// Code generated by sidekick. DO NOT EDIT.
//
// Copyright 2026 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     https://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

import Foundation
import GoogleCloudWkt

/// A
/// [CertificateAuthority][google.cloud.security.privateca.v1.CertificateAuthority]
/// represents an individual Certificate Authority. A
/// [CertificateAuthority][google.cloud.security.privateca.v1.CertificateAuthority]
/// can be used to create
/// [Certificates][google.cloud.security.privateca.v1.Certificate].
///
/// [google.cloud.security.privateca.v1.Certificate]: <doc:Certificate>
/// [google.cloud.security.privateca.v1.CertificateAuthority]: <doc:CertificateAuthority>
public struct CertificateAuthority: Codable, Equatable, GoogleCloudWkt._AnyPackable,
  Sendable
{
  /// Identifier. The resource name for this
  /// [CertificateAuthority][google.cloud.security.privateca.v1.CertificateAuthority]
  /// in the format `projects/*/locations/*/caPools/*/certificateAuthorities/*`.
  ///
  /// [google.cloud.security.privateca.v1.CertificateAuthority]: <doc:CertificateAuthority>
  public var name: Swift.String = Swift.String()

  /// Required. Immutable. The
  /// [Type][google.cloud.security.privateca.v1.CertificateAuthority.Type] of
  /// this
  /// [CertificateAuthority][google.cloud.security.privateca.v1.CertificateAuthority].
  ///
  /// [google.cloud.security.privateca.v1.CertificateAuthority]: <doc:CertificateAuthority>
  /// [google.cloud.security.privateca.v1.CertificateAuthority.Type]: <doc:CertificateAuthority/Type_>
  public var type: CertificateAuthority.Type_ = CertificateAuthority.Type_()

  /// Required. Immutable. The config used to create a self-signed X.509
  /// certificate or CSR.
  public var config: CertificateConfig? = nil

  /// Required. Immutable. The desired lifetime of the CA certificate. Used to
  /// create the "not_before_time" and "not_after_time" fields inside an X.509
  /// certificate.
  public var lifetime: GoogleCloudWkt.Duration? = nil

  /// Required. Immutable. Used when issuing certificates for this
  /// [CertificateAuthority][google.cloud.security.privateca.v1.CertificateAuthority].
  /// If this
  /// [CertificateAuthority][google.cloud.security.privateca.v1.CertificateAuthority]
  /// is a self-signed CertificateAuthority, this key is also used to sign the
  /// self-signed CA certificate. Otherwise, it is used to sign a CSR.
  ///
  /// [google.cloud.security.privateca.v1.CertificateAuthority]: <doc:CertificateAuthority>
  public var keySpec: CertificateAuthority.KeyVersionSpec? = nil

  /// Optional. If this is a subordinate
  /// [CertificateAuthority][google.cloud.security.privateca.v1.CertificateAuthority],
  /// this field will be set with the subordinate configuration, which describes
  /// its issuers. This may be updated, but this
  /// [CertificateAuthority][google.cloud.security.privateca.v1.CertificateAuthority]
  /// must continue to validate.
  ///
  /// [google.cloud.security.privateca.v1.CertificateAuthority]: <doc:CertificateAuthority>
  public var subordinateConfig: SubordinateConfig? = nil

  /// Output only. The
  /// [CaPool.Tier][google.cloud.security.privateca.v1.CaPool.Tier] of the
  /// [CaPool][google.cloud.security.privateca.v1.CaPool] that includes this
  /// [CertificateAuthority][google.cloud.security.privateca.v1.CertificateAuthority].
  ///
  /// [google.cloud.security.privateca.v1.CaPool]: <doc:CaPool>
  /// [google.cloud.security.privateca.v1.CaPool.Tier]: <doc:CaPool/Tier>
  /// [google.cloud.security.privateca.v1.CertificateAuthority]: <doc:CertificateAuthority>
  public var tier: CaPool.Tier = CaPool.Tier()

  /// Output only. The
  /// [State][google.cloud.security.privateca.v1.CertificateAuthority.State] for
  /// this
  /// [CertificateAuthority][google.cloud.security.privateca.v1.CertificateAuthority].
  ///
  /// [google.cloud.security.privateca.v1.CertificateAuthority]: <doc:CertificateAuthority>
  /// [google.cloud.security.privateca.v1.CertificateAuthority.State]: <doc:CertificateAuthority/State>
  public var state: CertificateAuthority.State = CertificateAuthority.State()

