@homeflare/distilled-openbao 0.2.0

package/src/services/rekey.ts

@@ -0,0 +1,540 @@
+// AUTO-GENERATED by scripts/generate.ts from .generated-specs (specs/spec-mirror-openbao, generated — see fetch-specs.ts). Do not edit.
+import * as S from "@distilled.cloud/core/schema";
+import * as API from "@distilled.cloud/core/api";
+import * as T from "../traits.ts";
+import {
+  OpenBaoProtocol,
+  type OpenBaoOpError,
+  type OpenBaoOpContext,
+} from "../protocol.ts";
+import * as Retry from "../retry.ts";
+
+export type { OpenBaoOpError, OpenBaoOpContext };
+
+export interface CancelRekeyAttemptRequest {}
+export const CancelRekeyAttemptRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}).pipe(
+    T.Http({ method: "DELETE", uri: "/sys/rekey/init", code: 200 }),
+  ),
+).annotate({
+  identifier: "CancelRekeyAttemptRequest",
+}) as any as S.Schema<CancelRekeyAttemptRequest>;
+
+export interface CancelRekeyAttemptResponse {}
+export const CancelRekeyAttemptResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "CancelRekeyAttemptResponse",
+}) as any as S.Schema<CancelRekeyAttemptResponse>;
+
+export interface CancelRekeyVerificationRequest {}
+export const CancelRekeyVerificationRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}).pipe(
+    T.Http({ method: "DELETE", uri: "/sys/rekey/verify", code: 200 }),
+  ),
+).annotate({
+  identifier: "CancelRekeyVerificationRequest",
+}) as any as S.Schema<CancelRekeyVerificationRequest>;
+
+export interface RekeyVerificationCancelResponse {
+  n?: number;
+  nounce?: string;
+  progress?: number;
+  started?: string;
+  t?: number;
+}
+export const RekeyVerificationCancelResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    n: S.optional(S.Number),
+    nounce: S.optional(S.String),
+    progress: S.optional(S.Number),
+    started: S.optional(S.String),
+    t: S.optional(S.Number),
+  }),
+).annotate({
+  identifier: "RekeyVerificationCancelResponse",
+}) as any as S.Schema<RekeyVerificationCancelResponse>;
+
+/** Specifies an array of PGP public keys used to encrypt the output unseal keys. Ordering is preserved. The keys must be base64-encoded from their original binary representation. The size of this array must be the same as secret_shares. */
+export type RekeyAttemptInitializeRequestPgpKeysList = Array<string>;
+export const RekeyAttemptInitializeRequestPgpKeysList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<RekeyAttemptInitializeRequestPgpKeysList>;
+
+export interface RekeyAttemptInitializeRequest {
+  /** Specifies if using PGP-encrypted keys, whether OpenBao should also store a plaintext backup of the PGP-encrypted keys. */
+  backup?: boolean;
+  /** Specifies an array of PGP public keys used to encrypt the output unseal keys. Ordering is preserved. The keys must be base64-encoded from their original binary representation. The size of this array must be the same as secret_shares. */
+  pgp_keys?: RekeyAttemptInitializeRequestPgpKeysList;
+  /** Turns on verification functionality */
+  require_verification?: boolean;
+  /** Specifies the number of shares to split the unseal key into. */
+  secret_shares?: number;
+  /** Specifies the number of shares required to reconstruct the unseal key. This must be less than or equal secret_shares. If using OpenBao HSM with auto-unsealing, this value must be the same as secret_shares. */
+  secret_threshold?: number;
+}
+export const RekeyAttemptInitializeRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    backup: S.optional(S.Boolean),
+    pgp_keys: S.optional(RekeyAttemptInitializeRequestPgpKeysList),
+    require_verification: S.optional(S.Boolean),
+    secret_shares: S.optional(S.Number),
+    secret_threshold: S.optional(S.Number),
+  }).pipe(T.Http({ method: "POST", uri: "/sys/rekey/init", code: 200 })),
+).annotate({
+  identifier: "RekeyAttemptInitializeRequest",
+}) as any as S.Schema<RekeyAttemptInitializeRequest>;
+
