@distilled.cloud/vercel 1.0.0-rc.7 → 1.0.0-rc.9

package/src/services/kms.ts

@@ -0,0 +1,2631 @@
+// AUTO-GENERATED by scripts/generate.ts from .generated-specs (specs/spec-mirror-vercel/specs/openapi.json). Do not edit.
+import * as S from "@distilled.cloud/core/schema";
+import * as API from "@distilled.cloud/core/api";
+import * as C from "@distilled.cloud/core/category";
+import * as T from "../traits.ts";
+import {
+  VercelProtocol,
+  type VercelOpError,
+  type VercelOpContext,
+} from "../protocol.ts";
+import * as Retry from "../retry.ts";
+
+export type { VercelOpError, VercelOpContext };
+
+export class BadRequest
+  extends /*@__PURE__*/ T.applyErrorMatchers(
+    /*@__PURE__*/ S.TaggedError<BadRequest>()("BadRequest", {
+      code: S.Number,
+      message: S.String,
+    }).pipe(C.withBadRequestError),
+    [{ status: 400 }],
+  ) {}
+
+export class Conflict
+  extends /*@__PURE__*/ T.applyErrorMatchers(
+    /*@__PURE__*/ S.TaggedError<Conflict>()("Conflict", {
+      code: S.Number,
+      message: S.String,
+    }).pipe(C.withConflictError),
+    [{ status: 409 }],
+  ) {}
+
+export class Forbidden
+  extends /*@__PURE__*/ T.applyErrorMatchers(
+    /*@__PURE__*/ S.TaggedError<Forbidden>()("Forbidden", {
+      code: S.Number,
+      message: S.String,
+    }).pipe(C.withAuthError),
+    [{ status: 403 }],
+  ) {}
+
+export class NotFound
+  extends /*@__PURE__*/ T.applyErrorMatchers(
+    /*@__PURE__*/ S.TaggedError<NotFound>()("NotFound", {
+      code: S.Number,
+      message: S.String,
+    }).pipe(C.withBadRequestError),
+    [{ status: 404 }],
+  ) {}
+
+export interface ActivateKmsSigningKeyRequest {
+  /** The ID of the issuer. */
+  issuerId: string;
+  /** The ID of the pending signing key to activate. */
+  keyId: string;
+  /** The Team identifier to perform the request on behalf of. */
+  teamId?: string;
+  /** The Team slug to perform the request on behalf of. */
+  slug?: string;
+  /** How many hours after activation the previously-active key should stop being used. Defaults to a 1 hour grace period so already-issued tokens keep verifying. */
+  revokePreviousAfterHours?: number;
+}
+export const ActivateKmsSigningKeyRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    issuerId: S.String.pipe(T.Label()),
+    keyId: S.String.pipe(T.Label()),
+    teamId: S.optional(S.String.pipe(T.Query())),
+    slug: S.optional(S.String.pipe(T.Query())),
+    revokePreviousAfterHours: S.optional(S.Number),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/v1/kms/issuers/{issuerId}/keys/{keyId}/activate",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "ActivateKmsSigningKeyRequest",
+}) as any as S.Schema<ActivateKmsSigningKeyRequest>;
+
+export type ActivateKmsSigningKeyResponseStatus =
+  | "active"
+  | "pending"
+  | "revoking";
+export const ActivateKmsSigningKeyResponseStatus = /*@__PURE__*/ S.String;
+
+export type ActivateKmsSigningKeyResponsePublicKeyKeyOpsList = Array<string>;
+export const ActivateKmsSigningKeyResponsePublicKeyKeyOpsList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<ActivateKmsSigningKeyResponsePublicKeyKeyOpsList>;
+
+/** The X.509 certificate chain (RFC 7517 §4.7). Each entry is the base64 DER (not base64url) of a certificate. For keys minted with a stored certificate this holds the single self-signed cert as `[x5c]`. */
+export type ActivateKmsSigningKeyResponsePublicKeyX5cList = Array<string>;
+export const ActivateKmsSigningKeyResponsePublicKeyX5cList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<ActivateKmsSigningKeyResponsePublicKeyX5cList>;
+
+export interface ActivateKmsSigningKeyResponsePublicKey {
+  kty?: string;
+  kid?: string;
+  alg?: string;
+  use?: string;
+  key_ops?: ActivateKmsSigningKeyResponsePublicKeyKeyOpsList;
+  /** The X.509 certificate chain (RFC 7517 §4.7). Each entry is the base64 DER (not base64url) of a certificate. For keys minted with a stored certificate this holds the single self-signed cert as `[x5c]`. */
+  x5c?: ActivateKmsSigningKeyResponsePublicKeyX5cList;
+  /** The base64url SHA-256 thumbprint of the DER certificate in `x5c[0]` (RFC 7517 §4.9). */
+  x5t_S256?: string;
+}
+export const ActivateKmsSigningKeyResponsePublicKey = /*@__PURE__*/ S.suspend(
+  () =>
+    S.Struct({
+      kty: S.optional(S.String),
+      kid: S.optional(S.String),
+      alg: S.optional(S.String),
+      use: S.optional(S.String),
+      key_ops: S.optional(ActivateKmsSigningKeyResponsePublicKeyKeyOpsList),
+      x5c: S.optional(ActivateKmsSigningKeyResponsePublicKeyX5cList),
+      x5t_S256: S.optional(S.String.pipe(T.Body("x5t#S256"))),
+    }),
+).annotate({
+  identifier: "ActivateKmsSigningKeyResponsePublicKey",
+}) as any as S.Schema<ActivateKmsSigningKeyResponsePublicKey>;
+
+export interface ActivateKmsSigningKeyResponse {
+  /** The server-minted, unique record identifier. Use this to address the key on the activate / certificate endpoints. */
+  keyId: string;
+  /** The caller-supplied key id (imported keys only), used as the JWT/JWKS `kid`. Not unique across an issuer's keys; omitted for generated keys. */
+  importKeyId?: string;
+  issuerId: string;
+  algorithm: string;
+  status: ActivateKmsSigningKeyResponseStatus;
+  publicKey?: ActivateKmsSigningKeyResponsePublicKey;
+  publicKeyFingerprint?: string;
+  /** The public key in SPKI PEM form, ready to render. Present whenever the key has public key material. Derived from `publicKey`; the embedded certificate members (`x5c`/`x5t#S256`) do not affect it. */
+  publicKeyPem?: string;
+  /** The stored X.509 certificate (from `publicKey.x5c[0]`) in PEM form, ready to render. Present only for keys created with a stored certificate; omitted for keys created before certificates were stored. */
+  certificatePem?: string;
+  createdAt: string;
+  updatedAt: string;
+  revokeAt?: string;
+  activateAt?: string;
+  /** When the key became the active signer. Present for active and revoking keys (and absent for pending keys and rows predating this field). */
+  activatedAt?: string;
+}
+export const ActivateKmsSigningKeyResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    keyId: S.String,
+    importKeyId: S.optional(S.String),
+    issuerId: S.String,
+    algorithm: S.String,
+    status: ActivateKmsSigningKeyResponseStatus,
+    publicKey: S.optional(ActivateKmsSigningKeyResponsePublicKey),
+    publicKeyFingerprint: S.optional(S.String),
+    publicKeyPem: S.optional(S.String),
+    certificatePem: S.optional(S.String),
+    createdAt: S.String,
+    updatedAt: S.String,
+    revokeAt: S.optional(S.String),
+    activateAt: S.optional(S.String),
+    activatedAt: S.optional(S.String),
+  }),
+).annotate({
+  identifier: "ActivateKmsSigningKeyResponse",
+}) as any as S.Schema<ActivateKmsSigningKeyResponse>;
+
+/** The signing algorithm to use for the issuer. */
+export type CreateKmsIssuerRequestAlgorithm =
+  | "RS256"
+  | "RS384"
+  | "RS512"
+  | "PS256"
+  | "PS384"
+  | "PS512"
+  | "ES256"
+  | "ES384"
+  | "ES512"
+  | "EdDSA";
+export const CreateKmsIssuerRequestAlgorithm = /*@__PURE__*/ S.String;
+
+/** A JSON Schema used to validate the resolved token claims when signing tokens for this issuer. */
+export type CreateKmsIssuerRequestClaimsSchemaMap = {
+  [key: string]: unknown | undefined;
+};
+export const CreateKmsIssuerRequestClaimsSchemaMap = /*@__PURE__*/ S.Record(
+  S.String,
+  S.Unknown,
+) as any as S.Schema<CreateKmsIssuerRequestClaimsSchemaMap>;
+
+export type CreateKmsIssuerRequestPolicyCase0Kind = "project-grant";
+export const CreateKmsIssuerRequestPolicyCase0Kind = /*@__PURE__*/ S.String;
+
+/** The environments for the project grant policy. Each entry is a system environment (production, preview, development) or a custom environment ID (env_...). */
+export type CreateKmsIssuerRequestPolicyCase0EnvironmentsList = Array<string>;
+export const CreateKmsIssuerRequestPolicyCase0EnvironmentsList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<CreateKmsIssuerRequestPolicyCase0EnvironmentsList>;
+
+/** The claims that KMS should include in signed JWTs for this policy. */
+export type CreateKmsIssuerRequestPolicyCase0TokenClaimsMap = {
+  [key: string]: unknown | undefined;
+};
+export const CreateKmsIssuerRequestPolicyCase0TokenClaimsMap =
+  /*@__PURE__*/ S.Record(
+    S.String,
+    S.Unknown,
+  ) as any as S.Schema<CreateKmsIssuerRequestPolicyCase0TokenClaimsMap>;
+
+export interface CreateKmsIssuerRequestPolicyCase0 {
+  kind: CreateKmsIssuerRequestPolicyCase0Kind;
+  /** The team ID for the project grant policy. */
+  teamId: string;
+  /** The project ID for the project grant policy. */
+  projectId: string;
+  /** The environments for the project grant policy. Each entry is a system environment (production, preview, development) or a custom environment ID (env_...). */
+  environments: CreateKmsIssuerRequestPolicyCase0EnvironmentsList;
+  /** The claims that KMS should include in signed JWTs for this policy. */
+  tokenClaims?: CreateKmsIssuerRequestPolicyCase0TokenClaimsMap;
+}
+export const CreateKmsIssuerRequestPolicyCase0 = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    kind: CreateKmsIssuerRequestPolicyCase0Kind,
+    teamId: S.String,
+    projectId: S.String,
+    environments: CreateKmsIssuerRequestPolicyCase0EnvironmentsList,
+    tokenClaims: S.optional(CreateKmsIssuerRequestPolicyCase0TokenClaimsMap),
+  }),
+).annotate({
+  identifier: "CreateKmsIssuerRequestPolicyCase0",
+}) as any as S.Schema<CreateKmsIssuerRequestPolicyCase0>;
+
+export type CreateKmsIssuerRequestPolicyCase1Kind = "connex-grant";
+export const CreateKmsIssuerRequestPolicyCase1Kind = /*@__PURE__*/ S.String;
+
+/** The claims that KMS should include in signed JWTs for this policy. */
+export type CreateKmsIssuerRequestPolicyCase1TokenClaimsMap = {
+  [key: string]: unknown | undefined;
+};
+export const CreateKmsIssuerRequestPolicyCase1TokenClaimsMap =
+  /*@__PURE__*/ S.Record(
+    S.String,
+    S.Unknown,
+  ) as any as S.Schema<CreateKmsIssuerRequestPolicyCase1TokenClaimsMap>;
+
+export interface CreateKmsIssuerRequestPolicyCase1 {
+  kind: CreateKmsIssuerRequestPolicyCase1Kind;
+  /** The Connex client ID for the Connex grant policy. */
+  clientId: string;
+  /** The claims that KMS should include in signed JWTs for this policy. */
+  tokenClaims?: CreateKmsIssuerRequestPolicyCase1TokenClaimsMap;
+}
+export const CreateKmsIssuerRequestPolicyCase1 = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    kind: CreateKmsIssuerRequestPolicyCase1Kind,
+    clientId: S.String,
+    tokenClaims: S.optional(CreateKmsIssuerRequestPolicyCase1TokenClaimsMap),
+  }),
+).annotate({
+  identifier: "CreateKmsIssuerRequestPolicyCase1",
+}) as any as S.Schema<CreateKmsIssuerRequestPolicyCase1>;
+
+export type CreateKmsIssuerRequestPolicy =
+  | CreateKmsIssuerRequestPolicyCase0
+  | CreateKmsIssuerRequestPolicyCase1;
+export const CreateKmsIssuerRequestPolicy =
+  /*@__PURE__*/ S.Unknown as any as S.Schema<CreateKmsIssuerRequestPolicy>;
+
+export interface CreateKmsIssuerRequest {
+  /** The Team identifier to perform the request on behalf of. */
+  teamId?: string;
+  /** The Team slug to perform the request on behalf of. */
+  slug?: string;
+  /** The name of the issuer. */
+  name: string;
+  /** The signing algorithm to use for the issuer. */
+  algorithm?: CreateKmsIssuerRequestAlgorithm | (string & {});
+  /** A JSON Schema used to validate the resolved token claims when signing tokens for this issuer. */
+  claimsSchema?: CreateKmsIssuerRequestClaimsSchemaMap;
+  policy?: CreateKmsIssuerRequestPolicy;
+  /** The PEM-encoded private key to use for the issuer. */
+  importKey?: string;
+  /** The key id to use as the imported key's JWT/JWKS `kid`. Only allowed when `importKey` is provided. Not required to be unique; the addressable key id is the server-minted `keyId` returned in the response. */
+  importKeyId?: string;
+}
+export const CreateKmsIssuerRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    teamId: S.optional(S.String.pipe(T.Query())),
+    slug: S.optional(S.String.pipe(T.Query())),
+    name: S.String,
+    algorithm: S.optional(CreateKmsIssuerRequestAlgorithm),
+    claimsSchema: S.optional(CreateKmsIssuerRequestClaimsSchemaMap),
+    policy: S.optional(CreateKmsIssuerRequestPolicy),
+    importKey: S.optional(S.String),
+    importKeyId: S.optional(S.String),
+  }).pipe(T.Http({ method: "POST", uri: "/v1/kms/issuers", code: 200 })),
+).annotate({
+  identifier: "CreateKmsIssuerRequest",
+}) as any as S.Schema<CreateKmsIssuerRequest>;
+
+export type CreateKmsIssuerResponseAlgorithm =
+  | "ES256"
+  | "ES384"
+  | "ES512"
+  | "EdDSA"
+  | "PS256"
+  | "PS384"
+  | "PS512"
+  | "RS256"
+  | "RS384"
+  | "RS512";
+export const CreateKmsIssuerResponseAlgorithm = /*@__PURE__*/ S.String;
+
+export type CreateKmsIssuerResponseOrigin = "external" | "vercel";
+export const CreateKmsIssuerResponseOrigin = /*@__PURE__*/ S.String;
+
+export type CreateKmsIssuerResponseClaimsSchemaMap = {
+  [key: string]: unknown | undefined;
+};
+export const CreateKmsIssuerResponseClaimsSchemaMap = /*@__PURE__*/ S.Record(
+  S.String,
+  S.Unknown,
+) as any as S.Schema<CreateKmsIssuerResponseClaimsSchemaMap>;
+
+export type CreateKmsIssuerResponseSigningKeysItemStatus =
+  | "active"
+  | "pending"
+  | "revoking";
+export const CreateKmsIssuerResponseSigningKeysItemStatus =
+  /*@__PURE__*/ S.String;
+
+export type CreateKmsIssuerResponseSigningKeysItemPublicKeyKeyOpsList =
+  Array<string>;
+export const CreateKmsIssuerResponseSigningKeysItemPublicKeyKeyOpsList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<CreateKmsIssuerResponseSigningKeysItemPublicKeyKeyOpsList>;