  /// Output only. This
  /// [CertificateAuthority][google.cloud.security.privateca.v1.CertificateAuthority]'s
  /// certificate chain, including the current
  /// [CertificateAuthority][google.cloud.security.privateca.v1.CertificateAuthority]'s
  /// certificate. Ordered such that the root issuer is the final element
  /// (consistent with RFC 5246). For a self-signed CA, this will only list the
  /// current
  /// [CertificateAuthority][google.cloud.security.privateca.v1.CertificateAuthority]'s
  /// certificate.
  ///
  /// [google.cloud.security.privateca.v1.CertificateAuthority]: <doc:CertificateAuthority>
  public var pemCaCertificates: [Swift.String] = []

  /// Output only. A structured description of this
  /// [CertificateAuthority][google.cloud.security.privateca.v1.CertificateAuthority]'s
  /// CA certificate and its issuers. Ordered as self-to-root.
  ///
  /// [google.cloud.security.privateca.v1.CertificateAuthority]: <doc:CertificateAuthority>
  public var caCertificateDescriptions: [CertificateDescription] = []

  /// Immutable. The name of a Cloud Storage bucket where this
  /// [CertificateAuthority][google.cloud.security.privateca.v1.CertificateAuthority]
  /// will publish content, such as the CA certificate and CRLs. This must be a
  /// bucket name, without any prefixes (such as `gs://`) or suffixes (such as
  /// `.googleapis.com`). For example, to use a bucket named `my-bucket`, you
  /// would simply specify `my-bucket`. If not specified, a managed bucket will
  /// be created.
  ///
  /// [google.cloud.security.privateca.v1.CertificateAuthority]: <doc:CertificateAuthority>
  public var gcsBucket: Swift.String = Swift.String()

  /// Output only. URLs for accessing content published by this CA, such as the
  /// CA certificate and CRLs.
  public var accessUrls: CertificateAuthority.AccessUrls? = nil

  /// Output only. The time at which this
  /// [CertificateAuthority][google.cloud.security.privateca.v1.CertificateAuthority]
  /// was created.
  ///
  /// [google.cloud.security.privateca.v1.CertificateAuthority]: <doc:CertificateAuthority>
  public var createTime: GoogleCloudWkt.Timestamp? = nil

  /// Output only. The time at which this
  /// [CertificateAuthority][google.cloud.security.privateca.v1.CertificateAuthority]
  /// was last updated.
  ///
  /// [google.cloud.security.privateca.v1.CertificateAuthority]: <doc:CertificateAuthority>
  public var updateTime: GoogleCloudWkt.Timestamp? = nil

  /// Output only. The time at which this
  /// [CertificateAuthority][google.cloud.security.privateca.v1.CertificateAuthority]
  /// was soft deleted, if it is in the
  /// [DELETED][google.cloud.security.privateca.v1.CertificateAuthority.State.DELETED]
  /// state.
  ///
  /// [google.cloud.security.privateca.v1.CertificateAuthority]: <doc:CertificateAuthority>
  /// [google.cloud.security.privateca.v1.CertificateAuthority.State.DELETED]: <doc:CertificateAuthority/State/deleted>
  public var deleteTime: GoogleCloudWkt.Timestamp? = nil

  /// Output only. The time at which this
  /// [CertificateAuthority][google.cloud.security.privateca.v1.CertificateAuthority]
  /// will be permanently purged, if it is in the
  /// [DELETED][google.cloud.security.privateca.v1.CertificateAuthority.State.DELETED]
  /// state.
  ///
  /// [google.cloud.security.privateca.v1.CertificateAuthority]: <doc:CertificateAuthority>
  /// [google.cloud.security.privateca.v1.CertificateAuthority.State.DELETED]: <doc:CertificateAuthority/State/deleted>
  public var expireTime: GoogleCloudWkt.Timestamp? = nil

  /// Optional. Labels with user-defined metadata.
  public var labels: [Swift.String: Swift.String] = [:]

  /// Optional. User-defined URLs for CA certificate and CRLs. The service does
  /// not publish content to these URLs. It is up to the user to mirror content
  /// to these URLs.
  public var userDefinedAccessUrls: CertificateAuthority.UserDefinedAccessUrls? = nil

  /// Output only. Reserved for future use.
  public var satisfiesPzs: Swift.Bool = Swift.Bool()

  /// Output only. Reserved for future use.
  public var satisfiesPzi: Swift.Bool = Swift.Bool()

