@homeflare/distilled-openbao 0.2.0

package/src/services/auth.ts

@@ -0,0 +1,416 @@
+// AUTO-GENERATED by scripts/generate.ts from .generated-specs (specs/spec-mirror-openbao, generated — see fetch-specs.ts). Do not edit.
+import * as S from "@distilled.cloud/core/schema";
+import * as API from "@distilled.cloud/core/api";
+import * as T from "../traits.ts";
+import {
+  OpenBaoProtocol,
+  type OpenBaoOpError,
+  type OpenBaoOpContext,
+} from "../protocol.ts";
+import * as Retry from "../retry.ts";
+
+export type { OpenBaoOpError, OpenBaoOpContext };
+
+export interface AuthDisableMethodRequest {
+  /** The path to mount to. Cannot be delimited. Example: "user" */
+  path: string;
+}
+export const AuthDisableMethodRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    path: S.String.pipe(T.Label()),
+  }).pipe(T.Http({ method: "DELETE", uri: "/sys/auth/{path}", code: 200 })),
+).annotate({
+  identifier: "AuthDisableMethodRequest",
+}) as any as S.Schema<AuthDisableMethodRequest>;
+
+export interface AuthDisableMethodResponse {}
+export const AuthDisableMethodResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "AuthDisableMethodResponse",
+}) as any as S.Schema<AuthDisableMethodResponse>;
+
+export interface AuthEnableMethodRequest {
+  /** The path to mount to. Cannot be delimited. Example: "user" */
+  path: string;
+  /** Configuration for this mount, such as plugin_name. */
+  config?: unknown;
+  /** User-friendly description for this credential backend. */
+  description?: string;
+  /** Whether to give the mount access to OpenBao's external entropy. */
+  external_entropy_access?: boolean;
+  /** Mark the mount as a local mount, which is not replicated and is unaffected by replication. */
+  local?: boolean;
+  /** The options to pass into the backend. Should be a json object with string keys and values. */
+  options?: unknown;
+  /** Name of the auth plugin to use based from the name in the plugin catalog. */
+  plugin_name?: string;
+  /** The semantic version of the plugin to use. */
+  plugin_version?: string;
+  /** Whether to turn on seal wrapping for the mount. */
+  seal_wrap?: boolean;
+  /** The type of the backend. Example: "userpass" */
+  type?: string;
+}
+export const AuthEnableMethodRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    path: S.String.pipe(T.Label()),
+    config: S.optional(S.Unknown),
+    description: S.optional(S.String),
+    external_entropy_access: S.optional(S.Boolean),
+    local: S.optional(S.Boolean),
+    options: S.optional(S.Unknown),
+    plugin_name: S.optional(S.String),
+    plugin_version: S.optional(S.String),
+    seal_wrap: S.optional(S.Boolean),
+    type: S.optional(S.String),
+  }).pipe(T.Http({ method: "POST", uri: "/sys/auth/{path}", code: 200 })),
+).annotate({
+  identifier: "AuthEnableMethodRequest",
+}) as any as S.Schema<AuthEnableMethodRequest>;
+
+export interface AuthEnableMethodResponse {}
+export const AuthEnableMethodResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "AuthEnableMethodResponse",
+}) as any as S.Schema<AuthEnableMethodResponse>;
+
+export interface AuthListEnabledMethodsRequest {}
+export const AuthListEnabledMethodsRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}).pipe(T.Http({ method: "GET", uri: "/sys/auth", code: 200 })),
+).annotate({
+  identifier: "AuthListEnabledMethodsRequest",
+}) as any as S.Schema<AuthListEnabledMethodsRequest>;
+
+export interface AuthListEnabledMethodsResponse {}
+export const AuthListEnabledMethodsResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "AuthListEnabledMethodsResponse",
+}) as any as S.Schema<AuthListEnabledMethodsResponse>;
+
+export interface AuthReadConfigurationRequest {
+  /** The path to mount to. Cannot be delimited. Example: "user" */
+  path: string;
+}
+export const AuthReadConfigurationRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    path: S.String.pipe(T.Label()),
+  }).pipe(T.Http({ method: "GET", uri: "/sys/auth/{path}", code: 200 })),
+).annotate({
+  identifier: "AuthReadConfigurationRequest",
+}) as any as S.Schema<AuthReadConfigurationRequest>;
+
+export interface AuthReadConfigurationResponse {
+  accessor?: string;
+  config?: unknown;
+  deprecation_status?: string;
+  description?: string;
+  external_entropy_access?: boolean;
+  local?: boolean;
