@distilled.cloud/vercel 0.0.0 → 1.0.0-rc.10

package/src/services/authentication.ts

@@ -0,0 +1,827 @@
+// AUTO-GENERATED by scripts/generate.ts from .generated-specs (specs/spec-mirror-vercel/specs/openapi.json). Do not edit.
+import * as S from "@distilled.cloud/core/schema";
+import * as Redacted from "effect/Redacted";
+import * as API from "@distilled.cloud/core/api";
+import * as C from "@distilled.cloud/core/category";
+import * as T from "../traits.ts";
+import {
+  VercelProtocol,
+  type VercelOpError,
+  type VercelOpContext,
+} from "../protocol.ts";
+import * as Retry from "../retry.ts";
+
+export type { VercelOpError, VercelOpContext };
+
+export class BadRequest
+  extends /*@__PURE__*/ T.applyErrorMatchers(
+    /*@__PURE__*/ S.TaggedError<BadRequest>()("BadRequest", {
+      code: S.Number,
+      message: S.String,
+    }).pipe(C.withBadRequestError),
+    [{ status: 400 }],
+  ) {}
+
+export class Conflict
+  extends /*@__PURE__*/ T.applyErrorMatchers(
+    /*@__PURE__*/ S.TaggedError<Conflict>()("Conflict", {
+      code: S.Number,
+      message: S.String,
+    }).pipe(C.withConflictError),
+    [{ status: 409 }],
+  ) {}
+
+export class Forbidden
+  extends /*@__PURE__*/ T.applyErrorMatchers(
+    /*@__PURE__*/ S.TaggedError<Forbidden>()("Forbidden", {
+      code: S.Number,
+      message: S.String,
+    }).pipe(C.withAuthError),
+    [{ status: 403 }],
+  ) {}
+
+export class NotFound
+  extends /*@__PURE__*/ T.applyErrorMatchers(
+    /*@__PURE__*/ S.TaggedError<NotFound>()("NotFound", {
+      code: S.Number,
+      message: S.String,
+    }).pipe(C.withBadRequestError),
+    [{ status: 404 }],
+  ) {}
+
+/** How often the quota refreshes. */
+export type CreateApiKeysRequestAiGatewayQuotaRefreshPeriod =
+  | "daily"
+  | "weekly"
+  | "monthly"
+  | "none";
+export const CreateApiKeysRequestAiGatewayQuotaRefreshPeriod = S.String;
+
+export type CreateApiKeysRequestAiGatewayQuotaAlertThresholdsItem =
+  | 50
+  | 75
+  | 100;
+export const CreateApiKeysRequestAiGatewayQuotaAlertThresholdsItem = S.Number;
+
+/** Spend percentages (a subset of [50, 75, 100]) at which to send a spend alert. */
+export type CreateApiKeysRequestAiGatewayQuotaAlertThresholdsList = Array<
+  CreateApiKeysRequestAiGatewayQuotaAlertThresholdsItem | (number & {})
+>;
+export const CreateApiKeysRequestAiGatewayQuotaAlertThresholdsList =
+  /*@__PURE__*/ S.Array(
+    CreateApiKeysRequestAiGatewayQuotaAlertThresholdsItem,
+  ) as any as S.Schema<CreateApiKeysRequestAiGatewayQuotaAlertThresholdsList>;
+
+/** Optional AI Gateway quota configuration for the API key. */
+export interface CreateApiKeysRequestAiGatewayQuota {
+  /** The quota limit amount. */
+  limitAmount: number;
+  /** Whether to include BYOK (Bring Your Own Key) usage in the quota. */
+  includeByokInQuota?: boolean;
+  /** How often the quota refreshes. */
+  refreshPeriod?:
+    | CreateApiKeysRequestAiGatewayQuotaRefreshPeriod
+    | (string & {});
+  /** Spend percentages (a subset of [50, 75, 100]) at which to send a spend alert. */
+  alertThresholds?: CreateApiKeysRequestAiGatewayQuotaAlertThresholdsList;
+}
+export const CreateApiKeysRequestAiGatewayQuota = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    limitAmount: S.Number,
+    includeByokInQuota: S.optional(S.Boolean),
+    refreshPeriod: S.optional(CreateApiKeysRequestAiGatewayQuotaRefreshPeriod),
+    alertThresholds: S.optional(
+      CreateApiKeysRequestAiGatewayQuotaAlertThresholdsList,
+    ),
+  }),
+).annotate({
+  identifier: "CreateApiKeysRequestAiGatewayQuota",
+}) as any as S.Schema<CreateApiKeysRequestAiGatewayQuota>;
+
+/** Optional generic metadata for the API key. The accepted shape depends on the key's `purpose` and is validated on creation; for `ai-gateway` keys this accepts `environment`. */