  /// Initialize a new instance of `CertificateAuthority`.
  public init() {}

  /// Use `config` to return a new instance of this object, with some fields updated.
  ///
  /// Commonly used to initialize the value, for example:
  ///
  /// ```
  /// let value = CertificateAuthority().with { $0.name = ... }
  /// ```
  public func with(_ config: (inout Self) throws -> Swift.Void) rethrows -> Self {
    var copy = self
    try config(&copy)
    return copy
  }

  /// URLs where a
  /// [CertificateAuthority][google.cloud.security.privateca.v1.CertificateAuthority]
  /// will publish content.
  ///
  /// [google.cloud.security.privateca.v1.CertificateAuthority]: <doc:CertificateAuthority>
  public struct AccessUrls: Codable, Equatable, GoogleCloudWkt._AnyPackable,
    Sendable
  {
    /// The URL where this
    /// [CertificateAuthority][google.cloud.security.privateca.v1.CertificateAuthority]'s
    /// CA certificate is published. This will only be set for CAs that have been
    /// activated.
    ///
    /// [google.cloud.security.privateca.v1.CertificateAuthority]: <doc:CertificateAuthority>
    public var caCertificateAccessUrl: Swift.String = Swift.String()

    /// The URLs where this
    /// [CertificateAuthority][google.cloud.security.privateca.v1.CertificateAuthority]'s
    /// CRLs are published. This will only be set for CAs that have been
    /// activated.
    ///
    /// [google.cloud.security.privateca.v1.CertificateAuthority]: <doc:CertificateAuthority>
    public var crlAccessUrls: [Swift.String] = []

    /// Initialize a new instance of `AccessUrls`.
    public init() {}

    /// Use `config` to return a new instance of this object, with some fields updated.
    ///
    /// Commonly used to initialize the value, for example:
    ///
    /// ```
    /// let value = AccessUrls().with { $0.caCertificateAccessUrl = ... }
    /// ```
    public func with(_ config: (inout Self) throws -> Swift.Void) rethrows -> Self {
      var copy = self
      try config(&copy)
      return copy
    }

    public static var _anyTypeUrl: Swift.String {
      return
        "type.googleapis.com/google.cloud.security.privateca.v1.CertificateAuthority.AccessUrls"
    }
    public init(fromAny any: GoogleCloudWkt.`Any`) throws {
      self = try GoogleCloudWkt._slowAnyDeserialize(Self.self, from: any)
    }
    public func _pack() throws -> GoogleCloudWkt.Struct {
      return try GoogleCloudWkt._slowAnySerialize(message: self)
    }
  }

  /// A Cloud KMS key configuration that a
  /// [CertificateAuthority][google.cloud.security.privateca.v1.CertificateAuthority]
  /// will use.
  ///
  /// [google.cloud.security.privateca.v1.CertificateAuthority]: <doc:CertificateAuthority>
  public struct KeyVersionSpec: Codable, Equatable, GoogleCloudWkt._AnyPackable,
    Sendable
  {
    public var keyVersion: OneOf_KeyVersion? = nil

    /// Initialize a new instance of `KeyVersionSpec`.
    public init() {}

    /// Use `config` to return a new instance of this object, with some fields updated.
    ///
    /// Commonly used to initialize the value, for example:
    ///
    /// ```
    /// let value = KeyVersionSpec().with { $0.cloudKmsKeyVersion = ... }
    /// ```
    public func with(_ config: (inout Self) throws -> Swift.Void) rethrows -> Self {
      var copy = self
      try config(&copy)
      return copy
    }

    private enum CodingKeys: Swift.String, CodingKey {
      case cloudKmsKeyVersion = "cloudKmsKeyVersion"
      case algorithm = "algorithm"
    }

    public init(from decoder: Decoder) throws {
      let container = try decoder.container(keyedBy: CodingKeys.self)

      var keyVersion: OneOf_KeyVersion? = nil
      let keyVersionCheckAndSet = {
        if keyVersion != nil {
          throw DecodingError.dataCorrupted(
            DecodingError.Context(
              codingPath: decoder.codingPath,
              debugDescription: "Multiple values set for oneof 'keyVersion'"))
        }
        keyVersion = $0
      }
      if let cloudKmsKeyVersion = try container.decodeIfPresent(
        Swift.String.self, forKey: .cloudKmsKeyVersion)
      {
        try keyVersionCheckAndSet(.cloudKmsKeyVersion(cloudKmsKeyVersion))
      }
      if let algorithm = try container.decodeIfPresent(
        CertificateAuthority.SignHashAlgorithm.self, forKey: .algorithm)
      {
        try keyVersionCheckAndSet(.algorithm(algorithm))
      }
      self.keyVersion = keyVersion
    }

