@homeflare/distilled-openbao 0.2.0

package/src/services/oidc.ts

@@ -0,0 +1,1613 @@
+// AUTO-GENERATED by scripts/generate.ts from .generated-specs (specs/spec-mirror-openbao, generated — see fetch-specs.ts). Do not edit.
+import * as S from "@distilled.cloud/core/schema";
+import * as API from "@distilled.cloud/core/api";
+import * as T from "../traits.ts";
+import {
+  OpenBaoProtocol,
+  type OpenBaoOpError,
+  type OpenBaoOpContext,
+} from "../protocol.ts";
+import * as Retry from "../retry.ts";
+
+export type { OpenBaoOpError, OpenBaoOpContext };
+
+export interface AuthorizeOidcProviderRequest {
+  /** Name of the provider */
+  name: string;
+}
+export const AuthorizeOidcProviderRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    name: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/identity/oidc/provider/{name}/authorize",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "AuthorizeOidcProviderRequest",
+}) as any as S.Schema<AuthorizeOidcProviderRequest>;
+
+export interface AuthorizeOidcProviderResponse {}
+export const AuthorizeOidcProviderResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "AuthorizeOidcProviderResponse",
+}) as any as S.Schema<AuthorizeOidcProviderResponse>;
+
+export interface OidcConfigureRequest {
+  /** Issuer URL to be used in the iss claim of the token. If not set, OpenBao's app_addr will be used. */
+  issuer?: string;
+}
+export const OidcConfigureRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    issuer: S.optional(S.String),
+  }).pipe(T.Http({ method: "POST", uri: "/identity/oidc/config", code: 200 })),
+).annotate({
+  identifier: "OidcConfigureRequest",
+}) as any as S.Schema<OidcConfigureRequest>;
+
+export interface OidcConfigureResponse {}
+export const OidcConfigureResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "OidcConfigureResponse",
+}) as any as S.Schema<OidcConfigureResponse>;
+
+export interface OidcDeleteAssignmentRequest {
+  /** Name of the assignment */
+  name: string;
+}
+export const OidcDeleteAssignmentRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    name: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "DELETE",
+      uri: "/identity/oidc/assignment/{name}",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "OidcDeleteAssignmentRequest",
+}) as any as S.Schema<OidcDeleteAssignmentRequest>;
+
+export interface OidcDeleteAssignmentResponse {}
+export const OidcDeleteAssignmentResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "OidcDeleteAssignmentResponse",
+}) as any as S.Schema<OidcDeleteAssignmentResponse>;
+
+export interface OidcDeleteClientRequest {
+  /** Name of the client. */
+  name: string;
+}
+export const OidcDeleteClientRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    name: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "DELETE",
+      uri: "/identity/oidc/client/{name}",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "OidcDeleteClientRequest",
+}) as any as S.Schema<OidcDeleteClientRequest>;
+
+export interface OidcDeleteClientResponse {}
+export const OidcDeleteClientResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "OidcDeleteClientResponse",
+}) as any as S.Schema<OidcDeleteClientResponse>;
+
+export interface OidcDeleteKeyRequest {
+  /** Name of the key */
+  name: string;
+}
+export const OidcDeleteKeyRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    name: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({ method: "DELETE", uri: "/identity/oidc/key/{name}", code: 200 }),
+  ),
+).annotate({
+  identifier: "OidcDeleteKeyRequest",
+}) as any as S.Schema<OidcDeleteKeyRequest>;
+
+export interface OidcDeleteKeyResponse {}
+export const OidcDeleteKeyResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "OidcDeleteKeyResponse",
+}) as any as S.Schema<OidcDeleteKeyResponse>;
+
+export interface OidcDeleteProviderRequest {
+  /** Name of the provider */
+  name: string;
+}
+export const OidcDeleteProviderRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    name: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "DELETE",
+      uri: "/identity/oidc/provider/{name}",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "OidcDeleteProviderRequest",
+}) as any as S.Schema<OidcDeleteProviderRequest>;
+
+export interface OidcDeleteProviderResponse {}
+export const OidcDeleteProviderResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "OidcDeleteProviderResponse",
+}) as any as S.Schema<OidcDeleteProviderResponse>;
+
+export interface OidcDeleteRoleRequest {
+  /** Name of the role */
+  name: string;
+}
+export const OidcDeleteRoleRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    name: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({ method: "DELETE", uri: "/identity/oidc/role/{name}", code: 200 }),
+  ),
+).annotate({
+  identifier: "OidcDeleteRoleRequest",
+}) as any as S.Schema<OidcDeleteRoleRequest>;
+
+export interface OidcDeleteRoleResponse {}
+export const OidcDeleteRoleResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "OidcDeleteRoleResponse",
+}) as any as S.Schema<OidcDeleteRoleResponse>;
+
+export interface OidcDeleteScopeRequest {
+  /** Name of the scope */
+  name: string;
+}
+export const OidcDeleteScopeRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    name: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({ method: "DELETE", uri: "/identity/oidc/scope/{name}", code: 200 }),
+  ),
+).annotate({
+  identifier: "OidcDeleteScopeRequest",
+}) as any as S.Schema<OidcDeleteScopeRequest>;
+
+export interface OidcDeleteScopeResponse {}
+export const OidcDeleteScopeResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "OidcDeleteScopeResponse",
+}) as any as S.Schema<OidcDeleteScopeResponse>;
+
+export interface OidcGenerateTokenRequest {
+  /** Name of the role */
+  name: string;
+}
+export const OidcGenerateTokenRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    name: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({ method: "GET", uri: "/identity/oidc/token/{name}", code: 200 }),
+  ),
+).annotate({
+  identifier: "OidcGenerateTokenRequest",
+}) as any as S.Schema<OidcGenerateTokenRequest>;
+
+export interface OidcGenerateTokenResponse {}
