@homeflare/distilled-openbao 0.2.0

package/src/services/ssh.ts

@@ -0,0 +1,1351 @@
+// AUTO-GENERATED by scripts/generate.ts from .generated-specs (specs/spec-mirror-openbao, generated — see fetch-specs.ts). Do not edit.
+import * as S from "@distilled.cloud/core/schema";
+import * as API from "@distilled.cloud/core/api";
+import * as T from "../traits.ts";
+import {
+  OpenBaoProtocol,
+  type OpenBaoOpError,
+  type OpenBaoOpContext,
+} from "../protocol.ts";
+import * as Retry from "../retry.ts";
+
+export type { OpenBaoOpError, OpenBaoOpContext };
+
+export interface SshConfigureDefaultCaRequest {
+  /** Path that the backend was mounted at */
+  ssh_mount_path: string;
+  /** Generate SSH key pair internally rather than use the private_key and public_key fields. */
+  generate_signing_key?: boolean;
+  /** Optional issuer name that can be used to identify the issuer. */
+  issuer_name?: string;
+  /** Specifies the desired key bits when generating variable-length keys (such as when key_type="ssh-rsa") or which NIST P-curve to use when key_type="ec" (256, 384, or 521). */
+  key_bits?: number;
+  /** Specifies the desired key type when generating; could be a OpenSSH key type identifier (ssh-rsa, ecdsa-sha2-nistp256, ecdsa-sha2-nistp384, ecdsa-sha2-nistp521, or ssh-ed25519) or an algorithm (rsa, ec, ed25519). */
+  key_type?: string;
+  /** Private half of the SSH key that will be used to sign certificates. */
+  private_key?: string;
+  /** Public half of the SSH key that will be used to sign certificates. */
+  public_key?: string;
+}
+export const SshConfigureDefaultCaRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    ssh_mount_path: S.String.pipe(T.Label()),
+    generate_signing_key: S.optional(S.Boolean),
+    issuer_name: S.optional(S.String),
+    key_bits: S.optional(S.Number),
+    key_type: S.optional(S.String),
+    private_key: S.optional(S.String),
+    public_key: S.optional(S.String),
+  }).pipe(
+    T.Http({ method: "POST", uri: "/{ssh_mount_path}/config/ca", code: 200 }),
+  ),
+).annotate({
+  identifier: "SshConfigureDefaultCaRequest",
+}) as any as S.Schema<SshConfigureDefaultCaRequest>;
+
+export interface SshConfigureDefaultCaResponse {
+  /** Issuer Id */
+  issuer_id?: string;
+  /** Issuer Name */
+  issuer_name?: string;
+  /** Issuer public key */
+  public_key?: boolean;
+}
+export const SshConfigureDefaultCaResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    issuer_id: S.optional(S.String),
+    issuer_name: S.optional(S.String),
+    public_key: S.optional(S.Boolean),
+  }),
+).annotate({
+  identifier: "SshConfigureDefaultCaResponse",
+}) as any as S.Schema<SshConfigureDefaultCaResponse>;
+
+/** [Required] Comma separated list of role names which allows credentials to be requested for any IP address. CIDR blocks previously registered under these roles will be ignored. */
+export type SshConfigureZeroAddressRequestRolesList = Array<string>;
+export const SshConfigureZeroAddressRequestRolesList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<SshConfigureZeroAddressRequestRolesList>;
+
+export interface SshConfigureZeroAddressRequest {
+  /** Path that the backend was mounted at */
+  ssh_mount_path: string;
+  /** [Required] Comma separated list of role names which allows credentials to be requested for any IP address. CIDR blocks previously registered under these roles will be ignored. */
+  roles?: SshConfigureZeroAddressRequestRolesList;
+}
+export const SshConfigureZeroAddressRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    ssh_mount_path: S.String.pipe(T.Label()),
+    roles: S.optional(SshConfigureZeroAddressRequestRolesList),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/{ssh_mount_path}/config/zeroaddress",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "SshConfigureZeroAddressRequest",
+}) as any as S.Schema<SshConfigureZeroAddressRequest>;
+
+export interface SshConfigureZeroAddressResponse {}
+export const SshConfigureZeroAddressResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "SshConfigureZeroAddressResponse",
+}) as any as S.Schema<SshConfigureZeroAddressResponse>;
+
+export interface SshDeleteIssuerRequest {
+  /** Path that the backend was mounted at */
+  ssh_mount_path: string;
+  /** Reference to a existing issuer; either "default" for the configured default issuer, an identifier or the name assigned to the issuer. */
+  issuer_ref: string;
+}
+export const SshDeleteIssuerRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    ssh_mount_path: S.String.pipe(T.Label()),
+    issuer_ref: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "DELETE",
+      uri: "/{ssh_mount_path}/issuer/{issuer_ref}",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "SshDeleteIssuerRequest",
+}) as any as S.Schema<SshDeleteIssuerRequest>;
+
+export interface SshDeleteIssuerResponse {}
+export const SshDeleteIssuerResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "SshDeleteIssuerResponse",
+}) as any as S.Schema<SshDeleteIssuerResponse>;
+
+export interface SshDeleteRoleRequest {
+  /** Path that the backend was mounted at */
+  ssh_mount_path: string;
+  /** [Required for all types] Name of the role being created. */
+  role: string;
+}
+export const SshDeleteRoleRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    ssh_mount_path: S.String.pipe(T.Label()),
+    role: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "DELETE",
+      uri: "/{ssh_mount_path}/roles/{role}",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "SshDeleteRoleRequest",
+}) as any as S.Schema<SshDeleteRoleRequest>;
+
+export interface SshDeleteRoleResponse {}
+export const SshDeleteRoleResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "SshDeleteRoleResponse",
+}) as any as S.Schema<SshDeleteRoleResponse>;
+
+export interface SshDeleteZeroAddressConfigurationRequest {
+  /** Path that the backend was mounted at */
+  ssh_mount_path: string;
+}
+export const SshDeleteZeroAddressConfigurationRequest = /*@__PURE__*/ S.suspend(
+  () =>
+    S.Struct({
+      ssh_mount_path: S.String.pipe(T.Label()),
+    }).pipe(
+      T.Http({
+        method: "DELETE",
+        uri: "/{ssh_mount_path}/config/zeroaddress",
+        code: 200,
+      }),
+    ),
+).annotate({
