@distilled.cloud/vercel 0.0.0 → 1.0.0-rc.10

package/lib/services/kms.d.ts

@@ -0,0 +1,1095 @@
+import * as S from "@distilled.cloud/core/schema";
+import * as API from "@distilled.cloud/core/api";
+import { type VercelOpError, type VercelOpContext } from "../protocol.ts";
+export type { VercelOpError, VercelOpContext };
+declare const BadRequest_base: S.Class<BadRequest, S.TaggedStruct<"BadRequest", {
+    readonly code: any;
+    readonly message: any;
+}>, import("effect/Cause").YieldableError> & (new (...args: any[]) => {
+    "@distilled.cloud/error/categories": {
+        BadRequestError: true;
+    };
+});
+export declare class BadRequest extends /*@__PURE__*/ BadRequest_base {
+}
+declare const Conflict_base: S.Class<Conflict, S.TaggedStruct<"Conflict", {
+    readonly code: any;
+    readonly message: any;
+}>, import("effect/Cause").YieldableError> & (new (...args: any[]) => {
+    "@distilled.cloud/error/categories": {
+        ConflictError: true;
+    };
+});
+export declare class Conflict extends /*@__PURE__*/ Conflict_base {
+}
+declare const Forbidden_base: S.Class<Forbidden, S.TaggedStruct<"Forbidden", {
+    readonly code: any;
+    readonly message: any;
+}>, import("effect/Cause").YieldableError> & (new (...args: any[]) => {
+    "@distilled.cloud/error/categories": {
+        AuthError: true;
+    };
+});
+export declare class Forbidden extends /*@__PURE__*/ Forbidden_base {
+}
+declare const NotFound_base: S.Class<NotFound, S.TaggedStruct<"NotFound", {
+    readonly code: any;
+    readonly message: any;
+}>, import("effect/Cause").YieldableError> & (new (...args: any[]) => {
+    "@distilled.cloud/error/categories": {
+        BadRequestError: true;
+    };
+});
+export declare class NotFound extends /*@__PURE__*/ NotFound_base {
+}
+export interface ActivateKmsSigningKeyRequest {
+    /** The ID of the issuer. */
+    issuerId: string;
+    /** The ID of the pending signing key to activate. */
+    keyId: string;
+    /** The Team identifier to perform the request on behalf of. */
+    teamId?: string;
+    /** The Team slug to perform the request on behalf of. */
+    slug?: string;
+    /** How many hours after activation the previously-active key should stop being used. Defaults to a 1 hour grace period so already-issued tokens keep verifying. */
+    revokePreviousAfterHours?: number;
+}
+export declare const ActivateKmsSigningKeyRequest: S.Schema<ActivateKmsSigningKeyRequest>;
+export type ActivateKmsSigningKeyResponseStatus = "active" | "pending" | "revoking";
+export declare const ActivateKmsSigningKeyResponseStatus: any;
+export type ActivateKmsSigningKeyResponsePublicKeyKeyOpsList = Array<string>;
+export declare const ActivateKmsSigningKeyResponsePublicKeyKeyOpsList: S.Schema<ActivateKmsSigningKeyResponsePublicKeyKeyOpsList>;
+/** The X.509 certificate chain (RFC 7517 §4.7). Each entry is the base64 DER (not base64url) of a certificate. For keys minted with a stored certificate this holds the single self-signed cert as `[x5c]`. */
+export type ActivateKmsSigningKeyResponsePublicKeyX5cList = Array<string>;
+export declare const ActivateKmsSigningKeyResponsePublicKeyX5cList: S.Schema<ActivateKmsSigningKeyResponsePublicKeyX5cList>;
+export interface ActivateKmsSigningKeyResponsePublicKey {
+    kty?: string;
+    kid?: string;
+    alg?: string;
+    use?: string;
+    key_ops?: ActivateKmsSigningKeyResponsePublicKeyKeyOpsList;
+    /** The X.509 certificate chain (RFC 7517 §4.7). Each entry is the base64 DER (not base64url) of a certificate. For keys minted with a stored certificate this holds the single self-signed cert as `[x5c]`. */
+    x5c?: ActivateKmsSigningKeyResponsePublicKeyX5cList;
+    /** The base64url SHA-256 thumbprint of the DER certificate in `x5c[0]` (RFC 7517 §4.9). */
+    x5t_S256?: string;
+}
+export declare const ActivateKmsSigningKeyResponsePublicKey: S.Schema<ActivateKmsSigningKeyResponsePublicKey>;
+export interface ActivateKmsSigningKeyResponse {
+    /** The server-minted, unique record identifier. Use this to address the key on the activate / certificate endpoints. */
+    keyId: string;
+    /** The caller-supplied key id (imported keys only), used as the JWT/JWKS `kid`. Not unique across an issuer's keys; omitted for generated keys. */
+    importKeyId?: string;
+    issuerId: string;
+    algorithm: string;
+    status: ActivateKmsSigningKeyResponseStatus;
+    publicKey?: ActivateKmsSigningKeyResponsePublicKey;
+    publicKeyFingerprint?: string;
+    /** The public key in SPKI PEM form, ready to render. Present whenever the key has public key material. Derived from `publicKey`; the embedded certificate members (`x5c`/`x5t#S256`) do not affect it. */
+    publicKeyPem?: string;
+    /** The stored X.509 certificate (from `publicKey.x5c[0]`) in PEM form, ready to render. Present only for keys created with a stored certificate; omitted for keys created before certificates were stored. */
+    certificatePem?: string;
+    createdAt: string;
+    updatedAt: string;
+    revokeAt?: string;
+    activateAt?: string;
+    /** When the key became the active signer. Present for active and revoking keys (and absent for pending keys and rows predating this field). */
+    activatedAt?: string;
+}
+export declare const ActivateKmsSigningKeyResponse: S.Schema<ActivateKmsSigningKeyResponse>;
+/** The signing algorithm to use for the issuer. */
+export type CreateKmsIssuerRequestAlgorithm = "RS256" | "RS384" | "RS512" | "PS256" | "PS384" | "PS512" | "ES256" | "ES384" | "ES512" | "EdDSA";
+export declare const CreateKmsIssuerRequestAlgorithm: any;
+/** A JSON Schema used to validate the resolved token claims when signing tokens for this issuer. */
+export type CreateKmsIssuerRequestClaimsSchemaMap = {
+    [key: string]: unknown | undefined;
+};
+export declare const CreateKmsIssuerRequestClaimsSchemaMap: S.Schema<CreateKmsIssuerRequestClaimsSchemaMap>;
+export type CreateKmsIssuerRequestPolicyCase0Kind = "project-grant";
+export declare const CreateKmsIssuerRequestPolicyCase0Kind: any;
+/** The environments for the project grant policy. Each entry is a system environment (production, preview, development) or a custom environment ID (env_...). */
+export type CreateKmsIssuerRequestPolicyCase0EnvironmentsList = Array<string>;
+export declare const CreateKmsIssuerRequestPolicyCase0EnvironmentsList: S.Schema<CreateKmsIssuerRequestPolicyCase0EnvironmentsList>;
+/** The claims that KMS should include in signed JWTs for this policy. */
+export type CreateKmsIssuerRequestPolicyCase0TokenClaimsMap = {
+    [key: string]: unknown | undefined;
+};
+export declare const CreateKmsIssuerRequestPolicyCase0TokenClaimsMap: S.Schema<CreateKmsIssuerRequestPolicyCase0TokenClaimsMap>;
+export interface CreateKmsIssuerRequestPolicyCase0 {
+    kind: CreateKmsIssuerRequestPolicyCase0Kind;
+    /** The team ID for the project grant policy. */
+    teamId: string;
+    /** The project ID for the project grant policy. */
+    projectId: string;
+    /** The environments for the project grant policy. Each entry is a system environment (production, preview, development) or a custom environment ID (env_...). */
+    environments: CreateKmsIssuerRequestPolicyCase0EnvironmentsList;
+    /** The claims that KMS should include in signed JWTs for this policy. */
+    tokenClaims?: CreateKmsIssuerRequestPolicyCase0TokenClaimsMap;
+}
+export declare const CreateKmsIssuerRequestPolicyCase0: S.Schema<CreateKmsIssuerRequestPolicyCase0>;
+export type CreateKmsIssuerRequestPolicyCase1Kind = "connex-grant";
+export declare const CreateKmsIssuerRequestPolicyCase1Kind: any;
+/** The claims that KMS should include in signed JWTs for this policy. */
+export type CreateKmsIssuerRequestPolicyCase1TokenClaimsMap = {
+    [key: string]: unknown | undefined;
+};
+export declare const CreateKmsIssuerRequestPolicyCase1TokenClaimsMap: S.Schema<CreateKmsIssuerRequestPolicyCase1TokenClaimsMap>;
+export interface CreateKmsIssuerRequestPolicyCase1 {
+    kind: CreateKmsIssuerRequestPolicyCase1Kind;
+    /** The Connex client ID for the Connex grant policy. */
+    clientId: string;
+    /** The claims that KMS should include in signed JWTs for this policy. */
+    tokenClaims?: CreateKmsIssuerRequestPolicyCase1TokenClaimsMap;
+}
+export declare const CreateKmsIssuerRequestPolicyCase1: S.Schema<CreateKmsIssuerRequestPolicyCase1>;
+export type CreateKmsIssuerRequestPolicy = CreateKmsIssuerRequestPolicyCase0 | CreateKmsIssuerRequestPolicyCase1;
+export declare const CreateKmsIssuerRequestPolicy: S.Schema<CreateKmsIssuerRequestPolicy>;
+export interface CreateKmsIssuerRequest {
+    /** The Team identifier to perform the request on behalf of. */
+    teamId?: string;
+    /** The Team slug to perform the request on behalf of. */
+    slug?: string;
+    /** The name of the issuer. */
+    name: string;
+    /** The signing algorithm to use for the issuer. */
+    algorithm?: CreateKmsIssuerRequestAlgorithm | (string & {});
+    /** A JSON Schema used to validate the resolved token claims when signing tokens for this issuer. */
+    claimsSchema?: CreateKmsIssuerRequestClaimsSchemaMap;
+    policy?: CreateKmsIssuerRequestPolicy;
+    /** The PEM-encoded private key to use for the issuer. */
+    importKey?: string;
+    /** The key id to use as the imported key's JWT/JWKS `kid`. Only allowed when `importKey` is provided. Not required to be unique; the addressable key id is the server-minted `keyId` returned in the response. */
+    importKeyId?: string;
+}
