.Schema<ConfigLogSink>;
+
+export type ConfigRegionsList = Array<Region>;
+export const ConfigRegionsList = /*@__PURE__*/ S.Array(
+  Region,
+) as any as S.Schema<ConfigRegionsList>;
+
+export interface Config {
+  backend: ConfigBackend;
+  /** Restricts access to your content based on country. We use the ISO 3166-1 alpha-2 standard for country codes (e.g. DE, ES, GB). This setting blocks users from the specified countries. */
+  blockedCountries: ConfigBlockedCountriesList;
+  /** Restricts access to your content by specifying a list of blocked IPv4 addresses. This feature enhances security and privacy by preventing these addresses from accessing your distribution. */
+  blockedIps: ConfigBlockedIpsList;
+  cacheConfig: CacheConfig;
+  /** Sets the default cache duration for the distribution. The default cache duration is applied when a 'Cache-Control' header is not presented in the origin's response. We use ISO8601 duration format for cache duration (e.g. P1DT2H30M) */
+  defaultCacheDuration?: string | null;
+  /** Enabling this allows the 'Host' header to be passed through to the origin. */
+  forwardHostHeader: boolean;
+  /** Labels are key-value string pairs that can be attached to a distribution. */
+  labels?: ConfigLabelsMap;
+  logSink?: ConfigLogSink;
+  /** Sets the monthly limit of bandwidth in bytes that the pullzone is allowed to use. */
+  monthlyLimitBytes?: number | null;
+  optimizer?: Optimizer;
+  redirects?: RedirectConfig;
+  regions: ConfigRegionsList;
+  /** Enable this to prevent origin-level cookies from being forwarded to the end user. */
+  stripResponseCookies: boolean;
+  tls: TlsConfig;
+  waf: WafConfig;
+}
+export const Config = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    backend: ConfigBackend,
+    blockedCountries: ConfigBlockedCountriesList,
+    blockedIps: ConfigBlockedIpsList,
+    cacheConfig: CacheConfig,
+    defaultCacheDuration: S.optional(S.NullOr(S.String)),
+    forwardHostHeader: S.Boolean,
+    labels: S.optional(ConfigLabelsMap),
+    logSink: S.optional(ConfigLogSink),
+    monthlyLimitBytes: S.optional(S.NullOr(S.Number)),
+    optimizer: S.optional(Optimizer),
+    redirects: S.optional(RedirectConfig),
+    regions: ConfigRegionsList,
+    stripResponseCookies: S.Boolean,
+    tls: TlsConfig,
+    waf: WafConfig,
+  }),
+).annotate({ identifier: "Config" }) as any as S.Schema<Config>;
+
+export type DomainCertificateType = "managed" | "custom";
+export const DomainCertificateType = /*@__PURE__*/ S.String;
+
+/** An enum value that describes a Status Error. */
+export type StatusErrorKey =
+  | "UNKNOWN"
+  | "CUSTOM_DOMAIN_CNAME_MISSING"
+  | "CUSTOM_DOMAIN_ALREADY_IN_USE"
+  | "PUBLIC_BETA_QUOTA_REACHED"
+  | "LOG_SINK_INSTANCE_UNAVAILABLE"
+  | "EXTERNAL_QUOTA_REACHED";
+export const StatusErrorKey = /*@__PURE__*/ S.String;
+
+export interface StatusError {
+  /** A german translation string corresponding to the error key. Note that we do not guarantee german translations are present. */
+  de?: string;
+  /** An english translation string corresponding to the error key. An english translation key is always present. */
+  en: string;
+  /** An enum value that describes a Status Error. */
+  key: StatusErrorKey;
+}
+export const StatusError = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    de: S.optional(S.String),
+    en: S.String,
+    key: StatusErrorKey,
+  }),
+).annotate({ identifier: "StatusError" }) as any as S.Schema<StatusError>;
+
+/** This object is present if the custom domain has errors. */
+export type DomainErrorsList = Array<StatusError>;
+export const DomainErrorsList = /*@__PURE__*/ S.Array(
+  StatusError,
+) as any as S.Schema<DomainErrorsList>;
+
+/** The status of the domain: CREATING indicates that the custom domain is being set up. UPDATING means that requested changes are being applied to the custom domain. ACTIVE means the custom domain is currently configured and active. DELETING means that the domain is in the process of being removed from the distribution. In case the domain has the ERROR state, more information will be available in the errors list. */
+export type DomainStatus =
+  | "CREATING"
+  | "ACTIVE"
+  | "UPDATING"
+  | "DELETING"
+  | "ERROR";
+export const DomainStatus = /*@__PURE__*/ S.String;
+
+/** Specifies the type of this Domain. Custom Domain can be further queries using the GetCustomDomain Endpoint */
+export type DomainType = "managed" | "custom";
+export const DomainType = /*@__PURE__*/ S.String;
+
+/** Definition of a custom or managed domain without any certificates or keys */
+export interface Domain {
+  certificateType: DomainCertificateType;
+  /** This object is present if the custom domain has errors. */
+  errors?: DomainErrorsList;
+  /** The domain. If this is a custom domain, you can call the GetCustomDomain Endpoint */
+  name: string;
+  status: DomainStatus;
+  /** Specifies the type of this Domain. Custom Domain can be further queries using the GetCustomDomain Endpoint */
+  type: DomainType;
+}
+export const Domain = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    certificateType: DomainCertificateType,
+    errors: S.optional(DomainErrorsList),
+    name: S.String,
+    status: DomainStatus,
+    type: DomainType,
+  }),
+).annotate({ identifier: "Domain" }) as any as S.Schema<Domain>;
+
+export type DistributionDomainsList = Array<Domain>;
+export const DistributionDomainsList = /*@__PURE__*/ S.Array(
+  Domain,
+) as any as S.Schema<DistributionDomainsList>;
+
+/** This object may be present if, and only if the distribution has encountered an error state. */
+export type DistributionErrorsList = Array<StatusError>;
+export const DistributionErrorsList = /*@__PURE__*/ S.Array(
+  StatusError,
+) as any as S.Schema<DistributionErrorsList>;
+
+/** - `CREATING`: The distribution was just created. All the relevant resources are created in the background. Once fully reconciled, this switches to `ACTIVE`. If there are any issues, the status changes to `ERROR`. You can look at the `errors` array to get more infos. - `ACTIVE`: The usual state. The desired configuration is synced, there are no errors - `UPDATING`: The state when there is a discrepancy between the desired and actual configuration state. This occurs right after an update. Will switch to `ACTIVE` or `ERROR`, depending on if synchronizing succeeds or not. - `DELETING`: The state right after a delete request was received. The distribution will stay in this status until all resources have been successfully removed, or until we encounter an `ERROR` state. **NOTE:** You can keep fetching the distribution while it is deleting. After successful deletion, trying to get a distribution will return a 404 Not Found response - `ERROR`: The error state. Look at the `errors` array for more info. */
+export type DistributionStatus =
+  | "CREATING"
+  | "ACTIVE"
+  | "UPDATING"
+  | "DELETING"
+  | "ERROR";
+export const DistributionStatus = /*@__PURE__*/ S.String;
+
+/** This object only ever shows up in the disabled rules section. If rules are never defined (e.g. no collection, rule group, or the rule itself is ever mentioned), they are implicitly disabled */
+export interface WafStatusRuleBlockReasonNeverDefined {
+  /** This is always `neverDefined` */
+  type: string;
+}
+export const WafStatusRuleBlockReasonNeverDefined = /*@__PURE__*/ S.suspend(
+  () =>
+    S.Struct({
+      type: S.String,
+    }),
+).annotate({
+  identifier: "WafStatusRuleBlockReasonNeverDefined",
+}) as any as S.Schema<WafStatusRuleBlockReasonNeverDefined>;
+
+export interface WafStatusRuleBlockReasonDirectlyDefined {
+  /** This is always `directlyDefined` */
+  type: string;
+}
+export const WafStatusRuleBlockReasonDirectlyDefined = /*@__PURE__*/ S.suspend(
+  () =>
+    S.Struct({
+      type: S.String,
+    }),
+).annotate({
+  identifier: "WafStatusRuleBlockReasonDirectlyDefined",
+}) as any as S.Schema<WafStatusRuleBlockReasonDirectlyDefined>;
+
+/** A list containing all WAF Types which can use this Rule. You must patch you WAF to one of these WAF Types to make use of this rule. Rules show up with this state if they would have been enabled or logOnly otherwise. */
+export type WafStatusRuleBlockReasonInvalidWafTypeAllowedWafTypesList =
+  Array<WafType>;
+export const WafStatusRuleBlockReasonInvalidWafTypeAllowedWafTypesList =
+  /*@__PURE__*/ S.Array(
+    WafType,
+  ) as any as S.Schema<WafStatusRuleBlockReasonInvalidWafTypeAllowedWafTypesList>;
+
+export interface WafStatusRuleBlockReasonInvalidWafType {
+  /** A list containing all WAF Types which can use this Rule. You must patch you WAF to one of these WAF Types to make use of this rule. Rules show up with this state if they would have been enabled or logOnly otherwise. */
+  allowedWafTypes: WafStatusRuleBlockReasonInvalidWafTypeAllowedWafTypesList;
+  /** This is always `invalidWafType` */
+  type: string;
+}
+export const WafStatusRuleBlockReasonInvalidWafType = /*@__PURE__*/ S.suspend(
+  () =>
+    S.Struct({
+      allowedWafTypes:
+        WafStatusRuleBlockReasonInvalidWafTypeAllowedWafTypesList,
+      type: S.String,
+    }),
+).annotate({
+  identifier: "WafStatusRuleBlockReasonInvalidWafType",
+}) as any as S.Schema<WafStatusRuleBlockReasonInvalidWafType>;
+
+export interface WafStatusRuleBlockReasonInheritedFromCollection {
+  /** The Collection that caused this rule to be in its current state. */
+  collectionId: string;
+  /** This is always `inheritedFromCollection` */
+  type: string;
+}
+export const WafStatusRuleBlockReasonInheritedFromCollection =
+  /*@__PURE__*/ S.suspend(() =>
+    S.Struct({
+      collectionId: S.String,
+      type: S.String,
+    }),
+  ).annotate({
+    identifier: "WafStatusRuleBlockReasonInheritedFromCollection",
+  }) as any as S.Schema<WafStatusRuleBlockReasonInheritedFromCollection>;
+
+export interface WafStatusRuleBlockReasonInheritedFromGroup {
+  /** The Group that caused this rule to be in its current state. */
+  groupId: string;
+  /** This is always `inheritedFromGroup` */
+  type: string;
+}
+export const WafStatusRuleBlockReasonInheritedFromGroup =
+  /*@__PURE__*/ S.suspend(() =>
+    S.Struct({
+      groupId: S.String,
+      type: S.String,
+    }),
+  ).annotate({
+    identifier: "WafStatusRuleBlockReasonInheritedFromGroup",
+  }) as any as S.Schema<WafStatusRuleBlockReasonInheritedFromGroup>;
+
+/** Defines the Reason why a Rule is in the specified state (set to be enabled, disabled or logOnly). */
+export type WafStatusRuleBlockReason =
+  | WafStatusRuleBlockReasonNeverDefined
+  | WafStatusRuleBlockReasonDirectlyDefined
+  | WafStatusRuleBlockReasonInvalidWafType
+  | WafStatusRuleBlockReasonInheritedFromCollection
+  | WafStatusRuleBlockReasonInheritedFromGroup;
+export const WafStatusRuleBlockReason =
+  /*@__PURE__*/ S.Unknown as any as S.Schema<WafStatusRuleBlockReason>;
+
+export interface WafStatusRuleBlock {
+  /** Specifies the Id of the Rule. */
+  id: string;