+  identifier: "SshDeleteZeroAddressConfigurationRequest",
+}) as any as S.Schema<SshDeleteZeroAddressConfigurationRequest>;
+
+export interface SshDeleteZeroAddressConfigurationResponse {}
+export const SshDeleteZeroAddressConfigurationResponse =
+  /*@__PURE__*/ S.suspend(() => S.Struct({})).annotate({
+    identifier: "SshDeleteZeroAddressConfigurationResponse",
+  }) as any as S.Schema<SshDeleteZeroAddressConfigurationResponse>;
+
+export interface SshGenerateCredentialsRequest {
+  /** Path that the backend was mounted at */
+  ssh_mount_path: string;
+  /** [Required] Name of the role */
+  role: string;
+  /** [Required] IP of the remote host */
+  ip?: string;
+  /** [Optional] Username in remote host */
+  username?: string;
+}
+export const SshGenerateCredentialsRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    ssh_mount_path: S.String.pipe(T.Label()),
+    role: S.String.pipe(T.Label()),
+    ip: S.optional(S.String),
+    username: S.optional(S.String),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/{ssh_mount_path}/creds/{role}",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "SshGenerateCredentialsRequest",
+}) as any as S.Schema<SshGenerateCredentialsRequest>;
+
+export interface SshGenerateCredentialsResponse {}
+export const SshGenerateCredentialsResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "SshGenerateCredentialsResponse",
+}) as any as S.Schema<SshGenerateCredentialsResponse>;
+
+export interface SshGetIssuerRequest {
+  /** Path that the backend was mounted at */
+  ssh_mount_path: string;
+  /** Reference to a existing issuer; either "default" for the configured default issuer, an identifier or the name assigned to the issuer. */
+  issuer_ref: string;
+}
+export const SshGetIssuerRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    ssh_mount_path: S.String.pipe(T.Label()),
+    issuer_ref: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/{ssh_mount_path}/issuer/{issuer_ref}/public_key",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "SshGetIssuerRequest",
+}) as any as S.Schema<SshGetIssuerRequest>;
+
+export interface SshGetIssuerResponse {}
+export const SshGetIssuerResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "SshGetIssuerResponse",
+}) as any as S.Schema<SshGetIssuerResponse>;
+
+export interface SshIssueCertificateRequest {
+  /** Path that the backend was mounted at */
+  ssh_mount_path: string;
+  /** The desired role with configuration for this request. */
+  role: string;
+  /** Type of certificate to be created; either "user" or "host". */
+  cert_type?: string;
+  /** Critical options that the certificate should be signed for. */
+  critical_options?: unknown;
+  /** Extensions that the certificate should be signed for. */
+  extensions?: unknown;
+  /** Specifies the number of bits to use for the generated keys. */
+  key_bits?: number;
+  /** Key id that the created certificate should have. If not specified, the display name of the token will be used. */
+  key_id?: string;
+  /** Specifies the desired key type; must be `rsa`, `ed25519` or `ec` */
+  key_type?: string;
+  /** The requested Time To Live for the SSH certificate; sets the expiration date. If not specified the role default, backend default, or system default TTL is used, in that order. Cannot be later than the role max TTL. */
+  ttl?: number;
+  /** Valid principals, either usernames or hostnames, that the certificate should be signed for. */
+  valid_principals?: string;
+}
+export const SshIssueCertificateRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    ssh_mount_path: S.String.pipe(T.Label()),
+    role: S.String.pipe(T.Label()),
+    cert_type: S.optional(S.String),
+    critical_options: S.optional(S.Unknown),
+    extensions: S.optional(S.Unknown),
+    key_bits: S.optional(S.Number),
+    key_id: S.optional(S.String),
+    key_type: S.optional(S.String),
+    ttl: S.optional(S.Number),
+    valid_principals: S.optional(S.String),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/{ssh_mount_path}/issue/{role}",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "SshIssueCertificateRequest",
+}) as any as S.Schema<SshIssueCertificateRequest>;
+
+export interface SshIssueCertificateResponse {}
+export const SshIssueCertificateResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "SshIssueCertificateResponse",
+}) as any as S.Schema<SshIssueCertificateResponse>;
+
+export type SshListIssuersRequestList = "true";
+export const SshListIssuersRequestList = S.String;
+
+export interface SshListIssuersRequest {
+  /** Path that the backend was mounted at */
+  ssh_mount_path: string;
+  /** Must be set to `true` */
+  list: SshListIssuersRequestList | (string & {});
+}
+export const SshListIssuersRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    ssh_mount_path: S.String.pipe(T.Label()),
+    list: SshListIssuersRequestList.pipe(T.Query()),
+  }).pipe(
+    T.Http({ method: "GET", uri: "/{ssh_mount_path}/issuers", code: 200 }),
+  ),
+).annotate({
+  identifier: "SshListIssuersRequest",
+}) as any as S.Schema<SshListIssuersRequest>;
+
+/** A list of keys */
+export type SshListIssuersResponseKeysList = Array<string>;
+export const SshListIssuersResponseKeysList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<SshListIssuersResponseKeysList>;
+
+export interface SshListIssuersResponse {
+  /** Key info with issuer identifier */
+  key_info?: unknown;
+  /** A list of keys */
+  keys?: SshListIssuersResponseKeysList;
+}
+export const SshListIssuersResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    key_info: S.optional(S.Unknown),
+    keys: S.optional(SshListIssuersResponseKeysList),
+  }),
+).annotate({
+  identifier: "SshListIssuersResponse",
+}) as any as S.Schema<SshListIssuersResponse>;
+
+export type SshListRolesRequestList = "true";
+export const SshListRolesRequestList = S.String;
+
+export interface SshListRolesRequest {
+  /** Path that the backend was mounted at */
+  ssh_mount_path: string;
+  /** Must be set to `true` */
+  list: SshListRolesRequestList | (string & {});
+}
+export const SshListRolesRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    ssh_mount_path: S.String.pipe(T.Label()),
+    list: SshListRolesRequestList.pipe(T.Query()),
+  }).pipe(T.Http({ method: "GET", uri: "/{ssh_mount_path}/roles", code: 200 })),
