@homeflare/distilled-openbao 0.2.0

package/src/services/ui.ts

@@ -0,0 +1,207 @@
+// AUTO-GENERATED by scripts/generate.ts from .generated-specs (specs/spec-mirror-openbao, generated — see fetch-specs.ts). Do not edit.
+import * as S from "@distilled.cloud/core/schema";
+import * as API from "@distilled.cloud/core/api";
+import * as T from "../traits.ts";
+import {
+  OpenBaoProtocol,
+  type OpenBaoOpError,
+  type OpenBaoOpContext,
+} from "../protocol.ts";
+import * as Retry from "../retry.ts";
+
+export type { OpenBaoOpError, OpenBaoOpContext };
+
+export type ListUiHeadersRequestList = "true";
+export const ListUiHeadersRequestList = S.String;
+
+export interface ListUiHeadersRequest {
+  /** Must be set to `true` */
+  list: ListUiHeadersRequestList | (string & {});
+}
+export const ListUiHeadersRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    list: ListUiHeadersRequestList.pipe(T.Query()),
+  }).pipe(T.Http({ method: "GET", uri: "/sys/config/ui/headers", code: 200 })),
+).annotate({
+  identifier: "ListUiHeadersRequest",
+}) as any as S.Schema<ListUiHeadersRequest>;
+
+/** Lists of configured UI headers. Omitted if list is empty */
+export type UiHeadersListResponseKeysList = Array<string>;
+export const UiHeadersListResponseKeysList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<UiHeadersListResponseKeysList>;
+
+export interface UiHeadersListResponse {
+  /** Lists of configured UI headers. Omitted if list is empty */
+  keys?: UiHeadersListResponseKeysList;
+}
+export const UiHeadersListResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    keys: S.optional(UiHeadersListResponseKeysList),
+  }),
+).annotate({
+  identifier: "UiHeadersListResponse",
+}) as any as S.Schema<UiHeadersListResponse>;
+
+/** The values to set the header. */
+export type UiHeadersConfigureRequestValuesList = Array<string>;
+export const UiHeadersConfigureRequestValuesList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<UiHeadersConfigureRequestValuesList>;
+
+export interface UiHeadersConfigureRequest {
+  /** The name of the header. */
+  header: string;
+  /** Returns multiple values if true */
+  multivalue?: boolean;
+  /** The values to set the header. */
+  values?: UiHeadersConfigureRequestValuesList;
+}
+export const UiHeadersConfigureRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    header: S.String.pipe(T.Label()),
+    multivalue: S.optional(S.Boolean),
+    values: S.optional(UiHeadersConfigureRequestValuesList),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/sys/config/ui/headers/{header}",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "UiHeadersConfigureRequest",
+}) as any as S.Schema<UiHeadersConfigureRequest>;
+
+export interface UiHeadersConfigureResponse {}
+export const UiHeadersConfigureResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "UiHeadersConfigureResponse",
+}) as any as S.Schema<UiHeadersConfigureResponse>;
+
+export interface UiHeadersDeleteConfigurationRequest {
+  /** The name of the header. */
+  header: string;
+}
+export const UiHeadersDeleteConfigurationRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    header: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "DELETE",
+      uri: "/sys/config/ui/headers/{header}",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "UiHeadersDeleteConfigurationRequest",
+}) as any as S.Schema<UiHeadersDeleteConfigurationRequest>;
+
+export interface UiHeadersDeleteConfigurationResponse {}
+export const UiHeadersDeleteConfigurationResponse = /*@__PURE__*/ S.suspend(
+  () => S.Struct({}),
+).annotate({
+  identifier: "UiHeadersDeleteConfigurationResponse",
+}) as any as S.Schema<UiHeadersDeleteConfigurationResponse>;
+
+export interface UiHeadersReadConfigurationRequest {
+  /** The name of the header. */
+  header: string;
+}
+export const UiHeadersReadConfigurationRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    header: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/sys/config/ui/headers/{header}",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "UiHeadersReadConfigurationRequest",