+  options?: unknown;
+  plugin_version?: string;
+  running_plugin_version?: string;
+  running_sha256?: string;
+  seal_wrap?: boolean;
+  type?: string;
+  uuid?: string;
+}
+export const AuthReadConfigurationResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    accessor: S.optional(S.String),
+    config: S.optional(S.Unknown),
+    deprecation_status: S.optional(S.String),
+    description: S.optional(S.String),
+    external_entropy_access: S.optional(S.Boolean),
+    local: S.optional(S.Boolean),
+    options: S.optional(S.Unknown),
+    plugin_version: S.optional(S.String),
+    running_plugin_version: S.optional(S.String),
+    running_sha256: S.optional(S.String),
+    seal_wrap: S.optional(S.Boolean),
+    type: S.optional(S.String),
+    uuid: S.optional(S.String),
+  }),
+).annotate({
+  identifier: "AuthReadConfigurationResponse",
+}) as any as S.Schema<AuthReadConfigurationResponse>;
+
+export interface AuthReadTuningInformationRequest {
+  /** Tune the configuration parameters for an auth path. */
+  path: string;
+}
+export const AuthReadTuningInformationRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    path: S.String.pipe(T.Label()),
+  }).pipe(T.Http({ method: "GET", uri: "/sys/auth/{path}/tune", code: 200 })),
+).annotate({
+  identifier: "AuthReadTuningInformationRequest",
+}) as any as S.Schema<AuthReadTuningInformationRequest>;
+
+export type AuthReadTuningInformationResponseAllowedResponseHeadersList =
+  Array<string>;
+export const AuthReadTuningInformationResponseAllowedResponseHeadersList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<AuthReadTuningInformationResponseAllowedResponseHeadersList>;
+
+export type AuthReadTuningInformationResponseAuditNonHmacRequestKeysList =
+  Array<string>;
+export const AuthReadTuningInformationResponseAuditNonHmacRequestKeysList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<AuthReadTuningInformationResponseAuditNonHmacRequestKeysList>;
+
+export type AuthReadTuningInformationResponseAuditNonHmacResponseKeysList =
+  Array<string>;
+export const AuthReadTuningInformationResponseAuditNonHmacResponseKeysList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<AuthReadTuningInformationResponseAuditNonHmacResponseKeysList>;
+
+export type AuthReadTuningInformationResponsePassthroughRequestHeadersList =
+  Array<string>;
+export const AuthReadTuningInformationResponsePassthroughRequestHeadersList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<AuthReadTuningInformationResponsePassthroughRequestHeadersList>;
+
+export interface AuthReadTuningInformationResponse {
+  allowed_response_headers?: AuthReadTuningInformationResponseAllowedResponseHeadersList;
+  audit_non_hmac_request_keys?: AuthReadTuningInformationResponseAuditNonHmacRequestKeysList;
+  audit_non_hmac_response_keys?: AuthReadTuningInformationResponseAuditNonHmacResponseKeysList;
+  default_lease_ttl?: number;
+  description?: string;
+  external_entropy_access?: boolean;
+  force_no_cache?: boolean;
+  listing_visibility?: string;
+  max_lease_ttl?: number;
+  options?: unknown;
+  passthrough_request_headers?: AuthReadTuningInformationResponsePassthroughRequestHeadersList;
+  plugin_version?: string;
+  token_type?: string;
+  user_lockout_counter_reset_duration?: number;
+  user_lockout_disable?: boolean;
+  user_lockout_duration?: number;
+  user_lockout_threshold?: number;
+}
+export const AuthReadTuningInformationResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    allowed_response_headers: S.optional(
+      AuthReadTuningInformationResponseAllowedResponseHeadersList,
+    ),
+    audit_non_hmac_request_keys: S.optional(
+      AuthReadTuningInformationResponseAuditNonHmacRequestKeysList,
+    ),
+    audit_non_hmac_response_keys: S.optional(
+      AuthReadTuningInformationResponseAuditNonHmacResponseKeysList,
+    ),
+    default_lease_ttl: S.optional(S.Number),
+    description: S.optional(S.String),
+    external_entropy_access: S.optional(S.Boolean),
+    force_no_cache: S.optional(S.Boolean),
+    listing_visibility: S.optional(S.String),
+    max_lease_ttl: S.optional(S.Number),
+    options: S.optional(S.Unknown),
+    passthrough_request_headers: S.optional(
+      AuthReadTuningInformationResponsePassthroughRequestHeadersList,
+    ),
+    plugin_version: S.optional(S.String),