+export declare const CreateKmsIssuerRequest: S.Schema<CreateKmsIssuerRequest>;
+export type CreateKmsIssuerResponseAlgorithm = "ES256" | "ES384" | "ES512" | "EdDSA" | "PS256" | "PS384" | "PS512" | "RS256" | "RS384" | "RS512";
+export declare const CreateKmsIssuerResponseAlgorithm: any;
+export type CreateKmsIssuerResponseOrigin = "external" | "vercel";
+export declare const CreateKmsIssuerResponseOrigin: any;
+export type CreateKmsIssuerResponseClaimsSchemaMap = {
+    [key: string]: unknown | undefined;
+};
+export declare const CreateKmsIssuerResponseClaimsSchemaMap: S.Schema<CreateKmsIssuerResponseClaimsSchemaMap>;
+export type CreateKmsIssuerResponseSigningKeysItemStatus = "active" | "pending" | "revoking";
+export declare const CreateKmsIssuerResponseSigningKeysItemStatus: any;
+export type CreateKmsIssuerResponseSigningKeysItemPublicKeyKeyOpsList = Array<string>;
+export declare const CreateKmsIssuerResponseSigningKeysItemPublicKeyKeyOpsList: S.Schema<CreateKmsIssuerResponseSigningKeysItemPublicKeyKeyOpsList>;
+/** The X.509 certificate chain (RFC 7517 §4.7). Each entry is the base64 DER (not base64url) of a certificate. For keys minted with a stored certificate this holds the single self-signed cert as `[x5c]`. */
+export type CreateKmsIssuerResponseSigningKeysItemPublicKeyX5cList = Array<string>;
+export declare const CreateKmsIssuerResponseSigningKeysItemPublicKeyX5cList: S.Schema<CreateKmsIssuerResponseSigningKeysItemPublicKeyX5cList>;
+export interface CreateKmsIssuerResponseSigningKeysItemPublicKey {
+    kty?: string;
+    kid?: string;
+    alg?: string;
+    use?: string;
+    key_ops?: CreateKmsIssuerResponseSigningKeysItemPublicKeyKeyOpsList;
+    /** The X.509 certificate chain (RFC 7517 §4.7). Each entry is the base64 DER (not base64url) of a certificate. For keys minted with a stored certificate this holds the single self-signed cert as `[x5c]`. */
+    x5c?: CreateKmsIssuerResponseSigningKeysItemPublicKeyX5cList;
+    /** The base64url SHA-256 thumbprint of the DER certificate in `x5c[0]` (RFC 7517 §4.9). */
+    x5t_S256?: string;
+}
+export declare const CreateKmsIssuerResponseSigningKeysItemPublicKey: S.Schema<CreateKmsIssuerResponseSigningKeysItemPublicKey>;
+export interface CreateKmsIssuerResponseSigningKeysItem {
+    /** The server-minted, unique record identifier. Use this to address the key on the activate / certificate endpoints. */
+    keyId: string;
+    /** The caller-supplied key id (imported keys only), used as the JWT/JWKS `kid`. Not unique across an issuer's keys; omitted for generated keys. */
+    importKeyId?: string;
+    issuerId: string;
+    algorithm: string;
+    status: CreateKmsIssuerResponseSigningKeysItemStatus;
+    publicKey?: CreateKmsIssuerResponseSigningKeysItemPublicKey;
+    publicKeyFingerprint?: string;
+    /** The public key in SPKI PEM form, ready to render. Present whenever the key has public key material. Derived from `publicKey`; the embedded certificate members (`x5c`/`x5t#S256`) do not affect it. */
+    publicKeyPem?: string;
+    /** The stored X.509 certificate (from `publicKey.x5c[0]`) in PEM form, ready to render. Present only for keys created with a stored certificate; omitted for keys created before certificates were stored. */
+    certificatePem?: string;
+    createdAt: string;
+    updatedAt: string;
+    revokeAt?: string;
+    activateAt?: string;
+    /** When the key became the active signer. Present for active and revoking keys (and absent for pending keys and rows predating this field). */
+    activatedAt?: string;
+}
+export declare const CreateKmsIssuerResponseSigningKeysItem: S.Schema<CreateKmsIssuerResponseSigningKeysItem>;
+export type CreateKmsIssuerResponseSigningKeysList = Array<CreateKmsIssuerResponseSigningKeysItem>;
+export declare const CreateKmsIssuerResponseSigningKeysList: S.Schema<CreateKmsIssuerResponseSigningKeysList>;
+export type CreateKmsIssuerResponsePoliciesItemCase0Kind = "project-grant";
+export declare const CreateKmsIssuerResponsePoliciesItemCase0Kind: any;
+/** Environments whose OIDC tokens this grant authorizes. Each entry is either a system environment slug (`production`, `preview`, `development`) or a custom environment ID (prefixed `env_`). Custom environments are matched against the token's `custom_environment_id` claim (the stable ID); system environments against its `environment` claim. */
+export type CreateKmsIssuerResponsePoliciesItemCase0EnvironmentsList = Array<string>;
+export declare const CreateKmsIssuerResponsePoliciesItemCase0EnvironmentsList: S.Schema<CreateKmsIssuerResponsePoliciesItemCase0EnvironmentsList>;
+export type CreateKmsIssuerResponsePoliciesItemCase0TokenClaimsMap = {
+    [key: string]: unknown | undefined;
+};
+export declare const CreateKmsIssuerResponsePoliciesItemCase0TokenClaimsMap: S.Schema<CreateKmsIssuerResponsePoliciesItemCase0TokenClaimsMap>;
+export interface CreateKmsIssuerResponsePoliciesItemCase0 {
+    kind: CreateKmsIssuerResponsePoliciesItemCase0Kind;
+    teamId: string;
+    projectId: string;
+    /** Environments whose OIDC tokens this grant authorizes. Each entry is either a system environment slug (`production`, `preview`, `development`) or a custom environment ID (prefixed `env_`). Custom environments are matched against the token's `custom_environment_id` claim (the stable ID); system environments against its `environment` claim. */
+    environments: CreateKmsIssuerResponsePoliciesItemCase0EnvironmentsList;
+    tokenClaims?: CreateKmsIssuerResponsePoliciesItemCase0TokenClaimsMap;
+    createdAt: string;
+    updatedAt: string;
+}
+export declare const CreateKmsIssuerResponsePoliciesItemCase0: S.Schema<CreateKmsIssuerResponsePoliciesItemCase0>;
+export type CreateKmsIssuerResponsePoliciesItemCase1Kind = "connex-grant";
+export declare const CreateKmsIssuerResponsePoliciesItemCase1Kind: any;
+export type CreateKmsIssuerResponsePoliciesItemCase1TokenClaimsMap = {
+    [key: string]: unknown | undefined;
+};
+export declare const CreateKmsIssuerResponsePoliciesItemCase1TokenClaimsMap: S.Schema<CreateKmsIssuerResponsePoliciesItemCase1TokenClaimsMap>;
+export interface CreateKmsIssuerResponsePoliciesItemCase1 {
+    kind: CreateKmsIssuerResponsePoliciesItemCase1Kind;
+    clientId: string;
+    tokenClaims?: CreateKmsIssuerResponsePoliciesItemCase1TokenClaimsMap;
+    createdAt: string;
+    updatedAt: string;
+}
+export declare const CreateKmsIssuerResponsePoliciesItemCase1: S.Schema<CreateKmsIssuerResponsePoliciesItemCase1>;
+export type CreateKmsIssuerResponsePoliciesItem = CreateKmsIssuerResponsePoliciesItemCase0 | CreateKmsIssuerResponsePoliciesItemCase1;
+export declare const CreateKmsIssuerResponsePoliciesItem: S.Schema<CreateKmsIssuerResponsePoliciesItem>;
+export type CreateKmsIssuerResponsePoliciesList = Array<CreateKmsIssuerResponsePoliciesItem>;
+export declare const CreateKmsIssuerResponsePoliciesList: S.Schema<CreateKmsIssuerResponsePoliciesList>;
+export interface CreateKmsIssuerResponse {
+    id: string;
+    ownerId: string;
+    name: string;
+    algorithm: CreateKmsIssuerResponseAlgorithm;
+    origin: CreateKmsIssuerResponseOrigin;
+    managedBy?: string;
+    claimsSchema?: CreateKmsIssuerResponseClaimsSchemaMap;
+    createdAt: string;
+    updatedAt: string;
+    signingKeys: CreateKmsIssuerResponseSigningKeysList;
+    policies: CreateKmsIssuerResponsePoliciesList;
+}
+export declare const CreateKmsIssuerResponse: S.Schema<CreateKmsIssuerResponse>;
+export type CreateKmsIssuerPolicyRequestKind = "project-grant";
+export declare const CreateKmsIssuerPolicyRequestKind: any;
+/** The environments for the project grant policy. Each entry is a system environment (production, preview, development) or a custom environment ID (env_...). */
+export type CreateKmsIssuerPolicyRequestEnvironmentsList = Array<string>;
+export declare const CreateKmsIssuerPolicyRequestEnvironmentsList: S.Schema<CreateKmsIssuerPolicyRequestEnvironmentsList>;
+/** The claims that KMS should include in signed JWTs for this policy. */
+export type CreateKmsIssuerPolicyRequestTokenClaimsMap = {
+    [key: string]: unknown | undefined;
+};
+export declare const CreateKmsIssuerPolicyRequestTokenClaimsMap: S.Schema<CreateKmsIssuerPolicyRequestTokenClaimsMap>;
+export interface CreateKmsIssuerPolicyRequest {
+    /** The ID of the issuer. */
+    issuerId: string;
+    /** The Team identifier to perform the request on behalf of. */
+    teamId?: string;
+    /** The Team slug to perform the request on behalf of. */
+    slug?: string;
+    kind: CreateKmsIssuerPolicyRequestKind | (string & {});
+    /** The project ID for the project grant policy. */
+    projectId: string;
+    /** The environments for the project grant policy. Each entry is a system environment (production, preview, development) or a custom environment ID (env_...). */
+    environments: CreateKmsIssuerPolicyRequestEnvironmentsList;
+    /** The claims that KMS should include in signed JWTs for this policy. */
+    tokenClaims?: CreateKmsIssuerPolicyRequestTokenClaimsMap;
+}
+export declare const CreateKmsIssuerPolicyRequest: S.Schema<CreateKmsIssuerPolicyRequest>;
+export type CreateKmsIssuerPolicyResponseBodyCase0Kind = "project-grant";
+export declare const CreateKmsIssuerPolicyResponseBodyCase0Kind: any;
+/** Environments whose OIDC tokens this grant authorizes. Each entry is either a system environment slug (`production`, `preview`, `development`) or a custom environment ID (prefixed `env_`). Custom environments are matched against the token's `custom_environment_id` claim (the stable ID); system environments against its `environment` claim. */
