import {z} from 'zod'

export type GetApiApiV1betaWorkloadsNameExportArgs = {name: string};

export type GetApiApiV1betaWorkloadsNameExportOptions = {baseUrl: string, fetch?: typeof fetch | undefined};

export const typesMiddlewareConfig = z.object({parameters: z.object({}).optional(), type: z.string().optional()});

export const auditConfig = z.object({component: z.string().optional(), detectApplicationErrors: z.boolean().optional(), enabled: z.boolean().optional(), eventTypes: z.array(z.string()).optional(), excludeEventTypes: z.array(z.string()).optional(), includeRequestData: z.boolean().optional(), includeResponseData: z.boolean().optional(), logFile: z.string().optional(), maxDataSize: z.number().int().optional(), maxDelegationDepth: z.number().int().optional()});

export const githubComStacklokToolhivePkgAuthzConfig = z.object({type: z.string().optional(), version: z.string().optional()});

export const githubComStacklokToolhivePkgAuthAwsstsRoleMapping = z.object({claim: z.string().optional(), matcher: z.string().optional(), priority: z.number().int().optional(), role_arn: z.string().optional()});

export const githubComStacklokToolhivePkgAuthAwsstsConfig = z.object({fallback_role_arn: z.string().optional(), region: z.string().optional(), role_claim: z.string().optional(), role_mappings: z.array(githubComStacklokToolhivePkgAuthAwsstsRoleMapping).optional(), service: z.string().optional(), session_duration: z.number().int().optional(), session_name_claim: z.string().optional(), subject_provider_name: z.string().optional()});

export const authserverCIMDRunConfig = z.object({cache_fallback_ttl: z.string().optional(), cache_max_size: z.number().int().optional(), enabled: z.boolean().optional()});

export const authserverDelegateClientExchangeRefreshTokens = z.object({id_jag_max_lifetime: z.string().optional(), refresh_token_max_lifetime: z.string().optional()});

export const authserverDelegateClientTokenExchange = z.object({allowed_source_clients: z.array(z.string()).optional(), exchange_refresh_tokens: authserverDelegateClientExchangeRefreshTokens.optional(), self_issued_subject_tokens: z.string(), subject_token_audiences: z.array(z.string()).optional()});

export const authserverDelegateClientRunConfig = z.object({audiences: z.array(z.string()).optional(), client_id: z.string().optional(), client_secret_env_var: z.string().optional(), client_secret_file: z.string().optional(), grant_types: z.array(z.string()).optional(), jwks_file: z.string().optional(), redirect_uris: z.array(z.string()).optional(), scopes: z.array(z.string()).optional(), token_endpoint_auth_method: z.string().optional(), token_endpoint_auth_signing_alg: z.string().optional(), token_exchange: authserverDelegateClientTokenExchange.optional()});

export const githubComStacklokToolhivePkgAuthserverServerTokenexchangeJWTBearerSubjectBinding = z.object({allowed_resources: z.array(z.string()).optional(), subject: z.string().optional()});

export const authserverJWTBearerIssuerPolicyRunConfig = z.object({accepted_audiences: z.array(z.string()).optional(), issuer_ref: z.string().optional(), max_assertion_age: z.string().optional(), subject_bindings: z.array(githubComStacklokToolhivePkgAuthserverServerTokenexchangeJWTBearerSubjectBinding).optional()});

export const authserverJWTBearerInboundGrantRunConfig = z.object({issuer_policies: z.array(authserverJWTBearerIssuerPolicyRunConfig).optional()});

export const authserverSPIFFEClientAuthRunConfig = z.object({audiences: z.array(z.string()).optional(), client_id: z.string().optional(), grant_types: z.array(z.string()).optional(), methods: z.array(z.string()).optional(), principal_pattern: z.string().optional(), resources: z.array(z.string()).optional(), scopes: z.array(z.string()).optional(), trust_domain_ref: z.string().optional()});