+export type RekeyAttemptInitializeResponsePgpFingerprintsList = Array<string>;
+export const RekeyAttemptInitializeResponsePgpFingerprintsList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<RekeyAttemptInitializeResponsePgpFingerprintsList>;
+
+export interface RekeyAttemptInitializeResponse {
+  backup?: boolean;
+  n?: number;
+  nounce?: string;
+  pgp_fingerprints?: RekeyAttemptInitializeResponsePgpFingerprintsList;
+  progress?: number;
+  required?: number;
+  started?: string;
+  t?: number;
+  verification_nonce?: string;
+  verification_required?: boolean;
+}
+export const RekeyAttemptInitializeResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    backup: S.optional(S.Boolean),
+    n: S.optional(S.Number),
+    nounce: S.optional(S.String),
+    pgp_fingerprints: S.optional(
+      RekeyAttemptInitializeResponsePgpFingerprintsList,
+    ),
+    progress: S.optional(S.Number),
+    required: S.optional(S.Number),
+    started: S.optional(S.String),
+    t: S.optional(S.Number),
+    verification_nonce: S.optional(S.String),
+    verification_required: S.optional(S.Boolean),
+  }),
+).annotate({
+  identifier: "RekeyAttemptInitializeResponse",
+}) as any as S.Schema<RekeyAttemptInitializeResponse>;
+
+export interface RekeyAttemptReadProgressRequest {}
+export const RekeyAttemptReadProgressRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}).pipe(
+    T.Http({ method: "GET", uri: "/sys/rekey/init", code: 200 }),
+  ),
+).annotate({
+  identifier: "RekeyAttemptReadProgressRequest",
+}) as any as S.Schema<RekeyAttemptReadProgressRequest>;
+
+export type RekeyAttemptReadProgressResponsePgpFingerprintsList = Array<string>;
+export const RekeyAttemptReadProgressResponsePgpFingerprintsList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<RekeyAttemptReadProgressResponsePgpFingerprintsList>;
+
+export interface RekeyAttemptReadProgressResponse {
+  backup?: boolean;
+  n?: number;
+  nounce?: string;
+  pgp_fingerprints?: RekeyAttemptReadProgressResponsePgpFingerprintsList;
+  progress?: number;
+  required?: number;
+  started?: string;
+  t?: number;
+  verification_nonce?: string;
+  verification_required?: boolean;
+}
+export const RekeyAttemptReadProgressResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    backup: S.optional(S.Boolean),
+    n: S.optional(S.Number),
+    nounce: S.optional(S.String),
+    pgp_fingerprints: S.optional(
+      RekeyAttemptReadProgressResponsePgpFingerprintsList,
+    ),
+    progress: S.optional(S.Number),
+    required: S.optional(S.Number),
+    started: S.optional(S.String),
+    t: S.optional(S.Number),
+    verification_nonce: S.optional(S.String),
+    verification_required: S.optional(S.Boolean),
+  }),
+).annotate({
+  identifier: "RekeyAttemptReadProgressResponse",
+}) as any as S.Schema<RekeyAttemptReadProgressResponse>;
+
+export interface RekeyDeleteBackupKeyRequest {}
+export const RekeyDeleteBackupKeyRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}).pipe(
+    T.Http({ method: "DELETE", uri: "/sys/rekey/backup", code: 200 }),
+  ),
+).annotate({
+  identifier: "RekeyDeleteBackupKeyRequest",
+}) as any as S.Schema<RekeyDeleteBackupKeyRequest>;
+
+export interface RekeyDeleteBackupKeyResponse {}
+export const RekeyDeleteBackupKeyResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "RekeyDeleteBackupKeyResponse",
+}) as any as S.Schema<RekeyDeleteBackupKeyResponse>;
+
+export interface RekeyDeleteBackupRecoveryKeyRequest {}
+export const RekeyDeleteBackupRecoveryKeyRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}).pipe(
+    T.Http({
+      method: "DELETE",
+      uri: "/sys/rekey/recovery-key-backup",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "RekeyDeleteBackupRecoveryKeyRequest",
+}) as any as S.Schema<RekeyDeleteBackupRecoveryKeyRequest>;
+
+export interface RekeyDeleteBackupRecoveryKeyResponse {}
+export const RekeyDeleteBackupRecoveryKeyResponse = /*@__PURE__*/ S.suspend(