+export type CreateKmsIssuerPolicyResponseBodyCase0EnvironmentsList = Array<string>;
+export declare const CreateKmsIssuerPolicyResponseBodyCase0EnvironmentsList: S.Schema<CreateKmsIssuerPolicyResponseBodyCase0EnvironmentsList>;
+export type CreateKmsIssuerPolicyResponseBodyCase0TokenClaimsMap = {
+    [key: string]: unknown | undefined;
+};
+export declare const CreateKmsIssuerPolicyResponseBodyCase0TokenClaimsMap: S.Schema<CreateKmsIssuerPolicyResponseBodyCase0TokenClaimsMap>;
+export interface CreateKmsIssuerPolicyResponseBodyCase0 {
+    kind: CreateKmsIssuerPolicyResponseBodyCase0Kind;
+    teamId: string;
+    projectId: string;
+    /** Environments whose OIDC tokens this grant authorizes. Each entry is either a system environment slug (`production`, `preview`, `development`) or a custom environment ID (prefixed `env_`). Custom environments are matched against the token's `custom_environment_id` claim (the stable ID); system environments against its `environment` claim. */
+    environments: CreateKmsIssuerPolicyResponseBodyCase0EnvironmentsList;
+    tokenClaims?: CreateKmsIssuerPolicyResponseBodyCase0TokenClaimsMap;
+    createdAt: string;
+    updatedAt: string;
+}
+export declare const CreateKmsIssuerPolicyResponseBodyCase0: S.Schema<CreateKmsIssuerPolicyResponseBodyCase0>;
+export type CreateKmsIssuerPolicyResponseBodyCase1Kind = "connex-grant";
+export declare const CreateKmsIssuerPolicyResponseBodyCase1Kind: any;
+export type CreateKmsIssuerPolicyResponseBodyCase1TokenClaimsMap = {
+    [key: string]: unknown | undefined;
+};
+export declare const CreateKmsIssuerPolicyResponseBodyCase1TokenClaimsMap: S.Schema<CreateKmsIssuerPolicyResponseBodyCase1TokenClaimsMap>;
+export interface CreateKmsIssuerPolicyResponseBodyCase1 {
+    kind: CreateKmsIssuerPolicyResponseBodyCase1Kind;
+    clientId: string;
+    tokenClaims?: CreateKmsIssuerPolicyResponseBodyCase1TokenClaimsMap;
+    createdAt: string;
+    updatedAt: string;
+}
+export declare const CreateKmsIssuerPolicyResponseBodyCase1: S.Schema<CreateKmsIssuerPolicyResponseBodyCase1>;
+export type CreateKmsIssuerPolicyResponseBody = CreateKmsIssuerPolicyResponseBodyCase0 | CreateKmsIssuerPolicyResponseBodyCase1;
+export declare const CreateKmsIssuerPolicyResponseBody: S.Schema<CreateKmsIssuerPolicyResponseBody>;
+export type CreateKmsIssuerPolicyResponse = CreateKmsIssuerPolicyResponseBody;
+export declare const CreateKmsIssuerPolicyResponse: S.Schema<CreateKmsIssuerPolicyResponse>;
+/** Whether the new key is activated automatically after its public key has propagated, or manually via the activate endpoint. Defaults to `automatic`. */
+export type CreateKmsSigningKeyRequestActivation = "automatic" | "manual";
+export declare const CreateKmsSigningKeyRequestActivation: any;
+/** Deprecated. The ISO date string or timestamp when the previous signing key should stop being used. Converted to a relative grace and applied at activation, not creation. Prefer revokePreviousAfterHours. */
+export type CreateKmsSigningKeyRequestRevokePreviousAt = string | number;
+export declare const CreateKmsSigningKeyRequestRevokePreviousAt: S.Schema<CreateKmsSigningKeyRequestRevokePreviousAt>;
+export interface CreateKmsSigningKeyRequest {
+    /** The ID of the issuer. */
+    issuerId: string;
+    /** The Team identifier to perform the request on behalf of. */
+    teamId?: string;
+    /** The Team slug to perform the request on behalf of. */
+    slug?: string;
+    /** Whether the new key is activated automatically after its public key has propagated, or manually via the activate endpoint. Defaults to `automatic`. */
+    activation?: CreateKmsSigningKeyRequestActivation | (string & {});
+    /** For automatic activation, how many hours after activation the previous signing key should stop being used. Defaults to a 1 hour grace period so already-issued tokens keep verifying. */
+    revokePreviousAfterHours?: number;
+    /** Deprecated. The ISO date string or timestamp when the previous signing key should stop being used. Converted to a relative grace and applied at activation, not creation. Prefer revokePreviousAfterHours. */
+    revokePreviousAt?: CreateKmsSigningKeyRequestRevokePreviousAt;
+    /** The PEM-encoded private key to use for the issuer. */
+    importKey?: string;
+    /** The key id to use as the imported key's JWT/JWKS `kid`. Only allowed when `importKey` is provided. Not required to be unique; the addressable key id is the server-minted `keyId` returned in the response. */
+    importKeyId?: string;
+}
+export declare const CreateKmsSigningKeyRequest: S.Schema<CreateKmsSigningKeyRequest>;
+export type CreateKmsSigningKeyResponseStatus = "active" | "pending" | "revoking";
+export declare const CreateKmsSigningKeyResponseStatus: any;
+export type CreateKmsSigningKeyResponsePublicKeyKeyOpsList = Array<string>;
+export declare const CreateKmsSigningKeyResponsePublicKeyKeyOpsList: S.Schema<CreateKmsSigningKeyResponsePublicKeyKeyOpsList>;
+/** The X.509 certificate chain (RFC 7517 §4.7). Each entry is the base64 DER (not base64url) of a certificate. For keys minted with a stored certificate this holds the single self-signed cert as `[x5c]`. */
+export type CreateKmsSigningKeyResponsePublicKeyX5cList = Array<string>;
+export declare const CreateKmsSigningKeyResponsePublicKeyX5cList: S.Schema<CreateKmsSigningKeyResponsePublicKeyX5cList>;
+export interface CreateKmsSigningKeyResponsePublicKey {
+    kty?: string;
+    kid?: string;
+    alg?: string;
+    use?: string;
+    key_ops?: CreateKmsSigningKeyResponsePublicKeyKeyOpsList;
+    /** The X.509 certificate chain (RFC 7517 §4.7). Each entry is the base64 DER (not base64url) of a certificate. For keys minted with a stored certificate this holds the single self-signed cert as `[x5c]`. */
+    x5c?: CreateKmsSigningKeyResponsePublicKeyX5cList;
+    /** The base64url SHA-256 thumbprint of the DER certificate in `x5c[0]` (RFC 7517 §4.9). */
+    x5t_S256?: string;
+}
+export declare const CreateKmsSigningKeyResponsePublicKey: S.Schema<CreateKmsSigningKeyResponsePublicKey>;
+export interface CreateKmsSigningKeyResponse {
+    /** The server-minted, unique record identifier. Use this to address the key on the activate / certificate endpoints. */
+    keyId: string;
+    /** The caller-supplied key id (imported keys only), used as the JWT/JWKS `kid`. Not unique across an issuer's keys; omitted for generated keys. */
+    importKeyId?: string;
+    issuerId: string;
+    algorithm: string;
+    status: CreateKmsSigningKeyResponseStatus;
+    publicKey?: CreateKmsSigningKeyResponsePublicKey;
+    publicKeyFingerprint?: string;
+    /** The public key in SPKI PEM form, ready to render. Present whenever the key has public key material. Derived from `publicKey`; the embedded certificate members (`x5c`/`x5t#S256`) do not affect it. */
+    publicKeyPem?: string;
+    /** The stored X.509 certificate (from `publicKey.x5c[0]`) in PEM form, ready to render. Present only for keys created with a stored certificate; omitted for keys created before certificates were stored. */
+    certificatePem?: string;
+    createdAt: string;
+    updatedAt: string;
+    revokeAt?: string;
+    activateAt?: string;
+    /** When the key became the active signer. Present for active and revoking keys (and absent for pending keys and rows predating this field). */
+    activatedAt?: string;
+}
+export declare const CreateKmsSigningKeyResponse: S.Schema<CreateKmsSigningKeyResponse>;
+export interface DeleteKmsIssuerRequest {
+    /** The ID of the issuer. */
+    issuerId: string;
+    /** The Team identifier to perform the request on behalf of. */
+    teamId?: string;
+    /** The Team slug to perform the request on behalf of. */
+    slug?: string;
+}
+export declare const DeleteKmsIssuerRequest: S.Schema<DeleteKmsIssuerRequest>;
+export interface DeleteKmsIssuerResponse {
+}
+export declare const DeleteKmsIssuerResponse: S.Schema<DeleteKmsIssuerResponse>;
+/** The issuer policy kind. */
+export type DeleteKmsIssuerPolicyRequestKind = "project-grant" | "connex-grant";
+export declare const DeleteKmsIssuerPolicyRequestKind: any;
+export interface DeleteKmsIssuerPolicyRequest {
+    /** The ID of the issuer. */
+    issuerId: string;
+    /** The issuer policy kind. */
+    kind: DeleteKmsIssuerPolicyRequestKind | (string & {});
+    /** The policy identifier. */
+    policyKey: string;
+    /** The Team identifier to perform the request on behalf of. */
+    teamId?: string;
+    /** The Team slug to perform the request on behalf of. */
+    slug?: string;
+}
+export declare const DeleteKmsIssuerPolicyRequest: S.Schema<DeleteKmsIssuerPolicyRequest>;
+export interface DeleteKmsIssuerPolicyResponse {
+}
+export declare const DeleteKmsIssuerPolicyResponse: S.Schema<DeleteKmsIssuerPolicyResponse>;
+export interface GetKmsIssuerRequest {
+    /** The ID of the issuer. */
+    issuerId: string;
+    /** The Team identifier to perform the request on behalf of. */
+    teamId?: string;
+    /** The Team slug to perform the request on behalf of. */
+    slug?: string;
+}
+export declare const GetKmsIssuerRequest: S.Schema<GetKmsIssuerRequest>;
+export type GetKmsIssuerResponseAlgorithm = "ES256" | "ES384" | "ES512" | "EdDSA" | "PS256" | "PS384" | "PS512" | "RS256" | "RS384" | "RS512";
+export declare const GetKmsIssuerResponseAlgorithm: any;