export const authserverTokenExchangeIssuerPolicyRunConfig = z.object({actor_claim: z.string().optional(), actor_matcher: z.string().optional(), allow_may_act: z.boolean().optional(), allowed_actors: z.array(z.string()).optional(), allowed_delegate_clients: z.array(z.string()).optional(), expected_audience: z.string().optional(), issuer_ref: z.string().optional()});

export const authserverTokenExchangeInboundGrantRunConfig = z.object({delegate_clients: z.array(authserverDelegateClientRunConfig).optional(), issuer_policies: z.array(authserverTokenExchangeIssuerPolicyRunConfig).optional()});

export const authserverInboundGrantsRunConfig = z.object({jwt_bearer: authserverJWTBearerInboundGrantRunConfig.optional(), spiffe_client_auth: z.array(authserverSPIFFEClientAuthRunConfig).optional(), token_exchange: authserverTokenExchangeInboundGrantRunConfig.optional()});

export const authserverRegistrationRateLimitRunConfig = z.object({burst: z.number().int().optional(), requests_per_second: z.number().optional()});

export const authserverSigningKeyRunConfig = z.object({fallback_key_files: z.array(z.string()).optional(), key_dir: z.string().optional(), signing_key_file: z.string().optional()});

export const authserverSPIFFEBundleEndpointSourceRunConfig = z.object({profile: z.string().optional(), url: z.string().optional()});

export const authserverSPIFFEFileBundleSourceRunConfig = z.object({path: z.string().optional()});

export const authserverSPIFFEWorkloadAPIBundleSourceRunConfig = z.object({});

export const authserverSPIFFEBundleSourceRunConfig = z.object({endpoint: authserverSPIFFEBundleEndpointSourceRunConfig.optional(), file: authserverSPIFFEFileBundleSourceRunConfig.optional(), type: z.string().optional(), workload_api: authserverSPIFFEWorkloadAPIBundleSourceRunConfig.optional()});

export const authserverSPIFFETrustDomainRunConfig = z.object({bundle_source: authserverSPIFFEBundleSourceRunConfig.optional(), methods: z.array(z.string()).optional(), name: z.string().optional(), trust_domain: z.string().optional()});

export const storageACLUserRunConfig = z.object({password_env_var: z.string().optional(), username_env_var: z.string().optional()});

export const storageSentinelRunConfig = z.object({db: z.number().int().optional(), master_name: z.string().optional(), sentinel_addrs: z.array(z.string()).optional()});

export const storageRedisTLSRunConfig = z.object({ca_cert_file: z.string().optional(), insecure_skip_verify: z.boolean().optional()});

export const storageRedisRunConfig = z.object({acl_user_config: storageACLUserRunConfig.optional(), addr: z.string().optional(), auth_type: z.string().optional(), cluster_mode: z.boolean().optional(), dial_timeout: z.string().optional(), key_prefix: z.string().optional(), read_timeout: z.string().optional(), sentinel_config: storageSentinelRunConfig.optional(), sentinel_tls: storageRedisTLSRunConfig.optional(), tls: storageRedisTLSRunConfig.optional(), write_timeout: z.string().optional()});

export const storageRunConfig = z.object({max_dcr_clients: z.number().int().optional(), redis_config: storageRedisRunConfig.optional(), type: z.string().optional()});

export const authserverTLSListenerRunConfig = z.object({cert_file: z.string().optional(), key_file: z.string().optional()});

export const authserverTokenLifespanRunConfig = z.object({access_token_lifespan: z.string().optional(), auth_code_lifespan: z.string().optional(), refresh_token_lifespan: z.string().optional()});

export const tokenexchangeJWTBearerSubjectBinding = z.object({allowed_resources: z.array(z.string()).optional(), subject: z.string().optional()});

export const tokenexchangeJWTBearerGrantPolicy = z.object({accepted_audiences: z.array(z.string()).optional(), max_assertion_age: z.string().optional(), subject_bindings: z.array(tokenexchangeJWTBearerSubjectBinding).optional()});