+
+/** The X.509 certificate chain (RFC 7517 §4.7). Each entry is the base64 DER (not base64url) of a certificate. For keys minted with a stored certificate this holds the single self-signed cert as `[x5c]`. */
+export type CreateKmsIssuerResponseSigningKeysItemPublicKeyX5cList =
+  Array<string>;
+export const CreateKmsIssuerResponseSigningKeysItemPublicKeyX5cList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<CreateKmsIssuerResponseSigningKeysItemPublicKeyX5cList>;
+
+export interface CreateKmsIssuerResponseSigningKeysItemPublicKey {
+  kty?: string;
+  kid?: string;
+  alg?: string;
+  use?: string;
+  key_ops?: CreateKmsIssuerResponseSigningKeysItemPublicKeyKeyOpsList;
+  /** The X.509 certificate chain (RFC 7517 §4.7). Each entry is the base64 DER (not base64url) of a certificate. For keys minted with a stored certificate this holds the single self-signed cert as `[x5c]`. */
+  x5c?: CreateKmsIssuerResponseSigningKeysItemPublicKeyX5cList;
+  /** The base64url SHA-256 thumbprint of the DER certificate in `x5c[0]` (RFC 7517 §4.9). */
+  x5t_S256?: string;
+}
+export const CreateKmsIssuerResponseSigningKeysItemPublicKey =
+  /*@__PURE__*/ S.suspend(() =>
+    S.Struct({
+      kty: S.optional(S.String),
+      kid: S.optional(S.String),
+      alg: S.optional(S.String),
+      use: S.optional(S.String),
+      key_ops: S.optional(
+        CreateKmsIssuerResponseSigningKeysItemPublicKeyKeyOpsList,
+      ),
+      x5c: S.optional(CreateKmsIssuerResponseSigningKeysItemPublicKeyX5cList),
+      x5t_S256: S.optional(S.String.pipe(T.Body("x5t#S256"))),
+    }),
+  ).annotate({
+    identifier: "CreateKmsIssuerResponseSigningKeysItemPublicKey",
+  }) as any as S.Schema<CreateKmsIssuerResponseSigningKeysItemPublicKey>;
+
+export interface CreateKmsIssuerResponseSigningKeysItem {
+  /** The server-minted, unique record identifier. Use this to address the key on the activate / certificate endpoints. */
+  keyId: string;
+  /** The caller-supplied key id (imported keys only), used as the JWT/JWKS `kid`. Not unique across an issuer's keys; omitted for generated keys. */
+  importKeyId?: string;
+  issuerId: string;
+  algorithm: string;
+  status: CreateKmsIssuerResponseSigningKeysItemStatus;
+  publicKey?: CreateKmsIssuerResponseSigningKeysItemPublicKey;
+  publicKeyFingerprint?: string;
+  /** The public key in SPKI PEM form, ready to render. Present whenever the key has public key material. Derived from `publicKey`; the embedded certificate members (`x5c`/`x5t#S256`) do not affect it. */
+  publicKeyPem?: string;
+  /** The stored X.509 certificate (from `publicKey.x5c[0]`) in PEM form, ready to render. Present only for keys created with a stored certificate; omitted for keys created before certificates were stored. */
+  certificatePem?: string;
+  createdAt: string;
+  updatedAt: string;
+  revokeAt?: string;
+  activateAt?: string;
+  /** When the key became the active signer. Present for active and revoking keys (and absent for pending keys and rows predating this field). */
+  activatedAt?: string;
+}
+export const CreateKmsIssuerResponseSigningKeysItem = /*@__PURE__*/ S.suspend(
+  () =>
+    S.Struct({
+      keyId: S.String,
+      importKeyId: S.optional(S.String),
+      issuerId: S.String,
+      algorithm: S.String,
+      status: CreateKmsIssuerResponseSigningKeysItemStatus,
+      publicKey: S.optional(CreateKmsIssuerResponseSigningKeysItemPublicKey),
+      publicKeyFingerprint: S.optional(S.String),
+      publicKeyPem: S.optional(S.String),
+      certificatePem: S.optional(S.String),
+      createdAt: S.String,
+      updatedAt: S.String,
+      revokeAt: S.optional(S.String),
+      activateAt: S.optional(S.String),
+      activatedAt: S.optional(S.String),
+    }),
+).annotate({
+  identifier: "CreateKmsIssuerResponseSigningKeysItem",
+}) as any as S.Schema<CreateKmsIssuerResponseSigningKeysItem>;
+
+export type CreateKmsIssuerResponseSigningKeysList =
+  Array<CreateKmsIssuerResponseSigningKeysItem>;
+export const CreateKmsIssuerResponseSigningKeysList = /*@__PURE__*/ S.Array(
+  CreateKmsIssuerResponseSigningKeysItem,
+) as any as S.Schema<CreateKmsIssuerResponseSigningKeysList>;
+
+export type CreateKmsIssuerResponsePoliciesItemCase0Kind = "project-grant";
+export const CreateKmsIssuerResponsePoliciesItemCase0Kind =
+  /*@__PURE__*/ S.String;
+
+/** Environments whose OIDC tokens this grant authorizes. Each entry is either a system environment slug (`production`, `preview`, `development`) or a custom environment ID (prefixed `env_`). Custom environments are matched against the token's `custom_environment_id` claim (the stable ID); system environments against its `environment` claim. */
+export type CreateKmsIssuerResponsePoliciesItemCase0EnvironmentsList =
+  Array<string>;
+export const CreateKmsIssuerResponsePoliciesItemCase0EnvironmentsList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<CreateKmsIssuerResponsePoliciesItemCase0EnvironmentsList>;
+
+export type CreateKmsIssuerResponsePoliciesItemCase0TokenClaimsMap = {
+  [key: string]: unknown | undefined;
+};
+export const CreateKmsIssuerResponsePoliciesItemCase0TokenClaimsMap =
+  /*@__PURE__*/ S.Record(
+    S.String,
+    S.Unknown,
+  ) as any as S.Schema<CreateKmsIssuerResponsePoliciesItemCase0TokenClaimsMap>;
+
+export interface CreateKmsIssuerResponsePoliciesItemCase0 {
+  kind: CreateKmsIssuerResponsePoliciesItemCase0Kind;
+  teamId: string;
+  projectId: string;
+  /** Environments whose OIDC tokens this grant authorizes. Each entry is either a system environment slug (`production`, `preview`, `development`) or a custom environment ID (prefixed `env_`). Custom environments are matched against the token's `custom_environment_id` claim (the stable ID); system environments against its `environment` claim. */
+  environments: CreateKmsIssuerResponsePoliciesItemCase0EnvironmentsList;
+  tokenClaims?: CreateKmsIssuerResponsePoliciesItemCase0TokenClaimsMap;
+  createdAt: string;
+  updatedAt: string;
+}
+export const CreateKmsIssuerResponsePoliciesItemCase0 = /*@__PURE__*/ S.suspend(
+  () =>
+    S.Struct({
+      kind: CreateKmsIssuerResponsePoliciesItemCase0Kind,
+      teamId: S.String,
+      projectId: S.String,
+      environments: CreateKmsIssuerResponsePoliciesItemCase0EnvironmentsList,
+      tokenClaims: S.optional(
+        CreateKmsIssuerResponsePoliciesItemCase0TokenClaimsMap,
+      ),
+      createdAt: S.String,
+      updatedAt: S.String,
+    }),
+).annotate({
+  identifier: "CreateKmsIssuerResponsePoliciesItemCase0",
+}) as any as S.Schema<CreateKmsIssuerResponsePoliciesItemCase0>;
+
+export type CreateKmsIssuerResponsePoliciesItemCase1Kind = "connex-grant";
+export const CreateKmsIssuerResponsePoliciesItemCase1Kind =
+  /*@__PURE__*/ S.String;
+
+export type CreateKmsIssuerResponsePoliciesItemCase1TokenClaimsMap = {
+  [key: string]: unknown | undefined;
+};
+export const CreateKmsIssuerResponsePoliciesItemCase1TokenClaimsMap =
+  /*@__PURE__*/ S.Record(
+    S.String,
+    S.Unknown,
+  ) as any as S.Schema<CreateKmsIssuerResponsePoliciesItemCase1TokenClaimsMap>;
+
+export interface CreateKmsIssuerResponsePoliciesItemCase1 {
+  kind: CreateKmsIssuerResponsePoliciesItemCase1Kind;
+  clientId: string;
+  tokenClaims?: CreateKmsIssuerResponsePoliciesItemCase1TokenClaimsMap;
+  createdAt: string;
+  updatedAt: string;
+}
+export const CreateKmsIssuerResponsePoliciesItemCase1 = /*@__PURE__*/ S.suspend(
+  () =>
+    S.Struct({
+      kind: CreateKmsIssuerResponsePoliciesItemCase1Kind,
+      clientId: S.String,
+      tokenClaims: S.optional(
+        CreateKmsIssuerResponsePoliciesItemCase1TokenClaimsMap,
+      ),
+      createdAt: S.String,
+      updatedAt: S.String,
+    }),
+).annotate({
+  identifier: "CreateKmsIssuerResponsePoliciesItemCase1",
+}) as any as S.Schema<CreateKmsIssuerResponsePoliciesItemCase1>;
+
+export type CreateKmsIssuerResponsePoliciesItem =
+  | CreateKmsIssuerResponsePoliciesItemCase0
+  | CreateKmsIssuerResponsePoliciesItemCase1;
+export const CreateKmsIssuerResponsePoliciesItem =
+  /*@__PURE__*/ S.Unknown as any as S.Schema<CreateKmsIssuerResponsePoliciesItem>;
+
+export type CreateKmsIssuerResponsePoliciesList =
+  Array<CreateKmsIssuerResponsePoliciesItem>;
+export const CreateKmsIssuerResponsePoliciesList = /*@__PURE__*/ S.Array(
+  CreateKmsIssuerResponsePoliciesItem,
+) as any as S.Schema<CreateKmsIssuerResponsePoliciesList>;
+
+export interface CreateKmsIssuerResponse {
+  id: string;
+  ownerId: string;
+  name: string;
+  algorithm: CreateKmsIssuerResponseAlgorithm;
+  origin: CreateKmsIssuerResponseOrigin;
+  managedBy?: string;
+  claimsSchema?: CreateKmsIssuerResponseClaimsSchemaMap;
+  createdAt: string;
+  updatedAt: string;
+  signingKeys: CreateKmsIssuerResponseSigningKeysList;
+  policies: CreateKmsIssuerResponsePoliciesList;
+}
+export const CreateKmsIssuerResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    id: S.String,
+    ownerId: S.String,
+    name: S.String,
+    algorithm: CreateKmsIssuerResponseAlgorithm,
+    origin: CreateKmsIssuerResponseOrigin,
+    managedBy: S.optional(S.String),
+    claimsSchema: S.optional(CreateKmsIssuerResponseClaimsSchemaMap),
+    createdAt: S.String,
+    updatedAt: S.String,
+    signingKeys: CreateKmsIssuerResponseSigningKeysList,
+    policies: CreateKmsIssuerResponsePoliciesList,
+  }),
+).annotate({
+  identifier: "CreateKmsIssuerResponse",
+}) as any as S.Schema<CreateKmsIssuerResponse>;
+
+export type CreateKmsIssuerPolicyRequestKind = "project-grant";
+export const CreateKmsIssuerPolicyRequestKind = /*@__PURE__*/ S.String;
+
+/** The environments for the project grant policy. Each entry is a system environment (production, preview, development) or a custom environment ID (env_...). */
+export type CreateKmsIssuerPolicyRequestEnvironmentsList = Array<string>;
+export const CreateKmsIssuerPolicyRequestEnvironmentsList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<CreateKmsIssuerPolicyRequestEnvironmentsList>;
+
+/** The claims that KMS should include in signed JWTs for this policy. */
+export type CreateKmsIssuerPolicyRequestTokenClaimsMap = {
+  [key: string]: unknown | undefined;
+};
+export const CreateKmsIssuerPolicyRequestTokenClaimsMap =
+  /*@__PURE__*/ S.Record(
+    S.String,
+    S.Unknown,
+  ) as any as S.Schema<CreateKmsIssuerPolicyRequestTokenClaimsMap>;
+
+export interface CreateKmsIssuerPolicyRequest {
+  /** The ID of the issuer. */
+  issuerId: string;
+  /** The Team identifier to perform the request on behalf of. */
+  teamId?: string;
+  /** The Team slug to perform the request on behalf of. */
+  slug?: string;
+  kind: CreateKmsIssuerPolicyRequestKind | (string & {});
+  /** The project ID for the project grant policy. */
+  projectId: string;
+  /** The environments for the project grant policy. Each entry is a system environment (production, preview, development) or a custom environment ID (env_...). */
+  environments: CreateKmsIssuerPolicyRequestEnvironmentsList;
+  /** The claims that KMS should include in signed JWTs for this policy. */
+  tokenClaims?: CreateKmsIssuerPolicyRequestTokenClaimsMap;
+}
+export const CreateKmsIssuerPolicyRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    issuerId: S.String.pipe(T.Label()),
+    teamId: S.optional(S.String.pipe(T.Query())),
+    slug: S.optional(S.String.pipe(T.Query())),
+    kind: CreateKmsIssuerPolicyRequestKind,
+    projectId: S.String,
+    environments: CreateKmsIssuerPolicyRequestEnvironmentsList,
+    tokenClaims: S.optional(CreateKmsIssuerPolicyRequestTokenClaimsMap),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/v1/kms/issuers/{issuerId}/policies",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "CreateKmsIssuerPolicyRequest",
+}) as any as S.Schema<CreateKmsIssuerPolicyRequest>;
+
+export type CreateKmsIssuerPolicyResponseBodyCase0Kind = "project-grant";
+export const CreateKmsIssuerPolicyResponseBodyCase0Kind =
+  /*@__PURE__*/ S.String;
+
+/** Environments whose OIDC tokens this grant authorizes. Each entry is either a system environment slug (`production`, `preview`, `development`) or a custom environment ID (prefixed `env_`). Custom environments are matched against the token's `custom_environment_id` claim (the stable ID); system environments against its `environment` claim. */
+export type CreateKmsIssuerPolicyResponseBodyCase0EnvironmentsList =
+  Array<string>;
+export const CreateKmsIssuerPolicyResponseBodyCase0EnvironmentsList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<CreateKmsIssuerPolicyResponseBodyCase0EnvironmentsList>;
+
+export type CreateKmsIssuerPolicyResponseBodyCase0TokenClaimsMap = {
+  [key: string]: unknown | undefined;
+};
+export const CreateKmsIssuerPolicyResponseBodyCase0TokenClaimsMap =
+  /*@__PURE__*/ S.Record(
+    S.String,
+    S.Unknown,
+  ) as any as S.Schema<CreateKmsIssuerPolicyResponseBodyCase0TokenClaimsMap>;
+
+export interface CreateKmsIssuerPolicyResponseBodyCase0 {
+  kind: CreateKmsIssuerPolicyResponseBodyCase0Kind;
+  teamId: string;
+  projectId: string;
+  /** Environments whose OIDC tokens this grant authorizes. Each entry is either a system environment slug (`production`, `preview`, `development`) or a custom environment ID (prefixed `env_`). Custom environments are matched against the token's `custom_environment_id` claim (the stable ID); system environments against its `environment` claim. */
+  environments: CreateKmsIssuerPolicyResponseBodyCase0EnvironmentsList;
+  tokenClaims?: CreateKmsIssuerPolicyResponseBodyCase0TokenClaimsMap;
+  createdAt: string;
+  updatedAt: string;
+}
+export const CreateKmsIssuerPolicyResponseBodyCase0 = /*@__PURE__*/ S.suspend(