+export type GetKmsIssuerResponseOrigin = "external" | "vercel";
+export declare const GetKmsIssuerResponseOrigin: any;
+export type GetKmsIssuerResponseClaimsSchemaMap = {
+    [key: string]: unknown | undefined;
+};
+export declare const GetKmsIssuerResponseClaimsSchemaMap: S.Schema<GetKmsIssuerResponseClaimsSchemaMap>;
+export type GetKmsIssuerResponseSigningKeysItemStatus = "active" | "pending" | "revoking";
+export declare const GetKmsIssuerResponseSigningKeysItemStatus: any;
+export type GetKmsIssuerResponseSigningKeysItemPublicKeyKeyOpsList = Array<string>;
+export declare const GetKmsIssuerResponseSigningKeysItemPublicKeyKeyOpsList: S.Schema<GetKmsIssuerResponseSigningKeysItemPublicKeyKeyOpsList>;
+/** The X.509 certificate chain (RFC 7517 §4.7). Each entry is the base64 DER (not base64url) of a certificate. For keys minted with a stored certificate this holds the single self-signed cert as `[x5c]`. */
+export type GetKmsIssuerResponseSigningKeysItemPublicKeyX5cList = Array<string>;
+export declare const GetKmsIssuerResponseSigningKeysItemPublicKeyX5cList: S.Schema<GetKmsIssuerResponseSigningKeysItemPublicKeyX5cList>;
+export interface GetKmsIssuerResponseSigningKeysItemPublicKey {
+    kty?: string;
+    kid?: string;
+    alg?: string;
+    use?: string;
+    key_ops?: GetKmsIssuerResponseSigningKeysItemPublicKeyKeyOpsList;
+    /** The X.509 certificate chain (RFC 7517 §4.7). Each entry is the base64 DER (not base64url) of a certificate. For keys minted with a stored certificate this holds the single self-signed cert as `[x5c]`. */
+    x5c?: GetKmsIssuerResponseSigningKeysItemPublicKeyX5cList;
+    /** The base64url SHA-256 thumbprint of the DER certificate in `x5c[0]` (RFC 7517 §4.9). */
+    x5t_S256?: string;
+}
+export declare const GetKmsIssuerResponseSigningKeysItemPublicKey: S.Schema<GetKmsIssuerResponseSigningKeysItemPublicKey>;
+export interface GetKmsIssuerResponseSigningKeysItem {
+    /** The server-minted, unique record identifier. Use this to address the key on the activate / certificate endpoints. */
+    keyId: string;
+    /** The caller-supplied key id (imported keys only), used as the JWT/JWKS `kid`. Not unique across an issuer's keys; omitted for generated keys. */
+    importKeyId?: string;
+    issuerId: string;
+    algorithm: string;
+    status: GetKmsIssuerResponseSigningKeysItemStatus;
+    publicKey?: GetKmsIssuerResponseSigningKeysItemPublicKey;
+    publicKeyFingerprint?: string;
+    /** The public key in SPKI PEM form, ready to render. Present whenever the key has public key material. Derived from `publicKey`; the embedded certificate members (`x5c`/`x5t#S256`) do not affect it. */
+    publicKeyPem?: string;
+    /** The stored X.509 certificate (from `publicKey.x5c[0]`) in PEM form, ready to render. Present only for keys created with a stored certificate; omitted for keys created before certificates were stored. */
+    certificatePem?: string;
+    createdAt: string;
+    updatedAt: string;
+    revokeAt?: string;
+    activateAt?: string;
+    /** When the key became the active signer. Present for active and revoking keys (and absent for pending keys and rows predating this field). */
+    activatedAt?: string;
+}
+export declare const GetKmsIssuerResponseSigningKeysItem: S.Schema<GetKmsIssuerResponseSigningKeysItem>;
+export type GetKmsIssuerResponseSigningKeysList = Array<GetKmsIssuerResponseSigningKeysItem>;
+export declare const GetKmsIssuerResponseSigningKeysList: S.Schema<GetKmsIssuerResponseSigningKeysList>;
+export type GetKmsIssuerResponsePoliciesItemCase0Kind = "project-grant";
+export declare const GetKmsIssuerResponsePoliciesItemCase0Kind: any;
+/** Environments whose OIDC tokens this grant authorizes. Each entry is either a system environment slug (`production`, `preview`, `development`) or a custom environment ID (prefixed `env_`). Custom environments are matched against the token's `custom_environment_id` claim (the stable ID); system environments against its `environment` claim. */
+export type GetKmsIssuerResponsePoliciesItemCase0EnvironmentsList = Array<string>;
+export declare const GetKmsIssuerResponsePoliciesItemCase0EnvironmentsList: S.Schema<GetKmsIssuerResponsePoliciesItemCase0EnvironmentsList>;
+export type GetKmsIssuerResponsePoliciesItemCase0TokenClaimsMap = {
+    [key: string]: unknown | undefined;
+};
+export declare const GetKmsIssuerResponsePoliciesItemCase0TokenClaimsMap: S.Schema<GetKmsIssuerResponsePoliciesItemCase0TokenClaimsMap>;
+export interface GetKmsIssuerResponsePoliciesItemCase0 {
+    kind: GetKmsIssuerResponsePoliciesItemCase0Kind;
+    teamId: string;
+    projectId: string;
+    /** Environments whose OIDC tokens this grant authorizes. Each entry is either a system environment slug (`production`, `preview`, `development`) or a custom environment ID (prefixed `env_`). Custom environments are matched against the token's `custom_environment_id` claim (the stable ID); system environments against its `environment` claim. */
+    environments: GetKmsIssuerResponsePoliciesItemCase0EnvironmentsList;
+    tokenClaims?: GetKmsIssuerResponsePoliciesItemCase0TokenClaimsMap;
+    createdAt: string;
+    updatedAt: string;
+}
+export declare const GetKmsIssuerResponsePoliciesItemCase0: S.Schema<GetKmsIssuerResponsePoliciesItemCase0>;
+export type GetKmsIssuerResponsePoliciesItemCase1Kind = "connex-grant";
+export declare const GetKmsIssuerResponsePoliciesItemCase1Kind: any;
+export type GetKmsIssuerResponsePoliciesItemCase1TokenClaimsMap = {
+    [key: string]: unknown | undefined;
+};
+export declare const GetKmsIssuerResponsePoliciesItemCase1TokenClaimsMap: S.Schema<GetKmsIssuerResponsePoliciesItemCase1TokenClaimsMap>;
+export interface GetKmsIssuerResponsePoliciesItemCase1 {
+    kind: GetKmsIssuerResponsePoliciesItemCase1Kind;
+    clientId: string;
+    tokenClaims?: GetKmsIssuerResponsePoliciesItemCase1TokenClaimsMap;
+    createdAt: string;
+    updatedAt: string;
+}
+export declare const GetKmsIssuerResponsePoliciesItemCase1: S.Schema<GetKmsIssuerResponsePoliciesItemCase1>;
+export type GetKmsIssuerResponsePoliciesItem = GetKmsIssuerResponsePoliciesItemCase0 | GetKmsIssuerResponsePoliciesItemCase1;
+export declare const GetKmsIssuerResponsePoliciesItem: S.Schema<GetKmsIssuerResponsePoliciesItem>;
+export type GetKmsIssuerResponsePoliciesList = Array<GetKmsIssuerResponsePoliciesItem>;
+export declare const GetKmsIssuerResponsePoliciesList: S.Schema<GetKmsIssuerResponsePoliciesList>;
+export interface GetKmsIssuerResponse {
+    id: string;
+    ownerId: string;
+    name: string;
+    algorithm: GetKmsIssuerResponseAlgorithm;
+    origin: GetKmsIssuerResponseOrigin;
+    managedBy?: string;
+    claimsSchema?: GetKmsIssuerResponseClaimsSchemaMap;
+    createdAt: string;
+    updatedAt: string;
+    signingKeys: GetKmsIssuerResponseSigningKeysList;
+    policies: GetKmsIssuerResponsePoliciesList;
+}
+export declare const GetKmsIssuerResponse: S.Schema<GetKmsIssuerResponse>;
+export interface ListKmsIssuersRequest {
+    /** Maximum number of issuers to return. */
+    limit?: number;
+    /** Continuation cursor to retrieve the next page of results. */
+    next?: string;
+    /** The Team identifier to perform the request on behalf of. */
+    teamId?: string;
+    /** The Team slug to perform the request on behalf of. */
+    slug?: string;
+}
+export declare const ListKmsIssuersRequest: S.Schema<ListKmsIssuersRequest>;
+export type ListKmsIssuersResponseIssuersItemAlgorithm = "ES256" | "ES384" | "ES512" | "EdDSA" | "PS256" | "PS384" | "PS512" | "RS256" | "RS384" | "RS512";
+export declare const ListKmsIssuersResponseIssuersItemAlgorithm: any;
+export type ListKmsIssuersResponseIssuersItemOrigin = "external" | "vercel";
+export declare const ListKmsIssuersResponseIssuersItemOrigin: any;
+export type ListKmsIssuersResponseIssuersItemClaimsSchemaMap = {
+    [key: string]: unknown | undefined;
+};
+export declare const ListKmsIssuersResponseIssuersItemClaimsSchemaMap: S.Schema<ListKmsIssuersResponseIssuersItemClaimsSchemaMap>;
+export type ListKmsIssuersResponseIssuersItemSigningKeysItemStatus = "active" | "pending" | "revoking";
+export declare const ListKmsIssuersResponseIssuersItemSigningKeysItemStatus: any;
+export type ListKmsIssuersResponseIssuersItemSigningKeysItemPublicKeyKeyOpsList = Array<string>;
+export declare const ListKmsIssuersResponseIssuersItemSigningKeysItemPublicKeyKeyOpsList: S.Schema<ListKmsIssuersResponseIssuersItemSigningKeysItemPublicKeyKeyOpsList>;
+/** The X.509 certificate chain (RFC 7517 §4.7). Each entry is the base64 DER (not base64url) of a certificate. For keys minted with a stored certificate this holds the single self-signed cert as `[x5c]`. */
+export type ListKmsIssuersResponseIssuersItemSigningKeysItemPublicKeyX5cList = Array<string>;
+export declare const ListKmsIssuersResponseIssuersItemSigningKeysItemPublicKeyX5cList: S.Schema<ListKmsIssuersResponseIssuersItemSigningKeysItemPublicKeyX5cList>;
+export interface ListKmsIssuersResponseIssuersItemSigningKeysItemPublicKey {
+    kty?: string;
+    kid?: string;
+    alg?: string;
+    use?: string;
+    key_ops?: ListKmsIssuersResponseIssuersItemSigningKeysItemPublicKeyKeyOpsList;
+    /** The X.509 certificate chain (RFC 7517 §4.7). Each entry is the base64 DER (not base64url) of a certificate. For keys minted with a stored certificate this holds the single self-signed cert as `[x5c]`. */
+    x5c?: ListKmsIssuersResponseIssuersItemSigningKeysItemPublicKeyX5cList;