    public func encode(to encoder: Encoder) throws {
      var container = encoder.container(keyedBy: CodingKeys.self)

      if let choice = self.keyVersion {
        switch choice {
        case .cloudKmsKeyVersion(let value):
          try container.encode(value, forKey: .cloudKmsKeyVersion)
        case .algorithm(let value):
          try container.encode(value, forKey: .algorithm)
        }
      }
    }

    public enum OneOf_KeyVersion: Codable, Equatable, Sendable {
      /// The resource name for an existing Cloud KMS CryptoKeyVersion in the
      /// format
      /// `projects/*/locations/*/keyRings/*/cryptoKeys/*/cryptoKeyVersions/*`.
      /// This option enables full flexibility in the key's capabilities and
      /// properties.
      case cloudKmsKeyVersion(Swift.String)
      /// The algorithm to use for creating a managed Cloud KMS key for a for a
      /// simplified experience. All managed keys will be have their
      /// [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] as `HSM`.
      case algorithm(CertificateAuthority.SignHashAlgorithm)
    }

    public static var _anyTypeUrl: Swift.String {
      return
        "type.googleapis.com/google.cloud.security.privateca.v1.CertificateAuthority.KeyVersionSpec"
    }
    public init(fromAny any: GoogleCloudWkt.`Any`) throws {
      self = try GoogleCloudWkt._slowAnyDeserialize(Self.self, from: any)
    }
    public func _pack() throws -> GoogleCloudWkt.Struct {
      return try GoogleCloudWkt._slowAnySerialize(message: self)
    }
  }

  /// User-defined URLs for accessing content published by this
  /// [CertificateAuthority][google.cloud.security.privateca.v1.CertificateAuthority].
  ///
  /// [google.cloud.security.privateca.v1.CertificateAuthority]: <doc:CertificateAuthority>
  public struct UserDefinedAccessUrls: Codable, Equatable, GoogleCloudWkt._AnyPackable,
    Sendable
  {
    /// Optional. A list of URLs where the issuer CA certificate may be
    /// downloaded, which appears in the "Authority Information Access" extension
    /// in the certificate. If specified, the default [Cloud Storage
    /// URLs][google.cloud.security.privateca.v1.CertificateAuthority.AccessUrls.ca_certificate_access_url]
    /// will be omitted.
    ///
    /// [google.cloud.security.privateca.v1.CertificateAuthority.AccessUrls.ca_certificate_access_url]: <doc:CertificateAuthority/AccessUrls/caCertificateAccessUrl>
    public var aiaIssuingCertificateUrls: [Swift.String] = []

    /// Optional. A list of URLs where to obtain CRL information, i.e.
    /// the DistributionPoint.fullName described by
    /// https://tools.ietf.org/html/rfc5280#section-4.2.1.13.
    /// If specified, the default
    /// [Cloud Storage
    /// URLs][google.cloud.security.privateca.v1.CertificateAuthority.AccessUrls.crl_access_urls]
    /// will be omitted.
    ///
    /// [google.cloud.security.privateca.v1.CertificateAuthority.AccessUrls.crl_access_urls]: <doc:CertificateAuthority/AccessUrls/crlAccessUrls>
    public var crlAccessUrls: [Swift.String] = []

    /// Initialize a new instance of `UserDefinedAccessUrls`.
    public init() {}

    /// Use `config` to return a new instance of this object, with some fields updated.
    ///
    /// Commonly used to initialize the value, for example:
    ///
    /// ```
    /// let value = UserDefinedAccessUrls().with { $0.aiaIssuingCertificateUrls = ... }
    /// ```
    public func with(_ config: (inout Self) throws -> Swift.Void) rethrows -> Self {
      var copy = self
      try config(&copy)
      return copy
    }

    public static var _anyTypeUrl: Swift.String {
      return
        "type.googleapis.com/google.cloud.security.privateca.v1.CertificateAuthority.UserDefinedAccessUrls"
    }
    public init(fromAny any: GoogleCloudWkt.`Any`) throws {
      self = try GoogleCloudWkt._slowAnyDeserialize(Self.self, from: any)
    }
    public func _pack() throws -> GoogleCloudWkt.Struct {
      return try GoogleCloudWkt._slowAnySerialize(message: self)
    }
  }