export const tokenexchangeTrustedIssuer = z.object({actor_claim: z.string().optional(), actor_matcher: z.string().optional(), allow_may_act: z.boolean().optional(), allow_private_ips: z.boolean().optional(), allowed_actors: z.array(z.string()).optional(), allowed_delegate_clients: z.array(z.string()).optional(), ca_file_path: z.string().optional(), expected_audience: z.string().optional(), insecure_allow_http: z.boolean().optional(), issuer_url: z.string().optional(), jwks_url: z.string().optional(), jwt_bearer_grant: tokenexchangeJWTBearerGrantPolicy.optional(), name: z.string().optional()});

export const upstreamfilterGroupRule = z.object({groups: z.array(z.string()).optional(), upstreamProviders: z.array(z.string()).optional()});

export const upstreamfilterGroupBasedFilterConfig = z.object({claim: z.string().optional(), defaultUpstreams: z.array(z.string()).optional(), rules: z.array(upstreamfilterGroupRule).optional()});

export const authserverDCRUpstreamConfig = z.object({discovery_url: z.string().optional(), initial_access_token_env_var: z.string().optional(), initial_access_token_file: z.string().optional(), registration_endpoint: z.string().optional(), registration_probe: z.string().optional(), registration_probe_interval: z.string().optional(), rotation_key: z.string().optional(), software_id: z.string().optional(), software_statement: z.string().optional()});

export const authserverIdentityFromTokenRunConfig = z.object({email_path: z.string().optional(), name_path: z.string().optional(), subject_path: z.string().optional()});

export const authserverTokenResponseMappingRunConfig = z.object({access_token_path: z.string().optional(), expires_in_path: z.string().optional(), refresh_token_path: z.string().optional(), scope_path: z.string().optional()});

export const authserverUserInfoFieldMappingRunConfig = z.object({email_fields: z.array(z.string()).optional(), name_fields: z.array(z.string()).optional(), subject_fields: z.array(z.string()).optional()});

export const authserverUserInfoRunConfig = z.object({additional_headers: z.record(z.string(), z.string()).optional(), endpoint_url: z.string().optional(), field_mapping: authserverUserInfoFieldMappingRunConfig.optional(), http_method: z.string().optional()});

export const authserverOAuth2UpstreamRunConfig = z.object({additional_authorization_params: z.record(z.string(), z.string()).optional(), additional_token_params: z.record(z.string(), z.string()).optional(), allow_private_ips: z.boolean().optional(), authorization_endpoint: z.string().optional(), ca_file_path: z.string().optional(), client_id: z.string().optional(), client_secret_env_var: z.string().optional(), client_secret_file: z.string().optional(), dcr_config: authserverDCRUpstreamConfig.optional(), identity_from_token: authserverIdentityFromTokenRunConfig.optional(), insecure_allow_http: z.boolean().optional(), omit_scope_on_refresh: z.boolean().optional(), redirect_uri: z.string().optional(), scopes: z.array(z.string()).optional(), token_endpoint: z.string().optional(), token_endpoint_auth_method: z.string().optional(), token_response_mapping: authserverTokenResponseMappingRunConfig.optional(), userinfo: authserverUserInfoRunConfig.optional()});

export const authserverOIDCUpstreamRunConfig = z.object({additional_authorization_params: z.record(z.string(), z.string()).optional(), additional_token_params: z.record(z.string(), z.string()).optional(), allow_private_ips: z.boolean().optional(), ca_file_path: z.string().optional(), client_id: z.string().optional(), client_secret_env_var: z.string().optional(), client_secret_file: z.string().optional(), dcr_config: authserverDCRUpstreamConfig.optional(), insecure_allow_http: z.boolean().optional(), issuer_url: z.string().optional(), omit_scope_on_refresh: z.boolean().optional(), redirect_uri: z.string().optional(), scopes: z.array(z.string()).optional(), subject_claim: z.string().optional(), userinfo_override: authserverUserInfoRunConfig.optional()});

export const authserverUpstreamRunConfig = z.object({display_name: z.string().optional(), name: z.string().optional(), oauth2_config: authserverOAuth2UpstreamRunConfig.optional(), oidc_config: authserverOIDCUpstreamRunConfig.optional(), type: z.string().optional()});