+  reason: WafStatusRuleBlockReason;
+}
+export const WafStatusRuleBlock = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    id: S.String,
+    reason: WafStatusRuleBlockReason,
+  }),
+).annotate({
+  identifier: "WafStatusRuleBlock",
+}) as any as S.Schema<WafStatusRuleBlock>;
+
+export type DistributionWafDisabledRulesList = Array<WafStatusRuleBlock>;
+export const DistributionWafDisabledRulesList = /*@__PURE__*/ S.Array(
+  WafStatusRuleBlock,
+) as any as S.Schema<DistributionWafDisabledRulesList>;
+
+export type DistributionWafEnabledRulesList = Array<WafStatusRuleBlock>;
+export const DistributionWafEnabledRulesList = /*@__PURE__*/ S.Array(
+  WafStatusRuleBlock,
+) as any as S.Schema<DistributionWafEnabledRulesList>;
+
+export type DistributionWafLogOnlyRulesList = Array<WafStatusRuleBlock>;
+export const DistributionWafLogOnlyRulesList = /*@__PURE__*/ S.Array(
+  WafStatusRuleBlock,
+) as any as S.Schema<DistributionWafLogOnlyRulesList>;
+
+/** For this property to be present two pre-conditions must be met: - the WAF was enabled at least once - the query parameter ?withWafStatus is truthy This property contains the waf Status. At this point in time, this contains all resolved rules. Rules are split into 3 groups: - enabledRules - logOnlyRules - disabledRules **Do note that the global waf mode (Disabled, LogOnly, Enabled) is *NOT* reflected in this list!** */
+export interface DistributionWaf {
+  disabledRules: DistributionWafDisabledRulesList;
+  enabledRules: DistributionWafEnabledRulesList;
+  logOnlyRules: DistributionWafLogOnlyRulesList;
+}
+export const DistributionWaf = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    disabledRules: DistributionWafDisabledRulesList,
+    enabledRules: DistributionWafEnabledRulesList,
+    logOnlyRules: DistributionWafLogOnlyRulesList,
+  }),
+).annotate({
+  identifier: "DistributionWaf",
+}) as any as S.Schema<DistributionWaf>;
+
+export interface Distribution {
+  config: Config;
+  /** RFC3339 string defining when the distribution was created */
+  createdAt: string;
+  domains: DistributionDomainsList;
+  /** This object may be present if, and only if the distribution has encountered an error state. */
+  errors?: DistributionErrorsList;
+  id: string;
+  projectId: string;
+  /** - `CREATING`: The distribution was just created. All the relevant resources are created in the background. Once fully reconciled, this switches to `ACTIVE`. If there are any issues, the status changes to `ERROR`. You can look at the `errors` array to get more infos. - `ACTIVE`: The usual state. The desired configuration is synced, there are no errors - `UPDATING`: The state when there is a discrepancy between the desired and actual configuration state. This occurs right after an update. Will switch to `ACTIVE` or `ERROR`, depending on if synchronizing succeeds or not. - `DELETING`: The state right after a delete request was received. The distribution will stay in this status until all resources have been successfully removed, or until we encounter an `ERROR` state. **NOTE:** You can keep fetching the distribution while it is deleting. After successful deletion, trying to get a distribution will return a 404 Not Found response - `ERROR`: The error state. Look at the `errors` array for more info. */
+  status: DistributionStatus;
+  /** RFC3339 string which returns the last time the distribution configuration was modified. */
+  updatedAt: string;
+  /** For this property to be present two pre-conditions must be met: - the WAF was enabled at least once - the query parameter ?withWafStatus is truthy This property contains the waf Status. At this point in time, this contains all resolved rules. Rules are split into 3 groups: - enabledRules - logOnlyRules - disabledRules **Do note that the global waf mode (Disabled, LogOnly, Enabled) is *NOT* reflected in this list!** */
+  waf?: DistributionWaf;
+}
+export const Distribution = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    config: Config,
+    createdAt: S.String,
+    domains: DistributionDomainsList,
+    errors: S.optional(DistributionErrorsList),
+    id: S.String,
+    projectId: S.String,
+    status: DistributionStatus,
+    updatedAt: S.String,
+    waf: S.optional(DistributionWaf),
+  }),
+).annotate({ identifier: "Distribution" }) as any as S.Schema<Distribution>;
+
+export interface CreateDistributionResponse {
+  distribution: Distribution;
+}
+export const CreateDistributionResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    distribution: Distribution,
+  }),
+).annotate({
+  identifier: "CreateDistributionResponse",
+}) as any as S.Schema<CreateDistributionResponse>;
+
+export interface DeleteCustomDomainRequest {
+  /** Your STACKIT Project Id */
+  projectId: string;
+  distributionId: string;
+  domain: string;
+  intentId?: string;
+}
+export const DeleteCustomDomainRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    projectId: S.String.pipe(T.Label()),
+    distributionId: S.String.pipe(T.Label()),
+    domain: S.String.pipe(T.Label()),
+    intentId: S.optional(S.String.pipe(T.Query())),
+  }).pipe(
+    T.Http({
+      method: "DELETE",
+      uri: "/v1/projects/{projectId}/distributions/{distributionId}/customDomains/{domain}",
+      code: 200,
+      baseUrl: "https://cdn.api.stackit.cloud",
+    }),
+  ),
+).annotate({
+  identifier: "DeleteCustomDomainRequest",
+}) as any as S.Schema<DeleteCustomDomainRequest>;
+
+/** This object is present if the custom domain has errors. */
+export type CustomDomainErrorsList = Array<StatusError>;
+export const CustomDomainErrorsList = /*@__PURE__*/ S.Array(
+  StatusError,
+) as any as S.Schema<CustomDomainErrorsList>;
+
+/** Definition of a custom domain */
+export interface CustomDomain {
+  /** This object is present if the custom domain has errors. */
+  errors?: CustomDomainErrorsList;
+  /** The domain. Can be used as input for the GetCustomDomain endpoint */
+  name: string;
+  status: DomainStatus;
+}
+export const CustomDomain = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    errors: S.optional(CustomDomainErrorsList),
+    name: S.String,
+    status: DomainStatus,
+  }),
+).annotate({ identifier: "CustomDomain" }) as any as S.Schema<CustomDomain>;
+
+/** Returns the custom domain that was deleted while the deletion has not completed yet. After the deletion was successful the response will be empty. */
+export interface DeleteCustomDomainResponse {
+  customDomain?: CustomDomain;
+}
+export const DeleteCustomDomainResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    customDomain: S.optional(CustomDomain),
+  }),
+).annotate({
+  identifier: "DeleteCustomDomainResponse",
+}) as any as S.Schema<DeleteCustomDomainResponse>;
+
+export interface DeleteDistributionRequest {
+  /** Your STACKIT Project Id */
+  projectId: string;
+  distributionId: string;
+  /** While optional, it is greatly encouraged to provide an `intentId`. This is used to deduplicate requests. If multiple DELETE-Requests with the same `intentId` are received, all but the first request are dropped. */
+  intentId?: string;
+}
+export const DeleteDistributionRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    projectId: S.String.pipe(T.Label()),
+    distributionId: S.String.pipe(T.Label()),
+    intentId: S.optional(S.String.pipe(T.Query())),
+  }).pipe(
+    T.Http({
+      method: "DELETE",
+      uri: "/v1/projects/{projectId}/distributions/{distributionId}",
+      code: 200,
+      baseUrl: "https://cdn.api.stackit.cloud",
+    }),
+  ),
+).annotate({
+  identifier: "DeleteDistributionRequest",
+}) as any as S.Schema<DeleteDistributionRequest>;
+
+export interface DeleteDistributionResponse {
+  distribution?: Distribution;
+}
+export const DeleteDistributionResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    distribution: S.optional(Distribution),
+  }),
+).annotate({
+  identifier: "DeleteDistributionResponse",
+}) as any as S.Schema<DeleteDistributionResponse>;
+
+export interface FindCachePathsRequest {
+  /** Your STACKIT Project Id */
+  projectId: string;
+  distributionId: string;
+  /** A substring of the search query. */
+  path: string;
+}
+export const FindCachePathsRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    projectId: S.String.pipe(T.Label()),
+    distributionId: S.String.pipe(T.Label()),
+    path: S.String.pipe(T.Query()),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/v1/projects/{projectId}/distributions/{distributionId}/cache/paths",
+      code: 200,
+      baseUrl: "https://cdn.api.stackit.cloud",
+    }),
+  ),
+).annotate({
+  identifier: "FindCachePathsRequest",
+}) as any as S.Schema<FindCachePathsRequest>;
+
+export interface FindCachePathsResponseEntry {
+  /** Defines one path that was previously used as part of a granular purge */
+  path: string;
+}
+export const FindCachePathsResponseEntry = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    path: S.String,
+  }),
+).annotate({
+  identifier: "FindCachePathsResponseEntry",
+}) as any as S.Schema<FindCachePathsResponseEntry>;
+
+export type FindCachePathsResponseResponseList =
+  Array<FindCachePathsResponseEntry>;
+export const FindCachePathsResponseResponseList = /*@__PURE__*/ S.Array(
+  FindCachePathsResponseEntry,
+) as any as S.Schema<FindCachePathsResponseResponseList>;
+
+export interface FindCachePathsResponse {
+  response: FindCachePathsResponseResponseList;
+}
+export const FindCachePathsResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    response: FindCachePathsResponseResponseList,
+  }),
+).annotate({
+  identifier: "FindCachePathsResponse",
+}) as any as S.Schema<FindCachePathsResponse>;
+
+export interface GetCacheInfoRequest {
+  /** Your STACKIT Project Id */
+  projectId: string;
+  distributionId: string;
+  purgePath?: string;
+}
+export const GetCacheInfoRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    projectId: S.String.pipe(T.Label()),
+    distributionId: S.String.pipe(T.Label()),
+    purgePath: S.optional(S.String.pipe(T.Query())),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/v1/projects/{projectId}/distributions/{distributionId}/cache",
+      code: 200,
+      baseUrl: "https://cdn.api.stackit.cloud",
+    }),
+  ),
+).annotate({
+  identifier: "GetCacheInfoRequest",
+}) as any as S.Schema<GetCacheInfoRequest>;
+
+export type GetCacheInfoResponseHistoryEntryType = "full" | "granular";
+export const GetCacheInfoResponseHistoryEntryType = /*@__PURE__*/ S.String;
+
+export interface GetCacheInfoResponseHistoryEntry {
+  occurredAt: string;
+  type: GetCacheInfoResponseHistoryEntryType;
+}
+export const GetCacheInfoResponseHistoryEntry = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    occurredAt: S.String,
+    type: GetCacheInfoResponseHistoryEntryType,
+  }),
+).annotate({
+  identifier: "GetCacheInfoResponseHistoryEntry",
+}) as any as S.Schema<GetCacheInfoResponseHistoryEntry>;
+
+export type GetCacheInfoResponseHistoryList =