+    token_type: S.optional(S.String),
+    user_lockout_counter_reset_duration: S.optional(S.Number),
+    user_lockout_disable: S.optional(S.Boolean),
+    user_lockout_duration: S.optional(S.Number),
+    user_lockout_threshold: S.optional(S.Number),
+  }),
+).annotate({
+  identifier: "AuthReadTuningInformationResponse",
+}) as any as S.Schema<AuthReadTuningInformationResponse>;
+
+/** A list of headers to whitelist and allow a plugin to set on responses. */
+export type AuthTuneConfigurationParametersRequestAllowedResponseHeadersList =
+  Array<string>;
+export const AuthTuneConfigurationParametersRequestAllowedResponseHeadersList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<AuthTuneConfigurationParametersRequestAllowedResponseHeadersList>;
+
+/** The list of keys in the request data object that will not be HMAC'ed by audit devices. */
+export type AuthTuneConfigurationParametersRequestAuditNonHmacRequestKeysList =
+  Array<string>;
+export const AuthTuneConfigurationParametersRequestAuditNonHmacRequestKeysList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<AuthTuneConfigurationParametersRequestAuditNonHmacRequestKeysList>;
+
+/** The list of keys in the response data object that will not be HMAC'ed by audit devices. */
+export type AuthTuneConfigurationParametersRequestAuditNonHmacResponseKeysList =
+  Array<string>;
+export const AuthTuneConfigurationParametersRequestAuditNonHmacResponseKeysList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<AuthTuneConfigurationParametersRequestAuditNonHmacResponseKeysList>;
+
+/** A list of headers to whitelist and pass from the request to the plugin. */
+export type AuthTuneConfigurationParametersRequestPassthroughRequestHeadersList =
+  Array<string>;
+export const AuthTuneConfigurationParametersRequestPassthroughRequestHeadersList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<AuthTuneConfigurationParametersRequestPassthroughRequestHeadersList>;
+
+export interface AuthTuneConfigurationParametersRequest {
+  /** Tune the configuration parameters for an auth path. */
+  path: string;
+  /** A list of headers to whitelist and allow a plugin to set on responses. */
+  allowed_response_headers?: AuthTuneConfigurationParametersRequestAllowedResponseHeadersList;
+  /** The list of keys in the request data object that will not be HMAC'ed by audit devices. */
+  audit_non_hmac_request_keys?: AuthTuneConfigurationParametersRequestAuditNonHmacRequestKeysList;
+  /** The list of keys in the response data object that will not be HMAC'ed by audit devices. */
+  audit_non_hmac_response_keys?: AuthTuneConfigurationParametersRequestAuditNonHmacResponseKeysList;
+  /** The default lease TTL for this mount. */
+  default_lease_ttl?: string;
+  /** User-friendly description for this credential backend. */
+  description?: string;
+  /** Determines the visibility of the mount in the UI-specific listing endpoint. Accepted value are 'unauth' and 'hidden', with the empty default ('') behaving like 'hidden'. */
+  listing_visibility?: string;
+  /** The max lease TTL for this mount. */
+  max_lease_ttl?: string;
+  /** The options to pass into the backend. Should be a json object with string keys and values. */
+  options?: unknown;
+  /** A list of headers to whitelist and pass from the request to the plugin. */
+  passthrough_request_headers?: AuthTuneConfigurationParametersRequestPassthroughRequestHeadersList;
+  /** The semantic version of the plugin to use. */
+  plugin_version?: string;
+  /** The type of token to issue (service or batch). */
+  token_type?: string;
+  /** The user lockout configuration to pass into the backend. Should be a json object with string keys and values. */
+  user_lockout_config?: unknown;
+}
+export const AuthTuneConfigurationParametersRequest = /*@__PURE__*/ S.suspend(
+  () =>
+    S.Struct({
+      path: S.String.pipe(T.Label()),
+      allowed_response_headers: S.optional(
+        AuthTuneConfigurationParametersRequestAllowedResponseHeadersList,
+      ),
+      audit_non_hmac_request_keys: S.optional(
+        AuthTuneConfigurationParametersRequestAuditNonHmacRequestKeysList,
+      ),
+      audit_non_hmac_response_keys: S.optional(
+        AuthTuneConfigurationParametersRequestAuditNonHmacResponseKeysList,
+      ),
+      default_lease_ttl: S.optional(S.String),