+export const OidcGenerateTokenResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "OidcGenerateTokenResponse",
+}) as any as S.Schema<OidcGenerateTokenResponse>;
+
+export interface OidcIntrospectRequest {
+  /** Optional client_id to verify */
+  client_id?: string;
+  /** Token to verify */
+  token?: string;
+}
+export const OidcIntrospectRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    client_id: S.optional(S.String),
+    token: S.optional(S.String),
+  }).pipe(
+    T.Http({ method: "POST", uri: "/identity/oidc/introspect", code: 200 }),
+  ),
+).annotate({
+  identifier: "OidcIntrospectRequest",
+}) as any as S.Schema<OidcIntrospectRequest>;
+
+export interface OidcIntrospectResponse {}
+export const OidcIntrospectResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "OidcIntrospectResponse",
+}) as any as S.Schema<OidcIntrospectResponse>;
+
+export type OidcListAssignmentsRequestList = "true";
+export const OidcListAssignmentsRequestList = S.String;
+
+export interface OidcListAssignmentsRequest {
+  /** Must be set to `true` */
+  list: OidcListAssignmentsRequestList | (string & {});
+}
+export const OidcListAssignmentsRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    list: OidcListAssignmentsRequestList.pipe(T.Query()),
+  }).pipe(
+    T.Http({ method: "GET", uri: "/identity/oidc/assignment", code: 200 }),
+  ),
+).annotate({
+  identifier: "OidcListAssignmentsRequest",
+}) as any as S.Schema<OidcListAssignmentsRequest>;
+
+export interface OidcListAssignmentsResponse {}
+export const OidcListAssignmentsResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "OidcListAssignmentsResponse",
+}) as any as S.Schema<OidcListAssignmentsResponse>;
+
+export type OidcListClientsRequestList = "true";
+export const OidcListClientsRequestList = S.String;
+
+export interface OidcListClientsRequest {
+  /** Must be set to `true` */
+  list: OidcListClientsRequestList | (string & {});
+}
+export const OidcListClientsRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    list: OidcListClientsRequestList.pipe(T.Query()),
+  }).pipe(T.Http({ method: "GET", uri: "/identity/oidc/client", code: 200 })),
+).annotate({
+  identifier: "OidcListClientsRequest",
+}) as any as S.Schema<OidcListClientsRequest>;
+
+export interface OidcListClientsResponse {}
+export const OidcListClientsResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "OidcListClientsResponse",
+}) as any as S.Schema<OidcListClientsResponse>;
+
+export type OidcListKeysRequestList = "true";
+export const OidcListKeysRequestList = S.String;
+
+export interface OidcListKeysRequest {
+  /** Must be set to `true` */
+  list: OidcListKeysRequestList | (string & {});
+}
+export const OidcListKeysRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    list: OidcListKeysRequestList.pipe(T.Query()),
+  }).pipe(T.Http({ method: "GET", uri: "/identity/oidc/key", code: 200 })),
+).annotate({
+  identifier: "OidcListKeysRequest",
+}) as any as S.Schema<OidcListKeysRequest>;
+
+export interface OidcListKeysResponse {}
+export const OidcListKeysResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "OidcListKeysResponse",
+}) as any as S.Schema<OidcListKeysResponse>;
+
+export type OidcListProvidersRequestList = "true";
+export const OidcListProvidersRequestList = S.String;
+
+export interface OidcListProvidersRequest {
+  /** Filters the list of OIDC providers to those that allow the given client ID in their set of allowed_client_ids. */
+  allowed_client_id?: string;
+  /** Must be set to `true` */
+  list: OidcListProvidersRequestList | (string & {});
+}
+export const OidcListProvidersRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    allowed_client_id: S.optional(S.String.pipe(T.Query())),
+    list: OidcListProvidersRequestList.pipe(T.Query()),
+  }).pipe(T.Http({ method: "GET", uri: "/identity/oidc/provider", code: 200 })),
+).annotate({
+  identifier: "OidcListProvidersRequest",
+}) as any as S.Schema<OidcListProvidersRequest>;
+
+export interface OidcListProvidersResponse {}
+export const OidcListProvidersResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "OidcListProvidersResponse",
+}) as any as S.Schema<OidcListProvidersResponse>;
+
+export type OidcListRolesRequestList = "true";
+export const OidcListRolesRequestList = S.String;
+
+export interface OidcListRolesRequest {
+  /** Must be set to `true` */
+  list: OidcListRolesRequestList | (string & {});
+}
+export const OidcListRolesRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    list: OidcListRolesRequestList.pipe(T.Query()),
+  }).pipe(T.Http({ method: "GET", uri: "/identity/oidc/role", code: 200 })),
+).annotate({
+  identifier: "OidcListRolesRequest",
+}) as any as S.Schema<OidcListRolesRequest>;
+
+export interface OidcListRolesResponse {}
+export const OidcListRolesResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "OidcListRolesResponse",
+}) as any as S.Schema<OidcListRolesResponse>;
+
+export type OidcListScopesRequestList = "true";
+export const OidcListScopesRequestList = S.String;
+
+export interface OidcListScopesRequest {
+  /** Must be set to `true` */
+  list: OidcListScopesRequestList | (string & {});
+}
+export const OidcListScopesRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    list: OidcListScopesRequestList.pipe(T.Query()),
+  }).pipe(T.Http({ method: "GET", uri: "/identity/oidc/scope", code: 200 })),
+).annotate({
+  identifier: "OidcListScopesRequest",
+}) as any as S.Schema<OidcListScopesRequest>;
+
+export interface OidcListScopesResponse {}
+export const OidcListScopesResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "OidcListScopesResponse",
+}) as any as S.Schema<OidcListScopesResponse>;
+
+export interface OidcProviderAuthorizeWithParametersRequest {
+  /** Name of the provider */
+  name: string;
+  /** The ID of the requesting client. */
+  client_id: string;
+  /** The code challenge derived from the code verifier. */
+  code_challenge?: string;
+  /** The method that was used to derive the code challenge. The following methods are supported: 'S256', 'plain'. Defaults to 'plain'. */
+  code_challenge_method?: string;