+export type CreateApiKeysRequestMetadataMap = {
+  [key: string]: unknown | undefined;
+};
+export const CreateApiKeysRequestMetadataMap = /*@__PURE__*/ S.Record(
+  S.String,
+  S.Unknown,
+) as any as S.Schema<CreateApiKeysRequestMetadataMap>;
+
+export interface CreateApiKeysRequest {
+  /** The API key's purpose, which restricts how it can be used. */
+  purpose: string;
+  /** An optional project to restrict the API key to. */
+  projectId?: string;
+  /** An optional name for the API key. */
+  name?: string;
+  /** The API key's expiration, expressed as a UNIX timestamp in milliseconds. */
+  expiresAt?: number;
+  /** Optional AI Gateway quota configuration for the API key. */
+  aiGatewayQuota?: CreateApiKeysRequestAiGatewayQuota;
+  /** Optional generic metadata for the API key. The accepted shape depends on the key's `purpose` and is validated on creation; for `ai-gateway` keys this accepts `environment`. */
+  metadata?: CreateApiKeysRequestMetadataMap;
+}
+export const CreateApiKeysRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    purpose: S.String,
+    projectId: S.optional(S.String),
+    name: S.optional(S.String),
+    expiresAt: S.optional(S.Number),
+    aiGatewayQuota: S.optional(CreateApiKeysRequestAiGatewayQuota),
+    metadata: S.optional(CreateApiKeysRequestMetadataMap),
+  }).pipe(T.Http({ method: "POST", uri: "/api-keys", code: 200 })),
+).annotate({
+  identifier: "CreateApiKeysRequest",
+}) as any as S.Schema<CreateApiKeysRequest>;
+
+/** Spend percentages (a subset of [50, 75, 100]) at which to send a spend alert. Empty or undefined disables alerts. */
+export type APIKeyQuotaAlertThresholdsList = Array<number>;
+export const APIKeyQuotaAlertThresholdsList = /*@__PURE__*/ S.Array(
+  S.Number,
+) as any as S.Schema<APIKeyQuotaAlertThresholdsList>;
+
+/** AI Gateway quota associated with an API key. */
+export interface APIKeyQuota {
+  /** The unique identifier for the quota. */
+  quotaEntityId: string;
+  /** The quota limit amount. */
+  limitAmount: number;
+  /** The current amount spent against the quota. */
+  currentSpend: number;
+  /** The current BYOK spend (tracked separately). */
+  currentByokSpend: number;
+  /** Whether BYOK (Bring Your Own Key) spend counts against the quota. */
+  includeByokInQuota: boolean;
+  /** How often the quota refreshes. */
+  refreshPeriod: string;
+  /** Whether the quota is currently active. */
+  active: boolean;
+  /** Whether the quota has been archived. */
+  archived: boolean;
+  /** Spend percentages (a subset of [50, 75, 100]) at which to send a spend alert. Empty or undefined disables alerts. */
+  alertThresholds?: APIKeyQuotaAlertThresholdsList;
+  /** Timestamp (in milliseconds) of when the quota was created. */
+  createdAt: number;
+  /** Timestamp (in milliseconds) of when the quota was last updated. */
+  updatedAt: number;
+}
+export const APIKeyQuota = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    quotaEntityId: S.String,
+    limitAmount: S.Number,
+    currentSpend: S.Number,
+    currentByokSpend: S.Number,
+    includeByokInQuota: S.Boolean,
+    refreshPeriod: S.String,
+    active: S.Boolean,
+    archived: S.Boolean,
+    alertThresholds: S.optional(APIKeyQuotaAlertThresholdsList),
+    createdAt: S.Number,
+    updatedAt: S.Number,
+  }),
+).annotate({ identifier: "APIKeyQuota" }) as any as S.Schema<APIKeyQuota>;
+
+/** Information about the newly created API key. */
+export interface APIKey {
+  /** The unique identifier of the API key. */
+  id: string;
+  /** The human-readable name of the API key. */
+  name: string;
+  /** The last few characters of the API key string, for helping identify the API key. */
+  partialKey: string;
+  /** The ID of the team that the API key grants access to. */
+  teamId: string;
