// Code generated by sidekick. DO NOT EDIT.
//
// Copyright 2026 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     https://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

import Foundation
import GoogleCloudWkt

/// An [EkmConnection][google.cloud.kms.v1.EkmConnection] represents an
/// individual EKM connection. It can be used for creating
/// [CryptoKeys][google.cloud.kms.v1.CryptoKey] and
/// [CryptoKeyVersions][google.cloud.kms.v1.CryptoKeyVersion] with a
/// [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of
/// [EXTERNAL_VPC][google.cloud.kms.v1.ProtectionLevel.EXTERNAL_VPC], as well as
/// performing cryptographic operations using keys created within the
/// [EkmConnection][google.cloud.kms.v1.EkmConnection].
///
/// [google.cloud.kms.v1.CryptoKey]: <doc:CryptoKey>
/// [google.cloud.kms.v1.CryptoKeyVersion]: <doc:CryptoKeyVersion>
/// [google.cloud.kms.v1.EkmConnection]: <doc:EkmConnection>
/// [google.cloud.kms.v1.ProtectionLevel]: <doc:ProtectionLevel>
/// [google.cloud.kms.v1.ProtectionLevel.EXTERNAL_VPC]: <doc:ProtectionLevel/externalVpc>
public struct EkmConnection: Codable, Equatable, GoogleCloudWkt._AnyPackable,
  Sendable
{
  /// Output only. The resource name for the
  /// [EkmConnection][google.cloud.kms.v1.EkmConnection] in the format
  /// `projects/*/locations/*/ekmConnections/*`.
  ///
  /// [google.cloud.kms.v1.EkmConnection]: <doc:EkmConnection>
  public var name: Swift.String = Swift.String()

  /// Output only. The time at which the
  /// [EkmConnection][google.cloud.kms.v1.EkmConnection] was created.
  ///
  /// [google.cloud.kms.v1.EkmConnection]: <doc:EkmConnection>
  public var createTime: GoogleCloudWkt.Timestamp? = nil

  /// Optional. A list of
  /// [ServiceResolvers][google.cloud.kms.v1.EkmConnection.ServiceResolver] where
  /// the EKM can be reached. There should be one ServiceResolver per EKM
  /// replica. Currently, only a single
  /// [ServiceResolver][google.cloud.kms.v1.EkmConnection.ServiceResolver] is
  /// supported.
  ///
  /// [google.cloud.kms.v1.EkmConnection.ServiceResolver]: <doc:EkmConnection/ServiceResolver>
  public var serviceResolvers: [EkmConnection.ServiceResolver] = []

  /// Optional. Etag of the currently stored
  /// [EkmConnection][google.cloud.kms.v1.EkmConnection].
  ///
  /// [google.cloud.kms.v1.EkmConnection]: <doc:EkmConnection>
  public var etag: Swift.String = Swift.String()

  /// Optional. Describes who can perform control plane operations on the EKM. If
  /// unset, this defaults to
  /// [MANUAL][google.cloud.kms.v1.EkmConnection.KeyManagementMode.MANUAL].
  ///
  /// [google.cloud.kms.v1.EkmConnection.KeyManagementMode.MANUAL]: <doc:EkmConnection/KeyManagementMode/manual>
  public var keyManagementMode: EkmConnection.KeyManagementMode = EkmConnection.KeyManagementMode()

  /// Optional. Identifies the EKM Crypto Space that this
  /// [EkmConnection][google.cloud.kms.v1.EkmConnection] maps to. Note: This
  /// field is required if
  /// [KeyManagementMode][google.cloud.kms.v1.EkmConnection.KeyManagementMode] is
  /// [CLOUD_KMS][google.cloud.kms.v1.EkmConnection.KeyManagementMode.CLOUD_KMS].
  ///
  /// [google.cloud.kms.v1.EkmConnection]: <doc:EkmConnection>
  /// [google.cloud.kms.v1.EkmConnection.KeyManagementMode]: <doc:EkmConnection/KeyManagementMode>
  /// [google.cloud.kms.v1.EkmConnection.KeyManagementMode.CLOUD_KMS]: <doc:EkmConnection/KeyManagementMode/cloudKms>
  public var cryptoSpacePath: Swift.String = Swift.String()

  /// Initialize a new instance of `EkmConnection`.
  public init() {}

  /// Use `config` to return a new instance of this object, with some fields updated.
  ///
  /// Commonly used to initialize the value, for example:
  ///
  /// ```
  /// let value = EkmConnection().with { $0.name = ... }
  /// ```
  public func with(_ config: (inout Self) throws -> Swift.Void) rethrows -> Self {
    var copy = self
    try config(&copy)
    return copy
  }