+  /** The allowable elapsed time in seconds since the last time the end-user was actively authenticated. */
+  max_age?: number;
+  /** The value that will be returned in the ID token nonce claim after a token exchange. */
+  nonce?: string;
+  /** The redirection URI to which the response will be sent. */
+  redirect_uri: string;
+  /** The OIDC authentication flow to be used. The following response types are supported: 'code' */
+  response_type: string;
+  /** A space-delimited, case-sensitive list of scopes to be requested. The 'openid' scope is required. */
+  scope: string;
+  /** The value used to maintain state between the authentication request and client. */
+  state?: string;
+}
+export const OidcProviderAuthorizeWithParametersRequest =
+  /*@__PURE__*/ S.suspend(() =>
+    S.Struct({
+      name: S.String.pipe(T.Label()),
+      client_id: S.String,
+      code_challenge: S.optional(S.String),
+      code_challenge_method: S.optional(S.String),
+      max_age: S.optional(S.Number),
+      nonce: S.optional(S.String),
+      redirect_uri: S.String,
+      response_type: S.String,
+      scope: S.String,
+      state: S.optional(S.String),
+    }).pipe(
+      T.Http({
+        method: "POST",
+        uri: "/identity/oidc/provider/{name}/authorize",
+        code: 200,
+      }),
+    ),
+  ).annotate({
+    identifier: "OidcProviderAuthorizeWithParametersRequest",
+  }) as any as S.Schema<OidcProviderAuthorizeWithParametersRequest>;
+
+export interface OidcProviderAuthorizeWithParametersResponse {}
+export const OidcProviderAuthorizeWithParametersResponse =
+  /*@__PURE__*/ S.suspend(() => S.Struct({})).annotate({
+    identifier: "OidcProviderAuthorizeWithParametersResponse",
+  }) as any as S.Schema<OidcProviderAuthorizeWithParametersResponse>;
+
+export interface OidcProviderTokenRequest {
+  /** Name of the provider */
+  name: string;
+  /** The ID of the requesting client. */
+  client_id?: string;
+  /** The secret of the requesting client. */
+  client_secret?: string;
+  /** The authorization code received from the provider's authorization endpoint. */
+  code: string;
+  /** The code verifier associated with the authorization code. */
+  code_verifier?: string;
+  /** The authorization grant type. The following grant types are supported: 'authorization_code','client_credentials'. */
+  grant_type: string;
+  /** The callback location where the authentication response was sent. */
+  redirect_uri: string;
+  /** A space-delimited, case-sensitive list of scopes to be requested. The 'openid' scope is required. This is used when using in with 'client_credentials' flow */
+  scope: string;
+}
+export const OidcProviderTokenRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    name: S.String.pipe(T.Label()),
+    client_id: S.optional(S.String),
+    client_secret: S.optional(S.String),
+    code: S.String,
+    code_verifier: S.optional(S.String),
+    grant_type: S.String,
+    redirect_uri: S.String,
+    scope: S.String,
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/identity/oidc/provider/{name}/token",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "OidcProviderTokenRequest",
+}) as any as S.Schema<OidcProviderTokenRequest>;
+
+export interface OidcProviderTokenResponse {}
+export const OidcProviderTokenResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "OidcProviderTokenResponse",
+}) as any as S.Schema<OidcProviderTokenResponse>;
+
+export interface OidcProviderUserInfoRequest {
+  /** Name of the provider */
+  name: string;
+}
+export const OidcProviderUserInfoRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    name: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/identity/oidc/provider/{name}/userinfo",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "OidcProviderUserInfoRequest",
+}) as any as S.Schema<OidcProviderUserInfoRequest>;
+
+export interface OidcProviderUserInfoResponse {}
+export const OidcProviderUserInfoResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "OidcProviderUserInfoResponse",
+}) as any as S.Schema<OidcProviderUserInfoResponse>;
+
+export interface OidcProviderUserInfo2Request {
+  /** Name of the provider */
+  name: string;
+}
+export const OidcProviderUserInfo2Request = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    name: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/identity/oidc/provider/{name}/userinfo",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "OidcProviderUserInfo2Request",
+}) as any as S.Schema<OidcProviderUserInfo2Request>;
+
+export interface OidcProviderUserInfo2Response {}
+export const OidcProviderUserInfo2Response = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "OidcProviderUserInfo2Response",
+}) as any as S.Schema<OidcProviderUserInfo2Response>;
+
+export interface OidcReadAssignmentRequest {
+  /** Name of the assignment */
+  name: string;
+}
+export const OidcReadAssignmentRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    name: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/identity/oidc/assignment/{name}",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "OidcReadAssignmentRequest",
+}) as any as S.Schema<OidcReadAssignmentRequest>;
+
+export interface OidcReadAssignmentResponse {}
+export const OidcReadAssignmentResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "OidcReadAssignmentResponse",
+}) as any as S.Schema<OidcReadAssignmentResponse>;
+
+export interface OidcReadClientRequest {
+  /** Name of the client. */
+  name: string;
+}
+export const OidcReadClientRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    name: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({ method: "GET", uri: "/identity/oidc/client/{name}", code: 200 }),
+  ),
+).annotate({
+  identifier: "OidcReadClientRequest",
+}) as any as S.Schema<OidcReadClientRequest>;
+
+export interface OidcReadClientResponse {}
+export const OidcReadClientResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "OidcReadClientResponse",
+}) as any as S.Schema<OidcReadClientResponse>;
+
+export interface OidcReadConfigurationRequest {}
+export const OidcReadConfigurationRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}).pipe(
+    T.Http({ method: "GET", uri: "/identity/oidc/config", code: 200 }),