+).annotate({
+  identifier: "SshListRolesRequest",
+}) as any as S.Schema<SshListRolesRequest>;
+
+export interface SshListRolesResponse {}
+export const SshListRolesResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "SshListRolesResponse",
+}) as any as S.Schema<SshListRolesResponse>;
+
+export interface SshListRolesByIpRequest {
+  /** Path that the backend was mounted at */
+  ssh_mount_path: string;
+  /** [Required] IP address of remote host */
+  ip?: string;
+}
+export const SshListRolesByIpRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    ssh_mount_path: S.String.pipe(T.Label()),
+    ip: S.optional(S.String),
+  }).pipe(
+    T.Http({ method: "POST", uri: "/{ssh_mount_path}/lookup", code: 200 }),
+  ),
+).annotate({
+  identifier: "SshListRolesByIpRequest",
+}) as any as S.Schema<SshListRolesByIpRequest>;
+
+export interface SshListRolesByIpResponse {}
+export const SshListRolesByIpResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "SshListRolesByIpResponse",
+}) as any as S.Schema<SshListRolesByIpResponse>;
+
+export interface SshPurgeCaRequest {
+  /** Path that the backend was mounted at */
+  ssh_mount_path: string;
+}
+export const SshPurgeCaRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    ssh_mount_path: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({ method: "DELETE", uri: "/{ssh_mount_path}/config/ca", code: 200 }),
+  ),
+).annotate({
+  identifier: "SshPurgeCaRequest",
+}) as any as S.Schema<SshPurgeCaRequest>;
+
+export interface SshPurgeCaResponse {}
+export const SshPurgeCaResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "SshPurgeCaResponse",
+}) as any as S.Schema<SshPurgeCaResponse>;
+
+export interface SshReadDefaultCaRequest {
+  /** Path that the backend was mounted at */
+  ssh_mount_path: string;
+}
+export const SshReadDefaultCaRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    ssh_mount_path: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({ method: "GET", uri: "/{ssh_mount_path}/config/ca", code: 200 }),
+  ),
+).annotate({
+  identifier: "SshReadDefaultCaRequest",
+}) as any as S.Schema<SshReadDefaultCaRequest>;
+
+export interface SshReadDefaultCaResponse {
+  /** Issuer Id */
+  issuer_id?: string;
+  /** Issuer Name */
+  issuer_name?: string;
+  /** Issuer public key */
+  public_key?: boolean;
+}
+export const SshReadDefaultCaResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    issuer_id: S.optional(S.String),
+    issuer_name: S.optional(S.String),
+    public_key: S.optional(S.Boolean),
+  }),
+).annotate({
+  identifier: "SshReadDefaultCaResponse",
+}) as any as S.Schema<SshReadDefaultCaResponse>;
+
+export interface SshReadIssuerRequest {
+  /** Path that the backend was mounted at */
+  ssh_mount_path: string;
+  /** Reference to a existing issuer; either "default" for the configured default issuer, an identifier or the name assigned to the issuer. */
+  issuer_ref: string;
+}
+export const SshReadIssuerRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    ssh_mount_path: S.String.pipe(T.Label()),
+    issuer_ref: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/{ssh_mount_path}/issuer/{issuer_ref}",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "SshReadIssuerRequest",
+}) as any as S.Schema<SshReadIssuerRequest>;
+
+export interface SshReadIssuerResponse {
+  /** Issuer Id */
+  issuer_id?: string;
+  /** Issuer Name */
+  issuer_name?: string;
+  /** Issuer public key */
+  public_key?: boolean;
+}
+export const SshReadIssuerResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    issuer_id: S.optional(S.String),
+    issuer_name: S.optional(S.String),
+    public_key: S.optional(S.Boolean),
+  }),
+).annotate({
+  identifier: "SshReadIssuerResponse",
+}) as any as S.Schema<SshReadIssuerResponse>;
+
+export interface SshReadPublicKeyRequest {
+  /** Path that the backend was mounted at */
+  ssh_mount_path: string;
+}
+export const SshReadPublicKeyRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    ssh_mount_path: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({ method: "GET", uri: "/{ssh_mount_path}/public_key", code: 200 }),
+  ),
+).annotate({
+  identifier: "SshReadPublicKeyRequest",
+}) as any as S.Schema<SshReadPublicKeyRequest>;
+
+export interface SshReadPublicKeyResponse {}
+export const SshReadPublicKeyResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "SshReadPublicKeyResponse",
+}) as any as S.Schema<SshReadPublicKeyResponse>;
+
+export interface SshReadReadRequest {
+  /** Path that the backend was mounted at */
+  ssh_mount_path: string;
+}
+export const SshReadReadRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    ssh_mount_path: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/{ssh_mount_path}/config/issuers",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "SshReadReadRequest",
+}) as any as S.Schema<SshReadReadRequest>;
+
+export interface SshReadReadResponse {
+  /** Reference (name or identifier) to issuer set as the default. */
+  default?: string;
+}
+export const SshReadReadResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    default: S.optional(S.String),
+  }),
+).annotate({
+  identifier: "SshReadReadResponse",
+}) as any as S.Schema<SshReadReadResponse>;
+
+export interface SshReadRoleRequest {
+  /** Path that the backend was mounted at */
+  ssh_mount_path: string;
+  /** [Required for all types] Name of the role being created. */
+  role: string;
+}
+export const SshReadRoleRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    ssh_mount_path: S.String.pipe(T.Label()),
+    role: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({ method: "GET", uri: "/{ssh_mount_path}/roles/{role}", code: 200 }),
+  ),
+).annotate({
+  identifier: "SshReadRoleRequest",
+}) as any as S.Schema<SshReadRoleRequest>;
+
+export interface SshReadRoleResponse {}
+export const SshReadRoleResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "SshReadRoleResponse",
+}) as any as S.Schema<SshReadRoleResponse>;
+
+export interface SshReadZeroAddressConfigurationRequest {
+  /** Path that the backend was mounted at */
+  ssh_mount_path: string;
+}
+export const SshReadZeroAddressConfigurationRequest = /*@__PURE__*/ S.suspend(
+  () =>
+    S.Struct({