+  Array<GetCacheInfoResponseHistoryEntry>;
+export const GetCacheInfoResponseHistoryList = /*@__PURE__*/ S.Array(
+  GetCacheInfoResponseHistoryEntry,
+) as any as S.Schema<GetCacheInfoResponseHistoryList>;
+
+export interface GetCacheInfoResponse {
+  history: GetCacheInfoResponseHistoryList;
+  /** Returns the last time the cache was purged by calling the PurgeCache endpoint. Time represented as RFC3339 compliant string. If the cache was never purged, this returns `null` */
+  lastPurgeTime: string | null;
+}
+export const GetCacheInfoResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    history: GetCacheInfoResponseHistoryList,
+    lastPurgeTime: S.NullOr(S.String),
+  }),
+).annotate({
+  identifier: "GetCacheInfoResponse",
+}) as any as S.Schema<GetCacheInfoResponse>;
+
+export interface GetCustomDomainRequest {
+  /** Your STACKIT Project Id */
+  projectId: string;
+  distributionId: string;
+  domain: string;
+}
+export const GetCustomDomainRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    projectId: S.String.pipe(T.Label()),
+    distributionId: S.String.pipe(T.Label()),
+    domain: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/v1/projects/{projectId}/distributions/{distributionId}/customDomains/{domain}",
+      code: 200,
+      baseUrl: "https://cdn.api.stackit.cloud",
+    }),
+  ),
+).annotate({
+  identifier: "GetCustomDomainRequest",
+}) as any as S.Schema<GetCustomDomainRequest>;
+
+/** This is returned when no custom certificate is used. We provision and manage a Let's Encrypt Certificate for you */
+export interface GetCustomDomainManagedCertificate {
+  type: string;
+}
+export const GetCustomDomainManagedCertificate = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    type: S.String,
+  }),
+).annotate({
+  identifier: "GetCustomDomainManagedCertificate",
+}) as any as S.Schema<GetCustomDomainManagedCertificate>;
+
+/** Returned if a custom certificate is used. Response does not contain the certificate or key. */
+export interface GetCustomDomainCustomCertificate {
+  /** Returns if the CNAME Check has been disabled for this Custom Domain. This is usually set for migrations to allow for no downtime. */
+  skipDnsCheck: boolean;
+  type: string;
+  /** Whenever a new custom certificate is added the version is increased by 1. */
+  version: number;
+}
+export const GetCustomDomainCustomCertificate = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    skipDnsCheck: S.Boolean,
+    type: S.String,
+    version: S.Number,
+  }),
+).annotate({
+  identifier: "GetCustomDomainCustomCertificate",
+}) as any as S.Schema<GetCustomDomainCustomCertificate>;
+
+export type GetCustomDomainResponseCertificate =
+  | GetCustomDomainManagedCertificate
+  | GetCustomDomainCustomCertificate;
+export const GetCustomDomainResponseCertificate =
+  /*@__PURE__*/ S.Unknown as any as S.Schema<GetCustomDomainResponseCertificate>;
+
+export interface GetCustomDomainResponse {
+  certificate: GetCustomDomainResponseCertificate;
+  customDomain: CustomDomain;
+}
+export const GetCustomDomainResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    certificate: GetCustomDomainResponseCertificate,
+    customDomain: CustomDomain,
+  }),
+).annotate({
+  identifier: "GetCustomDomainResponse",
+}) as any as S.Schema<GetCustomDomainResponse>;
+
+export interface GetDistributionRequest {
+  /** Your STACKIT Project Id */
+  projectId: string;
+  distributionId: string;
+  /** If set, the top level of a distribution contains a `waf` property, which defines the status of the waf. This includes a list of all resolved rules. */
+  withWafStatus?: boolean;
+}
+export const GetDistributionRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    projectId: S.String.pipe(T.Label()),
+    distributionId: S.String.pipe(T.Label()),
+    withWafStatus: S.optional(S.Boolean.pipe(T.Query())),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/v1/projects/{projectId}/distributions/{distributionId}",
+      code: 200,
+      baseUrl: "https://cdn.api.stackit.cloud",
+    }),
+  ),
+).annotate({
+  identifier: "GetDistributionRequest",
+}) as any as S.Schema<GetDistributionRequest>;
+
+export interface GetDistributionResponse {
+  distribution: Distribution;
+}
+export const GetDistributionResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    distribution: Distribution,
+  }),
+).annotate({
+  identifier: "GetDistributionResponse",
+}) as any as S.Schema<GetDistributionResponse>;
+
+export type GetLogsRequestSortBy =
+  | "timestamp"
+  | "dataCenterRegion"
+  | "requestCountryCode"
+  | "statusCode"
+  | "cacheHit"
+  | "size"
+  | "path"
+  | "host";
+export const GetLogsRequestSortBy = /*@__PURE__*/ S.String;
+
+export type GetLogsRequestSortOrder = "ascending" | "descending";
+export const GetLogsRequestSortOrder = /*@__PURE__*/ S.String;
+
+/** The action a WAF rule can take based on a request */
+export type WAFRuleAction = "BLOCKED" | "LOGGED" | "ALLOWED";
+export const WAFRuleAction = /*@__PURE__*/ S.String;
+
+export interface GetLogsRequest {
+  /** Your STACKIT Project Id */
+  projectId: string;
+  /** Your CDN distribution Id */
+  distributionId: string;
+  /** the start of the time range for which logs should be returned */
+  from?: string;
+  /** the end of the time range for which logs should be returned. If not specified, "now" is used. */
+  to?: string;
+  /** Quantifies how many log entries should be returned on this page. Must be a natural number between 1 and 1000 (inclusive) */
+  pageSize?: number;
+  /** Identifier is returned by the previous response and is used to request the next page. As the `pageIdentifier` encodes an element, inserts during pagination will *not* shift the result. So a scenario like: - Start listing first page - Insert new element - Start listing second page will *never* result in an element from the first page to get "pushed" to the second page, like it could occur with basic limit + offset pagination. The identifier should be treated as an opaque string and never modified. Only pass values returned by the API. */
+  pageIdentifier?: string;
+  /** Sorts the log messages by a specific field. Defaults to `timestamp`. Supported sort options: - `timestamp` - `dataCenterRegion` - `requestCountryCode` - `statusCode` - `cacheHit` - `size` - `path` - `host` */
+  sortBy?: GetLogsRequestSortBy | (string & {});
+  sortOrder?: GetLogsRequestSortOrder | (string & {});
+  /** If this is set then only log entries with the chosen WAF rule action/outcome are returned. Specifically, if `ALLOWED` then all requests with no violation are returned. If `BLOCKED` then those where a WAF rule blocked a request and if `LOGGED` then only those requests where the WAF violation was only logged but the request not blocked */
+  wafAction?: WAFRuleAction | (string & {});
+  /** Filters by the CDN data center region that served the request. Can be combined with other filters */
+  dataCenterRegion?: string;
+  /** Filters by the originating country of the user request. Can be combined with other filters */
+  requestCountryCode?: string;
+  /** Filters by the HTTP status code returned to the client. Can be combined with other filters */
+  statusCode?: number;
+  /** Filters based on whether the request was served from the CDN cache. Can be combined with other filters */
+  cacheHit?: boolean;
+}
+export const GetLogsRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    projectId: S.String.pipe(T.Label()),
+    distributionId: S.String.pipe(T.Label()),
+    from: S.optional(S.String.pipe(T.Query())),
+    to: S.optional(S.String.pipe(T.Query())),
+    pageSize: S.optional(S.Number.pipe(T.Query())),
+    pageIdentifier: S.optional(S.String.pipe(T.Query())),
+    sortBy: S.optional(GetLogsRequestSortBy.pipe(T.Query())),
+    sortOrder: S.optional(GetLogsRequestSortOrder.pipe(T.Query())),
+    wafAction: S.optional(WAFRuleAction.pipe(T.Query())),
+    dataCenterRegion: S.optional(S.String.pipe(T.Query())),
+    requestCountryCode: S.optional(S.String.pipe(T.Query())),
+    statusCode: S.optional(S.Number.pipe(T.Query())),
+    cacheHit: S.optional(S.Boolean.pipe(T.Query())),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/v1/projects/{projectId}/distributions/{distributionId}/logs",
+      code: 200,
+      baseUrl: "https://cdn.api.stackit.cloud",
+    }),
+  ),
+).annotate({ identifier: "GetLogsRequest" }) as any as S.Schema<GetLogsRequest>;
+
+export type WAFViolationRequestHeadersMap = {
+  [key: string]: string | undefined;
+};
+export const WAFViolationRequestHeadersMap = /*@__PURE__*/ S.Record(
+  S.String,
+  S.String,
+) as any as S.Schema<WAFViolationRequestHeadersMap>;
+
+/** Information about a violated WAF rule in case the WAF is enabled and a rule was triggered (either in BLOCK or LOG_ONLY mode) */
+export interface WAFViolation {
+  action: WAFRuleAction;
+  /** ASN for the request */
+  asn: string;
+  /** Rule specific message explaining the violation */
+  message: string;
+  /** HTTP Method of the request that triggered the violation */
+  method: string;
+  requestHeaders: WAFViolationRequestHeadersMap;
+  /** ID of the WAF rule that was triggered */
+  ruleId: string;
+}
+export const WAFViolation = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    action: WAFRuleAction,
+    asn: S.String,
+    message: S.String,
+    method: S.String,
+    requestHeaders: WAFViolationRequestHeadersMap,
+    ruleId: S.String,
+  }),
+).annotate({ identifier: "WAFViolation" }) as any as S.Schema<WAFViolation>;
+
+export interface DistributionLogsRecord {
+  cacheHit: boolean;
+  dataCenterRegion: string;
+  distributionId: string;
+  host: string;
+  path: string;
+  /** ISO 3166-1 A2 compliant country code */
+  requestCountryCode: string;
+  size: number;
+  statusCode: number;
+  timestamp: string;
+  wafViolation?: WAFViolation;
+}
+export const DistributionLogsRecord = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    cacheHit: S.Boolean,
+    dataCenterRegion: S.String,
+    distributionId: S.String,
+    host: S.String,
+    path: S.String,
+    requestCountryCode: S.String,
+    size: S.Number,
+    statusCode: S.Number,
+    timestamp: S.String,
+    wafViolation: S.optional(WAFViolation),
+  }),
+).annotate({
+  identifier: "DistributionLogsRecord",
+}) as any as S.Schema<DistributionLogsRecord>;
+
+export type GetLogsResponseLogsList = Array<DistributionLogsRecord>;
+export const GetLogsResponseLogsList = /*@__PURE__*/ S.Array(
+  DistributionLogsRecord,
+) as any as S.Schema<GetLogsResponseLogsList>;
+
+export interface GetLogsResponse {
+  logs: GetLogsResponseLogsList;
+  nextPageIdentifier?: string;
+}
+export const GetLogsResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    logs: GetLogsResponseLogsList,
+    nextPageIdentifier: S.optional(S.String),
+  }),
+).annotate({
+  identifier: "GetLogsResponse",
+}) as any as S.Schema<GetLogsResponse>;
+
+export interface GetLogsSearchFiltersRequest {
+  /** Your STACKIT Project ID. */