+  () => S.Struct({}),
+).annotate({
+  identifier: "RekeyDeleteBackupRecoveryKeyResponse",
+}) as any as S.Schema<RekeyDeleteBackupRecoveryKeyResponse>;
+
+export interface RekeyReadBackupKeyRequest {}
+export const RekeyReadBackupKeyRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}).pipe(
+    T.Http({ method: "GET", uri: "/sys/rekey/backup", code: 200 }),
+  ),
+).annotate({
+  identifier: "RekeyReadBackupKeyRequest",
+}) as any as S.Schema<RekeyReadBackupKeyRequest>;
+
+export interface RekeyReadBackupKeyResponse {
+  keys?: unknown;
+  keys_base64?: unknown;
+  nonce?: string;
+}
+export const RekeyReadBackupKeyResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    keys: S.optional(S.Unknown),
+    keys_base64: S.optional(S.Unknown),
+    nonce: S.optional(S.String),
+  }),
+).annotate({
+  identifier: "RekeyReadBackupKeyResponse",
+}) as any as S.Schema<RekeyReadBackupKeyResponse>;
+
+export interface RekeyReadBackupRecoveryKeyRequest {}
+export const RekeyReadBackupRecoveryKeyRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}).pipe(
+    T.Http({ method: "GET", uri: "/sys/rekey/recovery-key-backup", code: 200 }),
+  ),
+).annotate({
+  identifier: "RekeyReadBackupRecoveryKeyRequest",
+}) as any as S.Schema<RekeyReadBackupRecoveryKeyRequest>;
+
+export interface RekeyReadBackupRecoveryKeyResponse {
+  keys?: unknown;
+  keys_base64?: unknown;
+  nonce?: string;
+}
+export const RekeyReadBackupRecoveryKeyResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    keys: S.optional(S.Unknown),
+    keys_base64: S.optional(S.Unknown),
+    nonce: S.optional(S.String),
+  }),
+).annotate({
+  identifier: "RekeyReadBackupRecoveryKeyResponse",
+}) as any as S.Schema<RekeyReadBackupRecoveryKeyResponse>;
+
+export interface RekeyVerificationReadProgressRequest {}
+export const RekeyVerificationReadProgressRequest = /*@__PURE__*/ S.suspend(
+  () =>
+    S.Struct({}).pipe(
+      T.Http({ method: "GET", uri: "/sys/rekey/verify", code: 200 }),
+    ),
+).annotate({
+  identifier: "RekeyVerificationReadProgressRequest",
+}) as any as S.Schema<RekeyVerificationReadProgressRequest>;
+
+export interface RekeyVerificationReadProgressResponse {
+  n?: number;
+  nounce?: string;
+  progress?: number;
+  started?: string;
+  t?: number;
+}
+export const RekeyVerificationReadProgressResponse = /*@__PURE__*/ S.suspend(
+  () =>
+    S.Struct({
+      n: S.optional(S.Number),
+      nounce: S.optional(S.String),
+      progress: S.optional(S.Number),
+      started: S.optional(S.String),
+      t: S.optional(S.Number),
+    }),
+).annotate({
+  identifier: "RekeyVerificationReadProgressResponse",
+}) as any as S.Schema<RekeyVerificationReadProgressResponse>;
+
+export interface UpdateRekeyAttemptRequest {
+  /** Specifies a single unseal key share. */
+  key?: string;
+  /** Specifies the nonce of the rekey attempt. */
+  nonce?: string;
+}
+export const UpdateRekeyAttemptRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    key: S.optional(S.String),
+    nonce: S.optional(S.String),
+  }).pipe(T.Http({ method: "POST", uri: "/sys/rekey/update", code: 200 })),
+).annotate({
+  identifier: "UpdateRekeyAttemptRequest",
+}) as any as S.Schema<UpdateRekeyAttemptRequest>;
+
+export type RekeyAttemptUpdateResponseKeysList = Array<string>;
+export const RekeyAttemptUpdateResponseKeysList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<RekeyAttemptUpdateResponseKeysList>;
+
+export type RekeyAttemptUpdateResponseKeysBase64List = Array<string>;
+export const RekeyAttemptUpdateResponseKeysBase64List = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<RekeyAttemptUpdateResponseKeysBase64List>;
+
+export type RekeyAttemptUpdateResponsePgpFingerprintsList = Array<string>;
+export const RekeyAttemptUpdateResponsePgpFingerprintsList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<RekeyAttemptUpdateResponsePgpFingerprintsList>;
+
+export interface RekeyAttemptUpdateResponse {