+  /** The API key's purpose, i.e. what resources it can be used with. */
+  purpose: string;
+  /** The ID of the project that this API key grants access to. When this is unset, the API key grants access to all projects in the team. */
+  projectId: string | null;
+  /** Timestamp (in milliseconds) of when the API key expires. */
+  expiresAt: number | null;
+  /** Timestamp (in milliseconds) of when the API key was most recently used. */
+  activeAt: number;
+  /** Timestamp (in milliseconds) of when the API key was created. */
+  createdAt: number;
+  /** The ID of the user who created the API key. */
+  createdBy: string;
+  /** Timestamp (in milliseconds) of when the API key was marked as leaked. */
+  leakedAt: number | null;
+  /** URL where the API key was discovered as leaked. */
+  leakedUrl: string | null;
+  /** The ID of the app that created the API key, if any */
+  createdByAppId: string | null;
+  quota?: APIKeyQuota;
+  /** Generic metadata attached to the API key. The accepted shape depends on the key's `purpose` and is validated when the key is created. For `ai-gateway` keys this carries `environment` and `spendAttribution`. */
+  metadata?: unknown;
+}
+export const APIKey = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    id: S.String,
+    name: S.String,
+    partialKey: S.String,
+    teamId: S.String,
+    purpose: S.String,
+    projectId: S.NullOr(S.String),
+    expiresAt: S.NullOr(S.Number),
+    activeAt: S.Number,
+    createdAt: S.Number,
+    createdBy: S.String,
+    leakedAt: S.NullOr(S.Number),
+    leakedUrl: S.NullOr(S.String),
+    createdByAppId: S.NullOr(S.String),
+    quota: S.optional(APIKeyQuota),
+    metadata: S.optional(S.Unknown),
+  }),
+).annotate({ identifier: "APIKey" }) as any as S.Schema<APIKey>;
+
+export interface CreateApiKeysResponse {
+  /** The API key's actual value. This value is only provided in this response, and can never be retrieved again in the future. Be sure to save it somewhere safe! */
+  apiKeyString: string;
+  apiKey: APIKey;
+}
+export const CreateApiKeysResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    apiKeyString: S.String,
+    apiKey: APIKey,
+  }),
+).annotate({
+  identifier: "CreateApiKeysResponse",
+}) as any as S.Schema<CreateApiKeysResponse>;
+
+export interface CreateAuthTokenRequest {
+  /** The Team identifier to perform the request on behalf of. */
+  teamId?: string;
+  /** The Team slug to perform the request on behalf of. */
+  slug?: string;
+  name: string;
+  expiresAt?: number;
+  /** The ID of the project to scope this token to */
+  projectId?: string;
+}
+export const CreateAuthTokenRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    teamId: S.optional(S.String.pipe(T.Query())),
+    slug: S.optional(S.String.pipe(T.Query())),
+    name: S.String,
+    expiresAt: S.optional(S.Number),
+    projectId: S.optional(S.String),
+  }).pipe(T.Http({ method: "POST", uri: "/v3/user/tokens", code: 200 })),
+).annotate({
+  identifier: "CreateAuthTokenRequest",
+}) as any as S.Schema<CreateAuthTokenRequest>;
+
+export type AuthTokenScopesItemCase0Type = "user";
+export const AuthTokenScopesItemCase0Type = S.String;
+
+/** Possible step-up auth origins */
+export type AuthTokenScopesItemCase0SudoOrigin =
+  | "email-otp"
+  | "otp"
+  | "recovery-code"
+  | "totp"
+  | "webauthn";
+export const AuthTokenScopesItemCase0SudoOrigin = S.String;
+
+export interface AuthTokenScopesItemCase0Sudo {
+  /** Possible step-up auth origins */
+  origin: AuthTokenScopesItemCase0SudoOrigin;
+  verifiedAt?: number;
+  expiresAt: number;
+}
+export const AuthTokenScopesItemCase0Sudo = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    origin: AuthTokenScopesItemCase0SudoOrigin,
+    verifiedAt: S.optional(S.Number),
+    expiresAt: S.Number,
+  }),
+).annotate({