+  projectId: string;
+  /** Your CDN distribution ID. */
+  distributionId: string;
+  /** Optional search string. Will search the **values** for the text input. */
+  filter?: string;
+}
+export const GetLogsSearchFiltersRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    projectId: S.String.pipe(T.Label()),
+    distributionId: S.String.pipe(T.Label()),
+    filter: S.optional(S.String.pipe(T.Query())),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/v1/projects/{projectId}/distributions/{distributionId}/logs/searchFilters",
+      code: 200,
+      baseUrl: "https://cdn.api.stackit.cloud",
+    }),
+  ),
+).annotate({
+  identifier: "GetLogsSearchFiltersRequest",
+}) as any as S.Schema<GetLogsSearchFiltersRequest>;
+
+export type GetLogsSearchFiltersResponseCacheItem = "HIT" | "MISS";
+export const GetLogsSearchFiltersResponseCacheItem = /*@__PURE__*/ S.String;
+
+export type GetLogsSearchFiltersResponseCacheList =
+  Array<GetLogsSearchFiltersResponseCacheItem>;
+export const GetLogsSearchFiltersResponseCacheList = /*@__PURE__*/ S.Array(
+  GetLogsSearchFiltersResponseCacheItem,
+) as any as S.Schema<GetLogsSearchFiltersResponseCacheList>;
+
+/** A datacenter. The `id` defines the key needed to filter against the logs endpoint, while the `displayName` defines a human-readable Name. */
+export interface GetLogsSearchFiltersResponseDatacenterBlockItem {
+  displayName: string;
+  id: string;
+}
+export const GetLogsSearchFiltersResponseDatacenterBlockItem =
+  /*@__PURE__*/ S.suspend(() =>
+    S.Struct({
+      displayName: S.String,
+      id: S.String,
+    }),
+  ).annotate({
+    identifier: "GetLogsSearchFiltersResponseDatacenterBlockItem",
+  }) as any as S.Schema<GetLogsSearchFiltersResponseDatacenterBlockItem>;
+
+export type GetLogsSearchFiltersResponseDatacenterBlockAFList =
+  Array<GetLogsSearchFiltersResponseDatacenterBlockItem>;
+export const GetLogsSearchFiltersResponseDatacenterBlockAFList =
+  /*@__PURE__*/ S.Array(
+    GetLogsSearchFiltersResponseDatacenterBlockItem,
+  ) as any as S.Schema<GetLogsSearchFiltersResponseDatacenterBlockAFList>;
+
+export type GetLogsSearchFiltersResponseDatacenterBlockASIAList =
+  Array<GetLogsSearchFiltersResponseDatacenterBlockItem>;
+export const GetLogsSearchFiltersResponseDatacenterBlockASIAList =
+  /*@__PURE__*/ S.Array(
+    GetLogsSearchFiltersResponseDatacenterBlockItem,
+  ) as any as S.Schema<GetLogsSearchFiltersResponseDatacenterBlockASIAList>;
+
+export type GetLogsSearchFiltersResponseDatacenterBlockEUList =
+  Array<GetLogsSearchFiltersResponseDatacenterBlockItem>;
+export const GetLogsSearchFiltersResponseDatacenterBlockEUList =
+  /*@__PURE__*/ S.Array(
+    GetLogsSearchFiltersResponseDatacenterBlockItem,
+  ) as any as S.Schema<GetLogsSearchFiltersResponseDatacenterBlockEUList>;
+
+export type GetLogsSearchFiltersResponseDatacenterBlockNAList =
+  Array<GetLogsSearchFiltersResponseDatacenterBlockItem>;
+export const GetLogsSearchFiltersResponseDatacenterBlockNAList =
+  /*@__PURE__*/ S.Array(
+    GetLogsSearchFiltersResponseDatacenterBlockItem,
+  ) as any as S.Schema<GetLogsSearchFiltersResponseDatacenterBlockNAList>;
+
+export type GetLogsSearchFiltersResponseDatacenterBlockSAList =
+  Array<GetLogsSearchFiltersResponseDatacenterBlockItem>;
+export const GetLogsSearchFiltersResponseDatacenterBlockSAList =
+  /*@__PURE__*/ S.Array(
+    GetLogsSearchFiltersResponseDatacenterBlockItem,
+  ) as any as S.Schema<GetLogsSearchFiltersResponseDatacenterBlockSAList>;
+
+/** Object containing Datacenters to filter for. Each datacenter is grouped to the respective region. */
+export interface GetLogsSearchFiltersResponseDatacenterBlock {
+  AF: GetLogsSearchFiltersResponseDatacenterBlockAFList;
+  ASIA: GetLogsSearchFiltersResponseDatacenterBlockASIAList;
+  EU: GetLogsSearchFiltersResponseDatacenterBlockEUList;
+  NA: GetLogsSearchFiltersResponseDatacenterBlockNAList;
+  SA: GetLogsSearchFiltersResponseDatacenterBlockSAList;
+}
+export const GetLogsSearchFiltersResponseDatacenterBlock =
+  /*@__PURE__*/ S.suspend(() =>
+    S.Struct({
+      AF: GetLogsSearchFiltersResponseDatacenterBlockAFList,
+      ASIA: GetLogsSearchFiltersResponseDatacenterBlockASIAList,
+      EU: GetLogsSearchFiltersResponseDatacenterBlockEUList,
+      NA: GetLogsSearchFiltersResponseDatacenterBlockNAList,
+      SA: GetLogsSearchFiltersResponseDatacenterBlockSAList,
+    }),
+  ).annotate({
+    identifier: "GetLogsSearchFiltersResponseDatacenterBlock",
+  }) as any as S.Schema<GetLogsSearchFiltersResponseDatacenterBlock>;
+
+/** List of ISO-3166 Alpha2 Country Codes matching the input filter. Response is ordered in ascending order. For more Info about the country codes, see https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2 */
+export type GetLogsSearchFiltersResponseRemoteCountryList = Array<string>;
+export const GetLogsSearchFiltersResponseRemoteCountryList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<GetLogsSearchFiltersResponseRemoteCountryList>;
+
+/** List of Status Codes matching the input filter. Response is ordered in ascending order. */
+export type GetLogsSearchFiltersResponseStatusList = Array<number>;
+export const GetLogsSearchFiltersResponseStatusList = /*@__PURE__*/ S.Array(
+  S.Number,
+) as any as S.Schema<GetLogsSearchFiltersResponseStatusList>;
+
+export interface GetLogsSearchFiltersResponse {
+  cache: GetLogsSearchFiltersResponseCacheList;
+  dataCenter: GetLogsSearchFiltersResponseDatacenterBlock;
+  /** List of ISO-3166 Alpha2 Country Codes matching the input filter. Response is ordered in ascending order. For more Info about the country codes, see https://en.wikipedia.org/wiki/ISO_3166-1_alpha-2 */
+  remoteCountry: GetLogsSearchFiltersResponseRemoteCountryList;
+  /** List of Status Codes matching the input filter. Response is ordered in ascending order. */
+  status: GetLogsSearchFiltersResponseStatusList;
+}
+export const GetLogsSearchFiltersResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    cache: GetLogsSearchFiltersResponseCacheList,
+    dataCenter: GetLogsSearchFiltersResponseDatacenterBlock,
+    remoteCountry: GetLogsSearchFiltersResponseRemoteCountryList,
+    status: GetLogsSearchFiltersResponseStatusList,
+  }),
+).annotate({
+  identifier: "GetLogsSearchFiltersResponse",
+}) as any as S.Schema<GetLogsSearchFiltersResponse>;
+
+export type GetStatisticsRequestInterval =
+  | "hourly"
+  | "daily"
+  | "monthly"
+  | "yearly";
+export const GetStatisticsRequestInterval = /*@__PURE__*/ S.String;
+
+export interface GetStatisticsRequest {
+  /** Your STACKIT Project Id */
+  projectId: string;
+  distributionId: string;
+  /** the start of the time range for which statistics should be returned */
+  from: string;
+  /** the end of the time range for which statistics should be returned. If not specified, the end of the current time interval is used, e.g. next day for daily, next month for monthly, and so on. */
+  to?: string;
+  /** Over which interval should statistics be aggregated? defaults to hourly resolution **NOTE**: Intervals are grouped in buckets that start and end based on a day in UTC+0 time. So for the `daily` interval, the group starts (inclusive) and ends (exclusive) at `00:00Z` */
+  interval?: GetStatisticsRequestInterval | (string & {});
+}
+export const GetStatisticsRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    projectId: S.String.pipe(T.Label()),
+    distributionId: S.String.pipe(T.Label()),
+    from: S.String.pipe(T.Query()),
+    to: S.optional(S.String.pipe(T.Query())),
+    interval: S.optional(GetStatisticsRequestInterval.pipe(T.Query())),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/v1/projects/{projectId}/distributions/{distributionId}/statistics",
+      code: 200,
+      baseUrl: "https://cdn.api.stackit.cloud",
+    }),
+  ),
+).annotate({
+  identifier: "GetStatisticsRequest",
+}) as any as S.Schema<GetStatisticsRequest>;
+
+export interface DistributionStatisticsRecordEntry {
+  /** Number of cached requests that were served */
+  cachedRequests: number;
+  /** Total number of requests that were served */
+  totalRequests: number;
+  /** Total traffic in bytes that occurred during the time interval */
+  totalTrafficBytes: number;
+}
+export const DistributionStatisticsRecordEntry = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    cachedRequests: S.Number,
+    totalRequests: S.Number,
+    totalTrafficBytes: S.Number,
+  }),
+).annotate({
+  identifier: "DistributionStatisticsRecordEntry",
+}) as any as S.Schema<DistributionStatisticsRecordEntry>;
+
+/** Mapping of regions to the metrics for this region for the defined time interval All regions are always present. If no traffic was reported for a region, it will still contain 0-filled properties */
+export interface DistributionStatisticsRecordRegions {
+  AF: DistributionStatisticsRecordEntry;
+  ASIA: DistributionStatisticsRecordEntry;
+  EU: DistributionStatisticsRecordEntry;
+  SA: DistributionStatisticsRecordEntry;
+  US: DistributionStatisticsRecordEntry;
+}
+export const DistributionStatisticsRecordRegions = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    AF: DistributionStatisticsRecordEntry,
+    ASIA: DistributionStatisticsRecordEntry,
+    EU: DistributionStatisticsRecordEntry,
+    SA: DistributionStatisticsRecordEntry,
+    US: DistributionStatisticsRecordEntry,
+  }),
+).annotate({
+  identifier: "DistributionStatisticsRecordRegions",
+}) as any as S.Schema<DistributionStatisticsRecordRegions>;
+
+/** Aggregated statistics of a distribution during a time interval */
+export interface DistributionStatisticsRecord {
+  /** Number of cached requests that were served */
+  cachedRequests: number;
+  /** Total number of requests that were served */
+  totalRequests: number;
+  /** Total traffic in bytes that occurred during the time interval */
+  totalTrafficBytes: number;
+  /** Exclusive end of the time interval the statistics refer to */
+  end: string;
+  regions: DistributionStatisticsRecordRegions;
+  /** Start of the time interval the statistics refer to */
+  start: string;
+}
+export const DistributionStatisticsRecord = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    cachedRequests: S.Number,
+    totalRequests: S.Number,
+    totalTrafficBytes: S.Number,
+    end: S.String,
+    regions: DistributionStatisticsRecordRegions,
+    start: S.String,
+  }),
+).annotate({
+  identifier: "DistributionStatisticsRecord",
+}) as any as S.Schema<DistributionStatisticsRecord>;
+
+export type GetStatisticsResponseRecordsList =
+  Array<DistributionStatisticsRecord>;
+export const GetStatisticsResponseRecordsList = /*@__PURE__*/ S.Array(
+  DistributionStatisticsRecord,
+) as any as S.Schema<GetStatisticsResponseRecordsList>;
+
+export interface GetStatisticsResponse {
+  records: GetStatisticsResponseRecordsList;
+}
+export const GetStatisticsResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    records: GetStatisticsResponseRecordsList,