+  backup?: boolean;
+  complete?: boolean;
+  keys?: RekeyAttemptUpdateResponseKeysList;
+  keys_base64?: RekeyAttemptUpdateResponseKeysBase64List;
+  n?: number;
+  nounce?: string;
+  pgp_fingerprints?: RekeyAttemptUpdateResponsePgpFingerprintsList;
+  progress?: number;
+  required?: number;
+  started?: string;
+  t?: number;
+  verification_nonce?: string;
+  verification_required?: boolean;
+}
+export const RekeyAttemptUpdateResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    backup: S.optional(S.Boolean),
+    complete: S.optional(S.Boolean),
+    keys: S.optional(RekeyAttemptUpdateResponseKeysList),
+    keys_base64: S.optional(RekeyAttemptUpdateResponseKeysBase64List),
+    n: S.optional(S.Number),
+    nounce: S.optional(S.String),
+    pgp_fingerprints: S.optional(RekeyAttemptUpdateResponsePgpFingerprintsList),
+    progress: S.optional(S.Number),
+    required: S.optional(S.Number),
+    started: S.optional(S.String),
+    t: S.optional(S.Number),
+    verification_nonce: S.optional(S.String),
+    verification_required: S.optional(S.Boolean),
+  }),
+).annotate({
+  identifier: "RekeyAttemptUpdateResponse",
+}) as any as S.Schema<RekeyAttemptUpdateResponse>;
+
+export interface UpdateRekeyVerificationRequest {
+  /** Specifies a single unseal share key from the new set of shares. */
+  key?: string;
+  /** Specifies the nonce of the rekey verification operation. */
+  nonce?: string;
+}
+export const UpdateRekeyVerificationRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    key: S.optional(S.String),
+    nonce: S.optional(S.String),
+  }).pipe(T.Http({ method: "POST", uri: "/sys/rekey/verify", code: 200 })),
+).annotate({
+  identifier: "UpdateRekeyVerificationRequest",
+}) as any as S.Schema<UpdateRekeyVerificationRequest>;
+
+export interface RekeyVerificationUpdateResponse {
+  complete?: boolean;
+  nounce?: string;
+}
+export const RekeyVerificationUpdateResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    complete: S.optional(S.Boolean),
+    nounce: S.optional(S.String),
+  }),
+).annotate({
+  identifier: "RekeyVerificationUpdateResponse",
+}) as any as S.Schema<RekeyVerificationUpdateResponse>;
+
+export type CancelRekeyAttemptError = OpenBaoOpError;
+/** Cancels any in-progress rekey. This clears the rekey settings as well as any progress made. This must be called to change the parameters of the rekey. Note: verification is still a part of a rekey. If rekeying is canceled during the verification flow, the current unseal keys remain valid. */
+export const cancelRekeyAttempt: API.OperationMethod<
+  CancelRekeyAttemptRequest,
+  CancelRekeyAttemptResponse,
+  CancelRekeyAttemptError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: CancelRekeyAttemptRequest,
+  output: CancelRekeyAttemptResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type CancelRekeyVerificationError = OpenBaoOpError;
+/** Cancel any in-progress rekey verification operation. This clears any progress made and resets the nonce. Unlike a `DELETE` against `sys/rekey/init`, this only resets the current verification operation, not the entire rekey atttempt. */
+export const cancelRekeyVerification: API.OperationMethod<
+  CancelRekeyVerificationRequest,
+  RekeyVerificationCancelResponse,
+  CancelRekeyVerificationError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: CancelRekeyVerificationRequest,
+  output: RekeyVerificationCancelResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type RekeyAttemptInitializeError = OpenBaoOpError;
+/** Initializes a new rekey attempt. Only a single rekey attempt can take place at a time, and changing the parameters of a rekey requires canceling and starting a new rekey, which will also provide a new nonce. */
+export const rekeyAttemptInitialize: API.OperationMethod<
+  RekeyAttemptInitializeRequest,
+  RekeyAttemptInitializeResponse,