export const authserverRunConfig = z.object({allow_confidential_client_registration: z.boolean().optional(), allow_private_key_jwt_registration: z.boolean().optional(), allowed_audiences: z.array(z.string()).optional(), authorization_endpoint_base_url: z.string().optional(), baseline_client_scopes: z.array(z.string()).optional(), cimd: authserverCIMDRunConfig.optional(), delegate_clients: z.array(authserverDelegateClientRunConfig).optional(), delegation_token_lifespan: z.string().optional(), device_flow_enabled: z.boolean().optional(), disable_upstream_token_injection: z.boolean().optional(), force_confidential_redirect_uris: z.array(z.string()).optional(), hmac_secret_files: z.array(z.string()).optional(), inbound_grants: authserverInboundGrantsRunConfig.optional(), insecure_allow_confidential_over_loopback_http: z.boolean().optional(), insecure_allow_http: z.boolean().optional(), issuer: z.string().optional(), registration_rate_limit: authserverRegistrationRateLimitRunConfig.optional(), schema_version: z.string().optional(), scopes_supported: z.array(z.string()).optional(), signing_key_config: authserverSigningKeyRunConfig.optional(), spiffe_trust_domains: z.array(authserverSPIFFETrustDomainRunConfig).optional(), storage: storageRunConfig.optional(), tls_listener: authserverTLSListenerRunConfig.optional(), token_lifespans: authserverTokenLifespanRunConfig.optional(), trusted_issuers: z.array(tokenexchangeTrustedIssuer).optional(), upstream_filter: upstreamfilterGroupBasedFilterConfig.optional(), upstreams: z.array(authserverUpstreamRunConfig).optional()});

export const githubComStacklokToolhivePkgRunnerHeaderForwardConfig = z.object({add_headers_from_secret: z.record(z.string(), z.string()).optional(), add_plaintext_headers: z.record(z.string(), z.string()).optional()});

export const ignoreConfig = z.object({loadGlobal: z.boolean().optional(), printOverlays: z.boolean().optional()});

export const githubComStacklokToolhivePkgWebhookFailurePolicy = z.enum(["fail", "ignore"]);

export const githubComStacklokToolhivePkgWebhookTLSConfig = z.object({ca_bundle_path: z.string().optional(), client_cert_path: z.string().optional(), client_key_path: z.string().optional(), insecure_skip_verify: z.boolean().optional()});

export const githubComStacklokToolhivePkgWebhookConfig = z.object({failure_policy: githubComStacklokToolhivePkgWebhookFailurePolicy.optional(), hmac_secret_ref: z.string().optional(), name: z.string().optional(), timeout: z.number().int().optional(), tls_config: githubComStacklokToolhivePkgWebhookTLSConfig.optional(), url: z.string().optional()});

export const authTokenValidatorConfig = z.object({allowPrivateIP: z.boolean().optional(), audience: z.string().optional(), authTokenFile: z.string().optional(), cacertPath: z.string().optional(), clientID: z.string().optional(), clientSecret: z.string().optional(), insecureAllowHTTP: z.boolean().optional(), introspectionURL: z.string().optional(), issuer: z.string().optional(), jwksurl: z.string().optional(), resourceURL: z.string().optional(), scopes: z.array(z.string()).optional()});

export const v1Duration = z.object({});

export const typesRateLimitBucket = z.object({maxTokens: z.number().int().optional(), refillPeriod: v1Duration.optional()});

export const typesToolRateLimitConfig = z.object({name: z.string().optional(), perUser: typesRateLimitBucket.optional(), shared: typesRateLimitBucket.optional()});

export const v1beta1RateLimitConfig = z.object({perUser: typesRateLimitBucket.optional(), shared: typesRateLimitBucket.optional(), tools: z.array(typesToolRateLimitConfig).optional()});