+  ),
+).annotate({
+  identifier: "OidcReadConfigurationRequest",
+}) as any as S.Schema<OidcReadConfigurationRequest>;
+
+export interface OidcReadConfigurationResponse {}
+export const OidcReadConfigurationResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "OidcReadConfigurationResponse",
+}) as any as S.Schema<OidcReadConfigurationResponse>;
+
+export interface OidcReadKeyRequest {
+  /** Name of the key */
+  name: string;
+}
+export const OidcReadKeyRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    name: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({ method: "GET", uri: "/identity/oidc/key/{name}", code: 200 }),
+  ),
+).annotate({
+  identifier: "OidcReadKeyRequest",
+}) as any as S.Schema<OidcReadKeyRequest>;
+
+export interface OidcReadKeyResponse {}
+export const OidcReadKeyResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "OidcReadKeyResponse",
+}) as any as S.Schema<OidcReadKeyResponse>;
+
+export interface OidcReadOpenIdConfigurationRequest {}
+export const OidcReadOpenIdConfigurationRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/identity/oidc/.well-known/openid-configuration",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "OidcReadOpenIdConfigurationRequest",
+}) as any as S.Schema<OidcReadOpenIdConfigurationRequest>;
+
+export interface OidcReadOpenIdConfigurationResponse {}
+export const OidcReadOpenIdConfigurationResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "OidcReadOpenIdConfigurationResponse",
+}) as any as S.Schema<OidcReadOpenIdConfigurationResponse>;
+
+export interface OidcReadProviderRequest {
+  /** Name of the provider */
+  name: string;
+}
+export const OidcReadProviderRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    name: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({ method: "GET", uri: "/identity/oidc/provider/{name}", code: 200 }),
+  ),
+).annotate({
+  identifier: "OidcReadProviderRequest",
+}) as any as S.Schema<OidcReadProviderRequest>;
+
+export interface OidcReadProviderResponse {}
+export const OidcReadProviderResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "OidcReadProviderResponse",
+}) as any as S.Schema<OidcReadProviderResponse>;
+
+export interface OidcReadProviderOpenIdConfigurationRequest {
+  /** Name of the provider */
+  name: string;
+}
+export const OidcReadProviderOpenIdConfigurationRequest =
+  /*@__PURE__*/ S.suspend(() =>
+    S.Struct({
+      name: S.String.pipe(T.Label()),
+    }).pipe(
+      T.Http({
+        method: "GET",
+        uri: "/identity/oidc/provider/{name}/.well-known/openid-configuration",
+        code: 200,
+      }),
+    ),
+  ).annotate({
+    identifier: "OidcReadProviderOpenIdConfigurationRequest",
+  }) as any as S.Schema<OidcReadProviderOpenIdConfigurationRequest>;
+
+export interface OidcReadProviderOpenIdConfigurationResponse {}
+export const OidcReadProviderOpenIdConfigurationResponse =
+  /*@__PURE__*/ S.suspend(() => S.Struct({})).annotate({
+    identifier: "OidcReadProviderOpenIdConfigurationResponse",
+  }) as any as S.Schema<OidcReadProviderOpenIdConfigurationResponse>;
+
+export interface OidcReadProviderPublicKeysRequest {
+  /** Name of the provider */
+  name: string;
+}
+export const OidcReadProviderPublicKeysRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    name: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/identity/oidc/provider/{name}/.well-known/keys",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "OidcReadProviderPublicKeysRequest",
+}) as any as S.Schema<OidcReadProviderPublicKeysRequest>;
+
+export interface OidcReadProviderPublicKeysResponse {}
+export const OidcReadProviderPublicKeysResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "OidcReadProviderPublicKeysResponse",
+}) as any as S.Schema<OidcReadProviderPublicKeysResponse>;
+
+export interface OidcReadPublicKeysRequest {}
+export const OidcReadPublicKeysRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/identity/oidc/.well-known/keys",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "OidcReadPublicKeysRequest",
+}) as any as S.Schema<OidcReadPublicKeysRequest>;
+
+export interface OidcReadPublicKeysResponse {}
+export const OidcReadPublicKeysResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "OidcReadPublicKeysResponse",
+}) as any as S.Schema<OidcReadPublicKeysResponse>;
+
+export interface OidcReadRoleRequest {
+  /** Name of the role */
+  name: string;
+}
+export const OidcReadRoleRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    name: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({ method: "GET", uri: "/identity/oidc/role/{name}", code: 200 }),
+  ),
+).annotate({
+  identifier: "OidcReadRoleRequest",
+}) as any as S.Schema<OidcReadRoleRequest>;
+
+export interface OidcReadRoleResponse {}
+export const OidcReadRoleResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "OidcReadRoleResponse",
+}) as any as S.Schema<OidcReadRoleResponse>;
+
+export interface OidcReadScopeRequest {
+  /** Name of the scope */
+  name: string;
+}
+export const OidcReadScopeRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    name: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({ method: "GET", uri: "/identity/oidc/scope/{name}", code: 200 }),
+  ),
+).annotate({
+  identifier: "OidcReadScopeRequest",
+}) as any as S.Schema<OidcReadScopeRequest>;
+
+export interface OidcReadScopeResponse {}
+export const OidcReadScopeResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "OidcReadScopeResponse",
+}) as any as S.Schema<OidcReadScopeResponse>;
+
+export interface OidcRotateKeyRequest {
+  /** Name of the key */
+  name: string;
+  /** Controls how long the public portion of a key will be available for verification after being rotated. Setting verification_ttl here will override the verification_ttl set on the key. */
+  verification_ttl?: number;
+}
+export const OidcRotateKeyRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    name: S.String.pipe(T.Label()),
+    verification_ttl: S.optional(S.Number),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/identity/oidc/key/{name}/rotate",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "OidcRotateKeyRequest",