+      ssh_mount_path: S.String.pipe(T.Label()),
+    }).pipe(
+      T.Http({
+        method: "GET",
+        uri: "/{ssh_mount_path}/config/zeroaddress",
+        code: 200,
+      }),
+    ),
+).annotate({
+  identifier: "SshReadZeroAddressConfigurationRequest",
+}) as any as S.Schema<SshReadZeroAddressConfigurationRequest>;
+
+export interface SshReadZeroAddressConfigurationResponse {}
+export const SshReadZeroAddressConfigurationResponse = /*@__PURE__*/ S.suspend(
+  () => S.Struct({}),
+).annotate({
+  identifier: "SshReadZeroAddressConfigurationResponse",
+}) as any as S.Schema<SshReadZeroAddressConfigurationResponse>;
+
+export interface SshSignCertificateRequest {
+  /** Path that the backend was mounted at */
+  ssh_mount_path: string;
+  /** The desired role with configuration for this request. */
+  role: string;
+  /** Type of certificate to be created; either "user" or "host". */
+  cert_type?: string;
+  /** Critical options that the certificate should be signed for. */
+  critical_options?: unknown;
+  /** Extensions that the certificate should be signed for. */
+  extensions?: unknown;
+  /** Key id that the created certificate should have. If not specified, the display name of the token will be used. */
+  key_id?: string;
+  /** SSH public key that should be signed. */
+  public_key?: string;
+  /** The requested Time To Live for the SSH certificate; sets the expiration date. If not specified the role default, backend default, or system default TTL is used, in that order. Cannot be later than the role max TTL. */
+  ttl?: number;
+  /** Valid principals, either usernames or hostnames, that the certificate should be signed for. */
+  valid_principals?: string;
+}
+export const SshSignCertificateRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    ssh_mount_path: S.String.pipe(T.Label()),
+    role: S.String.pipe(T.Label()),
+    cert_type: S.optional(S.String),
+    critical_options: S.optional(S.Unknown),
+    extensions: S.optional(S.Unknown),
+    key_id: S.optional(S.String),
+    public_key: S.optional(S.String),
+    ttl: S.optional(S.Number),
+    valid_principals: S.optional(S.String),
+  }).pipe(
+    T.Http({ method: "POST", uri: "/{ssh_mount_path}/sign/{role}", code: 200 }),
+  ),
+).annotate({
+  identifier: "SshSignCertificateRequest",
+}) as any as S.Schema<SshSignCertificateRequest>;
+
+export interface SshSignCertificateResponse {}
+export const SshSignCertificateResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "SshSignCertificateResponse",
+}) as any as S.Schema<SshSignCertificateResponse>;
+
+export interface SshSubmitIssuerRequest {
+  /** Path that the backend was mounted at */
+  ssh_mount_path: string;
+  /** Generate SSH key pair internally rather than use the private_key and public_key fields. */
+  generate_signing_key?: boolean;
+  /** Optional issuer name that can be used to identify the issuer. */
+  issuer_name?: string;
+  /** Specifies the desired key bits when generating variable-length keys (such as when key_type="ssh-rsa") or which NIST P-curve to use when key_type="ec" (256, 384, or 521). */
+  key_bits?: number;
+  /** Specifies the desired key type when generating; could be a OpenSSH key type identifier (ssh-rsa, ecdsa-sha2-nistp256, ecdsa-sha2-nistp384, ecdsa-sha2-nistp521, or ssh-ed25519) or an algorithm (rsa, ec, ed25519). */
+  key_type?: string;
+  /** Private half of the SSH key that will be used to sign certificates. */
+  private_key?: string;
+  /** Public half of the SSH key that will be used to sign certificates. */
+  public_key?: string;
+  /** If true, this issuer will be set as the default issuer for performing operations. Only one issuer can be the default issuer and, if there's one set, it will be overridden. */
+  set_default?: boolean;
+}
+export const SshSubmitIssuerRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    ssh_mount_path: S.String.pipe(T.Label()),
+    generate_signing_key: S.optional(S.Boolean),
+    issuer_name: S.optional(S.String),
+    key_bits: S.optional(S.Number),
+    key_type: S.optional(S.String),
+    private_key: S.optional(S.String),
+    public_key: S.optional(S.String),
+    set_default: S.optional(S.Boolean),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/{ssh_mount_path}/issuers/import",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "SshSubmitIssuerRequest",
+}) as any as S.Schema<SshSubmitIssuerRequest>;
+
+export interface SshSubmitIssuerResponse {
+  /** Issuer Id */
+  issuer_id?: string;
+  /** Issuer Name */
+  issuer_name?: string;
+  /** Issuer public key */
+  public_key?: boolean;
+}
+export const SshSubmitIssuerResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    issuer_id: S.optional(S.String),
+    issuer_name: S.optional(S.String),
+    public_key: S.optional(S.Boolean),
+  }),
+).annotate({
+  identifier: "SshSubmitIssuerResponse",
+}) as any as S.Schema<SshSubmitIssuerResponse>;
+
+export interface SshSubmitIssuersImportIssuerNameRequest {
+  /** Path that the backend was mounted at */
+  ssh_mount_path: string;
+  /** Optional issuer name that can be used to identify the issuer. */
+  issuer_name: string;
+  /** Generate SSH key pair internally rather than use the private_key and public_key fields. */
+  generate_signing_key?: boolean;
+  /** Specifies the desired key bits when generating variable-length keys (such as when key_type="ssh-rsa") or which NIST P-curve to use when key_type="ec" (256, 384, or 521). */
+  key_bits?: number;
+  /** Specifies the desired key type when generating; could be a OpenSSH key type identifier (ssh-rsa, ecdsa-sha2-nistp256, ecdsa-sha2-nistp384, ecdsa-sha2-nistp521, or ssh-ed25519) or an algorithm (rsa, ec, ed25519). */
+  key_type?: string;
+  /** Private half of the SSH key that will be used to sign certificates. */
+  private_key?: string;
+  /** Public half of the SSH key that will be used to sign certificates. */
+  public_key?: string;
+  /** If true, this issuer will be set as the default issuer for performing operations. Only one issuer can be the default issuer and, if there's one set, it will be overridden. */
+  set_default?: boolean;
+}
+export const SshSubmitIssuersImportIssuerNameRequest = /*@__PURE__*/ S.suspend(
+  () =>
+    S.Struct({