+}) as any as S.Schema<UiHeadersReadConfigurationRequest>;
+
+/** returns all header values when `multivalue` request parameter is true */
+export type UiHeadersReadConfigurationResponseValuesList = Array<string>;
+export const UiHeadersReadConfigurationResponseValuesList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<UiHeadersReadConfigurationResponseValuesList>;
+
+export interface UiHeadersReadConfigurationResponse {
+  /** returns the first header value when `multivalue` request parameter is false */
+  value?: string;
+  /** returns all header values when `multivalue` request parameter is true */
+  values?: UiHeadersReadConfigurationResponseValuesList;
+}
+export const UiHeadersReadConfigurationResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    value: S.optional(S.String),
+    values: S.optional(UiHeadersReadConfigurationResponseValuesList),
+  }),
+).annotate({
+  identifier: "UiHeadersReadConfigurationResponse",
+}) as any as S.Schema<UiHeadersReadConfigurationResponse>;
+
+export type ListUiHeadersError = OpenBaoOpError;
+/** Return a list of configured UI headers. */
+export const listUiHeaders: API.OperationMethod<
+  ListUiHeadersRequest,
+  UiHeadersListResponse,
+  ListUiHeadersError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: ListUiHeadersRequest,
+  output: UiHeadersListResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type UiHeadersConfigureError = OpenBaoOpError;
+/** Configure the values to be returned for the UI header. */
+export const uiHeadersConfigure: API.OperationMethod<
+  UiHeadersConfigureRequest,
+  UiHeadersConfigureResponse,
+  UiHeadersConfigureError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: UiHeadersConfigureRequest,
+  output: UiHeadersConfigureResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type UiHeadersDeleteConfigurationError = OpenBaoOpError;
+/** Remove a UI header. */
+export const uiHeadersDeleteConfiguration: API.OperationMethod<
+  UiHeadersDeleteConfigurationRequest,
+  UiHeadersDeleteConfigurationResponse,
+  UiHeadersDeleteConfigurationError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: UiHeadersDeleteConfigurationRequest,
+  output: UiHeadersDeleteConfigurationResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type UiHeadersReadConfigurationError = OpenBaoOpError;
+/** Return the given UI header's configuration */
+export const uiHeadersReadConfiguration: API.OperationMethod<
+  UiHeadersReadConfigurationRequest,
+  UiHeadersReadConfigurationResponse,
+  UiHeadersReadConfigurationError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: UiHeadersReadConfigurationRequest,
+  output: UiHeadersReadConfigurationResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));

package/src/services/update.ts

@@ -0,0 +1,73 @@
+// AUTO-GENERATED by scripts/generate.ts from .generated-specs (specs/spec-mirror-openbao, generated — see fetch-specs.ts). Do not edit.
+import * as S from "@distilled.cloud/core/schema";
+import * as API from "@distilled.cloud/core/api";
+import * as T from "../traits.ts";
+import {
+  OpenBaoProtocol,
+  type OpenBaoOpError,
+  type OpenBaoOpContext,
+} from "../protocol.ts";
+import * as Retry from "../retry.ts";
+
+export type { OpenBaoOpError, OpenBaoOpContext };
+
+export interface UpdateGenerationAttemptRootTokenRequest {
+  /** Unseal key share. */
+  key: string;
+  /** Nonce for the generation operation. */
+  nonce: string;
+}
+export const UpdateGenerationAttemptRootTokenRequest = /*@__PURE__*/ S.suspend(
+  () =>
+    S.Struct({
+      key: S.String,
+      nonce: S.String,
+    }).pipe(
+      T.Http({
+        method: "POST",
+        uri: "/sys/generate-root-token/update",
+        code: 200,
+      }),
+    ),
+).annotate({
+  identifier: "UpdateGenerationAttemptRootTokenRequest",
+}) as any as S.Schema<UpdateGenerationAttemptRootTokenRequest>;
+
+export interface UpdateGenerationAttemptRootTokenResponse {
+  complete?: boolean;
+  encoded_token?: string;
+  nonce?: string;
+  pgp_fingerprint?: string;