+  identifier: "AuthTokenScopesItemCase0Sudo",
+}) as any as S.Schema<AuthTokenScopesItemCase0Sudo>;
+
+export type AuthTokenScopesItemCase0Origin =
+  | "app"
+  | "apple"
+  | "bitbucket"
+  | "chatgpt"
+  | "email"
+  | "emu"
+  | "github"
+  | "github-webhook"
+  | "gitlab"
+  | "google"
+  | "invite"
+  | "manual"
+  | "otp"
+  | "passkey"
+  | "saml"
+  | "sms"
+  | "token-exchange-oidc";
+export const AuthTokenScopesItemCase0Origin = S.String;
+
+/** The access scopes granted to the token. */
+export interface AuthTokenScopesItemCase0 {
+  type: AuthTokenScopesItemCase0Type;
+  sudo?: AuthTokenScopesItemCase0Sudo;
+  origin?: AuthTokenScopesItemCase0Origin;
+  createdAt: number;
+  expiresAt?: number;
+}
+export const AuthTokenScopesItemCase0 = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    type: AuthTokenScopesItemCase0Type,
+    sudo: S.optional(AuthTokenScopesItemCase0Sudo),
+    origin: S.optional(AuthTokenScopesItemCase0Origin),
+    createdAt: S.Number,
+    expiresAt: S.optional(S.Number),
+  }),
+).annotate({
+  identifier: "AuthTokenScopesItemCase0",
+}) as any as S.Schema<AuthTokenScopesItemCase0>;
+
+export type AuthTokenScopesItemCase1Type = "team";
+export const AuthTokenScopesItemCase1Type = S.String;
+
+export type AuthTokenScopesItemCase1Origin =
+  | "app"
+  | "apple"
+  | "bitbucket"
+  | "chatgpt"
+  | "email"
+  | "emu"
+  | "github"
+  | "github-webhook"
+  | "gitlab"
+  | "google"
+  | "invite"
+  | "manual"
+  | "otp"
+  | "passkey"
+  | "saml"
+  | "sms"
+  | "token-exchange-oidc";
+export const AuthTokenScopesItemCase1Origin = S.String;
+
+/** The access scopes granted to the token. */
+export interface AuthTokenScopesItemCase1 {
+  type: AuthTokenScopesItemCase1Type;
+  teamId: string;
+  origin?: AuthTokenScopesItemCase1Origin;
+  createdAt: number;
+  expiresAt?: number;
+}
+export const AuthTokenScopesItemCase1 = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    type: AuthTokenScopesItemCase1Type,
+    teamId: S.String,
+    origin: S.optional(AuthTokenScopesItemCase1Origin),
+    createdAt: S.Number,
+    expiresAt: S.optional(S.Number),
+  }),
+).annotate({
+  identifier: "AuthTokenScopesItemCase1",
+}) as any as S.Schema<AuthTokenScopesItemCase1>;
+
+export type AuthTokenScopesItem =
+  | AuthTokenScopesItemCase0
+  | AuthTokenScopesItemCase1;
+export const AuthTokenScopesItem =
+  S.Unknown as any as S.Schema<AuthTokenScopesItem>;
+
+/** The access scopes granted to the token. */
+export type AuthTokenScopesList = Array<AuthTokenScopesItem>;
+export const AuthTokenScopesList = /*@__PURE__*/ S.Array(
+  AuthTokenScopesItem,
+) as any as S.Schema<AuthTokenScopesList>;
+
+/** Authentication token metadata. */
+export interface AuthToken {
+  /** The unique identifier of the token. */
+  id: string;
+  /** The human-readable name of the token. */
+  name: string;
+  /** The type of the token. */
+  type: string;
+  /** The token's prefix, for identification purposes. */
+  prefix?: string;
+  /** The last few characters of the token, for identification purposes. */
+  suffix?: string;
+  /** The origin of how the token was created. */
+  origin?: string;
+  /** The access scopes granted to the token. */
+  scopes?: AuthTokenScopesList;
+  /** Timestamp (in milliseconds) of when the token was created. */
+  createdAt: number;
+  /** Timestamp (in milliseconds) of when the token was most recently used. */
+  activeAt: number;
+  /** Timestamp (in milliseconds) of when the token expires. */
+  expiresAt?: number;
+  /** Timestamp (in milliseconds) of when the token was revoked. */
+  revokedAt?: number;
+  /** Timestamp (in milliseconds) of when the token was marked as leaked. */
+  leakedAt?: number;
+  /** URL where the token was discovered as leaked. */
+  leakedUrl?: string;
+}