+      ssh_mount_path: S.String.pipe(T.Label()),
+      issuer_name: S.String.pipe(T.Label()),
+      generate_signing_key: S.optional(S.Boolean),
+      key_bits: S.optional(S.Number),
+      key_type: S.optional(S.String),
+      private_key: S.optional(S.String),
+      public_key: S.optional(S.String),
+      set_default: S.optional(S.Boolean),
+    }).pipe(
+      T.Http({
+        method: "POST",
+        uri: "/{ssh_mount_path}/issuers/import/{issuer_name}",
+        code: 200,
+      }),
+    ),
+).annotate({
+  identifier: "SshSubmitIssuersImportIssuerNameRequest",
+}) as any as S.Schema<SshSubmitIssuersImportIssuerNameRequest>;
+
+export interface SshSubmitIssuersImportIssuerNameResponse {
+  /** Issuer Id */
+  issuer_id?: string;
+  /** Issuer Name */
+  issuer_name?: string;
+  /** Issuer public key */
+  public_key?: boolean;
+}
+export const SshSubmitIssuersImportIssuerNameResponse = /*@__PURE__*/ S.suspend(
+  () =>
+    S.Struct({
+      issuer_id: S.optional(S.String),
+      issuer_name: S.optional(S.String),
+      public_key: S.optional(S.Boolean),
+    }),
+).annotate({
+  identifier: "SshSubmitIssuersImportIssuerNameResponse",
+}) as any as S.Schema<SshSubmitIssuersImportIssuerNameResponse>;
+
+export interface SshTidyDynamicHostKeysRequest {
+  /** Path that the backend was mounted at */
+  ssh_mount_path: string;
+}
+export const SshTidyDynamicHostKeysRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    ssh_mount_path: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "DELETE",
+      uri: "/{ssh_mount_path}/tidy/dynamic-keys",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "SshTidyDynamicHostKeysRequest",
+}) as any as S.Schema<SshTidyDynamicHostKeysRequest>;
+
+export interface SshTidyDynamicHostKeysResponse {}
+export const SshTidyDynamicHostKeysResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "SshTidyDynamicHostKeysResponse",
+}) as any as S.Schema<SshTidyDynamicHostKeysResponse>;
+
+export interface SshUpdateIssuerRequest {
+  /** Path that the backend was mounted at */
+  ssh_mount_path: string;
+  /** Reference to a existing issuer; either "default" for the configured default issuer, an identifier or the name assigned to the issuer. */
+  issuer_ref: string;
+  /** Provide a name to the generated or existing issuer, the name must be unique across all issuers and not be the reserved value 'default' */
+  issuer_name?: string;
+}
+export const SshUpdateIssuerRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    ssh_mount_path: S.String.pipe(T.Label()),
+    issuer_ref: S.String.pipe(T.Label()),
+    issuer_name: S.optional(S.String),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/{ssh_mount_path}/issuer/{issuer_ref}",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "SshUpdateIssuerRequest",
+}) as any as S.Schema<SshUpdateIssuerRequest>;
+
+export interface SshUpdateIssuerResponse {
+  /** Issuer Id */
+  issuer_id?: string;
+  /** Issuer Name */
+  issuer_name?: string;
+  /** Issuer public key */
+  public_key?: boolean;
+}
+export const SshUpdateIssuerResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    issuer_id: S.optional(S.String),
+    issuer_name: S.optional(S.String),
+    public_key: S.optional(S.Boolean),
+  }),
+).annotate({
+  identifier: "SshUpdateIssuerResponse",
+}) as any as S.Schema<SshUpdateIssuerResponse>;
+
+export interface SshVerifyOtpRequest {
+  /** Path that the backend was mounted at */
+  ssh_mount_path: string;
+  /** [Required] One-Time-Key that needs to be validated */
+  otp?: string;
+}
+export const SshVerifyOtpRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    ssh_mount_path: S.String.pipe(T.Label()),
+    otp: S.optional(S.String),
+  }).pipe(
+    T.Http({ method: "POST", uri: "/{ssh_mount_path}/verify", code: 200 }),
+  ),
+).annotate({
+  identifier: "SshVerifyOtpRequest",
+}) as any as S.Schema<SshVerifyOtpRequest>;
+
+export interface SshVerifyOtpResponse {}
+export const SshVerifyOtpResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "SshVerifyOtpResponse",
+}) as any as S.Schema<SshVerifyOtpResponse>;
+
+export interface SshWriteIssuerConfigRequest {
+  /** Path that the backend was mounted at */
+  ssh_mount_path: string;
+  /** Reference (name or identifier) to issuer to be used as the default. */
+  default?: string;
+}
+export const SshWriteIssuerConfigRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    ssh_mount_path: S.String.pipe(T.Label()),
+    default: S.optional(S.String),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/{ssh_mount_path}/config/issuers",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "SshWriteIssuerConfigRequest",
+}) as any as S.Schema<SshWriteIssuerConfigRequest>;
+
+export interface SshWriteIssuerConfigResponse {
+  /** Reference (name or identifier) to issuer set as the default. */
+  default?: string;
+}
+export const SshWriteIssuerConfigResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    default: S.optional(S.String),
+  }),
+).annotate({
+  identifier: "SshWriteIssuerConfigResponse",
+}) as any as S.Schema<SshWriteIssuerConfigResponse>;
+
+/** [Not applicable for OTP type] [Optional for CA type] When supplied, this value specifies a signing algorithm for the key. Possible values: ssh-rsa, rsa-sha2-256, rsa-sha2-512, default, or the empty string. */
+export type SshWriteRoleRequestAlgorithmSigner =
+  | ""
+  | "default"
+  | "ssh-rsa"
+  | "rsa-sha2-256"
+  | "rsa-sha2-512";
+export const SshWriteRoleRequestAlgorithmSigner = S.String;
+
+/** [Required for all types] Type of key used to login to hosts. It can be either 'otp' or 'ca'. 'otp' type requires agent to be installed in remote hosts. */
+export type SshWriteRoleRequestKeyType = "otp" | "ca";
+export const SshWriteRoleRequestKeyType = S.String;
+
+export interface SshWriteRoleRequest {
+  /** Path that the backend was mounted at */
+  ssh_mount_path: string;
+  /** [Required for all types] Name of the role being created. */
+  role: string;
+  /** [Not applicable for OTP type] [Optional for CA type] When supplied, this value specifies a signing algorithm for the key. Possible values: ssh-rsa, rsa-sha2-256, rsa-sha2-512, default, or the empty string. */
+  algorithm_signer?: SshWriteRoleRequestAlgorithmSigner | (string & {});