+  progress?: number;
+  required?: number;
+  started?: boolean;
+}
+export const UpdateGenerationAttemptRootTokenResponse = /*@__PURE__*/ S.suspend(
+  () =>
+    S.Struct({
+      complete: S.optional(S.Boolean),
+      encoded_token: S.optional(S.String),
+      nonce: S.optional(S.String),
+      pgp_fingerprint: S.optional(S.String),
+      progress: S.optional(S.Number),
+      required: S.optional(S.Number),
+      started: S.optional(S.Boolean),
+    }),
+).annotate({
+  identifier: "UpdateGenerationAttemptRootTokenResponse",
+}) as any as S.Schema<UpdateGenerationAttemptRootTokenResponse>;
+
+export type UpdateGenerationAttemptRootTokenError = OpenBaoOpError;
+/** Provide an unseal key share for root token generation. If the threshold number of unseal key shares is reached, OpenBao will complete the root generation and issue the new token. Otherwise, this API must be called multiple times until that threshold is met. The attempt nonce must be provided with each call. */
+export const updateGenerationAttemptRootToken: API.OperationMethod<
+  UpdateGenerationAttemptRootTokenRequest,
+  UpdateGenerationAttemptRootTokenResponse,
+  UpdateGenerationAttemptRootTokenError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: UpdateGenerationAttemptRootTokenRequest,
+  output: UpdateGenerationAttemptRootTokenResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));

package/src/services/userpass.ts

@@ -0,0 +1,410 @@
+// AUTO-GENERATED by scripts/generate.ts from .generated-specs (specs/spec-mirror-openbao, generated — see fetch-specs.ts). Do not edit.
+import * as S from "@distilled.cloud/core/schema";
+import * as API from "@distilled.cloud/core/api";
+import * as T from "../traits.ts";
+import {
+  OpenBaoProtocol,
+  type OpenBaoOpError,
+  type OpenBaoOpContext,
+} from "../protocol.ts";
+import * as Retry from "../retry.ts";
+
+export type { OpenBaoOpError, OpenBaoOpContext };
+
+export interface LoginUserpassRequest {
+  /** Path that the backend was mounted at */
+  userpass_mount_path: string;
+  /** Username of the user. */
+  username: string;
+  /** Password for this user. */
+  password?: string;
+}
+export const LoginUserpassRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    userpass_mount_path: S.String.pipe(T.Label()),
+    username: S.String.pipe(T.Label()),
+    password: S.optional(S.String),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/auth/{userpass_mount_path}/login/{username}",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "LoginUserpassRequest",
+}) as any as S.Schema<LoginUserpassRequest>;
+
+export interface LoginUserpassResponse {}
+export const LoginUserpassResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "LoginUserpassResponse",
+}) as any as S.Schema<LoginUserpassResponse>;
+
+export interface UserpassDeleteUserRequest {
+  /** Path that the backend was mounted at */
+  userpass_mount_path: string;
+  /** Username for this user. */
+  username: string;
+}
+export const UserpassDeleteUserRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    userpass_mount_path: S.String.pipe(T.Label()),
+    username: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "DELETE",
+      uri: "/auth/{userpass_mount_path}/users/{username}",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "UserpassDeleteUserRequest",
+}) as any as S.Schema<UserpassDeleteUserRequest>;
+
+export interface UserpassDeleteUserResponse {}
+export const UserpassDeleteUserResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "UserpassDeleteUserResponse",
+}) as any as S.Schema<UserpassDeleteUserResponse>;
+
+export type UserpassListUsersRequestList = "true";
+export const UserpassListUsersRequestList = S.String;
+
+export interface UserpassListUsersRequest {
+  /** Path that the backend was mounted at */
+  userpass_mount_path: string;
+  /** Must be set to `true` */
+  list: UserpassListUsersRequestList | (string & {});
+}
+export const UserpassListUsersRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    userpass_mount_path: S.String.pipe(T.Label()),