+  () =>
+    S.Struct({
+      kind: CreateKmsIssuerPolicyResponseBodyCase0Kind,
+      teamId: S.String,
+      projectId: S.String,
+      environments: CreateKmsIssuerPolicyResponseBodyCase0EnvironmentsList,
+      tokenClaims: S.optional(
+        CreateKmsIssuerPolicyResponseBodyCase0TokenClaimsMap,
+      ),
+      createdAt: S.String,
+      updatedAt: S.String,
+    }),
+).annotate({
+  identifier: "CreateKmsIssuerPolicyResponseBodyCase0",
+}) as any as S.Schema<CreateKmsIssuerPolicyResponseBodyCase0>;
+
+export type CreateKmsIssuerPolicyResponseBodyCase1Kind = "connex-grant";
+export const CreateKmsIssuerPolicyResponseBodyCase1Kind =
+  /*@__PURE__*/ S.String;
+
+export type CreateKmsIssuerPolicyResponseBodyCase1TokenClaimsMap = {
+  [key: string]: unknown | undefined;
+};
+export const CreateKmsIssuerPolicyResponseBodyCase1TokenClaimsMap =
+  /*@__PURE__*/ S.Record(
+    S.String,
+    S.Unknown,
+  ) as any as S.Schema<CreateKmsIssuerPolicyResponseBodyCase1TokenClaimsMap>;
+
+export interface CreateKmsIssuerPolicyResponseBodyCase1 {
+  kind: CreateKmsIssuerPolicyResponseBodyCase1Kind;
+  clientId: string;
+  tokenClaims?: CreateKmsIssuerPolicyResponseBodyCase1TokenClaimsMap;
+  createdAt: string;
+  updatedAt: string;
+}
+export const CreateKmsIssuerPolicyResponseBodyCase1 = /*@__PURE__*/ S.suspend(
+  () =>
+    S.Struct({
+      kind: CreateKmsIssuerPolicyResponseBodyCase1Kind,
+      clientId: S.String,
+      tokenClaims: S.optional(
+        CreateKmsIssuerPolicyResponseBodyCase1TokenClaimsMap,
+      ),
+      createdAt: S.String,
+      updatedAt: S.String,
+    }),
+).annotate({
+  identifier: "CreateKmsIssuerPolicyResponseBodyCase1",
+}) as any as S.Schema<CreateKmsIssuerPolicyResponseBodyCase1>;
+
+export type CreateKmsIssuerPolicyResponseBody =
+  | CreateKmsIssuerPolicyResponseBodyCase0
+  | CreateKmsIssuerPolicyResponseBodyCase1;
+export const CreateKmsIssuerPolicyResponseBody =
+  /*@__PURE__*/ S.Unknown as any as S.Schema<CreateKmsIssuerPolicyResponseBody>;
+
+export type CreateKmsIssuerPolicyResponse = CreateKmsIssuerPolicyResponseBody;
+export const CreateKmsIssuerPolicyResponse = /*@__PURE__*/ S.suspend(() =>
+  CreateKmsIssuerPolicyResponseBody.pipe(T.RawResponseRoot()),
+).annotate({
+  identifier: "CreateKmsIssuerPolicyResponse",
+}) as any as S.Schema<CreateKmsIssuerPolicyResponse>;
+
+/** Whether the new key is activated automatically after its public key has propagated, or manually via the activate endpoint. Defaults to `automatic`. */
+export type CreateKmsSigningKeyRequestActivation = "automatic" | "manual";
+export const CreateKmsSigningKeyRequestActivation = /*@__PURE__*/ S.String;
+
+/** Deprecated. The ISO date string or timestamp when the previous signing key should stop being used. Converted to a relative grace and applied at activation, not creation. Prefer revokePreviousAfterHours. */
+export type CreateKmsSigningKeyRequestRevokePreviousAt = string | number;
+export const CreateKmsSigningKeyRequestRevokePreviousAt =
+  /*@__PURE__*/ S.Unknown as any as S.Schema<CreateKmsSigningKeyRequestRevokePreviousAt>;
+
+export interface CreateKmsSigningKeyRequest {
+  /** The ID of the issuer. */
+  issuerId: string;
+  /** The Team identifier to perform the request on behalf of. */
+  teamId?: string;
+  /** The Team slug to perform the request on behalf of. */
+  slug?: string;
+  /** Whether the new key is activated automatically after its public key has propagated, or manually via the activate endpoint. Defaults to `automatic`. */
+  activation?: CreateKmsSigningKeyRequestActivation | (string & {});
+  /** For automatic activation, how many hours after activation the previous signing key should stop being used. Defaults to a 1 hour grace period so already-issued tokens keep verifying. */
+  revokePreviousAfterHours?: number;
+  /** Deprecated. The ISO date string or timestamp when the previous signing key should stop being used. Converted to a relative grace and applied at activation, not creation. Prefer revokePreviousAfterHours. */
+  revokePreviousAt?: CreateKmsSigningKeyRequestRevokePreviousAt;
+  /** The PEM-encoded private key to use for the issuer. */
+  importKey?: string;
+  /** The key id to use as the imported key's JWT/JWKS `kid`. Only allowed when `importKey` is provided. Not required to be unique; the addressable key id is the server-minted `keyId` returned in the response. */
+  importKeyId?: string;
+}
+export const CreateKmsSigningKeyRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    issuerId: S.String.pipe(T.Label()),
+    teamId: S.optional(S.String.pipe(T.Query())),
+    slug: S.optional(S.String.pipe(T.Query())),
+    activation: S.optional(CreateKmsSigningKeyRequestActivation),
+    revokePreviousAfterHours: S.optional(S.Number),
+    revokePreviousAt: S.optional(CreateKmsSigningKeyRequestRevokePreviousAt),
+    importKey: S.optional(S.String),
+    importKeyId: S.optional(S.String),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/v1/kms/issuers/{issuerId}/keys",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "CreateKmsSigningKeyRequest",
+}) as any as S.Schema<CreateKmsSigningKeyRequest>;
+
+export type CreateKmsSigningKeyResponseStatus =
+  | "active"
+  | "pending"
+  | "revoking";
+export const CreateKmsSigningKeyResponseStatus = /*@__PURE__*/ S.String;
+
+export type CreateKmsSigningKeyResponsePublicKeyKeyOpsList = Array<string>;
+export const CreateKmsSigningKeyResponsePublicKeyKeyOpsList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<CreateKmsSigningKeyResponsePublicKeyKeyOpsList>;
+
+/** The X.509 certificate chain (RFC 7517 §4.7). Each entry is the base64 DER (not base64url) of a certificate. For keys minted with a stored certificate this holds the single self-signed cert as `[x5c]`. */
+export type CreateKmsSigningKeyResponsePublicKeyX5cList = Array<string>;
+export const CreateKmsSigningKeyResponsePublicKeyX5cList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<CreateKmsSigningKeyResponsePublicKeyX5cList>;
+
+export interface CreateKmsSigningKeyResponsePublicKey {
+  kty?: string;
+  kid?: string;
+  alg?: string;
+  use?: string;
+  key_ops?: CreateKmsSigningKeyResponsePublicKeyKeyOpsList;
+  /** The X.509 certificate chain (RFC 7517 §4.7). Each entry is the base64 DER (not base64url) of a certificate. For keys minted with a stored certificate this holds the single self-signed cert as `[x5c]`. */
+  x5c?: CreateKmsSigningKeyResponsePublicKeyX5cList;
+  /** The base64url SHA-256 thumbprint of the DER certificate in `x5c[0]` (RFC 7517 §4.9). */
+  x5t_S256?: string;
+}
+export const CreateKmsSigningKeyResponsePublicKey = /*@__PURE__*/ S.suspend(
+  () =>
+    S.Struct({
+      kty: S.optional(S.String),
+      kid: S.optional(S.String),
+      alg: S.optional(S.String),
+      use: S.optional(S.String),
+      key_ops: S.optional(CreateKmsSigningKeyResponsePublicKeyKeyOpsList),
+      x5c: S.optional(CreateKmsSigningKeyResponsePublicKeyX5cList),
+      x5t_S256: S.optional(S.String.pipe(T.Body("x5t#S256"))),
+    }),
+).annotate({
+  identifier: "CreateKmsSigningKeyResponsePublicKey",
+}) as any as S.Schema<CreateKmsSigningKeyResponsePublicKey>;
+
+export interface CreateKmsSigningKeyResponse {
+  /** The server-minted, unique record identifier. Use this to address the key on the activate / certificate endpoints. */
+  keyId: string;
+  /** The caller-supplied key id (imported keys only), used as the JWT/JWKS `kid`. Not unique across an issuer's keys; omitted for generated keys. */
+  importKeyId?: string;
+  issuerId: string;
+  algorithm: string;
+  status: CreateKmsSigningKeyResponseStatus;
+  publicKey?: CreateKmsSigningKeyResponsePublicKey;
+  publicKeyFingerprint?: string;
+  /** The public key in SPKI PEM form, ready to render. Present whenever the key has public key material. Derived from `publicKey`; the embedded certificate members (`x5c`/`x5t#S256`) do not affect it. */
+  publicKeyPem?: string;
+  /** The stored X.509 certificate (from `publicKey.x5c[0]`) in PEM form, ready to render. Present only for keys created with a stored certificate; omitted for keys created before certificates were stored. */
+  certificatePem?: string;
+  createdAt: string;
+  updatedAt: string;
+  revokeAt?: string;
+  activateAt?: string;
+  /** When the key became the active signer. Present for active and revoking keys (and absent for pending keys and rows predating this field). */
+  activatedAt?: string;
+}
+export const CreateKmsSigningKeyResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    keyId: S.String,
+    importKeyId: S.optional(S.String),
+    issuerId: S.String,
+    algorithm: S.String,
+    status: CreateKmsSigningKeyResponseStatus,
+    publicKey: S.optional(CreateKmsSigningKeyResponsePublicKey),
+    publicKeyFingerprint: S.optional(S.String),
+    publicKeyPem: S.optional(S.String),
+    certificatePem: S.optional(S.String),
+    createdAt: S.String,
+    updatedAt: S.String,
+    revokeAt: S.optional(S.String),
+    activateAt: S.optional(S.String),
+    activatedAt: S.optional(S.String),
+  }),
+).annotate({
+  identifier: "CreateKmsSigningKeyResponse",
+}) as any as S.Schema<CreateKmsSigningKeyResponse>;
+
+export interface DeleteKmsIssuerRequest {
+  /** The ID of the issuer. */
+  issuerId: string;
+  /** The Team identifier to perform the request on behalf of. */
+  teamId?: string;
+  /** The Team slug to perform the request on behalf of. */
+  slug?: string;
+}
+export const DeleteKmsIssuerRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    issuerId: S.String.pipe(T.Label()),
+    teamId: S.optional(S.String.pipe(T.Query())),
+    slug: S.optional(S.String.pipe(T.Query())),
+  }).pipe(
+    T.Http({ method: "DELETE", uri: "/v1/kms/issuers/{issuerId}", code: 200 }),
+  ),
+).annotate({
+  identifier: "DeleteKmsIssuerRequest",
+}) as any as S.Schema<DeleteKmsIssuerRequest>;
+
+export interface DeleteKmsIssuerResponse {}
+export const DeleteKmsIssuerResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "DeleteKmsIssuerResponse",
+}) as any as S.Schema<DeleteKmsIssuerResponse>;
+
+/** The issuer policy kind. */
+export type DeleteKmsIssuerPolicyRequestKind = "project-grant" | "connex-grant";
+export const DeleteKmsIssuerPolicyRequestKind = /*@__PURE__*/ S.String;
+
+export interface DeleteKmsIssuerPolicyRequest {
+  /** The ID of the issuer. */
+  issuerId: string;
+  /** The issuer policy kind. */
+  kind: DeleteKmsIssuerPolicyRequestKind | (string & {});
+  /** The policy identifier. */
+  policyKey: string;
+  /** The Team identifier to perform the request on behalf of. */
+  teamId?: string;
+  /** The Team slug to perform the request on behalf of. */
+  slug?: string;
+}
+export const DeleteKmsIssuerPolicyRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    issuerId: S.String.pipe(T.Label()),
+    kind: DeleteKmsIssuerPolicyRequestKind.pipe(T.Label()),
+    policyKey: S.String.pipe(T.Label()),
+    teamId: S.optional(S.String.pipe(T.Query())),
+    slug: S.optional(S.String.pipe(T.Query())),
+  }).pipe(
+    T.Http({
+      method: "DELETE",
+      uri: "/v1/kms/issuers/{issuerId}/policies/{kind}/{policyKey}",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "DeleteKmsIssuerPolicyRequest",
+}) as any as S.Schema<DeleteKmsIssuerPolicyRequest>;
+
+export interface DeleteKmsIssuerPolicyResponse {}
+export const DeleteKmsIssuerPolicyResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "DeleteKmsIssuerPolicyResponse",
+}) as any as S.Schema<DeleteKmsIssuerPolicyResponse>;
+
+export interface GetKmsIssuerRequest {
+  /** The ID of the issuer. */
+  issuerId: string;
+  /** The Team identifier to perform the request on behalf of. */
+  teamId?: string;
+  /** The Team slug to perform the request on behalf of. */
+  slug?: string;
+}
+export const GetKmsIssuerRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    issuerId: S.String.pipe(T.Label()),
+    teamId: S.optional(S.String.pipe(T.Query())),
+    slug: S.optional(S.String.pipe(T.Query())),
+  }).pipe(
+    T.Http({ method: "GET", uri: "/v1/kms/issuers/{issuerId}", code: 200 }),
+  ),
+).annotate({
+  identifier: "GetKmsIssuerRequest",
+}) as any as S.Schema<GetKmsIssuerRequest>;
+
+export type GetKmsIssuerResponseAlgorithm =
+  | "ES256"
+  | "ES384"
+  | "ES512"
+  | "EdDSA"
+  | "PS256"
+  | "PS384"
+  | "PS512"
+  | "RS256"
+  | "RS384"
+  | "RS512";
+export const GetKmsIssuerResponseAlgorithm = /*@__PURE__*/ S.String;
+
+export type GetKmsIssuerResponseOrigin = "external" | "vercel";
+export const GetKmsIssuerResponseOrigin = /*@__PURE__*/ S.String;
+
+export type GetKmsIssuerResponseClaimsSchemaMap = {
+  [key: string]: unknown | undefined;
+};
+export const GetKmsIssuerResponseClaimsSchemaMap = /*@__PURE__*/ S.Record(
+  S.String,
+  S.Unknown,
+) as any as S.Schema<GetKmsIssuerResponseClaimsSchemaMap>;
+
+export type GetKmsIssuerResponseSigningKeysItemStatus =
+  | "active"
+  | "pending"
+  | "revoking";
+export const GetKmsIssuerResponseSigningKeysItemStatus = /*@__PURE__*/ S.String;
+
+export type GetKmsIssuerResponseSigningKeysItemPublicKeyKeyOpsList =
+  Array<string>;
+export const GetKmsIssuerResponseSigningKeysItemPublicKeyKeyOpsList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<GetKmsIssuerResponseSigningKeysItemPublicKeyKeyOpsList>;
+
+/** The X.509 certificate chain (RFC 7517 §4.7). Each entry is the base64 DER (not base64url) of a certificate. For keys minted with a stored certificate this holds the single self-signed cert as `[x5c]`. */
+export type GetKmsIssuerResponseSigningKeysItemPublicKeyX5cList = Array<string>;
+export const GetKmsIssuerResponseSigningKeysItemPublicKeyX5cList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<GetKmsIssuerResponseSigningKeysItemPublicKeyX5cList>;