  /// A [ServiceResolver][google.cloud.kms.v1.EkmConnection.ServiceResolver]
  /// represents an EKM replica that can be reached within an
  /// [EkmConnection][google.cloud.kms.v1.EkmConnection].
  ///
  /// [google.cloud.kms.v1.EkmConnection]: <doc:EkmConnection>
  /// [google.cloud.kms.v1.EkmConnection.ServiceResolver]: <doc:EkmConnection/ServiceResolver>
  public struct ServiceResolver: Codable, Equatable, GoogleCloudWkt._AnyPackable,
    Sendable
  {
    /// Required. The resource name of the Service Directory service pointing to
    /// an EKM replica, in the format
    /// `projects/*/locations/*/namespaces/*/services/*`.
    public var serviceDirectoryService: Swift.String = Swift.String()

    /// Optional. The filter applied to the endpoints of the resolved service. If
    /// no filter is specified, all endpoints will be considered. An endpoint
    /// will be chosen arbitrarily from the filtered list for each request.
    ///
    /// For endpoint filter syntax and examples, see
    /// https://cloud.google.com/service-directory/docs/reference/rpc/google.cloud.servicedirectory.v1#resolveservicerequest.
    public var endpointFilter: Swift.String = Swift.String()

    /// Required. The hostname of the EKM replica used at TLS and HTTP layers.
    public var hostname: Swift.String = Swift.String()

    /// Required. A list of leaf server certificates used to authenticate HTTPS
    /// connections to the EKM replica. Currently, a maximum of 10
    /// [Certificate][google.cloud.kms.v1.Certificate] is supported.
    ///
    /// [google.cloud.kms.v1.Certificate]: <doc:Certificate>
    public var serverCertificates: [Certificate] = []

    /// Initialize a new instance of `ServiceResolver`.
    public init() {}

    /// Use `config` to return a new instance of this object, with some fields updated.
    ///
    /// Commonly used to initialize the value, for example:
    ///
    /// ```
    /// let value = ServiceResolver().with { $0.serviceDirectoryService = ... }
    /// ```
    public func with(_ config: (inout Self) throws -> Swift.Void) rethrows -> Self {
      var copy = self
      try config(&copy)
      return copy
    }

    public static var _anyTypeUrl: Swift.String {
      return "type.googleapis.com/google.cloud.kms.v1.EkmConnection.ServiceResolver"
    }
    public init(fromAny any: GoogleCloudWkt.`Any`) throws {
      self = try GoogleCloudWkt._slowAnyDeserialize(Self.self, from: any)
    }
    public func _pack() throws -> GoogleCloudWkt.Struct {
      return try GoogleCloudWkt._slowAnySerialize(message: self)
    }
  }

  /// [KeyManagementMode][google.cloud.kms.v1.EkmConnection.KeyManagementMode]
  /// describes who can perform control plane cryptographic operations using this
  /// [EkmConnection][google.cloud.kms.v1.EkmConnection].
  ///
  /// [google.cloud.kms.v1.EkmConnection]: <doc:EkmConnection>
  /// [google.cloud.kms.v1.EkmConnection.KeyManagementMode]: <doc:EkmConnection/KeyManagementMode>
  public enum KeyManagementMode: Codable, Equatable, Sendable {
    /// Not specified.
    case unspecified
    /// EKM-side key management operations on
    /// [CryptoKeys][google.cloud.kms.v1.CryptoKey] created with this
    /// [EkmConnection][google.cloud.kms.v1.EkmConnection] must be initiated from
    /// the EKM directly and cannot be performed from Cloud KMS. This means that:
    /// * When creating a
    /// [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] associated with
    /// this
    ///   [EkmConnection][google.cloud.kms.v1.EkmConnection], the caller must
    ///   supply the key path of pre-existing external key material that will be
    ///   linked to the [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion].
    /// * Destruction of external key material cannot be requested via the
    ///   Cloud KMS API and must be performed directly in the EKM.
    /// * Automatic rotation of key material is not supported.
    ///
    /// [google.cloud.kms.v1.CryptoKey]: <doc:CryptoKey>
    /// [google.cloud.kms.v1.CryptoKeyVersion]: <doc:CryptoKeyVersion>
    /// [google.cloud.kms.v1.EkmConnection]: <doc:EkmConnection>
    case manual
    /// All [CryptoKeys][google.cloud.kms.v1.CryptoKey] created with this
    /// [EkmConnection][google.cloud.kms.v1.EkmConnection] use EKM-side key
    /// management operations initiated from Cloud KMS. This means that:
    ///
    /// * When a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]
    /// associated with this [EkmConnection][google.cloud.kms.v1.EkmConnection]
    /// is
    ///   created, the EKM automatically generates new key material and a new
    ///   key path. The caller cannot supply the key path of pre-existing
    ///   external key material.
    /// * Destruction of external key material associated with this
    ///   [EkmConnection][google.cloud.kms.v1.EkmConnection] can be requested by
    ///   calling
    ///   [DestroyCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.DestroyCryptoKeyVersion].
    /// * Automatic rotation of key material is supported.
    ///
    /// [google.cloud.kms.v1.CryptoKey]: <doc:CryptoKey>
    /// [google.cloud.kms.v1.CryptoKeyVersion]: <doc:CryptoKeyVersion>
    /// [google.cloud.kms.v1.EkmConnection]: <doc:EkmConnection>
    /// [google.cloud.kms.v1.KeyManagementService.DestroyCryptoKeyVersion]: <doc:KeyManagementService/destroyCryptoKeyVersion(request:)>
    case cloudKms
    /// Encodes an unknown integer value.
    ///
    /// The most common cause for an unknown values is for the service to send
    /// a value unknown to the library. We recommend you update your library to
    /// the latest version.
    case unknownIntValue(Int)
    /// Encodes an unknown string value.
    ///
    /// The most common cause for an unknown values is for the service to send
    /// a value unknown to the library. We recommend you update your library to
    /// the latest version.
    case unknownStringValue(String)