  /// The type of a
  /// [CertificateAuthority][google.cloud.security.privateca.v1.CertificateAuthority],
  /// indicating its issuing chain.
  ///
  /// [google.cloud.security.privateca.v1.CertificateAuthority]: <doc:CertificateAuthority>
  public enum Type_: Codable, Equatable, Sendable {
    /// Not specified.
    case unspecified
    /// Self-signed CA.
    case selfSigned
    /// Subordinate CA. Could be issued by a Private CA
    /// [CertificateAuthority][google.cloud.security.privateca.v1.CertificateAuthority]
    /// or an unmanaged CA.
    ///
    /// [google.cloud.security.privateca.v1.CertificateAuthority]: <doc:CertificateAuthority>
    case subordinate
    /// Encodes an unknown integer value.
    ///
    /// The most common cause for an unknown values is for the service to send
    /// a value unknown to the library. We recommend you update your library to
    /// the latest version.
    case unknownIntValue(Int)
    /// Encodes an unknown string value.
    ///
    /// The most common cause for an unknown values is for the service to send
    /// a value unknown to the library. We recommend you update your library to
    /// the latest version.
    case unknownStringValue(String)

    public init() {
      self = .unspecified
    }

    /// Returns the integer value associated with the enumeration.
    ///
    /// If the enumeration was initialized with an unknown string value, this returns `nil`.
    public var intValue: Int? {
      switch self {
      case .unspecified: return 0
      case .selfSigned: return 1
      case .subordinate: return 2
      case .unknownIntValue(let v): return v
      case .unknownStringValue: return nil
      }
    }

    /// Returns the string value (or name) associated with the enumeration.
    ///
    /// If the enumeration was initialized with an unknown integer value, this returns `nil`.
    public var stringValue: Swift.String? {
      switch self {
      case .unspecified: return "TYPE_UNSPECIFIED"
      case .selfSigned: return "SELF_SIGNED"
      case .subordinate: return "SUBORDINATE"
      case .unknownIntValue: return nil
      case .unknownStringValue(let v): return v
      }
    }

    /// Initialize from a string value.
    ///
    /// If the value is unknown, this initializes to [`unknownStringValue`](doc:Type_/unknownStringValue(_:)).
    public init(stringValue: Swift.String) {
      switch stringValue {
      case "TYPE_UNSPECIFIED": self = .unspecified
      case "SELF_SIGNED": self = .selfSigned
      case "SUBORDINATE": self = .subordinate
      default: self = .unknownStringValue(stringValue)
      }
    }

    /// Initialize from an integer value.
    ///
    /// If the value is unknown, this initializes to [`unknownIntValue`](doc:Type_/unknownIntValue(_:)).
    public init(intValue: Int) {
      switch intValue {
      case 0: self = .unspecified
      case 1: self = .selfSigned
      case 2: self = .subordinate
      default: self = .unknownIntValue(intValue)
      }
    }

    public init(from decoder: Decoder) throws {
      let container = try decoder.singleValueContainer()
      if let v = try? container.decode(Int.self) {
        self.init(intValue: v)
        return
      }
      if let s = try? container.decode(String.self) {
        if let v = Int(s) {
          self.init(intValue: v)
        } else {
          self.init(stringValue: s)
        }
        return
      }
      throw DecodingError.dataCorruptedError(
        in: container, debugDescription: "Expected enum value, must be integer or string.")
    }

    public func encode(to encoder: Encoder) throws {
      var container = encoder.singleValueContainer()
      switch self {
      case .unspecified: return try container.encode(0)
      case .selfSigned: return try container.encode(1)
      case .subordinate: return try container.encode(2)
      case .unknownIntValue(let v): return try container.encode(v)
      case .unknownStringValue(let v): return try container.encode(v)
      }
    }
  }