+
+export interface GetKmsIssuerResponseSigningKeysItemPublicKey {
+  kty?: string;
+  kid?: string;
+  alg?: string;
+  use?: string;
+  key_ops?: GetKmsIssuerResponseSigningKeysItemPublicKeyKeyOpsList;
+  /** The X.509 certificate chain (RFC 7517 §4.7). Each entry is the base64 DER (not base64url) of a certificate. For keys minted with a stored certificate this holds the single self-signed cert as `[x5c]`. */
+  x5c?: GetKmsIssuerResponseSigningKeysItemPublicKeyX5cList;
+  /** The base64url SHA-256 thumbprint of the DER certificate in `x5c[0]` (RFC 7517 §4.9). */
+  x5t_S256?: string;
+}
+export const GetKmsIssuerResponseSigningKeysItemPublicKey =
+  /*@__PURE__*/ S.suspend(() =>
+    S.Struct({
+      kty: S.optional(S.String),
+      kid: S.optional(S.String),
+      alg: S.optional(S.String),
+      use: S.optional(S.String),
+      key_ops: S.optional(
+        GetKmsIssuerResponseSigningKeysItemPublicKeyKeyOpsList,
+      ),
+      x5c: S.optional(GetKmsIssuerResponseSigningKeysItemPublicKeyX5cList),
+      x5t_S256: S.optional(S.String.pipe(T.Body("x5t#S256"))),
+    }),
+  ).annotate({
+    identifier: "GetKmsIssuerResponseSigningKeysItemPublicKey",
+  }) as any as S.Schema<GetKmsIssuerResponseSigningKeysItemPublicKey>;
+
+export interface GetKmsIssuerResponseSigningKeysItem {
+  /** The server-minted, unique record identifier. Use this to address the key on the activate / certificate endpoints. */
+  keyId: string;
+  /** The caller-supplied key id (imported keys only), used as the JWT/JWKS `kid`. Not unique across an issuer's keys; omitted for generated keys. */
+  importKeyId?: string;
+  issuerId: string;
+  algorithm: string;
+  status: GetKmsIssuerResponseSigningKeysItemStatus;
+  publicKey?: GetKmsIssuerResponseSigningKeysItemPublicKey;
+  publicKeyFingerprint?: string;
+  /** The public key in SPKI PEM form, ready to render. Present whenever the key has public key material. Derived from `publicKey`; the embedded certificate members (`x5c`/`x5t#S256`) do not affect it. */
+  publicKeyPem?: string;
+  /** The stored X.509 certificate (from `publicKey.x5c[0]`) in PEM form, ready to render. Present only for keys created with a stored certificate; omitted for keys created before certificates were stored. */
+  certificatePem?: string;
+  createdAt: string;
+  updatedAt: string;
+  revokeAt?: string;
+  activateAt?: string;
+  /** When the key became the active signer. Present for active and revoking keys (and absent for pending keys and rows predating this field). */
+  activatedAt?: string;
+}
+export const GetKmsIssuerResponseSigningKeysItem = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    keyId: S.String,
+    importKeyId: S.optional(S.String),
+    issuerId: S.String,
+    algorithm: S.String,
+    status: GetKmsIssuerResponseSigningKeysItemStatus,
+    publicKey: S.optional(GetKmsIssuerResponseSigningKeysItemPublicKey),
+    publicKeyFingerprint: S.optional(S.String),
+    publicKeyPem: S.optional(S.String),
+    certificatePem: S.optional(S.String),
+    createdAt: S.String,
+    updatedAt: S.String,
+    revokeAt: S.optional(S.String),
+    activateAt: S.optional(S.String),
+    activatedAt: S.optional(S.String),
+  }),
+).annotate({
+  identifier: "GetKmsIssuerResponseSigningKeysItem",
+}) as any as S.Schema<GetKmsIssuerResponseSigningKeysItem>;
+
+export type GetKmsIssuerResponseSigningKeysList =
+  Array<GetKmsIssuerResponseSigningKeysItem>;
+export const GetKmsIssuerResponseSigningKeysList = /*@__PURE__*/ S.Array(
+  GetKmsIssuerResponseSigningKeysItem,
+) as any as S.Schema<GetKmsIssuerResponseSigningKeysList>;
+
+export type GetKmsIssuerResponsePoliciesItemCase0Kind = "project-grant";
+export const GetKmsIssuerResponsePoliciesItemCase0Kind = /*@__PURE__*/ S.String;
+
+/** Environments whose OIDC tokens this grant authorizes. Each entry is either a system environment slug (`production`, `preview`, `development`) or a custom environment ID (prefixed `env_`). Custom environments are matched against the token's `custom_environment_id` claim (the stable ID); system environments against its `environment` claim. */
+export type GetKmsIssuerResponsePoliciesItemCase0EnvironmentsList =
+  Array<string>;
+export const GetKmsIssuerResponsePoliciesItemCase0EnvironmentsList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<GetKmsIssuerResponsePoliciesItemCase0EnvironmentsList>;
+
+export type GetKmsIssuerResponsePoliciesItemCase0TokenClaimsMap = {
+  [key: string]: unknown | undefined;
+};
+export const GetKmsIssuerResponsePoliciesItemCase0TokenClaimsMap =
+  /*@__PURE__*/ S.Record(
+    S.String,
+    S.Unknown,
+  ) as any as S.Schema<GetKmsIssuerResponsePoliciesItemCase0TokenClaimsMap>;
+
+export interface GetKmsIssuerResponsePoliciesItemCase0 {
+  kind: GetKmsIssuerResponsePoliciesItemCase0Kind;
+  teamId: string;
+  projectId: string;
+  /** Environments whose OIDC tokens this grant authorizes. Each entry is either a system environment slug (`production`, `preview`, `development`) or a custom environment ID (prefixed `env_`). Custom environments are matched against the token's `custom_environment_id` claim (the stable ID); system environments against its `environment` claim. */
+  environments: GetKmsIssuerResponsePoliciesItemCase0EnvironmentsList;
+  tokenClaims?: GetKmsIssuerResponsePoliciesItemCase0TokenClaimsMap;
+  createdAt: string;
+  updatedAt: string;
+}
+export const GetKmsIssuerResponsePoliciesItemCase0 = /*@__PURE__*/ S.suspend(
+  () =>
+    S.Struct({
+      kind: GetKmsIssuerResponsePoliciesItemCase0Kind,
+      teamId: S.String,
+      projectId: S.String,
+      environments: GetKmsIssuerResponsePoliciesItemCase0EnvironmentsList,
+      tokenClaims: S.optional(
+        GetKmsIssuerResponsePoliciesItemCase0TokenClaimsMap,
+      ),
+      createdAt: S.String,
+      updatedAt: S.String,
+    }),
+).annotate({
+  identifier: "GetKmsIssuerResponsePoliciesItemCase0",
+}) as any as S.Schema<GetKmsIssuerResponsePoliciesItemCase0>;
+
+export type GetKmsIssuerResponsePoliciesItemCase1Kind = "connex-grant";
+export const GetKmsIssuerResponsePoliciesItemCase1Kind = /*@__PURE__*/ S.String;
+
+export type GetKmsIssuerResponsePoliciesItemCase1TokenClaimsMap = {
+  [key: string]: unknown | undefined;
+};
+export const GetKmsIssuerResponsePoliciesItemCase1TokenClaimsMap =
+  /*@__PURE__*/ S.Record(
+    S.String,
+    S.Unknown,
+  ) as any as S.Schema<GetKmsIssuerResponsePoliciesItemCase1TokenClaimsMap>;
+
+export interface GetKmsIssuerResponsePoliciesItemCase1 {
+  kind: GetKmsIssuerResponsePoliciesItemCase1Kind;
+  clientId: string;
+  tokenClaims?: GetKmsIssuerResponsePoliciesItemCase1TokenClaimsMap;
+  createdAt: string;
+  updatedAt: string;
+}
+export const GetKmsIssuerResponsePoliciesItemCase1 = /*@__PURE__*/ S.suspend(
+  () =>
+    S.Struct({
+      kind: GetKmsIssuerResponsePoliciesItemCase1Kind,
+      clientId: S.String,
+      tokenClaims: S.optional(
+        GetKmsIssuerResponsePoliciesItemCase1TokenClaimsMap,
+      ),
+      createdAt: S.String,
+      updatedAt: S.String,
+    }),
+).annotate({
+  identifier: "GetKmsIssuerResponsePoliciesItemCase1",
+}) as any as S.Schema<GetKmsIssuerResponsePoliciesItemCase1>;
+
+export type GetKmsIssuerResponsePoliciesItem =
+  | GetKmsIssuerResponsePoliciesItemCase0
+  | GetKmsIssuerResponsePoliciesItemCase1;
+export const GetKmsIssuerResponsePoliciesItem =
+  /*@__PURE__*/ S.Unknown as any as S.Schema<GetKmsIssuerResponsePoliciesItem>;
+
+export type GetKmsIssuerResponsePoliciesList =
+  Array<GetKmsIssuerResponsePoliciesItem>;
+export const GetKmsIssuerResponsePoliciesList = /*@__PURE__*/ S.Array(
+  GetKmsIssuerResponsePoliciesItem,
+) as any as S.Schema<GetKmsIssuerResponsePoliciesList>;
+
+export interface GetKmsIssuerResponse {
+  id: string;
+  ownerId: string;
+  name: string;
+  algorithm: GetKmsIssuerResponseAlgorithm;
+  origin: GetKmsIssuerResponseOrigin;
+  managedBy?: string;
+  claimsSchema?: GetKmsIssuerResponseClaimsSchemaMap;
+  createdAt: string;
+  updatedAt: string;
+  signingKeys: GetKmsIssuerResponseSigningKeysList;
+  policies: GetKmsIssuerResponsePoliciesList;
+}
+export const GetKmsIssuerResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    id: S.String,
+    ownerId: S.String,
+    name: S.String,
+    algorithm: GetKmsIssuerResponseAlgorithm,
+    origin: GetKmsIssuerResponseOrigin,
+    managedBy: S.optional(S.String),
+    claimsSchema: S.optional(GetKmsIssuerResponseClaimsSchemaMap),
+    createdAt: S.String,
+    updatedAt: S.String,
+    signingKeys: GetKmsIssuerResponseSigningKeysList,
+    policies: GetKmsIssuerResponsePoliciesList,
+  }),
+).annotate({
+  identifier: "GetKmsIssuerResponse",
+}) as any as S.Schema<GetKmsIssuerResponse>;
+
+export interface ListKmsIssuersRequest {
+  /** Maximum number of issuers to return. */
+  limit?: number;
+  /** Continuation cursor to retrieve the next page of results. */
+  next?: string;
+  /** The Team identifier to perform the request on behalf of. */
+  teamId?: string;
+  /** The Team slug to perform the request on behalf of. */
+  slug?: string;
+}
+export const ListKmsIssuersRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    limit: S.optional(S.Number.pipe(T.Query())),
+    next: S.optional(S.String.pipe(T.Query())),
+    teamId: S.optional(S.String.pipe(T.Query())),
+    slug: S.optional(S.String.pipe(T.Query())),
+  }).pipe(T.Http({ method: "GET", uri: "/v1/kms/issuers", code: 200 })),
+).annotate({
+  identifier: "ListKmsIssuersRequest",
+}) as any as S.Schema<ListKmsIssuersRequest>;
+
+export type ListKmsIssuersResponseIssuersItemAlgorithm =
+  | "ES256"
+  | "ES384"
+  | "ES512"
+  | "EdDSA"
+  | "PS256"
+  | "PS384"
+  | "PS512"
+  | "RS256"
+  | "RS384"
+  | "RS512";
+export const ListKmsIssuersResponseIssuersItemAlgorithm =
+  /*@__PURE__*/ S.String;
+
+export type ListKmsIssuersResponseIssuersItemOrigin = "external" | "vercel";
+export const ListKmsIssuersResponseIssuersItemOrigin = /*@__PURE__*/ S.String;
+
+export type ListKmsIssuersResponseIssuersItemClaimsSchemaMap = {
+  [key: string]: unknown | undefined;
+};
+export const ListKmsIssuersResponseIssuersItemClaimsSchemaMap =
+  /*@__PURE__*/ S.Record(
+    S.String,
+    S.Unknown,
+  ) as any as S.Schema<ListKmsIssuersResponseIssuersItemClaimsSchemaMap>;
+
+export type ListKmsIssuersResponseIssuersItemSigningKeysItemStatus =
+  | "active"
+  | "pending"
+  | "revoking";
+export const ListKmsIssuersResponseIssuersItemSigningKeysItemStatus =
+  /*@__PURE__*/ S.String;
+
+export type ListKmsIssuersResponseIssuersItemSigningKeysItemPublicKeyKeyOpsList =
+  Array<string>;
+export const ListKmsIssuersResponseIssuersItemSigningKeysItemPublicKeyKeyOpsList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<ListKmsIssuersResponseIssuersItemSigningKeysItemPublicKeyKeyOpsList>;
+
+/** The X.509 certificate chain (RFC 7517 §4.7). Each entry is the base64 DER (not base64url) of a certificate. For keys minted with a stored certificate this holds the single self-signed cert as `[x5c]`. */
+export type ListKmsIssuersResponseIssuersItemSigningKeysItemPublicKeyX5cList =
+  Array<string>;
+export const ListKmsIssuersResponseIssuersItemSigningKeysItemPublicKeyX5cList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<ListKmsIssuersResponseIssuersItemSigningKeysItemPublicKeyX5cList>;
+
+export interface ListKmsIssuersResponseIssuersItemSigningKeysItemPublicKey {
+  kty?: string;
+  kid?: string;
+  alg?: string;
+  use?: string;
+  key_ops?: ListKmsIssuersResponseIssuersItemSigningKeysItemPublicKeyKeyOpsList;
+  /** The X.509 certificate chain (RFC 7517 §4.7). Each entry is the base64 DER (not base64url) of a certificate. For keys minted with a stored certificate this holds the single self-signed cert as `[x5c]`. */
+  x5c?: ListKmsIssuersResponseIssuersItemSigningKeysItemPublicKeyX5cList;
+  /** The base64url SHA-256 thumbprint of the DER certificate in `x5c[0]` (RFC 7517 §4.9). */
+  x5t_S256?: string;
+}
+export const ListKmsIssuersResponseIssuersItemSigningKeysItemPublicKey =
+  /*@__PURE__*/ S.suspend(() =>
+    S.Struct({
+      kty: S.optional(S.String),
+      kid: S.optional(S.String),
+      alg: S.optional(S.String),
+      use: S.optional(S.String),
+      key_ops: S.optional(
+        ListKmsIssuersResponseIssuersItemSigningKeysItemPublicKeyKeyOpsList,
+      ),
+      x5c: S.optional(
+        ListKmsIssuersResponseIssuersItemSigningKeysItemPublicKeyX5cList,
+      ),
+      x5t_S256: S.optional(S.String.pipe(T.Body("x5t#S256"))),
+    }),
+  ).annotate({
+    identifier: "ListKmsIssuersResponseIssuersItemSigningKeysItemPublicKey",
+  }) as any as S.Schema<ListKmsIssuersResponseIssuersItemSigningKeysItemPublicKey>;
+
+export interface ListKmsIssuersResponseIssuersItemSigningKeysItem {
+  /** The server-minted, unique record identifier. Use this to address the key on the activate / certificate endpoints. */
+  keyId: string;
+  /** The caller-supplied key id (imported keys only), used as the JWT/JWKS `kid`. Not unique across an issuer's keys; omitted for generated keys. */
+  importKeyId?: string;
+  issuerId: string;
+  algorithm: string;
+  status: ListKmsIssuersResponseIssuersItemSigningKeysItemStatus;
+  publicKey?: ListKmsIssuersResponseIssuersItemSigningKeysItemPublicKey;
+  publicKeyFingerprint?: string;
+  /** The public key in SPKI PEM form, ready to render. Present whenever the key has public key material. Derived from `publicKey`; the embedded certificate members (`x5c`/`x5t#S256`) do not affect it. */
+  publicKeyPem?: string;