    public init() {
      self = .unspecified
    }

    /// Returns the integer value associated with the enumeration.
    ///
    /// If the enumeration was initialized with an unknown string value, this returns `nil`.
    public var intValue: Int? {
      switch self {
      case .unspecified: return 0
      case .manual: return 1
      case .cloudKms: return 2
      case .unknownIntValue(let v): return v
      case .unknownStringValue: return nil
      }
    }

    /// Returns the string value (or name) associated with the enumeration.
    ///
    /// If the enumeration was initialized with an unknown integer value, this returns `nil`.
    public var stringValue: Swift.String? {
      switch self {
      case .unspecified: return "KEY_MANAGEMENT_MODE_UNSPECIFIED"
      case .manual: return "MANUAL"
      case .cloudKms: return "CLOUD_KMS"
      case .unknownIntValue: return nil
      case .unknownStringValue(let v): return v
      }
    }

    /// Initialize from a string value.
    ///
    /// If the value is unknown, this initializes to [`unknownStringValue`](doc:KeyManagementMode/unknownStringValue(_:)).
    public init(stringValue: Swift.String) {
      switch stringValue {
      case "KEY_MANAGEMENT_MODE_UNSPECIFIED": self = .unspecified
      case "MANUAL": self = .manual
      case "CLOUD_KMS": self = .cloudKms
      default: self = .unknownStringValue(stringValue)
      }
    }

    /// Initialize from an integer value.
    ///
    /// If the value is unknown, this initializes to [`unknownIntValue`](doc:KeyManagementMode/unknownIntValue(_:)).
    public init(intValue: Int) {
      switch intValue {
      case 0: self = .unspecified
      case 1: self = .manual
      case 2: self = .cloudKms
      default: self = .unknownIntValue(intValue)
      }
    }

    public init(from decoder: Decoder) throws {
      let container = try decoder.singleValueContainer()
      if let v = try? container.decode(Int.self) {
        self.init(intValue: v)
        return
      }
      if let s = try? container.decode(String.self) {
        if let v = Int(s) {
          self.init(intValue: v)
        } else {
          self.init(stringValue: s)
        }
        return
      }
      throw DecodingError.dataCorruptedError(
        in: container, debugDescription: "Expected enum value, must be integer or string.")
    }

    public func encode(to encoder: Encoder) throws {
      var container = encoder.singleValueContainer()
      switch self {
      case .unspecified: return try container.encode(0)
      case .manual: return try container.encode(1)
      case .cloudKms: return try container.encode(2)
      case .unknownIntValue(let v): return try container.encode(v)
      case .unknownStringValue(let v): return try container.encode(v)
      }
    }
  }

  public static var _anyTypeUrl: Swift.String {
    return "type.googleapis.com/google.cloud.kms.v1.EkmConnection"
  }
  public init(fromAny any: GoogleCloudWkt.`Any`) throws {
    self = try GoogleCloudWkt._slowAnyDeserialize(Self.self, from: any)
  }
  public func _pack() throws -> GoogleCloudWkt.Struct {
    return try GoogleCloudWkt._slowAnySerialize(message: self)
  }
}