export const remoteConfig = z.object({authorize_url: z.string().optional(), bearer_token: z.string().optional(), bearer_token_file: z.string().optional(), cached_cimd_client_id: z.string().optional(), cached_client_id: z.string().optional(), cached_client_secret_ref: z.string().optional(), cached_dcr_callback_port: z.number().int().optional(), cached_refresh_token_ref: z.string().optional(), cached_reg_client_uri: z.string().optional(), cached_reg_token_ref: z.string().optional(), cached_secret_expiry: z.string().optional(), cached_token_auth_method: z.string().optional(), cached_token_expiry: z.string().optional(), callback_port: z.number().int().optional(), client_id: z.string().optional(), client_secret: z.string().optional(), client_secret_file: z.string().optional(), issuer: z.string().optional(), oauth_params: z.record(z.string(), z.string()).optional(), resource: z.string().optional(), scope_param_name: z.string().optional(), scopes: z.array(z.string()).optional(), skip_browser: z.boolean().optional(), timeout: z.string().optional(), token_url: z.string().optional(), use_pkce: z.boolean().optional()});

export const templatesRuntimeConfig = z.object({additional_packages: z.array(z.string()).optional(), build_with: z.array(z.string()).optional(), builder_image: z.string().optional(), runtime_env: z.record(z.string(), z.string()).optional()});

export const redisconfigTLSConfig = z.object({caCertFile: z.string().optional(), insecureSkipVerify: z.boolean().optional()});

export const githubComStacklokToolhivePkgRunnerSessionRedisConfig = z.object({address: z.string().optional(), db: z.number().int().optional(), key_prefix: z.string().optional(), tls: redisconfigTLSConfig.optional()});

export const githubComStacklokToolhivePkgRunnerScalingConfig = z.object({backend_replicas: z.number().int().optional(), session_redis: githubComStacklokToolhivePkgRunnerSessionRedisConfig.optional()});

export const telemetryConfig = z.object({caCertPath: z.string().optional(), customAttributes: z.record(z.string(), z.string()).optional(), enablePrometheusMetricsPath: z.boolean().optional(), endpoint: z.string().optional(), environmentVariables: z.array(z.string()).optional(), headers: z.record(z.string(), z.string()).optional(), insecure: z.boolean().optional(), metricsEnabled: z.boolean().optional(), metricsOnTransportPort: z.boolean().optional(), prometheusPort: z.number().int().optional(), samplingRate: z.string().optional(), serviceName: z.string().optional(), serviceVersion: z.string().optional(), tracingEnabled: z.boolean().optional(), useLegacyAttributes: z.boolean().optional()});

export const tokenexchangeConfig = z.object({audience: z.string().optional(), client_id: z.string().optional(), client_secret: z.string().optional(), external_token_header_name: z.string().optional(), header_strategy: z.string().optional(), scopes: z.array(z.string()).optional(), subject_token_type: z.string().optional(), token_url: z.string().optional()});

export const githubComStacklokToolhivePkgRunnerToolOverride = z.object({description: z.string().optional(), name: z.string().optional()});

export const githubComStacklokToolhivePkgAuthUpstreamswapConfig = z.object({custom_header_name: z.string().optional(), header_strategy: z.string().optional(), provider_name: z.string().optional()});