+  /** The stored X.509 certificate (from `publicKey.x5c[0]`) in PEM form, ready to render. Present only for keys created with a stored certificate; omitted for keys created before certificates were stored. */
+  certificatePem?: string;
+  createdAt: string;
+  updatedAt: string;
+  revokeAt?: string;
+  activateAt?: string;
+  /** When the key became the active signer. Present for active and revoking keys (and absent for pending keys and rows predating this field). */
+  activatedAt?: string;
+}
+export const ListKmsIssuersResponseIssuersItemSigningKeysItem =
+  /*@__PURE__*/ S.suspend(() =>
+    S.Struct({
+      keyId: S.String,
+      importKeyId: S.optional(S.String),
+      issuerId: S.String,
+      algorithm: S.String,
+      status: ListKmsIssuersResponseIssuersItemSigningKeysItemStatus,
+      publicKey: S.optional(
+        ListKmsIssuersResponseIssuersItemSigningKeysItemPublicKey,
+      ),
+      publicKeyFingerprint: S.optional(S.String),
+      publicKeyPem: S.optional(S.String),
+      certificatePem: S.optional(S.String),
+      createdAt: S.String,
+      updatedAt: S.String,
+      revokeAt: S.optional(S.String),
+      activateAt: S.optional(S.String),
+      activatedAt: S.optional(S.String),
+    }),
+  ).annotate({
+    identifier: "ListKmsIssuersResponseIssuersItemSigningKeysItem",
+  }) as any as S.Schema<ListKmsIssuersResponseIssuersItemSigningKeysItem>;
+
+export type ListKmsIssuersResponseIssuersItemSigningKeysList =
+  Array<ListKmsIssuersResponseIssuersItemSigningKeysItem>;
+export const ListKmsIssuersResponseIssuersItemSigningKeysList =
+  /*@__PURE__*/ S.Array(
+    ListKmsIssuersResponseIssuersItemSigningKeysItem,
+  ) as any as S.Schema<ListKmsIssuersResponseIssuersItemSigningKeysList>;
+
+export type ListKmsIssuersResponseIssuersItemPoliciesItemCase0Kind =
+  "project-grant";
+export const ListKmsIssuersResponseIssuersItemPoliciesItemCase0Kind =
+  /*@__PURE__*/ S.String;
+
+/** Environments whose OIDC tokens this grant authorizes. Each entry is either a system environment slug (`production`, `preview`, `development`) or a custom environment ID (prefixed `env_`). Custom environments are matched against the token's `custom_environment_id` claim (the stable ID); system environments against its `environment` claim. */
+export type ListKmsIssuersResponseIssuersItemPoliciesItemCase0EnvironmentsList =
+  Array<string>;
+export const ListKmsIssuersResponseIssuersItemPoliciesItemCase0EnvironmentsList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<ListKmsIssuersResponseIssuersItemPoliciesItemCase0EnvironmentsList>;
+
+export type ListKmsIssuersResponseIssuersItemPoliciesItemCase0TokenClaimsMap = {
+  [key: string]: unknown | undefined;
+};
+export const ListKmsIssuersResponseIssuersItemPoliciesItemCase0TokenClaimsMap =
+  /*@__PURE__*/ S.Record(
+    S.String,
+    S.Unknown,
+  ) as any as S.Schema<ListKmsIssuersResponseIssuersItemPoliciesItemCase0TokenClaimsMap>;
+
+export interface ListKmsIssuersResponseIssuersItemPoliciesItemCase0 {
+  kind: ListKmsIssuersResponseIssuersItemPoliciesItemCase0Kind;
+  teamId: string;
+  projectId: string;
+  /** Environments whose OIDC tokens this grant authorizes. Each entry is either a system environment slug (`production`, `preview`, `development`) or a custom environment ID (prefixed `env_`). Custom environments are matched against the token's `custom_environment_id` claim (the stable ID); system environments against its `environment` claim. */
+  environments: ListKmsIssuersResponseIssuersItemPoliciesItemCase0EnvironmentsList;
+  tokenClaims?: ListKmsIssuersResponseIssuersItemPoliciesItemCase0TokenClaimsMap;
+  createdAt: string;
+  updatedAt: string;
+}
+export const ListKmsIssuersResponseIssuersItemPoliciesItemCase0 =
+  /*@__PURE__*/ S.suspend(() =>
+    S.Struct({
+      kind: ListKmsIssuersResponseIssuersItemPoliciesItemCase0Kind,
+      teamId: S.String,
+      projectId: S.String,
+      environments:
+        ListKmsIssuersResponseIssuersItemPoliciesItemCase0EnvironmentsList,
+      tokenClaims: S.optional(
+        ListKmsIssuersResponseIssuersItemPoliciesItemCase0TokenClaimsMap,
+      ),
+      createdAt: S.String,
+      updatedAt: S.String,
+    }),
+  ).annotate({
+    identifier: "ListKmsIssuersResponseIssuersItemPoliciesItemCase0",
+  }) as any as S.Schema<ListKmsIssuersResponseIssuersItemPoliciesItemCase0>;
+
+export type ListKmsIssuersResponseIssuersItemPoliciesItemCase1Kind =
+  "connex-grant";
+export const ListKmsIssuersResponseIssuersItemPoliciesItemCase1Kind =
+  /*@__PURE__*/ S.String;
+
+export type ListKmsIssuersResponseIssuersItemPoliciesItemCase1TokenClaimsMap = {
+  [key: string]: unknown | undefined;
+};
+export const ListKmsIssuersResponseIssuersItemPoliciesItemCase1TokenClaimsMap =
+  /*@__PURE__*/ S.Record(
+    S.String,
+    S.Unknown,
+  ) as any as S.Schema<ListKmsIssuersResponseIssuersItemPoliciesItemCase1TokenClaimsMap>;
+
+export interface ListKmsIssuersResponseIssuersItemPoliciesItemCase1 {
+  kind: ListKmsIssuersResponseIssuersItemPoliciesItemCase1Kind;
+  clientId: string;
+  tokenClaims?: ListKmsIssuersResponseIssuersItemPoliciesItemCase1TokenClaimsMap;
+  createdAt: string;
+  updatedAt: string;
+}
+export const ListKmsIssuersResponseIssuersItemPoliciesItemCase1 =
+  /*@__PURE__*/ S.suspend(() =>
+    S.Struct({
+      kind: ListKmsIssuersResponseIssuersItemPoliciesItemCase1Kind,
+      clientId: S.String,
+      tokenClaims: S.optional(
+        ListKmsIssuersResponseIssuersItemPoliciesItemCase1TokenClaimsMap,
+      ),
+      createdAt: S.String,
+      updatedAt: S.String,
+    }),
+  ).annotate({
+    identifier: "ListKmsIssuersResponseIssuersItemPoliciesItemCase1",
+  }) as any as S.Schema<ListKmsIssuersResponseIssuersItemPoliciesItemCase1>;
+
+export type ListKmsIssuersResponseIssuersItemPoliciesItem =
+  | ListKmsIssuersResponseIssuersItemPoliciesItemCase0
+  | ListKmsIssuersResponseIssuersItemPoliciesItemCase1;
+export const ListKmsIssuersResponseIssuersItemPoliciesItem =
+  /*@__PURE__*/ S.Unknown as any as S.Schema<ListKmsIssuersResponseIssuersItemPoliciesItem>;
+
+export type ListKmsIssuersResponseIssuersItemPoliciesList =
+  Array<ListKmsIssuersResponseIssuersItemPoliciesItem>;
+export const ListKmsIssuersResponseIssuersItemPoliciesList =
+  /*@__PURE__*/ S.Array(
+    ListKmsIssuersResponseIssuersItemPoliciesItem,
+  ) as any as S.Schema<ListKmsIssuersResponseIssuersItemPoliciesList>;
+
+export interface ListKmsIssuersResponseIssuersItem {
+  id: string;
+  ownerId: string;
+  name: string;
+  algorithm: ListKmsIssuersResponseIssuersItemAlgorithm;
+  origin: ListKmsIssuersResponseIssuersItemOrigin;
+  managedBy?: string;
+  claimsSchema?: ListKmsIssuersResponseIssuersItemClaimsSchemaMap;
+  createdAt: string;
+  updatedAt: string;
+  signingKeys: ListKmsIssuersResponseIssuersItemSigningKeysList;
+  policies: ListKmsIssuersResponseIssuersItemPoliciesList;
+}
+export const ListKmsIssuersResponseIssuersItem = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    id: S.String,
+    ownerId: S.String,
+    name: S.String,
+    algorithm: ListKmsIssuersResponseIssuersItemAlgorithm,
+    origin: ListKmsIssuersResponseIssuersItemOrigin,
+    managedBy: S.optional(S.String),
+    claimsSchema: S.optional(ListKmsIssuersResponseIssuersItemClaimsSchemaMap),
+    createdAt: S.String,
+    updatedAt: S.String,
+    signingKeys: ListKmsIssuersResponseIssuersItemSigningKeysList,
+    policies: ListKmsIssuersResponseIssuersItemPoliciesList,
+  }),
+).annotate({
+  identifier: "ListKmsIssuersResponseIssuersItem",
+}) as any as S.Schema<ListKmsIssuersResponseIssuersItem>;
+
+export type ListKmsIssuersResponseIssuersList =
+  Array<ListKmsIssuersResponseIssuersItem>;
+export const ListKmsIssuersResponseIssuersList = /*@__PURE__*/ S.Array(
+  ListKmsIssuersResponseIssuersItem,
+) as any as S.Schema<ListKmsIssuersResponseIssuersList>;
+
+export interface ListKmsIssuersResponsePagination {
+  count: number;
+  next: string | null;
+}
+export const ListKmsIssuersResponsePagination = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    count: S.Number,
+    next: S.NullOr(S.String),
+  }),
+).annotate({
+  identifier: "ListKmsIssuersResponsePagination",
+}) as any as S.Schema<ListKmsIssuersResponsePagination>;
+
+export interface ListKmsIssuersResponse {
+  issuers: ListKmsIssuersResponseIssuersList;
+  pagination: ListKmsIssuersResponsePagination;
+}
+export const ListKmsIssuersResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    issuers: ListKmsIssuersResponseIssuersList,
+    pagination: ListKmsIssuersResponsePagination,
+  }),
+).annotate({
+  identifier: "ListKmsIssuersResponse",
+}) as any as S.Schema<ListKmsIssuersResponse>;
+
+export interface RevokeKmsSigningKeyRequest {
+  /** The ID of the issuer. */
+  issuerId: string;
+  /** The ID of the signing key to revoke immediately. The key must already be scheduled for revocation. */
+  keyId: string;
+  /** The Team identifier to perform the request on behalf of. */
+  teamId?: string;
+  /** The Team slug to perform the request on behalf of. */
+  slug?: string;
+}
+export const RevokeKmsSigningKeyRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    issuerId: S.String.pipe(T.Label()),
+    keyId: S.String.pipe(T.Label()),
+    teamId: S.optional(S.String.pipe(T.Query())),
+    slug: S.optional(S.String.pipe(T.Query())),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/v1/kms/issuers/{issuerId}/keys/{keyId}/revoke",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "RevokeKmsSigningKeyRequest",
+}) as any as S.Schema<RevokeKmsSigningKeyRequest>;
+
+export type RevokeKmsSigningKeyResponseAlgorithm =
+  | "ES256"
+  | "ES384"
+  | "ES512"
+  | "EdDSA"
+  | "PS256"
+  | "PS384"
+  | "PS512"
+  | "RS256"
+  | "RS384"
+  | "RS512";
+export const RevokeKmsSigningKeyResponseAlgorithm = /*@__PURE__*/ S.String;
+
+export type RevokeKmsSigningKeyResponseOrigin = "external" | "vercel";
+export const RevokeKmsSigningKeyResponseOrigin = /*@__PURE__*/ S.String;
+
+export type RevokeKmsSigningKeyResponseClaimsSchemaMap = {
+  [key: string]: unknown | undefined;
+};
+export const RevokeKmsSigningKeyResponseClaimsSchemaMap =
+  /*@__PURE__*/ S.Record(
+    S.String,
+    S.Unknown,
+  ) as any as S.Schema<RevokeKmsSigningKeyResponseClaimsSchemaMap>;
+
+export type RevokeKmsSigningKeyResponseSigningKeysItemStatus =
+  | "active"
+  | "pending"
+  | "revoking";
+export const RevokeKmsSigningKeyResponseSigningKeysItemStatus =
+  /*@__PURE__*/ S.String;
+
+export type RevokeKmsSigningKeyResponseSigningKeysItemPublicKeyKeyOpsList =
+  Array<string>;
+export const RevokeKmsSigningKeyResponseSigningKeysItemPublicKeyKeyOpsList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<RevokeKmsSigningKeyResponseSigningKeysItemPublicKeyKeyOpsList>;
+
+/** The X.509 certificate chain (RFC 7517 §4.7). Each entry is the base64 DER (not base64url) of a certificate. For keys minted with a stored certificate this holds the single self-signed cert as `[x5c]`. */
+export type RevokeKmsSigningKeyResponseSigningKeysItemPublicKeyX5cList =
+  Array<string>;
+export const RevokeKmsSigningKeyResponseSigningKeysItemPublicKeyX5cList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<RevokeKmsSigningKeyResponseSigningKeysItemPublicKeyX5cList>;
+
+export interface RevokeKmsSigningKeyResponseSigningKeysItemPublicKey {
+  kty?: string;
+  kid?: string;
+  alg?: string;
+  use?: string;
+  key_ops?: RevokeKmsSigningKeyResponseSigningKeysItemPublicKeyKeyOpsList;
+  /** The X.509 certificate chain (RFC 7517 §4.7). Each entry is the base64 DER (not base64url) of a certificate. For keys minted with a stored certificate this holds the single self-signed cert as `[x5c]`. */
+  x5c?: RevokeKmsSigningKeyResponseSigningKeysItemPublicKeyX5cList;
+  /** The base64url SHA-256 thumbprint of the DER certificate in `x5c[0]` (RFC 7517 §4.9). */
+  x5t_S256?: string;
+}
+export const RevokeKmsSigningKeyResponseSigningKeysItemPublicKey =
+  /*@__PURE__*/ S.suspend(() =>
+    S.Struct({
+      kty: S.optional(S.String),
+      kid: S.optional(S.String),
+      alg: S.optional(S.String),
+      use: S.optional(S.String),
+      key_ops: S.optional(
+        RevokeKmsSigningKeyResponseSigningKeysItemPublicKeyKeyOpsList,
+      ),
+      x5c: S.optional(
+        RevokeKmsSigningKeyResponseSigningKeysItemPublicKeyX5cList,
+      ),
+      x5t_S256: S.optional(S.String.pipe(T.Body("x5t#S256"))),
+    }),
+  ).annotate({
+    identifier: "RevokeKmsSigningKeyResponseSigningKeysItemPublicKey",
+  }) as any as S.Schema<RevokeKmsSigningKeyResponseSigningKeysItemPublicKey>;
+
+export interface RevokeKmsSigningKeyResponseSigningKeysItem {
+  /** The server-minted, unique record identifier. Use this to address the key on the activate / certificate endpoints. */
+  keyId: string;
+  /** The caller-supplied key id (imported keys only), used as the JWT/JWKS `kid`. Not unique across an issuer's keys; omitted for generated keys. */
+  importKeyId?: string;
+  issuerId: string;
+  algorithm: string;
+  status: RevokeKmsSigningKeyResponseSigningKeysItemStatus;
+  publicKey?: RevokeKmsSigningKeyResponseSigningKeysItemPublicKey;
+  publicKeyFingerprint?: string;
+  /** The public key in SPKI PEM form, ready to render. Present whenever the key has public key material. Derived from `publicKey`; the embedded certificate members (`x5c`/`x5t#S256`) do not affect it. */
+  publicKeyPem?: string;
+  /** The stored X.509 certificate (from `publicKey.x5c[0]`) in PEM form, ready to render. Present only for keys created with a stored certificate; omitted for keys created before certificates were stored. */
+  certificatePem?: string;
+  createdAt: string;
+  updatedAt: string;
+  revokeAt?: string;
+  activateAt?: string;