+}) as any as S.Schema<OidcRotateKeyRequest>;
+
+export interface OidcRotateKeyResponse {}
+export const OidcRotateKeyResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "OidcRotateKeyResponse",
+}) as any as S.Schema<OidcRotateKeyResponse>;
+
+/** Comma separated string or array of identity entity IDs */
+export type OidcWriteAssignmentRequestEntityIdsList = Array<string>;
+export const OidcWriteAssignmentRequestEntityIdsList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<OidcWriteAssignmentRequestEntityIdsList>;
+
+/** Comma separated string or array of identity group IDs */
+export type OidcWriteAssignmentRequestGroupIdsList = Array<string>;
+export const OidcWriteAssignmentRequestGroupIdsList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<OidcWriteAssignmentRequestGroupIdsList>;
+
+export interface OidcWriteAssignmentRequest {
+  /** Name of the assignment */
+  name: string;
+  /** Comma separated string or array of identity entity IDs */
+  entity_ids?: OidcWriteAssignmentRequestEntityIdsList;
+  /** Comma separated string or array of identity group IDs */
+  group_ids?: OidcWriteAssignmentRequestGroupIdsList;
+}
+export const OidcWriteAssignmentRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    name: S.String.pipe(T.Label()),
+    entity_ids: S.optional(OidcWriteAssignmentRequestEntityIdsList),
+    group_ids: S.optional(OidcWriteAssignmentRequestGroupIdsList),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/identity/oidc/assignment/{name}",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "OidcWriteAssignmentRequest",
+}) as any as S.Schema<OidcWriteAssignmentRequest>;
+
+export interface OidcWriteAssignmentResponse {}
+export const OidcWriteAssignmentResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "OidcWriteAssignmentResponse",
+}) as any as S.Schema<OidcWriteAssignmentResponse>;
+
+/** Comma separated string or array of assignment resources. */
+export type OidcWriteClientRequestAssignmentsList = Array<string>;
+export const OidcWriteClientRequestAssignmentsList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<OidcWriteClientRequestAssignmentsList>;
+
+/** Comma separated string or array of redirect URIs used by the client. One of these values must exactly match the redirect_uri parameter value used in each authentication request. */
+export type OidcWriteClientRequestRedirectUrisList = Array<string>;
+export const OidcWriteClientRequestRedirectUrisList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<OidcWriteClientRequestRedirectUrisList>;
+
+export interface OidcWriteClientRequest {
+  /** Name of the client. */
+  name: string;
+  /** The time-to-live for access tokens obtained by the client. */
+  access_token_ttl?: number;
+  /** Comma separated string or array of assignment resources. */
+  assignments?: OidcWriteClientRequestAssignmentsList;
+  /** Whether or not to authorization code flow is allowed in this provider */
+  authorization_code?: boolean;
+  /** Whether or not to client credentials flow is allowed in this provider */
+  client_credentials?: boolean;
+  /** The client type based on its ability to maintain confidentiality of credentials. The following client types are supported: 'confidential', 'public'. Defaults to 'confidential'. */
+  client_type?: string;
+  /** The time-to-live for ID tokens obtained by the client. */
+  id_token_ttl?: number;
+  /** A reference to a named key resource. Cannot be modified after creation. Defaults to the 'default' key. */
+  key?: string;
+  /** Comma separated string or array of redirect URIs used by the client. One of these values must exactly match the redirect_uri parameter value used in each authentication request. */
+  redirect_uris?: OidcWriteClientRequestRedirectUrisList;
+}
+export const OidcWriteClientRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    name: S.String.pipe(T.Label()),
+    access_token_ttl: S.optional(S.Number),
+    assignments: S.optional(OidcWriteClientRequestAssignmentsList),
+    authorization_code: S.optional(S.Boolean),
+    client_credentials: S.optional(S.Boolean),
+    client_type: S.optional(S.String),
+    id_token_ttl: S.optional(S.Number),
+    key: S.optional(S.String),
+    redirect_uris: S.optional(OidcWriteClientRequestRedirectUrisList),
+  }).pipe(
+    T.Http({ method: "POST", uri: "/identity/oidc/client/{name}", code: 200 }),
+  ),
+).annotate({
+  identifier: "OidcWriteClientRequest",
+}) as any as S.Schema<OidcWriteClientRequest>;
+
+export interface OidcWriteClientResponse {}
+export const OidcWriteClientResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "OidcWriteClientResponse",
+}) as any as S.Schema<OidcWriteClientResponse>;
+
+/** Comma separated string or array of role client ids allowed to use this key for signing. If empty no roles are allowed. If "*" all roles are allowed. */
+export type OidcWriteKeyRequestAllowedClientIdsList = Array<string>;
+export const OidcWriteKeyRequestAllowedClientIdsList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<OidcWriteKeyRequestAllowedClientIdsList>;
+
+export interface OidcWriteKeyRequest {
+  /** Name of the key */
+  name: string;
+  /** Signing algorithm to use. This will default to RS256. */
+  algorithm?: string;
+  /** Comma separated string or array of role client ids allowed to use this key for signing. If empty no roles are allowed. If "*" all roles are allowed. */
+  allowed_client_ids?: OidcWriteKeyRequestAllowedClientIdsList;
+  /** How often to generate a new keypair. */
+  rotation_period?: number;
+  /** Controls how long the public portion of a key will be available for verification after being rotated. */
+  verification_ttl?: number;
+}
+export const OidcWriteKeyRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    name: S.String.pipe(T.Label()),
+    algorithm: S.optional(S.String),
+    allowed_client_ids: S.optional(OidcWriteKeyRequestAllowedClientIdsList),
+    rotation_period: S.optional(S.Number),
+    verification_ttl: S.optional(S.Number),
+  }).pipe(
+    T.Http({ method: "POST", uri: "/identity/oidc/key/{name}", code: 200 }),
+  ),
+).annotate({
+  identifier: "OidcWriteKeyRequest",
+}) as any as S.Schema<OidcWriteKeyRequest>;