+  }),
+).annotate({
+  identifier: "GetStatisticsResponse",
+}) as any as S.Schema<GetStatisticsResponse>;
+
+export type ListDistributionsRequestSortBy =
+  | "id"
+  | "updatedAt"
+  | "createdAt"
+  | "originUrl"
+  | "status"
+  | "originUrlRelated";
+export const ListDistributionsRequestSortBy = /*@__PURE__*/ S.String;
+
+export type ListDistributionsRequestSortOrder = "ascending" | "descending";
+export const ListDistributionsRequestSortOrder = /*@__PURE__*/ S.String;
+
+export interface ListDistributionsRequest {
+  /** Your STACKIT Project Id */
+  projectId: string;
+  /** Quantifies how many distributions should be returned on this page. Must be a natural number between 1 and 100 (inclusive) */
+  pageSize?: number;
+  /** If set, the top level of a distribution contains a `waf` property, which defines the status of the waf. This includes a list of all resolved rules. */
+  withWafStatus?: boolean;
+  /** Identifier is returned by the previous response and is used to request the next page. As the `pageIdentifier` encodes an element, inserts during pagination will *not* shift the result. So a scenario like: - Start listing first page - Insert new element - Start listing second page will *never* result in an element from the first page to get "pushed" to the second page, like it could occur with basic limit + offset pagination. The identifier should be treated as an opaque string and never modified. Only pass values returned by the API. */
+  pageIdentifier?: string;
+  /** The following sort options exist. We default to `createdAt` - `id` - Sort by distribution Id using String comparison - `updatedAt` - Sort by when the distribution configuration was last modified, for example by changing the regions or response headers - `createdAt` - Sort by when the distribution was initially created. - `originUrl` - Sort by originUrl using String comparison - `status` - Sort by distribution status, using String comparison - `originUrlRelated` - The originUrl is segmented and reversed before sorting. E.g. `www.example.com` is converted to `com.example.www` for sorting. This way, distributions pointing to the same domain trees are grouped next to each other. */
+  sortBy?: ListDistributionsRequestSortBy | (string & {});
+  sortOrder?: ListDistributionsRequestSortOrder | (string & {});
+}
+export const ListDistributionsRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    projectId: S.String.pipe(T.Label()),
+    pageSize: S.optional(S.Number.pipe(T.Query())),
+    withWafStatus: S.optional(S.Boolean.pipe(T.Query())),
+    pageIdentifier: S.optional(S.String.pipe(T.Query())),
+    sortBy: S.optional(ListDistributionsRequestSortBy.pipe(T.Query())),
+    sortOrder: S.optional(ListDistributionsRequestSortOrder.pipe(T.Query())),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/v1/projects/{projectId}/distributions",
+      code: 200,
+      baseUrl: "https://cdn.api.stackit.cloud",
+    }),
+  ),
+).annotate({
+  identifier: "ListDistributionsRequest",
+}) as any as S.Schema<ListDistributionsRequest>;
+
+export type ListDistributionsResponseDistributionsList = Array<Distribution>;
+export const ListDistributionsResponseDistributionsList = /*@__PURE__*/ S.Array(
+  Distribution,
+) as any as S.Schema<ListDistributionsResponseDistributionsList>;
+
+export interface ListDistributionsResponse {
+  distributions: ListDistributionsResponseDistributionsList;
+  nextPageIdentifier?: string;
+}
+export const ListDistributionsResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    distributions: ListDistributionsResponseDistributionsList,
+    nextPageIdentifier: S.optional(S.String),
+  }),
+).annotate({
+  identifier: "ListDistributionsResponse",
+}) as any as S.Schema<ListDistributionsResponse>;
+
+export interface ListWafCollectionsRequest {
+  /** Your STACKIT Project Id */
+  projectId: string;
+}
+export const ListWafCollectionsRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    projectId: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/v1/projects/{projectId}/waf/collections",
+      code: 200,
+      baseUrl: "https://cdn.api.stackit.cloud",
+    }),
+  ),
+).annotate({
+  identifier: "ListWafCollectionsRequest",
+}) as any as S.Schema<ListWafCollectionsRequest>;
+
+/** LocalizedString is a map from language to string value */
+export type LocalizedString = { [key: string]: string | undefined };
+export const LocalizedString = /*@__PURE__*/ S.Record(
+  S.String,
+  S.String,
+) as any as S.Schema<LocalizedString>;
+
+export interface WafRule {
+  /** Optional CoreRuleSet rule Id in case this is a CRS rule */
+  code?: string;
+  description: LocalizedString;
+  id: string;
+}
+export const WafRule = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    code: S.optional(S.String),
+    description: LocalizedString,
+    id: S.String,
+  }),
+).annotate({ identifier: "WafRule" }) as any as S.Schema<WafRule>;
+
+export type WafRuleGroupRulesList = Array<WafRule>;
+export const WafRuleGroupRulesList = /*@__PURE__*/ S.Array(
+  WafRule,
+) as any as S.Schema<WafRuleGroupRulesList>;
+
+export interface WafRuleGroup {
+  description: LocalizedString;
+  name: LocalizedString;
+  rules: WafRuleGroupRulesList;
+}
+export const WafRuleGroup = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    description: LocalizedString,
+    name: LocalizedString,
+    rules: WafRuleGroupRulesList,
+  }),
+).annotate({ identifier: "WafRuleGroup" }) as any as S.Schema<WafRuleGroup>;
+
+export type WafRuleCollectionGroupsList = Array<WafRuleGroup>;
+export const WafRuleCollectionGroupsList = /*@__PURE__*/ S.Array(
+  WafRuleGroup,
+) as any as S.Schema<WafRuleCollectionGroupsList>;
+
+export interface WafRuleCollection {
+  groups: WafRuleCollectionGroupsList;
+  id: string;
+  name: LocalizedString;
+}
+export const WafRuleCollection = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    groups: WafRuleCollectionGroupsList,
+    id: S.String,
+    name: LocalizedString,
+  }),
+).annotate({
+  identifier: "WafRuleCollection",
+}) as any as S.Schema<WafRuleCollection>;
+
+export type ListWafCollectionsResponseCollectionsList =
+  Array<WafRuleCollection>;
+export const ListWafCollectionsResponseCollectionsList = /*@__PURE__*/ S.Array(
+  WafRuleCollection,
+) as any as S.Schema<ListWafCollectionsResponseCollectionsList>;
+
+export interface ListWafCollectionsResponse {
+  collections: ListWafCollectionsResponseCollectionsList;
+}
+export const ListWafCollectionsResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    collections: ListWafCollectionsResponseCollectionsList,
+  }),
+).annotate({
+  identifier: "ListWafCollectionsResponse",
+}) as any as S.Schema<ListWafCollectionsResponse>;
+
+export type HttpBackendPatchGeofencingValueList = Array<string>;
+export const HttpBackendPatchGeofencingValueList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<HttpBackendPatchGeofencingValueList>;
+
+/** An object mapping multiple alternative origins to country codes. Any request from one of those country codes will route to the alternative origin. Do note that country codes may only be used once. You cannot have a country be assigned to multiple alternative origins. */
+export type HttpBackendPatchGeofencingMap = {
+  [key: string]: HttpBackendPatchGeofencingValueList | undefined;
+};
+export const HttpBackendPatchGeofencingMap = /*@__PURE__*/ S.Record(
+  S.String,
+  HttpBackendPatchGeofencingValueList,
+) as any as S.Schema<HttpBackendPatchGeofencingMap>;
+
+/** Headers that will be sent with every request to the configured origin. **WARNING**: Do not store sensitive values in the headers. The configuration is stored as plain text. */
+export type HttpBackendPatchOriginRequestHeadersMap = {
+  [key: string]: string | undefined;
+};
+export const HttpBackendPatchOriginRequestHeadersMap = /*@__PURE__*/ S.Record(
+  S.String,
+  S.String,
+) as any as S.Schema<HttpBackendPatchOriginRequestHeadersMap>;
+
+/** Defines the type of content origin. For this schema, it must be set to `http`. */
+export type HttpBackendPatchType = "http";
+export const HttpBackendPatchType = /*@__PURE__*/ S.String;
+
+/** A partial HTTP Backend */
+export interface HttpBackendPatch {
+  /** An object mapping multiple alternative origins to country codes. Any request from one of those country codes will route to the alternative origin. Do note that country codes may only be used once. You cannot have a country be assigned to multiple alternative origins. */
+  geofencing?: HttpBackendPatchGeofencingMap;
+  /** Headers that will be sent with every request to the configured origin. **WARNING**: Do not store sensitive values in the headers. The configuration is stored as plain text. */
+  originRequestHeaders?: HttpBackendPatchOriginRequestHeadersMap;
+  /** The origin of the content that should be made available through the CDN. Note that the path and query parameters are ignored. Ports are allowed. If no protocol is provided, `https` is assumed. So `www.example.com:1234/somePath?q=123` is normalized to `https://www.example.com:1234` */
+  originUrl?: string;
+  /** Defines the type of content origin. For this schema, it must be set to `http`. */
+  type: HttpBackendPatchType;
+}
+export const HttpBackendPatch = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    geofencing: S.optional(HttpBackendPatchGeofencingMap),
+    originRequestHeaders: S.optional(HttpBackendPatchOriginRequestHeadersMap),
+    originUrl: S.optional(S.String),
+    type: HttpBackendPatchType,
+  }),
+).annotate({
+  identifier: "HttpBackendPatch",
+}) as any as S.Schema<HttpBackendPatch>;
+
+/** Defines the type of content origin. For this schema, it must be set to `bucket`. */
+export type BucketBackendPatchType = "bucket";
+export const BucketBackendPatchType = /*@__PURE__*/ S.String;
+
+export interface BucketBackendPatch {
+  /** The fully qualified URL of your cloud storage bucket (for example, `https://s3.eu-central-1.amazonaws.com/my-bucket`). */
+  bucketUrl?: string;
+  credentials?: BucketCredentials;
+  /** The cloud provider region where your storage bucket is located (for example, `us-west-1` for AWS or `eu01` for STACKIT). */
+  region?: string;
+  /** Defines the type of content origin. For this schema, it must be set to `bucket`. */
+  type: BucketBackendPatchType;
+}
+export const BucketBackendPatch = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    bucketUrl: S.optional(S.String),
+    credentials: S.optional(BucketCredentials),
+    region: S.optional(S.String),
+    type: BucketBackendPatchType,
+  }),
+).annotate({
+  identifier: "BucketBackendPatch",
+}) as any as S.Schema<BucketBackendPatch>;
+
+export type ConfigPatchBackend = HttpBackendPatch | BucketBackendPatch;
+export const ConfigPatchBackend =
+  /*@__PURE__*/ S.Unknown as any as S.Schema<ConfigPatchBackend>;
+
+/** Restricts access to your content based on country. We use the ISO 3166-1 alpha-2 standard for country codes (e.g., DE, ES, GB). This setting blocks users from the specified countries. */