+  RekeyAttemptInitializeError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: RekeyAttemptInitializeRequest,
+  output: RekeyAttemptInitializeResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type RekeyAttemptReadProgressError = OpenBaoOpError;
+/** Reads the configuration and progress of the current rekey attempt. */
+export const rekeyAttemptReadProgress: API.OperationMethod<
+  RekeyAttemptReadProgressRequest,
+  RekeyAttemptReadProgressResponse,
+  RekeyAttemptReadProgressError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: RekeyAttemptReadProgressRequest,
+  output: RekeyAttemptReadProgressResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type RekeyDeleteBackupKeyError = OpenBaoOpError;
+/** Delete the backup copy of PGP-encrypted unseal keys. */
+export const rekeyDeleteBackupKey: API.OperationMethod<
+  RekeyDeleteBackupKeyRequest,
+  RekeyDeleteBackupKeyResponse,
+  RekeyDeleteBackupKeyError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: RekeyDeleteBackupKeyRequest,
+  output: RekeyDeleteBackupKeyResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type RekeyDeleteBackupRecoveryKeyError = OpenBaoOpError;
+export const rekeyDeleteBackupRecoveryKey: API.OperationMethod<
+  RekeyDeleteBackupRecoveryKeyRequest,
+  RekeyDeleteBackupRecoveryKeyResponse,
+  RekeyDeleteBackupRecoveryKeyError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: RekeyDeleteBackupRecoveryKeyRequest,
+  output: RekeyDeleteBackupRecoveryKeyResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type RekeyReadBackupKeyError = OpenBaoOpError;
+/** Return the backup copy of PGP-encrypted unseal keys. */
+export const rekeyReadBackupKey: API.OperationMethod<
+  RekeyReadBackupKeyRequest,
+  RekeyReadBackupKeyResponse,
+  RekeyReadBackupKeyError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: RekeyReadBackupKeyRequest,
+  output: RekeyReadBackupKeyResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type RekeyReadBackupRecoveryKeyError = OpenBaoOpError;
+export const rekeyReadBackupRecoveryKey: API.OperationMethod<
+  RekeyReadBackupRecoveryKeyRequest,
+  RekeyReadBackupRecoveryKeyResponse,
+  RekeyReadBackupRecoveryKeyError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: RekeyReadBackupRecoveryKeyRequest,
+  output: RekeyReadBackupRecoveryKeyResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type RekeyVerificationReadProgressError = OpenBaoOpError;
+/** Read the configuration and progress of the current rekey verification attempt. */
+export const rekeyVerificationReadProgress: API.OperationMethod<
+  RekeyVerificationReadProgressRequest,
+  RekeyVerificationReadProgressResponse,
+  RekeyVerificationReadProgressError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: RekeyVerificationReadProgressRequest,
+  output: RekeyVerificationReadProgressResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type UpdateRekeyAttemptError = OpenBaoOpError;
+/** Enter a single unseal key share to progress the rekey of the OpenBao. */
+export const updateRekeyAttempt: API.OperationMethod<
+  UpdateRekeyAttemptRequest,
+  RekeyAttemptUpdateResponse,
+  UpdateRekeyAttemptError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: UpdateRekeyAttemptRequest,
+  output: RekeyAttemptUpdateResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type UpdateRekeyVerificationError = OpenBaoOpError;
+/** Enter a single new key share to progress the rekey verification operation. */
+export const updateRekeyVerification: API.OperationMethod<
+  UpdateRekeyVerificationRequest,
+  RekeyVerificationUpdateResponse,
+  UpdateRekeyVerificationError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: UpdateRekeyVerificationRequest,
+  output: RekeyVerificationUpdateResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));

package/src/services/reload.ts

@@ -0,0 +1,51 @@
+// AUTO-GENERATED by scripts/generate.ts from .generated-specs (specs/spec-mirror-openbao, generated — see fetch-specs.ts). Do not edit.