+
+export interface OidcWriteKeyResponse {}
+export const OidcWriteKeyResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "OidcWriteKeyResponse",
+}) as any as S.Schema<OidcWriteKeyResponse>;
+
+/** The client IDs that are permitted to use the provider */
+export type OidcWriteProviderRequestAllowedClientIdsList = Array<string>;
+export const OidcWriteProviderRequestAllowedClientIdsList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<OidcWriteProviderRequestAllowedClientIdsList>;
+
+/** The scopes supported for requesting on the provider */
+export type OidcWriteProviderRequestScopesSupportedList = Array<string>;
+export const OidcWriteProviderRequestScopesSupportedList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<OidcWriteProviderRequestScopesSupportedList>;
+
+export interface OidcWriteProviderRequest {
+  /** Name of the provider */
+  name: string;
+  /** The client IDs that are permitted to use the provider */
+  allowed_client_ids?: OidcWriteProviderRequestAllowedClientIdsList;
+  /** Specifies what will be used for the iss claim of ID tokens. */
+  issuer?: string;
+  /** The scopes supported for requesting on the provider */
+  scopes_supported?: OidcWriteProviderRequestScopesSupportedList;
+}
+export const OidcWriteProviderRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    name: S.String.pipe(T.Label()),
+    allowed_client_ids: S.optional(
+      OidcWriteProviderRequestAllowedClientIdsList,
+    ),
+    issuer: S.optional(S.String),
+    scopes_supported: S.optional(OidcWriteProviderRequestScopesSupportedList),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/identity/oidc/provider/{name}",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "OidcWriteProviderRequest",
+}) as any as S.Schema<OidcWriteProviderRequest>;
+
+export interface OidcWriteProviderResponse {}
+export const OidcWriteProviderResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "OidcWriteProviderResponse",
+}) as any as S.Schema<OidcWriteProviderResponse>;
+
+export interface OidcWriteRoleRequest {
+  /** Name of the role */
+  name: string;
+  /** Optional client_id */
+  client_id?: string;
+  /** The OIDC key to use for generating tokens. The specified key must already exist. */
+  key: string;
+  /** The template string to use for generating tokens. This may be in string-ified JSON or base64 format. */
+  template?: string;
+  /** TTL of the tokens generated against the role. */
+  ttl?: number;
+}
+export const OidcWriteRoleRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    name: S.String.pipe(T.Label()),
+    client_id: S.optional(S.String),
+    key: S.String,
+    template: S.optional(S.String),
+    ttl: S.optional(S.Number),
+  }).pipe(
+    T.Http({ method: "POST", uri: "/identity/oidc/role/{name}", code: 200 }),
+  ),
+).annotate({
+  identifier: "OidcWriteRoleRequest",
+}) as any as S.Schema<OidcWriteRoleRequest>;
+
+export interface OidcWriteRoleResponse {}
+export const OidcWriteRoleResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "OidcWriteRoleResponse",
+}) as any as S.Schema<OidcWriteRoleResponse>;
+
+export interface OidcWriteScopeRequest {
+  /** Name of the scope */
+  name: string;
+  /** The description of the scope */
+  description?: string;
+  /** The template string to use for the scope. This may be in string-ified JSON or base64 format. */
+  template?: string;
+}
+export const OidcWriteScopeRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    name: S.String.pipe(T.Label()),
+    description: S.optional(S.String),
+    template: S.optional(S.String),
+  }).pipe(
+    T.Http({ method: "POST", uri: "/identity/oidc/scope/{name}", code: 200 }),
+  ),
+).annotate({
+  identifier: "OidcWriteScopeRequest",
+}) as any as S.Schema<OidcWriteScopeRequest>;
+
+export interface OidcWriteScopeResponse {}
+export const OidcWriteScopeResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "OidcWriteScopeResponse",
+}) as any as S.Schema<OidcWriteScopeResponse>;
+
+export interface PollOidcWriteOidcRequest {
+  /** Path that the backend was mounted at */
+  oidc_mount_path: string;
+  client_nonce?: string;
+  state?: string;
+}
+export const PollOidcWriteOidcRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    oidc_mount_path: S.String.pipe(T.Label()),
+    client_nonce: S.optional(S.String),
+    state: S.optional(S.String),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/auth/{oidc_mount_path}/oidc/poll",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "PollOidcWriteOidcRequest",
+}) as any as S.Schema<PollOidcWriteOidcRequest>;
+
+export interface PollOidcWriteOidcResponse {}
+export const PollOidcWriteOidcResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "PollOidcWriteOidcResponse",
+}) as any as S.Schema<PollOidcWriteOidcResponse>;
+
+export type AuthorizeOidcProviderError = OpenBaoOpError;
+export const authorizeOidcProvider: API.OperationMethod<
+  AuthorizeOidcProviderRequest,
+  AuthorizeOidcProviderResponse,
+  AuthorizeOidcProviderError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: AuthorizeOidcProviderRequest,
+  output: AuthorizeOidcProviderResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type OidcConfigureError = OpenBaoOpError;
+export const oidcConfigure: API.OperationMethod<
+  OidcConfigureRequest,
+  OidcConfigureResponse,
+  OidcConfigureError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: OidcConfigureRequest,
+  output: OidcConfigureResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type OidcDeleteAssignmentError = OpenBaoOpError;
+export const oidcDeleteAssignment: API.OperationMethod<
+  OidcDeleteAssignmentRequest,
+  OidcDeleteAssignmentResponse,
+  OidcDeleteAssignmentError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: OidcDeleteAssignmentRequest,
+  output: OidcDeleteAssignmentResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type OidcDeleteClientError = OpenBaoOpError;
+export const oidcDeleteClient: API.OperationMethod<
+  OidcDeleteClientRequest,
+  OidcDeleteClientResponse,
+  OidcDeleteClientError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: OidcDeleteClientRequest,