+export type ConfigPatchBlockedCountriesList = Array<string>;
+export const ConfigPatchBlockedCountriesList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<ConfigPatchBlockedCountriesList>;
+
+/** Restricts access to your content by specifying a list of blocked IPv4 addresses. This feature enhances security and privacy by preventing these addresses from accessing your distribution. */
+export type ConfigPatchBlockedIpsList = Array<string>;
+export const ConfigPatchBlockedIpsList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<ConfigPatchBlockedIpsList>;
+
+/** HTTP request header names that participate in the cache key. Omit to leave unchanged; send `[]` to clear. */
+export type CacheConfigPatchCacheKeyHeadersList = Array<string>;
+export const CacheConfigPatchCacheKeyHeadersList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<CacheConfigPatchCacheKeyHeadersList>;
+
+/** Allowlist of query-string parameter names. Omit to leave unchanged; send `[]` to clear. */
+export type CacheConfigPatchQueryStringVaryParametersList = Array<string>;
+export const CacheConfigPatchQueryStringVaryParametersList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<CacheConfigPatchQueryStringVaryParametersList>;
+
+/** PATCH variant of `CacheConfig`. Follows the standard PATCH conventions for this API: - Field omitted from the request: current value is left unchanged. - Array field sent as `[]`: current list is cleared. - `queryStringVaryEnabled` is a plain boolean (non-nullable); omit it to leave unchanged. `queryStringVaryParameters` is stored independently of `queryStringVaryEnabled`. Sending a non-empty `queryStringVaryParameters` together with `queryStringVaryEnabled=false` is accepted: the list is persisted for later re-activation but does not affect the cache while the flag is false. */
+export interface CacheConfigPatch {
+  /** HTTP request header names that participate in the cache key. Omit to leave unchanged; send `[]` to clear. */
+  cacheKeyHeaders?: CacheConfigPatchCacheKeyHeadersList;
+  /** When true, the CDN varies its cache by the request query string. Omit to leave unchanged. */
+  queryStringVaryEnabled?: boolean;
+  /** Allowlist of query-string parameter names. Omit to leave unchanged; send `[]` to clear. */
+  queryStringVaryParameters?: CacheConfigPatchQueryStringVaryParametersList;
+}
+export const CacheConfigPatch = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    cacheKeyHeaders: S.optional(CacheConfigPatchCacheKeyHeadersList),
+    queryStringVaryEnabled: S.optional(S.Boolean),
+    queryStringVaryParameters: S.optional(
+      CacheConfigPatchQueryStringVaryParametersList,
+    ),
+  }),
+).annotate({
+  identifier: "CacheConfigPatch",
+}) as any as S.Schema<CacheConfigPatch>;
+
+/** Labels are key-value string pairs that can be attached to a distribution. JSON Merge Patch is supported, meaning setting a key to null will remove it. */
+export type ConfigPatchLabelsMap = { [key: string]: string | undefined };
+export const ConfigPatchLabelsMap = /*@__PURE__*/ S.Record(
+  S.String,
+  S.String,
+) as any as S.Schema<ConfigPatchLabelsMap>;
+
+/** Defines the type of the log sink. For Grafana Loki, this must be set to `loki`. */
+export type LokiLogSinkPatchType = "loki";
+export const LokiLogSinkPatchType = /*@__PURE__*/ S.String;
+
+export interface LokiLogSinkPatch {
+  credentials?: LokiLogSinkCredentials;
+  /** The fully qualified URL where the CDN should push logs to your Loki instance (for example, `https://loki.example.com/loki/api/v1/push`). */
+  pushUrl?: string;
+  /** Defines the type of the log sink. For Grafana Loki, this must be set to `loki`. */
+  type: LokiLogSinkPatchType;
+}
+export const LokiLogSinkPatch = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    credentials: S.optional(LokiLogSinkCredentials),
+    pushUrl: S.optional(S.String),
+    type: LokiLogSinkPatchType,
+  }),
+).annotate({
+  identifier: "LokiLogSinkPatch",
+}) as any as S.Schema<LokiLogSinkPatch>;
+
+/** The authentication credentials required for the CDN to push logs to your OTLP endpoint. */
+export type OtlpLogSinkPatchCredentials =
+  | OtlpLogSinkBearerCredentials
+  | OtlpLogSinkBasicCredentials;
+export const OtlpLogSinkPatchCredentials =
+  /*@__PURE__*/ S.Unknown as any as S.Schema<OtlpLogSinkPatchCredentials>;
+
+/** Defines the type of the log sink. */
+export type OtlpLogSinkPatchType = "otlp";
+export const OtlpLogSinkPatchType = /*@__PURE__*/ S.String;
+
+export interface OtlpLogSinkPatch {
+  /** The authentication credentials required for the CDN to push logs to your OTLP endpoint. */
+  credentials?: OtlpLogSinkPatchCredentials;
+  /** The fully qualified URL where the CDN should push logs to your OTLP endpoint (for example, `https://otlp.example.com/otlp/v1/logs`). */
+  pushUrl?: string;
+  /** Defines the type of the log sink. */
+  type: OtlpLogSinkPatchType;
+}
+export const OtlpLogSinkPatch = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    credentials: S.optional(OtlpLogSinkPatchCredentials),
+    pushUrl: S.optional(S.String),
+    type: OtlpLogSinkPatchType,
+  }),
+).annotate({
+  identifier: "OtlpLogSinkPatch",
+}) as any as S.Schema<OtlpLogSinkPatch>;
+
+export type ConfigPatchLogSink = LokiLogSinkPatch | OtlpLogSinkPatch;
+export const ConfigPatchLogSink =
+  /*@__PURE__*/ S.Unknown as any as S.Schema<ConfigPatchLogSink>;
+
+export interface OptimizerPatch {
+  enabled?: boolean;
+}
+export const OptimizerPatch = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    enabled: S.optional(S.Boolean),
+  }),
+).annotate({ identifier: "OptimizerPatch" }) as any as S.Schema<OptimizerPatch>;
+
+export type ConfigPatchRegionsList = Array<Region | (string & {})>;
+export const ConfigPatchRegionsList = /*@__PURE__*/ S.Array(
+  Region,
+) as any as S.Schema<ConfigPatchRegionsList>;
+
+/** Configuration for TLS protocol versions. Note: Enabling older TLS versions (1.0, 1.1) is generally discouraged for security reasons. */
+export interface TlsConfigPatch {
+  /** If set to true, the distribution will accept connections using TLS 1.0. */
+  enableTls10?: boolean;
+  /** If set to true, the distribution will accept connections using TLS 1.1. */
+  enableTls11?: boolean;
+}
+export const TlsConfigPatch = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    enableTls10: S.optional(S.Boolean),
+    enableTls11: S.optional(S.Boolean),
+  }),
+).annotate({ identifier: "TlsConfigPatch" }) as any as S.Schema<TlsConfigPatch>;
+
+export type WafConfigPatchAllowedHttpMethodsList = Array<string>;
+export const WafConfigPatchAllowedHttpMethodsList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<WafConfigPatchAllowedHttpMethodsList>;
+
+export type WafConfigPatchAllowedHttpVersionsList = Array<string>;
+export const WafConfigPatchAllowedHttpVersionsList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<WafConfigPatchAllowedHttpVersionsList>;
+
+export type WafConfigPatchAllowedRequestContentTypesList = Array<string>;
+export const WafConfigPatchAllowedRequestContentTypesList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<WafConfigPatchAllowedRequestContentTypesList>;
+
+/** Ids of WAF Collections to mark as disabled */
+export type WafConfigPatchDisabledRuleCollectionIdsList = Array<string>;
+export const WafConfigPatchDisabledRuleCollectionIdsList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<WafConfigPatchDisabledRuleCollectionIdsList>;
+
+/** Ids of WAF Rule Groups to mark as disabled */
+export type WafConfigPatchDisabledRuleGroupIdsList = Array<string>;
+export const WafConfigPatchDisabledRuleGroupIdsList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<WafConfigPatchDisabledRuleGroupIdsList>;
+
+/** Ids of WAF Rules that are **explicitly** disabled for this distribution. */
+export type WafConfigPatchDisabledRuleIdsList = Array<string>;
+export const WafConfigPatchDisabledRuleIdsList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<WafConfigPatchDisabledRuleIdsList>;
+
+/** Ids of WAF Collections to mark as enabled */
+export type WafConfigPatchEnabledRuleCollectionIdsList = Array<string>;
+export const WafConfigPatchEnabledRuleCollectionIdsList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<WafConfigPatchEnabledRuleCollectionIdsList>;
+
+/** Ids of WAF Rule Groups to mark as enabled */
+export type WafConfigPatchEnabledRuleGroupIdsList = Array<string>;
+export const WafConfigPatchEnabledRuleGroupIdsList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<WafConfigPatchEnabledRuleGroupIdsList>;
+
+/** Ids of WAF Rules that are **explicitly** enabled for this distribution. */
+export type WafConfigPatchEnabledRuleIdsList = Array<string>;
+export const WafConfigPatchEnabledRuleIdsList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<WafConfigPatchEnabledRuleIdsList>;
+
+/** Ids of WAF Collections to mark as log Only. */
+export type WafConfigPatchLogOnlyRuleCollectionIdsList = Array<string>;
+export const WafConfigPatchLogOnlyRuleCollectionIdsList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<WafConfigPatchLogOnlyRuleCollectionIdsList>;
+
+/** Ids of WAF Rule Groups to mark as log Only. */
+export type WafConfigPatchLogOnlyRuleGroupIdsList = Array<string>;
+export const WafConfigPatchLogOnlyRuleGroupIdsList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<WafConfigPatchLogOnlyRuleGroupIdsList>;
+
+/** Ids of WAF Rules that are **explicitly** marked as Log Only for this distribution. */
+export type WafConfigPatchLogOnlyRuleIdsList = Array<string>;
+export const WafConfigPatchLogOnlyRuleIdsList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<WafConfigPatchLogOnlyRuleIdsList>;
+
+/** Modify the WAF Configuration ## WAF Rules You can modify the set of enabled, disabled and log-only Rules by modifying these 9 properties: - enabledRuleIds - disabledRuleIds - logOnlyRuleIds - enabledRuleGroupIds - disabledRuleGroupIds - logOnlyRuleGroupIds - enabledRuleCollectionIds - disabledRuleCollectionIds - logOnlyRuleCollectionIds Please inquire the `WafConfig` Description on how the effective configuration is determined. For patching, if an ID is already used in one of the properties, it will be removed (and effectively moved) to the new property. If patching multiple properties with the same ID (e.g. writing `@builtin/crs/response` to `logOnlyRuleCollectionIds` and `enabledRuleCollectionIds`), the request will be rejected with a 400. */
+export interface WafConfigPatch {
+  allowedHttpMethods?: WafConfigPatchAllowedHttpMethodsList;
+  allowedHttpVersions?: WafConfigPatchAllowedHttpVersionsList;
+  allowedRequestContentTypes?: WafConfigPatchAllowedRequestContentTypesList;
+  /** Ids of WAF Collections to mark as disabled */
+  disabledRuleCollectionIds?: WafConfigPatchDisabledRuleCollectionIdsList;
+  /** Ids of WAF Rule Groups to mark as disabled */
+  disabledRuleGroupIds?: WafConfigPatchDisabledRuleGroupIdsList;