+    list: UserpassListUsersRequestList.pipe(T.Query()),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/auth/{userpass_mount_path}/users",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "UserpassListUsersRequest",
+}) as any as S.Schema<UserpassListUsersRequest>;
+
+export interface UserpassListUsersResponse {}
+export const UserpassListUsersResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "UserpassListUsersResponse",
+}) as any as S.Schema<UserpassListUsersResponse>;
+
+export interface UserpassReadUserRequest {
+  /** Path that the backend was mounted at */
+  userpass_mount_path: string;
+  /** Username for this user. */
+  username: string;
+}
+export const UserpassReadUserRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    userpass_mount_path: S.String.pipe(T.Label()),
+    username: S.String.pipe(T.Label()),
+  }).pipe(
+    T.Http({
+      method: "GET",
+      uri: "/auth/{userpass_mount_path}/users/{username}",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "UserpassReadUserRequest",
+}) as any as S.Schema<UserpassReadUserRequest>;
+
+export interface UserpassReadUserResponse {}
+export const UserpassReadUserResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "UserpassReadUserResponse",
+}) as any as S.Schema<UserpassReadUserResponse>;
+
+export interface UserpassResetPasswordRequest {
+  /** Path that the backend was mounted at */
+  userpass_mount_path: string;
+  /** Username for this user. */
+  username: string;
+  /** Password for this user. */
+  password?: string;
+  /** Pre-hashed bcrypt password for this user. Mutually exclusive with password. */
+  password_hash?: string;
+}
+export const UserpassResetPasswordRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    userpass_mount_path: S.String.pipe(T.Label()),
+    username: S.String.pipe(T.Label()),
+    password: S.optional(S.String),
+    password_hash: S.optional(S.String),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/auth/{userpass_mount_path}/users/{username}/password",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "UserpassResetPasswordRequest",
+}) as any as S.Schema<UserpassResetPasswordRequest>;
+
+export interface UserpassResetPasswordResponse {}
+export const UserpassResetPasswordResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "UserpassResetPasswordResponse",
+}) as any as S.Schema<UserpassResetPasswordResponse>;
+
+/** Use "token_policies" instead. If this and "token_policies" are both specified, only "token_policies" will be used. */
+export type UserpassUpdatePoliciesRequestPoliciesList = Array<string>;
+export const UserpassUpdatePoliciesRequestPoliciesList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<UserpassUpdatePoliciesRequestPoliciesList>;
+
+/** Comma-separated list of policies */
+export type UserpassUpdatePoliciesRequestTokenPoliciesList = Array<string>;
+export const UserpassUpdatePoliciesRequestTokenPoliciesList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<UserpassUpdatePoliciesRequestTokenPoliciesList>;
+
+export interface UserpassUpdatePoliciesRequest {
+  /** Path that the backend was mounted at */
+  userpass_mount_path: string;
+  /** Username for this user. */
+  username: string;
+  /** Use "token_policies" instead. If this and "token_policies" are both specified, only "token_policies" will be used. */
+  policies?: UserpassUpdatePoliciesRequestPoliciesList;
+  /** Comma-separated list of policies */
+  token_policies?: UserpassUpdatePoliciesRequestTokenPoliciesList;
+}
+export const UserpassUpdatePoliciesRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    userpass_mount_path: S.String.pipe(T.Label()),
+    username: S.String.pipe(T.Label()),
+    policies: S.optional(UserpassUpdatePoliciesRequestPoliciesList),
+    token_policies: S.optional(UserpassUpdatePoliciesRequestTokenPoliciesList),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/auth/{userpass_mount_path}/users/{username}/policies",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "UserpassUpdatePoliciesRequest",
+}) as any as S.Schema<UserpassUpdatePoliciesRequest>;