  /// The state of a
  /// [CertificateAuthority][google.cloud.security.privateca.v1.CertificateAuthority],
  /// indicating if it can be used.
  ///
  /// [google.cloud.security.privateca.v1.CertificateAuthority]: <doc:CertificateAuthority>
  public enum State: Codable, Equatable, Sendable {
    /// Not specified.
    case unspecified
    /// Certificates can be issued from this CA. CRLs will be generated for this
    /// CA. The CA will be part of the
    /// [CaPool][google.cloud.security.privateca.v1.CaPool]'s trust anchor, and
    /// will be used to issue certificates from the
    /// [CaPool][google.cloud.security.privateca.v1.CaPool].
    ///
    /// [google.cloud.security.privateca.v1.CaPool]: <doc:CaPool>
    case enabled
    /// Certificates cannot be issued from this CA. CRLs will still be generated.
    /// The CA will be part of the
    /// [CaPool][google.cloud.security.privateca.v1.CaPool]'s trust anchor, but
    /// will not be used to issue certificates from the
    /// [CaPool][google.cloud.security.privateca.v1.CaPool].
    ///
    /// [google.cloud.security.privateca.v1.CaPool]: <doc:CaPool>
    case disabled
    /// Certificates can be issued from this CA. CRLs will be generated for this
    /// CA. The CA will be part of the
    /// [CaPool][google.cloud.security.privateca.v1.CaPool]'s trust anchor, but
    /// will not be used to issue certificates from the
    /// [CaPool][google.cloud.security.privateca.v1.CaPool].
    ///
    /// [google.cloud.security.privateca.v1.CaPool]: <doc:CaPool>
    case staged
    /// Certificates cannot be issued from this CA. CRLs will not be generated.
    /// The CA will not be part of the
    /// [CaPool][google.cloud.security.privateca.v1.CaPool]'s trust anchor, and
    /// will not be used to issue certificates from the
    /// [CaPool][google.cloud.security.privateca.v1.CaPool].
    ///
    /// [google.cloud.security.privateca.v1.CaPool]: <doc:CaPool>
    case awaitingUserActivation
    /// Certificates cannot be issued from this CA. CRLs will not be generated.
    /// The CA may still be recovered by calling
    /// [CertificateAuthorityService.UndeleteCertificateAuthority][google.cloud.security.privateca.v1.CertificateAuthorityService.UndeleteCertificateAuthority]
    /// before
    /// [expire_time][google.cloud.security.privateca.v1.CertificateAuthority.expire_time].
    /// The CA will not be part of the
    /// [CaPool][google.cloud.security.privateca.v1.CaPool]'s trust anchor, and
    /// will not be used to issue certificates from the
    /// [CaPool][google.cloud.security.privateca.v1.CaPool].
    ///
    /// [google.cloud.security.privateca.v1.CaPool]: <doc:CaPool>
    /// [google.cloud.security.privateca.v1.CertificateAuthority.expire_time]: <doc:CertificateAuthority/expireTime>
    /// [google.cloud.security.privateca.v1.CertificateAuthorityService.UndeleteCertificateAuthority]: <doc:CertificateAuthorityService/undeleteCertificateAuthority(request:)>
    case deleted
    /// Encodes an unknown integer value.
    ///
    /// The most common cause for an unknown values is for the service to send
    /// a value unknown to the library. We recommend you update your library to
    /// the latest version.
    case unknownIntValue(Int)
    /// Encodes an unknown string value.
    ///
    /// The most common cause for an unknown values is for the service to send
    /// a value unknown to the library. We recommend you update your library to
    /// the latest version.
    case unknownStringValue(String)

    public init() {
      self = .unspecified
    }

    /// Returns the integer value associated with the enumeration.
    ///
    /// If the enumeration was initialized with an unknown string value, this returns `nil`.
    public var intValue: Int? {
      switch self {
      case .unspecified: return 0
      case .enabled: return 1
      case .disabled: return 2
      case .staged: return 3
      case .awaitingUserActivation: return 4
      case .deleted: return 5
      case .unknownIntValue(let v): return v
      case .unknownStringValue: return nil
      }
    }

    /// Returns the string value (or name) associated with the enumeration.
    ///
    /// If the enumeration was initialized with an unknown integer value, this returns `nil`.
    public var stringValue: Swift.String? {
      switch self {
      case .unspecified: return "STATE_UNSPECIFIED"
      case .enabled: return "ENABLED"
      case .disabled: return "DISABLED"
      case .staged: return "STAGED"
      case .awaitingUserActivation: return "AWAITING_USER_ACTIVATION"
      case .deleted: return "DELETED"
      case .unknownIntValue: return nil
      case .unknownStringValue(let v): return v
      }
    }

    /// Initialize from a string value.
    ///
    /// If the value is unknown, this initializes to [`unknownStringValue`](doc:State/unknownStringValue(_:)).
    public init(stringValue: Swift.String) {
      switch stringValue {
      case "STATE_UNSPECIFIED": self = .unspecified
      case "ENABLED": self = .enabled
      case "DISABLED": self = .disabled
      case "STAGED": self = .staged
      case "AWAITING_USER_ACTIVATION": self = .awaitingUserActivation
      case "DELETED": self = .deleted
      default: self = .unknownStringValue(stringValue)
      }
    }