+export const AuthToken = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    id: S.String,
+    name: S.String,
+    type: S.String,
+    prefix: S.optional(S.String),
+    suffix: S.optional(S.String),
+    origin: S.optional(S.String),
+    scopes: S.optional(AuthTokenScopesList),
+    createdAt: S.Number,
+    activeAt: S.Number,
+    expiresAt: S.optional(S.Number),
+    revokedAt: S.optional(S.Number),
+    leakedAt: S.optional(S.Number),
+    leakedUrl: S.optional(S.String),
+  }),
+).annotate({ identifier: "AuthToken" }) as any as S.Schema<AuthToken>;
+
+export interface CreateAuthTokenResponse {
+  token: AuthToken;
+  /** The authentication token's actual value. This token is only provided in this response, and can never be retrieved again in the future. Be sure to save it somewhere safe! */
+  bearerToken: string;
+}
+export const CreateAuthTokenResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    token: AuthToken,
+    bearerToken: S.String,
+  }),
+).annotate({
+  identifier: "CreateAuthTokenResponse",
+}) as any as S.Schema<CreateAuthTokenResponse>;
+
+export interface DeleteAuthTokenRequest {
+  /** The identifier of the token to invalidate. The special value "current" may be supplied, which invalidates the token that the HTTP request was authenticated with. */
+  tokenId: string;
+}
+export const DeleteAuthTokenRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    tokenId: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({ method: "DELETE", uri: "/v3/user/tokens/{tokenId}", code: 200 }),
+  ),
+).annotate({
+  identifier: "DeleteAuthTokenRequest",
+}) as any as S.Schema<DeleteAuthTokenRequest>;
+
+export interface DeleteAuthTokenResponse {
+  /** The unique identifier of the token that was deleted. */
+  tokenId: string;
+}
+export const DeleteAuthTokenResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    tokenId: S.String,
+  }),
+).annotate({
+  identifier: "DeleteAuthTokenResponse",
+}) as any as S.Schema<DeleteAuthTokenResponse>;
+
+/** The grant type, when using x-www-form-urlencoded content type */
+export type ExchangeSsoTokenRequestBodyCase0GrantType = "authorization_code";
+export const ExchangeSsoTokenRequestBodyCase0GrantType = S.String;
+
+export interface ExchangeSsoTokenRequestBodyCase0 {
+  /** The sensitive code received from Vercel */
+  code: string;
+  /** The state received from the initialization request */
+  state?: string;
+  /** The integration client id */
+  client_id: string;
+  /** The integration client secret */
+  client_secret: string | Redacted.Redacted<string>;
+  /** The integration redirect URI */
+  redirect_uri?: string;
+  /** The grant type, when using x-www-form-urlencoded content type */
+  grant_type: ExchangeSsoTokenRequestBodyCase0GrantType;
+}
+export const ExchangeSsoTokenRequestBodyCase0 = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    code: S.String,
+    state: S.optional(S.String),
+    client_id: S.String,
+    client_secret: S.String.pipe(T.SensitiveValue({})),
+    redirect_uri: S.optional(S.String),
+    grant_type: ExchangeSsoTokenRequestBodyCase0GrantType,
+  }),
+).annotate({
+  identifier: "ExchangeSsoTokenRequestBodyCase0",
+}) as any as S.Schema<ExchangeSsoTokenRequestBodyCase0>;
+
+/** The grant type, when using x-www-form-urlencoded content type */
+export type ExchangeSsoTokenRequestBodyCase1GrantType = "refresh_token";
+export const ExchangeSsoTokenRequestBodyCase1GrantType = S.String;
+
+export interface ExchangeSsoTokenRequestBodyCase1 {
+  /** The refresh token received from previous token exchange */
+  refresh_token: string | Redacted.Redacted<string>;
+  /** The integration client id */
+  client_id: string;
+  /** The integration client secret */
+  client_secret: string | Redacted.Redacted<string>;