+  /** When the key became the active signer. Present for active and revoking keys (and absent for pending keys and rows predating this field). */
+  activatedAt?: string;
+}
+export const RevokeKmsSigningKeyResponseSigningKeysItem =
+  /*@__PURE__*/ S.suspend(() =>
+    S.Struct({
+      keyId: S.String,
+      importKeyId: S.optional(S.String),
+      issuerId: S.String,
+      algorithm: S.String,
+      status: RevokeKmsSigningKeyResponseSigningKeysItemStatus,
+      publicKey: S.optional(
+        RevokeKmsSigningKeyResponseSigningKeysItemPublicKey,
+      ),
+      publicKeyFingerprint: S.optional(S.String),
+      publicKeyPem: S.optional(S.String),
+      certificatePem: S.optional(S.String),
+      createdAt: S.String,
+      updatedAt: S.String,
+      revokeAt: S.optional(S.String),
+      activateAt: S.optional(S.String),
+      activatedAt: S.optional(S.String),
+    }),
+  ).annotate({
+    identifier: "RevokeKmsSigningKeyResponseSigningKeysItem",
+  }) as any as S.Schema<RevokeKmsSigningKeyResponseSigningKeysItem>;
+
+export type RevokeKmsSigningKeyResponseSigningKeysList =
+  Array<RevokeKmsSigningKeyResponseSigningKeysItem>;
+export const RevokeKmsSigningKeyResponseSigningKeysList = /*@__PURE__*/ S.Array(
+  RevokeKmsSigningKeyResponseSigningKeysItem,
+) as any as S.Schema<RevokeKmsSigningKeyResponseSigningKeysList>;
+
+export type RevokeKmsSigningKeyResponsePoliciesItemCase0Kind = "project-grant";
+export const RevokeKmsSigningKeyResponsePoliciesItemCase0Kind =
+  /*@__PURE__*/ S.String;
+
+/** Environments whose OIDC tokens this grant authorizes. Each entry is either a system environment slug (`production`, `preview`, `development`) or a custom environment ID (prefixed `env_`). Custom environments are matched against the token's `custom_environment_id` claim (the stable ID); system environments against its `environment` claim. */
+export type RevokeKmsSigningKeyResponsePoliciesItemCase0EnvironmentsList =
+  Array<string>;
+export const RevokeKmsSigningKeyResponsePoliciesItemCase0EnvironmentsList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<RevokeKmsSigningKeyResponsePoliciesItemCase0EnvironmentsList>;
+
+export type RevokeKmsSigningKeyResponsePoliciesItemCase0TokenClaimsMap = {
+  [key: string]: unknown | undefined;
+};
+export const RevokeKmsSigningKeyResponsePoliciesItemCase0TokenClaimsMap =
+  /*@__PURE__*/ S.Record(
+    S.String,
+    S.Unknown,
+  ) as any as S.Schema<RevokeKmsSigningKeyResponsePoliciesItemCase0TokenClaimsMap>;
+
+export interface RevokeKmsSigningKeyResponsePoliciesItemCase0 {
+  kind: RevokeKmsSigningKeyResponsePoliciesItemCase0Kind;
+  teamId: string;
+  projectId: string;
+  /** Environments whose OIDC tokens this grant authorizes. Each entry is either a system environment slug (`production`, `preview`, `development`) or a custom environment ID (prefixed `env_`). Custom environments are matched against the token's `custom_environment_id` claim (the stable ID); system environments against its `environment` claim. */
+  environments: RevokeKmsSigningKeyResponsePoliciesItemCase0EnvironmentsList;
+  tokenClaims?: RevokeKmsSigningKeyResponsePoliciesItemCase0TokenClaimsMap;
+  createdAt: string;
+  updatedAt: string;
+}
+export const RevokeKmsSigningKeyResponsePoliciesItemCase0 =
+  /*@__PURE__*/ S.suspend(() =>
+    S.Struct({
+      kind: RevokeKmsSigningKeyResponsePoliciesItemCase0Kind,
+      teamId: S.String,
+      projectId: S.String,
+      environments:
+        RevokeKmsSigningKeyResponsePoliciesItemCase0EnvironmentsList,
+      tokenClaims: S.optional(
+        RevokeKmsSigningKeyResponsePoliciesItemCase0TokenClaimsMap,
+      ),
+      createdAt: S.String,
+      updatedAt: S.String,
+    }),
+  ).annotate({
+    identifier: "RevokeKmsSigningKeyResponsePoliciesItemCase0",
+  }) as any as S.Schema<RevokeKmsSigningKeyResponsePoliciesItemCase0>;
+
+export type RevokeKmsSigningKeyResponsePoliciesItemCase1Kind = "connex-grant";
+export const RevokeKmsSigningKeyResponsePoliciesItemCase1Kind =
+  /*@__PURE__*/ S.String;
+
+export type RevokeKmsSigningKeyResponsePoliciesItemCase1TokenClaimsMap = {
+  [key: string]: unknown | undefined;
+};
+export const RevokeKmsSigningKeyResponsePoliciesItemCase1TokenClaimsMap =
+  /*@__PURE__*/ S.Record(
+    S.String,
+    S.Unknown,
+  ) as any as S.Schema<RevokeKmsSigningKeyResponsePoliciesItemCase1TokenClaimsMap>;
+
+export interface RevokeKmsSigningKeyResponsePoliciesItemCase1 {
+  kind: RevokeKmsSigningKeyResponsePoliciesItemCase1Kind;
+  clientId: string;
+  tokenClaims?: RevokeKmsSigningKeyResponsePoliciesItemCase1TokenClaimsMap;
+  createdAt: string;
+  updatedAt: string;
+}
+export const RevokeKmsSigningKeyResponsePoliciesItemCase1 =
+  /*@__PURE__*/ S.suspend(() =>
+    S.Struct({
+      kind: RevokeKmsSigningKeyResponsePoliciesItemCase1Kind,
+      clientId: S.String,
+      tokenClaims: S.optional(
+        RevokeKmsSigningKeyResponsePoliciesItemCase1TokenClaimsMap,
+      ),
+      createdAt: S.String,
+      updatedAt: S.String,
+    }),
+  ).annotate({
+    identifier: "RevokeKmsSigningKeyResponsePoliciesItemCase1",
+  }) as any as S.Schema<RevokeKmsSigningKeyResponsePoliciesItemCase1>;
+
+export type RevokeKmsSigningKeyResponsePoliciesItem =
+  | RevokeKmsSigningKeyResponsePoliciesItemCase0
+  | RevokeKmsSigningKeyResponsePoliciesItemCase1;
+export const RevokeKmsSigningKeyResponsePoliciesItem =
+  /*@__PURE__*/ S.Unknown as any as S.Schema<RevokeKmsSigningKeyResponsePoliciesItem>;
+
+export type RevokeKmsSigningKeyResponsePoliciesList =
+  Array<RevokeKmsSigningKeyResponsePoliciesItem>;
+export const RevokeKmsSigningKeyResponsePoliciesList = /*@__PURE__*/ S.Array(
+  RevokeKmsSigningKeyResponsePoliciesItem,
+) as any as S.Schema<RevokeKmsSigningKeyResponsePoliciesList>;
+
+export interface RevokeKmsSigningKeyResponse {
+  id: string;
+  ownerId: string;
+  name: string;
+  algorithm: RevokeKmsSigningKeyResponseAlgorithm;
+  origin: RevokeKmsSigningKeyResponseOrigin;
+  managedBy?: string;
+  claimsSchema?: RevokeKmsSigningKeyResponseClaimsSchemaMap;
+  createdAt: string;
+  updatedAt: string;
+  signingKeys: RevokeKmsSigningKeyResponseSigningKeysList;
+  policies: RevokeKmsSigningKeyResponsePoliciesList;
+}
+export const RevokeKmsSigningKeyResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    id: S.String,
+    ownerId: S.String,
+    name: S.String,
+    algorithm: RevokeKmsSigningKeyResponseAlgorithm,
+    origin: RevokeKmsSigningKeyResponseOrigin,
+    managedBy: S.optional(S.String),
+    claimsSchema: S.optional(RevokeKmsSigningKeyResponseClaimsSchemaMap),
+    createdAt: S.String,
+    updatedAt: S.String,
+    signingKeys: RevokeKmsSigningKeyResponseSigningKeysList,
+    policies: RevokeKmsSigningKeyResponsePoliciesList,
+  }),
+).annotate({
+  identifier: "RevokeKmsSigningKeyResponse",
+}) as any as S.Schema<RevokeKmsSigningKeyResponse>;
+
+export interface SignKmsMessageRequest {
+  /** The ID of the issuer. */
+  issuerId: string;
+  /** Base64-encoded message to be signed. */
+  message: string;
+}
+export const SignKmsMessageRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    issuerId: S.String.pipe(T.Label()),
+    message: S.String,
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/v1/kms/issuers/{issuerId}/sign/message",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "SignKmsMessageRequest",
+}) as any as S.Schema<SignKmsMessageRequest>;
+
+/** JWS "crit" (Critical) Header Parameter */
+export type SignKmsMessageResponseSignatureHeaderCritList = Array<string>;
+export const SignKmsMessageResponseSignatureHeaderCritList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<SignKmsMessageResponseSignatureHeaderCritList>;
+
+/** "x5c" (X.509 Certificate Chain) Header Parameter */
+export type SignKmsMessageResponseSignatureHeaderX5cList = Array<string>;
+export const SignKmsMessageResponseSignatureHeaderX5cList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<SignKmsMessageResponseSignatureHeaderX5cList>;
+
+/** "jwk" (JSON Web Key) Header Parameter */
+export interface SignKmsMessageResponseSignatureHeaderJwk {
+  /** RSA JWK "n" (Modulus) Parameter */
+  n?: string;
+  /** RSA JWK "e" (Exponent) Parameter */
+  e?: string;
+  /** JWK "kty" (Key Type) Parameter */
+  kty?: string;
+  /** - EC JWK "crv" (Curve) Parameter - OKP JWK "crv" (The Subtype of Key Pair) Parameter */
+  crv?: string;
+  /** - EC JWK "x" (X Coordinate) Parameter - OKP JWK "x" (The public key) Parameter */
+  x?: string;
+  /** EC JWK "y" (Y Coordinate) Parameter */
+  y?: string;
+  /** JWK "alg" (Algorithm) Parameter */
+  alg?: string;
+  /** AKP JWK "pub" (Public Key) Parameter */
+  pub?: string;
+}
+export const SignKmsMessageResponseSignatureHeaderJwk = /*@__PURE__*/ S.suspend(
+  () =>
+    S.Struct({
+      n: S.optional(S.String),
+      e: S.optional(S.String),
+      kty: S.optional(S.String),
+      crv: S.optional(S.String),
+      x: S.optional(S.String),
+      y: S.optional(S.String),
+      alg: S.optional(S.String),
+      pub: S.optional(S.String),
+    }),
+).annotate({
+  identifier: "SignKmsMessageResponseSignatureHeaderJwk",
+}) as any as S.Schema<SignKmsMessageResponseSignatureHeaderJwk>;
+
+/** The "header" member MUST be present and contain the value JWS Unprotected Header when the JWS Unprotected Header value is non- empty; otherwise, it MUST be absent. This value is represented as an unencoded JSON object, rather than as a string. These Header Parameter values are not integrity protected. */
+export interface SignKmsMessageResponseSignatureHeader {
+  /** JWS "alg" (Algorithm) Header Parameter */
+  alg?: string;
+  /** This JWS Extension Header Parameter modifies the JWS Payload representation and the JWS Signing Input computation as per {@link https://www.rfc-editor.org/rfc/rfc7797 RFC7797}. */
+  b64?: boolean;
+  /** JWS "crit" (Critical) Header Parameter */
+  crit?: SignKmsMessageResponseSignatureHeaderCritList;
+  /** "kid" (Key ID) Header Parameter */
+  kid?: string;
+  /** "x5t" (X.509 Certificate SHA-1 Thumbprint) Header Parameter */
+  x5t?: string;
+  /** "x5c" (X.509 Certificate Chain) Header Parameter */
+  x5c?: SignKmsMessageResponseSignatureHeaderX5cList;
+  /** "x5u" (X.509 URL) Header Parameter */
+  x5u?: string;
+  /** "jku" (JWK Set URL) Header Parameter */
+  jku?: string;
+  /** "jwk" (JSON Web Key) Header Parameter */
+  jwk?: SignKmsMessageResponseSignatureHeaderJwk;
+  /** "typ" (Type) Header Parameter */
+  typ?: string;
+  /** "cty" (Content Type) Header Parameter */
+  cty?: string;
+}
+export const SignKmsMessageResponseSignatureHeader = /*@__PURE__*/ S.suspend(
+  () =>
+    S.Struct({
+      alg: S.optional(S.String),
+      b64: S.optional(S.Boolean),
+      crit: S.optional(SignKmsMessageResponseSignatureHeaderCritList),
+      kid: S.optional(S.String),
+      x5t: S.optional(S.String),
+      x5c: S.optional(SignKmsMessageResponseSignatureHeaderX5cList),
+      x5u: S.optional(S.String),
+      jku: S.optional(S.String),
+      jwk: S.optional(SignKmsMessageResponseSignatureHeaderJwk),
+      typ: S.optional(S.String),
+      cty: S.optional(S.String),
+    }),
+).annotate({
+  identifier: "SignKmsMessageResponseSignatureHeader",
+}) as any as S.Schema<SignKmsMessageResponseSignatureHeader>;
+
+/** Flattened JWS JSON Serialization Syntax token. Payload is returned as an empty string when JWS Unencoded Payload ({@link https://www.rfc-editor.org/rfc/rfc7797 RFC7797}) is used. */
+export interface SignKmsMessageResponseSignature {
+  payload: string;
+  signature: string;
+  /** The "header" member MUST be present and contain the value JWS Unprotected Header when the JWS Unprotected Header value is non- empty; otherwise, it MUST be absent. This value is represented as an unencoded JSON object, rather than as a string. These Header Parameter values are not integrity protected. */
+  header?: SignKmsMessageResponseSignatureHeader;
+  /** The "protected" member MUST be present and contain the value BASE64URL(UTF8(JWS Protected Header)) when the JWS Protected Header value is non-empty; otherwise, it MUST be absent. These Header Parameter values are integrity protected. */
+  protected?: string;
+}
+export const SignKmsMessageResponseSignature = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    payload: S.String,
+    signature: S.String,
+    header: S.optional(SignKmsMessageResponseSignatureHeader),
+    protected: S.optional(S.String),
+  }),
+).annotate({
+  identifier: "SignKmsMessageResponseSignature",
+}) as any as S.Schema<SignKmsMessageResponseSignature>;
+
+export interface SignKmsMessageResponse {
+  /** Flattened JWS JSON Serialization Syntax token. Payload is returned as an empty string when JWS Unencoded Payload ({@link https://www.rfc-editor.org/rfc/rfc7797 RFC7797}) is used. */
+  signature: SignKmsMessageResponseSignature;
+}
+export const SignKmsMessageResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    signature: SignKmsMessageResponseSignature,
+  }),
+).annotate({
+  identifier: "SignKmsMessageResponse",
+}) as any as S.Schema<SignKmsMessageResponse>;
+
+export interface SignKmsTokenRequest {
+  /** The ID of the issuer. */
+  issuerId: string;
+  /** The claims to include in the token. */
+  claims?: unknown;
+  /** Additional headers to include in the token. */
+  headers?: unknown;
+  /** The time-to-live for the token, in seconds. */
+  ttl?: number | null;
+}
+export const SignKmsTokenRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    issuerId: S.String.pipe(T.Label()),
+    claims: S.optional(S.Unknown),
+    headers: S.optional(S.Unknown),
+    ttl: S.optional(S.NullOr(S.Number)),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/v1/kms/issuers/{issuerId}/sign/token",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "SignKmsTokenRequest",