export const githubComStacklokToolhivePkgRunnerRunConfig = z.object({additional_middleware_configs: z.array(typesMiddlewareConfig).optional(), allow_docker_gateway: z.boolean().optional(), allowed_origins: z.array(z.string()).optional(), audit_config: auditConfig.optional(), audit_config_path: z.string().optional(), authz_config: githubComStacklokToolhivePkgAuthzConfig.optional(), authz_config_path: z.string().optional(), aws_sts_config: githubComStacklokToolhivePkgAuthAwsstsConfig.optional(), base_name: z.string().optional(), cmd_args: z.array(z.string()).optional(), container_labels: z.record(z.string(), z.string()).optional(), container_name: z.string().optional(), debug: z.boolean().optional(), embedded_auth_server_config: authserverRunConfig.optional(), endpoint_prefix: z.string().optional(), env_file_dir: z.string().optional(), env_vars: z.record(z.string(), z.string()).optional(), group: z.string().optional(), header_forward: githubComStacklokToolhivePkgRunnerHeaderForwardConfig.optional(), host: z.string().optional(), ignore_config: ignoreConfig.optional(), image: z.string().optional(), isolate_network: z.boolean().optional(), jwks_auth_token_file: z.string().optional(), k8s_pod_template_patch: z.string().optional(), max_request_body_size: z.number().int().optional(), mcpserver_generation: z.number().int().optional(), middleware_configs: z.array(typesMiddlewareConfig).optional(), mutating_webhooks: z.array(githubComStacklokToolhivePkgWebhookConfig).optional(), name: z.string().optional(), oidc_config: authTokenValidatorConfig.optional(), permission_profile_name_or_path: z.string().optional(), port: z.number().int().optional(), proxy_mode: z.enum(["sse", "streamable-http"]).optional(), proxy_read_timeout: z.string().optional(), publish: z.array(z.string()).optional(), rate_limit_config: v1beta1RateLimitConfig.optional(), rate_limit_namespace: z.string().optional(), registry_api_url: z.string().optional(), registry_server_name: z.string().optional(), registry_url: z.string().optional(), remote_auth_config: remoteConfig.optional(), remote_url: z.string().optional(), runtime_config: templatesRuntimeConfig.optional(), scaling_config: githubComStacklokToolhivePkgRunnerScalingConfig.optional(), schema_version: z.string().optional(), secrets: z.array(z.string()).optional(), session_ttl: z.string().optional(), stateless: z.boolean().optional(), strict_protocol_validation: z.boolean().optional(), target_host: z.string().optional(), target_port: z.number().int().optional(), telemetry_config: telemetryConfig.optional(), thv_ca_bundle: z.string().optional(), token_exchange_config: tokenexchangeConfig.optional(), tools_filter: z.array(z.string()).optional(), tools_override: z.record(z.string(), githubComStacklokToolhivePkgRunnerToolOverride).optional(), transport: z.enum(["stdio", "sse", "streamable-http", "inspector"]).optional(), trust_proxy_headers: z.boolean().optional(), upstream_swap_config: githubComStacklokToolhivePkgAuthUpstreamswapConfig.optional(), validating_webhooks: z.array(githubComStacklokToolhivePkgWebhookConfig).optional(), volumes: z.array(z.string()).optional()});

export const validateResponse = async <Output>(
  schema: {
    readonly '~standard': {
      readonly validate: (value: unknown) => ({ readonly value: Output; readonly issues?: undefined } | { readonly issues: ReadonlyArray<{ readonly message: string; readonly path?: ReadonlyArray<PropertyKey | { readonly key: PropertyKey }> | undefined }> }) | Promise<{ readonly value: Output; readonly issues?: undefined } | { readonly issues: ReadonlyArray<{ readonly message: string; readonly path?: ReadonlyArray<PropertyKey | { readonly key: PropertyKey }> | undefined }> }>
    }
  },
  value: unknown
): Promise<Output> => {
  const result = await schema['~standard'].validate(value)

  if (result.issues !== undefined) {
    const detail = result.issues
      .map(({ message, path }) =>
        path?.length
          ? `${path.map((segment) => String(typeof segment === 'object' ? segment.key : segment)).join('.')}: ${message}`
          : message
      )
      .join('; ')

    throw new Error(`Response does not match the schema: ${detail}`, { cause: { issues: result.issues } })
  }

  return result.value
};

/**
 * Export workload configuration
 * 
 * GET /api/v1beta/workloads/{name}/export
 */
export const getApiApiV1betaWorkloadsNameExport = async (args: GetApiApiV1betaWorkloadsNameExportArgs, options: GetApiApiV1betaWorkloadsNameExportOptions) => {
const {baseUrl, fetch: fetchFn = fetch} = options ?? {}

const query = new URLSearchParams()
const headers = new Headers()
headers.set('accept', "application/json")

const url = `${baseUrl.replace(/\/+$/, '')}/api/v1beta/workloads/${encodeURIComponent(String(args.name))}/export${query.size > 0 ? `?${query}` : ''}`

const res = await fetchFn(url, {method: "GET", headers})

if (!res.ok) throw new Error(`Request failed with status ${res.status}`, {cause: {status: res.status, body: await res.text()}})

return validateResponse(githubComStacklokToolhivePkgRunnerRunConfig, await res.json())
};