+    /** The base64url SHA-256 thumbprint of the DER certificate in `x5c[0]` (RFC 7517 §4.9). */
+    x5t_S256?: string;
+}
+export declare const ListKmsIssuersResponseIssuersItemSigningKeysItemPublicKey: S.Schema<ListKmsIssuersResponseIssuersItemSigningKeysItemPublicKey>;
+export interface ListKmsIssuersResponseIssuersItemSigningKeysItem {
+    /** The server-minted, unique record identifier. Use this to address the key on the activate / certificate endpoints. */
+    keyId: string;
+    /** The caller-supplied key id (imported keys only), used as the JWT/JWKS `kid`. Not unique across an issuer's keys; omitted for generated keys. */
+    importKeyId?: string;
+    issuerId: string;
+    algorithm: string;
+    status: ListKmsIssuersResponseIssuersItemSigningKeysItemStatus;
+    publicKey?: ListKmsIssuersResponseIssuersItemSigningKeysItemPublicKey;
+    publicKeyFingerprint?: string;
+    /** The public key in SPKI PEM form, ready to render. Present whenever the key has public key material. Derived from `publicKey`; the embedded certificate members (`x5c`/`x5t#S256`) do not affect it. */
+    publicKeyPem?: string;
+    /** The stored X.509 certificate (from `publicKey.x5c[0]`) in PEM form, ready to render. Present only for keys created with a stored certificate; omitted for keys created before certificates were stored. */
+    certificatePem?: string;
+    createdAt: string;
+    updatedAt: string;
+    revokeAt?: string;
+    activateAt?: string;
+    /** When the key became the active signer. Present for active and revoking keys (and absent for pending keys and rows predating this field). */
+    activatedAt?: string;
+}
+export declare const ListKmsIssuersResponseIssuersItemSigningKeysItem: S.Schema<ListKmsIssuersResponseIssuersItemSigningKeysItem>;
+export type ListKmsIssuersResponseIssuersItemSigningKeysList = Array<ListKmsIssuersResponseIssuersItemSigningKeysItem>;
+export declare const ListKmsIssuersResponseIssuersItemSigningKeysList: S.Schema<ListKmsIssuersResponseIssuersItemSigningKeysList>;
+export type ListKmsIssuersResponseIssuersItemPoliciesItemCase0Kind = "project-grant";
+export declare const ListKmsIssuersResponseIssuersItemPoliciesItemCase0Kind: any;
+/** Environments whose OIDC tokens this grant authorizes. Each entry is either a system environment slug (`production`, `preview`, `development`) or a custom environment ID (prefixed `env_`). Custom environments are matched against the token's `custom_environment_id` claim (the stable ID); system environments against its `environment` claim. */
+export type ListKmsIssuersResponseIssuersItemPoliciesItemCase0EnvironmentsList = Array<string>;
+export declare const ListKmsIssuersResponseIssuersItemPoliciesItemCase0EnvironmentsList: S.Schema<ListKmsIssuersResponseIssuersItemPoliciesItemCase0EnvironmentsList>;
+export type ListKmsIssuersResponseIssuersItemPoliciesItemCase0TokenClaimsMap = {
+    [key: string]: unknown | undefined;
+};
+export declare const ListKmsIssuersResponseIssuersItemPoliciesItemCase0TokenClaimsMap: S.Schema<ListKmsIssuersResponseIssuersItemPoliciesItemCase0TokenClaimsMap>;
+export interface ListKmsIssuersResponseIssuersItemPoliciesItemCase0 {
+    kind: ListKmsIssuersResponseIssuersItemPoliciesItemCase0Kind;
+    teamId: string;
+    projectId: string;
+    /** Environments whose OIDC tokens this grant authorizes. Each entry is either a system environment slug (`production`, `preview`, `development`) or a custom environment ID (prefixed `env_`). Custom environments are matched against the token's `custom_environment_id` claim (the stable ID); system environments against its `environment` claim. */
+    environments: ListKmsIssuersResponseIssuersItemPoliciesItemCase0EnvironmentsList;
+    tokenClaims?: ListKmsIssuersResponseIssuersItemPoliciesItemCase0TokenClaimsMap;
+    createdAt: string;
+    updatedAt: string;
+}
+export declare const ListKmsIssuersResponseIssuersItemPoliciesItemCase0: S.Schema<ListKmsIssuersResponseIssuersItemPoliciesItemCase0>;
+export type ListKmsIssuersResponseIssuersItemPoliciesItemCase1Kind = "connex-grant";
+export declare const ListKmsIssuersResponseIssuersItemPoliciesItemCase1Kind: any;
+export type ListKmsIssuersResponseIssuersItemPoliciesItemCase1TokenClaimsMap = {
+    [key: string]: unknown | undefined;
+};
+export declare const ListKmsIssuersResponseIssuersItemPoliciesItemCase1TokenClaimsMap: S.Schema<ListKmsIssuersResponseIssuersItemPoliciesItemCase1TokenClaimsMap>;
+export interface ListKmsIssuersResponseIssuersItemPoliciesItemCase1 {
+    kind: ListKmsIssuersResponseIssuersItemPoliciesItemCase1Kind;
+    clientId: string;
+    tokenClaims?: ListKmsIssuersResponseIssuersItemPoliciesItemCase1TokenClaimsMap;
+    createdAt: string;
+    updatedAt: string;
+}
+export declare const ListKmsIssuersResponseIssuersItemPoliciesItemCase1: S.Schema<ListKmsIssuersResponseIssuersItemPoliciesItemCase1>;
+export type ListKmsIssuersResponseIssuersItemPoliciesItem = ListKmsIssuersResponseIssuersItemPoliciesItemCase0 | ListKmsIssuersResponseIssuersItemPoliciesItemCase1;
+export declare const ListKmsIssuersResponseIssuersItemPoliciesItem: S.Schema<ListKmsIssuersResponseIssuersItemPoliciesItem>;
+export type ListKmsIssuersResponseIssuersItemPoliciesList = Array<ListKmsIssuersResponseIssuersItemPoliciesItem>;
+export declare const ListKmsIssuersResponseIssuersItemPoliciesList: S.Schema<ListKmsIssuersResponseIssuersItemPoliciesList>;
+export interface ListKmsIssuersResponseIssuersItem {
+    id: string;
+    ownerId: string;
+    name: string;
+    algorithm: ListKmsIssuersResponseIssuersItemAlgorithm;
+    origin: ListKmsIssuersResponseIssuersItemOrigin;
+    managedBy?: string;
+    claimsSchema?: ListKmsIssuersResponseIssuersItemClaimsSchemaMap;
+    createdAt: string;
+    updatedAt: string;
+    signingKeys: ListKmsIssuersResponseIssuersItemSigningKeysList;
+    policies: ListKmsIssuersResponseIssuersItemPoliciesList;
+}
+export declare const ListKmsIssuersResponseIssuersItem: S.Schema<ListKmsIssuersResponseIssuersItem>;
+export type ListKmsIssuersResponseIssuersList = Array<ListKmsIssuersResponseIssuersItem>;
+export declare const ListKmsIssuersResponseIssuersList: S.Schema<ListKmsIssuersResponseIssuersList>;
+export interface ListKmsIssuersResponsePagination {
+    count: number;
+    next: string | null;
+}
+export declare const ListKmsIssuersResponsePagination: S.Schema<ListKmsIssuersResponsePagination>;
+export interface ListKmsIssuersResponse {
+    issuers: ListKmsIssuersResponseIssuersList;
+    pagination: ListKmsIssuersResponsePagination;
+}
+export declare const ListKmsIssuersResponse: S.Schema<ListKmsIssuersResponse>;
+export interface RevokeKmsSigningKeyRequest {
+    /** The ID of the issuer. */
+    issuerId: string;
+    /** The ID of the signing key to revoke immediately. The key must already be scheduled for revocation. */
+    keyId: string;
+    /** The Team identifier to perform the request on behalf of. */
+    teamId?: string;
+    /** The Team slug to perform the request on behalf of. */
+    slug?: string;
+}
+export declare const RevokeKmsSigningKeyRequest: S.Schema<RevokeKmsSigningKeyRequest>;
+export type RevokeKmsSigningKeyResponseAlgorithm = "ES256" | "ES384" | "ES512" | "EdDSA" | "PS256" | "PS384" | "PS512" | "RS256" | "RS384" | "RS512";
+export declare const RevokeKmsSigningKeyResponseAlgorithm: any;
+export type RevokeKmsSigningKeyResponseOrigin = "external" | "vercel";
+export declare const RevokeKmsSigningKeyResponseOrigin: any;
+export type RevokeKmsSigningKeyResponseClaimsSchemaMap = {
+    [key: string]: unknown | undefined;
+};
+export declare const RevokeKmsSigningKeyResponseClaimsSchemaMap: S.Schema<RevokeKmsSigningKeyResponseClaimsSchemaMap>;
+export type RevokeKmsSigningKeyResponseSigningKeysItemStatus = "active" | "pending" | "revoking";
+export declare const RevokeKmsSigningKeyResponseSigningKeysItemStatus: any;
+export type RevokeKmsSigningKeyResponseSigningKeysItemPublicKeyKeyOpsList = Array<string>;
+export declare const RevokeKmsSigningKeyResponseSigningKeysItemPublicKeyKeyOpsList: S.Schema<RevokeKmsSigningKeyResponseSigningKeysItemPublicKeyKeyOpsList>;
+/** The X.509 certificate chain (RFC 7517 §4.7). Each entry is the base64 DER (not base64url) of a certificate. For keys minted with a stored certificate this holds the single self-signed cert as `[x5c]`. */
+export type RevokeKmsSigningKeyResponseSigningKeysItemPublicKeyX5cList = Array<string>;
+export declare const RevokeKmsSigningKeyResponseSigningKeysItemPublicKeyX5cList: S.Schema<RevokeKmsSigningKeyResponseSigningKeysItemPublicKeyX5cList>;
+export interface RevokeKmsSigningKeyResponseSigningKeysItemPublicKey {
+    kty?: string;
+    kid?: string;
+    alg?: string;
+    use?: string;
+    key_ops?: RevokeKmsSigningKeyResponseSigningKeysItemPublicKeyKeyOpsList;
+    /** The X.509 certificate chain (RFC 7517 §4.7). Each entry is the base64 DER (not base64url) of a certificate. For keys minted with a stored certificate this holds the single self-signed cert as `[x5c]`. */
+    x5c?: RevokeKmsSigningKeyResponseSigningKeysItemPublicKeyX5cList;
+    /** The base64url SHA-256 thumbprint of the DER certificate in `x5c[0]` (RFC 7517 §4.9). */
+    x5t_S256?: string;
+}
+export declare const RevokeKmsSigningKeyResponseSigningKeysItemPublicKey: S.Schema<RevokeKmsSigningKeyResponseSigningKeysItemPublicKey>;
+export interface RevokeKmsSigningKeyResponseSigningKeysItem {
+    /** The server-minted, unique record identifier. Use this to address the key on the activate / certificate endpoints. */