+  /** Ids of WAF Rules that are **explicitly** disabled for this distribution. */
+  disabledRuleIds?: WafConfigPatchDisabledRuleIdsList;
+  /** Ids of WAF Collections to mark as enabled */
+  enabledRuleCollectionIds?: WafConfigPatchEnabledRuleCollectionIdsList;
+  /** Ids of WAF Rule Groups to mark as enabled */
+  enabledRuleGroupIds?: WafConfigPatchEnabledRuleGroupIdsList;
+  /** Ids of WAF Rules that are **explicitly** enabled for this distribution. */
+  enabledRuleIds?: WafConfigPatchEnabledRuleIdsList;
+  /** Ids of WAF Collections to mark as log Only. */
+  logOnlyRuleCollectionIds?: WafConfigPatchLogOnlyRuleCollectionIdsList;
+  /** Ids of WAF Rule Groups to mark as log Only. */
+  logOnlyRuleGroupIds?: WafConfigPatchLogOnlyRuleGroupIdsList;
+  /** Ids of WAF Rules that are **explicitly** marked as Log Only for this distribution. */
+  logOnlyRuleIds?: WafConfigPatchLogOnlyRuleIdsList;
+  mode?: WafMode | (string & {});
+  paranoiaLevel?: WafParanoiaLevel | (string & {});
+  type?: WafType | (string & {});
+}
+export const WafConfigPatch = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    allowedHttpMethods: S.optional(WafConfigPatchAllowedHttpMethodsList),
+    allowedHttpVersions: S.optional(WafConfigPatchAllowedHttpVersionsList),
+    allowedRequestContentTypes: S.optional(
+      WafConfigPatchAllowedRequestContentTypesList,
+    ),
+    disabledRuleCollectionIds: S.optional(
+      WafConfigPatchDisabledRuleCollectionIdsList,
+    ),
+    disabledRuleGroupIds: S.optional(WafConfigPatchDisabledRuleGroupIdsList),
+    disabledRuleIds: S.optional(WafConfigPatchDisabledRuleIdsList),
+    enabledRuleCollectionIds: S.optional(
+      WafConfigPatchEnabledRuleCollectionIdsList,
+    ),
+    enabledRuleGroupIds: S.optional(WafConfigPatchEnabledRuleGroupIdsList),
+    enabledRuleIds: S.optional(WafConfigPatchEnabledRuleIdsList),
+    logOnlyRuleCollectionIds: S.optional(
+      WafConfigPatchLogOnlyRuleCollectionIdsList,
+    ),
+    logOnlyRuleGroupIds: S.optional(WafConfigPatchLogOnlyRuleGroupIdsList),
+    logOnlyRuleIds: S.optional(WafConfigPatchLogOnlyRuleIdsList),
+    mode: S.optional(WafMode),
+    paranoiaLevel: S.optional(WafParanoiaLevel),
+    type: S.optional(WafType),
+  }),
+).annotate({ identifier: "WafConfigPatch" }) as any as S.Schema<WafConfigPatch>;
+
+export interface ConfigPatch {
+  backend?: ConfigPatchBackend;
+  /** Restricts access to your content based on country. We use the ISO 3166-1 alpha-2 standard for country codes (e.g., DE, ES, GB). This setting blocks users from the specified countries. */
+  blockedCountries?: ConfigPatchBlockedCountriesList;
+  /** Restricts access to your content by specifying a list of blocked IPv4 addresses. This feature enhances security and privacy by preventing these addresses from accessing your distribution. */
+  blockedIps?: ConfigPatchBlockedIpsList;
+  cacheConfig?: CacheConfigPatch;
+  /** Sets the default cache duration for the distribution. The default cache duration is applied when a 'Cache-Control' header is not presented in the origin's response. We use ISO8601 duration format for cache duration (e.g. P1DT2H30M) */
+  defaultCacheDuration?: string | null;
+  /** Enabling this allows the 'Host' header to be passed through to the origin. */
+  forwardHostHeader?: boolean;
+  /** Labels are key-value string pairs that can be attached to a distribution. JSON Merge Patch is supported, meaning setting a key to null will remove it. */
+  labels?: ConfigPatchLabelsMap;
+  logSink?: ConfigPatchLogSink | null;
+  /** Sets the monthly limit of bandwidth in bytes that the pullzone is allowed to use. */
+  monthlyLimitBytes?: number | null;
+  optimizer?: OptimizerPatch;
+  redirects?: RedirectConfig;
+  regions?: ConfigPatchRegionsList;
+  /** Enable this to prevent origin-level cookies from being forwarded to the end user. */
+  stripResponseCookies?: boolean;
+  tls?: TlsConfigPatch;
+  waf?: WafConfigPatch;
+}
+export const ConfigPatch = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    backend: S.optional(ConfigPatchBackend),
+    blockedCountries: S.optional(ConfigPatchBlockedCountriesList),
+    blockedIps: S.optional(ConfigPatchBlockedIpsList),
+    cacheConfig: S.optional(CacheConfigPatch),
+    defaultCacheDuration: S.optional(S.NullOr(S.String)),
+    forwardHostHeader: S.optional(S.Boolean),
+    labels: S.optional(ConfigPatchLabelsMap),
+    logSink: S.optional(S.NullOr(ConfigPatchLogSink)),
+    monthlyLimitBytes: S.optional(S.NullOr(S.Number)),
+    optimizer: S.optional(OptimizerPatch),
+    redirects: S.optional(RedirectConfig),
+    regions: S.optional(ConfigPatchRegionsList),
+    stripResponseCookies: S.optional(S.Boolean),
+    tls: S.optional(TlsConfigPatch),
+    waf: S.optional(WafConfigPatch),
+  }),
+).annotate({ identifier: "ConfigPatch" }) as any as S.Schema<ConfigPatch>;
+
+export interface PatchDistributionRequest {
+  /** Your STACKIT Project Id */
+  projectId: string;
+  distributionId: string;
+  config?: ConfigPatch;
+  /** While optional, it is greatly encouraged to provide an `intentId`. This is used to deduplicate requests. If multiple modifying requests with the same `intentId` for a given `projectId` are received, all but the first request are dropped. */
+  intentId?: string;
+}
+export const PatchDistributionRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    projectId: S.String.pipe(T.Label()),
+    distributionId: S.String.pipe(T.Label()),
+    config: S.optional(ConfigPatch),
+    intentId: S.optional(S.String),
+  }).pipe(
+    T.Http({
+      method: "PATCH",
+      uri: "/v1/projects/{projectId}/distributions/{distributionId}",
+      code: 200,
+      baseUrl: "https://cdn.api.stackit.cloud",
+    }),
+  ),
+).annotate({
+  identifier: "PatchDistributionRequest",
+}) as any as S.Schema<PatchDistributionRequest>;
+
+export interface PatchDistributionResponse {
+  distribution: Distribution;
+}
+export const PatchDistributionResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    distribution: Distribution,
+  }),
+).annotate({
+  identifier: "PatchDistributionResponse",
+}) as any as S.Schema<PatchDistributionResponse>;
+
+export interface PurgeCacheRequest {
+  /** Your STACKIT Project Id */
+  projectId: string;
+  distributionId: string;
+  /** Defines an optional path. If this is set, a granular purge is done. If missing, the entire cache is invalidated. During a granular cache purge, only the provided path is purged. Please do not that for example `/some/path` and `/some/path.txt` are considered different paths. */
+  path?: string;
+}
+export const PurgeCacheRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    projectId: S.String.pipe(T.Label()),
+    distributionId: S.String.pipe(T.Label()),
+    path: S.optional(S.String),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/v1/projects/{projectId}/distributions/{distributionId}/cache/purge",
+      code: 200,
+      baseUrl: "https://cdn.api.stackit.cloud",
+    }),
+  ),
+).annotate({
+  identifier: "PurgeCacheRequest",
+}) as any as S.Schema<PurgeCacheRequest>;
+
+export type PurgeCacheResponse2 = unknown;
+export const PurgeCacheResponse2 = /*@__PURE__*/ S.suspend(() =>
+  S.Unknown.pipe(T.RawResponseRoot()),
+).annotate({
+  identifier: "PurgeCacheResponse2",
+}) as any as S.Schema<PurgeCacheResponse2>;
+
+/** This is returned when no custom certificate is used. We provision and manage a Let's Encrypt Certificate for you */
+export type PutCustomDomainManagedCertificate =
+  GetCustomDomainManagedCertificate;
+export const PutCustomDomainManagedCertificate =
+  GetCustomDomainManagedCertificate;
+
+/** Returned if a custom certificate is used. Response does not contain the certificate or key. */
+export interface PutCustomDomainCustomCertificate {
+  /** base64-encoded PEM-encoded certificate */
+  certificate: string;
+  /** base64-encoded PEM encoded key */
+  key: string;
+  /** When adding a new custom domain, we do a check to verify that your Domain points to the managed domain via a CNAME or ALIAS. If this is not the case, the call would usually reject. This additional property is an escape hatch to this functionality. It's useful for when you are migrating onto STACKIT CDN. It allows you to migrate without downtime. By providing a custom certificate with `skipDnsCheck` set to `true`, we will not check the Record for correctness. Then, once the CDN is set up, you can change the CNAME Record on your DNS and update the Custom Domain entry to disable this check, or switch to a managed certificate. This field is optional. If not set, the check is **not** skipped. */
+  skipDnsCheck?: boolean;
+  type: string;
+}
+export const PutCustomDomainCustomCertificate = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    certificate: S.String,
+    key: S.String,
+    skipDnsCheck: S.optional(S.Boolean),
+    type: S.String,
+  }),
+).annotate({
+  identifier: "PutCustomDomainCustomCertificate",
+}) as any as S.Schema<PutCustomDomainCustomCertificate>;
+
+/** Pass a custom certificate to be served by the CDN when calling the custom domain. Will use a managed certificate when omitted */
+export type PutCustomDomainRequestCertificate =
+  | GetCustomDomainManagedCertificate
+  | PutCustomDomainCustomCertificate;
+export const PutCustomDomainRequestCertificate =
+  /*@__PURE__*/ S.Unknown as any as S.Schema<PutCustomDomainRequestCertificate>;
+
+export interface PutCustomDomainRequest {
+  /** Your STACKIT Project Id */
+  projectId: string;
+  distributionId: string;
+  domain: string;
+  /** Pass a custom certificate to be served by the CDN when calling the custom domain. Will use a managed certificate when omitted */
+  certificate?: PutCustomDomainRequestCertificate;
+  /** While optional, it is greatly encouraged to provide an `intentId`. This is used to deduplicate requests. If multiple modifying Requests with the same `intentId` for a given `projectId` are received, all but the first request are dropped. */
+  intentId?: string;
+}
+export const PutCustomDomainRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    projectId: S.String.pipe(T.Label()),
+    distributionId: S.String.pipe(T.Label()),
+    domain: S.String.pipe(T.Label()),
+    certificate: S.optional(PutCustomDomainRequestCertificate),
+    intentId: S.optional(S.String),
+  }).pipe(
+    T.Http({
+      method: "PUT",
+      uri: "/v1/projects/{projectId}/distributions/{distributionId}/customDomains/{domain}",
+      code: 200,
+      baseUrl: "https://cdn.api.stackit.cloud",
+    }),
+  ),
+).annotate({
+  identifier: "PutCustomDomainRequest",
+}) as any as S.Schema<PutCustomDomainRequest>;
+
+/** Pass a custom certificate to be served by the CDN when calling the custom domain. Will use a managed certificate when omitted */
+export type PutCustomDomainResponseCertificate =
+  | GetCustomDomainManagedCertificate
+  | GetCustomDomainCustomCertificate;
+export const PutCustomDomainResponseCertificate =