+  output: OidcDeleteClientResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type OidcDeleteKeyError = OpenBaoOpError;
+export const oidcDeleteKey: API.OperationMethod<
+  OidcDeleteKeyRequest,
+  OidcDeleteKeyResponse,
+  OidcDeleteKeyError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: OidcDeleteKeyRequest,
+  output: OidcDeleteKeyResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type OidcDeleteProviderError = OpenBaoOpError;
+export const oidcDeleteProvider: API.OperationMethod<
+  OidcDeleteProviderRequest,
+  OidcDeleteProviderResponse,
+  OidcDeleteProviderError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: OidcDeleteProviderRequest,
+  output: OidcDeleteProviderResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type OidcDeleteRoleError = OpenBaoOpError;
+export const oidcDeleteRole: API.OperationMethod<
+  OidcDeleteRoleRequest,
+  OidcDeleteRoleResponse,
+  OidcDeleteRoleError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: OidcDeleteRoleRequest,
+  output: OidcDeleteRoleResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type OidcDeleteScopeError = OpenBaoOpError;
+export const oidcDeleteScope: API.OperationMethod<
+  OidcDeleteScopeRequest,
+  OidcDeleteScopeResponse,
+  OidcDeleteScopeError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: OidcDeleteScopeRequest,
+  output: OidcDeleteScopeResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type OidcGenerateTokenError = OpenBaoOpError;
+export const oidcGenerateToken: API.OperationMethod<
+  OidcGenerateTokenRequest,
+  OidcGenerateTokenResponse,
+  OidcGenerateTokenError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: OidcGenerateTokenRequest,
+  output: OidcGenerateTokenResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type OidcIntrospectError = OpenBaoOpError;
+export const oidcIntrospect: API.OperationMethod<
+  OidcIntrospectRequest,
+  OidcIntrospectResponse,
+  OidcIntrospectError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: OidcIntrospectRequest,
+  output: OidcIntrospectResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type OidcListAssignmentsError = OpenBaoOpError;
+export const oidcListAssignments: API.OperationMethod<
+  OidcListAssignmentsRequest,
+  OidcListAssignmentsResponse,
+  OidcListAssignmentsError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: OidcListAssignmentsRequest,
+  output: OidcListAssignmentsResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type OidcListClientsError = OpenBaoOpError;
+export const oidcListClients: API.OperationMethod<
+  OidcListClientsRequest,
+  OidcListClientsResponse,
+  OidcListClientsError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: OidcListClientsRequest,
+  output: OidcListClientsResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type OidcListKeysError = OpenBaoOpError;
+export const oidcListKeys: API.OperationMethod<
+  OidcListKeysRequest,
+  OidcListKeysResponse,
+  OidcListKeysError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: OidcListKeysRequest,
+  output: OidcListKeysResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type OidcListProvidersError = OpenBaoOpError;
+export const oidcListProviders: API.OperationMethod<
+  OidcListProvidersRequest,
+  OidcListProvidersResponse,
+  OidcListProvidersError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: OidcListProvidersRequest,
+  output: OidcListProvidersResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type OidcListRolesError = OpenBaoOpError;
+export const oidcListRoles: API.OperationMethod<
+  OidcListRolesRequest,
+  OidcListRolesResponse,
+  OidcListRolesError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: OidcListRolesRequest,
+  output: OidcListRolesResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type OidcListScopesError = OpenBaoOpError;
+export const oidcListScopes: API.OperationMethod<
+  OidcListScopesRequest,
+  OidcListScopesResponse,
+  OidcListScopesError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: OidcListScopesRequest,
+  output: OidcListScopesResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type OidcProviderAuthorizeWithParametersError = OpenBaoOpError;
+export const oidcProviderAuthorizeWithParameters: API.OperationMethod<
+  OidcProviderAuthorizeWithParametersRequest,
+  OidcProviderAuthorizeWithParametersResponse,
+  OidcProviderAuthorizeWithParametersError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: OidcProviderAuthorizeWithParametersRequest,
+  output: OidcProviderAuthorizeWithParametersResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type OidcProviderTokenError = OpenBaoOpError;
+export const oidcProviderToken: API.OperationMethod<
+  OidcProviderTokenRequest,
+  OidcProviderTokenResponse,
+  OidcProviderTokenError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: OidcProviderTokenRequest,
+  output: OidcProviderTokenResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type OidcProviderUserInfoError = OpenBaoOpError;
+export const oidcProviderUserInfo: API.OperationMethod<
+  OidcProviderUserInfoRequest,
+  OidcProviderUserInfoResponse,
+  OidcProviderUserInfoError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: OidcProviderUserInfoRequest,
+  output: OidcProviderUserInfoResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type OidcProviderUserInfo2Error = OpenBaoOpError;
+export const oidcProviderUserInfo2: API.OperationMethod<
+  OidcProviderUserInfo2Request,
+  OidcProviderUserInfo2Response,
+  OidcProviderUserInfo2Error,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: OidcProviderUserInfo2Request,
+  output: OidcProviderUserInfo2Response,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type OidcReadAssignmentError = OpenBaoOpError;
+export const oidcReadAssignment: API.OperationMethod<
+  OidcReadAssignmentRequest,
+  OidcReadAssignmentResponse,
+  OidcReadAssignmentError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: OidcReadAssignmentRequest,
+  output: OidcReadAssignmentResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type OidcReadClientError = OpenBaoOpError;
+export const oidcReadClient: API.OperationMethod<
+  OidcReadClientRequest,
+  OidcReadClientResponse,