    /// Initialize from an integer value.
    ///
    /// If the value is unknown, this initializes to [`unknownIntValue`](doc:State/unknownIntValue(_:)).
    public init(intValue: Int) {
      switch intValue {
      case 0: self = .unspecified
      case 1: self = .enabled
      case 2: self = .disabled
      case 3: self = .staged
      case 4: self = .awaitingUserActivation
      case 5: self = .deleted
      default: self = .unknownIntValue(intValue)
      }
    }

    public init(from decoder: Decoder) throws {
      let container = try decoder.singleValueContainer()
      if let v = try? container.decode(Int.self) {
        self.init(intValue: v)
        return
      }
      if let s = try? container.decode(String.self) {
        if let v = Int(s) {
          self.init(intValue: v)
        } else {
          self.init(stringValue: s)
        }
        return
      }
      throw DecodingError.dataCorruptedError(
        in: container, debugDescription: "Expected enum value, must be integer or string.")
    }

    public func encode(to encoder: Encoder) throws {
      var container = encoder.singleValueContainer()
      switch self {
      case .unspecified: return try container.encode(0)
      case .enabled: return try container.encode(1)
      case .disabled: return try container.encode(2)
      case .staged: return try container.encode(3)
      case .awaitingUserActivation: return try container.encode(4)
      case .deleted: return try container.encode(5)
      case .unknownIntValue(let v): return try container.encode(v)
      case .unknownStringValue(let v): return try container.encode(v)
      }
    }
  }

  /// The algorithm of a Cloud KMS CryptoKeyVersion of a
  /// [CryptoKey][google.cloud.kms.v1.CryptoKey] with the
  /// [CryptoKeyPurpose][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose] value
  /// `ASYMMETRIC_SIGN`. These values correspond to the
  /// [CryptoKeyVersionAlgorithm][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionAlgorithm]
  /// values. For RSA signing algorithms, the PSS algorithms should be preferred,
  /// use PKCS1 algorithms if required for compatibility. For further
  /// recommendations, see
  /// https://cloud.google.com/kms/docs/algorithms#algorithm_recommendations.
  public enum SignHashAlgorithm: Codable, Equatable, Sendable {
    /// Not specified.
    case unspecified
    /// maps to CryptoKeyVersionAlgorithm.RSA_SIGN_PSS_2048_SHA256
    case rsaPss2048Sha256
    /// maps to CryptoKeyVersionAlgorithm. RSA_SIGN_PSS_3072_SHA256
    case rsaPss3072Sha256
    /// maps to CryptoKeyVersionAlgorithm.RSA_SIGN_PSS_4096_SHA256
    case rsaPss4096Sha256
    /// maps to CryptoKeyVersionAlgorithm.EC_SIGN_P256_SHA256
    case ecP256Sha256
    /// maps to CryptoKeyVersionAlgorithm.EC_SIGN_P384_SHA384
    case ecP384Sha384
    /// maps to CryptoKeyVersionAlgorithm.RSA_SIGN_PKCS1_2048_SHA256
    case rsaPkcs12048Sha256
    /// maps to CryptoKeyVersionAlgorithm.RSA_SIGN_PKCS1_3072_SHA256
    case rsaPkcs13072Sha256
    /// maps to CryptoKeyVersionAlgorithm.RSA_SIGN_PKCS1_4096_SHA256
    case rsaPkcs14096Sha256
    /// Encodes an unknown integer value.
    ///
    /// The most common cause for an unknown values is for the service to send
    /// a value unknown to the library. We recommend you update your library to
    /// the latest version.
    case unknownIntValue(Int)
    /// Encodes an unknown string value.
    ///
    /// The most common cause for an unknown values is for the service to send
    /// a value unknown to the library. We recommend you update your library to
    /// the latest version.
    case unknownStringValue(String)

    public init() {
      self = .unspecified
    }

    /// Returns the integer value associated with the enumeration.
    ///
    /// If the enumeration was initialized with an unknown string value, this returns `nil`.
    public var intValue: Int? {
      switch self {
      case .unspecified: return 0
      case .rsaPss2048Sha256: return 1
      case .rsaPss3072Sha256: return 2
      case .rsaPss4096Sha256: return 3
      case .ecP256Sha256: return 4
      case .ecP384Sha384: return 5
      case .rsaPkcs12048Sha256: return 6
      case .rsaPkcs13072Sha256: return 7
      case .rsaPkcs14096Sha256: return 8
      case .unknownIntValue(let v): return v
      case .unknownStringValue: return nil
      }
    }