+      description: S.optional(S.String),
+      listing_visibility: S.optional(S.String),
+      max_lease_ttl: S.optional(S.String),
+      options: S.optional(S.Unknown),
+      passthrough_request_headers: S.optional(
+        AuthTuneConfigurationParametersRequestPassthroughRequestHeadersList,
+      ),
+      plugin_version: S.optional(S.String),
+      token_type: S.optional(S.String),
+      user_lockout_config: S.optional(S.Unknown),
+    }).pipe(
+      T.Http({ method: "POST", uri: "/sys/auth/{path}/tune", code: 200 }),
+    ),
+).annotate({
+  identifier: "AuthTuneConfigurationParametersRequest",
+}) as any as S.Schema<AuthTuneConfigurationParametersRequest>;
+
+export interface AuthTuneConfigurationParametersResponse {}
+export const AuthTuneConfigurationParametersResponse = /*@__PURE__*/ S.suspend(
+  () => S.Struct({}),
+).annotate({
+  identifier: "AuthTuneConfigurationParametersResponse",
+}) as any as S.Schema<AuthTuneConfigurationParametersResponse>;
+
+export type AuthDisableMethodError = OpenBaoOpError;
+/** Disable the auth method at the given auth path */
+export const authDisableMethod: API.OperationMethod<
+  AuthDisableMethodRequest,
+  AuthDisableMethodResponse,
+  AuthDisableMethodError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: AuthDisableMethodRequest,
+  output: AuthDisableMethodResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type AuthEnableMethodError = OpenBaoOpError;
+/** Enables a new auth method. After enabling, the auth method can be accessed and configured via the auth path specified as part of the URL. This auth path will be nested under the auth prefix. For example, enable the "foo" auth method will make it accessible at /auth/foo. */
+export const authEnableMethod: API.OperationMethod<
+  AuthEnableMethodRequest,
+  AuthEnableMethodResponse,
+  AuthEnableMethodError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: AuthEnableMethodRequest,
+  output: AuthEnableMethodResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type AuthListEnabledMethodsError = OpenBaoOpError;
+export const authListEnabledMethods: API.OperationMethod<
+  AuthListEnabledMethodsRequest,
+  AuthListEnabledMethodsResponse,
+  AuthListEnabledMethodsError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: AuthListEnabledMethodsRequest,
+  output: AuthListEnabledMethodsResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type AuthReadConfigurationError = OpenBaoOpError;
+/** Read the configuration of the auth engine at the given path. */
+export const authReadConfiguration: API.OperationMethod<
+  AuthReadConfigurationRequest,
+  AuthReadConfigurationResponse,
+  AuthReadConfigurationError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: AuthReadConfigurationRequest,
+  output: AuthReadConfigurationResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type AuthReadTuningInformationError = OpenBaoOpError;
+/** Reads the given auth path's configuration. This endpoint requires sudo capability on the final path, but the same functionality can be achieved without sudo via `sys/mounts/auth/[auth-path]/tune`. */
+export const authReadTuningInformation: API.OperationMethod<
+  AuthReadTuningInformationRequest,
+  AuthReadTuningInformationResponse,
+  AuthReadTuningInformationError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: AuthReadTuningInformationRequest,
+  output: AuthReadTuningInformationResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type AuthTuneConfigurationParametersError = OpenBaoOpError;
+/** Tune configuration parameters for a given auth path. This endpoint requires sudo capability on the final path, but the same functionality can be achieved without sudo via `sys/mounts/auth/[auth-path]/tune`. */
+export const authTuneConfigurationParameters: API.OperationMethod<
+  AuthTuneConfigurationParametersRequest,
+  AuthTuneConfigurationParametersResponse,
+  AuthTuneConfigurationParametersError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: AuthTuneConfigurationParametersRequest,
+  output: AuthTuneConfigurationParametersResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));

package/src/services/collect.ts

@@ -0,0 +1,103 @@
+// AUTO-GENERATED by scripts/generate.ts from .generated-specs (specs/spec-mirror-openbao, generated — see fetch-specs.ts). Do not edit.