+  OidcReadClientError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: OidcReadClientRequest,
+  output: OidcReadClientResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type OidcReadConfigurationError = OpenBaoOpError;
+export const oidcReadConfiguration: API.OperationMethod<
+  OidcReadConfigurationRequest,
+  OidcReadConfigurationResponse,
+  OidcReadConfigurationError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: OidcReadConfigurationRequest,
+  output: OidcReadConfigurationResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type OidcReadKeyError = OpenBaoOpError;
+export const oidcReadKey: API.OperationMethod<
+  OidcReadKeyRequest,
+  OidcReadKeyResponse,
+  OidcReadKeyError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: OidcReadKeyRequest,
+  output: OidcReadKeyResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type OidcReadOpenIdConfigurationError = OpenBaoOpError;
+export const oidcReadOpenIdConfiguration: API.OperationMethod<
+  OidcReadOpenIdConfigurationRequest,
+  OidcReadOpenIdConfigurationResponse,
+  OidcReadOpenIdConfigurationError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: OidcReadOpenIdConfigurationRequest,
+  output: OidcReadOpenIdConfigurationResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type OidcReadProviderError = OpenBaoOpError;
+export const oidcReadProvider: API.OperationMethod<
+  OidcReadProviderRequest,
+  OidcReadProviderResponse,
+  OidcReadProviderError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: OidcReadProviderRequest,
+  output: OidcReadProviderResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type OidcReadProviderOpenIdConfigurationError = OpenBaoOpError;
+export const oidcReadProviderOpenIdConfiguration: API.OperationMethod<
+  OidcReadProviderOpenIdConfigurationRequest,
+  OidcReadProviderOpenIdConfigurationResponse,
+  OidcReadProviderOpenIdConfigurationError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: OidcReadProviderOpenIdConfigurationRequest,
+  output: OidcReadProviderOpenIdConfigurationResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type OidcReadProviderPublicKeysError = OpenBaoOpError;
+export const oidcReadProviderPublicKeys: API.OperationMethod<
+  OidcReadProviderPublicKeysRequest,
+  OidcReadProviderPublicKeysResponse,
+  OidcReadProviderPublicKeysError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: OidcReadProviderPublicKeysRequest,
+  output: OidcReadProviderPublicKeysResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type OidcReadPublicKeysError = OpenBaoOpError;
+export const oidcReadPublicKeys: API.OperationMethod<
+  OidcReadPublicKeysRequest,
+  OidcReadPublicKeysResponse,
+  OidcReadPublicKeysError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: OidcReadPublicKeysRequest,
+  output: OidcReadPublicKeysResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type OidcReadRoleError = OpenBaoOpError;
+export const oidcReadRole: API.OperationMethod<
+  OidcReadRoleRequest,
+  OidcReadRoleResponse,
+  OidcReadRoleError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: OidcReadRoleRequest,
+  output: OidcReadRoleResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type OidcReadScopeError = OpenBaoOpError;
+export const oidcReadScope: API.OperationMethod<
+  OidcReadScopeRequest,
+  OidcReadScopeResponse,
+  OidcReadScopeError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: OidcReadScopeRequest,
+  output: OidcReadScopeResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type OidcRotateKeyError = OpenBaoOpError;
+export const oidcRotateKey: API.OperationMethod<
+  OidcRotateKeyRequest,
+  OidcRotateKeyResponse,
+  OidcRotateKeyError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: OidcRotateKeyRequest,
+  output: OidcRotateKeyResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type OidcWriteAssignmentError = OpenBaoOpError;
+export const oidcWriteAssignment: API.OperationMethod<
+  OidcWriteAssignmentRequest,
+  OidcWriteAssignmentResponse,
+  OidcWriteAssignmentError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: OidcWriteAssignmentRequest,
+  output: OidcWriteAssignmentResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type OidcWriteClientError = OpenBaoOpError;
+export const oidcWriteClient: API.OperationMethod<
+  OidcWriteClientRequest,
+  OidcWriteClientResponse,
+  OidcWriteClientError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: OidcWriteClientRequest,
+  output: OidcWriteClientResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type OidcWriteKeyError = OpenBaoOpError;
+export const oidcWriteKey: API.OperationMethod<
+  OidcWriteKeyRequest,
+  OidcWriteKeyResponse,
+  OidcWriteKeyError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: OidcWriteKeyRequest,
+  output: OidcWriteKeyResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type OidcWriteProviderError = OpenBaoOpError;
+export const oidcWriteProvider: API.OperationMethod<
+  OidcWriteProviderRequest,
+  OidcWriteProviderResponse,
+  OidcWriteProviderError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: OidcWriteProviderRequest,
+  output: OidcWriteProviderResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type OidcWriteRoleError = OpenBaoOpError;
+export const oidcWriteRole: API.OperationMethod<
+  OidcWriteRoleRequest,
+  OidcWriteRoleResponse,
+  OidcWriteRoleError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: OidcWriteRoleRequest,
+  output: OidcWriteRoleResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type OidcWriteScopeError = OpenBaoOpError;
+export const oidcWriteScope: API.OperationMethod<
+  OidcWriteScopeRequest,
+  OidcWriteScopeResponse,
+  OidcWriteScopeError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: OidcWriteScopeRequest,
+  output: OidcWriteScopeResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type PollOidcWriteOidcError = OpenBaoOpError;
+/** Poll endpoint to complete an OIDC login. */
+export const pollOidcWriteOidc: API.OperationMethod<
+  PollOidcWriteOidcRequest,
+  PollOidcWriteOidcResponse,
+  PollOidcWriteOidcError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: PollOidcWriteOidcRequest,
+  output: PollOidcWriteOidcResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));