+    keyId: string;
+    /** The caller-supplied key id (imported keys only), used as the JWT/JWKS `kid`. Not unique across an issuer's keys; omitted for generated keys. */
+    importKeyId?: string;
+    issuerId: string;
+    algorithm: string;
+    status: RevokeKmsSigningKeyResponseSigningKeysItemStatus;
+    publicKey?: RevokeKmsSigningKeyResponseSigningKeysItemPublicKey;
+    publicKeyFingerprint?: string;
+    /** The public key in SPKI PEM form, ready to render. Present whenever the key has public key material. Derived from `publicKey`; the embedded certificate members (`x5c`/`x5t#S256`) do not affect it. */
+    publicKeyPem?: string;
+    /** The stored X.509 certificate (from `publicKey.x5c[0]`) in PEM form, ready to render. Present only for keys created with a stored certificate; omitted for keys created before certificates were stored. */
+    certificatePem?: string;
+    createdAt: string;
+    updatedAt: string;
+    revokeAt?: string;
+    activateAt?: string;
+    /** When the key became the active signer. Present for active and revoking keys (and absent for pending keys and rows predating this field). */
+    activatedAt?: string;
+}
+export declare const RevokeKmsSigningKeyResponseSigningKeysItem: S.Schema<RevokeKmsSigningKeyResponseSigningKeysItem>;
+export type RevokeKmsSigningKeyResponseSigningKeysList = Array<RevokeKmsSigningKeyResponseSigningKeysItem>;
+export declare const RevokeKmsSigningKeyResponseSigningKeysList: S.Schema<RevokeKmsSigningKeyResponseSigningKeysList>;
+export type RevokeKmsSigningKeyResponsePoliciesItemCase0Kind = "project-grant";
+export declare const RevokeKmsSigningKeyResponsePoliciesItemCase0Kind: any;
+/** Environments whose OIDC tokens this grant authorizes. Each entry is either a system environment slug (`production`, `preview`, `development`) or a custom environment ID (prefixed `env_`). Custom environments are matched against the token's `custom_environment_id` claim (the stable ID); system environments against its `environment` claim. */
+export type RevokeKmsSigningKeyResponsePoliciesItemCase0EnvironmentsList = Array<string>;
+export declare const RevokeKmsSigningKeyResponsePoliciesItemCase0EnvironmentsList: S.Schema<RevokeKmsSigningKeyResponsePoliciesItemCase0EnvironmentsList>;
+export type RevokeKmsSigningKeyResponsePoliciesItemCase0TokenClaimsMap = {
+    [key: string]: unknown | undefined;
+};
+export declare const RevokeKmsSigningKeyResponsePoliciesItemCase0TokenClaimsMap: S.Schema<RevokeKmsSigningKeyResponsePoliciesItemCase0TokenClaimsMap>;
+export interface RevokeKmsSigningKeyResponsePoliciesItemCase0 {
+    kind: RevokeKmsSigningKeyResponsePoliciesItemCase0Kind;
+    teamId: string;
+    projectId: string;
+    /** Environments whose OIDC tokens this grant authorizes. Each entry is either a system environment slug (`production`, `preview`, `development`) or a custom environment ID (prefixed `env_`). Custom environments are matched against the token's `custom_environment_id` claim (the stable ID); system environments against its `environment` claim. */
+    environments: RevokeKmsSigningKeyResponsePoliciesItemCase0EnvironmentsList;
+    tokenClaims?: RevokeKmsSigningKeyResponsePoliciesItemCase0TokenClaimsMap;
+    createdAt: string;
+    updatedAt: string;
+}
+export declare const RevokeKmsSigningKeyResponsePoliciesItemCase0: S.Schema<RevokeKmsSigningKeyResponsePoliciesItemCase0>;
+export type RevokeKmsSigningKeyResponsePoliciesItemCase1Kind = "connex-grant";
+export declare const RevokeKmsSigningKeyResponsePoliciesItemCase1Kind: any;
+export type RevokeKmsSigningKeyResponsePoliciesItemCase1TokenClaimsMap = {
+    [key: string]: unknown | undefined;
+};
+export declare const RevokeKmsSigningKeyResponsePoliciesItemCase1TokenClaimsMap: S.Schema<RevokeKmsSigningKeyResponsePoliciesItemCase1TokenClaimsMap>;
+export interface RevokeKmsSigningKeyResponsePoliciesItemCase1 {
+    kind: RevokeKmsSigningKeyResponsePoliciesItemCase1Kind;
+    clientId: string;
+    tokenClaims?: RevokeKmsSigningKeyResponsePoliciesItemCase1TokenClaimsMap;
+    createdAt: string;
+    updatedAt: string;
+}
+export declare const RevokeKmsSigningKeyResponsePoliciesItemCase1: S.Schema<RevokeKmsSigningKeyResponsePoliciesItemCase1>;
+export type RevokeKmsSigningKeyResponsePoliciesItem = RevokeKmsSigningKeyResponsePoliciesItemCase0 | RevokeKmsSigningKeyResponsePoliciesItemCase1;
+export declare const RevokeKmsSigningKeyResponsePoliciesItem: S.Schema<RevokeKmsSigningKeyResponsePoliciesItem>;
+export type RevokeKmsSigningKeyResponsePoliciesList = Array<RevokeKmsSigningKeyResponsePoliciesItem>;
+export declare const RevokeKmsSigningKeyResponsePoliciesList: S.Schema<RevokeKmsSigningKeyResponsePoliciesList>;
+export interface RevokeKmsSigningKeyResponse {
+    id: string;
+    ownerId: string;
+    name: string;
+    algorithm: RevokeKmsSigningKeyResponseAlgorithm;
+    origin: RevokeKmsSigningKeyResponseOrigin;
+    managedBy?: string;
+    claimsSchema?: RevokeKmsSigningKeyResponseClaimsSchemaMap;
+    createdAt: string;
+    updatedAt: string;
+    signingKeys: RevokeKmsSigningKeyResponseSigningKeysList;
+    policies: RevokeKmsSigningKeyResponsePoliciesList;
+}
+export declare const RevokeKmsSigningKeyResponse: S.Schema<RevokeKmsSigningKeyResponse>;
+export interface SignKmsMessageRequest {
+    /** The ID of the issuer. */
+    issuerId: string;
+    /** Base64-encoded message to be signed. */
+    message: string;
+}
+export declare const SignKmsMessageRequest: S.Schema<SignKmsMessageRequest>;
+/** JWS "crit" (Critical) Header Parameter */
+export type SignKmsMessageResponseSignatureHeaderCritList = Array<string>;
+export declare const SignKmsMessageResponseSignatureHeaderCritList: S.Schema<SignKmsMessageResponseSignatureHeaderCritList>;
+/** "x5c" (X.509 Certificate Chain) Header Parameter */
+export type SignKmsMessageResponseSignatureHeaderX5cList = Array<string>;
+export declare const SignKmsMessageResponseSignatureHeaderX5cList: S.Schema<SignKmsMessageResponseSignatureHeaderX5cList>;
+/** "jwk" (JSON Web Key) Header Parameter */
+export interface SignKmsMessageResponseSignatureHeaderJwk {
+    /** RSA JWK "n" (Modulus) Parameter */
+    n?: string;
+    /** RSA JWK "e" (Exponent) Parameter */
+    e?: string;
+    /** JWK "kty" (Key Type) Parameter */
+    kty?: string;
+    /** - EC JWK "crv" (Curve) Parameter - OKP JWK "crv" (The Subtype of Key Pair) Parameter */
+    crv?: string;
+    /** - EC JWK "x" (X Coordinate) Parameter - OKP JWK "x" (The public key) Parameter */
+    x?: string;
+    /** EC JWK "y" (Y Coordinate) Parameter */
+    y?: string;
+    /** JWK "alg" (Algorithm) Parameter */
+    alg?: string;
+    /** AKP JWK "pub" (Public Key) Parameter */
+    pub?: string;
+}
+export declare const SignKmsMessageResponseSignatureHeaderJwk: S.Schema<SignKmsMessageResponseSignatureHeaderJwk>;
+/** The "header" member MUST be present and contain the value JWS Unprotected Header when the JWS Unprotected Header value is non- empty; otherwise, it MUST be absent. This value is represented as an unencoded JSON object, rather than as a string. These Header Parameter values are not integrity protected. */
+export interface SignKmsMessageResponseSignatureHeader {
+    /** JWS "alg" (Algorithm) Header Parameter */
+    alg?: string;
+    /** This JWS Extension Header Parameter modifies the JWS Payload representation and the JWS Signing Input computation as per {@link https://www.rfc-editor.org/rfc/rfc7797 RFC7797}. */
+    b64?: boolean;
+    /** JWS "crit" (Critical) Header Parameter */
+    crit?: SignKmsMessageResponseSignatureHeaderCritList;
+    /** "kid" (Key ID) Header Parameter */
+    kid?: string;
+    /** "x5t" (X.509 Certificate SHA-1 Thumbprint) Header Parameter */
+    x5t?: string;
+    /** "x5c" (X.509 Certificate Chain) Header Parameter */
+    x5c?: SignKmsMessageResponseSignatureHeaderX5cList;
+    /** "x5u" (X.509 URL) Header Parameter */
+    x5u?: string;
+    /** "jku" (JWK Set URL) Header Parameter */
+    jku?: string;
+    /** "jwk" (JSON Web Key) Header Parameter */
+    jwk?: SignKmsMessageResponseSignatureHeaderJwk;
+    /** "typ" (Type) Header Parameter */
+    typ?: string;
+    /** "cty" (Content Type) Header Parameter */
+    cty?: string;
+}
+export declare const SignKmsMessageResponseSignatureHeader: S.Schema<SignKmsMessageResponseSignatureHeader>;
+/** Flattened JWS JSON Serialization Syntax token. Payload is returned as an empty string when JWS Unencoded Payload ({@link https://www.rfc-editor.org/rfc/rfc7797 RFC7797}) is used. */
+export interface SignKmsMessageResponseSignature {
+    payload: string;
+    signature: string;
+    /** The "header" member MUST be present and contain the value JWS Unprotected Header when the JWS Unprotected Header value is non- empty; otherwise, it MUST be absent. This value is represented as an unencoded JSON object, rather than as a string. These Header Parameter values are not integrity protected. */
+    header?: SignKmsMessageResponseSignatureHeader;
+    /** The "protected" member MUST be present and contain the value BASE64URL(UTF8(JWS Protected Header)) when the JWS Protected Header value is non-empty; otherwise, it MUST be absent. These Header Parameter values are integrity protected. */
+    protected?: string;
+}
+export declare const SignKmsMessageResponseSignature: S.Schema<SignKmsMessageResponseSignature>;
+export interface SignKmsMessageResponse {