+  /** The grant type, when using x-www-form-urlencoded content type */
+  grant_type: ExchangeSsoTokenRequestBodyCase1GrantType;
+}
+export const ExchangeSsoTokenRequestBodyCase1 = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    refresh_token: S.String.pipe(T.SensitiveValue({})),
+    client_id: S.String,
+    client_secret: S.String.pipe(T.SensitiveValue({})),
+    grant_type: ExchangeSsoTokenRequestBodyCase1GrantType,
+  }),
+).annotate({
+  identifier: "ExchangeSsoTokenRequestBodyCase1",
+}) as any as S.Schema<ExchangeSsoTokenRequestBodyCase1>;
+
+export type ExchangeSsoTokenRequestBody =
+  | ExchangeSsoTokenRequestBodyCase0
+  | ExchangeSsoTokenRequestBodyCase1;
+export const ExchangeSsoTokenRequestBody =
+  S.Unknown as any as S.Schema<ExchangeSsoTokenRequestBody>;
+
+export interface ExchangeSsoTokenRequest {
+  body: ExchangeSsoTokenRequestBody;
+}
+export const ExchangeSsoTokenRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    body: ExchangeSsoTokenRequestBody.pipe(T.HttpBody()),
+  }).pipe(
+    T.Http({ method: "POST", uri: "/v1/integrations/sso/token", code: 200 }),
+  ),
+).annotate({
+  identifier: "ExchangeSsoTokenRequest",
+}) as any as S.Schema<ExchangeSsoTokenRequest>;
+
+export interface ExchangeSsoTokenResponseBodyCase0 {
+  id_token: string;
+  token_type: string | null;
+  expires_in?: number;
+  access_token: string | Redacted.Redacted<string> | null;
+  refresh_token?: string | Redacted.Redacted<string>;
+}
+export const ExchangeSsoTokenResponseBodyCase0 = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    id_token: S.String,
+    token_type: S.NullOr(S.String),
+    expires_in: S.optional(S.Number),
+    access_token: S.NullOr(S.String).pipe(T.SensitiveValue({})),
+    refresh_token: S.optional(S.String.pipe(T.SensitiveValue({}))),
+  }),
+).annotate({
+  identifier: "ExchangeSsoTokenResponseBodyCase0",
+}) as any as S.Schema<ExchangeSsoTokenResponseBodyCase0>;
+
+export interface ExchangeSsoTokenResponseBodyCase1 {
+  id_token: string;
+  token_type: string;
+  access_token: string | Redacted.Redacted<string>;
+  refresh_token: string | Redacted.Redacted<string>;
+  expires_in: number;
+}
+export const ExchangeSsoTokenResponseBodyCase1 = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    id_token: S.String,
+    token_type: S.String,
+    access_token: S.String.pipe(T.SensitiveValue({})),
+    refresh_token: S.String.pipe(T.SensitiveValue({})),
+    expires_in: S.Number,
+  }),
+).annotate({
+  identifier: "ExchangeSsoTokenResponseBodyCase1",
+}) as any as S.Schema<ExchangeSsoTokenResponseBodyCase1>;
+
+export type ExchangeSsoTokenResponseBody =
+  | ExchangeSsoTokenResponseBodyCase0
+  | ExchangeSsoTokenResponseBodyCase1;
+export const ExchangeSsoTokenResponseBody =
+  S.Unknown as any as S.Schema<ExchangeSsoTokenResponseBody>;
+
+export type ExchangeSsoTokenResponse = ExchangeSsoTokenResponseBody;
+export const ExchangeSsoTokenResponse = /*@__PURE__*/ S.suspend(() =>
+  ExchangeSsoTokenResponseBody.pipe(T.RawResponseRoot()),
+).annotate({
+  identifier: "ExchangeSsoTokenResponse",
+}) as any as S.Schema<ExchangeSsoTokenResponse>;
+
+export interface GetAuthTokenRequest {
+  /** The identifier of the token to retrieve. The special value "current" may be supplied, which returns the metadata for the token that the current HTTP request is authenticated with. */
+  tokenId: string;
+}
+export const GetAuthTokenRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    tokenId: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({ method: "GET", uri: "/v5/user/tokens/{tokenId}", code: 200 }),
+  ),
+).annotate({
+  identifier: "GetAuthTokenRequest",
+}) as any as S.Schema<GetAuthTokenRequest>;
+
+export interface GetAuthTokenResponse {
+  token: AuthToken;
+}
+export const GetAuthTokenResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    token: AuthToken,