+}) as any as S.Schema<SignKmsTokenRequest>;
+
+export interface SignKmsTokenResponse {
+  token: string;
+}
+export const SignKmsTokenResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    token: S.String,
+  }),
+).annotate({
+  identifier: "SignKmsTokenResponse",
+}) as any as S.Schema<SignKmsTokenResponse>;
+
+/** A JSON Schema used to validate the resolved token claims when signing tokens for this issuer. Pass null to remove it. */
+export type UpdateKmsIssuerRequestClaimsSchemaMap = {
+  [key: string]: unknown | undefined;
+};
+export const UpdateKmsIssuerRequestClaimsSchemaMap = /*@__PURE__*/ S.Record(
+  S.String,
+  S.Unknown,
+) as any as S.Schema<UpdateKmsIssuerRequestClaimsSchemaMap>;
+
+export interface UpdateKmsIssuerRequest {
+  /** The ID of the issuer. */
+  issuerId: string;
+  /** The Team identifier to perform the request on behalf of. */
+  teamId?: string;
+  /** The Team slug to perform the request on behalf of. */
+  slug?: string;
+  /** The name of the issuer. */
+  name?: string;
+  /** A JSON Schema used to validate the resolved token claims when signing tokens for this issuer. Pass null to remove it. */
+  claimsSchema?: UpdateKmsIssuerRequestClaimsSchemaMap | null;
+}
+export const UpdateKmsIssuerRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    issuerId: S.String.pipe(T.Label()),
+    teamId: S.optional(S.String.pipe(T.Query())),
+    slug: S.optional(S.String.pipe(T.Query())),
+    name: S.optional(S.String),
+    claimsSchema: S.optional(S.NullOr(UpdateKmsIssuerRequestClaimsSchemaMap)),
+  }).pipe(
+    T.Http({ method: "PATCH", uri: "/v1/kms/issuers/{issuerId}", code: 200 }),
+  ),
+).annotate({
+  identifier: "UpdateKmsIssuerRequest",
+}) as any as S.Schema<UpdateKmsIssuerRequest>;
+
+export type UpdateKmsIssuerResponseAlgorithm =
+  | "ES256"
+  | "ES384"
+  | "ES512"
+  | "EdDSA"
+  | "PS256"
+  | "PS384"
+  | "PS512"
+  | "RS256"
+  | "RS384"
+  | "RS512";
+export const UpdateKmsIssuerResponseAlgorithm = /*@__PURE__*/ S.String;
+
+export type UpdateKmsIssuerResponseOrigin = "external" | "vercel";
+export const UpdateKmsIssuerResponseOrigin = /*@__PURE__*/ S.String;
+
+export type UpdateKmsIssuerResponseClaimsSchemaMap = {
+  [key: string]: unknown | undefined;
+};
+export const UpdateKmsIssuerResponseClaimsSchemaMap = /*@__PURE__*/ S.Record(
+  S.String,
+  S.Unknown,
+) as any as S.Schema<UpdateKmsIssuerResponseClaimsSchemaMap>;
+
+export type UpdateKmsIssuerResponseSigningKeysItemStatus =
+  | "active"
+  | "pending"
+  | "revoking";
+export const UpdateKmsIssuerResponseSigningKeysItemStatus =
+  /*@__PURE__*/ S.String;
+
+export type UpdateKmsIssuerResponseSigningKeysItemPublicKeyKeyOpsList =
+  Array<string>;
+export const UpdateKmsIssuerResponseSigningKeysItemPublicKeyKeyOpsList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<UpdateKmsIssuerResponseSigningKeysItemPublicKeyKeyOpsList>;
+
+/** The X.509 certificate chain (RFC 7517 §4.7). Each entry is the base64 DER (not base64url) of a certificate. For keys minted with a stored certificate this holds the single self-signed cert as `[x5c]`. */
+export type UpdateKmsIssuerResponseSigningKeysItemPublicKeyX5cList =
+  Array<string>;
+export const UpdateKmsIssuerResponseSigningKeysItemPublicKeyX5cList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<UpdateKmsIssuerResponseSigningKeysItemPublicKeyX5cList>;
+
+export interface UpdateKmsIssuerResponseSigningKeysItemPublicKey {
+  kty?: string;
+  kid?: string;
+  alg?: string;
+  use?: string;
+  key_ops?: UpdateKmsIssuerResponseSigningKeysItemPublicKeyKeyOpsList;
+  /** The X.509 certificate chain (RFC 7517 §4.7). Each entry is the base64 DER (not base64url) of a certificate. For keys minted with a stored certificate this holds the single self-signed cert as `[x5c]`. */
+  x5c?: UpdateKmsIssuerResponseSigningKeysItemPublicKeyX5cList;
+  /** The base64url SHA-256 thumbprint of the DER certificate in `x5c[0]` (RFC 7517 §4.9). */
+  x5t_S256?: string;
+}
+export const UpdateKmsIssuerResponseSigningKeysItemPublicKey =
+  /*@__PURE__*/ S.suspend(() =>
+    S.Struct({
+      kty: S.optional(S.String),
+      kid: S.optional(S.String),
+      alg: S.optional(S.String),
+      use: S.optional(S.String),
+      key_ops: S.optional(
+        UpdateKmsIssuerResponseSigningKeysItemPublicKeyKeyOpsList,
+      ),
+      x5c: S.optional(UpdateKmsIssuerResponseSigningKeysItemPublicKeyX5cList),
+      x5t_S256: S.optional(S.String.pipe(T.Body("x5t#S256"))),
+    }),
+  ).annotate({
+    identifier: "UpdateKmsIssuerResponseSigningKeysItemPublicKey",
+  }) as any as S.Schema<UpdateKmsIssuerResponseSigningKeysItemPublicKey>;
+
+export interface UpdateKmsIssuerResponseSigningKeysItem {
+  /** The server-minted, unique record identifier. Use this to address the key on the activate / certificate endpoints. */
+  keyId: string;
+  /** The caller-supplied key id (imported keys only), used as the JWT/JWKS `kid`. Not unique across an issuer's keys; omitted for generated keys. */
+  importKeyId?: string;
+  issuerId: string;
+  algorithm: string;
+  status: UpdateKmsIssuerResponseSigningKeysItemStatus;
+  publicKey?: UpdateKmsIssuerResponseSigningKeysItemPublicKey;
+  publicKeyFingerprint?: string;
+  /** The public key in SPKI PEM form, ready to render. Present whenever the key has public key material. Derived from `publicKey`; the embedded certificate members (`x5c`/`x5t#S256`) do not affect it. */
+  publicKeyPem?: string;
+  /** The stored X.509 certificate (from `publicKey.x5c[0]`) in PEM form, ready to render. Present only for keys created with a stored certificate; omitted for keys created before certificates were stored. */
+  certificatePem?: string;
+  createdAt: string;
+  updatedAt: string;
+  revokeAt?: string;
+  activateAt?: string;
+  /** When the key became the active signer. Present for active and revoking keys (and absent for pending keys and rows predating this field). */
+  activatedAt?: string;
+}
+export const UpdateKmsIssuerResponseSigningKeysItem = /*@__PURE__*/ S.suspend(
+  () =>
+    S.Struct({
+      keyId: S.String,
+      importKeyId: S.optional(S.String),
+      issuerId: S.String,
+      algorithm: S.String,
+      status: UpdateKmsIssuerResponseSigningKeysItemStatus,
+      publicKey: S.optional(UpdateKmsIssuerResponseSigningKeysItemPublicKey),
+      publicKeyFingerprint: S.optional(S.String),
+      publicKeyPem: S.optional(S.String),
+      certificatePem: S.optional(S.String),
+      createdAt: S.String,
+      updatedAt: S.String,
+      revokeAt: S.optional(S.String),
+      activateAt: S.optional(S.String),
+      activatedAt: S.optional(S.String),
+    }),
+).annotate({
+  identifier: "UpdateKmsIssuerResponseSigningKeysItem",
+}) as any as S.Schema<UpdateKmsIssuerResponseSigningKeysItem>;
+
+export type UpdateKmsIssuerResponseSigningKeysList =
+  Array<UpdateKmsIssuerResponseSigningKeysItem>;
+export const UpdateKmsIssuerResponseSigningKeysList = /*@__PURE__*/ S.Array(
+  UpdateKmsIssuerResponseSigningKeysItem,
+) as any as S.Schema<UpdateKmsIssuerResponseSigningKeysList>;
+
+export type UpdateKmsIssuerResponsePoliciesItemCase0Kind = "project-grant";
+export const UpdateKmsIssuerResponsePoliciesItemCase0Kind =
+  /*@__PURE__*/ S.String;
+
+/** Environments whose OIDC tokens this grant authorizes. Each entry is either a system environment slug (`production`, `preview`, `development`) or a custom environment ID (prefixed `env_`). Custom environments are matched against the token's `custom_environment_id` claim (the stable ID); system environments against its `environment` claim. */
+export type UpdateKmsIssuerResponsePoliciesItemCase0EnvironmentsList =
+  Array<string>;
+export const UpdateKmsIssuerResponsePoliciesItemCase0EnvironmentsList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<UpdateKmsIssuerResponsePoliciesItemCase0EnvironmentsList>;
+
+export type UpdateKmsIssuerResponsePoliciesItemCase0TokenClaimsMap = {
+  [key: string]: unknown | undefined;
+};
+export const UpdateKmsIssuerResponsePoliciesItemCase0TokenClaimsMap =
+  /*@__PURE__*/ S.Record(
+    S.String,
+    S.Unknown,
+  ) as any as S.Schema<UpdateKmsIssuerResponsePoliciesItemCase0TokenClaimsMap>;
+
+export interface UpdateKmsIssuerResponsePoliciesItemCase0 {
+  kind: UpdateKmsIssuerResponsePoliciesItemCase0Kind;
+  teamId: string;
+  projectId: string;
+  /** Environments whose OIDC tokens this grant authorizes. Each entry is either a system environment slug (`production`, `preview`, `development`) or a custom environment ID (prefixed `env_`). Custom environments are matched against the token's `custom_environment_id` claim (the stable ID); system environments against its `environment` claim. */
+  environments: UpdateKmsIssuerResponsePoliciesItemCase0EnvironmentsList;
+  tokenClaims?: UpdateKmsIssuerResponsePoliciesItemCase0TokenClaimsMap;
+  createdAt: string;
+  updatedAt: string;
+}
+export const UpdateKmsIssuerResponsePoliciesItemCase0 = /*@__PURE__*/ S.suspend(
+  () =>
+    S.Struct({
+      kind: UpdateKmsIssuerResponsePoliciesItemCase0Kind,
+      teamId: S.String,
+      projectId: S.String,
+      environments: UpdateKmsIssuerResponsePoliciesItemCase0EnvironmentsList,
+      tokenClaims: S.optional(
+        UpdateKmsIssuerResponsePoliciesItemCase0TokenClaimsMap,
+      ),
+      createdAt: S.String,
+      updatedAt: S.String,
+    }),
+).annotate({
+  identifier: "UpdateKmsIssuerResponsePoliciesItemCase0",
+}) as any as S.Schema<UpdateKmsIssuerResponsePoliciesItemCase0>;
+
+export type UpdateKmsIssuerResponsePoliciesItemCase1Kind = "connex-grant";
+export const UpdateKmsIssuerResponsePoliciesItemCase1Kind =
+  /*@__PURE__*/ S.String;
+
+export type UpdateKmsIssuerResponsePoliciesItemCase1TokenClaimsMap = {
+  [key: string]: unknown | undefined;
+};
+export const UpdateKmsIssuerResponsePoliciesItemCase1TokenClaimsMap =
+  /*@__PURE__*/ S.Record(
+    S.String,
+    S.Unknown,
+  ) as any as S.Schema<UpdateKmsIssuerResponsePoliciesItemCase1TokenClaimsMap>;
+
+export interface UpdateKmsIssuerResponsePoliciesItemCase1 {
+  kind: UpdateKmsIssuerResponsePoliciesItemCase1Kind;
+  clientId: string;
+  tokenClaims?: UpdateKmsIssuerResponsePoliciesItemCase1TokenClaimsMap;
+  createdAt: string;
+  updatedAt: string;
+}
+export const UpdateKmsIssuerResponsePoliciesItemCase1 = /*@__PURE__*/ S.suspend(
+  () =>
+    S.Struct({
+      kind: UpdateKmsIssuerResponsePoliciesItemCase1Kind,
+      clientId: S.String,
+      tokenClaims: S.optional(
+        UpdateKmsIssuerResponsePoliciesItemCase1TokenClaimsMap,
+      ),
+      createdAt: S.String,
+      updatedAt: S.String,
+    }),
+).annotate({
+  identifier: "UpdateKmsIssuerResponsePoliciesItemCase1",
+}) as any as S.Schema<UpdateKmsIssuerResponsePoliciesItemCase1>;
+
+export type UpdateKmsIssuerResponsePoliciesItem =
+  | UpdateKmsIssuerResponsePoliciesItemCase0
+  | UpdateKmsIssuerResponsePoliciesItemCase1;
+export const UpdateKmsIssuerResponsePoliciesItem =
+  /*@__PURE__*/ S.Unknown as any as S.Schema<UpdateKmsIssuerResponsePoliciesItem>;
+
+export type UpdateKmsIssuerResponsePoliciesList =
+  Array<UpdateKmsIssuerResponsePoliciesItem>;
+export const UpdateKmsIssuerResponsePoliciesList = /*@__PURE__*/ S.Array(
+  UpdateKmsIssuerResponsePoliciesItem,
+) as any as S.Schema<UpdateKmsIssuerResponsePoliciesList>;
+
+export interface UpdateKmsIssuerResponse {
+  id: string;
+  ownerId: string;
+  name: string;
+  algorithm: UpdateKmsIssuerResponseAlgorithm;
+  origin: UpdateKmsIssuerResponseOrigin;
+  managedBy?: string;
+  claimsSchema?: UpdateKmsIssuerResponseClaimsSchemaMap;
+  createdAt: string;
+  updatedAt: string;
+  signingKeys: UpdateKmsIssuerResponseSigningKeysList;
+  policies: UpdateKmsIssuerResponsePoliciesList;
+}
+export const UpdateKmsIssuerResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    id: S.String,
+    ownerId: S.String,
+    name: S.String,
+    algorithm: UpdateKmsIssuerResponseAlgorithm,
+    origin: UpdateKmsIssuerResponseOrigin,
+    managedBy: S.optional(S.String),
+    claimsSchema: S.optional(UpdateKmsIssuerResponseClaimsSchemaMap),
+    createdAt: S.String,
+    updatedAt: S.String,
+    signingKeys: UpdateKmsIssuerResponseSigningKeysList,
+    policies: UpdateKmsIssuerResponsePoliciesList,
+  }),
+).annotate({
+  identifier: "UpdateKmsIssuerResponse",
+}) as any as S.Schema<UpdateKmsIssuerResponse>;
+
+/** The issuer policy kind. */
+export type UpdateKmsIssuerPolicyRequestKind = "project-grant";
+export const UpdateKmsIssuerPolicyRequestKind = /*@__PURE__*/ S.String;
+
+/** The environments for the project grant policy. Each entry is a system environment (production, preview, development) or a custom environment ID (env_...). */
+export type UpdateKmsIssuerPolicyRequestEnvironmentsList = Array<string>;
+export const UpdateKmsIssuerPolicyRequestEnvironmentsList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<UpdateKmsIssuerPolicyRequestEnvironmentsList>;
+
+/** The claims that KMS should include in signed JWTs for this policy. Pass null to remove them. */
+export type UpdateKmsIssuerPolicyRequestTokenClaimsMap = {
+  [key: string]: unknown | undefined;
+};
+export const UpdateKmsIssuerPolicyRequestTokenClaimsMap =
+  /*@__PURE__*/ S.Record(
+    S.String,
+    S.Unknown,
+  ) as any as S.Schema<UpdateKmsIssuerPolicyRequestTokenClaimsMap>;
+
+export interface UpdateKmsIssuerPolicyRequest {
+  /** The ID of the issuer. */
+  issuerId: string;
+  /** The issuer policy kind. */
+  kind: UpdateKmsIssuerPolicyRequestKind | (string & {});
+  /** The policy identifier. */
+  policyKey: string;