+    /** Flattened JWS JSON Serialization Syntax token. Payload is returned as an empty string when JWS Unencoded Payload ({@link https://www.rfc-editor.org/rfc/rfc7797 RFC7797}) is used. */
+    signature: SignKmsMessageResponseSignature;
+}
+export declare const SignKmsMessageResponse: S.Schema<SignKmsMessageResponse>;
+export interface SignKmsTokenRequest {
+    /** The ID of the issuer. */
+    issuerId: string;
+    /** The claims to include in the token. */
+    claims?: unknown;
+    /** Additional headers to include in the token. */
+    headers?: unknown;
+    /** The time-to-live for the token, in seconds. */
+    ttl?: number | null;
+}
+export declare const SignKmsTokenRequest: S.Schema<SignKmsTokenRequest>;
+export interface SignKmsTokenResponse {
+    token: string;
+}
+export declare const SignKmsTokenResponse: S.Schema<SignKmsTokenResponse>;
+/** A JSON Schema used to validate the resolved token claims when signing tokens for this issuer. Pass null to remove it. */
+export type UpdateKmsIssuerRequestClaimsSchemaMap = {
+    [key: string]: unknown | undefined;
+};
+export declare const UpdateKmsIssuerRequestClaimsSchemaMap: S.Schema<UpdateKmsIssuerRequestClaimsSchemaMap>;
+export interface UpdateKmsIssuerRequest {
+    /** The ID of the issuer. */
+    issuerId: string;
+    /** The Team identifier to perform the request on behalf of. */
+    teamId?: string;
+    /** The Team slug to perform the request on behalf of. */
+    slug?: string;
+    /** The name of the issuer. */
+    name?: string;
+    /** A JSON Schema used to validate the resolved token claims when signing tokens for this issuer. Pass null to remove it. */
+    claimsSchema?: UpdateKmsIssuerRequestClaimsSchemaMap | null;
+}
+export declare const UpdateKmsIssuerRequest: S.Schema<UpdateKmsIssuerRequest>;
+export type UpdateKmsIssuerResponseAlgorithm = "ES256" | "ES384" | "ES512" | "EdDSA" | "PS256" | "PS384" | "PS512" | "RS256" | "RS384" | "RS512";
+export declare const UpdateKmsIssuerResponseAlgorithm: any;
+export type UpdateKmsIssuerResponseOrigin = "external" | "vercel";
+export declare const UpdateKmsIssuerResponseOrigin: any;
+export type UpdateKmsIssuerResponseClaimsSchemaMap = {
+    [key: string]: unknown | undefined;
+};
+export declare const UpdateKmsIssuerResponseClaimsSchemaMap: S.Schema<UpdateKmsIssuerResponseClaimsSchemaMap>;
+export type UpdateKmsIssuerResponseSigningKeysItemStatus = "active" | "pending" | "revoking";
+export declare const UpdateKmsIssuerResponseSigningKeysItemStatus: any;
+export type UpdateKmsIssuerResponseSigningKeysItemPublicKeyKeyOpsList = Array<string>;
+export declare const UpdateKmsIssuerResponseSigningKeysItemPublicKeyKeyOpsList: S.Schema<UpdateKmsIssuerResponseSigningKeysItemPublicKeyKeyOpsList>;
+/** The X.509 certificate chain (RFC 7517 §4.7). Each entry is the base64 DER (not base64url) of a certificate. For keys minted with a stored certificate this holds the single self-signed cert as `[x5c]`. */
+export type UpdateKmsIssuerResponseSigningKeysItemPublicKeyX5cList = Array<string>;
+export declare const UpdateKmsIssuerResponseSigningKeysItemPublicKeyX5cList: S.Schema<UpdateKmsIssuerResponseSigningKeysItemPublicKeyX5cList>;
+export interface UpdateKmsIssuerResponseSigningKeysItemPublicKey {
+    kty?: string;
+    kid?: string;
+    alg?: string;
+    use?: string;
+    key_ops?: UpdateKmsIssuerResponseSigningKeysItemPublicKeyKeyOpsList;
+    /** The X.509 certificate chain (RFC 7517 §4.7). Each entry is the base64 DER (not base64url) of a certificate. For keys minted with a stored certificate this holds the single self-signed cert as `[x5c]`. */
+    x5c?: UpdateKmsIssuerResponseSigningKeysItemPublicKeyX5cList;
+    /** The base64url SHA-256 thumbprint of the DER certificate in `x5c[0]` (RFC 7517 §4.9). */
+    x5t_S256?: string;
+}
+export declare const UpdateKmsIssuerResponseSigningKeysItemPublicKey: S.Schema<UpdateKmsIssuerResponseSigningKeysItemPublicKey>;
+export interface UpdateKmsIssuerResponseSigningKeysItem {
+    /** The server-minted, unique record identifier. Use this to address the key on the activate / certificate endpoints. */
+    keyId: string;
+    /** The caller-supplied key id (imported keys only), used as the JWT/JWKS `kid`. Not unique across an issuer's keys; omitted for generated keys. */
+    importKeyId?: string;
+    issuerId: string;
+    algorithm: string;
+    status: UpdateKmsIssuerResponseSigningKeysItemStatus;
+    publicKey?: UpdateKmsIssuerResponseSigningKeysItemPublicKey;
+    publicKeyFingerprint?: string;
+    /** The public key in SPKI PEM form, ready to render. Present whenever the key has public key material. Derived from `publicKey`; the embedded certificate members (`x5c`/`x5t#S256`) do not affect it. */
+    publicKeyPem?: string;
+    /** The stored X.509 certificate (from `publicKey.x5c[0]`) in PEM form, ready to render. Present only for keys created with a stored certificate; omitted for keys created before certificates were stored. */
+    certificatePem?: string;
+    createdAt: string;
+    updatedAt: string;
+    revokeAt?: string;
+    activateAt?: string;
+    /** When the key became the active signer. Present for active and revoking keys (and absent for pending keys and rows predating this field). */
+    activatedAt?: string;
+}
+export declare const UpdateKmsIssuerResponseSigningKeysItem: S.Schema<UpdateKmsIssuerResponseSigningKeysItem>;
+export type UpdateKmsIssuerResponseSigningKeysList = Array<UpdateKmsIssuerResponseSigningKeysItem>;
+export declare const UpdateKmsIssuerResponseSigningKeysList: S.Schema<UpdateKmsIssuerResponseSigningKeysList>;
+export type UpdateKmsIssuerResponsePoliciesItemCase0Kind = "project-grant";
+export declare const UpdateKmsIssuerResponsePoliciesItemCase0Kind: any;
+/** Environments whose OIDC tokens this grant authorizes. Each entry is either a system environment slug (`production`, `preview`, `development`) or a custom environment ID (prefixed `env_`). Custom environments are matched against the token's `custom_environment_id` claim (the stable ID); system environments against its `environment` claim. */
+export type UpdateKmsIssuerResponsePoliciesItemCase0EnvironmentsList = Array<string>;
+export declare const UpdateKmsIssuerResponsePoliciesItemCase0EnvironmentsList: S.Schema<UpdateKmsIssuerResponsePoliciesItemCase0EnvironmentsList>;
+export type UpdateKmsIssuerResponsePoliciesItemCase0TokenClaimsMap = {
+    [key: string]: unknown | undefined;
+};
+export declare const UpdateKmsIssuerResponsePoliciesItemCase0TokenClaimsMap: S.Schema<UpdateKmsIssuerResponsePoliciesItemCase0TokenClaimsMap>;
+export interface UpdateKmsIssuerResponsePoliciesItemCase0 {
+    kind: UpdateKmsIssuerResponsePoliciesItemCase0Kind;
+    teamId: string;
+    projectId: string;
+    /** Environments whose OIDC tokens this grant authorizes. Each entry is either a system environment slug (`production`, `preview`, `development`) or a custom environment ID (prefixed `env_`). Custom environments are matched against the token's `custom_environment_id` claim (the stable ID); system environments against its `environment` claim. */
+    environments: UpdateKmsIssuerResponsePoliciesItemCase0EnvironmentsList;
+    tokenClaims?: UpdateKmsIssuerResponsePoliciesItemCase0TokenClaimsMap;
+    createdAt: string;
+    updatedAt: string;
+}
+export declare const UpdateKmsIssuerResponsePoliciesItemCase0: S.Schema<UpdateKmsIssuerResponsePoliciesItemCase0>;
+export type UpdateKmsIssuerResponsePoliciesItemCase1Kind = "connex-grant";
+export declare const UpdateKmsIssuerResponsePoliciesItemCase1Kind: any;
+export type UpdateKmsIssuerResponsePoliciesItemCase1TokenClaimsMap = {
+    [key: string]: unknown | undefined;
+};
+export declare const UpdateKmsIssuerResponsePoliciesItemCase1TokenClaimsMap: S.Schema<UpdateKmsIssuerResponsePoliciesItemCase1TokenClaimsMap>;
+export interface UpdateKmsIssuerResponsePoliciesItemCase1 {
+    kind: UpdateKmsIssuerResponsePoliciesItemCase1Kind;
+    clientId: string;
+    tokenClaims?: UpdateKmsIssuerResponsePoliciesItemCase1TokenClaimsMap;
+    createdAt: string;
+    updatedAt: string;
+}
+export declare const UpdateKmsIssuerResponsePoliciesItemCase1: S.Schema<UpdateKmsIssuerResponsePoliciesItemCase1>;
+export type UpdateKmsIssuerResponsePoliciesItem = UpdateKmsIssuerResponsePoliciesItemCase0 | UpdateKmsIssuerResponsePoliciesItemCase1;
+export declare const UpdateKmsIssuerResponsePoliciesItem: S.Schema<UpdateKmsIssuerResponsePoliciesItem>;
+export type UpdateKmsIssuerResponsePoliciesList = Array<UpdateKmsIssuerResponsePoliciesItem>;
+export declare const UpdateKmsIssuerResponsePoliciesList: S.Schema<UpdateKmsIssuerResponsePoliciesList>;
+export interface UpdateKmsIssuerResponse {
+    id: string;
+    ownerId: string;
+    name: string;
+    algorithm: UpdateKmsIssuerResponseAlgorithm;
+    origin: UpdateKmsIssuerResponseOrigin;
+    managedBy?: string;
+    claimsSchema?: UpdateKmsIssuerResponseClaimsSchemaMap;
+    createdAt: string;
+    updatedAt: string;
+    signingKeys: UpdateKmsIssuerResponseSigningKeysList;
+    policies: UpdateKmsIssuerResponsePoliciesList;
+}
+export declare const UpdateKmsIssuerResponse: S.Schema<UpdateKmsIssuerResponse>;
+/** The issuer policy kind. */
+export type UpdateKmsIssuerPolicyRequestKind = "project-grant";
+export declare const UpdateKmsIssuerPolicyRequestKind: any;
+/** The environments for the project grant policy. Each entry is a system environment (production, preview, development) or a custom environment ID (env_...). */
+export type UpdateKmsIssuerPolicyRequestEnvironmentsList = Array<string>;