+import * as S from "@distilled.cloud/core/schema";
+import * as API from "@distilled.cloud/core/api";
+import * as T from "../traits.ts";
+import {
+  OpenBaoProtocol,
+  type OpenBaoOpError,
+  type OpenBaoOpContext,
+} from "../protocol.ts";
+import * as Retry from "../retry.ts";
+
+export type { OpenBaoOpError, OpenBaoOpContext };
+
+export interface ReloadSubsystemRequest {
+  subsystem: string;
+}
+export const ReloadSubsystemRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    subsystem: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/sys/config/reload/{subsystem}",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "ReloadSubsystemRequest",
+}) as any as S.Schema<ReloadSubsystemRequest>;
+
+export interface ReloadSubsystemResponse {}
+export const ReloadSubsystemResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "ReloadSubsystemResponse",
+}) as any as S.Schema<ReloadSubsystemResponse>;
+
+export type ReloadSubsystemError = OpenBaoOpError;
+/** Reload the given subsystem */
+export const reloadSubsystem: API.OperationMethod<
+  ReloadSubsystemRequest,
+  ReloadSubsystemResponse,
+  ReloadSubsystemError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: ReloadSubsystemRequest,
+  output: ReloadSubsystemResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));

package/src/services/remount.ts

@@ -0,0 +1,58 @@
+// AUTO-GENERATED by scripts/generate.ts from .generated-specs (specs/spec-mirror-openbao, generated — see fetch-specs.ts). Do not edit.
+import * as S from "@distilled.cloud/core/schema";
+import * as API from "@distilled.cloud/core/api";
+import * as T from "../traits.ts";
+import {
+  OpenBaoProtocol,
+  type OpenBaoOpError,
+  type OpenBaoOpContext,
+} from "../protocol.ts";
+import * as Retry from "../retry.ts";
+
+export type { OpenBaoOpError, OpenBaoOpContext };
+
+export interface RemountStatusRequest {
+  /** The ID of the migration operation */
+  migration_id: string;
+}
+export const RemountStatusRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    migration_id: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/sys/remount/status/{migration_id}",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "RemountStatusRequest",
+}) as any as S.Schema<RemountStatusRequest>;
+
+export interface RemountStatusResponse {
+  migration_id?: string;
+  migration_info?: unknown;
+}
+export const RemountStatusResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    migration_id: S.optional(S.String),
+    migration_info: S.optional(S.Unknown),
+  }),
+).annotate({
+  identifier: "RemountStatusResponse",
+}) as any as S.Schema<RemountStatusResponse>;
+
+export type RemountStatusError = OpenBaoOpError;
+/** Check status of a mount migration */
+export const remountStatus: API.OperationMethod<
+  RemountStatusRequest,
+  RemountStatusResponse,
+  RemountStatusError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: RemountStatusRequest,
+  output: RemountStatusResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));