+  }),
+).annotate({
+  identifier: "GetAuthTokenResponse",
+}) as any as S.Schema<GetAuthTokenResponse>;
+
+export interface ListAuthTokensRequest {}
+export const ListAuthTokensRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}).pipe(
+    T.Http({ method: "GET", uri: "/v6/user/tokens", code: 200 }),
+  ),
+).annotate({
+  identifier: "ListAuthTokensRequest",
+}) as any as S.Schema<ListAuthTokensRequest>;
+
+export type ListAuthTokensResponseBodyCase0TokensList = Array<AuthToken>;
+export const ListAuthTokensResponseBodyCase0TokensList = /*@__PURE__*/ S.Array(
+  AuthToken,
+) as any as S.Schema<ListAuthTokensResponseBodyCase0TokensList>;
+
+export interface ListAuthTokensResponseBodyCase0Pagination {
+  count: number;
+  next: string | null;
+  prev: string | null;
+}
+export const ListAuthTokensResponseBodyCase0Pagination =
+  /*@__PURE__*/ S.suspend(() =>
+    S.Struct({
+      count: S.Number,
+      next: S.NullOr(S.String),
+      prev: S.NullOr(S.String),
+    }),
+  ).annotate({
+    identifier: "ListAuthTokensResponseBodyCase0Pagination",
+  }) as any as S.Schema<ListAuthTokensResponseBodyCase0Pagination>;
+
+export interface ListAuthTokensResponseBodyCase0 {
+  tokens: ListAuthTokensResponseBodyCase0TokensList;
+  pagination: ListAuthTokensResponseBodyCase0Pagination;
+}
+export const ListAuthTokensResponseBodyCase0 = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    tokens: ListAuthTokensResponseBodyCase0TokensList,
+    pagination: ListAuthTokensResponseBodyCase0Pagination,
+  }),
+).annotate({
+  identifier: "ListAuthTokensResponseBodyCase0",
+}) as any as S.Schema<ListAuthTokensResponseBodyCase0>;
+
+export type ListAuthTokensResponseBodyCase1TokensList = Array<AuthToken>;
+export const ListAuthTokensResponseBodyCase1TokensList = /*@__PURE__*/ S.Array(
+  AuthToken,
+) as any as S.Schema<ListAuthTokensResponseBodyCase1TokensList>;
+
+/** This object contains information related to the pagination of the current request, including the necessary parameters to get the next or previous page of data. */
+export interface Pagination {
+  /** Amount of items in the current page. */
+  count: number;
+  /** Timestamp that must be used to request the next page. */
+  next: number | null;
+  /** Timestamp that must be used to request the previous page. */
+  prev: number | null;
+}
+export const Pagination = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    count: S.Number,
+    next: S.NullOr(S.Number),
+    prev: S.NullOr(S.Number),
+  }),
+).annotate({ identifier: "Pagination" }) as any as S.Schema<Pagination>;
+
+export interface ListAuthTokensResponseBodyCase1 {
+  tokens: ListAuthTokensResponseBodyCase1TokensList;
+  pagination: Pagination;
+}
+export const ListAuthTokensResponseBodyCase1 = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    tokens: ListAuthTokensResponseBodyCase1TokensList,
+    pagination: Pagination,
+  }),
+).annotate({
+  identifier: "ListAuthTokensResponseBodyCase1",
+}) as any as S.Schema<ListAuthTokensResponseBodyCase1>;
+
+export type ListAuthTokensResponseBody =
+  | ListAuthTokensResponseBodyCase0
+  | ListAuthTokensResponseBodyCase1;
+export const ListAuthTokensResponseBody =
+  S.Unknown as any as S.Schema<ListAuthTokensResponseBody>;
+
+export type ListAuthTokensResponse = ListAuthTokensResponseBody;
+export const ListAuthTokensResponse = /*@__PURE__*/ S.suspend(() =>
+  ListAuthTokensResponseBody.pipe(T.RawResponseRoot()),
+).annotate({
+  identifier: "ListAuthTokensResponse",
+}) as any as S.Schema<ListAuthTokensResponse>;
+
+export type CreateApiKeysError =
+  | BadRequest
+  | Forbidden
+  | Conflict
+  | VercelOpError;
+export const createApiKeys: API.OperationMethod<
+  CreateApiKeysRequest,
+  CreateApiKeysResponse,
+  CreateApiKeysError,