+  /** The Team identifier to perform the request on behalf of. */
+  teamId?: string;
+  /** The Team slug to perform the request on behalf of. */
+  slug?: string;
+  /** The environments for the project grant policy. Each entry is a system environment (production, preview, development) or a custom environment ID (env_...). */
+  environments?: UpdateKmsIssuerPolicyRequestEnvironmentsList;
+  /** The claims that KMS should include in signed JWTs for this policy. Pass null to remove them. */
+  tokenClaims?: UpdateKmsIssuerPolicyRequestTokenClaimsMap | null;
+}
+export const UpdateKmsIssuerPolicyRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    issuerId: S.String.pipe(T.Label()),
+    kind: UpdateKmsIssuerPolicyRequestKind.pipe(T.Label()),
+    policyKey: S.String.pipe(T.Label()),
+    teamId: S.optional(S.String.pipe(T.Query())),
+    slug: S.optional(S.String.pipe(T.Query())),
+    environments: S.optional(UpdateKmsIssuerPolicyRequestEnvironmentsList),
+    tokenClaims: S.optional(
+      S.NullOr(UpdateKmsIssuerPolicyRequestTokenClaimsMap),
+    ),
+  }).pipe(
+    T.Http({
+      method: "PATCH",
+      uri: "/v1/kms/issuers/{issuerId}/policies/{kind}/{policyKey}",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "UpdateKmsIssuerPolicyRequest",
+}) as any as S.Schema<UpdateKmsIssuerPolicyRequest>;
+
+export type UpdateKmsIssuerPolicyResponseBodyCase0Kind = "project-grant";
+export const UpdateKmsIssuerPolicyResponseBodyCase0Kind =
+  /*@__PURE__*/ S.String;
+
+/** Environments whose OIDC tokens this grant authorizes. Each entry is either a system environment slug (`production`, `preview`, `development`) or a custom environment ID (prefixed `env_`). Custom environments are matched against the token's `custom_environment_id` claim (the stable ID); system environments against its `environment` claim. */
+export type UpdateKmsIssuerPolicyResponseBodyCase0EnvironmentsList =
+  Array<string>;
+export const UpdateKmsIssuerPolicyResponseBodyCase0EnvironmentsList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<UpdateKmsIssuerPolicyResponseBodyCase0EnvironmentsList>;
+
+export type UpdateKmsIssuerPolicyResponseBodyCase0TokenClaimsMap = {
+  [key: string]: unknown | undefined;
+};
+export const UpdateKmsIssuerPolicyResponseBodyCase0TokenClaimsMap =
+  /*@__PURE__*/ S.Record(
+    S.String,
+    S.Unknown,
+  ) as any as S.Schema<UpdateKmsIssuerPolicyResponseBodyCase0TokenClaimsMap>;
+
+export interface UpdateKmsIssuerPolicyResponseBodyCase0 {
+  kind: UpdateKmsIssuerPolicyResponseBodyCase0Kind;
+  teamId: string;
+  projectId: string;
+  /** Environments whose OIDC tokens this grant authorizes. Each entry is either a system environment slug (`production`, `preview`, `development`) or a custom environment ID (prefixed `env_`). Custom environments are matched against the token's `custom_environment_id` claim (the stable ID); system environments against its `environment` claim. */
+  environments: UpdateKmsIssuerPolicyResponseBodyCase0EnvironmentsList;
+  tokenClaims?: UpdateKmsIssuerPolicyResponseBodyCase0TokenClaimsMap;
+  createdAt: string;
+  updatedAt: string;
+}
+export const UpdateKmsIssuerPolicyResponseBodyCase0 = /*@__PURE__*/ S.suspend(
+  () =>
+    S.Struct({
+      kind: UpdateKmsIssuerPolicyResponseBodyCase0Kind,
+      teamId: S.String,
+      projectId: S.String,
+      environments: UpdateKmsIssuerPolicyResponseBodyCase0EnvironmentsList,
+      tokenClaims: S.optional(
+        UpdateKmsIssuerPolicyResponseBodyCase0TokenClaimsMap,
+      ),
+      createdAt: S.String,
+      updatedAt: S.String,
+    }),
+).annotate({
+  identifier: "UpdateKmsIssuerPolicyResponseBodyCase0",
+}) as any as S.Schema<UpdateKmsIssuerPolicyResponseBodyCase0>;
+
+export type UpdateKmsIssuerPolicyResponseBodyCase1Kind = "connex-grant";
+export const UpdateKmsIssuerPolicyResponseBodyCase1Kind =
+  /*@__PURE__*/ S.String;
+
+export type UpdateKmsIssuerPolicyResponseBodyCase1TokenClaimsMap = {
+  [key: string]: unknown | undefined;
+};
+export const UpdateKmsIssuerPolicyResponseBodyCase1TokenClaimsMap =
+  /*@__PURE__*/ S.Record(
+    S.String,
+    S.Unknown,
+  ) as any as S.Schema<UpdateKmsIssuerPolicyResponseBodyCase1TokenClaimsMap>;
+
+export interface UpdateKmsIssuerPolicyResponseBodyCase1 {
+  kind: UpdateKmsIssuerPolicyResponseBodyCase1Kind;
+  clientId: string;
+  tokenClaims?: UpdateKmsIssuerPolicyResponseBodyCase1TokenClaimsMap;
+  createdAt: string;
+  updatedAt: string;
+}
+export const UpdateKmsIssuerPolicyResponseBodyCase1 = /*@__PURE__*/ S.suspend(
+  () =>
+    S.Struct({
+      kind: UpdateKmsIssuerPolicyResponseBodyCase1Kind,
+      clientId: S.String,
+      tokenClaims: S.optional(
+        UpdateKmsIssuerPolicyResponseBodyCase1TokenClaimsMap,
+      ),
+      createdAt: S.String,
+      updatedAt: S.String,
+    }),
+).annotate({
+  identifier: "UpdateKmsIssuerPolicyResponseBodyCase1",
+}) as any as S.Schema<UpdateKmsIssuerPolicyResponseBodyCase1>;
+
+export type UpdateKmsIssuerPolicyResponseBody =
+  | UpdateKmsIssuerPolicyResponseBodyCase0
+  | UpdateKmsIssuerPolicyResponseBodyCase1;
+export const UpdateKmsIssuerPolicyResponseBody =
+  /*@__PURE__*/ S.Unknown as any as S.Schema<UpdateKmsIssuerPolicyResponseBody>;
+
+export type UpdateKmsIssuerPolicyResponse = UpdateKmsIssuerPolicyResponseBody;
+export const UpdateKmsIssuerPolicyResponse = /*@__PURE__*/ S.suspend(() =>
+  UpdateKmsIssuerPolicyResponseBody.pipe(T.RawResponseRoot()),
+).annotate({
+  identifier: "UpdateKmsIssuerPolicyResponse",
+}) as any as S.Schema<UpdateKmsIssuerPolicyResponse>;
+
+export type ActivateKmsSigningKeyError =
+  | BadRequest
+  | Forbidden
+  | NotFound
+  | Conflict
+  | VercelOpError;
+/** Activate a signing key Activate a pending signing key so the issuer starts signing with it. */
+export const activateKmsSigningKey: API.OperationMethod<
+  ActivateKmsSigningKeyRequest,
+  ActivateKmsSigningKeyResponse,
+  ActivateKmsSigningKeyError,
+  VercelOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: ActivateKmsSigningKeyRequest,
+  output: ActivateKmsSigningKeyResponse,
+  errors: [BadRequest, Forbidden, NotFound, Conflict],
+  protocol: VercelProtocol,
+  retry: Retry.Retry,
+}));
+
+export type CreateKmsIssuerError =
+  | BadRequest
+  | Forbidden
+  | NotFound
+  | VercelOpError;
+/** Create an issuer Create a new KMS issuer for the authenticated team. An issuer owns the asymmetric signing keys that are used to sign tokens and messages. */
+export const createKmsIssuer: API.OperationMethod<
+  CreateKmsIssuerRequest,
+  CreateKmsIssuerResponse,
+  CreateKmsIssuerError,
+  VercelOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: CreateKmsIssuerRequest,
+  output: CreateKmsIssuerResponse,
+  errors: [BadRequest, Forbidden, NotFound],
+  protocol: VercelProtocol,
+  retry: Retry.Retry,
+}));
+
+export type CreateKmsIssuerPolicyError =
+  | BadRequest
+  | Forbidden
+  | NotFound
+  | VercelOpError;
+/** Create an issuer policy Attach a policy to a KMS issuer that grants a project's deployments permission to sign with it. */
+export const createKmsIssuerPolicy: API.OperationMethod<
+  CreateKmsIssuerPolicyRequest,
+  CreateKmsIssuerPolicyResponse,
+  CreateKmsIssuerPolicyError,
+  VercelOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: CreateKmsIssuerPolicyRequest,
+  output: CreateKmsIssuerPolicyResponse,
+  errors: [BadRequest, Forbidden, NotFound],
+  protocol: VercelProtocol,
+  retry: Retry.Retry,
+}));
+
+export type CreateKmsSigningKeyError =
+  | BadRequest
+  | Forbidden
+  | NotFound
+  | Conflict
+  | VercelOpError;
+/** Create a signing key Create a new signing key for a KMS issuer. Depending on the activation mode, the key is activated automatically once its public key has propagated, or manually via the activate endpoint. */
+export const createKmsSigningKey: API.OperationMethod<
+  CreateKmsSigningKeyRequest,
+  CreateKmsSigningKeyResponse,
+  CreateKmsSigningKeyError,
+  VercelOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: CreateKmsSigningKeyRequest,
+  output: CreateKmsSigningKeyResponse,
+  errors: [BadRequest, Forbidden, NotFound, Conflict],
+  protocol: VercelProtocol,
+  retry: Retry.Retry,
+}));
+
+export type DeleteKmsIssuerError =
+  | BadRequest
+  | Forbidden
+  | NotFound
+  | VercelOpError;
+/** Delete an issuer Delete a KMS issuer and its signing keys. */
+export const deleteKmsIssuer: API.OperationMethod<
+  DeleteKmsIssuerRequest,
+  DeleteKmsIssuerResponse,
+  DeleteKmsIssuerError,
+  VercelOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: DeleteKmsIssuerRequest,
+  output: DeleteKmsIssuerResponse,
+  errors: [BadRequest, Forbidden, NotFound],
+  protocol: VercelProtocol,
+  retry: Retry.Retry,
+}));
+
+export type DeleteKmsIssuerPolicyError =
+  | BadRequest
+  | Forbidden
+  | NotFound
+  | VercelOpError;
+/** Delete an issuer policy Remove a policy from a KMS issuer. */
+export const deleteKmsIssuerPolicy: API.OperationMethod<
+  DeleteKmsIssuerPolicyRequest,
+  DeleteKmsIssuerPolicyResponse,
+  DeleteKmsIssuerPolicyError,
+  VercelOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: DeleteKmsIssuerPolicyRequest,
+  output: DeleteKmsIssuerPolicyResponse,
+  errors: [BadRequest, Forbidden, NotFound],
+  protocol: VercelProtocol,
+  retry: Retry.Retry,
+}));
+
+export type GetKmsIssuerError =
+  | BadRequest
+  | Forbidden
+  | NotFound
+  | VercelOpError;
+/** Get an issuer Retrieve a single KMS issuer by its ID. Accepts either a team bearer token (existing path) or an OIDC token authorized by one of the issuer's policies (e.g. a connex-grant token). The OIDC path returns the issuer without policies, since a policy token only proves signing access, not management access. */
+export const getKmsIssuer: API.OperationMethod<
+  GetKmsIssuerRequest,
+  GetKmsIssuerResponse,
+  GetKmsIssuerError,
+  VercelOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: GetKmsIssuerRequest,
+  output: GetKmsIssuerResponse,
+  errors: [BadRequest, Forbidden, NotFound],
+  protocol: VercelProtocol,
+  retry: Retry.Retry,
+}));
+
+export type ListKmsIssuersError = BadRequest | Forbidden | VercelOpError;
+/** List issuers Retrieve the list of KMS issuers that belong to the authenticated team. The results are paginated. */
+export const listKmsIssuers: API.OperationMethod<
+  ListKmsIssuersRequest,
+  ListKmsIssuersResponse,
+  ListKmsIssuersError,
+  VercelOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: ListKmsIssuersRequest,
+  output: ListKmsIssuersResponse,
+  errors: [BadRequest, Forbidden],
+  protocol: VercelProtocol,
+  retry: Retry.Retry,
+}));
+
+export type RevokeKmsSigningKeyError =
+  | BadRequest
+  | Forbidden
+  | NotFound
+  | Conflict
+  | VercelOpError;
+/** Revoke a signing key Immediately revoke a signing key that is already scheduled for revocation. */
+export const revokeKmsSigningKey: API.OperationMethod<
+  RevokeKmsSigningKeyRequest,
+  RevokeKmsSigningKeyResponse,
+  RevokeKmsSigningKeyError,
+  VercelOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: RevokeKmsSigningKeyRequest,
+  output: RevokeKmsSigningKeyResponse,
+  errors: [BadRequest, Forbidden, NotFound, Conflict],
+  protocol: VercelProtocol,
+  retry: Retry.Retry,
+}));
+
+export type SignKmsMessageError =
+  | BadRequest
+  | Forbidden
+  | NotFound
+  | VercelOpError;
+/** Sign a message Sign a raw message with a KMS issuer's active signing key. Authenticate the request with a Vercel OIDC token in the `Authorization: Bearer` header; the issuer's policies decide which workloads are allowed to sign. */
+export const signKmsMessage: API.OperationMethod<
+  SignKmsMessageRequest,
+  SignKmsMessageResponse,
+  SignKmsMessageError,
+  VercelOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: SignKmsMessageRequest,
+  output: SignKmsMessageResponse,
+  errors: [BadRequest, Forbidden, NotFound],
+  protocol: VercelProtocol,
+  retry: Retry.Retry,
+}));
+
+export type SignKmsTokenError =
+  | BadRequest
+  | Forbidden
+  | NotFound
+  | VercelOpError;
+/** Sign a token Sign a JWT with a KMS issuer's active signing key. Authenticate the request with a Vercel OIDC token in the `Authorization: Bearer` header; the issuer's policies decide which workloads are allowed to sign. */
+export const signKmsToken: API.OperationMethod<
+  SignKmsTokenRequest,
+  SignKmsTokenResponse,
+  SignKmsTokenError,
+  VercelOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: SignKmsTokenRequest,
+  output: SignKmsTokenResponse,
+  errors: [BadRequest, Forbidden, NotFound],
+  protocol: VercelProtocol,
+  retry: Retry.Retry,
+}));
+
+export type UpdateKmsIssuerError =
+  | BadRequest
+  | Forbidden
+  | NotFound
+  | VercelOpError;
+/** Update an issuer Update a KMS issuer's name or claims schema. */
+export const updateKmsIssuer: API.OperationMethod<
+  UpdateKmsIssuerRequest,
+  UpdateKmsIssuerResponse,
+  UpdateKmsIssuerError,
+  VercelOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: UpdateKmsIssuerRequest,
+  output: UpdateKmsIssuerResponse,
+  errors: [BadRequest, Forbidden, NotFound],
+  protocol: VercelProtocol,
+  retry: Retry.Retry,
+}));
+
+export type UpdateKmsIssuerPolicyError =
+  | BadRequest
+  | Forbidden
+  | NotFound
+  | VercelOpError;
+/** Update an issuer policy Update an existing KMS issuer policy's environments or token claims. */
+export const updateKmsIssuerPolicy: API.OperationMethod<
+  UpdateKmsIssuerPolicyRequest,
+  UpdateKmsIssuerPolicyResponse,
+  UpdateKmsIssuerPolicyError,
+  VercelOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: UpdateKmsIssuerPolicyRequest,
+  output: UpdateKmsIssuerPolicyResponse,
+  errors: [BadRequest, Forbidden, NotFound],
+  protocol: VercelProtocol,
+  retry: Retry.Retry,
+}));