+  /** [Not applicable for OTP type] [Optional for CA type] If set, host certificates that are requested are allowed to use the base domains listed in "allowed_domains", e.g. "example.com". This is a separate option as in some cases this can be considered a security threat. */
+  allow_bare_domains?: boolean;
+  /** If true and templating is enabled, the values substituted in for allowed_users and allowed_domains template expressions might contain a comma (','). As these values are comma separated lists, this can enable injection attacks. Only use this, if the data used by the templates is trusted. */
+  allow_commas_in_identity_templates?: boolean;
+  /** [Optional for CA type] If true, host and user certificates can be issued without any valid principals. For host certificates, this means that any domain a host claims to be will be trusted by the connecting client. For user certificates, when a CA certificate is placed in a user's AuthorizedKeys file, any principal on that certificate will be allowed to connect. When allowed_users or allowed_domains is set to * (corresponding to the role/certificate type), allow_empty_principals=false still permits issuance. It is recommend to leave this disabled. */
+  allow_empty_principals?: boolean;
+  /** [Not applicable for OTP type] [Optional for CA type] If set, certificates are allowed to be signed for use as a 'host'. */
+  allow_host_certificates?: boolean;
+  /** [Not applicable for OTP type] [Optional for CA type] If set, host certificates that are requested are allowed to use subdomains of those listed in "allowed_domains". */
+  allow_subdomains?: boolean;
+  /** [Not applicable for OTP type] [Optional for CA type] If set, certificates are allowed to be signed for use as a 'user'. */
+  allow_user_certificates?: boolean;
+  /** [Not applicable for OTP type] [Optional for CA type] If true, users can override the key ID for a signed certificate with the "key_id" field. When false, the key ID will always be the token display name. The key ID is logged by the SSH server and can be useful for auditing. */
+  allow_user_key_ids?: boolean;
+  /** [Not applicable for OTP type] [Optional for CA type] A comma-separated list of critical options that certificates can have when signed. To allow any critical options, set this to an empty string. */
+  allowed_critical_options?: string;
+  /** [Not applicable for OTP type] [Optional for CA type] If this option is not specified, client can request for a signed certificate for any valid host. If only certain domains are allowed, then this list enforces it. */
+  allowed_domains?: string;
+  /** [Not applicable for OTP type] [Optional for CA type] If set, Allowed domains can be specified using identity template policies. Non-templated domains are also permitted. */
+  allowed_domains_template?: boolean;
+  /** [Not applicable for OTP type] [Optional for CA type] A comma-separated list of extensions that certificates can have when signed. An empty list means that no extension overrides are allowed by an end-user; explicitly specify '*' to allow any extensions to be set. */
+  allowed_extensions?: string;
+  /** [Not applicable for OTP type] [Optional for CA type] If set, allows the enforcement of key types and minimum key sizes to be signed. */
+  allowed_user_key_lengths?: unknown;
+  /** [Optional for all types] [Works differently for CA type] If this option is not specified, or is '*', client can request a credential for any valid user at the remote host, including the admin user. If only certain usernames are to be allowed, then this list enforces it. If this field is set, then credentials can only be created for default_user and usernames present in this list. Setting this option will enable all the users with access to this role to fetch credentials for all other usernames in this list. Use with caution. N.B.: with the CA type, an empty list means that no users are allowed; explicitly specify '*' to allow any user. */
+  allowed_users?: string;
+  /** [Not applicable for OTP type] [Optional for CA type] If set, Allowed users can be specified using identity template policies. Non-templated users are also permitted. */
+  allowed_users_template?: boolean;
+  /** [Optional for OTP type] [Not applicable for CA type] Comma separated list of CIDR blocks for which the role is applicable for. CIDR blocks can belong to more than one role. */
+  cidr_list?: string;
+  /** [Not applicable for OTP type] [Optional for CA type] Critical options certificates should have if none are provided when signing. This field takes in key value pairs in JSON format. Note that these are not restricted by "allowed_critical_options". Defaults to none. */
+  default_critical_options?: unknown;
+  /** [Not applicable for OTP type] [Optional for CA type] Extensions certificates should have if none are provided when signing. This field takes in key value pairs in JSON format. Note that these are not restricted by "allowed_extensions". Defaults to none. */
+  default_extensions?: unknown;
+  /** [Not applicable for OTP type] [Optional for CA type] If set, Default extension values can be specified using identity template policies. Non-templated extension values are also permitted. */
+  default_extensions_template?: boolean;
+  /** [Required for OTP type] [Optional for CA type] Default username for which a credential will be generated. When the endpoint 'creds/' is used without a username, this value will be used as default username. */
+  default_user?: string;
+  /** [Not applicable for OTP type] [Optional for CA type] If set, Default user can be specified using identity template policies. Non-templated users are also permitted. */
+  default_user_template?: boolean;
+  /** [Optional for OTP type] [Not applicable for CA type] Comma separated list of CIDR blocks. IP addresses belonging to these blocks are not accepted by the role. This is particularly useful when big CIDR blocks are being used by the role and certain parts of it needs to be kept out. */
+  exclude_cidr_list?: string;
+  /** Reference to the issuer used to sign requests serviced by this role. */
+  issuer_ref?: string;