+export declare const UpdateKmsIssuerPolicyRequestEnvironmentsList: S.Schema<UpdateKmsIssuerPolicyRequestEnvironmentsList>;
+/** The claims that KMS should include in signed JWTs for this policy. Pass null to remove them. */
+export type UpdateKmsIssuerPolicyRequestTokenClaimsMap = {
+    [key: string]: unknown | undefined;
+};
+export declare const UpdateKmsIssuerPolicyRequestTokenClaimsMap: S.Schema<UpdateKmsIssuerPolicyRequestTokenClaimsMap>;
+export interface UpdateKmsIssuerPolicyRequest {
+    /** The ID of the issuer. */
+    issuerId: string;
+    /** The issuer policy kind. */
+    kind: UpdateKmsIssuerPolicyRequestKind | (string & {});
+    /** The policy identifier. */
+    policyKey: string;
+    /** The Team identifier to perform the request on behalf of. */
+    teamId?: string;
+    /** The Team slug to perform the request on behalf of. */
+    slug?: string;
+    /** The environments for the project grant policy. Each entry is a system environment (production, preview, development) or a custom environment ID (env_...). */
+    environments?: UpdateKmsIssuerPolicyRequestEnvironmentsList;
+    /** The claims that KMS should include in signed JWTs for this policy. Pass null to remove them. */
+    tokenClaims?: UpdateKmsIssuerPolicyRequestTokenClaimsMap | null;
+}
+export declare const UpdateKmsIssuerPolicyRequest: S.Schema<UpdateKmsIssuerPolicyRequest>;
+export type UpdateKmsIssuerPolicyResponseBodyCase0Kind = "project-grant";
+export declare const UpdateKmsIssuerPolicyResponseBodyCase0Kind: any;
+/** Environments whose OIDC tokens this grant authorizes. Each entry is either a system environment slug (`production`, `preview`, `development`) or a custom environment ID (prefixed `env_`). Custom environments are matched against the token's `custom_environment_id` claim (the stable ID); system environments against its `environment` claim. */
+export type UpdateKmsIssuerPolicyResponseBodyCase0EnvironmentsList = Array<string>;
+export declare const UpdateKmsIssuerPolicyResponseBodyCase0EnvironmentsList: S.Schema<UpdateKmsIssuerPolicyResponseBodyCase0EnvironmentsList>;
+export type UpdateKmsIssuerPolicyResponseBodyCase0TokenClaimsMap = {
+    [key: string]: unknown | undefined;
+};
+export declare const UpdateKmsIssuerPolicyResponseBodyCase0TokenClaimsMap: S.Schema<UpdateKmsIssuerPolicyResponseBodyCase0TokenClaimsMap>;
+export interface UpdateKmsIssuerPolicyResponseBodyCase0 {
+    kind: UpdateKmsIssuerPolicyResponseBodyCase0Kind;
+    teamId: string;
+    projectId: string;
+    /** Environments whose OIDC tokens this grant authorizes. Each entry is either a system environment slug (`production`, `preview`, `development`) or a custom environment ID (prefixed `env_`). Custom environments are matched against the token's `custom_environment_id` claim (the stable ID); system environments against its `environment` claim. */
+    environments: UpdateKmsIssuerPolicyResponseBodyCase0EnvironmentsList;
+    tokenClaims?: UpdateKmsIssuerPolicyResponseBodyCase0TokenClaimsMap;
+    createdAt: string;
+    updatedAt: string;
+}
+export declare const UpdateKmsIssuerPolicyResponseBodyCase0: S.Schema<UpdateKmsIssuerPolicyResponseBodyCase0>;
+export type UpdateKmsIssuerPolicyResponseBodyCase1Kind = "connex-grant";
+export declare const UpdateKmsIssuerPolicyResponseBodyCase1Kind: any;
+export type UpdateKmsIssuerPolicyResponseBodyCase1TokenClaimsMap = {
+    [key: string]: unknown | undefined;
+};
+export declare const UpdateKmsIssuerPolicyResponseBodyCase1TokenClaimsMap: S.Schema<UpdateKmsIssuerPolicyResponseBodyCase1TokenClaimsMap>;
+export interface UpdateKmsIssuerPolicyResponseBodyCase1 {
+    kind: UpdateKmsIssuerPolicyResponseBodyCase1Kind;
+    clientId: string;
+    tokenClaims?: UpdateKmsIssuerPolicyResponseBodyCase1TokenClaimsMap;
+    createdAt: string;
+    updatedAt: string;
+}
+export declare const UpdateKmsIssuerPolicyResponseBodyCase1: S.Schema<UpdateKmsIssuerPolicyResponseBodyCase1>;
+export type UpdateKmsIssuerPolicyResponseBody = UpdateKmsIssuerPolicyResponseBodyCase0 | UpdateKmsIssuerPolicyResponseBodyCase1;
+export declare const UpdateKmsIssuerPolicyResponseBody: S.Schema<UpdateKmsIssuerPolicyResponseBody>;
+export type UpdateKmsIssuerPolicyResponse = UpdateKmsIssuerPolicyResponseBody;
+export declare const UpdateKmsIssuerPolicyResponse: S.Schema<UpdateKmsIssuerPolicyResponse>;
+export type ActivateKmsSigningKeyError = BadRequest | Forbidden | NotFound | Conflict | VercelOpError;
+/** Activate a signing key Activate a pending signing key so the issuer starts signing with it. */
+export declare const activateKmsSigningKey: API.OperationMethod<ActivateKmsSigningKeyRequest, ActivateKmsSigningKeyResponse, ActivateKmsSigningKeyError, VercelOpContext>;
+export type CreateKmsIssuerError = BadRequest | Forbidden | NotFound | VercelOpError;
+/** Create an issuer Create a new KMS issuer for the authenticated team. An issuer owns the asymmetric signing keys that are used to sign tokens and messages. */
+export declare const createKmsIssuer: API.OperationMethod<CreateKmsIssuerRequest, CreateKmsIssuerResponse, CreateKmsIssuerError, VercelOpContext>;
+export type CreateKmsIssuerPolicyError = BadRequest | Forbidden | NotFound | VercelOpError;
+/** Create an issuer policy Attach a policy to a KMS issuer that grants a project's deployments permission to sign with it. */
+export declare const createKmsIssuerPolicy: API.OperationMethod<CreateKmsIssuerPolicyRequest, CreateKmsIssuerPolicyResponse, CreateKmsIssuerPolicyError, VercelOpContext>;
+export type CreateKmsSigningKeyError = BadRequest | Forbidden | NotFound | Conflict | VercelOpError;
+/** Create a signing key Create a new signing key for a KMS issuer. Depending on the activation mode, the key is activated automatically once its public key has propagated, or manually via the activate endpoint. */
+export declare const createKmsSigningKey: API.OperationMethod<CreateKmsSigningKeyRequest, CreateKmsSigningKeyResponse, CreateKmsSigningKeyError, VercelOpContext>;
+export type DeleteKmsIssuerError = BadRequest | Forbidden | NotFound | VercelOpError;
+/** Delete an issuer Delete a KMS issuer and its signing keys. */
+export declare const deleteKmsIssuer: API.OperationMethod<DeleteKmsIssuerRequest, DeleteKmsIssuerResponse, DeleteKmsIssuerError, VercelOpContext>;
+export type DeleteKmsIssuerPolicyError = BadRequest | Forbidden | NotFound | VercelOpError;
+/** Delete an issuer policy Remove a policy from a KMS issuer. */
+export declare const deleteKmsIssuerPolicy: API.OperationMethod<DeleteKmsIssuerPolicyRequest, DeleteKmsIssuerPolicyResponse, DeleteKmsIssuerPolicyError, VercelOpContext>;
+export type GetKmsIssuerError = BadRequest | Forbidden | NotFound | VercelOpError;
+/** Get an issuer Retrieve a single KMS issuer by its ID. Accepts either a team bearer token (existing path) or an OIDC token authorized by one of the issuer's policies (e.g. a connex-grant token). The OIDC path returns the issuer without policies, since a policy token only proves signing access, not management access. */
+export declare const getKmsIssuer: API.OperationMethod<GetKmsIssuerRequest, GetKmsIssuerResponse, GetKmsIssuerError, VercelOpContext>;
+export type ListKmsIssuersError = BadRequest | Forbidden | VercelOpError;
+/** List issuers Retrieve the list of KMS issuers that belong to the authenticated team. The results are paginated. */
+export declare const listKmsIssuers: API.OperationMethod<ListKmsIssuersRequest, ListKmsIssuersResponse, ListKmsIssuersError, VercelOpContext>;
+export type RevokeKmsSigningKeyError = BadRequest | Forbidden | NotFound | Conflict | VercelOpError;
+/** Revoke a signing key Immediately revoke a signing key that is already scheduled for revocation. */
+export declare const revokeKmsSigningKey: API.OperationMethod<RevokeKmsSigningKeyRequest, RevokeKmsSigningKeyResponse, RevokeKmsSigningKeyError, VercelOpContext>;
+export type SignKmsMessageError = BadRequest | Forbidden | NotFound | VercelOpError;
+/** Sign a message Sign a raw message with a KMS issuer's active signing key. Authenticate the request with a Vercel OIDC token in the `Authorization: Bearer` header; the issuer's policies decide which workloads are allowed to sign. */
+export declare const signKmsMessage: API.OperationMethod<SignKmsMessageRequest, SignKmsMessageResponse, SignKmsMessageError, VercelOpContext>;
+export type SignKmsTokenError = BadRequest | Forbidden | NotFound | VercelOpError;
+/** Sign a token Sign a JWT with a KMS issuer's active signing key. Authenticate the request with a Vercel OIDC token in the `Authorization: Bearer` header; the issuer's policies decide which workloads are allowed to sign. */
+export declare const signKmsToken: API.OperationMethod<SignKmsTokenRequest, SignKmsTokenResponse, SignKmsTokenError, VercelOpContext>;
+export type UpdateKmsIssuerError = BadRequest | Forbidden | NotFound | VercelOpError;
+/** Update an issuer Update a KMS issuer's name or claims schema. */
+export declare const updateKmsIssuer: API.OperationMethod<UpdateKmsIssuerRequest, UpdateKmsIssuerResponse, UpdateKmsIssuerError, VercelOpContext>;
+export type UpdateKmsIssuerPolicyError = BadRequest | Forbidden | NotFound | VercelOpError;
+/** Update an issuer policy Update an existing KMS issuer policy's environments or token claims. */
+export declare const updateKmsIssuerPolicy: API.OperationMethod<UpdateKmsIssuerPolicyRequest, UpdateKmsIssuerPolicyResponse, UpdateKmsIssuerPolicyError, VercelOpContext>;
+//# sourceMappingURL=kms.d.ts.map