+import * as S from "@distilled.cloud/core/schema";
+import * as API from "@distilled.cloud/core/api";
+import * as T from "../traits.ts";
+import {
+  OpenBaoProtocol,
+  type OpenBaoOpError,
+  type OpenBaoOpContext,
+} from "../protocol.ts";
+import * as Retry from "../retry.ts";
+
+export type { OpenBaoOpError, OpenBaoOpContext };
+
+export interface CollectHostInformationRequest {}
+export const CollectHostInformationRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}).pipe(
+    T.Http({ method: "GET", uri: "/sys/host-info", code: 200 }),
+  ),
+).annotate({
+  identifier: "CollectHostInformationRequest",
+}) as any as S.Schema<CollectHostInformationRequest>;
+
+export type CollectHostInformationResponseCpuList = Array<unknown>;
+export const CollectHostInformationResponseCpuList = /*@__PURE__*/ S.Array(
+  S.Unknown,
+) as any as S.Schema<CollectHostInformationResponseCpuList>;
+
+export type CollectHostInformationResponseCpuTimesList = Array<unknown>;
+export const CollectHostInformationResponseCpuTimesList = /*@__PURE__*/ S.Array(
+  S.Unknown,
+) as any as S.Schema<CollectHostInformationResponseCpuTimesList>;
+
+export type CollectHostInformationResponseDiskList = Array<unknown>;
+export const CollectHostInformationResponseDiskList = /*@__PURE__*/ S.Array(
+  S.Unknown,
+) as any as S.Schema<CollectHostInformationResponseDiskList>;
+
+export interface CollectHostInformationResponse {
+  cpu?: CollectHostInformationResponseCpuList;
+  cpu_times?: CollectHostInformationResponseCpuTimesList;
+  disk?: CollectHostInformationResponseDiskList;
+  host?: unknown;
+  memory?: unknown;
+  timestamp?: string;
+}
+export const CollectHostInformationResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    cpu: S.optional(CollectHostInformationResponseCpuList),
+    cpu_times: S.optional(CollectHostInformationResponseCpuTimesList),
+    disk: S.optional(CollectHostInformationResponseDiskList),
+    host: S.optional(S.Unknown),
+    memory: S.optional(S.Unknown),
+    timestamp: S.optional(S.String),
+  }),
+).annotate({
+  identifier: "CollectHostInformationResponse",
+}) as any as S.Schema<CollectHostInformationResponse>;
+
+export interface CollectInFlightRequestInformationRequest {}
+export const CollectInFlightRequestInformationRequest = /*@__PURE__*/ S.suspend(
+  () =>
+    S.Struct({}).pipe(
+      T.Http({ method: "GET", uri: "/sys/in-flight-req", code: 200 }),
+    ),
+).annotate({
+  identifier: "CollectInFlightRequestInformationRequest",
+}) as any as S.Schema<CollectInFlightRequestInformationRequest>;
+
+export interface CollectInFlightRequestInformationResponse {}
+export const CollectInFlightRequestInformationResponse =
+  /*@__PURE__*/ S.suspend(() => S.Struct({})).annotate({
+    identifier: "CollectInFlightRequestInformationResponse",
+  }) as any as S.Schema<CollectInFlightRequestInformationResponse>;
+
+export type CollectHostInformationError = OpenBaoOpError;
+/** Information about the host instance that this OpenBao server is running on. Information about the host instance that this OpenBao server is running on. The information that gets collected includes host hardware information, and CPU, disk, and memory utilization */
+export const collectHostInformation: API.OperationMethod<
+  CollectHostInformationRequest,
+  CollectHostInformationResponse,
+  CollectHostInformationError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: CollectHostInformationRequest,
+  output: CollectHostInformationResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type CollectInFlightRequestInformationError = OpenBaoOpError;
+/** reports in-flight requests This path responds to the following HTTP methods. GET / Returns a map of in-flight requests. */
+export const collectInFlightRequestInformation: API.OperationMethod<
+  CollectInFlightRequestInformationRequest,
+  CollectInFlightRequestInformationResponse,
+  CollectInFlightRequestInformationError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: CollectInFlightRequestInformationRequest,
+  output: CollectInFlightRequestInformationResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));

package/src/services/configure.ts

@@ -0,0 +1,94 @@
+// AUTO-GENERATED by scripts/generate.ts from .generated-specs (specs/spec-mirror-openbao, generated — see fetch-specs.ts). Do not edit.