+  /** [Not applicable for OTP type] [Optional for CA type] When supplied, this value specifies a custom format for the key id of a signed certificate. The following variables are available for use: '{{token_display_name}}' - The display name of the token used to make the request. '{{role_name}}' - The name of the role signing the request. '{{public_key_hash}}' - A SHA256 checksum of the public key that is being signed. */
+  key_id_format?: string;
+  /** [Required for all types] Type of key used to login to hosts. It can be either 'otp' or 'ca'. 'otp' type requires agent to be installed in remote hosts. */
+  key_type?: SshWriteRoleRequestKeyType | (string & {});
+  /** [Not applicable for OTP type] [Optional for CA type] The maximum allowed lease duration */
+  max_ttl?: number;
+  /** [Not applicable for OTP type] [Optional for CA type] The duration that the SSH certificate should be backdated by at issuance. */
+  not_before_duration?: number;
+  /** [Optional for OTP type] [Not applicable for CA type] Port number for SSH connection. Default is '22'. Port number does not play any role in creation of OTP. For 'otp' type, this is just a way to inform client about the port number to use. Port number will be returned to client by OpenBao server along with OTP. */
+  port?: number;
+  /** [Not applicable for OTP type] [Optional for CA type] The lease duration if no specific lease duration is requested. The lease duration controls the expiration of certificates issued by this backend. Defaults to the value of max_ttl. */
+  ttl?: number;
+}
+export const SshWriteRoleRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    ssh_mount_path: S.String.pipe(T.Label()),
+    role: S.String.pipe(T.Label()),
+    algorithm_signer: S.optional(SshWriteRoleRequestAlgorithmSigner),
+    allow_bare_domains: S.optional(S.Boolean),
+    allow_commas_in_identity_templates: S.optional(S.Boolean),
+    allow_empty_principals: S.optional(S.Boolean),
+    allow_host_certificates: S.optional(S.Boolean),
+    allow_subdomains: S.optional(S.Boolean),
+    allow_user_certificates: S.optional(S.Boolean),
+    allow_user_key_ids: S.optional(S.Boolean),
+    allowed_critical_options: S.optional(S.String),
+    allowed_domains: S.optional(S.String),
+    allowed_domains_template: S.optional(S.Boolean),
+    allowed_extensions: S.optional(S.String),
+    allowed_user_key_lengths: S.optional(S.Unknown),
+    allowed_users: S.optional(S.String),
+    allowed_users_template: S.optional(S.Boolean),
+    cidr_list: S.optional(S.String),
+    default_critical_options: S.optional(S.Unknown),
+    default_extensions: S.optional(S.Unknown),
+    default_extensions_template: S.optional(S.Boolean),
+    default_user: S.optional(S.String),
+    default_user_template: S.optional(S.Boolean),
+    exclude_cidr_list: S.optional(S.String),
+    issuer_ref: S.optional(S.String),
+    key_id_format: S.optional(S.String),
+    key_type: S.optional(SshWriteRoleRequestKeyType),
+    max_ttl: S.optional(S.Number),
+    not_before_duration: S.optional(S.Number),
+    port: S.optional(S.Number),
+    ttl: S.optional(S.Number),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/{ssh_mount_path}/roles/{role}",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "SshWriteRoleRequest",
+}) as any as S.Schema<SshWriteRoleRequest>;
+
+export interface SshWriteRoleResponse {}
+export const SshWriteRoleResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "SshWriteRoleResponse",
+}) as any as S.Schema<SshWriteRoleResponse>;
+
+export type SshConfigureDefaultCaError = OpenBaoOpError;
+export const sshConfigureDefaultCa: API.OperationMethod<
+  SshConfigureDefaultCaRequest,
+  SshConfigureDefaultCaResponse,
+  SshConfigureDefaultCaError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: SshConfigureDefaultCaRequest,
+  output: SshConfigureDefaultCaResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type SshConfigureZeroAddressError = OpenBaoOpError;
+export const sshConfigureZeroAddress: API.OperationMethod<
+  SshConfigureZeroAddressRequest,
+  SshConfigureZeroAddressResponse,
+  SshConfigureZeroAddressError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: SshConfigureZeroAddressRequest,
+  output: SshConfigureZeroAddressResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type SshDeleteIssuerError = OpenBaoOpError;
+export const sshDeleteIssuer: API.OperationMethod<
+  SshDeleteIssuerRequest,
+  SshDeleteIssuerResponse,
+  SshDeleteIssuerError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: SshDeleteIssuerRequest,
+  output: SshDeleteIssuerResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type SshDeleteRoleError = OpenBaoOpError;
+export const sshDeleteRole: API.OperationMethod<
+  SshDeleteRoleRequest,
+  SshDeleteRoleResponse,
+  SshDeleteRoleError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: SshDeleteRoleRequest,
+  output: SshDeleteRoleResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type SshDeleteZeroAddressConfigurationError = OpenBaoOpError;
+export const sshDeleteZeroAddressConfiguration: API.OperationMethod<
+  SshDeleteZeroAddressConfigurationRequest,
+  SshDeleteZeroAddressConfigurationResponse,
+  SshDeleteZeroAddressConfigurationError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: SshDeleteZeroAddressConfigurationRequest,
+  output: SshDeleteZeroAddressConfigurationResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type SshGenerateCredentialsError = OpenBaoOpError;
+export const sshGenerateCredentials: API.OperationMethod<
+  SshGenerateCredentialsRequest,
+  SshGenerateCredentialsResponse,
+  SshGenerateCredentialsError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: SshGenerateCredentialsRequest,
+  output: SshGenerateCredentialsResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type SshGetIssuerError = OpenBaoOpError;
+export const sshGetIssuer: API.OperationMethod<
+  SshGetIssuerRequest,
+  SshGetIssuerResponse,
+  SshGetIssuerError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: SshGetIssuerRequest,
+  output: SshGetIssuerResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type SshIssueCertificateError = OpenBaoOpError;
+export const sshIssueCertificate: API.OperationMethod<
+  SshIssueCertificateRequest,
+  SshIssueCertificateResponse,
+  SshIssueCertificateError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: SshIssueCertificateRequest,