+
+export interface UserpassUpdatePoliciesResponse {}
+export const UserpassUpdatePoliciesResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "UserpassUpdatePoliciesResponse",
+}) as any as S.Schema<UserpassUpdatePoliciesResponse>;
+
+/** Use "token_bound_cidrs" instead. If this and "token_bound_cidrs" are both specified, only "token_bound_cidrs" will be used. */
+export type UserpassWriteUserRequestBoundCidrsList = Array<string>;
+export const UserpassWriteUserRequestBoundCidrsList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<UserpassWriteUserRequestBoundCidrsList>;
+
+/** Use "token_policies" instead. If this and "token_policies" are both specified, only "token_policies" will be used. */
+export type UserpassWriteUserRequestPoliciesList = Array<string>;
+export const UserpassWriteUserRequestPoliciesList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<UserpassWriteUserRequestPoliciesList>;
+
+/** Comma separated string or JSON list of CIDR blocks. If set, specifies the blocks of IP addresses which are allowed to use the generated token. */
+export type UserpassWriteUserRequestTokenBoundCidrsList = Array<string>;
+export const UserpassWriteUserRequestTokenBoundCidrsList =
+  /*@__PURE__*/ S.Array(
+    S.String,
+  ) as any as S.Schema<UserpassWriteUserRequestTokenBoundCidrsList>;
+
+/** Comma-separated list of policies */
+export type UserpassWriteUserRequestTokenPoliciesList = Array<string>;
+export const UserpassWriteUserRequestTokenPoliciesList = /*@__PURE__*/ S.Array(
+  S.String,
+) as any as S.Schema<UserpassWriteUserRequestTokenPoliciesList>;
+
+export interface UserpassWriteUserRequest {
+  /** Path that the backend was mounted at */
+  userpass_mount_path: string;
+  /** Username for this user. */
+  username: string;
+  /** Use "token_bound_cidrs" instead. If this and "token_bound_cidrs" are both specified, only "token_bound_cidrs" will be used. */
+  bound_cidrs?: UserpassWriteUserRequestBoundCidrsList;
+  /** Use "token_max_ttl" instead. If this and "token_max_ttl" are both specified, only "token_max_ttl" will be used. */
+  max_ttl?: number;
+  /** Password for this user. */
+  password?: string;
+  /** Pre-hashed bcrypt password for this user. Mutually exclusive with password. */
+  password_hash?: string;
+  /** Use "token_policies" instead. If this and "token_policies" are both specified, only "token_policies" will be used. */
+  policies?: UserpassWriteUserRequestPoliciesList;
+  /** Comma separated string or JSON list of CIDR blocks. If set, specifies the blocks of IP addresses which are allowed to use the generated token. */
+  token_bound_cidrs?: UserpassWriteUserRequestTokenBoundCidrsList;
+  /** If set, tokens created via this role carry an explicit maximum TTL. During renewal, the current maximum TTL values of the role and the mount are not checked for changes, and any updates to these values will have no effect on the token being renewed. */
+  token_explicit_max_ttl?: number;
+  /** The maximum lifetime of the generated token */
+  token_max_ttl?: number;
+  /** If true, the 'default' policy will not automatically be added to generated tokens */
+  token_no_default_policy?: boolean;
+  /** The maximum number of times a token may be used, a value of zero means unlimited */
+  token_num_uses?: number;
+  /** If set, tokens created via this role will have no max lifetime; instead, their renewal period will be fixed to this value. This takes an integer number of seconds, or a string duration (e.g. "24h"). */
+  token_period?: number;
+  /** Comma-separated list of policies */
+  token_policies?: UserpassWriteUserRequestTokenPoliciesList;
+  /** If true, CIDRs for the token will be strictly bound to the source IP address of the login request */
+  token_strictly_bind_ip?: boolean;
+  /** The initial ttl of the token to generate */
+  token_ttl?: number;
+  /** The type of token to generate, service or batch */
+  token_type?: string;
+  /** Use "token_ttl" instead. If this and "token_ttl" are both specified, only "token_ttl" will be used. */