+import * as S from "@distilled.cloud/core/schema";
+import * as API from "@distilled.cloud/core/api";
+import * as T from "../traits.ts";
+import {
+  OpenBaoProtocol,
+  type OpenBaoOpError,
+  type OpenBaoOpContext,
+} from "../protocol.ts";
+import * as Retry from "../retry.ts";
+
+export type { OpenBaoOpError, OpenBaoOpContext };
+
+export interface ConfigureEncryptionKeyConfigRequest {
+  /** Whether automatic rotation is enabled. */
+  enabled?: boolean;
+  /** How long after installation of an active key term that the key will be automatically rotated. */
+  interval?: number;
+  /** The number of encryption operations performed before the barrier key is automatically rotated. */
+  max_operations?: number;
+}
+export const ConfigureEncryptionKeyConfigRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    enabled: S.optional(S.Boolean),
+    interval: S.optional(S.Number),
+    max_operations: S.optional(S.Number),
+  }).pipe(T.Http({ method: "POST", uri: "/sys/rotate/config", code: 200 })),
+).annotate({
+  identifier: "ConfigureEncryptionKeyConfigRequest",
+}) as any as S.Schema<ConfigureEncryptionKeyConfigRequest>;
+
+export interface ConfigureEncryptionKeyConfigResponse {}
+export const ConfigureEncryptionKeyConfigResponse = /*@__PURE__*/ S.suspend(
+  () => S.Struct({}),
+).annotate({
+  identifier: "ConfigureEncryptionKeyConfigResponse",
+}) as any as S.Schema<ConfigureEncryptionKeyConfigResponse>;
+
+export interface ConfigureRotateKeyringConfigRequest {
+  /** Whether automatic rotation is enabled. */
+  enabled?: boolean;
+  /** How long after installation of an active key term that the key will be automatically rotated. */
+  interval?: number;
+  /** The number of encryption operations performed before the barrier key is automatically rotated. */
+  max_operations?: number;
+}
+export const ConfigureRotateKeyringConfigRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    enabled: S.optional(S.Boolean),
+    interval: S.optional(S.Number),
+    max_operations: S.optional(S.Number),
+  }).pipe(
+    T.Http({ method: "POST", uri: "/sys/rotate/keyring/config", code: 200 }),
+  ),
+).annotate({
+  identifier: "ConfigureRotateKeyringConfigRequest",
+}) as any as S.Schema<ConfigureRotateKeyringConfigRequest>;
+
+export interface ConfigureRotateKeyringConfigResponse {}
+export const ConfigureRotateKeyringConfigResponse = /*@__PURE__*/ S.suspend(
+  () => S.Struct({}),
+).annotate({
+  identifier: "ConfigureRotateKeyringConfigResponse",
+}) as any as S.Schema<ConfigureRotateKeyringConfigResponse>;
+
+export type ConfigureEncryptionKeyConfigError = OpenBaoOpError;
+/** Configure the automatic key rotation. */
+export const configureEncryptionKeyConfig: API.OperationMethod<
+  ConfigureEncryptionKeyConfigRequest,
+  ConfigureEncryptionKeyConfigResponse,
+  ConfigureEncryptionKeyConfigError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: ConfigureEncryptionKeyConfigRequest,
+  output: ConfigureEncryptionKeyConfigResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type ConfigureRotateKeyringConfigError = OpenBaoOpError;
+/** Configure the automatic key rotation. */
+export const configureRotateKeyringConfig: API.OperationMethod<
+  ConfigureRotateKeyringConfigRequest,
+  ConfigureRotateKeyringConfigResponse,
+  ConfigureRotateKeyringConfigError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: ConfigureRotateKeyringConfigRequest,
+  output: ConfigureRotateKeyringConfigResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));