    /// Returns the string value (or name) associated with the enumeration.
    ///
    /// If the enumeration was initialized with an unknown integer value, this returns `nil`.
    public var stringValue: Swift.String? {
      switch self {
      case .unspecified: return "SIGN_HASH_ALGORITHM_UNSPECIFIED"
      case .rsaPss2048Sha256: return "RSA_PSS_2048_SHA256"
      case .rsaPss3072Sha256: return "RSA_PSS_3072_SHA256"
      case .rsaPss4096Sha256: return "RSA_PSS_4096_SHA256"
      case .ecP256Sha256: return "EC_P256_SHA256"
      case .ecP384Sha384: return "EC_P384_SHA384"
      case .rsaPkcs12048Sha256: return "RSA_PKCS1_2048_SHA256"
      case .rsaPkcs13072Sha256: return "RSA_PKCS1_3072_SHA256"
      case .rsaPkcs14096Sha256: return "RSA_PKCS1_4096_SHA256"
      case .unknownIntValue: return nil
      case .unknownStringValue(let v): return v
      }
    }

    /// Initialize from a string value.
    ///
    /// If the value is unknown, this initializes to [`unknownStringValue`](doc:SignHashAlgorithm/unknownStringValue(_:)).
    public init(stringValue: Swift.String) {
      switch stringValue {
      case "SIGN_HASH_ALGORITHM_UNSPECIFIED": self = .unspecified
      case "RSA_PSS_2048_SHA256": self = .rsaPss2048Sha256
      case "RSA_PSS_3072_SHA256": self = .rsaPss3072Sha256
      case "RSA_PSS_4096_SHA256": self = .rsaPss4096Sha256
      case "RSA_PKCS1_2048_SHA256": self = .rsaPkcs12048Sha256
      case "RSA_PKCS1_3072_SHA256": self = .rsaPkcs13072Sha256
      case "RSA_PKCS1_4096_SHA256": self = .rsaPkcs14096Sha256
      case "EC_P256_SHA256": self = .ecP256Sha256
      case "EC_P384_SHA384": self = .ecP384Sha384
      default: self = .unknownStringValue(stringValue)
      }
    }

    /// Initialize from an integer value.
    ///
    /// If the value is unknown, this initializes to [`unknownIntValue`](doc:SignHashAlgorithm/unknownIntValue(_:)).
    public init(intValue: Int) {
      switch intValue {
      case 0: self = .unspecified
      case 1: self = .rsaPss2048Sha256
      case 2: self = .rsaPss3072Sha256
      case 3: self = .rsaPss4096Sha256
      case 4: self = .ecP256Sha256
      case 5: self = .ecP384Sha384
      case 6: self = .rsaPkcs12048Sha256
      case 7: self = .rsaPkcs13072Sha256
      case 8: self = .rsaPkcs14096Sha256
      default: self = .unknownIntValue(intValue)
      }
    }

    public init(from decoder: Decoder) throws {
      let container = try decoder.singleValueContainer()
      if let v = try? container.decode(Int.self) {
        self.init(intValue: v)
        return
      }
      if let s = try? container.decode(String.self) {
        if let v = Int(s) {
          self.init(intValue: v)
        } else {
          self.init(stringValue: s)
        }
        return
      }
      throw DecodingError.dataCorruptedError(
        in: container, debugDescription: "Expected enum value, must be integer or string.")
    }

    public func encode(to encoder: Encoder) throws {
      var container = encoder.singleValueContainer()
      switch self {
      case .unspecified: return try container.encode(0)
      case .rsaPss2048Sha256: return try container.encode(1)
      case .rsaPss3072Sha256: return try container.encode(2)
      case .rsaPss4096Sha256: return try container.encode(3)
      case .ecP256Sha256: return try container.encode(4)
      case .ecP384Sha384: return try container.encode(5)
      case .rsaPkcs12048Sha256: return try container.encode(6)
      case .rsaPkcs13072Sha256: return try container.encode(7)
      case .rsaPkcs14096Sha256: return try container.encode(8)
      case .unknownIntValue(let v): return try container.encode(v)
      case .unknownStringValue(let v): return try container.encode(v)
      }
    }
  }

  public static var _anyTypeUrl: Swift.String {
    return "type.googleapis.com/google.cloud.security.privateca.v1.CertificateAuthority"
  }
  public init(fromAny any: GoogleCloudWkt.`Any`) throws {
    self = try GoogleCloudWkt._slowAnyDeserialize(Self.self, from: any)
  }
  public func _pack() throws -> GoogleCloudWkt.Struct {
    return try GoogleCloudWkt._slowAnySerialize(message: self)
  }
}