+  /*@__PURE__*/ S.Unknown as any as S.Schema<PutCustomDomainResponseCertificate>;
+
+export interface PutCustomDomainResponse {
+  /** Pass a custom certificate to be served by the CDN when calling the custom domain. Will use a managed certificate when omitted */
+  certificate?: PutCustomDomainResponseCertificate;
+  customDomain: CustomDomain;
+}
+export const PutCustomDomainResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    certificate: S.optional(PutCustomDomainResponseCertificate),
+    customDomain: CustomDomain,
+  }),
+).annotate({
+  identifier: "PutCustomDomainResponse",
+}) as any as S.Schema<PutCustomDomainResponse>;
+
+export type CreateDistributionError =
+  | BadRequest
+  | UnprocessableEntity
+  | StackitOpError;
+/** Create new distribution CreateDistribution will create a new CDN distribution */
+export const createDistribution: API.OperationMethod<
+  CreateDistributionRequest,
+  CreateDistributionResponse,
+  CreateDistributionError,
+  StackitOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: CreateDistributionRequest,
+  output: CreateDistributionResponse,
+  errors: [BadRequest, UnprocessableEntity, UnknownStackitError],
+  protocol: StackitProtocol,
+  retry: Retry.Retry,
+}));
+
+export type DeleteCustomDomainError = UnprocessableEntity | StackitOpError;
+/** Delete a custom domain Removes a custom domain */
+export const deleteCustomDomain: API.OperationMethod<
+  DeleteCustomDomainRequest,
+  DeleteCustomDomainResponse,
+  DeleteCustomDomainError,
+  StackitOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: DeleteCustomDomainRequest,
+  output: DeleteCustomDomainResponse,
+  errors: [UnprocessableEntity, UnknownStackitError],
+  protocol: StackitProtocol,
+  retry: Retry.Retry,
+}));
+
+export type DeleteDistributionError = UnprocessableEntity | StackitOpError;
+/** Delete distribution DeleteDistribution accepts a project- and distribution-Id and will delete a distribution. */
+export const deleteDistribution: API.OperationMethod<
+  DeleteDistributionRequest,
+  DeleteDistributionResponse,
+  DeleteDistributionError,
+  StackitOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: DeleteDistributionRequest,
+  output: DeleteDistributionResponse,
+  errors: [UnprocessableEntity, UnknownStackitError],
+  protocol: StackitProtocol,
+  retry: Retry.Retry,
+}));
+
+export type FindCachePathsError = UnprocessableEntity | StackitOpError;
+/** Return Paths that were purged This returns paths that are present in the cache purging history. Only substrings of the provided input are returned. The response is sorted in descending order by the most recent purge. So, assuming you have have the following purged for a distribution - `/test/1` at `2025-01-01` - `/test/2` at `2025-01-02` - `/someOtherPath/1` at `2025-01-03` - `/test/1` at `2025-01-04` - `/test/3` at `2025-01-05`, this would return the following paths, in the following order, assuming `/te` was the search parameter: - `/test/3` - `/test/1` - `/test/2` */
+export const findCachePaths: API.OperationMethod<
+  FindCachePathsRequest,
+  FindCachePathsResponse,
+  FindCachePathsError,
+  StackitOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: FindCachePathsRequest,
+  output: FindCachePathsResponse,
+  errors: [UnprocessableEntity, UnknownStackitError],
+  protocol: StackitProtocol,
+  retry: Retry.Retry,
+}));
+
+export type GetCacheInfoError = UnprocessableEntity | StackitOpError;
+/** Get Infos about the Caching State Return caching info metadata, which contains the last cache purging time and a history of the most recent *full* purges. If (and only if) you provide the path query parameter, the history will also contain granular cache purges. The request will not fail if no data about a path is found. */
+export const getCacheInfo: API.OperationMethod<
+  GetCacheInfoRequest,
+  GetCacheInfoResponse,
+  GetCacheInfoError,
+  StackitOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: GetCacheInfoRequest,
+  output: GetCacheInfoResponse,
+  errors: [UnprocessableEntity, UnknownStackitError],
+  protocol: StackitProtocol,
+  retry: Retry.Retry,
+}));
+
+export type GetCustomDomainError =
+  | NotFound
+  | UnprocessableEntity
+  | StackitOpError;
+/** Retrieve a specific custom domain Returns a 200 and the custom domain if this custom domain was associated to this distribution, else 404 */
+export const getCustomDomain: API.OperationMethod<
+  GetCustomDomainRequest,
+  GetCustomDomainResponse,
+  GetCustomDomainError,
+  StackitOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: GetCustomDomainRequest,
+  output: GetCustomDomainResponse,
+  errors: [NotFound, UnprocessableEntity, UnknownStackitError],
+  protocol: StackitProtocol,
+  retry: Retry.Retry,
+}));
+
+export type GetDistributionError =
+  | NotFound
+  | UnprocessableEntity
+  | StackitOpError;
+/** Get distribution by Id This returns a specific distribution by its Id. If no distribution with the given Id exists the endpoint returns 404. Trying to get a deleted distributions also return 404. */
+export const getDistribution: API.OperationMethod<
+  GetDistributionRequest,
+  GetDistributionResponse,
+  GetDistributionError,
+  StackitOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: GetDistributionRequest,
+  output: GetDistributionResponse,
+  errors: [NotFound, UnprocessableEntity, UnknownStackitError],
+  protocol: StackitProtocol,
+  retry: Retry.Retry,
+}));
+
+export type GetLogsError = UnprocessableEntity | StackitOpError;
+/** Retrieve distribution logs */
+export const getLogs: API.OperationMethod<
+  GetLogsRequest,
+  GetLogsResponse,
+  GetLogsError,
+  StackitOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: GetLogsRequest,
+  output: GetLogsResponse,
+  errors: [UnprocessableEntity, UnknownStackitError],
+  protocol: StackitProtocol,
+  retry: Retry.Retry,
+}));
+
+export type GetLogsSearchFiltersError =
+  | BadRequest
+  | UnprocessableEntity
+  | StackitOpError;
+/** Get relevant search filters for this distribution based on user input. */
+export const getLogsSearchFilters: API.OperationMethod<
+  GetLogsSearchFiltersRequest,
+  GetLogsSearchFiltersResponse,
+  GetLogsSearchFiltersError,
+  StackitOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: GetLogsSearchFiltersRequest,
+  output: GetLogsSearchFiltersResponse,
+  errors: [BadRequest, UnprocessableEntity, UnknownStackitError],
+  protocol: StackitProtocol,
+  retry: Retry.Retry,
+}));
+
+export type GetStatisticsError = UnprocessableEntity | StackitOpError;
+/** Retrieve the statistics of a distribution Returns the statistics of the distribution in the given time range. The response is a list of statistics records. Each record aggregates the statistics for its time interval. In case no statistics for a time interval exist, no record is returned. The time range for which statistics should be returned can be configured using query parameters. Timestamps are assumed to be UTC. This is especially important for the "buckets" when you, for example, return daily information. A day always starts and ends at 00:00Z. **Important Note:** Lower bounds are inclusive, upper bounds are exclusive. If you, for example, want a daily grouped which starts on the 1st Jan and also contains the full 10th Jan day, you would define `2025-01-01T00:00:00Z` as the lower and `2025-01-11T00:00:00Z` as the upper bound. The upper bound is optional. If you omit it, the API will use the start of the next interval as the upper bound. Example: if `interval` is `hourly`, `from` would default to the start of the next hour, if it's `daily`, `from` would default to the start of the next day, etc. */
+export const getStatistics: API.OperationMethod<
+  GetStatisticsRequest,
+  GetStatisticsResponse,
+  GetStatisticsError,
+  StackitOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: GetStatisticsRequest,
+  output: GetStatisticsResponse,
+  errors: [UnprocessableEntity, UnknownStackitError],
+  protocol: StackitProtocol,
+  retry: Retry.Retry,
+}));
+
+export type ListDistributionsError = UnprocessableEntity | StackitOpError;
+/** List all distributions belonging to a specific project ListDistributions returns a list of all CDN distributions associated with a given project, ordered by their distribution Id. */
+export const listDistributions: API.OperationMethod<
+  ListDistributionsRequest,
+  ListDistributionsResponse,
+  ListDistributionsError,
+  StackitOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: ListDistributionsRequest,
+  output: ListDistributionsResponse,
+  errors: [UnprocessableEntity, UnknownStackitError],
+  protocol: StackitProtocol,
+  retry: Retry.Retry,
+}));
+
+export type ListWafCollectionsError = UnprocessableEntity | StackitOpError;
+/** List all WAF rule collections of the project Returns all WAF rule collections available to the project */
+export const listWafCollections: API.OperationMethod<
+  ListWafCollectionsRequest,
+  ListWafCollectionsResponse,
+  ListWafCollectionsError,
+  StackitOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: ListWafCollectionsRequest,
+  output: ListWafCollectionsResponse,
+  errors: [UnprocessableEntity, UnknownStackitError],
+  protocol: StackitProtocol,
+  retry: Retry.Retry,
+}));
+
+export type PatchDistributionError = UnprocessableEntity | StackitOpError;
+/** Update existing distribution Modify a CDN distribution with a partial update. Only the fields specified in the request will be modified. */
+export const patchDistribution: API.OperationMethod<
+  PatchDistributionRequest,
+  PatchDistributionResponse,
+  PatchDistributionError,
+  StackitOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: PatchDistributionRequest,
+  output: PatchDistributionResponse,
+  errors: [UnprocessableEntity, UnknownStackitError],
+  protocol: StackitProtocol,
+  retry: Retry.Retry,
+}));
+
+export type PurgeCacheError = UnprocessableEntity | StackitOpError;
+/** Clear distribution cache Clear the cache for this distribution. All content, regardless of its staleness, will get refetched from the host. */
+export const purgeCache: API.OperationMethod<
+  PurgeCacheRequest,
+  PurgeCacheResponse2,
+  PurgeCacheError,
+  StackitOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: PurgeCacheRequest,
+  output: PurgeCacheResponse2,
+  errors: [UnprocessableEntity, UnknownStackitError],
+  protocol: StackitProtocol,
+  retry: Retry.Retry,
+}));
+
+export type PutCustomDomainError = UnprocessableEntity | StackitOpError;
+/** Create or update a custom domain Creates a new custom domain. If it already exists, this will overwrite the previous custom domain's properties. */
+export const putCustomDomain: API.OperationMethod<
+  PutCustomDomainRequest,
+  PutCustomDomainResponse,
+  PutCustomDomainError,
+  StackitOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: PutCustomDomainRequest,
+  output: PutCustomDomainResponse,
+  errors: [UnprocessableEntity, UnknownStackitError],
+  protocol: StackitProtocol,
+  retry: Retry.Retry,
+}));