+  VercelOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: CreateApiKeysRequest,
+  output: CreateApiKeysResponse,
+  errors: [BadRequest, Forbidden, Conflict],
+  protocol: VercelProtocol,
+  retry: Retry.Retry,
+}));
+
+export type CreateAuthTokenError =
+  | BadRequest
+  | Forbidden
+  | NotFound
+  | VercelOpError;
+/** Create an Auth Token Creates and returns a new authentication token for the currently authenticated User. The `bearerToken` property is only provided once, in the response body, so be sure to save it on the client for use with API requests. */
+export const createAuthToken: API.OperationMethod<
+  CreateAuthTokenRequest,
+  CreateAuthTokenResponse,
+  CreateAuthTokenError,
+  VercelOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: CreateAuthTokenRequest,
+  output: CreateAuthTokenResponse,
+  errors: [BadRequest, Forbidden, NotFound],
+  protocol: VercelProtocol,
+  retry: Retry.Retry,
+}));
+
+export type DeleteAuthTokenError =
+  | BadRequest
+  | Forbidden
+  | NotFound
+  | VercelOpError;
+/** Delete an authentication token Invalidate an authentication token, such that it will no longer be valid for future HTTP requests. */
+export const deleteAuthToken: API.OperationMethod<
+  DeleteAuthTokenRequest,
+  DeleteAuthTokenResponse,
+  DeleteAuthTokenError,
+  VercelOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: DeleteAuthTokenRequest,
+  output: DeleteAuthTokenResponse,
+  errors: [BadRequest, Forbidden, NotFound],
+  protocol: VercelProtocol,
+  retry: Retry.Retry,
+}));
+
+export type ExchangeSsoTokenError = BadRequest | Forbidden | VercelOpError;
+/** SSO Token Exchange During the autorization process, Vercel sends the user to the provider [redirectLoginUrl](https://vercel.com/docs/integrations/create-integration/submit-integration#redirect-login-url), that includes the OAuth authorization `code` parameter. The provider then calls the SSO Token Exchange endpoint with the sent code and receives the OIDC token. They log the user in based on this token and redirects the user back to the Vercel account using deep-link parameters included the redirectLoginUrl. Providers should not persist the returned `id_token` in a database since the token will expire. See [**Authentication with SSO**](https://vercel.com/docs/integrations/create-integration/marketplace-api#authentication-with-sso) for more details. */
+export const exchangeSsoToken: API.OperationMethod<
+  ExchangeSsoTokenRequest,
+  ExchangeSsoTokenResponse,
+  ExchangeSsoTokenError,
+  VercelOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: ExchangeSsoTokenRequest,
+  output: ExchangeSsoTokenResponse,
+  errors: [BadRequest, Forbidden],
+  protocol: VercelProtocol,
+  retry: Retry.Retry,
+}));
+
+export type GetAuthTokenError =
+  | BadRequest
+  | Forbidden
+  | NotFound
+  | VercelOpError;
+/** Get Auth Token Metadata Retrieve metadata about an authentication token belonging to the currently authenticated User. */
+export const getAuthToken: API.OperationMethod<
+  GetAuthTokenRequest,
+  GetAuthTokenResponse,
+  GetAuthTokenError,
+  VercelOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: GetAuthTokenRequest,
+  output: GetAuthTokenResponse,
+  errors: [BadRequest, Forbidden, NotFound],
+  protocol: VercelProtocol,
+  retry: Retry.Retry,
+}));
+
+export type ListAuthTokensError = BadRequest | Forbidden | VercelOpError;
+/** List Auth Tokens Retrieve a list of the current User's authentication tokens. */
+export const listAuthTokens: API.OperationMethod<
+  ListAuthTokensRequest,
+  ListAuthTokensResponse,
+  ListAuthTokensError,
+  VercelOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: ListAuthTokensRequest,
+  output: ListAuthTokensResponse,
+  errors: [BadRequest, Forbidden],
+  protocol: VercelProtocol,
+  retry: Retry.Retry,
+}));