+  ttl?: number;
+}
+export const UserpassWriteUserRequest = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({
+    userpass_mount_path: S.String.pipe(T.Label()),
+    username: S.String.pipe(T.Label()),
+    bound_cidrs: S.optional(UserpassWriteUserRequestBoundCidrsList),
+    max_ttl: S.optional(S.Number),
+    password: S.optional(S.String),
+    password_hash: S.optional(S.String),
+    policies: S.optional(UserpassWriteUserRequestPoliciesList),
+    token_bound_cidrs: S.optional(UserpassWriteUserRequestTokenBoundCidrsList),
+    token_explicit_max_ttl: S.optional(S.Number),
+    token_max_ttl: S.optional(S.Number),
+    token_no_default_policy: S.optional(S.Boolean),
+    token_num_uses: S.optional(S.Number),
+    token_period: S.optional(S.Number),
+    token_policies: S.optional(UserpassWriteUserRequestTokenPoliciesList),
+    token_strictly_bind_ip: S.optional(S.Boolean),
+    token_ttl: S.optional(S.Number),
+    token_type: S.optional(S.String),
+    ttl: S.optional(S.Number),
+  }).pipe(
+    T.Http({
+      method: "POST",
+      uri: "/auth/{userpass_mount_path}/users/{username}",
+      code: 200,
+    }),
+  ),
+).annotate({
+  identifier: "UserpassWriteUserRequest",
+}) as any as S.Schema<UserpassWriteUserRequest>;
+
+export interface UserpassWriteUserResponse {}
+export const UserpassWriteUserResponse = /*@__PURE__*/ S.suspend(() =>
+  S.Struct({}),
+).annotate({
+  identifier: "UserpassWriteUserResponse",
+}) as any as S.Schema<UserpassWriteUserResponse>;
+
+export type LoginUserpassError = OpenBaoOpError;
+export const loginUserpass: API.OperationMethod<
+  LoginUserpassRequest,
+  LoginUserpassResponse,
+  LoginUserpassError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: LoginUserpassRequest,
+  output: LoginUserpassResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type UserpassDeleteUserError = OpenBaoOpError;
+export const userpassDeleteUser: API.OperationMethod<
+  UserpassDeleteUserRequest,
+  UserpassDeleteUserResponse,
+  UserpassDeleteUserError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: UserpassDeleteUserRequest,
+  output: UserpassDeleteUserResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type UserpassListUsersError = OpenBaoOpError;
+export const userpassListUsers: API.OperationMethod<
+  UserpassListUsersRequest,
+  UserpassListUsersResponse,
+  UserpassListUsersError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: UserpassListUsersRequest,
+  output: UserpassListUsersResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type UserpassReadUserError = OpenBaoOpError;
+export const userpassReadUser: API.OperationMethod<
+  UserpassReadUserRequest,
+  UserpassReadUserResponse,
+  UserpassReadUserError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: UserpassReadUserRequest,
+  output: UserpassReadUserResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type UserpassResetPasswordError = OpenBaoOpError;
+export const userpassResetPassword: API.OperationMethod<
+  UserpassResetPasswordRequest,
+  UserpassResetPasswordResponse,
+  UserpassResetPasswordError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: UserpassResetPasswordRequest,
+  output: UserpassResetPasswordResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type UserpassUpdatePoliciesError = OpenBaoOpError;
+export const userpassUpdatePolicies: API.OperationMethod<
+  UserpassUpdatePoliciesRequest,
+  UserpassUpdatePoliciesResponse,
+  UserpassUpdatePoliciesError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: UserpassUpdatePoliciesRequest,
+  output: UserpassUpdatePoliciesResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));
+
+export type UserpassWriteUserError = OpenBaoOpError;
+export const userpassWriteUser: API.OperationMethod<
+  UserpassWriteUserRequest,
+  UserpassWriteUserResponse,
+  UserpassWriteUserError,
+  OpenBaoOpContext
+> = /*@__PURE__*/ API.make(() => ({
+  input: UserpassWriteUserRequest,
+  output: UserpassWriteUserResponse,
+  errors: [],
+  protocol: OpenBaoProtocol,
+  retry: Retry.Retry,
+}));