+  output: SshIssueCertificateResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type SshListIssuersError = OpenBaoOpError;
+export const sshListIssuers: API.OperationMethod<
+  SshListIssuersRequest,
+  SshListIssuersResponse,
+  SshListIssuersError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: SshListIssuersRequest,
+  output: SshListIssuersResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type SshListRolesError = OpenBaoOpError;
+export const sshListRoles: API.OperationMethod<
+  SshListRolesRequest,
+  SshListRolesResponse,
+  SshListRolesError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: SshListRolesRequest,
+  output: SshListRolesResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type SshListRolesByIpError = OpenBaoOpError;
+export const sshListRolesByIp: API.OperationMethod<
+  SshListRolesByIpRequest,
+  SshListRolesByIpResponse,
+  SshListRolesByIpError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: SshListRolesByIpRequest,
+  output: SshListRolesByIpResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type SshPurgeCaError = OpenBaoOpError;
+export const sshPurgeCa: API.OperationMethod<
+  SshPurgeCaRequest,
+  SshPurgeCaResponse,
+  SshPurgeCaError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: SshPurgeCaRequest,
+  output: SshPurgeCaResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type SshReadDefaultCaError = OpenBaoOpError;
+export const sshReadDefaultCa: API.OperationMethod<
+  SshReadDefaultCaRequest,
+  SshReadDefaultCaResponse,
+  SshReadDefaultCaError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: SshReadDefaultCaRequest,
+  output: SshReadDefaultCaResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type SshReadIssuerError = OpenBaoOpError;
+export const sshReadIssuer: API.OperationMethod<
+  SshReadIssuerRequest,
+  SshReadIssuerResponse,
+  SshReadIssuerError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: SshReadIssuerRequest,
+  output: SshReadIssuerResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type SshReadPublicKeyError = OpenBaoOpError;
+export const sshReadPublicKey: API.OperationMethod<
+  SshReadPublicKeyRequest,
+  SshReadPublicKeyResponse,
+  SshReadPublicKeyError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: SshReadPublicKeyRequest,
+  output: SshReadPublicKeyResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type SshReadReadError = OpenBaoOpError;
+export const sshReadRead: API.OperationMethod<
+  SshReadReadRequest,
+  SshReadReadResponse,
+  SshReadReadError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: SshReadReadRequest,
+  output: SshReadReadResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type SshReadRoleError = OpenBaoOpError;
+export const sshReadRole: API.OperationMethod<
+  SshReadRoleRequest,
+  SshReadRoleResponse,
+  SshReadRoleError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: SshReadRoleRequest,
+  output: SshReadRoleResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type SshReadZeroAddressConfigurationError = OpenBaoOpError;
+export const sshReadZeroAddressConfiguration: API.OperationMethod<
+  SshReadZeroAddressConfigurationRequest,
+  SshReadZeroAddressConfigurationResponse,
+  SshReadZeroAddressConfigurationError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: SshReadZeroAddressConfigurationRequest,
+  output: SshReadZeroAddressConfigurationResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type SshSignCertificateError = OpenBaoOpError;
+export const sshSignCertificate: API.OperationMethod<
+  SshSignCertificateRequest,
+  SshSignCertificateResponse,
+  SshSignCertificateError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: SshSignCertificateRequest,
+  output: SshSignCertificateResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type SshSubmitIssuerError = OpenBaoOpError;
+export const sshSubmitIssuer: API.OperationMethod<
+  SshSubmitIssuerRequest,
+  SshSubmitIssuerResponse,
+  SshSubmitIssuerError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: SshSubmitIssuerRequest,
+  output: SshSubmitIssuerResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type SshSubmitIssuersImportIssuerNameError = OpenBaoOpError;
+export const sshSubmitIssuersImportIssuerName: API.OperationMethod<
+  SshSubmitIssuersImportIssuerNameRequest,
+  SshSubmitIssuersImportIssuerNameResponse,
+  SshSubmitIssuersImportIssuerNameError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: SshSubmitIssuersImportIssuerNameRequest,
+  output: SshSubmitIssuersImportIssuerNameResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type SshTidyDynamicHostKeysError = OpenBaoOpError;
+export const sshTidyDynamicHostKeys: API.OperationMethod<
+  SshTidyDynamicHostKeysRequest,
+  SshTidyDynamicHostKeysResponse,
+  SshTidyDynamicHostKeysError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: SshTidyDynamicHostKeysRequest,
+  output: SshTidyDynamicHostKeysResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type SshUpdateIssuerError = OpenBaoOpError;
+export const sshUpdateIssuer: API.OperationMethod<
+  SshUpdateIssuerRequest,
+  SshUpdateIssuerResponse,
+  SshUpdateIssuerError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: SshUpdateIssuerRequest,
+  output: SshUpdateIssuerResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type SshVerifyOtpError = OpenBaoOpError;
+export const sshVerifyOtp: API.OperationMethod<
+  SshVerifyOtpRequest,
+  SshVerifyOtpResponse,
+  SshVerifyOtpError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: SshVerifyOtpRequest,
+  output: SshVerifyOtpResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type SshWriteIssuerConfigError = OpenBaoOpError;
+export const sshWriteIssuerConfig: API.OperationMethod<
+  SshWriteIssuerConfigRequest,
+  SshWriteIssuerConfigResponse,
+  SshWriteIssuerConfigError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: SshWriteIssuerConfigRequest,
+  output: SshWriteIssuerConfigResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type SshWriteRoleError = OpenBaoOpError;
+export const sshWriteRole: API.OperationMethod<
+  SshWriteRoleRequest,
+  SshWriteRoleResponse,
+  SshWriteRoleError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: SshWriteRoleRequest,
+  output: SshWriteRoleResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));